circle-ir 3.136.0 → 3.138.0

package/dist/browser/circle-ir.js

@@ -23684,6 +23684,24 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findGoLdapInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findGoGobDeserializationFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findGoXmlDecoderXxeFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python") {
       additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
@@ -23732,6 +23750,12 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findPythonJinjaTemplateSstiFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
@@ -23765,6 +23789,18 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findRustLdapInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findRustLogInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "javascript" || language === "typescript" || language === "htmljs") {
       additionalSanitizers.push(...findJsSafeJsonParseSanitizers(code));
@@ -23801,6 +23837,30 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJsLdapInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findJsJsonParseBodyFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findJsDomXpathInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findJsTemplateInjectionSstiFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
@@ -27923,6 +27983,909 @@ function findPythonHeaderCrlfInjectionFindings(code, file) {
   }
   return findings;
 }
+function findJsLdapInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\.\s*search\s*\(/.test(code)) return findings;
+  if (!/\breq\s*\.\s*(?:query|body|params|headers|cookies)\b/.test(code)) {
+    return findings;
+  }
+  if (!/\b(?:ldapjs|ldapts|require\(['"]ldapjs['"]\)|from\s+['"]ldapts['"])\b/.test(
+    code
+  )) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const reqExtractRe = /\breq\s*\.\s*(?:query|body|params|headers|cookies)\b/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("//")) continue;
+      const m = t.match(/^(?:const|let|var)\s+(\w+)(?:\s*:\s*[^=]+)?\s*=\s*(.+?);?$/);
+      if (!m) continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  if (taintedVars.size === 0) return findings;
+  const filterPropRe = /\bfilter\s*:\s*([^,}\n]+)/;
+  const filterShorthandRe = /(?:^|[\{,])\s*filter\s*[,}]/;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const fm = line.match(filterPropRe);
+    let expr = null;
+    if (fm) {
+      expr = fm[1].trim();
+    } else if (filterShorthandRe.test(line)) {
+      expr = "filter";
+    } else {
+      continue;
+    }
+    let tainted = false;
+    for (const v of taintedVars) {
+      if (new RegExp(`\\b${v}\\b`).test(expr)) {
+        tainted = true;
+        break;
+      }
+    }
+    if (!tainted) continue;
+    if (seen.has(i2 + 1)) continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `ldap_injection-${file}-${i2 + 1}-js-ldap-filter`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "ldap_injection",
+      cwe: "CWE-90",
+      severity: "critical",
+      level: "error",
+      message: "LDAP injection: ldapjs/ldapts `client.search(..., { filter: <tainted>, ... })` lets the attacker break out of the filter expression (e.g. `*)(uid=*`) and enumerate the directory. Escape the user input with a tight allowlist (`[A-Za-z0-9_-]+`) or use a structured filter builder.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findGoLdapInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\bldap\s*\.\s*NewSearchRequest\s*\(/.test(code)) return findings;
+  if (!/\br\s*\.\s*(?:URL\s*\.\s*Query\s*\(\s*\)|Form|PostForm|FormValue|PostFormValue|Header)/.test(
+    code
+  )) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const reqExtractRe = /\br\s*\.\s*(?:URL\s*\.\s*Query\s*\(\s*\)\s*\.\s*Get|Form\s*\.\s*Get|PostForm\s*\.\s*Get|FormValue|PostFormValue|Header\s*\.\s*Get)\s*\(/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("//")) continue;
+      const m = t.match(/^(\w+)\s*(?::=|=)\s*(.+?)$/);
