circle-ir 3.128.0 → 3.131.0

package/dist/analysis/passes/language-sources-pass.js

@@ -206,6 +206,15 @@ export class LanguageSourcesPass {
         if (language === 'go') {
             additionalSanitizers.push(...findGoMapAllowlistGuardSanitizers(code));
             additionalSanitizers.push(...findGoHtmlTemplateImportSanitizers(code));
+            // Sprint 78 (#190): Go ECB-mode weak-crypto detection.
+            const goMisconfigFindings = findGoPatternFindings(code, graph.ir.meta.file);
+            for (const finding of goMisconfigFindings) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 81 (#189): Go xss — fmt.Fprint(f|ln) to http.ResponseWriter.
+            for (const finding of findGoXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Python: safe-handler sanitizer detectors (cognium-dev #114 Sprint 31) --
         if (language === 'python') {
@@ -227,6 +236,14 @@ export class LanguageSourcesPass {
             for (const finding of pyMisconfigFindings) {
                 ctx.addFinding(finding);
             }
+            // Sprint 81 (#189): Python xss — Flask string-concat / f-string returns
+            // and Jinja Markup wrap bypass.
+            for (const finding of findPythonFlaskStringConcatXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            for (const finding of findPythonJinjaMarkupXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Rust: safe-handler sanitizer detectors (cognium-dev #115 Sprint 31) --
         if (language === 'rust') {
@@ -241,6 +258,21 @@ export class LanguageSourcesPass {
             for (const finding of rustMisconfigFindings) {
                 ctx.addFinding(finding);
             }
+            // Sprint 78 (#190): additional Rust misconfig pattern detectors —
+            // hardcoded-credential, insecure-cookie (builder chain),
+            // jwt-verify-disabled, weak-crypto (raw ECB block ops).
+            for (const finding of findRustHardcodedCredentialFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            for (const finding of findRustInsecureCookieFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            for (const finding of findRustJwtVerifyDisabledFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            for (const finding of findRustWeakCryptoEcbFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- JavaScript/TypeScript: Sprint 73 (#216 Pattern A + B) — ETE
         // sanitizer-chain recognition (JSON.parse / bcrypt.hash / csv
@@ -252,6 +284,22 @@ export class LanguageSourcesPass {
             additionalSanitizers.push(...findJsWrapperFunctionSanitizers(code));
             // Sprint 75 (#216 Pattern D): JS SSRF allow-list guard (var-aware).
             additionalSanitizers.push(...findJsSsrfAllowlistGuardSanitizers(code));
+            // Sprint 77b (#216 Pattern X): JS/TS argv-form execFile/spawn and
+            // parameterized SQL placeholder sanitizers.
+            additionalSanitizers.push(...findJsArgvFormExecSanitizers(code));
+            additionalSanitizers.push(...findJsParameterizedSqlSanitizers(code));
+            // Sprint 78 (#190): JS misconfig pattern findings — libxmljs noent:true.
+            for (const finding of findJsPatternFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 81 (#189): JS/TS xss — Vue v-html directive tied to tainted
+            // template binding, and Angular DomSanitizer.bypassSecurityTrust*.
+            for (const finding of findJsVueVHtmlXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            for (const finding of findTsAngularBypassXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Java: Sprint 73 (#216 Pattern A) — Jackson readValue / Gson
         // fromJson recognized as ETE terminator (does not affect
@@ -263,6 +311,18 @@ export class LanguageSourcesPass {
             additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
             // Sprint 77a (#216 Pattern X): argv-form exec sanitizer.
             additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
+            // Sprint 78 (#190): Java misconfig pattern findings —
+            // jwt-verify-disabled (auth0 JWT.decode bare) +
+            // tls-verify-disabled (empty-body X509TrustManager).
+            for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 81 (#189): Java xss — HttpServletResponse.getWriter().{print,
+            // println,write} receiver-chain that the configured PrintWriter sink
+            // doesn't resolve.
+            for (const finding of findJavaResponseWriterXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // Sprint 70 (#151): cross-language env-secret → external-network exfiltration.
         // Pattern findings only — no taint flow required (composed-flow shape that
@@ -2939,6 +2999,121 @@ function findJsSsrfAllowlistGuardSanitizers(code) {
     }
     return sanitizers;
 }
+/**
+ * JS/TS: argv-form `execFile`/`spawn`/`execFileSync`/`spawnSync` with
+ * a string-literal program and an array literal argv (cognium-dev #216
+ * Sprint 77b Pattern X).
+ *
+ * Pattern recognized:
+ *
+ *   execFile('echo', ['--', arg], () => {});
+ *   spawn('grep', ['--', pattern, '/var/log/app.log']);
+ *   execFileSync('cat', [path]);
+ *
+ * Argv-form exec with a string-literal program splits arguments into
+ * the argv slot with no shell interpretation, so a tainted argv element
+ * cannot smuggle shell metacharacters into a separate command.
