circle-ir 3.216.0 → 4.2.0

package/dist/core/circle-ir-core.cjs

@@ -4402,8 +4402,84 @@ function extractTypes(tree, cache, language) {
   if (isJavaScript) {
     return extractJavaScriptTypes(tree, cache);
   }
+  if (effectiveLanguage === "csharp") {
+    return extractCSharpTypes(tree, cache);
+  }
   return extractJavaTypes(tree, cache);
 }
+function extractCSharpTypes(tree, cache) {
+  const types = [];
+  const KINDS = {
+    class_declaration: "class",
+    record_declaration: "class",
+    struct_declaration: "class",
+    interface_declaration: "interface",
+    enum_declaration: "enum"
+  };
+  for (const kindNode of Object.keys(KINDS)) {
+    for (const node of getNodesFromCache(tree.rootNode, kindNode, cache)) {
+      const nameNode = node.childForFieldName("name");
+      const body2 = node.childForFieldName("body");
+      const methods = [];
+      if (body2) {
+        for (let i2 = 0; i2 < body2.childCount; i2++) {
+          const m = body2.child(i2);
+          if (!m || m.type !== "method_declaration") continue;
+          const mName = m.childForFieldName("name");
+          const paramList = m.childForFieldName("parameters");
+          const parameters = [];
+          if (paramList) {
+            for (let j = 0; j < paramList.childCount; j++) {
+              const pnode = paramList.child(j);
+              if (!pnode || pnode.type !== "parameter") continue;
+              const pName = pnode.childForFieldName("name");
+              const pType = pnode.childForFieldName("type");
+              if (pName) {
+                parameters.push({
+                  name: getNodeText(pName),
+                  type: pType ? getNodeText(pType) : null,
+                  annotations: [],
+                  line: pnode.startPosition.row + 1
+                });
+              }
+            }
+          }
+          const returns = m.childForFieldName("returns");
+          methods.push({
+            name: mName ? getNodeText(mName) : "unknown",
+            return_type: returns ? getNodeText(returns) : null,
+            parameters,
+            annotations: [],
+            modifiers: extractCSharpModifiers(m),
+            start_line: m.startPosition.row + 1,
+            end_line: m.endPosition.row + 1
+          });
+        }
+      }
+      types.push({
+        name: nameNode ? getNodeText(nameNode) : "anonymous",
+        kind: KINDS[kindNode],
+        package: null,
+        extends: null,
+        implements: [],
+        annotations: [],
+        methods,
+        fields: [],
+        start_line: node.startPosition.row + 1,
+        end_line: node.endPosition.row + 1
+      });
+    }
+  }
+  return types;
+}
+function extractCSharpModifiers(node) {
+  const mods = [];
+  for (let i2 = 0; i2 < node.childCount; i2++) {
+    const c = node.child(i2);
+    if (c && c.type === "modifier") mods.push(getNodeText(c));
+  }
+  return mods;
+}
 function extractJavaTypes(tree, cache) {
   const types = [];
   const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
@@ -5862,6 +5938,9 @@ function extractCalls(tree, cache, language) {
   if (isJavaScript) {
     return extractJavaScriptCalls(tree, cache);
   }
+  if (detectedLanguage === "csharp") {
+    return extractCSharpCalls(tree, cache);
+  }
   const context = buildResolutionContext(tree, cache);
   const invocations = getNodesFromCache(tree.rootNode, "method_invocation", cache);
   for (const inv of invocations) {
@@ -5876,6 +5955,107 @@ function extractCalls(tree, cache, language) {
   }
   return calls;
 }
+function buildCSharpReceiverTypeMap(tree, cache) {
+  const map = /* @__PURE__ */ new Map();
+  const simple = (t) => t.replace(/<[^>]*>/g, "").split(".").pop()?.trim() ?? t;
+  for (const vd of getNodesFromCache(tree.rootNode, "variable_declaration", cache)) {
+    const typeNode = vd.childForFieldName("type");
+    const declaredType = typeNode ? getNodeText(typeNode) : null;
+    for (let i2 = 0; i2 < vd.childCount; i2++) {
+      const decl = vd.child(i2);
+      if (!decl || decl.type !== "variable_declarator") continue;
+      const nameNode = decl.childForFieldName("name");
+      if (nameNode?.type !== "identifier") continue;
+      let t = declaredType && declaredType !== "var" ? declaredType : null;
+      if (!t) {
