circle-ir 3.188.0 → 3.190.0

package/dist/browser/circle-ir.js

@@ -10134,7 +10134,34 @@ var GO_OPAQUE_CODEC_METHODS = /* @__PURE__ */ new Set([
   "UnmarshalYAML",
   "UnmarshalJSON",
   "UnmarshalText",
-  "UnmarshalBinary"
+  "UnmarshalBinary",
+  // Go web framework body binders (cognium-dev #213 ninth slice).
+  // `c.BindJSON(&q)` / `c.BodyParser(&q)` / `c.Bind(&q)` /
+  // `c.ShouldBindJSON(&q)` / `c.BindQuery(&q)` etc. populate `q` via
+  // reflection from the HTTP request body — same shape as
+  // json.Unmarshal so we model them as a dest re-def on the call line.
+  // Same source-side entries in DEFAULT_SOURCES flag the return, but
+  // the destination-through-pointer shape needs this DFG hook.
+  "BindJSON",
+  "ShouldBindJSON",
+  "Bind",
+  "ShouldBind",
+  "BindQuery",
+  "ShouldBindQuery",
+  "BindUri",
+  "ShouldBindUri",
+  "BindXML",
+  "ShouldBindXML",
+  "BindYAML",
+  "ShouldBindYAML",
+  "BindHeader",
+  "ShouldBindHeader",
+  "BodyParser",
+  // Fiber
+  "QueryParser",
+  // Fiber
+  "ParamsParser"
+  // Fiber
 ]);
 function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
   const fn = call.childForFieldName("function");
@@ -11334,6 +11361,71 @@ var DEFAULT_SOURCES = [
   { method_annotation: "GraphQLMutation", type: "http_body", severity: "high", languages: ["java"] },
   { annotation: "InputArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
   { annotation: "GraphQLArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  // --- Go web framework sources (cognium-dev #213 ninth slice) ---
+  //
+  // Gin `c.Query("id")` / `c.Param("id")` / `c.PostForm("k")` /
+  //     `c.GetHeader("H")` / `c.Cookie("c")` / `c.FormFile("f")`.
+  //     Also body binders: `c.BindJSON(&d)` / `c.ShouldBindJSON(&d)` /
+  //     `c.Bind(&d)`. Class-scoped to `Context` — the Go local-receiver
+  //     resolver from #240 3.177.0 puts the resolved type into the
+  //     `receiver` field so class-matching works for `func h(c *gin.Context)`.
+  //
+  // Echo `c.QueryParam("id")` / `c.QueryParams()` / `c.Param("id")` /
+  //     `c.FormValue("k")` / `c.FormParams()` / `c.Request().Header` /
+  //     `c.Cookie("c")` / `c.Bind(&d)`.
+  //
+  // Fiber `c.Query("id")` / `c.Params("id")` / `c.FormValue("k")` /
+  //     `c.Cookies("c")` / `c.Get("H")` / `c.Body()` / `c.BodyParser(&d)`.
+  //     Distinct receiver type `*fiber.Ctx` — separate class entries.
+  //
+  // Chi `chi.URLParam(r, "id")` — package-level call, matched via
+  //     bare-import resolution in matchesSourcePattern.
+  //
+  // Beego `ctx.Input.Query(...)` — `Input` is a struct, so `.Query`
+  //     matches on `Input` class.
+  //
+  // Gorilla mux `mux.Vars(r)` — returns map of path vars.
+  { method: "Query", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Param", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "PostForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "GetHeader", class: "Context", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Cookie", class: "Context", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ShouldBindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Bind", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ShouldBindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ShouldBindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "MultipartForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  // Echo — QueryParam/QueryParams are Echo-distinctive.
+  { method: "QueryParam", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "QueryParams", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormValue", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormParams", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // Fiber — receiver type is `*fiber.Ctx`, distinct class name.
+  { method: "Query", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Params", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormValue", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormFile", class: "Ctx", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Cookies", class: "Ctx", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Get", class: "Ctx", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Body", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BodyParser", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "QueryParser", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ParamsParser", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  // Chi package-level path param.
+  { method: "URLParam", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "URLParamFromCtx", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  // Gorilla mux path vars.
+  { method: "Vars", class: "mux", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  // Beego — `ctx.Input.Query(...)` etc. `Input` is a struct field on Context.