+ *
+ * The shell-via-argv form `execFile('sh', ['-c', tainted])` is excluded
+ * since `-c` re-enables shell parsing of the subsequent argv slot. A
+ * tainted-program slot `execFile(prog, [arg])` is NOT matched (TP-2
+ * control), nor is the single-string `exec("cmd " + arg)` form (TP-1
+ * control — `exec` itself spawns a shell regardless).
+ *
+ * Emits a `command_injection` + `external_taint_escape` sanitizer at
+ * that line.
+ */
+function findJsArgvFormExecSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // execFile/spawn (+Sync) with a string-literal program and array argv.
+    // Quoted program slot, then comma, then `[`.
+    const argvExecRe = /\b(?:execFile|spawn)(?:Sync)?\s*\(\s*(?:'[^']*'|"[^"]*"|`[^`]*`)\s*,\s*\[/;
+    // Shell-via-argv exclusion: program is sh/bash/etc. (possibly with a
+    // leading path like /bin/ or /usr/bin/) AND first argv is "-c".
+    const shellArgvRe = /\b(?:execFile|spawn)(?:Sync)?\s*\(\s*['"`](?:[\w./-]*\/)?(?:sh|bash|zsh|ksh|dash|cmd(?:\.exe)?|powershell|pwsh)['"`]\s*,\s*\[\s*['"`]-c['"`]/;
+    for (let i = 0; i < lines.length; i++) {
+        const text = lines[i];
+        if (!argvExecRe.test(text))
+            continue;
+        if (shellArgvRe.test(text))
+            continue;
+        sanitizers.push({
+            type: 'js_argv_form_exec',
+            method: 'execFile',
+            line: i + 1,
+            sanitizes: ['command_injection', 'external_taint_escape'],
+        });
+    }
+    return sanitizers;
+}
+/**
+ * JS/TS: parameterized SQL query sanitizer (cognium-dev #216 Sprint 77b
+ * Pattern X).
+ *
+ * Pattern recognized:
+ *
+ *   await pool.query('SELECT * FROM users WHERE name = $1', [name]);
+ *   await conn.execute('SELECT * FROM users WHERE id = ?', [id]);
+ *   await client.query(`UPDATE u SET name = $1 WHERE id = $2`, [name, id]);
+ *
+ * The query string is a STRING-LITERAL (`'...'` / `"..."` / `` `...` ``
+ * with no `${}` interpolation) that contains positional placeholders
+ * (`$1`-style PostgreSQL or `?` MySQL/SQLite), AND a second argument
+ * that begins with `[` (array literal of bound parameters). The driver
+ * binds those parameters at the protocol layer rather than splicing
+ * them into the SQL text, so the tainted values cannot become SQL.
+ *
+ * The concat form `pool.query("SELECT * FROM u WHERE n = '" + name + "'")`
+ * and the interpolated template literal
+ * `` pool.query(`SELECT * FROM u WHERE n = '${name}'`) `` are NOT
+ * matched and continue to fire `sql_injection` (TP-1 / TP-2 controls).
+ *
+ * Emits a `sql_injection` + `external_taint_escape` sanitizer at that
+ * line.
+ */
+function findJsParameterizedSqlSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // `.query(...)` / `.execute(...)` with a non-interpolating string
+    // literal containing $N or ? placeholders, followed by `, [`.
+    // Single quotes:
+    const singleRe = /\.\s*(?:query|execute)\s*\(\s*'([^'\\]*(?:\\.[^'\\]*)*)'\s*,\s*\[/;
+    // Double quotes:
+    const doubleRe = /\.\s*(?:query|execute)\s*\(\s*"([^"\\]*(?:\\.[^"\\]*)*)"\s*,\s*\[/;
+    // Backticks WITHOUT `${...}` interpolation:
+    const tickRe = /\.\s*(?:query|execute)\s*\(\s*`([^`]*)`\s*,\s*\[/;
+    const placeholderRe = /(?:\$\d+|\?)/;
+    for (let i = 0; i < lines.length; i++) {
+        const text = lines[i];
+        let sql = null;
+        const s = singleRe.exec(text);
+        if (s)
+            sql = s[1];
+        if (sql == null) {
+            const d = doubleRe.exec(text);
+            if (d)
+                sql = d[1];
+        }
+        if (sql == null) {
+            const t = tickRe.exec(text);
+            // Reject template literals that interpolate values.
+            if (t && !/\$\{/.test(t[1]))
+                sql = t[1];
+        }
+        if (sql == null)
+            continue;
+        if (!placeholderRe.test(sql))
+            continue;
+        sanitizers.push({
+            type: 'js_parameterized_sql',
+            method: 'query',
+            line: i + 1,
+            sanitizes: ['sql_injection', 'external_taint_escape'],
+        });
+    }
+    return sanitizers;
+}
 /**
  * Java: Path.resolve(...).normalize() + startsWith(ROOT) guard
  * sanitizer (cognium-dev #216 Sprint 76 Pattern B).
@@ -3710,4 +3885,846 @@ export function findRustPatternFindings(code, file) {
     }
     return out;
 }
+// ---------------------------------------------------------------------------
+// Sprint 78 (#190) — Tier-2 misconfig pattern extensions for Rust, Java, Go,
+// and JS that the dedicated misconfig passes don't yet recognize.
