apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/analysis/literal_scanner.py

@@ -0,0 +1,300 @@
+"""
+Literal-pattern scanner.
+
+Sweeps all string literals in parsed files and detects security-relevant
+patterns:
+
+- **URLs**: External endpoints the service communicates with.
+- **SQL fragments**: Query structures, even those not in tracked data flows.
+- **Connection strings**: Database/cache/broker URLs with known schemes.
+
+Results populate the ``LiteralsModel`` section of the manifest.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from ..core.manifest import LiteralPatternModel
+    from ..parsing.base import ParsedFile
+
+
+# ============================================================================
+# Pattern rules
+# ============================================================================
+
+_URL_RE = re.compile(
+    r'https?://[^\s\'"<>,;)\]}{]+',
+)
+
+_CONNECTION_STRING_RE = re.compile(
+    r"(?:postgres(?:ql)?|mysql|sqlite|mongodb(?:\+srv)?|redis|amqp|amqps|nats|kafka)://"
+    r'[^\s\'"<>,;)\]}{]+',
+    re.IGNORECASE,
+)
+
+_SQL_FRAGMENT_RE = re.compile(
+    r"\b(?:SELECT\s+.+?\s+FROM|INSERT\s+INTO|UPDATE\s+\w+\s+SET|DELETE\s+FROM|"
+    r"CREATE\s+TABLE|ALTER\s+TABLE|DROP\s+TABLE|EXEC(?:UTE)?)\b",
+    re.IGNORECASE,
+)
+
+_SECRET_NAME_RE = re.compile(
+    r"(?:SECRET|TOKEN|PASSWORD|PASSWD|API_KEY|APIKEY|PRIVATE_KEY|"
+    r"ACCESS_KEY|AUTH_KEY|ENCRYPTION_KEY|SIGNING_KEY|CLIENT_SECRET|"
+    r"CREDENTIAL|DB_PASS|DATABASE_PASSWORD)",
+    re.IGNORECASE,
+)
+
+
+# ============================================================================
+# Detected patterns
+# ============================================================================
+
+
+@dataclass
+class DetectedLiteral:
+    """A single detected literal pattern."""
+
+    pattern_type: str  # "url", "sql_pattern", "connection_string"
+    value: str  # The matched text (truncated for safety)
+    file: str
+    line: int
+    confidence: str = "HIGH"
+    notes: str | None = None
+
+
+# ============================================================================
+# LiteralScanner
+# ============================================================================
+
+
+class LiteralScanner:
+    """
+    Scans all string literals in parsed files for security-relevant patterns.
+    """
+
+    def __init__(self, parsed_files: list[ParsedFile]) -> None:
+        self._parsed_files = [pf for pf in parsed_files if pf.success]
+
+    def scan(self) -> list[DetectedLiteral]:
+        """Run the full scan and return detected literals."""
+        results: list[DetectedLiteral] = []
+        seen: set[tuple[str, str]] = set()
+
+        for pf in self._parsed_files:
+            file_str = str(pf.path)
+
+            for assign in pf.assignments:
+                line = assign.location.line if assign.location else 0
+
+                # Normalise the candidate value for scanning.
+                # Covers both plain literals and string-interpolated/concatenated
+                # expressions (Java SQL patterns, f-strings, etc.).
+                is_interp = getattr(assign, "is_string_interpolation", False)
+                if assign.source_type == "literal" and isinstance(assign.source_value, str):
+                    scan_val: str | None = assign.source_value or None
+                elif is_interp and assign.source_value:
+                    scan_val = str(assign.source_value)
+                else:
+                    scan_val = None
+
+                # Hardcoded secret detection: variable name looks sensitive
+                # and value is a non-trivial string (literal or concatenation).
