circle-ir 3.182.0 → 3.186.0

package/dist/browser/circle-ir.js

@@ -11326,6 +11326,49 @@ var DEFAULT_SOURCES = [
   // Server-side interceptor receives `Metadata headers`; `headers.get(KEY)`
   // returns caller-supplied header values.
   { method: "get", class: "Metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
+  // --- WebSocket transport channels (cognium-dev #213 second slice) ---
+  //
+  // Server-side WebSocket handlers receive attacker-authored frames on
+  // every call to a receive-shaped method. Untrusted the moment they
+  // return, regardless of any application-level auth on the socket.
+  //
+  // Python — FastAPI / Starlette (`from fastapi import WebSocket`):
+  //   data = await websocket.receive_text()
+  //   data = await websocket.receive_bytes()
+  //   data = await websocket.receive_json()   # parsed dict/list
+  //   data = await websocket.receive()        # {'type', 'text'|'bytes'}
+  { method: "receive_text", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_bytes", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_json", class: "WebSocket", type: "http_body", severity: "high", return_tainted: true, languages: ["python"] },
+  //
+  // `receive` intentionally class-scoped to WebSocket (Starlette pattern).
+  // Broadening to unqualified would collide with queue/signal `.receive()`.
+  { method: "receive", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  // Django Channels `AsyncJsonWebsocketConsumer` / `WebsocketConsumer`
+  // expose the same receive_* names on `self`; the class filter matches
+  // `WebSocket` only, so add unqualified fallbacks for the receive_json /
+  // receive_text convention (broad — no class filter possible without
+  // hardcoding Django's consumer names).
+  { method: "receive_json", type: "http_body", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_text", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_bytes", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  // Go — gorilla/websocket (`github.com/gorilla/websocket`):
+  //   messageType, message, err := conn.ReadMessage()
+  //   _, r, err := conn.NextReader()
+  { method: "ReadMessage", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "NextReader", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // nhooyr.io/websocket exposes a `Read` method on `*websocket.Conn`;
+  // signature is `func (c *Conn) Read(ctx) (MessageType, []byte, error)`.
+  { method: "Read", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // Java — Jakarta / Java WebSocket API (`javax.websocket` / `jakarta.websocket`):
+  //   session.getBasicRemote().sendText(input);      // OUT (not a source)
+  //   @OnMessage public void onMessage(String msg) — `msg` is a callback
+  //   param, not a return; handled via param_tainted when annotation is set.
+  { annotation: "OnMessage", type: "network_input", severity: "high", param_tainted: true, languages: ["java"] },
+  // Spring `@MessageMapping` STOMP-over-WebSocket handlers receive
+  // untrusted payloads on every dispatched frame.
+  { annotation: "MessageMapping", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "SubscribeMapping", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
   // --- Cache reads (second-order taint — Redis / Memcached / Django cache) ---
   // The cache round-trip is a canonical second-order sink: whatever was
   // written previously (potentially attacker-controlled) resurfaces on read.
@@ -13354,6 +13397,91 @@ var DEFAULT_SANITIZERS = [
   // Command injection - shell escaping
   { method: "quote", class: "shell", removes: ["command_injection"] },
   { method: "escape", class: "shell-escape", removes: ["command_injection"] },
+  // JS/Node — additional XSS/HTML encoders (cognium-dev #213 sixth slice).
+  //
+  //   he.encode(x) / he.escape(x)               — `he` npm package
+  //   sanitizeHtml(x)                            — `sanitize-html` npm
+  //   xss(x) / filterXSS(x)                      — `xss` npm (Yahoo)
+  //   escapeHtml(x) / escapeHTML(x)              — common bare helpers
+  //   entities.encode(x) / entities.escape(x)    — `entities` npm
+  //   xssFilters.inHTMLData(x) / inHTMLComment(x) / uriInHTMLData(x)
+  //                                              — `xss-filters` npm (Yahoo)
+  //
+  // `external_taint_escape` is included alongside `xss` — the CWE-668
+  // fallback fires on any call receiving tainted data that the engine
+  // does not otherwise recognize. Since these functions are explicitly
+  // registered as sanitizers (they PURIFY input), they should also
+  // suppress the fallback so a `res.send(sanitizeHtml(x))` flow does
+  // not report an external-taint-escape at the sanitizer call itself.
