circle-ir-ai 2.12.2 → 2.12.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +141 -0
- package/dist/secret-scan/history-patterns.d.ts.map +1 -1
- package/dist/secret-scan/history-patterns.js +4 -1
- package/dist/secret-scan/history-patterns.js.map +1 -1
- package/dist/secret-scan/validators.d.ts +41 -0
- package/dist/secret-scan/validators.d.ts.map +1 -1
- package/dist/secret-scan/validators.js +66 -0
- package/dist/secret-scan/validators.js.map +1 -1
- package/dist/security-scan/sink-filters.d.ts.map +1 -1
- package/dist/security-scan/sink-filters.js +73 -1
- package/dist/security-scan/sink-filters.js.map +1 -1
- package/package.json +3 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,147 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.12.5] - 2026-06-19
|
|
9
|
+
|
|
10
|
+
### Dependencies
|
|
11
|
+
|
|
12
|
+
- Bump `circle-ir` `3.75.0` → `3.82.0` (picks up the jwt-verify-disabled
|
|
13
|
+
regex fix landed in 3.77.0 — eliminated all 12 jwt-verify FPs in the
|
|
14
|
+
top-10 Java OSS harness re-run, -67% on top-10 criticals overall).
|
|
15
|
+
|
|
16
|
+
### Fixed — LLM verifier rubber-stamping assertion utilities as exploitable sinks (cognium-ai#109)
|
|
17
|
+
|
|
18
|
+
Top-10 Java OSS harness re-run on `circle-ir@3.80.0` (3.77.0 jwt-verify
|
|
19
|
+
fix landed; -67% on top-10 criticals) surfaced a second class of
|
|
20
|
+
LLM-layer FPs that the static `circle-ir` layer can't catch: the LLM
|
|
21
|
+
verifier (`openai/gpt-4o-mini` via OpenRouter) was returning
|
|
22
|
+
`llm_verified: true, llm_confidence: 0.8` on obvious no-op sinks.
|
|
23
|
+
|
|
24
|
+
Evidence — three findings on `chinabugotech/hutool`, all from one
|
|
25
|
+
file (`hutool-db/.../DialectRunner.java`):
|
|
26
|
+
|
|
27
|
+
1. `Assert.notNull(query, "[query] is null !")` flagged as critical
|
|
28
|
+
sql_injection. Definite FP — pure guard utility, no SQL semantics.
|
|
29
|
+
2. `SqlExecutor.queryAndClosePs(dialect.psForFind(conn, query), rsh)`
|
|
30
|
+
flagged as sql_injection from a library-API method parameter.
|
|
31
|
+
3. Same as 2 for `psForPage`.
|
|
32
|
+
|
|
33
|
+
All three returned `llm_confidence: 0.8` — the identical confidence
|
|
34
|
+
value across three independent prompts is a calibration smell that
|
|
35
|
+
the verifier has a "plausible-sounding default" instead of reading
|
|
36
|
+
the sink line. Same pattern seen on `baomidou/mybatis-plus` (ranks
|
|
37
|
+
11-20 harness): 9 critical sql_injection flagged in
|
|
38
|
+
`MybatisPlusInterceptor.java` framework lifecycle hooks
|
|
39
|
+
(`willDoQuery`, `beforeQuery`, `createCacheKey`, `beforePrepare`).
|
|
40
|
+
|
|
41
|
+
**This release ships fix #1 — sink-shape post-filter for assertion
|
|
42
|
+
utilities.** Drops the candidate before the LLM verifier ever sees
|
|
43
|
+
it; faster, free, and not subject to verifier hallucination.
|
|
44
|
+
|
|
45
|
+
`src/security-scan/sink-filters.ts` — added a `#109` block to
|
|
46
|
+
`NON_SINK_PATTERNS` covering:
|
|
47
|
+
|
|
48
|
+
- Spring `org.springframework.util.Assert.*` — `notNull`, `isTrue`,
|
|
49
|
+
`hasText`, `notEmpty`, `state`, etc.
|
|
50
|
+
- hutool `cn.hutool.core.lang.Assert.*` (same method surface as Spring)
|
|
51
|
+
- Guava `Preconditions.*` (`checkArgument`, `checkNotNull`,
|
|
52
|
+
`checkState`) and `Verify.*` (`verify`, `verifyNotNull`)
|
|
53
|
+
- `java.util.Objects` guard methods (`requireNonNull` family +
|
|
54
|
+
`checkIndex` family — but NOT `Objects.toString` / `hash` / `equals`
|
|
55
|
+
which can be legitimate sinks in template / log contexts)
|
|
56
|
+
- Apache Commons Lang `Validate.*` (`notNull`, `isTrue`, `notBlank`,
|
|
57
|
+
`matchesPattern`)
|
|
58
|
+
|
|
59
|
+
Method names are enumerated explicitly (not `\.\w+\(`) to avoid
|
|
60
|
+
over-suppressing user classes that happen to be named `Validate` /
|
|
61
|
+
`Verify` with unrelated APIs.
