circle-ir 3.132.0 → 3.134.0

package/dist/browser/circle-ir.js

@@ -23672,6 +23672,18 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findGoPluginOpenCodeInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findGoMongoNosqlInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python") {
       additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
@@ -23696,6 +23708,18 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findPythonInteractiveInterpreterCodeInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findPythonMongoengineWhereNosqlInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
@@ -23723,6 +23747,12 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findRustEvalCrateCodeInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "javascript" || language === "typescript" || language === "htmljs") {
       additionalSanitizers.push(...findJsSafeJsonParseSanitizers(code));
@@ -23747,6 +23777,12 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJsIndirectEvalCodeInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
@@ -23761,6 +23797,12 @@ var LanguageSourcesPass = class {
       for (const finding of findJavaResponseWriterXssFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJavaMongoNosqlInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python" || language === "javascript" || language === "typescript" || language === "go") {
       const exfilFindings = findExternalSecretExfiltrationFindings(
@@ -26920,6 +26962,650 @@ function findJsDomOpenRedirectFindings(code, file) {
   }
   return out2;
 }
+function findGoPluginOpenCodeInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\bplugin\s*\.\s*(?:Open|Lookup)\s*\(/.test(code)) return findings;
+  const lines = code.split("\n");
+  const reqExtractRe = /\b\w+\s*\.\s*(?:FormValue|PostFormValue|URL\.Query\(\)\.Get|Header\.Get|Cookie)\s*\(/;
+  const httpReqParamRe = /\*\s*http\.Request\b/;
+  const callRe = /\bplugin\s*\.\s*(?:Open|Lookup)\s*\(\s*([^)]*)\s*\)/;
+  const sinkLabel = (op) => op === "Lookup" ? "Go plugin.Lookup" : "Go plugin.Open";
+  const funcs = [];
+  let cur = null;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const t = lines[i2].trim();
+    if (/^func\b/.test(t)) {
+      if (cur) {
+        cur.end = i2 - 1;
+        funcs.push(cur);
+      }
+      cur = { start: i2, end: lines.length - 1 };
+    }
+  }
+  if (cur) funcs.push(cur);
+  for (const fn of funcs) {
+    const header = lines[fn.start];
+    if (!httpReqParamRe.test(header)) continue;
+    const taintedVars = /* @__PURE__ */ new Set();
+    for (let pass = 0; pass < 3; pass++) {
+      const before = taintedVars.size;
+      for (let i2 = fn.start; i2 <= fn.end; i2++) {
+        const line = lines[i2];
+        const trimmed = line.trim();
+        const assignMatch = trimmed.match(
+          /^(\w+)\s*(?::=|=)\s*(.+?)(?:\s*\/\/.*)?$/
+        );
+        if (!assignMatch) continue;
+        const lhs = assignMatch[1];
+        const rhs = assignMatch[2];
+        if (taintedVars.has(lhs)) continue;
+        if (reqExtractRe.test(rhs)) {
+          taintedVars.add(lhs);
+          continue;
+        }
+        for (const v of taintedVars) {
+          const re = new RegExp(`\\b${v}\\b`);
+          if (re.test(rhs)) {
+            taintedVars.add(lhs);
+            break;
+          }
+        }
+      }
+      if (taintedVars.size === before) break;
+    }
+    if (taintedVars.size === 0) continue;
+    for (let i2 = fn.start; i2 <= fn.end; i2++) {
+      const line = lines[i2];
+      const m = line.match(callRe);
+      if (!m) continue;
+      const arg = m[1].trim();
+      if (arg.length === 0) continue;
+      if (/^"[^"]*"$/.test(arg)) continue;
+      let tainted = false;
+      if (reqExtractRe.test(arg)) tainted = true;
+      else {
+        for (const v of taintedVars) {
+          const re = new RegExp(`\\b${v}\\b`);
+          if (re.test(arg)) {
+            tainted = true;
+            break;
+          }
+        }
+      }
+      if (!tainted) continue;
+      const op = /\bplugin\s*\.\s*Lookup\b/.test(line) ? "Lookup" : "Open";
+      findings.push({
+        id: `code_injection-${file}-${i2 + 1}-go-plugin-${op.toLowerCase()}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "code_injection",
+        cwe: "CWE-94",
+        severity: "critical",
+        level: "error",
