/**
 * LanguageSourcesPass
 *
 * Detects taint sources and sinks that are not covered by config-based
 * pattern matching (analyzer.js / taint-matcher).  Handles language-specific
 * patterns that require text-level heuristics:
 *   - Java: getter methods returning tainted constructor fields
 *   - JavaScript/TypeScript: assignment sources, DOM XSS property sinks
 *   - Python: assignment sources, return-XSS sinks, trust-boundary violations
 *
 * Also computes the forward-taint maps (pyTaintedVars / jsTaintedVars) that
 * SinkFilterPass uses to reduce false positives.
 *
 * Depends on: taint-matcher, constant-propagation
 */
import type { TaintSource, TaintSink, TaintSanitizer, SastFinding } from '../../types/index.js';
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export declare const JS_TAINTED_PATTERNS: ({
    pattern: RegExp;
    type: "http_param";
} | {
    pattern: RegExp;
    type: "http_body";
} | {
    pattern: RegExp;
    type: "http_header";
} | {
    pattern: RegExp;
    type: "http_cookie";
} | {
    pattern: RegExp;
    type: "http_path";
} | {
    pattern: RegExp;
    type: "file_input";
} | {
    pattern: RegExp;
    type: "env_input";
} | {
    pattern: RegExp;
    type: "io_input";
} | {
    pattern: RegExp;
    type: "dom_input";
})[];
export interface LanguageSourcesResult {
    additionalSources: TaintSource[];
    additionalSinks: TaintSink[];
    /**
     * Language-specific sanitizers (e.g. Bash regex-allowlist guards) emitted
     * alongside sources/sinks. Merged into the sanitizer set in
     * `SinkFilterPass`.
     */
    additionalSanitizers: TaintSanitizer[];
    /**
     * Python forward-taint map: variable name → first tainted line.
     * Used by SinkFilterPass to reduce XPath/XSS false positives.
     */
    pyTaintedVars: Map<string, number>;
    /**
     * Python sanitized-variable set (apostrophe-guard + .replace() sanitizers).
     * Used by SinkFilterPass to suppress sanitized XPath sinks.
     */
    pySanitizedVars: Set<string>;
    /**
     * JavaScript forward-taint map: variable name → first tainted line.
     * Used by SinkFilterPass to suppress spurious XSS sinks.
     */
    jsTaintedVars: Map<string, number>;
}
export declare class LanguageSourcesPass implements AnalysisPass<LanguageSourcesResult> {
    readonly name = "language-sources";
    readonly category: "security";
    run(ctx: PassContext): LanguageSourcesResult;
}
export declare function buildPythonTaintedVars(sourceCode: string): Map<string, number>;
export declare function buildPythonSanitizedVars(sourceCode: string, pyTaintedVars: Map<string, number>): Set<string>;
export declare function findPythonTrustBoundaryViolations(sourceCode: string, taintedVars: Map<string, number>): Array<{
    sourceLine: number;
    sinkLine: number;
}>;
export declare function buildJavaScriptTaintedVars(sourceCode: string, language: string): Map<string, number>;
/**
 * Rust let-binding alias expansion (cognium-dev #71).
 *
 * Given a seed set of already-tainted variable names (typed-extractor
 * parameters like `name: web::Path<String>`, plus method-call sources whose
 * `let <var> = req.match_info()...` binding was reverse-engineered in
 * `taint-matcher.ts`), iteratively propagate taint through `let X = ...`
 * and `X = ...` lines whose RHS references any already-tainted name.
 *
 * The fixpoint loop is bounded by the number of distinct let-bindings, so
 * it terminates in O(lines × tainted) worst case — fine for any realistic
 * Rust source file.
 */
export declare function buildRustTaintedVars(sourceCode: string, seedVars: Set<string>): Map<string, number>;
/**
 * cognium-dev #220 — Java derived-taint expansion.
 *
 * Mirrors {@link buildRustTaintedVars} for Java: given a seed set of
 * already-tainted variable names (real source variables), scan the file
 * for `[Type] lhs = rhs;` declarations and `lhs = rhs;` assignments and
 * propagate taint whenever the RHS references a known tainted name via a
 * word-boundary match. Iterates to a fixpoint to handle multi-hop chains.
