circle-ir 4.14.0 → 4.14.2

package/dist/core/circle-ir-core.cjs

@@ -8080,6 +8080,17 @@ function extractGoCallInfo(node) {
       if (operand.type === "identifier") {
         const resolved = resolveGoLocalReceiverType(opText, node);
         receiver = resolved !== null ? resolved : opText;
+      } else if (operand.type === "selector_expression" && methodName === "Get") {
+        const fieldNode = operand.childForFieldName("field");
+        const inner = operand.childForFieldName("operand");
+        const fieldName = fieldNode ? getNodeText(fieldNode) : "";
+        const innerName = inner && inner.type === "identifier" ? getNodeText(inner) : null;
+        const innerType = innerName !== null ? resolveGoLocalReceiverType(innerName, node) : null;
+        if (innerType === "Request" && (fieldName === "PostForm" || fieldName === "Form")) {
+          receiver = fieldName === "PostForm" ? "RequestPostForm" : "RequestForm";
+        } else {
+          receiver = opText;
+        }
       } else {
         receiver = opText;
       }
@@ -10242,6 +10253,36 @@ function extractFieldDefs(body2, startId) {
 function extractJSParameterDefs(params, startId) {
   const defs = [];
   let id = startId;
+  const addPatternDefs = (patternNode, line) => {
+    if (patternNode.type === "identifier" || patternNode.type === "shorthand_property_identifier_pattern") {
+      defs.push({
+        id: id++,
+        variable: getNodeText(patternNode),
+        line,
+        kind: "param"
+      });
+      return;
+    }
+    if (patternNode.type === "rest_pattern" || patternNode.type === "rest_element") {
+      const nameNode = patternNode.namedChildCount > 0 ? patternNode.namedChild(0) : null;
+      if (!nameNode) return;
+      addPatternDefs(nameNode, line);
+      return;
+    }
+    if (patternNode.type === "assignment_pattern") {
+      const leftNode = patternNode.childForFieldName("left");
+      if (leftNode) addPatternDefs(leftNode, line);
+      return;
+    }
+    if (patternNode.type === "object_pattern" || patternNode.type === "array_pattern") {
+      const destructDefs = extractDestructuringDefs(patternNode, id);
+      for (const def of destructDefs) {
+        def.kind = "param";
+        defs.push(def);
+        id++;
+      }
+    }
+  };
   for (let i2 = 0; i2 < params.childCount; i2++) {
     const param = params.child(i2);
     if (!param) continue;
@@ -10289,14 +10330,7 @@ function extractJSParameterDefs(params, startId) {
       }
     } else if (param.type === "required_parameter" || param.type === "optional_parameter") {
       const patternNode = param.childForFieldName("pattern");
-      if (patternNode && patternNode.type === "identifier") {
-        defs.push({
-          id: id++,
-          variable: getNodeText(patternNode),
-          line: param.startPosition.row + 1,
-          kind: "param"
-        });
-      }
+      if (patternNode) addPatternDefs(patternNode, param.startPosition.row + 1);
     }
   }
   return defs;
@@ -12425,8 +12459,15 @@ var DEFAULT_SINKS = [
   { method: "setExpireTimeSeconds", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
   { method: "configureJarCase", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "toString", class: "StringUtils", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  // Wildfly/Undertow servlet resource manager
-  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
+  // Wildfly/Undertow servlet resource manager.
+  // ResourceManager / PathResourceManager / FileResourceManager /
+  // ClassPathResourceManager are the interface and implementations WildFly
+  // calls through (cognium-dev#622, CVE-2018-1047). Class-qualified only.