|
|
62
|
+
|
|
63
|
+
Applies the suppression across every taint-flow CWE
|
|
64
|
+
(`sql_injection`, `command_injection`, `code_injection`,
|
|
65
|
+
`deserialization`, `xss`, `path_traversal`, `nosql_injection`,
|
|
66
|
+
`ssrf`, `ldap_injection`, `xpath_injection`, `open_redirect`,
|
|
67
|
+
`template_injection`) — implemented by extending the
|
|
68
|
+
`NonSinkPattern.sinkType` field to accept `string | readonly
|
|
69
|
+
string[]` so one regex covers all sink types without 12× duplication.
|
|
70
|
+
|
|
71
|
+
`isKnownNonSink()` now dispatches via `Array.isArray()`. Public
|
|
72
|
+
API unchanged; only the internal pattern table type widened.
|
|
73
|
+
|
|
74
|
+
Validated by 8 new vitest cases in `tests/sink-filters.test.ts`
|
|
75
|
+
(`describe('isKnownNonSink — #109 …')`) — full suite 805 pass +
|
|
76
|
+
3 skipped + typecheck + build clean.
|
|
77
|
+
|
|
78
|
+
Three follow-up fixes from the issue body deferred (tracked in
|
|
79
|
+
cognium-ai#109): (a) sink-name allowlist baked into the verifier
|
|
80
|
+
prompt, (b) library-API source detection (downgrade
|
|
81
|
+
critical → high when source is a public method parameter on an
|
|
82
|
+
infrastructure repo with no entry point), (c) verifier confidence
|
|
83
|
+
calibration audit (`0.8` rubber-stamp).
|
|
84
|
+
|
|
85
|
+
## [2.12.4] - 2026-06-19
|
|
86
|
+
|
|
87
|
+
### Dependencies
|
|
88
|
+
|
|
89
|
+
- Bump `circle-ir` `3.74.0` → `3.75.0`.
|
|
90
|
+
|
|
91
|
+
Routine upstream sync — picks up the latest static-analysis layer
|
|
92
|
+
(extra inter-procedural taint coverage, additional sink rules). No
|
|
93
|
+
circle-ir-ai source changes; full test suite (797 pass + 3 skipped)
|
|
94
|
+
+ typecheck + build clean on 3.75.0.
|
|
95
|
+
|
|
96
|
+
## [2.12.3] - 2026-06-19
|
|
97
|
+
|
|
98
|
+
### Added — structural validators for OpenAI / GCP / npm history patterns (REFACTOR-014)
|
|
99
|
+
|
|
100
|
+
REVIEW-004's 2026-06-18 audit found 1/15 history-scan patterns shipped
|
|
101
|
+
a structural validator (`jwt-token`). The 3 patterns with the highest
|
|
102
|
+
measured FP-risk (`openai-api-key`, `gcp-api-key`, `npm-token`) relied
|
|
103
|
+
on the regex alone. REFACTOR-003's fixture-path LLM gate caught test
|
|
104
|
+
paths, but production-path hits went direct.
|
|
105
|
+
|
|
106
|
+
This release adds three validators in
|
|
107
|
+
`src/secret-scan/validators.ts` (the module created in REFACTOR-015
|
|
108
|
+
specifically as the landing zone for this work):
|
|
109
|
+
|
|
110
|
+
```ts
|
|
111
|
+
validateOpenAIKey — length 51, sk- prefix, NOT sk-ant- prefix
|
|
112
|
+
validateGcpApiKey — length 39, AIza prefix
|
|
113
|
+
validateNpmToken — length 40, npm_ prefix, no doubled-underscore
|
|
114
|
+
```
|
|
115
|
+
|
|
116
|
+
Wired into the corresponding `HISTORY_SCAN_PATTERNS` entries in
|
|
117
|
+
`src/secret-scan/history-patterns.ts`:
|
|
118
|
+
|
|
119
|
+
| Pattern id | Was | Now |
|
|
120
|
+
|------------|-----|-----|
|
|
121
|
+
| `openai-api-key` | regex only | regex + `validateOpenAIKey` |
|
|
122
|
+
| `gcp-api-key` | regex only | regex + `validateGcpApiKey` |
|
|
123
|
+
| `npm-token` | regex only | regex + `validateNpmToken` |
|
|
124
|
+
|
|
125
|
+
**No production-path behavior change today.** The existing regexes
|
|
126
|
+
already enforce the lengths, prefixes, and charset constraints — the
|
|
127
|
+
validators codify the intent so future regex edits can't silently
|
|
128
|
+
widen the match set. They also cheaply defend against the
|
|
129
|
+
specifically-called-out hypothetical collisions (Anthropic
|
|
130
|
+
`sk-ant-` short form for openai; doubled-`__` variable names for
|
|
131
|
+
npm).