+                if scan_val and _SECRET_NAME_RE.search(assign.target):
+                    key = ("secret", file_str, assign.target)
+                    if key not in seen:
+                        seen.add(key)
+                        results.append(
+                            DetectedLiteral(
+                                pattern_type="secret",
+                                value=self._redact_secret(assign.target, scan_val),
+                                file=file_str,
+                                line=line,
+                                notes=f"Hardcoded value in variable '{assign.target}'",
+                            )
+                        )
+
+                # URL / SQL / connection-string scanning
+                if scan_val:
+                    self._scan_string(scan_val, file_str, line, results, seen)
+
+            # Scan class-level field declarations for hardcoded secrets.
+            # Java constants (e.g. private static final String JWT_SECRET = "...")
+            # are ParsedField objects, not local-variable assignments.
+            for cls in pf.classes:
+                for field in cls.fields:
+                    if not field.default_value or not isinstance(field.default_value, str):
+                        continue
+                    val = field.default_value
+                    if not _SECRET_NAME_RE.search(field.name):
+                        continue
+                    key = ("secret", file_str, field.name)
+                    if key not in seen:
+                        seen.add(key)
+                        # ParsedField has no line number; use the class location
+                        # as a best-effort pointer to the enclosing declaration.
+                        field_line = cls.location.line if cls.location else 0
+                        results.append(
+                            DetectedLiteral(
+                                pattern_type="secret",
+                                value=self._redact_secret(field.name, val),
+                                file=file_str,
+                                line=field_line,
+                                notes=f"Hardcoded value in field '{field.name}'",
+                            )
+                        )
+
+            # Scan string literals from call arguments
+            for cs in pf.call_sites:
+                for arg in cs.arguments:
+                    if not arg.is_literal:
+                        continue
+                    if arg.literal_type != "str":
+                        continue
+                    val = arg.literal_value
+                    if not val or not isinstance(val, str):
+                        continue
+                    line = cs.location.line
+                    self._scan_string(str(val), file_str, line, results, seen)
+
+        return results
+
+    def _scan_string(
+        self,
+        value: str,
+        file: str,
+        line: int,
+        results: list[DetectedLiteral],
+        seen: set[tuple[str, str]],
+    ) -> None:
+        """Scan a single string for all pattern types."""
+        # Connection strings (check before generic URLs to get specific type)
+        for m in _CONNECTION_STRING_RE.finditer(value):
+            matched = m.group()
+            key = ("connection_string", matched)
+            if key not in seen:
+                seen.add(key)
+                # Redact credentials: scheme://user:pass@host → scheme://***@host
+                sanitized = self._redact_credentials(matched)
+                results.append(
+                    DetectedLiteral(
+                        pattern_type="connection_string",
+                        value=sanitized[:200],
+                        file=file,
+                        line=line,
+                        notes=self._classify_connection_scheme(matched),
+                    )
+                )
+
+        # Generic URLs
+        for m in _URL_RE.finditer(value):
+            matched = m.group()
+            key = ("url", matched)
+            if key not in seen:
+                seen.add(key)
+                results.append(
+                    DetectedLiteral(
+                        pattern_type="url",
+                        value=matched[:200],
+                        file=file,
+                        line=line,
+                    )
+                )
+
+        # SQL fragments
+        for m in _SQL_FRAGMENT_RE.finditer(value):
+            matched = m.group()
+            # Deduplicate by normalized form
+            norm = matched.strip().upper()[:80]
+            key = ("sql_pattern", norm)
+            if key not in seen:
+                seen.add(key)
+                results.append(
+                    DetectedLiteral(
+                        pattern_type="sql_pattern",
+                        value=matched.strip()[:200],
+                        file=file,
+                        line=line,
+                    )
+                )
+
+    @staticmethod
+    def _redact_credentials(url: str) -> str:
+        """Replace user:password in a URL with ***."""
+        return re.sub(r"://[^@]+@", "://***@", url)
+
+    @staticmethod
+    def _redact_secret(var_name: str, value: str) -> str:
+        """Return a redacted representation: variable name + masked value."""
