circle-ir 4.8.2 → 4.9.8

package/dist/core/circle-ir-core.cjs

@@ -4421,6 +4421,7 @@ function extractCSharpTypes(tree, cache) {
       const nameNode = node.childForFieldName("name");
       const body2 = node.childForFieldName("body");
       const methods = [];
+      const fields = extractCSharpFields(body2);
       if (body2) {
         for (let i2 = 0; i2 < body2.childCount; i2++) {
           const m = body2.child(i2);
@@ -4438,7 +4439,7 @@ function extractCSharpTypes(tree, cache) {
                 parameters.push({
                   name: getNodeText(pName),
                   type: pType ? getNodeText(pType) : null,
-                  annotations: [],
+                  annotations: extractCSharpParamAnnotations(pnode),
                   line: pnode.startPosition.row + 1
                 });
               }
@@ -4464,7 +4465,7 @@ function extractCSharpTypes(tree, cache) {
         implements: [],
         annotations: [],
         methods,
-        fields: [],
+        fields,
         start_line: node.startPosition.row + 1,
         end_line: node.endPosition.row + 1
       });
@@ -4472,6 +4473,59 @@ function extractCSharpTypes(tree, cache) {
   }
   return types;
 }
+function extractCSharpFields(body2) {
+  const fields = [];
+  if (!body2) return fields;
+  for (let i2 = 0; i2 < body2.childCount; i2++) {
+    const c = body2.child(i2);
+    if (!c) continue;
+    if (c.type === "field_declaration") {
+      let varDecl = null;
+      for (let k = 0; k < c.childCount; k++) {
+        const cc = c.child(k);
+        if (cc?.type === "variable_declaration") {
+          varDecl = cc;
+          break;
+        }
+      }
+      if (!varDecl) continue;
+      const typeNode = varDecl.childForFieldName("type");
+      const type = typeNode ? getNodeText(typeNode) : null;
+      const modifiers = extractCSharpModifiers(c);
+      for (let k = 0; k < varDecl.childCount; k++) {
+        const decl = varDecl.child(k);
+        if (decl?.type !== "variable_declarator") continue;
+        const nameNode = decl.childForFieldName("name");
+        fields.push({ name: nameNode ? getNodeText(nameNode) : "unknown", type, modifiers, annotations: [] });
+      }
+    } else if (c.type === "property_declaration") {
+      const nameNode = c.childForFieldName("name");
+      if (!nameNode) continue;
+      const typeNode = c.childForFieldName("type");
+      fields.push({
+        name: getNodeText(nameNode),
+        type: typeNode ? getNodeText(typeNode) : null,
+        modifiers: extractCSharpModifiers(c),
+        annotations: []
+      });
+    }
+  }
+  return fields;
+}
+function extractCSharpParamAnnotations(param) {
+  const out2 = [];
+  for (let i2 = 0; i2 < param.childCount; i2++) {
+    const list = param.child(i2);
+    if (list?.type !== "attribute_list") continue;
+    for (let j = 0; j < list.childCount; j++) {
+      const attr = list.child(j);
+      if (attr?.type !== "attribute") continue;
+      const name2 = attr.childForFieldName("name");
+      if (name2) out2.push(getNodeText(name2));
+    }
+  }
+  return out2;
+}
 function extractCSharpModifiers(node) {
   const mods = [];
   for (let i2 = 0; i2 < node.childCount; i2++) {
@@ -13345,6 +13399,17 @@ var DEFAULT_SINKS = [
   { method: "Load", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "LoadFrom", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "LoadFile", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // C# server-side template injection (SSTI). Compiling an attacker-controlled
+  // template string is arbitrary code execution — classified as code_injection
+  // (CWE-94), matching how Python (Jinja2/Mako) and Node SSTI are modelled.
