circle-ir 3.134.0 → 3.136.0

package/dist/analysis/passes/language-sources-pass.d.ts

@@ -388,4 +388,41 @@ export declare function findJavaMongoNosqlInjectionFindings(code: string, file:
  * a value transitively derived from Flask/Django/FastAPI request input.
  */
 export declare function findPythonMongoengineWhereNosqlInjectionFindings(code: string, file: string): SastFinding[];
+/**
+ * Sprint 85 detector (#189) — Java SSRF via `new URL(<tainted>)` →
+ * `.openStream()` / `.openConnection()` / `.getContent()` receiver chains
+ * that the configured `URL.openStream` / `URL.openConnection` sinks
+ * recognize but the cross-statement flow construction misses (URL value
+ * passes through an intermediate local variable). Also fires when the
+ * tainted URL is gated only by a weak allowlist — a scheme-only check
+ * such as `url.startsWith("https://")` is NOT a sanitizer because the
+ * host is still attacker-controlled.
+ */
+export declare function findJavaUrlOpenStreamSsrfFindings(code: string, file: string): SastFinding[];
+/**
+ * Sprint 86 detector A (#189) — Python uncontrolled format-string.
+ *
+ * Two shapes:
+ *   1. `<tainted> % args`                 — old-style percent formatting
+ *   2. `<tainted>.format(args)`           — `str.format` API
+ *
+ * When the format string itself comes from HTTP request input, an
+ * attacker can probe arbitrary attributes/items via `str.format`
+ * (`{0.__class__.__init__.__globals__}`) or crash the process via
+ * malformed `%` specifiers. CWE-134.
+ */
+export declare function findPythonTaintedFormatStringFindings(code: string, file: string): SastFinding[];
+/**
+ * Sprint 86 detector B (#189) — JavaScript uncontrolled format-string
+ * via Node `util.format(<tainted>, ...args)`. `util.format` honours
+ * `%s`/`%d`/`%j`/`%O` specifiers; a tainted format string can fingerprint
+ * argument types and is the documented sink for CWE-134 in Node.
+ */
+export declare function findJsUtilFormatFormatStringFindings(code: string, file: string): SastFinding[];
+/**
+ * Sprint 86 detector C (#189) — Python HTTP header CRLF injection via
+ * Flask/Werkzeug `response.headers['X-Custom'] = <tainted concat>` or
+ * `response.headers.add(...)` / `response.headers.set(...)`. CWE-113.
+ */
+export declare function findPythonHeaderCrlfInjectionFindings(code: string, file: string): SastFinding[];
 //# sourceMappingURL=language-sources-pass.d.ts.map

package/dist/analysis/passes/language-sources-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAsW7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAg6DD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf"}
+{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAwY7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAg6DD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ff;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkHf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoEf;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA8Ff"}

package/dist/analysis/passes/language-sources-pass.js

@@ -271,6 +271,17 @@ export class LanguageSourcesPass {
             for (const finding of findPythonMongoengineWhereNosqlInjectionFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 86 (#189): Python format_string — `<tainted> % args` and
+            // `<tainted>.format(args)` where the format template comes from
+            // an HTTP request extractor.
+            for (const finding of findPythonTaintedFormatStringFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            // Sprint 86 (#189): Python crlf / header injection —
+            // `response.headers['X-Custom'] = <tainted>` (Flask/Werkzeug).
+            for (const finding of findPythonHeaderCrlfInjectionFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Rust: safe-handler sanitizer detectors (cognium-dev #115 Sprint 31) --
         if (language === 'rust') {
@@ -347,6 +358,11 @@ export class LanguageSourcesPass {
             for (const finding of findJsIndirectEvalCodeInjectionFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 86 (#189): JS format_string — `util.format(<tainted>, ...)`
+            // where the format template comes from an HTTP request extractor.
+            for (const finding of findJsUtilFormatFormatStringFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Java: Sprint 73 (#216 Pattern A) — Jackson readValue / Gson
         // fromJson recognized as ETE terminator (does not affect
@@ -375,6 +391,12 @@ export class LanguageSourcesPass {
             for (const finding of findJavaMongoNosqlInjectionFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            // Sprint 85 (#189): Java ssrf — `new URL(<tainted>)` →
+            // `.openStream()` / `.openConnection()` / `.getContent()` receiver
+            // chains (basic_fetch + weak_allowlist variants).
+            for (const finding of findJavaUrlOpenStreamSsrfFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // Sprint 70 (#151): cross-language env-secret → external-network exfiltration.
