circle-ir 3.131.0 → 3.133.0

package/dist/analysis/passes/language-sources-pass.js

@@ -215,6 +215,14 @@ export class LanguageSourcesPass {
             for (const finding of findGoXssFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 82 (#189): Go open_redirect — Header().Set("Location", taint).
+            for (const finding of findGoLocationHeaderOpenRedirectFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 83 (#189): Go code_injection — plugin.Open / plugin.Lookup.
+            for (const finding of findGoPluginOpenCodeInjectionFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Python: safe-handler sanitizer detectors (cognium-dev #114 Sprint 31) --
         if (language === 'python') {
@@ -244,6 +252,15 @@ export class LanguageSourcesPass {
             for (const finding of findPythonJinjaMarkupXssFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 82 (#189): Python open_redirect — resp.headers["Location"] = taint.
+            for (const finding of findPythonHeadersSubscriptOpenRedirectFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 83 (#189): Python code_injection — code.InteractiveInterpreter
+            // / InteractiveConsole / compile_command on Flask request input.
+            for (const finding of findPythonInteractiveInterpreterCodeInjectionFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Rust: safe-handler sanitizer detectors (cognium-dev #115 Sprint 31) --
         if (language === 'rust') {
@@ -273,6 +290,15 @@ export class LanguageSourcesPass {
             for (const finding of findRustWeakCryptoEcbFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 82 (#189): Rust open_redirect — append_header(("Location", taint)).
+            for (const finding of findRustAppendHeaderTupleOpenRedirectFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 83 (#189): Rust code_injection — evalexpr crate, libloading,
+            // mlua/rlua dynamic-load shapes on Actix/Axum request bodies.
+            for (const finding of findRustEvalCrateCodeInjectionFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- JavaScript/TypeScript: Sprint 73 (#216 Pattern A + B) — ETE
         // sanitizer-chain recognition (JSON.parse / bcrypt.hash / csv
@@ -300,6 +326,17 @@ export class LanguageSourcesPass {
             for (const finding of findTsAngularBypassXssFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 82 (#189): JS/HTML DOM open_redirect — location.href /
+            // window.location / location.assign|replace() / <meta>.content shapes
+            // sourced from URLSearchParams / location.search|hash.
+            for (const finding of findJsDomOpenRedirectFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 83 (#189): JS code_injection — indirect eval forms
+            // ((0, eval)(x), globalThis.eval(x), aliased eval).
+            for (const finding of findJsIndirectEvalCodeInjectionFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Java: Sprint 73 (#216 Pattern A) — Jackson readValue / Gson
         // fromJson recognized as ETE terminator (does not affect
@@ -4727,4 +4764,941 @@ export function findPythonJinjaMarkupXssFindings(code, file) {
     }
     return out;
 }
+/**
+ * Go open_redirect — `<rw>.Header().Set("Location", <expr>)` where
+ * `<rw>` is bound to `http.ResponseWriter`. The configured sink rows
+ * for `Header.Set` are typed `crlf` (CWE-113); the same line is also a
+ * CWE-601 open_redirect when the header key is exactly `"Location"`
+ * (case-insensitive). This pattern detector emits the open_redirect
+ * finding directly, complementing the engine's crlf classification.
+ *
+ * Sprint 82 (#189): closes go__v02_location_header.
+ *
+ * Conservative: only fires when the receiver matches a parameter typed
+ * `http.ResponseWriter` AND the literal key value is `Location` AND no
+ * recognized URL-allowlist sanitizer wraps the value argument.
+ */
+export function findGoLocationHeaderOpenRedirectFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const rwNames = new Set();
+    const sigRe = /\(\s*([A-Za-z_]\w*)\s+http\.ResponseWriter\b/g;
+    for (const line of lines) {
+        let m;
+        sigRe.lastIndex = 0;
+        while ((m = sigRe.exec(line)) !== null)
+            rwNames.add(m[1]);
+    }
+    if (rwNames.size === 0)
+        return out;
+    // Recognized URL-allowlist / strict-equality sanitizers. Conservative
+    // — keeps the FP set tight (Sprint 74 lesson). `url.Parse` alone is
+    // not a sanitizer; we require an `IsAbs`/`Host`/`==` check.
+    const safeWrapRe = /\b(?:net\/url|url)\.Parse\b[\s\S]{0,120}?\b(?:IsAbs|Host)\b|\bstrings\.HasPrefix\s*\(/;
+    // Match: `<rw>.Header().Set("Location", <expr>)` — also accept
+    // `Add` (header-stacking variant) which has the same redirect effect.
+    const callRe = /\b([A-Za-z_]\w*)\s*\.\s*Header\s*\(\s*\)\s*\.\s*(?:Set|Add)\s*\(\s*(['"])([^'"]+)\2\s*,\s*([\s\S]*)\)\s*(?:\/\/.*)?$/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        const m = trimmed.match(callRe);
+        if (!m)
+            continue;
+        const recv = m[1];
+        if (!rwNames.has(recv))
+            continue;
+        const key = m[3];
+        if (key.toLowerCase() !== 'location')
+            continue;
+        const valExpr = m[4];
+        // Skip when the value is a pure string literal (no taint shape).
