cognium-dev 3.216.0 → 4.2.0

package/README.md

@@ -65,7 +65,7 @@ Scan files or directories for security vulnerabilities.
 cognium-dev scan <path> [options]
 
 Options:
-  -l, --language <lang>      Force language (java|javascript|typescript|python|go|rust|bash|html)
+  -l, --language <lang>      Force language (java|javascript|typescript|python|go|rust|bash|html|csharp)
   -f, --format <format>      Output format (text|json|sarif) [default: text]
   --threads <n>              Parallel analysis threads [default: 4]
   --severity <level>         Filter by severity:
@@ -307,6 +307,12 @@ Filter to security findings only: `cognium-dev scan ./src --category security`
 | Rust | `.rs` | Actix-web, Rocket, Axum |
 | Bash | `.sh`, `.bash` | Shell scripts |
 | HTML | `.html`, `.htm` | Web extraction preprocessor |
+| C#/.NET _(experimental)_ | `.cs` | ASP.NET Core, ADO.NET, EF Core |
+
+> **C#/.NET is experimental / preview** (since 4.0.0). Straight-line taint
+> analysis across 10 CWE families (SQLi, command injection, path traversal,
+> SSRF, code injection, XSS, deserialization, LDAP, XPath, XXE). Not yet
+> benchmark-verified — expect gaps in branch/alias precision and detector breadth.
 
 ## Configuration
 

package/dist/cli.js

@@ -3627,8 +3627,87 @@ function extractTypes(tree, cache, language) {
   if (isJavaScript) {
     return extractJavaScriptTypes(tree, cache);
   }
+  if (effectiveLanguage === "csharp") {
+    return extractCSharpTypes(tree, cache);
+  }
   return extractJavaTypes(tree, cache);
 }
+function extractCSharpTypes(tree, cache) {
+  const types = [];
+  const KINDS = {
+    class_declaration: "class",
+    record_declaration: "class",
+    struct_declaration: "class",
+    interface_declaration: "interface",
+    enum_declaration: "enum"
+  };
+  for (const kindNode of Object.keys(KINDS)) {
+    for (const node of getNodesFromCache(tree.rootNode, kindNode, cache)) {
+      const nameNode = node.childForFieldName("name");
+      const body2 = node.childForFieldName("body");
+      const methods = [];
+      if (body2) {
+        for (let i2 = 0;i2 < body2.childCount; i2++) {
+          const m = body2.child(i2);
+          if (!m || m.type !== "method_declaration")
+            continue;
+          const mName = m.childForFieldName("name");
+          const paramList = m.childForFieldName("parameters");
+          const parameters = [];
+          if (paramList) {
+            for (let j = 0;j < paramList.childCount; j++) {
+              const pnode = paramList.child(j);
+              if (!pnode || pnode.type !== "parameter")
+                continue;
+              const pName = pnode.childForFieldName("name");
+              const pType = pnode.childForFieldName("type");
+              if (pName) {
+                parameters.push({
+                  name: getNodeText(pName),
+                  type: pType ? getNodeText(pType) : null,
+                  annotations: [],
+                  line: pnode.startPosition.row + 1
+                });
+              }
+            }
+          }
+          const returns = m.childForFieldName("returns");
+          methods.push({
+            name: mName ? getNodeText(mName) : "unknown",
+            return_type: returns ? getNodeText(returns) : null,
+            parameters,
+            annotations: [],
+            modifiers: extractCSharpModifiers(m),
+            start_line: m.startPosition.row + 1,
+            end_line: m.endPosition.row + 1
+          });
+        }
+      }
+      types.push({
+        name: nameNode ? getNodeText(nameNode) : "anonymous",
+        kind: KINDS[kindNode],
+        package: null,
+        extends: null,
+        implements: [],
+        annotations: [],
+        methods,
+        fields: [],
+        start_line: node.startPosition.row + 1,
+        end_line: node.endPosition.row + 1
+      });
+    }
+  }
+  return types;
+}
+function extractCSharpModifiers(node) {
+  const mods = [];
+  for (let i2 = 0;i2 < node.childCount; i2++) {
+    const c = node.child(i2);
+    if (c && c.type === "modifier")
+      mods.push(getNodeText(c));
+  }
+  return mods;
+}
 function extractJavaTypes(tree, cache) {
   const types = [];
   const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
@@ -5133,6 +5212,9 @@ function extractCalls(tree, cache, language) {
   if (isJavaScript) {
     return extractJavaScriptCalls(tree, cache);
   }
+  if (detectedLanguage === "csharp") {