+        if len(value) <= 4:
+            masked = "***"
+        else:
+            masked = value[:2] + "*" * min(len(value) - 4, 16) + value[-2:]
+        return f'{var_name} = "{masked}"'
+
+    @staticmethod
+    def _classify_connection_scheme(url: str) -> str | None:
+        """Return a human-readable type for a connection string scheme."""
+        lower = url.lower()
+        if lower.startswith(("postgres", "postgresql")):
+            return "PostgreSQL connection"
+        if lower.startswith("mysql"):
+            return "MySQL connection"
+        if lower.startswith("sqlite"):
+            return "SQLite connection"
+        if lower.startswith("mongodb"):
+            return "MongoDB connection"
+        if lower.startswith("redis"):
+            return "Redis connection"
+        if lower.startswith(("amqp", "amqps")):
+            return "RabbitMQ connection"
+        if lower.startswith("nats"):
+            return "NATS connection"
+        if lower.startswith("kafka"):
+            return "Kafka connection"
+        return None
+
+    # ------------------------------------------------------------------
+    # Conversion to manifest models
+    # ------------------------------------------------------------------
+
+    def to_manifest_models(
+        self,
+        detections: list[DetectedLiteral] | None = None,
+    ) -> LiteralsModel:  # noqa: F821
+        """Convert detections to manifest LiteralsModel."""
+        from ..core.manifest import LiteralPatternModel, LiteralsModel, LocationModel
+
+        if detections is None:
+            detections = self.scan()
+
+        urls: list[LiteralPatternModel] = []
+        sql_patterns: list[LiteralPatternModel] = []
+        secret_patterns: list[LiteralPatternModel] = []
+
+        for det in detections:
+            model = LiteralPatternModel(
+                type=det.pattern_type,
+                value=det.value,
+                location=LocationModel(file=det.file, line=det.line),
+                confidence=det.confidence,
+                notes=det.notes,
+            )
+            if det.pattern_type == "url":
+                urls.append(model)
+            elif det.pattern_type == "sql_pattern":
+                sql_patterns.append(model)
+            elif det.pattern_type == "connection_string":
+                urls.append(model)
+            elif det.pattern_type == "secret":
+                secret_patterns.append(model)
+
+        return LiteralsModel(
+            urls=urls,
+            sql_patterns=sql_patterns,
+            secret_patterns=secret_patterns,
+        )

apisec_code_bolt/analysis/path_normalizer.py

@@ -0,0 +1,55 @@
+"""
+Path normalization for route parameter syntax across frameworks.
+
+Converts framework-specific path param syntax to a canonical form
+for the manifest: {name} or {name:type}.
+"""
+
+from __future__ import annotations
+
+import re
+
+# Flask/Django: <int:id>, <uuid:pk>, <path:name>
+FLASK_DJANGO_PARAM = re.compile(r"<(?:(?P<type>\w+):)?(?P<name>\w+)>")
+
+# FastAPI/Starlette: {id}, {id:int}
+FASTAPI_PARAM = re.compile(r"\{(\w+)(?::[^}]*)?\}")
+
+
+def normalize_path(path: str, framework: str = "fastapi") -> str:
+    """
+    Normalize path parameter syntax to canonical {name} form.
+
+    Args:
+        path: Route path (e.g. /users/<int:id> or /users/{id})
+        framework: Source framework for format detection
+
+    Returns:
+        Path with params as {name}
+    """
+    if not path:
+        return path
+
+    framework = framework.lower()
+
+    if framework in ("flask", "django"):
+        return FLASK_DJANGO_PARAM.sub(r"{\2}", path)
+
+    # FastAPI/Starlette already use {name}; optionally strip type
+    if framework in ("fastapi", "starlette"):
+        return FASTAPI_PARAM.sub(r"{\1}", path)
+
+    # Generic: try both patterns
+    result = FLASK_DJANGO_PARAM.sub(r"{\2}", path)
+    result = FASTAPI_PARAM.sub(r"{\1}", result)
+    return result
+
+
+def extract_path_param_names(path: str) -> list[str]:
+    """Extract path parameter names from a route path."""