+        const valTrim = valExpr.trim();
+        if (/^"(?:\\.|[^"\\])*"$/.test(valTrim))
+            continue;
+        if (safeWrapRe.test(valExpr))
+            continue;
+        out.push({
+            id: `open_redirect-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'open_redirect',
+            cwe: 'CWE-601',
+            severity: 'high',
+            level: 'error',
+            message: 'Open redirect: ResponseWriter.Header().Set("Location", ...) ' +
+                'writes a user-controlled value into the Location header without ' +
+                'validating the target. Restrict to an allow-list of hosts/paths ' +
+                'or compare against a known-safe set before issuing the redirect.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Python Flask open_redirect — `<resp>.headers["Location"] = <expr>`
+ * subscript-assignment shape. The engine's configured sinks for
+ * Flask `Response.headers` model the dict-add form but not subscript
+ * assignment, so the open_redirect signal is missed even though the
+ * source (`request.args.get`) is detected.
+ *
+ * Sprint 82 (#189): closes py__v02_location_header.
+ *
+ * Conservative: requires the rhs to be a recognized request-source
+ * variable OR an inline `request.<x>.get/[]` expression. Skips when
+ * the value is wrapped in a recognized URL-allowlist call.
+ */
+export function findPythonHeadersSubscriptOpenRedirectFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const requestSourceRe = /\b([A-Za-z_]\w*)\s*=\s*request\s*\.\s*(?:args|form|values|files|json|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/;
+    const taintedVars = new Set();
+    for (const line of lines) {
+        const m = line.match(requestSourceRe);
+        if (m)
+            taintedVars.add(m[1]);
+    }
+    // Recognized URL-allowlist sanitizers (tight, Sprint 74 lesson).
+    const safeWrapRe = /\b(?:urllib\.parse\.urlparse|urlparse)\s*\([\s\S]{0,120}?\bnetloc\b|\b(?:startswith)\s*\(/;
+    const subscriptRe = /\b([A-Za-z_]\w*)\s*\.\s*headers\s*\[\s*(['"])([^'"]+)\2\s*\]\s*=\s*(.+)$/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const m = trimmed.match(subscriptRe);
+        if (!m)
+            continue;
+        const key = m[3];
+        if (key.toLowerCase() !== 'location')
+            continue;
+        const rhs = m[4].replace(/\s*(?:#.*)?$/, '').trim();
+        // Skip pure string literal.
+        if (/^['"](?:\\.|[^'"\\])*['"]$/.test(rhs))
+            continue;
+        // Skip when wrapped in a recognized allowlist check.
+        if (safeWrapRe.test(rhs))
+            continue;
+        const hasTaintedVar = [...taintedVars].some(v => new RegExp(`\\b${v}\\b`).test(rhs));
+        const inlineSource = /\brequest\s*\.\s*(?:args|form|values|files|cookies|headers|json)(?:\s*\.\s*get\s*\(|\s*\[)/.test(rhs);
+        if (!hasTaintedVar && !inlineSource)
+            continue;
+        out.push({
+            id: `open_redirect-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'open_redirect',
+            cwe: 'CWE-601',
+            severity: 'high',
+            level: 'error',
+            message: 'Open redirect: response.headers["Location"] = ... assigns a ' +
+                'user-controlled value to the Location header. Validate the URL ' +
+                'against an allow-list of trusted hosts before sending.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Rust open_redirect — Actix/Rocket builder pattern
+ * `<builder>.append_header(("Location", <expr>))` or
+ * `.insert_header(("Location", <expr>))` where the value traces back
+ * to a `web::Query` / `web::Path` / `Form` extractor. The tuple-arg
+ * form is the idiomatic Actix HeaderName→HeaderValue API; the
+ * engine's configured sinks model single-arg `set_header(value)` but
+ * not the tuple builder shape.
+ *
+ * Sprint 82 (#189): closes rust__v01_redirect_param.
+ *
+ * Conservative: requires the function to accept a recognized
+ * `web::Query` / `web::Path` / `web::Form` / `HttpRequest` parameter
+ * and the value expression to reference it (directly, or transitively
+ * via a `.get(...)` / `.cloned()` / `.unwrap_or_default()` chain).
+ */
+export function findRustAppendHeaderTupleOpenRedirectFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    // Discover request-extractor parameter names.
+    const extractorRe = /\b([A-Za-z_]\w*)\s*:\s*(?:web\s*::\s*)?(?:Query|Path|Form|Json)\s*<|\b([A-Za-z_]\w*)\s*:\s*&?\s*HttpRequest\b/g;
+    const extractorParams = new Set();
+    for (const line of lines) {
+        let m;
+        extractorRe.lastIndex = 0;
+        while ((m = extractorRe.exec(line)) !== null) {
+            const name = m[1] ?? m[2];
+            if (name)
+                extractorParams.add(name);
+        }
+    }
+    if (extractorParams.size === 0)
+        return out;
+    // Build transitive tainted-let set: `let v = <expr>` where <expr>
+    // references an extractor param or a previously tainted var.
