circle-ir 4.7.1 → 4.8.2

package/dist/core/circle-ir-core.js

@@ -5980,13 +5980,21 @@ function extractCSharpCalls(tree, cache) {
     const left = asn.childForFieldName("left");
     if (left?.type !== "member_access_expression") continue;
     const nameNode = left.childForFieldName("name");
-    if (!nameNode || getNodeText(nameNode) !== "CommandText") continue;
+    if (!nameNode) continue;
+    const propName = getNodeText(nameNode);
+    const exprNode = left.childForFieldName("expression");
+    if (propName === "Filter") {
+      const recv = exprNode ? getNodeText(exprNode) : null;
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (recvType !== "DirectorySearcher") continue;
+    } else if (propName !== "CommandText") {
+      continue;
+    }
     const right = asn.childForFieldName("right");
     if (!right) continue;
     const rhsText = getNodeText(right);
-    const exprNode = left.childForFieldName("expression");
     calls.push({
-      method_name: "CommandText",
+      method_name: propName,
       receiver: exprNode ? getNodeText(exprNode) : null,
       receiver_type: null,
       receiver_type_fqn: null,
@@ -8552,6 +8560,9 @@ function buildCFG(tree, language, cache) {
   if (effectiveLanguage === "go") {
     return buildGoCFG(tree, blockIdCounter, cache);
   }
+  if (effectiveLanguage === "csharp") {
+    return buildCSharpCFG(tree, blockIdCounter, cache);
+  }
   if (isJavaScript) {
     const functions = [
       ...getNodesFromCache(tree.rootNode, "function_declaration", cache),
@@ -8564,7 +8575,7 @@ function buildCFG(tree, language, cache) {
       const body2 = func2.childForFieldName("body");
       if (!body2) continue;
       if (body2.type === "statement_block") {
-        const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, true);
+        const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, "js");
         allBlocks.push(...blocks);
         allEdges.push(...edges);
         blockIdCounter = nextId;
@@ -8586,7 +8597,7 @@ function buildCFG(tree, language, cache) {
     for (const method of methods) {
       const body2 = method.childForFieldName("body");
       if (!body2) continue;
-      const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, false);
+      const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, "java");
       allBlocks.push(...blocks);
       allEdges.push(...edges);
       blockIdCounter = nextId;
@@ -8594,7 +8605,28 @@ function buildCFG(tree, language, cache) {
   }
   return { blocks: allBlocks, edges: allEdges };
 }
-function buildMethodCFG(body2, startId, isJavaScript) {
+function buildCSharpCFG(tree, blockIdCounter, cache) {
+  const allBlocks = [];
+  const allEdges = [];
+  const containers = [
+    ...getNodesFromCache(tree.rootNode, "method_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "constructor_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "destructor_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "operator_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "local_function_statement", cache),
+    ...getNodesFromCache(tree.rootNode, "accessor_declaration", cache)
+  ];
+  for (const container of containers) {
+    const body2 = container.childForFieldName("body");
+    if (!body2 || body2.type !== "block") continue;
+    const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, "csharp");
+    allBlocks.push(...blocks);
+    allEdges.push(...edges);
+    blockIdCounter = nextId;
+  }
+  return { blocks: allBlocks, edges: allEdges };
+}
+function buildMethodCFG(body2, startId, dialect) {
   const blocks = [];
   const edges = [];
   let currentId = startId;
@@ -8605,7 +8637,7 @@ function buildMethodCFG(body2, startId, isJavaScript) {
     end_line: body2.startPosition.row + 1
   };
   blocks.push(entryBlock);
-  const result = processStatements(body2, currentId, blocks, edges, isJavaScript);
+  const result = processStatements(body2, currentId, blocks, edges, dialect);
   currentId = result.nextId;
   if (result.entryId !== -1) {
     edges.push({
@@ -8637,15 +8669,15 @@ function buildMethodCFG(body2, startId, isJavaScript) {
   }
   return { blocks, edges, nextId: currentId };
 }
-function processStatements(container, startId, blocks, edges, isJavaScript) {
+function processStatements(container, startId, blocks, edges, dialect) {
   let currentId = startId;
   let firstBlockId = -1;
   let lastExitIds = [];
   for (let i2 = 0; i2 < container.childCount; i2++) {
     const stmt = container.child(i2);
