cognium-dev 4.7.2 → 4.9.7

package/dist/cli.js

@@ -3646,6 +3646,7 @@ function extractCSharpTypes(tree, cache) {
       const nameNode = node.childForFieldName("name");
       const body2 = node.childForFieldName("body");
       const methods = [];
+      const fields = extractCSharpFields(body2);
       if (body2) {
         for (let i2 = 0;i2 < body2.childCount; i2++) {
           const m = body2.child(i2);
@@ -3665,7 +3666,7 @@ function extractCSharpTypes(tree, cache) {
                 parameters.push({
                   name: getNodeText(pName),
                   type: pType ? getNodeText(pType) : null,
-                  annotations: [],
+                  annotations: extractCSharpParamAnnotations(pnode),
                   line: pnode.startPosition.row + 1
                 });
               }
@@ -3691,7 +3692,7 @@ function extractCSharpTypes(tree, cache) {
         implements: [],
         annotations: [],
         methods,
-        fields: [],
+        fields,
         start_line: node.startPosition.row + 1,
         end_line: node.endPosition.row + 1
       });
@@ -3699,6 +3700,67 @@ function extractCSharpTypes(tree, cache) {
   }
   return types;
 }
+function extractCSharpFields(body2) {
+  const fields = [];
+  if (!body2)
+    return fields;
+  for (let i2 = 0;i2 < body2.childCount; i2++) {
+    const c = body2.child(i2);
+    if (!c)
+      continue;
+    if (c.type === "field_declaration") {
+      let varDecl = null;
+      for (let k = 0;k < c.childCount; k++) {
+        const cc = c.child(k);
+        if (cc?.type === "variable_declaration") {
+          varDecl = cc;
+          break;
+        }
+      }
+      if (!varDecl)
+        continue;
+      const typeNode = varDecl.childForFieldName("type");
+      const type = typeNode ? getNodeText(typeNode) : null;
+      const modifiers = extractCSharpModifiers(c);
+      for (let k = 0;k < varDecl.childCount; k++) {
+        const decl = varDecl.child(k);
+        if (decl?.type !== "variable_declarator")
+          continue;
+        const nameNode = decl.childForFieldName("name");
+        fields.push({ name: nameNode ? getNodeText(nameNode) : "unknown", type, modifiers, annotations: [] });
+      }
+    } else if (c.type === "property_declaration") {
+      const nameNode = c.childForFieldName("name");
+      if (!nameNode)
+        continue;
+      const typeNode = c.childForFieldName("type");
+      fields.push({
+        name: getNodeText(nameNode),
+        type: typeNode ? getNodeText(typeNode) : null,
+        modifiers: extractCSharpModifiers(c),
+        annotations: []
+      });
+    }
+  }
+  return fields;
+}
+function extractCSharpParamAnnotations(param) {
+  const out2 = [];
+  for (let i2 = 0;i2 < param.childCount; i2++) {
+    const list = param.child(i2);
+    if (list?.type !== "attribute_list")
+      continue;
+    for (let j = 0;j < list.childCount; j++) {
+      const attr = list.child(j);
+      if (attr?.type !== "attribute")
+        continue;
+      const name2 = attr.childForFieldName("name");
+      if (name2)
+        out2.push(getNodeText(name2));
+    }
+  }
+  return out2;
+}
 function extractCSharpModifiers(node) {
   const mods = [];
   for (let i2 = 0;i2 < node.childCount; i2++) {
@@ -5328,15 +5390,24 @@ function extractCSharpCalls(tree, cache) {
     if (left?.type !== "member_access_expression")
       continue;
     const nameNode = left.childForFieldName("name");
-    if (!nameNode || getNodeText(nameNode) !== "CommandText")
+    if (!nameNode)
+      continue;
+    const propName = getNodeText(nameNode);
+    const exprNode = left.childForFieldName("expression");
+    if (propName === "Filter") {
+      const recv = exprNode ? getNodeText(exprNode) : null;
+      const recvType = recv ? typeMap.get(recv) : undefined;
+      if (recvType !== "DirectorySearcher")
+        continue;
+    } else if (propName !== "CommandText") {
       continue;
+    }
     const right = asn.childForFieldName("right");
     if (!right)
       continue;
     const rhsText = getNodeText(right);
-    const exprNode = left.childForFieldName("expression");
     calls.push({
-      method_name: "CommandText",
+      method_name: propName,
       receiver: exprNode ? getNodeText(exprNode) : null,
       receiver_type: null,
       receiver_type_fqn: null,
@@ -7985,6 +8056,9 @@ function buildCFG(tree, language, cache) {
   if (effectiveLanguage === "go") {
     return buildGoCFG(tree, blockIdCounter, cache);
   }
+  if (effectiveLanguage === "csharp") {
+    return buildCSharpCFG(tree, blockIdCounter, cache);
+  }
   if (isJavaScript) {
     const functions = [
       ...getNodesFromCache(tree.rootNode, "function_declaration", cache),
@@ -7998,7 +8072,7 @@ function buildCFG(tree, language, cache) {
       if (!body2)
         continue;
       if (body2.type === "statement_block") {
-        const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, true);
+        const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, "js");
         allBlocks.push(...blocks);
         allEdges.push(...edges);
         blockIdCounter = nextId;
@@ -8021,7 +8095,7 @@ function buildCFG(tree, language, cache) {
       const body2 = method.childForFieldName("body");
       if (!body2)
         continue;
-      const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, false);
+      const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, "java");
       allBlocks.push(...blocks);
       allEdges.push(...edges);
       blockIdCounter = nextId;
@@ -8029,7 +8103,29 @@ function buildCFG(tree, language, cache) {
   }
   return { blocks: allBlocks, edges: allEdges };
 }
-function buildMethodCFG(body2, startId, isJavaScript) {
+function buildCSharpCFG(tree, blockIdCounter, cache) {
+  const allBlocks = [];
+  const allEdges = [];
+  const containers = [
+    ...getNodesFromCache(tree.rootNode, "method_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "constructor_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "destructor_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "operator_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "local_function_statement", cache),
