circle-ir 4.6.0 → 4.7.1

package/dist/browser/circle-ir.js

@@ -9918,15 +9918,15 @@ function computeChains(defs, uses) {
     existing.push(use);
     usesByLine.set(use.line, existing);
   }
+  const seenChains = /* @__PURE__ */ new Set();
   for (const def of defs) {
     if (def.kind === "local") {
       const usesOnLine = usesByLine.get(def.line) ?? [];
       for (const use of usesOnLine) {
         if (use.def_id !== null && use.def_id !== def.id) {
-          const exists = chains.some(
-            (c) => c.from_def === use.def_id && c.to_def === def.id && c.via === use.variable
-          );
-          if (!exists) {
+          const key = `${use.def_id}\0${def.id}\0${use.variable}`;
+          if (!seenChains.has(key)) {
+            seenChains.add(key);
             chains.push({
               from_def: use.def_id,
               to_def: def.id,
@@ -12501,8 +12501,11 @@ var DEFAULT_SINKS = [
   // SAX handler sinks (can lead to XSS in parsed content)
   { method: "startElement", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
   { method: "characters", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  // Template output sinks
-  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
+  // Template output sinks. `output` is classless (Java template engines /
+  // Velocity), but Rust `std::process::Command::…output()` is process
+  // execution, not HTML — it already fires the CWE-78 command_injection sink,
+  // so exclude Rust here to drop the spurious xss (cognium-dev#146).
+  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], exclude_languages: ["rust"] },
   { method: "setOutput", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "writeAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
   // AntiSamy specific (SAX filters)
@@ -13793,7 +13796,10 @@ var DEFAULT_SINKS = [
   { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# command injection — Process.Start / ProcessStartInfo (CWE-78).
-  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // Both the single-string overload `Process.Start("sh -c " + x)` and the
+  // `(fileName, arguments)` overload `Process.Start("/bin/sh", "-c " + x)` are
+  // injectable — the second is the argv path where taint rides arg[1] (#276).
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   // C# path traversal — System.IO file APIs (CWE-22). Distinctive method names.
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13834,6 +13840,22 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
+  // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
+  // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
+  // `TypedResults.Redirect(url)` also route through the same method name. Taint-
+  // gated, so a constant URL never fires. `LocalRedirect` is deliberately NOT
+  // registered — it rejects non-local URLs and is the documented mitigation.
+  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  { method: "RedirectPermanent", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  // C# CRLF / HTTP response-header injection — classic ASP.NET header writers
+  // (CWE-113, cognium-dev#273/#275). The injectable value is the second arg.
+  { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  // C# NoSQL injection — MongoDB filter built from raw JSON (CWE-943,
+  // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
+  // attacker-controlled query document. Class-scoped (static receiver resolves).
+  { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -18562,6 +18584,26 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
     "Command",
     "CommandContext"
   ]);
+  const ormQueryBuilderMethods = /* @__PURE__ */ new Set([
+    "findMany",
+    "findFirst",
+    "findUnique",
+    "findUniqueOrThrow",
+    "findFirstOrThrow",
+    "findOne",
+    "findAll",
+    "findByPk",
+    "findAndCountAll",
+    "findBy",
+    "findOneBy",
+    "where",
+    "andWhere",
+    "orWhere",
+    "whereIn",
+    "whereNot",
+    "first",
+    "bind"
+  ]);
   const sanitizerMethods = /* @__PURE__ */ new Set();
   for (const san of sanitizers) {
     sanitizerMethods.add(san.method);
@@ -18586,7 +18628,7 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
     }