+  { method: "Query", class: "Input", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Param", class: "Input", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Header", class: "Input", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Cookie", class: "Input", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
   // --- gRPC request metadata (Python — grpcio) ---
   // `context.invocation_metadata()` returns the caller-supplied metadata tuple.
   // No `class` filter — receiver names vary (`context`, `ctx`, `servicer_context`).
@@ -11410,6 +11502,27 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  // --- Modern JS/TS framework sources (cognium-dev #213 tenth slice) ---
+  //
+  // NextJS App Router: `req.nextUrl` is a NextURL instance whose
+  // `.searchParams`, `.pathname`, `.hash` carry attacker-controlled
+  // request state.
+  //   req.nextUrl.searchParams.get('id')
+  //   req.nextUrl.pathname
+  { property: "nextUrl", object: "req", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "nextUrl", object: "request", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Angular ActivatedRoute: `route.snapshot.params` / `queryParams` /
+  // `data`, and `route.paramMap` (Observable-based) are the two
+  // idioms for reading URL params.
+  { property: "snapshot", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "paramMap", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryParamMap", object: "route", type: "http_param", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Remix / SvelteKit / Astro / Bun / Deno all destructure `{ params, request, url }`
+  // from a handler-args object. Registering `params` / `url` /
+  // `searchParams` as unqualified properties would over-fire; instead
+  // add regex-based coverage in language-sources-pass.ts so the
+  // taint enters only through the specific request-URL chain
+  // (`url.searchParams.get(...)`, `event.url.pathname`).
   // --- Serverless transport channels (cognium-dev #213 first slice) ---
   //
   // AWS Lambda / API Gateway invocation-event properties. The Lambda
@@ -25914,7 +26027,29 @@ var JS_TAINTED_PATTERNS = [
   { pattern: /\bevent\.multiValueQueryStringParameters\b/, type: "http_param" },
   { pattern: /\bevent\.pathParameters\b/, type: "http_path" },
   { pattern: /\bevent\.headers\b/, type: "http_header" },
-  { pattern: /\bevent\.multiValueHeaders\b/, type: "http_header" }
+  { pattern: /\bevent\.multiValueHeaders\b/, type: "http_header" },
+  // Modern JS/TS framework request-URL / route-args (cognium-dev #213
+  // tenth slice). Scoped enough to avoid unrelated code:
+  //
+  //   NextJS App Router:  req.nextUrl.searchParams
+  //                       req.nextUrl.pathname
+  //   Remix:              params.<id> from ({ params, request })
+  //                       new URL(request.url).searchParams
+  //   SvelteKit:          event.params.<id>
+  //                       event.url.searchParams
+  //                       event.request.formData()
+  //   Angular:            route.snapshot.params
+  //                       route.snapshot.queryParams
+  //                       route.paramMap.get(...)
+  { pattern: /\breq(?:uest)?\.nextUrl\b/, type: "http_body" },
+  { pattern: /\.searchParams\s*\.\s*get\b/, type: "http_param" },
+  { pattern: /\bevent\.params\b/, type: "http_path" },
+  { pattern: /\bevent\.url\b/, type: "http_body" },
+  { pattern: /\bevent\.request\b/, type: "http_body" },
+  { pattern: /\broute\.snapshot\.params\b/, type: "http_path" },
+  { pattern: /\broute\.snapshot\.queryParams\b/, type: "http_param" },
+  { pattern: /\broute\.paramMap\b/, type: "http_path" },
+  { pattern: /\broute\.queryParamMap\b/, type: "http_param" }
 ];
 var PYTHON_TAINTED_PATTERNS2 = [
   { pattern: /\brequest\.args\b/, type: "http_param" },

package/dist/core/circle-ir-core.cjs

@@ -10180,7 +10180,34 @@ var GO_OPAQUE_CODEC_METHODS = /* @__PURE__ */ new Set([
   "UnmarshalYAML",
   "UnmarshalJSON",
   "UnmarshalText",
-  "UnmarshalBinary"
+  "UnmarshalBinary",
+  // Go web framework body binders (cognium-dev #213 ninth slice).
