circle-ir 4.9.9 → 4.9.11

package/dist/browser/circle-ir.js

@@ -6003,6 +6003,26 @@ var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
   "ExecuteReaderAsync",
   "ExecuteNonQueryAsync"
 ]);
+var CSHARP_RECEIVER_URL_METHODS = /* @__PURE__ */ new Set([
+  "GetAsync",
+  "PostAsync",
+  "PutAsync",
+  "PatchAsync",
+  "DeleteAsync",
+  "HeadAsync",
+  "GetStringAsync",
+  "GetByteArrayAsync",
+  "GetStreamAsync",
+  "GetJsonAsync"
+]);
+var CSHARP_HEADER_RECEIVER_RE = /(^|\.)Headers$/;
+function csharpBareName(node) {
+  if (node.type === "generic_name") {
+    const id = node.childForFieldName("name") ?? node.namedChild(0);
+    if (id) return getNodeText(id);
+  }
+  return getNodeText(node);
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -6014,16 +6034,22 @@ function extractCSharpCalls(tree, cache) {
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
-      methodName = nameNode ? getNodeText(nameNode) : "unknown";
+      methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
     } else if (fn) {
-      methodName = getNodeText(fn);
+      methodName = csharpBareName(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
     let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
     if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
       args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
     }
+    if (methodName === "Add" && receiver && CSHARP_HEADER_RECEIVER_RE.test(receiver)) {
+      methodName = "AddHeader";
+    }
+    if (receiver && args2.length === 0 && CSHARP_RECEIVER_URL_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }];
+    }
     calls.push({
       method_name: methodName,
       receiver,
@@ -6039,7 +6065,7 @@ function extractCSharpCalls(tree, cache) {
     const typeNode = creation.childForFieldName("type");
     const argsNode = creation.childForFieldName("arguments");
     calls.push({
-      method_name: typeNode ? getNodeText(typeNode) : "unknown",
+      method_name: typeNode ? csharpBareName(typeNode) : "unknown",
       receiver: null,
       receiver_type: null,
       receiver_type_fqn: null,
@@ -6052,6 +6078,39 @@ function extractCSharpCalls(tree, cache) {
   const assignments = getNodesFromCache(tree.rootNode, "assignment_expression", cache);
   for (const asn of assignments) {
     const left = asn.childForFieldName("left");
+    if (left?.type === "element_access_expression") {
+      const target = left.childForFieldName("expression");
+      const right2 = asn.childForFieldName("right");
+      if (!target || !right2) continue;
+      if (!CSHARP_HEADER_RECEIVER_RE.test(getNodeText(target))) continue;
+      const subscript = left.childForFieldName("subscript") ?? left.namedChild(1);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: "AddHeader",
+        receiver: getNodeText(target),
+        receiver_type: null,
+        receiver_type_fqn: null,
+        arguments: [
+          {
+            position: 0,
+            expression: subscript ? getNodeText(subscript) : "",
+            variable: null,
+            literal: subscript ? getNodeText(subscript) : null,
+            value: null
+          },
+          {
+            position: 1,
+            expression: rhsText2,
+            variable: right2.type === "identifier" ? rhsText2 : null,
+            literal: right2.type === "string_literal" ? rhsText2 : null,
+            value: null
+          }
+        ],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression") continue;
     const nameNode = left.childForFieldName("name");
     if (!nameNode) continue;
@@ -13922,6 +13981,23 @@ var DEFAULT_SINKS = [
   { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // Dapper micro-ORM (cognium-dev#275). Every Dapper entry point is an
+  // `IDbConnection` extension whose arg 0 is raw SQL text — `conn.Query<T>(sql)`
+  // is exactly as injectable as `new SqlCommand(sql)`. Taint-gated on arg 0, so
+  // a constant/interpolation-free query never fires, and a same-named method on
+  // an unrelated receiver (e.g. RestSharp's `client.Execute(request)`, whose
+  // arg 0 is a request object rather than a tainted string) stays clean.
+  { method: "Query", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirst", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefaultAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingle", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingleOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryMultiple", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Execute", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // ADO.NET `cmd.CommandText = "…" + x` — emitted as a synthetic call by
   // extractCSharpCalls (property-assignment sink; the ctor-arg sink misses it).
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -13987,12 +14063,23 @@ var DEFAULT_SINKS = [
   { method: "DeleteAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStringAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetByteArrayAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // Remaining HttpClient/Flurl verbs (cognium-dev#275). For HttpClient these
+  // take the URL at arg 0; for Flurl's fluent form the receiver is surfaced as
+  // arg 0 by CSHARP_RECEIVER_URL_METHODS. Taint-gated either way.