+    ...getNodesFromCache(tree.rootNode, "accessor_declaration", cache)
+  ];
+  for (const container of containers) {
+    const body2 = container.childForFieldName("body");
+    if (!body2 || body2.type !== "block")
+      continue;
+    const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, "csharp");
+    allBlocks.push(...blocks);
+    allEdges.push(...edges);
+    blockIdCounter = nextId;
+  }
+  return { blocks: allBlocks, edges: allEdges };
+}
+function buildMethodCFG(body2, startId, dialect) {
   const blocks = [];
   const edges = [];
   let currentId = startId;
@@ -8040,7 +8136,7 @@ function buildMethodCFG(body2, startId, isJavaScript) {
     end_line: body2.startPosition.row + 1
   };
   blocks.push(entryBlock);
-  const result = processStatements(body2, currentId, blocks, edges, isJavaScript);
+  const result = processStatements(body2, currentId, blocks, edges, dialect);
   currentId = result.nextId;
   if (result.entryId !== -1) {
     edges.push({
@@ -8072,7 +8168,7 @@ function buildMethodCFG(body2, startId, isJavaScript) {
   }
   return { blocks, edges, nextId: currentId };
 }
-function processStatements(container, startId, blocks, edges, isJavaScript) {
+function processStatements(container, startId, blocks, edges, dialect) {
   let currentId = startId;
   let firstBlockId = -1;
   let lastExitIds = [];
@@ -8080,9 +8176,9 @@ function processStatements(container, startId, blocks, edges, isJavaScript) {
     const stmt = container.child(i2);
     if (!stmt)
       continue;
-    if (!isStatement(stmt, isJavaScript))
+    if (!isStatement(stmt, dialect))
       continue;
-    const result = processStatement(stmt, currentId, blocks, edges, isJavaScript);
+    const result = processStatement(stmt, currentId, blocks, edges, dialect);
     currentId = result.nextId;
     if (firstBlockId === -1) {
       firstBlockId = result.entryId;
@@ -8103,31 +8199,49 @@ function processStatements(container, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function processStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processStatement(stmt, startId, blocks, edges, dialect) {
   switch (stmt.type) {
     case "if_statement":
-      return processIfStatement(stmt, startId, blocks, edges, isJavaScript);
+      return processIfStatement(stmt, startId, blocks, edges, dialect);
     case "for_statement":
     case "enhanced_for_statement":
     case "for_in_statement":
     case "for_of_statement":
-      return processForStatement(stmt, startId, blocks, edges, isJavaScript);
+    case "foreach_statement":
+      return processForStatement(stmt, startId, blocks, edges, dialect);
     case "while_statement":
-      return processWhileStatement(stmt, startId, blocks, edges, isJavaScript);
+      return processWhileStatement(stmt, startId, blocks, edges, dialect);
     case "do_statement":
-      return processDoWhileStatement(stmt, startId, blocks, edges, isJavaScript);
+      return processDoWhileStatement(stmt, startId, blocks, edges, dialect);
     case "try_statement":
-      return processTryStatement(stmt, startId, blocks, edges, isJavaScript);
+      return processTryStatement(stmt, startId, blocks, edges, dialect);
     case "switch_expression":
     case "switch_statement":
-      return processSwitchStatement(stmt, startId, blocks, edges, isJavaScript);
+      return processSwitchStatement(stmt, startId, blocks, edges, dialect);
+    case "using_statement":
+    case "lock_statement":
+    case "checked_statement":
+    case "unsafe_statement": {
+      const inner = stmt.childForFieldName("body") ?? lastBlockChild(stmt);
+      if (inner)
+        return processStatement(inner, startId, blocks, edges, dialect);
+      return processSimpleStatement(stmt, startId, blocks);
+    }
     case "block":
     case "statement_block":
-      return processStatements(stmt, startId, blocks, edges, isJavaScript);
+      return processStatements(stmt, startId, blocks, edges, dialect);
     default:
       return processSimpleStatement(stmt, startId, blocks);
   }
 }
+function lastBlockChild(node) {
+  for (let i2 = node.childCount - 1;i2 >= 0; i2--) {
+    const c = node.child(i2);
+    if (c && c.type === "block")
+      return c;
+  }
+  return null;
+}
 function processSimpleStatement(stmt, startId, blocks) {
   const block = {
     id: startId,
@@ -8142,7 +8256,7 @@ function processSimpleStatement(stmt, startId, blocks) {
     nextId: startId + 1
   };
 }
-function processIfStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processIfStatement(stmt, startId, blocks, edges, dialect) {
   let currentId = startId;
   const condBlock = {
     id: currentId++,
@@ -8154,7 +8268,7 @@ function processIfStatement(stmt, startId, blocks, edges, isJavaScript) {
   const exitIds = [];
   const consequence = stmt.childForFieldName("consequence");
   if (consequence) {
-    const thenResult = processStatement(consequence, currentId, blocks, edges, isJavaScript);
+    const thenResult = processStatement(consequence, currentId, blocks, edges, dialect);
     currentId = thenResult.nextId;
     edges.push({
       from: condBlock.id,
@@ -8165,7 +8279,7 @@ function processIfStatement(stmt, startId, blocks, edges, isJavaScript) {
   }
   const alternative = stmt.childForFieldName("alternative");
   if (alternative) {
-    const elseResult = processStatement(alternative, currentId, blocks, edges, isJavaScript);
+    const elseResult = processStatement(alternative, currentId, blocks, edges, dialect);
     currentId = elseResult.nextId;
     edges.push({
       from: condBlock.id,
@@ -8182,7 +8296,7 @@ function processIfStatement(stmt, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function processForStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processForStatement(stmt, startId, blocks, edges, dialect) {
   let currentId = startId;
   const loopBlock = {
     id: currentId++,
@@ -8193,7 +8307,7 @@ function processForStatement(stmt, startId, blocks, edges, isJavaScript) {
   blocks.push(loopBlock);
   const body2 = stmt.childForFieldName("body");
   if (body2) {
-    const bodyResult = processStatement(body2, currentId, blocks, edges, isJavaScript);
+    const bodyResult = processStatement(body2, currentId, blocks, edges, dialect);