+        message: `Code injection: ${sinkLabel(op)} called with a path/symbol derived from an *http.Request without an allow-list. Loading a plugin runs its init() and exposes arbitrary exported symbols. Restrict the path to a trusted directory or use a fixed allow-list.`,
+        file,
+        line: i2 + 1,
+        snippet: line.trim()
+      });
+    }
+  }
+  return findings;
+}
+function findJsIndirectEvalCodeInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\beval\b/.test(code)) return findings;
+  const lines = code.split("\n");
+  const reqExtractRe = /\breq(?:uest)?\s*\.\s*(?:body|query|params|headers|cookies)\b/;
+  const aliasRe = /^\s*(?:const|let|var)\s+(\w+)\s*=\s*(?:globalThis\s*\.\s*eval|global\s*\.\s*eval|window\s*\.\s*eval|self\s*\.\s*eval|eval)\s*;?\s*$/;
+  const aliases = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    const m = line.match(aliasRe);
+    if (m) aliases.add(m[1]);
+  }
+  const taintedVars = /* @__PURE__ */ new Set();
+  const assignRe = /^\s*(?:const|let|var)\s+(\w+)\s*=\s*(.+?);?\s*$/;
+  const reassignRe = /^\s*(\w+)\s*=\s*(.+?);?\s*$/;
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (const line of lines) {
+      const m = line.match(assignRe) || line.match(reassignRe);
+      if (!m) continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs)) continue;
+      if (lhs === "const" || lhs === "let" || lhs === "var") continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        const re = new RegExp(`\\b${v}\\b`);
+        if (re.test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  const indirectCommaRe = /\(\s*0\s*,\s*eval\s*\)\s*\(\s*([^)]*)\s*\)/;
+  const indirectMemberRe = /\b(?:globalThis|global|window|self)\s*\.\s*eval\s*\(\s*([^)]*)\s*\)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+    if (aliasRe.test(line)) continue;
+    let arg = null;
+    let formLabel = "";
+    let m = trimmed.match(indirectCommaRe);
+    if (m) {
+      arg = m[1].trim();
+      formLabel = "(0, eval)(...) indirect eval";
+    }
+    if (!arg) {
+      m = trimmed.match(indirectMemberRe);
+      if (m) {
+        arg = m[1].trim();
+        formLabel = "globalThis.eval / window.eval / self.eval indirect eval";
+      }
+    }
+    if (!arg && aliases.size > 0) {
+      for (const a of aliases) {
+        const aliasCallRe = new RegExp(`\\b${a}\\s*\\(\\s*([^)]*)\\s*\\)`);
+        const mm = trimmed.match(aliasCallRe);
+        if (mm) {
+          arg = mm[1].trim();
+          formLabel = `aliased eval reference \`${a}(...)\``;
+          break;
+        }
+      }
+    }
+    if (arg === null) continue;
+    if (arg.length === 0) continue;
+    if (/^['"`][^'"`]*['"`]$/.test(arg)) continue;
+    let tainted = false;
+    if (reqExtractRe.test(arg)) tainted = true;
+    else {
+      for (const v of taintedVars) {
+        const re = new RegExp(`\\b${v}\\b`);
+        if (re.test(arg)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted) continue;
+    findings.push({
+      id: `code_injection-${file}-${i2 + 1}-js-indirect-eval`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "code_injection",
+      cwe: "CWE-94",
+      severity: "critical",
+      level: "error",
+      message: `Code injection: ${formLabel} called with a value derived from an HTTP request body/query/headers. Indirect eval forms still execute arbitrary code in the global scope. Remove the eval and parse the input with a safe data parser instead.`,
+      file,
+      line: i2 + 1,
+      snippet: trimmed
+    });
+  }
+  return findings;
+}
+function findPythonInteractiveInterpreterCodeInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/^\s*import\s+code\b/m.test(code)) return findings;
+  if (!/\bcode\s*\.\s*(?:InteractiveInterpreter|InteractiveConsole|compile_command)\b/.test(
+    code
+  )) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const reqExtractRe = /\brequest\s*\.\s*(?:args|form|values|files|json|cookies|headers|get_data|get_json)\b/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  const assignRe = /^\s*(\w+)\s*=\s*(.+?)\s*(?:#.*)?$/;
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (const line of lines) {
+      const m = line.match(assignRe);
+      if (!m) continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        const re = new RegExp(`\\b${v}\\b`);
+        if (re.test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  const callRe = /\bcode\s*\.\s*(?:InteractiveInterpreter|InteractiveConsole)\s*\([^)]*\)\s*\.\s*(runsource|runcode|push|interact)\s*\(\s*([^),]+)/;
