circle-ir 3.181.0 → 3.185.0

package/dist/core/circle-ir-core.cjs

@@ -10066,6 +10066,10 @@ function processGoBlock(node, defs, uses, scopeStack, counters) {
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {
+        const right = rangeClause.childForFieldName("right");
+        if (right) {
+          extractGoUses(right, uses, scopeStack);
+        }
         const left = rangeClause.childForFieldName("left");
         if (left) {
           extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
@@ -10073,6 +10077,7 @@ function processGoBlock(node, defs, uses, scopeStack, counters) {
       }
     } else if (child.type === "call_expression") {
       extractGoUses(child, uses, scopeStack);
+      recordGoOpaqueCodecDestDef(child, defs, scopeStack);
     } else if (child.type === "return_statement") {
       for (let i2 = 0; i2 < child.childCount; i2++) {
         const expr = child.child(i2);
@@ -10165,6 +10170,63 @@ function findChildByTypeGo(node, type) {
   }
   return null;
 }
+var GO_OPAQUE_CODEC_METHODS = /* @__PURE__ */ new Set([
+  "Unmarshal",
+  // json/xml/yaml/toml/gob
+  "Decode",
+  // json.NewDecoder(r).Decode(&dest), gob.Decoder.Decode
+  "NewDecoder",
+  // wrapper; handled via chained Decode above
+  "UnmarshalYAML",
+  "UnmarshalJSON",
+  "UnmarshalText",
+  "UnmarshalBinary"
+]);
+function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
+  const fn = call.childForFieldName("function");
+  if (!fn || fn.type !== "selector_expression") return;
+  const fieldNode = fn.childForFieldName("field");
+  if (!fieldNode) return;
+  const method = getNodeText(fieldNode);
+  if (!GO_OPAQUE_CODEC_METHODS.has(method)) return;
+  const argsNode = call.childForFieldName("arguments");
+  if (!argsNode) return;
+  const args2 = [];
+  for (let i2 = 0; i2 < argsNode.childCount; i2++) {
+    const c = argsNode.child(i2);
+    if (!c) continue;
+    if (c.type === "," || c.type === "(" || c.type === ")") continue;
+    args2.push(c);
+  }
+  if (args2.length === 0) return;
+  const destArg = args2.length >= 2 ? args2[1] : args2[0];
+  const destName = extractGoAddressableVarName(destArg);
+  if (!destName || destName === "_") return;
+  const line = call.startPosition.row + 1;
+  const def = {
+    id: defs.length + 1,
+    variable: destName,
+    kind: "local",
+    line
+  };
+  defs.push(def);
+  currentScope(scopeStack).set(destName, def.id);
+}
+function extractGoAddressableVarName(node) {
+  if (node.type === "unary_expression") {
+    const operand = node.childForFieldName("operand") ?? node.child(1) ?? null;
+    if (operand) return extractGoAddressableVarName(operand);
+    return null;
+  }
+  if (node.type === "identifier") {
+    return getNodeText(node);
+  }
+  if (node.type === "selector_expression") {
+    const field = node.childForFieldName("field");
+    if (field) return getNodeText(field);
+  }
+  return null;
+}
 
 // src/analysis/config-loader.ts
 function parseConfig(content) {
@@ -10659,6 +10721,49 @@ var DEFAULT_SOURCES = [
   // Server-side interceptor receives `Metadata headers`; `headers.get(KEY)`
   // returns caller-supplied header values.
   { method: "get", class: "Metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
+  // --- WebSocket transport channels (cognium-dev #213 second slice) ---
+  //
+  // Server-side WebSocket handlers receive attacker-authored frames on
+  // every call to a receive-shaped method. Untrusted the moment they
+  // return, regardless of any application-level auth on the socket.
+  //
+  // Python — FastAPI / Starlette (`from fastapi import WebSocket`):
+  //   data = await websocket.receive_text()
+  //   data = await websocket.receive_bytes()
+  //   data = await websocket.receive_json()   # parsed dict/list
+  //   data = await websocket.receive()        # {'type', 'text'|'bytes'}
+  { method: "receive_text", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_bytes", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_json", class: "WebSocket", type: "http_body", severity: "high", return_tainted: true, languages: ["python"] },
+  //
+  // `receive` intentionally class-scoped to WebSocket (Starlette pattern).