+      if (!m) continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  if (taintedVars.size === 0) return findings;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const openIdx = lines[i2].indexOf("NewSearchRequest(");
+    if (openIdx === -1) continue;
+    let depth = 0;
+    let buf = "";
+    let endLine = i2;
+    let started = false;
+    for (let j = i2; j < Math.min(i2 + 25, lines.length); j++) {
+      for (const ch of lines[j]) {
+        if (ch === "(") {
+          depth++;
+          started = true;
+        } else if (ch === ")") {
+          depth--;
+        }
+        buf += ch;
+        if (started && depth === 0) {
+          endLine = j;
+          break;
+        }
+      }
+      if (started && depth === 0) break;
+      buf += "\n";
+    }
+    const argsStart = buf.indexOf("(");
+    if (argsStart === -1) continue;
+    const args2 = buf.substring(argsStart + 1, buf.length - 1);
+    const parts2 = [];
+    {
+      let d = 0;
+      let b = "";
+      let inStr = null;
+      for (let k = 0; k < args2.length; k++) {
+        const ch = args2[k];
+        if (inStr) {
+          if (ch === "\\") {
+            b += ch + (args2[k + 1] ?? "");
+            k++;
+            continue;
+          }
+          if (ch === inStr) inStr = null;
+          b += ch;
+          continue;
+        }
+        if (ch === '"' || ch === "`") {
+          inStr = ch;
+          b += ch;
+          continue;
+        }
+        if (ch === "(" || ch === "[" || ch === "{") d++;
+        else if (ch === ")" || ch === "]" || ch === "}") d--;
+        if (ch === "," && d === 0) {
+          parts2.push(b);
+          b = "";
+          continue;
+        }
+        b += ch;
+      }
+      if (b.trim().length > 0) parts2.push(b);
+    }
+    if (parts2.length < 7) continue;
+    const filterExpr = parts2[6].trim();
+    let tainted = false;
+    for (const v of taintedVars) {
+      if (new RegExp(`\\b${v}\\b`).test(filterExpr)) {
+        tainted = true;
+        break;
+      }
+    }
+    if (!tainted) continue;
+    if (seen.has(i2 + 1)) continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `ldap_injection-${file}-${i2 + 1}-go-newsearchrequest`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "ldap_injection",
+      cwe: "CWE-90",
+      severity: "critical",
+      level: "error",
+      message: "LDAP injection: go-ldap `ldap.NewSearchRequest(..., <tainted filter>, ...)` lets the attacker break out of the filter expression and enumerate the directory. Escape the user input with `ldap.EscapeFilter(...)` or use a structured filter builder.",
+      file,
+      line: i2 + 1,
+      snippet: (lines[i2] + (endLine > i2 ? " \u2026" : "")).trim()
+    });
+  }
+  return findings;
+}
+function findRustLdapInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\.\s*search\s*\(/.test(code)) return findings;
+  if (!/\b(?:ldap3|LdapConn|Ldap)\b/.test(code)) return findings;
+  const lines = code.split("\n");
+  const extractorTypeRe = /:\s*(?:String|Bytes|bytes::Bytes|axum::body::Bytes|web::Query\b|web::Path\b|web::Form\b|web::Json\b|HttpRequest\b|actix_web::HttpRequest\b)/;
+  const fns = [];
+  let cur = null;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const t = lines[i2];
+    if (/^\s*(?:pub\s+)?(?:async\s+)?fn\s+\w+\s*\(/.test(t)) {
+      if (cur) {
+        cur.end = i2 - 1;
+        fns.push(cur);
+      }
+      cur = { start: i2, end: lines.length - 1, tainted: /* @__PURE__ */ new Set() };
+      let headerJoined = "";
+      for (let j = i2; j < Math.min(i2 + 12, lines.length); j++) {
+        headerJoined += lines[j];
+        if (/\{\s*$/.test(lines[j])) break;
+      }
+      const open = headerJoined.indexOf("(");
+      const close = headerJoined.lastIndexOf(")");
+      if (open !== -1 && close > open) {
+        const params = headerJoined.substring(open + 1, close);
+        let depth = 0;
+        let buf = "";
+        const parts2 = [];
+        for (const ch of params) {
+          if (ch === "<" || ch === "(") depth++;
+          else if (ch === ">" || ch === ")") depth--;
