circle-ir 4.9.27 → 4.9.28

package/dist/browser/circle-ir.js

@@ -6184,6 +6184,31 @@ function extractCSharpCalls(tree, cache) {
       });
       continue;
     }
+    if (left?.type === "identifier" && asn.parent?.type === "initializer_expression") {
+      const creation = asn.parent.parent;
+      if (creation?.type !== "object_creation_expression") continue;
+      const ctorType = creation.childForFieldName("type");
+      const right2 = asn.childForFieldName("right");
+      if (!ctorType || !right2) continue;
+      const typeName = csharpBareName(ctorType);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: getNodeText(left),
+        receiver: typeName,
+        receiver_type: typeName,
+        receiver_type_fqn: null,
+        arguments: [{
+          position: 0,
+          expression: rhsText2,
+          variable: right2.type === "identifier" ? rhsText2 : null,
+          literal: CSHARP_LITERAL_NODE_TYPES.has(right2.type) ? rhsText2 : null,
+          value: null
+        }],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression") continue;
     const nameNode = left.childForFieldName("name");
     if (!nameNode) continue;
@@ -6193,6 +6218,13 @@ function extractCSharpCalls(tree, cache) {
       const recv = exprNode ? getNodeText(exprNode) : null;
       const recvType = recv ? typeMap.get(recv) : void 0;
       if (recvType !== "DirectorySearcher") continue;
+    } else if (propName === "StatusDescription") {
+      const recv = exprNode ? getNodeText(exprNode) : "";
+      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv)) continue;
+    } else if (propName === "BaseAddress") {
+      const recv = exprNode ? getNodeText(exprNode) : null;
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (recvType !== "HttpClient") continue;
     } else if (propName !== "CommandText") {
       continue;
     }
@@ -6215,8 +6247,34 @@ function extractCSharpCalls(tree, cache) {
       in_method: findEnclosingMethod(asn)
     });
   }
+  const casts = getNodesFromCache(tree.rootNode, "cast_expression", cache);
+  for (const cast of casts) {
+    const typeNode = cast.childForFieldName("type");
+    const valueNode = cast.childForFieldName("value");
+    if (!typeNode || !valueNode) continue;
+    const typeName = csharpBareName(typeNode);
+    if (!CSHARP_RAW_MARKUP_CAST_TYPES.has(typeName)) continue;
+    const valueText = getNodeText(valueNode);
+    calls.push({
+      method_name: typeName,
+      receiver: null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: [{
+        position: 0,
+        expression: valueText,
+        variable: valueNode.type === "identifier" ? valueText : null,
+        literal: CSHARP_LITERAL_NODE_TYPES.has(valueNode.type) ? valueText : null,
+        value: null
+      }],
+      location: { line: cast.startPosition.row + 1, column: cast.startPosition.column },
+      in_method: findEnclosingMethod(cast),
+      is_constructor: true
+    });
+  }
   return calls;
 }
+var CSHARP_RAW_MARKUP_CAST_TYPES = /* @__PURE__ */ new Set(["MarkupString"]);
 function extractCSharpArguments(argsNode) {
   const args2 = [];
   let position = 0;
@@ -6236,12 +6294,22 @@ function extractCSharpArguments(argsNode) {
       position: position++,
       expression: text,
       variable: expr?.type === "identifier" ? text : null,
-      literal: expr?.type === "string_literal" ? text : null,
+      literal: expr && CSHARP_LITERAL_NODE_TYPES.has(expr.type) ? text : null,
       value: null
     });
   }
   return args2;
 }
+var CSHARP_LITERAL_NODE_TYPES = /* @__PURE__ */ new Set([
+  "string_literal",
+  "verbatim_string_literal",
+  "raw_string_literal",
+  "character_literal",
+  "integer_literal",
+  "real_literal",
+  "boolean_literal",
+  "null_literal"
+]);
 function extractJavaScriptCalls(tree, cache) {
   const calls = [];
   const context = buildJSResolutionContext(tree, cache);
@@ -13892,9 +13960,14 @@ var DEFAULT_SINKS = [
   { method: "deserialize", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "from_str", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
   { method: "from_str", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
-  // Generic deserialization patterns
-  { method: "from_str", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
-  { method: "from_slice", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
+  // #294/#484: no classless `from_str` / `from_slice` deserialization sink.
