circle-ir 3.198.0 → 3.200.0

package/dist/browser/circle-ir.js

@@ -4380,6 +4380,10 @@ function extractJavaScriptTypes(tree, cache) {
   for (const cls of classes) {
     types.push(extractJSClassInfo(cls));
   }
+  const interfaces = getNodesFromCache(tree.rootNode, "interface_declaration", cache);
+  for (const iface of interfaces) {
+    types.push(extractTSInterfaceInfo(iface));
+  }
   const functions = getNodesFromCache(tree.rootNode, "function_declaration", cache);
   if (functions.length > 0) {
     const moduleFunctions = [];
@@ -4715,6 +4719,73 @@ function extractSelfAssignments(body2, fields, fieldNames) {
     }
   }
 }
+function extractTSInterfaceInfo(node) {
+  const name2 = getIdentifier(node, "name") ?? "Anonymous";
+  const parents = [];
+  for (let i2 = 0; i2 < node.childCount; i2++) {
+    const child = node.child(i2);
+    if (!child || child.type !== "extends_type_clause") continue;
+    for (let j = 0; j < child.childCount; j++) {
+      const gc = child.child(j);
+      if (!gc) continue;
+      if (gc.type === "type_identifier" || gc.type === "generic_type" || gc.type === "nested_type_identifier") {
+        parents.push(getNodeText(gc));
+      }
+    }
+  }
+  const body2 = node.childForFieldName("body");
+  const methods = [];
+  const fields = [];
+  if (body2) {
+    for (let i2 = 0; i2 < body2.childCount; i2++) {
+      const member = body2.child(i2);
+      if (!member) continue;
+      if (member.type === "method_signature") {
+        const methodName = getIdentifier(member, "name") ?? getNodeText(member.child(0) ?? member);
+        const params = member.childForFieldName("parameters");
+        const returnType = member.childForFieldName("return_type");
+        methods.push({
+          name: methodName,
+          return_type: returnType ? getNodeText(returnType).replace(/^:\s*/, "") : null,
+          parameters: params ? extractJSParameters(params) : [],
+          annotations: [],
+          // An interface member has no body and therefore no modifiers in the
+          // class sense; `readonly` / `?` live on property signatures.
+          modifiers: [],
+          start_line: member.startPosition.row + 1,
+          end_line: member.endPosition.row + 1
+        });
+        continue;
+      }
+      if (member.type === "property_signature") {
+        const fieldName = getIdentifier(member, "name") ?? getNodeText(member.child(0) ?? member);
+        const typeNode = member.childForFieldName("type");
+        const modifiers = [];
+        const text = getNodeText(member);
+        if (/^\s*readonly\b/.test(text)) modifiers.push("readonly");
+        if (/\?\s*:/.test(text)) modifiers.push("optional");
+        fields.push({
+          name: fieldName,
+          type: typeNode ? getNodeText(typeNode).replace(/^:\s*/, "") : null,
+          modifiers,
+          annotations: []
+        });
+      }
+    }
+  }
+  return {
+    name: name2,
+    kind: "interface",
+    package: null,
+    extends: parents[0] ?? null,
+    implements: parents.slice(1),
+    annotations: [],
+    methods,
+    fields,
+    start_line: node.startPosition.row + 1,
+    end_line: node.endPosition.row + 1
+  };
+}
 function extractJSClassInfo(node) {
   const name2 = getIdentifier(node, "name") ?? "Anonymous";
   let extendsType = null;
@@ -11011,6 +11082,26 @@ var DEFAULT_SOURCES = [
   { annotation: "FormParam", type: "http_param", severity: "high", param_tainted: true },
   { annotation: "PathParam", type: "http_path", severity: "medium", param_tainted: true },
   { annotation: "HeaderParam", type: "http_header", severity: "high", param_tainted: true },
+  // JAX-RS params the block was missing (jakarta.ws.rs). Java-scoped — the
+  // JS decorator ecosystem has its own distinct names and should not match.
+  { annotation: "CookieParam", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "MatrixParam", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "BeanParam", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Micronaut (io.micronaut.http.annotation). @Body / @Header / @CookieValue /
+  // @PathVariable reuse Spring/JAX-RS names already covered above; these three
+  // are Micronaut-specific. Java-scoped.