     const targetMethod = getMethodNode(methodNodes, call.method_name);
     if (!targetMethod) {
-      if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name)) {
+      if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name) && !ormQueryBuilderMethods.has(call.method_name)) {
         const isBash = graph.ir.meta.language === "bash";
         const bashSafeBuiltins = /* @__PURE__ */ new Set([
           "echo",
@@ -26375,6 +26417,7 @@ var LanguageSourcesPass = class {
     additionalSources.push(...findSetterChainSources(types, code, language));
     additionalSources.push(...findJavaScriptAssignmentSources(code, language));
     additionalSources.push(...findCSharpRequestSources(code, language));
+    additionalSources.push(...findGoArgvSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -27029,6 +27072,31 @@ function findSetterChainSources(types, sourceCode, language) {
   }
   return sources;
 }
+function findGoArgvSources(sourceCode, language) {
+  if (language !== "go") return [];
+  const sources = [];
+  const lines = sourceCode.split("\n");
+  const rangeRe = /\bfor\b[^;{]*?,\s*([A-Za-z_]\w*)\s*:?=\s*range\s+os\.Args\b/;
+  const assignRe = /\b([A-Za-z_]\w*)\s*:?=\s*os\.Args\b/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const rm = rangeRe.exec(line);
+    const m = rm ?? assignRe.exec(line);
+    if (!m) continue;
+    const varName = m[1];
+    const lineNumber = i2 + 1;
+    if (sources.some((s) => s.line === lineNumber && s.variable === varName)) continue;
+    sources.push({
+      type: "io_input",
+      location: `${varName} = os.Args`,
+      severity: "high",
+      line: lineNumber,
+      confidence: 1,
+      variable: varName
+    });
+  }
+  return sources;
+}
 function findCSharpRequestSources(sourceCode, language) {
   if (language !== "csharp") return [];
   const sources = [];
@@ -27036,11 +27104,12 @@ function findCSharpRequestSources(sourceCode, language) {
   const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
+  const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
   for (let i2 = 0; i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m) continue;
     const [, varName, rhs] = m;
-    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : null;
+    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
     if (!type) continue;
     const lineNumber = i2 + 1;
     if (sources.some((s) => s.line === lineNumber && s.variable === varName)) continue;
@@ -27872,7 +27941,7 @@ function findBashTaintSources(sourceCode, dfg) {
         });
       }
     }
-    const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})\}/g;
+    const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})(?:[:#%/^,@!*+?=-][^}]*)?\}/g;
     let em;
     while ((em = envRe.exec(line)) !== null) {
       const envVar = em[1] ?? em[2];
@@ -33928,7 +33997,9 @@ var SinkFilterPass = class {
     if (language === "csharp") {
       const sourceLines = ctx.code.split("\n");
       const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
+      const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
+        if (sink.type === "xxe" && xxeHardened) return false;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
         for (const { re, type } of CSHARP_SANITIZER_RES) {
           if (type === sink.type && re.test(sinkLineText)) return false;
@@ -37084,6 +37155,8 @@ function isPublicMethod(method, language) {
   switch (language) {
     case "java":
       return method.modifiers.includes("public");
+    case "csharp":
+      return method.modifiers.includes("public");
     case "javascript":
     case "typescript":
     case "tsx":
@@ -37105,7 +37178,7 @@ var MissingPublicDocPass = class {
     if (UTIL_DIR_RE.test(graph.ir.meta.file)) {
       return { missingDocMethods: [], missingDocTypes: [] };
     }
-    if (!["java", "javascript", "typescript", "tsx", "python"].includes(language)) {
+    if (!["java", "javascript", "typescript", "tsx", "python", "csharp"].includes(language)) {
       return { missingDocMethods: [], missingDocTypes: [] };
     }
     const lines = code.split("\n");
@@ -38101,6 +38174,7 @@ var SKIP_NAMES3 = /* @__PURE__ */ new Set([
   "unknown",
   "bigint"
 ]);
+var EMPTY_LINES = [];