         // Pattern findings only — no taint flow required (composed-flow shape that
@@ -6017,4 +6039,413 @@ export function findPythonMongoengineWhereNosqlInjectionFindings(code, file) {
     }
     return findings;
 }
+/**
+ * Sprint 85 detector (#189) — Java SSRF via `new URL(<tainted>)` →
+ * `.openStream()` / `.openConnection()` / `.getContent()` receiver chains
+ * that the configured `URL.openStream` / `URL.openConnection` sinks
+ * recognize but the cross-statement flow construction misses (URL value
+ * passes through an intermediate local variable). Also fires when the
+ * tainted URL is gated only by a weak allowlist — a scheme-only check
+ * such as `url.startsWith("https://")` is NOT a sanitizer because the
+ * host is still attacker-controlled.
+ */
+export function findJavaUrlOpenStreamSsrfFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    // Gate: require URL construction + a fetch-style method call.
+    if (!/\bnew\s+URL\s*\(/.test(code) &&
+        !/\bURI\s*\.\s*create\s*\(/.test(code)) {
+        return findings;
+    }
+    if (!/\.\s*(?:openStream|openConnection|getContent)\s*\(/.test(code)) {
+        return findings;
+    }
+    const lines = code.split('\n');
+    const reqExtractRe = /\b\w+\s*\.\s*(?:getParameter|getParameterValues|getHeader|getHeaders|getCookies|getReader|getQueryString|getRequestURI|getInputStream|getPart|getParts)\s*\(/;
+    // Whole-file 3-pass taint propagation. Tracks straightforward
+    // `Type name = expr;` / `name = expr;` assignments. Notably
+    // includes the `new URL(<tainted>)` wrapper — substring match on
+    // the rhs is sufficient because no built-in URL constructor erases
+    // taint.
+    const taintedVars = new Set();
+    for (let pass = 0; pass < 3; pass++) {
+        const before = taintedVars.size;
+        for (let i = 0; i < lines.length; i++) {
+            const t = lines[i].trim();
+            const a = t.match(/^(?:final\s+)?(?:[\w<>?,\[\]]+\s+)?(\w+)\s*=\s*(.+?);?$/);
+            if (!a)
+                continue;
+            const lhs = a[1];
+            const rhs = a[2];
+            if (taintedVars.has(lhs))
+                continue;
+            if (reqExtractRe.test(rhs)) {
+                taintedVars.add(lhs);
+                continue;
+            }
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+                    taintedVars.add(lhs);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    if (taintedVars.size === 0)
+        return findings;
+    const sinkRe = /\.\s*(openStream|openConnection|getContent)\s*\(/;
+    const seen = new Set();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const m = line.match(sinkRe);
+        if (!m)
+            continue;
+        const op = m[1];
+        const sinkIdx = line.indexOf(`.${op}`);
+        if (sinkIdx < 0)
+            continue;
+        // Identify the receiver span: everything to the left of the `.op(`
+        // call. The receiver may be a chained call (e.g.
+        // `new URL(url).openStream()`) — treat the entire pre-call span as
+        // the analysis target and ask whether any tainted var appears in it.
+        const head = line.substring(0, sinkIdx + 1);
+        let tainted = reqExtractRe.test(head);
+        if (!tainted) {
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(head)) {
+                    tainted = true;
+                    break;
+                }
+            }
+        }
+        if (!tainted)
+            continue;
+        const key = `${i + 1}:${op}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        findings.push({
+            id: `ssrf-${file}-${i + 1}-java-url-${op.toLowerCase()}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'ssrf',
+            cwe: 'CWE-918',
+            severity: 'critical',
+            level: 'error',
+            message: `SSRF: Java \`URL.${op}()\` invoked on a URL derived from servlet ` +
+                'request input. Even when an `if (url.startsWith("https://"))` ' +
+                'guard is present, the host portion remains attacker-controlled — ' +
+                'use a strict host allowlist (parse the URL, check `getHost()`) ' +
+                'before issuing the request.',
+            file,
+            line: i + 1,
+            snippet: line.trim(),
+        });
+    }
+    return findings;
+}
+/**
+ * Sprint 86 detector A (#189) — Python uncontrolled format-string.
+ *
+ * Two shapes:
+ *   1. `<tainted> % args`                 — old-style percent formatting
+ *   2. `<tainted>.format(args)`           — `str.format` API
+ *
+ * When the format string itself comes from HTTP request input, an
+ * attacker can probe arbitrary attributes/items via `str.format`
+ * (`{0.__class__.__init__.__globals__}`) or crash the process via
+ * malformed `%` specifiers. CWE-134.
+ */
+export function findPythonTaintedFormatStringFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    // Gate: the file must use a Flask/Django/FastAPI request extractor.
+    if (!/\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)|flask\.request)\b/.test(code)) {
+        return findings;
+    }
+    const lines = code.split('\n');
+    const reqExtractRe = /\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)\b|flask\.request\b)/;
+    // 3-pass whole-file taint propagation across simple `name = expr`
+    // assignments.