+  // `c.BindJSON(&q)` / `c.BodyParser(&q)` / `c.Bind(&q)` /
+  // `c.ShouldBindJSON(&q)` / `c.BindQuery(&q)` etc. populate `q` via
+  // reflection from the HTTP request body — same shape as
+  // json.Unmarshal so we model them as a dest re-def on the call line.
+  // Same source-side entries in DEFAULT_SOURCES flag the return, but
+  // the destination-through-pointer shape needs this DFG hook.
+  "BindJSON",
+  "ShouldBindJSON",
+  "Bind",
+  "ShouldBind",
+  "BindQuery",
+  "ShouldBindQuery",
+  "BindUri",
+  "ShouldBindUri",
+  "BindXML",
+  "ShouldBindXML",
+  "BindYAML",
+  "ShouldBindYAML",
+  "BindHeader",
+  "ShouldBindHeader",
+  "BodyParser",
+  // Fiber
+  "QueryParser",
+  // Fiber
+  "ParamsParser"
+  // Fiber
 ]);
 function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
   const fn = call.childForFieldName("function");
@@ -10729,6 +10756,71 @@ var DEFAULT_SOURCES = [
   { method_annotation: "GraphQLMutation", type: "http_body", severity: "high", languages: ["java"] },
   { annotation: "InputArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
   { annotation: "GraphQLArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  // --- Go web framework sources (cognium-dev #213 ninth slice) ---
+  //
+  // Gin `c.Query("id")` / `c.Param("id")` / `c.PostForm("k")` /
+  //     `c.GetHeader("H")` / `c.Cookie("c")` / `c.FormFile("f")`.
+  //     Also body binders: `c.BindJSON(&d)` / `c.ShouldBindJSON(&d)` /
+  //     `c.Bind(&d)`. Class-scoped to `Context` — the Go local-receiver
+  //     resolver from #240 3.177.0 puts the resolved type into the
+  //     `receiver` field so class-matching works for `func h(c *gin.Context)`.
+  //
+  // Echo `c.QueryParam("id")` / `c.QueryParams()` / `c.Param("id")` /
+  //     `c.FormValue("k")` / `c.FormParams()` / `c.Request().Header` /
+  //     `c.Cookie("c")` / `c.Bind(&d)`.
+  //
+  // Fiber `c.Query("id")` / `c.Params("id")` / `c.FormValue("k")` /
+  //     `c.Cookies("c")` / `c.Get("H")` / `c.Body()` / `c.BodyParser(&d)`.
+  //     Distinct receiver type `*fiber.Ctx` — separate class entries.
+  //
+  // Chi `chi.URLParam(r, "id")` — package-level call, matched via
+  //     bare-import resolution in matchesSourcePattern.
+  //
+  // Beego `ctx.Input.Query(...)` — `Input` is a struct, so `.Query`
+  //     matches on `Input` class.
+  //
+  // Gorilla mux `mux.Vars(r)` — returns map of path vars.
+  { method: "Query", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Param", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "PostForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "GetHeader", class: "Context", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Cookie", class: "Context", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ShouldBindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Bind", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ShouldBindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ShouldBindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "MultipartForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  // Echo — QueryParam/QueryParams are Echo-distinctive.
+  { method: "QueryParam", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "QueryParams", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormValue", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormParams", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // Fiber — receiver type is `*fiber.Ctx`, distinct class name.
+  { method: "Query", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Params", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormValue", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormFile", class: "Ctx", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Cookies", class: "Ctx", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Get", class: "Ctx", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Body", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BodyParser", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "QueryParser", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ParamsParser", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  // Chi package-level path param.
+  { method: "URLParam", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "URLParamFromCtx", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  // Gorilla mux path vars.
+  { method: "Vars", class: "mux", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  // Beego — `ctx.Input.Query(...)` etc. `Input` is a struct field on Context.
+  { method: "Query", class: "Input", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Param", class: "Input", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Header", class: "Input", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Cookie", class: "Input", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
   // --- gRPC request metadata (Python — grpcio) ---
   // `context.invocation_metadata()` returns the caller-supplied metadata tuple.
   // No `class` filter — receiver names vary (`context`, `ctx`, `servicer_context`).
@@ -10805,6 +10897,27 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  // --- Modern JS/TS framework sources (cognium-dev #213 tenth slice) ---
+  //
+  // NextJS App Router: `req.nextUrl` is a NextURL instance whose
+  // `.searchParams`, `.pathname`, `.hash` carry attacker-controlled
+  // request state.