     currentId = bodyResult.nextId;
     edges.push({
       from: loopBlock.id,
@@ -8214,16 +8328,16 @@ function processForStatement(stmt, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function processWhileStatement(stmt, startId, blocks, edges, isJavaScript) {
-  return processForStatement(stmt, startId, blocks, edges, isJavaScript);
+function processWhileStatement(stmt, startId, blocks, edges, dialect) {
+  return processForStatement(stmt, startId, blocks, edges, dialect);
 }
-function processDoWhileStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processDoWhileStatement(stmt, startId, blocks, edges, dialect) {
   let currentId = startId;
   const body2 = stmt.childForFieldName("body");
   let bodyEntryId = currentId;
   let bodyExitIds = [];
   if (body2) {
-    const bodyResult = processStatement(body2, currentId, blocks, edges, isJavaScript);
+    const bodyResult = processStatement(body2, currentId, blocks, edges, dialect);
     currentId = bodyResult.nextId;
     bodyEntryId = bodyResult.entryId;
     bodyExitIds = bodyResult.exitIds;
@@ -8253,13 +8367,13 @@ function processDoWhileStatement(stmt, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function processTryStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processTryStatement(stmt, startId, blocks, edges, dialect) {
   let currentId = startId;
   const exitIds = [];
   const body2 = stmt.childForFieldName("body");
   let tryEntryId = -1;
   if (body2) {
-    const bodyResult = processStatements(body2, currentId, blocks, edges, isJavaScript);
+    const bodyResult = processStatements(body2, currentId, blocks, edges, dialect);
     currentId = bodyResult.nextId;
     tryEntryId = bodyResult.entryId;
     exitIds.push(...bodyResult.exitIds);
@@ -8269,7 +8383,7 @@ function processTryStatement(stmt, startId, blocks, edges, isJavaScript) {
     if (child?.type === "catch_clause") {
       const catchBody = child.childForFieldName("body");
       if (catchBody) {
-        const catchResult = processStatements(catchBody, currentId, blocks, edges, isJavaScript);
+        const catchResult = processStatements(catchBody, currentId, blocks, edges, dialect);
         currentId = catchResult.nextId;
         if (tryEntryId !== -1) {
           edges.push({
@@ -8282,9 +8396,18 @@ function processTryStatement(stmt, startId, blocks, edges, isJavaScript) {
       }
     }
   }
-  const finallyClause = stmt.childForFieldName("finally") ?? stmt.childForFieldName("finalizer");
+  let finallyClause = stmt.childForFieldName("finally") ?? stmt.childForFieldName("finalizer");
+  if (!finallyClause && dialect === "csharp") {
+    for (let i2 = 0;i2 < stmt.childCount; i2++) {
+      const child = stmt.child(i2);
+      if (child?.type === "finally_clause") {
+        finallyClause = lastBlockChild(child);
+        break;
+      }
+    }
+  }
   if (finallyClause) {
-    const finallyResult = processStatements(finallyClause, currentId, blocks, edges, isJavaScript);
+    const finallyResult = processStatements(finallyClause, currentId, blocks, edges, dialect);
     currentId = finallyResult.nextId;
     for (const exitId of exitIds) {
       edges.push({
@@ -8305,7 +8428,7 @@ function processTryStatement(stmt, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function processSwitchStatement(stmt, startId, blocks, edges, isJavaScript) {
+function processSwitchStatement(stmt, startId, blocks, edges, dialect) {
   let currentId = startId;
   const switchBlock = {
     id: currentId++,
@@ -8317,11 +8440,11 @@ function processSwitchStatement(stmt, startId, blocks, edges, isJavaScript) {
   const exitIds = [];
   const body2 = stmt.childForFieldName("body");
   if (body2) {
-    const caseTypes = isJavaScript ? ["switch_case", "switch_default"] : ["switch_block_statement_group", "switch_rule"];
+    const caseTypes = dialect === "js" ? ["switch_case", "switch_default"] : dialect === "csharp" ? ["switch_section"] : ["switch_block_statement_group", "switch_rule"];
     for (let i2 = 0;i2 < body2.childCount; i2++) {
       const child = body2.child(i2);
       if (child && caseTypes.includes(child.type)) {
-        const caseResult = processStatements(child, currentId, blocks, edges, isJavaScript);
+        const caseResult = processStatements(child, currentId, blocks, edges, dialect);
         currentId = caseResult.nextId;
         if (caseResult.entryId !== -1) {
           edges.push({
@@ -8352,7 +8475,7 @@ function buildBashCFG(tree, startId, cache) {
     const body2 = func2.childForFieldName("body");
     if (!body2)
       continue;
-    const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, false);
+    const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, "java");
     allBlocks.push(...blocks);
     allEdges.push(...edges);
     blockIdCounter = nextId;
@@ -8375,7 +8498,7 @@ function buildBashCFG(tree, startId, cache) {
     let lastExitIds = [];
     let firstBlockId = -1;
     for (const stmt of topLevelStatements) {
-      const result = processStatement(stmt, blockIdCounter, allBlocks, allEdges, false);
+      const result = processStatement(stmt, blockIdCounter, allBlocks, allEdges, "java");
       blockIdCounter = result.nextId;
       if (firstBlockId === -1) {
         firstBlockId = result.entryId;
@@ -8419,7 +8542,9 @@ function isBashStatement(node) {
   ]);
   return bashStatementTypes.has(node.type);
 }
-function isStatement(node, isJavaScript) {
+function isStatement(node, dialect) {
+  if (dialect === "csharp")
+    return csharpStatementTypes.has(node.type);
   const javaStatementTypes = new Set([
     "local_variable_declaration",
     "expression_statement",
@@ -8463,8 +8588,30 @@ function isStatement(node, isJavaScript) {
     "export_statement",
     "import_statement"
   ]);
-  return isJavaScript ? jsStatementTypes.has(node.type) : javaStatementTypes.has(node.type);
-}
+  return dialect === "js" ? jsStatementTypes.has(node.type) : javaStatementTypes.has(node.type);
+}
+var csharpStatementTypes = new Set([
+  "local_declaration_statement",
+  "expression_statement",
+  "if_statement",
+  "for_statement",
+  "foreach_statement",
+  "while_statement",
