circle-ir 3.129.0 → 3.132.0

package/dist/browser/circle-ir.js

@@ -11732,8 +11732,10 @@ var DEFAULT_SINKS = [
   { method: "newTransformer", class: "TransformerFactory", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
   { method: "transform", class: "Transformer", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
   // SSRF - Server-Side Request Forgery (CWE-918) and Open Redirect (CWE-601)
-  { method: "sendRedirect", class: "HttpServletResponse", type: "ssrf", cwe: "CWE-601", severity: "high", arg_positions: [0] },
-  { method: "sendRedirect", type: "ssrf", cwe: "CWE-601", severity: "high", arg_positions: [0] },
+  // Sprint 82 (#189): HttpServletResponse.sendRedirect is CWE-601 / open_redirect,
+  // not ssrf. Re-typing so manifest sink_type='open_redirect' matches.
+  { method: "sendRedirect", class: "HttpServletResponse", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
+  { method: "sendRedirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
   { method: "openConnection", class: "URL", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
   { method: "openStream", class: "URL", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
   // NOTE: URL/URI constructors removed — constructing a URL object doesn't make a network
@@ -14611,12 +14613,19 @@ function canSourceReachSink(sourceType, sinkType) {
     // splitting (CWE-113) — Sprint 6, issue #86.
     // mass_assignment added to http_body / http_param: Object.assign(user, req.body),
     // User(**request.form) — CWE-915.
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment"],
-    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment"],
-    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf"],
-    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf"],
-    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment"],
+    // open_redirect added to http_param/http_query/http_header/http_cookie/http_body/http_path
+    // Sprint 82 (#189): a user-controlled value reaching res.sendRedirect /
+    // res.redirect / Location header / append_header(("Location", x)) /
+    // Header().Set("Location", x) IS open_redirect (CWE-601). The reach map
+    // previously omitted open_redirect so the inline-colocation flow detector
+    // silently skipped all `http_* → open_redirect` co-located flows
+    // (java sendRedirect, JS res.redirect, Rust append_header tuple, etc.).
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect"],
+    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect"],
+    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect"],
+    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect"],
+    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect"],
     // ssrf added Sprint 57 #200: bash CGI/webhook handlers and scripts that
     // take a URL on stdin or as a positional CLI arg (`curl "$1"`,
     // `wget "$(read line)"`) and curl/wget it server-side are textbook SSRF
@@ -14630,8 +14639,8 @@ function canSourceReachSink(sourceType, sinkType) {
     network_input: ["sql_injection", "command_injection", "xss", "ssrf"],
     config_param: ["sql_injection", "command_injection", "path_traversal", "xss", "ssrf"],
     // Servlet init params
-    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment"],
-    // Cross-method taint
+    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect"],
+    // Cross-method taint; Sprint 82 (#189) — open_redirect added
     plugin_param: ["sql_injection", "command_injection", "path_traversal", "xss", "code_injection"]
     // Plugin/config parameters
   };
@@ -23654,6 +23663,15 @@ var LanguageSourcesPass = class {
       for (const finding of goMisconfigFindings) {
         ctx.addFinding(finding);
       }
+      for (const finding of findGoXssFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findGoLocationHeaderOpenRedirectFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python") {
       additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
@@ -23666,6 +23684,18 @@ var LanguageSourcesPass = class {