+  // Those rows matched EVERY `T::from_str` / `from_slice` — `u32::from_str`,
+  // `Url::from_str`, `PublicKey::from_slice` — i.e. ordinary `FromStr` / byte
+  // parsing, which cannot instantiate an attacker-chosen type. Removing them
+  // was previously blocked because the class-scoped rows below could not match
+  // the IMPORTED call form (`use serde_json::from_str; from_str(&body)`); the
+  // `::` path-separator fix in taint-matcher.ts makes them match, so the
+  // classless rows are no longer load-bearing.
   // Rust XSS (actix-web, rocket, axum response body)
   { method: "body", class: "HttpResponseBuilder", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "body", class: "HttpResponse", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -14300,6 +14373,10 @@ var DEFAULT_SINKS = [
   // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
   // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #503 (part 1): `Response.StatusDescription = "Bad " + data` writes
+  // attacker text into the HTTP status line (CWE-81). Surfaced by the
+  // property-assignment synthesiser in the C# extractor, receiver-gated there.
+  { method: "StatusDescription", class: "Response", type: "xss", cwe: "CWE-81", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   // `return Content(html, "text/html")` on a controller writes arg 0 to the
   // response body unescaped (cognium-dev#275). Taint-gated on arg 0; the common
   // `Content(constantString)` and the JSON/plain-text content types are
@@ -14314,6 +14391,12 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #336: a tainted `HttpClient.BaseAddress` gives the attacker the scheme,
+  // host and port of every RELATIVE request made on that client, so the
+  // request arguments can all be constant and the destination still be
+  // attacker-chosen. Surfaced by the property-assignment synthesiser, which
+  // class-gates it to a resolved `HttpClient`.
+  { method: "BaseAddress", class: "HttpClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
   // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
   // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
@@ -16777,8 +16860,9 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       return false;
     } else if (!call.receiver && !call.receiver_type) {
       const target = call.resolution?.target;
+      const normalisedTarget = language === "rust" ? target?.replace(/::/g, ".") : target;
       const expectedTail = `${pattern.class}.${pattern.method}`;
-      if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {
+      if (normalisedTarget && (normalisedTarget === expectedTail || normalisedTarget.endsWith("." + expectedTail))) {
       } else {
         return false;
       }
@@ -19345,6 +19429,122 @@ var GO_PURE_PACKAGES = /* @__PURE__ */ new Set([
   "hex",
   "base64"
 ]);
+var CSHARP_PURE_STATIC_RECEIVERS = /* @__PURE__ */ new Set([
+  // formatting / conversion / parsing — return a derived value
+  "string",
+  "String",
+  "Convert",
+  "Encoding",
+  "BitConverter",
+  "Math",
+  "Int16",
+  "Int32",
+  "Int64",
+  "UInt16",
+  "UInt32",
+  "UInt64",
+  "Double",
+  "Single",
+  "Decimal",
+  "Boolean",
+  "Byte",
+  "SByte",
+  "Char",
+  "Guid",
+  "DateTime",
+  "DateTimeOffset",
+  "TimeSpan",
+  "Enum",
+  "Array",
+  "Buffer",
+  "Nullable",
+  "CultureInfo",
+  "StringComparer",
+  "Comparer",
+  "EqualityComparer",
+  // logging / diagnostics receivers
+  "Console",
+  "Debug",
+  "Trace",
+  "Logger",
+  "logger",
+  "_logger",
+  "Log"
+]);
+var CSHARP_NON_ESCAPE_METHODS = /* @__PURE__ */ new Set([
+  // string / value derivation
+  "ToString",
+  "ToArray",
+  "ToList",
+  "ToCharArray",
+  "GetHashCode",
+  "Equals",
+  "CompareTo",
+  "Trim",
+  "TrimStart",
+  "TrimEnd",
+  "Substring",
+  "Split",
+  "Join",
+  "Concat",
+  "PadLeft",
+  "PadRight",
+  "ToLower",
+  "ToUpper",
+  "ToLowerInvariant",
+  "ToUpperInvariant",
+  "StartsWith",
+  "EndsWith",
+  "Contains",
+  "IndexOf",
+  "LastIndexOf",
+  "Insert",
+  "Remove",
+  "Normalize",
+  "Append",
+  "AppendLine",
+  "AppendFormat",
+  "TryParse",
+  "Parse",
+  // structured logging (Microsoft.Extensions.Logging, Serilog, NLog, log4net)
+  "LogInformation",
+  "LogWarning",
+  "LogError",
+  "LogDebug",
+  "LogTrace",
+  "LogCritical",
+  "Information",
+  "Warning",
+  "Verbose",
+  "Fatal",
+  "BeginScope",
+  // Collection stores. A value put into a container has not left the program —
+  // the same reasoning that puts Go's `append` in GO_BUILTIN_CALLS. Measured
+  // on the 10 scored Juliet C# families these were 1,296 of the 2,368 escape
+  // rows remaining after the first pass of this gate (#474): `Add` 864,
+  // `AddLast` 432.