+  "do_statement",
+  "try_statement",
+  "switch_statement",
+  "return_statement",
+  "throw_statement",
+  "break_statement",
+  "continue_statement",
+  "using_statement",
+  "lock_statement",
+  "checked_statement",
+  "unsafe_statement",
+  "yield_statement",
+  "goto_statement",
+  "block"
+]);
 function buildGoCFG(tree, blockIdCounter, cache) {
   const allBlocks = [];
   const allEdges = [];
@@ -8476,7 +8623,7 @@ function buildGoCFG(tree, blockIdCounter, cache) {
     const body2 = func2.childForFieldName("body");
     if (!body2 || body2.type !== "block")
       continue;
-    const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, false);
+    const { blocks, edges, nextId } = buildMethodCFG(body2, blockIdCounter, "java");
     allBlocks.push(...blocks);
     allEdges.push(...edges);
     blockIdCounter = nextId;
@@ -12328,6 +12475,7 @@ var DEFAULT_SINKS = [
   { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Filter", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteScalar", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteReader", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteNonQuery", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -12336,6 +12484,7 @@ var DEFAULT_SINKS = [
   { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "system", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "ReadAllBytes", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "ReadAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12359,6 +12508,7 @@ var DEFAULT_SINKS = [
   { method: "Delete", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetFiles", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "EnumerateFiles", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PhysicalFile", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "PostAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "PutAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12376,6 +12526,9 @@ var DEFAULT_SINKS = [
   { method: "Load", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "LoadFrom", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "LoadFile", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "RunCompile", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "CompileRenderStringAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Compile", class: "Handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Deserialize", class: "BinaryFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Deserialize", class: "NetDataContractSerializer", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Deserialize", class: "SoapFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -12384,6 +12537,8 @@ var DEFAULT_SINKS = [
   { method: "Raw", class: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Format", class: "String", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
@@ -12401,6 +12556,8 @@ var DEFAULT_SINKS = [
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Compile", class: "XPathExpression", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Select", class: "XPathNavigator", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Evaluate", class: "XPathNavigator", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "LoadXml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "XmlDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "XDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13179,7 +13336,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
       if (skipMethods.includes(method.name))
         continue;
       for (const param of method.parameters) {
-        const isTaintable = param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
+        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -13292,6 +13450,13 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   return result;
 }
+var CSHARP_BINDING_ATTRS = new Set([
+  "FromBody",
+  "FromQuery",
+  "FromRoute",
+  "FromForm",
+  "FromHeader"
+]);
 function isInterproceduralTaintableType(typeName, language) {
   const baseType = typeName.split("<")[0].trim();
   const excludedTypes = [
@@ -13540,39 +13705,226 @@ function isSafeJSChildProcessCall(call, pattern, language) {
     return false;
   return true;
 }
-function isSafeCSharpProcessStartCall(call, pattern, language) {
+var CSHARP_SHELL_PROGRAMS = new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "dash",
+  "ash",
+  "ksh",
+  "cmd",
+  "powershell",
+  "pwsh"
+]);
+function isConstNonShellExe(raw) {
+  if (!raw)
+    return false;
+  const t = raw.trim();
+  if (!/^@?"[^"]*"$/.test(t))
+    return false;
+  const program = (t.replace(/^@?"|"$/g, "").split(/[\\/]/).pop() ?? "").toLowerCase().replace(/\.exe$/, "");
+  return !CSHARP_SHELL_PROGRAMS.has(program);
+}
+var PSI_CTOR_EXE_RE = /\bnew\s+ProcessStartInfo\s*(?:<[^>]*>)?\s*\(\s*(@?"[^"]*")/;
+function processStartInfoExe(expr, sourceLines) {
+  const inline = PSI_CTOR_EXE_RE.exec(expr);
+  if (inline)
+    return inline[1];
+  if (sourceLines && /^[A-Za-z_]\w*$/.test(expr.trim())) {
+    const varName = expr.trim();
+    const assignRe = new RegExp(`\\b${varName}\\s*=\\s*new\\s+ProcessStartInfo\\s*(?:<[^>]*>)?\\s*\\(\\s*(@?"[^"]*")`);
+    for (const line of sourceLines) {
+      const m = assignRe.exec(line);
+      if (m)
+        return m[1];
+    }
+  }
+  return null;
+}
+function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
   if (language !== "csharp")
     return false;
   if (pattern.type !== "command_injection")
     return false;
-  if (call.method_name !== "Start")
+  const method = call.method_name;
+  if (method !== "Start" && method !== "ProcessStartInfo")
     return false;
-  if (call.arguments.length < 2)
+  if (call.arguments.length >= 2) {
+    const fileArg = call.arguments.find((a) => a.position === 0);
+    const raw = fileArg?.literal != null ? String(fileArg.literal) : fileArg?.expression;
+    return isConstNonShellExe(raw);
+  }
+  if (method === "Start" && call.arguments.length === 1) {
+    const arg0 = call.arguments.find((a) => a.position === 0);
+    const expr = (arg0?.expression ?? "").trim();
+    return isConstNonShellExe(processStartInfoExe(expr, sourceLines));
+  }
+  return false;
+}