     if (!stmt) continue;
-    if (!isStatement(stmt, isJavaScript)) continue;
-    const result = processStatement(stmt, currentId, blocks, edges, isJavaScript);
+    if (!isStatement(stmt, dialect)) continue;
+    const result = processStatement(stmt, currentId, blocks, edges, dialect);
     currentId = result.nextId;
     if (firstBlockId === -1) {
       firstBlockId = result.entryId;
@@ -8666,31 +8698,49 @@ function processStatements(container, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function processStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processStatement(stmt, startId, blocks, edges, dialect) {
   switch (stmt.type) {
     case "if_statement":
-      return processIfStatement(stmt, startId, blocks, edges, isJavaScript);
+      return processIfStatement(stmt, startId, blocks, edges, dialect);
     case "for_statement":
     case "enhanced_for_statement":
     case "for_in_statement":
     case "for_of_statement":
-      return processForStatement(stmt, startId, blocks, edges, isJavaScript);
+    case "foreach_statement":
+      return processForStatement(stmt, startId, blocks, edges, dialect);
     case "while_statement":
-      return processWhileStatement(stmt, startId, blocks, edges, isJavaScript);
+      return processWhileStatement(stmt, startId, blocks, edges, dialect);
     case "do_statement":
-      return processDoWhileStatement(stmt, startId, blocks, edges, isJavaScript);
+      return processDoWhileStatement(stmt, startId, blocks, edges, dialect);
     case "try_statement":
-      return processTryStatement(stmt, startId, blocks, edges, isJavaScript);
+      return processTryStatement(stmt, startId, blocks, edges, dialect);
     case "switch_expression":
     case "switch_statement":
-      return processSwitchStatement(stmt, startId, blocks, edges, isJavaScript);
+      return processSwitchStatement(stmt, startId, blocks, edges, dialect);
+    // C# scoped blocks add no branching — flow through the inner block so its
+    // nested statements are still captured.
+    case "using_statement":
+    case "lock_statement":
+    case "checked_statement":
+    case "unsafe_statement": {
+      const inner = stmt.childForFieldName("body") ?? lastBlockChild(stmt);
+      if (inner) return processStatement(inner, startId, blocks, edges, dialect);
+      return processSimpleStatement(stmt, startId, blocks);
+    }
     case "block":
     case "statement_block":
-      return processStatements(stmt, startId, blocks, edges, isJavaScript);
+      return processStatements(stmt, startId, blocks, edges, dialect);
     default:
       return processSimpleStatement(stmt, startId, blocks);
   }
 }
+function lastBlockChild(node) {
+  for (let i2 = node.childCount - 1; i2 >= 0; i2--) {
+    const c = node.child(i2);
+    if (c && c.type === "block") return c;
+  }
+  return null;
+}
 function processSimpleStatement(stmt, startId, blocks) {
   const block = {
     id: startId,
@@ -8705,7 +8755,7 @@ function processSimpleStatement(stmt, startId, blocks) {
     nextId: startId + 1
   };
 }
-function processIfStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processIfStatement(stmt, startId, blocks, edges, dialect) {
   let currentId = startId;
   const condBlock = {
     id: currentId++,
@@ -8717,7 +8767,7 @@ function processIfStatement(stmt, startId, blocks, edges, isJavaScript) {
   const exitIds = [];
   const consequence = stmt.childForFieldName("consequence");
   if (consequence) {
-    const thenResult = processStatement(consequence, currentId, blocks, edges, isJavaScript);
+    const thenResult = processStatement(consequence, currentId, blocks, edges, dialect);
     currentId = thenResult.nextId;
     edges.push({
       from: condBlock.id,
@@ -8728,7 +8778,7 @@ function processIfStatement(stmt, startId, blocks, edges, isJavaScript) {
   }
   const alternative = stmt.childForFieldName("alternative");
   if (alternative) {
-    const elseResult = processStatement(alternative, currentId, blocks, edges, isJavaScript);
+    const elseResult = processStatement(alternative, currentId, blocks, edges, dialect);
     currentId = elseResult.nextId;
     edges.push({
       from: condBlock.id,
@@ -8745,7 +8795,7 @@ function processIfStatement(stmt, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function processForStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processForStatement(stmt, startId, blocks, edges, dialect) {
   let currentId = startId;
   const loopBlock = {