+    const taintedVars = new Set(extractorParams);
+    const letRe = /\blet\s+(?:mut\s+)?([A-Za-z_]\w*)\s*(?::[^=]+)?=\s*([^;]+);/g;
+    for (let pass = 0; pass < 4; pass++) {
+        const before = taintedVars.size;
+        let lm;
+        letRe.lastIndex = 0;
+        while ((lm = letRe.exec(code)) !== null) {
+            const name = lm[1];
+            const rhs = lm[2];
+            if (taintedVars.has(name))
+                continue;
+            for (const tv of taintedVars) {
+                if (new RegExp(`\\b${tv}\\b`).test(rhs)) {
+                    taintedVars.add(name);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    const safeWrapRe = /\b(?:Url\s*::\s*parse|url\s*::\s*Url\s*::\s*parse)\s*\([\s\S]{0,160}?\b(?:host_str|host|origin)\b/;
+    const tupleCallRe = /\.\s*(?:append_header|insert_header)\s*\(\s*\(\s*(['"])([^'"]+)\1\s*,\s*([^)]*?)\s*\)\s*\)/g;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        let cm;
+        tupleCallRe.lastIndex = 0;
+        while ((cm = tupleCallRe.exec(raw)) !== null) {
+            const key = cm[2];
+            if (key.toLowerCase() !== 'location')
+                continue;
+            const valExpr = cm[3];
+            if (/^['"](?:\\.|[^'"\\])*['"]$/.test(valExpr.trim()))
+                continue;
+            if (safeWrapRe.test(valExpr))
+                continue;
+            const hasTainted = [...taintedVars].some(v => new RegExp(`\\b${v}\\b`).test(valExpr));
+            if (!hasTainted)
+                continue;
+            out.push({
+                id: `open_redirect-${file}-${i + 1}`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'open_redirect',
+                cwe: 'CWE-601',
+                severity: 'high',
+                level: 'error',
+                message: 'Open redirect: HttpResponse builder ' +
+                    '.append_header(("Location", ...)) sets the Location header from ' +
+                    'a request-derived value without allow-list validation. Parse ' +
+                    'with url::Url::parse and compare host_str against an allow-list.',
+                file,
+                line: i + 1,
+                snippet: trimmed.substring(0, 100),
+            });
+            break;
+        }
+    }
+    return out;
+}
+/**
+ * JS/HTML DOM open_redirect — assignment / call patterns that drive
+ * `location.href`, `window.location`, `document.location`,
+ * `location.assign(...)`, `location.replace(...)`, or `<elem>.content
+ * = '...;url=' + ...` (meta-refresh DOM shape) where the right-hand
+ * side traces back to a DOM source (`location.search`,
+ * `location.hash`, `URLSearchParams.get(...)`, `document.referrer`,
+ * `window.name`).
+ *
+ * Sprint 82 (#189): closes html__v01_redirect_param,
+ * html__v03_meta_refresh, htmljs__v03_meta_refresh.
+ *
+ * Conservative: only fires when the rhs expression contains (or
+ * references a var that contains) a recognized DOM source token;
+ * never fires on literal-only assignments.
+ */
+export function findJsDomOpenRedirectFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    // DOM source pattern — direct references to user-controlled URL
+    // pieces. `document.referrer` / `window.name` round out the common
+    // taint sources beyond URLSearchParams.
+    const domSourceRe = /\blocation\s*\.\s*(?:search|hash|href|pathname)\b|\bwindow\s*\.\s*location\s*\.\s*(?:search|hash|href|pathname)\b|\bURLSearchParams\b|\bdocument\s*\.\s*(?:referrer|URL|location\s*\.\s*(?:search|hash|href|pathname))\b|\bwindow\s*\.\s*name\b/;
+    // Transitive tainted variable set: `const x = <DOM source ...>`,
+    // then `const y = x.get(...)`, etc.
+    const taintedVars = new Set();
+    const assignRe = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+    let am;
+    assignRe.lastIndex = 0;
+    while ((am = assignRe.exec(code)) !== null) {
+        if (domSourceRe.test(am[2]))
+            taintedVars.add(am[1]);
+    }
+    for (let pass = 0; pass < 4; pass++) {
+        const before = taintedVars.size;
+        assignRe.lastIndex = 0;
+        while ((am = assignRe.exec(code)) !== null) {
+            if (taintedVars.has(am[1]))
+                continue;
+            for (const tv of taintedVars) {
+                if (new RegExp(`\\b${tv}\\b`).test(am[2])) {
+                    taintedVars.add(am[1]);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    // Recognized sanitizers (tight): explicit allow-list check against a
+    // known set / startsWith on a same-origin literal prefix.
+    const safeWrapRe = /\b(?:startsWith|includes)\s*\(\s*['"`]\/[^'"`]*['"`]\s*\)|\bnew\s+URL\s*\([\s\S]{0,80}?\)\s*\.\s*(?:origin|hostname)\s*===/;
+    const containsTaint = (expr) => {
+        if (domSourceRe.test(expr))
+            return true;
+        for (const tv of taintedVars) {
+            if (new RegExp(`\\b${tv}\\b`).test(expr))
+                return true;
+        }
+        return false;
+    };
+    // Sink shape (a1): `[<X>.]location.href = <expr>`.
