apisec-code-bolt 0.1.8__tar.gz → 0.1.9__tar.gz

{apisec_code_bolt-0.1.8 → apisec_code_bolt-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apisec-code-bolt
-Version: 0.1.8
+Version: 0.1.9
 Summary: Static analysis probe for extracting architectural metadata from codebases
 Project-URL: Homepage, https://apisec.ai
 Project-URL: Documentation, https://docs.apisec.ai/code-bolt
@@ -349,6 +349,48 @@ ruff check .
 ruff format --check .
 ```
 
+### Publishing a release (maintainers)
+
+The CLI is published to [PyPI](https://pypi.org/project/apisec-code-bolt/) by the
+**Publish to PyPI** GitHub Action. **Merging to `build` does NOT publish** — the
+workflow only runs on `workflow_dispatch` or a published GitHub Release, and it
+builds from whatever ref it runs on.
+
+Prerequisites (one-time): the `PYPI_API_TOKEN` repository secret must be set
+(Settings → Secrets and variables → Actions).
+
+1. **Bump the version.** Edit `version` in `pyproject.toml` (single source of
+   truth; `--version` reads it via package metadata). PyPI **rejects re-uploads**
+   of an existing version, so the number must be higher than the current PyPI
+   release. Open a PR and merge it to `build`.
+
+2. **Publish** — dispatch the workflow (the standard path we use):
+   Actions → *Publish to PyPI* → **Run workflow** → select branch **`build`**.
+
+   ```bash
+   gh workflow run "Publish to PyPI" --ref build
+   ```
+
+   <details><summary>Alternative: publish via a GitHub Release</summary>
+
+   New release → create tag `vX.Y.Z` → set **Target: `build`** (it defaults to
+   the default branch; only `build` has the bumped version) → Publish. This
+   fires the same workflow via `release: [published]`.
+
+   ```bash
+   gh release create vX.Y.Z --target build --title "vX.Y.Z" --notes "…"
+   ```
+   </details>
+
+3. **Verify.** Confirm the new version appears on
+   [PyPI](https://pypi.org/project/apisec-code-bolt/), then upgrade an install:
+   ```bash
+   uv tool upgrade apisec-code-bolt   # or: pipx upgrade apisec-code-bolt
+   ```
+
+> Always release from `build` after the version bump has merged there — releasing
+> from a ref that still carries the old version will fail the PyPI upload.
+
 ## Privacy
 
 apisec-code-bolt is designed with privacy as a core principle:

{apisec_code_bolt-0.1.8 → apisec_code_bolt-0.1.9}/README.md

@@ -302,6 +302,48 @@ ruff check .
 ruff format --check .
 ```
 
+### Publishing a release (maintainers)
+
+The CLI is published to [PyPI](https://pypi.org/project/apisec-code-bolt/) by the
+**Publish to PyPI** GitHub Action. **Merging to `build` does NOT publish** — the
+workflow only runs on `workflow_dispatch` or a published GitHub Release, and it
+builds from whatever ref it runs on.
+
+Prerequisites (one-time): the `PYPI_API_TOKEN` repository secret must be set
+(Settings → Secrets and variables → Actions).
+
+1. **Bump the version.** Edit `version` in `pyproject.toml` (single source of
+   truth; `--version` reads it via package metadata). PyPI **rejects re-uploads**
+   of an existing version, so the number must be higher than the current PyPI
+   release. Open a PR and merge it to `build`.
+
+2. **Publish** — dispatch the workflow (the standard path we use):
+   Actions → *Publish to PyPI* → **Run workflow** → select branch **`build`**.
+
+   ```bash
+   gh workflow run "Publish to PyPI" --ref build
+   ```
+
+   <details><summary>Alternative: publish via a GitHub Release</summary>
+
+   New release → create tag `vX.Y.Z` → set **Target: `build`** (it defaults to
+   the default branch; only `build` has the bumped version) → Publish. This
+   fires the same workflow via `release: [published]`.
+
+   ```bash
+   gh release create vX.Y.Z --target build --title "vX.Y.Z" --notes "…"
+   ```
+   </details>
+
+3. **Verify.** Confirm the new version appears on
+   [PyPI](https://pypi.org/project/apisec-code-bolt/), then upgrade an install:
+   ```bash
+   uv tool upgrade apisec-code-bolt   # or: pipx upgrade apisec-code-bolt
+   ```
+
+> Always release from `build` after the version bump has merged there — releasing
+> from a ref that still carries the old version will fail the PyPI upload.
+
 ## Privacy
 