+          if (ch === "," && depth === 0) {
+            parts2.push(buf);
+            buf = "";
+            continue;
+          }
+          buf += ch;
+        }
+        if (buf.trim().length > 0) parts2.push(buf);
+        for (const p of parts2) {
+          const pm = p.match(/(?:mut\s+)?(\w+)\s*:/);
+          if (!pm) continue;
+          if (extractorTypeRe.test(p)) cur.tainted.add(pm[1]);
+        }
+      }
+    }
+  }
+  if (cur) fns.push(cur);
+  for (const fn of fns) {
+    for (let pass = 0; pass < 3; pass++) {
+      const before = fn.tainted.size;
+      for (let i2 = fn.start; i2 <= fn.end; i2++) {
+        const t = lines[i2].trim();
+        const m = t.match(/^let\s+(?:mut\s+)?(\w+)\s*(?::\s*[^=]+)?=\s*(.+?);?$/);
+        if (!m) continue;
+        const lhs = m[1];
+        const rhs = m[2];
+        if (fn.tainted.has(lhs)) continue;
+        for (const v of fn.tainted) {
+          if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+            fn.tainted.add(lhs);
+            break;
+          }
+        }
+      }
+      if (fn.tainted.size === before) break;
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const fn of fns) {
+    if (fn.tainted.size === 0) continue;
+    for (let i2 = fn.start; i2 <= fn.end; i2++) {
+      const searchIdx = lines[i2].indexOf(".search(");
+      if (searchIdx === -1) continue;
+      let depth = 0;
+      let buf = "";
+      let started = false;
+      for (let j = i2; j < Math.min(i2 + 15, lines.length); j++) {
+        const startCol = j === i2 ? searchIdx : 0;
+        for (let k = startCol; k < lines[j].length; k++) {
+          const ch = lines[j][k];
+          if (ch === "(") {
+            depth++;
+            started = true;
+          } else if (ch === ")") {
+            depth--;
+          }
+          buf += ch;
+          if (started && depth === 0) break;
+        }
+        if (started && depth === 0) break;
+        buf += "\n";
+      }
+      const argsStart = buf.indexOf("(");
+      if (argsStart === -1) continue;
+      const args2 = buf.substring(argsStart + 1, buf.length - 1);
+      const parts2 = [];
+      {
+        let d = 0;
+        let b = "";
+        let inStr = null;
+        for (let k = 0; k < args2.length; k++) {
+          const ch = args2[k];
+          if (inStr) {
+            if (ch === "\\") {
+              b += ch + (args2[k + 1] ?? "");
+              k++;
+              continue;
+            }
+            if (ch === inStr) inStr = null;
+            b += ch;
+            continue;
+          }
+          if (ch === '"') {
+            inStr = ch;
+            b += ch;
+            continue;
+          }
+          if (ch === "(" || ch === "[" || ch === "{") d++;
+          else if (ch === ")" || ch === "]" || ch === "}") d--;
+          if (ch === "," && d === 0) {
+            parts2.push(b);
+            b = "";
+            continue;
+          }
+          b += ch;
+        }
+        if (b.trim().length > 0) parts2.push(b);
+      }
+      if (parts2.length < 3) continue;
+      const filterExpr = parts2[2].trim();
+      let tainted = false;
+      for (const v of fn.tainted) {
+        if (new RegExp(`\\b${v}\\b`).test(filterExpr)) {
+          tainted = true;
+          break;
+        }
+      }
+      if (!tainted) continue;
+      if (seen.has(i2 + 1)) continue;
+      seen.add(i2 + 1);
+      findings.push({
+        id: `ldap_injection-${file}-${i2 + 1}-rust-ldap3-search`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "ldap_injection",
+        cwe: "CWE-90",
+        severity: "critical",
+        level: "error",
+        message: "LDAP injection: ldap3 `LdapConn::search(..., &<tainted filter>, ...)` lets the attacker break out of the filter expression and enumerate the directory. Escape the user input or use a structured filter builder.",
+        file,
+        line: i2 + 1,
+        snippet: lines[i2].trim()
+      });
+    }
+  }
+  return findings;
+}