|
|
132
|
+
|
|
133
|
+
**Excluded patterns** (REVIEW-004 ranked their collision risk low,
|
|
134
|
+
and validators add per-finding cost): `aws-access-key-id`,
|
|
135
|
+
`github-pat`, `github-oauth`, `github-app-token`,
|
|
136
|
+
`github-user-token`, `github-refresh-token`, `stripe-secret-key`,
|
|
137
|
+
`stripe-publishable-key`, `anthropic-api-key`, `slack-token`,
|
|
138
|
+
`pem-private-key`.
|
|
139
|
+
|
|
140
|
+
Tests: new `historyPatternValidators (REFACTOR-014)` describe block
|
|
141
|
+
in `tests/secret-scan-llm-gate.test.ts` with 9 cases (3 patterns × 3
|
|
142
|
+
assertions each: positive + collision + length boundary). 52 files /
|
|
143
|
+
**797 pass** + 3 skipped (was 788). typecheck clean.
|
|
144
|
+
|
|
145
|
+
Pre-existing files in `.specifica/hardcoded-secrets/`: this closes
|
|
146
|
+
REFACTOR-014 (priority: medium) — see `tasks.md` for the audit-trail
|
|
147
|
+
entry.
|
|
148
|
+
|
|
8
149
|
## [2.12.2] - 2026-06-19
|
|
9
150
|
|
|
10
151
|
### Refactored — extract `validateJwtStructure` to shared utility (REFACTOR-015)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"history-patterns.d.ts","sourceRoot":"","sources":["../../src/secret-scan/history-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"history-patterns.d.ts","sourceRoot":"","sources":["../../src/secret-scan/history-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQnD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CACxC;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,EAiIjD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBpD"}
|
|
@@ -8,7 +8,7 @@
|
|
|
8
8
|
* This file intentionally duplicates a minimal subset of patterns to support
|
|
9
9
|
* git history scanning. The authoritative patterns live in circle-ir.
|
|
10
10
|
*/
|
|
11
|
-
import { validateJwtStructure } from './validators.js';
|
|
11
|
+
import { validateGcpApiKey, validateJwtStructure, validateNpmToken, validateOpenAIKey, } from './validators.js';
|
|
12
12
|
/**
|
|
13
13
|
* Minimal high-confidence patterns for git history scanning.
|
|
14
14
|
* These mirror circle-ir's ScanSecretsPass provider patterns.
|
|
@@ -80,6 +80,7 @@ export const HISTORY_SCAN_PATTERNS = [
|
|
|
80
80
|
pattern: /\bsk-[A-Za-z0-9]{48}\b/g,
|
|
81
81
|
severity: 'critical',
|
|
82
82
|
category: 'openai',
|
|
83
|
+
validator: validateOpenAIKey,
|
|
83
84
|
},
|
|
84
85
|
// Anthropic
|
|
85
86
|
{
|
|
@@ -104,6 +105,7 @@ export const HISTORY_SCAN_PATTERNS = [
|
|
|
104
105
|
pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g,
|
|
105
106
|
severity: 'critical',
|
|
106
107
|
category: 'gcp',
|
|
108
|
+
validator: validateGcpApiKey,
|
|
107
109
|
},
|
|
108
110
|
// JWT
|
|
109
111
|
{
|
|
@@ -129,6 +131,7 @@ export const HISTORY_SCAN_PATTERNS = [
|
|
|
129
131
|
pattern: /\bnpm_[A-Za-z0-9]{36}\b/g,
|
|
130
132
|
severity: 'critical',
|
|
131
133
|
category: 'npm',
|
|
134
|
+
validator: validateNpmToken,
|
|
132
135
|
},
|
|
133
136
|
];
|
|
134
137
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"history-patterns.js","sourceRoot":"","sources":["../../src/secret-scan/history-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,
|
|
1
|
+
{"version":3,"file":"history-patterns.js","sourceRoot":"","sources":["../../src/secret-scan/history-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAYzB;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACrD,MAAM;IACN;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,uBAAuB;QAChC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;KAChB;IAED,gBAAgB;IAChB;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;KACnB;IAED,SAAS;IACT;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,QAAQ;KACnB;IAED,SAAS;IACT;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,iBAAiB;KAC7B;IAED,YAAY;IACZ;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,WAAW;KACtB;IAED,QAAQ;IACR;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,mCAAmC;QAC5C,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,OAAO;KAClB;IAED,SAAS;IACT;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,iBAAiB;KAC7B;IAED,MAAM;IACN;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,uEAAuE;QAChF,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;KAChC;IAED,eAAe;IACf;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,8DAA8D;QACvE,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,aAAa;KACxB;IAED,MAAM;IACN;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gBAAgB;KAC5B;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACvB,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAExB,MAAM,IAAI,GAAwB,IAAI,GAAG,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC;QACtB,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
|
@@ -25,4 +25,45 @@
|
|
|
25
25
|
* base64 strings.
