circle-ir 3.129.0 → 3.132.0

package/dist/analysis/passes/language-sources-pass.js

@@ -211,6 +211,14 @@ export class LanguageSourcesPass {
             for (const finding of goMisconfigFindings) {
                 ctx.addFinding(finding);
             }
+            // Sprint 81 (#189): Go xss — fmt.Fprint(f|ln) to http.ResponseWriter.
+            for (const finding of findGoXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 82 (#189): Go open_redirect — Header().Set("Location", taint).
+            for (const finding of findGoLocationHeaderOpenRedirectFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Python: safe-handler sanitizer detectors (cognium-dev #114 Sprint 31) --
         if (language === 'python') {
@@ -232,6 +240,18 @@ export class LanguageSourcesPass {
             for (const finding of pyMisconfigFindings) {
                 ctx.addFinding(finding);
             }
+            // Sprint 81 (#189): Python xss — Flask string-concat / f-string returns
+            // and Jinja Markup wrap bypass.
+            for (const finding of findPythonFlaskStringConcatXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            for (const finding of findPythonJinjaMarkupXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 82 (#189): Python open_redirect — resp.headers["Location"] = taint.
+            for (const finding of findPythonHeadersSubscriptOpenRedirectFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Rust: safe-handler sanitizer detectors (cognium-dev #115 Sprint 31) --
         if (language === 'rust') {
@@ -261,6 +281,10 @@ export class LanguageSourcesPass {
             for (const finding of findRustWeakCryptoEcbFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 82 (#189): Rust open_redirect — append_header(("Location", taint)).
+            for (const finding of findRustAppendHeaderTupleOpenRedirectFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- JavaScript/TypeScript: Sprint 73 (#216 Pattern A + B) — ETE
         // sanitizer-chain recognition (JSON.parse / bcrypt.hash / csv
@@ -272,10 +296,28 @@ export class LanguageSourcesPass {
             additionalSanitizers.push(...findJsWrapperFunctionSanitizers(code));
             // Sprint 75 (#216 Pattern D): JS SSRF allow-list guard (var-aware).
             additionalSanitizers.push(...findJsSsrfAllowlistGuardSanitizers(code));
+            // Sprint 77b (#216 Pattern X): JS/TS argv-form execFile/spawn and
+            // parameterized SQL placeholder sanitizers.
+            additionalSanitizers.push(...findJsArgvFormExecSanitizers(code));
+            additionalSanitizers.push(...findJsParameterizedSqlSanitizers(code));
             // Sprint 78 (#190): JS misconfig pattern findings — libxmljs noent:true.
             for (const finding of findJsPatternFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 81 (#189): JS/TS xss — Vue v-html directive tied to tainted
+            // template binding, and Angular DomSanitizer.bypassSecurityTrust*.
+            for (const finding of findJsVueVHtmlXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            for (const finding of findTsAngularBypassXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 82 (#189): JS/HTML DOM open_redirect — location.href /
+            // window.location / location.assign|replace() / <meta>.content shapes
+            // sourced from URLSearchParams / location.search|hash.
+            for (const finding of findJsDomOpenRedirectFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Java: Sprint 73 (#216 Pattern A) — Jackson readValue / Gson
         // fromJson recognized as ETE terminator (does not affect
@@ -293,6 +335,12 @@ export class LanguageSourcesPass {
             for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 81 (#189): Java xss — HttpServletResponse.getWriter().{print,
+            // println,write} receiver-chain that the configured PrintWriter sink
+            // doesn't resolve.
+            for (const finding of findJavaResponseWriterXssFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // Sprint 70 (#151): cross-language env-secret → external-network exfiltration.
         // Pattern findings only — no taint flow required (composed-flow shape that
@@ -2969,6 +3017,121 @@ function findJsSsrfAllowlistGuardSanitizers(code) {
     }
     return sanitizers;
 }
+/**
+ * JS/TS: argv-form `execFile`/`spawn`/`execFileSync`/`spawnSync` with
+ * a string-literal program and an array literal argv (cognium-dev #216
+ * Sprint 77b Pattern X).
+ *
+ * Pattern recognized:
+ *
+ *   execFile('echo', ['--', arg], () => {});
+ *   spawn('grep', ['--', pattern, '/var/log/app.log']);
+ *   execFileSync('cat', [path]);
+ *
+ * Argv-form exec with a string-literal program splits arguments into
+ * the argv slot with no shell interpretation, so a tainted argv element
+ * cannot smuggle shell metacharacters into a separate command.
+ *
+ * The shell-via-argv form `execFile('sh', ['-c', tainted])` is excluded
+ * since `-c` re-enables shell parsing of the subsequent argv slot. A
+ * tainted-program slot `execFile(prog, [arg])` is NOT matched (TP-2
+ * control), nor is the single-string `exec("cmd " + arg)` form (TP-1
+ * control — `exec` itself spawns a shell regardless).
+ *
+ * Emits a `command_injection` + `external_taint_escape` sanitizer at
+ * that line.
+ */
+function findJsArgvFormExecSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // execFile/spawn (+Sync) with a string-literal program and array argv.
+    // Quoted program slot, then comma, then `[`.
+    const argvExecRe = /\b(?:execFile|spawn)(?:Sync)?\s*\(\s*(?:'[^']*'|"[^"]*"|`[^`]*`)\s*,\s*\[/;
+    // Shell-via-argv exclusion: program is sh/bash/etc. (possibly with a
+    // leading path like /bin/ or /usr/bin/) AND first argv is "-c".