       for (const finding of pyMisconfigFindings) {
         ctx.addFinding(finding);
       }
+      for (const finding of findPythonFlaskStringConcatXssFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findPythonJinjaMarkupXssFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findPythonHeadersSubscriptOpenRedirectFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
@@ -23687,6 +23717,12 @@ var LanguageSourcesPass = class {
       for (const finding of findRustWeakCryptoEcbFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findRustAppendHeaderTupleOpenRedirectFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "javascript" || language === "typescript" || language === "htmljs") {
       additionalSanitizers.push(...findJsSafeJsonParseSanitizers(code));
@@ -23694,9 +23730,23 @@ var LanguageSourcesPass = class {
       additionalSanitizers.push(...findJsCsvFormulaPrefixSanitizers(code));
       additionalSanitizers.push(...findJsWrapperFunctionSanitizers(code));
       additionalSanitizers.push(...findJsSsrfAllowlistGuardSanitizers(code));
+      additionalSanitizers.push(...findJsArgvFormExecSanitizers(code));
+      additionalSanitizers.push(...findJsParameterizedSqlSanitizers(code));
       for (const finding of findJsPatternFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJsVueVHtmlXssFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findTsAngularBypassXssFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findJsDomOpenRedirectFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
@@ -23708,6 +23758,9 @@ var LanguageSourcesPass = class {
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJavaResponseWriterXssFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python" || language === "javascript" || language === "typescript" || language === "go") {
       const exfilFindings = findExternalSecretExfiltrationFindings(
@@ -25454,6 +25507,55 @@ function findJsSsrfAllowlistGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJsArgvFormExecSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const argvExecRe = /\b(?:execFile|spawn)(?:Sync)?\s*\(\s*(?:'[^']*'|"[^"]*"|`[^`]*`)\s*,\s*\[/;
+  const shellArgvRe = /\b(?:execFile|spawn)(?:Sync)?\s*\(\s*['"`](?:[\w./-]*\/)?(?:sh|bash|zsh|ksh|dash|cmd(?:\.exe)?|powershell|pwsh)['"`]\s*,\s*\[\s*['"`]-c['"`]/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const text = lines[i2];
+    if (!argvExecRe.test(text)) continue;
+    if (shellArgvRe.test(text)) continue;
+    sanitizers.push({
+      type: "js_argv_form_exec",
+      method: "execFile",
+      line: i2 + 1,
+      sanitizes: ["command_injection", "external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJsParameterizedSqlSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const singleRe = /\.\s*(?:query|execute)\s*\(\s*'([^'\\]*(?:\\.[^'\\]*)*)'\s*,\s*\[/;
+  const doubleRe = /\.\s*(?:query|execute)\s*\(\s*"([^"\\]*(?:\\.[^"\\]*)*)"\s*,\s*\[/;
+  const tickRe = /\.\s*(?:query|execute)\s*\(\s*`([^`]*)`\s*,\s*\[/;
+  const placeholderRe = /(?:\$\d+|\?)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const text = lines[i2];
+    let sql = null;
+    const s = singleRe.exec(text);
+    if (s) sql = s[1];
+    if (sql == null) {
+      const d = doubleRe.exec(text);
+      if (d) sql = d[1];
+    }
+    if (sql == null) {
+      const t = tickRe.exec(text);
+      if (t && !/\$\{/.test(t[1])) sql = t[1];
+    }
+    if (sql == null) continue;
+    if (!placeholderRe.test(sql)) continue;
+    sanitizers.push({
+      type: "js_parameterized_sql",
+      method: "query",
+      line: i2 + 1,
+      sanitizes: ["sql_injection", "external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
 function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -26212,6 +26314,612 @@ function findJsPatternFindings(code, file) {
   }
   return out2;
 }
+function findGoXssFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const rwNames = /* @__PURE__ */ new Set();
+  const sigRe = /\(\s*([A-Za-z_]\w*)\s+http\.ResponseWriter\b/g;
+  for (const line of lines) {