 var UnusedVariablePass = class {
   name = "unused-variable";
   category = "reliability";
@@ -38113,6 +38187,29 @@ var UnusedVariablePass = class {
     const codeLines = code.split("\n");
     const unusedVars = [];
     const reported = /* @__PURE__ */ new Set();
+    const defsByVar = /* @__PURE__ */ new Map();
+    for (const d of graph.ir.dfg.defs) {
+      const arr = defsByVar.get(d.variable);
+      if (arr) arr.push(d);
+      else defsByVar.set(d.variable, [d]);
+    }
+    const nameLines = /* @__PURE__ */ new Map();
+    const idRe = /[A-Za-z_][A-Za-z0-9_]*/g;
+    for (let i2 = 0; i2 < codeLines.length; i2++) {
+      const line = codeLines[i2];
+      idRe.lastIndex = 0;
+      let seen = null;
+      let m;
+      while ((m = idRe.exec(line)) !== null) {
+        const w = m[0];
+        if (seen === null) seen = /* @__PURE__ */ new Set();
+        if (seen.has(w)) continue;
+        seen.add(w);
+        const arr = nameLines.get(w);
+        if (arr) arr.push(i2 + 1);
+        else nameLines.set(w, [i2 + 1]);
+      }
+    }
     for (const def of graph.ir.dfg.defs) {
       if (def.kind !== "local") continue;
       const variable = def.variable;
@@ -38123,22 +38220,19 @@ var UnusedVariablePass = class {
       if (/\bexport\b/.test(lineText)) continue;
       const uses = graph.usesOfDef(def.id);
       if (uses.length > 0) continue;
-      const otherDefs = graph.ir.dfg.defs.filter(
-        (d) => d.variable === variable && d.id !== def.id
-      );
+      const otherDefs = (defsByVar.get(variable) ?? []).filter((d) => d.id !== def.id);
       const otherDefLines = new Set(otherDefs.map((d) => d.line));
-      const escapedName = variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const namePattern = new RegExp(`\\b${escapedName}\\b`);
+      const plainName = /^[A-Za-z_][A-Za-z0-9_]*$/.test(variable);
+      const idxLines = plainName ? nameLines.get(variable) ?? EMPTY_LINES : null;
+      const namePattern = plainName ? null : new RegExp(`\\b${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
       if (otherDefLines.size === 0) {
-        const usedElsewhere = codeLines.some(
-          (line, idx) => idx !== def.line - 1 && namePattern.test(line)
-        );
+        const usedElsewhere = idxLines !== null ? idxLines.some((ln) => ln !== def.line) : codeLines.some((line, idx) => idx !== def.line - 1 && namePattern.test(line));
         if (usedElsewhere) continue;
       } else {
         const lineText2 = codeLines[def.line - 1] ?? "";
         const isTrueDeclaration = /\b(?:let|const|var)\s+[\w{[]/.test(lineText2) || /\b(?:int|long|float|double|boolean|byte|char|short|var|final)\b/.test(lineText2) || /\b[A-Z]\w*(?:<[^>]*>)?\s+\w/.test(lineText2) || /\blet\s+(?:mut\s+)?\w/.test(lineText2);
         if (isTrueDeclaration) {
-          const usedBeforeNextDef = codeLines.some((line, idx) => {
+          const usedBeforeNextDef = idxLines !== null ? idxLines.some((ln) => ln !== def.line && !otherDefLines.has(ln) && !otherDefs.some((d) => d.line > def.line && d.line < ln)) : codeLines.some((line, idx) => {
             const lineNum = idx + 1;
             if (lineNum === def.line || otherDefLines.has(lineNum)) return false;
             if (!namePattern.test(line)) return false;
@@ -38146,7 +38240,7 @@ var UnusedVariablePass = class {
           });
           if (usedBeforeNextDef) continue;
         } else {
-          const usedOnNonDefLine = codeLines.some((line, idx) => {
+          const usedOnNonDefLine = idxLines !== null ? idxLines.some((ln) => ln !== def.line && !otherDefLines.has(ln)) : codeLines.some((line, idx) => {
             const lineNum = idx + 1;
             return lineNum !== def.line && !otherDefLines.has(lineNum) && namePattern.test(line);
           });
@@ -41538,6 +41632,28 @@ var WEAK_HASH_NAMES = /* @__PURE__ */ new Set([
   "sha-1",
   "sha1"
 ]);
+var CSHARP_WEAK_HASH_CLASSES = /* @__PURE__ */ new Set(["MD5", "SHA1"]);
+var CSHARP_HASH_FACTORY_RECEIVERS = /* @__PURE__ */ new Set([
+  "HashAlgorithm",
+  "KeyedHashAlgorithm",
+  "HMAC",
+  "CryptoConfig"
+]);
+var CSHARP_WEAK_HASH_CTORS = {
+  MD5CryptoServiceProvider: "md5",
+  MD5Cng: "md5",
+  SHA1CryptoServiceProvider: "sha1",