+    const shellArgvRe = /\b(?:execFile|spawn)(?:Sync)?\s*\(\s*['"`](?:[\w./-]*\/)?(?:sh|bash|zsh|ksh|dash|cmd(?:\.exe)?|powershell|pwsh)['"`]\s*,\s*\[\s*['"`]-c['"`]/;
+    for (let i = 0; i < lines.length; i++) {
+        const text = lines[i];
+        if (!argvExecRe.test(text))
+            continue;
+        if (shellArgvRe.test(text))
+            continue;
+        sanitizers.push({
+            type: 'js_argv_form_exec',
+            method: 'execFile',
+            line: i + 1,
+            sanitizes: ['command_injection', 'external_taint_escape'],
+        });
+    }
+    return sanitizers;
+}
+/**
+ * JS/TS: parameterized SQL query sanitizer (cognium-dev #216 Sprint 77b
+ * Pattern X).
+ *
+ * Pattern recognized:
+ *
+ *   await pool.query('SELECT * FROM users WHERE name = $1', [name]);
+ *   await conn.execute('SELECT * FROM users WHERE id = ?', [id]);
+ *   await client.query(`UPDATE u SET name = $1 WHERE id = $2`, [name, id]);
+ *
+ * The query string is a STRING-LITERAL (`'...'` / `"..."` / `` `...` ``
+ * with no `${}` interpolation) that contains positional placeholders
+ * (`$1`-style PostgreSQL or `?` MySQL/SQLite), AND a second argument
+ * that begins with `[` (array literal of bound parameters). The driver
+ * binds those parameters at the protocol layer rather than splicing
+ * them into the SQL text, so the tainted values cannot become SQL.
+ *
+ * The concat form `pool.query("SELECT * FROM u WHERE n = '" + name + "'")`
+ * and the interpolated template literal
+ * `` pool.query(`SELECT * FROM u WHERE n = '${name}'`) `` are NOT
+ * matched and continue to fire `sql_injection` (TP-1 / TP-2 controls).
+ *
+ * Emits a `sql_injection` + `external_taint_escape` sanitizer at that
+ * line.
+ */
+function findJsParameterizedSqlSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // `.query(...)` / `.execute(...)` with a non-interpolating string
+    // literal containing $N or ? placeholders, followed by `, [`.
+    // Single quotes:
+    const singleRe = /\.\s*(?:query|execute)\s*\(\s*'([^'\\]*(?:\\.[^'\\]*)*)'\s*,\s*\[/;
+    // Double quotes:
+    const doubleRe = /\.\s*(?:query|execute)\s*\(\s*"([^"\\]*(?:\\.[^"\\]*)*)"\s*,\s*\[/;
+    // Backticks WITHOUT `${...}` interpolation:
+    const tickRe = /\.\s*(?:query|execute)\s*\(\s*`([^`]*)`\s*,\s*\[/;
+    const placeholderRe = /(?:\$\d+|\?)/;
+    for (let i = 0; i < lines.length; i++) {
+        const text = lines[i];
+        let sql = null;
+        const s = singleRe.exec(text);
+        if (s)
+            sql = s[1];
+        if (sql == null) {
+            const d = doubleRe.exec(text);
+            if (d)
+                sql = d[1];
+        }
+        if (sql == null) {
+            const t = tickRe.exec(text);
+            // Reject template literals that interpolate values.
+            if (t && !/\$\{/.test(t[1]))
+                sql = t[1];
+        }
+        if (sql == null)
+            continue;
+        if (!placeholderRe.test(sql))
+            continue;
+        sanitizers.push({
+            type: 'js_parameterized_sql',
+            method: 'query',
+            line: i + 1,
+            sanitizes: ['sql_injection', 'external_taint_escape'],
+        });
+    }
+    return sanitizers;
+}
 /**
  * Java: Path.resolve(...).normalize() + startsWith(ROOT) guard
  * sanitizer (cognium-dev #216 Sprint 76 Pattern B).
@@ -4104,4 +4267,872 @@ export function findJsPatternFindings(code, file) {
     }
     return out;
 }
+// ---------------------------------------------------------------------------
+// Sprint 81 (#189) — xss-cluster FN coverage. Six per-language pattern
+// detectors that emit SastFinding{rule_id:'xss'} directly, bypassing the
+// source→sink→flow construction where the engine can't yet build a flow
+// (e.g. Python string-concat / f-string, Java receiver-chain typing).
+// ---------------------------------------------------------------------------
+/**
+ * Go xss — `fmt.Fprint(f|ln)?(w, ...)` writing tainted data directly to an
+ * `http.ResponseWriter`. Two-pass:
+ *
+ *   1. Discover ResponseWriter parameter names by scanning function
+ *      signatures `(<name> http.ResponseWriter, ...)`.
+ *   2. For every `fmt.Fprint(f|ln)?(<name>, <format>, <args...>)` whose
+ *      first argument matches a discovered name, emit xss UNLESS one of
+ *      the args is wrapped in a recognized HTML escaper
+ *      (`html.EscapeString` / `template.HTMLEscapeString` /
+ *      `template.HTMLEscaper`).
+ */
+export function findGoXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const rwNames = new Set();
+    const sigRe = /\(\s*([A-Za-z_]\w*)\s+http\.ResponseWriter\b/g;
+    for (const line of lines) {
+        let m;
+        sigRe.lastIndex = 0;
+        while ((m = sigRe.exec(line)) !== null)
+            rwNames.add(m[1]);
+    }
+    if (rwNames.size === 0)
+        return out;
+    const escaperRe = /\b(?:html|template)\.(?:EscapeString|HTMLEscapeString|HTMLEscaper|JSEscapeString|URLQueryEscaper)\s*\(/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        const callRe = /\bfmt\.Fprint(?:f|ln)?\s*\(\s*([A-Za-z_]\w*)\s*,\s*([\s\S]*)\)\s*(?:\/\/.*)?$/;
+        const m = trimmed.match(callRe);
+        if (!m)
+            continue;
+        if (!rwNames.has(m[1]))
+            continue;
+        const tail = m[2];
+        if (escaperRe.test(tail))
+            continue;
+        // Require at least one identifier in tail outside string literals.