+    const taintedVars = new Set();
+    for (let pass = 0; pass < 3; pass++) {
+        const before = taintedVars.size;
+        for (let i = 0; i < lines.length; i++) {
+            const t = lines[i].trim();
+            if (t.startsWith('#'))
+                continue;
+            const a = t.match(/^(\w+)\s*=\s*(.+?)$/);
+            if (!a)
+                continue;
+            const lhs = a[1];
+            const rhs = a[2];
+            if (taintedVars.has(lhs))
+                continue;
+            if (reqExtractRe.test(rhs)) {
+                taintedVars.add(lhs);
+                continue;
+            }
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+                    taintedVars.add(lhs);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    if (taintedVars.size === 0)
+        return findings;
+    // Percent format: `<name> % <rhs>` where `<name>` is tainted and not a
+    // string literal. Avoid false-fire on `2 % x` etc. by gating on
+    // taintedVar appearing as the LHS of `%`.
+    const percentRe = /\b(\w+)\s*%\s*[\(\[\{"'\w]/;
+    // str.format(...): `<name>.format(`
+    const dotFormatRe = /\b(\w+)\s*\.\s*format\s*\(/;
+    const seen = new Set();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const t = line.trim();
+        if (t.startsWith('#'))
+            continue;
+        // Percent format
+        const pm = line.match(percentRe);
+        if (pm && taintedVars.has(pm[1])) {
+            // Avoid string literal LHS (already a literal would have been
+            // assigned as a literal, but we double-check the var was tainted —
+            // which the check above asserts).
+            const key = `${i + 1}:percent`;
+            if (!seen.has(key)) {
+                seen.add(key);
+                findings.push({
+                    id: `format_string-${file}-${i + 1}-py-percent`,
+                    pass: 'language-sources',
+                    category: 'security',
+                    rule_id: 'format_string',
+                    cwe: 'CWE-134',
+                    severity: 'high',
+                    level: 'error',
+                    message: 'Format-string injection: Python `<tainted> % args` uses an ' +
+                        'HTTP-request-controlled format string. Malformed specifiers can ' +
+                        'crash the handler (TypeError) and `%(name)s` access can reveal ' +
+                        'arbitrary mapping keys. Use a literal format string and pass ' +
+                        'untrusted values as arguments only.',
+                    file,
+                    line: i + 1,
+                    snippet: line.trim(),
+                });
+            }
+        }
+        // str.format
+        const dm = line.match(dotFormatRe);
+        if (dm && taintedVars.has(dm[1])) {
+            const key = `${i + 1}:dotformat`;
+            if (!seen.has(key)) {
+                seen.add(key);
+                findings.push({
+                    id: `format_string-${file}-${i + 1}-py-strformat`,
+                    pass: 'language-sources',
+                    category: 'security',
+                    rule_id: 'format_string',
+                    cwe: 'CWE-134',
+                    severity: 'high',
+                    level: 'error',
+                    message: 'Format-string injection: Python `<tainted>.format(...)` lets ' +
+                        'the attacker control the format template. Field-access shapes ' +
+                        'such as `{0.__class__.__init__.__globals__}` can leak module ' +
+                        'globals (e.g. secret keys). Use a literal template and pass ' +
+                        'untrusted values as positional/keyword arguments only.',
+                    file,
+                    line: i + 1,
+                    snippet: line.trim(),
+                });
+            }
+        }
+    }
+    return findings;
+}
+/**
+ * Sprint 86 detector B (#189) — JavaScript uncontrolled format-string
+ * via Node `util.format(<tainted>, ...args)`. `util.format` honours
+ * `%s`/`%d`/`%j`/`%O` specifiers; a tainted format string can fingerprint
+ * argument types and is the documented sink for CWE-134 in Node.
+ */
+export function findJsUtilFormatFormatStringFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    if (!/\butil\s*\.\s*format\s*\(/.test(code))
+        return findings;
+    if (!/\breq\s*\.\s*(?:query|body|params|headers|cookies)\b/.test(code)) {
+        return findings;
+    }
+    const lines = code.split('\n');
+    const reqExtractRe = /\breq\s*\.\s*(?:query|body|params|headers|cookies)\b/;
+    const taintedVars = new Set();
+    for (let pass = 0; pass < 3; pass++) {
+        const before = taintedVars.size;
+        for (let i = 0; i < lines.length; i++) {
+            const t = lines[i].trim();
+            if (t.startsWith('//'))
+                continue;
+            const a = t.match(/^(?:const|let|var)\s+(\w+)\s*=\s*(.+?);?$/);
+            if (!a)
+                continue;
+            const lhs = a[1];
+            const rhs = a[2];
+            if (taintedVars.has(lhs))
+                continue;
+            if (reqExtractRe.test(rhs)) {
+                taintedVars.add(lhs);
+                continue;
+            }
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+                    taintedVars.add(lhs);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    if (taintedVars.size === 0)
+        return findings;
+    // util.format(<firstArg>, ...) — check whether <firstArg> is tainted.