+    const hrefSinkRe = /\b(?:(?:window|document|self|top|parent)\s*\.\s*)?location\s*\.\s*href\s*=\s*([^;\n]+?)\s*;?\s*(?:\/\/.*)?$/;
+    // Sink shape (a2): `window.location = <expr>` etc.
+    const locSinkRe = /\b(?:window|document|self|top|parent)\s*\.\s*location\s*=\s*([^;\n]+?)\s*;?\s*(?:\/\/.*)?$/;
+    // Sink shape (a3): `<elem>.content = <expr>` — only counts when the
+    // rhs looks like a meta-refresh string (`'...url=' + ...`). Allow `;`
+    // inside string literals on the rhs (meta-refresh format is
+    // `'<delay>;url=<...>'`), so match up to newline then trim trailing
+    // semicolon/comment manually.
+    const contentSinkRe = /\.\s*content\s*=\s*([^\n]+?)\s*$/;
+    // Sink shape (b): `[<X>.]location.assign(<expr>)` /
+    // `[<X>.]location.replace(<expr>)`.
+    const callSinkRe = /\b(?:(?:window|document|self|top|parent)\s*\.\s*)?location\s*\.\s*(?:assign|replace)\s*\(\s*([^)]+)\)/;
+    const emit = (line, msg, snippet) => {
+        out.push({
+            id: `open_redirect-${file}-${line}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'open_redirect',
+            cwe: 'CWE-601',
+            severity: 'high',
+            level: 'error',
+            message: msg,
+            file,
+            line,
+            snippet: snippet.substring(0, 100),
+        });
+    };
+    const isLiteralOnly = (expr) => /^['"`](?:\\.|[^'"`\\])*['"`]$/.test(expr.trim());
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        let matched = false;
+        // (a1) location.href = ...
+        const hm = trimmed.match(hrefSinkRe);
+        if (hm) {
+            const rhs = hm[1].trim();
+            if (!isLiteralOnly(rhs) && containsTaint(rhs) && !safeWrapRe.test(rhs)) {
+                emit(i + 1, 'Open redirect: assignment to location.href uses a value ' +
+                    'derived from a URL query/hash without allow-list validation. ' +
+                    'Compare the target origin to a known-safe set before navigating.', trimmed);
+                matched = true;
+            }
+        }
+        // (a2) window.location = ... (skip if already matched as href)
+        if (!matched) {
+            const lm = trimmed.match(locSinkRe);
+            if (lm) {
+                const rhs = lm[1].trim();
+                if (!isLiteralOnly(rhs) && containsTaint(rhs) && !safeWrapRe.test(rhs)) {
+                    emit(i + 1, 'Open redirect: assignment to window.location uses a value ' +
+                        'derived from a URL query/hash without allow-list validation. ' +
+                        'Compare the target origin to a known-safe set before navigating.', trimmed);
+                    matched = true;
+                }
+            }
+        }
+        // (a3) <elem>.content = '...url=' + ... (meta-refresh DOM shape)
+        if (!matched) {
+            const cm = trimmed.match(contentSinkRe);
+            if (cm) {
+                // Strip trailing `;` and comment from captured rhs.
+                const rhs = cm[1].replace(/\s*\/\/.*$/, '').replace(/\s*;\s*$/, '').trim();
+                if (!isLiteralOnly(rhs) &&
+                    /['"`][^'"`]*\burl\s*=/i.test(rhs) &&
+                    containsTaint(rhs) &&
+                    !safeWrapRe.test(rhs)) {
+                    emit(i + 1, 'Open redirect: DOM assignment to <meta>.content with a ' +
+                        'meta-refresh URL built from a URL query/hash without ' +
+                        'allow-list validation. Validate origin before navigating.', trimmed);
+                    matched = true;
+                }
+            }
+        }
+        // (b) location.assign(...) / location.replace(...)
+        if (!matched) {
+            const callm = trimmed.match(callSinkRe);
+            if (callm) {
+                const arg = callm[1].trim();
+                if (!isLiteralOnly(arg) && containsTaint(arg) && !safeWrapRe.test(arg)) {
+                    emit(i + 1, 'Open redirect: location.assign / location.replace invoked ' +
+                        'with a value derived from a URL query/hash without allow-' +
+                        'list validation. Validate origin before navigating.', trimmed);
+                }
+            }
+        }
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Sprint 83 (issue #189 — code_injection cluster, 8 FN cells)
+// ---------------------------------------------------------------------------
+// Per-language pattern detectors that close 4 remaining code_injection FN
+// shapes that the configured-sink path does not cover:
+//   - Go plugin.Open / plugin.Lookup with *http.Request-derived path
+//   - JS indirect eval forms: (0, eval)(x), globalThis.eval(x), aliased eval
+//   - Python code.InteractiveInterpreter / InteractiveConsole / compile_command
+//   - Rust evalexpr crate, libloading dynamic load, mlua/rlua .load().exec
+// ---------------------------------------------------------------------------
+/**
+ * Sprint 83 detector A — Go `plugin.Open(<tainted>)` / `plugin.Lookup(...)`.