+        if (!/[A-Za-z_]\w*/.test(tail.replace(/"[^"]*"|`[^`]*`/g, '')))
+            continue;
+        out.push({
+            id: `xss-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'xss',
+            cwe: 'CWE-79',
+            severity: 'high',
+            level: 'error',
+            message: 'Reflected XSS: fmt.Fprint writes data to http.ResponseWriter ' +
+                'without HTML escaping. Wrap user-controlled args with ' +
+                'html.EscapeString / template.HTMLEscapeString.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Java xss — `<recv>.getWriter().{print,println,write,printf,format,append}
+ * (<arg>)` chained call where `<recv>` is typed `HttpServletResponse`.
+ * The receiver-chain form bypasses the configured `PrintWriter.print`
+ * sink because the engine doesn't yet trace `HttpServletResponse
+ * .getWriter()` → `PrintWriter` type resolution.
+ *
+ * Conservative: only fires when the receiver token matches a parameter
+ * named with the `HttpServletResponse` type AND no recognized HTML
+ * encoder wraps the argument.
+ */
+export function findJavaResponseWriterXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const respNames = new Set();
+    const sigRe = /\bHttpServletResponse\s+([A-Za-z_]\w*)\b/g;
+    for (const line of lines) {
+        let m;
+        sigRe.lastIndex = 0;
+        while ((m = sigRe.exec(line)) !== null)
+            respNames.add(m[1]);
+    }
+    if (respNames.size === 0)
+        return out;
+    const safeWrapRe = /\b(?:Encode\.(?:forHtml|forHtmlAttribute|forHtmlContent|forJavaScript)|StringEscapeUtils\.escape(?:Html3|Html4|EcmaScript|Xml)|HtmlUtils\.htmlEscape(?:Decimal|Hex)?|Escaper\.escapeHtml|HtmlEscapers\.(?:escapeHtml|htmlEscaper)|Encoder\.encodeForHTML(?:Attribute)?|Jsoup\.clean)\s*\(/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        const chainRe = /\b([A-Za-z_]\w*)\s*\.\s*getWriter\s*\(\s*\)\s*\.\s*(print|println|write|printf|format|append)\s*\(([\s\S]*)\)\s*;?\s*(?:\/\/.*)?$/;
+        const m = trimmed.match(chainRe);
+        if (!m)
+            continue;
+        const recv = m[1];
+        if (!respNames.has(recv))
+            continue;
+        const args = m[3];
+        if (safeWrapRe.test(args))
+            continue;
+        // Skip when args is a pure string-literal call like `print("hello")`.
+        // Anything else (`+`-concat, bare identifier, method call) is a write
+        // of dynamic content that should have gone through an HTML encoder.
+        const argsTrim = args.trim();
+        if (/^"(?:\\.|[^"\\])*"$/.test(argsTrim))
+            continue;
+        if (!/[A-Za-z_]\w*/.test(argsTrim))
+            continue;
+        out.push({
+            id: `xss-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'xss',
+            cwe: 'CWE-79',
+            severity: 'high',
+            level: 'error',
+            message: 'Reflected XSS: HttpServletResponse.getWriter().' +
+                m[2] +
+                '(...) writes data to the response without HTML escaping. ' +
+                'Wrap user-controlled values with OWASP Encode.forHtml / ' +
+                'StringEscapeUtils.escapeHtml4 / Jsoup.clean.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Vue xss — `template: '<...v-html="<var>"...>'` directive binding to a
+ * variable that is sourced from a tainted location (URLSearchParams,
+ * location.search/hash, route.query/params, fetch, etc.).
+ *
+ * Conservative: when the bound variable is a literal initializer
+ * (`<var>: 'static'`) or sourced from a non-recognized location, no
+ * finding is emitted.
+ */
+export function findJsVueVHtmlXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const sourceRe = /\b(?:URLSearchParams|location\s*\.\s*(?:search|hash|href|pathname)|window\s*\.\s*location|route\s*\.\s*(?:query|params)|router\s*\.\s*(?:currentRoute|query)|\$route\s*\.\s*(?:query|params)|fetch\s*\(|axios\s*\.\s*(?:get|post)|XMLHttpRequest|document\s*\.\s*location)\b/;
+    const tplRe = /\btemplate\s*:\s*(['"`])([\s\S]*?)\1/g;
+    let tm;
+    const boundVars = new Set();
+    while ((tm = tplRe.exec(code)) !== null) {
+        const tpl = tm[2];
+        const vhRe = /\bv-html\s*=\s*"([^"]+)"/g;
+        let vm;
+        while ((vm = vhRe.exec(tpl)) !== null) {
+            const expr = vm[1].trim();
+            const idMatch = expr.match(/^([A-Za-z_$][\w$]*)/);
+            if (idMatch)
+                boundVars.add(idMatch[1]);
+        }
+    }
+    if (boundVars.size === 0)
+        return out;
+    // Build a set of variables transitively tainted by a recognized source
+    // pattern: `const params = new URLSearchParams(...)` taints `params`,
+    // then `const q = params.get('q')` taints `q` (one-hop).
+    const taintedSet = new Set();
+    const assignRe = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+    let am;
+    // First pass: direct source-pattern assignments.
