circle-ir 4.12.0 → 4.13.0

package/dist/browser/circle-ir.js

@@ -9621,6 +9621,7 @@ function buildCSharpDFG(tree, cache) {
           currentScope(scopeStack).set(name2, def.id);
         }
       }
+      const plainTargets = [];
       for (const asn of findNodes(body2, "assignment_expression")) {
         const left = asn.childForFieldName("left");
         if (left?.type === "identifier") {
@@ -9628,9 +9629,16 @@ function buildCSharpDFG(tree, cache) {
           const def = { id: defIdCounter++, variable: name2, line: asn.startPosition.row + 1, kind: "local" };
           defs.push(def);
           currentScope(scopeStack).set(name2, def.id);
+          if (asn.children.some((c) => c?.type === "=")) {
+            plainTargets.push({ name: name2, line: left.startPosition.row + 1 });
+          }
         }
       }
       const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      for (const target of plainTargets) {
+        const idx = bodyUses.uses.findIndex((u) => u.variable === target.name && u.line === target.line);
+        if (idx !== -1) bodyUses.uses.splice(idx, 1);
+      }
       resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
       uses.push(...bodyUses.uses);
       useIdCounter = bodyUses.nextId;
@@ -19733,7 +19741,16 @@ var CSHARP_NON_ESCAPE_METHODS = /* @__PURE__ */ new Set([
   "TryAdd",
   "Insert",
   "Push",
-  "Enqueue"
+  "Enqueue",
+  // Encoders (cognium-dev#518). Encoding a value hands back a string; nothing
+  // has left the program at `Uri.EscapeDataString(input)`.
+  "EscapeDataString",
+  "EscapeUriString",
+  "UrlEncode",
+  "UrlPathEncode",
+  "HtmlEncode",
+  "HtmlAttributeEncode",
+  "JavaScriptStringEncode"
 ]);
 function isCSharpNonEscapeCall(call) {
   const name2 = call.method_name;
@@ -22151,7 +22168,16 @@ var ConstantPropagator = class _ConstantPropagator {
         break;
       }
     }
-    const switchBlock = node.children.find((c) => c.type === "switch_block");
+    if (!switchValue) {
+      const valueNode = node.childForFieldName("value");
+      if (valueNode) {
+        const literal = this.literalValue(valueNode);
+        switchValue = literal !== null ? { type: typeof literal === "number" ? "int" : "string", value: literal, sourceLine: getNodeLine(valueNode) } : this.evaluateExpression(valueNode);
+      }
+    }
+    const switchBlock = node.children.find(
+      (c) => c.type === "switch_block" || c.type === "switch_body"
+    );
     if (!switchBlock) {
       for (const child of node.children) {
         this.visit(child);
@@ -22159,7 +22185,7 @@ var ConstantPropagator = class _ConstantPropagator {
       return;
     }
     const caseGroups = switchBlock.children.filter(
-      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule"
+      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section"
     );
     if (switchValue && isKnown(switchValue)) {
       let matchingIdx = -1;
@@ -22177,6 +22203,16 @@ var ConstantPropagator = class _ConstantPropagator {
                 matchingIdx = i2;
               }
             }
+          } else if (caseGroup.type === "switch_section") {
+            if (child.type === "default") {
+              defaultIdx = i2;
+            } else if (child.type === "constant_pattern") {
+              const inner = child.children.find((c) => c.isNamed);
+              const caseValue = inner ? this.literalValue(inner) : null;
+              if (caseValue !== null && caseValue === switchValue.value) {
+                matchingIdx = i2;
+              }
+            }
           }
         }
       }
@@ -22258,6 +22294,18 @@ var ConstantPropagator = class _ConstantPropagator {
     }
     return false;
   }
+  /** The value of an integer, character or string literal node; null for anything else. */
+  literalValue(node) {
+    const text = getNodeText2(node, this.source);
+    if (node.type === "integer_literal" || node.type === "decimal_integer_literal") {
+      const n = Number(text.replace(/_/g, "").replace(/[uUlL]+$/, ""));
+      return Number.isInteger(n) ? n : null;
+    }
+    if (node.type === "character_literal" || node.type === "string_literal") {
+      return text.slice(1, -1);
+    }
+    return null;
+  }
   extractCaseValue(labelNode) {
     for (const child of labelNode.children) {
       if (child.type === "decimal_integer_literal") {
@@ -31317,7 +31365,7 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
     if (!m) continue;
     if (!guardRejects(lines, i2, terminatorRe, 6)) continue;
     const guarded = /* @__PURE__ */ new Set([m[1]]);
-    const mentions = (t) => {
+    const mentions2 = (t) => {
       for (const n of guarded) if (new RegExp(`\\b${n}\\b`).test(t)) return true;
       return false;
     };
@@ -31325,10 +31373,10 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
       const lt = lines[l];
       const a = assignRe.exec(lt);
       if (a) {
-        if (mentions(a[2])) guarded.add(a[1]);
+        if (mentions2(a[2])) guarded.add(a[1]);
         else if (a[1] !== m[1]) guarded.delete(a[1]);
       }
-      if (mentions(lt)) {
+      if (mentions2(lt)) {
         sanitizers.push({
           type: "java_canonical_startswith_guard",
           method: "getCanonicalPath",
@@ -31384,14 +31432,14 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
       if (!a || !guarded.has(a[1])) continue;
       for (const id of a[2].match(/[A-Za-z_]\w*/g) ?? []) guarded.add(id);
     }
-    const mentions = (t) => {
+    const mentions2 = (t) => {
       for (const n of guarded) if (new RegExp(`\\b${n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`).test(t)) return true;
       return false;
     };
     for (let l = i2 + 1; l < lines.length; l++) {
       const a = assignRe.exec(lines[l]);
-      if (a && mentions(a[2])) guarded.add(a[1]);
-      if (mentions(lines[l])) {
+      if (a && mentions2(a[2])) guarded.add(a[1]);
+      if (mentions2(lines[l])) {
         sanitizers.push({
           type: "csharp_early_return_guard",
           method: "guard",
@@ -31429,7 +31477,7 @@ function findCSharpFullPathStartsWithGuardSanitizers(code) {
     if (!m || !canonicalVars.has(m[1])) continue;
     if (!guardRejects(lines, i2, terminatorRe, 6)) continue;
     const guarded = /* @__PURE__ */ new Set([m[1]]);
-    const mentions = (t) => {
+    const mentions2 = (t) => {
       for (const n of guarded) if (new RegExp(`\\b${n}\\b`).test(t)) return true;
       return false;
     };
@@ -31437,10 +31485,10 @@ function findCSharpFullPathStartsWithGuardSanitizers(code) {
       const lt = lines[l];
       const a = assignRe.exec(lt);
       if (a) {
-        if (mentions(a[2])) guarded.add(a[1]);
+        if (mentions2(a[2])) guarded.add(a[1]);
         else if (a[1] !== m[1]) guarded.delete(a[1]);
       }
-      if (mentions(lt)) {
+      if (mentions2(lt)) {
         sanitizers.push({
           type: "csharp_fullpath_startswith_guard",
           method: "GetFullPath",
@@ -35060,6 +35108,443 @@ var MyBatisAnnotationSqlSinkPass = class {
   }
 };
 
+// src/analysis/passes/csharp-sanitizer-credit.ts
+var CSHARP_ALLOWLIST_STRIP_RE = /\bRegex\s*\.\s*Replace\s*\([^,]*,\s*@?"\[\^(?:[A-Za-z0-9_\- ]|\\w|\\d|\\s)+\]"\s*,\s*@?"[A-Za-z0-9_]?"\s*\)/;
+var CSHARP_ALLOWLIST_FILTER_RE = /\bnew\s+string\s*\(\s*[A-Za-z_]\w*\s*\.\s*Where\s*\(\s*char\s*\.\s*Is(?:LetterOrDigit|Digit|Letter)\s*\)\s*\.\s*ToArray\s*\(\s*\)\s*\)/;
+var CSHARP_SANITIZER_RES = [
+  { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: "xss" },
+  // `HtmlEncoder.Default.Encode(x)` is the ASP.NET Core spelling (#520).