+ * Loading a Go plugin executes the loaded module's init() functions and
+ * makes its exported symbols callable, which is a code-injection sink
+ * equivalent to dynamic library loading. Fires when the path argument
+ * traces back to an `*http.Request` extractor (FormValue / URL.Query /
+ * PostFormValue / Header.Get / Cookie) within the same function.
+ */
+export function findGoPluginOpenCodeInjectionFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    if (!/\bplugin\s*\.\s*(?:Open|Lookup)\s*\(/.test(code))
+        return findings;
+    const lines = code.split('\n');
+    const reqExtractRe = /\b\w+\s*\.\s*(?:FormValue|PostFormValue|URL\.Query\(\)\.Get|Header\.Get|Cookie)\s*\(/;
+    const httpReqParamRe = /\*\s*http\.Request\b/;
+    const callRe = /\bplugin\s*\.\s*(?:Open|Lookup)\s*\(\s*([^)]*)\s*\)/;
+    const sinkLabel = (op) => op === 'Lookup'
+        ? 'Go plugin.Lookup'
+        : 'Go plugin.Open';
+    const funcs = [];
+    let cur = null;
+    for (let i = 0; i < lines.length; i++) {
+        const t = lines[i].trim();
+        if (/^func\b/.test(t)) {
+            if (cur) {
+                cur.end = i - 1;
+                funcs.push(cur);
+            }
+            cur = { start: i, end: lines.length - 1 };
+        }
+    }
+    if (cur)
+        funcs.push(cur);
+    for (const fn of funcs) {
+        const header = lines[fn.start];
+        if (!httpReqParamRe.test(header))
+            continue;
+        const taintedVars = new Set();
+        // Up to 3 passes: discover transitively-tainted vars from request extractors.
+        for (let pass = 0; pass < 3; pass++) {
+            const before = taintedVars.size;
+            for (let i = fn.start; i <= fn.end; i++) {
+                const line = lines[i];
+                const trimmed = line.trim();
+                const assignMatch = trimmed.match(/^(\w+)\s*(?::=|=)\s*(.+?)(?:\s*\/\/.*)?$/);
+                if (!assignMatch)
+                    continue;
+                const lhs = assignMatch[1];
+                const rhs = assignMatch[2];
+                if (taintedVars.has(lhs))
+                    continue;
+                if (reqExtractRe.test(rhs)) {
+                    taintedVars.add(lhs);
+                    continue;
+                }
+                // Aliasing existing taint
+                for (const v of taintedVars) {
+                    const re = new RegExp(`\\b${v}\\b`);
+                    if (re.test(rhs)) {
+                        taintedVars.add(lhs);
+                        break;
+                    }
+                }
+            }
+            if (taintedVars.size === before)
+                break;
+        }
+        if (taintedVars.size === 0)
+            continue;
+        for (let i = fn.start; i <= fn.end; i++) {
+            const line = lines[i];
+            const m = line.match(callRe);
+            if (!m)
+                continue;
+            const arg = m[1].trim();
+            if (arg.length === 0)
+                continue;
+            // skip clear literal-only constants
+            if (/^"[^"]*"$/.test(arg))
+                continue;
+            let tainted = false;
+            // direct extractor call as argument
+            if (reqExtractRe.test(arg))
+                tainted = true;
+            else {
+                for (const v of taintedVars) {
+                    const re = new RegExp(`\\b${v}\\b`);
+                    if (re.test(arg)) {
+                        tainted = true;
+                        break;
+                    }
+                }
+            }
+            if (!tainted)
+                continue;
+            const op = /\bplugin\s*\.\s*Lookup\b/.test(line) ? 'Lookup' : 'Open';
+            findings.push({
+                id: `code_injection-${file}-${i + 1}-go-plugin-${op.toLowerCase()}`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'code_injection',
+                cwe: 'CWE-94',
+                severity: 'critical',
+                level: 'error',
+                message: `Code injection: ${sinkLabel(op)} called with a path/symbol derived ` +
+                    'from an *http.Request without an allow-list. Loading a plugin ' +
+                    'runs its init() and exposes arbitrary exported symbols. Restrict ' +
+                    'the path to a trusted directory or use a fixed allow-list.',
+                file,
+                line: i + 1,
+                snippet: line.trim(),
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Sprint 83 detector B — JS indirect eval forms.
+ * Configured `eval` sink matches direct `eval(x)` but misses:
+ *   - `(0, eval)(x)` comma-operator indirect call
+ *   - `globalThis.eval(x)` / `global.eval(x)` / `window.eval(x)` / `self.eval(x)`
+ *   - aliased eval: `const f = eval; f(x)` then `f(taint)`
+ * Fires when the argument traces back to req.body / req.query / req.params /
+ * req.headers / req.cookies (Express/Koa-style request extractor).