+// ---------------------------------------------------------------------------
+/**
+ * Rust `hardcoded-credential` (CWE-798). Pattern:
+ *   `(pub|const|static) <NAME>: &str = "literal";` where NAME matches
+ *   /api[_]?key|secret|token|password|passwd|pwd|auth/i and the literal is
+ *   non-trivial (length > 8 and not a placeholder).
+ */
+export function findRustHardcodedCredentialFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const re = /\b(?:pub\s+)?(?:const|static)\s+([A-Z][A-Z0-9_]*)\s*:\s*&\s*'?[a-z_]*\s*str\s*=\s*"([^"]+)"/;
+    const nameRe = /(?:^|_)(?:API[_]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|AUTH)(?:_|$)/i;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        const m = trimmed.match(re);
+        if (!m)
+            continue;
+        const name = m[1];
+        const value = m[2];
+        if (!nameRe.test(name))
+            continue;
+        if (value.length < 8)
+            continue;
+        if (/^(?:xxx|todo|fixme|placeholder|changeme)/i.test(value))
+            continue;
+        out.push({
+            id: `hardcoded-credential-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'hardcoded-credential',
+            cwe: 'CWE-798',
+            severity: 'high',
+            level: 'error',
+            message: `Hardcoded credential: const ${name} contains a literal secret value`,
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Rust `insecure-cookie` (CWE-1004 / CWE-614). Pattern:
+ *   `Cookie::build(...)` chain that explicitly calls `.secure(false)` or
+ *   `.http_only(false)` (or both). The dedicated `insecure-cookie-pass.ts`
+ *   handles the `format!("Set-Cookie: ...")` shape but not the actix-web
+ *   builder chain.
+ */
+export function findRustInsecureCookieFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const builderRe = /\bCookie\s*::\s*build\s*\(/;
+    const insecureFlagRe = /\.\s*(?:secure|http_only)\s*\(\s*false\s*\)/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        if (!builderRe.test(trimmed))
+            continue;
+        if (!insecureFlagRe.test(trimmed))
+            continue;
+        out.push({
+            id: `insecure-cookie-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'insecure-cookie',
+            cwe: 'CWE-1004',
+            severity: 'medium',
+            level: 'warning',
+            message: 'Insecure cookie: Cookie::build chain disables Secure / HttpOnly flag(s)',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Rust `jwt-verify-disabled` (CWE-347). Pattern:
+ *   `.insecure_disable_signature_validation()` method call on a
+ *   jsonwebtoken `Validation` value. Any presence of this method
+ *   disables the signature check.
+ */
+export function findRustJwtVerifyDisabledFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const re = /\.\s*insecure_disable_signature_validation\s*\(/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        if (!re.test(trimmed))
+            continue;
+        out.push({
+            id: `jwt-verify-disabled-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'jwt-verify-disabled',
+            cwe: 'CWE-347',
+            severity: 'critical',
+            level: 'error',
+            message: 'JWT signature verification disabled: ' +
+                'Validation::insecure_disable_signature_validation() forfeits signature enforcement',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Rust `weak-crypto` (CWE-327). Pattern (raw ECB via `aes` crate):
+ *   any line that calls `.encrypt_block(` or `.decrypt_block(` on a
+ *   block-cipher receiver constructed via `Aes128::new` / `Aes192::new` /
+ *   `Aes256::new` / `Aes128Ecb` / `Aes256Ecb`. We collect the cipher
+ *   constructor lines in a first pass (variable name → seen) and emit
+ *   on every `.encrypt_block(` / `.decrypt_block(` line in the same file.
+ *
+ *   The wrapped CBC/GCM/CTR forms go through `Cbc::<Aes128, ...>::new`
+ *   or `Aes128Gcm::new` — those do NOT call `.encrypt_block` directly
+ *   and so are not matched.
+ */
+export function findRustWeakCryptoEcbFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const ctorRe = /\bAes(?:128|192|256)(?:Ecb)?\s*::\s*new\s*\(/;
+    const blockOpRe = /\.\s*(encrypt_block|decrypt_block)\s*\(/;
+    // First: confirm the file uses raw block-cipher construction (Aes*::new)
+    // — without that, a stray `.encrypt_block(` on some other type isn't
+    // necessarily ECB.
+    let sawCtor = false;
+    for (const line of lines) {
+        if (ctorRe.test(line)) {
+            sawCtor = true;
+            break;
+        }
+    }
+    if (!sawCtor)
+        return out;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        if (!blockOpRe.test(trimmed))
+            continue;
+        out.push({
+            id: `weak-crypto-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'weak-crypto',
+            cwe: 'CWE-327',
+            severity: 'high',
+            level: 'error',
+            message: 'Weak crypto (ECB mode): raw Aes::encrypt_block/decrypt_block ' +
+                'leaks repeating-block patterns. Use AES-GCM, AES-CTR, or ' +
+                'AES-CBC with an HMAC.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Java pattern findings — Sprint 78 (#190):
+ *   - `jwt-verify-disabled` (CWE-347): bare `JWT.decode(<token>)` on the
+ *     auth0 `com.auth0.jwt.JWT` class. `decode` is documented as
+ *     "decode the token without performing any verification"; only
+ *     `JWT.require(...).build().verify(token)` enforces the signature.