     id: currentId++,
@@ -8756,7 +8806,7 @@ function processForStatement(stmt, startId, blocks, edges, isJavaScript) {
   blocks.push(loopBlock);
   const body2 = stmt.childForFieldName("body");
   if (body2) {
-    const bodyResult = processStatement(body2, currentId, blocks, edges, isJavaScript);
+    const bodyResult = processStatement(body2, currentId, blocks, edges, dialect);
     currentId = bodyResult.nextId;
     edges.push({
       from: loopBlock.id,
@@ -8778,16 +8828,16 @@ function processForStatement(stmt, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function processWhileStatement(stmt, startId, blocks, edges, isJavaScript) {
-  return processForStatement(stmt, startId, blocks, edges, isJavaScript);
+function processWhileStatement(stmt, startId, blocks, edges, dialect) {
+  return processForStatement(stmt, startId, blocks, edges, dialect);
 }
-function processDoWhileStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processDoWhileStatement(stmt, startId, blocks, edges, dialect) {
   let currentId = startId;
   const body2 = stmt.childForFieldName("body");
   let bodyEntryId = currentId;
   let bodyExitIds = [];
   if (body2) {
-    const bodyResult = processStatement(body2, currentId, blocks, edges, isJavaScript);
+    const bodyResult = processStatement(body2, currentId, blocks, edges, dialect);
     currentId = bodyResult.nextId;
     bodyEntryId = bodyResult.entryId;
     bodyExitIds = bodyResult.exitIds;
@@ -8817,13 +8867,13 @@ function processDoWhileStatement(stmt, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function processTryStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processTryStatement(stmt, startId, blocks, edges, dialect) {
   let currentId = startId;
   const exitIds = [];
   const body2 = stmt.childForFieldName("body");
   let tryEntryId = -1;
   if (body2) {
-    const bodyResult = processStatements(body2, currentId, blocks, edges, isJavaScript);
+    const bodyResult = processStatements(body2, currentId, blocks, edges, dialect);
     currentId = bodyResult.nextId;
     tryEntryId = bodyResult.entryId;
     exitIds.push(...bodyResult.exitIds);
@@ -8833,7 +8883,7 @@ function processTryStatement(stmt, startId, blocks, edges, isJavaScript) {
     if (child?.type === "catch_clause") {
       const catchBody = child.childForFieldName("body");
       if (catchBody) {
-        const catchResult = processStatements(catchBody, currentId, blocks, edges, isJavaScript);
+        const catchResult = processStatements(catchBody, currentId, blocks, edges, dialect);
         currentId = catchResult.nextId;
         if (tryEntryId !== -1) {
           edges.push({
@@ -8846,9 +8896,18 @@ function processTryStatement(stmt, startId, blocks, edges, isJavaScript) {
       }
     }
   }
-  const finallyClause = stmt.childForFieldName("finally") ?? stmt.childForFieldName("finalizer");
+  let finallyClause = stmt.childForFieldName("finally") ?? stmt.childForFieldName("finalizer");
+  if (!finallyClause && dialect === "csharp") {
+    for (let i2 = 0; i2 < stmt.childCount; i2++) {
+      const child = stmt.child(i2);
+      if (child?.type === "finally_clause") {
+        finallyClause = lastBlockChild(child);
+        break;
+      }
+    }
+  }
   if (finallyClause) {
-    const finallyResult = processStatements(finallyClause, currentId, blocks, edges, isJavaScript);
+    const finallyResult = processStatements(finallyClause, currentId, blocks, edges, dialect);
     currentId = finallyResult.nextId;
     for (const exitId of exitIds) {
       edges.push({
@@ -8869,7 +8928,7 @@ function processTryStatement(stmt, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function processSwitchStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processSwitchStatement(stmt, startId, blocks, edges, dialect) {
   let currentId = startId;
   const switchBlock = {
     id: currentId++,
@@ -8881,11 +8940,11 @@ function processSwitchStatement(stmt, startId, blocks, edges, isJavaScript) {
   const exitIds = [];
   const body2 = stmt.childForFieldName("body");
   if (body2) {
-    const caseTypes = isJavaScript ? ["switch_case", "switch_default"] : ["switch_block_statement_group", "switch_rule"];
+    const caseTypes = dialect === "js" ? ["switch_case", "switch_default"] : dialect === "csharp" ? ["switch_section"] : ["switch_block_statement_group", "switch_rule"];
     for (let i2 = 0; i2 < body2.childCount; i2++) {
       const child = body2.child(i2);
       if (child && caseTypes.includes(child.type)) {