+  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "PathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "FileResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ClassPathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
   // Yamcs file system bucket
   { method: "deleteObject", class: "FileSystemBucket", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   // RocketMQ validators
@@ -15066,7 +15107,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
       if (skipMethods.includes(method.name)) continue;
       for (const param of method.parameters) {
         const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
-        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const isDestructureBinding = param.name.startsWith("{") || param.name.startsWith("[");
+        const isTaintable = hasCSharpBindingAttr ? true : isDestructureBinding ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -15296,7 +15338,8 @@ function isInterproceduralTaintableType(typeName, language) {
 }
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection") return false;
-  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const positions = pattern.arg_positions ?? [];
+  const queryPos = positions.length > 0 ? Math.min(...positions) : 0;
   const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
@@ -17220,6 +17263,9 @@ function buildSanitizersByLine(sanitizers) {
   }
   return out2;
 }
+function concatOutsideStrings(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
 function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanitizers, sanitizersArg) {
   let graph;
   let sources;
@@ -17251,6 +17297,7 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
   }
   const taintedVars = [];
   const flows = [];
+  const javaConcat = graph.ir.meta.language === "java";
   const reachableSinks = /* @__PURE__ */ new Map();
   const defsByLine = graph.defsByLine;
   const usesByLine = graph.usesByLine;
@@ -17287,23 +17334,40 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
             continue;
           }
         }
-        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        const expr = typeof arg.expression === "string" ? arg.expression : "";
+        const compoundConcat = javaConcat && !!arg.variable && expr !== arg.variable && concatOutsideStrings(expr);
+        const candidateUses = arg.variable && !compoundConcat ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
         {
           for (const use of candidateUses) {
             if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
-                if (!arg.variable) {
+                if (!arg.variable || compoundConcat) {
                   if (typeof arg.expression !== "string" || arg.expression.length === 0) continue;
                   const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
                   if (!re.test(arg.expression)) continue;
                 }
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
+                  let sanMap = sanitizersByLine;
+                  if (identifierOutsideSanitizerCalls(
+                    use.variable,
+                    callsAtSink,
+                    sanitizersByLine.get(sink.line) ?? [],
+                    sink.type
+                  )) {
+                    const stripped = new Map(sanitizersByLine);
+                    const kept = (sanitizersByLine.get(sink.line) ?? []).filter(
+                      (s) => !sanitizerCoversSink(s, sink.type)
+                    );
+                    if (kept.length === 0) stripped.delete(sink.line);
+                    else stripped.set(sink.line, kept);
+                    sanMap = stripped;
+                  }
                   const isSanitized = checkSanitized(
                     taintInfo.line,
                     sink.line,
                     sink.type,
-                    sanitizersByLine,
+                    sanMap,
                     {
                       startDefId: use.def_id,
                       chainsByToDef: graph.chainsByToDef,
@@ -17457,6 +17521,86 @@ var KNOWN_SINK_TYPES = /* @__PURE__ */ new Set([
   "crlf",
   "mass_assignment"
 ]);
+function readBalancedArg(text, openParen) {
+  let depth = 0;
+  let quote = null;
+  let escaped = false;
+  for (let i2 = openParen; i2 < text.length; i2++) {
+    const c = text[i2];
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (c === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (c === "(") depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0) return text.slice(openParen + 1, i2);
+    }
+  }
+  return null;
+}
+function sanitizerCallRefs(sanitizers, sinkType) {
+  const refs = [];
+  for (const san of sanitizers) {
+    if (!sanitizerCoversSink(san, sinkType)) continue;
+    const m = /(?:(\w+)\.)?(\w+)\(\)/.exec(san.method);
+    if (!m?.[2]) continue;
+    refs.push({ receiver: m[1], methodName: m[2] });
+  }
+  return refs;
+}
+function maskSanitizerCalls(expr, refs) {
+  let out2 = expr;
+  for (const ref of refs) {
