circle-ir 4.9.28 → 4.10.0

package/dist/core/circle-ir-core.cjs

@@ -4458,7 +4458,7 @@ function detectLanguage(tree) {
   if (pythonScore > jsScore && pythonScore > javaScore) return "python";
   return jsScore > javaScore ? "javascript" : "java";
 }
-function extractTypes(tree, cache, language) {
+function extractTypes(tree, cache, language, options) {
   const effectiveLanguage = language ?? detectLanguage(tree);
   const isJavaScript = effectiveLanguage === "javascript" || effectiveLanguage === "typescript" || effectiveLanguage === "tsx";
   const isPython = effectiveLanguage === "python";
@@ -4478,7 +4478,22 @@ function extractTypes(tree, cache, language) {
   if (effectiveLanguage === "csharp") {
     return extractCSharpTypes(tree, cache);
   }
-  return extractJavaTypes(tree, cache);
+  return extractJavaTypes(tree, cache, options);
+}
+function csharpMemberNodes(body2) {
+  if (!body2) return [];
+  const out2 = [];
+  const visit = (parent, depth) => {
+    if (depth > 32) return;
+    for (let i2 = 0; i2 < parent.childCount; i2++) {
+      const c = parent.child(i2);
+      if (!c) continue;
+      if (c.type.startsWith("preproc_")) visit(c, depth + 1);
+      else out2.push(c);
+    }
+  };
+  visit(body2, 0);
+  return out2;
 }
 function extractCSharpTypes(tree, cache) {
   const types = [];
@@ -4496,9 +4511,8 @@ function extractCSharpTypes(tree, cache) {
       const methods = [];
       const fields = extractCSharpFields(body2);
       if (body2) {
-        for (let i2 = 0; i2 < body2.childCount; i2++) {
-          const m = body2.child(i2);
-          if (!m || m.type !== "method_declaration") continue;
+        for (const m of csharpMemberNodes(body2)) {
+          if (m.type !== "method_declaration") continue;
           const mName = m.childForFieldName("name");
           const paramList = m.childForFieldName("parameters");
           const parameters = [];
@@ -4549,9 +4563,7 @@ function extractCSharpTypes(tree, cache) {
 function extractCSharpFields(body2) {
   const fields = [];
   if (!body2) return fields;
-  for (let i2 = 0; i2 < body2.childCount; i2++) {
-    const c = body2.child(i2);
-    if (!c) continue;
+  for (const c of csharpMemberNodes(body2)) {
     if (c.type === "field_declaration") {
       let varDecl = null;
       for (let k = 0; k < c.childCount; k++) {
@@ -4607,7 +4619,7 @@ function extractCSharpModifiers(node) {
   }
   return mods;
 }
-function extractJavaTypes(tree, cache) {
+function extractJavaTypes(tree, cache, options) {
   const types = [];
   const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
   for (const cls of classes) {
@@ -4621,8 +4633,76 @@ function extractJavaTypes(tree, cache) {
   for (const enumDecl of enums) {
     types.push(extractEnumInfo(enumDecl));
   }
+  if (!options?.navigationTypes) return types;
+  for (const rec of getNodesFromCache(tree.rootNode, "record_declaration", cache)) {
+    const info2 = extractClassInfo(rec);
+    info2.is_record = true;
+    for (const comp of recordComponents(rec)) {
+      if (!info2.fields.some((f) => f.name === comp.name)) {
+        info2.fields.push({
+          name: comp.name,
+          type: comp.type,
+          modifiers: ["private", "final"],
+          annotations: []
+        });
+      }
+      if (!info2.methods.some((m) => m.name === comp.name)) {
+        info2.methods.push({
+          name: comp.name,
+          return_type: comp.type,
+          parameters: [],
+          annotations: [],
+          modifiers: ["public"],
+          start_line: rec.startPosition.row + 1,
+          end_line: rec.startPosition.row + 1
+        });
+      }
+    }
+    types.push(info2);
+  }
+  const declNodes = [
+    ...classes,
+    ...interfaces,
+    ...enums,
+    ...getNodesFromCache(tree.rootNode, "record_declaration", cache)
+  ];
+  for (const t of types) {
+    const node = declNodes.find(
+      (n) => n.startPosition.row + 1 === t.start_line && getIdentifier(n, "name") === t.name