+  { re: /\bHtmlEncoder\s*\.\s*(?:Default\s*\.\s*)?Encode\s*\(/, type: "xss" },
+  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" },
+  // XML-escapes `< > & " '`. A value escaped this way cannot close the quoted
+  // literal it is placed in, which is what XPath injection needs.
+  { re: /\bSecurityElement\s*\.\s*Escape\s*\(/, type: "xpath_injection" },
+  // An allowlist strip leaves only inert characters, so it covers every family
+  // whose exploitation needs a metacharacter. Each has a fixture; see
+  // `issue-272-csharp-allowlist-strip.test.ts`.
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "ldap_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "xpath_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "command_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "sql_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "crlf" },
+  { re: CSHARP_ALLOWLIST_FILTER_RE, type: "ldap_injection" },
+  { re: CSHARP_ALLOWLIST_FILTER_RE, type: "xpath_injection" },
+  { re: CSHARP_ALLOWLIST_FILTER_RE, type: "command_injection" },
+  { re: CSHARP_ALLOWLIST_FILTER_RE, type: "sql_injection" },
+  { re: CSHARP_ALLOWLIST_FILTER_RE, type: "crlf" }
+];
+var INERT_WHEN_ALPHANUMERIC = /* @__PURE__ */ new Set([
+  "ldap_injection",
+  "xpath_injection",
+  "command_injection",
+  "sql_injection",
+  "crlf",
+  "xss",
+  "path_traversal",
+  "code_injection"
+]);
+var IDENT = "[A-Za-z_]\\w*";
+var ASSIGN_RE = new RegExp(`^\\s*(?:var\\s+|[A-Za-z_][\\w.<>\\[\\]?]*\\s+)?(${IDENT})\\s*=(?!=)\\s*(.+?);?\\s*$`);
+var ENDS_STATEMENT_RE = /[;{}]\s*(?:\/\/.*)?$/;
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function mentions(text, name2) {
+  return new RegExp(`(?<![\\w])${escapeRegex(name2)}(?![\\w])`).test(text);
+}
+function insideParens(text, open) {
+  let depth = 0;
+  for (let i2 = open; i2 < text.length; i2++) {
+    if (text[i2] === "(") depth++;
+    else if (text[i2] === ")" && --depth === 0) return text.slice(open + 1, i2);
+  }
+  return null;
+}
+function leadingIf(text) {
+  const m = /^\s*(?:\}\s*)?(?:else\s+)?if\s*\(/.exec(text);
+  if (!m) return null;
+  const open = m[0].length - 1;
+  const cond = insideParens(text, open);
+  if (cond === null) return null;
+  return { cond: cond.trim(), rest: text.slice(open + cond.length + 2).trim() };
+}
+var EXITS_RE = /^(?:\{\s*)?(?:return\b|throw\b|continue\b|break\b)/;
+var CSharpCredit = class {
+  constructor(code, methods) {
+    this.methods = methods;
+    this.lines = code.split(/\r?\n/);
+  }
+  methods;
+  lines;
+  helperCache = /* @__PURE__ */ new Map();
+  guardHelperCache = /* @__PURE__ */ new Map();
+  /** The innermost method containing `line`, or null. */
+  methodAt(line) {
+    let best = null;
+    for (const m of this.methods) {
+      if (line < m.start_line || line > m.end_line) continue;
+      if (!best || m.end_line - m.start_line < best.end_line - best.start_line) best = m;
+    }
+    return best;
+  }
+  /**
+   * Statements of lines `[from, to)`, 1-based, with a statement wrapped over
+   * several lines joined up to its `;`. `line` is where the statement starts.
+   */
+  statements(from, to) {
+    const out2 = [];
+    for (let i2 = Math.max(from, 1); i2 < to; i2++) {
+      let text = (this.lines[i2 - 1] ?? "").trimEnd();
+      const first = i2;
+      if (/^\s*(?:[\w.<>[\]?]+\s+)?[A-Za-z_]\w*\s*=(?!=)/.test(text) && !ENDS_STATEMENT_RE.test(text)) {
+        while (i2 < to - 1 && i2 < first + 12) {
+          i2++;
+          text += " " + (this.lines[i2 - 1] ?? "").trim();
+          if (ENDS_STATEMENT_RE.test(this.lines[i2 - 1] ?? "")) break;
+        }
+      }
+      out2.push({ line: first, text });
+    }
+    return out2;
+  }
+  /** Does `text` apply a built-in sanitizer for `type`? */
+  builtinSanitizes(type, text) {
+    for (const { re, type: t } of CSHARP_SANITIZER_RES) {
+      if (t === type && re.test(text)) return true;
+    }
+    if (type === "ldap_injection") {
+      if (/\.\s*Replace\s*\(\s*"\("\s*,/.test(text) && /\.\s*Replace\s*\(\s*"\)"\s*,/.test(text)) return true;
+    }
+    if (type === "path_traversal") {
+      if (/\b([A-Za-z_]\w*)\s*\.\s*StartsWith\s*\([^)]*\)\s*\?\s*\1\s*:\s*null\b/.test(text)) return true;
+    }
+    return false;
+  }
+  /**
+   * Same-file methods that sanitize for `type`: every `return` hands back a
+   * sanitized expression. `static string Clean(string x) { return HtmlEncode(x); }`
+   * makes `Clean(input)` an xss sanitizer at its call sites.
+   */
+  helpers(type) {
+    const cached = this.helperCache.get(type);
+    if (cached) return cached;
+    const set = /* @__PURE__ */ new Set();
+    this.helperCache.set(type, set);
+    for (const m of this.methods) {
+      const returns = this.returnExprs(m);
+      if (returns.length === 0) continue;
+      const ok = returns.every((r) => {
+        if (this.builtinSanitizes(type, r.expr)) return true;
+        const v = /^([A-Za-z_]\w*)$/.exec(r.expr.trim());
+        return !!v && this.sanitizedVarsIn(type, m.start_line, r.line, false).has(v[1]);
+      });
+      if (ok) set.add(m.name);
+    }
+    return set;
+  }
+  /** Every returned expression of a method: `return e;` and expression bodies. */
+  returnExprs(m) {
+    const out2 = [];
+    for (const st of this.statements(m.start_line, m.end_line + 1)) {
+      for (const r of st.text.matchAll(/\breturn\s+([^;]+);/g)) out2.push({ line: st.line, expr: r[1] });
+      if (st.line === m.start_line) {
+        const body2 = /\)\s*=>\s*(.+?);\s*$/.exec(st.text);
+        if (body2) out2.push({ line: st.line, expr: body2[1] });
+      }
+    }
+    return out2;
+  }
+  /** Does `text` apply a sanitizer for `type`, built in or a same-file helper? */
+  sanitizes(type, text) {
+    if (this.builtinSanitizes(type, text)) return true;
+    for (const name2 of this.helpers(type)) {
+      if (new RegExp(`(?<![\\w.])${escapeRegex(name2)}\\s*\\(`).test(text)) return true;
+    }
+    return false;
+  }
+  sanitizedVarsIn(type, from, to, withHelpers) {
+    const sanitized = /* @__PURE__ */ new Set();
+    for (const st of this.statements(from, to)) {
+      const m = ASSIGN_RE.exec(st.text);
+      if (!m) continue;
+      const [, lhs, rhs] = m;
+      const credited = (withHelpers ? this.sanitizes(type, rhs) : this.builtinSanitizes(type, rhs)) || [...sanitized].some((v) => mentions(rhs, v));
+      if (credited) sanitized.add(lhs);
+      else sanitized.delete(lhs);
+    }
+    return sanitized;
+  }
+  /**
+   * The variables sanitized for `type` at `sinkLine`, judged inside the method
+   * that contains the sink (cognium-dev#579). The body is read top to bottom up
+   * to the sink and the last assignment to a name decides: a sanitizer call or
+   * a derivation from a sanitized name credits it, anything else removes it.
+   * Class fields are the caller's concern: they can be sanitized in one method
+   * and read in another.
+   */
+  sanitizedVarsAt(type, sinkLine) {
+    return this.sanitizedVarsIn(type, this.methodAt(sinkLine)?.start_line ?? 1, sinkLine, true);
+  }
+  /**
+   * The text of the statement at `line` that a sink call can be in: for
+   * `if (COND) sink(x);` that is `sink(x);`, without the condition. A name
+   * that only appears in the condition is not something the sink receives.
