sdlc-agent-4-enterprise-server 1.0.0

package/src/engine/analyzers/security/injection/patterns/SQLInjectionMatcher.ts

@@ -0,0 +1,56 @@
+/**
+ * KSA-165: SQL Injection Matcher — 4 patterns for SQL injection detection.
+ */
+
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+
+export class SQLInjectionMatcher extends PatternMatcher {
+  readonly category = 'sql_injection';
+  readonly patterns: InjectionPattern[] = [
+    {
+      id: 1,
+      name: 'String Concatenation in SQL Query',
+      category: 'sql_injection',
+      cwe: 'CWE-89',
+      severity: 'Critical',
+      sinkPatterns: ['query(', 'execute(', 'raw(', 'knex.raw', 'sequelize.query', 'db.run(', 'cursor.execute'],
+      dangerousOps: ['concat', 'template_literal', 'format_string'],
+      safePatterns: ['?', '$1', '%s', 'prepare', 'parameterize'],
+      description: 'Use parameterized queries instead of string concatenation. Example: db.query("SELECT * FROM users WHERE id = ?", [userId])',
+    },
+    {
+      id: 2,
+      name: 'Template Literal in SQL Query',
+      category: 'sql_injection',
+      cwe: 'CWE-89',
+      severity: 'Critical',
+      sinkPatterns: ['query(', 'execute(', 'raw(', 'knex.raw', 'sequelize.query'],
+      dangerousOps: ['template_literal'],
+      safePatterns: ['?', '$1', 'tagged_template', 'sql`'],
+      description: 'Use tagged template literals (e.g., sql`...`) or parameterized queries instead of plain template literals.',
+    },
+    {
+      id: 3,
+      name: 'Dynamic Table/Column Name in SQL',
+      category: 'sql_injection',
+      cwe: 'CWE-89',
+      severity: 'High',
+      sinkPatterns: ['query(', 'execute(', 'raw('],
+      dangerousOps: ['concat', 'template_literal', 'format_string'],
+      safePatterns: ['whitelist', 'allowedColumns', 'allowedTables', 'includes('],
+      description: 'Validate table/column names against a whitelist. Parameterized queries cannot protect identifiers.',
+    },
+    {
+      id: 4,
+      name: 'ORM Raw Query with User Input',
+      category: 'sql_injection',
+      cwe: 'CWE-89',
+      severity: 'High',
+      sinkPatterns: ['raw(', 'rawQuery(', 'literal(', '$queryRaw'],
+      dangerousOps: ['concat', 'template_literal', 'format_string', 'pass_through'],
+      safePatterns: ['bind', 'replacements', 'Prisma.sql'],
+      description: 'Use ORM binding parameters: Model.rawQuery("... WHERE id = ?", { replacements: [id] })',
+    },
+  ];
+}

package/src/engine/analyzers/security/injection/patterns/XSSMatcher.ts

@@ -0,0 +1,56 @@
+/**
+ * KSA-165: XSS Matcher — 4 patterns for Cross-Site Scripting detection.
+ */
+
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+
+export class XSSMatcher extends PatternMatcher {
+  readonly category = 'xss';
+  readonly patterns: InjectionPattern[] = [
+    {
+      id: 5,
+      name: 'innerHTML Assignment with User Input',
+      category: 'xss',
+      cwe: 'CWE-79',
+      severity: 'High',
+      sinkPatterns: ['innerHTML', 'outerHTML', 'dangerouslySetInnerHTML'],
+      dangerousOps: ['concat', 'template_literal', 'assign', 'pass_through'],
+      safePatterns: ['DOMPurify', 'sanitize', 'textContent', 'innerText'],
+      description: 'Use textContent/innerText instead of innerHTML, or sanitize with DOMPurify.sanitize(input)',
+    },
+    {
+      id: 6,
+      name: 'document.write with User Input',
+      category: 'xss',
+      cwe: 'CWE-79',
+      severity: 'Critical',
+      sinkPatterns: ['document.write(', 'document.writeln('],
+      dangerousOps: ['concat', 'template_literal', 'pass_through'],
+      safePatterns: ['encode', 'escape', 'sanitize'],
+      description: 'Avoid document.write entirely. Use DOM manipulation methods with textContent.',
+    },
+    {
+      id: 7,
+      name: 'Reflected XSS in Server Response',
+      category: 'xss',
+      cwe: 'CWE-79',
+      severity: 'High',
+      sinkPatterns: ['res.send(', 'res.write(', 'response.write(', 'render('],
+      dangerousOps: ['concat', 'template_literal', 'format_string'],
+      safePatterns: ['escape', 'encode', 'sanitize', 'helmet', 'csp'],
+      description: 'Use template engines with auto-escaping (EJS, Handlebars) or explicitly escape output.',
+    },
+    {
+      id: 8,
+      name: 'DOM-based XSS via URL Fragment',
+      category: 'xss',
+      cwe: 'CWE-79',
+      severity: 'High',
+      sinkPatterns: ['innerHTML', 'eval(', 'document.write(', 'location.href'],
+      dangerousOps: ['pass_through', 'assign'],
+      safePatterns: ['encodeURIComponent', 'sanitize', 'DOMPurify'],
+      description: 'Sanitize URL fragments before DOM insertion. Use encodeURIComponent or DOMPurify.',
+    },
+  ];
+}

package/src/engine/analyzers/security/ssrf/SSRFDetector.ts

@@ -0,0 +1,103 @@
+/**
+ * KSA-166: SSRF Detector — Detects Server-Side Request Forgery vulnerabilities.