 *
 * The primary motivation is Java's array-form `Runtime.exec(String[])`
 * shape:
 *   String cmd = "echo " + arg;
 *   Runtime.getRuntime().exec(new String[]{"/bin/sh", "-c", cmd});
 * where the variable-scan flow detector would otherwise miss `cmd` since
 * only `arg` is in the source's `variable` field. The alias map is
 * consumed by `detectExpressionScanFlows` in `taint-propagation-pass.ts`
 * to synthesize a virtual source for each derived var.
 */
export declare function buildJavaTaintedVars(sourceCode: string, seedVars: Set<string>): Map<string, number>;
export declare function findBashPatternFindings(sourceCode: string, file: string): SastFinding[];
export declare function findExternalSecretExfiltrationFindings(code: string, file: string, language: string): SastFinding[];
/**
 * Emit Python `cors-wildcard-origin`, `xfo-csp-mismatch`, and
 * `tls-verify-disabled` findings for the subscript-assignment / context-
 * assignment shapes that the language-agnostic detectors miss.
 *
 *   cors-wildcard-origin:
 *     `resp.headers['Access-Control-Allow-Origin'] = '*'`
 *
 *   xfo-csp-mismatch:
 *     `resp.headers['X-Frame-Options'] = 'DENY' | 'SAMEORIGIN'`
 *     correlated with
 *     `resp.headers['Content-Security-Policy'] = '... frame-ancestors *|http* ...'`
 *
 *   tls-verify-disabled:
 *     `ctx.verify_mode = ssl.CERT_NONE`  OR
 *     `ctx.check_hostname = False`
 */
export declare function findPythonPatternFindings(code: string, file: string): SastFinding[];
/**
 * Emit Rust `tls-verify-disabled` for `reqwest`-style builders that opt out
 * of certificate / hostname validation:
 *
 *   `.danger_accept_invalid_certs(true)`
 *   `.danger_accept_invalid_hostnames(true)`
 *
 * Conservative: requires the literal `true` argument; `false` (re-enable) is
 * benign and is ignored.
 */
export declare function findRustPatternFindings(code: string, file: string): SastFinding[];
/**
 * Rust `hardcoded-credential` (CWE-798). Pattern:
 *   `(pub|const|static) <NAME>: &str = "literal";` where NAME matches
 *   /api[_]?key|secret|token|password|passwd|pwd|auth/i and the literal is
 *   non-trivial (length > 8 and not a placeholder).
 */
export declare function findRustHardcodedCredentialFindings(code: string, file: string): SastFinding[];
/**
 * Rust `insecure-cookie` (CWE-1004 / CWE-614). Pattern:
 *   `Cookie::build(...)` chain that explicitly calls `.secure(false)` or
 *   `.http_only(false)` (or both). The dedicated `insecure-cookie-pass.ts`
 *   handles the `format!("Set-Cookie: ...")` shape but not the actix-web
 *   builder chain.
 */
export declare function findRustInsecureCookieFindings(code: string, file: string): SastFinding[];
/**
 * Rust `jwt-verify-disabled` (CWE-347). Pattern:
 *   `.insecure_disable_signature_validation()` method call on a
 *   jsonwebtoken `Validation` value. Any presence of this method
 *   disables the signature check.
 */
export declare function findRustJwtVerifyDisabledFindings(code: string, file: string): SastFinding[];
/**
 * Rust `weak-crypto` (CWE-327). Pattern (raw ECB via `aes` crate):
 *   any line that calls `.encrypt_block(` or `.decrypt_block(` on a
 *   block-cipher receiver constructed via `Aes128::new` / `Aes192::new` /
 *   `Aes256::new` / `Aes128Ecb` / `Aes256Ecb`. We collect the cipher
 *   constructor lines in a first pass (variable name → seen) and emit
 *   on every `.encrypt_block(` / `.decrypt_block(` line in the same file.
 *
 *   The wrapped CBC/GCM/CTR forms go through `Cbc::<Aes128, ...>::new`
 *   or `Aes128Gcm::new` — those do NOT call `.encrypt_block` directly
 *   and so are not matched.