+  { method: "encode", class: "he", removes: ["xss", "external_taint_escape"] },
+  { method: "escape", class: "he", removes: ["xss", "external_taint_escape"] },
+  { method: "sanitizeHtml", removes: ["xss", "external_taint_escape"] },
+  { method: "xss", removes: ["xss", "external_taint_escape"] },
+  { method: "filterXSS", removes: ["xss", "external_taint_escape"] },
+  { method: "escapeHtml", removes: ["xss", "external_taint_escape"] },
+  { method: "escapeHTML", removes: ["xss", "external_taint_escape"] },
+  { method: "encode", class: "entities", removes: ["xss", "external_taint_escape"] },
+  { method: "escape", class: "entities", removes: ["xss", "external_taint_escape"] },
+  // xss-filters: context-specific helpers, all XSS-safe by construction.
+  { method: "inHTMLData", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  { method: "inHTMLComment", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  { method: "uriInHTMLData", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  // JS/Node — SQL escaping (in addition to the mysql class above).
+  //
+  //   SqlString.escape / .escapeId               — `sqlstring` npm (raw
+  //                                                escape used by mysql /
+  //                                                node-mysql2 drivers)
+  //   pgFormat(sql, ...args) / format(bare)      — `pg-format` npm
+  //   SQL.raw / SQL(bare)                        — `sql-template-strings`
+  //
+  // Bare `format` is intentionally NOT registered — it collides with
+  // string.format-style helpers unrelated to SQL. Callers should use the
+  // qualified form.
+  { method: "escape", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "escapeId", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "format", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "format", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "ident", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "literal", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  // JS/Node — crypto.randomUUID() and Node's crypto.randomBytes(...)toString()
+  // produce cryptographically-secure typed strings that cannot carry
+  // attacker-injected payload. Registered as type coercion.
+  { method: "randomUUID", class: "crypto", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection", "xss"] },
+  // Bare `randomUUID()` alias — `import { randomUUID } from 'crypto'`.
+  { method: "randomUUID", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection", "xss"] },
+  // JS/Node — URL construction. `new URL(x, base)` (constructor-call
+  // matched by method_name === 'URL') and `URLSearchParams.toString()`
+  // safely encode components for URL context.
+  { method: "toString", class: "URLSearchParams", removes: ["ssrf", "open_redirect", "xss"] },
+  // Go — additional sanitizers (cognium-dev #213 sixth slice).
+  //
+  //   regexp.QuoteMeta(x)  — mirror of Python re.escape; strips regex
+  //                          metacharacters so downstream compile/match
+  //                          cannot execute attacker-crafted patterns.
+  //   bluemonday.Sanitize  — dominant Go HTML sanitizer library
+  //                          (`microcosm-cc/bluemonday`). Called on a
+  //                          Policy value returned by UGCPolicy() /
+  //                          StrictPolicy() / etc. Match by method name
+  //                          alone — Policy is the receiver type.
+  //   net.ParseIP(x)        — validates the input is a well-formed IP;
+  //                          returns nil for bad input (developer must
+  //                          check, but the sanitizer only applies when
+  //                          the parsed IP flows onward).
+  //   sql.Named(name, val) — parameterized query binding.
+  { method: "QuoteMeta", class: "regexp", removes: ["redos", "code_injection", "external_taint_escape"] },
+  { method: "Sanitize", class: "bluemonday", removes: ["xss", "external_taint_escape"] },
+  { method: "Sanitize", class: "Policy", removes: ["xss", "external_taint_escape"] },
+  // Bare `Sanitize` — the receiver is a Policy variable (`p := bluemonday.UGCPolicy(); p.Sanitize(x)`).
+  // `Policy` class-matching only fires when the IR resolves the receiver type;
+  // since Go DFG rarely propagates the type of a locally-assigned variable
+  // from a package factory call, we also register the bare method name.
+  // Narrow FP risk: `Sanitize` bare is uncommon outside bluemonday context.