+  //
+  // Project methods are deliberately NOT gated, matching the Go gate's rule
+  // that an unknown call must still escape: Juliet's own `BadSink` /
+  // `GoodB2GSink` / `Action` dispatches account for a further 840 rows and are
+  // left alone, because "the callee is defined in this file" is a different
+  // claim needing its own change.
+  "Add",
+  "AddLast",
+  "AddFirst",
+  "AddRange",
+  "TryAdd",
+  "Insert",
+  "Push",
+  "Enqueue"
+]);
+function isCSharpNonEscapeCall(call) {
+  const name2 = call.method_name;
+  const recv = (call.receiver ?? "").split(".").pop() ?? "";
+  if (CSHARP_PURE_STATIC_RECEIVERS.has(recv)) return true;
+  if (CSHARP_NON_ESCAPE_METHODS.has(name2)) return true;
+  return false;
+}
 function isGoNonEscapeCall(call) {
   const name2 = call.method_name;
   const recv = (call.receiver ?? "").split(".").pop() ?? "";
@@ -19611,6 +19811,9 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
         if (graph.ir.meta.language === "go" && isGoNonEscapeCall(call)) {
           continue;
         }
+        if (graph.ir.meta.language === "csharp" && isCSharpNonEscapeCall(call)) {
+          continue;
+        }
         const bashSafeBuiltins = /* @__PURE__ */ new Set([
           "echo",
           "printf",
@@ -27786,7 +27989,8 @@ var LanguageSourcesPass = class {
     }
     if (language === "csharp") {
       additionalSanitizers.push(
-        ...findCSharpFullPathStartsWithGuardSanitizers(code)
+        ...findCSharpFullPathStartsWithGuardSanitizers(code),
+        ...findCSharpEarlyReturnGuardSanitizers(code, language)
       );
     }
     if (language === "java") {
@@ -30902,6 +31106,66 @@ function guardRejects(lines, i2, terminatorRe, window2) {
   }
   return false;
 }
+function findCSharpEarlyReturnGuardSanitizers(code, language) {
+  if (language !== "csharp") return [];
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const terminatorRe = /\b(throw|return)\b/;
+  const allowlistRes = [
+    /\bif\s*\(\s*Array\s*\.\s*IndexOf\s*\([^,]+,\s*([A-Za-z_][\w.]*)\s*\)\s*<\s*0\s*\)/,
+    /\bif\s*\(\s*!\s*[A-Za-z_][\w.]*\s*\.\s*Contains\s*\(\s*([A-Za-z_][\w.]*)\s*\)\s*\)/
+  ];
+  const charClassRe = /\bif\s*\(\s*!\s*([A-Za-z_][\w.]*)\s*\.\s*All\s*\(\s*char\s*\.\s*Is[A-Za-z]+\s*\)\s*\)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    let guardedExpr = null;
+    for (const re of allowlistRes) {
+      const m = re.exec(lines[i2]);
+      if (m) {
+        guardedExpr = m[1];
+        break;
+      }
+    }
+    if (!guardedExpr) {
+      const m = charClassRe.exec(lines[i2]);
+      if (m) guardedExpr = m[1];
+    }
+    if (!guardedExpr) continue;
+    if (!guardRejects(lines, i2, terminatorRe, 6)) continue;
+    const root = guardedExpr.split(".")[0];
+    const guarded = /* @__PURE__ */ new Set([guardedExpr, root]);
+    const assignRe = /^\s*(?:(?:var|string)\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+    for (let b = i2 - 1; b >= 0; b--) {
+      const a = assignRe.exec(lines[b]);
+      if (!a || !guarded.has(a[1])) continue;
+      for (const id of a[2].match(/[A-Za-z_]\w*/g) ?? []) guarded.add(id);
+    }
+    const mentions = (t) => {
+      for (const n of guarded) if (new RegExp(`\\b${n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`).test(t)) return true;
+      return false;
+    };
+    for (let l = i2 + 1; l < lines.length; l++) {
+      const a = assignRe.exec(lines[l]);
+      if (a && mentions(a[2])) guarded.add(a[1]);
+      if (mentions(lines[l])) {
+        sanitizers.push({
+          type: "csharp_early_return_guard",
+          method: "guard",
+          line: l + 1,
+          sanitizes: [
+            "ssrf",
+            "xpath_injection",
+            "ldap_injection",
+            "path_traversal",
+            "command_injection",
+            "sql_injection",
+            "external_taint_escape"
+          ]
+        });
+      }
+    }
