cognium-dev 3.215.0 → 4.0.0

package/dist/cli.js

@@ -3627,8 +3627,87 @@ function extractTypes(tree, cache, language) {
   if (isJavaScript) {
     return extractJavaScriptTypes(tree, cache);
   }
+  if (effectiveLanguage === "csharp") {
+    return extractCSharpTypes(tree, cache);
+  }
   return extractJavaTypes(tree, cache);
 }
+function extractCSharpTypes(tree, cache) {
+  const types = [];
+  const KINDS = {
+    class_declaration: "class",
+    record_declaration: "class",
+    struct_declaration: "class",
+    interface_declaration: "interface",
+    enum_declaration: "enum"
+  };
+  for (const kindNode of Object.keys(KINDS)) {
+    for (const node of getNodesFromCache(tree.rootNode, kindNode, cache)) {
+      const nameNode = node.childForFieldName("name");
+      const body2 = node.childForFieldName("body");
+      const methods = [];
+      if (body2) {
+        for (let i2 = 0;i2 < body2.childCount; i2++) {
+          const m = body2.child(i2);
+          if (!m || m.type !== "method_declaration")
+            continue;
+          const mName = m.childForFieldName("name");
+          const paramList = m.childForFieldName("parameters");
+          const parameters = [];
+          if (paramList) {
+            for (let j = 0;j < paramList.childCount; j++) {
+              const pnode = paramList.child(j);
+              if (!pnode || pnode.type !== "parameter")
+                continue;
+              const pName = pnode.childForFieldName("name");
+              const pType = pnode.childForFieldName("type");
+              if (pName) {
+                parameters.push({
+                  name: getNodeText(pName),
+                  type: pType ? getNodeText(pType) : null,
+                  annotations: [],
+                  line: pnode.startPosition.row + 1
+                });
+              }
+            }
+          }
+          const returns = m.childForFieldName("returns");
+          methods.push({
+            name: mName ? getNodeText(mName) : "unknown",
+            return_type: returns ? getNodeText(returns) : null,
+            parameters,
+            annotations: [],
+            modifiers: extractCSharpModifiers(m),
+            start_line: m.startPosition.row + 1,
+            end_line: m.endPosition.row + 1
+          });
+        }
+      }
+      types.push({
+        name: nameNode ? getNodeText(nameNode) : "anonymous",
+        kind: KINDS[kindNode],
+        package: null,
+        extends: null,
+        implements: [],
+        annotations: [],
+        methods,
+        fields: [],
+        start_line: node.startPosition.row + 1,
+        end_line: node.endPosition.row + 1
+      });
+    }
+  }
+  return types;
+}
+function extractCSharpModifiers(node) {
+  const mods = [];
+  for (let i2 = 0;i2 < node.childCount; i2++) {
+    const c = node.child(i2);
+    if (c && c.type === "modifier")
+      mods.push(getNodeText(c));
+  }
+  return mods;
+}
 function extractJavaTypes(tree, cache) {
   const types = [];
   const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
@@ -5133,6 +5212,9 @@ function extractCalls(tree, cache, language) {
   if (isJavaScript) {
     return extractJavaScriptCalls(tree, cache);
   }
+  if (detectedLanguage === "csharp") {
+    return extractCSharpCalls(tree, cache);
+  }
   const context = buildResolutionContext(tree, cache);
   const invocations = getNodesFromCache(tree.rootNode, "method_invocation", cache);
   for (const inv of invocations) {
@@ -5147,6 +5229,115 @@ function extractCalls(tree, cache, language) {
   }
   return calls;
 }
+function buildCSharpReceiverTypeMap(tree, cache) {
+  const map = new Map;
+  const simple = (t) => t.replace(/<[^>]*>/g, "").split(".").pop()?.trim() ?? t;
+  for (const vd of getNodesFromCache(tree.rootNode, "variable_declaration", cache)) {
+    const typeNode = vd.childForFieldName("type");
+    const declaredType = typeNode ? getNodeText(typeNode) : null;
+    for (let i2 = 0;i2 < vd.childCount; i2++) {
+      const decl = vd.child(i2);