+ *   - `tls-verify-disabled` (CWE-295): anonymous `X509TrustManager`
+ *     implementation whose `checkServerTrusted` body is empty
+ *     (returns void without raising). This trust-nothing implementation
+ *     accepts every certificate.
+ */
+export function findJavaPatternFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    // jwt-verify-disabled: `JWT.decode(<expr>)`. Anchored to the `JWT.`
+    // receiver to avoid matching unrelated `decode(` calls on Base64,
+    // URLDecoder, etc. Guarded against the safer `JWT.require(...).build()
+    // .verify(...)` chain by requiring `decode` to appear without
+    // `.verify(` later on the same line.
+    const jwtDecodeRe = /\bJWT\s*\.\s*decode\s*\(/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        if (!jwtDecodeRe.test(trimmed))
+            continue;
+        if (/\.\s*verify\s*\(/.test(trimmed))
+            continue;
+        out.push({
+            id: `jwt-verify-disabled-${file}-${i + 1}-decode`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'jwt-verify-disabled',
+            cwe: 'CWE-347',
+            severity: 'critical',
+            level: 'error',
+            message: 'JWT signature not verified: auth0 `JWT.decode(token)` parses ' +
+                'without checking the signature. Use `JWT.require(<algorithm>)' +
+                '.build().verify(token)` to enforce verification.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    // tls-verify-disabled: anonymous X509TrustManager with empty
+    // checkServerTrusted body. Two-pass: locate the anonymous-class start
+    // line (`new X509TrustManager() {`), then scan ahead for the
+    // `checkServerTrusted(...)` method signature whose `{...}` body is
+    // empty (no `throw`, no `if`).
+    const anonStartRe = /\bnew\s+X509TrustManager\s*\(\s*\)\s*\{/;
+    const checkServerSig = /\bcheckServerTrusted\s*\([^)]*\)\s*(?:throws\s+[^\{]*)?\{\s*\}/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        if (!anonStartRe.test(raw))
+            continue;
+        // Scan up to 15 lines ahead for the empty-body checkServerTrusted.
+        const end = Math.min(lines.length, i + 16);
+        let foundAt = -1;
+        for (let j = i; j < end; j++) {
+            if (checkServerSig.test(lines[j])) {
+                foundAt = j;
+                break;
+            }
+        }
+        if (foundAt < 0)
+            continue;
+        out.push({
+            id: `tls-verify-disabled-${file}-${foundAt + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'tls-verify-disabled',
+            cwe: 'CWE-295',
+            severity: 'high',
+            level: 'error',
+            message: 'TLS certificate verification disabled: anonymous X509TrustManager ' +
+                'with empty checkServerTrusted body accepts every certificate.',
+            file,
+            line: foundAt + 1,
+            snippet: lines[foundAt].trim().substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Go pattern findings — Sprint 78 (#190):
+ *   - `weak-crypto` (CWE-327): raw ECB usage via `aes.NewCipher(...)`
+ *     followed by a direct `<cipher>.Encrypt(` / `.Decrypt(` call on the
+ *     constructed value (no `cipher.NewCBCEncrypter` / `NewGCM` / `NewCTR`
+ *     wrapper). The Go stdlib `aes.Cipher` exposes `Encrypt` / `Decrypt`
+ *     that operate on a single 16-byte block — calling these directly is
+ *     ECB mode.
+ *
+ *   Algorithm:
+ *     1. Collect every `<v>, _ := aes.NewCipher(...)` cipher variable.
+ *     2. If the file contains a `cipher.NewGCM(<v>)` / `cipher.NewCBC*(<v>)`
+ *        / `cipher.NewCTR(<v>)` wrapping line for that variable, skip it
+ *        (wrapped mode is not ECB).
+ *     3. Otherwise emit on every `<v>.Encrypt(` / `<v>.Decrypt(` line.
+ */
+export function findGoPatternFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const cipherVars = new Set();
+    const ctorRe = /\b([a-zA-Z_]\w*)\s*(?:,\s*[a-zA-Z_]\w*)?\s*:?=\s*aes\.NewCipher\s*\(/;
+    for (const line of lines) {
+        const m = line.match(ctorRe);
+        if (m)
+            cipherVars.add(m[1]);
+    }
+    if (cipherVars.size === 0)
+        return out;
+    // Drop wrapped ciphers (CBC/GCM/CTR/OFB/CFB) — those are not ECB.
