circle-ir 4.7.0 → 4.7.2

package/dist/browser/circle-ir.js

@@ -9918,15 +9918,15 @@ function computeChains(defs, uses) {
     existing.push(use);
     usesByLine.set(use.line, existing);
   }
+  const seenChains = /* @__PURE__ */ new Set();
   for (const def of defs) {
     if (def.kind === "local") {
       const usesOnLine = usesByLine.get(def.line) ?? [];
       for (const use of usesOnLine) {
         if (use.def_id !== null && use.def_id !== def.id) {
-          const exists = chains.some(
-            (c) => c.from_def === use.def_id && c.to_def === def.id && c.via === use.variable
-          );
-          if (!exists) {
+          const key = `${use.def_id}\0${def.id}\0${use.variable}`;
+          if (!seenChains.has(key)) {
+            seenChains.add(key);
             chains.push({
               from_def: use.def_id,
               to_def: def.id,
@@ -12258,7 +12258,11 @@ var DEFAULT_SINKS = [
   // File: covers both File(String pathname) and File(parent, child). The 2-arg
   // overload's child argument carries CVE-2018-8041 (Camel mail Content-Disposition
   // filename written to disk).
-  { method: "File", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
+  // Java `new File(path)` idiom. Excluded for C#: there is no `new File()` in
+  // .NET (it's `System.IO.File` statics + `FileStream`, covered separately), and
+  // this over-matched ASP.NET `ControllerBase.File(stream|bytes, contentType)` —
+  // a result helper that returns a file, not a path sink (cognium-ai#326 B).
+  { method: "File", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], exclude_languages: ["csharp"] },
   { method: "FileInputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileOutputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileReader", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -12501,8 +12505,11 @@ var DEFAULT_SINKS = [
   // SAX handler sinks (can lead to XSS in parsed content)
   { method: "startElement", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
   { method: "characters", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  // Template output sinks
-  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
+  // Template output sinks. `output` is classless (Java template engines /
+  // Velocity), but Rust `std::process::Command::…output()` is process
+  // execution, not HTML — it already fires the CWE-78 command_injection sink,
+  // so exclude Rust here to drop the spurious xss (cognium-dev#146).
+  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], exclude_languages: ["rust"] },
   { method: "setOutput", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "writeAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
   // AntiSamy specific (SAX filters)
@@ -13810,6 +13817,22 @@ var DEFAULT_SINKS = [
   { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // Remaining System.IO.File path APIs — class-scoped so they don't collide
+  // with unrelated methods. Copy/Move take a source AND destination path (both
+  // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
+  { method: "Copy", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Move", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Delete", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Open", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "OpenText", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Create", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "AppendAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // System.IO.Directory path APIs.
+  { method: "CreateDirectory", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Delete", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetFiles", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "EnumerateFiles", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# SSRF — HttpClient / WebClient / WebRequest (CWE-918).
   { method: "GetAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "PostAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13826,9 +13849,24 @@ var DEFAULT_SINKS = [
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
-  // C# insecure deserialization — BinaryFormatter et al. (CWE-502).
+  // Loading an assembly from an attacker-controlled name/path is arbitrary code
+  // execution. Class-scoped to `Assembly` (low FP — a tainted arg here is rare
+  // in benign code). `Type.GetType`/`Activator.CreateInstance` are intentionally
+  // NOT added — reflection with config-driven type names is common in DI, an FP
+  // trap without the reflection-suppress machinery.
+  { method: "Load", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "LoadFrom", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "LoadFile", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // C# insecure deserialization — the polymorphic BCL formatters that can
+  // instantiate arbitrary types named in the payload (CWE-502, cognium-ai#318).
+  // Each of these classes exists only to deserialize and is unsafe on untrusted
+  // input; class-scoped, so no collision with safe JSON APIs (System.Text.Json /
+  // Newtonsoft-default, which are intentionally NOT sinks).
   { method: "Deserialize", class: "BinaryFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Deserialize", class: "NetDataContractSerializer", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "SoapFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "LosFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "ObjectStateFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# XSS — raw HTML output (CWE-79).
   { method: "Raw", class: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13853,6 +13891,20 @@ var DEFAULT_SINKS = [
   // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
   // attacker-controlled query document. Class-scoped (static receiver resolves).
   { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# log injection — Microsoft.Extensions.Logging `ILogger` (CWE-117,
+  // cognium-ai#318). Only the message TEMPLATE (arg[0]) is the injectable
+  // position; the structured form `LogInformation("… {Id}", id)` keeps taint in
+  // later args (the logger renders them as data), so arg_positions:[0] does not
+  // flag it. Mirrors the Java `Logger` sinks; severity low.
+  { method: "LogInformation", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogWarning", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogError", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogDebug", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogCritical", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogTrace", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  // Generic `ILogger.Log(logLevel, message, …)` — class-scoped (`Log` alone is
+  // too generic); the message is arg[1].
+  { method: "Log", class: "ILogger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1], languages: ["csharp"] },
   // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13861,6 +13913,11 @@ var DEFAULT_SINKS = [
   { method: "LoadXml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "XmlDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "XDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // `new XmlTextReader(input)` — its DtdProcessing defaults to Parse (resolves
+  // external entities), unlike `XmlReader.Create` (Prohibit). CWE-611,
+  // cognium-ai#318. The 4.7.0 XmlResolver=null / DtdProcessing=Prohibit
+  // hardening still suppresses the safe shape.
+  { method: "XmlTextReader", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // Python SQLi — asyncpg Connection.*
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -15273,6 +15330,34 @@ function isSafeJSChildProcessCall(call, pattern, language) {
   if (SHELL_PROGRAMS.has(program)) return false;
   return true;
 }
+function isSafeCSharpProcessStartCall(call, pattern, language) {
+  if (language !== "csharp") return false;
+  if (pattern.type !== "command_injection") return false;
+  if (call.method_name !== "Start") return false;
+  if (call.arguments.length < 2) return false;
+  const fileArg = call.arguments.find((a) => a.position === 0);
+  if (!fileArg) return false;
+  let raw;
+  if (fileArg.literal !== null && fileArg.literal !== void 0) {
+    raw = String(fileArg.literal).trim();
+  } else {
+    raw = (fileArg.expression ?? "").trim();
+  }
+  if (!/^@?"[^"]*"$/.test(raw)) return false;
+  const program = (raw.replace(/^@?"|"$/g, "").split(/[\\/]/).pop() ?? "").toLowerCase().replace(/\.exe$/, "");
+  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ash",
+    "ksh",
+    "cmd",
+    "powershell",
+    "pwsh"
+  ]);
+  return !SHELL_PROGRAMS.has(program);
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
@@ -15528,6 +15613,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeJSChildProcessCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeCSharpProcessStartCall(call, pattern, language)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }
@@ -16758,8 +16846,8 @@ function canSourceReachSink(sourceType, sinkType) {
     network_input: ["sql_injection", "command_injection", "xss", "ssrf", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     config_param: ["sql_injection", "command_injection", "path_traversal", "xss", "ssrf", "log_injection", "format_string"],
     // Servlet init params
-    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
-    // Cross-method taint; Sprint 82 (#189) — open_redirect added; Sprint 91 (#117) — trust_boundary added; cognium-ai#129 — log_injection/format_string/nosql_injection added; cognium-ai#281 — prompt_injection added
+    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection", "xxe", "deserialization"],
+    // Cross-method taint; Sprint 82 (#189) — open_redirect added; Sprint 91 (#117) — trust_boundary added; cognium-ai#129 — log_injection/format_string/nosql_injection added; cognium-ai#281 — prompt_injection added; cognium-ai#317 — xxe/deserialization added (C# xxe/deser sinks are reached via param-seeded sources and were silently dropped, 0% finding conversion)
     plugin_param: ["sql_injection", "command_injection", "path_traversal", "xss", "code_injection", "log_injection", "format_string"]
     // Plugin/config parameters