+   */
+  sinkText(line) {
+    const text = this.lines[line - 1] ?? "";
+    const guarded = leadingIf(text);
+    return guarded && guarded.rest !== "" ? guarded.rest : text;
+  }
+  // -------------------------------------------------------------------------
+  // Guards
+  // -------------------------------------------------------------------------
+  /** Variables a condition proves to hold only letters, digits, `_` and `-`. */
+  allowlistVars(cond) {
+    const out2 = [];
+    const anchored = new RegExp(
+      `\\bRegex\\s*\\.\\s*IsMatch\\s*\\(\\s*(${IDENT})\\s*,\\s*@?"\\^\\[(?:[A-Za-z0-9_\\- ]|\\\\w|\\\\d)+\\](?:[+*]|\\{\\d+(?:,\\d*)?\\})\\$"`,
+      "g"
+    );
+    for (const m of cond.matchAll(anchored)) out2.push(m[1]);
+    const methodGroup = new RegExp(`(${IDENT})\\s*\\.\\s*All\\s*\\(\\s*char\\s*\\.\\s*Is(?:LetterOrDigit|Digit|Letter)\\s*\\)`, "g");
+    for (const m of cond.matchAll(methodGroup)) out2.push(m[1]);
+    const lambda = new RegExp(`(${IDENT})\\s*\\.\\s*All\\s*\\(\\s*(${IDENT})\\s*=>`, "g");
+    for (const m of cond.matchAll(lambda)) {
+      const open = cond.indexOf("(", m.index + m[1].length);
+      const body2 = insideParens(cond, open)?.replace(new RegExp(`^\\s*${m[2]}\\s*=>`), "") ?? "";
+      const c = escapeRegex(m[2]);
+      const residue = body2.replace(new RegExp(`char\\s*\\.\\s*Is(?:LetterOrDigit|Digit|Letter)\\s*\\(\\s*${c}\\s*\\)`, "g"), "").replace(new RegExp(`${c}\\s*==\\s*'[_\\-]'`, "g"), "").replace(/\|\||\s/g, "");
+      if (residue === "") out2.push(m[1]);
+    }
+    return out2;
+  }
+  /** Variables a condition proves to be numeric (`int.TryParse(x, out _)`). */
+  numericVars(cond, parsedFrom) {
+    const out2 = [];
+    const tryParse = new RegExp(
+      `\\b(?:int|long|short|byte|uint|ulong|decimal|double|float|Int32|Int64|Guid)\\s*\\.\\s*TryParse\\s*\\(\\s*(${IDENT})\\s*,`,
+      "g"
+    );
+    for (const m of cond.matchAll(tryParse)) out2.push(m[1]);
+    for (const [parsed, from] of parsedFrom) {
+      if (new RegExp(`(?<![\\w])${escapeRegex(parsed)}\\s*(?:!=\\s*null|\\.\\s*HasValue)\\b`).test(cond)) out2.push(from);
+    }
+    return out2;
+  }
+  /** Variables whose host a condition compares against a constant or an allowlist. */
+  hostVars(cond, hostOf) {
+    const out2 = [];
+    const compares = (expr) => {
+      const e = escapeRegex(expr).replace(/\\ /g, "\\s*");
+      return new RegExp(`${e}\\s*==\\s*@?"[^"]+"`).test(cond) || new RegExp(`@?"[^"]+"\\s*==\\s*${e}`).test(cond) || new RegExp(`${e}\\s*\\.\\s*Equals\\s*\\(`).test(cond) || new RegExp(`\\.\\s*Contains\\s*\\(\\s*${e}\\s*[),]`).test(cond) || new RegExp(`\\bIndexOf\\s*\\([^()]*,\\s*${e}\\s*\\)\\s*>=\\s*0`).test(cond);
+    };
+    const direct = new RegExp(`new\\s+(?:System\\s*\\.\\s*)?Uri\\s*\\(\\s*(${IDENT})\\s*\\)\\s*\\.\\s*Host\\b`, "g");
+    for (const m of cond.matchAll(direct)) {
+      if (compares(m[0])) out2.push(m[1]);
+    }
+    for (const [hostVar, from] of hostOf) {
+      if (mentions(cond, hostVar) && compares(hostVar)) out2.push(from);
+    }
+    return out2;
+  }
+  /**
+   * Same-file methods that are guards of `kind` on one of their parameters:
+   * `static bool IsAllowed(string c) { return Array.IndexOf(Allowed, new Uri(c).Host) >= 0; }`.
+   * Maps the method name to the position of the validated parameter.
+   */
+  guardHelpers(kind) {
+    const cached = this.guardHelperCache.get(kind);
+    if (cached) return cached;
+    const map = /* @__PURE__ */ new Map();
+    this.guardHelperCache.set(kind, map);
+    for (const m of this.methods) {
+      const signature = this.lines[m.start_line - 1] ?? "";
+      const open = signature.indexOf("(", signature.indexOf(m.name));
+      const params = open === -1 ? null : insideParens(signature, open);
+      if (!params) continue;
+      const names = params.split(",").map((p) => p.trim().split(/\s+/).pop() ?? "");
+      const returns = this.returnExprs(m);
+      if (returns.length !== 1) continue;
+      const proven = this.provenBy(kind, returns[0].expr, /* @__PURE__ */ new Map(), /* @__PURE__ */ new Map(), false);
+      const pos = names.findIndex((n) => proven.includes(n));
+      if (pos !== -1) map.set(m.name, pos);
+    }
+    return map;
+  }
+  provenBy(kind, cond, parsedFrom, hostOf, withHelpers) {
+    const out2 = kind === "allowlist" ? this.allowlistVars(cond) : kind === "numeric" ? this.numericVars(cond, parsedFrom) : this.hostVars(cond, hostOf);
+    if (withHelpers) {
+      for (const [name2, pos] of this.guardHelpers(kind)) {
+        for (const call of cond.matchAll(new RegExp(`(?<![\\w.])${escapeRegex(name2)}\\s*\\(`, "g"))) {
+          const args2 = insideParens(cond, call.index + call[0].length - 1)?.split(",") ?? [];
+          const arg = args2[pos]?.trim();
+          if (arg && new RegExp(`^${IDENT}$`).test(arg)) out2.push(arg);
+        }
+      }
+    }
+    return out2;
+  }
+  /**
+   * The variables a check dominating `sinkLine` proves safe for `type`.
+   *
+   * Recognised checks:
+   *   - allowlist: anchored `Regex.IsMatch(x, "^[A-Za-z0-9_]+$")`, `x.All(char.IsLetterOrDigit)`;
+   *   - numeric:   `int.TryParse(x, out _)`, or `p != null` where `p = int.Parse(x)`;
+   *   - host (ssrf only): `new Uri(x).Host == "api.example.com"`, an allowlist
+   *     `Contains` / `IndexOf` of that host.
+   * directly, through a `bool` or host variable, or through a same-file helper.
+   *
+   * A check dominates the sink when the sink is the body of the `if`, is
+   * inside its block, or follows an early exit on the negated check
+   * (`if (!ok) return;`).