-        const caseResult = processStatements(child, currentId, blocks, edges, isJavaScript);
+        const caseResult = processStatements(child, currentId, blocks, edges, dialect);
         currentId = caseResult.nextId;
         if (caseResult.entryId !== -1) {
           edges.push({
@@ -8915,7 +8974,7 @@ function buildBashCFG(tree, startId, cache) {
   for (const func2 of functions) {
     const body2 = func2.childForFieldName("body");
     if (!body2) continue;
-    const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, false);
+    const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, "java");
     allBlocks.push(...blocks);
     allEdges.push(...edges);
     blockIdCounter = nextId;
@@ -8938,7 +8997,7 @@ function buildBashCFG(tree, startId, cache) {
     let lastExitIds = [];
     let firstBlockId = -1;
     for (const stmt of topLevelStatements) {
-      const result = processStatement(stmt, blockIdCounter, allBlocks, allEdges, false);
+      const result = processStatement(stmt, blockIdCounter, allBlocks, allEdges, "java");
       blockIdCounter = result.nextId;
       if (firstBlockId === -1) {
         firstBlockId = result.entryId;
@@ -8982,7 +9041,8 @@ function isBashStatement(node) {
   ]);
   return bashStatementTypes.has(node.type);
 }
-function isStatement(node, isJavaScript) {
+function isStatement(node, dialect) {
+  if (dialect === "csharp") return csharpStatementTypes.has(node.type);
   const javaStatementTypes = /* @__PURE__ */ new Set([
     "local_variable_declaration",
     "expression_statement",
@@ -9026,8 +9086,30 @@ function isStatement(node, isJavaScript) {
     "export_statement",
     "import_statement"
   ]);
-  return isJavaScript ? jsStatementTypes.has(node.type) : javaStatementTypes.has(node.type);
-}
+  return dialect === "js" ? jsStatementTypes.has(node.type) : javaStatementTypes.has(node.type);
+}
+var csharpStatementTypes = /* @__PURE__ */ new Set([
+  "local_declaration_statement",
+  "expression_statement",
+  "if_statement",
+  "for_statement",
+  "foreach_statement",
+  "while_statement",
+  "do_statement",
+  "try_statement",
+  "switch_statement",
+  "return_statement",
+  "throw_statement",
+  "break_statement",
+  "continue_statement",
+  "using_statement",
+  "lock_statement",
+  "checked_statement",
+  "unsafe_statement",
+  "yield_statement",
+  "goto_statement",
+  "block"
+]);
 function buildGoCFG(tree, blockIdCounter, cache) {
   const allBlocks = [];
   const allEdges = [];
@@ -9038,7 +9120,7 @@ function buildGoCFG(tree, blockIdCounter, cache) {
   for (const func2 of functions) {
     const body2 = func2.childForFieldName("body");
     if (!body2 || body2.type !== "block") continue;
-    const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, false);
+    const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, "java");
     allBlocks.push(...blocks);
     allEdges.push(...edges);
     blockIdCounter = nextId;
@@ -11587,7 +11669,11 @@ var DEFAULT_SINKS = [
   // File: covers both File(String pathname) and File(parent, child). The 2-arg
   // overload's child argument carries CVE-2018-8041 (Camel mail Content-Disposition
   // filename written to disk).
-  { method: "File", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
+  // Java `new File(path)` idiom. Excluded for C#: there is no `new File()` in
+  // .NET (it's `System.IO.File` statics + `FileStream`, covered separately), and
+  // this over-matched ASP.NET `ControllerBase.File(stream|bytes, contentType)` —
+  // a result helper that returns a file, not a path sink (cognium-ai#326 B).
+  { method: "File", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], exclude_languages: ["csharp"] },
   { method: "FileInputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileOutputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileReader", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -13114,6 +13200,11 @@ var DEFAULT_SINKS = [
   // ADO.NET `cmd.CommandText = "…" + x` — emitted as a synthetic call by
   // extractCSharpCalls (property-assignment sink; the ctor-arg sink misses it).
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // `DirectorySearcher.Filter = "(uid=" + x + ")"` — LDAP injection (cognium-ai#272).
+  // Emitted as a synthetic call by extractCSharpCalls ONLY when the receiver
+  // resolves to a DirectorySearcher, so this classless entry never over-matches
+  // other `.Filter =` assignments (DataView/BindingSource/collection filters).