+    let m;
+    sigRe.lastIndex = 0;
+    while ((m = sigRe.exec(line)) !== null) rwNames.add(m[1]);
+  }
+  if (rwNames.size === 0) return out2;
+  const escaperRe = /\b(?:html|template)\.(?:EscapeString|HTMLEscapeString|HTMLEscaper|JSEscapeString|URLQueryEscaper)\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    const callRe = /\bfmt\.Fprint(?:f|ln)?\s*\(\s*([A-Za-z_]\w*)\s*,\s*([\s\S]*)\)\s*(?:\/\/.*)?$/;
+    const m = trimmed.match(callRe);
+    if (!m) continue;
+    if (!rwNames.has(m[1])) continue;
+    const tail = m[2];
+    if (escaperRe.test(tail)) continue;
+    if (!/[A-Za-z_]\w*/.test(tail.replace(/"[^"]*"|`[^`]*`/g, ""))) continue;
+    out2.push({
+      id: `xss-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xss",
+      cwe: "CWE-79",
+      severity: "high",
+      level: "error",
+      message: "Reflected XSS: fmt.Fprint writes data to http.ResponseWriter without HTML escaping. Wrap user-controlled args with html.EscapeString / template.HTMLEscapeString.",
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findJavaResponseWriterXssFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const respNames = /* @__PURE__ */ new Set();
+  const sigRe = /\bHttpServletResponse\s+([A-Za-z_]\w*)\b/g;
+  for (const line of lines) {
+    let m;
+    sigRe.lastIndex = 0;
+    while ((m = sigRe.exec(line)) !== null) respNames.add(m[1]);
+  }
+  if (respNames.size === 0) return out2;
+  const safeWrapRe = /\b(?:Encode\.(?:forHtml|forHtmlAttribute|forHtmlContent|forJavaScript)|StringEscapeUtils\.escape(?:Html3|Html4|EcmaScript|Xml)|HtmlUtils\.htmlEscape(?:Decimal|Hex)?|Escaper\.escapeHtml|HtmlEscapers\.(?:escapeHtml|htmlEscaper)|Encoder\.encodeForHTML(?:Attribute)?|Jsoup\.clean)\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+    const chainRe = /\b([A-Za-z_]\w*)\s*\.\s*getWriter\s*\(\s*\)\s*\.\s*(print|println|write|printf|format|append)\s*\(([\s\S]*)\)\s*;?\s*(?:\/\/.*)?$/;
+    const m = trimmed.match(chainRe);
+    if (!m) continue;
+    const recv = m[1];
+    if (!respNames.has(recv)) continue;
+    const args2 = m[3];
+    if (safeWrapRe.test(args2)) continue;
+    const argsTrim = args2.trim();
+    if (/^"(?:\\.|[^"\\])*"$/.test(argsTrim)) continue;
+    if (!/[A-Za-z_]\w*/.test(argsTrim)) continue;
+    out2.push({
+      id: `xss-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xss",
+      cwe: "CWE-79",
+      severity: "high",
+      level: "error",
+      message: "Reflected XSS: HttpServletResponse.getWriter()." + m[2] + "(...) writes data to the response without HTML escaping. Wrap user-controlled values with OWASP Encode.forHtml / StringEscapeUtils.escapeHtml4 / Jsoup.clean.",
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findJsVueVHtmlXssFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const sourceRe = /\b(?:URLSearchParams|location\s*\.\s*(?:search|hash|href|pathname)|window\s*\.\s*location|route\s*\.\s*(?:query|params)|router\s*\.\s*(?:currentRoute|query)|\$route\s*\.\s*(?:query|params)|fetch\s*\(|axios\s*\.\s*(?:get|post)|XMLHttpRequest|document\s*\.\s*location)\b/;
+  const tplRe = /\btemplate\s*:\s*(['"`])([\s\S]*?)\1/g;
+  let tm;
+  const boundVars = /* @__PURE__ */ new Set();
+  while ((tm = tplRe.exec(code)) !== null) {
+    const tpl = tm[2];
+    const vhRe = /\bv-html\s*=\s*"([^"]+)"/g;
+    let vm;
+    while ((vm = vhRe.exec(tpl)) !== null) {
+      const expr = vm[1].trim();
+      const idMatch = expr.match(/^([A-Za-z_$][\w$]*)/);
+      if (idMatch) boundVars.add(idMatch[1]);
+    }
+  }
+  if (boundVars.size === 0) return out2;
+  const taintedSet = /* @__PURE__ */ new Set();
+  const assignRe = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+  let am;
+  assignRe.lastIndex = 0;
+  while ((am = assignRe.exec(code)) !== null) {
+    if (sourceRe.test(am[2])) taintedSet.add(am[1]);
+  }
+  for (let pass = 0; pass < 3; pass++) {
+    assignRe.lastIndex = 0;
+    const before = taintedSet.size;
+    while ((am = assignRe.exec(code)) !== null) {
+      if (taintedSet.has(am[1])) continue;