+      if (!decl || decl.type !== "variable_declarator")
+        continue;
+      const nameNode = decl.childForFieldName("name");
+      if (nameNode?.type !== "identifier")
+        continue;
+      let t = declaredType && declaredType !== "var" ? declaredType : null;
+      if (!t) {
+        const oce = findFirstDescendant(decl, "object_creation_expression");
+        const oceType = oce?.childForFieldName("type");
+        if (oceType)
+          t = getNodeText(oceType);
+      }
+      if (t && t !== "var")
+        map.set(getNodeText(nameNode), simple(t));
+    }
+  }
+  return map;
+}
+function findFirstDescendant(node, type) {
+  for (let i2 = 0;i2 < node.childCount; i2++) {
+    const c = node.child(i2);
+    if (!c)
+      continue;
+    if (c.type === type)
+      return c;
+    const found = findFirstDescendant(c, type);
+    if (found)
+      return found;
+  }
+  return null;
+}
+function extractCSharpCalls(tree, cache) {
+  const calls = [];
+  const typeMap = buildCSharpReceiverTypeMap(tree, cache);
+  const invocations = getNodesFromCache(tree.rootNode, "invocation_expression", cache);
+  for (const inv of invocations) {
+    const fn = inv.childForFieldName("function");
+    let methodName = "unknown";
+    let receiver = null;
+    if (fn?.type === "member_access_expression") {
+      const nameNode = fn.childForFieldName("name");
+      const exprNode = fn.childForFieldName("expression");
+      methodName = nameNode ? getNodeText(nameNode) : "unknown";
+      receiver = exprNode ? getNodeText(exprNode) : null;
+    } else if (fn) {
+      methodName = getNodeText(fn);
+    }
+    const argsNode = inv.childForFieldName("arguments");
+    calls.push({
+      method_name: methodName,
+      receiver,
+      receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
+      receiver_type_fqn: null,
+      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
+      in_method: findEnclosingMethod(inv)
+    });
+  }
+  const objectCreations = getNodesFromCache(tree.rootNode, "object_creation_expression", cache);
+  for (const creation of objectCreations) {
+    const typeNode = creation.childForFieldName("type");
+    const argsNode = creation.childForFieldName("arguments");
+    calls.push({
+      method_name: typeNode ? getNodeText(typeNode) : "unknown",
+      receiver: null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      location: { line: creation.startPosition.row + 1, column: creation.startPosition.column },
+      in_method: findEnclosingMethod(creation),
+      is_constructor: true
+    });
+  }
+  return calls;
+}
+function extractCSharpArguments(argsNode) {
+  const args2 = [];
+  let position = 0;
+  for (let i2 = 0;i2 < argsNode.childCount; i2++) {
+    const child = argsNode.child(i2);
+    if (!child || child.type !== "argument")
+      continue;
+    let expr = null;
+    for (let j = child.childCount - 1;j >= 0; j--) {
+      const c = child.child(j);
+      if (c && c.isNamed) {
+        expr = c;
+        break;
+      }
+    }
+    const text = expr ? getNodeText(expr) : getNodeText(child);
+    args2.push({
+      position: position++,
+      expression: text,
+      variable: expr?.type === "identifier" ? text : null,
+      literal: expr?.type === "string_literal" ? text : null,
+      value: null
+    });
+  }
+  return args2;
+}
 function extractJavaScriptCalls(tree, cache) {
   const calls = [];
   const context = buildJSResolutionContext(tree, cache);
@@ -8337,8 +8528,72 @@ function buildDFG(tree, cache, language) {
   if (effectiveLanguage === "go") {
     return buildGoDFG(tree);
   }
+  if (effectiveLanguage === "csharp") {
+    return buildCSharpDFG(tree, cache);
+  }
   return buildJavaDFG(tree, cache);
 }
+function buildCSharpDFG(tree, cache) {
+  const defs = [];
+  const uses = [];
+  let defIdCounter = 1;
+  let useIdCounter = 1;
+  const scopeStack = [new Map];
+  const methods = [
+    ...getNodesFromCache(tree.rootNode, "method_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "constructor_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "local_function_statement", cache)