+ */
+
+import { TaintAnalyzer } from '../taint/TaintAnalyzer.js';
+import type { SyntaxNode } from '../../../parsers/types.js';
+import type { SSRFFinding, TaintPath, TrustTier } from '../types.js';
+
+/** HTTP sink functions that make outbound requests. */
+const HTTP_SINKS = [
+  'fetch(', 'axios(', 'axios.get(', 'axios.post(', 'axios.put(', 'axios.delete(',
+  'http.get(', 'http.request(', 'https.get(', 'https.request(',
+  'request(', 'got(', 'got.get(', 'superagent.get(',
+  'urllib.request.urlopen', 'requests.get(', 'requests.post(',
+  'httpx.get(', 'httpx.post(',
+];
+
+/** URL validation patterns that mitigate SSRF. */
+const URL_VALIDATORS = [
+  'new URL(', 'URL.parse(', 'url.parse(',
+  'allowedHosts', 'allowedDomains', 'whitelist',
+  'isInternalUrl', 'validateUrl', 'isAllowedHost',
+  'startsWith("http', 'startsWith("https',
+];
+
+export class SSRFDetector {
+  private taintAnalyzer: TaintAnalyzer;
+
+  constructor(taintAnalyzer?: TaintAnalyzer) {
+    this.taintAnalyzer = taintAnalyzer ?? new TaintAnalyzer();
+  }
+
+  /** Detect SSRF in a function that handles HTTP requests. */
+  detect(
+    functionNode: SyntaxNode,
+    filePath: string,
+    language: string,
+    handlerName: string
+  ): SSRFFinding[] {
+    const taintResult = this.taintAnalyzer.analyze(functionNode, language, {
+      sinkTypes: ['url_fetch'],
+    });
+
+    const findings: SSRFFinding[] = [];
+
+    for (const path of taintResult.paths) {
+      // Only care about paths that end in HTTP sinks
+      if (!this.isHTTPSink(path.sink.function)) continue;
+
+      // Check if URL validation exists in the path
+      const hasValidation = this.hasURLValidation(path);
+      if (hasValidation) continue;
+
+      const trustTier = this.classifyTrustTier(path);
+      const confidence = this.computeConfidence(path, trustTier);
+
+      findings.push({
+        handler: handlerName,
+        filePath,
+        source: path.source,
+        sink: path.sink,
+        path: path.chain.map(s => s.line),
+        trustTier,
+        confidence,
+        missingControl: 'URL validation/allowlist',
+        cwe: 'CWE-918',
+        severity: trustTier === 'T1' ? 'Critical' : trustTier === 'T2' ? 'High' : 'Medium',
+      });
+    }
+
+    return findings;
+  }
+
+  private isHTTPSink(functionName: string): boolean {
+    return HTTP_SINKS.some(sink => functionName.includes(sink));
+  }
+
+  private hasURLValidation(path: TaintPath): boolean {
+    // Check if any step in the chain involves URL validation
+    for (const step of path.chain) {
+      for (const validator of URL_VALIDATORS) {
+        if (step.expression.includes(validator)) return true;
+      }
+    }
+    // Also check sink expression
+    for (const validator of URL_VALIDATORS) {
+      if (path.sink.expression.includes(validator)) return true;
+    }
+    return false;
+  }
+
+  private classifyTrustTier(path: TaintPath): TrustTier {
+    if (path.length <= 2) return 'T1'; // Direct: param → fetch
+    if (path.length <= 5) return 'T2'; // Partial processing
+    return 'T3'; // Indirect
+  }
+
+  private computeConfidence(path: TaintPath, tier: TrustTier): number {
+    if (tier === 'T1') return 95;
+    if (tier === 'T2') return 75;
+    return 50;
+  }
+}

package/src/engine/analyzers/security/taint/TaintAnalyzer.ts

@@ -0,0 +1,230 @@
+/**
+ * KSA-164: Taint Analyzer — Main taint analysis engine.