+    const needles = ref.receiver ? [`${ref.receiver}.${ref.methodName}`, ref.methodName] : [ref.methodName];
+    for (const needle of needles) {
+      const re = new RegExp(`\\b${needle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\(`);
+      for (let guard = 0; guard < 8; guard++) {
+        const m = re.exec(out2);
+        if (!m) break;
+        const open = m.index + m[0].length - 1;
+        const arg = readBalancedArg(out2, open);
+        if (arg === null) break;
+        out2 = out2.slice(0, m.index) + " " + out2.slice(open + arg.length + 2);
+      }
+    }
+  }
+  return out2;
+}
+function blankStringLiterals(expr) {
+  return expr.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)*'/g, "''");
+}
+function identifierOutsideSanitizerCalls(variable, calls, sanitizers, sinkType) {
+  if (!/^[A-Za-z_$][\w$]*$/.test(variable)) return false;
+  const refs = sanitizerCallRefs(sanitizers, sinkType);
+  if (refs.length === 0) return false;
+  const re = new RegExp(
+    `(?:^|[^A-Za-z0-9_$])${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`
+  );
+  for (const call of calls) {
+    if (refs.some((r) => r.methodName === call.method_name)) continue;
+    for (const arg of call.arguments) {
+      const expr = arg.expression ?? "";
+      if (!expr) continue;
+      const masked = maskSanitizerCalls(expr, refs);
+      if (masked === expr) continue;
+      if (re.test(blankStringLiterals(masked))) return true;
+    }
+  }
+  return false;
+}
 function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);

package/dist/core/circle-ir-core.js

@@ -8014,6 +8014,17 @@ function extractGoCallInfo(node) {
       if (operand.type === "identifier") {
         const resolved = resolveGoLocalReceiverType(opText, node);
         receiver = resolved !== null ? resolved : opText;
+      } else if (operand.type === "selector_expression" && methodName === "Get") {
+        const fieldNode = operand.childForFieldName("field");
+        const inner = operand.childForFieldName("operand");
+        const fieldName = fieldNode ? getNodeText(fieldNode) : "";
+        const innerName = inner && inner.type === "identifier" ? getNodeText(inner) : null;
+        const innerType = innerName !== null ? resolveGoLocalReceiverType(innerName, node) : null;
+        if (innerType === "Request" && (fieldName === "PostForm" || fieldName === "Form")) {
+          receiver = fieldName === "PostForm" ? "RequestPostForm" : "RequestForm";
+        } else {
+          receiver = opText;
+        }
       } else {
         receiver = opText;
       }
@@ -10176,6 +10187,36 @@ function extractFieldDefs(body2, startId) {
 function extractJSParameterDefs(params, startId) {
   const defs = [];
   let id = startId;
+  const addPatternDefs = (patternNode, line) => {
+    if (patternNode.type === "identifier" || patternNode.type === "shorthand_property_identifier_pattern") {
+      defs.push({
+        id: id++,
+        variable: getNodeText(patternNode),
+        line,
+        kind: "param"
+      });
+      return;
+    }
+    if (patternNode.type === "rest_pattern" || patternNode.type === "rest_element") {
+      const nameNode = patternNode.namedChildCount > 0 ? patternNode.namedChild(0) : null;
+      if (!nameNode) return;
+      addPatternDefs(nameNode, line);
+      return;
+    }
+    if (patternNode.type === "assignment_pattern") {
+      const leftNode = patternNode.childForFieldName("left");
+      if (leftNode) addPatternDefs(leftNode, line);
+      return;
+    }
+    if (patternNode.type === "object_pattern" || patternNode.type === "array_pattern") {
+      const destructDefs = extractDestructuringDefs(patternNode, id);
+      for (const def of destructDefs) {
+        def.kind = "param";
+        defs.push(def);
+        id++;
+      }
+    }
+  };
   for (let i2 = 0; i2 < params.childCount; i2++) {
     const param = params.child(i2);
     if (!param) continue;
@@ -10223,14 +10264,7 @@ function extractJSParameterDefs(params, startId) {
       }
     } else if (param.type === "required_parameter" || param.type === "optional_parameter") {
       const patternNode = param.childForFieldName("pattern");
-      if (patternNode && patternNode.type === "identifier") {
-        defs.push({
-          id: id++,
-          variable: getNodeText(patternNode),
-          line: param.startPosition.row + 1,
-          kind: "param"
-        });
-      }
+      if (patternNode) addPatternDefs(patternNode, param.startPosition.row + 1);
     }
   }
   return defs;
@@ -12359,8 +12393,15 @@ var DEFAULT_SINKS = [
   { method: "setExpireTimeSeconds", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
   { method: "configureJarCase", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "toString", class: "StringUtils", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  // Wildfly/Undertow servlet resource manager
-  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
+  // Wildfly/Undertow servlet resource manager.