+  }
+  return sanitizers;
+}
 function findCSharpFullPathStartsWithGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -37299,6 +37563,53 @@ var LibraryProfileXssGatePass = class {
 };
 
 // src/analysis/passes/taint-propagation-pass.ts
+var CONTAINER_READ_SOURCES = /* @__PURE__ */ new Set(["plugin_param", "config_param"]);
+function makeConstPropVeto(constProp, graph, sources, code) {
+  const lines = typeof code === "string" ? code.split("\n") : [];
+  const selfReassign = /* @__PURE__ */ new Map();
+  const escape = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  for (const [line, defs] of graph.defsByLine) {
+    const text = lines[line - 1];
+    if (!text) continue;
+    for (const d of defs) {
+      if (d.kind !== "local" && d.kind !== "param") continue;
+      const v = escape(d.variable);
+      const m = new RegExp(`(?:^|[^\\w.$])${v}\\s*(?:([-+*/%&|^]|<<|>>)=|=(?!=))(.*)$`).exec(text);
+      if (!m) continue;
+      if (m[1] || new RegExp(`(?:^|[^\\w.$])${v}\\b`).test(m[2])) {
+        const arr = selfReassign.get(d.variable) ?? [];
+        arr.push(line);
+        selfReassign.set(d.variable, arr);
+      }
+    }
+  }
+  const reassignedAt = (v, line) => (selfReassign.get(v) ?? []).includes(line);
+  const defAt = (v, line) => {
+    const own = (graph.defsByLine.get(line) ?? []).find((d) => d.variable === v);
+    if (own) return own;
+    const use = (graph.usesByLine.get(line) ?? []).find((u) => u.variable === v && u.def_id != null);
+    return use ? graph.defById.get(use.def_id) : void 0;
+  };
+  return (step, sourceLine, sinkLine) => {
+    const r = isFalsePositive(constProp, step.line, step.variable);
+    if (!r.isFalsePositive) return false;
+    if (r.reason !== "variable_not_tainted") return true;
+    const lo = Math.min(sourceLine, sinkLine);
+    let d = defAt(step.variable, step.line);
+    let selfHops = 0;
+    for (let guard = 0; d && d.line > lo && reassignedAt(d.variable, d.line) && guard < 32; guard++) {
+      const here = d.id;
+      const prior = (graph.usesByLine.get(d.line) ?? []).find((u) => u.variable === d.variable && u.def_id != null && u.def_id !== here);
+      if (!prior) break;
+      selfHops++;
+      d = graph.defById.get(prior.def_id);
+    }
+    if (!d) return true;
+    if (d.line === sourceLine && sources.some((s) => s.line === sourceLine && !CONTAINER_READ_SOURCES.has(s.type))) return false;
+    if (selfHops > 0 && d.line >= lo) return false;
+    return true;
+  };
+}
 var TaintPropagationPass = class {
   name = "taint-propagation";
   category = "security";
@@ -37316,11 +37627,11 @@ var TaintPropagationPass = class {
       return { flows: [] };
     }
     const propagationResult = propagateTaint(graph, sources, sinks, sanitizers);
+    const isVetoed = makeConstPropVeto(constProp, graph, sources, ctx.code);
     const verifiedFlows = propagationResult.flows.filter((flow) => {
       if (constProp.unreachableLines.has(flow.sink.line)) return false;
       for (const step of flow.path) {
-        const fpCheck = isFalsePositive(constProp, step.line, step.variable);
-        if (fpCheck.isFalsePositive) return false;
+        if (isVetoed(step, flow.source.line, flow.sink.line)) return false;
       }
       if (isCorrelatedPredicateFP(constProp, flow)) return false;
       return true;
@@ -37413,7 +37724,7 @@ var TaintPropagationPass = class {
       if (isCorrelatedPredicateFP(constProp, flowForCheck)) continue;
       let isFP = false;
       for (const step of f.path) {
-        if (isFalsePositive(constProp, step.line, step.variable).isFalsePositive) {
+        if (isVetoed(step, f.source_line, f.sink_line)) {
           isFP = true;
           break;
         }
@@ -37436,7 +37747,7 @@ var TaintPropagationPass = class {
       if (isCorrelatedPredicateFP(constProp, flowForCheck)) continue;
       let isFP = false;
       for (const step of f.path) {