+   */
+  guardedVarsAt(type, sinkLine) {
+    const kinds = [];
+    if (INERT_WHEN_ALPHANUMERIC.has(type)) kinds.push("allowlist", "numeric");
+    if (type === "ssrf") kinds.push("host");
+    const proven = /* @__PURE__ */ new Set();
+    if (kinds.length === 0) return proven;
+    const scopeStart = this.methodAt(sinkLine)?.start_line ?? 1;
+    const before = this.statements(scopeStart, sinkLine);
+    const boolOf = /* @__PURE__ */ new Map();
+    const parsedFrom = /* @__PURE__ */ new Map();
+    const hostOf = /* @__PURE__ */ new Map();
+    const parseAnywhere = new RegExp(
+      `(${IDENT})\\s*=\\s*(?:\\([^)]*\\)\\s*)?(?:int|long|short|byte|uint|ulong|decimal|double|float|Int32|Int64)\\s*\\.\\s*Parse\\s*\\(\\s*(${IDENT})\\s*[,)]`,
+      "g"
+    );
+    for (const st of before) {
+      for (const p of st.text.matchAll(parseAnywhere)) parsedFrom.set(p[1], p[2]);
+      const m = ASSIGN_RE.exec(st.text);
+      if (!m) continue;
+      const [, lhs, rhs] = m;
+      const parse2 = new RegExp(`^(?:\\([^)]*\\)\\s*)?(?:int|long|short|byte|uint|ulong|decimal|double|float|Int32|Int64)\\s*\\.\\s*Parse\\s*\\(\\s*(${IDENT})\\s*[,)]`).exec(rhs);
+      if (parse2) parsedFrom.set(lhs, parse2[1]);
+      const host = new RegExp(`^new\\s+(?:System\\s*\\.\\s*)?Uri\\s*\\(\\s*(${IDENT})\\s*\\)\\s*\\.\\s*Host$`).exec(rhs.trim());
+      if (host) hostOf.set(lhs, host[1]);
+      boolOf.set(lhs, rhs);
+    }
+    const credit = (cond) => {
+      const resolved = new RegExp(`^${IDENT}$`).test(cond) ? boolOf.get(cond) ?? cond : cond;
+      for (const kind of kinds) {
+        for (const v of this.provenBy(kind, resolved, parsedFrom, hostOf, true)) proven.add(v);
+      }
+    };
+    const own = leadingIf(this.lines[sinkLine - 1] ?? "");
+    if (own && !own.cond.startsWith("!")) credit(own.cond);
+    let depth = 0;
+    for (let i2 = sinkLine - 1; i2 >= scopeStart; i2--) {
+      const text = this.lines[i2 - 1] ?? "";
+      for (let c = text.length - 1; c >= 0; c--) {
+        if (text[c] === "}") depth++;
+        else if (text[c] === "{") {
+          if (depth > 0) {
+            depth--;
+            continue;
+          }
+          let header = text.slice(0, c);
+          for (let h = i2 - 1; header.trim() === "" && h >= scopeStart; h--) header = this.lines[h - 1] ?? "";
+          const enclosing = leadingIf(header);
+          if (enclosing && !enclosing.cond.startsWith("!")) credit(enclosing.cond);
+        }
+      }
+    }
+    for (let i2 = scopeStart; i2 < sinkLine; i2++) {
+      const guard = leadingIf(this.lines[i2 - 1] ?? "");
+      if (!guard) continue;
+      let rest = guard.rest;
+      for (let n = i2 + 1; rest === "" && n < sinkLine; n++) rest = (this.lines[n - 1] ?? "").trim();
+      if (!EXITS_RE.test(rest)) continue;
+      if (guard.cond.startsWith("!")) {
+        const inner = guard.cond.slice(1).trim();
+        const wrapped = inner.startsWith("(") && insideParens(inner, 0)?.length === inner.length - 2;
+        credit(wrapped ? inner.slice(1, -1) : inner);
+      } else if (/!=/.test(guard.cond) && !/[|&]/.test(guard.cond)) credit(guard.cond.replace("!=", "=="));
+    }
+    return proven;
+  }
+  /**
+   * `StringBuilder`s that hold only safe text at `sinkLine`: every write to
+   * the builder before the sink is made of string literals and `credited`
+   * names. One write with anything else and the builder is not credited, so
+   * `sb.Append(validated); sb.Append(raw);` stays tainted.
+   *
+   * This is how a guard on a value reaches a sink that receives the builder
+   * the value was appended to (`if (parsed != null) { sb.Append(data); Compile(sb.ToString()); }`).
+   */
+  safeBuilders(credited, sinkLine) {
+    const scopeStart = this.methodAt(sinkLine)?.start_line ?? 1;
+    const onlySafe = (expr) => {
+      const idents = expr.replace(/\$?@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ").replace(/\.\s*[A-Za-z_]\w*\s*\(\s*\)/g, " ").match(/[A-Za-z_]\w*/g) ?? [];
+      return idents.every((id) => credited.has(id));
+    };
+    const state = /* @__PURE__ */ new Map();
+    const declRe = new RegExp(`\\b(?:StringBuilder|var)\\s+(${IDENT})\\s*=\\s*new\\s+(?:System\\s*\\.\\s*Text\\s*\\.\\s*)?StringBuilder\\s*\\(`);
+    const writeRe = new RegExp(`^\\s*(${IDENT})\\s*\\.\\s*(?:Append|AppendLine|AppendFormat|Insert)\\s*\\(`);
+    for (const st of this.statements(scopeStart, sinkLine)) {
+      const decl = declRe.exec(st.text);
+      if (decl) {
+        const args2 = insideParens(st.text, decl.index + decl[0].length - 1) ?? "";
+        state.set(decl[1], onlySafe(args2));
+        continue;
+      }
+      const write = writeRe.exec(st.text);
+      if (write && state.has(write[1])) {
+        const args2 = insideParens(st.text, write[0].length - 1);
+        if (args2 === null || !onlySafe(args2)) state.set(write[1], false);
+      }
+    }
+    return new Set([...state].filter(([, safe]) => safe).map(([name2]) => name2));
+  }
+  /**
+   * True when what leaves on `line` has been sanitized or validated for some
+   * sink type. Used for the untyped "tainted data reaches an external call"
+   * fallback, which has no sink type of its own to ask about.
+   */
+  creditedOnLine(line) {
+    const text = this.sinkText(line);
+    const types = new Set(CSHARP_SANITIZER_RES.map((r) => r.type));
+    for (const t of INERT_WHEN_ALPHANUMERIC) types.add(t);
+    types.add("ssrf");
+    for (const type of types) {
+      if (this.sanitizes(type, text)) return true;
+      const credited = /* @__PURE__ */ new Set([...this.sanitizedVarsAt(type, line), ...this.guardedVarsAt(type, line)]);
+      for (const v of this.safeBuilders(credited, line)) credited.add(v);
+      for (const v of credited) if (mentions(text, v)) return true;
+    }
+    return this.fixedHostRequest(line);
+  }
+  // -------------------------------------------------------------------------
+  // SSRF: constant host
+  // -------------------------------------------------------------------------
+  /**
+   * True when the request on `sinkLine` goes to a constant host: the URL
+   * argument starts with a string literal holding the whole authority, as in
+   * `GetAsync("https://api.internal.example.com/?x=" + v)`. Input can then only
+   * extend the path or query. The literal must be the first operand of the
+   * argument, and must end the authority (`/`, `?` or `#` after the host), or
+   * `"https://api.example.com" + x` would let `x = ".evil.org"` move the host.
+   */
+  fixedHostRequest(sinkLine) {
+    const fixedLiteral = '\\$?@?"https?:\\/\\/[A-Za-z0-9.\\-]+(?::\\d+)?[\\/?#][^"]*"';
+    const text = this.lines[sinkLine - 1] ?? "";
+    const argStart = `\\(\\s*(?:new\\s+(?:System\\s*\\.\\s*)?Uri\\s*\\(\\s*)?`;
+    if (new RegExp(argStart + fixedLiteral).test(text)) return true;
+    const scopeStart = this.methodAt(sinkLine)?.start_line ?? 1;
+    const fixed = /* @__PURE__ */ new Set();
+    for (const st of this.statements(scopeStart, sinkLine)) {
+      const m = ASSIGN_RE.exec(st.text);
+      if (!m) continue;
+      if (new RegExp("^(?:new\\s+(?:System\\s*\\.\\s*)?Uri\\s*\\(\\s*)?" + fixedLiteral).test(m[2].trim())) fixed.add(m[1]);
+      else fixed.delete(m[1]);
+    }
+    for (const v of fixed) {
+      if (new RegExp(argStart + escapeRegex(v) + "\\s*[,)]").test(text)) return true;
+    }
+    return false;
+  }
+};
+
 // src/analysis/passes/sink-filter-pass.ts
 function escapeReSf(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -35350,7 +35835,6 @@ function jsSsrfHostGuardedLines(code) {
   }
   return covered;
 }
-var CSHARP_ALLOWLIST_STRIP_RE = /\bRegex\s*\.\s*Replace\s*\([^,]*,\s*@?"\[\^(?:[A-Za-z0-9_\- ]|\\w|\\d|\\s)+\]"\s*,\s*@?"[A-Za-z0-9_]?"\s*\)/;
 function isUnwrittenLocalMapKeyRead(code, source) {
   if (source.type !== "plugin_param") return false;
   const lines = code.split("\n");
@@ -35372,18 +35856,6 @@ function isUnwrittenLocalMapKeyRead(code, source) {
   if (lines.some((l) => putRe.test(l))) return false;
   return true;
 }
-var CSHARP_SANITIZER_RES = [
-  { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: "xss" },
-  { re: /\bHtmlEncoder\s*\.\s*Encode\s*\(/, type: "xss" },
-  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" },
-  // An allowlist strip leaves only inert characters, so it covers every family
-  // whose exploitation needs a metacharacter. Each has a fixture; see
-  // `issue-272-csharp-allowlist-strip.test.ts`.
