circle-ir 4.9.12 → 4.9.14

package/dist/browser/circle-ir.js

@@ -6700,6 +6700,14 @@ function buildResolutionContext(tree, cache) {
       }
     }
   }
+  const resourceDecls = getNodesFromCache(tree.rootNode, "resource", cache);
+  for (const res of resourceDecls) {
+    const typeNode = res.childForFieldName("type");
+    const nameNode = res.childForFieldName("name");
+    if (typeNode && nameNode) {
+      context.localVarTypes.set(getNodeText(nameNode), getNodeText(typeNode));
+    }
+  }
   const imports = getNodesFromCache(tree.rootNode, "import_declaration", cache);
   for (const imp of imports) {
     const text = getNodeText(imp);
@@ -9363,6 +9371,7 @@ function buildCSharpDFG(tree, cache) {
   ];
   for (const method of methods) {
     scopeStack.push(/* @__PURE__ */ new Map());
+    const methodDefStart = defs.length;
     const params = method.childForFieldName("parameters");
     if (params) {
       for (const def of extractParameterDefs(params, defIdCounter)) {
@@ -9392,6 +9401,7 @@ function buildCSharpDFG(tree, cache) {
         }
       }
       const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
       uses.push(...bodyUses.uses);
       useIdCounter = bodyUses.nextId;
     }
@@ -10101,6 +10111,30 @@ function findReachingDef(name2, scopeStack) {
   }
   return null;
 }
+function resolveReassignedUses(methodDefs, methodUses) {
+  const defsByVar = /* @__PURE__ */ new Map();
+  for (const def of methodDefs) {
+    if (def.kind !== "local" && def.kind !== "param") continue;
+    const existing = defsByVar.get(def.variable);
+    if (existing) existing.push(def);
+    else defsByVar.set(def.variable, [def]);
+  }
+  for (const list of defsByVar.values()) {
+    if (list.length > 1) list.sort((a, b) => a.line - b.line || a.id - b.id);
+  }
+  for (const use of methodUses) {
+    const list = defsByVar.get(use.variable);
+    if (!list || list.length < 2) continue;
+    let strictlyBefore;
+    let sameLine;
+    for (const def of list) {
+      if (def.line < use.line) strictlyBefore = def;
+      else if (def.line === use.line) sameLine = def;
+    }
+    const reaching = strictlyBefore ?? sameLine;
+    if (reaching) use.def_id = reaching.id;
+  }
+}
 function computeChains(defs, uses) {
   const chains = [];
   const defById = /* @__PURE__ */ new Map();
@@ -12346,9 +12380,27 @@ var DEFAULT_SINKS = [
   // Command Injection (CWE-78)
   { method: "exec", class: "Runtime", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "start", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [] },
-  // ProcessBuilder constructor
-  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // ProcessBuilder constructor + command(): cognium-dev#351 — BOTH take
+  // `String...` varargs (or a single List<String>), and EVERY element is a
+  // command token, so no position is safe. Pinning these to `[0]` missed the
+  // canonical shell-wrapper shape, where the payload is the last argument:
+  //
+  //   new ProcessBuilder("bash", "-c", tainted)     // payload at position 2
+  //   pb.command("bash", "-c", tainted)
+  //
+  // `Runtime.exec(String[])` with the identical array already fired, so the
+  // taint was available and only the sink model was wrong.
+  //
+  // The positions are enumerated rather than left `[]` because the two layers
+  // that read this field disagree about what an empty array means:
+  // `isInDangerousPosition` (taint-matcher) does `arg_positions.includes(pos)`,
+  // so `[]` matches NOTHING, while the sink-reachability loop in
+  // taint-propagation treats `length === 0` as "any argument".
+  // `ProcessBuilder.start` gets away with `[]` only because it takes no
+  // arguments at all. Enumerating is unambiguous in both, and matches how the
+  // logging sinks in this file already spell it.
+  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
   // Commons Exec
   // Note: bare class 'Executor' removed — it collided with java.util.concurrent.Executor
   // (Executor.execute(Runnable) is not command injection). Apache Commons Exec users
@@ -13626,8 +13678,10 @@ var DEFAULT_SINKS = [
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
-  // Collection-based command injection (ProcessBuilder with List)
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // Collection-based command injection (ProcessBuilder with List) — the
+  // `ProcessBuilder.command` entry lives with the other ProcessBuilder sinks
+  // above; a second copy here only risked the two drifting apart, which is
+  // what happened (cognium-dev#351).