+  { annotation: "QueryValue", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "Part", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RequestBean", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Quarkus / RESTEasy Reactive (org.jboss.resteasy.reactive) — the `@Rest*`
+  // shortcut annotations that infer the binding name from the parameter name.
+  // Java-scoped.
+  { annotation: "RestQuery", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestPath", type: "http_path", severity: "medium", param_tainted: true, languages: ["java"] },
+  { annotation: "RestHeader", type: "http_header", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestForm", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestCookie", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestMatrix", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
   // Jenkins data-binding: every parameter of an annotated constructor is wired
   // from form/JSON user input at construction time. Method-level annotation —
   // all params tainted.
@@ -12689,6 +12780,25 @@ var DEFAULT_SINKS = [
   { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  // TypeORM QueryBuilder raw fragments (CWE-89). TypeORM's raw `.query(sql)`
+  // escape hatch is already covered by the classless `query` sink in the JS
+  // plugin (getBuiltinSinks), so it is NOT re-registered here — the dedup
+  // would discard the duplicate anyway. What was uncovered is the
+  // QueryBuilder fragment API: `andWhere`/`orWhere`/`andHaving`/`orHaving`
+  // take raw SQL strings. These names are TypeORM-idiomatic, so classless +
+  // language-scoped is safe and recovers the dominant chained-builder shape
+  // (`repo.createQueryBuilder('u').andWhere(raw)`) that class matching cannot
+  // reach — the receiver of `.andWhere(...)` is the factory call, not a
+  // class-named variable. Generic `where`/`having` are deliberately NOT added
+  // (too generic for classless; a `*QueryBuilder`-scoped entry would be
+  // near-dead since receivers are rarely named that). Precision is inherent
+  // to the flow: parameterised use (`:id` placeholders + a params object)
+  // keeps input out of the string literal, so a finding fires only on
+  // concatenation.
+  { method: "andWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "andHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
@@ -12890,6 +13000,12 @@ var DEFAULT_SINKS = [
   { method: "executemany", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "extra", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Django RawSQL expression (django.db.models.expressions.RawSQL) — the raw
+  // SQL fragment in arg[0] is embedded verbatim into the query when the
+  // annotate/filter/order_by containing it runs. Distinctive constructor name,
+  // so classless + python-scoped is safe. Parameterised use passes user input
+  // through arg[1] (`RawSQL("... %s", [uid])`), which keeps it out of arg[0].
+  { method: "RawSQL", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   // Python Path Traversal
   // Language-scoped: classless `open` collides with Java I/O / JS DOM.
   { method: "open", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["python"] },

package/dist/core/circle-ir-core.cjs

@@ -4426,6 +4426,10 @@ function extractJavaScriptTypes(tree, cache) {
   for (const cls of classes) {
     types.push(extractJSClassInfo(cls));
   }
+  const interfaces = getNodesFromCache(tree.rootNode, "interface_declaration", cache);
+  for (const iface of interfaces) {
+    types.push(extractTSInterfaceInfo(iface));
+  }
   const functions = getNodesFromCache(tree.rootNode, "function_declaration", cache);
   if (functions.length > 0) {
     const moduleFunctions = [];
@@ -4761,6 +4765,73 @@ function extractSelfAssignments(body2, fields, fieldNames) {
     }
   }
 }
+function extractTSInterfaceInfo(node) {
+  const name2 = getIdentifier(node, "name") ?? "Anonymous";
+  const parents = [];
+  for (let i2 = 0; i2 < node.childCount; i2++) {
+    const child = node.child(i2);
+    if (!child || child.type !== "extends_type_clause") continue;
+    for (let j = 0; j < child.childCount; j++) {
+      const gc = child.child(j);
+      if (!gc) continue;
+      if (gc.type === "type_identifier" || gc.type === "generic_type" || gc.type === "nested_type_identifier") {
+        parents.push(getNodeText(gc));
+      }
+    }
+  }
+  const body2 = node.childForFieldName("body");
+  const methods = [];
+  const fields = [];
+  if (body2) {
+    for (let i2 = 0; i2 < body2.childCount; i2++) {
+      const member = body2.child(i2);
+      if (!member) continue;
+      if (member.type === "method_signature") {
+        const methodName = getIdentifier(member, "name") ?? getNodeText(member.child(0) ?? member);
+        const params = member.childForFieldName("parameters");
+        const returnType = member.childForFieldName("return_type");
+        methods.push({
+          name: methodName,
+          return_type: returnType ? getNodeText(returnType).replace(/^:\s*/, "") : null,
+          parameters: params ? extractJSParameters(params) : [],
+          annotations: [],
+          // An interface member has no body and therefore no modifiers in the
+          // class sense; `readonly` / `?` live on property signatures.