+  { method: "Sanitize", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", class: "bluemonday", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", class: "Policy", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", removes: ["xss", "external_taint_escape"] },
+  { method: "ParseIP", class: "net", removes: ["ssrf", "command_injection", "path_traversal", "external_taint_escape"] },
+  { method: "Named", class: "sql", removes: ["sql_injection", "external_taint_escape"] },
   // =========================================================================
   // Python Sanitizers
   // =========================================================================
@@ -13398,6 +13526,60 @@ var DEFAULT_SANITIZERS = [
   // Python Type coercion
   { method: "int", removes: ["sql_injection", "command_injection", "xss"] },
   { method: "float", removes: ["sql_injection", "command_injection"] },
+  // Python URL encoding (cognium-dev #213 fifth slice).
+  //
+  //   urllib.parse.quote(x)      — RFC-3986 percent-encode; safe for URL path
+  //   urllib.parse.quote_plus(x) — same + space→+; safe for query string
+  //   urllib.parse.urlencode(d)  — encode a dict of pairs
+  //
+  // Bounded to URL-context sinks. Class-scoped to the specific
+  // `urllib.parse` receiver to avoid colliding with unrelated bare
+  // `quote(...)` calls in other libraries.
+  { method: "quote", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "quote_plus", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "urlencode", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss"] },
+  // Bare aliases — `from urllib.parse import quote` then unqualified.
+  { method: "quote_plus", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "urlencode", removes: ["ssrf", "open_redirect", "xss"] },
+  // `quote` bare is intentionally NOT registered — it collides with
+  // shlex.quote (bare-imported) which is a command_injection sanitizer,
+  // not a URL sanitizer. The class-scoped variant above catches the
+  // qualified `urllib.parse.quote(...)` shape; unqualified callers who
+  // want URL-context credit should use `quote_plus` (which does not
+  // collide with any command_injection sanitizer).
+  // Python XSS — additional common sanitizers.
+  //
+  //   bleach.clean(...)   — already covered above (line 2898)
+  //   bleach.linkify(...) — turns URLs into anchor tags; sanitizes as well
+  //   django.utils.html.escape / strip_tags — Django's XSS escape helpers
+  //   jinja2.escape       — Jinja2's Markup escape (aliased from markupsafe)
+  //   flask.escape        — Flask re-export of markupsafe.escape
+  //   saxutils.escape     — stdlib xml.sax.saxutils.escape for XML docs
+  { method: "linkify", class: "bleach", removes: ["xss"] },
+  // Bare `linkify(...)` alias — `from bleach import linkify`.
+  { method: "linkify", removes: ["xss"] },
+  { method: "escape", class: "django.utils.html", removes: ["xss"] },
+  { method: "strip_tags", class: "django.utils.html", removes: ["xss"] },
+  { method: "escape", class: "jinja2", removes: ["xss"] },
+  { method: "escape", class: "flask", removes: ["xss"] },
+  { method: "escape", class: "saxutils", removes: ["xss"] },
+  { method: "escape", class: "xml.sax.saxutils", removes: ["xss"] },
+  { method: "quoteattr", class: "saxutils", removes: ["xss"] },
+  { method: "quoteattr", class: "xml.sax.saxutils", removes: ["xss"] },
+  // Python ReDoS — `re.escape(user)` when building a regex from user input
+  // strips regex metacharacters. Downstream `re.compile / re.match` cannot
+  // interpret user-supplied alternations or quantifiers. Also covers the
+  // `code_injection` categorization that `re.compile` currently emits
+  // (a re.escape-wrapped pattern cannot execute anything, so both are safe).
+  { method: "escape", class: "re", removes: ["redos", "code_injection"] },
+  // Python SQLAlchemy — `text(...).bindparams(...)` binds params safely.
+  // The `bindparams` call is the sanitizer; the parent `text` wraps the
+  // template. Also add `expression.literal` for explicit SQL literals.