+        const oce = findFirstDescendant(decl, "object_creation_expression");
+        const oceType = oce?.childForFieldName("type");
+        if (oceType) t = getNodeText(oceType);
+      }
+      if (t && t !== "var") map.set(getNodeText(nameNode), simple(t));
+    }
+  }
+  return map;
+}
+function findFirstDescendant(node, type) {
+  for (let i2 = 0; i2 < node.childCount; i2++) {
+    const c = node.child(i2);
+    if (!c) continue;
+    if (c.type === type) return c;
+    const found = findFirstDescendant(c, type);
+    if (found) return found;
+  }
+  return null;
+}
+function extractCSharpCalls(tree, cache) {
+  const calls = [];
+  const typeMap = buildCSharpReceiverTypeMap(tree, cache);
+  const invocations = getNodesFromCache(tree.rootNode, "invocation_expression", cache);
+  for (const inv of invocations) {
+    const fn = inv.childForFieldName("function");
+    let methodName = "unknown";
+    let receiver = null;
+    if (fn?.type === "member_access_expression") {
+      const nameNode = fn.childForFieldName("name");
+      const exprNode = fn.childForFieldName("expression");
+      methodName = nameNode ? getNodeText(nameNode) : "unknown";
+      receiver = exprNode ? getNodeText(exprNode) : null;
+    } else if (fn) {
+      methodName = getNodeText(fn);
+    }
+    const argsNode = inv.childForFieldName("arguments");
+    calls.push({
+      method_name: methodName,
+      receiver,
+      receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
+      receiver_type_fqn: null,
+      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
+      in_method: findEnclosingMethod(inv)
+    });
+  }
+  const objectCreations = getNodesFromCache(tree.rootNode, "object_creation_expression", cache);
+  for (const creation of objectCreations) {
+    const typeNode = creation.childForFieldName("type");
+    const argsNode = creation.childForFieldName("arguments");
+    calls.push({
+      method_name: typeNode ? getNodeText(typeNode) : "unknown",
+      receiver: null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      location: { line: creation.startPosition.row + 1, column: creation.startPosition.column },
+      in_method: findEnclosingMethod(creation),
+      is_constructor: true
+    });
+  }
+  return calls;
+}
+function extractCSharpArguments(argsNode) {
+  const args2 = [];
+  let position = 0;
+  for (let i2 = 0; i2 < argsNode.childCount; i2++) {
+    const child = argsNode.child(i2);
+    if (!child || child.type !== "argument") continue;
+    let expr = null;
+    for (let j = child.childCount - 1; j >= 0; j--) {
+      const c = child.child(j);
+      if (c && c.isNamed) {
+        expr = c;
+        break;
+      }
+    }
+    const text = expr ? getNodeText(expr) : getNodeText(child);
+    args2.push({
+      position: position++,
+      expression: text,
+      variable: expr?.type === "identifier" ? text : null,
+      literal: expr?.type === "string_literal" ? text : null,
+      value: null
+    });
+  }
+  return args2;
+}
 function extractJavaScriptCalls(tree, cache) {
   const calls = [];
   const context = buildJSResolutionContext(tree, cache);
@@ -8978,8 +9158,72 @@ function buildDFG(tree, cache, language) {
   if (effectiveLanguage === "go") {
     return buildGoDFG(tree);
   }
+  if (effectiveLanguage === "csharp") {
+    return buildCSharpDFG(tree, cache);
+  }
   return buildJavaDFG(tree, cache);
 }
+function buildCSharpDFG(tree, cache) {
+  const defs = [];
+  const uses = [];
+  let defIdCounter = 1;
+  let useIdCounter = 1;
+  const scopeStack = [/* @__PURE__ */ new Map()];
+  const methods = [
+    ...getNodesFromCache(tree.rootNode, "method_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "constructor_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "local_function_statement", cache)
+  ];
+  for (const method of methods) {
+    scopeStack.push(/* @__PURE__ */ new Map());
+    const params = method.childForFieldName("parameters");
+    if (params) {
+      for (const def of extractParameterDefs(params, defIdCounter)) {
+        defs.push(def);
+        currentScope(scopeStack).set(def.variable, def.id);
+        defIdCounter++;
+      }
+    }
+    const body2 = method.childForFieldName("body");
+    if (body2) {
+      for (const decl of findNodes(body2, "variable_declarator")) {
+        const nameNode = decl.childForFieldName("name");
+        if (nameNode?.type === "identifier") {
+          const name2 = getNodeText(nameNode);
+          const def = { id: defIdCounter++, variable: name2, line: decl.startPosition.row + 1, kind: "local" };
+          defs.push(def);
+          currentScope(scopeStack).set(name2, def.id);
+        }
+      }
+      for (const asn of findNodes(body2, "assignment_expression")) {
+        const left = asn.childForFieldName("left");
+        if (left?.type === "identifier") {
+          const name2 = getNodeText(left);
+          const def = { id: defIdCounter++, variable: name2, line: asn.startPosition.row + 1, kind: "local" };
+          defs.push(def);
+          currentScope(scopeStack).set(name2, def.id);
+        }
+      }
+      const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      uses.push(...bodyUses.uses);
+      useIdCounter = bodyUses.nextId;
+    }
+    scopeStack.pop();
+  }
+  const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
+  for (const cls of classes) {
+    const body2 = cls.childForFieldName("body");
+    if (body2) {
+      for (const def of extractFieldDefs(body2, defIdCounter)) {
+        defs.push(def);
+        currentScope(scopeStack).set(def.variable, def.id);
+        defIdCounter++;
+      }
+    }
+  }
+  const chains = computeChains(defs, uses);
+  return { defs, uses, chains };
+}
 function buildJavaDFG(tree, cache) {
   const defs = [];
   const uses = [];
@@ -9442,7 +9686,7 @@ function extractParameterDefs(params, startId) {
   for (let i2 = 0; i2 < params.childCount; i2++) {
     const param = params.child(i2);
     if (!param) continue;
-    if (param.type === "formal_parameter" || param.type === "spread_parameter") {
+    if (param.type === "formal_parameter" || param.type === "spread_parameter" || param.type === "parameter") {
       const nameNode = param.childForFieldName("name");
       if (nameNode) {
         defs.push({
@@ -12881,6 +13125,67 @@ var DEFAULT_SINKS = [
   { method: "put", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "patch", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "head", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // C# SQLi (Phase-0 spike — ADO.NET). `new SqlCommand(sql, conn)` builds the
+  // command from a raw string; the tainted SQL is arg[0] of the constructor.
+  { method: "SqlCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "NpgsqlCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "MySqlCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "SqliteCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "OracleCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // C# command injection — Process.Start / ProcessStartInfo (CWE-78).
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
+  // C# path traversal — System.IO file APIs (CWE-22). Distinctive method names.
+  { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "ReadAllBytes", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "ReadAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAllBytes", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "AppendAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "OpenRead", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "OpenWrite", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# SSRF — HttpClient / WebClient / WebRequest (CWE-918).
+  { method: "GetAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PostAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PutAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DeleteAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetStringAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetByteArrayAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetStreamAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "SendAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DownloadString", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DownloadData", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DownloadFile", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1], languages: ["csharp"] },
+  { method: "Create", class: "WebRequest", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# code injection — dynamic script/assembly loading (CWE-94).
+  { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // C# insecure deserialization — BinaryFormatter et al. (CWE-502).
+  { method: "Deserialize", class: "BinaryFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "NetDataContractSerializer", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // C# XSS — raw HTML output (CWE-79).
+  { method: "Raw", class: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# LDAP injection — System.DirectoryServices (CWE-90). The user-built
+  // filter is the constructor argument.
+  { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
+  { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Compile", class: "XPathExpression", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# XXE — untrusted XML into a parser without DTD hardening (CWE-611).
+  { method: "LoadXml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Load", class: "XmlDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Load", class: "XDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // Python SQLi — asyncpg Connection.*
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -13088,6 +13393,15 @@ var DEFAULT_SANITIZERS = [
   { method: "escapeCsv", removes: ["xss"] },
   // OWASP HTML sanitizer (`com.googlecode.owasp-java-html-sanitizer`).
   { method: "sanitize", class: "PolicyFactory", removes: ["xss"] },
+  // C# sanitizers (Phase-1). HTML encoders neutralise XSS; Path.GetFileName
+  // strips any directory component (basename) so a traversal payload cannot
+  // escape the target directory. Method names are C#-distinctive.
+  { method: "HtmlEncode", removes: ["xss"] },
+  // HttpUtility / WebUtility
+  { method: "JavaScriptStringEncode", removes: ["xss"] },
+  // HttpUtility
+  { method: "Encode", class: "HtmlEncoder", removes: ["xss"] },
+  { method: "GetFileName", class: "Path", removes: ["path_traversal"] },
   // Java Base64 / Hex / MessageDigest — encoded output is binary-safe
   // (cognium-dev #213 seventh slice). None of these carry attacker
   // shell/SQL/HTML metacharacters through the encoding — Base64 emits
@@ -13831,7 +14145,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
       const skipMethods = ["toString", "hashCode", "equals", "compareTo"];
       if (skipMethods.includes(method.name)) continue;
       for (const param of method.parameters) {
-        const isTaintable = param.type ? isInterproceduralTaintableType(param.type) : true;
+        const isTaintable = param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -13854,7 +14168,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
             // interprocedural_param at the method decl line instead of the
             // real HTTP source, breaking downstream sink-type filters
             // (regressed #78, #92.1, #105 FP-31, #215 recall).
-            ...language === "java" ? { variable: param.name } : {}
+            ...language === "java" || language === "csharp" ? { variable: param.name } : {}
           });
         }
       }
@@ -13951,7 +14265,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   return result;
 }
-function isInterproceduralTaintableType(typeName) {
+function isInterproceduralTaintableType(typeName, language) {
   const baseType = typeName.split("<")[0].trim();
   const excludedTypes = [
     // Servlet framework - taint comes from specific methods, not the parameter itself
@@ -14024,6 +14338,26 @@ function isInterproceduralTaintableType(typeName) {
   if (taintableTypes.includes(baseType)) {
     return true;
   }
+  if (language === "csharp") {
+    const csharpTaintable = [
+      "string",
+      "object",
+      "IEnumerable",
+      "ICollection",
+      "IList",
+      "Dictionary",
+      "IDictionary",
+      "IReadOnlyList",
+      "IReadOnlyCollection",
+      // Byte/stream payloads carry deserialization / upload input.
+      "Stream",
+      "byte[]",
+      "Byte[]",
+      "MemoryStream"
+    ];
+    const leaf = baseType.split(".").pop() ?? baseType;
+    if (csharpTaintable.includes(baseType) || csharpTaintable.includes(leaf)) return true;
+  }
   if (typeName.endsWith("[]")) {
     const elementType = typeName.slice(0, -2);
     if (elementType === "String" || elementType === "Object" || elementType === "byte") {