+  // (GetStreamAsync / PutAsync / DeleteAsync are already registered below.)
+  { method: "GetJsonAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PatchAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "HeadAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStreamAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SendAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadString", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadData", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadFile", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1], languages: ["csharp"] },
   { method: "Create", class: "WebRequest", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // RestSharp (cognium-dev#275) — the base URL is fixed at construction, so
+  // `new RestClient(userUrl)` points every later request at attacker-controlled
+  // infrastructure. Ctor arg 0, taint-gated.
+  { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# code injection — dynamic script/assembly loading (CWE-94).
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -14032,6 +14119,11 @@ var DEFAULT_SINKS = [
   // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
   // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // `return Content(html, "text/html")` on a controller writes arg 0 to the
+  // response body unescaped (cognium-dev#275). Taint-gated on arg 0; the common
+  // `Content(constantString)` and the JSON/plain-text content types are
+  // unaffected because a constant argument carries no taint.
+  { method: "Content", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // `String.Format(fmt, …)` with an attacker-controlled FORMAT string — CWE-134.
   // Taint-gated on arg 0 (the format), so ordinary `String.Format("...", user)` where
   // only an argument is tainted never fires. .NET composite formatting can't corrupt
@@ -14057,6 +14149,10 @@ var DEFAULT_SINKS = [
   // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
   // attacker-controlled query document. Class-scoped (static receiver resolves).
   { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // `new BsonJavaScript(userCode)` wraps a server-side JS string — the payload
+  // MongoDB's `$where` / `$function` operators execute. Unconditionally
+  // dangerous when tainted, so no literal gating is needed (cognium-dev#275).
+  { method: "BsonJavaScript", class: "constructor", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# log injection — Microsoft.Extensions.Logging `ILogger` (CWE-117,
   // cognium-ai#318). Only the message TEMPLATE (arg[0]) is the injectable
   // position; the structured form `LogInformation("… {Id}", id)` keeps taint in
@@ -14068,6 +14164,16 @@ var DEFAULT_SINKS = [
   { method: "LogDebug", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogCritical", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogTrace", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  // C# ReDoS (CWE-1333, cognium-dev#275). The injectable position is the
+  // PATTERN, not the input: a user-supplied regex can be crafted with
+  // catastrophic backtracking. `Regex.IsMatch(input, pattern)` and friends take
+  // the pattern at arg 1; the `new Regex(pattern)` ctor takes it at arg 0. A
+  // tainted *input* with a constant pattern is not ReDoS and does not fire.
+  { method: "IsMatch", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Match", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Matches", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Replace", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Regex", class: "constructor", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   // Generic `ILogger.Log(logLevel, message, …)` — class-scoped (`Log` alone is
   // too generic); the message is arg[1].
   { method: "Log", class: "ILogger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1], languages: ["csharp"] },
@@ -14326,6 +14432,15 @@ var DEFAULT_SANITIZERS = [
   // this table; the drift surfaced as a SecuriBench Micro FP on
   // `sanitizers/Sanitizers3.java` (`URLEncoder.encode` + `sendRedirect`).
   { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
+  // ASP.NET Core local-redirect guards (cognium-dev#275). `Url.IsLocalUrl(x)`
+  // returns false for any absolute/scheme-relative URL, so a `Redirect(x)` gated
+  // on it cannot leave the site — without this credit the guarded form is a
+  // false positive. `LocalRedirect(x)` is the same check applied by the
+  // framework itself: it THROWS on a non-local URL, which is why it is
+  // deliberately not registered as an open_redirect sink. Recording it here
+  // states that intent in the model rather than leaving it as a silent omission.
+  { method: "IsLocalUrl", removes: ["open_redirect"] },
+  { method: "LocalRedirect", removes: ["open_redirect"] },
   // URL encoding wrapper aliases (common patterns in benchmarks and real-world code)
   { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },
@@ -14941,14 +15056,30 @@ var PYTHON_TAINTED_PATTERNS = [
   // regex registry so it's recognized in subscript/var contexts.