+  // Restricted to DISTINCTIVE template-compile APIs so the generic
+  // `Template.Parse` / `.Compile` names (int.Parse, Regex.Compile, …) are not
+  // over-matched. Taint-gated: a constant template never fires. `RunCompile`
+  // = RazorEngine; `CompileRenderStringAsync` = RazorLight; `Compile` is
+  // class-scoped to Handlebars. (cognium-dev#273)
+  { method: "RunCompile", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "CompileRenderStringAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Compile", class: "Handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# insecure deserialization — the polymorphic BCL formatters that can
   // instantiate arbitrary types named in the payload (CWE-502, cognium-ai#318).
   // Each of these classes exists only to deserialize and is unsafe on untrusted
@@ -14377,7 +14442,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
       const skipMethods = ["toString", "hashCode", "equals", "compareTo"];
       if (skipMethods.includes(method.name)) continue;
       for (const param of method.parameters) {
-        const isTaintable = param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
+        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -14497,6 +14563,13 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   return result;
 }
+var CSHARP_BINDING_ATTRS = /* @__PURE__ */ new Set([
+  "FromBody",
+  "FromQuery",
+  "FromRoute",
+  "FromForm",
+  "FromHeader"
+]);
 function isInterproceduralTaintableType(typeName, language) {
   const baseType = typeName.split("<")[0].trim();
   const excludedTypes = [
@@ -14786,6 +14859,145 @@ function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
+function stripCsLiterals(line) {
+  return line.replace(/\/\/.*$/, "").replace(/@?"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)'/g, "''");
+}
+function csBraceDepthBefore(lines, idx) {
+  let depth = 0;
+  for (let i2 = 0; i2 < idx && i2 < lines.length; i2++) {
+    for (const ch of stripCsLiterals(lines[i2])) {
+      if (ch === "{") depth++;
+      else if (ch === "}") depth--;
+    }
+  }
+  return depth;
+}
+function netBraces(fragment) {
+  let n = 0;
+  for (const ch of fragment) {
+    if (ch === "{") n++;
+    else if (ch === "}") n--;
+  }
+  return n;
+}
+function splitCsIf(line) {
+  const m = /\bif\s*\(/.exec(line);
+  if (!m) return null;
+  const ifCol = m.index;
+  let i2 = m.index + m[0].length;
+  let depth = 1;
+  let inStr = false;
+  let strCh = "";
+  for (; i2 < line.length; i2++) {
+    const c = line[i2];
+    if (inStr) {
+      if (c === "\\") {
+        i2++;
+        continue;
+      }
+      if (c === strCh) inStr = false;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      inStr = true;
+      strCh = c;
+      continue;
+    }
+    if (c === "(") depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0) break;
+    }
+  }
+  if (depth !== 0) return null;
+  return { cond: line.slice(m.index + m[0].length, i2), rest: line.slice(i2 + 1), ifCol };
+}
+function csEqualityGuard(cond) {
+  const c = cond.trim();
+  let m = /^(.*?)\s*(==|!=)\s*@?"[^"]*"\s*$/.exec(c);
+  if (m) return { op: m[2], exprSide: m[1].trim() };
+  m = /^@?"[^"]*"\s*(==|!=)\s*(.*)$/.exec(c);
+  if (m) return { op: m[1], exprSide: m[2].trim() };
+  return null;
+}
+var CS_IDENT_RE = /[A-Za-z_]\w*/g;
+function csIdentifiers(expr) {
+  return new Set(expr.match(CS_IDENT_RE) ?? []);
+}
+function csThenBlock(lines, ifIdx, rest) {
+  const isExit = (s) => /^\s*(?:return|throw|continue|break)\b/.test(s);
+  let firstIdx;
+  let firstText;
+  if (rest.trim()) {
+    firstIdx = ifIdx;
+    firstText = rest;
+  } else {
+    let j = ifIdx + 1;
+    while (j < lines.length && stripCsLiterals(lines[j]).trim() === "") j++;
+    firstIdx = j;
+    firstText = lines[j] ?? "";
+  }
+  if (firstText.trim().startsWith("{")) {
+    let depth = 0;
+    let started = false;
+    let endLine = lines.length - 1;
+    let body2 = "";
+    for (let i2 = firstIdx; i2 < lines.length; i2++) {
+      const stripped = stripCsLiterals(i2 === firstIdx ? firstText : lines[i2]);
