circle-ir 4.9.9 → 4.9.10

package/dist/core/circle-ir-core.js

@@ -5983,6 +5983,26 @@ var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
   "ExecuteReaderAsync",
   "ExecuteNonQueryAsync"
 ]);
+var CSHARP_RECEIVER_URL_METHODS = /* @__PURE__ */ new Set([
+  "GetAsync",
+  "PostAsync",
+  "PutAsync",
+  "PatchAsync",
+  "DeleteAsync",
+  "HeadAsync",
+  "GetStringAsync",
+  "GetByteArrayAsync",
+  "GetStreamAsync",
+  "GetJsonAsync"
+]);
+var CSHARP_HEADER_RECEIVER_RE = /(^|\.)Headers$/;
+function csharpBareName(node) {
+  if (node.type === "generic_name") {
+    const id = node.childForFieldName("name") ?? node.namedChild(0);
+    if (id) return getNodeText(id);
+  }
+  return getNodeText(node);
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -5994,16 +6014,22 @@ function extractCSharpCalls(tree, cache) {
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
-      methodName = nameNode ? getNodeText(nameNode) : "unknown";
+      methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
     } else if (fn) {
-      methodName = getNodeText(fn);
+      methodName = csharpBareName(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
     let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
     if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
       args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
     }
+    if (methodName === "Add" && receiver && CSHARP_HEADER_RECEIVER_RE.test(receiver)) {
+      methodName = "AddHeader";
+    }
+    if (receiver && args2.length === 0 && CSHARP_RECEIVER_URL_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }];
+    }
     calls.push({
       method_name: methodName,
       receiver,
@@ -6019,7 +6045,7 @@ function extractCSharpCalls(tree, cache) {
     const typeNode = creation.childForFieldName("type");
     const argsNode = creation.childForFieldName("arguments");
     calls.push({
-      method_name: typeNode ? getNodeText(typeNode) : "unknown",
+      method_name: typeNode ? csharpBareName(typeNode) : "unknown",
       receiver: null,
       receiver_type: null,
       receiver_type_fqn: null,
@@ -6032,6 +6058,39 @@ function extractCSharpCalls(tree, cache) {
   const assignments = getNodesFromCache(tree.rootNode, "assignment_expression", cache);
   for (const asn of assignments) {
     const left = asn.childForFieldName("left");
+    if (left?.type === "element_access_expression") {
+      const target = left.childForFieldName("expression");
+      const right2 = asn.childForFieldName("right");
+      if (!target || !right2) continue;
+      if (!CSHARP_HEADER_RECEIVER_RE.test(getNodeText(target))) continue;
+      const subscript = left.childForFieldName("subscript") ?? left.namedChild(1);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: "AddHeader",
+        receiver: getNodeText(target),
+        receiver_type: null,
+        receiver_type_fqn: null,
+        arguments: [
+          {
+            position: 0,
+            expression: subscript ? getNodeText(subscript) : "",
+            variable: null,
+            literal: subscript ? getNodeText(subscript) : null,
+            value: null
+          },
+          {
+            position: 1,
+            expression: rhsText2,
+            variable: right2.type === "identifier" ? rhsText2 : null,
+            literal: right2.type === "string_literal" ? rhsText2 : null,
+            value: null
+          }
+        ],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression") continue;
     const nameNode = left.childForFieldName("name");
     if (!nameNode) continue;
@@ -13251,6 +13310,23 @@ var DEFAULT_SINKS = [
   { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // Dapper micro-ORM (cognium-dev#275). Every Dapper entry point is an
+  // `IDbConnection` extension whose arg 0 is raw SQL text — `conn.Query<T>(sql)`
+  // is exactly as injectable as `new SqlCommand(sql)`. Taint-gated on arg 0, so
+  // a constant/interpolation-free query never fires, and a same-named method on
+  // an unrelated receiver (e.g. RestSharp's `client.Execute(request)`, whose
+  // arg 0 is a request object rather than a tainted string) stays clean.
+  { method: "Query", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirst", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefaultAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingle", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingleOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryMultiple", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Execute", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // ADO.NET `cmd.CommandText = "…" + x` — emitted as a synthetic call by
   // extractCSharpCalls (property-assignment sink; the ctor-arg sink misses it).
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -13316,12 +13392,23 @@ var DEFAULT_SINKS = [
   { method: "DeleteAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStringAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetByteArrayAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // Remaining HttpClient/Flurl verbs (cognium-dev#275). For HttpClient these
+  // take the URL at arg 0; for Flurl's fluent form the receiver is surfaced as
+  // arg 0 by CSHARP_RECEIVER_URL_METHODS. Taint-gated either way.
+  // (GetStreamAsync / PutAsync / DeleteAsync are already registered below.)
+  { method: "GetJsonAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PatchAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "HeadAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStreamAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SendAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadString", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadData", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadFile", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1], languages: ["csharp"] },
   { method: "Create", class: "WebRequest", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // RestSharp (cognium-dev#275) — the base URL is fixed at construction, so
+  // `new RestClient(userUrl)` points every later request at attacker-controlled
+  // infrastructure. Ctor arg 0, taint-gated.
+  { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -13361,6 +13448,11 @@ var DEFAULT_SINKS = [
   // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
   // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // `return Content(html, "text/html")` on a controller writes arg 0 to the
+  // response body unescaped (cognium-dev#275). Taint-gated on arg 0; the common
+  // `Content(constantString)` and the JSON/plain-text content types are
+  // unaffected because a constant argument carries no taint.
+  { method: "Content", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // `String.Format(fmt, …)` with an attacker-controlled FORMAT string — CWE-134.
   // Taint-gated on arg 0 (the format), so ordinary `String.Format("...", user)` where
   // only an argument is tainted never fires. .NET composite formatting can't corrupt
@@ -13386,6 +13478,10 @@ var DEFAULT_SINKS = [
   // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
   // attacker-controlled query document. Class-scoped (static receiver resolves).
   { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // `new BsonJavaScript(userCode)` wraps a server-side JS string — the payload
+  // MongoDB's `$where` / `$function` operators execute. Unconditionally
+  // dangerous when tainted, so no literal gating is needed (cognium-dev#275).
+  { method: "BsonJavaScript", class: "constructor", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# log injection — Microsoft.Extensions.Logging `ILogger` (CWE-117,
   // cognium-ai#318). Only the message TEMPLATE (arg[0]) is the injectable
   // position; the structured form `LogInformation("… {Id}", id)` keeps taint in
@@ -13397,6 +13493,16 @@ var DEFAULT_SINKS = [
   { method: "LogDebug", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogCritical", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogTrace", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  // C# ReDoS (CWE-1333, cognium-dev#275). The injectable position is the
+  // PATTERN, not the input: a user-supplied regex can be crafted with
+  // catastrophic backtracking. `Regex.IsMatch(input, pattern)` and friends take
+  // the pattern at arg 1; the `new Regex(pattern)` ctor takes it at arg 0. A
+  // tainted *input* with a constant pattern is not ReDoS and does not fire.
+  { method: "IsMatch", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Match", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Matches", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Replace", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Regex", class: "constructor", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   // Generic `ILogger.Log(logLevel, message, …)` — class-scoped (`Log` alone is
   // too generic); the message is arg[1].
   { method: "Log", class: "ILogger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1], languages: ["csharp"] },
@@ -13655,6 +13761,15 @@ var DEFAULT_SANITIZERS = [
   // this table; the drift surfaced as a SecuriBench Micro FP on
   // `sanitizers/Sanitizers3.java` (`URLEncoder.encode` + `sendRedirect`).
   { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
+  // ASP.NET Core local-redirect guards (cognium-dev#275). `Url.IsLocalUrl(x)`
+  // returns false for any absolute/scheme-relative URL, so a `Redirect(x)` gated
+  // on it cannot leave the site — without this credit the guarded form is a
+  // false positive. `LocalRedirect(x)` is the same check applied by the
+  // framework itself: it THROWS on a non-local URL, which is why it is
+  // deliberately not registered as an open_redirect sink. Recording it here
+  // states that intent in the model rather than leaving it as a silent omission.
+  { method: "IsLocalUrl", removes: ["open_redirect"] },
+  { method: "LocalRedirect", removes: ["open_redirect"] },
   // URL encoding wrapper aliases (common patterns in benchmarks and real-world code)
   { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },

package/dist/core/extractors/calls.js

@@ -160,6 +160,53 @@ const CSHARP_COMMAND_EXECUTE_METHODS = new Set([
     'ExecuteScalar', 'ExecuteReader', 'ExecuteNonQuery',
     'ExecuteScalarAsync', 'ExecuteReaderAsync', 'ExecuteNonQueryAsync',
 ]);
+/**
+ * Flurl fluent HTTP methods (cognium-dev#275). Flurl extends `string`/`Url`, so
+ * the request target is the RECEIVER — `userUrl.GetStringAsync()` — which the
+ * arg-position sink model cannot address.
+ *
+ * These names collide with `HttpClient`'s (`client.GetStringAsync(url)`), where
+ * the URL is already arg 0 and the receiver is an untainted client. Prepending
+ * the receiver unconditionally would shift that URL to index 1 and silently
+ * break every existing HttpClient SSRF detection. The two are disambiguated by
+ * arity instead: the Flurl fluent form passes no URL argument, HttpClient always
+ * does — so the receiver is only surfaced as arg 0 for a ZERO-argument call.
+ *
+ * Consequence: body-carrying Flurl verbs (`url.PostJsonAsync(dto)`,
+ * `url.DownloadFileAsync(dir)`) are NOT covered — they pass an argument, so the
+ * guard skips them. Covering those needs real receiver-type resolution to tell a
+ * `Url`/`string` receiver from an `HttpClient` one; listing their names here
+ * without it would only add entries the guard can never reach.
+ */
+const CSHARP_RECEIVER_URL_METHODS = new Set([
+    'GetAsync', 'PostAsync', 'PutAsync', 'PatchAsync', 'DeleteAsync', 'HeadAsync',
+    'GetStringAsync', 'GetByteArrayAsync', 'GetStreamAsync', 'GetJsonAsync',
+]);
+/**
+ * Receiver expressions that denote an ASP.NET header dictionary —
+ * `Response.Headers`, `ctx.Response.Headers`, `req.Headers`. Used to normalize
+ * `.Headers.Add(k, v)` / `.Headers[k] = v` onto the registered `AddHeader`
+ * CRLF sink without registering the ubiquitous bare `Add`. (cognium-dev#275)
+ */
+const CSHARP_HEADER_RECEIVER_RE = /(^|\.)Headers$/;
+/**
+ * Bare method/type name for a C# node, with any generic type-argument list
+ * stripped (cognium-dev#275).
+ *
+ * tree-sitter-c-sharp represents `conn.Query<User>(sql)` with a `generic_name`
+ * in the `name` field, so `getNodeText` yields `"Query<User>"` — which matches
+ * no registry entry, making EVERY generic C# call invisible to the sink matcher
+ * (Dapper's `Query<T>`/`QueryAsync<T>`, `Deserialize<T>`, `GetService<T>`, …).
+ * Taking the identifier child restores the bare name the registry keys on.