|
|
26
26
|
*/
|
|
27
27
|
export declare function validateJwtStructure(match: string): boolean;
|
|
28
|
+
/**
|
|
29
|
+
* Validate an OpenAI API key shape (REFACTOR-014).
|
|
30
|
+
*
|
|
31
|
+
* OpenAI keys are `sk-` + 48 alphanumeric chars = 51 total. The
|
|
32
|
+
* `history-patterns.ts` regex `\bsk-[A-Za-z0-9]{48}\b` already enforces
|
|
33
|
+
* length and charset, but the validator adds three explicit guards:
|
|
34
|
+
*
|
|
35
|
+
* 1. Exact length 51 (defense against future regex relaxation).
|
|
36
|
+
* 2. Prefix `sk-` (rules out Stripe `sk_live_...` and a malformed
|
|
37
|
+
* `sk_test_` that might slip past a future pattern split).
|
|
38
|
+
* 3. NOT `sk-ant-` (Anthropic keys also start with `sk-` but are
|
|
39
|
+
* much longer and have hyphens in the tail; if Anthropic ever
|
|
40
|
+
* issued a 51-char short form it would not be an OpenAI key).
|
|
41
|
+
*
|
|
42
|
+
* Cheap (4 string ops). Filters vendored-docs example collisions
|
|
43
|
+
* such as `sk-replaceMeWithYourRealKey...` (51 chars, alphanumeric)
|
|
44
|
+
* which match the regex but are obviously placeholders.
|
|
45
|
+
*/
|
|
46
|
+
export declare function validateOpenAIKey(match: string): boolean;
|
|
47
|
+
/**
|
|
48
|
+
* Validate a Google Cloud API key shape (REFACTOR-014).
|
|
49
|
+
*
|
|
50
|
+
* GCP API keys are `AIza` + 35 chars from `[A-Za-z0-9_-]` = 39 total.
|
|
51
|
+
* The `history-patterns.ts` regex bound `{35}` already enforces this.
|
|
52
|
+
* The validator codifies the constant so a future pattern edit
|
|
53
|
+
* (e.g. broadening to `{30,40}` by mistake) is caught by tests
|
|
54
|
+
* before shipping, and documents the canonical Google-published
|
|
55
|
+
* shape.
|
|
56
|
+
*/
|
|
57
|
+
export declare function validateGcpApiKey(match: string): boolean;
|
|
58
|
+
/**
|
|
59
|
+
* Validate an npm access token shape (REFACTOR-014).
|
|
60
|
+
*
|
|
61
|
+
* Real npm tokens are `npm_` + 36 alphanumeric chars = 40 total. The
|
|
62
|
+
* `history-patterns.ts` regex `\bnpm_[A-Za-z0-9]{36}\b` already
|
|
63
|
+
* enforces the tail charset (no `_` in tail). The validator adds an
|
|
64
|
+
* explicit doubled-underscore guard so a future pattern edit that
|
|
65
|
+
* relaxes the tail (e.g. to `[A-Za-z0-9_]`) doesn't silently start
|
|
66
|
+
* matching variable names like `npm__internal_cache_key_42_chars_xx`.
|
|
67
|
+
*/
|
|
68
|
+
export declare function validateNpmToken(match: string): boolean;
|
|
28
69
|
//# sourceMappingURL=validators.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/secret-scan/validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAW3D"}
|
|
1
|
+
{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/secret-scan/validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAW3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKxD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIxD;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQvD"}
|
|
@@ -36,4 +36,70 @@ export function validateJwtStructure(match) {
|
|
|
36
36
|
return false;
|
|
37
37
|
}
|
|
38
38
|
}
|
|
39
|
+
/**
|
|
40
|
+
* Validate an OpenAI API key shape (REFACTOR-014).