+      for (const tv of taintedSet) {
+        if (new RegExp(`\\b${tv}\\b`).test(am[2])) {
+          taintedSet.add(am[1]);
+          break;
+        }
+      }
+    }
+    if (taintedSet.size === before) break;
+  }
+  const taintedBindings = /* @__PURE__ */ new Set();
+  for (const v of boundVars) {
+    const bindRe = new RegExp(`\\b${v}\\s*[:=]\\s*([^,;\\n]+)`);
+    for (const line of lines) {
+      const m = line.match(bindRe);
+      if (!m) continue;
+      const val = m[1];
+      if (sourceRe.test(val)) {
+        taintedBindings.add(v);
+        break;
+      }
+      let found = false;
+      for (const tv of taintedSet) {
+        if (new RegExp(`\\b${tv}\\b`).test(val)) {
+          taintedBindings.add(v);
+          found = true;
+          break;
+        }
+      }
+      if (found) break;
+    }
+    const propsRe = new RegExp(
+      `\\bprops\\s*:\\s*\\[[^\\]]*['"\`]${v}['"\`][^\\]]*\\]`
+    );
+    if (propsRe.test(code)) taintedBindings.add(v);
+  }
+  if (taintedBindings.size === 0) return out2;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    if (!/v-html\s*=/.test(raw)) continue;
+    const vm = raw.match(/v-html\s*=\s*"([^"]+)"/);
+    if (!vm) continue;
+    const idMatch = vm[1].trim().match(/^([A-Za-z_$][\w$]*)/);
+    if (!idMatch || !taintedBindings.has(idMatch[1])) continue;
+    out2.push({
+      id: `xss-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xss",
+      cwe: "CWE-79",
+      severity: "high",
+      level: "error",
+      message: 'Vue v-html XSS: directive binds to "' + idMatch[1] + '" which is sourced from user-controlled input. Use {{ }} interpolation (auto-escapes) or sanitize the HTML with DOMPurify before binding.',
+      file,
+      line: i2 + 1,
+      snippet: raw.trim().substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findTsAngularBypassXssFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const sanitizerNames = /* @__PURE__ */ new Set();
+  const declRe = /\b(?:public|private|protected|readonly|\s)?\s*([A-Za-z_$][\w$]*)\s*:\s*DomSanitizer\b/g;
+  let m;
+  declRe.lastIndex = 0;
+  while ((m = declRe.exec(code)) !== null) sanitizerNames.add(m[1]);
+  if (sanitizerNames.size === 0) return out2;
+  const assignRe = /\bthis\s*\.\s*([A-Za-z_$][\w$]*)\s*=\s*([A-Za-z_$][\w$]*)\b/g;
+  let am;
+  assignRe.lastIndex = 0;
+  while ((am = assignRe.exec(code)) !== null) {
+    if (sanitizerNames.has(am[2])) sanitizerNames.add(am[1]);
+  }
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+    const callRe = /\b(?:this\s*\.\s*)?([A-Za-z_$][\w$]*)\s*\.\s*bypassSecurityTrust(Html|Script|Url|ResourceUrl|Style)\s*\(([\s\S]*?)\)/;
+    const cm = trimmed.match(callRe);
+    if (!cm) continue;
+    const recv = cm[1];
+    if (!sanitizerNames.has(recv)) continue;
+    const arg = cm[3].trim();
+    if (/^(['"`])[^'"`]*\1$/.test(arg)) continue;
+    out2.push({
+      id: `xss-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xss",
+      cwe: "CWE-79",
+      severity: "high",
+      level: "error",
+      message: "Angular XSS: DomSanitizer.bypassSecurityTrust" + cm[2] + "() opts out of Angular's built-in sanitization for a non-literal argument. Prefer leaving Angular's default sanitizer in place, or sanitize the input with DOMPurify before bypassing.",
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findPythonFlaskStringConcatXssFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const fns = [];
+  const defRe = /^(\s*)def\s+([A-Za-z_]\w*)\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const dm = raw.match(defRe);
+    if (!dm) continue;
+    const indent = dm[1].length;
+    let hasRoute = false;
+    for (let j = i2 - 1; j >= 0; j--) {
+      const prev = lines[j].trim();
+      if (prev === "" || prev.startsWith("#")) continue;
+      if (!prev.startsWith("@")) break;
+      if (/@\s*[A-Za-z_]\w*\s*\.\s*route\s*\(/.test(prev) || /@\s*route\s*\(/.test(prev)) {
+        hasRoute = true;
+      }
+    }
+    if (!hasRoute) continue;
+    let end = lines.length;
