circle-ir 3.133.0 → 3.135.0

package/dist/analysis/passes/language-sources-pass.d.ts

@@ -360,4 +360,43 @@ export declare function findPythonInteractiveInterpreterCodeInjectionFindings(co
  * `web::Json<T>` / `HttpRequest` param, or `axum::body::Bytes`/`String` etc.
  */
 export declare function findRustEvalCrateCodeInjectionFindings(code: string, file: string): SastFinding[];
+/**
+ * Sprint 84 detector A (#189) — Go MongoDB driver nosql_injection.
+ * The Go MongoDB driver call shape `coll.FindOne(ctx, bson.M{"k": <taint>})`
+ * (and siblings: Find / InsertOne / InsertMany / UpdateOne / UpdateMany /
+ * DeleteOne / DeleteMany / FindOneAndUpdate / FindOneAndDelete /
+ * FindOneAndReplace / Aggregate) is not modeled by configured sinks (those
+ * cover Node.js Mongo only). Fires when the filter argument (after `ctx`)
+ * references a value transitively derived from `*http.Request` extractors
+ * (URL.Query().Get / FormValue / PostFormValue / Header.Get / Cookie).
+ */
+export declare function findGoMongoNosqlInjectionFindings(code: string, file: string): SastFinding[];
+/**
+ * Sprint 84 detector B (#189) — Java Mongo driver nosql_injection.
+ * Mongo Java driver shape `users.find(eq("k", <taint>))` (and siblings)
+ * is not modeled by configured sinks (those cover Node.js Mongo only).
+ * Fires when the receiver call payload references a value transitively
+ * derived from servlet request extractors (request.getParameter /
+ * getHeader / getCookies / getReader / getQueryString / getPart).
+ */
+export declare function findJavaMongoNosqlInjectionFindings(code: string, file: string): SastFinding[];
+/**
+ * Sprint 84 detector C (#189) — Python mongoengine `$where` JS-string injection.
+ * The shape `User.objects(__raw__={'$where': "this.x == '" + n + "'"})`
+ * (and aliases via `$where` key with string concat / f-string) bypasses
+ * the configured nosql sinks. Fires when the `$where` value references
+ * a value transitively derived from Flask/Django/FastAPI request input.
+ */
+export declare function findPythonMongoengineWhereNosqlInjectionFindings(code: string, file: string): SastFinding[];
+/**
+ * Sprint 85 detector (#189) — Java SSRF via `new URL(<tainted>)` →
+ * `.openStream()` / `.openConnection()` / `.getContent()` receiver chains
+ * that the configured `URL.openStream` / `URL.openConnection` sinks
+ * recognize but the cross-statement flow construction misses (URL value
+ * passes through an intermediate local variable). Also fires when the
+ * tainted URL is gated only by a weak allowlist — a scheme-only check
+ * such as `url.startsWith("https://")` is NOT a sanitizer because the
+ * host is still attacker-controlled.
+ */
+export declare function findJavaUrlOpenStreamSsrfFindings(code: string, file: string): SastFinding[];
 //# sourceMappingURL=language-sources-pass.d.ts.map

package/dist/analysis/passes/language-sources-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CA8U7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAg6DD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf"}
+{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CA+W7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAg6DD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ff"}

package/dist/analysis/passes/language-sources-pass.js

@@ -223,6 +223,11 @@ export class LanguageSourcesPass {
             for (const finding of findGoPluginOpenCodeInjectionFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 84 (#189): Go nosql_injection — *mongo.Collection FindOne / Find
+            // / Insert / Update / Delete / Aggregate with bson.M{...tainted}.
+            for (const finding of findGoMongoNosqlInjectionFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Python: safe-handler sanitizer detectors (cognium-dev #114 Sprint 31) --
         if (language === 'python') {
@@ -261,6 +266,11 @@ export class LanguageSourcesPass {
             for (const finding of findPythonInteractiveInterpreterCodeInjectionFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 84 (#189): Python nosql_injection — mongoengine `__raw__={"$where":
+            // <tainted-string-concat>}` JS-string injection through MongoDB $where.