+    assignRe.lastIndex = 0;
+    while ((am = assignRe.exec(code)) !== null) {
+        if (sourceRe.test(am[2]))
+            taintedSet.add(am[1]);
+    }
+    // Second pass: one-hop through tainted vars (limit 3 iterations).
+    for (let pass = 0; pass < 3; pass++) {
+        assignRe.lastIndex = 0;
+        const before = taintedSet.size;
+        while ((am = assignRe.exec(code)) !== null) {
+            if (taintedSet.has(am[1]))
+                continue;
+            for (const tv of taintedSet) {
+                if (new RegExp(`\\b${tv}\\b`).test(am[2])) {
+                    taintedSet.add(am[1]);
+                    break;
+                }
+            }
+        }
+        if (taintedSet.size === before)
+            break;
+    }
+    const taintedBindings = new Set();
+    for (const v of boundVars) {
+        const bindRe = new RegExp(`\\b${v}\\s*[:=]\\s*([^,;\\n]+)`);
+        for (const line of lines) {
+            const m = line.match(bindRe);
+            if (!m)
+                continue;
+            const val = m[1];
+            if (sourceRe.test(val)) {
+                taintedBindings.add(v);
+                break;
+            }
+            let found = false;
+            for (const tv of taintedSet) {
+                if (new RegExp(`\\b${tv}\\b`).test(val)) {
+                    taintedBindings.add(v);
+                    found = true;
+                    break;
+                }
+            }
+            if (found)
+                break;
+        }
+        const propsRe = new RegExp(`\\bprops\\s*:\\s*\\[[^\\]]*['"\`]${v}['"\`][^\\]]*\\]`);
+        if (propsRe.test(code))
+            taintedBindings.add(v);
+    }
+    if (taintedBindings.size === 0)
+        return out;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        if (!/v-html\s*=/.test(raw))
+            continue;
+        const vm = raw.match(/v-html\s*=\s*"([^"]+)"/);
+        if (!vm)
+            continue;
+        const idMatch = vm[1].trim().match(/^([A-Za-z_$][\w$]*)/);
+        if (!idMatch || !taintedBindings.has(idMatch[1]))
+            continue;
+        out.push({
+            id: `xss-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'xss',
+            cwe: 'CWE-79',
+            severity: 'high',
+            level: 'error',
+            message: 'Vue v-html XSS: directive binds to "' +
+                idMatch[1] +
+                '" which is sourced from user-controlled input. Use {{ }} ' +
+                'interpolation (auto-escapes) or sanitize the HTML with ' +
+                'DOMPurify before binding.',
+            file,
+            line: i + 1,
+            snippet: raw.trim().substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Angular xss — `<recv>.bypassSecurityTrust(Html|Script|Url|ResourceUrl|
+ * Style)(<arg>)` where `<recv>` is typed `DomSanitizer`. Skip when
+ * `<arg>` is a string literal (intentional safe-by-author escape hatch).
+ */
+export function findTsAngularBypassXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const sanitizerNames = new Set();
+    const declRe = /\b(?:public|private|protected|readonly|\s)?\s*([A-Za-z_$][\w$]*)\s*:\s*DomSanitizer\b/g;
+    let m;
+    declRe.lastIndex = 0;
+    while ((m = declRe.exec(code)) !== null)
+        sanitizerNames.add(m[1]);
+    if (sanitizerNames.size === 0)
+        return out;
+    const assignRe = /\bthis\s*\.\s*([A-Za-z_$][\w$]*)\s*=\s*([A-Za-z_$][\w$]*)\b/g;
+    let am;
+    assignRe.lastIndex = 0;
+    while ((am = assignRe.exec(code)) !== null) {
+        if (sanitizerNames.has(am[2]))
+            sanitizerNames.add(am[1]);
+    }
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        const callRe = /\b(?:this\s*\.\s*)?([A-Za-z_$][\w$]*)\s*\.\s*bypassSecurityTrust(Html|Script|Url|ResourceUrl|Style)\s*\(([\s\S]*?)\)/;
+        const cm = trimmed.match(callRe);
+        if (!cm)
+            continue;
+        const recv = cm[1];
+        if (!sanitizerNames.has(recv))
+            continue;
+        const arg = cm[3].trim();
+        if (/^(['"`])[^'"`]*\1$/.test(arg))
+            continue;
+        out.push({
+            id: `xss-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'xss',
+            cwe: 'CWE-79',
+            severity: 'high',
+            level: 'error',
+            message: 'Angular XSS: DomSanitizer.bypassSecurityTrust' +
+                cm[2] +
+                '() opts out of Angular\'s built-in sanitization for a ' +
+                'non-literal argument. Prefer leaving Angular\'s default ' +
+                'sanitizer in place, or sanitize the input with DOMPurify ' +
+                'before bypassing.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Python Flask xss — route function returning HTML built from a
+ * `request.<args|form|values|files>.get(...)` value via string concat,
+ * f-string, %, or .format(). Bypasses the engine's flow construction
+ * gap for these string ops.
+ *
+ * Conservative: requires a Flask-style route decorator (`@<x>.route(`)
+ * above the function; skip when the variable is escape()-wrapped.