+function findRustLogInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\b(?:info|warn|error|debug|trace)\s*!\s*\(/.test(code)) return findings;
+  if (!/\b(?:log|tracing)\b/.test(code)) return findings;
+  const lines = code.split("\n");
+  const extractorTypeRe = /:\s*(?:String|Bytes|bytes::Bytes|axum::body::Bytes|web::Query\b|web::Path\b|web::Form\b|web::Json\b|HttpRequest\b|actix_web::HttpRequest\b)/;
+  const fns = [];
+  let cur = null;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const t = lines[i2];
+    if (/^\s*(?:pub\s+)?(?:async\s+)?fn\s+\w+\s*\(/.test(t)) {
+      if (cur) {
+        cur.end = i2 - 1;
+        fns.push(cur);
+      }
+      cur = { start: i2, end: lines.length - 1, tainted: /* @__PURE__ */ new Set() };
+      let headerJoined = "";
+      for (let j = i2; j < Math.min(i2 + 12, lines.length); j++) {
+        headerJoined += lines[j];
+        if (/\{\s*$/.test(lines[j])) break;
+      }
+      const open = headerJoined.indexOf("(");
+      const close = headerJoined.lastIndexOf(")");
+      if (open !== -1 && close > open) {
+        const params = headerJoined.substring(open + 1, close);
+        let depth = 0;
+        let buf = "";
+        const parts2 = [];
+        for (const ch of params) {
+          if (ch === "<" || ch === "(") depth++;
+          else if (ch === ">" || ch === ")") depth--;
+          if (ch === "," && depth === 0) {
+            parts2.push(buf);
+            buf = "";
+            continue;
+          }
+          buf += ch;
+        }
+        if (buf.trim().length > 0) parts2.push(buf);
+        for (const p of parts2) {
+          const pm = p.match(/(?:mut\s+)?(\w+)\s*:/);
+          if (!pm) continue;
+          if (extractorTypeRe.test(p)) cur.tainted.add(pm[1]);
+        }
+      }
+    }
+  }
+  if (cur) fns.push(cur);
+  for (const fn of fns) {
+    for (let pass = 0; pass < 3; pass++) {
+      const before = fn.tainted.size;
+      for (let i2 = fn.start; i2 <= fn.end; i2++) {
+        const t = lines[i2].trim();
+        const m = t.match(/^let\s+(?:mut\s+)?(\w+)\s*(?::\s*[^=]+)?=\s*(.+?);?$/);
+        if (!m) continue;
+        const lhs = m[1];
+        const rhs = m[2];
+        if (fn.tainted.has(lhs)) continue;
+        for (const v of fn.tainted) {
+          if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+            fn.tainted.add(lhs);
+            break;
+          }
+        }
+      }
+      if (fn.tainted.size === before) break;
+    }
+  }
+  const macroRe = /\b(info|warn|error|debug|trace)\s*!\s*\(\s*([^;]+?)\)\s*;?\s*$/;
+  const seen = /* @__PURE__ */ new Set();
+  for (const fn of fns) {
+    if (fn.tainted.size === 0) continue;
+    for (let i2 = fn.start; i2 <= fn.end; i2++) {
+      const line = lines[i2];
+      const m = line.match(macroRe);
+      if (!m) continue;
+      const macroName = m[1];
+      const argSpan = m[2];
+      const parts2 = [];
+      {
+        let d = 0;
+        let b = "";
+        let inStr = null;
+        for (let k = 0; k < argSpan.length; k++) {
+          const ch = argSpan[k];
+          if (inStr) {
+            if (ch === "\\") {
+              b += ch + (argSpan[k + 1] ?? "");
+              k++;
+              continue;
+            }
+            if (ch === inStr) inStr = null;
+            b += ch;
+            continue;
+          }
+          if (ch === '"') {
+            inStr = ch;
+            b += ch;
+            continue;
+          }
+          if (ch === "(" || ch === "[" || ch === "{") d++;
+          else if (ch === ")" || ch === "]" || ch === "}") d--;
+          if (ch === "," && d === 0) {
+            parts2.push(b);
+            b = "";
+            continue;
+          }
+          b += ch;
+        }
+        if (b.trim().length > 0) parts2.push(b);
+      }
+      if (parts2.length < 2) continue;
+      let tainted = false;
+      for (let p = 1; p < parts2.length; p++) {
+        for (const v of fn.tainted) {
+          if (new RegExp(`\\b${v}\\b`).test(parts2[p])) {
+            tainted = true;
+            break;
