circle-ir 4.9.27 → 4.9.29

package/dist/core/circle-ir-core.cjs

@@ -4480,6 +4480,21 @@ function extractTypes(tree, cache, language) {
   }
   return extractJavaTypes(tree, cache);
 }
+function csharpMemberNodes(body2) {
+  if (!body2) return [];
+  const out2 = [];
+  const visit = (parent, depth) => {
+    if (depth > 32) return;
+    for (let i2 = 0; i2 < parent.childCount; i2++) {
+      const c = parent.child(i2);
+      if (!c) continue;
+      if (c.type.startsWith("preproc_")) visit(c, depth + 1);
+      else out2.push(c);
+    }
+  };
+  visit(body2, 0);
+  return out2;
+}
 function extractCSharpTypes(tree, cache) {
   const types = [];
   const KINDS = {
@@ -4496,9 +4511,8 @@ function extractCSharpTypes(tree, cache) {
       const methods = [];
       const fields = extractCSharpFields(body2);
       if (body2) {
-        for (let i2 = 0; i2 < body2.childCount; i2++) {
-          const m = body2.child(i2);
-          if (!m || m.type !== "method_declaration") continue;
+        for (const m of csharpMemberNodes(body2)) {
+          if (m.type !== "method_declaration") continue;
           const mName = m.childForFieldName("name");
           const paramList = m.childForFieldName("parameters");
           const parameters = [];
@@ -4549,9 +4563,7 @@ function extractCSharpTypes(tree, cache) {
 function extractCSharpFields(body2) {
   const fields = [];
   if (!body2) return fields;
-  for (let i2 = 0; i2 < body2.childCount; i2++) {
-    const c = body2.child(i2);
-    if (!c) continue;
+  for (const c of csharpMemberNodes(body2)) {
     if (c.type === "field_declaration") {
       let varDecl = null;
       for (let k = 0; k < c.childCount; k++) {
@@ -6085,6 +6097,13 @@ function extractCalls(tree, cache, language) {
 function buildCSharpReceiverTypeMap(tree, cache) {
   const map = /* @__PURE__ */ new Map();
   const simple = (t) => t.replace(/<[^>]*>/g, "").split(".").pop()?.trim() ?? t;
+  for (const prm of getNodesFromCache(tree.rootNode, "parameter", cache)) {
+    const nameNode = prm.childForFieldName("name");
+    const typeNode = prm.childForFieldName("type");
+    if (nameNode?.type !== "identifier" || !typeNode) continue;
+    const t = getNodeText(typeNode);
+    if (t && t !== "var") map.set(getNodeText(nameNode), simple(t));
+  }
   for (const vd of getNodesFromCache(tree.rootNode, "variable_declaration", cache)) {
     const typeNode = vd.childForFieldName("type");
     const declaredType = typeNode ? getNodeText(typeNode) : null;
@@ -6114,6 +6133,7 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_RESPONSE_TYPES = /* @__PURE__ */ new Set(["HttpResponse", "HttpResponseBase"]);
 var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
   "ExecuteScalar",
   "ExecuteReader",
@@ -6230,6 +6250,31 @@ function extractCSharpCalls(tree, cache) {
       });
       continue;
     }
+    if (left?.type === "identifier" && asn.parent?.type === "initializer_expression") {
+      const creation = asn.parent.parent;
+      if (creation?.type !== "object_creation_expression") continue;
+      const ctorType = creation.childForFieldName("type");
+      const right2 = asn.childForFieldName("right");
+      if (!ctorType || !right2) continue;
+      const typeName = csharpBareName(ctorType);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: getNodeText(left),
+        receiver: typeName,
+        receiver_type: typeName,
+        receiver_type_fqn: null,
+        arguments: [{
+          position: 0,
+          expression: rhsText2,
+          variable: right2.type === "identifier" ? rhsText2 : null,
+          literal: CSHARP_LITERAL_NODE_TYPES.has(right2.type) ? rhsText2 : null,
+          value: null
+        }],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression") continue;
     const nameNode = left.childForFieldName("name");
     if (!nameNode) continue;