+          modifiers: [],
+          start_line: member.startPosition.row + 1,
+          end_line: member.endPosition.row + 1
+        });
+        continue;
+      }
+      if (member.type === "property_signature") {
+        const fieldName = getIdentifier(member, "name") ?? getNodeText(member.child(0) ?? member);
+        const typeNode = member.childForFieldName("type");
+        const modifiers = [];
+        const text = getNodeText(member);
+        if (/^\s*readonly\b/.test(text)) modifiers.push("readonly");
+        if (/\?\s*:/.test(text)) modifiers.push("optional");
+        fields.push({
+          name: fieldName,
+          type: typeNode ? getNodeText(typeNode).replace(/^:\s*/, "") : null,
+          modifiers,
+          annotations: []
+        });
+      }
+    }
+  }
+  return {
+    name: name2,
+    kind: "interface",
+    package: null,
+    extends: parents[0] ?? null,
+    implements: parents.slice(1),
+    annotations: [],
+    methods,
+    fields,
+    start_line: node.startPosition.row + 1,
+    end_line: node.endPosition.row + 1
+  };
+}
 function extractJSClassInfo(node) {
   const name2 = getIdentifier(node, "name") ?? "Anonymous";
   let extendsType = null;
@@ -10406,6 +10477,26 @@ var DEFAULT_SOURCES = [
   { annotation: "FormParam", type: "http_param", severity: "high", param_tainted: true },
   { annotation: "PathParam", type: "http_path", severity: "medium", param_tainted: true },
   { annotation: "HeaderParam", type: "http_header", severity: "high", param_tainted: true },
+  // JAX-RS params the block was missing (jakarta.ws.rs). Java-scoped — the
+  // JS decorator ecosystem has its own distinct names and should not match.
+  { annotation: "CookieParam", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "MatrixParam", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "BeanParam", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Micronaut (io.micronaut.http.annotation). @Body / @Header / @CookieValue /
+  // @PathVariable reuse Spring/JAX-RS names already covered above; these three
+  // are Micronaut-specific. Java-scoped.
+  { annotation: "QueryValue", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "Part", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RequestBean", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Quarkus / RESTEasy Reactive (org.jboss.resteasy.reactive) — the `@Rest*`
+  // shortcut annotations that infer the binding name from the parameter name.
+  // Java-scoped.
+  { annotation: "RestQuery", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestPath", type: "http_path", severity: "medium", param_tainted: true, languages: ["java"] },
+  { annotation: "RestHeader", type: "http_header", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestForm", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestCookie", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestMatrix", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
   // Jenkins data-binding: every parameter of an annotated constructor is wired
   // from form/JSON user input at construction time. Method-level annotation —
   // all params tainted.
@@ -12084,6 +12175,25 @@ var DEFAULT_SINKS = [
   { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  // TypeORM QueryBuilder raw fragments (CWE-89). TypeORM's raw `.query(sql)`
+  // escape hatch is already covered by the classless `query` sink in the JS
+  // plugin (getBuiltinSinks), so it is NOT re-registered here — the dedup
+  // would discard the duplicate anyway. What was uncovered is the
+  // QueryBuilder fragment API: `andWhere`/`orWhere`/`andHaving`/`orHaving`
+  // take raw SQL strings. These names are TypeORM-idiomatic, so classless +
+  // language-scoped is safe and recovers the dominant chained-builder shape
+  // (`repo.createQueryBuilder('u').andWhere(raw)`) that class matching cannot
+  // reach — the receiver of `.andWhere(...)` is the factory call, not a
+  // class-named variable. Generic `where`/`having` are deliberately NOT added
+  // (too generic for classless; a `*QueryBuilder`-scoped entry would be
+  // near-dead since receivers are rarely named that). Precision is inherent
+  // to the flow: parameterised use (`:id` placeholders + a params object)
+  // keeps input out of the string literal, so a finding fires only on
+  // concatenation.