+  { method: "bindparams", removes: ["sql_injection"] },
+  // psycopg2 sql-composition helpers
+  { method: "Identifier", class: "sql", removes: ["sql_injection"] },
+  { method: "Literal", class: "sql", removes: ["sql_injection"] },
+  { method: "Placeholder", class: "sql", removes: ["sql_injection"] },
   // =========================================================================
   // Rust Sanitizers
   // =========================================================================
@@ -15321,7 +15503,14 @@ function matchesSanitizerPattern(call, pattern) {
       return false;
     }
     if (pattern.class) {
-      if (!call.receiver || !receiverMightBeClass(call.receiver, pattern.class)) {
+      if (!call.receiver) {
+        const target = call.resolution?.target;
+        const expectedTail = `${pattern.class}.${pattern.method}`;
+        if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {
+        } else {
+          return false;
+        }
+      } else if (!receiverMightBeClass(call.receiver, pattern.class)) {
         return false;
       }
     }
@@ -25647,7 +25836,22 @@ var PYTHON_TAINTED_PATTERNS2 = [
   // configs/sources/python.json but was not in the forward-taint regex
   // registry, so `name = input()` was not added to pyTaintedVars. Closes
   // the deferred `getattr(obj, input())()` reflection-invocation shape.
-  { pattern: /\binput\s*\(/, type: "io_input" }
+  { pattern: /\binput\s*\(/, type: "io_input" },
+  // WebSocket transport channels (cognium-dev #213 second slice).
+  // FastAPI / Starlette (`from fastapi import WebSocket`) and Django
+  // Channels consumers both expose `receive_*` methods that return
+  // untrusted frame payloads on every call. Registered in
+  // config-loader.ts as return-tainted; the forward-taint regex here
+  // enables `data = await websocket.receive_text()` → `data` tainted,
+  // which the DFG-less Python path needs so downstream sinks that
+  // consume `data` are flagged.
+  //
+  // Deliberately not adding a bare `.receive\s*\(` here — that would
+  // match too many unrelated APIs (queue receive, signal receive, etc.)
+  // and produce spurious sources on every `x = q.receive()` in the wild.
+  { pattern: /\.receive_text\s*\(/, type: "network_input" },
+  { pattern: /\.receive_bytes\s*\(/, type: "network_input" },
+  { pattern: /\.receive_json\s*\(/, type: "http_body" }
 ];
 var LanguageSourcesPass = class {
   name = "language-sources";
@@ -26339,6 +26543,31 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
       }
     }
   }
+  sources.push(...findJavaScriptCallbackParamSources(sourceCode));
+  return sources;
+}
+function findJavaScriptCallbackParamSources(sourceCode) {
+  const sources = [];
+  const CB_EVENT_RE = /\.on\s*\(\s*['"](?:message|text|binary)['"]\s*,\s*(?:async\s+)?(?:function\s*\*?\s*(?:\w+\s*)?\(\s*(\w+)|\(\s*(\w+)\s*(?:[,):]|$)|(\w+)\s*=>)/;
+  const lines = sourceCode.split("\n");
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const trimmed = line.trimStart();
+    if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+    const m = line.match(CB_EVENT_RE);
+    if (!m) continue;
+    const paramName = m[1] ?? m[2] ?? m[3];
+    if (!paramName) continue;
+    if (paramName === "err" || paramName === "error") continue;
+    sources.push({
+      type: "network_input",
+      location: `WebSocket .on(...) callback param '${paramName}' at line ${i2 + 1}`,
+      severity: "high",
+      line: i2 + 1,
+      confidence: 0.95,
+      variable: paramName
+    });
+  }
   return sources;
 }
 function findPythonAssignmentSources(sourceCode, language) {
@@ -26621,6 +26850,14 @@ function buildJavaScriptTaintedVars(sourceCode, language) {
   if (!["javascript", "typescript"].includes(language)) return /* @__PURE__ */ new Map();
   const tainted = /* @__PURE__ */ new Map();
   const lines = sourceCode.split("\n");
+  const CB_EVENT_RE = /\.on\s*\(\s*['"](?:message|text|binary)['"]\s*,\s*(?:async\s+)?(?:function\s*\*?\s*(?:\w+\s*)?\(\s*(\w+)|\(\s*(\w+)\s*(?:[,):]|$)|(\w+)\s*=>)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = lines[i2].match(CB_EVENT_RE);
+    if (!m) continue;
+    const paramName = m[1] ?? m[2] ?? m[3];
+    if (!paramName || paramName === "err" || paramName === "error") continue;
+    tainted.set(paramName, i2 + 1);
+  }
   for (let i2 = 0; i2 < lines.length; i2++) {
     const line = lines[i2];
     const trimmed = line.trimStart();
@@ -26817,6 +27054,79 @@ function findBashTaintSources(sourceCode, dfg) {
         });
       }
     }
+    const readMatch = /^read\s*\(/.test(trimmed) ? null : trimmed.match(/^read\b([^#(]*)$/);
+    if (readMatch) {
+      const argStr = readMatch[1].trim();
+      const noRedirect = argStr.replace(/\s*<[^<].*$/, "").trim();
+      const tokens = noRedirect.split(/\s+/);
+      const varNames = [];
+      for (let ti = 0; ti < tokens.length; ti++) {
+        const tok = tokens[ti];
+        if (!tok) continue;
+        if (tok.startsWith("-")) {
+          if (/^-[antpidu]$|^-N$/.test(tok)) ti++;
+          continue;
+        }
+        if (/^[A-Za-z_][\w]*$/.test(tok)) varNames.push(tok);
+      }
+      if (varNames.length === 0) varNames.push("REPLY");
+      for (const v of varNames) {
+        const already = sources.some((s) => s.line === lineNumber && s.variable === v);
+        if (already) continue;
+        sources.push({
+          type: "io_input",
+          location: `read \u2192 $${v} (stdin)`,
+          severity: "high",
+          line: lineNumber,
+          confidence: 0.9,
+          variable: v
+        });
+      }
+    }
+    const mapfileMatch = /^(?:mapfile|readarray)\s*\(/.test(trimmed) ? null : trimmed.match(/^(?:mapfile|readarray)\b([^#(]*)$/);
+    if (mapfileMatch) {
+      const argStr = mapfileMatch[1].trim();
+      const tokens = argStr.split(/\s+/);
+      const varNames = [];
+      for (let ti = 0; ti < tokens.length; ti++) {
+        const tok = tokens[ti];
+        if (!tok) continue;
+        if (tok.startsWith("-")) {
+          if (/^-[cCnOsud]$/.test(tok)) ti++;
+          continue;
+        }
+        if (/^[A-Za-z_][\w]*$/.test(tok)) varNames.push(tok);
+      }
+      if (varNames.length === 0) varNames.push("MAPFILE");
+      for (const v of varNames) {
+        const already = sources.some((s) => s.line === lineNumber && s.variable === v);
+        if (already) continue;
+        sources.push({
+          type: "io_input",
+          location: `mapfile \u2192 $${v} (stdin array)`,
+          severity: "high",
+          line: lineNumber,
+          confidence: 0.9,
+          variable: v
+        });
+      }
+    }
+    const getoptsMatch = trimmed.match(/\bgetopts\s+["'][^"']+["']\s+(\w+)/);
+    if (getoptsMatch) {
+      const flagVar = getoptsMatch[1];
+      for (const v of [flagVar, "OPTARG"]) {
+        const already = sources.some((s) => s.line === lineNumber && s.variable === v);
+        if (already) continue;
+        sources.push({
+          type: "io_input",
+          location: `getopts \u2192 $${v} (CLI arg)`,
+          severity: "high",
+          line: lineNumber,
+          confidence: 0.9,
+          variable: v
+        });
+      }
+    }
     const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})\}/g;
     let em;
     while ((em = envRe.exec(line)) !== null) {

package/dist/core/circle-ir-core.cjs

@@ -10721,6 +10721,49 @@ var DEFAULT_SOURCES = [
   // Server-side interceptor receives `Metadata headers`; `headers.get(KEY)`
   // returns caller-supplied header values.
   { method: "get", class: "Metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
+  // --- WebSocket transport channels (cognium-dev #213 second slice) ---
+  //
+  // Server-side WebSocket handlers receive attacker-authored frames on
+  // every call to a receive-shaped method. Untrusted the moment they
+  // return, regardless of any application-level auth on the socket.
+  //
+  // Python — FastAPI / Starlette (`from fastapi import WebSocket`):
+  //   data = await websocket.receive_text()
+  //   data = await websocket.receive_bytes()
+  //   data = await websocket.receive_json()   # parsed dict/list
+  //   data = await websocket.receive()        # {'type', 'text'|'bytes'}
+  { method: "receive_text", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_bytes", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_json", class: "WebSocket", type: "http_body", severity: "high", return_tainted: true, languages: ["python"] },
+  //
+  // `receive` intentionally class-scoped to WebSocket (Starlette pattern).
+  // Broadening to unqualified would collide with queue/signal `.receive()`.
+  { method: "receive", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  // Django Channels `AsyncJsonWebsocketConsumer` / `WebsocketConsumer`
+  // expose the same receive_* names on `self`; the class filter matches
+  // `WebSocket` only, so add unqualified fallbacks for the receive_json /
+  // receive_text convention (broad — no class filter possible without
+  // hardcoding Django's consumer names).
+  { method: "receive_json", type: "http_body", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_text", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_bytes", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  // Go — gorilla/websocket (`github.com/gorilla/websocket`):
+  //   messageType, message, err := conn.ReadMessage()
+  //   _, r, err := conn.NextReader()
+  { method: "ReadMessage", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "NextReader", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // nhooyr.io/websocket exposes a `Read` method on `*websocket.Conn`;
+  // signature is `func (c *Conn) Read(ctx) (MessageType, []byte, error)`.
+  { method: "Read", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // Java — Jakarta / Java WebSocket API (`javax.websocket` / `jakarta.websocket`):
+  //   session.getBasicRemote().sendText(input);      // OUT (not a source)
+  //   @OnMessage public void onMessage(String msg) — `msg` is a callback
+  //   param, not a return; handled via param_tainted when annotation is set.
+  { annotation: "OnMessage", type: "network_input", severity: "high", param_tainted: true, languages: ["java"] },
+  // Spring `@MessageMapping` STOMP-over-WebSocket handlers receive
+  // untrusted payloads on every dispatched frame.
+  { annotation: "MessageMapping", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "SubscribeMapping", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
   // --- Cache reads (second-order taint — Redis / Memcached / Django cache) ---
   // The cache round-trip is a canonical second-order sink: whatever was
   // written previously (potentially attacker-controlled) resurfaces on read.
@@ -12749,6 +12792,91 @@ var DEFAULT_SANITIZERS = [
   // Command injection - shell escaping
   { method: "quote", class: "shell", removes: ["command_injection"] },
   { method: "escape", class: "shell-escape", removes: ["command_injection"] },
+  // JS/Node — additional XSS/HTML encoders (cognium-dev #213 sixth slice).
+  //
+  //   he.encode(x) / he.escape(x)               — `he` npm package
+  //   sanitizeHtml(x)                            — `sanitize-html` npm
+  //   xss(x) / filterXSS(x)                      — `xss` npm (Yahoo)
+  //   escapeHtml(x) / escapeHTML(x)              — common bare helpers
+  //   entities.encode(x) / entities.escape(x)    — `entities` npm
+  //   xssFilters.inHTMLData(x) / inHTMLComment(x) / uriInHTMLData(x)
+  //                                              — `xss-filters` npm (Yahoo)
+  //
+  // `external_taint_escape` is included alongside `xss` — the CWE-668
+  // fallback fires on any call receiving tainted data that the engine
+  // does not otherwise recognize. Since these functions are explicitly
+  // registered as sanitizers (they PURIFY input), they should also
+  // suppress the fallback so a `res.send(sanitizeHtml(x))` flow does
+  // not report an external-taint-escape at the sanitizer call itself.
+  { method: "encode", class: "he", removes: ["xss", "external_taint_escape"] },
+  { method: "escape", class: "he", removes: ["xss", "external_taint_escape"] },
+  { method: "sanitizeHtml", removes: ["xss", "external_taint_escape"] },
+  { method: "xss", removes: ["xss", "external_taint_escape"] },
+  { method: "filterXSS", removes: ["xss", "external_taint_escape"] },
+  { method: "escapeHtml", removes: ["xss", "external_taint_escape"] },
+  { method: "escapeHTML", removes: ["xss", "external_taint_escape"] },
+  { method: "encode", class: "entities", removes: ["xss", "external_taint_escape"] },
+  { method: "escape", class: "entities", removes: ["xss", "external_taint_escape"] },
+  // xss-filters: context-specific helpers, all XSS-safe by construction.