|
|
41
|
+
*
|
|
42
|
+
* OpenAI keys are `sk-` + 48 alphanumeric chars = 51 total. The
|
|
43
|
+
* `history-patterns.ts` regex `\bsk-[A-Za-z0-9]{48}\b` already enforces
|
|
44
|
+
* length and charset, but the validator adds three explicit guards:
|
|
45
|
+
*
|
|
46
|
+
* 1. Exact length 51 (defense against future regex relaxation).
|
|
47
|
+
* 2. Prefix `sk-` (rules out Stripe `sk_live_...` and a malformed
|
|
48
|
+
* `sk_test_` that might slip past a future pattern split).
|
|
49
|
+
* 3. NOT `sk-ant-` (Anthropic keys also start with `sk-` but are
|
|
50
|
+
* much longer and have hyphens in the tail; if Anthropic ever
|
|
51
|
+
* issued a 51-char short form it would not be an OpenAI key).
|
|
52
|
+
*
|
|
53
|
+
* Cheap (4 string ops). Filters vendored-docs example collisions
|
|
54
|
+
* such as `sk-replaceMeWithYourRealKey...` (51 chars, alphanumeric)
|
|
55
|
+
* which match the regex but are obviously placeholders.
|
|
56
|
+
*/
|
|
57
|
+
export function validateOpenAIKey(match) {
|
|
58
|
+
if (match.length !== 51)
|
|
59
|
+
return false;
|
|
60
|
+
if (!match.startsWith('sk-'))
|
|
61
|
+
return false;
|
|
62
|
+
if (match.startsWith('sk-ant-'))
|
|
63
|
+
return false;
|
|
64
|
+
return true;
|
|
65
|
+
}
|
|
66
|
+
/**
|
|
67
|
+
* Validate a Google Cloud API key shape (REFACTOR-014).
|
|
68
|
+
*
|
|
69
|
+
* GCP API keys are `AIza` + 35 chars from `[A-Za-z0-9_-]` = 39 total.
|
|
70
|
+
* The `history-patterns.ts` regex bound `{35}` already enforces this.
|
|
71
|
+
* The validator codifies the constant so a future pattern edit
|
|
72
|
+
* (e.g. broadening to `{30,40}` by mistake) is caught by tests
|
|
73
|
+
* before shipping, and documents the canonical Google-published
|
|
74
|
+
* shape.
|
|
75
|
+
*/
|
|
76
|
+
export function validateGcpApiKey(match) {
|
|
77
|
+
if (match.length !== 39)
|
|
78
|
+
return false;
|
|
79
|
+
if (!match.startsWith('AIza'))
|
|
80
|
+
return false;
|
|
81
|
+
return true;
|
|
82
|
+
}
|
|
83
|
+
/**
|
|
84
|
+
* Validate an npm access token shape (REFACTOR-014).
|
|
85
|
+
*
|
|
86
|
+
* Real npm tokens are `npm_` + 36 alphanumeric chars = 40 total. The
|
|
87
|
+
* `history-patterns.ts` regex `\bnpm_[A-Za-z0-9]{36}\b` already
|
|
88
|
+
* enforces the tail charset (no `_` in tail). The validator adds an
|
|
89
|
+
* explicit doubled-underscore guard so a future pattern edit that
|
|
90
|
+
* relaxes the tail (e.g. to `[A-Za-z0-9_]`) doesn't silently start
|
|
91
|
+
* matching variable names like `npm__internal_cache_key_42_chars_xx`.
|
|
92
|
+
*/
|
|
93
|
+
export function validateNpmToken(match) {
|
|
94
|
+
if (match.length !== 40)
|
|
95
|
+
return false;
|
|
96
|
+
if (!match.startsWith('npm_'))
|
|
97
|
+
return false;
|
|
98
|
+
// Reject doubled-underscore anywhere in the matched string. Real
|
|
99
|
+
// tokens have exactly one underscore (the `npm_` separator); a
|
|
100
|
+
// doubled `__` strongly suggests a variable name or constant.