+  { method: "andWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "andHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
@@ -12285,6 +12395,12 @@ var DEFAULT_SINKS = [
   { method: "executemany", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "extra", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Django RawSQL expression (django.db.models.expressions.RawSQL) — the raw
+  // SQL fragment in arg[0] is embedded verbatim into the query when the
+  // annotate/filter/order_by containing it runs. Distinctive constructor name,
+  // so classless + python-scoped is safe. Parameterised use passes user input
+  // through arg[1] (`RawSQL("... %s", [uid])`), which keeps it out of arg[0].
+  { method: "RawSQL", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   // Python Path Traversal
   // Language-scoped: classless `open` collides with Java I/O / JS DOM.
   { method: "open", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["python"] },

package/dist/core/circle-ir-core.js

@@ -4360,6 +4360,10 @@ function extractJavaScriptTypes(tree, cache) {
   for (const cls of classes) {
     types.push(extractJSClassInfo(cls));
   }
+  const interfaces = getNodesFromCache(tree.rootNode, "interface_declaration", cache);
+  for (const iface of interfaces) {
+    types.push(extractTSInterfaceInfo(iface));
+  }
   const functions = getNodesFromCache(tree.rootNode, "function_declaration", cache);
   if (functions.length > 0) {
     const moduleFunctions = [];
@@ -4695,6 +4699,73 @@ function extractSelfAssignments(body2, fields, fieldNames) {
     }
   }
 }
+function extractTSInterfaceInfo(node) {
+  const name2 = getIdentifier(node, "name") ?? "Anonymous";
+  const parents = [];
+  for (let i2 = 0; i2 < node.childCount; i2++) {
+    const child = node.child(i2);
+    if (!child || child.type !== "extends_type_clause") continue;
+    for (let j = 0; j < child.childCount; j++) {
+      const gc = child.child(j);
+      if (!gc) continue;
+      if (gc.type === "type_identifier" || gc.type === "generic_type" || gc.type === "nested_type_identifier") {
+        parents.push(getNodeText(gc));
+      }
+    }
+  }
+  const body2 = node.childForFieldName("body");
+  const methods = [];
+  const fields = [];
+  if (body2) {
+    for (let i2 = 0; i2 < body2.childCount; i2++) {
+      const member = body2.child(i2);
+      if (!member) continue;
+      if (member.type === "method_signature") {
+        const methodName = getIdentifier(member, "name") ?? getNodeText(member.child(0) ?? member);
+        const params = member.childForFieldName("parameters");
+        const returnType = member.childForFieldName("return_type");
+        methods.push({
+          name: methodName,
+          return_type: returnType ? getNodeText(returnType).replace(/^:\s*/, "") : null,
+          parameters: params ? extractJSParameters(params) : [],
+          annotations: [],
+          // An interface member has no body and therefore no modifiers in the
+          // class sense; `readonly` / `?` live on property signatures.
+          modifiers: [],
+          start_line: member.startPosition.row + 1,
+          end_line: member.endPosition.row + 1
+        });
+        continue;
+      }
+      if (member.type === "property_signature") {
+        const fieldName = getIdentifier(member, "name") ?? getNodeText(member.child(0) ?? member);
+        const typeNode = member.childForFieldName("type");
+        const modifiers = [];
+        const text = getNodeText(member);
+        if (/^\s*readonly\b/.test(text)) modifiers.push("readonly");
+        if (/\?\s*:/.test(text)) modifiers.push("optional");
+        fields.push({
+          name: fieldName,
+          type: typeNode ? getNodeText(typeNode).replace(/^:\s*/, "") : null,
+          modifiers,
+          annotations: []
+        });
+      }
+    }
+  }
+  return {
+    name: name2,
+    kind: "interface",
+    package: null,
+    extends: parents[0] ?? null,
+    implements: parents.slice(1),
+    annotations: [],
+    methods,
+    fields,
+    start_line: node.startPosition.row + 1,
+    end_line: node.endPosition.row + 1
+  };
+}
 function extractJSClassInfo(node) {
   const name2 = getIdentifier(node, "name") ?? "Anonymous";
   let extendsType = null;
@@ -10340,6 +10411,26 @@ var DEFAULT_SOURCES = [
   { annotation: "FormParam", type: "http_param", severity: "high", param_tainted: true },
   { annotation: "PathParam", type: "http_path", severity: "medium", param_tainted: true },
   { annotation: "HeaderParam", type: "http_header", severity: "high", param_tainted: true },
+  // JAX-RS params the block was missing (jakarta.ws.rs). Java-scoped — the
+  // JS decorator ecosystem has its own distinct names and should not match.