+ */
+export function findJsIndirectEvalCodeInjectionFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    if (!/\beval\b/.test(code))
+        return findings;
+    const lines = code.split('\n');
+    // request extractor (assignment rhs)
+    const reqExtractRe = /\breq(?:uest)?\s*\.\s*(?:body|query|params|headers|cookies)\b/;
+    // First: discover indirect-eval aliases: `const f = eval;`, `let f = eval`
+    const aliasRe = /^\s*(?:const|let|var)\s+(\w+)\s*=\s*(?:globalThis\s*\.\s*eval|global\s*\.\s*eval|window\s*\.\s*eval|self\s*\.\s*eval|eval)\s*;?\s*$/;
+    const aliases = new Set();
+    for (const line of lines) {
+        const m = line.match(aliasRe);
+        if (m)
+            aliases.add(m[1]);
+    }
+    // Discover transitively-tainted vars
+    const taintedVars = new Set();
+    const assignRe = /^\s*(?:const|let|var)\s+(\w+)\s*=\s*(.+?);?\s*$/;
+    const reassignRe = /^\s*(\w+)\s*=\s*(.+?);?\s*$/;
+    for (let pass = 0; pass < 3; pass++) {
+        const before = taintedVars.size;
+        for (const line of lines) {
+            const m = line.match(assignRe) || line.match(reassignRe);
+            if (!m)
+                continue;
+            const lhs = m[1];
+            const rhs = m[2];
+            if (taintedVars.has(lhs))
+                continue;
+            if (lhs === 'const' || lhs === 'let' || lhs === 'var')
+                continue;
+            if (reqExtractRe.test(rhs)) {
+                taintedVars.add(lhs);
+                continue;
+            }
+            for (const v of taintedVars) {
+                const re = new RegExp(`\\b${v}\\b`);
+                if (re.test(rhs)) {
+                    taintedVars.add(lhs);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    // Patterns: (0, eval)(x); globalThis.eval(x); aliased f(x)
+    const indirectCommaRe = /\(\s*0\s*,\s*eval\s*\)\s*\(\s*([^)]*)\s*\)/;
+    const indirectMemberRe = /\b(?:globalThis|global|window|self)\s*\.\s*eval\s*\(\s*([^)]*)\s*\)/;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const trimmed = line.trim();
+        // skip comment lines and alias-declaration lines themselves
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        if (aliasRe.test(line))
+            continue;
+        let arg = null;
+        let formLabel = '';
+        let m = trimmed.match(indirectCommaRe);
+        if (m) {
+            arg = m[1].trim();
+            formLabel = '(0, eval)(...) indirect eval';
+        }
+        if (!arg) {
+            m = trimmed.match(indirectMemberRe);
+            if (m) {
+                arg = m[1].trim();
+                formLabel = 'globalThis.eval / window.eval / self.eval indirect eval';
+            }
+        }
+        if (!arg && aliases.size > 0) {
+            for (const a of aliases) {
+                const aliasCallRe = new RegExp(`\\b${a}\\s*\\(\\s*([^)]*)\\s*\\)`);
+                const mm = trimmed.match(aliasCallRe);
+                if (mm) {
+                    arg = mm[1].trim();
+                    formLabel = `aliased eval reference \`${a}(...)\``;
+                    break;
+                }
+            }
+        }
+        if (arg === null)
+            continue;
+        if (arg.length === 0)
+            continue;
+        // skip literal-only string args
+        if (/^['"`][^'"`]*['"`]$/.test(arg))
+            continue;
+        let tainted = false;
+        if (reqExtractRe.test(arg))
+            tainted = true;
+        else {
+            for (const v of taintedVars) {
+                const re = new RegExp(`\\b${v}\\b`);
+                if (re.test(arg)) {
+                    tainted = true;
+                    break;
+                }
+            }
+        }
+        if (!tainted)
+            continue;
+        findings.push({
+            id: `code_injection-${file}-${i + 1}-js-indirect-eval`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'code_injection',
+            cwe: 'CWE-94',
+            severity: 'critical',
+            level: 'error',
+            message: `Code injection: ${formLabel} called with a value derived from ` +
+                'an HTTP request body/query/headers. Indirect eval forms still ' +
+                'execute arbitrary code in the global scope. Remove the eval and ' +
+                'parse the input with a safe data parser instead.',
+            file,
+            line: i + 1,
+            snippet: trimmed,
+        });
+    }
+    return findings;
+}
+/**
+ * Sprint 83 detector C — Python `code` stdlib REPL / compile_command.
+ * `code.InteractiveInterpreter().runsource(s)`, `runcode(c)`, `push(line)` and
+ * `code.InteractiveConsole().push(line)`, plus `code.compile_command(s)` —
+ * all execute or compile arbitrary Python source. Fires when the argument
+ * traces back to a Flask `request.*` extractor; gated on `import code`
+ * to avoid colliding with user-defined `code` variables.
+ */
+export function findPythonInteractiveInterpreterCodeInjectionFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    // Require `import code` namespace gate to avoid clashing with user-defined
+    // identifiers named `code`.