@@ -6239,6 +6284,14 @@ function extractCSharpCalls(tree, cache) {
       const recv = exprNode ? getNodeText(exprNode) : null;
       const recvType = recv ? typeMap.get(recv) : void 0;
       if (recvType !== "DirectorySearcher") continue;
+    } else if (propName === "StatusDescription") {
+      const recv = exprNode ? getNodeText(exprNode) : "";
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv) && !(recvType && CSHARP_RESPONSE_TYPES.has(recvType))) continue;
+    } else if (propName === "BaseAddress") {
+      const recv = exprNode ? getNodeText(exprNode) : null;
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (recvType !== "HttpClient") continue;
     } else if (propName !== "CommandText") {
       continue;
     }
@@ -6261,8 +6314,34 @@ function extractCSharpCalls(tree, cache) {
       in_method: findEnclosingMethod(asn)
     });
   }
+  const casts = getNodesFromCache(tree.rootNode, "cast_expression", cache);
+  for (const cast of casts) {
+    const typeNode = cast.childForFieldName("type");
+    const valueNode = cast.childForFieldName("value");
+    if (!typeNode || !valueNode) continue;
+    const typeName = csharpBareName(typeNode);
+    if (!CSHARP_RAW_MARKUP_CAST_TYPES.has(typeName)) continue;
+    const valueText = getNodeText(valueNode);
+    calls.push({
+      method_name: typeName,
+      receiver: null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: [{
+        position: 0,
+        expression: valueText,
+        variable: valueNode.type === "identifier" ? valueText : null,
+        literal: CSHARP_LITERAL_NODE_TYPES.has(valueNode.type) ? valueText : null,
+        value: null
+      }],
+      location: { line: cast.startPosition.row + 1, column: cast.startPosition.column },
+      in_method: findEnclosingMethod(cast),
+      is_constructor: true
+    });
+  }
   return calls;
 }
+var CSHARP_RAW_MARKUP_CAST_TYPES = /* @__PURE__ */ new Set(["MarkupString"]);
 function extractCSharpArguments(argsNode) {
   const args2 = [];
   let position = 0;
@@ -6282,12 +6361,22 @@ function extractCSharpArguments(argsNode) {
       position: position++,
       expression: text,
       variable: expr?.type === "identifier" ? text : null,
-      literal: expr?.type === "string_literal" ? text : null,
+      literal: expr && CSHARP_LITERAL_NODE_TYPES.has(expr.type) ? text : null,
       value: null
     });
   }
   return args2;
 }
+var CSHARP_LITERAL_NODE_TYPES = /* @__PURE__ */ new Set([
+  "string_literal",
+  "verbatim_string_literal",
+  "raw_string_literal",
+  "character_literal",
+  "integer_literal",
+  "real_literal",
+  "boolean_literal",
+  "null_literal"
+]);
 function extractJavaScriptCalls(tree, cache) {
   const calls = [];
   const context = buildJSResolutionContext(tree, cache);
@@ -11071,6 +11160,23 @@ var DEFAULT_SOURCES = [
   { method: "next", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   { method: "nextInt", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   // Database result sources
+  // C# I/O, network and database reads (cognium-dev#502). Mirrors the Java
+  // rows above one-for-one, including the severity split: console/file I/O is
+  // `io_input` at high, a database row read is `db_input` at medium. There is
+  // no separate confidence tier — `type` + `severity` IS the tier, exactly as
+  // for `BufferedReader.readLine` vs `ResultSet.getString`.
+  { method: "ReadLine", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadLineAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEnd", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEndAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  // Socket and HTTP-client reads. `GetStream` / `AcceptTcpClient` /
+  // `OpenRead` return the channel; the read off it is covered by the
+  // StreamReader rows above, and seeding the channel too lets a flow form when
+  // the read is inlined.