+ */
+export function findPythonFlaskStringConcatXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const fns = [];
+    const defRe = /^(\s*)def\s+([A-Za-z_]\w*)\s*\(/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const dm = raw.match(defRe);
+        if (!dm)
+            continue;
+        const indent = dm[1].length;
+        let hasRoute = false;
+        for (let j = i - 1; j >= 0; j--) {
+            const prev = lines[j].trim();
+            if (prev === '' || prev.startsWith('#'))
+                continue;
+            if (!prev.startsWith('@'))
+                break;
+            if (/@\s*[A-Za-z_]\w*\s*\.\s*route\s*\(/.test(prev) ||
+                /@\s*route\s*\(/.test(prev)) {
+                hasRoute = true;
+            }
+        }
+        if (!hasRoute)
+            continue;
+        let end = lines.length;
+        for (let k = i + 1; k < lines.length; k++) {
+            const ln = lines[k];
+            if (!ln.trim())
+                continue;
+            const ind = ln.match(/^(\s*)/)?.[1].length ?? 0;
+            if (ind <= indent) {
+                end = k;
+                break;
+            }
+        }
+        fns.push({ name: dm[2], startLine: i + 1, endLine: end });
+    }
+    if (fns.length === 0)
+        return out;
+    const requestSourceRe = /\b([A-Za-z_]\w*)\s*=\s*request\s*\.\s*(?:args|form|values|files|json|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/;
+    const escapeWrapRe = /\b(?:html\.escape|markupsafe\.escape|escape|markupsafe\.Markup\s*\.\s*escape|werkzeug\.utils\.escape)\s*\(/;
+    for (const fn of fns) {
+        const taintedVars = new Set();
+        for (let li = fn.startLine; li < fn.endLine; li++) {
+            const raw = lines[li];
+            const rm = raw.match(requestSourceRe);
+            if (rm)
+                taintedVars.add(rm[1]);
+        }
+        for (let li = fn.startLine; li < fn.endLine; li++) {
+            const raw = lines[li];
+            const trimmed = raw.trim();
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            const retMatch = trimmed.match(/^(?:return|yield)\s+(.+)$/);
+            if (!retMatch)
+                continue;
+            const expr = retMatch[1];
+            const inlineSource = /\brequest\s*\.\s*(?:args|form|values|files|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/.test(expr);
+            const hasTaintedVar = [...taintedVars].some(v => new RegExp(`\\b${v}\\b`).test(expr));
+            if (!hasTaintedVar && !inlineSource)
+                continue;
+            if (escapeWrapRe.test(expr))
+                continue;
+            const buildsHtml = (/['"`]\s*\+/.test(expr) || /\+\s*['"`]/.test(expr)) ||
+                // f-string with interpolation. Allow any non-`{` char between the
+                // opening quote and the first `{` (Python f-strings may embed `"`
+                // when single-quoted and vice-versa, e.g. f'<a href="{u}">').
+                /\bf['"`][^{\n]*\{[^}]+\}/.test(expr) ||
+                /['"`]\s*%\s*[^=]/.test(expr) ||
+                /['"`]\.\s*format\s*\(/.test(expr);
+            if (!buildsHtml)
+                continue;
+            out.push({
+                id: `xss-${file}-${li + 1}`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'xss',
+                cwe: 'CWE-79',
+                severity: 'high',
+                level: 'error',
+                message: 'Reflected XSS: Flask route returns HTML built from request ' +
+                    'input via string concatenation / f-string / format. Wrap ' +
+                    'user input with markupsafe.escape() or render via a ' +
+                    'Jinja2 template (autoescape on by default).',
+                file,
+                line: li + 1,
+                snippet: trimmed.substring(0, 100),
+            });
+            break;
+        }
+    }
+    return out;
+}
+/**
+ * Python Jinja2 Markup-bypass xss — `Markup(<var>)` where `<var>` is
+ * request-sourced, then passed into a `<X>.render(...)` call. The
+ * `Markup` wrap deliberately disables Jinja autoescape for the value.
+ *
+ * Namespace-scoped alias tracking (Sprint 74 lesson): only treats
+ * `Markup` as dangerous when imported from `markupsafe` or `flask`,
+ * and only when no user-defined `class Markup` shadows the import.
+ */
+export function findPythonJinjaMarkupXssFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const importRe = /^\s*from\s+(?:markupsafe|flask)\s+import\s+(?:[^#\n]*\b)?Markup\b/m;
+    const classDefRe = /^\s*class\s+Markup\b/m;
+    if (!importRe.test(code))
+        return out;
+    if (classDefRe.test(code))
+        return out;
+    const requestSourceRe = /\b([A-Za-z_]\w*)\s*=\s*request\s*\.\s*(?:args|form|values|files|json|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/;
+    const taintedVars = new Set();
+    for (const line of lines) {
+        const m = line.match(requestSourceRe);
+        if (m)
+            taintedVars.add(m[1]);
+    }
+    if (taintedVars.size === 0)
+        return out;
+    if (!/\.\s*render\s*\(/.test(code))
+        return out;
+    const markupCallRe = /\bMarkup\s*\(\s*([A-Za-z_]\w*)\s*[,)]/g;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        let mm;
+        markupCallRe.lastIndex = 0;
+        while ((mm = markupCallRe.exec(trimmed)) !== null) {
+            const argName = mm[1];
+            if (!taintedVars.has(argName))
+                continue;
+            out.push({
+                id: `xss-${file}-${i + 1}`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'xss',
+                cwe: 'CWE-79',
+                severity: 'high',
+                level: 'error',
+                message: 'Jinja2 autoescape bypass: Markup(' +
+                    argName +
+                    ') wraps a request-derived value, disabling autoescape when ' +
+                    'rendered. Pass the raw value to render() and let Jinja2 ' +
+                    'auto-escape, or sanitize with bleach.clean first.',
+                file,
+                line: i + 1,
+                snippet: trimmed.substring(0, 100),
+            });
+            break;
+        }
+    }
+    return out;
+}
+/**
+ * Go open_redirect — `<rw>.Header().Set("Location", <expr>)` where
+ * `<rw>` is bound to `http.ResponseWriter`. The configured sink rows
+ * for `Header.Set` are typed `crlf` (CWE-113); the same line is also a
+ * CWE-601 open_redirect when the header key is exactly `"Location"`
+ * (case-insensitive). This pattern detector emits the open_redirect
+ * finding directly, complementing the engine's crlf classification.