   // ProcessBuilder.inheritIO removed in 3.83.0 (#124): no args, no command
   // string flows into it. See note above next to the Process-related cluster.
   // Jenkins DSL patterns
@@ -15557,7 +15611,7 @@ function isSafeGoExecCommandCall(call, pattern, language) {
     const stripped = expr.slice(1, -1);
     program = stripped.split("/").pop() ?? stripped;
   }
-  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+  const SHELL_PROGRAMS2 = /* @__PURE__ */ new Set([
     "sh",
     "bash",
     "zsh",
@@ -15571,7 +15625,7 @@ function isSafeGoExecCommandCall(call, pattern, language) {
     "powershell.exe",
     "pwsh.exe"
   ]);
-  if (SHELL_PROGRAMS.has(program)) return false;
+  if (SHELL_PROGRAMS2.has(program)) return false;
   const PACKAGE_MANAGER_EXEC_SUBCOMMANDS = {
     go: /* @__PURE__ */ new Set(["install", "run", "get"]),
     npm: /* @__PURE__ */ new Set(["install", "i", "exec"]),
@@ -15622,7 +15676,7 @@ function isSafeJSChildProcessCall(call, pattern, language) {
     const stripped = expr.slice(1, -1);
     program = stripped.split("/").pop() ?? stripped;
   }
-  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+  const SHELL_PROGRAMS2 = /* @__PURE__ */ new Set([
     "sh",
     "bash",
     "zsh",
@@ -15636,7 +15690,7 @@ function isSafeJSChildProcessCall(call, pattern, language) {
     "powershell.exe",
     "pwsh.exe"
   ]);
-  if (SHELL_PROGRAMS.has(program)) return false;
+  if (SHELL_PROGRAMS2.has(program)) return false;
   return true;
 }
 var CSHARP_SHELL_PROGRAMS = /* @__PURE__ */ new Set([
@@ -15869,7 +15923,7 @@ function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
   if (pattern.class !== void 0 && pattern.class !== "Command") return false;
-  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+  const SHELL_PROGRAMS2 = /* @__PURE__ */ new Set([
     "sh",
     "bash",
     "zsh",
@@ -15904,13 +15958,13 @@ function isSafeRustCommandCall(call, pattern, language) {
       const stripped = expr.slice(1, -1);
       program = stripped.split("/").pop() ?? stripped;
     }
-    return !SHELL_PROGRAMS.has(program);
+    return !SHELL_PROGRAMS2.has(program);
   }
   if (pattern.method === "arg" || pattern.method === "args" || pattern.method === "spawn" || pattern.method === "output") {
     const receiverText = call.receiver ?? "";
     const program = extractProgram(receiverText);
     if (program === null) return false;
-    return !SHELL_PROGRAMS.has(program);
+    return !SHELL_PROGRAMS2.has(program);
   }
   return false;
 }
@@ -18965,7 +19019,7 @@ function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
 function buildTaintFlow(source, sink, taintInfo) {
   const path = [];
   path.push({
-    variable: taintInfo.variable,
+    variable: source.variable ?? taintInfo.variable,
     line: source.line,
     type: "source",
     description: `Tainted data enters via ${source.type}`
@@ -27163,6 +27217,7 @@ var LanguageSourcesPass = class {
       additionalSanitizers.push(...findPythonUrlAllowlistRedirectSanitizers(code));
       additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
       additionalSanitizers.push(...findPythonJinjaAutoescapeSanitizers(code));
+      additionalSanitizers.push(...findCrlfWrapperFunctionSanitizers(code, "python"));
       const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
       for (const finding of pyMisconfigFindings) {
         ctx.addFinding(finding);
@@ -27321,6 +27376,11 @@ var LanguageSourcesPass = class {
         ctx.addFinding(finding);
       }
     }
+    if (language === "csharp") {
+      additionalSanitizers.push(
+        ...findCSharpFullPathStartsWithGuardSanitizers(code)
+      );
+    }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
       additionalSanitizers.push(
@@ -27329,6 +27389,7 @@ var LanguageSourcesPass = class {
       additionalSanitizers.push(...findJavaPathGetFileNameSanitizers(code));
       additionalSanitizers.push(...findJavaCanonicalPathStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
+      additionalSanitizers.push(...findCrlfWrapperFunctionSanitizers(code, "java"));
       additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