+  // ResourceManager / PathResourceManager / FileResourceManager /
+  // ClassPathResourceManager are the interface and implementations WildFly
+  // calls through (cognium-dev#622, CVE-2018-1047). Class-qualified only.
+  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "PathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "FileResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ClassPathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
   // Yamcs file system bucket
   { method: "deleteObject", class: "FileSystemBucket", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   // RocketMQ validators
@@ -15000,7 +15041,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
       if (skipMethods.includes(method.name)) continue;
       for (const param of method.parameters) {
         const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
-        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const isDestructureBinding = param.name.startsWith("{") || param.name.startsWith("[");
+        const isTaintable = hasCSharpBindingAttr ? true : isDestructureBinding ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -15230,7 +15272,8 @@ function isInterproceduralTaintableType(typeName, language) {
 }
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection") return false;
-  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const positions = pattern.arg_positions ?? [];
+  const queryPos = positions.length > 0 ? Math.min(...positions) : 0;
   const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
@@ -17154,6 +17197,9 @@ function buildSanitizersByLine(sanitizers) {
   }
   return out2;
 }
+function concatOutsideStrings(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
 function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanitizers, sanitizersArg) {
   let graph;
   let sources;
@@ -17185,6 +17231,7 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
   }
   const taintedVars = [];
   const flows = [];
+  const javaConcat = graph.ir.meta.language === "java";
   const reachableSinks = /* @__PURE__ */ new Map();
   const defsByLine = graph.defsByLine;
   const usesByLine = graph.usesByLine;
@@ -17221,23 +17268,40 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
             continue;
           }
         }
-        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        const expr = typeof arg.expression === "string" ? arg.expression : "";
+        const compoundConcat = javaConcat && !!arg.variable && expr !== arg.variable && concatOutsideStrings(expr);
+        const candidateUses = arg.variable && !compoundConcat ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
         {
           for (const use of candidateUses) {
             if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
-                if (!arg.variable) {
+                if (!arg.variable || compoundConcat) {
                   if (typeof arg.expression !== "string" || arg.expression.length === 0) continue;
                   const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
                   if (!re.test(arg.expression)) continue;
                 }
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
+                  let sanMap = sanitizersByLine;
+                  if (identifierOutsideSanitizerCalls(
+                    use.variable,
+                    callsAtSink,
+                    sanitizersByLine.get(sink.line) ?? [],
+                    sink.type
+                  )) {
+                    const stripped = new Map(sanitizersByLine);
+                    const kept = (sanitizersByLine.get(sink.line) ?? []).filter(
+                      (s) => !sanitizerCoversSink(s, sink.type)
+                    );
+                    if (kept.length === 0) stripped.delete(sink.line);
+                    else stripped.set(sink.line, kept);
+                    sanMap = stripped;
+                  }
                   const isSanitized = checkSanitized(
                     taintInfo.line,
                     sink.line,
                     sink.type,
-                    sanitizersByLine,
+                    sanMap,
                     {
                       startDefId: use.def_id,