+    for (let k = i2 + 1; k < lines.length; k++) {
+      const ln = lines[k];
+      if (!ln.trim()) continue;
+      const ind = ln.match(/^(\s*)/)?.[1].length ?? 0;
+      if (ind <= indent) {
+        end = k;
+        break;
+      }
+    }
+    fns.push({ name: dm[2], startLine: i2 + 1, endLine: end });
+  }
+  if (fns.length === 0) return out2;
+  const requestSourceRe = /\b([A-Za-z_]\w*)\s*=\s*request\s*\.\s*(?:args|form|values|files|json|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/;
+  const escapeWrapRe = /\b(?:html\.escape|markupsafe\.escape|escape|markupsafe\.Markup\s*\.\s*escape|werkzeug\.utils\.escape)\s*\(/;
+  for (const fn of fns) {
+    const taintedVars = /* @__PURE__ */ new Set();
+    for (let li = fn.startLine; li < fn.endLine; li++) {
+      const raw = lines[li];
+      const rm = raw.match(requestSourceRe);
+      if (rm) taintedVars.add(rm[1]);
+    }
+    for (let li = fn.startLine; li < fn.endLine; li++) {
+      const raw = lines[li];
+      const trimmed = raw.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const retMatch = trimmed.match(/^(?:return|yield)\s+(.+)$/);
+      if (!retMatch) continue;
+      const expr = retMatch[1];
+      const inlineSource = /\brequest\s*\.\s*(?:args|form|values|files|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/.test(
+        expr
+      );
+      const hasTaintedVar = [...taintedVars].some(
+        (v) => new RegExp(`\\b${v}\\b`).test(expr)
+      );
+      if (!hasTaintedVar && !inlineSource) continue;
+      if (escapeWrapRe.test(expr)) continue;
+      const buildsHtml = /['"`]\s*\+/.test(expr) || /\+\s*['"`]/.test(expr) || // f-string with interpolation. Allow any non-`{` char between the
+      // opening quote and the first `{` (Python f-strings may embed `"`
+      // when single-quoted and vice-versa, e.g. f'<a href="{u}">').
+      /\bf['"`][^{\n]*\{[^}]+\}/.test(expr) || /['"`]\s*%\s*[^=]/.test(expr) || /['"`]\.\s*format\s*\(/.test(expr);
+      if (!buildsHtml) continue;
+      out2.push({
+        id: `xss-${file}-${li + 1}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "xss",
+        cwe: "CWE-79",
+        severity: "high",
+        level: "error",
+        message: "Reflected XSS: Flask route returns HTML built from request input via string concatenation / f-string / format. Wrap user input with markupsafe.escape() or render via a Jinja2 template (autoescape on by default).",
+        file,
+        line: li + 1,
+        snippet: trimmed.substring(0, 100)
+      });
+      break;
+    }
+  }
+  return out2;
+}
+function findPythonJinjaMarkupXssFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const importRe = /^\s*from\s+(?:markupsafe|flask)\s+import\s+(?:[^#\n]*\b)?Markup\b/m;
+  const classDefRe = /^\s*class\s+Markup\b/m;
+  if (!importRe.test(code)) return out2;
+  if (classDefRe.test(code)) return out2;
+  const requestSourceRe = /\b([A-Za-z_]\w*)\s*=\s*request\s*\.\s*(?:args|form|values|files|json|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    const m = line.match(requestSourceRe);
+    if (m) taintedVars.add(m[1]);
+  }
+  if (taintedVars.size === 0) return out2;
+  if (!/\.\s*render\s*\(/.test(code)) return out2;
+  const markupCallRe = /\bMarkup\s*\(\s*([A-Za-z_]\w*)\s*[,)]/g;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    let mm;
+    markupCallRe.lastIndex = 0;
+    while ((mm = markupCallRe.exec(trimmed)) !== null) {
+      const argName = mm[1];
+      if (!taintedVars.has(argName)) continue;
+      out2.push({
+        id: `xss-${file}-${i2 + 1}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "xss",
+        cwe: "CWE-79",
+        severity: "high",
+        level: "error",
+        message: "Jinja2 autoescape bypass: Markup(" + argName + ") wraps a request-derived value, disabling autoescape when rendered. Pass the raw value to render() and let Jinja2 auto-escape, or sanitize with bleach.clean first.",
+        file,
+        line: i2 + 1,
+        snippet: trimmed.substring(0, 100)
+      });
+      break;
+    }
+  }