+    names = []
+    for match in FLASK_DJANGO_PARAM.finditer(path):
+        names.append(match.group("name"))
+    for match in FASTAPI_PARAM.finditer(path):
+        names.append(match.group(1))
+    return names

apisec_code_bolt/analysis/read_site_detector.py

@@ -0,0 +1,310 @@
+"""
+Read-site origin detection for request and environment variable access patterns.
+
+Identifies data origins when handlers read from the request object
+directly (request.args.get("id"), request.path_params["id"], etc.)
+or from environment variables (os.environ["KEY"], os.getenv("KEY"), etc.)
+rather than via function parameters. Used for Flask, Django, and
+any framework where request data is accessed in the handler body.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from .request_patterns import get_request_pattern_registry
+
+if TYPE_CHECKING:
+    from ..parsing.base import ParsedFile, ParsedFunction
+
+
+# Regex patterns for request access in assignment RHS
+# Captures: (framework_hint, origin_type, param_name_if_any)
+# Pattern format: (regex, origin_type, param_group)
+REQUEST_ACCESS_PATTERNS: list[tuple[re.Pattern, str, int | None]] = [
+    # request.path_params["id"] or request.path_params['id']
+    (re.compile(r"request\.path_params\s*\[\s*['\"]([^'\"]+)['\"]\s*\]"), "HTTP_PATH_PARAM", 1),
+    # request.path_params.get("id")
+    (re.compile(r"request\.path_params\.get\s*\(\s*['\"]([^'\"]+)['\"]"), "HTTP_PATH_PARAM", 1),
+    # request.query_params["page"]
+    (re.compile(r"request\.query_params\s*\[\s*['\"]([^'\"]+)['\"]\s*\]"), "HTTP_QUERY_PARAM", 1),
+    # request.query_params.get("page")
+    (re.compile(r"request\.query_params\.get\s*\(\s*['\"]([^'\"]+)['\"]"), "HTTP_QUERY_PARAM", 1),
+    # request.args.get("id") - Flask
+    (re.compile(r"request\.args\.get\s*\(\s*['\"]([^'\"]+)['\"]"), "HTTP_QUERY_PARAM", 1),
+    # request.args["id"]
+    (re.compile(r"request\.args\s*\[\s*['\"]([^'\"]+)['\"]\s*\]"), "HTTP_QUERY_PARAM", 1),
+    # request.GET.get("id") - Django
+    (re.compile(r"request\.GET\.get\s*\(\s*['\"]([^'\"]+)['\"]"), "HTTP_QUERY_PARAM", 1),
+    # request.POST.get("id") - Django
+    (re.compile(r"request\.POST\.get\s*\(\s*['\"]([^'\"]+)['\"]"), "HTTP_FORM", 1),
+    # request.form.get("id") - Flask
+    (re.compile(r"request\.form\.get\s*\(\s*['\"]([^'\"]+)['\"]"), "HTTP_FORM", 1),
+    # request.form["id"]
+    (re.compile(r"request\.form\s*\[\s*['\"]([^'\"]+)['\"]\s*\]"), "HTTP_FORM", 1),
+    # request.headers["X-API-Key"] - param group 1 is header name
+    (re.compile(r"request\.headers\.get\s*\(\s*['\"]([^'\"]+)['\"]"), "HTTP_HEADER", 1),
+    (re.compile(r"request\.headers\s*\[\s*['\"]([^'\"]+)['\"]\s*\]"), "HTTP_HEADER", 1),
+    # request.cookies.get("session")
+    (re.compile(r"request\.cookies\.get\s*\(\s*['\"]([^'\"]+)['\"]"), "HTTP_COOKIE", 1),
+    # request.json() - body, no param name
+    (re.compile(r"request\.json\s*\(\s*\)"), "HTTP_BODY", None),
+    (re.compile(r"request\.get_json\s*\(\s*\)"), "HTTP_BODY", None),
+    # request.body - Django/Starlette
+    (re.compile(r"request\.body\b"), "HTTP_BODY", None),
+    # request.data - Flask/Django DRF
+    (re.compile(r"request\.data\b"), "HTTP_BODY", None),
+]
+
+# Java / Spring Boot read-site patterns (HttpServletRequest, etc.)