+    const callRe = /\butil\s*\.\s*format\s*\(\s*([\w.]+)\s*[,)]/;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const m = line.match(callRe);
+        if (!m)
+            continue;
+        const arg = m[1];
+        // First token of dotted path is the var name.
+        const root = arg.split('.')[0];
+        if (!taintedVars.has(root) && !reqExtractRe.test(arg))
+            continue;
+        findings.push({
+            id: `format_string-${file}-${i + 1}-js-util-format`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'format_string',
+            cwe: 'CWE-134',
+            severity: 'medium',
+            level: 'error',
+            message: 'Format-string injection: Node `util.format(<tainted>, ...)` uses ' +
+                'an HTTP-request-controlled format string. The attacker can ' +
+                'manipulate `%s`/`%j`/`%O` specifiers to alter the rendered ' +
+                'output. Pass user input as a subsequent argument with a literal ' +
+                'format string.',
+            file,
+            line: i + 1,
+            snippet: line.trim(),
+        });
+    }
+    return findings;
+}
+/**
+ * Sprint 86 detector C (#189) — Python HTTP header CRLF injection via
+ * Flask/Werkzeug `response.headers['X-Custom'] = <tainted concat>` or
+ * `response.headers.add(...)` / `response.headers.set(...)`. CWE-113.
+ */
+export function findPythonHeaderCrlfInjectionFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    if (!/\b\w+\s*\.\s*headers\b/.test(code))
+        return findings;
+    if (!/\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)|flask\.request)\b/.test(code)) {
+        return findings;
+    }
+    const lines = code.split('\n');
+    const reqExtractRe = /\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)\b|flask\.request\b)/;
+    const taintedVars = new Set();
+    for (let pass = 0; pass < 3; pass++) {
+        const before = taintedVars.size;
+        for (let i = 0; i < lines.length; i++) {
+            const t = lines[i].trim();
+            if (t.startsWith('#'))
+                continue;
+            const a = t.match(/^(\w+)\s*=\s*(.+?)$/);
+            if (!a)
+                continue;
+            const lhs = a[1];
+            const rhs = a[2];
+            if (taintedVars.has(lhs))
+                continue;
+            if (reqExtractRe.test(rhs)) {
+                taintedVars.add(lhs);
+                continue;
+            }
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+                    taintedVars.add(lhs);
+                    break;
+                }
+            }
+        }
+        if (taintedVars.size === before)
+            break;
+    }
+    if (taintedVars.size === 0)
+        return findings;
+    // Patterns:
+    //   resp.headers['X-Custom'] = <expr>
+    //   resp.headers.add('X-Custom', <expr>)
+    //   resp.headers.set('X-Custom', <expr>)
+    //   resp.headers.update({'X-Custom': <expr>})
+    const subscriptRe = /\b\w+\s*\.\s*headers\s*\[\s*['"][^'"]+['"]\s*\]\s*=\s*(.+)$/;
+    const methodRe = /\b\w+\s*\.\s*headers\s*\.\s*(?:add|set|setdefault|append)\s*\(\s*['"][^'"]+['"]\s*,\s*(.+?)\)/;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const t = line.trim();
+        if (t.startsWith('#'))
+            continue;
+        let expr = null;
+        const sm = line.match(subscriptRe);
+        if (sm)
+            expr = sm[1];
+        else {
+            const mm = line.match(methodRe);
+            if (mm)
+                expr = mm[1];
+        }
+        if (!expr)
+            continue;
+        let tainted = reqExtractRe.test(expr);
+        if (!tainted) {
+            for (const v of taintedVars) {
+                if (new RegExp(`\\b${v}\\b`).test(expr)) {
+                    tainted = true;
+                    break;
+                }
+            }
+        }
+        if (!tainted)
+            continue;
+        findings.push({
+            id: `crlf-${file}-${i + 1}-py-headers`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'crlf',
+            cwe: 'CWE-113',
+            severity: 'medium',
+            level: 'error',
+            message: 'CRLF / header injection: Python Flask/Werkzeug ' +
+                '`response.headers[...] = <tainted>` lets an attacker inject a ' +
+                '`\\r\\n` sequence and forge additional headers or split the ' +
+                'response body. Validate the value (reject control characters) or ' +
+                'use a fixed allowlist.',
+            file,
+            line: i + 1,
+            snippet: line.trim(),
+        });
+    }
+    return findings;
+}
 //# sourceMappingURL=language-sources-pass.js.map