+    );
+    const path = node ? enclosingTypePath(node) : [];
+    if (path.length > 0) t.enclosing_type = path.join(".");
+  }
   return types;
 }
+function recordComponents(node) {
+  const out2 = [];
+  const params = node.childForFieldName("parameters");
+  if (!params) return out2;
+  for (let i2 = 0; i2 < params.childCount; i2++) {
+    const c = params.child(i2);
+    if (!c || c.type !== "formal_parameter") continue;
+    const name2 = c.childForFieldName("name");
+    const type = c.childForFieldName("type");
+    if (name2) out2.push({ name: getNodeText(name2), type: type ? getNodeText(type) : null });
+  }
+  return out2;
+}
+function enclosingTypePath(node) {
+  const DECLS = /* @__PURE__ */ new Set([
+    "class_declaration",
+    "interface_declaration",
+    "enum_declaration",
+    "record_declaration"
+  ]);
+  const path = [];
+  for (let p = node.parent; p; p = p.parent) {
+    if (!DECLS.has(p.type)) continue;
+    const n = getIdentifier(p, "name");
+    if (n) path.unshift(n);
+  }
+  return path;
+}
 function extractJavaScriptTypes(tree, cache) {
   const types = [];
   const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
@@ -6085,6 +6165,13 @@ function extractCalls(tree, cache, language) {
 function buildCSharpReceiverTypeMap(tree, cache) {
   const map = /* @__PURE__ */ new Map();
   const simple = (t) => t.replace(/<[^>]*>/g, "").split(".").pop()?.trim() ?? t;
+  for (const prm of getNodesFromCache(tree.rootNode, "parameter", cache)) {
+    const nameNode = prm.childForFieldName("name");
+    const typeNode = prm.childForFieldName("type");
+    if (nameNode?.type !== "identifier" || !typeNode) continue;
+    const t = getNodeText(typeNode);
+    if (t && t !== "var") map.set(getNodeText(nameNode), simple(t));
+  }
   for (const vd of getNodesFromCache(tree.rootNode, "variable_declaration", cache)) {
     const typeNode = vd.childForFieldName("type");
     const declaredType = typeNode ? getNodeText(typeNode) : null;
@@ -6114,6 +6201,7 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_RESPONSE_TYPES = /* @__PURE__ */ new Set(["HttpResponse", "HttpResponseBase"]);
 var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
   "ExecuteScalar",
   "ExecuteReader",
@@ -6266,7 +6354,8 @@ function extractCSharpCalls(tree, cache) {
       if (recvType !== "DirectorySearcher") continue;
     } else if (propName === "StatusDescription") {
       const recv = exprNode ? getNodeText(exprNode) : "";
-      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv)) continue;
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv) && !(recvType && CSHARP_RESPONSE_TYPES.has(recvType))) continue;
     } else if (propName === "BaseAddress") {
       const recv = exprNode ? getNodeText(exprNode) : null;
       const recvType = recv ? typeMap.get(recv) : void 0;
@@ -11139,6 +11228,23 @@ var DEFAULT_SOURCES = [
   { method: "next", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   { method: "nextInt", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   // Database result sources
+  // C# I/O, network and database reads (cognium-dev#502). Mirrors the Java
+  // rows above one-for-one, including the severity split: console/file I/O is
+  // `io_input` at high, a database row read is `db_input` at medium. There is
+  // no separate confidence tier — `type` + `severity` IS the tier, exactly as
+  // for `BufferedReader.readLine` vs `ResultSet.getString`.
+  { method: "ReadLine", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadLineAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEnd", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEndAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  // Socket and HTTP-client reads. `GetStream` / `AcceptTcpClient` /
+  // `OpenRead` return the channel; the read off it is covered by the
+  // StreamReader rows above, and seeding the channel too lets a flow form when
+  // the read is inlined.
