@clear-capabilities/agentic-security-scanner 0.151.3 → 0.152.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (45) hide show
  1. package/CHANGELOG.md +71 -0
  2. package/dist/agentic-security.mjs +80 -80
  3. package/dist/agentic-security.mjs.sha256 +1 -1
  4. package/package.json +5 -5
  5. package/src/dataflow/CLAUDE.md +1 -1
  6. package/src/dataflow/catalog.js +802 -13
  7. package/src/dataflow/engine.js +852 -89
  8. package/src/dataflow/incremental.js +13 -0
  9. package/src/dataflow/index.js +18 -5
  10. package/src/dataflow/path-feasibility.js +86 -9
  11. package/src/dataflow/string-domain.js +132 -0
  12. package/src/dataflow/summaries.js +69 -8
  13. package/src/engine.js +108 -3
  14. package/src/ir/CLAUDE.md +2 -1
  15. package/src/ir/balanced-call.js +33 -1
  16. package/src/ir/callgraph.js +26 -2
  17. package/src/ir/class-hierarchy.js +101 -6
  18. package/src/ir/csharp-ir.js +97 -8
  19. package/src/ir/index.js +21 -1
  20. package/src/ir/parser-cs.js +706 -24
  21. package/src/ir/parser-java.js +498 -17
  22. package/src/ir/parser-js.js +22 -0
  23. package/src/ir/parser-php.js +446 -43
  24. package/src/ir/parser-rust.js +1338 -0
  25. package/src/ir/php-include-merge.js +190 -0
  26. package/src/lineage/sink-registry.js +18 -0
  27. package/src/lineage/source-registry.js +23 -0
  28. package/src/posture/csharp-analysis.js +341 -43
  29. package/src/posture/finding-defaults.js +5 -1
  30. package/src/posture/fix-coverage.js +1 -0
  31. package/src/posture/proof-coverage.js +1 -0
  32. package/src/sast/CLAUDE.md +1 -1
  33. package/src/sast/authz.js +144 -1
  34. package/src/sast/crypto-protocol.js +65 -7
  35. package/src/sast/csharp-cross-file.js +125 -0
  36. package/src/sast/csharp-structural.js +78 -2
  37. package/src/sast/csharp.js +574 -42
  38. package/src/sast/java-ast-folding.js +268 -11
  39. package/src/sast/java-bench-extras.js +530 -2
  40. package/src/sast/java-deserialization.js +31 -2
  41. package/src/sast/java-structural-cross-file.js +146 -0
  42. package/src/sast/java-structural.js +499 -6
  43. package/src/sast/ldap-injection.js +133 -3
  44. package/src/sast/rust.js +57 -0
  45. package/src/sast/xss-reflected-multilang.js +252 -3
package/src/ir/index.js CHANGED
@@ -18,7 +18,9 @@ import {
18
18
  import { parseJavaFile } from './parser-java.js';
19
19
  import { parseGoFile } from './parser-go.js';
20
20
  import { parsePhpFile } from './parser-php.js';
21
+ import { mergePhpIncludes } from './php-include-merge.js';
21
22
  import { parseRubyFile } from './parser-rb.js';
23
+ import { parseRustFile } from './parser-rust.js';
22
24
  import { parseCppFile, cppExtRe } from './parser-cpp.js';
23
25
  import { buildCallGraph } from './callgraph.js';
24
26
  import { buildClassHierarchy } from './class-hierarchy.js';
@@ -164,6 +166,9 @@ export function buildProjectIR(fileContents) {
164
166
  } else if (/\.rb$/i.test(file)) {
165
167
  const ir = parseRubyFile(file, code);
166
168
  if (ir) perFile[file] = ir;
169
+ } else if (/\.rs$/i.test(file)) {
170
+ const ir = parseRustFile(file, code);
171
+ if (ir) perFile[file] = ir;
167
172
  } else if (cppExtRe().test(file)) {
168
173
  const ir = parseCppFile(file, code);
169
174
  if (ir) perFile[file] = ir;
@@ -175,6 +180,12 @@ export function buildProjectIR(fileContents) {
175
180
  if (ir && ir.file) perFile[ir.file] = ir;
176
181
  }
177
182
  }
183
+ // SARD_80_F1 W5.7 — merge PHP include/require targets' top-level
184
+ // assignments into the includer's own scope before anything else touches
185
+ // the CFGs (SSA numbering included), since PHP's `include` genuinely
186
+ // executes in the caller's variable namespace. See php-include-merge.js's
187
+ // module header for the full rationale and scope.
188
+ try { mergePhpIncludes(perFile); } catch {}
178
189
  if (isSSAEnabled()) {
179
190
  for (const ir of Object.values(perFile)) {
180
191
  for (const fn of (ir.functions || [])) {
@@ -226,6 +237,9 @@ export async function buildProjectIRAsync(fileContents) {
226
237
  } else if (/\.rb$/i.test(file)) {
227
238
  const ir = parseRubyFile(file, code);
228
239
  if (ir) perFile[file] = ir;
240
+ } else if (/\.rs$/i.test(file)) {
241
+ const ir = parseRustFile(file, code);
242
+ if (ir) perFile[file] = ir;
229
243
  } else if (cppExtRe().test(file)) {
230
244
  const ir = parseCppFile(file, code);
231
245
  if (ir) perFile[file] = ir;
@@ -237,6 +251,12 @@ export async function buildProjectIRAsync(fileContents) {
237
251
  if (ir && ir.file) perFile[ir.file] = ir;
238
252
  }
239
253
  }
254
+ // SARD_80_F1 W5.7 — merge PHP include/require targets' top-level
255
+ // assignments into the includer's own scope before anything else touches
256
+ // the CFGs (SSA numbering included), since PHP's `include` genuinely
257
+ // executes in the caller's variable namespace. See php-include-merge.js's
258
+ // module header for the full rationale and scope.
259
+ try { mergePhpIncludes(perFile); } catch {}
240
260
  if (isSSAEnabled()) {
241
261
  for (const ir of Object.values(perFile)) {
242
262
  for (const fn of (ir.functions || [])) {
@@ -269,4 +289,4 @@ export function parsePythonFile(file, code) {
269
289
  return parsePythonFileRegex(file, code);
270
290
  }
271
291
 
272
- export { parseJsFile, parseJavaFile, parseCSharpFile, parseKotlinFile, parseGoFile, parsePhpFile, parseRubyFile, parseCppFile, buildCallGraph, buildClassHierarchy, computeSSA, isSSAEnabled, probePythonAvailable, pythonParserDegradation, resetPythonParserDegradation };
292
+ export { parseJsFile, parseJavaFile, parseCSharpFile, parseKotlinFile, parseGoFile, parsePhpFile, parseRubyFile, parseRustFile, parseCppFile, buildCallGraph, buildClassHierarchy, computeSSA, isSSAEnabled, probePythonAvailable, pythonParserDegradation, resetPythonParserDegradation };