+  { method: "GetStream", class: "TcpClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "AcceptTcpClient", class: "TcpListener", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "OpenRead", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "DownloadString", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
   { method: "getString", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getObject", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getInt", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
@@ -13311,9 +13417,14 @@ var DEFAULT_SINKS = [
   { method: "deserialize", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "from_str", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
   { method: "from_str", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
-  // Generic deserialization patterns
-  { method: "from_str", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
-  { method: "from_slice", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
+  // #294/#484: no classless `from_str` / `from_slice` deserialization sink.
+  // Those rows matched EVERY `T::from_str` / `from_slice` — `u32::from_str`,
+  // `Url::from_str`, `PublicKey::from_slice` — i.e. ordinary `FromStr` / byte
+  // parsing, which cannot instantiate an attacker-chosen type. Removing them
+  // was previously blocked because the class-scoped rows below could not match
+  // the IMPORTED call form (`use serde_json::from_str; from_str(&body)`); the
+  // `::` path-separator fix in taint-matcher.ts makes them match, so the
+  // classless rows are no longer load-bearing.
   // Rust XSS (actix-web, rocket, axum response body)
   { method: "body", class: "HttpResponseBuilder", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "body", class: "HttpResponse", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -13630,8 +13741,12 @@ var DEFAULT_SINKS = [
   { method: "OpenRead", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "OpenWrite", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamReader(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamWriter(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
   // Remaining System.IO.File path APIs — class-scoped so they don't collide
   // with unrelated methods. Copy/Move take a source AND destination path (both
   // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
@@ -13675,6 +13790,23 @@ var DEFAULT_SINKS = [
   // `new RestClient(userUrl)` points every later request at attacker-controlled
   // infrastructure. Ctor arg 0, taint-gated.
   { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# code injection — CodeDOM runtime compilation (CWE-94), cognium-dev#503
+  // part 2. `provider.CompileAssemblyFromSource(parameters, source)` compiles
+  // and can then execute attacker-supplied C#, so the source argument is the
+  // injection point. The signature is
+  // `CompileAssemblyFromSource(CompilerParameters, params string[] sources)`,
+  // so the sources begin at position 1 — position 0 is the options object.
+  //
+  // These rows are only useful together with the #530 StringBuilder
+  // propagation fix: the Juliet CWE-94 corpus accumulates the compiled source
+  // through `sb.Append(...)` and reads it back with `ToString()`, so before
+  // that fix the sink registered but no taint ever reached it.
+  { method: "CompileAssemblyFromSource", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  { method: "CompileAssemblyFromSourceBatch", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  // Roslyn's equivalent pair. `ParseText` turns text into a syntax tree and
+  // `Create` compiles it; either is the point where attacker text becomes code.
+  { method: "ParseText", class: "CSharpSyntaxTree", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ParseText", class: "SyntaxFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -13719,6 +13851,10 @@ var DEFAULT_SINKS = [
   // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
   // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #503 (part 1): `Response.StatusDescription = "Bad " + data` writes
+  // attacker text into the HTTP status line (CWE-81). Surfaced by the
+  // property-assignment synthesiser in the C# extractor, receiver-gated there.
+  { method: "StatusDescription", class: "Response", type: "xss", cwe: "CWE-81", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   // `return Content(html, "text/html")` on a controller writes arg 0 to the
   // response body unescaped (cognium-dev#275). Taint-gated on arg 0; the common
   // `Content(constantString)` and the JSON/plain-text content types are
@@ -13733,6 +13869,12 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #336: a tainted `HttpClient.BaseAddress` gives the attacker the scheme,
+  // host and port of every RELATIVE request made on that client, so the
+  // request arguments can all be constant and the destination still be
+  // attacker-chosen. Surfaced by the property-assignment synthesiser, which
+  // class-gates it to a resolved `HttpClient`.
+  { method: "BaseAddress", class: "HttpClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
   // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
   // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
@@ -15446,6 +15588,20 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+function argIsStreamExpression(call, position) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg) return false;
+  const expr = (arg.expression ?? "").trim();
+  if (!expr) return false;
+  return (
+    // `new MemoryStream(...)`, `new FileStream(...)`, `new GZipStream(...)`
+    /^new\s+[A-Za-z_][\w.]*Stream\s*\(/.test(expr) || // `tcp.GetStream()`, `resp.GetResponseStream()`, `file.OpenReadStream()`
+    /\.\s*Get(?:Response)?Stream\s*\(/.test(expr) || /\.\s*OpenReadStream\s*\(/.test(expr) || // `wc.OpenRead(url)` returns a Stream (WebClient), as does `File.OpenRead`
+    /\.\s*OpenRead\s*\(/.test(expr) || // `Request.Body`, `x.BaseStream`
+    /\.\s*(?:Body|BaseStream)\s*$/.test(expr) || // a local whose name is stream-ish and is not a path string
+    /^(?:[A-Za-z_]\w*\.)*[A-Za-z_]*[sS]tream\d*$/.test(expr)
+  );
+}
 function argIsStringLiteral(call, position) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg) return false;
@@ -15683,6 +15839,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
           continue;
         }
+        if (pattern.safe_if_stream_arg_at !== void 0 && argIsStreamExpression(call, pattern.safe_if_stream_arg_at)) {
+          continue;
+        }
         if (pattern.type === "command_injection") {
           if (call.is_constructor) {
             if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {
@@ -16077,8 +16236,9 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       return false;
     } else if (!call.receiver && !call.receiver_type) {
       const target = call.resolution?.target;
+      const normalisedTarget = language === "rust" ? target?.replace(/::/g, ".") : target;
       const expectedTail = `${pattern.class}.${pattern.method}`;
-      if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {
+      if (normalisedTarget && (normalisedTarget === expectedTail || normalisedTarget.endsWith("." + expectedTail))) {
       } else {
         return false;
       }

package/dist/core/circle-ir-core.js

@@ -4414,6 +4414,21 @@ function extractTypes(tree, cache, language) {
   }
   return extractJavaTypes(tree, cache);
 }
+function csharpMemberNodes(body2) {
+  if (!body2) return [];
+  const out2 = [];
+  const visit = (parent, depth) => {
+    if (depth > 32) return;
+    for (let i2 = 0; i2 < parent.childCount; i2++) {
+      const c = parent.child(i2);
+      if (!c) continue;
+      if (c.type.startsWith("preproc_")) visit(c, depth + 1);
+      else out2.push(c);
+    }
+  };
+  visit(body2, 0);
+  return out2;
+}
 function extractCSharpTypes(tree, cache) {
   const types = [];
   const KINDS = {
@@ -4430,9 +4445,8 @@ function extractCSharpTypes(tree, cache) {
       const methods = [];
       const fields = extractCSharpFields(body2);
       if (body2) {
-        for (let i2 = 0; i2 < body2.childCount; i2++) {
-          const m = body2.child(i2);
-          if (!m || m.type !== "method_declaration") continue;
+        for (const m of csharpMemberNodes(body2)) {
+          if (m.type !== "method_declaration") continue;
           const mName = m.childForFieldName("name");
           const paramList = m.childForFieldName("parameters");
           const parameters = [];
@@ -4483,9 +4497,7 @@ function extractCSharpTypes(tree, cache) {
 function extractCSharpFields(body2) {
   const fields = [];
   if (!body2) return fields;
-  for (let i2 = 0; i2 < body2.childCount; i2++) {
-    const c = body2.child(i2);
-    if (!c) continue;
+  for (const c of csharpMemberNodes(body2)) {
     if (c.type === "field_declaration") {
       let varDecl = null;
       for (let k = 0; k < c.childCount; k++) {
@@ -6019,6 +6031,13 @@ function extractCalls(tree, cache, language) {
 function buildCSharpReceiverTypeMap(tree, cache) {
   const map = /* @__PURE__ */ new Map();
   const simple = (t) => t.replace(/<[^>]*>/g, "").split(".").pop()?.trim() ?? t;
+  for (const prm of getNodesFromCache(tree.rootNode, "parameter", cache)) {
+    const nameNode = prm.childForFieldName("name");
+    const typeNode = prm.childForFieldName("type");
+    if (nameNode?.type !== "identifier" || !typeNode) continue;
+    const t = getNodeText(typeNode);
+    if (t && t !== "var") map.set(getNodeText(nameNode), simple(t));
+  }
   for (const vd of getNodesFromCache(tree.rootNode, "variable_declaration", cache)) {
     const typeNode = vd.childForFieldName("type");
     const declaredType = typeNode ? getNodeText(typeNode) : null;
@@ -6048,6 +6067,7 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_RESPONSE_TYPES = /* @__PURE__ */ new Set(["HttpResponse", "HttpResponseBase"]);
 var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
   "ExecuteScalar",
   "ExecuteReader",
@@ -6164,6 +6184,31 @@ function extractCSharpCalls(tree, cache) {
       });
       continue;
     }
+    if (left?.type === "identifier" && asn.parent?.type === "initializer_expression") {
+      const creation = asn.parent.parent;
+      if (creation?.type !== "object_creation_expression") continue;
+      const ctorType = creation.childForFieldName("type");
+      const right2 = asn.childForFieldName("right");
+      if (!ctorType || !right2) continue;
+      const typeName = csharpBareName(ctorType);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: getNodeText(left),
+        receiver: typeName,
+        receiver_type: typeName,
+        receiver_type_fqn: null,
+        arguments: [{
+          position: 0,
+          expression: rhsText2,
+          variable: right2.type === "identifier" ? rhsText2 : null,
+          literal: CSHARP_LITERAL_NODE_TYPES.has(right2.type) ? rhsText2 : null,
+          value: null
+        }],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression") continue;
     const nameNode = left.childForFieldName("name");
     if (!nameNode) continue;
@@ -6173,6 +6218,14 @@ function extractCSharpCalls(tree, cache) {
       const recv = exprNode ? getNodeText(exprNode) : null;
       const recvType = recv ? typeMap.get(recv) : void 0;
       if (recvType !== "DirectorySearcher") continue;
+    } else if (propName === "StatusDescription") {
+      const recv = exprNode ? getNodeText(exprNode) : "";
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv) && !(recvType && CSHARP_RESPONSE_TYPES.has(recvType))) continue;
+    } else if (propName === "BaseAddress") {
+      const recv = exprNode ? getNodeText(exprNode) : null;
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (recvType !== "HttpClient") continue;
     } else if (propName !== "CommandText") {
       continue;
     }
@@ -6195,8 +6248,34 @@ function extractCSharpCalls(tree, cache) {
       in_method: findEnclosingMethod(asn)
     });
   }
+  const casts = getNodesFromCache(tree.rootNode, "cast_expression", cache);
+  for (const cast of casts) {
+    const typeNode = cast.childForFieldName("type");
+    const valueNode = cast.childForFieldName("value");
+    if (!typeNode || !valueNode) continue;
+    const typeName = csharpBareName(typeNode);
+    if (!CSHARP_RAW_MARKUP_CAST_TYPES.has(typeName)) continue;
+    const valueText = getNodeText(valueNode);
+    calls.push({
+      method_name: typeName,
+      receiver: null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: [{
+        position: 0,
+        expression: valueText,
+        variable: valueNode.type === "identifier" ? valueText : null,
+        literal: CSHARP_LITERAL_NODE_TYPES.has(valueNode.type) ? valueText : null,
+        value: null
+      }],
+      location: { line: cast.startPosition.row + 1, column: cast.startPosition.column },
+      in_method: findEnclosingMethod(cast),
+      is_constructor: true
+    });
+  }
   return calls;
 }
+var CSHARP_RAW_MARKUP_CAST_TYPES = /* @__PURE__ */ new Set(["MarkupString"]);
 function extractCSharpArguments(argsNode) {
   const args2 = [];
   let position = 0;
@@ -6216,12 +6295,22 @@ function extractCSharpArguments(argsNode) {
       position: position++,
       expression: text,
       variable: expr?.type === "identifier" ? text : null,
-      literal: expr?.type === "string_literal" ? text : null,