+JAVA_REQUEST_ACCESS_PATTERNS: list[tuple[re.Pattern, str, int | None]] = [
+    # request.getParameter("name")  or  httpRequest.getParameter("name")
+    (re.compile(r"(?:\w+\.)?getParameter\s*\(\s*\"([^\"]+)\""), "HTTP_QUERY_PARAM", 1),
+    # request.getPathVariable("id") / UriComponentsBuilder pattern
+    (re.compile(r"(?:\w+\.)?getPathVariable\s*\(\s*\"([^\"]+)\""), "HTTP_PATH_PARAM", 1),
+    # uriVariables.get("id")  (Spring PathVariables map)
+    (
+        re.compile(r"(?:uriVariables|pathVariables|pathParams)\s*\.get\s*\(\s*\"([^\"]+)\""),
+        "HTTP_PATH_PARAM",
+        1,
+    ),
+    # request.getHeader("X-API-Key")
+    (re.compile(r"(?:\w+\.)?getHeader\s*\(\s*\"([^\"]+)\""), "HTTP_HEADER", 1),
+    # request.getCookies() — no param name
+    (re.compile(r"(?:\w+\.)?getCookies\s*\("), "HTTP_COOKIE", None),
+    # request.getInputStream() / getReader()  — body
+    (re.compile(r"(?:\w+\.)?(?:getInputStream|getReader)\s*\("), "HTTP_BODY", None),
+    # httpExchange.getRequestBody() (Java HttpServer)
+    (re.compile(r"(?:\w+\.)?getRequestBody\s*\("), "HTTP_BODY", None),
+    # System.getenv("KEY")
+    (re.compile(r"System\.getenv\s*\(\s*\"([^\"]+)\""), "ENVIRONMENT_VAR", 1),
+    # System.getProperty("key")
+    (re.compile(r"System\.getProperty\s*\(\s*\"([^\"]+)\""), "ENVIRONMENT_VAR", 1),
+]
+
+# .NET / ASP.NET Core read-site patterns
+DOTNET_REQUEST_ACCESS_PATTERNS: list[tuple[re.Pattern, str, int | None]] = [
+    # HttpContext.Request.Query["key"]  or  Request.Query["key"]
+    (re.compile(r"(?:\w+\.)?Request\.Query\s*\[\s*\"([^\"]+)\""), "HTTP_QUERY_PARAM", 1),
+    # Request.Query.TryGetValue("key", ...)  or  Request.Query.ContainsKey("key")
+    (
+        re.compile(r"(?:\w+\.)?Request\.Query(?:\.TryGetValue|\.ContainsKey)\s*\(\s*\"([^\"]+)\""),
+        "HTTP_QUERY_PARAM",
+        1,
+    ),
+    # Request.RouteValues["key"]
+    (re.compile(r"(?:\w+\.)?Request\.RouteValues\s*\[\s*\"([^\"]+)\""), "HTTP_PATH_PARAM", 1),
+    # routeValues["key"]  (from RouteData.Values)
+    (
+        re.compile(r"(?:routeValues|routeData\.Values|RouteData\.Values)\s*\[\s*\"([^\"]+)\""),
+        "HTTP_PATH_PARAM",
+        1,
+    ),
+    # Request.Headers["X-API-Key"]
+    (re.compile(r"(?:\w+\.)?Request\.Headers\s*\[\s*\"([^\"]+)\""), "HTTP_HEADER", 1),
+    (
+        re.compile(r"(?:\w+\.)?Request\.Headers\s*\.\s*TryGetValue\s*\(\s*\"([^\"]+)\""),
+        "HTTP_HEADER",
+        1,
+    ),
+    # Request.Cookies["session"]
+    (re.compile(r"(?:\w+\.)?Request\.Cookies\s*\[\s*\"([^\"]+)\""), "HTTP_COOKIE", 1),
+    # Request.Form["field"]