   { pattern: /\binput\s*\(/, sourceType: "io_input" }
 ];
+function dropCSharpObjectCarriedWaypoints(sinks, calls) {
+  const zeroArgCtors = /* @__PURE__ */ new Set();
+  for (const call of calls) {
+    if (call.is_constructor && call.arguments.length === 0) {
+      zeroArgCtors.add(`${call.location.line}:${call.method_name}`);
+    }
+  }
+  return sinks.filter((sink) => {
+    if (sink.type !== "sql_injection") return true;
+    if (sink.method && zeroArgCtors.has(`${sink.line}:${sink.method}`)) {
+      return false;
+    }
+    return true;
+  });
+}
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
+  const gatedSinks = language === "csharp" ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
-  return { sources, sinks, sanitizers };
+  return { sources, sinks: gatedSinks, sanitizers };
 }
 function sinkPatternAppliesTo(pattern, language) {
   if (language === void 0) return true;
@@ -15219,7 +15350,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   const sourceMap = /* @__PURE__ */ new Map();
   for (const source of sources) {
-    const key = `${source.line}:${source.type}`;
+    const key = source.type === "interprocedural_param" && source.variable ? `${source.line}:${source.type}:${source.variable}` : `${source.line}:${source.type}`;
     const existing = sourceMap.get(key);
     if (!existing || source.confidence > existing.confidence) {
       sourceMap.set(key, source);
@@ -15837,6 +15968,15 @@ var CWE_78_RECEIVER_ALLOWLIST = /* @__PURE__ */ new Set([
   // hutool
   "RuntimeUtil"
 ]);
+function isRegexReceiver(receiver, sourceLines) {
+  const r = (receiver ?? "").trim();
+  if (r.length === 0) return false;
+  if (r.startsWith("/") && /\/[a-z]*$/.test(r)) return true;
+  if (/^(?:new\s+)?RegExp\s*\(/.test(r)) return true;
+  if (!/^[A-Za-z_$][\w$]*$/.test(r) || !sourceLines) return false;
+  const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
+  return sourceLines.some((l) => decl.test(l));
+}
 function isFunctionCallbackArgument(arg) {
   if (arg.literal !== null && arg.literal !== void 0) return false;
   const expr = (arg.expression ?? "").trim();
@@ -16019,6 +16159,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (pattern.type === "command_injection" && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
+          continue;
+        }
+        if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {
+          continue;
+        }
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -17200,7 +17346,13 @@ function canSourceReachSink(sourceType, sinkType) {
     // scan path (`generateFindings`) dropped every `http_*/io/network/interproc →
     // prompt_injection` flow even though `taint.flows` / the trust pass reported
     // it — the same "two paths disagree" shape as #129. Now emitted from scan too.
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    // xxe added (cognium-dev #282): `request.getParameter("xml")` reaching an
+    // XML parser (DocumentBuilder.parse etc.) is XXE, but xxe was absent from
+    // http_param/http_query (present on http_body/io_input/file_input), so the
+    // pairing was gated out and generateFindings dropped it — same class as the
+    // #129 log_injection/format_string/nosql_injection drop. Mirrors how
+    // deserialization already sits on both http_param and http_query.
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
@@ -17211,7 +17363,7 @@ function canSourceReachSink(sourceType, sinkType) {
     // annotated `/* BAD */`. Prior to 3.163.0 the reach map omitted xss
     // so http_path → xss inline-colocation flows were silently dropped.
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string", "prompt_injection"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     // ssrf added Sprint 57 #200: bash CGI/webhook handlers and scripts that
     // take a URL on stdin or as a positional CLI arg (`curl "$1"`,
     // `wget "$(read line)"`) and curl/wget it server-side are textbook SSRF
@@ -18663,6 +18815,9 @@ function findInitialTaint(sources, callsByLine, defsByLine) {
   for (const source of sources) {
     const defsOnLine = defsByLine.get(source.line) ?? [];
     for (const def of defsOnLine) {
+      if (source.type === "interprocedural_param" && source.variable && def.kind === "param" && def.variable !== source.variable) {
+        continue;
+      }
       tainted.push({
         variable: def.variable,
         defId: def.id,
@@ -24724,14 +24879,11 @@ var RustPlugin = class extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      // Format String (Rust is mostly safe, but unchecked format! can be dangerous)
-      {
-        method: "format!",
-        type: "format_string",
-        cwe: "CWE-134",
-        severity: "medium",
-        argPositions: [0]
-      },
+      // Format String — `format!` is NOT a CWE-134 sink in Rust. Its template
+      // is a compile-time string literal; a non-literal template does not
+      // compile, so an attacker-controlled format string is not expressible.
+      // Interpolating data into `format!` is the ordinary, safe way to build a
+      // string. (cognium-dev #294 part 1 — removed as a format_string sink.)