+  { method: "GetStream", class: "TcpClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "AcceptTcpClient", class: "TcpListener", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "OpenRead", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "DownloadString", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
   { method: "getString", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getObject", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getInt", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
@@ -13379,6 +13485,29 @@ var DEFAULT_SINKS = [
   { method: "deserialize", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "from_str", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
   { method: "from_str", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  // cognium-dev#541 — the crates the removed classless rows were silently
+  // covering. #484 replaced a classless `from_str` / `from_slice` with
+  // class-scoped rows, but only for the four formats that already had entries;
+  // every other serde data format lost its sink, and `rmp_serde::from_slice`
+  // on bytes read straight off a `TcpStream` stopped being reported. Each row
+  // below is a serde *data format* entry point — a function whose whole job is
+  // to build a typed value out of untrusted bytes or text.
+  { method: "from_slice", class: "rmp_serde", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_read", class: "rmp_serde", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_read_ref", class: "rmp_serde", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "serde_yaml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_bytes", class: "postcard", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "serde_cbor", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "serde_cbor", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "ciborium", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_str", class: "serde_xml_rs", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "serde_xml_rs", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_str", class: "quick_xml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "quick_xml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
+  { method: "deserialize_from", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   // #294/#484: no classless `from_str` / `from_slice` deserialization sink.
   // Those rows matched EVERY `T::from_str` / `from_slice` — `u32::from_str`,
   // `Url::from_str`, `PublicKey::from_slice` — i.e. ordinary `FromStr` / byte
@@ -13703,8 +13832,12 @@ var DEFAULT_SINKS = [
   { method: "OpenRead", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "OpenWrite", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamReader(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamWriter(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
   // Remaining System.IO.File path APIs — class-scoped so they don't collide
   // with unrelated methods. Copy/Move take a source AND destination path (both
   // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
@@ -13748,6 +13881,23 @@ var DEFAULT_SINKS = [
   // `new RestClient(userUrl)` points every later request at attacker-controlled
   // infrastructure. Ctor arg 0, taint-gated.
   { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# code injection — CodeDOM runtime compilation (CWE-94), cognium-dev#503
+  // part 2. `provider.CompileAssemblyFromSource(parameters, source)` compiles
+  // and can then execute attacker-supplied C#, so the source argument is the
+  // injection point. The signature is
+  // `CompileAssemblyFromSource(CompilerParameters, params string[] sources)`,
+  // so the sources begin at position 1 — position 0 is the options object.
+  //
+  // These rows are only useful together with the #530 StringBuilder
+  // propagation fix: the Juliet CWE-94 corpus accumulates the compiled source
+  // through `sb.Append(...)` and reads it back with `ToString()`, so before
+  // that fix the sink registered but no taint ever reached it.
+  { method: "CompileAssemblyFromSource", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  { method: "CompileAssemblyFromSourceBatch", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  // Roslyn's equivalent pair. `ParseText` turns text into a syntax tree and
+  // `Create` compiles it; either is the point where attacker text becomes code.
+  { method: "ParseText", class: "CSharpSyntaxTree", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ParseText", class: "SyntaxFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -15529,6 +15679,20 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+function argIsStreamExpression(call, position) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg) return false;
+  const expr = (arg.expression ?? "").trim();
+  if (!expr) return false;
+  return (
+    // `new MemoryStream(...)`, `new FileStream(...)`, `new GZipStream(...)`
+    /^new\s+[A-Za-z_][\w.]*Stream\s*\(/.test(expr) || // `tcp.GetStream()`, `resp.GetResponseStream()`, `file.OpenReadStream()`
+    /\.\s*Get(?:Response)?Stream\s*\(/.test(expr) || /\.\s*OpenReadStream\s*\(/.test(expr) || // `wc.OpenRead(url)` returns a Stream (WebClient), as does `File.OpenRead`
+    /\.\s*OpenRead\s*\(/.test(expr) || // `Request.Body`, `x.BaseStream`
+    /\.\s*(?:Body|BaseStream)\s*$/.test(expr) || // a local whose name is stream-ish and is not a path string
+    /^(?:[A-Za-z_]\w*\.)*[A-Za-z_]*[sS]tream\d*$/.test(expr)
+  );
+}
 function argIsStringLiteral(call, position) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg) return false;
@@ -15766,6 +15930,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
           continue;
         }
+        if (pattern.safe_if_stream_arg_at !== void 0 && argIsStreamExpression(call, pattern.safe_if_stream_arg_at)) {
+          continue;
+        }
         if (pattern.type === "command_injection") {
           if (call.is_constructor) {
             if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {

package/dist/core/circle-ir-core.js

@@ -4392,7 +4392,7 @@ function detectLanguage(tree) {
   if (pythonScore > jsScore && pythonScore > javaScore) return "python";
   return jsScore > javaScore ? "javascript" : "java";
 }
-function extractTypes(tree, cache, language) {
+function extractTypes(tree, cache, language, options) {
   const effectiveLanguage = language ?? detectLanguage(tree);
   const isJavaScript = effectiveLanguage === "javascript" || effectiveLanguage === "typescript" || effectiveLanguage === "tsx";
   const isPython = effectiveLanguage === "python";
@@ -4412,7 +4412,22 @@ function extractTypes(tree, cache, language) {
   if (effectiveLanguage === "csharp") {
     return extractCSharpTypes(tree, cache);
   }
-  return extractJavaTypes(tree, cache);
+  return extractJavaTypes(tree, cache, options);
+}
+function csharpMemberNodes(body2) {
+  if (!body2) return [];
+  const out2 = [];
+  const visit = (parent, depth) => {
+    if (depth > 32) return;
+    for (let i2 = 0; i2 < parent.childCount; i2++) {
+      const c = parent.child(i2);
+      if (!c) continue;
+      if (c.type.startsWith("preproc_")) visit(c, depth + 1);
+      else out2.push(c);
+    }
+  };
+  visit(body2, 0);
+  return out2;
 }
 function extractCSharpTypes(tree, cache) {
   const types = [];
@@ -4430,9 +4445,8 @@ function extractCSharpTypes(tree, cache) {
       const methods = [];
       const fields = extractCSharpFields(body2);
       if (body2) {
-        for (let i2 = 0; i2 < body2.childCount; i2++) {
-          const m = body2.child(i2);
-          if (!m || m.type !== "method_declaration") continue;
+        for (const m of csharpMemberNodes(body2)) {
+          if (m.type !== "method_declaration") continue;
           const mName = m.childForFieldName("name");
           const paramList = m.childForFieldName("parameters");
           const parameters = [];
@@ -4483,9 +4497,7 @@ function extractCSharpTypes(tree, cache) {
 function extractCSharpFields(body2) {
   const fields = [];
   if (!body2) return fields;
-  for (let i2 = 0; i2 < body2.childCount; i2++) {
-    const c = body2.child(i2);
-    if (!c) continue;
+  for (const c of csharpMemberNodes(body2)) {
     if (c.type === "field_declaration") {
       let varDecl = null;
       for (let k = 0; k < c.childCount; k++) {
@@ -4541,7 +4553,7 @@ function extractCSharpModifiers(node) {
   }
   return mods;
 }
-function extractJavaTypes(tree, cache) {
+function extractJavaTypes(tree, cache, options) {
   const types = [];
   const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
   for (const cls of classes) {
@@ -4555,8 +4567,76 @@ function extractJavaTypes(tree, cache) {
   for (const enumDecl of enums) {
     types.push(extractEnumInfo(enumDecl));
   }
+  if (!options?.navigationTypes) return types;
+  for (const rec of getNodesFromCache(tree.rootNode, "record_declaration", cache)) {
+    const info2 = extractClassInfo(rec);
+    info2.is_record = true;
+    for (const comp of recordComponents(rec)) {
+      if (!info2.fields.some((f) => f.name === comp.name)) {
+        info2.fields.push({
+          name: comp.name,
+          type: comp.type,
+          modifiers: ["private", "final"],
+          annotations: []
+        });
+      }
+      if (!info2.methods.some((m) => m.name === comp.name)) {
+        info2.methods.push({
+          name: comp.name,
+          return_type: comp.type,
+          parameters: [],
+          annotations: [],
+          modifiers: ["public"],
+          start_line: rec.startPosition.row + 1,
+          end_line: rec.startPosition.row + 1
+        });
+      }
+    }
+    types.push(info2);
+  }
+  const declNodes = [
+    ...classes,
+    ...interfaces,
+    ...enums,
+    ...getNodesFromCache(tree.rootNode, "record_declaration", cache)
+  ];
+  for (const t of types) {
+    const node = declNodes.find(
+      (n) => n.startPosition.row + 1 === t.start_line && getIdentifier(n, "name") === t.name
+    );
+    const path = node ? enclosingTypePath(node) : [];
+    if (path.length > 0) t.enclosing_type = path.join(".");
+  }
   return types;
 }
+function recordComponents(node) {
+  const out2 = [];
+  const params = node.childForFieldName("parameters");
+  if (!params) return out2;
+  for (let i2 = 0; i2 < params.childCount; i2++) {
+    const c = params.child(i2);
+    if (!c || c.type !== "formal_parameter") continue;
+    const name2 = c.childForFieldName("name");
+    const type = c.childForFieldName("type");
+    if (name2) out2.push({ name: getNodeText(name2), type: type ? getNodeText(type) : null });
+  }
+  return out2;
+}
+function enclosingTypePath(node) {
+  const DECLS = /* @__PURE__ */ new Set([
+    "class_declaration",
+    "interface_declaration",
+    "enum_declaration",
+    "record_declaration"
+  ]);
+  const path = [];
+  for (let p = node.parent; p; p = p.parent) {
+    if (!DECLS.has(p.type)) continue;
+    const n = getIdentifier(p, "name");
+    if (n) path.unshift(n);
+  }
+  return path;
+}
 function extractJavaScriptTypes(tree, cache) {
   const types = [];
   const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
@@ -6019,6 +6099,13 @@ function extractCalls(tree, cache, language) {
 function buildCSharpReceiverTypeMap(tree, cache) {
   const map = /* @__PURE__ */ new Map();
   const simple = (t) => t.replace(/<[^>]*>/g, "").split(".").pop()?.trim() ?? t;
+  for (const prm of getNodesFromCache(tree.rootNode, "parameter", cache)) {
+    const nameNode = prm.childForFieldName("name");
+    const typeNode = prm.childForFieldName("type");
+    if (nameNode?.type !== "identifier" || !typeNode) continue;
+    const t = getNodeText(typeNode);
+    if (t && t !== "var") map.set(getNodeText(nameNode), simple(t));
+  }
   for (const vd of getNodesFromCache(tree.rootNode, "variable_declaration", cache)) {
     const typeNode = vd.childForFieldName("type");
     const declaredType = typeNode ? getNodeText(typeNode) : null;
@@ -6048,6 +6135,7 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_RESPONSE_TYPES = /* @__PURE__ */ new Set(["HttpResponse", "HttpResponseBase"]);
 var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
   "ExecuteScalar",
   "ExecuteReader",
@@ -6200,7 +6288,8 @@ function extractCSharpCalls(tree, cache) {
       if (recvType !== "DirectorySearcher") continue;
     } else if (propName === "StatusDescription") {
       const recv = exprNode ? getNodeText(exprNode) : "";
-      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv)) continue;
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv) && !(recvType && CSHARP_RESPONSE_TYPES.has(recvType))) continue;
     } else if (propName === "BaseAddress") {
       const recv = exprNode ? getNodeText(exprNode) : null;
       const recvType = recv ? typeMap.get(recv) : void 0;
@@ -11073,6 +11162,23 @@ var DEFAULT_SOURCES = [
   { method: "next", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   { method: "nextInt", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   // Database result sources
+  // C# I/O, network and database reads (cognium-dev#502). Mirrors the Java
+  // rows above one-for-one, including the severity split: console/file I/O is
+  // `io_input` at high, a database row read is `db_input` at medium. There is
+  // no separate confidence tier — `type` + `severity` IS the tier, exactly as
+  // for `BufferedReader.readLine` vs `ResultSet.getString`.
+  { method: "ReadLine", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadLineAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEnd", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEndAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  // Socket and HTTP-client reads. `GetStream` / `AcceptTcpClient` /
+  // `OpenRead` return the channel; the read off it is covered by the
+  // StreamReader rows above, and seeding the channel too lets a flow form when
+  // the read is inlined.
+  { method: "GetStream", class: "TcpClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "AcceptTcpClient", class: "TcpListener", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "OpenRead", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "DownloadString", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
   { method: "getString", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getObject", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getInt", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
@@ -13313,6 +13419,29 @@ var DEFAULT_SINKS = [
   { method: "deserialize", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "from_str", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
   { method: "from_str", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  // cognium-dev#541 — the crates the removed classless rows were silently
+  // covering. #484 replaced a classless `from_str` / `from_slice` with
+  // class-scoped rows, but only for the four formats that already had entries;
+  // every other serde data format lost its sink, and `rmp_serde::from_slice`
+  // on bytes read straight off a `TcpStream` stopped being reported. Each row
+  // below is a serde *data format* entry point — a function whose whole job is
+  // to build a typed value out of untrusted bytes or text.
+  { method: "from_slice", class: "rmp_serde", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_read", class: "rmp_serde", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_read_ref", class: "rmp_serde", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "serde_yaml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_bytes", class: "postcard", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "serde_cbor", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "serde_cbor", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "ciborium", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_str", class: "serde_xml_rs", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "serde_xml_rs", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_str", class: "quick_xml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "quick_xml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
+  { method: "deserialize_from", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   // #294/#484: no classless `from_str` / `from_slice` deserialization sink.
   // Those rows matched EVERY `T::from_str` / `from_slice` — `u32::from_str`,
   // `Url::from_str`, `PublicKey::from_slice` — i.e. ordinary `FromStr` / byte
@@ -13637,8 +13766,12 @@ var DEFAULT_SINKS = [
   { method: "OpenRead", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "OpenWrite", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamReader(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamWriter(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
   // Remaining System.IO.File path APIs — class-scoped so they don't collide
   // with unrelated methods. Copy/Move take a source AND destination path (both
   // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
@@ -13682,6 +13815,23 @@ var DEFAULT_SINKS = [
   // `new RestClient(userUrl)` points every later request at attacker-controlled
   // infrastructure. Ctor arg 0, taint-gated.
   { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# code injection — CodeDOM runtime compilation (CWE-94), cognium-dev#503
+  // part 2. `provider.CompileAssemblyFromSource(parameters, source)` compiles
+  // and can then execute attacker-supplied C#, so the source argument is the
+  // injection point. The signature is
+  // `CompileAssemblyFromSource(CompilerParameters, params string[] sources)`,
+  // so the sources begin at position 1 — position 0 is the options object.
+  //
+  // These rows are only useful together with the #530 StringBuilder
+  // propagation fix: the Juliet CWE-94 corpus accumulates the compiled source
+  // through `sb.Append(...)` and reads it back with `ToString()`, so before
+  // that fix the sink registered but no taint ever reached it.
+  { method: "CompileAssemblyFromSource", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  { method: "CompileAssemblyFromSourceBatch", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  // Roslyn's equivalent pair. `ParseText` turns text into a syntax tree and
+  // `Create` compiles it; either is the point where attacker text becomes code.
+  { method: "ParseText", class: "CSharpSyntaxTree", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ParseText", class: "SyntaxFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -15463,6 +15613,20 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+function argIsStreamExpression(call, position) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg) return false;
+  const expr = (arg.expression ?? "").trim();
+  if (!expr) return false;
+  return (
+    // `new MemoryStream(...)`, `new FileStream(...)`, `new GZipStream(...)`
+    /^new\s+[A-Za-z_][\w.]*Stream\s*\(/.test(expr) || // `tcp.GetStream()`, `resp.GetResponseStream()`, `file.OpenReadStream()`
+    /\.\s*Get(?:Response)?Stream\s*\(/.test(expr) || /\.\s*OpenReadStream\s*\(/.test(expr) || // `wc.OpenRead(url)` returns a Stream (WebClient), as does `File.OpenRead`
+    /\.\s*OpenRead\s*\(/.test(expr) || // `Request.Body`, `x.BaseStream`
+    /\.\s*(?:Body|BaseStream)\s*$/.test(expr) || // a local whose name is stream-ish and is not a path string
+    /^(?:[A-Za-z_]\w*\.)*[A-Za-z_]*[sS]tream\d*$/.test(expr)
+  );
+}
 function argIsStringLiteral(call, position) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg) return false;
@@ -15700,6 +15864,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
           continue;
         }
+        if (pattern.safe_if_stream_arg_at !== void 0 && argIsStreamExpression(call, pattern.safe_if_stream_arg_at)) {
+          continue;
+        }
         if (pattern.type === "command_injection") {
           if (call.is_constructor) {
             if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {

package/dist/core/extractors/calls.js

@@ -118,6 +118,20 @@ export function extractCalls(tree, cache, language) {
 function buildCSharpReceiverTypeMap(tree, cache) {
     const map = new Map();
     const simple = (t) => t.replace(/<[^>]*>/g, '').split('.').pop()?.trim() ?? t;
+    // cognium-dev#542 — method/constructor parameters. A receiver is just as often a parameter as a
+    // local — `void Bad(HttpRequest req, HttpResponse resp)` is the canonical
+    // ASP.NET handler shape — and omitting them meant every receiver gate keyed on
+    // a declared type silently failed for parameters. Locals below win on a name
+    // clash, since an inner declaration shadows the parameter.
+    for (const prm of getNodesFromCache(tree.rootNode, 'parameter', cache)) {
+        const nameNode = prm.childForFieldName('name');
+        const typeNode = prm.childForFieldName('type');
+        if (nameNode?.type !== 'identifier' || !typeNode)
+            continue;
+        const t = getNodeText(typeNode);
+        if (t && t !== 'var')
+            map.set(getNodeText(nameNode), simple(t));
+    }
     for (const vd of getNodesFromCache(tree.rootNode, 'variable_declaration', cache)) {
         const typeNode = vd.childForFieldName('type');
         const declaredType = typeNode ? getNodeText(typeNode) : null;
@@ -155,6 +169,12 @@ function findFirstDescendant(node, type) {
     }
     return null;
 }
+/**
+ * Declared types that make a receiver an HTTP response. `HttpResponse` is
+ * classic ASP.NET and ASP.NET Core; `HttpResponseBase` is the testable
+ * abstraction MVC hands controllers.
+ */
+const CSHARP_RESPONSE_TYPES = new Set(['HttpResponse', 'HttpResponseBase']);
 /** ADO.NET command-execution methods whose taint rides the receiver object. */
 const CSHARP_COMMAND_EXECUTE_METHODS = new Set([
     'ExecuteScalar', 'ExecuteReader', 'ExecuteNonQuery',
@@ -381,7 +401,15 @@ function extractCSharpCalls(tree, cache) {
             // a Response-shaped name so an unrelated `.StatusDescription =` on some
             // other type is not surfaced.
             const recv = exprNode ? getNodeText(exprNode) : '';
-            if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv))
+            const recvType = recv ? typeMap.get(recv) : undefined;
+            // cognium-dev#542 — two ways to be a response: named like the ASP.NET
+            // intrinsic (`Response`, `Context.Response`), which has no declaration to
+            // resolve, or *declared* as one. Juliet names the parameter `resp`, so the
+            // name test alone scored CWE-81 at 0/9 — the same defect #501 fixed on the
+            // source side, where `HttpRequest req` was missed because it was not
+            // spelled `Request`.
+            if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv)
+                && !(recvType && CSHARP_RESPONSE_TYPES.has(recvType)))
                 continue;
         }
         else if (propName === 'BaseAddress') {