@@ -29896,7 +29957,7 @@ function findJsPathResolveStartsWithGuardSanitizers(code) {
     let guardLine = -1;
     for (let l = c.line; l < Math.min(lines.length, c.line + 6); l++) {
       if (!guardRe.test(lines[l])) continue;
-      if (terminatorRe.test(lines[l]) || l + 1 < lines.length && terminatorRe.test(lines[l + 1])) {
+      if (guardRejects(lines, l, terminatorRe, 2)) {
         guardLine = l + 1;
         break;
       }
@@ -30005,7 +30066,7 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
     let guardLine = -1;
     for (let l = c.line; l < Math.min(lines.length, c.line + 6); l++) {
       if (!guardRe.test(lines[l])) continue;
-      if (terminatorRe.test(lines[l]) || l + 1 < lines.length && terminatorRe.test(lines[l + 1])) {
+      if (guardRejects(lines, l, terminatorRe, 2)) {
         guardLine = l + 1;
         break;
       }
@@ -30039,17 +30100,7 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
   for (let i2 = 0; i2 < lines.length; i2++) {
     const m = guardRe.exec(lines[i2]);
     if (!m) continue;
-    let hasTerminator = terminatorRe.test(lines[i2]);
-    if (!hasTerminator) {
-      for (let j = i2 + 1; j < Math.min(lines.length, i2 + 6); j++) {
-        if (terminatorRe.test(lines[j])) {
-          hasTerminator = true;
-          break;
-        }
-        if (lines[j].includes("}")) break;
-      }
-    }
-    if (!hasTerminator) continue;
+    if (!guardRejects(lines, i2, terminatorRe, 6)) continue;
     const guarded = /* @__PURE__ */ new Set([m[1]]);
     const mentions = (t) => {
       for (const n of guarded) if (new RegExp(`\\b${n}\\b`).test(t)) return true;
@@ -30074,6 +30125,58 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function guardRejects(lines, i2, terminatorRe, window2) {
+  if (terminatorRe.test(lines[i2])) return true;
+  const opens = (lines[i2].match(/\{/g) ?? []).length;
+  const closes = (lines[i2].match(/\}/g) ?? []).length;
+  if (opens > 0 && closes >= opens) return false;
+  for (let j = i2 + 1; j < Math.min(lines.length, i2 + window2); j++) {
+    if (terminatorRe.test(lines[j])) return true;
+    if (lines[j].includes("}")) return false;
+  }
+  return false;
+}
+function findCSharpFullPathStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const assignRe = /^\s*(?:(?:var|string)\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  const fullPathRe = /\bPath\s*\.\s*GetFullPath\s*\(/;
+  const canonicalVars = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    const a = assignRe.exec(line);
+    if (a && fullPathRe.test(a[2])) canonicalVars.add(a[1]);
+  }
+  if (canonicalVars.size === 0) return sanitizers;
+  const guardRe = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*StartsWith\s*\(/;
+  const terminatorRe = /\b(throw|return)\b/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = guardRe.exec(lines[i2]);
+    if (!m || !canonicalVars.has(m[1])) continue;
+    if (!guardRejects(lines, i2, terminatorRe, 6)) continue;
+    const guarded = /* @__PURE__ */ new Set([m[1]]);
+    const mentions = (t) => {
+      for (const n of guarded) if (new RegExp(`\\b${n}\\b`).test(t)) return true;
+      return false;
+    };
+    for (let l = 0; l < lines.length; l++) {
+      const lt = lines[l];
+      const a = assignRe.exec(lt);
+      if (a) {
+        if (mentions(a[2])) guarded.add(a[1]);
+        else if (a[1] !== m[1]) guarded.delete(a[1]);
+      }
+      if (mentions(lt)) {
+        sanitizers.push({
+          type: "csharp_fullpath_startswith_guard",
+          method: "GetFullPath",
+          line: l + 1,
+          sanitizes: ["path_traversal", "external_taint_escape"]
+        });
+      }
+    }
+  }
+  return sanitizers;
+}
 function findJavaPathGetFileNameSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -30112,6 +30215,34 @@ function findJavaPathGetFileNameSanitizers(code) {
   }
   return sanitizers;
 }
+function findCrlfWrapperFunctionSanitizers(code, language) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const declRe = language === "java" ? /^\s*(?:public|private|protected)?\s*(?:static\s+)?(?:final\s+)?(?:String|CharSequence)\s+([A-Za-z_]\w*)\s*\(/ : /^\s*def\s+([A-Za-z_]\w*)\s*\(/;