 apisec-code-bolt is designed with privacy as a core principle:

{apisec_code_bolt-0.1.8 → apisec_code_bolt-0.1.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "apisec-code-bolt"
-version = "0.1.8"
+version = "0.1.9"
 description = "Static analysis probe for extracting architectural metadata from codebases"
 readme = "README.md"
 license = {text = "Proprietary"}

{apisec_code_bolt-0.1.8 → apisec_code_bolt-0.1.9}/src/apisec_code_bolt/analysis/analyzer.py

@@ -2234,46 +2234,107 @@ class ProjectAnalyzer:
         Resolve handler qualified names to call graph symbols.
 
         Handles mismatches between route extraction and call graph naming
-        (e.g., module path variations).
+        (e.g., module path variations), and the interface-handler pattern where
+        the route annotations live on an interface method but the body lives in
+        an implementing class (e.g. Micronaut operation interfaces: routes are
+        declared on ``*Operations`` interfaces and the ``@Controller`` class
+        implements them). Taint must seed from the concrete implementation —
+        the interface method has no body, so a manifest handler pointing at it
+        yields zero data flows.
         """
         if not self._call_graph:
             return entry_points
 
-        symbols = set(self._call_graph._symbols.keys())
-        resolved = []
+        cg = self._call_graph
+        symbols = set(cg._symbols.keys())
+
+        # interface simple-name -> {implementing class qualified names}. Sourced
+        # from parsed classes (base_classes includes Java `implements`); the
+        # built CallGraph does not expose the builder's class-base map.
+        iface_impls: dict[str, set[str]] = {}
+        for pf in self._parsed_files.values():
+            if not getattr(pf, "success", False):
+                continue
+            for cls in getattr(pf, "classes", None) or []:
+                try:
+                    cls_qname = cls.qualified_name.full
+                except AttributeError:
+                    continue
+                for base in getattr(cls, "base_classes", None) or []:
+                    iface_impls.setdefault(base.rsplit(".", 1)[-1], set()).add(cls_qname)
+
+        def _redirect_to_impl(handler_qn: str) -> str:
+            """If handler is declared on an interface a concrete class implements,
+            redirect to that class's method (where the body/params live)."""
+            if "." not in handler_qn:
+                return handler_qn
+            owner, method = handler_qn.rsplit(".", 1)
+            impls = iface_impls.get(owner.rsplit(".", 1)[-1])
+            if not impls:
+                return handler_qn
+            fallback = None
+            for impl_cls in impls:
+                cand = f"{impl_cls}.{method}"
+                if cand == handler_qn or cand not in symbols:
+                    continue
+                node = cg.get_node(cand)
+                # Prefer a concrete implementation with a body (call edges) or one
+                # not flagged abstract; keep the interface handler otherwise.
+                if cg.get_callees(cand) or not getattr(node, "is_abstract", False):
+                    return cand
+                fallback = fallback or cand
+            return fallback or handler_qn
 
+        resolved = []
         for ep in entry_points:
             handler = ep.get("handler_qualified_name")
             if not handler:
                 resolved.append(ep)
                 continue
 