+function stripCsLiterals(line) {
+  return line.replace(/\/\/.*$/, "").replace(/@?"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)'/g, "''");
+}
+function csBraceDepthBefore(lines, idx) {
+  let depth = 0;
+  for (let i2 = 0;i2 < idx && i2 < lines.length; i2++) {
+    for (const ch of stripCsLiterals(lines[i2])) {
+      if (ch === "{")
+        depth++;
+      else if (ch === "}")
+        depth--;
+    }
+  }
+  return depth;
+}
+function netBraces(fragment) {
+  let n = 0;
+  for (const ch of fragment) {
+    if (ch === "{")
+      n++;
+    else if (ch === "}")
+      n--;
+  }
+  return n;
+}
+function splitCsIf(line) {
+  const m = /\bif\s*\(/.exec(line);
+  if (!m)
+    return null;
+  const ifCol = m.index;
+  let i2 = m.index + m[0].length;
+  let depth = 1;
+  let inStr = false;
+  let strCh = "";
+  for (;i2 < line.length; i2++) {
+    const c = line[i2];
+    if (inStr) {
+      if (c === "\\") {
+        i2++;
+        continue;
+      }
+      if (c === strCh)
+        inStr = false;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      inStr = true;
+      strCh = c;
+      continue;
+    }
+    if (c === "(")
+      depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0)
+        break;
+    }
+  }
+  if (depth !== 0)
+    return null;
+  return { cond: line.slice(m.index + m[0].length, i2), rest: line.slice(i2 + 1), ifCol };
+}
+function csEqualityGuard(cond) {
+  const c = cond.trim();
+  let m = /^(.*?)\s*(==|!=)\s*@?"[^"]*"\s*$/.exec(c);
+  if (m)
+    return { op: m[2], exprSide: m[1].trim() };
+  m = /^@?"[^"]*"\s*(==|!=)\s*(.*)$/.exec(c);
+  if (m)
+    return { op: m[1], exprSide: m[2].trim() };
+  return null;
+}
+var CS_IDENT_RE = /[A-Za-z_]\w*/g;
+function csIdentifiers(expr) {
+  return new Set(expr.match(CS_IDENT_RE) ?? []);
+}
+function csThenBlock(lines, ifIdx, rest) {
+  const isExit = (s) => /^\s*(?:return|throw|continue|break)\b/.test(s);
+  let firstIdx;
+  let firstText;
+  if (rest.trim()) {
+    firstIdx = ifIdx;
+    firstText = rest;
+  } else {
+    let j = ifIdx + 1;
+    while (j < lines.length && stripCsLiterals(lines[j]).trim() === "")
+      j++;
+    firstIdx = j;
+    firstText = lines[j] ?? "";
+  }
+  if (firstText.trim().startsWith("{")) {
+    let depth = 0;
+    let started = false;
+    let endLine = lines.length - 1;
+    let body2 = "";
+    for (let i2 = firstIdx;i2 < lines.length; i2++) {
+      const stripped = stripCsLiterals(i2 === firstIdx ? firstText : lines[i2]);
+      let broke = false;
+      for (const ch of stripped) {
+        if (ch === "{") {
+          depth++;
+          started = true;
+          if (depth === 1)
+            continue;
+        } else if (ch === "}") {
+          depth--;
+          if (depth === 0) {
+            endLine = i2;
+            broke = true;
+            break;
+          }
+        }
+        if (started && depth >= 1)
+          body2 += ch;
+      }
+      if (broke)
+        break;
+      if (started)
+        body2 += " ";
+    }
+    return { start: ifIdx, end: endLine, earlyExit: isExit(body2.trim()) };
+  }
+  return { start: ifIdx, end: firstIdx, earlyExit: isExit(firstText.trim()) };
+}
+function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines) {
+  if (language !== "csharp")
     return false;
-  const fileArg = call.arguments.find((a) => a.position === 0);
-  if (!fileArg)
+  if (pattern.type !== "ssrf")
     return false;
-  let raw;
-  if (fileArg.literal !== null && fileArg.literal !== undefined) {
-    raw = String(fileArg.literal).trim();
-  } else {
-    raw = (fileArg.expression ?? "").trim();
+  if (!sourceLines || sourceLines.length === 0)
+    return false;
+  const candidates = new Set;
+  for (const a of call.arguments) {
+    if (a.variable)
+      candidates.add(a.variable);
+    for (const id of csIdentifiers(a.expression ?? ""))
+      candidates.add(id);
   }
-  if (!/^@?"[^"]*"$/.test(raw))
+  if (candidates.size === 0)
     return false;
-  const program = (raw.replace(/^@?"|"$/g, "").split(/[\\/]/).pop() ?? "").toLowerCase().replace(/\.exe$/, "");
-  const SHELL_PROGRAMS = new Set([
-    "sh",
-    "bash",
-    "zsh",
-    "dash",
-    "ash",
-    "ksh",
-    "cmd",
-    "powershell",
-    "pwsh"
-  ]);
-  return !SHELL_PROGRAMS.has(program);
+  const sinkIdx = call.location.line - 1;
+  const sinkDepth = csBraceDepthBefore(sourceLines, sinkIdx);
+  for (let i2 = 0;i2 < sinkIdx; i2++) {
+    const parts2 = splitCsIf(sourceLines[i2]);
+    if (!parts2)
+      continue;
+    const guard = csEqualityGuard(parts2.cond);
+    if (!guard)
+      continue;
+    const guardIds = csIdentifiers(guard.exprSide);
+    if (![...guardIds].some((id) => candidates.has(id)))
+      continue;
+    const block = csThenBlock(sourceLines, i2, parts2.rest);
+    if (guard.op === "==") {
+      if (sinkIdx >= block.start && sinkIdx <= block.end)
+        return true;
+    } else {
+      const guardDepth = csBraceDepthBefore(sourceLines, i2) + netBraces(stripCsLiterals(sourceLines[i2]).slice(0, parts2.ifCol));
+      if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
+        return true;
+      }
+    }
+  }
+  return false;
 }
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust")
@@ -13864,7 +14216,10 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeJSChildProcessCall(call, pattern, language)) {
           continue;
         }
-        if (isSafeCSharpProcessStartCall(call, pattern, language)) {
+        if (isSafeCSharpProcessStartCall(call, pattern, language, sourceLines)) {
+          continue;
+        }
+        if (isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)) {
           continue;
         }
         if (pattern.safe_if_class_literal_at !== undefined && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
@@ -25097,6 +25452,8 @@ class LanguageSourcesPass {
     additionalSources.push(...findSetterChainSources(types, code, language));
     additionalSources.push(...findJavaScriptAssignmentSources(code, language));
     additionalSources.push(...findCSharpRequestSources(code, language));
+    additionalSources.push(...findCSharpBindingAttributeSources(code, language));
+    additionalSources.push(...findCSharpMinimalApiSources(code, language));
     additionalSources.push(...findGoArgvSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
@@ -25761,6 +26118,104 @@ function findCSharpRequestSources(sourceCode, language) {
   }
   return sources;
 }
+var CSHARP_MINIMAL_API_BINDING = new Map([
+  ["FromBody", "http_body"],
+  ["FromForm", "http_body"],
+  ["FromQuery", "http_param"],
+  ["FromRoute", "http_path"],
+  ["FromHeader", "http_param"]
+]);
+var CSHARP_NON_INPUT_TYPES = new Set([
+  "HttpContext",
+  "HttpRequest",
+  "HttpResponse",
+  "CancellationToken",
+  "ClaimsPrincipal",
+  "ILogger",
+  "IFormFileCollection"
+]);
+function findCSharpBindingAttributeSources(sourceCode, language) {
+  if (language !== "csharp")
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const re = /\[\s*(FromQuery|FromBody|FromForm|FromRoute|FromHeader)(?:\s*\([^)]*\))?\s*\]\s*(?:\[[^\]]*\]\s*)*[\w.<>[\]?]+\s+([A-Za-z_]\w*)/g;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const lineRe = new RegExp(re.source, "g");
+    let m;
+    while ((m = lineRe.exec(lines[i2])) !== null) {
+      const attr = m[1];
+      const name2 = m[2];
+      const type = attr === "FromBody" || attr === "FromForm" ? "http_body" : attr === "FromRoute" ? "http_path" : "http_param";
+      if (sources.some((s) => s.line === i2 + 1 && s.variable === name2))
+        continue;
+      sources.push({
+        type,
+        location: `[${attr}] ${name2}`,
+        severity: "high",
+        line: i2 + 1,
+        confidence: 1,
+        variable: name2
+      });
+    }
+  }
+  return sources;
+}
+function findCSharpMinimalApiSources(sourceCode, language) {
+  if (language !== "csharp")
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const mapRe = /\bMap(?:Get|Post|Put|Delete|Patch)\s*\(\s*(?:@?"[^"]*"|[\w.]+)\s*,\s*(?:\[[^\]]*\]\s*)?(?:async\s*)?\(([^)]*)\)\s*=>/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = mapRe.exec(lines[i2]);
+    if (!m || !m[1].trim())
+      continue;
+    for (const rawParam of m[1].split(",")) {
+      const seed = classifyCSharpLambdaParam(rawParam);
+      if (!seed)
+        continue;
+      if (sources.some((s) => s.line === i2 + 1 && s.variable === seed.name))
+        continue;
+      sources.push({
+        type: seed.type,
+        location: `${seed.name} (Minimal API ${seed.via})`,
+        severity: "high",
+        line: i2 + 1,
+        confidence: 1,
+        variable: seed.name
+      });
+    }
+  }
+  return sources;
+}
+function classifyCSharpLambdaParam(raw) {
+  const attrs = [...raw.matchAll(/\[([^\]]*)\]/g)].map((a) => a[1].split("(")[0].trim());
+  if (attrs.includes("FromServices"))
+    return null;
+  if (attrs.some((a) => CSHARP_MINIMAL_API_BINDING.has(a)))
+    return null;
+  const noAttr = raw.replace(/\[[^\]]*\]/g, "").trim();
+  const parts2 = noAttr.split(/\s+/).filter(Boolean);
+  if (parts2.length < 2)
+    return null;
+  const name2 = parts2[parts2.length - 1];
+  if (!/^[A-Za-z_]\w*$/.test(name2))
+    return null;
+  const baseType = (parts2[parts2.length - 2] ?? "").replace(/[?\[\]]/g, "").split("<")[0].split(".").pop() ?? "";
+  if (CSHARP_NON_INPUT_TYPES.has(baseType))
+    return null;
+  for (const a of attrs) {
+    const t = CSHARP_MINIMAL_API_BINDING.get(a);
+    if (t)
+      return { type: t, name: name2, via: `[${a}]` };
+  }
+  if (baseType === "string")
+    return { type: "http_param", name: name2, via: "string param" };
+  return null;
+}
 function findJavaScriptAssignmentSources(sourceCode, language) {
   if (!["javascript", "typescript"].includes(language))
     return [];
@@ -42193,6 +42648,9 @@ var JAVA_SET_HTTPONLY_TRUE_RE = /\.setHttpOnly\s*\(\s*true\s*\)/;
 var GO_SECURE_TRUE_RE = /\bSecure\s*:\s*true\b/;
 var GO_HTTPONLY_TRUE_RE = /\bHttpOnly\s*:\s*true\b/;
 var RUST_SET_COOKIE_MACRO_RE = /(format!|write!|writeln!)\s*\(([^()]*Set-Cookie[^()]*)\)/gis;
+var CS_COOKIE_OPTIONS_RE = /\bnew\s+CookieOptions\s*\{([^{}]*)\}/gs;
+var CS_SECURE_FALSE_RE = /\bSecure\s*=\s*false\b/;
+var CS_HTTPONLY_FALSE_RE = /\bHttpOnly\s*=\s*false\b/;
 
 class InsecureCookiePass {
   name = "insecure-cookie";
@@ -42241,9 +42699,30 @@ class InsecureCookiePass {
         insecureCookies.push(det);
         this.emit(ctx, file, det, "rust");
       }
+    } else if (language === "csharp") {
+      for (const det of this.detectCSharpCookieOptions(code)) {
+        insecureCookies.push(det);
+        this.emit(ctx, file, det, "csharp");
+      }
     }
     return { insecureCookies };
   }
+  detectCSharpCookieOptions(code) {
+    const out2 = [];
+    const re = new RegExp(CS_COOKIE_OPTIONS_RE.source, CS_COOKIE_OPTIONS_RE.flags);
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const body2 = m[1] ?? "";
+      const missingSecure = CS_SECURE_FALSE_RE.test(body2);
+      const missingHttpOnly = CS_HTTPONLY_FALSE_RE.test(body2);
+      if (!missingSecure && !missingHttpOnly)
+        continue;
+      const line = code.slice(0, m.index).split(`
+`).length;
+      out2.push({ line, receiver: "CookieOptions", missingSecure, missingHttpOnly, optionsPresent: true });
+    }
+    return out2;
+  }
   detectJs(call) {
     if (call.method_name !== "cookie")
       return null;
@@ -42357,12 +42836,12 @@ class InsecureCookiePass {
   emit(ctx, file, det, flavor) {
     const missing = [];
     if (det.missingSecure) {
-      missing.push(flavor === "js" ? "`secure: true`" : flavor === "python" ? "`secure=True`" : flavor === "java" ? "`setSecure(true)`" : flavor === "go" ? "`Secure: true`" : "`Secure` attribute");
+      missing.push(flavor === "js" ? "`secure: true`" : flavor === "python" ? "`secure=True`" : flavor === "java" ? "`setSecure(true)`" : flavor === "go" ? "`Secure: true`" : flavor === "csharp" ? "`Secure = true`" : "`Secure` attribute");
     }
     if (det.missingHttpOnly) {
-      missing.push(flavor === "js" ? "`httpOnly: true`" : flavor === "python" ? "`httponly=True`" : flavor === "java" ? "`setHttpOnly(true)`" : flavor === "go" ? "`HttpOnly: true`" : "`HttpOnly` attribute");
+      missing.push(flavor === "js" ? "`httpOnly: true`" : flavor === "python" ? "`httponly=True`" : flavor === "java" ? "`setHttpOnly(true)`" : flavor === "go" ? "`HttpOnly: true`" : flavor === "csharp" ? "`HttpOnly = true`" : "`HttpOnly` attribute");
     }
-    const fix = flavor === "js" ? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.' : flavor === "python" ? 'Pass `secure=True, httponly=True, samesite="Lax"` to `response.set_cookie(...)`.' : flavor === "java" ? "After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response." : flavor === "go" ? "Set `Secure: true` and `HttpOnly: true` on the `http.Cookie` struct literal passed to `http.SetCookie`." : "Append `; Secure; HttpOnly` to the `Set-Cookie` header string.";
+    const fix = flavor === "js" ? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.' : flavor === "python" ? 'Pass `secure=True, httponly=True, samesite="Lax"` to `response.set_cookie(...)`.' : flavor === "java" ? "After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response." : flavor === "go" ? "Set `Secure: true` and `HttpOnly: true` on the `http.Cookie` struct literal passed to `http.SetCookie`." : flavor === "csharp" ? "Set `Secure = true` and `HttpOnly = true` on the `CookieOptions` (or enforce them globally via `CookiePolicyOptions`)." : "Append `; Secure; HttpOnly` to the `Set-Cookie` header string.";
     ctx.addFinding({
       id: `${this.name}-${file}-${det.line}`,
       pass: this.name,
@@ -42871,6 +43350,7 @@ var ISSUE_CWE = {
   "hardcoded-key": "CWE-321",
   "weak-rsa-key": "CWE-326"
 };
+var CS_CIPHER_MODE_ECB_RE = /\bCipherMode\s*\.\s*ECB\b/;
 
 class WeakCryptoPass {
   name = "weak-crypto";
@@ -42887,26 +43367,35 @@ class WeakCryptoPass {
     const findings = [];
     const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
     const literalBindings = scanLiteralBindings(code, language);
+    const emit = (line, det) => {
+      findings.push({ line, language, ...det });
+      ctx.addFinding({
+        id: `${this.name}-${file}-${line}-${det.issue}`,
+        pass: this.name,
+        category: this.category,
+        rule_id: this.name,
+        cwe: ISSUE_CWE[det.issue],
+        severity: "high",
+        level: "error",
+        message: this.buildMessage(det),
+        file,
+        line,
+        fix: this.buildFix(det.issue),
+        evidence: { ...det, language }
+      });
+    };
     for (const call of graph.ir.calls) {
-      const detections = this.detect(call, language, constProp, literalBindings);
-      for (const det of detections) {
-        const line = call.location.line;
-        findings.push({ line, language, ...det });
-        const message = this.buildMessage(det);
-        ctx.addFinding({
-          id: `${this.name}-${file}-${line}-${det.issue}`,
-          pass: this.name,
-          category: this.category,
-          rule_id: this.name,
-          cwe: ISSUE_CWE[det.issue],
-          severity: "high",
-          level: "error",
-          message,
-          file,
-          line,
-          fix: this.buildFix(det.issue),
-          evidence: { ...det, language }
-        });
+      for (const det of this.detect(call, language, constProp, literalBindings)) {
+        emit(call.location.line, det);
+      }
+    }
+    if (language === "csharp") {
+      const lines = code.split(`
+`);
+      for (let i2 = 0;i2 < lines.length; i2++) {
+        if (CS_CIPHER_MODE_ECB_RE.test(lines[i2])) {
+          emit(i2 + 1, { issue: "ecb-mode", detail: "CipherMode.ECB", api: "SymmetricAlgorithm.Mode" });
+        }
       }
     }
     return { findings };
@@ -44166,9 +44655,14 @@ class InsecureDeserializationConfigPass {
   name = "insecure-deserialization-config";
   category = "security";
   run(ctx) {
+    if (ctx.language === "java")
+      return this.runJava(ctx);
+    if (ctx.language === "csharp")
+      return this.runCSharp(ctx);
+    return { findings: [] };
+  }
+  runJava(ctx) {
     const { graph, language } = ctx;
-    if (language !== "java")
-      return { findings: [] };
     const file = graph.ir.meta.file;
     const findings = [];
     for (const call of graph.ir.calls) {
@@ -44194,6 +44688,35 @@ class InsecureDeserializationConfigPass {
     }
     return { findings };
   }
+  runCSharp(ctx) {
+    const file = ctx.graph.ir.meta.file;
+    const findings = [];
+    const lines = ctx.code.split(`
+`);
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const m = INSECURE_TYPE_NAME_HANDLING_RE.exec(lines[i2]);
+      if (!m)
+        continue;
+      const line = i2 + 1;
+      const api = `TypeNameHandling = TypeNameHandling.${m[1]}`;
+      findings.push({ line, api });
+      ctx.addFinding({
+        id: `${this.name}-${file}-${line}`,
+        pass: this.name,
+        category: this.category,
+        rule_id: this.name,
+        cwe: "CWE-502",
+        severity: "high",
+        level: "error",
+        message: `Json.NET configured with TypeNameHandling.${m[1]}: a $type field in ` + "untrusted JSON can instantiate arbitrary .NET types (deserialization RCE)",
+        file,
+        line,
+        fix: "Use TypeNameHandling.None (the default), or bind a SerializationBinder that allow-lists the exact types you deserialize.",
+        evidence: { api, language: "csharp" }
+      });
+    }
+    return { findings };
+  }
   isPermissiveXStreamConfig(call) {
     if (call.method_name !== "addPermission")
       return false;
@@ -44201,6 +44724,7 @@ class InsecureDeserializationConfigPass {
     return typeof arg0 === "string" && ANY_TYPE_PERMISSION_RE.test(arg0);
   }
 }
+var INSECURE_TYPE_NAME_HANDLING_RE = /\bTypeNameHandling\s*=\s*(?:Newtonsoft\.Json\.)?TypeNameHandling\.(All|Auto|Objects|Arrays)\b/;
 
 // ../circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
 function isWriteStorageCall(call, language) {
@@ -44461,6 +44985,8 @@ var VERIFY_FALSE_RE = /\bverify\s*=\s*False\b/;
 var REJECT_UNAUTHORIZED_FALSE_RE = /\brejectUnauthorized\s*:\s*false\b/;
 var INSECURE_SKIP_VERIFY_TRUE_RE = /\bInsecureSkipVerify\s*:\s*true\b/;
 var HOSTNAME_LAMBDA_TRUE_RE = /\(\s*\w+\s*,\s*\w+\s*\)\s*->\s*true\b/;
+var CS_CERT_CALLBACK_TRUE_RE = /\b(ServerCertificateValidationCallback|ServerCertificateCustomValidationCallback|RemoteCertificateValidationCallback)\s*(?:\+?=|\()\s*(?:\([^)]*\)|\w+)\s*=>\s*(?:true\b|\{\s*return\s+true\b)/;
+var CS_DANGEROUS_ACCEPT_RE = /\bDangerousAcceptAnyServerCertificateValidator\b/;
 var ALLOW_ALL_HOSTNAME_VERIFIERS = new Set([
   "NoopHostnameVerifier.INSTANCE",
   "new AllowAllHostnameVerifier()",
@@ -44609,6 +45135,21 @@ class TlsVerifyDisabledPass {
         }
       }
     }
+    if (language === "csharp") {
+      for (let i2 = 0;i2 < lines.length; i2++) {
+        const l = lines[i2];
+        const m = CS_CERT_CALLBACK_TRUE_RE.exec(l);
+        if (m) {
+          out2.push({ line: i2 + 1, pattern: `${m[1]} => true`, api: m[1] });
+        } else if (CS_DANGEROUS_ACCEPT_RE.test(l)) {
+          out2.push({
+            line: i2 + 1,
+            pattern: "DangerousAcceptAnyServerCertificateValidator",
+            api: "HttpClientHandler"
+          });
+        }
+      }
+    }
     return out2;
   }
   fixFor(language, pattern) {
@@ -44630,6 +45171,9 @@ class TlsVerifyDisabledPass {
     if (pattern.includes("ssl._create_unverified_context")) {
       return "Do not use `_create_unverified_context()`. Use `ssl.create_default_context()`.";
     }
+    if (language === "csharp") {
+      return "Do not accept every certificate. Remove the always-true validation " + "callback (and `DangerousAcceptAnyServerCertificateValidator`); rely on the " + "platform default. To trust a private CA, validate the chain against it in " + "the callback instead of returning true.";
+    }
     return "Restore TLS certificate and hostname verification.";
   }
 }
@@ -45157,6 +45701,8 @@ var PY_VERIFY_SIGNATURE_FALSE_RE = /["']verify_signature["']\s*:\s*False\b/;
 var PY_VERIFY_KW_FALSE_RE = /\bverify\s*=\s*False\b/;
 var PY_ALG_NONE_RE = /\balgorithms\s*=\s*[\[\(]\s*["']none["']/i;
 var JS_ALG_NONE_RE = /\balgorithms\s*:\s*\[\s*["']none["']/i;
+var CS_REQUIRE_SIGNED_FALSE_RE = /\bRequireSignedTokens\s*=\s*false\b/;
+var CS_SIGNATURE_VALIDATOR_BYPASS_RE = /\bSignatureValidator\s*=\s*[^;]*=>\s*new\s+JwtSecurityToken\b/;
 
 class JwtVerifyDisabledPass {
   name = "jwt-verify-disabled";
@@ -45165,25 +45711,36 @@ class JwtVerifyDisabledPass {
     const { graph, language } = ctx;
     const file = graph.ir.meta.file;
     const findings = [];
+    const emit = (line, det) => {
+      findings.push({ line, language, ...det });
+      ctx.addFinding({
+        id: `${this.name}-${file}-${line}-${det.pattern}`,
+        pass: this.name,
+        category: this.category,
+        rule_id: this.name,
+        cwe: "CWE-347",
+        severity: "critical",
+        level: "error",
+        message: `JWT signature verification disabled via \`${det.pattern}\` in ` + `\`${det.api}\`. Any attacker can forge a token with arbitrary ` + "claims (user id, roles, expiry) since the signature is not " + "checked.",
+        file,
+        line,
+        fix: this.fixFor(language),
+        evidence: { ...det, language }
+      });
+    };
     for (const call of graph.ir.calls) {
-      const detections = this.detect(call, language);
-      for (const det of detections) {
-        const line = call.location.line;
-        findings.push({ line, language, ...det });
-        ctx.addFinding({
-          id: `${this.name}-${file}-${line}-${det.pattern}`,
-          pass: this.name,
-          category: this.category,
-          rule_id: this.name,
-          cwe: "CWE-347",
-          severity: "critical",
-          level: "error",
-          message: `JWT signature verification disabled via \`${det.pattern}\` in ` + `\`${det.api}\`. Any attacker can forge a token with arbitrary ` + "claims (user id, roles, expiry) since the signature is not " + "checked.",
-          file,
-          line,
-          fix: this.fixFor(language),
-          evidence: { ...det, language }
-        });
+      for (const det of this.detect(call, language))
+        emit(call.location.line, det);
+    }
+    if (language === "csharp") {
+      const lines = ctx.code.split(`
+`);
+      for (let i2 = 0;i2 < lines.length; i2++) {
+        if (CS_REQUIRE_SIGNED_FALSE_RE.test(lines[i2])) {
+          emit(i2 + 1, { pattern: "RequireSignedTokens = false", api: "TokenValidationParameters" });
+        } else if (CS_SIGNATURE_VALIDATOR_BYPASS_RE.test(lines[i2])) {
+          emit(i2 + 1, { pattern: "SignatureValidator returns an unvalidated token", api: "TokenValidationParameters" });
+        }
       }
     }
     return { findings };
@@ -45257,6 +45814,9 @@ class JwtVerifyDisabledPass {
     if (language === "java") {
       return "For auth0/java-jwt: use `JWT.require(Algorithm.HMAC256(secret))` or " + "an RSA algorithm. For jjwt: call `parseClaimsJws(token)` (signature " + "enforced) rather than `parse(token)` (signature ignored).";
     }
+    if (language === "csharp") {
+      return "Leave `RequireSignedTokens = true` and do not install a custom " + "`SignatureValidator` that returns the token unverified. Configure " + "`IssuerSigningKey`/`IssuerSigningKeys` and let the handler validate " + "the signature.";
+    }
     return "Enforce JWT signature verification with a concrete algorithm " + "(HS256/RS256/ES256). Never accept `alg: none`.";
   }
 }
@@ -46601,6 +47161,24 @@ function getNodeTypesForLanguage(language) {
         "selector_expression",
         "identifier"
       ]);
+    case "csharp":
+      return new Set([
+        "method_invocation",
+        "object_creation_expression",
+        "class_declaration",
+        "method_declaration",
+        "constructor_declaration",
+        "field_declaration",
+        "import_declaration",
+        "interface_declaration",
+        "enum_declaration",
+        "package_declaration",
+        "local_variable_declaration",
+        "destructor_declaration",
+        "operator_declaration",
+        "local_function_statement",
+        "accessor_declaration"
+      ]);
     default:
       return new Set([
         "method_invocation",
@@ -48153,7 +48731,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.7.2";
+var version = "4.9.7";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.7.2",
+  "version": "4.9.7",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.7.2"
+    "circle-ir": "^4.9.7"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",