       // Unsafe operations
       {
         method: "from_raw_parts",
@@ -27571,11 +27723,19 @@ function findCSharpRequestSources(sourceCode, language) {
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
+  const formFileParams = /* @__PURE__ */ new Set();
+  const formFileDeclRe = /\bIFormFile\s+([A-Za-z_]\w*)/g;
+  for (const line of lines) {
+    const re = new RegExp(formFileDeclRe.source, "g");
+    let d;
+    while ((d = re.exec(line)) !== null) formFileParams.add(d[1]);
+  }
+  const formFileReadRe = formFileParams.size > 0 ? new RegExp(`\\b(?:${[...formFileParams].join("|")})\\s*\\.\\s*(?:FileName|ContentType)\\b`) : null;
   for (let i2 = 0; i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m) continue;
     const [, varName, rhs] = m;
-    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
+    const type = requestReadRe.test(rhs) ? "http_param" : formFileReadRe?.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
     if (!type) continue;
     const lineNumber = i2 + 1;
     if (sources.some((s) => s.line === lineNumber && s.variable === varName)) continue;
@@ -36206,7 +36366,7 @@ var TaintPropagationPass = class {
     for (const f of paramFlows) {
       pushIfNew(f);
     }
-    const exprScanFlows = detectExpressionScanFlows(calls, sources, sinks, sanitizers, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language) ?? [];
+    const exprScanFlows = detectExpressionScanFlows(calls, sources, sinks, sanitizers, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language, types) ?? [];
     for (const f of exprScanFlows) {
       if (flowKeys.has(flowKey(f))) continue;
       const flowForCheck = {
@@ -36358,6 +36518,36 @@ var TaintPropagationPass = class {
         return bestByKey.get(key) === f;
       });
     }
+    if (ctx.language === "csharp" && finalFlows.length > 1) {
+      const CSHARP_ADO_EXECUTE = /^Execute(?:Reader|NonQuery|Scalar)(?:Async)?$/;
+      const commandTextReceiverByLine = /* @__PURE__ */ new Map();
+      const execLinesByReceiver = /* @__PURE__ */ new Map();
+      for (const call of calls) {
+        const receiver = (call.receiver ?? "").trim();
+        if (!receiver) continue;
+        if (call.method_name === "CommandText") {
+          commandTextReceiverByLine.set(call.location.line, receiver);
+        } else if (CSHARP_ADO_EXECUTE.test(call.method_name)) {
+          const lines = execLinesByReceiver.get(receiver) ?? [];
+          lines.push(call.location.line);
+          execLinesByReceiver.set(receiver, lines);
+        }
+      }
+      if (commandTextReceiverByLine.size > 0) {
+        const reportedSqlSinkLines = new Set(
+          finalFlows.filter((f) => f.sink_type === "sql_injection").map((f) => f.sink_line)
+        );
+        finalFlows = finalFlows.filter((f) => {
+          if (f.sink_type !== "sql_injection") return true;
+          const receiver = commandTextReceiverByLine.get(f.sink_line);
+          if (receiver === void 0) return true;
+          const execLines = execLinesByReceiver.get(receiver) ?? [];
+          return !execLines.some(
+            (line) => line > f.sink_line && reportedSqlSinkLines.has(line)
+          );
+        });
+      }
+    }
     return { flows: finalFlows };
   }
 };
@@ -36775,7 +36965,7 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
   }
   return false;
 }
-function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language) {
+function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language, types) {
   const flows = [];
   const sourcesWithVar = sources.filter(
     (s) => typeof s.variable === "string" && s.variable.length > 0
@@ -37032,12 +37222,32 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       for (const s of sourcesWithVar) {
         if (s.line < anchor.line) anchor = s;
       }
+      const methodAt = (line) => {
+        for (const t of types ?? []) {
+          for (const m of t.methods) {
+            if (line >= m.start_line && line <= m.end_line) return m.name;
+          }
+        }
+        return null;
+      };
       const existingVars = new Set(sourcesWithVar.map((s) => s.variable));
-      for (const [varName] of derived) {
+      for (const [varName, derivedLine] of derived) {
         if (!varName || existingVars.has(varName)) continue;
+        const owner = methodAt(derivedLine);
+        let scopedAnchor = anchor;
+        if (owner) {
+          let best;
+          for (const s of sourcesWithVar) {
+            const sOwner = s.in_method ?? methodAt(s.line);
+            if (sOwner !== owner) continue;
+            if (!best || s.line < best.line) best = s;
+          }
+          if (best) scopedAnchor = best;
+        }
         sourcesWithVar.push({
-          ...anchor,
-          variable: varName
+          ...scopedAnchor,
+          variable: varName,
+          ...owner ? { in_method: owner } : {}
         });
         existingVars.add(varName);
       }