circle-ir 4.9.8 → 4.9.10

package/dist/browser/circle-ir.js

@@ -6003,6 +6003,26 @@ var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
   "ExecuteReaderAsync",
   "ExecuteNonQueryAsync"
 ]);
+var CSHARP_RECEIVER_URL_METHODS = /* @__PURE__ */ new Set([
+  "GetAsync",
+  "PostAsync",
+  "PutAsync",
+  "PatchAsync",
+  "DeleteAsync",
+  "HeadAsync",
+  "GetStringAsync",
+  "GetByteArrayAsync",
+  "GetStreamAsync",
+  "GetJsonAsync"
+]);
+var CSHARP_HEADER_RECEIVER_RE = /(^|\.)Headers$/;
+function csharpBareName(node) {
+  if (node.type === "generic_name") {
+    const id = node.childForFieldName("name") ?? node.namedChild(0);
+    if (id) return getNodeText(id);
+  }
+  return getNodeText(node);
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -6014,16 +6034,22 @@ function extractCSharpCalls(tree, cache) {
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
-      methodName = nameNode ? getNodeText(nameNode) : "unknown";
+      methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
     } else if (fn) {
-      methodName = getNodeText(fn);
+      methodName = csharpBareName(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
     let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
     if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
       args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
     }
+    if (methodName === "Add" && receiver && CSHARP_HEADER_RECEIVER_RE.test(receiver)) {
+      methodName = "AddHeader";
+    }
+    if (receiver && args2.length === 0 && CSHARP_RECEIVER_URL_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }];
+    }
     calls.push({
       method_name: methodName,
       receiver,
@@ -6039,7 +6065,7 @@ function extractCSharpCalls(tree, cache) {
     const typeNode = creation.childForFieldName("type");
     const argsNode = creation.childForFieldName("arguments");
     calls.push({
-      method_name: typeNode ? getNodeText(typeNode) : "unknown",
+      method_name: typeNode ? csharpBareName(typeNode) : "unknown",
       receiver: null,
       receiver_type: null,
       receiver_type_fqn: null,
@@ -6052,6 +6078,39 @@ function extractCSharpCalls(tree, cache) {
   const assignments = getNodesFromCache(tree.rootNode, "assignment_expression", cache);
   for (const asn of assignments) {
     const left = asn.childForFieldName("left");
+    if (left?.type === "element_access_expression") {
+      const target = left.childForFieldName("expression");
+      const right2 = asn.childForFieldName("right");
+      if (!target || !right2) continue;
+      if (!CSHARP_HEADER_RECEIVER_RE.test(getNodeText(target))) continue;
+      const subscript = left.childForFieldName("subscript") ?? left.namedChild(1);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: "AddHeader",
+        receiver: getNodeText(target),
+        receiver_type: null,
+        receiver_type_fqn: null,
+        arguments: [
+          {
+            position: 0,
+            expression: subscript ? getNodeText(subscript) : "",
+            variable: null,
+            literal: subscript ? getNodeText(subscript) : null,
+            value: null
+          },
+          {
+            position: 1,
+            expression: rhsText2,
+            variable: right2.type === "identifier" ? rhsText2 : null,
+            literal: right2.type === "string_literal" ? rhsText2 : null,
+            value: null
+          }
+        ],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression") continue;
     const nameNode = left.childForFieldName("name");
     if (!nameNode) continue;
@@ -13922,6 +13981,23 @@ var DEFAULT_SINKS = [
   { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // Dapper micro-ORM (cognium-dev#275). Every Dapper entry point is an
+  // `IDbConnection` extension whose arg 0 is raw SQL text — `conn.Query<T>(sql)`
+  // is exactly as injectable as `new SqlCommand(sql)`. Taint-gated on arg 0, so
+  // a constant/interpolation-free query never fires, and a same-named method on
+  // an unrelated receiver (e.g. RestSharp's `client.Execute(request)`, whose
+  // arg 0 is a request object rather than a tainted string) stays clean.
+  { method: "Query", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirst", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefaultAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingle", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingleOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryMultiple", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Execute", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // ADO.NET `cmd.CommandText = "…" + x` — emitted as a synthetic call by
   // extractCSharpCalls (property-assignment sink; the ctor-arg sink misses it).