+          }
+        }
+        if (tainted) break;
+      }
+      if (!tainted) continue;
+      const key = `${i2 + 1}:${macroName}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push({
+        id: `log_injection-${file}-${i2 + 1}-rust-${macroName}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "log_injection",
+        cwe: "CWE-117",
+        severity: "medium",
+        level: "warning",
+        message: `Log injection: Rust \`${macroName}!(...)\` interpolates a tainted value into the log line. Unsanitized CRLF lets an attacker forge log entries or split records. Strip control characters or use a structured logging API.`,
+        file,
+        line: i2 + 1,
+        snippet: line.trim()
+      });
+    }
+  }
+  return findings;
+}
+function findGoGobDeserializationFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\bgob\s*\.\s*NewDecoder\s*\(/.test(code)) return findings;
+  if (!/\*http\.Request\b/.test(code) && !/\bhttp\.HandlerFunc\b/.test(code)) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const decoderFromBody = /* @__PURE__ */ new Set();
+  const newDecoderAssignRe = /^(\w+)\s*(?::=|=)\s*gob\s*\.\s*NewDecoder\s*\(\s*([^)]+)\)/;
+  for (const raw of lines) {
+    const t = raw.trim();
+    if (t.startsWith("//")) continue;
+    const m = t.match(newDecoderAssignRe);
+    if (!m) continue;
+    const lhs = m[1];
+    const arg = m[2];
+    if (/\b\w+\s*\.\s*Body\b/.test(arg)) {
+      decoderFromBody.add(lhs);
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  if (decoderFromBody.size > 0) {
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const line = lines[i2];
+      if (line.trim().startsWith("//")) continue;
+      const m = line.match(/\b(\w+)\s*\.\s*Decode\s*\(/);
+      if (!m) continue;
+      if (!decoderFromBody.has(m[1])) continue;
+      if (seen.has(i2 + 1)) continue;
+      seen.add(i2 + 1);
+      findings.push({
+        id: `insecure_deserialization-${file}-${i2 + 1}-go-gob`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "insecure_deserialization",
+        cwe: "CWE-502",
+        severity: "critical",
+        level: "error",
+        message: "Insecure deserialization: `gob.NewDecoder(req.Body).Decode(...)` reconstructs arbitrary registered Go types from attacker-controlled bytes. Use an authenticated framing (signed/MAC payloads), avoid decoding interface{} values, or switch to a schema-bound format (JSON with explicit types, Protocol Buffers).",
+        file,
+        line: i2 + 1,
+        snippet: line.trim()
+      });
+    }
+  }
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("//")) continue;
+    if (!/\bgob\s*\.\s*NewDecoder\s*\(\s*\w+\s*\.\s*Body\s*\)\s*\.\s*Decode\s*\(/.test(
+      line
+    )) {
+      continue;
+    }
+    if (seen.has(i2 + 1)) continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `insecure_deserialization-${file}-${i2 + 1}-go-gob-inline`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "insecure_deserialization",
+      cwe: "CWE-502",
+      severity: "critical",
+      level: "error",
+      message: "Insecure deserialization: `gob.NewDecoder(req.Body).Decode(...)` reconstructs arbitrary registered Go types from attacker-controlled bytes. Use an authenticated framing (signed/MAC payloads), avoid decoding interface{} values, or switch to a schema-bound format (JSON with explicit types, Protocol Buffers).",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findJsJsonParseBodyFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\bJSON\s*\.\s*parse\s*\(/.test(code)) return findings;
+  if (!/\breq\s*\.\s*body\b/.test(code)) return findings;
+  const lines = code.split("\n");
+  const reqBodyRe = /\breq\s*\.\s*body\b/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("//")) continue;
+      const m = t.match(/^(?:const|let|var)\s+(\w+)(?:\s*:\s*[^=]+)?\s*=\s*(.+?);?$/);
+      if (!m) continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqBodyRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  const callRe = /\bJSON\s*\.\s*parse\s*\(\s*([^)]+?)\s*\)/g;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("//")) continue;