-  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "ldap_injection" },
-  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "xpath_injection" },
-  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "command_injection" },
-  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "sql_injection" }
-];
 function csharpSanitizedVarsByType(code) {
   const lines = code.split("\n");
   const byType = /* @__PURE__ */ new Map();
@@ -35411,7 +35883,7 @@ function csharpSanitizedVarsByType(code) {
       for (const [type, set] of byType) {
         if (set.has(lhs)) continue;
         const refsSanitized = [...set].some(
-          (v) => new RegExp(`(?<![\\w])${escapeRegex(v)}(?![\\w])`).test(rhs)
+          (v) => new RegExp(`(?<![\\w])${escapeRegex2(v)}(?![\\w])`).test(rhs)
         );
         if (refsSanitized) {
           set.add(lhs);
@@ -36202,18 +36674,25 @@ var SinkFilterPass = class {
     if (language === "csharp") {
       const sourceLines = ctx.code.split("\n");
       const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
+      const csFields = new Set(ctx.graph.ir.types.flatMap((t) => (t.fields ?? []).map((f) => f.name)));
+      const credit = new CSharpCredit(ctx.code, ctx.graph.ir.types.flatMap((t) => t.methods));
       const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
         if (sink.type === "xxe" && xxeHardened) return false;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        for (const { re, type } of CSHARP_SANITIZER_RES) {
-          if (type === sink.type && re.test(sinkLineText)) return false;
-        }
-        const sanitizedVars = sanitizedByType.get(sink.type);
-        if (sanitizedVars && sanitizedVars.size > 0) {
-          for (const v of sanitizedVars) {
-            if (new RegExp(`(?<![\\w])${escapeRegex(v)}(?![\\w])`).test(sinkLineText)) return false;
-          }
+        if (credit.sanitizes(sink.type, sinkLineText)) return false;
+        if (sink.type === "ssrf" && credit.fixedHostRequest(sink.line)) return false;
+        const scoped = credit.sanitizedVarsAt(sink.type, sink.line);
+        const fileWide = sanitizedByType.get(sink.type);
+        const sanitizedVars = new Set(scoped);
+        if (fileWide) {
+          for (const v of fileWide) if (csFields.has(v)) sanitizedVars.add(v);
+        }
+        for (const v of credit.guardedVarsAt(sink.type, sink.line)) sanitizedVars.add(v);
+        for (const v of credit.safeBuilders(sanitizedVars, sink.line)) sanitizedVars.add(v);
+        const received = credit.sinkText(sink.line);
+        for (const v of sanitizedVars) {
+          if (new RegExp(`(?<![\\w])${escapeRegex2(v)}(?![\\w])`).test(received)) return false;
         }
         return true;
       });
@@ -36221,7 +36700,7 @@ var SinkFilterPass = class {
     if (language === "csharp") {
       const sourceLines = ctx.code.split("\n");
       const constBaseClients = /* @__PURE__ */ new Set();
-      const declRe = /\b(?:var|HttpClient)\s+([A-Za-z_]\w*)\s*=\s*new\s+HttpClient\s*\{[^}]*\bBaseAddress\s*=\s*new\s+Uri\s*\(\s*(?:@?"[^"]*"|\$?"[^"{}]*")\s*\)/;
+      const declRe = /\b(?:var|HttpClient)\s+([A-Za-z_]\w*)\s*=\s*new\s+HttpClient\s*(?:\([^)]*\)\s*)?\{[^}]*\bBaseAddress\s*=\s*new\s+(?:System\s*\.\s*)?Uri\s*\(\s*(?:@?"[^"]*"|\$?"[^"{}]*")\s*\)/;
       for (const line of sourceLines) {
         const m = declRe.exec(line);
         if (m) constBaseClients.add(m[1]);
@@ -36233,13 +36712,20 @@ var SinkFilterPass = class {
           const text = sourceLines[sink.line - 1] ?? "";
           let onConstClient = false;
           for (const v of constBaseClients) {
-            if (new RegExp(`(?<![\\w])${escapeRegex(v)}\\s*\\.`).test(text)) {
+            if (new RegExp(`(?<![\\w])${escapeRegex2(v)}\\s*\\.`).test(text)) {
               onConstClient = true;
               break;
             }
           }
           if (!onConstClient) return true;
-          const m = relativeLiteralArgRe.exec(text);
+          let m = relativeLiteralArgRe.exec(text);
+          if (!m) {
+            const arg = /Async\s*\(\s*([A-Za-z_]\w*)\s*[,)]/.exec(text)?.[1];
+            if (arg) {
+              const assigned = new RegExp(`\\b${escapeRegex2(arg)}\\s*=\\s*(?:@?\\$?)"([^"]*)"`);
+              for (let i2 = sink.line - 2; i2 >= 0 && !m; i2--) m = assigned.exec(sourceLines[i2] ?? "");
+            }
+          }
           if (!m) return true;
           const lit = m[1];
           if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(lit)) return true;
@@ -36269,7 +36755,7 @@ var SinkFilterPass = class {
       const allLdapSanitizers = [...PY_BUILTIN_LDAP_SANITIZERS, ...wrappers];
       if (allLdapSanitizers.length > 0) {
         const ldapPatterns = allLdapSanitizers.map(
-          (name2) => new RegExp(`\\b${escapeRegex(name2)}\\s*\\(`)
+          (name2) => new RegExp(`\\b${escapeRegex2(name2)}\\s*\\(`)
         );
         filtered = filtered.filter((sink) => {
           if (sink.type !== "ldap_injection") return true;
@@ -36341,7 +36827,7 @@ var SinkFilterPass = class {
     return { sources, sinks: filtered, sanitizers };
   }
 };
-function escapeRegex(s) {
+function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var RESERVED_KEYWORDS = /* @__PURE__ */ new Set([
@@ -36425,7 +36911,7 @@ function extractSourceIdentifiers(text) {
   return out2;
 }
 function isAssignedFromSanitizerPattern(sourceLines, sinkLine, varName, sanitizerPatterns, lookback = 30) {
-  const escapedVar = escapeRegex(varName);
+  const escapedVar = escapeRegex2(varName);
   const assignRe = new RegExp(
     `(?:\\b(?:const|let|var|final|String)\\s+)?\\b${escapedVar}\\s*=\\s*(.+)`
   );
@@ -37895,7 +38381,7 @@ var LibraryProfileXssGatePass = class {
 
 // src/analysis/passes/taint-propagation-pass.ts
 var CONTAINER_READ_SOURCES = /* @__PURE__ */ new Set(["plugin_param", "config_param"]);
-function makeConstPropVeto(constProp, graph, sources, code) {
+function makeConstPropVeto(constProp, graph, sources, code, language) {
   const lines = typeof code === "string" ? code.split("\n") : [];
   const selfReassign = /* @__PURE__ */ new Map();
   const escape = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -37925,6 +38411,7 @@ function makeConstPropVeto(constProp, graph, sources, code) {
     const r = isFalsePositive(constProp, step.line, step.variable);
     if (!r.isFalsePositive) return false;
     if (r.reason !== "variable_not_tainted") return true;
+    if (language === "csharp") return false;
     const lo = Math.min(sourceLine, sinkLine);
     let d = defAt(step.variable, step.line);
     let selfHops = 0;
@@ -37958,7 +38445,7 @@ var TaintPropagationPass = class {
       return { flows: [] };
     }
     const propagationResult = propagateTaint(graph, sources, sinks, sanitizers);
-    const isVetoed = makeConstPropVeto(constProp, graph, sources, ctx.code);
+    const isVetoed = makeConstPropVeto(constProp, graph, sources, ctx.code, ctx.language);
     const verifiedFlows = propagationResult.flows.filter((flow) => {
       if (constProp.unreachableLines.has(flow.sink.line)) return false;
       for (const step of flow.path) {
@@ -38457,7 +38944,7 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
               if (source.variable && source.variable !== varName && source.in_method && call.in_method && source.in_method !== call.in_method) {
                 continue;
               }
-              if (typeof code === "string" && isReassignedToLiteralBetween(code, varName, source.line, sink.line)) {