+    for (const v of Array.from(cipherVars)) {
+        const wrapRe = new RegExp(`\\bcipher\\.New(?:GCM|CBCEncrypter|CBCDecrypter|CTR|OFB|CFBEncrypter|CFBDecrypter)\\s*\\(\\s*${v}\\b`);
+        for (const line of lines) {
+            if (wrapRe.test(line)) {
+                cipherVars.delete(v);
+                break;
+            }
+        }
+    }
+    if (cipherVars.size === 0)
+        return out;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        for (const v of cipherVars) {
+            const opRe = new RegExp(`\\b${v}\\s*\\.\\s*(?:Encrypt|Decrypt)\\s*\\(`);
+            if (!opRe.test(trimmed))
+                continue;
+            out.push({
+                id: `weak-crypto-${file}-${i + 1}`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'weak-crypto',
+                cwe: 'CWE-327',
+                severity: 'high',
+                level: 'error',
+                message: 'Weak crypto (ECB mode): raw aes.Cipher.Encrypt/Decrypt on a ' +
+                    'block leaks repeating-block patterns. Wrap with cipher.NewGCM, ' +
+                    'cipher.NewCTR, or cipher.NewCBCEncrypter + HMAC.',
+                file,
+                line: i + 1,
+                snippet: trimmed.substring(0, 100),
+            });
+            break;
+        }
+    }
+    return out;
+}
+/**
+ * JS pattern findings — Sprint 78 (#190):
+ *   - `xml-entity-expansion` (CWE-611 / CWE-776): libxmljs `parseXml`
+ *     (and `parseXmlString`) called with `{ noent: true }` resolves
+ *     external entities, enabling XXE / billion-laughs. The default is
+ *     `noent: false`; only the explicit-true form is unsafe.
+ */
+export function findJsPatternFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const parseRe = /\blibxml(?:js)?\s*\.\s*parseXml(?:String)?\s*\(/;
+    const noentTrueRe = /\bnoent\s*:\s*true\b/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        if (!parseRe.test(trimmed))
+            continue;
+        if (!noentTrueRe.test(trimmed))
+            continue;
+        out.push({
+            id: `xml-entity-expansion-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'xml-entity-expansion',
+            cwe: 'CWE-611',
+            severity: 'high',
+            level: 'error',
+            message: 'XML external entity resolution enabled: libxmljs parseXml ' +
+                'called with `noent: true` resolves external entities (XXE / ' +
+                'billion-laughs). Omit the flag or set `noent: false`.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Sprint 81 (#189) — xss-cluster FN coverage. Six per-language pattern
+// detectors that emit SastFinding{rule_id:'xss'} directly, bypassing the
+// source→sink→flow construction where the engine can't yet build a flow
+// (e.g. Python string-concat / f-string, Java receiver-chain typing).
+// ---------------------------------------------------------------------------
+/**
+ * Go xss — `fmt.Fprint(f|ln)?(w, ...)` writing tainted data directly to an
+ * `http.ResponseWriter`. Two-pass:
+ *
+ *   1. Discover ResponseWriter parameter names by scanning function
+ *      signatures `(<name> http.ResponseWriter, ...)`.
+ *   2. For every `fmt.Fprint(f|ln)?(<name>, <format>, <args...>)` whose
+ *      first argument matches a discovered name, emit xss UNLESS one of
+ *      the args is wrapped in a recognized HTML escaper
+ *      (`html.EscapeString` / `template.HTMLEscapeString` /
+ *      `template.HTMLEscaper`).
+ */
+export function findGoXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const rwNames = new Set();
+    const sigRe = /\(\s*([A-Za-z_]\w*)\s+http\.ResponseWriter\b/g;
+    for (const line of lines) {
+        let m;
+        sigRe.lastIndex = 0;
+        while ((m = sigRe.exec(line)) !== null)
+            rwNames.add(m[1]);
+    }
+    if (rwNames.size === 0)
+        return out;
+    const escaperRe = /\b(?:html|template)\.(?:EscapeString|HTMLEscapeString|HTMLEscaper|JSEscapeString|URLQueryEscaper)\s*\(/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        const callRe = /\bfmt\.Fprint(?:f|ln)?\s*\(\s*([A-Za-z_]\w*)\s*,\s*([\s\S]*)\)\s*(?:\/\/.*)?$/;
+        const m = trimmed.match(callRe);
+        if (!m)
+            continue;
+        if (!rwNames.has(m[1]))
+            continue;
+        const tail = m[2];
+        if (escaperRe.test(tail))
+            continue;
+        // Require at least one identifier in tail outside string literals.
+        if (!/[A-Za-z_]\w*/.test(tail.replace(/"[^"]*"|`[^`]*`/g, '')))
+            continue;
+        out.push({
+            id: `xss-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'xss',
+            cwe: 'CWE-79',
+            severity: 'high',
+            level: 'error',
+            message: 'Reflected XSS: fmt.Fprint writes data to http.ResponseWriter ' +
+                'without HTML escaping. Wrap user-controlled args with ' +
+                'html.EscapeString / template.HTMLEscapeString.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Java xss — `<recv>.getWriter().{print,println,write,printf,format,append}
+ * (<arg>)` chained call where `<recv>` is typed `HttpServletResponse`.
+ * The receiver-chain form bypasses the configured `PrintWriter.print`
+ * sink because the engine doesn't yet trace `HttpServletResponse
+ * .getWriter()` → `PrintWriter` type resolution.
+ *
+ * Conservative: only fires when the receiver token matches a parameter
+ * named with the `HttpServletResponse` type AND no recognized HTML
+ * encoder wraps the argument.