|
|
101
|
+
if (match.includes('__'))
|
|
102
|
+
return false;
|
|
103
|
+
return true;
|
|
104
|
+
}
|
|
39
105
|
//# sourceMappingURL=validators.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/secret-scan/validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACrD,CAAC;QACF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/secret-scan/validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACrD,CAAC;QACF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,iEAAiE;IACjE,+DAA+D;IAC/D,8DAA8D;IAC9D,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sink-filters.d.ts","sourceRoot":"","sources":["../../src/security-scan/sink-filters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAwBH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAW1E;AA6BD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAK9E;
|
|
1
|
+
{"version":3,"file":"sink-filters.d.ts","sourceRoot":"","sources":["../../src/security-scan/sink-filters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAwBH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAW1E;AA6BD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAK9E;AAuMD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAClC,OAAO,CAUT;AAsBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACnC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAClC,OAAO,CAGT;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACnC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACnC,OAAO,CAMT"}
|
|
@@ -95,6 +95,25 @@ export function isRequireOrImportSink(code) {
|
|
|
95
95
|
return false;
|
|
96
96
|
return REQUIRE_OR_IMPORT_RE.test(trimmed);
|
|
97
97
|
}
|
|
98
|
+
/**
|
|
99
|
+
* Sink types where assertion utilities can be mistaken for the sink.
|
|
100
|
+
* Used by the #109 patterns below. Covers every taint-flow CWE the
|
|
101
|
+
* LLM verifier was observed to rubber-stamp on hutool / mybatis-plus.
|
|
102
|
+
*/
|
|
103
|
+
const ASSERTION_SINK_TYPES = [
|
|
104
|
+
'sql_injection',
|
|
105
|
+
'command_injection',
|
|
106
|
+
'code_injection',
|
|
107
|
+
'deserialization',
|
|
108
|
+
'xss',
|
|
109
|
+
'path_traversal',
|
|
110
|
+
'nosql_injection',
|
|
111
|
+
'ssrf',
|
|
112
|
+
'ldap_injection',
|
|
113
|
+
'xpath_injection',
|
|
114
|
+
'open_redirect',
|
|
115
|
+
'template_injection',
|
|
116
|
+
];
|
|
98
117
|
const NON_SINK_PATTERNS = [
|
|
99
118
|
// #52 — code_injection
|
|
100
119
|
{ pattern: /\bproxyaddr\s*\.\s*compile\b/, sinkType: 'code_injection', ref: '#52' },
|
|
@@ -148,6 +167,54 @@ const NON_SINK_PATTERNS = [
|
|
|
148
167
|
// conventional lowercase `method.invoke(...)` (j.l.r.Method instance)
|
|
149
168
|
// and the uppercase static-reference form.
|
|
150
169
|
{ pattern: /\b[Mm]ethod\s*\.\s*invoke\s*\(/, sinkType: 'code_injection', ref: '#93' },
|
|
170
|
+
// #109 — assertion utilities rubber-stamped by LLM verifier
|
|
171
|
+
// Evidence: hutool DialectRunner.java line 241
|
|
172
|
+
// `Assert.notNull(query, "[query] is null !");`
|
|
173
|
+
// flagged as critical sql_injection with llm_verified: true,
|
|
174
|
+
// llm_confidence: 0.8 by gpt-4o-mini. The LLM saw a method named
|
|
175
|
+
// `find` with a `query` arg + a nearby `SqlExecutor` call and gave a
|
|
176
|
+
// default-plausible answer without reading the actual sink line.
|
|
177
|
+
// These methods are pure guard / null-check / state-check utilities
|
|
178
|
+
// — they cannot interpret SQL, OS shell, JSON, regex, paths, or
|
|
179
|
+
// templates. Static layer drops them before the LLM verifier ever
|
|
180
|
+
// sees the candidate. (cognium-ai#109)
|
|
181
|
+
//
|
|
182
|
+
// Receivers covered:
|
|
183
|
+
// - Spring `org.springframework.util.Assert`
|
|
184
|
+
// - hutool `cn.hutool.core.lang.Assert` (same surface as Spring)
|
|
185
|
+
// - Guava `com.google.common.base.Preconditions` / `Verify`
|
|
186
|
+
// - java.util.Objects guard methods (NOT `Objects.hash` / `equals`
|
|
187
|
+
// / `toString` — those can be real sinks in template / log
|
|
188
|
+
// contexts; only the `requireNonNull`-family is suppressed)
|
|
189
|
+
// - Apache Commons `org.apache.commons.lang3.Validate`
|
|
190
|
+
//
|
|
191
|
+
// Method names are enumerated explicitly (not `\.\w+\(`) to avoid
|
|
192
|
+
// over-suppressing user classes named `Validate` / `Verify` that
|
|
193
|
+
// happen to expose unrelated APIs.
|
|
194
|
+
// Spring Assert + hutool Assert (identical method surface).
|
|
195
|
+
{
|
|
196
|
+
pattern: /\bAssert\s*\.\s*(?:notNull|isNull|isTrue|isFalse|hasText|hasLength|notEmpty|isAssignable|isInstanceOf|state|doesNotContain|noNullElements)\s*\(/,
|
|
197
|
+
sinkType: ASSERTION_SINK_TYPES,
|
|
198
|
+
ref: '#109',
|
|
199
|
+
},
|
|
200
|
+
// Guava Preconditions + Verify.