+              if (typeof code === "string" && isReassignedToLiteralBetween(code, varName, source.line, sink.line, unreachableLines)) {
                 continue;
               }
               flows.push({
@@ -38497,7 +38984,7 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
                   if (source.variable && source.variable !== collectionVar && source.in_method && call.in_method && source.in_method !== call.in_method) {
                     continue;
                   }
-                  if (typeof code === "string" && isReassignedToLiteralBetween(code, collectionVar, source.line, sink.line)) {
+                  if (typeof code === "string" && isReassignedToLiteralBetween(code, collectionVar, source.line, sink.line, unreachableLines)) {
                     continue;
                   }
                   flows.push({
@@ -38611,7 +39098,7 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
           if (paramSource) {
             const exists = flows.some((f) => f.source_line === paramSource.line && f.sink_line === sink.line && f.sink_type === sink.type);
             if (!exists) {
-              if (typeof code === "string" && isReassignedToLiteralBetween(code, arg.variable, paramSource.line, sink.line)) {
+              if (typeof code === "string" && isReassignedToLiteralBetween(code, arg.variable, paramSource.line, sink.line, unreachableLines)) {
                 continue;
               }
               flows.push({
@@ -38635,6 +39122,85 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
   void types;
   return flows;
 }
+function csharpMethodScopedAliases(code, seeds, methods, fieldNames) {
+  const lines = code.split("\n");
+  const methodOf = (line) => {
+    let best = -1;
+    let span = Infinity;
+    methods.forEach((m, i2) => {
+      if (line >= m.start_line && line <= m.end_line && m.end_line - m.start_line < span) {
+        best = i2;
+        span = m.end_line - m.start_line;
+      }
+    });
+    return best;
+  };
+  const declRe = /^\s*(?:public|private|protected|internal|static|readonly|const|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*\??)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const assignRe = /^\s*(?:this\s*\.\s*)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const returnRe = /^\s*return\s+(.+?);\s*$/;
+  const KEYWORDS2 = /* @__PURE__ */ new Set(["return", "throw", "new", "await", "yield", "else", "case", "using", "var"]);
+  const codeOf = (rhs) => rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
+  const local = /* @__PURE__ */ new Map();
+  const taintedFields = /* @__PURE__ */ new Set();
+  const returnsTainted = /* @__PURE__ */ new Set();
+  const localsOf = (m) => {
+    let set = local.get(m);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      local.set(m, set);
+    }
+    return set;
+  };
+  for (const seed of seeds) {
+    const base = seed.variable.replace(/^this\./, "");
+    if (fieldNames.has(base)) taintedFields.add(base);
+    else localsOf(methodOf(seed.line)).add(seed.variable);
+  }
+  const out2 = [];
+  let changed = true;
+  for (let guard = 0; changed && guard < lines.length + 2; guard++) {
+    changed = false;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      let text = lines[i2];
+      const trimmed = text.trimStart();
+      if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+      if (/^\s*(?:[\w.<>\[\]?]+\s+)?[A-Za-z_]\w*\s*=(?!=)/.test(text) && !/;\s*(?:\/\/.*)?$/.test(text)) {
+        for (let j = i2 + 1; j < lines.length && j <= i2 + 12; j++) {
+          text = text.trimEnd() + " " + lines[j].trim();
+          if (/;\s*(?:\/\/.*)?$/.test(lines[j])) break;
+        }
+      }
+      const m = methodOf(i2 + 1);
+      const here = localsOf(m);
+      const ret = returnRe.exec(text);
+      if (ret && m !== -1 && !returnsTainted.has(methods[m].name)) {
+        const idents2 = codeOf(ret[1]).match(/[\p{L}\p{N}_]+/gu) ?? [];
+        if (idents2.some((t) => here.has(t) || taintedFields.has(t))) {
+          returnsTainted.add(methods[m].name);
+          changed = true;
+        }
+        continue;
+      }
+      const d = declRe.exec(text) ?? assignRe.exec(text);
+      if (!d) continue;
+      const [, lhs, rhs] = d;
+      if (KEYWORDS2.has(lhs)) continue;
+      const isField = fieldNames.has(lhs) && !declRe.test(text);
+      if (isField ? taintedFields.has(lhs) : here.has(lhs)) continue;
+      const rhsCode = codeOf(rhs);
+      const idents = rhsCode.match(/[\p{L}\p{N}_]+/gu) ?? [];
+      const viaLocal = idents.some((t) => here.has(t));
+      const viaField = idents.some((t) => taintedFields.has(t) && !here.has(t));
+      const viaCall = [...rhsCode.matchAll(/([\p{L}_][\p{L}\p{N}_]*)\s*\(/gu)].some((c) => returnsTainted.has(c[1]));
+      if (!viaLocal && !viaField && !viaCall) continue;
+      if (isField) taintedFields.add(lhs);
+      else here.add(lhs);
+      out2.push({ variable: lhs, line: i2 + 1, carried: !viaLocal });
+      changed = true;
+    }
+  }
+  return out2;
+}
 var _reassignSplitCode;
 var _reassignSplitLines;
 function splitLinesCached(code) {
@@ -38643,7 +39209,7 @@ function splitLinesCached(code) {
   _reassignSplitLines = code.split("\n");
   return _reassignSplitLines;
 }
-function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
+function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine, unreachableLines) {
   if (!variable || sinkLine - srcLine < 2) return false;
   if (!/^[A-Za-z_][\w]*$/.test(variable)) return false;
   const lines = splitLinesCached(code);
@@ -38664,40 +39230,103 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
     if (!line) continue;
     if (reGuarded.test(line)) return true;
     if (!reNaked.test(line) && !reSwitchCase.test(line)) continue;
-    if (switchAlsoAssignsNonLiteral(lines, i2, variable, strLit)) continue;
+    if (siblingBranchAssignsNonLiteral(lines, i2, variable, strLit, unreachableLines)) continue;
     return true;
   }
   return false;
 }
-function switchAlsoAssignsNonLiteral(lines, idx, variable, strLit) {
+function enclosingBrace(lines, line, col) {
   let depth = 0;
-  let start2 = -1;
-  for (let i2 = idx; i2 >= 0; i2--) {
-    const line = lines[i2];
-    for (let c = line.length - 1; c >= 0; c--) {
-      if (line[c] === "}") depth++;
-      else if (line[c] === "{") depth--;
+  for (let i2 = line; i2 >= 0; i2--) {
+    const text = lines[i2];
+    for (let c = i2 === line ? Math.min(col, text.length) - 1 : text.length - 1; c >= 0; c--) {
+      if (text[c] === "}") depth++;
+      else if (text[c] === "{") {
+        if (depth === 0) {
+          let header = text.slice(0, c).trim();
+          let headerLine = i2;
+          for (let h = i2 - 1; header === "" && h >= 0; h--) {
+            header = lines[h].trim();
+            headerLine = h;
+          }
+          return { line: i2, col: c, header, headerLine };
+        }
+        depth--;
+      }
     }
-    if (depth < 0) {
-      if (/\bswitch\b/.test(line)) start2 = i2;
-      break;
+  }
+  return null;
+}
+function matchingClose(lines, line, col) {
+  let depth = 0;
+  for (let i2 = line; i2 < lines.length; i2++) {
+    const text = lines[i2];
+    for (let c = i2 === line ? col : 0; c < text.length; c++) {
+      if (text[c] === "{") depth++;
+      else if (text[c] === "}" && --depth === 0) return { line: i2, col: c };
     }
   }
-  if (start2 < 0) return false;
+  return null;