 */
export declare function findRustWeakCryptoEcbFindings(code: string, file: string): SastFinding[];
/**
 * Java pattern findings — Sprint 78 (#190):
 *   - `jwt-verify-disabled` (CWE-347): bare `JWT.decode(<token>)` on the
 *     auth0 `com.auth0.jwt.JWT` class. `decode` is documented as
 *     "decode the token without performing any verification"; only
 *     `JWT.require(...).build().verify(token)` enforces the signature.
 *   - `tls-verify-disabled` (CWE-295): anonymous `X509TrustManager`
 *     implementation whose `checkServerTrusted` body is empty
 *     (returns void without raising). This trust-nothing implementation
 *     accepts every certificate.
 */
export declare function findJavaPatternFindings(code: string, file: string): SastFinding[];
/**
 * Go pattern findings — Sprint 78 (#190):
 *   - `weak-crypto` (CWE-327): raw ECB usage via `aes.NewCipher(...)`
 *     followed by a direct `<cipher>.Encrypt(` / `.Decrypt(` call on the
 *     constructed value (no `cipher.NewCBCEncrypter` / `NewGCM` / `NewCTR`
 *     wrapper). The Go stdlib `aes.Cipher` exposes `Encrypt` / `Decrypt`
 *     that operate on a single 16-byte block — calling these directly is
 *     ECB mode.
 *
 *   Algorithm:
 *     1. Collect every `<v>, _ := aes.NewCipher(...)` cipher variable.
 *     2. If the file contains a `cipher.NewGCM(<v>)` / `cipher.NewCBC*(<v>)`
 *        / `cipher.NewCTR(<v>)` wrapping line for that variable, skip it
 *        (wrapped mode is not ECB).
 *     3. Otherwise emit on every `<v>.Encrypt(` / `<v>.Decrypt(` line.
 */
export declare function findGoPatternFindings(code: string, file: string): SastFinding[];
/**
 * JS pattern findings — Sprint 78 (#190):
 *   - `xml-entity-expansion` (CWE-611 / CWE-776): libxmljs `parseXml`
 *     (and `parseXmlString`) called with `{ noent: true }` resolves
 *     external entities, enabling XXE / billion-laughs. The default is
 *     `noent: false`; only the explicit-true form is unsafe.
 */
export declare function findJsPatternFindings(code: string, file: string): SastFinding[];
/**
 * Go xss — `fmt.Fprint(f|ln)?(w, ...)` writing tainted data directly to an
 * `http.ResponseWriter`. Two-pass:
 *
 *   1. Discover ResponseWriter parameter names by scanning function
 *      signatures `(<name> http.ResponseWriter, ...)`.
 *   2. For every `fmt.Fprint(f|ln)?(<name>, <format>, <args...>)` whose
 *      first argument matches a discovered name, emit xss UNLESS one of
 *      the args is wrapped in a recognized HTML escaper
 *      (`html.EscapeString` / `template.HTMLEscapeString` /
 *      `template.HTMLEscaper`).
 */
export declare function findGoXssFindings(code: string, file: string): SastFinding[];
/**
 * Java xss — `<recv>.getWriter().{print,println,write,printf,format,append}
 * (<arg>)` chained call where `<recv>` is typed `HttpServletResponse`.
 * The receiver-chain form bypasses the configured `PrintWriter.print`
 * sink because the engine doesn't yet trace `HttpServletResponse
 * .getWriter()` → `PrintWriter` type resolution.
 *
 * Conservative: only fires when the receiver token matches a parameter
 * named with the `HttpServletResponse` type AND no recognized HTML
 * encoder wraps the argument.
 */
export declare function findJavaResponseWriterXssFindings(code: string, file: string): SastFinding[];
/**
 * Vue xss — `template: '<...v-html="<var>"...>'` directive binding to a
 * variable that is sourced from a tainted location (URLSearchParams,
 * location.search/hash, route.query/params, fetch, etc.).
 *
 * Conservative: when the bound variable is a literal initializer
 * (`<var>: 'static'`) or sourced from a non-recognized location, no
 * finding is emitted.