+            for (const finding of findPythonMongoengineWhereNosqlInjectionFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Rust: safe-handler sanitizer detectors (cognium-dev #115 Sprint 31) --
         if (language === 'rust') {
@@ -360,6 +370,17 @@ export class LanguageSourcesPass {
             for (const finding of findJavaResponseWriterXssFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 84 (#189): Java nosql_injection — MongoCollection find / insert /
+            // update / delete / aggregate with Filters.eq("k", <tainted servlet input>).
+            for (const finding of findJavaMongoNosqlInjectionFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 85 (#189): Java ssrf — `new URL(<tainted>)` →
+            // `.openStream()` / `.openConnection()` / `.getContent()` receiver
+            // chains (basic_fetch + weak_allowlist variants).
+            for (const finding of findJavaUrlOpenStreamSsrfFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // Sprint 70 (#151): cross-language env-secret → external-network exfiltration.
         // Pattern findings only — no taint flow required (composed-flow shape that
@@ -5701,4 +5722,413 @@ export function findRustEvalCrateCodeInjectionFindings(code, file) {
     }
     return findings;
 }
+/**
+ * Sprint 84 detector A (#189) — Go MongoDB driver nosql_injection.
+ * The Go MongoDB driver call shape `coll.FindOne(ctx, bson.M{"k": <taint>})`
+ * (and siblings: Find / InsertOne / InsertMany / UpdateOne / UpdateMany /
+ * DeleteOne / DeleteMany / FindOneAndUpdate / FindOneAndDelete /
+ * FindOneAndReplace / Aggregate) is not modeled by configured sinks (those
+ * cover Node.js Mongo only). Fires when the filter argument (after `ctx`)
+ * references a value transitively derived from `*http.Request` extractors
+ * (URL.Query().Get / FormValue / PostFormValue / Header.Get / Cookie).
+ */
+export function findGoMongoNosqlInjectionFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    // Gate: require some hint of the mongo-driver / bson namespace usage.
+    if (!/(\bbson\s*\.\s*[MDAE]\b|mongo-driver|\*\s*mongo\.Collection)/.test(code)) {
+        return findings;
+    }
+    const lines = code.split('\n');
+    const reqExtractRe = /\b\w+\s*\.\s*(?:FormValue|PostFormValue|URL\s*\.\s*Query\s*\(\s*\)\s*\.\s*Get|Header\s*\.\s*Get|Cookie)\s*\(/;
+    const httpReqParamRe = /\*\s*http\.Request\b/;
+    const opsAlt = '(?:FindOne|Find|InsertOne|InsertMany|UpdateOne|UpdateMany|DeleteOne|DeleteMany|FindOneAndUpdate|FindOneAndDelete|FindOneAndReplace|Aggregate)';
+    // Match call-site head only; balanced parens for args are extracted below.