+  const compileRe = /\bcode\s*\.\s*compile_command\s*\(\s*([^),]+)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const trimmed = line.trim();
+    let arg = null;
+    let formLabel = "";
+    const m1 = trimmed.match(callRe);
+    if (m1) {
+      arg = m1[2].trim();
+      formLabel = `code.${/Interpreter/.test(trimmed) ? "InteractiveInterpreter" : "InteractiveConsole"}().${m1[1]}`;
+    }
+    if (!arg) {
+      const m2 = trimmed.match(compileRe);
+      if (m2) {
+        arg = m2[1].trim();
+        formLabel = "code.compile_command";
+      }
+    }
+    if (arg === null) continue;
+    if (arg.length === 0) continue;
+    if (/^['"][^'"]*['"]$/.test(arg)) continue;
+    let tainted = false;
+    if (reqExtractRe.test(arg)) tainted = true;
+    else {
+      for (const v of taintedVars) {
+        const re = new RegExp(`\\b${v}\\b`);
+        if (re.test(arg)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted) continue;
+    findings.push({
+      id: `code_injection-${file}-${i2 + 1}-py-interactive-interpreter`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "code_injection",
+      cwe: "CWE-94",
+      severity: "critical",
+      level: "error",
+      message: `Code injection: ${formLabel}(...) called with a value derived from a Flask request extractor. The Python \`code\` module compiles and executes arbitrary source. Remove the call and validate input against a fixed allow-list instead.`,
+      file,
+      line: i2 + 1,
+      snippet: trimmed
+    });
+  }
+  return findings;
+}
+function findRustEvalCrateCodeInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\b(?:evalexpr\s*::\s*eval|libloading\s*::\s*Library\s*::\s*new|\.\s*load\s*\([^)]*\)\s*\.\s*(?:exec|eval|call))/.test(
+    code
+  )) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const extractorTypeRe = /:\s*(?:String|Bytes|bytes::Bytes|axum::body::Bytes|web::Query\b|web::Path\b|web::Form\b|web::Json\b|HttpRequest\b|actix_web::HttpRequest\b)/;
+  const fns = [];
+  let cur = null;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const t = lines[i2];
+    if (/^\s*(?:pub\s+)?(?:async\s+)?fn\s+\w+\s*\(/.test(t)) {
+      if (cur) {
+        cur.end = i2 - 1;
+        fns.push(cur);
+      }
+      cur = { start: i2, end: lines.length - 1, tainted: /* @__PURE__ */ new Set() };
+      const headerJoined = (() => {
+        let j = i2;
+        let s = "";
+        while (j < lines.length && !/\{\s*$/.test(s)) {
+          s += lines[j];
+          if (/\{\s*$/.test(lines[j])) break;
+          j++;
+          if (j - i2 > 12) break;
+        }
+        return s;
+      })();
+      const open = headerJoined.indexOf("(");
+      const close = headerJoined.lastIndexOf(")");
+      if (open !== -1 && close > open) {
+        const params = headerJoined.substring(open + 1, close);
+        let depth = 0;
+        let buf = "";
+        const parts2 = [];
+        for (const ch of params) {
+          if (ch === "<" || ch === "(") depth++;
+          else if (ch === ">" || ch === ")") depth--;
+          if (ch === "," && depth === 0) {
+            parts2.push(buf);
+            buf = "";
+            continue;
+          }
+          buf += ch;
+        }
+        if (buf.trim().length > 0) parts2.push(buf);
+        for (const p of parts2) {
+          const pm = p.match(/(?:mut\s+)?(\w+)\s*:/);
+          if (!pm) continue;
+          if (extractorTypeRe.test(p)) cur.tainted.add(pm[1]);
+        }
+      }
+    }
+  }
+  if (cur) fns.push(cur);
+  for (const fn of fns) {
+    for (let pass = 0; pass < 3; pass++) {
+      const before = fn.tainted.size;
+      for (let i2 = fn.start; i2 <= fn.end; i2++) {
+        const t = lines[i2].trim();
+        const m = t.match(/^let\s+(?:mut\s+)?(\w+)\s*(?::\s*[^=]+)?=\s*(.+?);?$/);
+        if (!m) continue;
+        const lhs = m[1];
+        const rhs = m[2];
+        if (fn.tainted.has(lhs)) continue;
+        for (const v of fn.tainted) {
+          const re = new RegExp(`\\b${v}\\b`);
+          if (re.test(rhs)) {
+            fn.tainted.add(lhs);
+            break;
+          }
+        }
+      }
+      if (fn.tainted.size === before) break;
+    }
+  }
+  const evalExprRe = /\bevalexpr\s*::\s*eval(?:_with_context|_boolean|_int|_float|_string|_tuple|_empty)?\s*\(\s*([^)]+)\s*\)/;
+  const libloadingRe = /\blibloading\s*::\s*Library\s*::\s*new\s*\(\s*([^)]+)\s*\)/;
+  const luaLoadRe = /\.\s*load\s*\(\s*([^)]+)\s*\)\s*\.\s*(?:exec|eval|call)\b/;