+ */
+function csharpBareName(node) {
+    if (node.type === 'generic_name') {
+        const id = node.childForFieldName('name') ?? node.namedChild(0);
+        if (id)
+            return getNodeText(id);
+    }
+    return getNodeText(node);
+}
 function extractCSharpCalls(tree, cache) {
     const calls = [];
     const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -171,11 +218,11 @@ function extractCSharpCalls(tree, cache) {
         if (fn?.type === 'member_access_expression') {
             const nameNode = fn.childForFieldName('name');
             const exprNode = fn.childForFieldName('expression');
-            methodName = nameNode ? getNodeText(nameNode) : 'unknown';
+            methodName = nameNode ? csharpBareName(nameNode) : 'unknown';
             receiver = exprNode ? getNodeText(exprNode) : null;
         }
         else if (fn) {
-            methodName = getNodeText(fn);
+            methodName = csharpBareName(fn);
         }
         const argsNode = inv.childForFieldName('arguments');
         let args = argsNode ? extractCSharpArguments(argsNode) : [];
@@ -187,6 +234,20 @@ function extractCSharpCalls(tree, cache) {
         if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
             args = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args];
         }
+        // `Response.Headers.Add(name, value)` is the ASP.NET Core response-header
+        // writer, but a bare `Add` is far too common to register as a CRLF sink
+        // (List.Add, Dictionary.Add, …). Normalize the header-dictionary form to the
+        // already-registered `AddHeader` name instead, gated on the receiver
+        // expression ending in `.Headers`, so the existing arg-1 crlf sink matches
+        // and nothing else named `Add` is touched. (cognium-dev#275)
+        if (methodName === 'Add' && receiver && CSHARP_HEADER_RECEIVER_RE.test(receiver)) {
+            methodName = 'AddHeader';
+        }
+        // Flurl fluent form only — see CSHARP_RECEIVER_URL_METHODS. The arity guard
+        // is what keeps `client.GetStringAsync(url)` (HttpClient) untouched.
+        if (receiver && args.length === 0 && CSHARP_RECEIVER_URL_METHODS.has(methodName)) {
+            args = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }];
+        }
         calls.push({
             method_name: methodName,
             receiver,
@@ -202,7 +263,7 @@ function extractCSharpCalls(tree, cache) {
         const typeNode = creation.childForFieldName('type');
         const argsNode = creation.childForFieldName('arguments');
         calls.push({
-            method_name: typeNode ? getNodeText(typeNode) : 'unknown',
+            method_name: typeNode ? csharpBareName(typeNode) : 'unknown',
             receiver: null,
             receiver_type: null,
             receiver_type_fqn: null,
@@ -221,6 +282,44 @@ function extractCSharpCalls(tree, cache) {
     const assignments = getNodesFromCache(tree.rootNode, 'assignment_expression', cache);
     for (const asn of assignments) {
         const left = asn.childForFieldName('left');
+        // `Response.Headers["X-Foo"] = tainted` — the indexer form of the header
+        // write above. Emitted as `AddHeader(name, value)` so the same arg-1 crlf
+        // sink matches. (cognium-dev#275)
+        if (left?.type === 'element_access_expression') {
+            const target = left.childForFieldName('expression');
+            const right = asn.childForFieldName('right');
+            if (!target || !right)
+                continue;
+            if (!CSHARP_HEADER_RECEIVER_RE.test(getNodeText(target)))
+                continue;
+            const subscript = left.childForFieldName('subscript') ?? left.namedChild(1);
+            const rhsText = getNodeText(right);
+            calls.push({
+                method_name: 'AddHeader',
+                receiver: getNodeText(target),
+                receiver_type: null,
+                receiver_type_fqn: null,
+                arguments: [
+                    {
+                        position: 0,
+                        expression: subscript ? getNodeText(subscript) : '',
+                        variable: null,
+                        literal: subscript ? getNodeText(subscript) : null,
+                        value: null,
+                    },
+                    {
+                        position: 1,
+                        expression: rhsText,
+                        variable: right.type === 'identifier' ? rhsText : null,
+                        literal: right.type === 'string_literal' ? rhsText : null,
+                        value: null,
+                    },
+                ],
+                location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+                in_method: findEnclosingMethod(asn),
+            });
+            continue;
+        }
         if (left?.type !== 'member_access_expression')
             continue;
         const nameNode = left.childForFieldName('name');