+      let broke = false;
+      for (const ch of stripped) {
+        if (ch === "{") {
+          depth++;
+          started = true;
+          if (depth === 1) continue;
+        } else if (ch === "}") {
+          depth--;
+          if (depth === 0) {
+            endLine = i2;
+            broke = true;
+            break;
+          }
+        }
+        if (started && depth >= 1) body2 += ch;
+      }
+      if (broke) break;
+      if (started) body2 += " ";
+    }
+    return { start: ifIdx, end: endLine, earlyExit: isExit(body2.trim()) };
+  }
+  return { start: ifIdx, end: firstIdx, earlyExit: isExit(firstText.trim()) };
+}
+function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines) {
+  if (language !== "csharp") return false;
+  if (pattern.type !== "ssrf") return false;
+  if (!sourceLines || sourceLines.length === 0) return false;
+  const candidates = /* @__PURE__ */ new Set();
+  for (const a of call.arguments) {
+    if (a.variable) candidates.add(a.variable);
+    for (const id of csIdentifiers(a.expression ?? "")) candidates.add(id);
+  }
+  if (candidates.size === 0) return false;
+  const sinkIdx = call.location.line - 1;
+  const sinkDepth = csBraceDepthBefore(sourceLines, sinkIdx);
+  for (let i2 = 0; i2 < sinkIdx; i2++) {
+    const parts2 = splitCsIf(sourceLines[i2]);
+    if (!parts2) continue;
+    const guard = csEqualityGuard(parts2.cond);
+    if (!guard) continue;
+    const guardIds = csIdentifiers(guard.exprSide);
+    if (![...guardIds].some((id) => candidates.has(id))) continue;
+    const block = csThenBlock(sourceLines, i2, parts2.rest);
+    if (guard.op === "==") {
+      if (sinkIdx >= block.start && sinkIdx <= block.end) return true;
+    } else {
+      const guardDepth = csBraceDepthBefore(sourceLines, i2) + netBraces(stripCsLiterals(sourceLines[i2]).slice(0, parts2.ifCol));
+      if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
@@ -15044,6 +15256,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeCSharpProcessStartCall(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }

package/dist/core/circle-ir-core.js

@@ -4355,6 +4355,7 @@ function extractCSharpTypes(tree, cache) {
       const nameNode = node.childForFieldName("name");
       const body2 = node.childForFieldName("body");
       const methods = [];
+      const fields = extractCSharpFields(body2);
       if (body2) {
         for (let i2 = 0; i2 < body2.childCount; i2++) {
           const m = body2.child(i2);
@@ -4372,7 +4373,7 @@ function extractCSharpTypes(tree, cache) {
                 parameters.push({
                   name: getNodeText(pName),
                   type: pType ? getNodeText(pType) : null,
-                  annotations: [],
+                  annotations: extractCSharpParamAnnotations(pnode),
                   line: pnode.startPosition.row + 1
                 });
               }
@@ -4398,7 +4399,7 @@ function extractCSharpTypes(tree, cache) {
         implements: [],
         annotations: [],
         methods,
-        fields: [],
+        fields,
         start_line: node.startPosition.row + 1,
         end_line: node.endPosition.row + 1
       });
@@ -4406,6 +4407,59 @@ function extractCSharpTypes(tree, cache) {
   }
   return types;
 }
+function extractCSharpFields(body2) {
+  const fields = [];
+  if (!body2) return fields;
+  for (let i2 = 0; i2 < body2.childCount; i2++) {
+    const c = body2.child(i2);
+    if (!c) continue;
+    if (c.type === "field_declaration") {
+      let varDecl = null;
+      for (let k = 0; k < c.childCount; k++) {
+        const cc = c.child(k);
+        if (cc?.type === "variable_declaration") {
+          varDecl = cc;
+          break;
+        }
+      }
+      if (!varDecl) continue;
+      const typeNode = varDecl.childForFieldName("type");
+      const type = typeNode ? getNodeText(typeNode) : null;
+      const modifiers = extractCSharpModifiers(c);
+      for (let k = 0; k < varDecl.childCount; k++) {
+        const decl = varDecl.child(k);
+        if (decl?.type !== "variable_declarator") continue;