+  for (const fn of fns) {
+    if (fn.tainted.size === 0) continue;
+    for (let i2 = fn.start; i2 <= fn.end; i2++) {
+      const line = lines[i2];
+      const trimmed = line.trim();
+      let arg = null;
+      let formLabel = "";
+      let m = trimmed.match(evalExprRe);
+      if (m) {
+        arg = m[1].trim();
+        formLabel = "evalexpr::eval";
+      }
+      if (!arg) {
+        m = trimmed.match(libloadingRe);
+        if (m) {
+          arg = m[1].trim();
+          formLabel = "libloading::Library::new";
+        }
+      }
+      if (!arg) {
+        m = trimmed.match(luaLoadRe);
+        if (m) {
+          arg = m[1].trim();
+          formLabel = "mlua/rlua Lua::load().{exec|eval|call}";
+        }
+      }
+      if (arg === null) continue;
+      if (arg.length === 0) continue;
+      let unwrapped = arg.replace(/^&\s*/, "").trim();
+      if (/^"[^"]*"$/.test(unwrapped)) continue;
+      let tainted = false;
+      for (const v of fn.tainted) {
+        const re = new RegExp(`\\b${v}\\b`);
+        if (re.test(unwrapped)) {
+          tainted = true;
+          break;
+        }
+      }
+      if (!tainted) continue;
+      findings.push({
+        id: `code_injection-${file}-${i2 + 1}-rust-eval-crate`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "code_injection",
+        cwe: "CWE-94",
+        severity: "critical",
+        level: "error",
+        message: `Code injection: ${formLabel}(...) called with a value derived from an HTTP request extractor (body / Query / Path / Form / Json / HttpRequest). The expression / library / Lua chunk is executed as code. Remove the dynamic-eval path or restrict input to a fixed allow-list.`,
+        file,
+        line: i2 + 1,
+        snippet: trimmed
+      });
+    }
+  }
+  return findings;
+}
+function findGoMongoNosqlInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/(\bbson\s*\.\s*[MDAE]\b|mongo-driver|\*\s*mongo\.Collection)/.test(code)) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const reqExtractRe = /\b\w+\s*\.\s*(?:FormValue|PostFormValue|URL\s*\.\s*Query\s*\(\s*\)\s*\.\s*Get|Header\s*\.\s*Get|Cookie)\s*\(/;
+  const httpReqParamRe = /\*\s*http\.Request\b/;
+  const opsAlt = "(?:FindOne|Find|InsertOne|InsertMany|UpdateOne|UpdateMany|DeleteOne|DeleteMany|FindOneAndUpdate|FindOneAndDelete|FindOneAndReplace|Aggregate)";
+  const callHeadRe = new RegExp(`\\.\\s*(${opsAlt})\\s*\\(`);
+  function extractBalanced(line, openIdx) {
+    let depth = 0;
+    for (let k = openIdx; k < line.length; k++) {
+      const ch = line[k];
+      if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) return line.substring(openIdx + 1, k);
+      }
+    }
+    return null;
+  }
+  const funcs = [];
+  let cur = null;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const t = lines[i2].trim();
+    if (/^func\b/.test(t)) {
+      if (cur) {
+        cur.end = i2 - 1;
+        funcs.push(cur);
+      }
+      cur = { start: i2, end: lines.length - 1 };
+    }
+  }
+  if (cur) funcs.push(cur);
+  for (const fn of funcs) {
+    const header = lines[fn.start];
+    if (!httpReqParamRe.test(header)) continue;
+    const taintedVars = /* @__PURE__ */ new Set();
+    for (let pass = 0; pass < 3; pass++) {
+      const before = taintedVars.size;
+      for (let i2 = fn.start; i2 <= fn.end; i2++) {
+        const trimmed = lines[i2].trim();
+        const assignMatch = trimmed.match(
+          /^(\w+)\s*(?::=|=)\s*(.+?)(?:\s*\/\/.*)?$/
+        );
+        if (!assignMatch) continue;
+        const lhs = assignMatch[1];
+        const rhs = assignMatch[2];
+        if (taintedVars.has(lhs)) continue;
+        if (reqExtractRe.test(rhs)) {
+          taintedVars.add(lhs);
+          continue;
+        }
+        for (const v of taintedVars) {
+          if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+            taintedVars.add(lhs);
+            break;
+          }
+        }
+      }
+      if (taintedVars.size === before) break;
+    }
+    if (taintedVars.size === 0) continue;
+    for (let i2 = fn.start; i2 <= fn.end; i2++) {
+      const line = lines[i2];
+      const m = callHeadRe.exec(line);
+      if (!m) continue;
+      const op = m[1];
+      const openIdx = m.index + m[0].length - 1;
+      const args2 = extractBalanced(line, openIdx);
+      if (args2 === null || args2.length === 0) continue;
+      let tainted = reqExtractRe.test(args2);
+      if (!tainted) {