+    callRe.lastIndex = 0;
+    let m;
+    while ((m = callRe.exec(line)) !== null) {
+      const arg = m[1];
+      let tainted = reqBodyRe.test(arg);
+      if (!tainted) {
+        for (const v of taintedVars) {
+          if (new RegExp(`\\b${v}\\b`).test(arg)) {
+            tainted = true;
+            break;
+          }
+        }
+      }
+      if (!tainted) continue;
+      if (seen.has(i2 + 1)) continue;
+      seen.add(i2 + 1);
+      findings.push({
+        id: `insecure_deserialization-${file}-${i2 + 1}-js-jsonparse-body`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "insecure_deserialization",
+        cwe: "CWE-502",
+        severity: "high",
+        level: "warning",
+        message: "`JSON.parse(req.body)` deserializes attacker-controlled bytes directly. With `express.text()` / `bodyParser.raw()` middleware `req.body` is an unvetted string; the parsed object can carry a `__proto__` payload that pollutes downstream property lookups. Validate against a schema (zod/ajv) before consuming the value.",
+        file,
+        line: i2 + 1,
+        snippet: line.trim()
+      });
+    }
+  }
+  return findings;
+}
+function findJsDomXpathInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\.\s*evaluate\s*\(/.test(code)) return findings;
+  if (!/\bXPathResult\b/.test(code)) return findings;
+  const browserSourceRe = /\b(?:location\s*\.\s*(?:search|hash|href)|URLSearchParams|window\s*\.\s*name|document\s*\.\s*cookie)\b/;
+  if (!browserSourceRe.test(code)) return findings;
+  const lines = code.split("\n");
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("//")) continue;
+      const m = t.match(/^(?:const|let|var)\s+(\w+)(?:\s*:\s*[^=]+)?\s*=\s*(.+?);?$/);
+      if (!m) continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs)) continue;
+      if (browserSourceRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  if (taintedVars.size === 0) return findings;
+  const evalRe = /\.\s*evaluate\s*\(\s*([^,)]+)/;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("//")) continue;
+    const m = line.match(evalRe);
+    if (!m) continue;
+    const arg = m[1].trim();
+    let tainted = false;
+    for (const v of taintedVars) {
+      if (new RegExp(`\\b${v}\\b`).test(arg)) {
+        tainted = true;
+        break;
+      }
+    }
+    if (!tainted) continue;
+    if (seen.has(i2 + 1)) continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `xpath_injection-${file}-${i2 + 1}-js-dom-evaluate`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xpath_injection",
+      cwe: "CWE-643",
+      severity: "high",
+      level: "warning",
+      message: "XPath injection: `document.evaluate(<tainted>, ...)` lets the attacker break out of the XPath expression and read sibling nodes. Bind user input through XPath variables / parameterized expressions, or escape with an allowlist before concatenation.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findGoXmlDecoderXxeFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\bxml\s*\.\s*NewDecoder\s*\(/.test(code)) return findings;
+  if (!/\*http\.Request\b/.test(code) && !/\bhttp\.HandlerFunc\b/.test(code)) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const decoderFromBody = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const t = lines[i2].trim();
+    if (t.startsWith("//")) continue;
+    const m = t.match(
+      /^(\w+)\s*(?::=|=)\s*xml\s*\.\s*NewDecoder\s*\(\s*([^)]+)\)/
+    );
+    if (!m) continue;
+    if (/\b\w+\s*\.\s*Body\b/.test(m[2])) decoderFromBody.set(m[1], i2);
+  }
+  if (decoderFromBody.size === 0) return findings;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("//")) continue;
+    const m = line.match(
+      /\b(\w+)\s*\.\s*(?:Strict\s*=\s*false|Entity\s*=)\b/
+    );
+    if (!m) continue;
+    if (!decoderFromBody.has(m[1])) continue;