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -13987,12 +14063,23 @@ var DEFAULT_SINKS = [
   { method: "DeleteAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStringAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetByteArrayAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // Remaining HttpClient/Flurl verbs (cognium-dev#275). For HttpClient these
+  // take the URL at arg 0; for Flurl's fluent form the receiver is surfaced as
+  // arg 0 by CSHARP_RECEIVER_URL_METHODS. Taint-gated either way.
+  // (GetStreamAsync / PutAsync / DeleteAsync are already registered below.)
+  { method: "GetJsonAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PatchAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "HeadAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStreamAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SendAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadString", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadData", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadFile", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1], languages: ["csharp"] },
   { method: "Create", class: "WebRequest", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // RestSharp (cognium-dev#275) — the base URL is fixed at construction, so
+  // `new RestClient(userUrl)` points every later request at attacker-controlled
+  // infrastructure. Ctor arg 0, taint-gated.
+  { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -14032,6 +14119,11 @@ var DEFAULT_SINKS = [
   // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
   // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // `return Content(html, "text/html")` on a controller writes arg 0 to the
+  // response body unescaped (cognium-dev#275). Taint-gated on arg 0; the common
+  // `Content(constantString)` and the JSON/plain-text content types are
+  // unaffected because a constant argument carries no taint.
+  { method: "Content", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // `String.Format(fmt, …)` with an attacker-controlled FORMAT string — CWE-134.
   // Taint-gated on arg 0 (the format), so ordinary `String.Format("...", user)` where
   // only an argument is tainted never fires. .NET composite formatting can't corrupt
@@ -14057,6 +14149,10 @@ var DEFAULT_SINKS = [
   // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
   // attacker-controlled query document. Class-scoped (static receiver resolves).
   { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // `new BsonJavaScript(userCode)` wraps a server-side JS string — the payload
+  // MongoDB's `$where` / `$function` operators execute. Unconditionally
+  // dangerous when tainted, so no literal gating is needed (cognium-dev#275).
+  { method: "BsonJavaScript", class: "constructor", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# log injection — Microsoft.Extensions.Logging `ILogger` (CWE-117,
   // cognium-ai#318). Only the message TEMPLATE (arg[0]) is the injectable
   // position; the structured form `LogInformation("… {Id}", id)` keeps taint in
@@ -14068,6 +14164,16 @@ var DEFAULT_SINKS = [
   { method: "LogDebug", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogCritical", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogTrace", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  // C# ReDoS (CWE-1333, cognium-dev#275). The injectable position is the
+  // PATTERN, not the input: a user-supplied regex can be crafted with
+  // catastrophic backtracking. `Regex.IsMatch(input, pattern)` and friends take
+  // the pattern at arg 1; the `new Regex(pattern)` ctor takes it at arg 0. A
+  // tainted *input* with a constant pattern is not ReDoS and does not fire.
+  { method: "IsMatch", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Match", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Matches", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Replace", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Regex", class: "constructor", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   // Generic `ILogger.Log(logLevel, message, …)` — class-scoped (`Log` alone is
   // too generic); the message is arg[1].
   { method: "Log", class: "ILogger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1], languages: ["csharp"] },
@@ -14326,6 +14432,15 @@ var DEFAULT_SANITIZERS = [
   // this table; the drift surfaced as a SecuriBench Micro FP on
   // `sanitizers/Sanitizers3.java` (`URLEncoder.encode` + `sendRedirect`).
   { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
+  // ASP.NET Core local-redirect guards (cognium-dev#275). `Url.IsLocalUrl(x)`
+  // returns false for any absolute/scheme-relative URL, so a `Redirect(x)` gated
+  // on it cannot leave the site — without this credit the guarded form is a
+  // false positive. `LocalRedirect(x)` is the same check applied by the
+  // framework itself: it THROWS on a non-local URL, which is why it is
+  // deliberately not registered as an open_redirect sink. Recording it here
+  // states that intent in the model rather than leaving it as a silent omission.