+  // Broadening to unqualified would collide with queue/signal `.receive()`.
+  { method: "receive", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  // Django Channels `AsyncJsonWebsocketConsumer` / `WebsocketConsumer`
+  // expose the same receive_* names on `self`; the class filter matches
+  // `WebSocket` only, so add unqualified fallbacks for the receive_json /
+  // receive_text convention (broad — no class filter possible without
+  // hardcoding Django's consumer names).
+  { method: "receive_json", type: "http_body", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_text", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_bytes", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  // Go — gorilla/websocket (`github.com/gorilla/websocket`):
+  //   messageType, message, err := conn.ReadMessage()
+  //   _, r, err := conn.NextReader()
+  { method: "ReadMessage", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "NextReader", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // nhooyr.io/websocket exposes a `Read` method on `*websocket.Conn`;
+  // signature is `func (c *Conn) Read(ctx) (MessageType, []byte, error)`.
+  { method: "Read", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // Java — Jakarta / Java WebSocket API (`javax.websocket` / `jakarta.websocket`):
+  //   session.getBasicRemote().sendText(input);      // OUT (not a source)
+  //   @OnMessage public void onMessage(String msg) — `msg` is a callback
+  //   param, not a return; handled via param_tainted when annotation is set.
+  { annotation: "OnMessage", type: "network_input", severity: "high", param_tainted: true, languages: ["java"] },
+  // Spring `@MessageMapping` STOMP-over-WebSocket handlers receive
+  // untrusted payloads on every dispatched frame.
+  { annotation: "MessageMapping", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "SubscribeMapping", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
   // --- Cache reads (second-order taint — Redis / Memcached / Django cache) ---
   // The cache round-trip is a canonical second-order sink: whatever was
   // written previously (potentially attacker-controlled) resurfaces on read.
@@ -12731,6 +12836,60 @@ var DEFAULT_SANITIZERS = [
   // Python Type coercion
   { method: "int", removes: ["sql_injection", "command_injection", "xss"] },
   { method: "float", removes: ["sql_injection", "command_injection"] },
+  // Python URL encoding (cognium-dev #213 fifth slice).
+  //
+  //   urllib.parse.quote(x)      — RFC-3986 percent-encode; safe for URL path
+  //   urllib.parse.quote_plus(x) — same + space→+; safe for query string
+  //   urllib.parse.urlencode(d)  — encode a dict of pairs
+  //
+  // Bounded to URL-context sinks. Class-scoped to the specific
+  // `urllib.parse` receiver to avoid colliding with unrelated bare
+  // `quote(...)` calls in other libraries.
+  { method: "quote", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "quote_plus", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "urlencode", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss"] },
+  // Bare aliases — `from urllib.parse import quote` then unqualified.
+  { method: "quote_plus", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "urlencode", removes: ["ssrf", "open_redirect", "xss"] },
+  // `quote` bare is intentionally NOT registered — it collides with
+  // shlex.quote (bare-imported) which is a command_injection sanitizer,
+  // not a URL sanitizer. The class-scoped variant above catches the
+  // qualified `urllib.parse.quote(...)` shape; unqualified callers who
+  // want URL-context credit should use `quote_plus` (which does not
+  // collide with any command_injection sanitizer).
+  // Python XSS — additional common sanitizers.
+  //
+  //   bleach.clean(...)   — already covered above (line 2898)
+  //   bleach.linkify(...) — turns URLs into anchor tags; sanitizes as well
+  //   django.utils.html.escape / strip_tags — Django's XSS escape helpers
+  //   jinja2.escape       — Jinja2's Markup escape (aliased from markupsafe)
+  //   flask.escape        — Flask re-export of markupsafe.escape
+  //   saxutils.escape     — stdlib xml.sax.saxutils.escape for XML docs
+  { method: "linkify", class: "bleach", removes: ["xss"] },
+  // Bare `linkify(...)` alias — `from bleach import linkify`.