-            if handler in symbols:
-                resolved.append(ep)
-                continue
-
-            # Try common variations
-            candidates = [
-                handler,
-                handler.replace(".__init__", ""),
-            ]
-            # Try with/without package prefix (e.g., "app.main.get_user" -> "main.get_user")
-            if "." in handler:
-                parts = handler.split(".")
-                for i in range(1, len(parts)):
-                    variant = ".".join(parts[i:])
-                    if variant not in candidates:
-                        candidates.append(variant)
-
-            for cand in candidates:
-                if cand in symbols:
-                    ep = dict(ep)
-                    ep["handler_qualified_name"] = cand
-                    break
+            chosen = handler if handler in symbols else None
+            if chosen is None:
+                # Try common variations (module-path prefix stripping, __init__).
+                candidates = [handler, handler.replace(".__init__", "")]
+                if "." in handler:
+                    parts = handler.split(".")
+                    candidates += [".".join(parts[i:]) for i in range(1, len(parts))]
+                for cand in candidates:
+                    if cand in symbols:
+                        chosen = cand
+                        break
+                # Suffix match on the handler tail. Some plugins record the
+                # handler module as the *routing* file rather than the view's
+                # module (e.g. Django: `urls.UserSessionLoginApi.post` or the
+                # function-based `api_router.favorite_post`, while the symbols
+                # are `app.authentication.apis.UserSessionLoginApi.post` and
+                # `app.api.views.favorite_post`). Prefix stripping can't bridge
+                # that. Try the `Class.method` tail first, then the bare name,
+                # accepting a match only when it is unambiguous.
+                if chosen is None and "." in handler:
+                    parts = handler.split(".")
+                    for depth in (2, 1):
+                        if depth > len(parts):
+                            continue
+                        tail = "." + ".".join(parts[-depth:])
+                        tail_matches = [s for s in symbols if s.endswith(tail)]
+                        if len(tail_matches) == 1:
+                            chosen = tail_matches[0]
+                            break
+            chosen = chosen or handler
+
+            # Interface-handler → concrete implementation (Micronaut operation
+            # interfaces, and any handler declared on an implemented interface).
+            redirected = _redirect_to_impl(chosen)
+            if redirected != handler:
+                ep = dict(ep)
+                ep["handler_qualified_name"] = redirected
             resolved.append(ep)
 
         return resolved
 
+        return resolved
+
     # =========================================================================
     # Integration Detection
     # =========================================================================

{apisec_code_bolt-0.1.8 → apisec_code_bolt-0.1.9}/src/apisec_code_bolt/analysis/data_flow.py

@@ -1646,6 +1646,18 @@ class DataFlowAnalyzer:
                     if pname and ploc:
                         param_locations[pname] = ploc
 
+            # Django/DRF views receive all user input via the `request` object
+            # (request.data / .GET / .POST / .query_params) rather than typed
+            # per-field route params, so there is nothing in param_locations to
+            # seed. Treat the handler's `request` parameter itself as an HTTP
+            # origin and let propagation carry it into request.* reads, serializer
+            # construction, and downstream sinks.
+            if framework.startswith("django"):
+                for pobj in getattr(func, "parameters", None) or []:
+                    pname = getattr(pobj, "name", None)
+                    if pname == "request" and pname not in param_locations:
+                        param_locations[pname] = "HTTP_BODY"
+
             route_path = ep.get("path", "")
             origins = source_id.identify_from_function(
                 func,

{apisec_code_bolt-0.1.8 → apisec_code_bolt-0.1.9}/src/apisec_code_bolt/core/telemetry.py

@@ -337,7 +337,8 @@ def emit_install_event(*, probe_version: str = "") -> None:
 # Overridable for non-prod testing (staging/dev receivers), mirroring the
 # analyze path's --api-url. Defaults to prod, so unset means no change.
 _TELEMETRY_ENDPOINT = os.environ.get(
-    "APISEC_TELEMETRY_ENDPOINT", "https://api.apisec.ai/v1/surface/telemetry/events"
+    "APISEC_TELEMETRY_ENDPOINT",
+    "https://api.apisec.ai/v1/applications/surface/telemetry/events",
 )
 
 

{apisec_code_bolt-0.1.8 → apisec_code_bolt-0.1.9}/src/apisec_code_bolt/frameworks/ruby/taint_scanner.py