+}
+function siblingBranchAssignsNonLiteral(lines, idx, variable, strLit, unreachableLines) {
+  let block = enclosingBrace(lines, idx, 0);
+  if (block && /^(?:case\b.*|default\s*):$/.test(block.header)) {
+    block = enclosingBrace(lines, block.line, block.col);
+  }
+  if (!block) return false;
+  let first = block.headerLine;
+  let last;
+  const end = matchingClose(lines, block.line, block.col);
+  if (!end) return false;
+  last = end.line;
+  if (/\bswitch\b/.test(block.header)) {
+  } else if (/^(?:\}\s*)?else\b/.test(block.header) || /^(?:\}\s*)?(?:else\s+)?if\s*\(/.test(block.header)) {
+    let cur = block;
+    for (let guard = 0; guard < 64 && /^(?:\}\s*)?else\b/.test(cur.header); guard++) {
+      let closeLine = cur.headerLine;
+      let closeCol = lines[closeLine].indexOf("}");
+      if (closeCol === -1 || closeCol > lines[closeLine].search(/\belse\b/)) {
+        closeLine--;
+        while (closeLine >= 0 && lines[closeLine].trim() === "") closeLine--;
+        if (closeLine < 0 || !lines[closeLine].trimEnd().endsWith("}")) return false;
+        closeCol = lines[closeLine].lastIndexOf("}");
+      }
+      const prev = enclosingBrace(lines, closeLine, closeCol);
+      if (!prev) return false;
+      cur = prev;
+      first = prev.headerLine;
+    }
+    let close = end;
+    for (let guard = 0; guard < 64; guard++) {
+      let l = close.line;
+      let rest = lines[l].slice(close.col + 1).trim();
+      while (rest === "" && l + 1 < lines.length) {
+        l++;
+        rest = lines[l].trim();
+      }
+      if (!/^else\b/.test(rest)) break;
+      let openLine = l;
+      let openCol = lines[l].indexOf("{", l === close.line ? close.col + 1 : 0);
+      if (openCol === -1) {
+        openLine = l + 1;
+        while (openLine < lines.length && lines[openLine].trim() === "") openLine++;
+        if (openLine >= lines.length || !lines[openLine].trimStart().startsWith("{")) break;
+        openCol = lines[openLine].indexOf("{");
+      }
+      const next = matchingClose(lines, openLine, openCol);
+      if (!next) break;
+      close = next;
+      last = next.line;
+    }
+  } else {
+    return false;
+  }
   const assign = new RegExp(`(?:^|[^\\w.$])${variable}\\s*(?::?=)(?!=)\\s*(.*?)\\s*;?\\s*(?:break\\s*;?)?\\s*$`);
   const literalOnly = new RegExp(`^${strLit}$`);
-  depth = 0;
-  for (let i2 = start2; i2 < lines.length; i2++) {
-    const line = lines[i2];
-    if (i2 > start2 || line.includes("{")) {
-      const m = assign.exec(line);
-      if (m && m[1] && !literalOnly.test(m[1])) return true;
-    }
-    for (const ch of line) {
-      if (ch === "{") depth++;
-      else if (ch === "}") depth--;
-    }
-    if (i2 > start2 && depth <= 0) break;
+  for (let i2 = first; i2 <= last; i2++) {
+    if (i2 === idx || unreachableLines?.has(i2 + 1)) continue;
+    const m = assign.exec(lines[i2]);
+    if (m && m[1] && !literalOnly.test(m[1])) return true;
   }
   return false;
 }
@@ -38825,6 +39454,18 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
   const goFnStart = (line) => enclosingStart(goFnRanges, line);
   const csFnRanges = methodRanges(["csharp"]);
   const csFnStart = (line) => enclosingStart(csFnRanges, line);
+  const csFieldNames = /* @__PURE__ */ new Set();
+  if (language === "csharp") {
+    for (const t of types ?? []) for (const f of t.fields ?? []) csFieldNames.add(f.name);
+  }
+  const csDifferentMethod = (variable, sourceLine, otherLine) => {
+    if (csFnRanges.length === 0) return false;
+    const a = csFnStart(sourceLine);
+    const b = csFnStart(otherLine);
+    if (a === -1 || b === -1 || a === b) return false;
+    const base = variable.replace(/^this\./, "").split(".")[0];
+    return !csFieldNames.has(base);
+  };
   const sourcesWithVar = sources.filter(
     (s) => typeof s.variable === "string" && s.variable.length > 0
   );
@@ -39072,7 +39713,28 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
-  if ((language === "java" || language === "csharp") && typeof code === "string" && sourcesWithVar.length > 0) {
+  if (language === "csharp" && typeof code === "string" && sourcesWithVar.length > 0 && csFnRanges.length > 0) {
+    const csMethods = (types ?? []).flatMap((t) => t.methods);
+    const seeds = sourcesWithVar.map((sv) => ({ variable: sv.variable, line: sv.line }));
+    const methodStartOf = (line) => csFnStart(line);
+    const aliases = csharpMethodScopedAliases(code, seeds, csMethods, csFieldNames);
+    const fileAnchor = sourcesWithVar.reduce((a, sv) => sv.line < a.line ? sv : a, sourcesWithVar[0]);
+    const have = new Set(sourcesWithVar.map((sv) => `${sv.variable}@${methodStartOf(sv.line)}`));
+    for (const alias of aliases) {
+      const fn = methodStartOf(alias.line);
+      const isField = csFieldNames.has(alias.variable);
+      const key = `${alias.variable}@${isField ? "field" : fn}`;
+      if (have.has(key)) continue;
+      have.add(key);
+      const inMethod = sourcesWithVar.filter((sv) => methodStartOf(sv.line) === fn && sv.line <= alias.line);
+      const from = !alias.carried && inMethod.length > 0 ? inMethod.reduce((a, sv) => sv.line < a.line ? sv : a, inMethod[0]) : fileAnchor;
+      sourcesWithVar.push({
+        ...from,
+        variable: alias.variable,
+        ...alias.carried || inMethod.length === 0 ? { line: alias.line } : {}
+      });
+    }
+  } else if ((language === "java" || language === "csharp") && typeof code === "string" && sourcesWithVar.length > 0) {
     const seedVars = new Set(sourcesWithVar.map((s) => s.variable));
     const derived = buildJavaTaintedVars(code, seedVars);
     if (derived.size > 0) {
@@ -39114,20 +39776,25 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
   if (language === "csharp" && typeof code === "string" && sourcesWithVar.length > 0) {
     const lines = code.split("\n");
     const ctRe = /(\w+)\s*\.\s*CommandText\s*\+?=\s*(.+)/;
-    const anchor = sourcesWithVar.reduce((a, s) => s.line < a.line ? s : a, sourcesWithVar[0]);
+    const seeded = /* @__PURE__ */ new Set();
     let added = true;
     let guard = 0;
     while (added && guard < lines.length + 2) {
       added = false;
       guard++;
-      const known = new Set(sourcesWithVar.map((s) => s.variable));
       for (let i2 = 0; i2 < lines.length; i2++) {
         const m = ctRe.exec(lines[i2]);
         if (!m) continue;
         const [, obj, rhs] = m;
-        if (known.has(obj)) continue;
-        if (!argsReferenceTaintedVar(rhs, sourcesWithVar)) continue;
-        sourcesWithVar.push({ ...anchor, variable: obj, line: i2 + 1 });
+        const key = `${obj}@${csFnStart(i2 + 1)}`;
+        if (seeded.has(key)) continue;
+        const reachable = sourcesWithVar.filter(
+          (sv) => sv.line <= i2 + 1 && !csDifferentMethod(sv.variable, sv.line, i2 + 1)
+        );
+        if (reachable.length === 0 || !argsReferenceTaintedVar(rhs, reachable)) continue;
+        const from = reachable.reduce((a, sv) => sv.line < a.line ? sv : a, reachable[0]);
+        sourcesWithVar.push({ ...from, variable: obj, line: i2 + 1 });
+        seeded.add(key);
         added = true;
       }
     }
@@ -39143,17 +39810,18 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     if (builders.size > 0) {
       const appendRe = /([\p{L}_][\p{L}\p{N}_]*)\s*\.\s*(?:Append|AppendLine|AppendFormat|Insert)\s*\(([\s\S]*)/u;
       const anchor = sourcesWithVar.reduce((a, s) => s.line < a.line ? s : a, sourcesWithVar[0]);