+  ];
+  for (const method of methods) {
+    scopeStack.push(new Map);
+    const params = method.childForFieldName("parameters");
+    if (params) {
+      for (const def of extractParameterDefs(params, defIdCounter)) {
+        defs.push(def);
+        currentScope(scopeStack).set(def.variable, def.id);
+        defIdCounter++;
+      }
+    }
+    const body2 = method.childForFieldName("body");
+    if (body2) {
+      for (const decl of findNodes(body2, "variable_declarator")) {
+        const nameNode = decl.childForFieldName("name");
+        if (nameNode?.type === "identifier") {
+          const name2 = getNodeText(nameNode);
+          const def = { id: defIdCounter++, variable: name2, line: decl.startPosition.row + 1, kind: "local" };
+          defs.push(def);
+          currentScope(scopeStack).set(name2, def.id);
+        }
+      }
+      for (const asn of findNodes(body2, "assignment_expression")) {
+        const left = asn.childForFieldName("left");
+        if (left?.type === "identifier") {
+          const name2 = getNodeText(left);
+          const def = { id: defIdCounter++, variable: name2, line: asn.startPosition.row + 1, kind: "local" };
+          defs.push(def);
+          currentScope(scopeStack).set(name2, def.id);
+        }
+      }
+      const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      uses.push(...bodyUses.uses);
+      useIdCounter = bodyUses.nextId;
+    }
+    scopeStack.pop();
+  }
+  const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
+  for (const cls of classes) {
+    const body2 = cls.childForFieldName("body");
+    if (body2) {
+      for (const def of extractFieldDefs(body2, defIdCounter)) {
+        defs.push(def);
+        currentScope(scopeStack).set(def.variable, def.id);
+        defIdCounter++;
+      }
+    }
+  }
+  const chains = computeChains(defs, uses);
+  return { defs, uses, chains };
+}
 function buildJavaDFG(tree, cache) {
   const defs = [];
   const uses = [];
@@ -8808,7 +9063,7 @@ function extractParameterDefs(params, startId) {
     const param = params.child(i2);
     if (!param)
       continue;
-    if (param.type === "formal_parameter" || param.type === "spread_parameter") {
+    if (param.type === "formal_parameter" || param.type === "spread_parameter" || param.type === "parameter") {
       const nameNode = param.childForFieldName("name");
       if (nameNode) {
         defs.push({
@@ -12020,6 +12275,55 @@ var DEFAULT_SINKS = [
   { method: "put", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "patch", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "head", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "SqlCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "NpgsqlCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "MySqlCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "SqliteCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "OracleCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "ReadAllBytes", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "ReadAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAllBytes", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "AppendAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "OpenRead", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "OpenWrite", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PostAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PutAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DeleteAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetStringAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetByteArrayAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetStreamAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "SendAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DownloadString", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DownloadData", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DownloadFile", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1], languages: ["csharp"] },