@@ -52,21 +52,47 @@ _SOURCE_CALLEES: frozenset[str] = frozenset(
     {"params", "cookies", "session", "request", "headers", "env"}
 )
 
-_SOURCE_SUBSTRINGS: tuple[str, ...] = (
-    "params[",
-    "params.require",
-    "params.permit",
-    "cookies[",
-    "session[",
-    "request.body",
-    "request.raw_post",
-    "request.query_string",
-    "request.query_parameters",
-    "request.path_parameters",
-    "request.headers[",
-    "request.env[",
+# HTTP-verb DSL methods used by rack-style frameworks (Grape, Sinatra) that
+# declare a route handler as a block rather than a ``def`` method:
+#   get '/users/:id' do ... end     post do ... end
+# These blocks never appear as ``method`` nodes, so the method-based passes
+# below miss them entirely; Pass C scans their block bodies directly.
+_ROUTE_VERBS: frozenset[str] = frozenset(
+    {"get", "post", "put", "patch", "delete", "options", "head"}
 )
 
+# Inherently-tainted source identifiers: `params`, `cookies`, `session`,
+# `request`, `headers`, `env`. Matched by NAME (not substring) inside
+# ``_is_tainted_node`` so that ``group_params`` / ``webcal_params`` (which
+# merely *contain* the substring ``params``) and ``Model.find(params[:id])``
+# (whose call text contains ``params[``) are NOT mis-read as sources. This
+# replaces the removed ``params[``-substring fallback, which was the P0
+# over-taint root cause: it marked every expression embedding ``params[...]``
+# as tainted and poisoned all derived values (see RUBY_SUPPORT_ROADMAP.md P0).
+# Method chains on these (``request.body``, ``params.permit``) and indexing
+# (``params[:id]``, ``cookies[:sid]``) are covered structurally by the
+# element_reference / source-call rules, so no substring fallback is needed.
+_SOURCE_IDENTIFIERS: frozenset[str] = _SOURCE_CALLEES
+
+# Sanitizer calls (P3) — a call whose RESULT is not tainted even when its
+# receiver / arguments are. Prevents the "receiver is tainted => the call is
+# a source" rule from propagating taint through coercions and escaping.
+#   - numeric coercion (receiver-agnostic): params[:x].to_i / .to_f / .to_d
+#   - numeric constructors (no receiver): Integer(x) / Float(x) / BigDecimal(x)
+#   - Shellwords escaping: Shellwords.escape / .shellescape
+_NUMERIC_COERCIONS: frozenset[str] = frozenset({"to_i", "to_f", "to_d", "to_r"})
+_SANITIZER_CONSTRUCTORS: frozenset[str] = frozenset({"Integer", "Float", "BigDecimal"})
+_SHELLWORDS_SANITIZERS: frozenset[str] = frozenset({"escape", "shellescape"})
+
+# ActiveRecord query-builder sinks that support parameterized forms
+# (``?``, ``:named``, hash). For these, a tainted value passed as a BOUND
+# argument — after a plain SQL template string, or as a hash / keyword
+# value — is SAFE; only taint interpolated *into* a SQL string argument is
+# dangerous. Raw-execution SQL sinks (``execute``, ``find_by_sql``,
+# ``update_all``, ...) take a single SQL string and keep the normal
+# tainted-arg treatment.
+_QUERY_BUILDER_SINKS: frozenset[str] = frozenset({"where", "having", "order", "group"})
+
 # ── Sink catalogue ────────────────────────────────────────────────────────────
 
 
@@ -76,11 +102,22 @@ class _Sink:
     receiver_fragment: str | None  # receiver text must contain this (None = any)
     sink_type: str
     description: str
+    receiver_excludes: tuple[str, ...] | None = None  # skip if receiver contains any
 