+    const callHeadRe = new RegExp(`\\.\\s*(${opsAlt})\\s*\\(`);
+    function extractBalanced(line, openIdx) {
+        let depth = 0;
+        for (let k = openIdx; k < line.length; k++) {
+            const ch = line[k];
+            if (ch === '(')
+                depth++;
+            else if (ch === ')') {
+                depth--;
+                if (depth === 0)
+                    return line.substring(openIdx + 1, k);
+            }
+        }
+        return null;
+    }
+    const funcs = [];
+    let cur = null;
+    for (let i = 0; i < lines.length; i++) {
+        const t = lines[i].trim();
+        if (/^func\b/.test(t)) {
+            if (cur) {
+                cur.end = i - 1;
+                funcs.push(cur);
+            }
+            cur = { start: i, end: lines.length - 1 };
+        }
+    }
+    if (cur)
+        funcs.push(cur);
+    for (const fn of funcs) {
+        const header = lines[fn.start];
+        if (!httpReqParamRe.test(header))
+            continue;
+        const taintedVars = new Set();
+        for (let pass = 0; pass < 3; pass++) {
+            const before = taintedVars.size;
+            for (let i = fn.start; i <= fn.end; i++) {
+                const trimmed = lines[i].trim();
+                const assignMatch = trimmed.match(/^(\w+)\s*(?::=|=)\s*(.+?)(?:\s*\/\/.*)?$/);
+                if (!assignMatch)
+                    continue;
+                const lhs = assignMatch[1];
+                const rhs = assignMatch[2];
+                if (taintedVars.has(lhs))
+                    continue;
+                if (reqExtractRe.test(rhs)) {
+                    taintedVars.add(lhs);
+                    continue;
+                }
+                for (const v of taintedVars) {
+                    if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+                        taintedVars.add(lhs);
+                        break;
+                    }
+                }
+            }
+            if (taintedVars.size === before)
+                break;
+        }
+        if (taintedVars.size === 0)
+            continue;
+        for (let i = fn.start; i <= fn.end; i++) {
+            const line = lines[i];
+            const m = callHeadRe.exec(line);
+            if (!m)
+                continue;
+            const op = m[1];
+            const openIdx = m.index + m[0].length - 1;
+            const args = extractBalanced(line, openIdx);
+            if (args === null || args.length === 0)
+                continue;
+            let tainted = reqExtractRe.test(args);
+            if (!tainted) {
+                for (const v of taintedVars) {
+                    if (new RegExp(`\\b${v}\\b`).test(args)) {
+                        tainted = true;
+                        break;
+                    }
+                }
+            }
+            if (!tainted)
+                continue;
+            findings.push({
+                id: `nosql_injection-${file}-${i + 1}-go-mongo-${op.toLowerCase()}`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'nosql_injection',
+                cwe: 'CWE-943',
+                severity: 'critical',
+                level: 'error',
+                message: `NoSQL injection: Go MongoDB driver \`${op}(...)\` called with a ` +
+                    'filter derived from *http.Request input. Untrusted values inside ' +
+                    'a `bson.M` / `bson.D` filter can be operator objects (e.g. ' +
+                    '`{"$ne": null}`) and bypass authentication/intent. Validate or ' +
+                    'coerce the value to a primitive before building the filter.',
+                file,
+                line: i + 1,
+                snippet: line.trim(),
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Sprint 84 detector B (#189) — Java Mongo driver nosql_injection.
+ * Mongo Java driver shape `users.find(eq("k", <taint>))` (and siblings)
+ * is not modeled by configured sinks (those cover Node.js Mongo only).
+ * Fires when the receiver call payload references a value transitively
+ * derived from servlet request extractors (request.getParameter /
+ * getHeader / getCookies / getReader / getQueryString / getPart).
+ */
+export function findJavaMongoNosqlInjectionFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    // Gate: require some hint of MongoCollection / Filters / Document use.
+    if (!/(MongoCollection\b|com\.mongodb\b|\bFilters\b|\bnew\s+Document\s*\()/.test(code)) {
+        return findings;
+    }
+    const lines = code.split('\n');
+    const reqExtractRe = /\b\w+\s*\.\s*(?:getParameter|getParameterValues|getHeader|getHeaders|getCookies|getReader|getQueryString|getRequestURI|getInputStream|getPart|getParts)\s*\(/;
+    const opsAlt = '(?:find|findOne|findOneAndUpdate|findOneAndDelete|findOneAndReplace|insertOne|insertMany|updateOne|updateMany|deleteOne|deleteMany|replaceOne|aggregate|countDocuments|distinct)';
+    const callRe = new RegExp(`\\.\\s*(${opsAlt})\\s*\\(([\\s\\S]*?)\\)`);
+    // Whole-file 3-pass taint propagation across simple `Type name = expr;`
+    // and `name = expr;` assignments. Lightweight; suitable for the fixture
+    // set without paying for full Java scope tracking.