 */
export declare function findJsVueVHtmlXssFindings(code: string, file: string): SastFinding[];
/**
 * Angular xss — `<recv>.bypassSecurityTrust(Html|Script|Url|ResourceUrl|
 * Style)(<arg>)` where `<recv>` is typed `DomSanitizer`. Skip when
 * `<arg>` is a string literal (intentional safe-by-author escape hatch).
 */
export declare function findTsAngularBypassXssFindings(code: string, file: string): SastFinding[];
/**
 * Python Flask xss — route function returning HTML built from a
 * `request.<args|form|values|files>.get(...)` value via string concat,
 * f-string, %, or .format(). Bypasses the engine's flow construction
 * gap for these string ops.
 *
 * Conservative: requires a Flask-style route decorator (`@<x>.route(`)
 * above the function; skip when the variable is escape()-wrapped.
 */
export declare function findPythonFlaskStringConcatXssFindings(code: string, file: string): SastFinding[];
/**
 * Python Jinja2 Markup-bypass xss — `Markup(<var>)` where `<var>` is
 * request-sourced, then passed into a `<X>.render(...)` call. The
 * `Markup` wrap deliberately disables Jinja autoescape for the value.
 *
 * Namespace-scoped alias tracking (Sprint 74 lesson): only treats
 * `Markup` as dangerous when imported from `markupsafe` or `flask`,
 * and only when no user-defined `class Markup` shadows the import.
 */
export declare function findPythonJinjaMarkupXssFindings(code: string, file: string): SastFinding[];
/**
 * Go open_redirect — `<rw>.Header().Set("Location", <expr>)` where
 * `<rw>` is bound to `http.ResponseWriter`. The configured sink rows
 * for `Header.Set` are typed `crlf` (CWE-113); the same line is also a
 * CWE-601 open_redirect when the header key is exactly `"Location"`
 * (case-insensitive). This pattern detector emits the open_redirect
 * finding directly, complementing the engine's crlf classification.
 *
 * Sprint 82 (#189): closes go__v02_location_header.
 *
 * Conservative: only fires when the receiver matches a parameter typed
 * `http.ResponseWriter` AND the literal key value is `Location` AND no
 * recognized URL-allowlist sanitizer wraps the value argument.
 */
export declare function findGoLocationHeaderOpenRedirectFindings(code: string, file: string): SastFinding[];
/**
 * Python Flask open_redirect — `<resp>.headers["Location"] = <expr>`
 * subscript-assignment shape. The engine's configured sinks for
 * Flask `Response.headers` model the dict-add form but not subscript
 * assignment, so the open_redirect signal is missed even though the
 * source (`request.args.get`) is detected.
 *
 * Sprint 82 (#189): closes py__v02_location_header.
 *
 * Conservative: requires the rhs to be a recognized request-source
 * variable OR an inline `request.<x>.get/[]` expression. Skips when
 * the value is wrapped in a recognized URL-allowlist call.
 */
export declare function findPythonHeadersSubscriptOpenRedirectFindings(code: string, file: string): SastFinding[];
/**
 * Rust open_redirect — Actix/Rocket builder pattern
 * `<builder>.append_header(("Location", <expr>))` or
 * `.insert_header(("Location", <expr>))` where the value traces back
 * to a `web::Query` / `web::Path` / `Form` extractor. The tuple-arg
 * form is the idiomatic Actix HeaderName→HeaderValue API; the
 * engine's configured sinks model single-arg `set_header(value)` but
 * not the tuple builder shape.
 *
 * Sprint 82 (#189): closes rust__v01_redirect_param.
 *
 * Conservative: requires the function to accept a recognized
 * `web::Query` / `web::Path` / `web::Form` / `HttpRequest` parameter
 * and the value expression to reference it (directly, or transitively
 * via a `.get(...)` / `.cloned()` / `.unwrap_or_default()` chain).