+  { annotation: "CookieParam", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "MatrixParam", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "BeanParam", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Micronaut (io.micronaut.http.annotation). @Body / @Header / @CookieValue /
+  // @PathVariable reuse Spring/JAX-RS names already covered above; these three
+  // are Micronaut-specific. Java-scoped.
+  { annotation: "QueryValue", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "Part", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RequestBean", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Quarkus / RESTEasy Reactive (org.jboss.resteasy.reactive) — the `@Rest*`
+  // shortcut annotations that infer the binding name from the parameter name.
+  // Java-scoped.
+  { annotation: "RestQuery", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestPath", type: "http_path", severity: "medium", param_tainted: true, languages: ["java"] },
+  { annotation: "RestHeader", type: "http_header", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestForm", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestCookie", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestMatrix", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
   // Jenkins data-binding: every parameter of an annotated constructor is wired
   // from form/JSON user input at construction time. Method-level annotation —
   // all params tainted.
@@ -12018,6 +12109,25 @@ var DEFAULT_SINKS = [
   { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  // TypeORM QueryBuilder raw fragments (CWE-89). TypeORM's raw `.query(sql)`
+  // escape hatch is already covered by the classless `query` sink in the JS
+  // plugin (getBuiltinSinks), so it is NOT re-registered here — the dedup
+  // would discard the duplicate anyway. What was uncovered is the
+  // QueryBuilder fragment API: `andWhere`/`orWhere`/`andHaving`/`orHaving`
+  // take raw SQL strings. These names are TypeORM-idiomatic, so classless +
+  // language-scoped is safe and recovers the dominant chained-builder shape
+  // (`repo.createQueryBuilder('u').andWhere(raw)`) that class matching cannot
+  // reach — the receiver of `.andWhere(...)` is the factory call, not a
+  // class-named variable. Generic `where`/`having` are deliberately NOT added
+  // (too generic for classless; a `*QueryBuilder`-scoped entry would be
+  // near-dead since receivers are rarely named that). Precision is inherent
+  // to the flow: parameterised use (`:id` placeholders + a params object)
+  // keeps input out of the string literal, so a finding fires only on
+  // concatenation.
+  { method: "andWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "andHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
@@ -12219,6 +12329,12 @@ var DEFAULT_SINKS = [
   { method: "executemany", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "extra", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Django RawSQL expression (django.db.models.expressions.RawSQL) — the raw
+  // SQL fragment in arg[0] is embedded verbatim into the query when the
+  // annotate/filter/order_by containing it runs. Distinctive constructor name,
+  // so classless + python-scoped is safe. Parameterised use passes user input
+  // through arg[1] (`RawSQL("... %s", [uid])`), which keeps it out of arg[0].
+  { method: "RawSQL", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   // Python Path Traversal
   // Language-scoped: classless `open` collides with Java I/O / JS DOM.
   { method: "open", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["python"] },

package/dist/core/extractors/types.js

@@ -100,6 +100,12 @@ function extractJavaScriptTypes(tree, cache) {
     for (const cls of classes) {
         types.push(extractJSClassInfo(cls));
     }
+    // Extract TypeScript interfaces. Only the TS/TSX grammars produce
+    // `interface_declaration`, so this is a no-op for plain JavaScript.