+    (re.compile(r"(?:\w+\.)?Request\.Form\s*\[\s*\"([^\"]+)\""), "HTTP_FORM", 1),
+    # Request.Body  — no param name
+    (re.compile(r"(?:\w+\.)?Request\.Body\b"), "HTTP_BODY", None),
+    # await Request.ReadFromJsonAsync<T>()  or  ReadAsStringAsync()
+    (
+        re.compile(
+            r"(?:\w+\.)?Request\.(?:ReadFromJsonAsync|ReadAsStringAsync|GetFromJsonAsync)\b"
+        ),
+        "HTTP_BODY",
+        None,
+    ),
+    # Environment.GetEnvironmentVariable("KEY")
+    (re.compile(r"Environment\.GetEnvironmentVariable\s*\(\s*\"([^\"]+)\""), "ENVIRONMENT_VAR", 1),
+    # config["key"]  or  configuration["key"]  (IConfiguration)
+    (re.compile(r"(?:_?config(?:uration)?)\s*\[\s*\"([^\"]+)\""), "ENVIRONMENT_VAR", 1),
+]
+
+# Regex patterns for environment variable access in assignment RHS
+ENV_ACCESS_PATTERNS: list[tuple[re.Pattern, str, int | None]] = [
+    # os.environ["KEY"] or os.environ['KEY']
+    (re.compile(r"(?:os\.)?environ\s*\[\s*['\"]([^'\"]+)['\"]\s*\]"), "ENVIRONMENT_VAR", 1),
+    # os.environ.get("KEY") or os.environ.get("KEY", default)
+    (re.compile(r"(?:os\.)?environ\.get\s*\(\s*['\"]([^'\"]+)['\"]"), "ENVIRONMENT_VAR", 1),
+    # os.getenv("KEY") or os.getenv("KEY", default)
+    (re.compile(r"(?:os\.)?getenv\s*\(\s*['\"]([^'\"]+)['\"]"), "ENVIRONMENT_VAR", 1),
+    # Java: System.getenv("KEY")
+    (re.compile(r"System\.getenv\s*\(\s*\"([^\"]+)\""), "ENVIRONMENT_VAR", 1),
+    # Java: System.getProperty("key")
+    (re.compile(r"System\.getProperty\s*\(\s*\"([^\"]+)\""), "ENVIRONMENT_VAR", 1),
+    # .NET: Environment.GetEnvironmentVariable("KEY")
+    (re.compile(r"Environment\.GetEnvironmentVariable\s*\(\s*\"([^\"]+)\""), "ENVIRONMENT_VAR", 1),
+]
+
+
+@dataclass
+class ReadSiteOrigin:
+    """An origin detected at a read site (assignment from request)."""
+
+    origin_type: str  # OriginType name, e.g. "HTTP_PATH_PARAM"
+    param_name: str | None
+    target_variable: str
+    line: int
+    file_path: Path
+    framework: str = ""
+
+
+class ReadSiteDetector:
+    """
+    Detects data origins from request access in assignment RHS.
+
+    Scans handler bodies for assignments like:
+        user_id = request.path_params["user_id"]
+        page = request.args.get("page", 1)
+    and registers them as taint origins.
+    """
+
+    def __init__(self, framework: str = "fastapi"):
+        self._framework = framework.lower()
+        self._registry = get_request_pattern_registry()
+
+    def detect_origins(
+        self,
+        func: ParsedFunction,
+        parsed_file: ParsedFile,
+    ) -> list[ReadSiteOrigin]:
+        """
+        Detect read-site origins from assignments in a function.