 
 _SINKS: list[_Sink] = [
     # ── SQL injection ─────────────────────────────────────────────────────────
-    _Sink("execute", None, "sql_injection", "Raw SQL execution"),
+    # `execute` is raw-SQL only on a DB connection (e.g. `connection.execute(sql)`).
+    # GraphQL `*Schema.execute(query_string)` runs a GraphQL query, NOT SQL —
+    # exclude receivers whose name ends in `Schema` (ApiSchema, MySchema,
+    # GraphQL::Schema) so a `Schema.execute(params[:query])` controller isn't SQLi.
+    _Sink(
+        "execute",
+        None,
+        "sql_injection",
+        "Raw SQL execution",
+        receiver_excludes=("Schema",),
+    ),
     _Sink("exec_query", None, "sql_injection", "Raw SQL execution"),
     _Sink("find_by_sql", None, "sql_injection", "Raw SQL query"),
     _Sink("select_all", None, "sql_injection", "Raw SQL select"),
@@ -100,7 +137,20 @@ _SINKS: list[_Sink] = [
     _Sink("capture2e", None, "command_injection", "Open3.capture2e"),
     _Sink("capture3", None, "command_injection", "Open3.capture3"),
     _Sink("pipeline", "Open3", "command_injection", "Open3.pipeline"),
-    # ── Open redirect ─────────────────────────────────────────────────────────
+    # ── Code / template injection (eval family) ──────────────────────────────
+    # `eval` / `instance_eval` / `class_eval` / `module_eval` with a tainted
+    # STRING argument execute attacker-controlled Ruby. The block form
+    # (`class_eval { ... }`) has no string arg and naturally does not fire.
+    _Sink("eval", None, "code_injection", "Kernel#eval with user-controlled string"),
+    _Sink("instance_eval", None, "code_injection", "instance_eval with user-controlled string"),
+    _Sink("class_eval", None, "code_injection", "class_eval with user-controlled string"),
+    _Sink("module_eval", None, "code_injection", "module_eval with user-controlled string"),
+    # ── SSTI ──────────────────────────────────────────────────────────────────
+    # ERB.new with a tainted template renders attacker-controlled ERB.
+    # Receiver-gated to the ERB class so the common `x.new` callee doesn't
+    # over-fire.
+    _Sink("new", "ERB", "ssti", "ERB.new with user-controlled template"),
+    # ── Open redirect ─────────────────────────────────────────────────────────────
     _Sink("redirect_to", None, "open_redirect", "HTTP redirect with user-controlled URL"),
     # ── Path traversal ────────────────────────────────────────────────────────
     _Sink("send_file", None, "path_traversal", "File serving with user-supplied path"),
@@ -267,6 +317,32 @@ class _MethodScanner:
             return True
         return False
 
+    def _is_sanitizer_call(self, node: Node) -> bool:
+        """True if the call's RESULT is guaranteed non-tainted (P3 sanitizers).
+
+        Checked before the source-call rule so that ``params[:x].to_i`` and
+        ``Shellwords.escape(...)`` clear taint instead of propagating it.
+        """
+        if node.type != "call":
+            return False
+        method_node = node.child_by_field_name("method")
+        if method_node is None:
+            return False
+        method = self._text(method_node)
+        # Numeric coercion — a number cannot inject into any sink.
+        if method in _NUMERIC_COERCIONS:
+            return True
+        receiver_node = node.child_by_field_name("receiver")
+        # Numeric constructors: Integer(x) / Float(x) / BigDecimal(x) (no receiver)
+        if receiver_node is None and method in _SANITIZER_CONSTRUCTORS:
+            return True
+        # Shellwords.escape / Shellwords.shellescape
+        if receiver_node is not None and method in _SHELLWORDS_SANITIZERS:
+            recv = self._text(receiver_node)
+            if recv == "Shellwords" or recv.endswith("::Shellwords"):
+                return True
+        return False
+
     def _is_tainted_node(self, node: Node) -> bool:
         """
         Recursively determine whether a subtree is tainted.
@@ -283,6 +359,22 @@ class _MethodScanner:
         if t in ("identifier", "instance_variable") and self._text(node) in self._tainted_vars:
             return True
 