+  const stripRe = language === "java" ? /\.\s*replace(?:All)?\s*\(\s*(?:"[^"]*\\[rnt]|'\\[rnt]')/ : /(?:re\s*\.\s*sub\s*\(\s*r?["'][^"']*\\[rnt]|\.\s*replace\s*\(\s*["']\\[rnt])/;
+  const bodyWindow = 10;
+  const wrappers = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = declRe.exec(lines[i2]);
+    if (!m) continue;
+    const body2 = lines.slice(i2, Math.min(lines.length, i2 + bodyWindow)).join("\n");
+    if (stripRe.test(body2)) wrappers.add(m[1]);
+  }
+  if (wrappers.size === 0) return sanitizers;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    for (const name2 of wrappers) {
+      if (declRe.test(lines[i2]) && new RegExp(`\\b${name2}\\s*\\(`).test(lines[i2])) continue;
+      if (!new RegExp(`\\b${name2}\\s*\\(`).test(lines[i2])) continue;
+      sanitizers.push({
+        type: language === "java" ? "java_wrapper_crlf_strip" : "python_wrapper_crlf_strip",
+        method: name2,
+        line: i2 + 1,
+        sanitizes: ["log_injection", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findJavaInlineCrlfStripLogSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -33778,6 +33909,29 @@ var PROTOCOL_CLIENT_PACKAGES = [
 ];
 var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
 var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
+var PROCESS_BUILDER_COMMAND_ARGV_FORM_RE = /\.\s*command\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
+var SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "ksh",
+  "dash",
+  "ash",
+  "csh",
+  "tcsh",
+  "fish",
+  "cmd",
+  "command",
+  "powershell",
+  "pwsh"
+]);
+var ARGV_FIRST_LITERAL_RE = /(?:\bnew\s+ProcessBuilder\s*\(|\.\s*command\s*\()\s*(?:Arrays\.asList\s*\(|List\.of\s*\(|Collections\.singletonList\s*\(|new\s+ArrayList\s*(?:<[^>]*>)?\s*\(\s*(?:Arrays\.asList\s*\()?|new\s+String\s*\[\s*\]\s*\{)?\s*"([^"]*)"/;
+function argvFirstLiteralIsShell(lineText) {
+  const m = ARGV_FIRST_LITERAL_RE.exec(lineText);
+  if (!m) return false;
+  const base = m[1].split(/[\\/]/).pop().replace(/\.exe$/i, "").toLowerCase();
+  return SHELL_PROGRAMS.has(base);
+}
 var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b[^;]*;\s*(?:\/\/.*|\/\*.*)?$/;
 var JEXL_ENGINE_TYPES = /* @__PURE__ */ new Set(["JexlEngine", "Jexl", "JxltEngine"]);
 var JEXL_EXPRESSION_TYPE_RE = /(?:Jexl)?(?:Expression|Script|Template)(?:Script)?$/;
@@ -33924,10 +34078,39 @@ function jsSsrfHostGuardedLines(code) {
   }
   return covered;
 }
+var CSHARP_ALLOWLIST_STRIP_RE = /\bRegex\s*\.\s*Replace\s*\([^,]*,\s*@?"\[\^(?:[A-Za-z0-9_\- ]|\\w|\\d|\\s)+\]"\s*,\s*@?"[A-Za-z0-9_]?"\s*\)/;
+function isUnwrittenLocalMapKeyRead(code, source) {
+  if (source.type !== "plugin_param") return false;
+  const lines = code.split("\n");
+  const lineText = lines[source.line - 1] ?? "";
+  const read = /\b([A-Za-z_]\w*)\s*\.\s*get\s*\(\s*"([^"]*)"\s*\)/.exec(lineText);
+  if (!read) return false;
+  const [, recv, key] = read;
+  const ctorRe = new RegExp(
+    `\\b${recv}\\s*=\\s*new\\s+(?:Hash|Tree|LinkedHash|ConcurrentHash|Concurrent|Identity|Weak)?Map\\s*(?:<[^>]*>)?\\s*\\(`
+  );
+  if (!lines.some((l) => ctorRe.test(l))) return false;
+  const escapeRe2 = new RegExp(`\\w\\s*\\([^)]*(?<![\\w.])${recv}(?![\\w.])[^)]*\\)`);
+  for (const l of lines) {
+    if (!escapeRe2.test(l)) continue;
+    const stripped = l.replace(new RegExp(`\\b${recv}\\s*\\.\\s*\\w+\\s*\\(`, "g"), "X(");
+    if (escapeRe2.test(stripped)) return false;
+  }
+  const putRe = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}"`);
+  if (lines.some((l) => putRe.test(l))) return false;
+  return true;
+}
 var CSHARP_SANITIZER_RES = [
   { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: "xss" },
   { re: /\bHtmlEncoder\s*\.\s*Encode\s*\(/, type: "xss" },
-  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" }
+  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" },
+  // An allowlist strip leaves only inert characters, so it covers every family
+  // whose exploitation needs a metacharacter. Each has a fixture; see
+  // `issue-272-csharp-allowlist-strip.test.ts`.