                       chainsByToDef: graph.chainsByToDef,
@@ -17391,6 +17455,86 @@ var KNOWN_SINK_TYPES = /* @__PURE__ */ new Set([
   "crlf",
   "mass_assignment"
 ]);
+function readBalancedArg(text, openParen) {
+  let depth = 0;
+  let quote = null;
+  let escaped = false;
+  for (let i2 = openParen; i2 < text.length; i2++) {
+    const c = text[i2];
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (c === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (c === "(") depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0) return text.slice(openParen + 1, i2);
+    }
+  }
+  return null;
+}
+function sanitizerCallRefs(sanitizers, sinkType) {
+  const refs = [];
+  for (const san of sanitizers) {
+    if (!sanitizerCoversSink(san, sinkType)) continue;
+    const m = /(?:(\w+)\.)?(\w+)\(\)/.exec(san.method);
+    if (!m?.[2]) continue;
+    refs.push({ receiver: m[1], methodName: m[2] });
+  }
+  return refs;
+}
+function maskSanitizerCalls(expr, refs) {
+  let out2 = expr;
+  for (const ref of refs) {
+    const needles = ref.receiver ? [`${ref.receiver}.${ref.methodName}`, ref.methodName] : [ref.methodName];
+    for (const needle of needles) {
+      const re = new RegExp(`\\b${needle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\(`);
+      for (let guard = 0; guard < 8; guard++) {
+        const m = re.exec(out2);
+        if (!m) break;
+        const open = m.index + m[0].length - 1;
+        const arg = readBalancedArg(out2, open);
+        if (arg === null) break;
+        out2 = out2.slice(0, m.index) + " " + out2.slice(open + arg.length + 2);
+      }
+    }
+  }
+  return out2;
+}
+function blankStringLiterals(expr) {
+  return expr.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)*'/g, "''");
+}
+function identifierOutsideSanitizerCalls(variable, calls, sanitizers, sinkType) {
+  if (!/^[A-Za-z_$][\w$]*$/.test(variable)) return false;
+  const refs = sanitizerCallRefs(sanitizers, sinkType);
+  if (refs.length === 0) return false;
+  const re = new RegExp(
+    `(?:^|[^A-Za-z0-9_$])${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`
+  );
+  for (const call of calls) {
+    if (refs.some((r) => r.methodName === call.method_name)) continue;
+    for (const arg of call.arguments) {
+      const expr = arg.expression ?? "";
+      if (!expr) continue;
+      const masked = maskSanitizerCalls(expr, refs);
+      if (masked === expr) continue;
+      if (re.test(blankStringLiterals(masked))) return true;
+    }
+  }
+  return false;
+}
 function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);

package/dist/core/extractors/calls.js

@@ -2615,6 +2615,25 @@ function extractGoCallInfo(node) {
                 const resolved = resolveGoLocalReceiverType(opText, node);
                 receiver = resolved !== null ? resolved : opText;
             }
+            else if (operand.type === 'selector_expression' && methodName === 'Get') {
+                // cognium-dev #492 — `r.PostForm.Get` / `r.Form.Get` on a declared
+                // `*http.Request`. The operand is `url.Values`, so a type-resolved
+                // receiver would be `Values` and would also match a plain
+                // `url.Values.Get`. Rewrite only this shape to a synthetic class
+                // the Go plugin registers. Index form `r.Form[k][0]` is not a call;
+                // LanguageSourcesPass covers it.
+                const fieldNode = operand.childForFieldName('field');
+                const inner = operand.childForFieldName('operand');
+                const fieldName = fieldNode ? getNodeText(fieldNode) : '';
+                const innerName = inner && inner.type === 'identifier' ? getNodeText(inner) : null;
+                const innerType = innerName !== null ? resolveGoLocalReceiverType(innerName, node) : null;
+                if (innerType === 'Request' && (fieldName === 'PostForm' || fieldName === 'Form')) {
+                    receiver = fieldName === 'PostForm' ? 'RequestPostForm' : 'RequestForm';
+                }
+                else {
+                    receiver = opText;
+                }
+            }
             else {
                 receiver = opText;
             }