+  { method: "Create", class: "WebRequest", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "BinaryFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "NetDataContractSerializer", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Raw", class: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Compile", class: "XPathExpression", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "LoadXml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Load", class: "XmlDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Load", class: "XDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "fetchrow", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -12138,6 +12442,10 @@ var DEFAULT_SANITIZERS = [
   { method: "escapeEcmaScript", removes: ["xss"] },
   { method: "escapeCsv", removes: ["xss"] },
   { method: "sanitize", class: "PolicyFactory", removes: ["xss"] },
+  { method: "HtmlEncode", removes: ["xss"] },
+  { method: "JavaScriptStringEncode", removes: ["xss"] },
+  { method: "Encode", class: "HtmlEncoder", removes: ["xss"] },
+  { method: "GetFileName", class: "Path", removes: ["path_traversal"] },
   { method: "encodeToString", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   { method: "encode", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   { method: "encodeHexString", class: "Hex", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
@@ -12790,7 +13098,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
       if (skipMethods.includes(method.name))
         continue;
       for (const param of method.parameters) {
-        const isTaintable = param.type ? isInterproceduralTaintableType(param.type) : true;
+        const isTaintable = param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -12800,7 +13108,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
             line: paramLine,
             confidence: param.type ? 0.7 : 0.5,
             in_method: method.name,
-            ...language === "java" ? { variable: param.name } : {}
+            ...language === "java" || language === "csharp" ? { variable: param.name } : {}
           });
         }
       }
@@ -12903,7 +13211,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   return result;
 }
-function isInterproceduralTaintableType(typeName) {
+function isInterproceduralTaintableType(typeName, language) {
   const baseType = typeName.split("<")[0].trim();
   const excludedTypes = [
     "HttpServletRequest",
@@ -12966,6 +13274,26 @@ function isInterproceduralTaintableType(typeName) {
   if (taintableTypes.includes(baseType)) {
     return true;
   }
+  if (language === "csharp") {
+    const csharpTaintable = [
+      "string",
+      "object",
+      "IEnumerable",
+      "ICollection",
+      "IList",
+      "Dictionary",
+      "IDictionary",
+      "IReadOnlyList",
+      "IReadOnlyCollection",
+      "Stream",
+      "byte[]",
+      "Byte[]",
+      "MemoryStream"
+    ];
+    const leaf = baseType.split(".").pop() ?? baseType;
+    if (csharpTaintable.includes(baseType) || csharpTaintable.includes(leaf))
+      return true;
+  }
   if (typeName.endsWith("[]")) {
     const elementType = typeName.slice(0, -2);
     if (elementType === "String" || elementType === "Object" || elementType === "byte") {
@@ -23377,6 +23705,65 @@ class GoPlugin extends BaseLanguagePlugin {
   }
 }
 
+// ../circle-ir/dist/languages/plugins/csharp.js
+class CSharpPlugin extends BaseLanguagePlugin {
+  id = "csharp";
+  name = "C#";
+  extensions = [".cs"];
+  wasmPath = "tree-sitter-csharp.wasm";
+  nodeTypes = {
+    classDeclaration: ["class_declaration", "record_declaration", "struct_declaration"],
+    interfaceDeclaration: ["interface_declaration"],
+    enumDeclaration: ["enum_declaration"],
+    functionDeclaration: [],
+    methodDeclaration: ["method_declaration", "constructor_declaration", "local_function_statement"],
+    methodCall: ["invocation_expression"],
+    functionCall: [],
+    assignment: ["assignment_expression"],