+  SHA1Managed: "sha1",
+  SHA1Cng: "sha1",
+  HMACMD5: "md5",
+  HMACSHA1: "sha1"
+};
+function csharpWeakHashAlgo(cleaned) {
+  if (!cleaned) return null;
+  const base = (cleaned.split(".").pop() ?? cleaned).replace(/^hmac/, "");
+  if (base === "sha") return "sha1";
+  return WEAK_HASH_NAMES.has(base) ? base : null;
+}
 var COMMONS_DIGEST_METHODS = /* @__PURE__ */ new Set([
   "md2",
   "md2Hex",
@@ -41697,6 +41813,19 @@ var WeakHashPass = class {
       }
       return null;
     }
+    if (language === "csharp") {
+      if ((method === "Create" || method === "HashData") && CSHARP_WEAK_HASH_CLASSES.has(receiver)) {
+        return { algorithm: receiver.toLowerCase(), api: `${receiver}.${method}` };
+      }
+      if ((method === "Create" || method === "CreateFromName") && CSHARP_HASH_FACTORY_RECEIVERS.has(receiver)) {
+        const algo = csharpWeakHashAlgo(literalAlgo(call, 0));
+        if (algo) return { algorithm: algo, api: `${receiver}.${method}` };
+      }
+      if (call.is_constructor && CSHARP_WEAK_HASH_CTORS[method]) {
+        return { algorithm: CSHARP_WEAK_HASH_CTORS[method], api: `new ${method}()` };
+      }
+      return null;
+    }
     return null;
   }
 };
@@ -41758,6 +41887,27 @@ var WEAK_CIPHER_BASES = /* @__PURE__ */ new Set([
   "seed",
   "cast5"
 ]);
+var CSHARP_WEAK_CIPHER_CLASSES = /* @__PURE__ */ new Set(["DES", "TripleDES", "RC2", "RC4"]);
+var CSHARP_CIPHER_FACTORY_RECEIVERS = /* @__PURE__ */ new Set(["SymmetricAlgorithm", "CryptoConfig"]);
+var CSHARP_WEAK_CIPHER_CTORS = {
+  DESCryptoServiceProvider: "des",
+  TripleDESCryptoServiceProvider: "3des",
+  RC2CryptoServiceProvider: "rc2"
+};
+var CSHARP_RSA_FACTORY_CLASSES = /* @__PURE__ */ new Set(["RSA", "DSA"]);
+var CSHARP_RSA_CTORS = /* @__PURE__ */ new Set([
+  "RSACryptoServiceProvider",
+  "DSACryptoServiceProvider",
+  "RSACng",
+  "DSACng"
+]);
+function csharpWeakCipher(cleaned) {
+  if (!cleaned) return null;
+  const base = (cleaned.split(".").pop() ?? cleaned).toLowerCase();
+  if (base === "tripledes" || base === "desede") return "3des";
+  if (base === "arc4") return "rc4";
+  return WEAK_CIPHER_BASES.has(base) ? base : null;
+}
 function classifyJavaCipherSpec(spec) {
   const parts2 = spec.split("/").map((p) => p.trim().toLowerCase());
   const base = parts2[0] ?? "";
@@ -42149,6 +42299,34 @@ var WeakCryptoPass = class {
       }
       return out2;
     }
+    if (language === "csharp") {
+      if (method === "Create" && CSHARP_WEAK_CIPHER_CLASSES.has(receiver)) {
+        const base = receiver === "TripleDES" ? "3des" : receiver.toLowerCase();
+        out2.push({ issue: "weak-cipher", detail: base, api: `${receiver}.Create` });
+      }
+      if ((method === "Create" || method === "CreateFromName") && CSHARP_CIPHER_FACTORY_RECEIVERS.has(receiver)) {
+        const base = csharpWeakCipher(literalAlgo2(call, 0));
+        if (base) out2.push({ issue: "weak-cipher", detail: base, api: `${receiver}.${method}` });
+      }
+      if (call.is_constructor && CSHARP_WEAK_CIPHER_CTORS[method]) {
+        out2.push({ issue: "weak-cipher", detail: CSHARP_WEAK_CIPHER_CTORS[method], api: `new ${method}()` });
+      }
+      const rsaFactory = method === "Create" && CSHARP_RSA_FACTORY_CLASSES.has(receiver);
+      const rsaCtor = call.is_constructor && CSHARP_RSA_CTORS.has(method);
+      if (rsaFactory || rsaCtor) {
+        const sizeArg = call.arguments.find((a) => a.position === 0);
+        const expr = (sizeArg?.literal ?? sizeArg?.expression ?? "").trim();
+        const n = parseInt(expr, 10);
+        if (Number.isFinite(n) && n > 0 && n < 2048) {
+          out2.push({
+            issue: "weak-rsa-key",
+            detail: String(n),
+            api: rsaCtor ? `new ${method}()` : `${receiver}.Create`
+          });
+        }
+      }
+      return out2;
+    }
     return out2;
   }
 };
@@ -42832,8 +43010,7 @@ var InfoDisclosureStacktracePass = class {
 // src/analysis/passes/unrestricted-file-upload-pass.ts
 var UPLOAD_NAME_RE = /(?:getOriginalFilename|getSubmittedFileName|originalname|originalName|\.filename|\.Filename|FileHeader\.Filename|UploadFile)/;
 var FILE_SAFE_CALL_RE = /(?:secure_filename|FilenameUtils\.getExtension|\.lastIndexOf\(['"]\.['"]\)|ALLOWED_EXT|ALLOWED_EXTENSIONS|allowedExtensions|\bfileFilter\b|filepath\.Ext|path\.extname)/;
-function lineWindow(code, startLine, endLine) {
-  const lines = code.split("\n");
+function lineWindow(lines, startLine, endLine) {
   const s = Math.max(0, startLine - 1);
   const e = Math.min(lines.length, endLine);
   return lines.slice(s, e).join("\n");
@@ -42853,10 +43030,11 @@ var UnrestrictedFileUploadPass = class {
     const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
     const findings = [];
+    const codeLines = code.split("\n");
     const safeFunctionRanges = [];
     for (const t of graph.ir.types) {
       for (const m of t.methods) {
-        const body2 = lineWindow(code, m.start_line, m.end_line);
+        const body2 = lineWindow(codeLines, m.start_line, m.end_line);
         if (FILE_SAFE_CALL_RE.test(body2)) {
           safeFunctionRanges.push({ start: m.start_line, end: m.end_line });
         }
@@ -42866,7 +43044,7 @@ var UnrestrictedFileUploadPass = class {
       for (const r of safeFunctionRanges) {
         if (line >= r.start && line <= r.end) return true;
       }
-      const win = lineWindow(code, Math.max(1, line - 20), line + 5);
+      const win = lineWindow(codeLines, Math.max(1, line - 20), line + 5);
       return FILE_SAFE_CALL_RE.test(win);
     };
     if (language === "java") {

package/dist/core/circle-ir-core.cjs

@@ -9964,15 +9964,15 @@ function computeChains(defs, uses) {
     existing.push(use);
     usesByLine.set(use.line, existing);
   }
+  const seenChains = /* @__PURE__ */ new Set();
   for (const def of defs) {
     if (def.kind === "local") {
       const usesOnLine = usesByLine.get(def.line) ?? [];
       for (const use of usesOnLine) {
         if (use.def_id !== null && use.def_id !== def.id) {
-          const exists = chains.some(
-            (c) => c.from_def === use.def_id && c.to_def === def.id && c.via === use.variable
-          );
-          if (!exists) {
+          const key = `${use.def_id}\0${def.id}\0${use.variable}`;
+          if (!seenChains.has(key)) {
+            seenChains.add(key);
             chains.push({
               from_def: use.def_id,
               to_def: def.id,
@@ -11896,8 +11896,11 @@ var DEFAULT_SINKS = [
   // SAX handler sinks (can lead to XSS in parsed content)
   { method: "startElement", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
   { method: "characters", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  // Template output sinks
-  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
+  // Template output sinks. `output` is classless (Java template engines /
+  // Velocity), but Rust `std::process::Command::…output()` is process
+  // execution, not HTML — it already fires the CWE-78 command_injection sink,
+  // so exclude Rust here to drop the spurious xss (cognium-dev#146).
+  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], exclude_languages: ["rust"] },
   { method: "setOutput", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "writeAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
   // AntiSamy specific (SAX filters)
@@ -13188,7 +13191,10 @@ var DEFAULT_SINKS = [
   { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# command injection — Process.Start / ProcessStartInfo (CWE-78).
-  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // Both the single-string overload `Process.Start("sh -c " + x)` and the
+  // `(fileName, arguments)` overload `Process.Start("/bin/sh", "-c " + x)` are
+  // injectable — the second is the argv path where taint rides arg[1] (#276).
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   // C# path traversal — System.IO file APIs (CWE-22). Distinctive method names.
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13229,6 +13235,22 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
+  // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
+  // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
+  // `TypedResults.Redirect(url)` also route through the same method name. Taint-
+  // gated, so a constant URL never fires. `LocalRedirect` is deliberately NOT
+  // registered — it rejects non-local URLs and is the documented mitigation.