+      const builderSeeded = /* @__PURE__ */ new Set();
       let added = true;
       let guard = 0;
       while (added && guard < lines.length + 2) {
         added = false;
         guard++;
-        const known = new Set(sourcesWithVar.map((s) => s.variable));
         for (let i2 = 0; i2 < lines.length; i2++) {
           const m = appendRe.exec(lines[i2]);
           if (!m) continue;
           const [, obj, args2] = m;
-          if (!builders.has(obj) || known.has(obj)) continue;
+          const seedKey = `${obj}@${csFnStart(i2 + 1)}`;
+          if (!builders.has(obj) || builderSeeded.has(seedKey)) continue;
           const appendFn = csFnStart(i2 + 1);
           const reachable = sourcesWithVar.filter(
             (sv) => appendFn === -1 || csFnStart(sv.line) === -1 || csFnStart(sv.line) === appendFn
@@ -39161,6 +39829,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
           if (reachable.length > 0 && argsReferenceTaintedVar(args2, reachable)) {
             sourcesWithVar.push({ ...anchor, variable: obj, line: i2 + 1 });
             builderSeeds.add(`${obj}@${i2 + 1}`);
+            builderSeeded.add(seedKey);
             added = true;
           }
         }
@@ -39234,6 +39903,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             const sinkFn = csFnStart(sink.line);
             if (srcFn !== sinkFn) continue;
           }
+          if (csDifferentMethod(source.variable, source.line, sink.line)) continue;
           if (complex) {
             const re = reCache.get(source.variable);
             if (!re || !re.test(expr)) continue;
@@ -39244,7 +39914,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
           if (aliasSanitizedFor.get(source.variable)?.has(sink.type)) {
             break;
           }
-          if (typeof code === "string" && isReassignedToLiteralBetween(code, source.variable, source.line, sink.line)) {
+          if (typeof code === "string" && isReassignedToLiteralBetween(code, source.variable, source.line, sink.line, unreachableLines)) {
             break;
           }
           flows.push({
@@ -39380,6 +40050,7 @@ var InterproceduralPass = class {
       }
     }
     const language = graph.ir.meta.language;
+    const csCredit = language === "csharp" && typeof ctx.code === "string" ? new CSharpCredit(ctx.code, graph.ir.types.flatMap((t) => t.methods)) : null;
     if (sinks.length > 0) {
       const interProc = analyzeInterprocedural(graph, sources, sinks, sanitizers, {
         taintedVariables: constProp.tainted
@@ -39406,6 +40077,9 @@ var InterproceduralPass = class {
             if (!method) continue;
             if (sink.line < method.startLine || sink.line > method.endLine) continue;
             if (sanitizerMethodNames.has(method.name)) continue;
+            if (language === "csharp" && typeof ctx.code === "string" && !csharpParamReachesSink(ctx.code, method, edge.taintedArgs, sink, csCredit)) {
+              continue;
+            }
             for (const source of sources) {
               if (source.line > edge.callLine) continue;
               if (source.type === "interprocedural_param" && source.confidence < 0.6) continue;
@@ -39548,9 +40222,53 @@ var InterproceduralPass = class {
         return !sanitizedSinkKeys.has(`${s.line}:${s.type}`);
       });
     }
+    if (csCredit) {
+      const credited = /* @__PURE__ */ new Set();
+      filteredAdditionalFlows = filteredAdditionalFlows.filter((f) => {
+        if (f.sink_type !== "external_taint_escape" || !csCredit.creditedOnLine(f.sink_line)) return true;
+        credited.add(f.sink_line);
+        return false;
+      });
+      filteredAdditionalSinks = filteredAdditionalSinks.filter(
+        (s) => !(s.type === "external_taint_escape" && credited.has(s.line))
+      );
+    }
     return { additionalSinks: filteredAdditionalSinks, additionalFlows: filteredAdditionalFlows, interprocedural };
   }
 };
+function csharpParamReachesSink(code, method, taintedArgs, sink, credit) {
+  const lines = code.split(/\r?\n/);
+  const params = taintedArgs.length > 0 ? method.parameters.filter((p) => taintedArgs.includes(p.position)) : method.parameters;
+  if (params.length === 0) return true;
+  const derived = new Set(params.map((p) => p.name));
+  const codeOf = (text) => text.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
+  const mentionsDerived = (text) => {
+    const bare = codeOf(text);
+    return [...derived].filter((v) => new RegExp(`(?<![\\w.])${v}(?![\\w])`).test(bare));
+  };
+  const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>[\]?]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.+)$/;
+  const objectWriteRe = /^\s*([A-Za-z_]\w*)\s*\.\s*[A-Za-z_]\w*\s*(?:\+?=(?!=)|\()(.*)$/;
+  for (let i2 = method.startLine + 1; i2 < sink.line; i2++) {
+    const text = lines[i2 - 1] ?? "";
+    const assign = assignRe.exec(text);
+    if (assign) {
+      if (mentionsDerived(assign[2]).length > 0) derived.add(assign[1]);
+      else if (!params.some((p) => p.name === assign[1])) derived.delete(assign[1]);
+      continue;
+    }
+    const write = objectWriteRe.exec(text);
+    if (write && mentionsDerived(write[2]).length > 0) derived.add(write[1]);
+  }
+  let statement = lines[sink.line - 1] ?? "";
+  for (let i2 = sink.line; i2 < lines.length && i2 < sink.line + 6 && !/[;{}]\s*$/.test(statement.trimEnd()); i2++) {
+    statement += " " + (lines[i2] ?? "").trim();
+  }
+  const reaching = mentionsDerived(statement);
+  if (reaching.length === 0) return false;
+  if (!credit) return true;
+  const safe = /* @__PURE__ */ new Set([...credit.sanitizedVarsAt(sink.type, sink.line), ...credit.guardedVarsAt(sink.type, sink.line)]);
+  return reaching.some((v) => !safe.has(v));
+}
 
 // src/analysis/passes/dead-code-pass.ts
 var DeadCodePass = class {
@@ -40234,7 +40952,7 @@ var NullDerefPass = class {
 };
 
 // src/analysis/passes/resource-leak-pass.ts
-function escapeRegex2(s) {
+function escapeRegex3(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var FACTORY_METHOD_NAME_RE = /^(?:open|create|new|get|make|build)[A-Z]/;
@@ -40453,7 +41171,7 @@ var ResourceLeakPass = class {
    * ownership to the caller (caller is responsible for close).
    */
   isReturnedToCaller(lines, variable, fromLine, toLine) {
-    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex2(variable)}\\b`);
+    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex3(variable)}\\b`);
     for (let l = fromLine; l <= toLine && l <= lines.length; l++) {
       if (varRe.test(lines[l - 1] ?? "")) return true;
     }
@@ -40466,7 +41184,7 @@ var ResourceLeakPass = class {
    */
   fieldStoredName(lines, variable, openLine, toLine) {
     const thisAssignRe = new RegExp(
-      `\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex2(variable)}\\b`
+      `\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex3(variable)}\\b`
     );
     for (let l = openLine; l <= toLine && l <= lines.length; l++) {
       const m = thisAssignRe.exec(lines[l - 1] ?? "");
@@ -40541,7 +41259,7 @@ var ResourceLeakPass = class {
       candidateField = variable;
     } else {
       const thisAssignRe = new RegExp(
-        `(?:\\bthis\\s*\\.\\s*)?(\\w+)\\s*=\\s*${escapeRegex2(variable)}\\b`
+        `(?:\\bthis\\s*\\.\\s*)?(\\w+)\\s*=\\s*${escapeRegex3(variable)}\\b`
       );
       for (let l = fromLine; l <= toLine && l <= lines.length; l++) {
         const m = thisAssignRe.exec(lines[l - 1] ?? "");