+ *
+ * Sprint 82 (#189): closes go__v02_location_header.
+ *
+ * Conservative: only fires when the receiver matches a parameter typed
+ * `http.ResponseWriter` AND the literal key value is `Location` AND no
+ * recognized URL-allowlist sanitizer wraps the value argument.
+ */
+export function findGoLocationHeaderOpenRedirectFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const rwNames = new Set();
+    const sigRe = /\(\s*([A-Za-z_]\w*)\s+http\.ResponseWriter\b/g;
+    for (const line of lines) {
+        let m;
+        sigRe.lastIndex = 0;
+        while ((m = sigRe.exec(line)) !== null)
+            rwNames.add(m[1]);
+    }
+    if (rwNames.size === 0)
+        return out;
+    // Recognized URL-allowlist / strict-equality sanitizers. Conservative
+    // — keeps the FP set tight (Sprint 74 lesson). `url.Parse` alone is
+    // not a sanitizer; we require an `IsAbs`/`Host`/`==` check.
+    const safeWrapRe = /\b(?:net\/url|url)\.Parse\b[\s\S]{0,120}?\b(?:IsAbs|Host)\b|\bstrings\.HasPrefix\s*\(/;
+    // Match: `<rw>.Header().Set("Location", <expr>)` — also accept
+    // `Add` (header-stacking variant) which has the same redirect effect.
+    const callRe = /\b([A-Za-z_]\w*)\s*\.\s*Header\s*\(\s*\)\s*\.\s*(?:Set|Add)\s*\(\s*(['"])([^'"]+)\2\s*,\s*([\s\S]*)\)\s*(?:\/\/.*)?$/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        const m = trimmed.match(callRe);
+        if (!m)
+            continue;
+        const recv = m[1];
+        if (!rwNames.has(recv))
+            continue;
+        const key = m[3];
+        if (key.toLowerCase() !== 'location')
+            continue;
+        const valExpr = m[4];
+        // Skip when the value is a pure string literal (no taint shape).
+        const valTrim = valExpr.trim();
+        if (/^"(?:\\.|[^"\\])*"$/.test(valTrim))
+            continue;
+        if (safeWrapRe.test(valExpr))
+            continue;
+        out.push({
+            id: `open_redirect-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'open_redirect',
+            cwe: 'CWE-601',
+            severity: 'high',
+            level: 'error',
+            message: 'Open redirect: ResponseWriter.Header().Set("Location", ...) ' +
+                'writes a user-controlled value into the Location header without ' +
+                'validating the target. Restrict to an allow-list of hosts/paths ' +
+                'or compare against a known-safe set before issuing the redirect.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Python Flask open_redirect — `<resp>.headers["Location"] = <expr>`
+ * subscript-assignment shape. The engine's configured sinks for
+ * Flask `Response.headers` model the dict-add form but not subscript
+ * assignment, so the open_redirect signal is missed even though the
+ * source (`request.args.get`) is detected.
+ *
+ * Sprint 82 (#189): closes py__v02_location_header.
+ *
+ * Conservative: requires the rhs to be a recognized request-source
+ * variable OR an inline `request.<x>.get/[]` expression. Skips when
+ * the value is wrapped in a recognized URL-allowlist call.
+ */
+export function findPythonHeadersSubscriptOpenRedirectFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const requestSourceRe = /\b([A-Za-z_]\w*)\s*=\s*request\s*\.\s*(?:args|form|values|files|json|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/;
+    const taintedVars = new Set();
+    for (const line of lines) {
+        const m = line.match(requestSourceRe);
+        if (m)
+            taintedVars.add(m[1]);
+    }
+    // Recognized URL-allowlist sanitizers (tight, Sprint 74 lesson).
+    const safeWrapRe = /\b(?:urllib\.parse\.urlparse|urlparse)\s*\([\s\S]{0,120}?\bnetloc\b|\b(?:startswith)\s*\(/;
+    const subscriptRe = /\b([A-Za-z_]\w*)\s*\.\s*headers\s*\[\s*(['"])([^'"]+)\2\s*\]\s*=\s*(.+)$/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const m = trimmed.match(subscriptRe);
+        if (!m)
+            continue;
+        const key = m[3];
+        if (key.toLowerCase() !== 'location')
+            continue;
+        const rhs = m[4].replace(/\s*(?:#.*)?$/, '').trim();
+        // Skip pure string literal.
+        if (/^['"](?:\\.|[^'"\\])*['"]$/.test(rhs))
+            continue;
+        // Skip when wrapped in a recognized allowlist check.
+        if (safeWrapRe.test(rhs))
+            continue;
+        const hasTaintedVar = [...taintedVars].some(v => new RegExp(`\\b${v}\\b`).test(rhs));
+        const inlineSource = /\brequest\s*\.\s*(?:args|form|values|files|cookies|headers|json)(?:\s*\.\s*get\s*\(|\s*\[)/.test(rhs);
+        if (!hasTaintedVar && !inlineSource)
+            continue;
+        out.push({
+            id: `open_redirect-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'open_redirect',
+            cwe: 'CWE-601',
+            severity: 'high',
+            level: 'error',
+            message: 'Open redirect: response.headers["Location"] = ... assigns a ' +
+                'user-controlled value to the Location header. Validate the URL ' +
+                'against an allow-list of trusted hosts before sending.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Rust open_redirect — Actix/Rocket builder pattern
+ * `<builder>.append_header(("Location", <expr>))` or
+ * `.insert_header(("Location", <expr>))` where the value traces back
+ * to a `web::Query` / `web::Path` / `Form` extractor. The tuple-arg
+ * form is the idiomatic Actix HeaderName→HeaderValue API; the
+ * engine's configured sinks model single-arg `set_header(value)` but
+ * not the tuple builder shape.