+  //   req.nextUrl.searchParams.get('id')
+  //   req.nextUrl.pathname
+  { property: "nextUrl", object: "req", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "nextUrl", object: "request", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Angular ActivatedRoute: `route.snapshot.params` / `queryParams` /
+  // `data`, and `route.paramMap` (Observable-based) are the two
+  // idioms for reading URL params.
+  { property: "snapshot", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "paramMap", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryParamMap", object: "route", type: "http_param", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Remix / SvelteKit / Astro / Bun / Deno all destructure `{ params, request, url }`
+  // from a handler-args object. Registering `params` / `url` /
+  // `searchParams` as unqualified properties would over-fire; instead
+  // add regex-based coverage in language-sources-pass.ts so the
+  // taint enters only through the specific request-URL chain
+  // (`url.searchParams.get(...)`, `event.url.pathname`).
   // --- Serverless transport channels (cognium-dev #213 first slice) ---
   //
   // AWS Lambda / API Gateway invocation-event properties. The Lambda

package/dist/core/circle-ir-core.js

@@ -10114,7 +10114,34 @@ var GO_OPAQUE_CODEC_METHODS = /* @__PURE__ */ new Set([
   "UnmarshalYAML",
   "UnmarshalJSON",
   "UnmarshalText",
-  "UnmarshalBinary"
+  "UnmarshalBinary",
+  // Go web framework body binders (cognium-dev #213 ninth slice).
+  // `c.BindJSON(&q)` / `c.BodyParser(&q)` / `c.Bind(&q)` /
+  // `c.ShouldBindJSON(&q)` / `c.BindQuery(&q)` etc. populate `q` via
+  // reflection from the HTTP request body — same shape as
+  // json.Unmarshal so we model them as a dest re-def on the call line.
+  // Same source-side entries in DEFAULT_SOURCES flag the return, but
+  // the destination-through-pointer shape needs this DFG hook.
+  "BindJSON",
+  "ShouldBindJSON",
+  "Bind",
+  "ShouldBind",
+  "BindQuery",
+  "ShouldBindQuery",
+  "BindUri",
+  "ShouldBindUri",
+  "BindXML",
+  "ShouldBindXML",
+  "BindYAML",
+  "ShouldBindYAML",
+  "BindHeader",
+  "ShouldBindHeader",
+  "BodyParser",
+  // Fiber
+  "QueryParser",
+  // Fiber
+  "ParamsParser"
+  // Fiber
 ]);
 function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
   const fn = call.childForFieldName("function");
@@ -10663,6 +10690,71 @@ var DEFAULT_SOURCES = [
   { method_annotation: "GraphQLMutation", type: "http_body", severity: "high", languages: ["java"] },
   { annotation: "InputArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
   { annotation: "GraphQLArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  // --- Go web framework sources (cognium-dev #213 ninth slice) ---
+  //
+  // Gin `c.Query("id")` / `c.Param("id")` / `c.PostForm("k")` /
+  //     `c.GetHeader("H")` / `c.Cookie("c")` / `c.FormFile("f")`.
+  //     Also body binders: `c.BindJSON(&d)` / `c.ShouldBindJSON(&d)` /
+  //     `c.Bind(&d)`. Class-scoped to `Context` — the Go local-receiver
+  //     resolver from #240 3.177.0 puts the resolved type into the
+  //     `receiver` field so class-matching works for `func h(c *gin.Context)`.
+  //
+  // Echo `c.QueryParam("id")` / `c.QueryParams()` / `c.Param("id")` /
+  //     `c.FormValue("k")` / `c.FormParams()` / `c.Request().Header` /
+  //     `c.Cookie("c")` / `c.Bind(&d)`.
+  //
+  // Fiber `c.Query("id")` / `c.Params("id")` / `c.FormValue("k")` /
+  //     `c.Cookies("c")` / `c.Get("H")` / `c.Body()` / `c.BodyParser(&d)`.
+  //     Distinct receiver type `*fiber.Ctx` — separate class entries.
+  //
+  // Chi `chi.URLParam(r, "id")` — package-level call, matched via
+  //     bare-import resolution in matchesSourcePattern.