+
+        Returns list of origins found (assignments from request.xxx).
+        """
+        origins: list[ReadSiteOrigin] = []
+        func_qname = (
+            func.qualified_name.full
+            if hasattr(func.qualified_name, "full")
+            else str(func.qualified_name)
+        )
+
+        # Get assignments in this function
+        if not hasattr(parsed_file, "assignments"):
+            return origins
+
+        for assign in parsed_file.assignments:
+            assign_func_raw = assign.in_function
+            assign_func = (
+                assign_func_raw.full
+                if hasattr(assign_func_raw, "full")
+                else str(assign_func_raw or "")
+            )
+            if not assign_func:
+                continue
+            # Match: exact, or func_qname ends with .assign_func
+            if assign_func != func_qname and assign_func != func.name:
+                if not (
+                    func_qname
+                    and (func_qname == assign_func or func_qname.endswith(f".{assign_func}"))
+                ):
+                    continue
+
+            if assign.source_type not in ("call", "expression", "variable"):
+                continue
+
+            source = assign.source_value or assign.value_source or ""
+            if not source:
+                continue
+            source_lower = source.lower()
+            has_request = "request" in source_lower
+            has_java_request = any(
+                kw in source_lower
+                for kw in (
+                    "getparameter",
+                    "getheader",
+                    "getpathvariable",
+                    "getinputstream",
+                    "getreader",
+                    "getrequestbody",
+                    "urivariables",
+                    "pathvariables",
+                )
+            )
+            has_dotnet_request = any(
+                kw in source_lower
+                for kw in (
+                    "request.query",
+                    "request.routevalues",
+                    "request.headers",
+                    "request.cookies",
+                    "request.form",
+                    "request.body",
+                    "readfromjsonasync",
+                    "readasstringasync",
+                )
+            )
+            has_env = (
+                "environ" in source_lower
+                or "getenv" in source_lower
+                or "getproperty" in source_lower
+                or "getenvironmentvariable" in source_lower
+            )
+            if not has_request and not has_java_request and not has_dotnet_request and not has_env:
+                continue
+
+            matched = False
+
+            # Match against request access patterns (.NET first when .NET keywords present)
+            if has_request or has_java_request or has_dotnet_request:
+                dotnet_patterns = DOTNET_REQUEST_ACCESS_PATTERNS if has_dotnet_request else []
+                java_patterns = JAVA_REQUEST_ACCESS_PATTERNS if has_java_request else []
+                for pattern, origin_type_name, param_group in (
+                    dotnet_patterns + java_patterns + REQUEST_ACCESS_PATTERNS
+                ):
+                    match = pattern.search(source)
+                    if match:
+                        param_name = None
+                        if param_group is not None and param_group <= len(match.groups()):
+                            param_name = match.group(param_group)
+
+                        origins.append(
+                            ReadSiteOrigin(
+                                origin_type=origin_type_name,
+                                param_name=param_name or assign.target,
+                                target_variable=assign.target,
+                                line=assign.location.line,
+                                file_path=Path(str(assign.location.file))
+                                if assign.location
+                                else parsed_file.path,
+                                framework=self._framework,
+                            )
+                        )
+                        matched = True
+                        break
+
+            # Match against environment variable access patterns (Python + Java)
+            if not matched and has_env:
+                for pattern, origin_type_name, param_group in ENV_ACCESS_PATTERNS:
+                    match = pattern.search(source)
+                    if match:
+                        param_name = None
+                        if param_group is not None and param_group <= len(match.groups()):
+                            param_name = match.group(param_group)
+
+                        origins.append(
+                            ReadSiteOrigin(
+                                origin_type=origin_type_name,
+                                param_name=param_name or assign.target,
+                                target_variable=assign.target,
+                                line=assign.location.line,
+                                file_path=Path(str(assign.location.file))
+                                if assign.location
+                                else parsed_file.path,
+                                framework=self._framework,
+                            )
+                        )
+                        break
+
+        return origins