+ *
+ * Sprint 82 (#189): closes rust__v01_redirect_param.
+ *
+ * Conservative: requires the function to accept a recognized
+ * `web::Query` / `web::Path` / `web::Form` / `HttpRequest` parameter
+ * and the value expression to reference it (directly, or transitively
+ * via a `.get(...)` / `.cloned()` / `.unwrap_or_default()` chain).
+ */
+export function findRustAppendHeaderTupleOpenRedirectFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    // Discover request-extractor parameter names.
+    const extractorRe = /\b([A-Za-z_]\w*)\s*:\s*(?:web\s*::\s*)?(?:Query|Path|Form|Json)\s*<|\b([A-Za-z_]\w*)\s*:\s*&?\s*HttpRequest\b/g;
+    const extractorParams = new Set();
+    for (const line of lines) {
+        let m;
+        extractorRe.lastIndex = 0;
+        while ((m = extractorRe.exec(line)) !== null) {
+            const name = m[1] ?? m[2];
+            if (name)
+                extractorParams.add(name);
+        }
+    }
+    if (extractorParams.size === 0)
+        return out;
+    // Build transitive tainted-let set: `let v = <expr>` where <expr>
+    // references an extractor param or a previously tainted var.
+    const taintedVars = new Set(extractorParams);
+    const letRe = /\blet\s+(?:mut\s+)?([A-Za-z_]\w*)\s*(?::[^=]+)?=\s*([^;]+);/g;
+    for (let pass = 0; pass < 4; pass++) {
+        const before = taintedVars.size;
+        let lm;
+        letRe.lastIndex = 0;
+        while ((lm = letRe.exec(code)) !== null) {
+            const name = lm[1];
+            const rhs = lm[2];
+            if (taintedVars.has(name))
+                continue;
+            for (const tv of taintedVars) {
+                if (new RegExp(`\\b${tv}\\b`).test(rhs)) {
+                    taintedVars.add(name);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    const safeWrapRe = /\b(?:Url\s*::\s*parse|url\s*::\s*Url\s*::\s*parse)\s*\([\s\S]{0,160}?\b(?:host_str|host|origin)\b/;
+    const tupleCallRe = /\.\s*(?:append_header|insert_header)\s*\(\s*\(\s*(['"])([^'"]+)\1\s*,\s*([^)]*?)\s*\)\s*\)/g;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        let cm;
+        tupleCallRe.lastIndex = 0;
+        while ((cm = tupleCallRe.exec(raw)) !== null) {
+            const key = cm[2];
+            if (key.toLowerCase() !== 'location')
+                continue;
+            const valExpr = cm[3];
+            if (/^['"](?:\\.|[^'"\\])*['"]$/.test(valExpr.trim()))
+                continue;
+            if (safeWrapRe.test(valExpr))
+                continue;
+            const hasTainted = [...taintedVars].some(v => new RegExp(`\\b${v}\\b`).test(valExpr));
+            if (!hasTainted)
+                continue;
+            out.push({
+                id: `open_redirect-${file}-${i + 1}`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'open_redirect',
+                cwe: 'CWE-601',
+                severity: 'high',
+                level: 'error',
+                message: 'Open redirect: HttpResponse builder ' +
+                    '.append_header(("Location", ...)) sets the Location header from ' +
+                    'a request-derived value without allow-list validation. Parse ' +
+                    'with url::Url::parse and compare host_str against an allow-list.',
+                file,
+                line: i + 1,
+                snippet: trimmed.substring(0, 100),
+            });
+            break;
+        }
+    }
+    return out;
+}
+/**
+ * JS/HTML DOM open_redirect — assignment / call patterns that drive
+ * `location.href`, `window.location`, `document.location`,
+ * `location.assign(...)`, `location.replace(...)`, or `<elem>.content
+ * = '...;url=' + ...` (meta-refresh DOM shape) where the right-hand
+ * side traces back to a DOM source (`location.search`,
+ * `location.hash`, `URLSearchParams.get(...)`, `document.referrer`,
+ * `window.name`).
+ *
+ * Sprint 82 (#189): closes html__v01_redirect_param,
+ * html__v03_meta_refresh, htmljs__v03_meta_refresh.
+ *
+ * Conservative: only fires when the rhs expression contains (or
+ * references a var that contains) a recognized DOM source token;
+ * never fires on literal-only assignments.
+ */
+export function findJsDomOpenRedirectFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    // DOM source pattern — direct references to user-controlled URL
+    // pieces. `document.referrer` / `window.name` round out the common
+    // taint sources beyond URLSearchParams.
+    const domSourceRe = /\blocation\s*\.\s*(?:search|hash|href|pathname)\b|\bwindow\s*\.\s*location\s*\.\s*(?:search|hash|href|pathname)\b|\bURLSearchParams\b|\bdocument\s*\.\s*(?:referrer|URL|location\s*\.\s*(?:search|hash|href|pathname))\b|\bwindow\s*\.\s*name\b/;
+    // Transitive tainted variable set: `const x = <DOM source ...>`,
+    // then `const y = x.get(...)`, etc.