+ */
+export function findJavaResponseWriterXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const respNames = new Set();
+    const sigRe = /\bHttpServletResponse\s+([A-Za-z_]\w*)\b/g;
+    for (const line of lines) {
+        let m;
+        sigRe.lastIndex = 0;
+        while ((m = sigRe.exec(line)) !== null)
+            respNames.add(m[1]);
+    }
+    if (respNames.size === 0)
+        return out;
+    const safeWrapRe = /\b(?:Encode\.(?:forHtml|forHtmlAttribute|forHtmlContent|forJavaScript)|StringEscapeUtils\.escape(?:Html3|Html4|EcmaScript|Xml)|HtmlUtils\.htmlEscape(?:Decimal|Hex)?|Escaper\.escapeHtml|HtmlEscapers\.(?:escapeHtml|htmlEscaper)|Encoder\.encodeForHTML(?:Attribute)?|Jsoup\.clean)\s*\(/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        const chainRe = /\b([A-Za-z_]\w*)\s*\.\s*getWriter\s*\(\s*\)\s*\.\s*(print|println|write|printf|format|append)\s*\(([\s\S]*)\)\s*;?\s*(?:\/\/.*)?$/;
+        const m = trimmed.match(chainRe);
+        if (!m)
+            continue;
+        const recv = m[1];
+        if (!respNames.has(recv))
+            continue;
+        const args = m[3];
+        if (safeWrapRe.test(args))
+            continue;
+        // Skip when args is a pure string-literal call like `print("hello")`.
+        // Anything else (`+`-concat, bare identifier, method call) is a write
+        // of dynamic content that should have gone through an HTML encoder.
+        const argsTrim = args.trim();
+        if (/^"(?:\\.|[^"\\])*"$/.test(argsTrim))
+            continue;
+        if (!/[A-Za-z_]\w*/.test(argsTrim))
+            continue;
+        out.push({
+            id: `xss-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'xss',
+            cwe: 'CWE-79',
+            severity: 'high',
+            level: 'error',
+            message: 'Reflected XSS: HttpServletResponse.getWriter().' +
+                m[2] +
+                '(...) writes data to the response without HTML escaping. ' +
+                'Wrap user-controlled values with OWASP Encode.forHtml / ' +
+                'StringEscapeUtils.escapeHtml4 / Jsoup.clean.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Vue xss — `template: '<...v-html="<var>"...>'` directive binding to a
+ * variable that is sourced from a tainted location (URLSearchParams,
+ * location.search/hash, route.query/params, fetch, etc.).
+ *
+ * Conservative: when the bound variable is a literal initializer
+ * (`<var>: 'static'`) or sourced from a non-recognized location, no
+ * finding is emitted.
+ */
+export function findJsVueVHtmlXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const sourceRe = /\b(?:URLSearchParams|location\s*\.\s*(?:search|hash|href|pathname)|window\s*\.\s*location|route\s*\.\s*(?:query|params)|router\s*\.\s*(?:currentRoute|query)|\$route\s*\.\s*(?:query|params)|fetch\s*\(|axios\s*\.\s*(?:get|post)|XMLHttpRequest|document\s*\.\s*location)\b/;
+    const tplRe = /\btemplate\s*:\s*(['"`])([\s\S]*?)\1/g;
+    let tm;
+    const boundVars = new Set();
+    while ((tm = tplRe.exec(code)) !== null) {
+        const tpl = tm[2];
+        const vhRe = /\bv-html\s*=\s*"([^"]+)"/g;
+        let vm;
+        while ((vm = vhRe.exec(tpl)) !== null) {
+            const expr = vm[1].trim();
+            const idMatch = expr.match(/^([A-Za-z_$][\w$]*)/);
+            if (idMatch)
+                boundVars.add(idMatch[1]);
+        }
+    }
+    if (boundVars.size === 0)
+        return out;
+    // Build a set of variables transitively tainted by a recognized source
+    // pattern: `const params = new URLSearchParams(...)` taints `params`,
+    // then `const q = params.get('q')` taints `q` (one-hop).
+    const taintedSet = new Set();
+    const assignRe = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+    let am;
+    // First pass: direct source-pattern assignments.
+    assignRe.lastIndex = 0;
+    while ((am = assignRe.exec(code)) !== null) {
+        if (sourceRe.test(am[2]))
+            taintedSet.add(am[1]);
+    }
+    // Second pass: one-hop through tainted vars (limit 3 iterations).