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "ldap_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "xpath_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "command_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "sql_injection" }
 ];
 function csharpSanitizedVarsByType(code) {
   const lines = code.split("\n");
@@ -34169,9 +34352,10 @@ var SinkFilterPass = class {
     const constProp = ctx.getResult("constant-propagation");
     const langSources = ctx.getResult("language-sources");
     const mergedSources = [...taintMatcher.sources, ...langSources.additionalSources];
-    const sources = ctx.code && ctx.language ? mergedSources.filter(
+    const executableSources = ctx.code && ctx.language ? mergedSources.filter(
       (s) => !isNonExecutableSourceLine(ctx.code, s.line, ctx.language)
     ) : mergedSources;
+    const sources = ctx.code ? executableSources.filter((s) => !isUnwrittenLocalMapKeyRead(ctx.code, s)) : executableSources;
     const sinks = [...taintMatcher.sinks];
     for (const s of langSources.additionalSinks) {
       if (!sinks.some((x) => x.line === s.line && x.cwe === s.cwe && x.type === s.type)) {
@@ -34439,10 +34623,19 @@ var SinkFilterPass = class {
       const irTypes = ctx.graph.ir.types;
       filtered = filtered.filter((sink) => {
         if (sink.type !== "command_injection") return true;
-        if (sink.method !== "ProcessBuilder" && sink.method !== "start") return true;
+        if (sink.method !== "ProcessBuilder" && sink.method !== "start" && sink.method !== "command") {
+          return true;
+        }
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText)) return true;
-        if (PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText)) return false;
+        const isCtorLine = /\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText);
+        const isCommandLine = /\.\s*command\s*\(/.test(sinkLineText);
+        if (!isCtorLine && !isCommandLine) return true;
+        if (argvFirstLiteralIsShell(sinkLineText)) return true;
+        if (isCtorLine && PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText)) return false;
+        if (isCommandLine && PROCESS_BUILDER_COMMAND_ARGV_FORM_RE.test(sinkLineText)) {
+          return false;
+        }
+        if (!isCtorLine) return true;
         const ctorCall = irCalls.find(
           (c) => c.method_name === "ProcessBuilder" && c.location.line === sink.line && (c.receiver === null || c.receiver === void 0)
         );
@@ -34746,6 +34939,36 @@ var SinkFilterPass = class {
         return true;
       });
     }
+    if (language === "csharp") {
+      const sourceLines = ctx.code.split("\n");
+      const constBaseClients = /* @__PURE__ */ new Set();
+      const declRe = /\b(?:var|HttpClient)\s+([A-Za-z_]\w*)\s*=\s*new\s+HttpClient\s*\{[^}]*\bBaseAddress\s*=\s*new\s+Uri\s*\(\s*(?:@?"[^"]*"|\$?"[^"{}]*")\s*\)/;
+      for (const line of sourceLines) {
+        const m = declRe.exec(line);
+        if (m) constBaseClients.add(m[1]);
+      }
+      if (constBaseClients.size > 0) {
+        const relativeLiteralArgRe = /\.\s*(?:Get|Post|Put|Patch|Delete|Send|GetString|GetByteArray|GetStream)\w*Async\s*\(\s*(?:@?\$?)"([^"]*)"/;
+        filtered = filtered.filter((sink) => {
+          if (sink.type !== "ssrf") return true;
+          const text = sourceLines[sink.line - 1] ?? "";
+          let onConstClient = false;
+          for (const v of constBaseClients) {
+            if (new RegExp(`(?<![\\w])${escapeRegex(v)}\\s*\\.`).test(text)) {
+              onConstClient = true;
+              break;
+            }
+          }
+          if (!onConstClient) return true;
+          const m = relativeLiteralArgRe.exec(text);
+          if (!m) return true;
+          const lit = m[1];