+    return extractCSharpCalls(tree, cache);
+  }
   const context = buildResolutionContext(tree, cache);
   const invocations = getNodesFromCache(tree.rootNode, "method_invocation", cache);
   for (const inv of invocations) {
@@ -5147,6 +5229,115 @@ function extractCalls(tree, cache, language) {
   }
   return calls;
 }
+function buildCSharpReceiverTypeMap(tree, cache) {
+  const map = new Map;
+  const simple = (t) => t.replace(/<[^>]*>/g, "").split(".").pop()?.trim() ?? t;
+  for (const vd of getNodesFromCache(tree.rootNode, "variable_declaration", cache)) {
+    const typeNode = vd.childForFieldName("type");
+    const declaredType = typeNode ? getNodeText(typeNode) : null;
+    for (let i2 = 0;i2 < vd.childCount; i2++) {
+      const decl = vd.child(i2);
+      if (!decl || decl.type !== "variable_declarator")
+        continue;
+      const nameNode = decl.childForFieldName("name");
+      if (nameNode?.type !== "identifier")
+        continue;
+      let t = declaredType && declaredType !== "var" ? declaredType : null;
+      if (!t) {
+        const oce = findFirstDescendant(decl, "object_creation_expression");
+        const oceType = oce?.childForFieldName("type");
+        if (oceType)
+          t = getNodeText(oceType);
+      }
+      if (t && t !== "var")
+        map.set(getNodeText(nameNode), simple(t));
+    }
+  }
+  return map;
+}
+function findFirstDescendant(node, type) {
+  for (let i2 = 0;i2 < node.childCount; i2++) {
+    const c = node.child(i2);
+    if (!c)
+      continue;
+    if (c.type === type)
+      return c;
+    const found = findFirstDescendant(c, type);
+    if (found)
+      return found;
+  }
+  return null;
+}
+function extractCSharpCalls(tree, cache) {
+  const calls = [];
+  const typeMap = buildCSharpReceiverTypeMap(tree, cache);
+  const invocations = getNodesFromCache(tree.rootNode, "invocation_expression", cache);
+  for (const inv of invocations) {
+    const fn = inv.childForFieldName("function");
+    let methodName = "unknown";
+    let receiver = null;
+    if (fn?.type === "member_access_expression") {
+      const nameNode = fn.childForFieldName("name");
+      const exprNode = fn.childForFieldName("expression");
+      methodName = nameNode ? getNodeText(nameNode) : "unknown";
+      receiver = exprNode ? getNodeText(exprNode) : null;
+    } else if (fn) {
+      methodName = getNodeText(fn);
+    }
+    const argsNode = inv.childForFieldName("arguments");
+    calls.push({
+      method_name: methodName,
+      receiver,
+      receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
+      receiver_type_fqn: null,
+      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
+      in_method: findEnclosingMethod(inv)
+    });
+  }
+  const objectCreations = getNodesFromCache(tree.rootNode, "object_creation_expression", cache);
+  for (const creation of objectCreations) {
+    const typeNode = creation.childForFieldName("type");
+    const argsNode = creation.childForFieldName("arguments");
+    calls.push({
+      method_name: typeNode ? getNodeText(typeNode) : "unknown",
+      receiver: null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      location: { line: creation.startPosition.row + 1, column: creation.startPosition.column },
+      in_method: findEnclosingMethod(creation),
+      is_constructor: true
+    });
+  }
+  return calls;
+}
+function extractCSharpArguments(argsNode) {
+  const args2 = [];
+  let position = 0;
+  for (let i2 = 0;i2 < argsNode.childCount; i2++) {
+    const child = argsNode.child(i2);
+    if (!child || child.type !== "argument")
+      continue;
+    let expr = null;
+    for (let j = child.childCount - 1;j >= 0; j--) {
+      const c = child.child(j);
+      if (c && c.isNamed) {
+        expr = c;
+        break;
+      }
+    }
+    const text = expr ? getNodeText(expr) : getNodeText(child);
+    args2.push({
+      position: position++,
+      expression: text,
+      variable: expr?.type === "identifier" ? text : null,
+      literal: expr?.type === "string_literal" ? text : null,
+      value: null
+    });
+  }
+  return args2;
+}
 function extractJavaScriptCalls(tree, cache) {
   const calls = [];
   const context = buildJSResolutionContext(tree, cache);
@@ -8337,8 +8528,72 @@ function buildDFG(tree, cache, language) {
   if (effectiveLanguage === "go") {
     return buildGoDFG(tree);
   }
+  if (effectiveLanguage === "csharp") {
+    return buildCSharpDFG(tree, cache);
+  }
   return buildJavaDFG(tree, cache);
 }
+function buildCSharpDFG(tree, cache) {
+  const defs = [];
+  const uses = [];
+  let defIdCounter = 1;
+  let useIdCounter = 1;
+  const scopeStack = [new Map];
+  const methods = [
+    ...getNodesFromCache(tree.rootNode, "method_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "constructor_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "local_function_statement", cache)
+  ];
+  for (const method of methods) {
+    scopeStack.push(new Map);
+    const params = method.childForFieldName("parameters");
+    if (params) {
+      for (const def of extractParameterDefs(params, defIdCounter)) {
+        defs.push(def);
+        currentScope(scopeStack).set(def.variable, def.id);
+        defIdCounter++;
+      }
+    }
+    const body2 = method.childForFieldName("body");
+    if (body2) {
+      for (const decl of findNodes(body2, "variable_declarator")) {
+        const nameNode = decl.childForFieldName("name");
+        if (nameNode?.type === "identifier") {
+          const name2 = getNodeText(nameNode);
+          const def = { id: defIdCounter++, variable: name2, line: decl.startPosition.row + 1, kind: "local" };
+          defs.push(def);
+          currentScope(scopeStack).set(name2, def.id);
+        }
+      }
+      for (const asn of findNodes(body2, "assignment_expression")) {
+        const left = asn.childForFieldName("left");
+        if (left?.type === "identifier") {
+          const name2 = getNodeText(left);
+          const def = { id: defIdCounter++, variable: name2, line: asn.startPosition.row + 1, kind: "local" };
+          defs.push(def);
+          currentScope(scopeStack).set(name2, def.id);
+        }
+      }
+      const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      uses.push(...bodyUses.uses);
+      useIdCounter = bodyUses.nextId;
+    }
+    scopeStack.pop();
+  }
+  const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
+  for (const cls of classes) {
+    const body2 = cls.childForFieldName("body");
+    if (body2) {
+      for (const def of extractFieldDefs(body2, defIdCounter)) {
+        defs.push(def);
+        currentScope(scopeStack).set(def.variable, def.id);
+        defIdCounter++;
+      }
+    }
+  }
+  const chains = computeChains(defs, uses);
+  return { defs, uses, chains };
+}
 function buildJavaDFG(tree, cache) {
   const defs = [];
   const uses = [];
@@ -8808,7 +9063,7 @@ function extractParameterDefs(params, startId) {
     const param = params.child(i2);
     if (!param)
       continue;
-    if (param.type === "formal_parameter" || param.type === "spread_parameter") {
+    if (param.type === "formal_parameter" || param.type === "spread_parameter" || param.type === "parameter") {
       const nameNode = param.childForFieldName("name");
       if (nameNode) {
         defs.push({
@@ -12020,6 +12275,55 @@ var DEFAULT_SINKS = [
   { method: "put", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "patch", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "head", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "SqlCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "NpgsqlCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "MySqlCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "SqliteCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "OracleCommand", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "ReadAllBytes", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "ReadAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAllBytes", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "AppendAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "OpenRead", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "OpenWrite", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PostAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PutAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DeleteAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetStringAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetByteArrayAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetStreamAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "SendAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DownloadString", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DownloadData", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DownloadFile", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1], languages: ["csharp"] },
+  { method: "Create", class: "WebRequest", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "BinaryFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "NetDataContractSerializer", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Raw", class: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Compile", class: "XPathExpression", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "LoadXml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Load", class: "XmlDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Load", class: "XDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "fetchrow", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -12138,6 +12442,10 @@ var DEFAULT_SANITIZERS = [
   { method: "escapeEcmaScript", removes: ["xss"] },
   { method: "escapeCsv", removes: ["xss"] },
   { method: "sanitize", class: "PolicyFactory", removes: ["xss"] },
+  { method: "HtmlEncode", removes: ["xss"] },
+  { method: "JavaScriptStringEncode", removes: ["xss"] },
+  { method: "Encode", class: "HtmlEncoder", removes: ["xss"] },
+  { method: "GetFileName", class: "Path", removes: ["path_traversal"] },
   { method: "encodeToString", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   { method: "encode", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   { method: "encodeHexString", class: "Hex", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
@@ -12790,7 +13098,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
       if (skipMethods.includes(method.name))
         continue;
       for (const param of method.parameters) {
-        const isTaintable = param.type ? isInterproceduralTaintableType(param.type) : true;
+        const isTaintable = param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -12800,7 +13108,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
             line: paramLine,
             confidence: param.type ? 0.7 : 0.5,
             in_method: method.name,
-            ...language === "java" ? { variable: param.name } : {}
+            ...language === "java" || language === "csharp" ? { variable: param.name } : {}
           });
         }
       }
@@ -12903,7 +13211,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   return result;
 }
-function isInterproceduralTaintableType(typeName) {
+function isInterproceduralTaintableType(typeName, language) {
   const baseType = typeName.split("<")[0].trim();
   const excludedTypes = [
     "HttpServletRequest",
@@ -12966,6 +13274,26 @@ function isInterproceduralTaintableType(typeName) {
   if (taintableTypes.includes(baseType)) {
     return true;
   }
+  if (language === "csharp") {
+    const csharpTaintable = [
+      "string",
+      "object",
+      "IEnumerable",
+      "ICollection",
+      "IList",
+      "Dictionary",
+      "IDictionary",
+      "IReadOnlyList",
+      "IReadOnlyCollection",
+      "Stream",
+      "byte[]",
+      "Byte[]",
+      "MemoryStream"
+    ];
+    const leaf = baseType.split(".").pop() ?? baseType;
+    if (csharpTaintable.includes(baseType) || csharpTaintable.includes(leaf))
+      return true;
+  }
   if (typeName.endsWith("[]")) {
     const elementType = typeName.slice(0, -2);
     if (elementType === "String" || elementType === "Object" || elementType === "byte") {
@@ -14549,19 +14877,19 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection"],
-    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
-    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
-    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
-    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection"],
-    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf", "log_injection", "format_string"],
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string", "prompt_injection"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf", "log_injection", "format_string", "prompt_injection"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection", "log_injection"],
     file_input: ["deserialization", "xxe", "path_traversal", "command_injection", "code_injection"],
-    network_input: ["sql_injection", "command_injection", "xss", "ssrf", "log_injection", "format_string", "nosql_injection"],
+    network_input: ["sql_injection", "command_injection", "xss", "ssrf", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     config_param: ["sql_injection", "command_injection", "path_traversal", "xss", "ssrf", "log_injection", "format_string"],
-    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
+    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     plugin_param: ["sql_injection", "command_injection", "path_traversal", "xss", "code_injection", "log_injection", "format_string"]
   };
   const validSinks = sourceToSinkMapping[sourceType];
@@ -19694,6 +20022,10 @@ function applyLibraryApiSurfaceDowngrade(findings) {
 }
 
 // ../circle-ir/dist/analysis/note-coalescer.js
+var CLICKJACKING_PAIR = new Set(["missing-x-frame-options", "missing-csp-frame-ancestors"]);
+function levelRank(level) {
+  return level === "error" ? 0 : level === "warning" ? 1 : 2;
+}
 function coalesceNoteLevelFindings(findings) {
   if (findings.length < 2)
     return [...findings];
@@ -19711,11 +20043,27 @@ function coalesceNoteLevelFindings(findings) {
   }
   const out2 = [];
   for (const key of order) {
-    const bucket = groups.get(key);
+    let bucket = groups.get(key);
     if (bucket.length === 1) {
       out2.push(bucket[0]);
       continue;
     }
+    const cj = bucket.filter((f) => CLICKJACKING_PAIR.has(f.rule_id));
+    if (new Set(cj.map((f) => f.rule_id)).size === CLICKJACKING_PAIR.size) {
+      const primary2 = [...cj].sort((a, b) => levelRank(a.level) - levelRank(b.level) || a.rule_id.localeCompare(b.rule_id))[0];
+      const labels = Array.from(new Set([
+        ...primary2.labels ?? [],
+        ...cj.flatMap((f) => [f.rule_id, ...f.labels ?? []])
+      ])).filter((l) => l !== primary2.rule_id);
+      out2.push({ ...primary2, labels });
+      bucket = bucket.filter((f) => !CLICKJACKING_PAIR.has(f.rule_id));
+      if (bucket.length === 0)
+        continue;
+      if (bucket.length === 1) {
+        out2.push(bucket[0]);
+        continue;
+      }
+    }
     const allNote = bucket.every((f) => f.level === "note");
     if (!allNote) {
       for (const f of bucket)
@@ -23377,6 +23725,65 @@ class GoPlugin extends BaseLanguagePlugin {
   }
 }
 
+// ../circle-ir/dist/languages/plugins/csharp.js
+class CSharpPlugin extends BaseLanguagePlugin {
+  id = "csharp";
+  name = "C#";
+  extensions = [".cs"];
+  wasmPath = "tree-sitter-csharp.wasm";
+  nodeTypes = {
+    classDeclaration: ["class_declaration", "record_declaration", "struct_declaration"],
+    interfaceDeclaration: ["interface_declaration"],
+    enumDeclaration: ["enum_declaration"],
+    functionDeclaration: [],
+    methodDeclaration: ["method_declaration", "constructor_declaration", "local_function_statement"],
+    methodCall: ["invocation_expression"],
+    functionCall: [],
+    assignment: ["assignment_expression"],
+    variableDeclaration: ["local_declaration_statement", "field_declaration", "variable_declaration"],
+    parameter: ["parameter"],
+    argument: ["argument_list"],
+    annotation: ["attribute", "attribute_list"],
+    decorator: [],
+    importStatement: ["using_directive"],
+    ifStatement: ["if_statement"],
+    forStatement: ["for_statement", "for_each_statement"],
+    whileStatement: ["while_statement"],
+    tryStatement: ["try_statement"],
+    returnStatement: ["return_statement"]
+  };
+  detectFramework(context) {
+    for (const imp of context.imports) {
+      const path = imp.from_package || imp.imported_name;
+      if (path.startsWith("Microsoft.AspNetCore") || path.startsWith("Microsoft.Extensions")) {
+        return { name: "aspnetcore", confidence: 0.9, indicators: [`using: ${path}`] };
+      }
+      if (path.startsWith("Microsoft.EntityFrameworkCore")) {
+        return { name: "efcore", confidence: 0.9, indicators: [`using: ${path}`] };
+      }
+    }
+    return;
+  }
+  extractTypes(_context) {
+    return [];
+  }
+  extractCalls(_context) {
+    return [];
+  }
+  extractImports(_context) {
+    return [];
+  }
+  extractPackage(_context) {
+    return;
+  }
+  getBuiltinSources() {
+    return [];
+  }
+  getBuiltinSinks() {
+    return [];
+  }
+}
+
 // ../circle-ir/dist/languages/plugins/index.js
 function registerBuiltinPlugins() {
   registerLanguage(new JavaPlugin);
@@ -23387,6 +23794,7 @@ function registerBuiltinPlugins() {
   registerLanguage(new HtmlPlugin);
   registerLanguage(new VuePlugin);
   registerLanguage(new GoPlugin);
+  registerLanguage(new CSharpPlugin);
 }
 // ../circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
@@ -24570,6 +24978,7 @@ class LanguageSourcesPass {
     additionalSources.push(...findStaticFieldSources(types, code, language));
     additionalSources.push(...findSetterChainSources(types, code, language));
     additionalSources.push(...findJavaScriptAssignmentSources(code, language));
+    additionalSources.push(...findCSharpRequestSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -25172,12 +25581,43 @@ function findSetterChainSources(types, sourceCode, language) {
   }
   return sources;
 }
+function findCSharpRequestSources(sourceCode, language) {
+  if (language !== "csharp")
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+  const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = assignRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    const [, varName, rhs] = m;
+    if (!requestReadRe.test(rhs))
+      continue;
+    const lineNumber = i2 + 1;
+    if (sources.some((s) => s.line === lineNumber && s.variable === varName))
+      continue;
+    sources.push({
+      type: "http_param",
+      location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? "..." : ""}`,
+      severity: "high",
+      line: lineNumber,
+      confidence: 1,
+      variable: varName
+    });
+  }
+  return sources;
+}
 function findJavaScriptAssignmentSources(sourceCode, language) {
   if (!["javascript", "typescript"].includes(language))
     return [];
   const sources = [];
   const lines = sourceCode.split(`
 `);
+  const isRouteHandler = /export\s+(?:async\s+)?(?:function\s+(?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|loader|action)\b|const\s+(?:GET|POST|PUT|PATCH|DELETE|loader|action)\b)/.test(sourceCode) && /\{[^}]*\bparams\b[^}]*\}/.test(sourceCode);
+  const patterns = isRouteHandler ? [...JS_TAINTED_PATTERNS, { pattern: /\bparams\s*[.[]/, type: "http_path" }] : JS_TAINTED_PATTERNS;
   for (let lineNum = 0;lineNum < lines.length; lineNum++) {
     const line = lines[lineNum];
     const lineNumber = lineNum + 1;
@@ -25185,7 +25625,7 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
     if (!assignmentMatch)
       continue;
     const [, varName, rhs] = assignmentMatch;
-    for (const { pattern, type } of JS_TAINTED_PATTERNS) {
+    for (const { pattern, type } of patterns) {
       if (pattern.test(rhs)) {
         const alreadyExists = sources.some((s) => s.line === lineNumber && s.type === type);
         if (!alreadyExists) {
@@ -31857,6 +32297,13 @@ var REPLACE_ALL_TO_PLACEHOLDER_RE = /\.replaceAll\s*\([\s\S]*?,\s*"[\s,?]*\?[\s,
 var HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
 var FETCH_GLOBAL_RECEIVER_RE = /(?:^|[^.\w])(?:window|globalThis|self|global)\s*\.\s*fetch\s*\(/;
 var FETCH_MEMBER_RECEIVER_RE = /[\w$)\]]\s*\.\s*fetch\s*\(/;
+var NOSQL_ARRAY_METHODS = new Set(["find", "filter", "some", "every", "findIndex", "findLast"]);
+var FUNCTION_FIRST_ARG_RE = /\.\s*(?:find|filter|some|every|findIndex|findLast)\s*\(\s*(?:async\s+)?(?:function\b|(?:\([^()]*\)|[A-Za-z_$][\w$]*)\s*=>)/;
+var ORM_BUILDER_KEY_RE = /[{,]\s*(?:where|select|populate|include|orderBy|relations|attributes)\s*:/;
+var BROWSER_COMPONENT_EXT_RE = /\.(?:jsx|tsx|vue|svelte)$/;
+var CLIENT_SIGNAL_RE = /["']use client["']|\buse(?:State|Effect|Ref|Callback|Memo|Context|Reducer|LayoutEffect)\s*\(|\b(?:window|document|localStorage|sessionStorage|navigator)\s*\.|\son(?:Click|Change|Submit|Input|KeyDown|KeyUp|MouseOver|Focus|Blur)\s*=/;
+var SERVER_SIGNAL_RE = /["']use server["']|\b(?:getServerSideProps|getStaticProps|getStaticPaths)\b|from\s+["']next\/server["']|\bNext(?:Api)?(?:Request|Response)\b|from\s+["'](?:node:)?(?:fs|child_process|http|https|net|dns|dgram)["']|\bexport\s+(?:default\s+)?(?:async\s+)?function\s+handler\s*\(/;
+var FIXED_HOST_TEMPLATE_RE = /`https?:\/\/[^/${}\s`]+[/`]/;
 function javaTraversalRejectGuardedLines(code) {
   const covered = new Set;
   const lines = code.split(`
@@ -31971,6 +32418,53 @@ function jsSsrfHostGuardedLines(code) {
   }
   return covered;
 }
+var CSHARP_SANITIZER_RES = [
+  { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: "xss" },
+  { re: /\bHtmlEncoder\s*\.\s*Encode\s*\(/, type: "xss" },
+  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" }
+];
+function csharpSanitizedVarsByType(code) {
+  const lines = code.split(`
+`);
+  const byType = new Map;
+  const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+  for (const { type } of CSHARP_SANITIZER_RES) {
+    if (!byType.has(type))
+      byType.set(type, new Set);
+  }
+  for (const line of lines) {
+    const m = assignRe.exec(line);
+    if (!m)
+      continue;
+    const [, lhs, rhs] = m;
+    for (const { re, type } of CSHARP_SANITIZER_RES) {
+      if (re.test(rhs))
+        byType.get(type).add(lhs);
+    }
+  }
+  let changed = true;
+  let guard = 0;
+  while (changed && guard < lines.length + 2) {
+    changed = false;
+    guard++;
+    for (const line of lines) {
+      const m = assignRe.exec(line);
+      if (!m)
+        continue;
+      const [, lhs, rhs] = m;
+      for (const [type, set] of byType) {
+        if (set.has(lhs))
+          continue;
+        const refsSanitized = [...set].some((v) => new RegExp(`(?<![\\w])${escapeRegex(v)}(?![\\w])`).test(rhs));
+        if (refsSanitized) {
+          set.add(lhs);
+          changed = true;
+        }
+      }
+    }
+  }
+  return byType;
+}
 var JAVA_INLINE_MATCHES_RE = /\.\s*matches\s*\(\s*"((?:[^"\\]|\\.)*)"\s*\)/g;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
@@ -32768,12 +33262,70 @@ class SinkFilterPass {
         return !FETCH_MEMBER_RECEIVER_RE.test(sinkLineText);
       });
     }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "nosql_injection")
+          return true;
+        if (!NOSQL_ARRAY_METHODS.has(sink.method ?? ""))
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        return !FUNCTION_FIRST_ARG_RE.test(sinkLineText);
+      });
+    }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "sql_injection" && sink.type !== "nosql_injection")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        return !ORM_BUILDER_KEY_RE.test(sinkLineText);
+      });
+    }
+    if (["javascript", "typescript", "tsx"].includes(language)) {
+      const file = ctx.graph?.ir?.meta?.file ?? "";
+      if (BROWSER_COMPONENT_EXT_RE.test(file) && CLIENT_SIGNAL_RE.test(ctx.code) && !SERVER_SIGNAL_RE.test(ctx.code)) {
+        filtered = filtered.filter((sink) => sink.type !== "ssrf");
+      }
+    }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "ssrf")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        return !FIXED_HOST_TEMPLATE_RE.test(sinkLineText);
+      });
+    }
     if (["javascript", "typescript"].includes(language)) {
       const guardedLines = jsSsrfHostGuardedLines(ctx.code);
       if (guardedLines.size > 0) {
         filtered = filtered.filter((sink) => !(sink.type === "ssrf" && guardedLines.has(sink.line)));
       }
     }
+    if (language === "csharp") {
+      const sourceLines = ctx.code.split(`
+`);
+      const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
+      filtered = filtered.filter((sink) => {
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        for (const { re, type } of CSHARP_SANITIZER_RES) {
+          if (type === sink.type && re.test(sinkLineText))
+            return false;
+        }
+        const sanitizedVars = sanitizedByType.get(sink.type);
+        if (sanitizedVars && sanitizedVars.size > 0) {
+          for (const v of sanitizedVars) {
+            if (new RegExp(`(?<![\\w])${escapeRegex(v)}(?![\\w])`).test(sinkLineText))
+              return false;
+          }
+        }
+        return true;
+      });
+    }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split(`
 `);
@@ -35417,7 +35969,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
-  if (language === "java" && typeof code === "string" && sourcesWithVar.length > 0) {
+  if ((language === "java" || language === "csharp") && typeof code === "string" && sourcesWithVar.length > 0) {
     const seedVars = new Set(sourcesWithVar.map((s) => s.variable));
     const derived = buildJavaTaintedVars(code, seedVars);
     if (derived.size > 0) {
@@ -47226,7 +47778,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.216.0";
+var version = "4.2.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -48108,6 +48660,7 @@ var LANG_MAP = {
   ".tsx": "typescript",
   ".py": "python",
   ".go": "go",
+  ".cs": "csharp",
   ".rs": "rust",
   ".sh": "bash",
   ".bash": "bash",
@@ -48866,7 +49419,7 @@ async function handleInit() {
   }
   const config = {
     version: "1.0",
-    include: ["src/**/*.java", "src/**/*.ts", "src/**/*.js", "src/**/*.py", "src/**/*.go"],
+    include: ["src/**/*.java", "src/**/*.ts", "src/**/*.js", "src/**/*.py", "src/**/*.go", "src/**/*.cs"],
     exclude: ["**/test/**", "**/tests/**", "**/node_modules/**", "**/dist/**"],
     passes: {
       "naming-convention": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.216.0",
+  "version": "4.2.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.216.0"
+    "circle-ir": "^4.2.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",