+        const nameNode = decl.childForFieldName("name");
+        fields.push({ name: nameNode ? getNodeText(nameNode) : "unknown", type, modifiers, annotations: [] });
+      }
+    } else if (c.type === "property_declaration") {
+      const nameNode = c.childForFieldName("name");
+      if (!nameNode) continue;
+      const typeNode = c.childForFieldName("type");
+      fields.push({
+        name: getNodeText(nameNode),
+        type: typeNode ? getNodeText(typeNode) : null,
+        modifiers: extractCSharpModifiers(c),
+        annotations: []
+      });
+    }
+  }
+  return fields;
+}
+function extractCSharpParamAnnotations(param) {
+  const out2 = [];
+  for (let i2 = 0; i2 < param.childCount; i2++) {
+    const list = param.child(i2);
+    if (list?.type !== "attribute_list") continue;
+    for (let j = 0; j < list.childCount; j++) {
+      const attr = list.child(j);
+      if (attr?.type !== "attribute") continue;
+      const name2 = attr.childForFieldName("name");
+      if (name2) out2.push(getNodeText(name2));
+    }
+  }
+  return out2;
+}
 function extractCSharpModifiers(node) {
   const mods = [];
   for (let i2 = 0; i2 < node.childCount; i2++) {
@@ -13279,6 +13333,17 @@ var DEFAULT_SINKS = [
   { method: "Load", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "LoadFrom", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "LoadFile", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // C# server-side template injection (SSTI). Compiling an attacker-controlled
+  // template string is arbitrary code execution — classified as code_injection
+  // (CWE-94), matching how Python (Jinja2/Mako) and Node SSTI are modelled.
+  // Restricted to DISTINCTIVE template-compile APIs so the generic
+  // `Template.Parse` / `.Compile` names (int.Parse, Regex.Compile, …) are not
+  // over-matched. Taint-gated: a constant template never fires. `RunCompile`
+  // = RazorEngine; `CompileRenderStringAsync` = RazorLight; `Compile` is
+  // class-scoped to Handlebars. (cognium-dev#273)
+  { method: "RunCompile", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "CompileRenderStringAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Compile", class: "Handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# insecure deserialization — the polymorphic BCL formatters that can
   // instantiate arbitrary types named in the payload (CWE-502, cognium-ai#318).
   // Each of these classes exists only to deserialize and is unsafe on untrusted
@@ -14311,7 +14376,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
       const skipMethods = ["toString", "hashCode", "equals", "compareTo"];
       if (skipMethods.includes(method.name)) continue;
       for (const param of method.parameters) {
-        const isTaintable = param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
+        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -14431,6 +14497,13 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   return result;
 }
+var CSHARP_BINDING_ATTRS = /* @__PURE__ */ new Set([
+  "FromBody",
+  "FromQuery",
+  "FromRoute",
+  "FromForm",
+  "FromHeader"
+]);
 function isInterproceduralTaintableType(typeName, language) {
   const baseType = typeName.split("<")[0].trim();
   const excludedTypes = [
@@ -14720,6 +14793,145 @@ function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
+function stripCsLiterals(line) {
+  return line.replace(/\/\/.*$/, "").replace(/@?"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)'/g, "''");
+}
+function csBraceDepthBefore(lines, idx) {
+  let depth = 0;
+  for (let i2 = 0; i2 < idx && i2 < lines.length; i2++) {
+    for (const ch of stripCsLiterals(lines[i2])) {
+      if (ch === "{") depth++;
+      else if (ch === "}") depth--;
+    }
+  }
+  return depth;
+}
+function netBraces(fragment) {
+  let n = 0;
+  for (const ch of fragment) {
+    if (ch === "{") n++;
+    else if (ch === "}") n--;
+  }
+  return n;
+}
+function splitCsIf(line) {
+  const m = /\bif\s*\(/.exec(line);
+  if (!m) return null;
+  const ifCol = m.index;
+  let i2 = m.index + m[0].length;
+  let depth = 1;