+          if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(lit)) return true;
+          if (lit.startsWith("//")) return true;
+          return false;
+        });
+      }
+    }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split("\n");
       filtered = filtered.filter((sink) => {
@@ -36983,6 +37206,103 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
   }
   return false;
 }
+var MASKABLE_STRING_LANGUAGES = /* @__PURE__ */ new Set(["python", "javascript", "typescript"]);
+function maskStringLiteralsForTokenScan(expr) {
+  let out2 = "";
+  let i2 = 0;
+  const braceExprs = (body2) => {
+    let acc = "";
+    for (let j = 0; j < body2.length; ) {
+      if (body2[j] === "{" && body2[j + 1] === "{") {
+        j += 2;
+        continue;
+      }
+      if (body2[j] === "}" && body2[j + 1] === "}") {
+        j += 2;
+        continue;
+      }
+      if (body2[j] === "{") {
+        j++;
+        let depth = 1;
+        let inner = "";
+        while (j < body2.length && depth > 0) {
+          if (body2[j] === "{") depth++;
+          else if (body2[j] === "}") {
+            depth--;
+            if (depth === 0) break;
+          }
+          inner += body2[j];
+          j++;
+        }
+        j++;
+        acc += " " + maskStringLiteralsForTokenScan(inner) + " ";
+        continue;
+      }
+      j++;
+    }
+    return acc;
+  };
+  while (i2 < expr.length) {
+    const ch = expr[i2];
+    if (ch === "`") {
+      i2++;
+      let acc = "";
+      while (i2 < expr.length && expr[i2] !== "`") {
+        if (expr[i2] === "\\") {
+          i2 += 2;
+          continue;
+        }
+        if (expr[i2] === "$" && expr[i2 + 1] === "{") {
+          i2 += 2;
+          let depth = 1;
+          let inner = "";
+          while (i2 < expr.length && depth > 0) {
+            if (expr[i2] === "{") depth++;
+            else if (expr[i2] === "}") {
+              depth--;
+              if (depth === 0) break;
+            }
+            inner += expr[i2];
+            i2++;
+          }
+          i2++;
+          acc += " " + maskStringLiteralsForTokenScan(inner) + " ";
+          continue;
+        }
+        i2++;
+      }
+      i2++;
+      out2 += " " + acc + " ";
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      const pm = /[A-Za-z_][A-Za-z0-9_]*$/.exec(out2);
+      const prefix = pm ? pm[0] : "";
+      const isPrefix = prefix.length > 0 && /^[rRbBuUfF]+$/.test(prefix);
+      const isF = isPrefix && /[fF]/.test(prefix);
+      if (isPrefix) out2 = out2.slice(0, out2.length - prefix.length) + " ";
+      const triple = expr.startsWith(ch.repeat(3), i2);
+      const delim = triple ? ch.repeat(3) : ch;
+      i2 += delim.length;
+      let body2 = "";
+      while (i2 < expr.length && !expr.startsWith(delim, i2)) {
+        if (expr[i2] === "\\") {
+          body2 += " ";
+          i2 += 2;
+          continue;
+        }
+        body2 += expr[i2];
+        i2++;
+      }
+      i2 += delim.length;
+      out2 += isF ? " " + braceExprs(body2) + " " : " ";
+      continue;
+    }
+    out2 += ch;
+    i2++;
+  }
+  return out2;
+}
 function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language, types) {
   const flows = [];
   const sourcesWithVar = sources.filter(
@@ -37336,7 +37656,8 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         }
         const expr = arg.expression;
         if (!expr) continue;
-        const exprIdentMatches = expr.match(/[\p{L}\p{N}_]+/gu);
+        const scannable = language !== void 0 && MASKABLE_STRING_LANGUAGES.has(language) ? maskStringLiteralsForTokenScan(expr) : expr;
+        const exprIdentMatches = scannable.match(/[\p{L}\p{N}_]+/gu);
         let candidates = complexSources.length > 0 ? complexSources.slice() : null;