   };
@@ -18581,6 +18669,26 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
     "Command",
     "CommandContext"
   ]);
+  const ormQueryBuilderMethods = /* @__PURE__ */ new Set([
+    "findMany",
+    "findFirst",
+    "findUnique",
+    "findUniqueOrThrow",
+    "findFirstOrThrow",
+    "findOne",
+    "findAll",
+    "findByPk",
+    "findAndCountAll",
+    "findBy",
+    "findOneBy",
+    "where",
+    "andWhere",
+    "orWhere",
+    "whereIn",
+    "whereNot",
+    "first",
+    "bind"
+  ]);
   const sanitizerMethods = /* @__PURE__ */ new Set();
   for (const san of sanitizers) {
     sanitizerMethods.add(san.method);
@@ -18605,7 +18713,7 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
     }
     const targetMethod = getMethodNode(methodNodes, call.method_name);
     if (!targetMethod) {
-      if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name)) {
+      if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name) && !ormQueryBuilderMethods.has(call.method_name)) {
         const isBash = graph.ir.meta.language === "bash";
         const bashSafeBuiltins = /* @__PURE__ */ new Set([
           "echo",
@@ -26394,6 +26502,7 @@ var LanguageSourcesPass = class {
     additionalSources.push(...findSetterChainSources(types, code, language));
     additionalSources.push(...findJavaScriptAssignmentSources(code, language));
     additionalSources.push(...findCSharpRequestSources(code, language));
+    additionalSources.push(...findGoArgvSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -27048,6 +27157,31 @@ function findSetterChainSources(types, sourceCode, language) {
   }
   return sources;
 }
+function findGoArgvSources(sourceCode, language) {
+  if (language !== "go") return [];
+  const sources = [];
+  const lines = sourceCode.split("\n");
+  const rangeRe = /\bfor\b[^;{]*?,\s*([A-Za-z_]\w*)\s*:?=\s*range\s+os\.Args\b/;
+  const assignRe = /\b([A-Za-z_]\w*)\s*:?=\s*os\.Args\b/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const rm = rangeRe.exec(line);
+    const m = rm ?? assignRe.exec(line);
+    if (!m) continue;
+    const varName = m[1];
+    const lineNumber = i2 + 1;
+    if (sources.some((s) => s.line === lineNumber && s.variable === varName)) continue;
+    sources.push({
+      type: "io_input",
+      location: `${varName} = os.Args`,
+      severity: "high",
+      line: lineNumber,
+      confidence: 1,
+      variable: varName
+    });
+  }
+  return sources;
+}
 function findCSharpRequestSources(sourceCode, language) {
   if (language !== "csharp") return [];
   const sources = [];
@@ -27715,8 +27849,9 @@ function buildJavaTaintedVars(sourceCode, seedVars) {
       if (JAVA_KEYWORDS.has(lhs)) continue;
       if (knownTainted.has(lhs)) continue;
       const escaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const rhsCode = rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
       const ref = [...knownTainted].some(
-        (v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhs)
+        (v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhsCode)
       );
       if (ref) {
         derived.set(lhs, i2 + 1);
@@ -27892,7 +28027,7 @@ function findBashTaintSources(sourceCode, dfg) {
         });
       }
     }
-    const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})\}/g;
+    const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})(?:[:#%/^,@!*+?=-][^}]*)?\}/g;
     let em;
     while ((em = envRe.exec(line)) !== null) {
       const envVar = em[1] ?? em[2];
@@ -38125,6 +38260,7 @@ var SKIP_NAMES3 = /* @__PURE__ */ new Set([
   "unknown",
   "bigint"
 ]);
+var EMPTY_LINES = [];
 var UnusedVariablePass = class {
   name = "unused-variable";
   category = "reliability";
@@ -38137,6 +38273,29 @@ var UnusedVariablePass = class {
     const codeLines = code.split("\n");
     const unusedVars = [];
     const reported = /* @__PURE__ */ new Set();
+    const defsByVar = /* @__PURE__ */ new Map();
+    for (const d of graph.ir.dfg.defs) {
+      const arr = defsByVar.get(d.variable);
+      if (arr) arr.push(d);
+      else defsByVar.set(d.variable, [d]);
+    }
+    const nameLines = /* @__PURE__ */ new Map();
+    const idRe = /[A-Za-z_][A-Za-z0-9_]*/g;
+    for (let i2 = 0; i2 < codeLines.length; i2++) {
+      const line = codeLines[i2];
+      idRe.lastIndex = 0;
+      let seen = null;
+      let m;