+      literal: expr && CSHARP_LITERAL_NODE_TYPES.has(expr.type) ? text : null,
       value: null
     });
   }
   return args2;
 }
+var CSHARP_LITERAL_NODE_TYPES = /* @__PURE__ */ new Set([
+  "string_literal",
+  "verbatim_string_literal",
+  "raw_string_literal",
+  "character_literal",
+  "integer_literal",
+  "real_literal",
+  "boolean_literal",
+  "null_literal"
+]);
 function extractJavaScriptCalls(tree, cache) {
   const calls = [];
   const context = buildJSResolutionContext(tree, cache);
@@ -11005,6 +11094,23 @@ var DEFAULT_SOURCES = [
   { method: "next", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   { method: "nextInt", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   // Database result sources
+  // C# I/O, network and database reads (cognium-dev#502). Mirrors the Java
+  // rows above one-for-one, including the severity split: console/file I/O is
+  // `io_input` at high, a database row read is `db_input` at medium. There is
+  // no separate confidence tier — `type` + `severity` IS the tier, exactly as
+  // for `BufferedReader.readLine` vs `ResultSet.getString`.
+  { method: "ReadLine", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadLineAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEnd", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEndAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  // Socket and HTTP-client reads. `GetStream` / `AcceptTcpClient` /
+  // `OpenRead` return the channel; the read off it is covered by the
+  // StreamReader rows above, and seeding the channel too lets a flow form when
+  // the read is inlined.
+  { method: "GetStream", class: "TcpClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "AcceptTcpClient", class: "TcpListener", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "OpenRead", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "DownloadString", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
   { method: "getString", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getObject", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getInt", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
@@ -13245,9 +13351,14 @@ var DEFAULT_SINKS = [
   { method: "deserialize", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "from_str", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
   { method: "from_str", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
-  // Generic deserialization patterns
-  { method: "from_str", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
-  { method: "from_slice", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
+  // #294/#484: no classless `from_str` / `from_slice` deserialization sink.
+  // Those rows matched EVERY `T::from_str` / `from_slice` — `u32::from_str`,
+  // `Url::from_str`, `PublicKey::from_slice` — i.e. ordinary `FromStr` / byte
+  // parsing, which cannot instantiate an attacker-chosen type. Removing them
+  // was previously blocked because the class-scoped rows below could not match
+  // the IMPORTED call form (`use serde_json::from_str; from_str(&body)`); the
+  // `::` path-separator fix in taint-matcher.ts makes them match, so the
+  // classless rows are no longer load-bearing.
   // Rust XSS (actix-web, rocket, axum response body)
   { method: "body", class: "HttpResponseBuilder", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "body", class: "HttpResponse", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -13564,8 +13675,12 @@ var DEFAULT_SINKS = [
   { method: "OpenRead", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "OpenWrite", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamReader(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamWriter(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
   // Remaining System.IO.File path APIs — class-scoped so they don't collide
   // with unrelated methods. Copy/Move take a source AND destination path (both
   // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
@@ -13609,6 +13724,23 @@ var DEFAULT_SINKS = [
   // `new RestClient(userUrl)` points every later request at attacker-controlled
   // infrastructure. Ctor arg 0, taint-gated.
   { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# code injection — CodeDOM runtime compilation (CWE-94), cognium-dev#503
+  // part 2. `provider.CompileAssemblyFromSource(parameters, source)` compiles
+  // and can then execute attacker-supplied C#, so the source argument is the
+  // injection point. The signature is
+  // `CompileAssemblyFromSource(CompilerParameters, params string[] sources)`,
+  // so the sources begin at position 1 — position 0 is the options object.
+  //
+  // These rows are only useful together with the #530 StringBuilder
+  // propagation fix: the Juliet CWE-94 corpus accumulates the compiled source
+  // through `sb.Append(...)` and reads it back with `ToString()`, so before
+  // that fix the sink registered but no taint ever reached it.
+  { method: "CompileAssemblyFromSource", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  { method: "CompileAssemblyFromSourceBatch", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  // Roslyn's equivalent pair. `ParseText` turns text into a syntax tree and
+  // `Create` compiles it; either is the point where attacker text becomes code.
+  { method: "ParseText", class: "CSharpSyntaxTree", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ParseText", class: "SyntaxFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -13653,6 +13785,10 @@ var DEFAULT_SINKS = [
   // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
   // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #503 (part 1): `Response.StatusDescription = "Bad " + data` writes
+  // attacker text into the HTTP status line (CWE-81). Surfaced by the
+  // property-assignment synthesiser in the C# extractor, receiver-gated there.
+  { method: "StatusDescription", class: "Response", type: "xss", cwe: "CWE-81", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   // `return Content(html, "text/html")` on a controller writes arg 0 to the
   // response body unescaped (cognium-dev#275). Taint-gated on arg 0; the common
   // `Content(constantString)` and the JSON/plain-text content types are
@@ -13667,6 +13803,12 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #336: a tainted `HttpClient.BaseAddress` gives the attacker the scheme,
+  // host and port of every RELATIVE request made on that client, so the
+  // request arguments can all be constant and the destination still be
+  // attacker-chosen. Surfaced by the property-assignment synthesiser, which
+  // class-gates it to a resolved `HttpClient`.
+  { method: "BaseAddress", class: "HttpClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
   // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
   // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
@@ -15380,6 +15522,20 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+function argIsStreamExpression(call, position) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg) return false;
+  const expr = (arg.expression ?? "").trim();
+  if (!expr) return false;
+  return (
+    // `new MemoryStream(...)`, `new FileStream(...)`, `new GZipStream(...)`
+    /^new\s+[A-Za-z_][\w.]*Stream\s*\(/.test(expr) || // `tcp.GetStream()`, `resp.GetResponseStream()`, `file.OpenReadStream()`
+    /\.\s*Get(?:Response)?Stream\s*\(/.test(expr) || /\.\s*OpenReadStream\s*\(/.test(expr) || // `wc.OpenRead(url)` returns a Stream (WebClient), as does `File.OpenRead`
+    /\.\s*OpenRead\s*\(/.test(expr) || // `Request.Body`, `x.BaseStream`
+    /\.\s*(?:Body|BaseStream)\s*$/.test(expr) || // a local whose name is stream-ish and is not a path string
+    /^(?:[A-Za-z_]\w*\.)*[A-Za-z_]*[sS]tream\d*$/.test(expr)
+  );
+}
 function argIsStringLiteral(call, position) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg) return false;
@@ -15617,6 +15773,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
           continue;
         }
+        if (pattern.safe_if_stream_arg_at !== void 0 && argIsStreamExpression(call, pattern.safe_if_stream_arg_at)) {
+          continue;
+        }
         if (pattern.type === "command_injection") {
           if (call.is_constructor) {
             if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {
@@ -16011,8 +16170,9 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       return false;
     } else if (!call.receiver && !call.receiver_type) {
       const target = call.resolution?.target;
+      const normalisedTarget = language === "rust" ? target?.replace(/::/g, ".") : target;
       const expectedTail = `${pattern.class}.${pattern.method}`;
-      if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {
+      if (normalisedTarget && (normalisedTarget === expectedTail || normalisedTarget.endsWith("." + expectedTail))) {
       } else {
         return false;
       }