         if (exprIdentMatches) {
           for (const id of new Set(exprIdentMatches)) {
@@ -40575,6 +40896,18 @@ var CRYPTO_BLOCKING_METHODS = /* @__PURE__ */ new Set([
   "deriveKeySync"
 ]);
 var SYNC_SUFFIX_RE2 = /Sync$/;
+var ROUTER_METHODS = /* @__PURE__ */ new Set([
+  "get",
+  "post",
+  "put",
+  "patch",
+  "delete",
+  "all",
+  "options",
+  "head",
+  "use"
+]);
+var FN_ARG_PARAMS_RE = /^(?:async\s+)?(?:function\s*[\w$]*\s*)?\(([^)]*)\)\s*(?:=>|\{)|^(?:async\s+)?([A-Za-z_$][\w$]*)\s*=>/;
 var BlockingMainThreadPass = class {
   name = "blocking-main-thread";
   category = "performance";
@@ -40596,7 +40929,10 @@ var BlockingMainThreadPass = class {
         }
       }
     }
-    if (handlerRanges.length === 0) return { blockingInHandlers: [] };
+    const inlineHandlers = this.collectInlineHandlerNames(graph.ir.calls);
+    if (handlerRanges.length === 0 && inlineHandlers.size === 0) {
+      return { blockingInHandlers: [] };
+    }
     const blockingInHandlers = [];
     for (const call of graph.ir.calls) {
       const name2 = call.method_name;
@@ -40604,7 +40940,8 @@ var BlockingMainThreadPass = class {
       const isSyncSuffix = SYNC_SUFFIX_RE2.test(name2);
       if (!isCrypto && !isSyncSuffix) continue;
       const line = call.location.line;
-      const range = handlerRanges.find((r) => line >= r.start && line <= r.end);
+      const enclosing = call.in_method ?? null;
+      const range = handlerRanges.find((r) => line >= r.start && line <= r.end) ?? (enclosing && inlineHandlers.has(enclosing) ? { start: line, end: line, name: enclosing } : void 0);
       if (!range) continue;
       const reason = isCrypto ? "crypto" : "sync-suffix";
       blockingInHandlers.push({ line, method: name2, handler: range.name, reason });
@@ -40625,6 +40962,40 @@ var BlockingMainThreadPass = class {
     }
     return { blockingInHandlers };
   }
+  /**
+   * Synthetic `<verb>_handler` names that really do belong to an HTTP route.
+   *
+   * The extractor tags *any* function argument of *any* member-expression call
+   * this way, so `items.map(x => …)` becomes `map_handler` and
+   * `cache.get(k, () => …)` becomes `get_handler`. Accepting every
+   * `*_handler` would pull ordinary callbacks into a pass that is explicitly
+   * about the HTTP request path, so two conditions are required: the method is
+   * a router verb, and the callback's own parameters look like a request
+   * handler's — the same `HANDLER_PARAM_NAMES` test used for methods.
+   *
+   * Known limitation: `in_method` carries no receiver, so two callbacks that
+   * share a verb in one file are indistinguishable. A file containing both
+   * `app.get('/x', (req, res) => …)` and `cache.get(k, () => …)` will treat a
+   * blocking call in the second as in-handler. Both conditions still have to
+   * hold for the verb to register at all, which keeps that to files already
+   * mounting a real route of the same verb.
+   */
+  collectInlineHandlerNames(calls) {
+    const names = /* @__PURE__ */ new Set();
+    for (const call of calls) {
+      if (!ROUTER_METHODS.has(call.method_name)) continue;
+      for (const arg of call.arguments) {
+        const match = FN_ARG_PARAMS_RE.exec((arg.expression ?? "").trim());
+        if (!match) continue;
+        const params = (match[1] ?? match[2] ?? "").split(",").map((p) => p.trim().toLowerCase()).filter((p) => p.length > 0);
+        if (params.some((p) => HANDLER_PARAM_NAMES.has(p))) {
+          names.add(`${call.method_name}_handler`);
+          break;
+        }
+      }
+    }
+    return names;
+  }
   isRequestHandler(method) {
     if (method.annotations.some((a) => HTTP_DECORATORS.has(a))) return true;
     if (HANDLER_METHOD_NAMES.has(method.name)) return true;