-        if (isFalsePositive(constProp, step.line, step.variable).isFalsePositive) {
+        if (isVetoed(step, f.source_line, f.sink_line)) {
           isFP = true;
           break;
         }
@@ -40009,6 +40320,7 @@ var VariableShadowingPass = class {
             const outerEntry = declLocals[0];
             for (let i2 = 1; i2 < numDeclLocals; i2++) {
               const inner = declLocals[i2];
+              if (inner.def.line <= outerEntry.def.line) continue;
               if (!isInNestedScope(codeLines, outerEntry.def.line, inner.def.line)) continue;
               const key = `${variable}-${inner.def.line}`;
               if (reported.has(key)) continue;

package/dist/core/circle-ir-core.cjs

@@ -6230,6 +6230,31 @@ function extractCSharpCalls(tree, cache) {
       });
       continue;
     }
+    if (left?.type === "identifier" && asn.parent?.type === "initializer_expression") {
+      const creation = asn.parent.parent;
+      if (creation?.type !== "object_creation_expression") continue;
+      const ctorType = creation.childForFieldName("type");
+      const right2 = asn.childForFieldName("right");
+      if (!ctorType || !right2) continue;
+      const typeName = csharpBareName(ctorType);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: getNodeText(left),
+        receiver: typeName,
+        receiver_type: typeName,
+        receiver_type_fqn: null,
+        arguments: [{
+          position: 0,
+          expression: rhsText2,
+          variable: right2.type === "identifier" ? rhsText2 : null,
+          literal: CSHARP_LITERAL_NODE_TYPES.has(right2.type) ? rhsText2 : null,
+          value: null
+        }],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression") continue;
     const nameNode = left.childForFieldName("name");
     if (!nameNode) continue;
@@ -6239,6 +6264,13 @@ function extractCSharpCalls(tree, cache) {
       const recv = exprNode ? getNodeText(exprNode) : null;
       const recvType = recv ? typeMap.get(recv) : void 0;
       if (recvType !== "DirectorySearcher") continue;
+    } else if (propName === "StatusDescription") {
+      const recv = exprNode ? getNodeText(exprNode) : "";
+      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv)) continue;
+    } else if (propName === "BaseAddress") {
+      const recv = exprNode ? getNodeText(exprNode) : null;
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (recvType !== "HttpClient") continue;
     } else if (propName !== "CommandText") {
       continue;
     }
@@ -6261,8 +6293,34 @@ function extractCSharpCalls(tree, cache) {
       in_method: findEnclosingMethod(asn)
     });
   }
+  const casts = getNodesFromCache(tree.rootNode, "cast_expression", cache);
+  for (const cast of casts) {
+    const typeNode = cast.childForFieldName("type");
+    const valueNode = cast.childForFieldName("value");
+    if (!typeNode || !valueNode) continue;
+    const typeName = csharpBareName(typeNode);
+    if (!CSHARP_RAW_MARKUP_CAST_TYPES.has(typeName)) continue;
+    const valueText = getNodeText(valueNode);
+    calls.push({
+      method_name: typeName,
+      receiver: null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: [{
+        position: 0,
+        expression: valueText,
+        variable: valueNode.type === "identifier" ? valueText : null,
+        literal: CSHARP_LITERAL_NODE_TYPES.has(valueNode.type) ? valueText : null,
+        value: null
+      }],
+      location: { line: cast.startPosition.row + 1, column: cast.startPosition.column },
+      in_method: findEnclosingMethod(cast),
+      is_constructor: true
+    });
+  }
   return calls;
 }
+var CSHARP_RAW_MARKUP_CAST_TYPES = /* @__PURE__ */ new Set(["MarkupString"]);
 function extractCSharpArguments(argsNode) {
   const args2 = [];
   let position = 0;
@@ -6282,12 +6340,22 @@ function extractCSharpArguments(argsNode) {
       position: position++,
       expression: text,