+  { method: "IsLocalUrl", removes: ["open_redirect"] },
+  { method: "LocalRedirect", removes: ["open_redirect"] },
   // URL encoding wrapper aliases (common patterns in benchmarks and real-world code)
   { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },
@@ -15562,15 +15677,25 @@ function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
 function stripCsLiterals(line) {
   return line.replace(/\/\/.*$/, "").replace(/@?"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)'/g, "''");
 }
+var _csDepthLines;
+var _csDepthPrefix;
 function csBraceDepthBefore(lines, idx) {
-  let depth = 0;
-  for (let i2 = 0; i2 < idx && i2 < lines.length; i2++) {
-    for (const ch of stripCsLiterals(lines[i2])) {
-      if (ch === "{") depth++;
-      else if (ch === "}") depth--;
+  if (lines !== _csDepthLines) {
+    const pref = new Int32Array(lines.length + 1);
+    let depth = 0;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      pref[i2] = depth;
+      for (const ch of stripCsLiterals(lines[i2])) {
+        if (ch === "{") depth++;
+        else if (ch === "}") depth--;
+      }
     }
+    pref[lines.length] = depth;
+    _csDepthLines = lines;
+    _csDepthPrefix = pref;
   }
-  return depth;
+  const clamped = idx < 0 ? 0 : idx > lines.length ? lines.length : idx;
+  return _csDepthPrefix[clamped];
 }
 function netBraces(fragment) {
   let n = 0;
@@ -15667,6 +15792,30 @@ function csThenBlock(lines, ifIdx, rest) {
   }
   return { start: ifIdx, end: firstIdx, earlyExit: isExit(firstText.trim()) };
 }
+var _csGuardLines;
+var _csGuardMap;
+function csEqualityGuardIndex(lines) {
+  if (lines === _csGuardLines && _csGuardMap) return _csGuardMap;
+  const map = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const parts2 = splitCsIf(lines[i2]);
+    if (!parts2) continue;
+    const guard = csEqualityGuard(parts2.cond);
+    if (!guard) continue;
+    const entry = { i: i2, rest: parts2.rest, ifCol: parts2.ifCol, op: guard.op };
+    for (const id of csIdentifiers(guard.exprSide)) {
+      let arr = map.get(id);
+      if (!arr) {
+        arr = [];
+        map.set(id, arr);
+      }
+      arr.push(entry);
+    }
+  }
+  _csGuardLines = lines;
+  _csGuardMap = map;
+  return map;
+}
 function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines) {
   if (language !== "csharp") return false;
   if (pattern.type !== "ssrf") return false;
@@ -15679,20 +15828,22 @@ function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)
   if (candidates.size === 0) return false;
   const sinkIdx = call.location.line - 1;
   const sinkDepth = csBraceDepthBefore(sourceLines, sinkIdx);
-  for (let i2 = 0; i2 < sinkIdx; i2++) {
-    const parts2 = splitCsIf(sourceLines[i2]);
-    if (!parts2) continue;
-    const guard = csEqualityGuard(parts2.cond);
-    if (!guard) continue;
-    const guardIds = csIdentifiers(guard.exprSide);
-    if (![...guardIds].some((id) => candidates.has(id))) continue;
-    const block = csThenBlock(sourceLines, i2, parts2.rest);
-    if (guard.op === "==") {
-      if (sinkIdx >= block.start && sinkIdx <= block.end) return true;
-    } else {
-      const guardDepth = csBraceDepthBefore(sourceLines, i2) + netBraces(stripCsLiterals(sourceLines[i2]).slice(0, parts2.ifCol));
-      if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
-        return true;
+  const guardMap = csEqualityGuardIndex(sourceLines);
+  const checked = /* @__PURE__ */ new Set();
+  for (const cand of candidates) {
+    const guards = guardMap.get(cand);
+    if (!guards) continue;
+    for (const g of guards) {
+      if (g.i >= sinkIdx || checked.has(g)) continue;
+      checked.add(g);
+      const block = csThenBlock(sourceLines, g.i, g.rest);
+      if (g.op === "==") {
+        if (sinkIdx >= block.start && sinkIdx <= block.end) return true;
+      } else {
+        const guardDepth = csBraceDepthBefore(sourceLines, g.i) + netBraces(stripCsLiterals(sourceLines[g.i]).slice(0, g.ifCol));
+        if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
+          return true;
+        }
       }
     }
   }
@@ -17164,7 +17315,13 @@ function canSourceReachSink(sourceType, sinkType) {
     // scan path (`generateFindings`) dropped every `http_*/io/network/interproc →
     // prompt_injection` flow even though `taint.flows` / the trust pass reported
     // it — the same "two paths disagree" shape as #129. Now emitted from scan too.