 */
export declare function findRustAppendHeaderTupleOpenRedirectFindings(code: string, file: string): SastFinding[];
/**
 * JS/HTML DOM open_redirect — assignment / call patterns that drive
 * `location.href`, `window.location`, `document.location`,
 * `location.assign(...)`, `location.replace(...)`, or `<elem>.content
 * = '...;url=' + ...` (meta-refresh DOM shape) where the right-hand
 * side traces back to a DOM source (`location.search`,
 * `location.hash`, `URLSearchParams.get(...)`, `document.referrer`,
 * `window.name`).
 *
 * Sprint 82 (#189): closes html__v01_redirect_param,
 * html__v03_meta_refresh, htmljs__v03_meta_refresh.
 *
 * Conservative: only fires when the rhs expression contains (or
 * references a var that contains) a recognized DOM source token;
 * never fires on literal-only assignments.
 */
export declare function findJsDomOpenRedirectFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 83 detector A — Go `plugin.Open(<tainted>)` / `plugin.Lookup(...)`.
 * Loading a Go plugin executes the loaded module's init() functions and
 * makes its exported symbols callable, which is a code-injection sink
 * equivalent to dynamic library loading. Fires when the path argument
 * traces back to an `*http.Request` extractor (FormValue / URL.Query /
 * PostFormValue / Header.Get / Cookie) within the same function.
 */
export declare function findGoPluginOpenCodeInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 83 detector B — JS indirect eval forms.
 * Configured `eval` sink matches direct `eval(x)` but misses:
 *   - `(0, eval)(x)` comma-operator indirect call
 *   - `globalThis.eval(x)` / `global.eval(x)` / `window.eval(x)` / `self.eval(x)`
 *   - aliased eval: `const f = eval; f(x)` then `f(taint)`
 * Fires when the argument traces back to req.body / req.query / req.params /
 * req.headers / req.cookies (Express/Koa-style request extractor).
 */
export declare function findJsIndirectEvalCodeInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 83 detector C — Python `code` stdlib REPL / compile_command.
 * `code.InteractiveInterpreter().runsource(s)`, `runcode(c)`, `push(line)` and
 * `code.InteractiveConsole().push(line)`, plus `code.compile_command(s)` —
 * all execute or compile arbitrary Python source. Fires when the argument
 * traces back to a Flask `request.*` extractor; gated on `import code`
 * to avoid colliding with user-defined `code` variables.
 */
export declare function findPythonInteractiveInterpreterCodeInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 83 detector D — Rust eval-crate / dynamic-load sinks.
 * Rust has no language-level eval; the canonical sinks are:
 *   - `evalexpr::eval(...)` (and `_with_context|_boolean|_int|_float|_string|_tuple|_empty`)
 *   - `libloading::Library::new(...)` (dynamic library load)
 *   - `mlua::Lua::new().load(<src>).{exec,eval,call}(...)` / rlua equivalent
 * Fires when the argument traces back to an Actix-web extractor: a plain
 * `body: String|Bytes`, a `web::Query<T>` / `web::Path<T>` / `web::Form<T>` /
 * `web::Json<T>` / `HttpRequest` param, or `axum::body::Bytes`/`String` etc.
 */
export declare function findRustEvalCrateCodeInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 84 detector A (#189) — Go MongoDB driver nosql_injection.
 * The Go MongoDB driver call shape `coll.FindOne(ctx, bson.M{"k": <taint>})`
 * (and siblings: Find / InsertOne / InsertMany / UpdateOne / UpdateMany /
 * DeleteOne / DeleteMany / FindOneAndUpdate / FindOneAndDelete /
 * FindOneAndReplace / Aggregate) is not modeled by configured sinks (those
 * cover Node.js Mongo only). Fires when the filter argument (after `ctx`)
 * references a value transitively derived from `*http.Request` extractors
 * (URL.Query().Get / FormValue / PostFormValue / Header.Get / Cookie).
 */
export declare function findGoMongoNosqlInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 84 detector B (#189) — Java Mongo driver nosql_injection.
 * Mongo Java driver shape `users.find(eq("k", <taint>))` (and siblings)
 * is not modeled by configured sinks (those cover Node.js Mongo only).
 * Fires when the receiver call payload references a value transitively
 * derived from servlet request extractors (request.getParameter /
 * getHeader / getCookies / getReader / getQueryString / getPart).