+  let inStr = false;
+  let strCh = "";
+  for (; i2 < line.length; i2++) {
+    const c = line[i2];
+    if (inStr) {
+      if (c === "\\") {
+        i2++;
+        continue;
+      }
+      if (c === strCh) inStr = false;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      inStr = true;
+      strCh = c;
+      continue;
+    }
+    if (c === "(") depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0) break;
+    }
+  }
+  if (depth !== 0) return null;
+  return { cond: line.slice(m.index + m[0].length, i2), rest: line.slice(i2 + 1), ifCol };
+}
+function csEqualityGuard(cond) {
+  const c = cond.trim();
+  let m = /^(.*?)\s*(==|!=)\s*@?"[^"]*"\s*$/.exec(c);
+  if (m) return { op: m[2], exprSide: m[1].trim() };
+  m = /^@?"[^"]*"\s*(==|!=)\s*(.*)$/.exec(c);
+  if (m) return { op: m[1], exprSide: m[2].trim() };
+  return null;
+}
+var CS_IDENT_RE = /[A-Za-z_]\w*/g;
+function csIdentifiers(expr) {
+  return new Set(expr.match(CS_IDENT_RE) ?? []);
+}
+function csThenBlock(lines, ifIdx, rest) {
+  const isExit = (s) => /^\s*(?:return|throw|continue|break)\b/.test(s);
+  let firstIdx;
+  let firstText;
+  if (rest.trim()) {
+    firstIdx = ifIdx;
+    firstText = rest;
+  } else {
+    let j = ifIdx + 1;
+    while (j < lines.length && stripCsLiterals(lines[j]).trim() === "") j++;
+    firstIdx = j;
+    firstText = lines[j] ?? "";
+  }
+  if (firstText.trim().startsWith("{")) {
+    let depth = 0;
+    let started = false;
+    let endLine = lines.length - 1;
+    let body2 = "";
+    for (let i2 = firstIdx; i2 < lines.length; i2++) {
+      const stripped = stripCsLiterals(i2 === firstIdx ? firstText : lines[i2]);
+      let broke = false;
+      for (const ch of stripped) {
+        if (ch === "{") {
+          depth++;
+          started = true;
+          if (depth === 1) continue;
+        } else if (ch === "}") {
+          depth--;
+          if (depth === 0) {
+            endLine = i2;
+            broke = true;
+            break;
+          }
+        }
+        if (started && depth >= 1) body2 += ch;
+      }
+      if (broke) break;
+      if (started) body2 += " ";
+    }
+    return { start: ifIdx, end: endLine, earlyExit: isExit(body2.trim()) };
+  }
+  return { start: ifIdx, end: firstIdx, earlyExit: isExit(firstText.trim()) };
+}
+function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines) {
+  if (language !== "csharp") return false;
+  if (pattern.type !== "ssrf") return false;
+  if (!sourceLines || sourceLines.length === 0) return false;
+  const candidates = /* @__PURE__ */ new Set();
+  for (const a of call.arguments) {
+    if (a.variable) candidates.add(a.variable);
+    for (const id of csIdentifiers(a.expression ?? "")) candidates.add(id);
+  }
+  if (candidates.size === 0) return false;
+  const sinkIdx = call.location.line - 1;
+  const sinkDepth = csBraceDepthBefore(sourceLines, sinkIdx);
+  for (let i2 = 0; i2 < sinkIdx; i2++) {
+    const parts2 = splitCsIf(sourceLines[i2]);
+    if (!parts2) continue;
+    const guard = csEqualityGuard(parts2.cond);
+    if (!guard) continue;
+    const guardIds = csIdentifiers(guard.exprSide);
+    if (![...guardIds].some((id) => candidates.has(id))) continue;
+    const block = csThenBlock(sourceLines, i2, parts2.rest);
+    if (guard.op === "==") {
+      if (sinkIdx >= block.start && sinkIdx <= block.end) return true;
+    } else {
+      const guardDepth = csBraceDepthBefore(sourceLines, i2) + netBraces(stripCsLiterals(sourceLines[i2]).slice(0, parts2.ifCol));
+      if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
@@ -14978,6 +15190,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeCSharpProcessStartCall(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }

package/dist/core/extractors/types.js

@@ -94,6 +94,7 @@ function extractCSharpTypes(tree, cache) {
             const nameNode = node.childForFieldName('name');
             const body = node.childForFieldName('body');
             const methods = [];
+            const fields = extractCSharpFields(body);
             if (body) {