       variable: expr?.type === "identifier" ? text : null,
-      literal: expr?.type === "string_literal" ? text : null,
+      literal: expr && CSHARP_LITERAL_NODE_TYPES.has(expr.type) ? text : null,
       value: null
     });
   }
   return args2;
 }
+var CSHARP_LITERAL_NODE_TYPES = /* @__PURE__ */ new Set([
+  "string_literal",
+  "verbatim_string_literal",
+  "raw_string_literal",
+  "character_literal",
+  "integer_literal",
+  "real_literal",
+  "boolean_literal",
+  "null_literal"
+]);
 function extractJavaScriptCalls(tree, cache) {
   const calls = [];
   const context = buildJSResolutionContext(tree, cache);
@@ -13311,9 +13379,14 @@ var DEFAULT_SINKS = [
   { method: "deserialize", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "from_str", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
   { method: "from_str", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
-  // Generic deserialization patterns
-  { method: "from_str", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
-  { method: "from_slice", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
+  // #294/#484: no classless `from_str` / `from_slice` deserialization sink.
+  // Those rows matched EVERY `T::from_str` / `from_slice` — `u32::from_str`,
+  // `Url::from_str`, `PublicKey::from_slice` — i.e. ordinary `FromStr` / byte
+  // parsing, which cannot instantiate an attacker-chosen type. Removing them
+  // was previously blocked because the class-scoped rows below could not match
+  // the IMPORTED call form (`use serde_json::from_str; from_str(&body)`); the
+  // `::` path-separator fix in taint-matcher.ts makes them match, so the
+  // classless rows are no longer load-bearing.
   // Rust XSS (actix-web, rocket, axum response body)
   { method: "body", class: "HttpResponseBuilder", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "body", class: "HttpResponse", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -13719,6 +13792,10 @@ var DEFAULT_SINKS = [
   // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
   // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #503 (part 1): `Response.StatusDescription = "Bad " + data` writes
+  // attacker text into the HTTP status line (CWE-81). Surfaced by the
+  // property-assignment synthesiser in the C# extractor, receiver-gated there.
+  { method: "StatusDescription", class: "Response", type: "xss", cwe: "CWE-81", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   // `return Content(html, "text/html")` on a controller writes arg 0 to the
   // response body unescaped (cognium-dev#275). Taint-gated on arg 0; the common
   // `Content(constantString)` and the JSON/plain-text content types are
@@ -13733,6 +13810,12 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #336: a tainted `HttpClient.BaseAddress` gives the attacker the scheme,
+  // host and port of every RELATIVE request made on that client, so the
+  // request arguments can all be constant and the destination still be
+  // attacker-chosen. Surfaced by the property-assignment synthesiser, which
+  // class-gates it to a resolved `HttpClient`.
+  { method: "BaseAddress", class: "HttpClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
   // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
   // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
@@ -16077,8 +16160,9 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       return false;
     } else if (!call.receiver && !call.receiver_type) {
       const target = call.resolution?.target;
+      const normalisedTarget = language === "rust" ? target?.replace(/::/g, ".") : target;
       const expectedTail = `${pattern.class}.${pattern.method}`;
-      if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {
+      if (normalisedTarget && (normalisedTarget === expectedTail || normalisedTarget.endsWith("." + expectedTail))) {
       } else {
         return false;
       }