+  { method: "Filter", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // ADO.NET `cmd.Execute*()` — object-carried sink (cognium-dev#271). The taint
   // rides the SqlCommand receiver (CommandText set from tainted data); the
   // receiver is surfaced as arg[0] by extractCSharpCalls, and the command object
@@ -13130,6 +13221,9 @@ var DEFAULT_SINKS = [
   // injectable — the second is the argv path where taint rides arg[1] (#276).
   { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
+  // P/Invoke of libc `system(cmd)` — lowercase `system` in C# is virtually
+  // always the imported shell entry point (cognium-ai#275 interop/IlPinvoke).
+  { method: "system", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# path traversal — System.IO file APIs (CWE-22). Distinctive method names.
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "ReadAllBytes", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13142,6 +13236,25 @@ var DEFAULT_SINKS = [
   { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // Remaining System.IO.File path APIs — class-scoped so they don't collide
+  // with unrelated methods. Copy/Move take a source AND destination path (both
+  // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
+  { method: "Copy", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Move", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Delete", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Open", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "OpenText", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Create", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "AppendAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // System.IO.Directory path APIs.
+  { method: "CreateDirectory", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Delete", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetFiles", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "EnumerateFiles", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // ASP.NET `ControllerBase.PhysicalFile(path, contentType)` serves a file from
+  // an absolute disk path — attacker-controllable path is CWE-22 (cognium-ai#326/#275).
+  { method: "PhysicalFile", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# SSRF — HttpClient / WebClient / WebRequest (CWE-918).
   { method: "GetAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "PostAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13158,13 +13271,36 @@ var DEFAULT_SINKS = [
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
-  // C# insecure deserialization — BinaryFormatter et al. (CWE-502).
+  // Loading an assembly from an attacker-controlled name/path is arbitrary code
+  // execution. Class-scoped to `Assembly` (low FP — a tainted arg here is rare
+  // in benign code). `Type.GetType`/`Activator.CreateInstance` are intentionally
+  // NOT added — reflection with config-driven type names is common in DI, an FP
+  // trap without the reflection-suppress machinery.
+  { method: "Load", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "LoadFrom", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "LoadFile", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // C# insecure deserialization — the polymorphic BCL formatters that can
+  // instantiate arbitrary types named in the payload (CWE-502, cognium-ai#318).
+  // Each of these classes exists only to deserialize and is unsafe on untrusted
+  // input; class-scoped, so no collision with safe JSON APIs (System.Text.Json /
+  // Newtonsoft-default, which are intentionally NOT sinks).
   { method: "Deserialize", class: "BinaryFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Deserialize", class: "NetDataContractSerializer", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "SoapFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "LosFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "ObjectStateFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# XSS — raw HTML output (CWE-79).
   { method: "Raw", class: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
+  // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
+  { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // `String.Format(fmt, …)` with an attacker-controlled FORMAT string — CWE-134.
+  // Taint-gated on arg 0 (the format), so ordinary `String.Format("...", user)` where
+  // only an argument is tainted never fires. .NET composite formatting can't corrupt
+  // memory, so medium (FormatException DoS / unintended arg access), unlike C printf.
+  { method: "Format", class: "String", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   // C# LDAP injection — System.DirectoryServices (CWE-90). The user-built
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13185,14 +13321,37 @@ var DEFAULT_SINKS = [
   // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
   // attacker-controlled query document. Class-scoped (static receiver resolves).
   { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# log injection — Microsoft.Extensions.Logging `ILogger` (CWE-117,
+  // cognium-ai#318). Only the message TEMPLATE (arg[0]) is the injectable
+  // position; the structured form `LogInformation("… {Id}", id)` keeps taint in
+  // later args (the logger renders them as data), so arg_positions:[0] does not
+  // flag it. Mirrors the Java `Logger` sinks; severity low.
+  { method: "LogInformation", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogWarning", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogError", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogDebug", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogCritical", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogTrace", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  // Generic `ILogger.Log(logLevel, message, …)` — class-scoped (`Log` alone is
+  // too generic); the message is arg[1].
+  { method: "Log", class: "ILogger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1], languages: ["csharp"] },
   // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Compile", class: "XPathExpression", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // XPathNavigator.Select/Evaluate — class-scoped (both names collide with LINQ
+  // `.Select`/`.Evaluate`, so they must resolve to an XPathNavigator receiver).
+  { method: "Select", class: "XPathNavigator", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Evaluate", class: "XPathNavigator", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# XXE — untrusted XML into a parser without DTD hardening (CWE-611).