+  //
+  // Beego `ctx.Input.Query(...)` — `Input` is a struct, so `.Query`
+  //     matches on `Input` class.
+  //
+  // Gorilla mux `mux.Vars(r)` — returns map of path vars.
+  { method: "Query", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Param", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "PostForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "GetHeader", class: "Context", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Cookie", class: "Context", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ShouldBindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Bind", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ShouldBindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ShouldBindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "MultipartForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  // Echo — QueryParam/QueryParams are Echo-distinctive.
+  { method: "QueryParam", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "QueryParams", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormValue", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormParams", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
+  // Fiber — receiver type is `*fiber.Ctx`, distinct class name.
+  { method: "Query", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Params", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormValue", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "FormFile", class: "Ctx", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Cookies", class: "Ctx", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Get", class: "Ctx", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Body", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "BodyParser", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "QueryParser", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "ParamsParser", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  // Chi package-level path param.
+  { method: "URLParam", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "URLParamFromCtx", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  // Gorilla mux path vars.
+  { method: "Vars", class: "mux", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  // Beego — `ctx.Input.Query(...)` etc. `Input` is a struct field on Context.
+  { method: "Query", class: "Input", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Param", class: "Input", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Header", class: "Input", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Cookie", class: "Input", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
   // --- gRPC request metadata (Python — grpcio) ---
   // `context.invocation_metadata()` returns the caller-supplied metadata tuple.
   // No `class` filter — receiver names vary (`context`, `ctx`, `servicer_context`).
@@ -10739,6 +10831,27 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  // --- Modern JS/TS framework sources (cognium-dev #213 tenth slice) ---
+  //
+  // NextJS App Router: `req.nextUrl` is a NextURL instance whose
+  // `.searchParams`, `.pathname`, `.hash` carry attacker-controlled
+  // request state.
+  //   req.nextUrl.searchParams.get('id')
+  //   req.nextUrl.pathname
+  { property: "nextUrl", object: "req", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "nextUrl", object: "request", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Angular ActivatedRoute: `route.snapshot.params` / `queryParams` /
+  // `data`, and `route.paramMap` (Observable-based) are the two
+  // idioms for reading URL params.
+  { property: "snapshot", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "paramMap", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryParamMap", object: "route", type: "http_param", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Remix / SvelteKit / Astro / Bun / Deno all destructure `{ params, request, url }`
+  // from a handler-args object. Registering `params` / `url` /
+  // `searchParams` as unqualified properties would over-fire; instead
+  // add regex-based coverage in language-sources-pass.ts so the
+  // taint enters only through the specific request-URL chain
+  // (`url.searchParams.get(...)`, `event.url.pathname`).
   // --- Serverless transport channels (cognium-dev #213 first slice) ---
   //
   // AWS Lambda / API Gateway invocation-event properties. The Lambda

package/dist/core/extractors/dfg.js

@@ -1546,6 +1546,30 @@ const GO_OPAQUE_CODEC_METHODS = new Set([
     'UnmarshalJSON',
     'UnmarshalText',
     'UnmarshalBinary',
+    // Go web framework body binders (cognium-dev #213 ninth slice).
+    // `c.BindJSON(&q)` / `c.BodyParser(&q)` / `c.Bind(&q)` /
+    // `c.ShouldBindJSON(&q)` / `c.BindQuery(&q)` etc. populate `q` via
+    // reflection from the HTTP request body — same shape as
+    // json.Unmarshal so we model them as a dest re-def on the call line.
+    // Same source-side entries in DEFAULT_SOURCES flag the return, but
+    // the destination-through-pointer shape needs this DFG hook.
+    'BindJSON',
+    'ShouldBindJSON',
+    'Bind',
+    'ShouldBind',
+    'BindQuery',
+    'ShouldBindQuery',
+    'BindUri',
+    'ShouldBindUri',
+    'BindXML',
+    'ShouldBindXML',
+    'BindYAML',
+    'ShouldBindYAML',
+    'BindHeader',
+    'ShouldBindHeader',
+    'BodyParser', // Fiber
+    'QueryParser', // Fiber
+    'ParamsParser', // Fiber
 ]);
 function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
     // Only handle direct selector calls: `pkg.Method(...)` or `receiver.Decode(...)`.