+    variableDeclaration: ["local_declaration_statement", "field_declaration", "variable_declaration"],
+    parameter: ["parameter"],
+    argument: ["argument_list"],
+    annotation: ["attribute", "attribute_list"],
+    decorator: [],
+    importStatement: ["using_directive"],
+    ifStatement: ["if_statement"],
+    forStatement: ["for_statement", "for_each_statement"],
+    whileStatement: ["while_statement"],
+    tryStatement: ["try_statement"],
+    returnStatement: ["return_statement"]
+  };
+  detectFramework(context) {
+    for (const imp of context.imports) {
+      const path = imp.from_package || imp.imported_name;
+      if (path.startsWith("Microsoft.AspNetCore") || path.startsWith("Microsoft.Extensions")) {
+        return { name: "aspnetcore", confidence: 0.9, indicators: [`using: ${path}`] };
+      }
+      if (path.startsWith("Microsoft.EntityFrameworkCore")) {
+        return { name: "efcore", confidence: 0.9, indicators: [`using: ${path}`] };
+      }
+    }
+    return;
+  }
+  extractTypes(_context) {
+    return [];
+  }
+  extractCalls(_context) {
+    return [];
+  }
+  extractImports(_context) {
+    return [];
+  }
+  extractPackage(_context) {
+    return;
+  }
+  getBuiltinSources() {
+    return [];
+  }
+  getBuiltinSinks() {
+    return [];
+  }
+}
+
 // ../circle-ir/dist/languages/plugins/index.js
 function registerBuiltinPlugins() {
   registerLanguage(new JavaPlugin);
@@ -23387,6 +23774,7 @@ function registerBuiltinPlugins() {
   registerLanguage(new HtmlPlugin);
   registerLanguage(new VuePlugin);
   registerLanguage(new GoPlugin);
+  registerLanguage(new CSharpPlugin);
 }
 // ../circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
@@ -24570,6 +24958,7 @@ class LanguageSourcesPass {
     additionalSources.push(...findStaticFieldSources(types, code, language));
     additionalSources.push(...findSetterChainSources(types, code, language));
     additionalSources.push(...findJavaScriptAssignmentSources(code, language));
+    additionalSources.push(...findCSharpRequestSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -25172,6 +25561,35 @@ function findSetterChainSources(types, sourceCode, language) {
   }
   return sources;
 }
+function findCSharpRequestSources(sourceCode, language) {
+  if (language !== "csharp")
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+  const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = assignRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    const [, varName, rhs] = m;
+    if (!requestReadRe.test(rhs))
+      continue;
+    const lineNumber = i2 + 1;
+    if (sources.some((s) => s.line === lineNumber && s.variable === varName))
+      continue;
+    sources.push({
+      type: "http_param",
+      location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? "..." : ""}`,
+      severity: "high",
+      line: lineNumber,
+      confidence: 1,
+      variable: varName
+    });
+  }
+  return sources;
+}
 function findJavaScriptAssignmentSources(sourceCode, language) {
   if (!["javascript", "typescript"].includes(language))
     return [];
@@ -31857,6 +32275,13 @@ var REPLACE_ALL_TO_PLACEHOLDER_RE = /\.replaceAll\s*\([\s\S]*?,\s*"[\s,?]*\?[\s,
 var HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
 var FETCH_GLOBAL_RECEIVER_RE = /(?:^|[^.\w])(?:window|globalThis|self|global)\s*\.\s*fetch\s*\(/;
 var FETCH_MEMBER_RECEIVER_RE = /[\w$)\]]\s*\.\s*fetch\s*\(/;
+var NOSQL_ARRAY_METHODS = new Set(["find", "filter", "some", "every", "findIndex", "findLast"]);
+var FUNCTION_FIRST_ARG_RE = /\.\s*(?:find|filter|some|every|findIndex|findLast)\s*\(\s*(?:async\s+)?(?:function\b|(?:\([^()]*\)|[A-Za-z_$][\w$]*)\s*=>)/;
+var ORM_BUILDER_KEY_RE = /[{,]\s*(?:where|select|populate|include|orderBy|relations|attributes)\s*:/;
+var BROWSER_COMPONENT_EXT_RE = /\.(?:jsx|tsx|vue|svelte)$/;
+var CLIENT_SIGNAL_RE = /["']use client["']|\buse(?:State|Effect|Ref|Callback|Memo|Context|Reducer|LayoutEffect)\s*\(|\b(?:window|document|localStorage|sessionStorage|navigator)\s*\.|\son(?:Click|Change|Submit|Input|KeyDown|KeyUp|MouseOver|Focus|Blur)\s*=/;
+var SERVER_SIGNAL_RE = /["']use server["']|\b(?:getServerSideProps|getStaticProps|getStaticPaths)\b|from\s+["']next\/server["']|\bNext(?:Api)?(?:Request|Response)\b|from\s+["'](?:node:)?(?:fs|child_process|http|https|net|dns|dgram)["']|\bexport\s+(?:default\s+)?(?:async\s+)?function\s+handler\s*\(/;
+var FIXED_HOST_TEMPLATE_RE = /`https?:\/\/[^/${}\s`]+[/`]/;
 function javaTraversalRejectGuardedLines(code) {
   const covered = new Set;
   const lines = code.split(`
@@ -31903,6 +32328,121 @@ function javaTraversalRejectGuardedLines(code) {
   }
   return covered;
 }
+function isAnchoredHostAllowlistRegex(src) {
+  if (!src.startsWith("^"))
+    return false;
+  if (!/https?/i.test(src))
+    return false;
+  return /[A-Za-z][A-Za-z0-9-]+\\?\./.test(src);
+}
+function isSchemeHostPrefix(prefix) {
+  if (!/^https?:\/\//i.test(prefix))
+    return false;
+  const afterScheme = prefix.replace(/^https?:\/\//i, "");
+  return /[A-Za-z][A-Za-z0-9-]*\./.test(afterScheme);
+}
+function jsSsrfHostGuardedLines(code) {
+  const covered = new Set;
+  const lines = code.split(`
+`);
+  const rejectRegexTest = /\bif\s*\(\s*!\s*\/((?:[^/\\]|\\.)*)\/[a-z]*\s*\.\s*test\s*\(\s*([A-Za-z_]\w*)\s*\)/;
+  const rejectStartsWith = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*startsWith\s*\(\s*["'`]([^"'`]+)["'`]/;
+  const terminatorRe = /\b(throw|return)\b/;
+  const assignRe = /^\s*(?:const|let|var\s+)?\s*([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    let guardedVar = null;
+    const rm = rejectRegexTest.exec(lines[i2]);
+    if (rm && isAnchoredHostAllowlistRegex(rm[1]))
+      guardedVar = rm[2];
+    if (!guardedVar) {
+      const sm = rejectStartsWith.exec(lines[i2]);
+      if (sm && isSchemeHostPrefix(sm[2]))
+        guardedVar = sm[1];
+    }
+    if (!guardedVar)
+      continue;
+    let hasTerminator = terminatorRe.test(lines[i2]);
+    if (!hasTerminator) {
+      for (let j = i2 + 1;j < Math.min(lines.length, i2 + 6); j++) {
+        if (terminatorRe.test(lines[j])) {
+          hasTerminator = true;
+          break;
+        }
+        if (lines[j].includes("}"))
+          break;
+      }
+    }
+    if (!hasTerminator)
+      continue;
+    const guarded = new Set([guardedVar]);
+    const mentionsGuarded = (text) => {
+      for (const name2 of guarded)
+        if (new RegExp(`\\b${name2}\\b`).test(text))
+          return true;
+      return false;
+    };
+    for (let l = i2 + 1;l < lines.length; l++) {
+      const lineText = lines[l];
+      const assign = assignRe.exec(lineText);
+      if (assign) {
+        if (mentionsGuarded(assign[2]))
+          guarded.add(assign[1]);
+        else if (assign[1] !== guardedVar)
+          guarded.delete(assign[1]);
+      }
+      if (mentionsGuarded(lineText))
+        covered.add(l + 1);
+    }
+  }
+  return covered;
+}
+var CSHARP_SANITIZER_RES = [
+  { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: "xss" },
+  { re: /\bHtmlEncoder\s*\.\s*Encode\s*\(/, type: "xss" },
+  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" }
+];
+function csharpSanitizedVarsByType(code) {
+  const lines = code.split(`
+`);
+  const byType = new Map;
+  const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+  for (const { type } of CSHARP_SANITIZER_RES) {
+    if (!byType.has(type))
+      byType.set(type, new Set);
+  }
+  for (const line of lines) {
+    const m = assignRe.exec(line);
+    if (!m)
+      continue;
+    const [, lhs, rhs] = m;
+    for (const { re, type } of CSHARP_SANITIZER_RES) {
+      if (re.test(rhs))
+        byType.get(type).add(lhs);
+    }
+  }
+  let changed = true;
+  let guard = 0;
+  while (changed && guard < lines.length + 2) {
+    changed = false;
+    guard++;
+    for (const line of lines) {
+      const m = assignRe.exec(line);
+      if (!m)
+        continue;
+      const [, lhs, rhs] = m;
+      for (const [type, set] of byType) {
+        if (set.has(lhs))
+          continue;
+        const refsSanitized = [...set].some((v) => new RegExp(`(?<![\\w])${escapeRegex(v)}(?![\\w])`).test(rhs));
+        if (refsSanitized) {
+          set.add(lhs);
+          changed = true;
+        }
+      }
+    }
+  }
+  return byType;
+}
 var JAVA_INLINE_MATCHES_RE = /\.\s*matches\s*\(\s*"((?:[^"\\]|\\.)*)"\s*\)/g;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
@@ -32702,6 +33242,70 @@ class SinkFilterPass {
     }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "nosql_injection")
+          return true;
+        if (!NOSQL_ARRAY_METHODS.has(sink.method ?? ""))
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        return !FUNCTION_FIRST_ARG_RE.test(sinkLineText);
+      });
+    }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "sql_injection" && sink.type !== "nosql_injection")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        return !ORM_BUILDER_KEY_RE.test(sinkLineText);
+      });
+    }
+    if (["javascript", "typescript", "tsx"].includes(language)) {
+      const file = ctx.graph?.ir?.meta?.file ?? "";
+      if (BROWSER_COMPONENT_EXT_RE.test(file) && CLIENT_SIGNAL_RE.test(ctx.code) && !SERVER_SIGNAL_RE.test(ctx.code)) {
+        filtered = filtered.filter((sink) => sink.type !== "ssrf");
+      }
+    }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "ssrf")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        return !FIXED_HOST_TEMPLATE_RE.test(sinkLineText);
+      });
+    }
+    if (["javascript", "typescript"].includes(language)) {
+      const guardedLines = jsSsrfHostGuardedLines(ctx.code);
+      if (guardedLines.size > 0) {
+        filtered = filtered.filter((sink) => !(sink.type === "ssrf" && guardedLines.has(sink.line)));
+      }
+    }
+    if (language === "csharp") {
+      const sourceLines = ctx.code.split(`
+`);
+      const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
+      filtered = filtered.filter((sink) => {
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        for (const { re, type } of CSHARP_SANITIZER_RES) {
+          if (type === sink.type && re.test(sinkLineText))
+            return false;
+        }
+        const sanitizedVars = sanitizedByType.get(sink.type);
+        if (sanitizedVars && sanitizedVars.size > 0) {
+          for (const v of sanitizedVars) {
+            if (new RegExp(`(?<![\\w])${escapeRegex(v)}(?![\\w])`).test(sinkLineText))
+              return false;
+          }
+        }
+        return true;
+      });
+    }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split(`
 `);
       filtered = filtered.filter((sink) => {
         if (sink.type !== "log_injection")
@@ -35343,7 +35947,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
-  if (language === "java" && typeof code === "string" && sourcesWithVar.length > 0) {
+  if ((language === "java" || language === "csharp") && typeof code === "string" && sourcesWithVar.length > 0) {
     const seedVars = new Set(sourcesWithVar.map((s) => s.variable));
     const derived = buildJavaTaintedVars(code, seedVars);
     if (derived.size > 0) {
@@ -47152,7 +47756,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.215.0";
+var version = "4.0.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -48034,6 +48638,7 @@ var LANG_MAP = {
   ".tsx": "typescript",
   ".py": "python",
   ".go": "go",
+  ".cs": "csharp",
   ".rs": "rust",
   ".sh": "bash",
   ".bash": "bash",
@@ -48792,7 +49397,7 @@ async function handleInit() {
   }
   const config = {
     version: "1.0",
-    include: ["src/**/*.java", "src/**/*.ts", "src/**/*.js", "src/**/*.py", "src/**/*.go"],
+    include: ["src/**/*.java", "src/**/*.ts", "src/**/*.js", "src/**/*.py", "src/**/*.go", "src/**/*.cs"],
     exclude: ["**/test/**", "**/tests/**", "**/node_modules/**", "**/dist/**"],
     passes: {
       "naming-convention": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.215.0",
+  "version": "4.0.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.215.0"
+    "circle-ir": "^4.0.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",