   { method: "LoadXml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "XmlDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "XDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // `new XmlTextReader(input)` — its DtdProcessing defaults to Parse (resolves
+  // external entities), unlike `XmlReader.Create` (Prohibit). CWE-611,
+  // cognium-ai#318. The 4.7.0 XmlResolver=null / DtdProcessing=Prohibit
+  // hardening still suppresses the safe shape.
+  { method: "XmlTextReader", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // Python SQLi — asyncpg Connection.*
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -14510,6 +14669,57 @@ function isSafeJSChildProcessCall(call, pattern, language) {
   if (SHELL_PROGRAMS.has(program)) return false;
   return true;
 }
+var CSHARP_SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "dash",
+  "ash",
+  "ksh",
+  "cmd",
+  "powershell",
+  "pwsh"
+]);
+function isConstNonShellExe(raw) {
+  if (!raw) return false;
+  const t = raw.trim();
+  if (!/^@?"[^"]*"$/.test(t)) return false;
+  const program = (t.replace(/^@?"|"$/g, "").split(/[\\/]/).pop() ?? "").toLowerCase().replace(/\.exe$/, "");
+  return !CSHARP_SHELL_PROGRAMS.has(program);
+}
+var PSI_CTOR_EXE_RE = /\bnew\s+ProcessStartInfo\s*(?:<[^>]*>)?\s*\(\s*(@?"[^"]*")/;
+function processStartInfoExe(expr, sourceLines) {
+  const inline = PSI_CTOR_EXE_RE.exec(expr);
+  if (inline) return inline[1];
+  if (sourceLines && /^[A-Za-z_]\w*$/.test(expr.trim())) {
+    const varName = expr.trim();
+    const assignRe = new RegExp(
+      `\\b${varName}\\s*=\\s*new\\s+ProcessStartInfo\\s*(?:<[^>]*>)?\\s*\\(\\s*(@?"[^"]*")`
+    );
+    for (const line of sourceLines) {
+      const m = assignRe.exec(line);
+      if (m) return m[1];
+    }
+  }
+  return null;
+}
+function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
+  if (language !== "csharp") return false;
+  if (pattern.type !== "command_injection") return false;
+  const method = call.method_name;
+  if (method !== "Start" && method !== "ProcessStartInfo") return false;
+  if (call.arguments.length >= 2) {
+    const fileArg = call.arguments.find((a) => a.position === 0);
+    const raw = fileArg?.literal != null ? String(fileArg.literal) : fileArg?.expression;
+    return isConstNonShellExe(raw);
+  }
+  if (method === "Start" && call.arguments.length === 1) {
+    const arg0 = call.arguments.find((a) => a.position === 0);
+    const expr = (arg0?.expression ?? "").trim();
+    return isConstNonShellExe(processStartInfoExe(expr, sourceLines));
+  }
+  return false;
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
@@ -14765,6 +14975,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeJSChildProcessCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeCSharpProcessStartCall(call, pattern, language, sourceLines)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }

package/dist/core/extractors/calls.js

@@ -224,15 +224,29 @@ function extractCSharpCalls(tree, cache) {
         if (left?.type !== 'member_access_expression')
             continue;
         const nameNode = left.childForFieldName('name');
-        if (!nameNode || getNodeText(nameNode) !== 'CommandText')
+        if (!nameNode)
             continue;
+        const propName = getNodeText(nameNode);
+        const exprNode = left.childForFieldName('expression');
+        // `CommandText` is distinctive to ADO.NET commands, so it fires classless.
+        // `Filter` is a common property name, so it is class-gated to a resolved
+        // `DirectorySearcher` receiver (cognium-ai#272 LDAP injection) — this keeps
+        // the classless registry sink from over-matching unrelated `.Filter =`.
+        if (propName === 'Filter') {
+            const recv = exprNode ? getNodeText(exprNode) : null;
+            const recvType = recv ? typeMap.get(recv) : undefined;
+            if (recvType !== 'DirectorySearcher')
+                continue;
+        }
+        else if (propName !== 'CommandText') {
+            continue;
+        }
         const right = asn.childForFieldName('right');
         if (!right)
             continue;
         const rhsText = getNodeText(right);
-        const exprNode = left.childForFieldName('expression');
         calls.push({
-            method_name: 'CommandText',
+            method_name: propName,
             receiver: exprNode ? getNodeText(exprNode) : null,
             receiver_type: null,
             receiver_type_fqn: null,