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    // xxe added (cognium-dev #282): `request.getParameter("xml")` reaching an
+    // XML parser (DocumentBuilder.parse etc.) is XXE, but xxe was absent from
+    // http_param/http_query (present on http_body/io_input/file_input), so the
+    // pairing was gated out and generateFindings dropped it — same class as the
+    // #129 log_injection/format_string/nosql_injection drop. Mirrors how
+    // deserialization already sits on both http_param and http_query.
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
@@ -17175,7 +17332,7 @@ function canSourceReachSink(sourceType, sinkType) {
     // annotated `/* BAD */`. Prior to 3.163.0 the reach map omitted xss
     // so http_path → xss inline-colocation flows were silently dropped.
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string", "prompt_injection"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     // ssrf added Sprint 57 #200: bash CGI/webhook handlers and scripts that
     // take a URL on stdin or as a positional CLI arg (`curl "$1"`,
     // `wget "$(read line)"`) and curl/wget it server-side are textbook SSRF
@@ -24688,14 +24845,11 @@ var RustPlugin = class extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      // Format String (Rust is mostly safe, but unchecked format! can be dangerous)
-      {
-        method: "format!",
-        type: "format_string",
-        cwe: "CWE-134",
-        severity: "medium",
-        argPositions: [0]
-      },
+      // Format String — `format!` is NOT a CWE-134 sink in Rust. Its template
+      // is a compile-time string literal; a non-literal template does not
+      // compile, so an attacker-controlled format string is not expressible.
+      // Interpolating data into `format!` is the ordinary, safe way to build a
+      // string. (cognium-dev #294 part 1 — removed as a format_string sink.)
       // Unsafe operations
       {
         method: "from_raw_parts",
@@ -27535,11 +27689,19 @@ function findCSharpRequestSources(sourceCode, language) {
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
+  const formFileParams = /* @__PURE__ */ new Set();
+  const formFileDeclRe = /\bIFormFile\s+([A-Za-z_]\w*)/g;
+  for (const line of lines) {
+    const re = new RegExp(formFileDeclRe.source, "g");
+    let d;
+    while ((d = re.exec(line)) !== null) formFileParams.add(d[1]);
+  }
+  const formFileReadRe = formFileParams.size > 0 ? new RegExp(`\\b(?:${[...formFileParams].join("|")})\\s*\\.\\s*(?:FileName|ContentType)\\b`) : null;
   for (let i2 = 0; i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m) continue;
     const [, varName, rhs] = m;
-    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
+    const type = requestReadRe.test(rhs) ? "http_param" : formFileReadRe?.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
     if (!type) continue;
     const lineNumber = i2 + 1;
     if (sources.some((s) => s.line === lineNumber && s.variable === varName)) continue;
@@ -28259,6 +28421,13 @@ function buildJavaTaintedVars(sourceCode, seedVars) {
     "interface",
     "enum"
   ]);
+  const complexTaintedRes = [];
+  for (const v of knownTainted) {
+    if (!/^[\p{L}\p{N}_]+$/u.test(v)) {
+      const esc = v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      complexTaintedRes.push(new RegExp(`(?<![\\p{L}\\p{N}_])${esc}(?![\\p{L}\\p{N}_])`, "u"));
+    }
+  }
   let changed = true;
   let guard = 0;
   while (changed && guard < lines.length + 2) {
@@ -28276,11 +28445,9 @@ function buildJavaTaintedVars(sourceCode, seedVars) {
       const rhs = m[2];
       if (JAVA_KEYWORDS.has(lhs)) continue;
       if (knownTainted.has(lhs)) continue;
-      const escaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
       const rhsCode = rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
-      const ref = [...knownTainted].some(
-        (v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhsCode)
-      );
+      const rhsIdents = rhsCode.match(/[\p{L}\p{N}_]+/gu);
+      const ref = rhsIdents !== null && rhsIdents.some((t) => knownTainted.has(t)) || complexTaintedRes.length > 0 && complexTaintedRes.some((re) => re.test(rhsCode));