+  { method: "inHTMLData", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  { method: "inHTMLComment", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  { method: "uriInHTMLData", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  // JS/Node — SQL escaping (in addition to the mysql class above).
+  //
+  //   SqlString.escape / .escapeId               — `sqlstring` npm (raw
+  //                                                escape used by mysql /
+  //                                                node-mysql2 drivers)
+  //   pgFormat(sql, ...args) / format(bare)      — `pg-format` npm
+  //   SQL.raw / SQL(bare)                        — `sql-template-strings`
+  //
+  // Bare `format` is intentionally NOT registered — it collides with
+  // string.format-style helpers unrelated to SQL. Callers should use the
+  // qualified form.
+  { method: "escape", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "escapeId", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "format", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "format", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "ident", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "literal", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  // JS/Node — crypto.randomUUID() and Node's crypto.randomBytes(...)toString()
+  // produce cryptographically-secure typed strings that cannot carry
+  // attacker-injected payload. Registered as type coercion.
+  { method: "randomUUID", class: "crypto", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection", "xss"] },
+  // Bare `randomUUID()` alias — `import { randomUUID } from 'crypto'`.
+  { method: "randomUUID", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection", "xss"] },
+  // JS/Node — URL construction. `new URL(x, base)` (constructor-call
+  // matched by method_name === 'URL') and `URLSearchParams.toString()`
+  // safely encode components for URL context.
+  { method: "toString", class: "URLSearchParams", removes: ["ssrf", "open_redirect", "xss"] },
+  // Go — additional sanitizers (cognium-dev #213 sixth slice).
+  //
+  //   regexp.QuoteMeta(x)  — mirror of Python re.escape; strips regex
+  //                          metacharacters so downstream compile/match
+  //                          cannot execute attacker-crafted patterns.
+  //   bluemonday.Sanitize  — dominant Go HTML sanitizer library
+  //                          (`microcosm-cc/bluemonday`). Called on a
+  //                          Policy value returned by UGCPolicy() /
+  //                          StrictPolicy() / etc. Match by method name
+  //                          alone — Policy is the receiver type.
+  //   net.ParseIP(x)        — validates the input is a well-formed IP;
+  //                          returns nil for bad input (developer must
+  //                          check, but the sanitizer only applies when
+  //                          the parsed IP flows onward).
+  //   sql.Named(name, val) — parameterized query binding.
+  { method: "QuoteMeta", class: "regexp", removes: ["redos", "code_injection", "external_taint_escape"] },
+  { method: "Sanitize", class: "bluemonday", removes: ["xss", "external_taint_escape"] },
+  { method: "Sanitize", class: "Policy", removes: ["xss", "external_taint_escape"] },
+  // Bare `Sanitize` — the receiver is a Policy variable (`p := bluemonday.UGCPolicy(); p.Sanitize(x)`).
+  // `Policy` class-matching only fires when the IR resolves the receiver type;
+  // since Go DFG rarely propagates the type of a locally-assigned variable
+  // from a package factory call, we also register the bare method name.
+  // Narrow FP risk: `Sanitize` bare is uncommon outside bluemonday context.
+  { method: "Sanitize", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", class: "bluemonday", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", class: "Policy", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", removes: ["xss", "external_taint_escape"] },
+  { method: "ParseIP", class: "net", removes: ["ssrf", "command_injection", "path_traversal", "external_taint_escape"] },
+  { method: "Named", class: "sql", removes: ["sql_injection", "external_taint_escape"] },
   // =========================================================================
   // Python Sanitizers
   // =========================================================================
@@ -12793,6 +12921,60 @@ var DEFAULT_SANITIZERS = [
   // Python Type coercion
   { method: "int", removes: ["sql_injection", "command_injection", "xss"] },
   { method: "float", removes: ["sql_injection", "command_injection"] },
+  // Python URL encoding (cognium-dev #213 fifth slice).