+        for (const v of taintedVars) {
+          if (new RegExp(`\\b${v}\\b`).test(args2)) {
+            tainted = true;
+            break;
+          }
+        }
+      }
+      if (!tainted) continue;
+      findings.push({
+        id: `nosql_injection-${file}-${i2 + 1}-go-mongo-${op.toLowerCase()}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "nosql_injection",
+        cwe: "CWE-943",
+        severity: "critical",
+        level: "error",
+        message: `NoSQL injection: Go MongoDB driver \`${op}(...)\` called with a filter derived from *http.Request input. Untrusted values inside a \`bson.M\` / \`bson.D\` filter can be operator objects (e.g. \`{"$ne": null}\`) and bypass authentication/intent. Validate or coerce the value to a primitive before building the filter.`,
+        file,
+        line: i2 + 1,
+        snippet: line.trim()
+      });
+    }
+  }
+  return findings;
+}
+function findJavaMongoNosqlInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/(MongoCollection\b|com\.mongodb\b|\bFilters\b|\bnew\s+Document\s*\()/.test(code)) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const reqExtractRe = /\b\w+\s*\.\s*(?:getParameter|getParameterValues|getHeader|getHeaders|getCookies|getReader|getQueryString|getRequestURI|getInputStream|getPart|getParts)\s*\(/;
+  const opsAlt = "(?:find|findOne|findOneAndUpdate|findOneAndDelete|findOneAndReplace|insertOne|insertMany|updateOne|updateMany|deleteOne|deleteMany|replaceOne|aggregate|countDocuments|distinct)";
+  const callRe = new RegExp(`\\.\\s*(${opsAlt})\\s*\\(([\\s\\S]*?)\\)`);
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      const a = t.match(/^(?:final\s+)?(?:[\w<>?,\[\]]+\s+)?(\w+)\s*=\s*(.+?);?$/);
+      if (!a) continue;
+      const lhs = a[1];
+      const rhs = a[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  if (taintedVars.size === 0) return findings;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const m = line.match(callRe);
+    if (!m) continue;
+    const op = m[1];
+    const args2 = m[2];
+    if (args2.trim().length === 0) continue;
+    let tainted = reqExtractRe.test(args2);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(args2)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted) continue;
+    findings.push({
+      id: `nosql_injection-${file}-${i2 + 1}-java-mongo-${op.toLowerCase()}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "nosql_injection",
+      cwe: "CWE-943",
+      severity: "critical",
+      level: "error",
+      message: `NoSQL injection: Java Mongo driver \`${op}(...)\` called with a filter derived from servlet request input. Untrusted values can reach BSON operator positions and bypass intent. Validate the input type before constructing the filter (e.g. require String).`,
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findPythonMongoengineWhereNosqlInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/['"]\$where['"]/.test(code)) return findings;
+  const lines = code.split("\n");
+  const reqExtractRe = /\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)\b|flask\.request\b)/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("#")) continue;
+      const a = t.match(/^(\w+)\s*=\s*(.+?)$/);
+      if (!a) continue;
+      const lhs = a[1];
+      const rhs = a[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  const whereRe = /['"]\$where['"]\s*:\s*([^,}\n]+)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const m = line.match(whereRe);
+    if (!m) continue;
+    const valueExpr = m[1].trim();
+    if (/^"[^"]*"$/.test(valueExpr) || /^'[^']*'$/.test(valueExpr)) continue;
+    let tainted = reqExtractRe.test(valueExpr);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(valueExpr)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted) continue;
+    findings.push({
+      id: `nosql_injection-${file}-${i2 + 1}-py-mongoengine-where`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "nosql_injection",
+      cwe: "CWE-943",
+      severity: "critical",
+      level: "error",
+      message: 'NoSQL injection: mongoengine `__raw__={"$where": ...}` payload derived from HTTP request input. The `$where` operator evaluates JavaScript on the server; tainted string concatenation lets an attacker inject arbitrary JS. Replace `$where` with field-based operators or validate the input.',
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
 
 // src/analysis/passes/sink-filter-pass.ts
 var JS_XSS_SANITIZERS = [