+    const taintedVars = new Set();
+    for (let pass = 0; pass < 3; pass++) {
+        const before = taintedVars.size;
+        for (let i = 0; i < lines.length; i++) {
+            const t = lines[i].trim();
+            const a = t.match(/^(?:final\s+)?(?:[\w<>?,\[\]]+\s+)?(\w+)\s*=\s*(.+?);?$/);
+            if (!a)
+                continue;
+            const lhs = a[1];
+            const rhs = a[2];
+            if (taintedVars.has(lhs))
+                continue;
+            if (reqExtractRe.test(rhs)) {
+                taintedVars.add(lhs);
+                continue;
+            }
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+                    taintedVars.add(lhs);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    if (taintedVars.size === 0)
+        return findings;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const m = line.match(callRe);
+        if (!m)
+            continue;
+        const op = m[1];
+        const args = m[2];
+        if (args.trim().length === 0)
+            continue;
+        let tainted = reqExtractRe.test(args);
+        if (!tainted) {
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(args)) {
+                    tainted = true;
+                    break;
+                }
+            }
+        }
+        if (!tainted)
+            continue;
+        findings.push({
+            id: `nosql_injection-${file}-${i + 1}-java-mongo-${op.toLowerCase()}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'nosql_injection',
+            cwe: 'CWE-943',
+            severity: 'critical',
+            level: 'error',
+            message: `NoSQL injection: Java Mongo driver \`${op}(...)\` called with a ` +
+                'filter derived from servlet request input. Untrusted values can ' +
+                'reach BSON operator positions and bypass intent. Validate the ' +
+                'input type before constructing the filter (e.g. require String).',
+            file,
+            line: i + 1,
+            snippet: line.trim(),
+        });
+    }
+    return findings;
+}
+/**
+ * Sprint 84 detector C (#189) — Python mongoengine `$where` JS-string injection.
+ * The shape `User.objects(__raw__={'$where': "this.x == '" + n + "'"})`
+ * (and aliases via `$where` key with string concat / f-string) bypasses
+ * the configured nosql sinks. Fires when the `$where` value references
+ * a value transitively derived from Flask/Django/FastAPI request input.
+ */
+export function findPythonMongoengineWhereNosqlInjectionFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    // Gate: require literal '$where' to appear in the file.
+    if (!/['"]\$where['"]/.test(code))
+        return findings;
+    const lines = code.split('\n');
+    const reqExtractRe = /\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)\b|flask\.request\b)/;
+    const taintedVars = new Set();
+    for (let pass = 0; pass < 3; pass++) {
+        const before = taintedVars.size;
+        for (let i = 0; i < lines.length; i++) {
+            const t = lines[i].trim();
+            if (t.startsWith('#'))
+                continue;
+            const a = t.match(/^(\w+)\s*=\s*(.+?)$/);
+            if (!a)
+                continue;
+            const lhs = a[1];
+            const rhs = a[2];
+            if (taintedVars.has(lhs))
+                continue;
+            if (reqExtractRe.test(rhs)) {
+                taintedVars.add(lhs);
+                continue;
+            }
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+                    taintedVars.add(lhs);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    const whereRe = /['"]\$where['"]\s*:\s*([^,}\n]+)/;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const m = line.match(whereRe);
+        if (!m)
+            continue;
+        const valueExpr = m[1].trim();
+        // Pure string literal (no concat, no f-string interp): safe.
+        if (/^"[^"]*"$/.test(valueExpr) || /^'[^']*'$/.test(valueExpr))
+            continue;
+        let tainted = reqExtractRe.test(valueExpr);
+        if (!tainted) {
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(valueExpr)) {
+                    tainted = true;
+                    break;
+                }
+            }
+        }
+        if (!tainted)
+            continue;
+        findings.push({
+            id: `nosql_injection-${file}-${i + 1}-py-mongoengine-where`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'nosql_injection',
+            cwe: 'CWE-943',
+            severity: 'critical',
+            level: 'error',
+            message: 'NoSQL injection: mongoengine `__raw__={"$where": ...}` payload ' +
+                'derived from HTTP request input. The `$where` operator evaluates ' +
+                'JavaScript on the server; tainted string concatenation lets an ' +
+                'attacker inject arbitrary JS. Replace `$where` with field-based ' +
+                'operators or validate the input.',
+            file,
+            line: i + 1,
+            snippet: line.trim(),
+        });
+    }
+    return findings;
+}
+/**
+ * Sprint 85 detector (#189) — Java SSRF via `new URL(<tainted>)` →
+ * `.openStream()` / `.openConnection()` / `.getContent()` receiver chains
+ * that the configured `URL.openStream` / `URL.openConnection` sinks
+ * recognize but the cross-statement flow construction misses (URL value
+ * passes through an intermediate local variable). Also fires when the
+ * tainted URL is gated only by a weak allowlist — a scheme-only check
+ * such as `url.startsWith("https://")` is NOT a sanitizer because the
+ * host is still attacker-controlled.