|
|
201
|
+
{
|
|
202
|
+
pattern: /\b(?:Preconditions|Verify)\s*\.\s*(?:checkArgument|checkNotNull|checkState|checkPositionIndex|checkPositionIndexes|checkElementIndex|verify|verifyNotNull)\s*\(/,
|
|
203
|
+
sinkType: ASSERTION_SINK_TYPES,
|
|
204
|
+
ref: '#109',
|
|
205
|
+
},
|
|
206
|
+
// java.util.Objects guard methods (requireNonNull family + index checks).
|
|
207
|
+
{
|
|
208
|
+
pattern: /\bObjects\s*\.\s*(?:requireNonNull|requireNonNullElse|requireNonNullElseGet|checkIndex|checkFromIndexSize|checkFromToIndex)\s*\(/,
|
|
209
|
+
sinkType: ASSERTION_SINK_TYPES,
|
|
210
|
+
ref: '#109',
|
|
211
|
+
},
|
|
212
|
+
// Apache Commons Lang Validate.
|
|
213
|
+
{
|
|
214
|
+
pattern: /\bValidate\s*\.\s*(?:notNull|isTrue|notEmpty|notBlank|inclusiveBetween|exclusiveBetween|matchesPattern|validIndex|noNullElements)\s*\(/,
|
|
215
|
+
sinkType: ASSERTION_SINK_TYPES,
|
|
216
|
+
ref: '#109',
|
|
217
|
+
},
|
|
151
218
|
];
|
|
152
219
|
export function isKnownNonSink(code, sinkType) {
|
|
153
220
|
if (!code || !sinkType)
|
|
@@ -155,7 +222,12 @@ export function isKnownNonSink(code, sinkType) {
|
|
|
155
222
|
const trimmed = code.trim();
|
|
156
223
|
if (!trimmed)
|
|
157
224
|
return false;
|
|
158
|
-
return NON_SINK_PATTERNS.some((p) =>
|
|
225
|
+
return NON_SINK_PATTERNS.some((p) => {
|
|
226
|
+
const matchesType = Array.isArray(p.sinkType)
|
|
227
|
+
? p.sinkType.includes(sinkType)
|
|
228
|
+
: p.sinkType === sinkType;
|
|
229
|
+
return matchesType && p.pattern.test(trimmed);
|
|
230
|
+
});
|
|
159
231
|
}
|
|
160
232
|
// ---------------------------------------------------------------------------
|
|
161
233
|
// Fix 4 — nosql_injection on browser-side JS/HTML (#94)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sink-filters.js","sourceRoot":"","sources":["../../src/security-scan/sink-filters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,eAAe,GAAG,2BAA2B,CAAC;AACpD,6EAA6E;AAC7E,uEAAuE;AACvE,kEAAkE;AAClE,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,MAAM,UAAU,iBAAiB,CAAC,IAA+B;IAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,yDAAyD;IACzD,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,+CAA+C;IAC/C,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,sDAAsD;IACtD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,oBAAoB,GACxB,mEAAmE,CAAC;AAEtE,MAAM,UAAU,qBAAqB,CAAC,IAA+B;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;
|
|
1
|
+
{"version":3,"file":"sink-filters.js","sourceRoot":"","sources":["../../src/security-scan/sink-filters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,eAAe,GAAG,2BAA2B,CAAC;AACpD,6EAA6E;AAC7E,uEAAuE;AACvE,kEAAkE;AAClE,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,MAAM,UAAU,iBAAiB,CAAC,IAA+B;IAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,yDAAyD;IACzD,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,+CAA+C;IAC/C,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,sDAAsD;IACtD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,oBAAoB,GACxB,mEAAmE,CAAC;AAEtE,MAAM,UAAU,qBAAqB,CAAC,IAA+B;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAkED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG;IAC3B,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,KAAK;IACL,gBAAgB;IAChB,iBAAiB;IACjB,MAAM;IACN,gBAAgB;IAChB,iBAAiB;IACjB,eAAe;IACf,oBAAoB;CACZ,CAAC;AAEX,MAAM,iBAAiB,GAAqB;IAC1C,uBAAuB;IACvB,EAAE,OAAO,EAAE,8BAA8B,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IACnF,EAAE,OAAO,EAAE,wCAAwC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAE7F,mEAAmE;IACnE,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IACzF,EAAE,OAAO,EAAE,2CAA2C,