+    for (let pass = 0; pass < 3; pass++) {
+        assignRe.lastIndex = 0;
+        const before = taintedSet.size;
+        while ((am = assignRe.exec(code)) !== null) {
+            if (taintedSet.has(am[1]))
+                continue;
+            for (const tv of taintedSet) {
+                if (new RegExp(`\\b${tv}\\b`).test(am[2])) {
+                    taintedSet.add(am[1]);
+                    break;
+                }
+            }
+        }
+        if (taintedSet.size === before)
+            break;
+    }
+    const taintedBindings = new Set();
+    for (const v of boundVars) {
+        const bindRe = new RegExp(`\\b${v}\\s*[:=]\\s*([^,;\\n]+)`);
+        for (const line of lines) {
+            const m = line.match(bindRe);
+            if (!m)
+                continue;
+            const val = m[1];
+            if (sourceRe.test(val)) {
+                taintedBindings.add(v);
+                break;
+            }
+            let found = false;
+            for (const tv of taintedSet) {
+                if (new RegExp(`\\b${tv}\\b`).test(val)) {
+                    taintedBindings.add(v);
+                    found = true;
+                    break;
+                }
+            }
+            if (found)
+                break;
+        }
+        const propsRe = new RegExp(`\\bprops\\s*:\\s*\\[[^\\]]*['"\`]${v}['"\`][^\\]]*\\]`);
+        if (propsRe.test(code))
+            taintedBindings.add(v);
+    }
+    if (taintedBindings.size === 0)
+        return out;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        if (!/v-html\s*=/.test(raw))
+            continue;
+        const vm = raw.match(/v-html\s*=\s*"([^"]+)"/);
+        if (!vm)
+            continue;
+        const idMatch = vm[1].trim().match(/^([A-Za-z_$][\w$]*)/);
+        if (!idMatch || !taintedBindings.has(idMatch[1]))
+            continue;
+        out.push({
+            id: `xss-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'xss',
+            cwe: 'CWE-79',
+            severity: 'high',
+            level: 'error',
+            message: 'Vue v-html XSS: directive binds to "' +
+                idMatch[1] +
+                '" which is sourced from user-controlled input. Use {{ }} ' +
+                'interpolation (auto-escapes) or sanitize the HTML with ' +
+                'DOMPurify before binding.',
+            file,
+            line: i + 1,
+            snippet: raw.trim().substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Angular xss — `<recv>.bypassSecurityTrust(Html|Script|Url|ResourceUrl|
+ * Style)(<arg>)` where `<recv>` is typed `DomSanitizer`. Skip when
+ * `<arg>` is a string literal (intentional safe-by-author escape hatch).
+ */
+export function findTsAngularBypassXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const sanitizerNames = new Set();
+    const declRe = /\b(?:public|private|protected|readonly|\s)?\s*([A-Za-z_$][\w$]*)\s*:\s*DomSanitizer\b/g;
+    let m;
+    declRe.lastIndex = 0;
+    while ((m = declRe.exec(code)) !== null)
+        sanitizerNames.add(m[1]);
+    if (sanitizerNames.size === 0)
+        return out;
+    const assignRe = /\bthis\s*\.\s*([A-Za-z_$][\w$]*)\s*=\s*([A-Za-z_$][\w$]*)\b/g;
+    let am;
+    assignRe.lastIndex = 0;
+    while ((am = assignRe.exec(code)) !== null) {
+        if (sanitizerNames.has(am[2]))
+            sanitizerNames.add(am[1]);
+    }
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        const callRe = /\b(?:this\s*\.\s*)?([A-Za-z_$][\w$]*)\s*\.\s*bypassSecurityTrust(Html|Script|Url|ResourceUrl|Style)\s*\(([\s\S]*?)\)/;
+        const cm = trimmed.match(callRe);
+        if (!cm)
+            continue;
+        const recv = cm[1];
+        if (!sanitizerNames.has(recv))
+            continue;
+        const arg = cm[3].trim();
+        if (/^(['"`])[^'"`]*\1$/.test(arg))
+            continue;
+        out.push({
+            id: `xss-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'xss',
+            cwe: 'CWE-79',
+            severity: 'high',
+            level: 'error',
+            message: 'Angular XSS: DomSanitizer.bypassSecurityTrust' +
+                cm[2] +
+                '() opts out of Angular\'s built-in sanitization for a ' +
+                'non-literal argument. Prefer leaving Angular\'s default ' +
+                'sanitizer in place, or sanitize the input with DOMPurify ' +
+                'before bypassing.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Python Flask xss — route function returning HTML built from a
+ * `request.<args|form|values|files>.get(...)` value via string concat,
+ * f-string, %, or .format(). Bypasses the engine's flow construction
+ * gap for these string ops.
+ *
+ * Conservative: requires a Flask-style route decorator (`@<x>.route(`)
+ * above the function; skip when the variable is escape()-wrapped.