+ */
+export function findJavaUrlOpenStreamSsrfFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    // Gate: require URL construction + a fetch-style method call.
+    if (!/\bnew\s+URL\s*\(/.test(code) &&
+        !/\bURI\s*\.\s*create\s*\(/.test(code)) {
+        return findings;
+    }
+    if (!/\.\s*(?:openStream|openConnection|getContent)\s*\(/.test(code)) {
+        return findings;
+    }
+    const lines = code.split('\n');
+    const reqExtractRe = /\b\w+\s*\.\s*(?:getParameter|getParameterValues|getHeader|getHeaders|getCookies|getReader|getQueryString|getRequestURI|getInputStream|getPart|getParts)\s*\(/;
+    // Whole-file 3-pass taint propagation. Tracks straightforward
+    // `Type name = expr;` / `name = expr;` assignments. Notably
+    // includes the `new URL(<tainted>)` wrapper — substring match on
+    // the rhs is sufficient because no built-in URL constructor erases
+    // taint.
+    const taintedVars = new Set();
+    for (let pass = 0; pass < 3; pass++) {
+        const before = taintedVars.size;
+        for (let i = 0; i < lines.length; i++) {
+            const t = lines[i].trim();
+            const a = t.match(/^(?:final\s+)?(?:[\w<>?,\[\]]+\s+)?(\w+)\s*=\s*(.+?);?$/);
+            if (!a)
+                continue;
+            const lhs = a[1];
+            const rhs = a[2];
+            if (taintedVars.has(lhs))
+                continue;
+            if (reqExtractRe.test(rhs)) {
+                taintedVars.add(lhs);
+                continue;
+            }
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+                    taintedVars.add(lhs);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    if (taintedVars.size === 0)
+        return findings;
+    const sinkRe = /\.\s*(openStream|openConnection|getContent)\s*\(/;
+    const seen = new Set();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const m = line.match(sinkRe);
+        if (!m)
+            continue;
+        const op = m[1];
+        const sinkIdx = line.indexOf(`.${op}`);
+        if (sinkIdx < 0)
+            continue;
+        // Identify the receiver span: everything to the left of the `.op(`
+        // call. The receiver may be a chained call (e.g.
+        // `new URL(url).openStream()`) — treat the entire pre-call span as
+        // the analysis target and ask whether any tainted var appears in it.
+        const head = line.substring(0, sinkIdx + 1);
+        let tainted = reqExtractRe.test(head);
+        if (!tainted) {
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(head)) {
+                    tainted = true;
+                    break;
+                }
+            }
+        }
+        if (!tainted)
+            continue;
+        const key = `${i + 1}:${op}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        findings.push({
+            id: `ssrf-${file}-${i + 1}-java-url-${op.toLowerCase()}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'ssrf',
+            cwe: 'CWE-918',
+            severity: 'critical',
+            level: 'error',
+            message: `SSRF: Java \`URL.${op}()\` invoked on a URL derived from servlet ` +
+                'request input. Even when an `if (url.startsWith("https://"))` ' +
+                'guard is present, the host portion remains attacker-controlled — ' +
+                'use a strict host allowlist (parse the URL, check `getHost()`) ' +
+                'before issuing the request.',
+            file,
+            line: i + 1,
+            snippet: line.trim(),
+        });
+    }
+    return findings;
+}
 //# sourceMappingURL=language-sources-pass.js.map