+  //
+  //   urllib.parse.quote(x)      — RFC-3986 percent-encode; safe for URL path
+  //   urllib.parse.quote_plus(x) — same + space→+; safe for query string
+  //   urllib.parse.urlencode(d)  — encode a dict of pairs
+  //
+  // Bounded to URL-context sinks. Class-scoped to the specific
+  // `urllib.parse` receiver to avoid colliding with unrelated bare
+  // `quote(...)` calls in other libraries.
+  { method: "quote", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "quote_plus", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "urlencode", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss"] },
+  // Bare aliases — `from urllib.parse import quote` then unqualified.
+  { method: "quote_plus", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "urlencode", removes: ["ssrf", "open_redirect", "xss"] },
+  // `quote` bare is intentionally NOT registered — it collides with
+  // shlex.quote (bare-imported) which is a command_injection sanitizer,
+  // not a URL sanitizer. The class-scoped variant above catches the
+  // qualified `urllib.parse.quote(...)` shape; unqualified callers who
+  // want URL-context credit should use `quote_plus` (which does not
+  // collide with any command_injection sanitizer).
+  // Python XSS — additional common sanitizers.
+  //
+  //   bleach.clean(...)   — already covered above (line 2898)
+  //   bleach.linkify(...) — turns URLs into anchor tags; sanitizes as well
+  //   django.utils.html.escape / strip_tags — Django's XSS escape helpers
+  //   jinja2.escape       — Jinja2's Markup escape (aliased from markupsafe)
+  //   flask.escape        — Flask re-export of markupsafe.escape
+  //   saxutils.escape     — stdlib xml.sax.saxutils.escape for XML docs
+  { method: "linkify", class: "bleach", removes: ["xss"] },
+  // Bare `linkify(...)` alias — `from bleach import linkify`.
+  { method: "linkify", removes: ["xss"] },
+  { method: "escape", class: "django.utils.html", removes: ["xss"] },
+  { method: "strip_tags", class: "django.utils.html", removes: ["xss"] },
+  { method: "escape", class: "jinja2", removes: ["xss"] },
+  { method: "escape", class: "flask", removes: ["xss"] },
+  { method: "escape", class: "saxutils", removes: ["xss"] },
+  { method: "escape", class: "xml.sax.saxutils", removes: ["xss"] },
+  { method: "quoteattr", class: "saxutils", removes: ["xss"] },
+  { method: "quoteattr", class: "xml.sax.saxutils", removes: ["xss"] },
+  // Python ReDoS — `re.escape(user)` when building a regex from user input
+  // strips regex metacharacters. Downstream `re.compile / re.match` cannot
+  // interpret user-supplied alternations or quantifiers. Also covers the
+  // `code_injection` categorization that `re.compile` currently emits
+  // (a re.escape-wrapped pattern cannot execute anything, so both are safe).
+  { method: "escape", class: "re", removes: ["redos", "code_injection"] },
+  // Python SQLAlchemy — `text(...).bindparams(...)` binds params safely.
+  // The `bindparams` call is the sanitizer; the parent `text` wraps the
+  // template. Also add `expression.literal` for explicit SQL literals.
+  { method: "bindparams", removes: ["sql_injection"] },
+  // psycopg2 sql-composition helpers
+  { method: "Identifier", class: "sql", removes: ["sql_injection"] },
+  { method: "Literal", class: "sql", removes: ["sql_injection"] },
+  { method: "Placeholder", class: "sql", removes: ["sql_injection"] },
   // =========================================================================
   // Rust Sanitizers
   // =========================================================================
@@ -14621,7 +14803,14 @@ function matchesSanitizerPattern(call, pattern) {
       return false;
     }
     if (pattern.class) {
-      if (!call.receiver || !receiverMightBeClass(call.receiver, pattern.class)) {
+      if (!call.receiver) {
+        const target = call.resolution?.target;
+        const expectedTail = `${pattern.class}.${pattern.method}`;
+        if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {
+        } else {
+          return false;
+        }
+      } else if (!receiverMightBeClass(call.receiver, pattern.class)) {
         return false;
       }
     }