 */
export declare function findJavaMongoNosqlInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 84 detector C (#189) — Python mongoengine `$where` JS-string injection.
 * The shape `User.objects(__raw__={'$where': "this.x == '" + n + "'"})`
 * (and aliases via `$where` key with string concat / f-string) bypasses
 * the configured nosql sinks. Fires when the `$where` value references
 * a value transitively derived from Flask/Django/FastAPI request input.
 */
export declare function findPythonMongoengineWhereNosqlInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 85 detector (#189) — Java SSRF via `new URL(<tainted>)` →
 * `.openStream()` / `.openConnection()` / `.getContent()` receiver chains
 * that the configured `URL.openStream` / `URL.openConnection` sinks
 * recognize but the cross-statement flow construction misses (URL value
 * passes through an intermediate local variable). Also fires when the
 * tainted URL is gated only by a weak allowlist — a scheme-only check
 * such as `url.startsWith("https://")` is NOT a sanitizer because the
 * host is still attacker-controlled.
 */
export declare function findJavaUrlOpenStreamSsrfFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 86 detector A (#189) — Python uncontrolled format-string.
 *
 * Two shapes:
 *   1. `<tainted> % args`                 — old-style percent formatting
 *   2. `<tainted>.format(args)`           — `str.format` API
 *
 * When the format string itself comes from HTTP request input, an
 * attacker can probe arbitrary attributes/items via `str.format`
 * (`{0.__class__.__init__.__globals__}`) or crash the process via
 * malformed `%` specifiers. CWE-134.
 */
export declare function findPythonTaintedFormatStringFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 86 detector B (#189) — JavaScript uncontrolled format-string
 * via Node `util.format(<tainted>, ...args)`. `util.format` honours
 * `%s`/`%d`/`%j`/`%O` specifiers; a tainted format string can fingerprint
 * argument types and is the documented sink for CWE-134 in Node.
 */
export declare function findJsUtilFormatFormatStringFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 86 detector C (#189) — Python HTTP header CRLF injection via
 * Flask/Werkzeug `response.headers['X-Custom'] = <tainted concat>` or
 * `response.headers.add(...)` / `response.headers.set(...)`. CWE-113.
 */
export declare function findPythonHeaderCrlfInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 87 detector A (#189) — JavaScript / TypeScript LDAP injection
 * via ldapjs / ldapts `client.search(base, { filter: <tainted>, ... })`.
 *
 * ldapjs and ldapts share the same call shape: `client.search(base, opts,
 * cb)` where `opts.filter` is the LDAP filter string. When an attacker
 * controls the filter content, they can break out of the intended filter
 * (e.g. `*)(uid=*` injection) to enumerate the directory. CWE-90.
 *
 * The detector tracks taint propagation from Express request extractors
 * (`req.query.X`, `req.body.X`, `req.params.X`, `req.headers.X`,
 * `req.cookies.X`) through both `let|const|var` assignments and
 * template-literal / `+`-concat construction of the filter string.
 */
export declare function findJsLdapInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 87 detector B (#189) — Go LDAP injection via go-ldap/ldap.v3
 * `ldap.NewSearchRequest(base, scope, deref, sizeLimit, timeLimit,
 * typesOnly, <tainted-filter>, attributes, controls)`.
 *
 * The 7th positional argument is the LDAP filter. The detector tracks
 * tainted strings derived from `r.URL.Query().Get(...)` / `r.Form.Get`
 * / `r.PostForm.Get` / `r.FormValue` / `r.PostFormValue` through
 * `:=`/`=` assignments and `fmt.Sprintf` calls, then fires when the
 * filter slot resolves to a tainted symbol. CWE-90.
 */
export declare function findGoLdapInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 87 detector C (#189) — Rust LDAP injection via ldap3
 * `LdapConn::search(base, scope, &<tainted-filter>, attrs)` (and the
 * async `Ldap::search(...)` mirror).
 *
 * The 3rd positional argument is the LDAP filter. Tainted strings come
 * from actix-web `web::Query<HashMap<String, String>>` / `web::Path` /
 * `web::Form` / `web::Json` parameter types (extractor handlers) and
 * propagate through `let` bindings and `format!(...)` macros. CWE-90.