+      while ((m = idRe.exec(line)) !== null) {
+        const w = m[0];
+        if (seen === null) seen = /* @__PURE__ */ new Set();
+        if (seen.has(w)) continue;
+        seen.add(w);
+        const arr = nameLines.get(w);
+        if (arr) arr.push(i2 + 1);
+        else nameLines.set(w, [i2 + 1]);
+      }
+    }
     for (const def of graph.ir.dfg.defs) {
       if (def.kind !== "local") continue;
       const variable = def.variable;
@@ -38147,22 +38306,19 @@ var UnusedVariablePass = class {
       if (/\bexport\b/.test(lineText)) continue;
       const uses = graph.usesOfDef(def.id);
       if (uses.length > 0) continue;
-      const otherDefs = graph.ir.dfg.defs.filter(
-        (d) => d.variable === variable && d.id !== def.id
-      );
+      const otherDefs = (defsByVar.get(variable) ?? []).filter((d) => d.id !== def.id);
       const otherDefLines = new Set(otherDefs.map((d) => d.line));
-      const escapedName = variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const namePattern = new RegExp(`\\b${escapedName}\\b`);
+      const plainName = /^[A-Za-z_][A-Za-z0-9_]*$/.test(variable);
+      const idxLines = plainName ? nameLines.get(variable) ?? EMPTY_LINES : null;
+      const namePattern = plainName ? null : new RegExp(`\\b${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
       if (otherDefLines.size === 0) {
-        const usedElsewhere = codeLines.some(
-          (line, idx) => idx !== def.line - 1 && namePattern.test(line)
-        );
+        const usedElsewhere = idxLines !== null ? idxLines.some((ln) => ln !== def.line) : codeLines.some((line, idx) => idx !== def.line - 1 && namePattern.test(line));
         if (usedElsewhere) continue;
       } else {
         const lineText2 = codeLines[def.line - 1] ?? "";
         const isTrueDeclaration = /\b(?:let|const|var)\s+[\w{[]/.test(lineText2) || /\b(?:int|long|float|double|boolean|byte|char|short|var|final)\b/.test(lineText2) || /\b[A-Z]\w*(?:<[^>]*>)?\s+\w/.test(lineText2) || /\blet\s+(?:mut\s+)?\w/.test(lineText2);
         if (isTrueDeclaration) {
-          const usedBeforeNextDef = codeLines.some((line, idx) => {
+          const usedBeforeNextDef = idxLines !== null ? idxLines.some((ln) => ln !== def.line && !otherDefLines.has(ln) && !otherDefs.some((d) => d.line > def.line && d.line < ln)) : codeLines.some((line, idx) => {
             const lineNum = idx + 1;
             if (lineNum === def.line || otherDefLines.has(lineNum)) return false;
             if (!namePattern.test(line)) return false;
@@ -38170,7 +38326,7 @@ var UnusedVariablePass = class {
           });
           if (usedBeforeNextDef) continue;
         } else {
-          const usedOnNonDefLine = codeLines.some((line, idx) => {
+          const usedOnNonDefLine = idxLines !== null ? idxLines.some((ln) => ln !== def.line && !otherDefLines.has(ln)) : codeLines.some((line, idx) => {
             const lineNum = idx + 1;
             return lineNum !== def.line && !otherDefLines.has(lineNum) && namePattern.test(line);
           });
@@ -40720,6 +40876,8 @@ function isLikelyCredentialAssignment(line) {
   if (CRED_DYNAMIC_VALUE_RE.test(value)) return null;
   if (value.length < 3) return null;
   if (isAllSameChar(value)) return null;
+  if (value.toLowerCase() === name2.toLowerCase()) return null;
+  if (/^(?:https?:\/\/|urn:|xmlns)/i.test(value)) return null;
   if (value.length < 12) return null;
   if (shannonEntropy(value) < 3.5) return null;
   if (charClassDiversity(value) < 2) return null;
@@ -42940,8 +43098,7 @@ var InfoDisclosureStacktracePass = class {
 // src/analysis/passes/unrestricted-file-upload-pass.ts
 var UPLOAD_NAME_RE = /(?:getOriginalFilename|getSubmittedFileName|originalname|originalName|\.filename|\.Filename|FileHeader\.Filename|UploadFile)/;
 var FILE_SAFE_CALL_RE = /(?:secure_filename|FilenameUtils\.getExtension|\.lastIndexOf\(['"]\.['"]\)|ALLOWED_EXT|ALLOWED_EXTENSIONS|allowedExtensions|\bfileFilter\b|filepath\.Ext|path\.extname)/;
-function lineWindow(code, startLine, endLine) {
-  const lines = code.split("\n");
+function lineWindow(lines, startLine, endLine) {
   const s = Math.max(0, startLine - 1);
   const e = Math.min(lines.length, endLine);
   return lines.slice(s, e).join("\n");
@@ -42961,10 +43118,11 @@ var UnrestrictedFileUploadPass = class {
     const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
     const findings = [];
+    const codeLines = code.split("\n");
     const safeFunctionRanges = [];
     for (const t of graph.ir.types) {
       for (const m of t.methods) {
-        const body2 = lineWindow(code, m.start_line, m.end_line);
+        const body2 = lineWindow(codeLines, m.start_line, m.end_line);
         if (FILE_SAFE_CALL_RE.test(body2)) {
           safeFunctionRanges.push({ start: m.start_line, end: m.end_line });
         }
@@ -42974,7 +43132,7 @@ var UnrestrictedFileUploadPass = class {
       for (const r of safeFunctionRanges) {
         if (line >= r.start && line <= r.end) return true;
       }
-      const win = lineWindow(code, Math.max(1, line - 20), line + 5);
+      const win = lineWindow(codeLines, Math.max(1, line - 20), line + 5);
       return FILE_SAFE_CALL_RE.test(win);
     };
     if (language === "java") {

package/dist/core/circle-ir-core.cjs

@@ -9964,15 +9964,15 @@ function computeChains(defs, uses) {
     existing.push(use);
     usesByLine.set(use.line, existing);
   }
+  const seenChains = /* @__PURE__ */ new Set();
   for (const def of defs) {
     if (def.kind === "local") {
       const usesOnLine = usesByLine.get(def.line) ?? [];
       for (const use of usesOnLine) {
         if (use.def_id !== null && use.def_id !== def.id) {
-          const exists = chains.some(
-            (c) => c.from_def === use.def_id && c.to_def === def.id && c.via === use.variable
-          );
-          if (!exists) {
+          const key = `${use.def_id}\0${def.id}\0${use.variable}`;
+          if (!seenChains.has(key)) {
+            seenChains.add(key);
             chains.push({
               from_def: use.def_id,
               to_def: def.id,
@@ -11653,7 +11653,11 @@ var DEFAULT_SINKS = [
   // File: covers both File(String pathname) and File(parent, child). The 2-arg
   // overload's child argument carries CVE-2018-8041 (Camel mail Content-Disposition
   // filename written to disk).
-  { method: "File", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
+  // Java `new File(path)` idiom. Excluded for C#: there is no `new File()` in
+  // .NET (it's `System.IO.File` statics + `FileStream`, covered separately), and
+  // this over-matched ASP.NET `ControllerBase.File(stream|bytes, contentType)` —
+  // a result helper that returns a file, not a path sink (cognium-ai#326 B).
+  { method: "File", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], exclude_languages: ["csharp"] },
   { method: "FileInputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileOutputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileReader", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -11896,8 +11900,11 @@ var DEFAULT_SINKS = [
   // SAX handler sinks (can lead to XSS in parsed content)
   { method: "startElement", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
   { method: "characters", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  // Template output sinks
-  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
+  // Template output sinks. `output` is classless (Java template engines /
+  // Velocity), but Rust `std::process::Command::…output()` is process
+  // execution, not HTML — it already fires the CWE-78 command_injection sink,
+  // so exclude Rust here to drop the spurious xss (cognium-dev#146).
+  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], exclude_languages: ["rust"] },
   { method: "setOutput", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "writeAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
   // AntiSamy specific (SAX filters)
@@ -13205,6 +13212,22 @@ var DEFAULT_SINKS = [
   { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // Remaining System.IO.File path APIs — class-scoped so they don't collide
+  // with unrelated methods. Copy/Move take a source AND destination path (both
+  // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
+  { method: "Copy", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Move", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Delete", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Open", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "OpenText", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Create", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "AppendAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // System.IO.Directory path APIs.
+  { method: "CreateDirectory", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Delete", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetFiles", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "EnumerateFiles", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# SSRF — HttpClient / WebClient / WebRequest (CWE-918).
   { method: "GetAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "PostAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13221,9 +13244,24 @@ var DEFAULT_SINKS = [
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
-  // C# insecure deserialization — BinaryFormatter et al. (CWE-502).
+  // Loading an assembly from an attacker-controlled name/path is arbitrary code
+  // execution. Class-scoped to `Assembly` (low FP — a tainted arg here is rare
+  // in benign code). `Type.GetType`/`Activator.CreateInstance` are intentionally
+  // NOT added — reflection with config-driven type names is common in DI, an FP
+  // trap without the reflection-suppress machinery.
+  { method: "Load", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "LoadFrom", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "LoadFile", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // C# insecure deserialization — the polymorphic BCL formatters that can
+  // instantiate arbitrary types named in the payload (CWE-502, cognium-ai#318).
+  // Each of these classes exists only to deserialize and is unsafe on untrusted
+  // input; class-scoped, so no collision with safe JSON APIs (System.Text.Json /
+  // Newtonsoft-default, which are intentionally NOT sinks).
   { method: "Deserialize", class: "BinaryFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Deserialize", class: "NetDataContractSerializer", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "SoapFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "LosFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "ObjectStateFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# XSS — raw HTML output (CWE-79).
   { method: "Raw", class: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13248,6 +13286,20 @@ var DEFAULT_SINKS = [
   // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
   // attacker-controlled query document. Class-scoped (static receiver resolves).
   { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# log injection — Microsoft.Extensions.Logging `ILogger` (CWE-117,
+  // cognium-ai#318). Only the message TEMPLATE (arg[0]) is the injectable
+  // position; the structured form `LogInformation("… {Id}", id)` keeps taint in
+  // later args (the logger renders them as data), so arg_positions:[0] does not
+  // flag it. Mirrors the Java `Logger` sinks; severity low.
+  { method: "LogInformation", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogWarning", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogError", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogDebug", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogCritical", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogTrace", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  // Generic `ILogger.Log(logLevel, message, …)` — class-scoped (`Log` alone is
+  // too generic); the message is arg[1].
+  { method: "Log", class: "ILogger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1], languages: ["csharp"] },
   // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13256,6 +13308,11 @@ var DEFAULT_SINKS = [
   { method: "LoadXml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "XmlDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "XDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // `new XmlTextReader(input)` — its DtdProcessing defaults to Parse (resolves
+  // external entities), unlike `XmlReader.Create` (Prohibit). CWE-611,
+  // cognium-ai#318. The 4.7.0 XmlResolver=null / DtdProcessing=Prohibit
+  // hardening still suppresses the safe shape.
+  { method: "XmlTextReader", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // Python SQLi — asyncpg Connection.*
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -14573,6 +14630,34 @@ function isSafeJSChildProcessCall(call, pattern, language) {
   if (SHELL_PROGRAMS.has(program)) return false;
   return true;
 }
+function isSafeCSharpProcessStartCall(call, pattern, language) {
+  if (language !== "csharp") return false;
+  if (pattern.type !== "command_injection") return false;
+  if (call.method_name !== "Start") return false;
+  if (call.arguments.length < 2) return false;
+  const fileArg = call.arguments.find((a) => a.position === 0);
+  if (!fileArg) return false;
+  let raw;
+  if (fileArg.literal !== null && fileArg.literal !== void 0) {
+    raw = String(fileArg.literal).trim();
+  } else {
+    raw = (fileArg.expression ?? "").trim();
+  }
+  if (!/^@?"[^"]*"$/.test(raw)) return false;
+  const program = (raw.replace(/^@?"|"$/g, "").split(/[\\/]/).pop() ?? "").toLowerCase().replace(/\.exe$/, "");
+  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ash",
+    "ksh",
+    "cmd",
+    "powershell",
+    "pwsh"
+  ]);
+  return !SHELL_PROGRAMS.has(program);
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
@@ -14828,6 +14913,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeJSChildProcessCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeCSharpProcessStartCall(call, pattern, language)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }