circle-ir 4.9.28 → 4.9.29

package/dist/browser/circle-ir.js

@@ -4434,6 +4434,21 @@ function extractTypes(tree, cache, language) {
   }
   return extractJavaTypes(tree, cache);
 }
+function csharpMemberNodes(body2) {
+  if (!body2) return [];
+  const out2 = [];
+  const visit = (parent, depth) => {
+    if (depth > 32) return;
+    for (let i2 = 0; i2 < parent.childCount; i2++) {
+      const c = parent.child(i2);
+      if (!c) continue;
+      if (c.type.startsWith("preproc_")) visit(c, depth + 1);
+      else out2.push(c);
+    }
+  };
+  visit(body2, 0);
+  return out2;
+}
 function extractCSharpTypes(tree, cache) {
   const types = [];
   const KINDS = {
@@ -4450,9 +4465,8 @@ function extractCSharpTypes(tree, cache) {
       const methods = [];
       const fields = extractCSharpFields(body2);
       if (body2) {
-        for (let i2 = 0; i2 < body2.childCount; i2++) {
-          const m = body2.child(i2);
-          if (!m || m.type !== "method_declaration") continue;
+        for (const m of csharpMemberNodes(body2)) {
+          if (m.type !== "method_declaration") continue;
           const mName = m.childForFieldName("name");
           const paramList = m.childForFieldName("parameters");
           const parameters = [];
@@ -4503,9 +4517,7 @@ function extractCSharpTypes(tree, cache) {
 function extractCSharpFields(body2) {
   const fields = [];
   if (!body2) return fields;
-  for (let i2 = 0; i2 < body2.childCount; i2++) {
-    const c = body2.child(i2);
-    if (!c) continue;
+  for (const c of csharpMemberNodes(body2)) {
     if (c.type === "field_declaration") {
       let varDecl = null;
       for (let k = 0; k < c.childCount; k++) {
@@ -6039,6 +6051,13 @@ function extractCalls(tree, cache, language) {
 function buildCSharpReceiverTypeMap(tree, cache) {
   const map = /* @__PURE__ */ new Map();
   const simple = (t) => t.replace(/<[^>]*>/g, "").split(".").pop()?.trim() ?? t;
+  for (const prm of getNodesFromCache(tree.rootNode, "parameter", cache)) {
+    const nameNode = prm.childForFieldName("name");
+    const typeNode = prm.childForFieldName("type");
+    if (nameNode?.type !== "identifier" || !typeNode) continue;
+    const t = getNodeText(typeNode);
+    if (t && t !== "var") map.set(getNodeText(nameNode), simple(t));
+  }
   for (const vd of getNodesFromCache(tree.rootNode, "variable_declaration", cache)) {
     const typeNode = vd.childForFieldName("type");
     const declaredType = typeNode ? getNodeText(typeNode) : null;
@@ -6068,6 +6087,7 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_RESPONSE_TYPES = /* @__PURE__ */ new Set(["HttpResponse", "HttpResponseBase"]);
 var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
   "ExecuteScalar",
   "ExecuteReader",
@@ -6220,7 +6240,8 @@ function extractCSharpCalls(tree, cache) {
       if (recvType !== "DirectorySearcher") continue;
     } else if (propName === "StatusDescription") {
       const recv = exprNode ? getNodeText(exprNode) : "";
-      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv)) continue;
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv) && !(recvType && CSHARP_RESPONSE_TYPES.has(recvType))) continue;
     } else if (propName === "BaseAddress") {
       const recv = exprNode ? getNodeText(exprNode) : null;
       const recvType = recv ? typeMap.get(recv) : void 0;
@@ -11720,6 +11741,23 @@ var DEFAULT_SOURCES = [
   { method: "next", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   { method: "nextInt", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   // Database result sources
+  // C# I/O, network and database reads (cognium-dev#502). Mirrors the Java
+  // rows above one-for-one, including the severity split: console/file I/O is
+  // `io_input` at high, a database row read is `db_input` at medium. There is
+  // no separate confidence tier — `type` + `severity` IS the tier, exactly as
+  // for `BufferedReader.readLine` vs `ResultSet.getString`.
+  { method: "ReadLine", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadLineAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEnd", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEndAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  // Socket and HTTP-client reads. `GetStream` / `AcceptTcpClient` /
+  // `OpenRead` return the channel; the read off it is covered by the
+  // StreamReader rows above, and seeding the channel too lets a flow form when
+  // the read is inlined.
+  { method: "GetStream", class: "TcpClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "AcceptTcpClient", class: "TcpListener", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "OpenRead", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "DownloadString", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
   { method: "getString", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getObject", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getInt", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
@@ -14284,8 +14322,12 @@ var DEFAULT_SINKS = [
   { method: "OpenRead", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "OpenWrite", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamReader(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamWriter(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
   // Remaining System.IO.File path APIs — class-scoped so they don't collide
   // with unrelated methods. Copy/Move take a source AND destination path (both
   // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
@@ -14329,6 +14371,23 @@ var DEFAULT_SINKS = [
   // `new RestClient(userUrl)` points every later request at attacker-controlled
   // infrastructure. Ctor arg 0, taint-gated.
   { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# code injection — CodeDOM runtime compilation (CWE-94), cognium-dev#503
+  // part 2. `provider.CompileAssemblyFromSource(parameters, source)` compiles
+  // and can then execute attacker-supplied C#, so the source argument is the
+  // injection point. The signature is
+  // `CompileAssemblyFromSource(CompilerParameters, params string[] sources)`,
+  // so the sources begin at position 1 — position 0 is the options object.
+  //
+  // These rows are only useful together with the #530 StringBuilder
+  // propagation fix: the Juliet CWE-94 corpus accumulates the compiled source
+  // through `sb.Append(...)` and reads it back with `ToString()`, so before
+  // that fix the sink registered but no taint ever reached it.
+  { method: "CompileAssemblyFromSource", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  { method: "CompileAssemblyFromSourceBatch", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  // Roslyn's equivalent pair. `ParseText` turns text into a syntax tree and
+  // `Create` compiles it; either is the point where attacker text becomes code.
+  { method: "ParseText", class: "CSharpSyntaxTree", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ParseText", class: "SyntaxFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -16229,6 +16288,20 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+function argIsStreamExpression(call, position) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg) return false;
+  const expr = (arg.expression ?? "").trim();
+  if (!expr) return false;
+  return (
+    // `new MemoryStream(...)`, `new FileStream(...)`, `new GZipStream(...)`
+    /^new\s+[A-Za-z_][\w.]*Stream\s*\(/.test(expr) || // `tcp.GetStream()`, `resp.GetResponseStream()`, `file.OpenReadStream()`
+    /\.\s*Get(?:Response)?Stream\s*\(/.test(expr) || /\.\s*OpenReadStream\s*\(/.test(expr) || // `wc.OpenRead(url)` returns a Stream (WebClient), as does `File.OpenRead`
+    /\.\s*OpenRead\s*\(/.test(expr) || // `Request.Body`, `x.BaseStream`
+    /\.\s*(?:Body|BaseStream)\s*$/.test(expr) || // a local whose name is stream-ish and is not a path string
+    /^(?:[A-Za-z_]\w*\.)*[A-Za-z_]*[sS]tream\d*$/.test(expr)
+  );
+}
 function argIsStringLiteral(call, position) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg) return false;
@@ -16466,6 +16539,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
           continue;
         }
+        if (pattern.safe_if_stream_arg_at !== void 0 && argIsStreamExpression(call, pattern.safe_if_stream_arg_at)) {
+          continue;
+        }
         if (pattern.type === "command_injection") {
           if (call.is_constructor) {
             if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {
@@ -28647,23 +28723,35 @@ function findCSharpRequestSources(sourceCode, language) {
   const formFileDeclRe = /\bIFormFile\s+([A-Za-z_]\w*)/g;
   const httpRequestReceivers = /* @__PURE__ */ new Set(["Request"]);
   const httpRequestDeclRe = /\b(?:HttpRequest|HttpRequestBase)\??\s+([A-Za-z_]\w*)/g;
+  const streamReaderVars = /* @__PURE__ */ new Set();
+  const streamReaderDeclRe = /\b(?:StreamReader|TextReader|BinaryReader)\??\s+([A-Za-z_]\w*)/g;
+  const dbReaderVars = /* @__PURE__ */ new Set();
+  const dbReaderDeclRe = /\b(?:SqlDataReader|DbDataReader|IDataReader|OdbcDataReader|OleDbDataReader)\??\s+([A-Za-z_]\w*)/g;
   for (const line of lines) {
     const formRe = new RegExp(formFileDeclRe.source, "g");
     let d;
     while ((d = formRe.exec(line)) !== null) formFileParams.add(d[1]);
     const reqRe = new RegExp(httpRequestDeclRe.source, "g");
     while ((d = reqRe.exec(line)) !== null) httpRequestReceivers.add(d[1]);
+    const srRe = new RegExp(streamReaderDeclRe.source, "g");
+    while ((d = srRe.exec(line)) !== null) streamReaderVars.add(d[1]);
+    const dbRe = new RegExp(dbReaderDeclRe.source, "g");
+    while ((d = dbRe.exec(line)) !== null) dbReaderVars.add(d[1]);
   }
+  const streamReadRe = streamReaderVars.size > 0 ? new RegExp(`\\b(?:${[...streamReaderVars].join("|")})\\s*\\.\\s*(?:ReadLine|ReadToEnd|ReadLineAsync|ReadToEndAsync|ReadBlock|Read)\\s*\\(`) : null;
+  const dbReadRe = dbReaderVars.size > 0 ? new RegExp(`\\b(?:${[...dbReaderVars].join("|")})\\s*\\.\\s*(?:GetString|GetValue|GetInt32|GetInt64|GetDecimal|GetDateTime|GetFieldValue|\\[)`) : null;
   const formFileReadRe = formFileParams.size > 0 ? new RegExp(`\\b(?:${[...formFileParams].join("|")})\\s*\\.\\s*(?:FileName|ContentType)\\b`) : null;
   const requestReadRe = new RegExp(
     `\\b(?:${[...httpRequestReceivers].join("|")})\\s*\\.\\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\\b`
   );
-  const classify = (text) => requestReadRe.test(text) ? "http_param" : formFileReadRe?.test(text) ? "http_param" : consoleReadRe.test(text) ? "io_input" : envReadRe.test(text) ? "env_input" : null;
+  const classify = (text) => requestReadRe.test(text) ? "http_param" : formFileReadRe?.test(text) ? "http_param" : consoleReadRe.test(text) ? "io_input" : envReadRe.test(text) ? "env_input" : streamReadRe?.test(text) ? "io_input" : dbReadRe?.test(text) ? "db_input" : null;
   const inlineReads = [
     [requestReadRe, "http_param"],
     [formFileReadRe, "http_param"],
     [consoleReadRe, "io_input"],
-    [envReadRe, "env_input"]
+    [envReadRe, "env_input"],
+    [streamReadRe, "io_input"],
+    [dbReadRe, "db_input"]
   ];
   const inlineRead = (text) => {
     const argsStart = text.indexOf("(");
@@ -28684,7 +28772,8 @@ function findCSharpRequestSources(sourceCode, language) {
   const embeddedAssignRe = /(?:^|[{;])\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*([^;{}]+)/;
   for (let i2 = 0; i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
-    if (!m) {
+    const rhsCrossesBlock = m !== null && m[2].includes("{");
+    if (!m || rhsCrossesBlock) {
       const stmt = lines[i2];
       if (stmt.includes("{") && !/^\s*(?:\/\/|\/\*|\*)/.test(stmt)) {
         const emb = new RegExp(embeddedAssignRe.source, "g");
@@ -28700,7 +28789,8 @@ function findCSharpRequestSources(sourceCode, language) {
           sources.push({
             type: type3,
             location: `${varName2} = ${rhs2.trim().substring(0, 50)}${rhs2.length > 50 ? "..." : ""}`,
-            severity: "high",
+            // #502 — Java parity: a database row read is medium, I/O is high.
+            severity: type3 === "db_input" ? "medium" : "high",
             line: lineNumber3,
             confidence: 1,
             variable: varName2
@@ -28719,7 +28809,7 @@ function findCSharpRequestSources(sourceCode, language) {
       sources.push({
         type: type2,
         location: `${read} in ${code.substring(0, 50)}${code.length > 50 ? "..." : ""}`,
-        severity: "high",
+        severity: type2 === "db_input" ? "medium" : "high",
         line: lineNumber2,
         confidence: 1,
         variable: "<inline>",
@@ -28735,7 +28825,8 @@ function findCSharpRequestSources(sourceCode, language) {
     sources.push({
       type,
       location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? "..." : ""}`,
-      severity: "high",
+      // #502 — Java parity: a database row read is medium, I/O is high.
+      severity: type === "db_input" ? "medium" : "high",
       line: lineNumber,
       confidence: 1,
       variable: varName
@@ -28902,7 +28993,8 @@ function findPythonAssignmentSources(sourceCode, language) {
           sources.push({
             type,
             location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? "..." : ""}`,
-            severity: "high",
+            // #502 — Java parity: a database row read is medium, I/O is high.
+            severity: type === "db_input" ? "medium" : "high",
             line: lineNumber,
             confidence: 0.95,
             variable: varName
@@ -38432,13 +38524,22 @@ function maskStringLiteralsForTokenScan(expr) {
   }
   return out2;
 }
+function argsReferenceTaintedVar(expr, sources) {
+  const codePart = expr.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\n]*/g, " ");
+  return sources.some(
+    (s) => new RegExp(
+      `(?<![\\p{L}\\p{N}_])${s.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\p{L}\\p{N}_])`,
+      "u"
+    ).test(codePart)
+  );
+}
 function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language, types) {
   const flows = [];
-  const goFnRanges = language === "go" && types ? types.flatMap((t) => t.methods.map((m) => [m.start_line, m.end_line])) : [];
-  const goFnStart = (line) => {
+  const methodRanges = (langs) => language && langs.includes(language) && types ? types.flatMap((t) => t.methods.map((m) => [m.start_line, m.end_line])) : [];
+  const enclosingStart = (ranges, line) => {
     let best = -1;
     let bestSpan = -1;
-    for (const [start2, end] of goFnRanges) {
+    for (const [start2, end] of ranges) {
       if (line >= start2 && line <= end && end - start2 > bestSpan) {
         best = start2;
         bestSpan = end - start2;
@@ -38446,6 +38547,10 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     }
     return best;
   };
+  const goFnRanges = methodRanges(["go"]);
+  const goFnStart = (line) => enclosingStart(goFnRanges, line);
+  const csFnRanges = methodRanges(["csharp"]);
+  const csFnStart = (line) => enclosingStart(csFnRanges, line);
   const sourcesWithVar = sources.filter(
     (s) => typeof s.variable === "string" && s.variable.length > 0
   );
@@ -38747,16 +38852,47 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         if (!m) continue;
         const [, obj, rhs] = m;
         if (known.has(obj)) continue;
-        const codePart = rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ");
-        const rhsTainted = sourcesWithVar.some(
-          (s) => new RegExp(`(?<![\\p{L}\\p{N}_])${s.variable.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}(?![\\p{L}\\p{N}_])`, "u").test(codePart)
-        );
-        if (!rhsTainted) continue;
+        if (!argsReferenceTaintedVar(rhs, sourcesWithVar)) continue;
         sourcesWithVar.push({ ...anchor, variable: obj, line: i2 + 1 });
         added = true;
       }
     }
   }
+  const builderSeeds = /* @__PURE__ */ new Set();
+  if (language === "csharp" && typeof code === "string" && sourcesWithVar.length > 0) {
+    const lines = code.split("\n");
+    const builders = /* @__PURE__ */ new Set();
+    for (const line of lines) {
+      for (const m of line.matchAll(/\bStringBuilder\s+([\p{L}_][\p{L}\p{N}_]*)/gu)) builders.add(m[1]);
+      for (const m of line.matchAll(/\b([\p{L}_][\p{L}\p{N}_]*)\s*=\s*new\s+StringBuilder\b/gu)) builders.add(m[1]);
+    }
+    if (builders.size > 0) {
+      const appendRe = /([\p{L}_][\p{L}\p{N}_]*)\s*\.\s*(?:Append|AppendLine|AppendFormat|Insert)\s*\(([\s\S]*)/u;
+      const anchor = sourcesWithVar.reduce((a, s) => s.line < a.line ? s : a, sourcesWithVar[0]);
+      let added = true;
+      let guard = 0;
+      while (added && guard < lines.length + 2) {
+        added = false;
+        guard++;
+        const known = new Set(sourcesWithVar.map((s) => s.variable));
+        for (let i2 = 0; i2 < lines.length; i2++) {
+          const m = appendRe.exec(lines[i2]);
+          if (!m) continue;
+          const [, obj, args2] = m;
+          if (!builders.has(obj) || known.has(obj)) continue;
+          const appendFn = csFnStart(i2 + 1);
+          const reachable = sourcesWithVar.filter(
+            (sv) => appendFn === -1 || csFnStart(sv.line) === -1 || csFnStart(sv.line) === appendFn
+          );
+          if (reachable.length > 0 && argsReferenceTaintedVar(args2, reachable)) {
+            sourcesWithVar.push({ ...anchor, variable: obj, line: i2 + 1 });
+            builderSeeds.add(`${obj}@${i2 + 1}`);
+            added = true;
+          }
+        }
+      }
+    }
+  }
   const SIMPLE_IDENT = /^[\p{L}\p{N}_]+$/u;
   const reCache = /* @__PURE__ */ new Map();
   for (const s of sourcesWithVar) {
@@ -38819,6 +38955,11 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             const sinkFn = goFnStart(sink.line);
             if (srcFn !== -1 && sinkFn !== -1 && srcFn !== sinkFn) continue;
           }
+          if (csFnRanges.length > 0 && builderSeeds.has(`${source.variable}@${source.line}`)) {
+            const srcFn = csFnStart(source.line);
+            const sinkFn = csFnStart(sink.line);
+            if (srcFn !== sinkFn) continue;
+          }
           if (complex) {
             const re = reCache.get(source.variable);
             if (!re || !re.test(expr)) continue;

package/dist/core/circle-ir-core.cjs

@@ -4480,6 +4480,21 @@ function extractTypes(tree, cache, language) {
   }
   return extractJavaTypes(tree, cache);
 }
+function csharpMemberNodes(body2) {
+  if (!body2) return [];
+  const out2 = [];
+  const visit = (parent, depth) => {
+    if (depth > 32) return;
+    for (let i2 = 0; i2 < parent.childCount; i2++) {
+      const c = parent.child(i2);
+      if (!c) continue;
+      if (c.type.startsWith("preproc_")) visit(c, depth + 1);
+      else out2.push(c);
+    }
+  };
+  visit(body2, 0);
+  return out2;
+}
 function extractCSharpTypes(tree, cache) {
   const types = [];
   const KINDS = {
@@ -4496,9 +4511,8 @@ function extractCSharpTypes(tree, cache) {
       const methods = [];
       const fields = extractCSharpFields(body2);
       if (body2) {
-        for (let i2 = 0; i2 < body2.childCount; i2++) {
-          const m = body2.child(i2);
-          if (!m || m.type !== "method_declaration") continue;
+        for (const m of csharpMemberNodes(body2)) {
+          if (m.type !== "method_declaration") continue;
           const mName = m.childForFieldName("name");
           const paramList = m.childForFieldName("parameters");
           const parameters = [];
@@ -4549,9 +4563,7 @@ function extractCSharpTypes(tree, cache) {
 function extractCSharpFields(body2) {
   const fields = [];
   if (!body2) return fields;
-  for (let i2 = 0; i2 < body2.childCount; i2++) {
-    const c = body2.child(i2);
-    if (!c) continue;
+  for (const c of csharpMemberNodes(body2)) {
     if (c.type === "field_declaration") {
       let varDecl = null;
       for (let k = 0; k < c.childCount; k++) {
@@ -6085,6 +6097,13 @@ function extractCalls(tree, cache, language) {
 function buildCSharpReceiverTypeMap(tree, cache) {
   const map = /* @__PURE__ */ new Map();
   const simple = (t) => t.replace(/<[^>]*>/g, "").split(".").pop()?.trim() ?? t;
+  for (const prm of getNodesFromCache(tree.rootNode, "parameter", cache)) {
+    const nameNode = prm.childForFieldName("name");
+    const typeNode = prm.childForFieldName("type");
+    if (nameNode?.type !== "identifier" || !typeNode) continue;
+    const t = getNodeText(typeNode);
+    if (t && t !== "var") map.set(getNodeText(nameNode), simple(t));
+  }
   for (const vd of getNodesFromCache(tree.rootNode, "variable_declaration", cache)) {
     const typeNode = vd.childForFieldName("type");
     const declaredType = typeNode ? getNodeText(typeNode) : null;
@@ -6114,6 +6133,7 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_RESPONSE_TYPES = /* @__PURE__ */ new Set(["HttpResponse", "HttpResponseBase"]);
 var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
   "ExecuteScalar",
   "ExecuteReader",
@@ -6266,7 +6286,8 @@ function extractCSharpCalls(tree, cache) {
       if (recvType !== "DirectorySearcher") continue;
     } else if (propName === "StatusDescription") {
       const recv = exprNode ? getNodeText(exprNode) : "";
-      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv)) continue;
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv) && !(recvType && CSHARP_RESPONSE_TYPES.has(recvType))) continue;
     } else if (propName === "BaseAddress") {
       const recv = exprNode ? getNodeText(exprNode) : null;
       const recvType = recv ? typeMap.get(recv) : void 0;
@@ -11139,6 +11160,23 @@ var DEFAULT_SOURCES = [
   { method: "next", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   { method: "nextInt", class: "Scanner", type: "io_input", severity: "high", return_tainted: true },
   // Database result sources
+  // C# I/O, network and database reads (cognium-dev#502). Mirrors the Java
+  // rows above one-for-one, including the severity split: console/file I/O is
+  // `io_input` at high, a database row read is `db_input` at medium. There is
+  // no separate confidence tier — `type` + `severity` IS the tier, exactly as
+  // for `BufferedReader.readLine` vs `ResultSet.getString`.
+  { method: "ReadLine", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadLineAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEnd", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "ReadToEndAsync", class: "StreamReader", type: "io_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  // Socket and HTTP-client reads. `GetStream` / `AcceptTcpClient` /
+  // `OpenRead` return the channel; the read off it is covered by the
+  // StreamReader rows above, and seeding the channel too lets a flow form when
+  // the read is inlined.
+  { method: "GetStream", class: "TcpClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "AcceptTcpClient", class: "TcpListener", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "OpenRead", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
+  { method: "DownloadString", class: "WebClient", type: "network_input", severity: "high", return_tainted: true, languages: ["csharp"] },
   { method: "getString", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getObject", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
   { method: "getInt", class: "ResultSet", type: "db_input", severity: "medium", return_tainted: true },
@@ -13703,8 +13741,12 @@ var DEFAULT_SINKS = [
   { method: "OpenRead", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "OpenWrite", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
-  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamReader(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
+  // #502: the `(Stream)` overload takes no path — `new StreamWriter(tcp.GetStream())`
+  // is not CWE-22. The `(string path)` overload still matches.
+  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], safe_if_stream_arg_at: 0, languages: ["csharp"] },
   // Remaining System.IO.File path APIs — class-scoped so they don't collide
   // with unrelated methods. Copy/Move take a source AND destination path (both
   // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
@@ -13748,6 +13790,23 @@ var DEFAULT_SINKS = [
   // `new RestClient(userUrl)` points every later request at attacker-controlled
   // infrastructure. Ctor arg 0, taint-gated.
   { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# code injection — CodeDOM runtime compilation (CWE-94), cognium-dev#503
+  // part 2. `provider.CompileAssemblyFromSource(parameters, source)` compiles
+  // and can then execute attacker-supplied C#, so the source argument is the
+  // injection point. The signature is
+  // `CompileAssemblyFromSource(CompilerParameters, params string[] sources)`,
+  // so the sources begin at position 1 — position 0 is the options object.
+  //
+  // These rows are only useful together with the #530 StringBuilder
+  // propagation fix: the Juliet CWE-94 corpus accumulates the compiled source
+  // through `sb.Append(...)` and reads it back with `ToString()`, so before
+  // that fix the sink registered but no taint ever reached it.
+  { method: "CompileAssemblyFromSource", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  { method: "CompileAssemblyFromSourceBatch", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1, 2], languages: ["csharp"] },
+  // Roslyn's equivalent pair. `ParseText` turns text into a syntax tree and
+  // `Create` compiles it; either is the point where attacker text becomes code.
+  { method: "ParseText", class: "CSharpSyntaxTree", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ParseText", class: "SyntaxFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -15529,6 +15588,20 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+function argIsStreamExpression(call, position) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg) return false;
+  const expr = (arg.expression ?? "").trim();
+  if (!expr) return false;
+  return (
+    // `new MemoryStream(...)`, `new FileStream(...)`, `new GZipStream(...)`
+    /^new\s+[A-Za-z_][\w.]*Stream\s*\(/.test(expr) || // `tcp.GetStream()`, `resp.GetResponseStream()`, `file.OpenReadStream()`
+    /\.\s*Get(?:Response)?Stream\s*\(/.test(expr) || /\.\s*OpenReadStream\s*\(/.test(expr) || // `wc.OpenRead(url)` returns a Stream (WebClient), as does `File.OpenRead`
+    /\.\s*OpenRead\s*\(/.test(expr) || // `Request.Body`, `x.BaseStream`
+    /\.\s*(?:Body|BaseStream)\s*$/.test(expr) || // a local whose name is stream-ish and is not a path string
+    /^(?:[A-Za-z_]\w*\.)*[A-Za-z_]*[sS]tream\d*$/.test(expr)
+  );
+}
 function argIsStringLiteral(call, position) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg) return false;
@@ -15766,6 +15839,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
           continue;
         }
+        if (pattern.safe_if_stream_arg_at !== void 0 && argIsStreamExpression(call, pattern.safe_if_stream_arg_at)) {
+          continue;
+        }
         if (pattern.type === "command_injection") {
           if (call.is_constructor) {
             if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {