cognium-dev 4.12.0 → 4.13.0

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/cognium-dev.svg)](https://www.npmjs.com/package/cognium-dev)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/cogniumhq/cognium-dev/blob/main/LICENSE)
-[![OWASP Benchmark](https://img.shields.io/badge/OWASP%20Benchmark-100%25%20TPR%2C%200%25%20FPR-brightgreen)](https://github.com/cogniumhq/cognium-dev#benchmark-results)
+[![OWASP Benchmark](https://img.shields.io/badge/OWASP%20BenchmarkJava-90.0%25%20TPR%2C%203.0%25%20FPR-green)](https://github.com/cogniumhq/cognium-dev#benchmark-results)
 [![GitHub Action](https://img.shields.io/badge/GitHub%20Action-available-blue?logo=github)](https://github.com/marketplace/actions/cognium-dev-scan)
 ![Trust Score](https://raw.githubusercontent.com/cogniumhq/cognium-dev/badges/trust-badge.svg)
 ![Quality Score](https://raw.githubusercontent.com/cogniumhq/cognium-dev/badges/quality-badge.svg)
@@ -467,35 +467,28 @@ For details on LLM integration and benchmark improvements (42.5% → 78.3% on CW
 
 ## Benchmark Results
 
-**All scores below are from the static analysis engine** — fully deterministic, no LLM required:
+Measured on cognium-dev **4.12.0**, the CLI as published. Fully deterministic.
 
-| Benchmark | Score | Details |
-|-----------|-------|---------|
-| OWASP Benchmark | +100% | TPR 100%, FPR 0% (1415 test cases) |
-| Juliet Test Suite | +100% | 156/156 test cases, 9 CWEs |
-| SecuriBench Micro | 97.7% TPR | 105/108 vulns detected, 6.7% FPR |
-| CWE-Bench-Java | 42.5% | 51/120 real-world CVEs |
+| Benchmark | TPR | FPR | Scope and rule |
+|-----------|-----|-----|----------------|
+| OWASP BenchmarkJava 1.2 | 90.0% | 3.0% | All 2,740 cases; scorecard rule (file-level CWE match) |
+| Juliet Test Suite 1.3 | 99.4% | 21.9% | `_01` cases of 9 injection CWEs; `bad()` vs `good*()` methods; `require-entry-path` disabled |
+| SecuriBench Micro | 88.0% | 6.7% | 123 annotated cases; found sink lines vs `vuln_count` |
+| CWE-Bench-Java | 32.5% (39/120) | n/a | 120 real CVEs; a finding of the CVE's CWE inside the fix method |
 
 ### Reproducing Benchmarks
 
-The benchmark scores are verifiable and reproducible:
+Each number above comes from a `cognium-dev scan` JSON report and a scoring script in this repository. For example, OWASP:
 
 ```bash
-# Install cognium
-npm install -g cognium
-
-# Clone benchmark repositories
+npm install -g cognium-dev
 git clone https://github.com/OWASP-Benchmark/BenchmarkJava
-git clone https://github.com/juliet-test-suite/juliet-test-suite-for-java
-git clone https://github.com/CWE-Bench/cwe-bench-java
-
-# Run scans
-cognium-dev scan BenchmarkJava/src --format json -o owasp-results.json
-cognium-dev scan juliet-test-suite-for-java --format json -o juliet-results.json
-cognium-dev scan cwe-bench-java --format json -o cwe-bench-results.json
+cd BenchmarkJava
+cognium-dev scan . --format json --category security -l java > owasp.json
+node <cognium-dev repo>/bench/sast/score-owasp.mjs expectedresults-1.2.csv owasp.json
 ```
 
-For detailed benchmark methodology and comparison with other tools, see [cognium.dev](https://cognium.dev).
+The scoring rule and command for every benchmark are in [`bench/README.md`](https://github.com/cogniumhq/cognium-dev/blob/main/bench/README.md#sast-accuracy-benchsast).
 
 ## Links
 

package/dist/cli.js

@@ -9055,6 +9055,7 @@ function buildCSharpDFG(tree, cache) {
           currentScope(scopeStack).set(name2, def.id);
         }
       }
+      const plainTargets = [];
       for (const asn of findNodes(body2, "assignment_expression")) {
         const left = asn.childForFieldName("left");
         if (left?.type === "identifier") {
@@ -9062,9 +9063,17 @@ function buildCSharpDFG(tree, cache) {
           const def = { id: defIdCounter++, variable: name2, line: asn.startPosition.row + 1, kind: "local" };
           defs.push(def);
           currentScope(scopeStack).set(name2, def.id);
+          if (asn.children.some((c) => c?.type === "=")) {
+            plainTargets.push({ name: name2, line: left.startPosition.row + 1 });
+          }
         }
       }
       const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      for (const target of plainTargets) {
+        const idx = bodyUses.uses.findIndex((u) => u.variable === target.name && u.line === target.line);
+        if (idx !== -1)
+          bodyUses.uses.splice(idx, 1);
+      }
       resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
       uses.push(...bodyUses.uses);
       useIdCounter = bodyUses.nextId;
@@ -20165,14 +20174,21 @@ class ConstantPropagator {
         break;
       }
     }
-    const switchBlock = node.children.find((c) => c.type === "switch_block");
+    if (!switchValue) {
+      const valueNode = node.childForFieldName("value");
+      if (valueNode) {
+        const literal = this.literalValue(valueNode);
+        switchValue = literal !== null ? { type: typeof literal === "number" ? "int" : "string", value: literal, sourceLine: getNodeLine(valueNode) } : this.evaluateExpression(valueNode);
+      }
+    }
+    const switchBlock = node.children.find((c) => c.type === "switch_block" || c.type === "switch_body");
     if (!switchBlock) {
       for (const child of node.children) {
         this.visit(child);
       }
       return;
     }
-    const caseGroups = switchBlock.children.filter((c) => c.type === "switch_block_statement_group" || c.type === "switch_rule");
+    const caseGroups = switchBlock.children.filter((c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section");
     if (switchValue && isKnown(switchValue)) {
       let matchingIdx = -1;
       let defaultIdx = -1;
@@ -20189,6 +20205,16 @@ class ConstantPropagator {
                 matchingIdx = i2;
               }
             }
+          } else if (caseGroup.type === "switch_section") {
+            if (child.type === "default") {
+              defaultIdx = i2;
+            } else if (child.type === "constant_pattern") {
+              const inner = child.children.find((c) => c.isNamed);
+              const caseValue = inner ? this.literalValue(inner) : null;
+              if (caseValue !== null && caseValue === switchValue.value) {
+                matchingIdx = i2;
+              }
+            }
           }
         }
       }
@@ -20271,6 +20297,17 @@ class ConstantPropagator {
     }
     return false;
   }
+  literalValue(node) {
+    const text = getNodeText2(node, this.source);
+    if (node.type === "integer_literal" || node.type === "decimal_integer_literal") {
+      const n = Number(text.replace(/_/g, "").replace(/[uUlL]+$/, ""));
+      return Number.isInteger(n) ? n : null;
+    }
+    if (node.type === "character_literal" || node.type === "string_literal") {
+      return text.slice(1, -1);
+    }
+    return null;
+  }
   extractCaseValue(labelNode) {
     for (const child of labelNode.children) {
       if (child.type === "decimal_integer_literal") {
@@ -34062,6 +34099,413 @@ class MyBatisAnnotationSqlSinkPass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/csharp-sanitizer-credit.js
+var CSHARP_ALLOWLIST_STRIP_RE = /\bRegex\s*\.\s*Replace\s*\([^,]*,\s*@?"\[\^(?:[A-Za-z0-9_\- ]|\\w|\\d|\\s)+\]"\s*,\s*@?"[A-Za-z0-9_]?"\s*\)/;
+var CSHARP_ALLOWLIST_FILTER_RE = /\bnew\s+string\s*\(\s*[A-Za-z_]\w*\s*\.\s*Where\s*\(\s*char\s*\.\s*Is(?:LetterOrDigit|Digit|Letter)\s*\)\s*\.\s*ToArray\s*\(\s*\)\s*\)/;
+var CSHARP_SANITIZER_RES = [
+  { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: "xss" },
+  { re: /\bHtmlEncoder\s*\.\s*(?:Default\s*\.\s*)?Encode\s*\(/, type: "xss" },
+  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" },
+  { re: /\bSecurityElement\s*\.\s*Escape\s*\(/, type: "xpath_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "ldap_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "xpath_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "command_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "sql_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "crlf" },
+  { re: CSHARP_ALLOWLIST_FILTER_RE, type: "ldap_injection" },
+  { re: CSHARP_ALLOWLIST_FILTER_RE, type: "xpath_injection" },
+  { re: CSHARP_ALLOWLIST_FILTER_RE, type: "command_injection" },
+  { re: CSHARP_ALLOWLIST_FILTER_RE, type: "sql_injection" },
+  { re: CSHARP_ALLOWLIST_FILTER_RE, type: "crlf" }
+];
+var INERT_WHEN_ALPHANUMERIC = new Set([
+  "ldap_injection",
+  "xpath_injection",
+  "command_injection",
+  "sql_injection",
+  "crlf",
+  "xss",
+  "path_traversal",
+  "code_injection"
+]);
+var IDENT = "[A-Za-z_]\\w*";
+var ASSIGN_RE = new RegExp(`^\\s*(?:var\\s+|[A-Za-z_][\\w.<>\\[\\]?]*\\s+)?(${IDENT})\\s*=(?!=)\\s*(.+?);?\\s*$`);
+var ENDS_STATEMENT_RE = /[;{}]\s*(?:\/\/.*)?$/;
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function mentions(text, name2) {
+  return new RegExp(`(?<![\\w])${escapeRegex(name2)}(?![\\w])`).test(text);
+}
+function insideParens(text, open) {
+  let depth = 0;
+  for (let i2 = open;i2 < text.length; i2++) {
+    if (text[i2] === "(")
+      depth++;
+    else if (text[i2] === ")" && --depth === 0)
+      return text.slice(open + 1, i2);
+  }
+  return null;
+}
+function leadingIf(text) {
+  const m = /^\s*(?:\}\s*)?(?:else\s+)?if\s*\(/.exec(text);
+  if (!m)
+    return null;
+  const open = m[0].length - 1;
+  const cond = insideParens(text, open);
+  if (cond === null)
+    return null;
+  return { cond: cond.trim(), rest: text.slice(open + cond.length + 2).trim() };
+}
+var EXITS_RE = /^(?:\{\s*)?(?:return\b|throw\b|continue\b|break\b)/;
+
+class CSharpCredit {
+  methods;
+  lines;
+  helperCache = new Map;
+  guardHelperCache = new Map;
+  constructor(code, methods) {
+    this.methods = methods;
+    this.lines = code.split(/\r?\n/);
+  }
+  methodAt(line) {
+    let best = null;
+    for (const m of this.methods) {
+      if (line < m.start_line || line > m.end_line)
+        continue;
+      if (!best || m.end_line - m.start_line < best.end_line - best.start_line)
+        best = m;
+    }
+    return best;
+  }
+  statements(from, to) {
+    const out2 = [];
+    for (let i2 = Math.max(from, 1);i2 < to; i2++) {
+      let text = (this.lines[i2 - 1] ?? "").trimEnd();
+      const first = i2;
+      if (/^\s*(?:[\w.<>[\]?]+\s+)?[A-Za-z_]\w*\s*=(?!=)/.test(text) && !ENDS_STATEMENT_RE.test(text)) {
+        while (i2 < to - 1 && i2 < first + 12) {
+          i2++;
+          text += " " + (this.lines[i2 - 1] ?? "").trim();
+          if (ENDS_STATEMENT_RE.test(this.lines[i2 - 1] ?? ""))
+            break;
+        }
+      }
+      out2.push({ line: first, text });
+    }
+    return out2;
+  }
+  builtinSanitizes(type, text) {
+    for (const { re, type: t } of CSHARP_SANITIZER_RES) {
+      if (t === type && re.test(text))
+        return true;
+    }
+    if (type === "ldap_injection") {
+      if (/\.\s*Replace\s*\(\s*"\("\s*,/.test(text) && /\.\s*Replace\s*\(\s*"\)"\s*,/.test(text))
+        return true;
+    }
+    if (type === "path_traversal") {
+      if (/\b([A-Za-z_]\w*)\s*\.\s*StartsWith\s*\([^)]*\)\s*\?\s*\1\s*:\s*null\b/.test(text))
+        return true;
+    }
+    return false;
+  }
+  helpers(type) {
+    const cached = this.helperCache.get(type);
+    if (cached)
+      return cached;
+    const set = new Set;
+    this.helperCache.set(type, set);
+    for (const m of this.methods) {
+      const returns = this.returnExprs(m);
+      if (returns.length === 0)
+        continue;
+      const ok = returns.every((r) => {
+        if (this.builtinSanitizes(type, r.expr))
+          return true;
+        const v = /^([A-Za-z_]\w*)$/.exec(r.expr.trim());
+        return !!v && this.sanitizedVarsIn(type, m.start_line, r.line, false).has(v[1]);
+      });
+      if (ok)
+        set.add(m.name);
+    }
+    return set;
+  }
+  returnExprs(m) {
+    const out2 = [];
+    for (const st of this.statements(m.start_line, m.end_line + 1)) {
+      for (const r of st.text.matchAll(/\breturn\s+([^;]+);/g))
+        out2.push({ line: st.line, expr: r[1] });
+      if (st.line === m.start_line) {
+        const body2 = /\)\s*=>\s*(.+?);\s*$/.exec(st.text);
+        if (body2)
+          out2.push({ line: st.line, expr: body2[1] });
+      }
+    }
+    return out2;
+  }
+  sanitizes(type, text) {
+    if (this.builtinSanitizes(type, text))
+      return true;
+    for (const name2 of this.helpers(type)) {
+      if (new RegExp(`(?<![\\w.])${escapeRegex(name2)}\\s*\\(`).test(text))
+        return true;
+    }
+    return false;
+  }
+  sanitizedVarsIn(type, from, to, withHelpers) {
+    const sanitized = new Set;
+    for (const st of this.statements(from, to)) {
+      const m = ASSIGN_RE.exec(st.text);
+      if (!m)
+        continue;
+      const [, lhs, rhs] = m;
+      const credited = (withHelpers ? this.sanitizes(type, rhs) : this.builtinSanitizes(type, rhs)) || [...sanitized].some((v) => mentions(rhs, v));
+      if (credited)
+        sanitized.add(lhs);
+      else
+        sanitized.delete(lhs);
+    }
+    return sanitized;
+  }
+  sanitizedVarsAt(type, sinkLine) {
+    return this.sanitizedVarsIn(type, this.methodAt(sinkLine)?.start_line ?? 1, sinkLine, true);
+  }
+  sinkText(line) {
+    const text = this.lines[line - 1] ?? "";
+    const guarded = leadingIf(text);
+    return guarded && guarded.rest !== "" ? guarded.rest : text;
+  }
+  allowlistVars(cond) {
+    const out2 = [];
+    const anchored = new RegExp(`\\bRegex\\s*\\.\\s*IsMatch\\s*\\(\\s*(${IDENT})\\s*,\\s*@?"\\^\\[(?:[A-Za-z0-9_\\- ]|\\\\w|\\\\d)+\\](?:[+*]|\\{\\d+(?:,\\d*)?\\})\\$"`, "g");
+    for (const m of cond.matchAll(anchored))
+      out2.push(m[1]);
+    const methodGroup = new RegExp(`(${IDENT})\\s*\\.\\s*All\\s*\\(\\s*char\\s*\\.\\s*Is(?:LetterOrDigit|Digit|Letter)\\s*\\)`, "g");
+    for (const m of cond.matchAll(methodGroup))
+      out2.push(m[1]);
+    const lambda = new RegExp(`(${IDENT})\\s*\\.\\s*All\\s*\\(\\s*(${IDENT})\\s*=>`, "g");
+    for (const m of cond.matchAll(lambda)) {
+      const open = cond.indexOf("(", m.index + m[1].length);
+      const body2 = insideParens(cond, open)?.replace(new RegExp(`^\\s*${m[2]}\\s*=>`), "") ?? "";
+      const c = escapeRegex(m[2]);
+      const residue = body2.replace(new RegExp(`char\\s*\\.\\s*Is(?:LetterOrDigit|Digit|Letter)\\s*\\(\\s*${c}\\s*\\)`, "g"), "").replace(new RegExp(`${c}\\s*==\\s*'[_\\-]'`, "g"), "").replace(/\|\||\s/g, "");
+      if (residue === "")
+        out2.push(m[1]);
+    }
+    return out2;
+  }
+  numericVars(cond, parsedFrom) {
+    const out2 = [];
+    const tryParse = new RegExp(`\\b(?:int|long|short|byte|uint|ulong|decimal|double|float|Int32|Int64|Guid)\\s*\\.\\s*TryParse\\s*\\(\\s*(${IDENT})\\s*,`, "g");
+    for (const m of cond.matchAll(tryParse))
+      out2.push(m[1]);
+    for (const [parsed, from] of parsedFrom) {
+      if (new RegExp(`(?<![\\w])${escapeRegex(parsed)}\\s*(?:!=\\s*null|\\.\\s*HasValue)\\b`).test(cond))
+        out2.push(from);
+    }
+    return out2;
+  }
+  hostVars(cond, hostOf) {
+    const out2 = [];
+    const compares = (expr) => {
+      const e = escapeRegex(expr).replace(/\\ /g, "\\s*");
+      return new RegExp(`${e}\\s*==\\s*@?"[^"]+"`).test(cond) || new RegExp(`@?"[^"]+"\\s*==\\s*${e}`).test(cond) || new RegExp(`${e}\\s*\\.\\s*Equals\\s*\\(`).test(cond) || new RegExp(`\\.\\s*Contains\\s*\\(\\s*${e}\\s*[),]`).test(cond) || new RegExp(`\\bIndexOf\\s*\\([^()]*,\\s*${e}\\s*\\)\\s*>=\\s*0`).test(cond);
+    };
+    const direct = new RegExp(`new\\s+(?:System\\s*\\.\\s*)?Uri\\s*\\(\\s*(${IDENT})\\s*\\)\\s*\\.\\s*Host\\b`, "g");
+    for (const m of cond.matchAll(direct)) {
+      if (compares(m[0]))
+        out2.push(m[1]);
+    }
+    for (const [hostVar, from] of hostOf) {
+      if (mentions(cond, hostVar) && compares(hostVar))
+        out2.push(from);
+    }
+    return out2;
+  }
+  guardHelpers(kind) {
+    const cached = this.guardHelperCache.get(kind);
+    if (cached)
+      return cached;
+    const map = new Map;
+    this.guardHelperCache.set(kind, map);
+    for (const m of this.methods) {
+      const signature = this.lines[m.start_line - 1] ?? "";
+      const open = signature.indexOf("(", signature.indexOf(m.name));
+      const params = open === -1 ? null : insideParens(signature, open);
+      if (!params)
+        continue;
+      const names = params.split(",").map((p) => p.trim().split(/\s+/).pop() ?? "");
+      const returns = this.returnExprs(m);
+      if (returns.length !== 1)
+        continue;
+      const proven = this.provenBy(kind, returns[0].expr, new Map, new Map, false);
+      const pos = names.findIndex((n) => proven.includes(n));
+      if (pos !== -1)
+        map.set(m.name, pos);
+    }
+    return map;
+  }
+  provenBy(kind, cond, parsedFrom, hostOf, withHelpers) {
+    const out2 = kind === "allowlist" ? this.allowlistVars(cond) : kind === "numeric" ? this.numericVars(cond, parsedFrom) : this.hostVars(cond, hostOf);
+    if (withHelpers) {
+      for (const [name2, pos] of this.guardHelpers(kind)) {
+        for (const call of cond.matchAll(new RegExp(`(?<![\\w.])${escapeRegex(name2)}\\s*\\(`, "g"))) {
+          const args2 = insideParens(cond, call.index + call[0].length - 1)?.split(",") ?? [];
+          const arg = args2[pos]?.trim();
+          if (arg && new RegExp(`^${IDENT}$`).test(arg))
+            out2.push(arg);
+        }
+      }
+    }
+    return out2;
+  }
+  guardedVarsAt(type, sinkLine) {
+    const kinds = [];
+    if (INERT_WHEN_ALPHANUMERIC.has(type))
+      kinds.push("allowlist", "numeric");
+    if (type === "ssrf")
+      kinds.push("host");
+    const proven = new Set;
+    if (kinds.length === 0)
+      return proven;
+    const scopeStart = this.methodAt(sinkLine)?.start_line ?? 1;
+    const before = this.statements(scopeStart, sinkLine);
+    const boolOf = new Map;
+    const parsedFrom = new Map;
+    const hostOf = new Map;
+    const parseAnywhere = new RegExp(`(${IDENT})\\s*=\\s*(?:\\([^)]*\\)\\s*)?(?:int|long|short|byte|uint|ulong|decimal|double|float|Int32|Int64)\\s*\\.\\s*Parse\\s*\\(\\s*(${IDENT})\\s*[,)]`, "g");
+    for (const st of before) {
+      for (const p of st.text.matchAll(parseAnywhere))
+        parsedFrom.set(p[1], p[2]);
+      const m = ASSIGN_RE.exec(st.text);
+      if (!m)
+        continue;
+      const [, lhs, rhs] = m;
+      const parse2 = new RegExp(`^(?:\\([^)]*\\)\\s*)?(?:int|long|short|byte|uint|ulong|decimal|double|float|Int32|Int64)\\s*\\.\\s*Parse\\s*\\(\\s*(${IDENT})\\s*[,)]`).exec(rhs);
+      if (parse2)
+        parsedFrom.set(lhs, parse2[1]);
+      const host = new RegExp(`^new\\s+(?:System\\s*\\.\\s*)?Uri\\s*\\(\\s*(${IDENT})\\s*\\)\\s*\\.\\s*Host$`).exec(rhs.trim());
+      if (host)
+        hostOf.set(lhs, host[1]);
+      boolOf.set(lhs, rhs);
+    }
+    const credit = (cond) => {
+      const resolved = new RegExp(`^${IDENT}$`).test(cond) ? boolOf.get(cond) ?? cond : cond;
+      for (const kind of kinds) {
+        for (const v of this.provenBy(kind, resolved, parsedFrom, hostOf, true))
+          proven.add(v);
+      }
+    };
+    const own = leadingIf(this.lines[sinkLine - 1] ?? "");
+    if (own && !own.cond.startsWith("!"))
+      credit(own.cond);
+    let depth = 0;
+    for (let i2 = sinkLine - 1;i2 >= scopeStart; i2--) {
+      const text = this.lines[i2 - 1] ?? "";
+      for (let c = text.length - 1;c >= 0; c--) {
+        if (text[c] === "}")
+          depth++;
+        else if (text[c] === "{") {
+          if (depth > 0) {
+            depth--;
+            continue;
+          }
+          let header = text.slice(0, c);
+          for (let h = i2 - 1;header.trim() === "" && h >= scopeStart; h--)
+            header = this.lines[h - 1] ?? "";
+          const enclosing = leadingIf(header);
+          if (enclosing && !enclosing.cond.startsWith("!"))
+            credit(enclosing.cond);
+        }
+      }
+    }
+    for (let i2 = scopeStart;i2 < sinkLine; i2++) {
+      const guard = leadingIf(this.lines[i2 - 1] ?? "");
+      if (!guard)
+        continue;
+      let rest = guard.rest;
+      for (let n = i2 + 1;rest === "" && n < sinkLine; n++)
+        rest = (this.lines[n - 1] ?? "").trim();
+      if (!EXITS_RE.test(rest))
+        continue;
+      if (guard.cond.startsWith("!")) {
+        const inner = guard.cond.slice(1).trim();
+        const wrapped = inner.startsWith("(") && insideParens(inner, 0)?.length === inner.length - 2;
+        credit(wrapped ? inner.slice(1, -1) : inner);
+      } else if (/!=/.test(guard.cond) && !/[|&]/.test(guard.cond))
+        credit(guard.cond.replace("!=", "=="));
+    }
+    return proven;
+  }
+  safeBuilders(credited, sinkLine) {
+    const scopeStart = this.methodAt(sinkLine)?.start_line ?? 1;
+    const onlySafe = (expr) => {
+      const idents = expr.replace(/\$?@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ").replace(/\.\s*[A-Za-z_]\w*\s*\(\s*\)/g, " ").match(/[A-Za-z_]\w*/g) ?? [];
+      return idents.every((id) => credited.has(id));
+    };
+    const state = new Map;
+    const declRe = new RegExp(`\\b(?:StringBuilder|var)\\s+(${IDENT})\\s*=\\s*new\\s+(?:System\\s*\\.\\s*Text\\s*\\.\\s*)?StringBuilder\\s*\\(`);
+    const writeRe = new RegExp(`^\\s*(${IDENT})\\s*\\.\\s*(?:Append|AppendLine|AppendFormat|Insert)\\s*\\(`);
+    for (const st of this.statements(scopeStart, sinkLine)) {
+      const decl = declRe.exec(st.text);
+      if (decl) {
+        const args2 = insideParens(st.text, decl.index + decl[0].length - 1) ?? "";
+        state.set(decl[1], onlySafe(args2));
+        continue;
+      }
+      const write = writeRe.exec(st.text);
+      if (write && state.has(write[1])) {
+        const args2 = insideParens(st.text, write[0].length - 1);
+        if (args2 === null || !onlySafe(args2))
+          state.set(write[1], false);
+      }
+    }
+    return new Set([...state].filter(([, safe]) => safe).map(([name2]) => name2));
+  }
+  creditedOnLine(line) {
+    const text = this.sinkText(line);
+    const types = new Set(CSHARP_SANITIZER_RES.map((r) => r.type));
+    for (const t of INERT_WHEN_ALPHANUMERIC)
+      types.add(t);
+    types.add("ssrf");
+    for (const type of types) {
+      if (this.sanitizes(type, text))
+        return true;
+      const credited = new Set([...this.sanitizedVarsAt(type, line), ...this.guardedVarsAt(type, line)]);
+      for (const v of this.safeBuilders(credited, line))
+        credited.add(v);
+      for (const v of credited)
+        if (mentions(text, v))
+          return true;
+    }
+    return this.fixedHostRequest(line);
+  }
+  fixedHostRequest(sinkLine) {
+    const fixedLiteral = '\\$?@?"https?:\\/\\/[A-Za-z0-9.\\-]+(?::\\d+)?[\\/?#][^"]*"';
+    const text = this.lines[sinkLine - 1] ?? "";
+    const argStart = `\\(\\s*(?:new\\s+(?:System\\s*\\.\\s*)?Uri\\s*\\(\\s*)?`;
+    if (new RegExp(argStart + fixedLiteral).test(text))
+      return true;
+    const scopeStart = this.methodAt(sinkLine)?.start_line ?? 1;
+    const fixed = new Set;
+    for (const st of this.statements(scopeStart, sinkLine)) {
+      const m = ASSIGN_RE.exec(st.text);
+      if (!m)
+        continue;
+      if (new RegExp("^(?:new\\s+(?:System\\s*\\.\\s*)?Uri\\s*\\(\\s*)?" + fixedLiteral).test(m[2].trim()))
+        fixed.add(m[1]);
+      else
+        fixed.delete(m[1]);
+    }
+    for (const v of fixed) {
+      if (new RegExp(argStart + escapeRegex(v) + "\\s*[,)]").test(text))
+        return true;
+    }
+    return false;
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 function escapeReSf(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -34364,7 +34808,6 @@ function jsSsrfHostGuardedLines(code) {
   }
   return covered;
 }
-var CSHARP_ALLOWLIST_STRIP_RE = /\bRegex\s*\.\s*Replace\s*\([^,]*,\s*@?"\[\^(?:[A-Za-z0-9_\- ]|\\w|\\d|\\s)+\]"\s*,\s*@?"[A-Za-z0-9_]?"\s*\)/;
 function isUnwrittenLocalMapKeyRead(code, source) {
   if (source.type !== "plugin_param")
     return false;
@@ -34391,15 +34834,6 @@ function isUnwrittenLocalMapKeyRead(code, source) {
     return false;
   return true;
 }
-var CSHARP_SANITIZER_RES = [
-  { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: "xss" },
-  { re: /\bHtmlEncoder\s*\.\s*Encode\s*\(/, type: "xss" },
-  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" },
-  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "ldap_injection" },
-  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "xpath_injection" },
-  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "command_injection" },
-  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "sql_injection" }
-];
 function csharpSanitizedVarsByType(code) {
   const lines = code.split(`
 `);
@@ -34432,7 +34866,7 @@ function csharpSanitizedVarsByType(code) {
       for (const [type, set] of byType) {
         if (set.has(lhs))
           continue;
-        const refsSanitized = [...set].some((v) => new RegExp(`(?<![\\w])${escapeRegex(v)}(?![\\w])`).test(rhs));
+        const refsSanitized = [...set].some((v) => new RegExp(`(?<![\\w])${escapeRegex2(v)}(?![\\w])`).test(rhs));
         if (refsSanitized) {
           set.add(lhs);
           changed = true;
@@ -35328,22 +35762,34 @@ class SinkFilterPass {
       const sourceLines = ctx.code.split(`
 `);
       const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
+      const csFields = new Set(ctx.graph.ir.types.flatMap((t) => (t.fields ?? []).map((f) => f.name)));
+      const credit = new CSharpCredit(ctx.code, ctx.graph.ir.types.flatMap((t) => t.methods));
       const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
         if (sink.type === "xxe" && xxeHardened)
           return false;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        for (const { re, type } of CSHARP_SANITIZER_RES) {
-          if (type === sink.type && re.test(sinkLineText))
+        if (credit.sanitizes(sink.type, sinkLineText))
+          return false;
+        if (sink.type === "ssrf" && credit.fixedHostRequest(sink.line))
+          return false;
+        const scoped = credit.sanitizedVarsAt(sink.type, sink.line);
+        const fileWide = sanitizedByType.get(sink.type);
+        const sanitizedVars = new Set(scoped);
+        if (fileWide) {
+          for (const v of fileWide)
+            if (csFields.has(v))
+              sanitizedVars.add(v);
+        }
+        for (const v of credit.guardedVarsAt(sink.type, sink.line))
+          sanitizedVars.add(v);
+        for (const v of credit.safeBuilders(sanitizedVars, sink.line))
+          sanitizedVars.add(v);
+        const received = credit.sinkText(sink.line);
+        for (const v of sanitizedVars) {
+          if (new RegExp(`(?<![\\w])${escapeRegex2(v)}(?![\\w])`).test(received))
             return false;
         }
-        const sanitizedVars = sanitizedByType.get(sink.type);
-        if (sanitizedVars && sanitizedVars.size > 0) {
-          for (const v of sanitizedVars) {
-            if (new RegExp(`(?<![\\w])${escapeRegex(v)}(?![\\w])`).test(sinkLineText))
-              return false;
-          }
-        }
         return true;
       });
     }
@@ -35351,7 +35797,7 @@ class SinkFilterPass {
       const sourceLines = ctx.code.split(`
 `);
       const constBaseClients = new Set;
-      const declRe = /\b(?:var|HttpClient)\s+([A-Za-z_]\w*)\s*=\s*new\s+HttpClient\s*\{[^}]*\bBaseAddress\s*=\s*new\s+Uri\s*\(\s*(?:@?"[^"]*"|\$?"[^"{}]*")\s*\)/;
+      const declRe = /\b(?:var|HttpClient)\s+([A-Za-z_]\w*)\s*=\s*new\s+HttpClient\s*(?:\([^)]*\)\s*)?\{[^}]*\bBaseAddress\s*=\s*new\s+(?:System\s*\.\s*)?Uri\s*\(\s*(?:@?"[^"]*"|\$?"[^"{}]*")\s*\)/;
       for (const line of sourceLines) {
         const m = declRe.exec(line);
         if (m)
@@ -35365,14 +35811,22 @@ class SinkFilterPass {
           const text = sourceLines[sink.line - 1] ?? "";
           let onConstClient = false;
           for (const v of constBaseClients) {
-            if (new RegExp(`(?<![\\w])${escapeRegex(v)}\\s*\\.`).test(text)) {
+            if (new RegExp(`(?<![\\w])${escapeRegex2(v)}\\s*\\.`).test(text)) {
               onConstClient = true;
               break;
             }
           }
           if (!onConstClient)
             return true;
-          const m = relativeLiteralArgRe.exec(text);
+          let m = relativeLiteralArgRe.exec(text);
+          if (!m) {
+            const arg = /Async\s*\(\s*([A-Za-z_]\w*)\s*[,)]/.exec(text)?.[1];
+            if (arg) {
+              const assigned = new RegExp(`\\b${escapeRegex2(arg)}\\s*=\\s*(?:@?\\$?)"([^"]*)"`);
+              for (let i2 = sink.line - 2;i2 >= 0 && !m; i2--)
+                m = assigned.exec(sourceLines[i2] ?? "");
+            }
+          }
           if (!m)
             return true;
           const lit = m[1];
@@ -35408,7 +35862,7 @@ class SinkFilterPass {
       const wrappers = findPythonLdapStripWrappers(sourceLines);
       const allLdapSanitizers = [...PY_BUILTIN_LDAP_SANITIZERS, ...wrappers];
       if (allLdapSanitizers.length > 0) {
-        const ldapPatterns = allLdapSanitizers.map((name2) => new RegExp(`\\b${escapeRegex(name2)}\\s*\\(`));
+        const ldapPatterns = allLdapSanitizers.map((name2) => new RegExp(`\\b${escapeRegex2(name2)}\\s*\\(`));
         filtered = filtered.filter((sink) => {
           if (sink.type !== "ldap_injection")
             return true;
@@ -35494,7 +35948,7 @@ class SinkFilterPass {
     return { sources, sinks: filtered, sanitizers };
   }
 }
-function escapeRegex(s) {
+function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var RESERVED_KEYWORDS = new Set([
@@ -35576,7 +36030,7 @@ function extractSourceIdentifiers(text) {
   return out2;
 }
 function isAssignedFromSanitizerPattern(sourceLines, sinkLine, varName, sanitizerPatterns, lookback = 30) {
-  const escapedVar = escapeRegex(varName);
+  const escapedVar = escapeRegex2(varName);
   const assignRe = new RegExp(`(?:\\b(?:const|let|var|final|String)\\s+)?\\b${escapedVar}\\s*=\\s*(.+)`);
   const fnBoundaryRe = /^\s*(?:def\s+\w+\s*\(|function\s+\w+\s*\(|\w+\s*[:=]\s*(?:async\s+)?\(?[^)]*\)?\s*=>)/;
   const lo = Math.max(0, sinkLine - 1 - lookback);
@@ -37145,7 +37599,7 @@ class LibraryProfileXssGatePass {
 
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 var CONTAINER_READ_SOURCES = new Set(["plugin_param", "config_param"]);
-function makeConstPropVeto(constProp, graph, sources, code) {
+function makeConstPropVeto(constProp, graph, sources, code, language) {
   const lines = typeof code === "string" ? code.split(`
 `) : [];
   const selfReassign = new Map;
@@ -37182,6 +37636,8 @@ function makeConstPropVeto(constProp, graph, sources, code) {
       return false;
     if (r.reason !== "variable_not_tainted")
       return true;
+    if (language === "csharp")
+      return false;
     const lo = Math.min(sourceLine, sinkLine);
     let d = defAt(step.variable, step.line);
     let selfHops = 0;
@@ -37220,7 +37676,7 @@ class TaintPropagationPass {
       return { flows: [] };
     }
     const propagationResult = propagateTaint(graph, sources, sinks, sanitizers);
-    const isVetoed = makeConstPropVeto(constProp, graph, sources, ctx.code);
+    const isVetoed = makeConstPropVeto(constProp, graph, sources, ctx.code, ctx.language);
     const verifiedFlows = propagationResult.flows.filter((flow) => {
       if (constProp.unreachableLines.has(flow.sink.line))
         return false;
@@ -37790,7 +38246,7 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
               if (source.variable && source.variable !== varName && source.in_method && call.in_method && source.in_method !== call.in_method) {
                 continue;
               }
-              if (typeof code === "string" && isReassignedToLiteralBetween(code, varName, source.line, sink.line)) {
+              if (typeof code === "string" && isReassignedToLiteralBetween(code, varName, source.line, sink.line, unreachableLines)) {
                 continue;
               }
               flows.push({
@@ -37830,7 +38286,7 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
                   if (source.variable && source.variable !== collectionVar && source.in_method && call.in_method && source.in_method !== call.in_method) {
                     continue;
                   }
-                  if (typeof code === "string" && isReassignedToLiteralBetween(code, collectionVar, source.line, sink.line)) {
+                  if (typeof code === "string" && isReassignedToLiteralBetween(code, collectionVar, source.line, sink.line, unreachableLines)) {
                     continue;
                   }
                   flows.push({
@@ -37949,7 +38405,7 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
           if (paramSource) {
             const exists = flows.some((f) => f.source_line === paramSource.line && f.sink_line === sink.line && f.sink_type === sink.type);
             if (!exists) {
-              if (typeof code === "string" && isReassignedToLiteralBetween(code, arg.variable, paramSource.line, sink.line)) {
+              if (typeof code === "string" && isReassignedToLiteralBetween(code, arg.variable, paramSource.line, sink.line, unreachableLines)) {
                 continue;
               }
               flows.push({
@@ -37972,6 +38428,96 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
   }
   return flows;
 }
+function csharpMethodScopedAliases(code, seeds, methods, fieldNames) {
+  const lines = code.split(`
+`);
+  const methodOf = (line) => {
+    let best = -1;
+    let span = Infinity;
+    methods.forEach((m, i2) => {
+      if (line >= m.start_line && line <= m.end_line && m.end_line - m.start_line < span) {
+        best = i2;
+        span = m.end_line - m.start_line;
+      }
+    });
+    return best;
+  };
+  const declRe = /^\s*(?:public|private|protected|internal|static|readonly|const|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*\??)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const assignRe = /^\s*(?:this\s*\.\s*)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const returnRe = /^\s*return\s+(.+?);\s*$/;
+  const KEYWORDS = new Set(["return", "throw", "new", "await", "yield", "else", "case", "using", "var"]);
+  const codeOf = (rhs) => rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
+  const local = new Map;
+  const taintedFields = new Set;
+  const returnsTainted = new Set;
+  const localsOf = (m) => {
+    let set = local.get(m);
+    if (!set) {
+      set = new Set;
+      local.set(m, set);
+    }
+    return set;
+  };
+  for (const seed of seeds) {
+    const base = seed.variable.replace(/^this\./, "");
+    if (fieldNames.has(base))
+      taintedFields.add(base);
+    else
+      localsOf(methodOf(seed.line)).add(seed.variable);
+  }
+  const out2 = [];
+  let changed = true;
+  for (let guard = 0;changed && guard < lines.length + 2; guard++) {
+    changed = false;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      let text = lines[i2];
+      const trimmed = text.trimStart();
+      if (trimmed.startsWith("//") || trimmed.startsWith("*"))
+        continue;
+      if (/^\s*(?:[\w.<>\[\]?]+\s+)?[A-Za-z_]\w*\s*=(?!=)/.test(text) && !/;\s*(?:\/\/.*)?$/.test(text)) {
+        for (let j = i2 + 1;j < lines.length && j <= i2 + 12; j++) {
+          text = text.trimEnd() + " " + lines[j].trim();
+          if (/;\s*(?:\/\/.*)?$/.test(lines[j]))
+            break;
+        }
+      }
+      const m = methodOf(i2 + 1);
+      const here = localsOf(m);
+      const ret = returnRe.exec(text);
+      if (ret && m !== -1 && !returnsTainted.has(methods[m].name)) {
+        const idents2 = codeOf(ret[1]).match(/[\p{L}\p{N}_]+/gu) ?? [];
+        if (idents2.some((t) => here.has(t) || taintedFields.has(t))) {
+          returnsTainted.add(methods[m].name);
+          changed = true;
+        }
+        continue;
+      }
+      const d = declRe.exec(text) ?? assignRe.exec(text);
+      if (!d)
+        continue;
+      const [, lhs, rhs] = d;
+      if (KEYWORDS.has(lhs))
+        continue;
+      const isField = fieldNames.has(lhs) && !declRe.test(text);
+      if (isField ? taintedFields.has(lhs) : here.has(lhs))
+        continue;
+      const rhsCode = codeOf(rhs);
+      const idents = rhsCode.match(/[\p{L}\p{N}_]+/gu) ?? [];
+      const viaLocal = idents.some((t) => here.has(t));
+      const viaField = idents.some((t) => taintedFields.has(t) && !here.has(t));
+      const viaCall = [...rhsCode.matchAll(/([\p{L}_][\p{L}\p{N}_]*)\s*\(/gu)].some((c) => returnsTainted.has(c[1]));
+      if (!viaLocal && !viaField && !viaCall)
+        continue;
+      if (isField)
+        taintedFields.add(lhs);
+      else
+        here.add(lhs);
+      out2.push({ variable: lhs, line: i2 + 1, carried: !viaLocal });
+      changed = true;
+    }
+  }
+  return out2;
+}
 var _reassignSplitCode;
 var _reassignSplitLines;
 function splitLinesCached(code) {
@@ -37982,7 +38528,7 @@ function splitLinesCached(code) {
 `);
   return _reassignSplitLines;
 }
-function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
+function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine, unreachableLines) {
   if (!variable || sinkLine - srcLine < 2)
     return false;
   if (!/^[A-Za-z_][\w]*$/.test(variable))
@@ -38002,49 +38548,117 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
       return true;
     if (!reNaked.test(line) && !reSwitchCase.test(line))
       continue;
-    if (switchAlsoAssignsNonLiteral(lines, i2, variable, strLit))
+    if (siblingBranchAssignsNonLiteral(lines, i2, variable, strLit, unreachableLines))
       continue;
     return true;
   }
   return false;
 }
-function switchAlsoAssignsNonLiteral(lines, idx, variable, strLit) {
+function enclosingBrace(lines, line, col) {
   let depth = 0;
-  let start2 = -1;
-  for (let i2 = idx;i2 >= 0; i2--) {
-    const line = lines[i2];
-    for (let c = line.length - 1;c >= 0; c--) {
-      if (line[c] === "}")
+  for (let i2 = line;i2 >= 0; i2--) {
+    const text = lines[i2];
+    for (let c = i2 === line ? Math.min(col, text.length) - 1 : text.length - 1;c >= 0; c--) {
+      if (text[c] === "}")
         depth++;
-      else if (line[c] === "{")
+      else if (text[c] === "{") {
+        if (depth === 0) {
+          let header = text.slice(0, c).trim();
+          let headerLine = i2;
+          for (let h = i2 - 1;header === "" && h >= 0; h--) {
+            header = lines[h].trim();
+            headerLine = h;
+          }
+          return { line: i2, col: c, header, headerLine };
+        }
         depth--;
+      }
     }
-    if (depth < 0) {
-      if (/\bswitch\b/.test(line))
-        start2 = i2;
-      break;
+  }
+  return null;
+}
+function matchingClose(lines, line, col) {
+  let depth = 0;
+  for (let i2 = line;i2 < lines.length; i2++) {
+    const text = lines[i2];
+    for (let c = i2 === line ? col : 0;c < text.length; c++) {
+      if (text[c] === "{")
+        depth++;
+      else if (text[c] === "}" && --depth === 0)
+        return { line: i2, col: c };
     }
   }
-  if (start2 < 0)
+  return null;
+}
+function siblingBranchAssignsNonLiteral(lines, idx, variable, strLit, unreachableLines) {
+  let block = enclosingBrace(lines, idx, 0);
+  if (block && /^(?:case\b.*|default\s*):$/.test(block.header)) {
+    block = enclosingBrace(lines, block.line, block.col);
+  }
+  if (!block)
+    return false;
+  let first = block.headerLine;
+  let last;
+  const end = matchingClose(lines, block.line, block.col);
+  if (!end)
     return false;
+  last = end.line;
+  if (/\bswitch\b/.test(block.header)) {} else if (/^(?:\}\s*)?else\b/.test(block.header) || /^(?:\}\s*)?(?:else\s+)?if\s*\(/.test(block.header)) {
+    let cur = block;
+    for (let guard = 0;guard < 64 && /^(?:\}\s*)?else\b/.test(cur.header); guard++) {
+      let closeLine = cur.headerLine;
+      let closeCol = lines[closeLine].indexOf("}");
+      if (closeCol === -1 || closeCol > lines[closeLine].search(/\belse\b/)) {
+        closeLine--;
+        while (closeLine >= 0 && lines[closeLine].trim() === "")
+          closeLine--;
+        if (closeLine < 0 || !lines[closeLine].trimEnd().endsWith("}"))
+          return false;
+        closeCol = lines[closeLine].lastIndexOf("}");
+      }
+      const prev = enclosingBrace(lines, closeLine, closeCol);
+      if (!prev)
+        return false;
+      cur = prev;
+      first = prev.headerLine;
+    }
+    let close = end;
+    for (let guard = 0;guard < 64; guard++) {
+      let l = close.line;
+      let rest = lines[l].slice(close.col + 1).trim();
+      while (rest === "" && l + 1 < lines.length) {
+        l++;
+        rest = lines[l].trim();
+      }
+      if (!/^else\b/.test(rest))
+        break;
+      let openLine = l;
+      let openCol = lines[l].indexOf("{", l === close.line ? close.col + 1 : 0);
+      if (openCol === -1) {
+        openLine = l + 1;
+        while (openLine < lines.length && lines[openLine].trim() === "")
+          openLine++;
+        if (openLine >= lines.length || !lines[openLine].trimStart().startsWith("{"))
+          break;
+        openCol = lines[openLine].indexOf("{");
+      }
+      const next = matchingClose(lines, openLine, openCol);
+      if (!next)
+        break;
+      close = next;
+      last = next.line;
+    }
+  } else {
+    return false;
+  }
   const assign = new RegExp(`(?:^|[^\\w.$])${variable}\\s*(?::?=)(?!=)\\s*(.*?)\\s*;?\\s*(?:break\\s*;?)?\\s*$`);
   const literalOnly = new RegExp(`^${strLit}$`);
-  depth = 0;
-  for (let i2 = start2;i2 < lines.length; i2++) {
-    const line = lines[i2];
-    if (i2 > start2 || line.includes("{")) {
-      const m = assign.exec(line);
-      if (m && m[1] && !literalOnly.test(m[1]))
-        return true;
-    }
-    for (const ch of line) {
-      if (ch === "{")
-        depth++;
-      else if (ch === "}")
-        depth--;
-    }
-    if (i2 > start2 && depth <= 0)
-      break;
+  for (let i2 = first;i2 <= last; i2++) {
+    if (i2 === idx || unreachableLines?.has(i2 + 1))
+      continue;
+    const m = assign.exec(lines[i2]);
+    if (m && m[1] && !literalOnly.test(m[1]))
+      return true;
   }
   return false;
 }
@@ -38172,6 +38786,22 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
   const goFnStart = (line) => enclosingStart(goFnRanges, line);
   const csFnRanges = methodRanges(["csharp"]);
   const csFnStart = (line) => enclosingStart(csFnRanges, line);
+  const csFieldNames = new Set;
+  if (language === "csharp") {
+    for (const t of types ?? [])
+      for (const f of t.fields ?? [])
+        csFieldNames.add(f.name);
+  }
+  const csDifferentMethod = (variable, sourceLine, otherLine) => {
+    if (csFnRanges.length === 0)
+      return false;
+    const a = csFnStart(sourceLine);
+    const b = csFnStart(otherLine);
+    if (a === -1 || b === -1 || a === b)
+      return false;
+    const base = variable.replace(/^this\./, "").split(".")[0];
+    return !csFieldNames.has(base);
+  };
   const sourcesWithVar = sources.filter((s) => typeof s.variable === "string" && s.variable.length > 0);
   const aliasSanitizedFor = new Map;
   if (language === "python" && typeof code === "string") {
@@ -38444,7 +39074,29 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
-  if ((language === "java" || language === "csharp") && typeof code === "string" && sourcesWithVar.length > 0) {
+  if (language === "csharp" && typeof code === "string" && sourcesWithVar.length > 0 && csFnRanges.length > 0) {
+    const csMethods = (types ?? []).flatMap((t) => t.methods);
+    const seeds = sourcesWithVar.map((sv) => ({ variable: sv.variable, line: sv.line }));
+    const methodStartOf = (line) => csFnStart(line);
+    const aliases = csharpMethodScopedAliases(code, seeds, csMethods, csFieldNames);
+    const fileAnchor = sourcesWithVar.reduce((a, sv) => sv.line < a.line ? sv : a, sourcesWithVar[0]);
+    const have = new Set(sourcesWithVar.map((sv) => `${sv.variable}@${methodStartOf(sv.line)}`));
+    for (const alias of aliases) {
+      const fn = methodStartOf(alias.line);
+      const isField = csFieldNames.has(alias.variable);
+      const key = `${alias.variable}@${isField ? "field" : fn}`;
+      if (have.has(key))
+        continue;
+      have.add(key);
+      const inMethod = sourcesWithVar.filter((sv) => methodStartOf(sv.line) === fn && sv.line <= alias.line);
+      const from = !alias.carried && inMethod.length > 0 ? inMethod.reduce((a, sv) => sv.line < a.line ? sv : a, inMethod[0]) : fileAnchor;
+      sourcesWithVar.push({
+        ...from,
+        variable: alias.variable,
+        ...alias.carried || inMethod.length === 0 ? { line: alias.line } : {}
+      });
+    }
+  } else if ((language === "java" || language === "csharp") && typeof code === "string" && sourcesWithVar.length > 0) {
     const seedVars = new Set(sourcesWithVar.map((s) => s.variable));
     const derived = buildJavaTaintedVars(code, seedVars);
     if (derived.size > 0) {
@@ -38493,23 +39145,26 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     const lines = code.split(`
 `);
     const ctRe = /(\w+)\s*\.\s*CommandText\s*\+?=\s*(.+)/;
-    const anchor = sourcesWithVar.reduce((a, s) => s.line < a.line ? s : a, sourcesWithVar[0]);
+    const seeded = new Set;
     let added = true;
     let guard = 0;
     while (added && guard < lines.length + 2) {
       added = false;
       guard++;
-      const known = new Set(sourcesWithVar.map((s) => s.variable));
       for (let i2 = 0;i2 < lines.length; i2++) {
         const m = ctRe.exec(lines[i2]);
         if (!m)
           continue;
         const [, obj, rhs] = m;
-        if (known.has(obj))
+        const key = `${obj}@${csFnStart(i2 + 1)}`;
+        if (seeded.has(key))
           continue;
-        if (!argsReferenceTaintedVar(rhs, sourcesWithVar))
+        const reachable = sourcesWithVar.filter((sv) => sv.line <= i2 + 1 && !csDifferentMethod(sv.variable, sv.line, i2 + 1));
+        if (reachable.length === 0 || !argsReferenceTaintedVar(rhs, reachable))
           continue;
-        sourcesWithVar.push({ ...anchor, variable: obj, line: i2 + 1 });
+        const from = reachable.reduce((a, sv) => sv.line < a.line ? sv : a, reachable[0]);
+        sourcesWithVar.push({ ...from, variable: obj, line: i2 + 1 });
+        seeded.add(key);
         added = true;
       }
     }
@@ -38528,24 +39183,26 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     if (builders.size > 0) {
       const appendRe = /([\p{L}_][\p{L}\p{N}_]*)\s*\.\s*(?:Append|AppendLine|AppendFormat|Insert)\s*\(([\s\S]*)/u;
       const anchor = sourcesWithVar.reduce((a, s) => s.line < a.line ? s : a, sourcesWithVar[0]);
+      const builderSeeded = new Set;
       let added = true;
       let guard = 0;
       while (added && guard < lines.length + 2) {
         added = false;
         guard++;
-        const known = new Set(sourcesWithVar.map((s) => s.variable));
         for (let i2 = 0;i2 < lines.length; i2++) {
           const m = appendRe.exec(lines[i2]);
           if (!m)
             continue;
           const [, obj, args2] = m;
-          if (!builders.has(obj) || known.has(obj))
+          const seedKey = `${obj}@${csFnStart(i2 + 1)}`;
+          if (!builders.has(obj) || builderSeeded.has(seedKey))
             continue;
           const appendFn = csFnStart(i2 + 1);
           const reachable = sourcesWithVar.filter((sv) => appendFn === -1 || csFnStart(sv.line) === -1 || csFnStart(sv.line) === appendFn);
           if (reachable.length > 0 && argsReferenceTaintedVar(args2, reachable)) {
             sourcesWithVar.push({ ...anchor, variable: obj, line: i2 + 1 });
             builderSeeds.add(`${obj}@${i2 + 1}`);
+            builderSeeded.add(seedKey);
             added = true;
           }
         }
@@ -38628,6 +39285,8 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             if (srcFn !== sinkFn)
               continue;
           }
+          if (csDifferentMethod(source.variable, source.line, sink.line))
+            continue;
           if (complex) {
             const re = reCache.get(source.variable);
             if (!re || !re.test(expr))
@@ -38641,7 +39300,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
           if (aliasSanitizedFor.get(source.variable)?.has(sink.type)) {
             break;
           }
-          if (typeof code === "string" && isReassignedToLiteralBetween(code, source.variable, source.line, sink.line)) {
+          if (typeof code === "string" && isReassignedToLiteralBetween(code, source.variable, source.line, sink.line, unreachableLines)) {
             break;
           }
           flows.push({
@@ -38948,7 +39607,14 @@ var CSHARP_NON_ESCAPE_METHODS = new Set([
   "TryAdd",
   "Insert",
   "Push",
-  "Enqueue"
+  "Enqueue",
+  "EscapeDataString",
+  "EscapeUriString",
+  "UrlEncode",
+  "UrlPathEncode",
+  "HtmlEncode",
+  "HtmlAttributeEncode",
+  "JavaScriptStringEncode"
 ]);
 function isCSharpNonEscapeCall(call) {
   const name2 = call.method_name;
@@ -39520,6 +40186,7 @@ class InterproceduralPass {
       }
     }
     const language = graph.ir.meta.language;
+    const csCredit = language === "csharp" && typeof ctx.code === "string" ? new CSharpCredit(ctx.code, graph.ir.types.flatMap((t) => t.methods)) : null;
     if (sinks.length > 0) {
       const interProc = analyzeInterprocedural2(graph, sources, sinks, sanitizers, {
         taintedVariables: constProp.tainted
@@ -39552,6 +40219,9 @@ class InterproceduralPass {
               continue;
             if (sanitizerMethodNames.has(method.name))
               continue;
+            if (language === "csharp" && typeof ctx.code === "string" && !csharpParamReachesSink(ctx.code, method, edge.taintedArgs, sink, csCredit)) {
+              continue;
+            }
             for (const source of sources) {
               if (source.line > edge.callLine)
                 continue;
@@ -39693,9 +40363,58 @@ class InterproceduralPass {
         return !sanitizedSinkKeys.has(`${s.line}:${s.type}`);
       });
     }
+    if (csCredit) {
+      const credited = new Set;
+      filteredAdditionalFlows = filteredAdditionalFlows.filter((f) => {
+        if (f.sink_type !== "external_taint_escape" || !csCredit.creditedOnLine(f.sink_line))
+          return true;
+        credited.add(f.sink_line);
+        return false;
+      });
+      filteredAdditionalSinks = filteredAdditionalSinks.filter((s) => !(s.type === "external_taint_escape" && credited.has(s.line)));
+    }
     return { additionalSinks: filteredAdditionalSinks, additionalFlows: filteredAdditionalFlows, interprocedural };
   }
 }
+function csharpParamReachesSink(code, method, taintedArgs, sink, credit) {
+  const lines = code.split(/\r?\n/);
+  const params = taintedArgs.length > 0 ? method.parameters.filter((p) => taintedArgs.includes(p.position)) : method.parameters;
+  if (params.length === 0)
+    return true;
+  const derived = new Set(params.map((p) => p.name));
+  const codeOf = (text) => text.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
+  const mentionsDerived = (text) => {
+    const bare = codeOf(text);
+    return [...derived].filter((v) => new RegExp(`(?<![\\w.])${v}(?![\\w])`).test(bare));
+  };
+  const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>[\]?]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.+)$/;
+  const objectWriteRe = /^\s*([A-Za-z_]\w*)\s*\.\s*[A-Za-z_]\w*\s*(?:\+?=(?!=)|\()(.*)$/;
+  for (let i2 = method.startLine + 1;i2 < sink.line; i2++) {
+    const text = lines[i2 - 1] ?? "";
+    const assign = assignRe.exec(text);
+    if (assign) {
+      if (mentionsDerived(assign[2]).length > 0)
+        derived.add(assign[1]);
+      else if (!params.some((p) => p.name === assign[1]))
+        derived.delete(assign[1]);
+      continue;
+    }
+    const write = objectWriteRe.exec(text);
+    if (write && mentionsDerived(write[2]).length > 0)
+      derived.add(write[1]);
+  }
+  let statement = lines[sink.line - 1] ?? "";
+  for (let i2 = sink.line;i2 < lines.length && i2 < sink.line + 6 && !/[;{}]\s*$/.test(statement.trimEnd()); i2++) {
+    statement += " " + (lines[i2] ?? "").trim();
+  }
+  const reaching = mentionsDerived(statement);
+  if (reaching.length === 0)
+    return false;
+  if (!credit)
+    return true;
+  const safe = new Set([...credit.sanitizedVarsAt(sink.type, sink.line), ...credit.guardedVarsAt(sink.type, sink.line)]);
+  return reaching.some((v) => !safe.has(v));
+}
 
 // ../circle-ir/dist/analysis/passes/dead-code-pass.js
 class DeadCodePass {
@@ -40408,7 +41127,7 @@ class NullDerefPass {
 }
 
 // ../circle-ir/dist/analysis/passes/resource-leak-pass.js
-function escapeRegex2(s) {
+function escapeRegex3(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var FACTORY_METHOD_NAME_RE = /^(?:open|create|new|get|make|build)[A-Z]/;
@@ -40599,7 +41318,7 @@ class ResourceLeakPass {
     return false;
   }
   isReturnedToCaller(lines, variable, fromLine, toLine) {
-    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex2(variable)}\\b`);
+    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex3(variable)}\\b`);
     for (let l = fromLine;l <= toLine && l <= lines.length; l++) {
       if (varRe.test(lines[l - 1] ?? ""))
         return true;
@@ -40607,7 +41326,7 @@ class ResourceLeakPass {
     return false;
   }
   fieldStoredName(lines, variable, openLine, toLine) {
-    const thisAssignRe = new RegExp(`\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex2(variable)}\\b`);
+    const thisAssignRe = new RegExp(`\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex3(variable)}\\b`);
     for (let l = openLine;l <= toLine && l <= lines.length; l++) {
       const m = thisAssignRe.exec(lines[l - 1] ?? "");
       if (m)
@@ -40650,7 +41369,7 @@ class ResourceLeakPass {
     if (fieldNames.has(variable)) {
       candidateField = variable;
     } else {
-      const thisAssignRe = new RegExp(`(?:\\bthis\\s*\\.\\s*)?(\\w+)\\s*=\\s*${escapeRegex2(variable)}\\b`);
+      const thisAssignRe = new RegExp(`(?:\\bthis\\s*\\.\\s*)?(\\w+)\\s*=\\s*${escapeRegex3(variable)}\\b`);
       for (let l = fromLine;l <= toLine && l <= lines.length; l++) {
         const m = thisAssignRe.exec(lines[l - 1] ?? "");
         if (m && fieldNames.has(m[1])) {
@@ -51135,7 +51854,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.12.0";
+var version = "4.13.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -51687,8 +52406,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "8c284bc",
-  builtAt: "2026-10-08T00:42:12.776Z"
+  gitSha: "a45b21b",
+  builtAt: "2026-10-08T13:38:40.827Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.12.0",
+  "version": "4.13.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.12.0"
+    "circle-ir": "4.13.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.4",