+  { method: "linkify", removes: ["xss"] },
+  { method: "escape", class: "django.utils.html", removes: ["xss"] },
+  { method: "strip_tags", class: "django.utils.html", removes: ["xss"] },
+  { method: "escape", class: "jinja2", removes: ["xss"] },
+  { method: "escape", class: "flask", removes: ["xss"] },
+  { method: "escape", class: "saxutils", removes: ["xss"] },
+  { method: "escape", class: "xml.sax.saxutils", removes: ["xss"] },
+  { method: "quoteattr", class: "saxutils", removes: ["xss"] },
+  { method: "quoteattr", class: "xml.sax.saxutils", removes: ["xss"] },
+  // Python ReDoS — `re.escape(user)` when building a regex from user input
+  // strips regex metacharacters. Downstream `re.compile / re.match` cannot
+  // interpret user-supplied alternations or quantifiers. Also covers the
+  // `code_injection` categorization that `re.compile` currently emits
+  // (a re.escape-wrapped pattern cannot execute anything, so both are safe).
+  { method: "escape", class: "re", removes: ["redos", "code_injection"] },
+  // Python SQLAlchemy — `text(...).bindparams(...)` binds params safely.
+  // The `bindparams` call is the sanitizer; the parent `text` wraps the
+  // template. Also add `expression.literal` for explicit SQL literals.
+  { method: "bindparams", removes: ["sql_injection"] },
+  // psycopg2 sql-composition helpers
+  { method: "Identifier", class: "sql", removes: ["sql_injection"] },
+  { method: "Literal", class: "sql", removes: ["sql_injection"] },
+  { method: "Placeholder", class: "sql", removes: ["sql_injection"] },
   // =========================================================================
   // Rust Sanitizers
   // =========================================================================
@@ -14559,7 +14718,14 @@ function matchesSanitizerPattern(call, pattern) {
       return false;
     }
     if (pattern.class) {
-      if (!call.receiver || !receiverMightBeClass(call.receiver, pattern.class)) {
+      if (!call.receiver) {
+        const target = call.resolution?.target;
+        const expectedTail = `${pattern.class}.${pattern.method}`;
+        if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {
+        } else {
+          return false;
+        }
+      } else if (!receiverMightBeClass(call.receiver, pattern.class)) {
         return false;
       }
     }
@@ -14987,15 +15153,21 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
     const callsAtSink = callsByLine.get(sink.line) ?? [];
     for (const call of callsAtSink) {
       for (const arg of call.arguments) {
-        if (arg.variable) {
-          if (sink.argPositions && sink.argPositions.length > 0) {
-            if (!sink.argPositions.includes(arg.position)) {
-              continue;
-            }
+        if (sink.argPositions && sink.argPositions.length > 0) {
+          if (!sink.argPositions.includes(arg.position)) {
+            continue;
           }
-          for (const use of usesAtSink) {
-            if (use.variable === arg.variable && use.def_id !== null) {
+        }
+        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        {
+          for (const use of candidateUses) {
+            if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
+                if (!arg.variable) {
+                  if (typeof arg.expression !== "string" || arg.expression.length === 0) continue;
+                  const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
+                  if (!re.test(arg.expression)) continue;
+                }
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
                   const isSanitized = checkSanitized(
@@ -15033,7 +15205,15 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
       }
     }
   }
-  return { taintedVars, flows, reachableSinks };
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const f of flows) {
+    const key = `${f.source.line}|${f.sink.line}|${f.sink.type}|${f.path.map((p) => p.variable).join(">")}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    deduped.push(f);
+  }
+  return { taintedVars, flows: deduped, reachableSinks };
 }
 function findInitialTaint(sources, callsByLine, defsByLine) {
   const tainted = [];

package/dist/core/circle-ir-core.js

@@ -10000,6 +10000,10 @@ function processGoBlock(node, defs, uses, scopeStack, counters) {
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {
+        const right = rangeClause.childForFieldName("right");
+        if (right) {
+          extractGoUses(right, uses, scopeStack);
+        }
         const left = rangeClause.childForFieldName("left");
         if (left) {
           extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
@@ -10007,6 +10011,7 @@ function processGoBlock(node, defs, uses, scopeStack, counters) {
       }
     } else if (child.type === "call_expression") {
       extractGoUses(child, uses, scopeStack);
+      recordGoOpaqueCodecDestDef(child, defs, scopeStack);
     } else if (child.type === "return_statement") {
       for (let i2 = 0; i2 < child.childCount; i2++) {
         const expr = child.child(i2);
@@ -10099,6 +10104,63 @@ function findChildByTypeGo(node, type) {
   }
   return null;
 }
+var GO_OPAQUE_CODEC_METHODS = /* @__PURE__ */ new Set([
+  "Unmarshal",
+  // json/xml/yaml/toml/gob
+  "Decode",
+  // json.NewDecoder(r).Decode(&dest), gob.Decoder.Decode
+  "NewDecoder",
+  // wrapper; handled via chained Decode above
+  "UnmarshalYAML",
+  "UnmarshalJSON",
+  "UnmarshalText",
+  "UnmarshalBinary"
+]);
+function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
+  const fn = call.childForFieldName("function");
+  if (!fn || fn.type !== "selector_expression") return;
+  const fieldNode = fn.childForFieldName("field");
+  if (!fieldNode) return;
+  const method = getNodeText(fieldNode);
+  if (!GO_OPAQUE_CODEC_METHODS.has(method)) return;
+  const argsNode = call.childForFieldName("arguments");
+  if (!argsNode) return;
+  const args2 = [];
+  for (let i2 = 0; i2 < argsNode.childCount; i2++) {
+    const c = argsNode.child(i2);
+    if (!c) continue;
+    if (c.type === "," || c.type === "(" || c.type === ")") continue;
+    args2.push(c);
+  }
+  if (args2.length === 0) return;
+  const destArg = args2.length >= 2 ? args2[1] : args2[0];
+  const destName = extractGoAddressableVarName(destArg);
+  if (!destName || destName === "_") return;
+  const line = call.startPosition.row + 1;
+  const def = {
+    id: defs.length + 1,
+    variable: destName,
+    kind: "local",
+    line
+  };
+  defs.push(def);
+  currentScope(scopeStack).set(destName, def.id);
+}
+function extractGoAddressableVarName(node) {
+  if (node.type === "unary_expression") {
+    const operand = node.childForFieldName("operand") ?? node.child(1) ?? null;
+    if (operand) return extractGoAddressableVarName(operand);
+    return null;
+  }
+  if (node.type === "identifier") {
+    return getNodeText(node);
+  }
+  if (node.type === "selector_expression") {
+    const field = node.childForFieldName("field");
+    if (field) return getNodeText(field);
+  }
+  return null;
+}
 
 // src/analysis/config-loader.ts
 function parseConfig(content) {
@@ -10593,6 +10655,49 @@ var DEFAULT_SOURCES = [
   // Server-side interceptor receives `Metadata headers`; `headers.get(KEY)`
   // returns caller-supplied header values.
   { method: "get", class: "Metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
+  // --- WebSocket transport channels (cognium-dev #213 second slice) ---
+  //
+  // Server-side WebSocket handlers receive attacker-authored frames on
+  // every call to a receive-shaped method. Untrusted the moment they
+  // return, regardless of any application-level auth on the socket.
+  //
+  // Python — FastAPI / Starlette (`from fastapi import WebSocket`):
+  //   data = await websocket.receive_text()
+  //   data = await websocket.receive_bytes()
+  //   data = await websocket.receive_json()   # parsed dict/list
+  //   data = await websocket.receive()        # {'type', 'text'|'bytes'}
+  { method: "receive_text", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_bytes", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_json", class: "WebSocket", type: "http_body", severity: "high", return_tainted: true, languages: ["python"] },
+  //
+  // `receive` intentionally class-scoped to WebSocket (Starlette pattern).
+  // Broadening to unqualified would collide with queue/signal `.receive()`.
+  { method: "receive", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  // Django Channels `AsyncJsonWebsocketConsumer` / `WebsocketConsumer`
+  // expose the same receive_* names on `self`; the class filter matches
+  // `WebSocket` only, so add unqualified fallbacks for the receive_json /
+  // receive_text convention (broad — no class filter possible without
+  // hardcoding Django's consumer names).
+  { method: "receive_json", type: "http_body", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_text", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_bytes", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  // Go — gorilla/websocket (`github.com/gorilla/websocket`):
+  //   messageType, message, err := conn.ReadMessage()
+  //   _, r, err := conn.NextReader()
+  { method: "ReadMessage", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "NextReader", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // nhooyr.io/websocket exposes a `Read` method on `*websocket.Conn`;
+  // signature is `func (c *Conn) Read(ctx) (MessageType, []byte, error)`.
+  { method: "Read", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // Java — Jakarta / Java WebSocket API (`javax.websocket` / `jakarta.websocket`):
+  //   session.getBasicRemote().sendText(input);      // OUT (not a source)
+  //   @OnMessage public void onMessage(String msg) — `msg` is a callback
+  //   param, not a return; handled via param_tainted when annotation is set.
+  { annotation: "OnMessage", type: "network_input", severity: "high", param_tainted: true, languages: ["java"] },
+  // Spring `@MessageMapping` STOMP-over-WebSocket handlers receive
+  // untrusted payloads on every dispatched frame.
+  { annotation: "MessageMapping", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "SubscribeMapping", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
   // --- Cache reads (second-order taint — Redis / Memcached / Django cache) ---
   // The cache round-trip is a canonical second-order sink: whatever was
   // written previously (potentially attacker-controlled) resurfaces on read.
@@ -12665,6 +12770,60 @@ var DEFAULT_SANITIZERS = [
   // Python Type coercion
   { method: "int", removes: ["sql_injection", "command_injection", "xss"] },
   { method: "float", removes: ["sql_injection", "command_injection"] },
+  // Python URL encoding (cognium-dev #213 fifth slice).
+  //
+  //   urllib.parse.quote(x)      — RFC-3986 percent-encode; safe for URL path
+  //   urllib.parse.quote_plus(x) — same + space→+; safe for query string
+  //   urllib.parse.urlencode(d)  — encode a dict of pairs
+  //
+  // Bounded to URL-context sinks. Class-scoped to the specific
+  // `urllib.parse` receiver to avoid colliding with unrelated bare
+  // `quote(...)` calls in other libraries.
+  { method: "quote", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "quote_plus", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "urlencode", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss"] },
+  // Bare aliases — `from urllib.parse import quote` then unqualified.
+  { method: "quote_plus", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "urlencode", removes: ["ssrf", "open_redirect", "xss"] },
+  // `quote` bare is intentionally NOT registered — it collides with
+  // shlex.quote (bare-imported) which is a command_injection sanitizer,
+  // not a URL sanitizer. The class-scoped variant above catches the
+  // qualified `urllib.parse.quote(...)` shape; unqualified callers who
+  // want URL-context credit should use `quote_plus` (which does not
+  // collide with any command_injection sanitizer).
+  // Python XSS — additional common sanitizers.
+  //
+  //   bleach.clean(...)   — already covered above (line 2898)
+  //   bleach.linkify(...) — turns URLs into anchor tags; sanitizes as well
+  //   django.utils.html.escape / strip_tags — Django's XSS escape helpers
+  //   jinja2.escape       — Jinja2's Markup escape (aliased from markupsafe)
+  //   flask.escape        — Flask re-export of markupsafe.escape
+  //   saxutils.escape     — stdlib xml.sax.saxutils.escape for XML docs
+  { method: "linkify", class: "bleach", removes: ["xss"] },
+  // Bare `linkify(...)` alias — `from bleach import linkify`.
+  { method: "linkify", removes: ["xss"] },
+  { method: "escape", class: "django.utils.html", removes: ["xss"] },
+  { method: "strip_tags", class: "django.utils.html", removes: ["xss"] },
+  { method: "escape", class: "jinja2", removes: ["xss"] },
+  { method: "escape", class: "flask", removes: ["xss"] },
+  { method: "escape", class: "saxutils", removes: ["xss"] },
+  { method: "escape", class: "xml.sax.saxutils", removes: ["xss"] },
+  { method: "quoteattr", class: "saxutils", removes: ["xss"] },
+  { method: "quoteattr", class: "xml.sax.saxutils", removes: ["xss"] },
+  // Python ReDoS — `re.escape(user)` when building a regex from user input
+  // strips regex metacharacters. Downstream `re.compile / re.match` cannot
+  // interpret user-supplied alternations or quantifiers. Also covers the
+  // `code_injection` categorization that `re.compile` currently emits
+  // (a re.escape-wrapped pattern cannot execute anything, so both are safe).
+  { method: "escape", class: "re", removes: ["redos", "code_injection"] },
+  // Python SQLAlchemy — `text(...).bindparams(...)` binds params safely.
+  // The `bindparams` call is the sanitizer; the parent `text` wraps the
+  // template. Also add `expression.literal` for explicit SQL literals.
+  { method: "bindparams", removes: ["sql_injection"] },
+  // psycopg2 sql-composition helpers
+  { method: "Identifier", class: "sql", removes: ["sql_injection"] },
+  { method: "Literal", class: "sql", removes: ["sql_injection"] },
+  { method: "Placeholder", class: "sql", removes: ["sql_injection"] },
   // =========================================================================
   // Rust Sanitizers
   // =========================================================================
@@ -14493,7 +14652,14 @@ function matchesSanitizerPattern(call, pattern) {
       return false;
     }
     if (pattern.class) {
-      if (!call.receiver || !receiverMightBeClass(call.receiver, pattern.class)) {
+      if (!call.receiver) {
+        const target = call.resolution?.target;
+        const expectedTail = `${pattern.class}.${pattern.method}`;
+        if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {
+        } else {
+          return false;
+        }
+      } else if (!receiverMightBeClass(call.receiver, pattern.class)) {
         return false;
       }
     }
@@ -14921,15 +15087,21 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
     const callsAtSink = callsByLine.get(sink.line) ?? [];
     for (const call of callsAtSink) {
       for (const arg of call.arguments) {
-        if (arg.variable) {
-          if (sink.argPositions && sink.argPositions.length > 0) {
-            if (!sink.argPositions.includes(arg.position)) {
-              continue;
-            }
+        if (sink.argPositions && sink.argPositions.length > 0) {
+          if (!sink.argPositions.includes(arg.position)) {
+            continue;
           }
-          for (const use of usesAtSink) {
-            if (use.variable === arg.variable && use.def_id !== null) {
+        }
+        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        {
+          for (const use of candidateUses) {
+            if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
+                if (!arg.variable) {
+                  if (typeof arg.expression !== "string" || arg.expression.length === 0) continue;
+                  const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
+                  if (!re.test(arg.expression)) continue;
+                }
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
                   const isSanitized = checkSanitized(
@@ -14967,7 +15139,15 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
       }
     }
   }
-  return { taintedVars, flows, reachableSinks };
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const f of flows) {
+    const key = `${f.source.line}|${f.sink.line}|${f.sink.type}|${f.path.map((p) => p.variable).join(">")}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    deduped.push(f);
+  }
+  return { taintedVars, flows: deduped, reachableSinks };
 }
 function findInitialTaint(sources, callsByLine, defsByLine) {
   const tainted = [];

package/dist/core/extractors/dfg.js

@@ -1385,6 +1385,14 @@ function processGoBlock(node, defs, uses, scopeStack, counters) {
             // range clause: for k, v := range expr
             const rangeClause = findChildByTypeGo(child, 'range_clause');
             if (rangeClause) {
+                const right = rangeClause.childForFieldName('right');
+                // Record uses of the range source on the same line as the loop-var
+                // defs, so `computeChains` links the source def → loop-var def, which
+                // is what carries taint into the loop body. Emit before defs so RHS
+                // uses see the outer binding, not the new loop var. (Issue #243.)