+ * Combines CFG, data flow, and taint propagation to find source-to-sink paths.
+ */
+
+import type { SyntaxNode } from '../../../parsers/types.js';
+import { CFGBuilder } from '../cfg/CFGBuilder.js';
+import { DataFlowAnalyzer } from '../dataflow/DataFlowAnalyzer.js';
+import { TaintRegistry } from './TaintRegistry.js';
+import { TaintPropagator, type TaintState } from './TaintPropagator.js';
+import type { ControlFlowGraph } from '../cfg/ControlFlowGraph.js';
+import type { TaintResult, TaintPath, TaintSource, TaintSink, TaintStep, TaintOptions, TaintSinkType } from '../types.js';
+
+export class TaintAnalyzer {
+  private cfgBuilder: CFGBuilder;
+  private dataFlowAnalyzer: DataFlowAnalyzer;
+  private registry: TaintRegistry;
+  private propagator: TaintPropagator;
+  private cfgCache: Map<string, ControlFlowGraph> = new Map();
+  private readonly MAX_CACHE = 100;
+
+  constructor(registry?: TaintRegistry) {
+    this.cfgBuilder = new CFGBuilder();
+    this.dataFlowAnalyzer = new DataFlowAnalyzer();
+    this.registry = registry ?? new TaintRegistry();
+    this.propagator = new TaintPropagator(this.registry);
+  }
+
+  /** Perform taint analysis on a function node. */
+  analyze(functionNode: SyntaxNode, language: string, options: TaintOptions = {}): TaintResult {
+    const maxPathLength = options.maxPathLength ?? 20;
+
+    // Build CFG
+    const cfg = this.cfgBuilder.build(functionNode, language);
+
+    // Propagate taint through CFG blocks in topological order
+    const blockStates = new Map<number, Map<string, TaintState>>();
+    const initialState = new Map<string, TaintState>();
+    blockStates.set(cfg.entry.id, initialState);
+
+    // Identify sources from function parameters
+    this.identifyParamSources(functionNode, language, initialState);
+
+    // Forward propagation through CFG
+    for (const block of cfg.reversePostOrder()) {
+      // Merge predecessor states
+      const predecessors = cfg.getPredecessors(block);
+      let mergedState: Map<string, TaintState>;
+
+      if (predecessors.length === 0) {
+        mergedState = new Map(blockStates.get(block.id) ?? initialState);
+      } else {
+        mergedState = new Map<string, TaintState>();
+        for (const pred of predecessors) {
+          const predState = blockStates.get(pred.id);
+          if (predState) {
+            for (const [key, val] of predState) {
+              if (!mergedState.has(key)) mergedState.set(key, val);
+            }
+          }
+        }
+      }
+
+      // Propagate through block
+      const outState = this.propagator.propagateBlock(block, mergedState);
+      blockStates.set(block.id, outState);
+    }
+
+    // Collect taint paths: find sinks that receive tainted data
+    const paths: TaintPath[] = [];
+    const sources: TaintSource[] = [];
+    const sinks: TaintSink[] = [];
+
+    for (const block of cfg.blocks) {
+      const state = blockStates.get(block.id);
+      if (!state) continue;
+
+      for (const stmt of block.statements) {
+        const sinkInfo = this.findSink(stmt.node, state, language);
+        if (sinkInfo) {
+          sinks.push(sinkInfo.sink);
+          if (sinkInfo.taintState) {
+            const path: TaintPath = {
+              source: {
+                variable: sinkInfo.taintState.variable,
+                type: sinkInfo.taintState.sourceType as TaintSource['type'],
+                line: sinkInfo.taintState.sourceLine,
+                expression: sinkInfo.taintState.variable,
+              },
+              sink: sinkInfo.sink,
+              chain: sinkInfo.taintState.steps.slice(0, maxPathLength),
+              sanitized: false,
+              length: sinkInfo.taintState.steps.length,
+            };
+            paths.push(path);
+
+            // Track unique sources
+            if (!sources.find(s => s.variable === path.source.variable && s.line === path.source.line)) {
+              sources.push(path.source);
+            }
+          }
+        }
+      }
+    }
+
+    // Filter by options
+    let filteredPaths = paths;
+    if (options.sinkTypes) {
+      filteredPaths = filteredPaths.filter(p => options.sinkTypes!.includes(p.sink.type));
+    }
+    if (options.sourceTypes) {
+      filteredPaths = filteredPaths.filter(p => options.sourceTypes!.includes(p.source.type));
+    }
+    if (!options.includeSanitized) {
+      filteredPaths = filteredPaths.filter(p => !p.sanitized);
+    }
+
+    return {
+      paths: filteredPaths,
+      sources,
+      sinks,
+      sanitizers: [],
+    };
+  }
+
+  /** Get the taint registry for external configuration. */
+  getRegistry(): TaintRegistry {
+    return this.registry;
+  }
+
+  /** Identify taint sources from function parameters. */
+  private identifyParamSources(
+    functionNode: SyntaxNode,
+    language: string,
+    state: Map<string, TaintState>
+  ): void {
+    const params = functionNode.childForFieldName('parameters');
+    if (!params) return;
+
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const param = params.namedChild(i);
+      if (!param) continue;
+
+      let paramName: string | null = null;
+
+      if (param.type === 'identifier') {
+        paramName = param.text;
+      } else if (param.type === 'required_parameter' || param.type === 'optional_parameter') {
+        const nameNode = param.childForFieldName('pattern') ?? param.childForFieldName('name');
+        if (nameNode) paramName = nameNode.text;
+      } else if (param.type === 'formal_parameters') {
+        continue;
+      }
+
+      if (!paramName) continue;
+
+      // Common HTTP handler parameter names
+      const httpParams = ['req', 'request', 'ctx', 'context'];
+      if (httpParams.includes(paramName)) {
+        state.set(paramName, {
+          variable: paramName,
+          tainted: true,
+          sourceType: 'http_param',
+          sourceLine: param.startPosition.row + 1,
+          steps: [],
+        });
+      }
+    }
+  }
+
+  /** Find a taint sink in a statement and check if it receives tainted data. */
+  private findSink(
+    node: SyntaxNode,
+    state: Map<string, TaintState>,
+    language: string
+  ): { sink: TaintSink; taintState: TaintState | null } | null {
+    if (node.type === 'call_expression' || node.type === 'expression_statement') {
+      const callNode = node.type === 'expression_statement' ? node.namedChild(0) : node;
+      if (!callNode || callNode.type !== 'call_expression') return null;
+
+      const fn = callNode.childForFieldName('function');
+      if (!fn) return null;
+
+      const sinkMatch = this.registry.matchSink(fn.text, language);
+      if (!sinkMatch) return null;
+
+      const sink: TaintSink = {
+        function: fn.text,
+        type: sinkMatch.type,
+        line: callNode.startPosition.row + 1,
+        expression: callNode.text.slice(0, 100),
+        paramIndex: sinkMatch.paramIndex,
+      };
+
+      // Check if the relevant argument is tainted
+      const args = callNode.childForFieldName('arguments');
+      if (args) {
+        const targetArg = args.namedChild(sinkMatch.paramIndex);
+        if (targetArg) {
+          const taintInfo = this.propagator.evaluateExpression(targetArg, state);
+          if (taintInfo.tainted) {
+            return {
+              sink,
+              taintState: {
+                variable: targetArg.text.slice(0, 50),
+                tainted: true,
+                sourceType: taintInfo.sourceType,
+                sourceLine: taintInfo.sourceLine,
+                steps: taintInfo.steps,
+              },
+            };
+          }
+        }
+      }
+
+      return { sink, taintState: null };
+    }
+
+    // Recurse into child expressions
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const child = node.namedChild(i);
+      if (child) {
+        const result = this.findSink(child, state, language);
+        if (result?.taintState) return result;
+      }
+    }
+
+    return null;
+  }
+}

package/src/engine/analyzers/security/taint/TaintPropagator.ts

@@ -0,0 +1,250 @@
+/**
+ * KSA-164: Taint Propagator — Propagates taint state through CFG blocks.
+ */
+
+import type { SyntaxNode } from '../../../parsers/types.js';
+import type { BasicBlock } from '../cfg/BasicBlock.js';
+import type { TaintStep, TaintSinkType } from '../types.js';
+import { TaintRegistry } from './TaintRegistry.js';
+
+export interface TaintState {
+  variable: string;
+  tainted: boolean;
+  sourceType: string;
+  sourceLine: number;
+  steps: TaintStep[];
+}
+
+export class TaintPropagator {
+  private registry: TaintRegistry;
+
+  constructor(registry: TaintRegistry) {
+    this.registry = registry;
+  }
+
+  /** Propagate taint through a single block, updating state map. */
+  propagateBlock(block: BasicBlock, state: Map<string, TaintState>): Map<string, TaintState> {
+    const newState = new Map(state);
+
+    for (const stmt of block.statements) {
+      this.propagateStatement(stmt.node, newState);
+    }
+
+    return newState;
+  }
+
+  /** Propagate taint for a single statement. */
+  private propagateStatement(node: SyntaxNode, state: Map<string, TaintState>): void {
+    const type = node.type;
+
+    // Handle variable declarations and assignments
+    if (type === 'lexical_declaration' || type === 'variable_declaration') {
+      this.handleDeclaration(node, state);
+    } else if (type === 'expression_statement') {
+      const expr = node.namedChild(0);
+      if (expr) this.propagateExpression(expr, state);
+    } else if (type === 'assignment_expression' || type === 'augmented_assignment_expression') {
+      this.handleAssignment(node, state);
+    }
+  }
+
+  private handleDeclaration(node: SyntaxNode, state: Map<string, TaintState>): void {
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const declarator = node.namedChild(i);
+      if (!declarator || declarator.type !== 'variable_declarator') continue;
+
+      const nameNode = declarator.childForFieldName('name');
+      const valueNode = declarator.childForFieldName('value');
+      if (!nameNode || !valueNode) continue;
+
+      const varName = nameNode.text;
+      const taintInfo = this.evaluateExpression(valueNode, state);
+
+      if (taintInfo.tainted) {
+        state.set(varName, {
+          variable: varName,
+          tainted: true,
+          sourceType: taintInfo.sourceType,
+          sourceLine: taintInfo.sourceLine,
+          steps: [...taintInfo.steps, {
+            variable: varName,
+            line: nameNode.startPosition.row + 1,
+            action: taintInfo.action,
+            expression: valueNode.text.slice(0, 80),
+          }],
+        });
+      } else {
+        // Check if this is a sanitizer call
+        if (this.isSanitizerCall(valueNode)) {
+          state.delete(varName);
+        } else {
+          state.delete(varName);
+        }
+      }
+    }
+  }
+
+  private handleAssignment(node: SyntaxNode, state: Map<string, TaintState>): void {
+    const left = node.childForFieldName('left');
+    const right = node.childForFieldName('right');
+    if (!left || !right) return;
+
+    if (left.type !== 'identifier') return;
+    const varName = left.text;
+
+    const taintInfo = this.evaluateExpression(right, state);
+    if (taintInfo.tainted) {
+      state.set(varName, {
+        variable: varName,
+        tainted: true,
+        sourceType: taintInfo.sourceType,
+        sourceLine: taintInfo.sourceLine,
+        steps: [...taintInfo.steps, {
+          variable: varName,
+          line: left.startPosition.row + 1,
+          action: taintInfo.action,
+          expression: right.text.slice(0, 80),
+        }],
+      });
+    } else {
+      state.delete(varName);
+    }
+  }
+
+  private propagateExpression(node: SyntaxNode, state: Map<string, TaintState>): void {
+    if (node.type === 'assignment_expression' || node.type === 'augmented_assignment_expression') {
+      this.handleAssignment(node, state);
+    }
+  }
+
+  /** Evaluate if an expression produces a tainted value. */
+  evaluateExpression(node: SyntaxNode, state: Map<string, TaintState>): {
+    tainted: boolean;
+    sourceType: string;
+    sourceLine: number;
+    steps: TaintStep[];
+    action: TaintStep['action'];
+  } {
+    const notTainted = { tainted: false, sourceType: '', sourceLine: 0, steps: [], action: 'assign' as const };
+
+    // Direct identifier reference
+    if (node.type === 'identifier') {
+      const existing = state.get(node.text);
+      if (existing?.tainted) {
+        return { tainted: true, sourceType: existing.sourceType, sourceLine: existing.sourceLine, steps: existing.steps, action: 'pass_through' };
+      }
+      return notTainted;
+    }
+
+    // Member expression (e.g., req.body.name)
+    if (node.type === 'member_expression') {
+      const text = node.text;
+      const sourceMatch = this.registry.matchSource(text);
+      if (sourceMatch) {
+        return { tainted: true, sourceType: sourceMatch.type, sourceLine: node.startPosition.row + 1, steps: [], action: 'assign' };
+      }
+      // Check if object is tainted
+      const obj = node.childForFieldName('object');
+      if (obj) {
+        const objTaint = this.evaluateExpression(obj, state);
+        if (objTaint.tainted) return { ...objTaint, action: 'pass_through' };
+      }
+      return notTainted;
+    }
+
+    // Call expression
+    if (node.type === 'call_expression') {
+      const fn = node.childForFieldName('function');
+      if (fn) {
+        // Check if it's a sanitizer
+        if (this.isSanitizerCall(node)) {
+          return notTainted;
+        }
+        // Check if it's a source
+        const sourceMatch = this.registry.matchSource(fn.text);
+        if (sourceMatch) {
+          return { tainted: true, sourceType: sourceMatch.type, sourceLine: node.startPosition.row + 1, steps: [], action: 'function_call' };
+        }
+        // Check if arguments are tainted (conservative: if any arg tainted, result tainted)
+        const args = node.childForFieldName('arguments');
+        if (args) {
+          for (let i = 0; i < args.namedChildCount; i++) {
+            const arg = args.namedChild(i);
+            if (arg) {
+              const argTaint = this.evaluateExpression(arg, state);
+              if (argTaint.tainted) {
+                return { ...argTaint, action: 'function_call' };
+              }
+            }
+          }
+        }
+      }
+      return notTainted;
+    }
+
+    // Template literal (template_string)
+    if (node.type === 'template_string') {
+      for (let i = 0; i < node.namedChildCount; i++) {
+        const child = node.namedChild(i);
+        if (child && child.type === 'template_substitution') {
+          const expr = child.namedChild(0);
+          if (expr) {
+            const exprTaint = this.evaluateExpression(expr, state);
+            if (exprTaint.tainted) {
+              return { ...exprTaint, action: 'template_literal' };
+            }
+          }
+        }
+      }
+      return notTainted;
+    }
+
+    // Binary expression (string concatenation)
+    if (node.type === 'binary_expression') {
+      const left = node.childForFieldName('left');
+      const right = node.childForFieldName('right');
+      if (left) {
+        const leftTaint = this.evaluateExpression(left, state);
+        if (leftTaint.tainted) return { ...leftTaint, action: 'concat' };
+      }
+      if (right) {
+        const rightTaint = this.evaluateExpression(right, state);
+        if (rightTaint.tainted) return { ...rightTaint, action: 'concat' };
+      }
+      return notTainted;
+    }
+
+    // Subscript/element access
+    if (node.type === 'subscript_expression') {
+      const obj = node.childForFieldName('object');
+      if (obj) {
+        const objTaint = this.evaluateExpression(obj, state);
+        if (objTaint.tainted) return { ...objTaint, action: 'pass_through' };
+      }
+      return notTainted;
+    }
+
+    // Await expression
+    if (node.type === 'await_expression') {
+      const child = node.namedChild(0);
+      if (child) return this.evaluateExpression(child, state);
+      return notTainted;
+    }
+
+    return notTainted;
+  }
+
+  /** Check if a call expression is a sanitizer. */
+  private isSanitizerCall(node: SyntaxNode): boolean {
+    const fn = node.type === 'call_expression' ? node.childForFieldName('function') : null;
+    if (!fn) return false;
+    const fnText = fn.text;
+
+    // Check against all sink types
+    const sinkTypes: TaintSinkType[] = ['sql_query', 'shell_exec', 'html_output', 'file_path', 'url_fetch'];
+    for (const sinkType of sinkTypes) {
+      if (this.registry.isSanitizer(fnText, sinkType)) return true;
+    }
+    return false;
+  }
+}