+  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  { method: "RedirectPermanent", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  // C# CRLF / HTTP response-header injection — classic ASP.NET header writers
+  // (CWE-113, cognium-dev#273/#275). The injectable value is the second arg.
+  { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  // C# NoSQL injection — MongoDB filter built from raw JSON (CWE-943,
+  // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
+  // attacker-controlled query document. Class-scoped (static receiver resolves).
+  { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },

package/dist/core/circle-ir-core.js

@@ -9898,15 +9898,15 @@ function computeChains(defs, uses) {
     existing.push(use);
     usesByLine.set(use.line, existing);
   }
+  const seenChains = /* @__PURE__ */ new Set();
   for (const def of defs) {
     if (def.kind === "local") {
       const usesOnLine = usesByLine.get(def.line) ?? [];
       for (const use of usesOnLine) {
         if (use.def_id !== null && use.def_id !== def.id) {
-          const exists = chains.some(
-            (c) => c.from_def === use.def_id && c.to_def === def.id && c.via === use.variable
-          );
-          if (!exists) {
+          const key = `${use.def_id}\0${def.id}\0${use.variable}`;
+          if (!seenChains.has(key)) {
+            seenChains.add(key);
             chains.push({
               from_def: use.def_id,
               to_def: def.id,
@@ -11830,8 +11830,11 @@ var DEFAULT_SINKS = [
   // SAX handler sinks (can lead to XSS in parsed content)
   { method: "startElement", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
   { method: "characters", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  // Template output sinks
-  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
+  // Template output sinks. `output` is classless (Java template engines /
+  // Velocity), but Rust `std::process::Command::…output()` is process
+  // execution, not HTML — it already fires the CWE-78 command_injection sink,
+  // so exclude Rust here to drop the spurious xss (cognium-dev#146).
+  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], exclude_languages: ["rust"] },
   { method: "setOutput", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "writeAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
   // AntiSamy specific (SAX filters)
@@ -13122,7 +13125,10 @@ var DEFAULT_SINKS = [
   { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# command injection — Process.Start / ProcessStartInfo (CWE-78).
-  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // Both the single-string overload `Process.Start("sh -c " + x)` and the
+  // `(fileName, arguments)` overload `Process.Start("/bin/sh", "-c " + x)` are
+  // injectable — the second is the argv path where taint rides arg[1] (#276).
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   // C# path traversal — System.IO file APIs (CWE-22). Distinctive method names.
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13163,6 +13169,22 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
+  // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
+  // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
+  // `TypedResults.Redirect(url)` also route through the same method name. Taint-
+  // gated, so a constant URL never fires. `LocalRedirect` is deliberately NOT
+  // registered — it rejects non-local URLs and is the documented mitigation.
+  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  { method: "RedirectPermanent", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  // C# CRLF / HTTP response-header injection — classic ASP.NET header writers
+  // (CWE-113, cognium-dev#273/#275). The injectable value is the second arg.
+  { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  // C# NoSQL injection — MongoDB filter built from raw JSON (CWE-943,
+  // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
+  // attacker-controlled query document. Class-scoped (static receiver resolves).
+  { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },

package/dist/core/extractors/dfg.js

@@ -1014,15 +1014,18 @@ function computeChains(defs, uses) {
     }
     // For each definition, find uses on the same line that might be in its initializer
     // This is a heuristic - more precise would require tracking def-use relationships in AST
+    // Dedup via a Set keyed on (from_def, to_def, via) — an `Array.some` scan per
+    // insertion was O(chains²) on large files (cognium-ai#305).
+    const seenChains = new Set();
     for (const def of defs) {
         if (def.kind === 'local') {
             const usesOnLine = usesByLine.get(def.line) ?? [];
             for (const use of usesOnLine) {
                 // If this use has a reaching def, create a chain
                 if (use.def_id !== null && use.def_id !== def.id) {
-                    // Avoid duplicate chains
-                    const exists = chains.some(c => c.from_def === use.def_id && c.to_def === def.id && c.via === use.variable);
-                    if (!exists) {
+                    const key = `${use.def_id}${def.id}${use.variable}`;
+                    if (!seenChains.has(key)) {
+                        seenChains.add(key);
                         chains.push({
                             from_def: use.def_id,
                             to_def: def.id,