+  return out2;
+}
+function findGoLocationHeaderOpenRedirectFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const rwNames = /* @__PURE__ */ new Set();
+  const sigRe = /\(\s*([A-Za-z_]\w*)\s+http\.ResponseWriter\b/g;
+  for (const line of lines) {
+    let m;
+    sigRe.lastIndex = 0;
+    while ((m = sigRe.exec(line)) !== null) rwNames.add(m[1]);
+  }
+  if (rwNames.size === 0) return out2;
+  const safeWrapRe = /\b(?:net\/url|url)\.Parse\b[\s\S]{0,120}?\b(?:IsAbs|Host)\b|\bstrings\.HasPrefix\s*\(/;
+  const callRe = /\b([A-Za-z_]\w*)\s*\.\s*Header\s*\(\s*\)\s*\.\s*(?:Set|Add)\s*\(\s*(['"])([^'"]+)\2\s*,\s*([\s\S]*)\)\s*(?:\/\/.*)?$/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    const m = trimmed.match(callRe);
+    if (!m) continue;
+    const recv = m[1];
+    if (!rwNames.has(recv)) continue;
+    const key = m[3];
+    if (key.toLowerCase() !== "location") continue;
+    const valExpr = m[4];
+    const valTrim = valExpr.trim();
+    if (/^"(?:\\.|[^"\\])*"$/.test(valTrim)) continue;
+    if (safeWrapRe.test(valExpr)) continue;
+    out2.push({
+      id: `open_redirect-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "open_redirect",
+      cwe: "CWE-601",
+      severity: "high",
+      level: "error",
+      message: 'Open redirect: ResponseWriter.Header().Set("Location", ...) writes a user-controlled value into the Location header without validating the target. Restrict to an allow-list of hosts/paths or compare against a known-safe set before issuing the redirect.',
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findPythonHeadersSubscriptOpenRedirectFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const requestSourceRe = /\b([A-Za-z_]\w*)\s*=\s*request\s*\.\s*(?:args|form|values|files|json|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    const m = line.match(requestSourceRe);
+    if (m) taintedVars.add(m[1]);
+  }
+  const safeWrapRe = /\b(?:urllib\.parse\.urlparse|urlparse)\s*\([\s\S]{0,120}?\bnetloc\b|\b(?:startswith)\s*\(/;
+  const subscriptRe = /\b([A-Za-z_]\w*)\s*\.\s*headers\s*\[\s*(['"])([^'"]+)\2\s*\]\s*=\s*(.+)$/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const m = trimmed.match(subscriptRe);
+    if (!m) continue;
+    const key = m[3];
+    if (key.toLowerCase() !== "location") continue;
+    const rhs = m[4].replace(/\s*(?:#.*)?$/, "").trim();
+    if (/^['"](?:\\.|[^'"\\])*['"]$/.test(rhs)) continue;
+    if (safeWrapRe.test(rhs)) continue;
+    const hasTaintedVar = [...taintedVars].some(
+      (v) => new RegExp(`\\b${v}\\b`).test(rhs)
+    );
+    const inlineSource = /\brequest\s*\.\s*(?:args|form|values|files|cookies|headers|json)(?:\s*\.\s*get\s*\(|\s*\[)/.test(
+      rhs
+    );
+    if (!hasTaintedVar && !inlineSource) continue;
+    out2.push({
+      id: `open_redirect-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "open_redirect",
+      cwe: "CWE-601",
+      severity: "high",
+      level: "error",
+      message: 'Open redirect: response.headers["Location"] = ... assigns a user-controlled value to the Location header. Validate the URL against an allow-list of trusted hosts before sending.',
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findRustAppendHeaderTupleOpenRedirectFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const extractorRe = /\b([A-Za-z_]\w*)\s*:\s*(?:web\s*::\s*)?(?:Query|Path|Form|Json)\s*<|\b([A-Za-z_]\w*)\s*:\s*&?\s*HttpRequest\b/g;
+  const extractorParams = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    let m;
+    extractorRe.lastIndex = 0;
+    while ((m = extractorRe.exec(line)) !== null) {
+      const name2 = m[1] ?? m[2];
+      if (name2) extractorParams.add(name2);
+    }
+  }
+  if (extractorParams.size === 0) return out2;
+  const taintedVars = new Set(extractorParams);
+  const letRe = /\blet\s+(?:mut\s+)?([A-Za-z_]\w*)\s*(?::[^=]+)?=\s*([^;]+);/g;
+  for (let pass = 0; pass < 4; pass++) {
+    const before = taintedVars.size;
+    let lm;
+    letRe.lastIndex = 0;
+    while ((lm = letRe.exec(code)) !== null) {
+      const name2 = lm[1];