+    const interfaces = getNodesFromCache(tree.rootNode, 'interface_declaration', cache);
+    for (const iface of interfaces) {
+        types.push(extractTSInterfaceInfo(iface));
+    }
     // Extract standalone functions as a module-like type
     const functions = getNodesFromCache(tree.rootNode, 'function_declaration', cache);
     if (functions.length > 0) {
@@ -516,6 +522,97 @@ function extractSelfAssignments(body, fields, fieldNames) {
 /**
  * Extract JavaScript class information.
  */
+/**
+ * Extract a TypeScript `interface_declaration` as a `TypeInfo`.
+ *
+ * The TS grammar produces `interface_declaration` → `interface_body`, whose
+ * members are `property_signature` (fields, including function-typed ones
+ * such as `onEvent: (e: string) => void`) and `method_signature` (methods).
+ * Java interfaces are handled separately by `extractInterfaceInfo`, whose body
+ * shape is different — the two cannot share an implementation.
+ *
+ * Needed because a type contract declared as an interface was previously
+ * dropped entirely: `interface UserRepo` alongside
+ * `class SqlUserRepo implements UserRepo` yielded one `TypeInfo`, the class.
+ * Cross-instance taint analysis (Issue #1) needs the declared contract to
+ * resolve a field's type when the declaration site is an interface.
+ */
+function extractTSInterfaceInfo(node) {
+    const name = getIdentifier(node, 'name') ?? 'Anonymous';
+    // `interface A extends B, C` — tree-sitter-typescript wraps these in an
+    // `extends_type_clause`. `TypeInfo.extends` is a single string, so the first
+    // parent goes there and the rest land in `implements`, which mirrors how a
+    // consumer reads "the contracts this type carries".
+    const parents = [];
+    for (let i = 0; i < node.childCount; i++) {
+        const child = node.child(i);
+        if (!child || child.type !== 'extends_type_clause')
+            continue;
+        for (let j = 0; j < child.childCount; j++) {
+            const gc = child.child(j);
+            if (!gc)
+                continue;
+            if (gc.type === 'type_identifier' || gc.type === 'generic_type' || gc.type === 'nested_type_identifier') {
+                parents.push(getNodeText(gc));
+            }
+        }
+    }
+    const body = node.childForFieldName('body');
+    const methods = [];
+    const fields = [];
+    if (body) {
+        for (let i = 0; i < body.childCount; i++) {
+            const member = body.child(i);
+            if (!member)
+                continue;
+            if (member.type === 'method_signature') {
+                const methodName = getIdentifier(member, 'name') ?? getNodeText(member.child(0) ?? member);
+                const params = member.childForFieldName('parameters');
+                const returnType = member.childForFieldName('return_type');
+                methods.push({
+                    name: methodName,
+                    return_type: returnType ? getNodeText(returnType).replace(/^:\s*/, '') : null,
+                    parameters: params ? extractJSParameters(params) : [],
+                    annotations: [],
+                    // An interface member has no body and therefore no modifiers in the
+                    // class sense; `readonly` / `?` live on property signatures.
+                    modifiers: [],
+                    start_line: member.startPosition.row + 1,
+                    end_line: member.endPosition.row + 1,
+                });
+                continue;
+            }
+            if (member.type === 'property_signature') {
+                const fieldName = getIdentifier(member, 'name') ?? getNodeText(member.child(0) ?? member);
+                const typeNode = member.childForFieldName('type');
+                const modifiers = [];
+                const text = getNodeText(member);
+                if (/^\s*readonly\b/.test(text))
+                    modifiers.push('readonly');
+                if (/\?\s*:/.test(text))
+                    modifiers.push('optional');
+                fields.push({
+                    name: fieldName,
+                    type: typeNode ? getNodeText(typeNode).replace(/^:\s*/, '') : null,
+                    modifiers,
+                    annotations: [],
+                });
+            }
+        }
+    }
+    return {
+        name,
+        kind: 'interface',
+        package: null,
+        extends: parents[0] ?? null,
+        implements: parents.slice(1),
+        annotations: [],
+        methods,
+        fields,
+        start_line: node.startPosition.row + 1,
+        end_line: node.endPosition.row + 1,
+    };
+}
 function extractJSClassInfo(node) {
     const name = getIdentifier(node, 'name') ?? 'Anonymous';
     // Extract superclass (extends)