+    if (seen.has(i2 + 1)) continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `xml_entity_expansion-${file}-${i2 + 1}-go-xml-decoder`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xml_entity_expansion",
+      cwe: "CWE-611",
+      severity: "high",
+      level: "warning",
+      message: "XXE: Go `xml.NewDecoder(req.Body)` with `Strict = false` (or a custom `Entity` map) allows entity references that the standard library normally rejects. Keep `Strict = true` and avoid setting `Entity` from attacker-controlled inputs.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findPythonJinjaTemplateSstiFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\bfrom\s+jinja2\s+import\s+[^#\n]*\bTemplate\b/.test(code) && !/\bjinja2\s*\.\s*Template\b/.test(code)) {
+    return findings;
+  }
+  const reqExtractRe = /\brequest\s*\.\s*(?:args|form|values|json|data|cookies|headers)\b/;
+  if (!reqExtractRe.test(code)) return findings;
+  const lines = code.split("\n");
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("#")) continue;
+      const m = t.match(/^(\w+)\s*=\s*(.+?)$/);
+      if (!m) continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  if (taintedVars.size === 0) return findings;
+  const ctorRe = /\b(?:jinja2\s*\.\s*)?Template\s*\(\s*([^)]+?)\s*\)/;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("#")) continue;
+    const m = line.match(ctorRe);
+    if (!m) continue;
+    const arg = m[1].trim();
+    let tainted = reqExtractRe.test(arg);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(arg)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted) continue;
+    if (seen.has(i2 + 1)) continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `template_injection-${file}-${i2 + 1}-py-jinja-template`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "template_injection",
+      cwe: "CWE-1336",
+      severity: "critical",
+      level: "error",
+      message: "Server-side template injection: `jinja2.Template(<tainted>).render()` compiles attacker-controlled source. Sandbox-escape gadgets such as `{{ ().__class__.__bases__[0].__subclasses__() }}` lead to RCE. Render fixed templates with user data passed as context variables.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findJsTemplateInjectionSstiFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\bHandlebars\s*\.\s*compile\s*\(/.test(code) && !/\bejs\s*\.\s*(?:render|compile)\s*\(/.test(code)) {
+    return findings;
+  }
+  if (!/\breq\s*\.\s*(?:query|body|params|headers|cookies)\b/.test(code)) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const reqExtractRe = /\breq\s*\.\s*(?:query|body|params|headers|cookies)\b/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("//")) continue;
+      const m = t.match(/^(?:const|let|var)\s+(\w+)(?:\s*:\s*[^=]+)?\s*=\s*(.+?);?$/);
+      if (!m) continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  if (taintedVars.size === 0) return findings;
+  const callRe = /\b(Handlebars\s*\.\s*compile|ejs\s*\.\s*(?:render|compile))\s*\(\s*([^,)]+)/;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("//")) continue;
+    const m = line.match(callRe);
+    if (!m) continue;
+    const arg = m[2].trim();
+    let tainted = reqExtractRe.test(arg);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(arg)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted) continue;
+    if (seen.has(i2 + 1)) continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `template_injection-${file}-${i2 + 1}-js-${m[1].replace(/[\s.]/g, "").toLowerCase()}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "template_injection",
+      cwe: "CWE-1336",
+      severity: "critical",
+      level: "error",
+      message: "Server-side template injection: compiling/rendering a template whose source is attacker-controlled (`Handlebars.compile(...)` / `ejs.render(...)`) opens helper-shadowing and prototype-gadget RCE paths. Use a fixed template and pass user data as context.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
 
 // src/analysis/passes/sink-filter-pass.ts
 var JS_XSS_SANITIZERS = [