+      const rhs = lm[2];
+      if (taintedVars.has(name2)) continue;
+      for (const tv of taintedVars) {
+        if (new RegExp(`\\b${tv}\\b`).test(rhs)) {
+          taintedVars.add(name2);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  const safeWrapRe = /\b(?:Url\s*::\s*parse|url\s*::\s*Url\s*::\s*parse)\s*\([\s\S]{0,160}?\b(?:host_str|host|origin)\b/;
+  const tupleCallRe = /\.\s*(?:append_header|insert_header)\s*\(\s*\(\s*(['"])([^'"]+)\1\s*,\s*([^)]*?)\s*\)\s*\)/g;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    let cm;
+    tupleCallRe.lastIndex = 0;
+    while ((cm = tupleCallRe.exec(raw)) !== null) {
+      const key = cm[2];
+      if (key.toLowerCase() !== "location") continue;
+      const valExpr = cm[3];
+      if (/^['"](?:\\.|[^'"\\])*['"]$/.test(valExpr.trim())) continue;
+      if (safeWrapRe.test(valExpr)) continue;
+      const hasTainted = [...taintedVars].some(
+        (v) => new RegExp(`\\b${v}\\b`).test(valExpr)
+      );
+      if (!hasTainted) continue;
+      out2.push({
+        id: `open_redirect-${file}-${i2 + 1}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "open_redirect",
+        cwe: "CWE-601",
+        severity: "high",
+        level: "error",
+        message: 'Open redirect: HttpResponse builder .append_header(("Location", ...)) sets the Location header from a request-derived value without allow-list validation. Parse with url::Url::parse and compare host_str against an allow-list.',
+        file,
+        line: i2 + 1,
+        snippet: trimmed.substring(0, 100)
+      });
+      break;
+    }
+  }
+  return out2;
+}
+function findJsDomOpenRedirectFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const domSourceRe = /\blocation\s*\.\s*(?:search|hash|href|pathname)\b|\bwindow\s*\.\s*location\s*\.\s*(?:search|hash|href|pathname)\b|\bURLSearchParams\b|\bdocument\s*\.\s*(?:referrer|URL|location\s*\.\s*(?:search|hash|href|pathname))\b|\bwindow\s*\.\s*name\b/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  const assignRe = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+  let am;
+  assignRe.lastIndex = 0;
+  while ((am = assignRe.exec(code)) !== null) {
+    if (domSourceRe.test(am[2])) taintedVars.add(am[1]);
+  }
+  for (let pass = 0; pass < 4; pass++) {
+    const before = taintedVars.size;
+    assignRe.lastIndex = 0;
+    while ((am = assignRe.exec(code)) !== null) {
+      if (taintedVars.has(am[1])) continue;
+      for (const tv of taintedVars) {
+        if (new RegExp(`\\b${tv}\\b`).test(am[2])) {
+          taintedVars.add(am[1]);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  const safeWrapRe = /\b(?:startsWith|includes)\s*\(\s*['"`]\/[^'"`]*['"`]\s*\)|\bnew\s+URL\s*\([\s\S]{0,80}?\)\s*\.\s*(?:origin|hostname)\s*===/;
+  const containsTaint = (expr) => {
+    if (domSourceRe.test(expr)) return true;
+    for (const tv of taintedVars) {
+      if (new RegExp(`\\b${tv}\\b`).test(expr)) return true;
+    }
+    return false;
+  };
+  const hrefSinkRe = /\b(?:(?:window|document|self|top|parent)\s*\.\s*)?location\s*\.\s*href\s*=\s*([^;\n]+?)\s*;?\s*(?:\/\/.*)?$/;
+  const locSinkRe = /\b(?:window|document|self|top|parent)\s*\.\s*location\s*=\s*([^;\n]+?)\s*;?\s*(?:\/\/.*)?$/;
+  const contentSinkRe = /\.\s*content\s*=\s*([^\n]+?)\s*$/;
+  const callSinkRe = /\b(?:(?:window|document|self|top|parent)\s*\.\s*)?location\s*\.\s*(?:assign|replace)\s*\(\s*([^)]+)\)/;
+  const emit = (line, msg, snippet) => {
+    out2.push({
+      id: `open_redirect-${file}-${line}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "open_redirect",
+      cwe: "CWE-601",
+      severity: "high",
+      level: "error",
+      message: msg,
+      file,
+      line,
+      snippet: snippet.substring(0, 100)
+    });
+  };
+  const isLiteralOnly = (expr) => /^['"`](?:\\.|[^'"`\\])*['"`]$/.test(expr.trim());
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    let matched = false;
+    const hm = trimmed.match(hrefSinkRe);
+    if (hm) {
+      const rhs = hm[1].trim();