       if (ref) {
         derived.set(lhs, i2 + 1);
         knownTainted.add(lhs);
@@ -36703,10 +36870,18 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
   void types;
   return flows;
 }
+var _reassignSplitCode;
+var _reassignSplitLines;
+function splitLinesCached(code) {
+  if (code === _reassignSplitCode && _reassignSplitLines) return _reassignSplitLines;
+  _reassignSplitCode = code;
+  _reassignSplitLines = code.split("\n");
+  return _reassignSplitLines;
+}
 function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
   if (!variable || sinkLine - srcLine < 2) return false;
   if (!/^[A-Za-z_][\w]*$/.test(variable)) return false;
-  const lines = code.split("\n");
+  const lines = splitLinesCached(code);
   const lo = Math.max(0, srcLine);
   const hi = Math.min(lines.length, sinkLine - 1);
   const strLit = `(?:"[^"\\\\]*(?:\\\\.[^"\\\\]*)*"|'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'|\`[^\`\\\\]*(?:\\\\.[^\`\\\\]*)*\`)`;
@@ -37019,9 +37194,10 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  const SIMPLE_IDENT = /^[\p{L}\p{N}_]+$/u;
   const reCache = /* @__PURE__ */ new Map();
   for (const s of sourcesWithVar) {
-    if (reCache.has(s.variable)) continue;
+    if (SIMPLE_IDENT.test(s.variable) || reCache.has(s.variable)) continue;
     const escaped = s.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     reCache.set(s.variable, new RegExp(`(?<![\\p{L}\\p{N}_])${escaped}(?![\\p{L}\\p{N}_])`, "u"));
   }
@@ -37031,6 +37207,23 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     existing.push(call);
     callsByLine.set(call.location.line, existing);
   }
+  const sourcesByVar = /* @__PURE__ */ new Map();
+  const complexSources = [];
+  sourcesWithVar.forEach((source, ord) => {
+    const complex = !SIMPLE_IDENT.test(source.variable);
+    const entry = { source, ord, complex };
+    if (!complex) {
+      let list = sourcesByVar.get(source.variable);
+      if (!list) {
+        list = [];
+        sourcesByVar.set(source.variable, list);
+      }
+      list.push(entry);
+    } else {
+      complexSources.push(entry);
+    }
+  });
+  const flowKeys = /* @__PURE__ */ new Set();
   for (const sink of sinks) {
     if (unreachableLines.has(sink.line)) continue;
     const callsAtSink = callsByLine.get(sink.line) ?? [];
@@ -37041,17 +37234,29 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         }
         const expr = arg.expression;
         if (!expr) continue;
-        for (const source of sourcesWithVar) {
+        const exprIdentMatches = expr.match(/[\p{L}\p{N}_]+/gu);
+        let candidates = complexSources.length > 0 ? complexSources.slice() : null;
+        if (exprIdentMatches) {
+          for (const id of new Set(exprIdentMatches)) {
+            const list = sourcesByVar.get(id);
+            if (!list) continue;
+            (candidates ??= []).push(...list);
+          }
+        }
+        if (!candidates) continue;
+        if (candidates.length > 1) candidates.sort((a, b) => a.ord - b.ord);
+        for (const { source, complex } of candidates) {
           if (source.line >= sink.line) continue;
           if (source.in_method && call.in_method && source.in_method !== call.in_method) {
             continue;
           }
-          const re = reCache.get(source.variable);
-          if (!re || !re.test(expr)) continue;
+          if (complex) {
+            const re = reCache.get(source.variable);
+            if (!re || !re.test(expr)) continue;
+          }
           if (!sourceSemanticsAllowed(source, sink.type)) continue;
-          if (flows.some(
-            (f) => f.source_line === source.line && f.sink_line === sink.line && f.sink_type === sink.type
-          )) continue;
+          const dedupKey = `${source.line}:${sink.line}:${sink.type}`;
+          if (flowKeys.has(dedupKey)) continue;
           if (aliasSanitizedFor.get(source.variable)?.has(sink.type)) {
             break;
           }
@@ -37070,6 +37275,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             confidence: source.confidence * sink.confidence * 0.7,
             sanitized: false
           });
+          flowKeys.add(dedupKey);
           break;
         }
       }