 */
export declare function findRustLdapInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 87 detector D (#189) — Rust log injection via the `log` crate
 * macros (`info!`, `warn!`, `error!`, `debug!`, `trace!`) where a
 * tainted value is interpolated into the format args.
 *
 * Unsanitized CRLF in log lines can split log entries, forge
 * authentication events, or escape into log-aggregation pipelines that
 * parse newlines as record boundaries. CWE-117.
 */
export declare function findRustLogInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 89 detector A (#189) — Go insecure deserialization via
 * `encoding/gob` `gob.NewDecoder(<req-body>).Decode(&v)`.
 *
 * The `gob` package will reconstruct arbitrary Go values, and any
 * registered concrete type can be instantiated by the attacker through
 * `gob.Register(...)` side effects. Decoding directly from
 * `r.Body` (`*http.Request`) without authenticated framing is unsafe.
 * CWE-502.
 */
export declare function findGoGobDeserializationFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 89 detector B (#189) — JS insecure deserialization via
 * `JSON.parse(req.body)`.
 *
 * Express applications that register `express.text(...)` or
 * `bodyParser.raw(...)` middleware leave `req.body` as an
 * attacker-controlled string. Passing it through `JSON.parse(...)`
 * exposes prototype-pollution paths if the parsed object is then
 * merged into trusted state or used as a property bag. CWE-502 /
 * CWE-1321 (prototype-pollution adjacent).
 *
 * Conservative gate: only fire on `JSON.parse(<expr>)` where
 * `<expr>` resolves to `req.body` (the only express extractor that
 * is genuinely a raw string when text/raw bodyparsing is used).
 */
export declare function findJsJsonParseBodyFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 89 detector C (#189) — JS DOM XPath injection via
 * `document.evaluate(<tainted>, ...)`.
 *
 * The DOM `XPathEvaluator.evaluate()` API takes a string XPath
 * expression as its first argument. When that string is built from
 * `location.search` / `location.hash` / URLSearchParams without
 * escaping, the attacker can rewrite the query (e.g. injecting
 * `' or '1'='1`-style predicates) and exfiltrate other nodes. CWE-643.
 *
 * Gate: file must reference `XPathResult` (strong DOM-XPath signal)
 * AND call `.evaluate(`, AND contain a browser taint source
 * (`location.search`, `location.hash`, `URLSearchParams`).
 */
export declare function findJsDomXpathInjectionFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 90 detector A (#189) — Go XXE via `encoding/xml` decoder with
 * `d.Strict = false` (allows DTD-like constructs and custom Entity
 * resolution to be configured on the decoder). When the source stream
 * is `*http.Request.Body`, the attacker can submit a payload that
 * triggers entity-expansion / external-entity reads through the
 * `Entity` map. CWE-611 / CWE-776.
 */
export declare function findGoXmlDecoderXxeFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 90 detector B (#189) — Python SSTI via Jinja2
 * `Template(<tainted>).render(...)`.
 *
 * Constructing a `jinja2.Template` from attacker-controlled source
 * gives the attacker the entire Jinja sandbox-escape surface
 * (`{{ ''.__class__.__mro__[1].__subclasses__() ... }}`). CWE-1336.
 *
 * Gate: file must import `jinja2.Template` AND construct it from a
 * Flask/FastAPI request extractor (request.args/form/values/json/data).
 */
export declare function findPythonJinjaTemplateSstiFindings(code: string, file: string): SastFinding[];
/**
 * Sprint 90 detector C (#189) — JS SSTI via `Handlebars.compile(<tainted>)`
 * or `ejs.render(<tainted>, ...)` / `ejs.compile(<tainted>)`.
 *
 * Compiling an attacker-controlled template lets the attacker execute
 * arbitrary code through helper-shadowing / prototype gadgets
 * (Handlebars CVE-2019-19919 chains, EJS render-options escape). CWE-1336.
 */
export declare function findJsTemplateInjectionSstiFindings(code: string, file: string): SastFinding[];
//# sourceMappingURL=language-sources-pass.d.ts.map