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IACnG,EAAE,OAAO,EAAE,4CAA4C,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IACpG,8DAA8D;IAC9D,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,EAAE,OAAO,EAAE,+DAA+D,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IAEvH,4DAA4D;IAC5D,+DAA+D;IAC/D,sEAAsE;IACtE,4DAA4D;IAC5D,gEAAgE;IAChE,2CAA2C;IAC3C,oEAAoE;IACpE,yDAAyD;IACzD,qDAAqD;IACrD;QACE,OAAO,EAAE,+FAA+F;QACxG,QAAQ,EAAE,eAAe;QACzB,GAAG,EAAE,KAAK;KACX;IAED,sDAAsD;IACtD,mEAAmE;IACnE,sEAAsE;IACtE,EAAE,OAAO,EAAE,qDAAqD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC3G,2EAA2E;IAC3E,uDAAuD;IACvD,EAAE,OAAO,EAAE,kDAAkD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IACxG,qCAAqC;IACrC,EAAE,OAAO,EAAE,oDAAoD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC1G,0DAA0D;IAC1D,EAAE,OAAO,EAAE,6CAA6C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IACnG,4CAA4C;IAC5C,EAAE,OAAO,EAAE,uDAAuD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IAE7G,8DAA8D;IAC9D,oEAAoE;IACpE,EAAE,OAAO,EAAE,uCAAuC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC5F,8DAA8D;IAC9D,sEAAsE;IACtE,kDAAkD;IAClD,EAAE,OAAO,EAAE,uDAAuD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC5G,8EAA8E;IAC9E,EAAE,OAAO,EAAE,qDAAqD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC1G,6DAA6D;IAC7D,sEAAsE;IACtE,2CAA2C;IAC3C,EAAE,OAAO,EAAE,gCAAgC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAErF,4DAA4D;IAC5D,+CAA+C;IAC/C,kDAAkD;IAClD,6DAA6D;IAC7D,iEAAiE;IACjE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,gEAAgE;IAChE,kEAAkE;IAClE,uCAAuC;IACvC,EAAE;IACF,qBAAqB;IACrB,+CAA+C;IAC/C,mEAAmE;IACnE,8DAA8D;IAC9D,qEAAqE;IACrE,+DAA+D;IAC/D,gEAAgE;IAChE,yDAAyD;IACzD,EAAE;IACF,kEAAkE;IAClE,iEAAiE;IACjE,mCAAmC;IAEnC,4DAA4D;IAC5D;QACE,OAAO,EACL,iJAAiJ;QACnJ,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IACD,gCAAgC;IAChC;QACE,OAAO,EACL,iKAAiK;QACnK,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IACD,0EAA0E;IAC1E;QACE,OAAO,EACL,kIAAkI;QACpI,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IACD,gCAAgC;IAChC;QACE,OAAO,EACL,wIAAwI;QAC1I,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;CACF,CAAC;AAEF,MAAM,UAAU,cAAc,CAC5B,IAA+B,EAC/B,QAAmC;IAEnC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC3C,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/B,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5B,OAAO,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAElF,SAAS,aAAa,CAAC,IAA+B;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAmC,EACnC,QAAmC;IAEnC,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAmC,EACnC,QAAmC,EACnC,QAAoC;IAEpC,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.12.
|
|
3
|
+
"version": "2.12.5",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -60,6 +60,7 @@
|
|
|
60
60
|
"benchmark:dvna": "tsx benchmarks/runners/run-dvna.ts --verbose",
|
|
61
61
|
"benchmark:top100": "tsx benchmarks/runners/run-top100-secure.ts",
|
|
62
62
|
"benchmark:top100:setup": "tsx benchmarks/runners/run-top100-secure.ts --setup",
|
|
63
|
+
"benchmark:secrets": "tsx benchmarks/runners/run-secrets.ts",
|
|
63
64
|
"setup:skills-benchmark": "tsx benchmarks/skills/setup-skills-benchmark.ts",
|
|
64
65
|
"benchmark:skills": "tsx benchmarks/skills/run-skills-benchmark.ts",
|
|
65
66
|
"benchmark:instruction-safety": "tsx benchmarks/instruction-safety/run-benchmark.ts"
|
|
@@ -94,7 +95,7 @@
|
|
|
94
95
|
"dependencies": {
|
|
95
96
|
"@ax-llm/ax": "^20.0.0",
|
|
96
97
|
"@mastra/core": "^1.18.0",
|
|
97
|
-
"circle-ir": "3.
|
|
98
|
+
"circle-ir": "3.82.0",
|
|
98
99
|
"minimatch": "^10.2.5",
|
|
99
100
|
"p-queue": "^9.1.0"
|
|
100
101
|
},
|