+ */
+export function findPythonFlaskStringConcatXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const fns = [];
+    const defRe = /^(\s*)def\s+([A-Za-z_]\w*)\s*\(/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const dm = raw.match(defRe);
+        if (!dm)
+            continue;
+        const indent = dm[1].length;
+        let hasRoute = false;
+        for (let j = i - 1; j >= 0; j--) {
+            const prev = lines[j].trim();
+            if (prev === '' || prev.startsWith('#'))
+                continue;
+            if (!prev.startsWith('@'))
+                break;
+            if (/@\s*[A-Za-z_]\w*\s*\.\s*route\s*\(/.test(prev) ||
+                /@\s*route\s*\(/.test(prev)) {
+                hasRoute = true;
+            }
+        }
+        if (!hasRoute)
+            continue;
+        let end = lines.length;
+        for (let k = i + 1; k < lines.length; k++) {
+            const ln = lines[k];
+            if (!ln.trim())
+                continue;
+            const ind = ln.match(/^(\s*)/)?.[1].length ?? 0;
+            if (ind <= indent) {
+                end = k;
+                break;
+            }
+        }
+        fns.push({ name: dm[2], startLine: i + 1, endLine: end });
+    }
+    if (fns.length === 0)
+        return out;
+    const requestSourceRe = /\b([A-Za-z_]\w*)\s*=\s*request\s*\.\s*(?:args|form|values|files|json|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/;
+    const escapeWrapRe = /\b(?:html\.escape|markupsafe\.escape|escape|markupsafe\.Markup\s*\.\s*escape|werkzeug\.utils\.escape)\s*\(/;
+    for (const fn of fns) {
+        const taintedVars = new Set();
+        for (let li = fn.startLine; li < fn.endLine; li++) {
+            const raw = lines[li];
+            const rm = raw.match(requestSourceRe);
+            if (rm)
+                taintedVars.add(rm[1]);
+        }
+        for (let li = fn.startLine; li < fn.endLine; li++) {
+            const raw = lines[li];
+            const trimmed = raw.trim();
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            const retMatch = trimmed.match(/^(?:return|yield)\s+(.+)$/);
+            if (!retMatch)
+                continue;
+            const expr = retMatch[1];
+            const inlineSource = /\brequest\s*\.\s*(?:args|form|values|files|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/.test(expr);
+            const hasTaintedVar = [...taintedVars].some(v => new RegExp(`\\b${v}\\b`).test(expr));
+            if (!hasTaintedVar && !inlineSource)
+                continue;
+            if (escapeWrapRe.test(expr))
+                continue;
+            const buildsHtml = (/['"`]\s*\+/.test(expr) || /\+\s*['"`]/.test(expr)) ||
+                // f-string with interpolation. Allow any non-`{` char between the
+                // opening quote and the first `{` (Python f-strings may embed `"`
+                // when single-quoted and vice-versa, e.g. f'<a href="{u}">').
+                /\bf['"`][^{\n]*\{[^}]+\}/.test(expr) ||
+                /['"`]\s*%\s*[^=]/.test(expr) ||
+                /['"`]\.\s*format\s*\(/.test(expr);
+            if (!buildsHtml)
+                continue;
+            out.push({
+                id: `xss-${file}-${li + 1}`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'xss',
+                cwe: 'CWE-79',
+                severity: 'high',
+                level: 'error',
+                message: 'Reflected XSS: Flask route returns HTML built from request ' +
+                    'input via string concatenation / f-string / format. Wrap ' +
+                    'user input with markupsafe.escape() or render via a ' +
+                    'Jinja2 template (autoescape on by default).',
+                file,
+                line: li + 1,
+                snippet: trimmed.substring(0, 100),
+            });
+            break;
+        }
+    }
+    return out;
+}
+/**
+ * Python Jinja2 Markup-bypass xss — `Markup(<var>)` where `<var>` is
+ * request-sourced, then passed into a `<X>.render(...)` call. The
+ * `Markup` wrap deliberately disables Jinja autoescape for the value.
+ *
+ * Namespace-scoped alias tracking (Sprint 74 lesson): only treats
+ * `Markup` as dangerous when imported from `markupsafe` or `flask`,
+ * and only when no user-defined `class Markup` shadows the import.
+ */
+export function findPythonJinjaMarkupXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const importRe = /^\s*from\s+(?:markupsafe|flask)\s+import\s+(?:[^#\n]*\b)?Markup\b/m;
+    const classDefRe = /^\s*class\s+Markup\b/m;
+    if (!importRe.test(code))
+        return out;
+    if (classDefRe.test(code))
+        return out;
+    const requestSourceRe = /\b([A-Za-z_]\w*)\s*=\s*request\s*\.\s*(?:args|form|values|files|json|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/;
+    const taintedVars = new Set();
+    for (const line of lines) {
+        const m = line.match(requestSourceRe);
+        if (m)
+            taintedVars.add(m[1]);
+    }
+    if (taintedVars.size === 0)
+        return out;
+    if (!/\.\s*render\s*\(/.test(code))
+        return out;
+    const markupCallRe = /\bMarkup\s*\(\s*([A-Za-z_]\w*)\s*[,)]/g;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        let mm;
+        markupCallRe.lastIndex = 0;
+        while ((mm = markupCallRe.exec(trimmed)) !== null) {
+            const argName = mm[1];
+            if (!taintedVars.has(argName))
+                continue;
+            out.push({
+                id: `xss-${file}-${i + 1}`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'xss',
+                cwe: 'CWE-79',
+                severity: 'high',
+                level: 'error',
+                message: 'Jinja2 autoescape bypass: Markup(' +
+                    argName +
+                    ') wraps a request-derived value, disabling autoescape when ' +
+                    'rendered. Pass the raw value to render() and let Jinja2 ' +
+                    'auto-escape, or sanitize with bleach.clean first.',
+                file,
+                line: i + 1,
+                snippet: trimmed.substring(0, 100),
+            });
+            break;
+        }
+    }
+    return out;
+}
 //# sourceMappingURL=language-sources-pass.js.map