+    const taintedVars = new Set();
+    const assignRe = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+    let am;
+    assignRe.lastIndex = 0;
+    while ((am = assignRe.exec(code)) !== null) {
+        if (domSourceRe.test(am[2]))
+            taintedVars.add(am[1]);
+    }
+    for (let pass = 0; pass < 4; pass++) {
+        const before = taintedVars.size;
+        assignRe.lastIndex = 0;
+        while ((am = assignRe.exec(code)) !== null) {
+            if (taintedVars.has(am[1]))
+                continue;
+            for (const tv of taintedVars) {
+                if (new RegExp(`\\b${tv}\\b`).test(am[2])) {
+                    taintedVars.add(am[1]);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    // Recognized sanitizers (tight): explicit allow-list check against a
+    // known set / startsWith on a same-origin literal prefix.
+    const safeWrapRe = /\b(?:startsWith|includes)\s*\(\s*['"`]\/[^'"`]*['"`]\s*\)|\bnew\s+URL\s*\([\s\S]{0,80}?\)\s*\.\s*(?:origin|hostname)\s*===/;
+    const containsTaint = (expr) => {
+        if (domSourceRe.test(expr))
+            return true;
+        for (const tv of taintedVars) {
+            if (new RegExp(`\\b${tv}\\b`).test(expr))
+                return true;
+        }
+        return false;
+    };
+    // Sink shape (a1): `[<X>.]location.href = <expr>`.
+    const hrefSinkRe = /\b(?:(?:window|document|self|top|parent)\s*\.\s*)?location\s*\.\s*href\s*=\s*([^;\n]+?)\s*;?\s*(?:\/\/.*)?$/;
+    // Sink shape (a2): `window.location = <expr>` etc.
+    const locSinkRe = /\b(?:window|document|self|top|parent)\s*\.\s*location\s*=\s*([^;\n]+?)\s*;?\s*(?:\/\/.*)?$/;
+    // Sink shape (a3): `<elem>.content = <expr>` — only counts when the
+    // rhs looks like a meta-refresh string (`'...url=' + ...`). Allow `;`
+    // inside string literals on the rhs (meta-refresh format is
+    // `'<delay>;url=<...>'`), so match up to newline then trim trailing
+    // semicolon/comment manually.
+    const contentSinkRe = /\.\s*content\s*=\s*([^\n]+?)\s*$/;
+    // Sink shape (b): `[<X>.]location.assign(<expr>)` /
+    // `[<X>.]location.replace(<expr>)`.
+    const callSinkRe = /\b(?:(?:window|document|self|top|parent)\s*\.\s*)?location\s*\.\s*(?:assign|replace)\s*\(\s*([^)]+)\)/;
+    const emit = (line, msg, snippet) => {
+        out.push({
+            id: `open_redirect-${file}-${line}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'open_redirect',
+            cwe: 'CWE-601',
+            severity: 'high',
+            level: 'error',
+            message: msg,
+            file,
+            line,
+            snippet: snippet.substring(0, 100),
+        });
+    };
+    const isLiteralOnly = (expr) => /^['"`](?:\\.|[^'"`\\])*['"`]$/.test(expr.trim());
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        let matched = false;
+        // (a1) location.href = ...
+        const hm = trimmed.match(hrefSinkRe);
+        if (hm) {
+            const rhs = hm[1].trim();
+            if (!isLiteralOnly(rhs) && containsTaint(rhs) && !safeWrapRe.test(rhs)) {
+                emit(i + 1, 'Open redirect: assignment to location.href uses a value ' +
+                    'derived from a URL query/hash without allow-list validation. ' +
+                    'Compare the target origin to a known-safe set before navigating.', trimmed);
+                matched = true;
+            }
+        }
+        // (a2) window.location = ... (skip if already matched as href)
+        if (!matched) {
+            const lm = trimmed.match(locSinkRe);
+            if (lm) {
+                const rhs = lm[1].trim();
+                if (!isLiteralOnly(rhs) && containsTaint(rhs) && !safeWrapRe.test(rhs)) {
+                    emit(i + 1, 'Open redirect: assignment to window.location uses a value ' +
+                        'derived from a URL query/hash without allow-list validation. ' +
+                        'Compare the target origin to a known-safe set before navigating.', trimmed);
+                    matched = true;
+                }
+            }
+        }
+        // (a3) <elem>.content = '...url=' + ... (meta-refresh DOM shape)
+        if (!matched) {
+            const cm = trimmed.match(contentSinkRe);
+            if (cm) {
+                // Strip trailing `;` and comment from captured rhs.
+                const rhs = cm[1].replace(/\s*\/\/.*$/, '').replace(/\s*;\s*$/, '').trim();
+                if (!isLiteralOnly(rhs) &&
+                    /['"`][^'"`]*\burl\s*=/i.test(rhs) &&
+                    containsTaint(rhs) &&
+                    !safeWrapRe.test(rhs)) {
+                    emit(i + 1, 'Open redirect: DOM assignment to <meta>.content with a ' +
+                        'meta-refresh URL built from a URL query/hash without ' +
+                        'allow-list validation. Validate origin before navigating.', trimmed);
+                    matched = true;
+                }
+            }
+        }
+        // (b) location.assign(...) / location.replace(...)
+        if (!matched) {
+            const callm = trimmed.match(callSinkRe);
+            if (callm) {
+                const arg = callm[1].trim();
+                if (!isLiteralOnly(arg) && containsTaint(arg) && !safeWrapRe.test(arg)) {
+                    emit(i + 1, 'Open redirect: location.assign / location.replace invoked ' +
+                        'with a value derived from a URL query/hash without allow-' +
+                        'list validation. Validate origin before navigating.', trimmed);
+                }
+            }
+        }
+    }
+    return out;
+}
 //# sourceMappingURL=language-sources-pass.js.map