+    if (!/^\s*import\s+code\b/m.test(code))
+        return findings;
+    if (!/\bcode\s*\.\s*(?:InteractiveInterpreter|InteractiveConsole|compile_command)\b/.test(code)) {
+        return findings;
+    }
+    const lines = code.split('\n');
+    const reqExtractRe = /\brequest\s*\.\s*(?:args|form|values|files|json|cookies|headers|get_data|get_json)\b/;
+    // Discover transitively-tainted vars
+    const taintedVars = new Set();
+    const assignRe = /^\s*(\w+)\s*=\s*(.+?)\s*(?:#.*)?$/;
+    for (let pass = 0; pass < 3; pass++) {
+        const before = taintedVars.size;
+        for (const line of lines) {
+            const m = line.match(assignRe);
+            if (!m)
+                continue;
+            const lhs = m[1];
+            const rhs = m[2];
+            if (taintedVars.has(lhs))
+                continue;
+            if (reqExtractRe.test(rhs)) {
+                taintedVars.add(lhs);
+                continue;
+            }
+            for (const v of taintedVars) {
+                const re = new RegExp(`\\b${v}\\b`);
+                if (re.test(rhs)) {
+                    taintedVars.add(lhs);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    // Sink call patterns
+    // a) code.InteractiveInterpreter(...).{runsource,runcode,push}(arg)
+    // b) code.InteractiveConsole(...).{runsource,runcode,push,interact}(arg)
+    // c) code.compile_command(arg, ...)
+    const callRe = /\bcode\s*\.\s*(?:InteractiveInterpreter|InteractiveConsole)\s*\([^)]*\)\s*\.\s*(runsource|runcode|push|interact)\s*\(\s*([^),]+)/;
+    const compileRe = /\bcode\s*\.\s*compile_command\s*\(\s*([^),]+)/;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const trimmed = line.trim();
+        let arg = null;
+        let formLabel = '';
+        const m1 = trimmed.match(callRe);
+        if (m1) {
+            arg = m1[2].trim();
+            formLabel = `code.${/Interpreter/.test(trimmed) ? 'InteractiveInterpreter' : 'InteractiveConsole'}().${m1[1]}`;
+        }
+        if (!arg) {
+            const m2 = trimmed.match(compileRe);
+            if (m2) {
+                arg = m2[1].trim();
+                formLabel = 'code.compile_command';
+            }
+        }
+        if (arg === null)
+            continue;
+        if (arg.length === 0)
+            continue;
+        if (/^['"][^'"]*['"]$/.test(arg))
+            continue;
+        let tainted = false;
+        if (reqExtractRe.test(arg))
+            tainted = true;
+        else {
+            for (const v of taintedVars) {
+                const re = new RegExp(`\\b${v}\\b`);
+                if (re.test(arg)) {
+                    tainted = true;
+                    break;
+                }
+            }
+        }
+        if (!tainted)
+            continue;
+        findings.push({
+            id: `code_injection-${file}-${i + 1}-py-interactive-interpreter`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'code_injection',
+            cwe: 'CWE-94',
+            severity: 'critical',
+            level: 'error',
+            message: `Code injection: ${formLabel}(...) called with a value derived from ` +
+                'a Flask request extractor. The Python `code` module compiles and ' +
+                'executes arbitrary source. Remove the call and validate input ' +
+                'against a fixed allow-list instead.',
+            file,
+            line: i + 1,
+            snippet: trimmed,
+        });
+    }
+    return findings;
+}
+/**
+ * Sprint 83 detector D — Rust eval-crate / dynamic-load sinks.
+ * Rust has no language-level eval; the canonical sinks are:
+ *   - `evalexpr::eval(...)` (and `_with_context|_boolean|_int|_float|_string|_tuple|_empty`)
+ *   - `libloading::Library::new(...)` (dynamic library load)
+ *   - `mlua::Lua::new().load(<src>).{exec,eval,call}(...)` / rlua equivalent
+ * Fires when the argument traces back to an Actix-web extractor: a plain
+ * `body: String|Bytes`, a `web::Query<T>` / `web::Path<T>` / `web::Form<T>` /
+ * `web::Json<T>` / `HttpRequest` param, or `axum::body::Bytes`/`String` etc.
+ */
+export function findRustEvalCrateCodeInjectionFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    if (!/\b(?:evalexpr\s*::\s*eval|libloading\s*::\s*Library\s*::\s*new|\.\s*load\s*\([^)]*\)\s*\.\s*(?:exec|eval|call))/.test(code)) {
+        return findings;
+    }
+    const lines = code.split('\n');
+    // Discover per-function tainted params: scan `fn ...(params)` headers and
+    // mark params with extractor types as tainted.