+        # Inherently-tainted source identifiers: `params`, `cookies`,
+        # `session`, `request`, `headers`, `env`. Matched by NAME, not by
+        # substring, so `group_params` / `webcal_params` (which merely
+        # contain `params`) are NOT treated as sources. This replaces the
+        # removed `params[`-substring fallback (the P0 over-taint root cause:
+        # it marked `Model.find(params[:id])` and every derived value as
+        # tainted).
+        if t == "identifier" and self._text(node) in _SOURCE_IDENTIFIERS:
+            return True
+
+        # Sanitizer call — result is NOT tainted (P3). Checked before the
+        # source-call rule so `params[:x].to_i` / `Shellwords.escape(...)`
+        # clear taint instead of propagating it.
+        if t == "call" and self._is_sanitizer_call(node):
+            return False
+
         # Direct source call or method chain on tainted receiver
         if t == "call" and self._is_source_call(node):
             return True
@@ -290,6 +382,27 @@ class _MethodScanner:
         # params[:id], cookies[:session], tainted_var[:x]
         if t == "element_reference":
             obj = node.child_by_field_name("object")
+            # Rack multipart Tempfile accessor: `params[:file][:tempfile]`
+            # yields a server-managed Tempfile (a server-assigned temp path),
+            # not a user-supplied string. Only the NESTED multipart-part
+            # shape is cleared — a top-level `params[:tempfile]` is a plain
+            # user param named `tempfile` and stays tainted (see
+            # test_toplevel_param_named_tempfile_still_fires).
+            if (
+                obj is not None
+                and obj.type == "element_reference"
+                and any(
+                    c.type in ("simple_symbol", "symbol") and self._text(c) == ":tempfile"
+                    for c in node.children
+                )
+            ):
+                inner = obj.child_by_field_name("object")
+                if (
+                    inner is not None
+                    and inner.type == "identifier"
+                    and self._text(inner) in _SOURCE_IDENTIFIERS
+                ):
+                    return False
             if obj and self._is_tainted_node(obj):
                 return True
 
@@ -318,9 +431,7 @@ class _MethodScanner:
             if self._local_call_returns_tainted(node):
                 return True
 
-        # Fast text fallback
-        raw = self._text(node)
-        return any(sub in raw for sub in _SOURCE_SUBSTRINGS)
+        return False
 
     def _local_call_returns_tainted(self, call_node: Node) -> bool:
         """Return True if a local method call with tainted args returns tainted."""
@@ -398,9 +509,24 @@ class _MethodScanner:
                     for sink in candidates:
                         if sink.receiver_fragment and sink.receiver_fragment not in receiver_text:
                             continue
+                        if sink.receiver_excludes and any(
+                            ex in receiver_text for ex in sink.receiver_excludes
+                        ):
+                            continue
                         args_node = node.child_by_field_name("arguments")
                         if not args_node:
                             continue
+                        # Query-builder sinks (where/having/order/group)
+                        # support parameterized forms. If the first argument
+                        # is a plain SQL template (a string literal with NO
+                        # interpolation) or a hash / keyword pair, tainted values
+                        # in the BOUND arguments are SAFE — only taint
+                        # interpolated *into* a SQL string is dangerous. Raw
+                        # SQL-execution sinks skip this guard.
+                        if sink.callee in _QUERY_BUILDER_SINKS and self._is_parameterized_call(
+                            node
+                        ):
+                            continue
                         arg_idx = 0
                         for arg_node in args_node.children:
                             if arg_node.type in (",", "(", ")", "argument_list"):
@@ -461,6 +587,35 @@ class _MethodScanner:
             f["path"] = [{"caller": self._method_name, "callee": callee_name}] + f.get("path", [])
         return callee_flows
 