+                if (right) {
+                    extractGoUses(right, uses, scopeStack);
+                }
                 const left = rangeClause.childForFieldName('left');
                 if (left) {
                     extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
@@ -1394,6 +1402,14 @@ function processGoBlock(node, defs, uses, scopeStack, counters) {
         else if (child.type === 'call_expression') {
             // Extract uses from call arguments
             extractGoUses(child, uses, scopeStack);
+            // Opaque-codec destination re-def (cognium-dev #243).
+            //
+            // Calls like `json.Unmarshal(bytes, &dest)`, `xml.Unmarshal(...)`,
+            // `gob.NewDecoder(r).Decode(&dest)`, `yaml.Unmarshal(...)` populate
+            // `dest` via reflection. Model that as a re-definition of `dest` on
+            // this line so `computeChains` links the source-arg use to a fresh
+            // `dest` def and taint propagates through the codec.
+            recordGoOpaqueCodecDestDef(child, defs, scopeStack);
         }
         else if (child.type === 'return_statement') {
             // Extract uses from return expressions
@@ -1514,4 +1530,87 @@ function findChildByTypeGo(node, type) {
     }
     return null;
 }
+/**
+ * cognium-dev #243 — opaque codec destination re-defs for Go.
+ *
+ * Package/method pairs whose second (or only) arg is a destination that the
+ * call populates via reflection. Modelling them as re-defs of the dest lets
+ * `computeChains` link source-arg → dest and taint propagates through the
+ * codec.
+ */
+const GO_OPAQUE_CODEC_METHODS = new Set([
+    'Unmarshal', // json/xml/yaml/toml/gob
+    'Decode', // json.NewDecoder(r).Decode(&dest), gob.Decoder.Decode
+    'NewDecoder', // wrapper; handled via chained Decode above
+    'UnmarshalYAML',
+    'UnmarshalJSON',
+    'UnmarshalText',
+    'UnmarshalBinary',
+]);
+function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
+    // Only handle direct selector calls: `pkg.Method(...)` or `receiver.Decode(...)`.
+    const fn = call.childForFieldName('function');
+    if (!fn || fn.type !== 'selector_expression')
+        return;
+    const fieldNode = fn.childForFieldName('field');
+    if (!fieldNode)
+        return;
+    const method = getNodeText(fieldNode);
+    if (!GO_OPAQUE_CODEC_METHODS.has(method))
+        return;
+    const argsNode = call.childForFieldName('arguments');
+    if (!argsNode)
+        return;
+    // Positional args (skip commas / parens).
+    const args = [];
+    for (let i = 0; i < argsNode.childCount; i++) {
+        const c = argsNode.child(i);
+        if (!c)
+            continue;
+        if (c.type === ',' || c.type === '(' || c.type === ')')
+            continue;
+        args.push(c);
+    }
+    if (args.length === 0)
+        return;
+    // Destination convention:
+    //   - Unmarshal(bytes, &dest) → args[1]
+    //   - Decode(&dest)           → args[0]
+    const destArg = args.length >= 2 ? args[1] : args[0];
+    const destName = extractGoAddressableVarName(destArg);
+    if (!destName || destName === '_')
+        return;
+    const line = call.startPosition.row + 1;
+    const def = {
+        id: defs.length + 1,
+        variable: destName,
+        kind: 'local',
+        line,
+    };
+    defs.push(def);
+    currentScope(scopeStack).set(destName, def.id);
+}
+/**
+ * Return the addressed variable name for an opaque-codec destination arg.
+ * Handles `&x`, bare `x`, and `&pkg.Y`-style receivers (returns `Y` — the
+ * codec still populates that concrete addressable location).
+ */
+function extractGoAddressableVarName(node) {
+    if (node.type === 'unary_expression') {
+        // &x — operand carries the identifier
+        const operand = node.childForFieldName('operand') ?? node.child(1) ?? null;
+        if (operand)
+            return extractGoAddressableVarName(operand);
+        return null;
+    }
+    if (node.type === 'identifier') {
+        return getNodeText(node);
+    }
+    if (node.type === 'selector_expression') {
+        const field = node.childForFieldName('field');
+        if (field)
+            return getNodeText(field);
+    }
+    return null;
+}
 //# sourceMappingURL=dfg.js.map