+      if (!isLiteralOnly(rhs) && containsTaint(rhs) && !safeWrapRe.test(rhs)) {
+        emit(
+          i2 + 1,
+          "Open redirect: assignment to location.href uses a value derived from a URL query/hash without allow-list validation. Compare the target origin to a known-safe set before navigating.",
+          trimmed
+        );
+        matched = true;
+      }
+    }
+    if (!matched) {
+      const lm = trimmed.match(locSinkRe);
+      if (lm) {
+        const rhs = lm[1].trim();
+        if (!isLiteralOnly(rhs) && containsTaint(rhs) && !safeWrapRe.test(rhs)) {
+          emit(
+            i2 + 1,
+            "Open redirect: assignment to window.location uses a value derived from a URL query/hash without allow-list validation. Compare the target origin to a known-safe set before navigating.",
+            trimmed
+          );
+          matched = true;
+        }
+      }
+    }
+    if (!matched) {
+      const cm = trimmed.match(contentSinkRe);
+      if (cm) {
+        const rhs = cm[1].replace(/\s*\/\/.*$/, "").replace(/\s*;\s*$/, "").trim();
+        if (!isLiteralOnly(rhs) && /['"`][^'"`]*\burl\s*=/i.test(rhs) && containsTaint(rhs) && !safeWrapRe.test(rhs)) {
+          emit(
+            i2 + 1,
+            "Open redirect: DOM assignment to <meta>.content with a meta-refresh URL built from a URL query/hash without allow-list validation. Validate origin before navigating.",
+            trimmed
+          );
+          matched = true;
+        }
+      }
+    }
+    if (!matched) {
+      const callm = trimmed.match(callSinkRe);
+      if (callm) {
+        const arg = callm[1].trim();
+        if (!isLiteralOnly(arg) && containsTaint(arg) && !safeWrapRe.test(arg)) {
+          emit(
+            i2 + 1,
+            "Open redirect: location.assign / location.replace invoked with a value derived from a URL query/hash without allow-list validation. Validate origin before navigating.",
+            trimmed
+          );
+        }
+      }
+    }
+  }
+  return out2;
+}
 
 // src/analysis/passes/sink-filter-pass.ts
 var JS_XSS_SANITIZERS = [
@@ -27546,13 +28254,13 @@ var TaintPropagationPass = class {
     }));
     const arrayFlows = detectArrayElementFlows(calls, sources, sinks, constProp.taintedArrayElements, constProp.unreachableLines, types) ?? [];
     for (const f of arrayFlows) {
-      if (!flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line)) {
+      if (!flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type)) {
         flows.push(f);
       }
     }
     const collectionFlows = detectCollectionFlows(calls, sources, sinks, constProp.tainted, constProp.unreachableLines, ctx.code, types) ?? [];
     for (const f of collectionFlows) {
-      if (flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line)) continue;
+      if (flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type)) continue;
       const flowForCheck = {
         source: { line: f.source_line },
         sink: { line: f.sink_line },
@@ -27571,7 +28279,7 @@ var TaintPropagationPass = class {
     }
     const paramFlows = detectParameterSinkFlows(types, calls, sources, sinks, constProp.unreachableLines, constProp.tainted, ctx.code) ?? [];
     for (const f of paramFlows) {
-      if (!flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line)) {
+      if (!flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type)) {
         flows.push(f);
       }
     }
@@ -27961,7 +28669,7 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
           }
           const paramSource = methodParamSources.get(arg.variable);
           if (paramSource) {
-            const exists = flows.some((f) => f.source_line === paramSource.line && f.sink_line === sink.line);
+            const exists = flows.some((f) => f.source_line === paramSource.line && f.sink_line === sink.line && f.sink_type === sink.type);
             if (!exists) {
               if (typeof code === "string" && isReassignedToLiteralBetween(code, arg.variable, paramSource.line, sink.line)) {
                 continue;