+    def _is_parameterized_call(self, call_node: Node) -> bool:
+        """True if a query-builder call uses a bound / parameterized form.
+
+        Recognises the three safe first-argument shapes (the rest fall through
+        to the normal tainted-arg check):
+          - hash / keyword pair:  ``where(name: x)`` / ``where({name: x})``
+          - plain SQL template:  ``where("col = ?", x)`` /
+            ``where("col = :k", k: x)`` — a string literal with NO
+            interpolation; the ``?``/``:k`` are bound placeholders.
+        Interpolated strings, concatenations, and bare identifiers are NOT
+        parameterized (the taint is in the SQL string itself).
+        """
+        args_node = call_node.child_by_field_name("arguments")
+        if args_node is None:
+            return False
+        first = None
+        for arg in args_node.children:
+            if arg.type in (",", "(", ")", "argument_list"):
+                continue
+            first = arg
+            break
+        if first is None:
+            return False
+        if first.type in ("pair", "hash"):
+            return True
+        if first.type == "string":
+            return not any(c.type == "interpolation" for c in first.children)
+        return False
+
     # ── Flow construction ─────────────────────────────────────────────────────
 
     def _make_flow(
@@ -546,6 +701,35 @@ def _collect_methods(node: Node, src: bytes) -> list[tuple[Node, str]]:
     return results
 
 
+def _collect_route_blocks(node: Node, src: bytes) -> list[tuple[Node, str]]:
+    """Find HTTP-verb DSL route handler blocks (Grape/Sinatra).
+
+    ``get '/users/:id' do ... end`` parses as a ``call`` whose method is an
+    HTTP verb with an attached ``do_block``/``block``. Returns
+    ``(block_node, verb)`` for each; the block exposes a ``body`` field, so a
+    ``_MethodScanner`` can scan it exactly like a method body. Non-verb DSL
+    blocks (``resource``, ``namespace``, ``before``) are skipped, but we
+    recurse through them to reach the verb blocks nested inside.
+    """
+    results: list[tuple[Node, str]] = []
+    if node.type == "call":
+        mnode = node.child_by_field_name("method")
+        if mnode is not None:
+            verb = src[mnode.start_byte : mnode.end_byte].decode("utf-8", errors="replace")
+            if verb in _ROUTE_VERBS:
+                blk = node.child_by_field_name("block")
+                if blk is None:
+                    for c in node.children:
+                        if c.type in ("do_block", "block"):
+                            blk = c
+                            break
+                if blk is not None and blk.child_by_field_name("body") is not None:
+                    results.append((blk, verb))
+    for child in node.children:
+        results.extend(_collect_route_blocks(child, src))
+    return results
+
+
 def _collect_classes(node: Node, src: bytes) -> list[tuple[Node, str]]:
     results: list[tuple[Node, str]] = []
     if node.type == "class":
@@ -608,8 +792,10 @@ class RubyTaintScanner:
             scanned_ids: set[int] = set()
 
             # Pass A: methods within classes — cross-method @ivar context + call graph
+            file_ivar_taint: set[str] = set()
             for class_node, _ in _collect_classes(tree.root_node, src):
                 ivar_taint = _prescan_class_instance_vars(class_node, src, pf.path)
+                file_ivar_taint |= ivar_taint
                 for method_node, method_name in _collect_methods(class_node, src):
                     scanned_ids.add(method_node.id)
                     scanner = _MethodScanner(
@@ -636,5 +822,19 @@ class RubyTaintScanner:
                     )
                     flows.extend(scanner.scan())
 
+            # Pass C: HTTP-verb DSL route blocks (Grape/Sinatra). Their handler
+            # bodies are blocks, not ``def`` methods, so Passes A/B skip them.
+            for block_node, verb in _collect_route_blocks(tree.root_node, src):
+                scanner = _MethodScanner(
+                    src=src,
+                    path=pf.path,
+                    method_node=block_node,
+                    method_name=verb,
+                    extra_tainted_vars=file_ivar_taint,
+                    method_index=method_index,
+                    depth=0,
+                )
+                flows.extend(scanner.scan())
+
         logger.debug("RubyTaintScanner: %d flows across %d files", len(flows), len(self._files))
         return flows