                 for (let i = 0; i < body.childCount; i++) {
                     const m = body.child(i);
@@ -113,7 +114,7 @@ function extractCSharpTypes(tree, cache) {
                                 parameters.push({
                                     name: getNodeText(pName),
                                     type: pType ? getNodeText(pType) : null,
-                                    annotations: [],
+                                    annotations: extractCSharpParamAnnotations(pnode),
                                     line: pnode.startPosition.row + 1,
                                 });
                             }
@@ -139,7 +140,7 @@ function extractCSharpTypes(tree, cache) {
                 implements: [],
                 annotations: [],
                 methods,
-                fields: [],
+                fields,
                 start_line: node.startPosition.row + 1,
                 end_line: node.endPosition.row + 1,
             });
@@ -147,6 +148,80 @@ function extractCSharpTypes(tree, cache) {
     }
     return types;
 }
+/**
+ * Extract C# instance state — `field_declaration`s (incl. multi-declarator
+ * `int a, b;`) and `property_declaration`s (auto-properties hold state too).
+ * Both are class members that methods reference by name, so both count toward
+ * cohesion metrics (LCOM). Returns [] for a null body (e.g. expression-bodied
+ * or partial declarations without an inline body).
+ */
+function extractCSharpFields(body) {
+    const fields = [];
+    if (!body)
+        return fields;
+    for (let i = 0; i < body.childCount; i++) {
+        const c = body.child(i);
+        if (!c)
+            continue;
+        if (c.type === 'field_declaration') {
+            let varDecl = null;
+            for (let k = 0; k < c.childCount; k++) {
+                const cc = c.child(k);
+                if (cc?.type === 'variable_declaration') {
+                    varDecl = cc;
+                    break;
+                }
+            }
+            if (!varDecl)
+                continue;
+            const typeNode = varDecl.childForFieldName('type');
+            const type = typeNode ? getNodeText(typeNode) : null;
+            const modifiers = extractCSharpModifiers(c);
+            for (let k = 0; k < varDecl.childCount; k++) {
+                const decl = varDecl.child(k);
+                if (decl?.type !== 'variable_declarator')
+                    continue;
+                const nameNode = decl.childForFieldName('name');
+                fields.push({ name: nameNode ? getNodeText(nameNode) : 'unknown', type, modifiers, annotations: [] });
+            }
+        }
+        else if (c.type === 'property_declaration') {
+            const nameNode = c.childForFieldName('name');
+            if (!nameNode)
+                continue;
+            const typeNode = c.childForFieldName('type');
+            fields.push({
+                name: getNodeText(nameNode),
+                type: typeNode ? getNodeText(typeNode) : null,
+                modifiers: extractCSharpModifiers(c),
+                annotations: [],
+            });
+        }
+    }
+    return fields;
+}
+/**
+ * Attribute names on a C# `parameter` node — e.g. `[FromBody]` / `[FromQuery]`
+ * → `['FromBody']` / `['FromQuery']`. Used to recognise ASP.NET model-binding
+ * parameters (including DTO types) as taint sources.
+ */
+function extractCSharpParamAnnotations(param) {
+    const out = [];
+    for (let i = 0; i < param.childCount; i++) {
+        const list = param.child(i);
+        if (list?.type !== 'attribute_list')
+            continue;
+        for (let j = 0; j < list.childCount; j++) {
+            const attr = list.child(j);
+            if (attr?.type !== 'attribute')
+                continue;
+            const name = attr.childForFieldName('name');
+            if (name)
+                out.push(getNodeText(name));
+        }
+    }
+    return out;
+}
 /** Leading `modifier` tokens (public/static/…) of a C# declaration node. */
 function extractCSharpModifiers(node) {
     const mods = [];