+    const extractorTypeRe = /:\s*(?:String|Bytes|bytes::Bytes|axum::body::Bytes|web::Query\b|web::Path\b|web::Form\b|web::Json\b|HttpRequest\b|actix_web::HttpRequest\b)/;
+    const fns = [];
+    let cur = null;
+    for (let i = 0; i < lines.length; i++) {
+        const t = lines[i];
+        if (/^\s*(?:pub\s+)?(?:async\s+)?fn\s+\w+\s*\(/.test(t)) {
+            if (cur) {
+                cur.end = i - 1;
+                fns.push(cur);
+            }
+            cur = { start: i, end: lines.length - 1, tainted: new Set() };
+            // collect param idents whose type matches extractor
+            const headerJoined = (() => {
+                let j = i;
+                let s = '';
+                while (j < lines.length && !/\{\s*$/.test(s)) {
+                    s += lines[j];
+                    if (/\{\s*$/.test(lines[j]))
+                        break;
+                    j++;
+                    if (j - i > 12)
+                        break;
+                }
+                return s;
+            })();
+            // params are between first '(' and matching ')'
+            const open = headerJoined.indexOf('(');
+            const close = headerJoined.lastIndexOf(')');
+            if (open !== -1 && close > open) {
+                const params = headerJoined.substring(open + 1, close);
+                // Split by top-level commas
+                let depth = 0;
+                let buf = '';
+                const parts = [];
+                for (const ch of params) {
+                    if (ch === '<' || ch === '(')
+                        depth++;
+                    else if (ch === '>' || ch === ')')
+                        depth--;
+                    if (ch === ',' && depth === 0) {
+                        parts.push(buf);
+                        buf = '';
+                        continue;
+                    }
+                    buf += ch;
+                }
+                if (buf.trim().length > 0)
+                    parts.push(buf);
+                for (const p of parts) {
+                    const pm = p.match(/(?:mut\s+)?(\w+)\s*:/);
+                    if (!pm)
+                        continue;
+                    if (extractorTypeRe.test(p))
+                        cur.tainted.add(pm[1]);
+                }
+            }
+        }
+    }
+    if (cur)
+        fns.push(cur);
+    // Inside each function, scan assignments (let / let mut) to propagate
+    // taint from existing tainted vars into new bindings.
+    for (const fn of fns) {
+        for (let pass = 0; pass < 3; pass++) {
+            const before = fn.tainted.size;
+            for (let i = fn.start; i <= fn.end; i++) {
+                const t = lines[i].trim();
+                const m = t.match(/^let\s+(?:mut\s+)?(\w+)\s*(?::\s*[^=]+)?=\s*(.+?);?$/);
+                if (!m)
+                    continue;
+                const lhs = m[1];
+                const rhs = m[2];
+                if (fn.tainted.has(lhs))
+                    continue;
+                for (const v of fn.tainted) {
+                    const re = new RegExp(`\\b${v}\\b`);
+                    if (re.test(rhs)) {
+                        fn.tainted.add(lhs);
+                        break;
+                    }
+                }
+            }
+            if (fn.tainted.size === before)
+                break;
+        }
+    }
+    const evalExprRe = /\bevalexpr\s*::\s*eval(?:_with_context|_boolean|_int|_float|_string|_tuple|_empty)?\s*\(\s*([^)]+)\s*\)/;
+    const libloadingRe = /\blibloading\s*::\s*Library\s*::\s*new\s*\(\s*([^)]+)\s*\)/;
+    const luaLoadRe = /\.\s*load\s*\(\s*([^)]+)\s*\)\s*\.\s*(?:exec|eval|call)\b/;
+    for (const fn of fns) {
+        if (fn.tainted.size === 0)
+            continue;
+        for (let i = fn.start; i <= fn.end; i++) {
+            const line = lines[i];
+            const trimmed = line.trim();
+            let arg = null;
+            let formLabel = '';
+            let m = trimmed.match(evalExprRe);
+            if (m) {
+                arg = m[1].trim();
+                formLabel = 'evalexpr::eval';
+            }
+            if (!arg) {
+                m = trimmed.match(libloadingRe);
+                if (m) {
+                    arg = m[1].trim();
+                    formLabel = 'libloading::Library::new';
+                }
+            }
+            if (!arg) {
+                m = trimmed.match(luaLoadRe);
+                if (m) {
+                    arg = m[1].trim();
+                    formLabel = 'mlua/rlua Lua::load().{exec|eval|call}';
+                }
+            }
+            if (arg === null)
+                continue;
+            if (arg.length === 0)
+                continue;
+            // unwrap leading '&' borrow
+            let unwrapped = arg.replace(/^&\s*/, '').trim();
+            if (/^"[^"]*"$/.test(unwrapped))
+                continue;
+            let tainted = false;
+            for (const v of fn.tainted) {
+                const re = new RegExp(`\\b${v}\\b`);
+                if (re.test(unwrapped)) {
+                    tainted = true;
+                    break;
+                }
+            }
+            if (!tainted)
+                continue;
+            findings.push({
+                id: `code_injection-${file}-${i + 1}-rust-eval-crate`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'code_injection',
+                cwe: 'CWE-94',
+                severity: 'critical',
+                level: 'error',
+                message: `Code injection: ${formLabel}(...) called with a value derived ` +
+                    'from an HTTP request extractor (body / Query / Path / Form / ' +
+                    'Json / HttpRequest). The expression / library / Lua chunk is ' +
+                    'executed as code. Remove the dynamic-eval path or restrict ' +
+                    'input to a fixed allow-list.',
+                file,
+                line: i + 1,
+                snippet: trimmed,
+            });
+        }
+    }
+    return findings;
+}
 //# sourceMappingURL=language-sources-pass.js.map