circle-ir-ai 2.80.0 → 2.82.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +77 -0
- package/dist/security-scan/source-classifier.d.ts +32 -0
- package/dist/security-scan/source-classifier.d.ts.map +1 -1
- package/dist/security-scan/source-classifier.js +55 -15
- package/dist/security-scan/source-classifier.js.map +1 -1
- package/dist/trust/passes/input-validation.d.ts +1 -1
- package/dist/trust/passes/input-validation.d.ts.map +1 -1
- package/dist/trust/passes/input-validation.js +37 -0
- package/dist/trust/passes/input-validation.js.map +1 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,83 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.82.0] - 2026-08-02
|
|
9
|
+
|
|
10
|
+
### Fixed — trust pass rated 19 of 29 sink types as a flat `medium` (#204 adjacent)
|
|
11
|
+
|
|
12
|
+
`sinkSeverity` in `trust/passes/input-validation.ts` classified sinks from two
|
|
13
|
+
hardcoded sets and returned `'medium'` for anything else. Those sets cover **10
|
|
14
|
+
of circle-ir 3.198.0's 29 sink types**; the other 19 were all reported medium
|
|
15
|
+
regardless of what they are — wrong in both directions:
|
|
16
|
+
|
|
17
|
+
| sink type | registry | was reported |
|
|
18
|
+
|---|---|---|
|
|
19
|
+
| `nosql_injection` | **critical** | medium |
|
|
20
|
+
| `prompt_injection`, `mass_assignment`, `format_string`, `redos`, `prototype_pollution`, `regex_dos`, `unsafe_memory` | high | medium |
|
|
21
|
+
| `log_injection`, `insecure_cookie` | low | medium |
|
|
22
|
+
|
|
23
|
+
The registry is now consulted before falling back to `'medium'`, which fixes all
|
|
24
|
+
19 at once and needs no list maintenance as circle-ir adds types.
|
|
25
|
+
|
|
26
|
+
**Precedence is deliberate: the local sets win, the registry fills gaps.** The
|
|
27
|
+
first attempt derived severity wholesale from the registry and
|
|
28
|
+
`trust-passes.test.ts` failed it — circle-ir rates `xss` as `medium`, while this
|
|
29
|
+
pass rates an unsanitized *flow* into xss as `high`. Those answer different
|
|
30
|
+
questions: the registry gives a baseline for the rule *type*, this pass scores a
|
|
31
|
+
**proven unsanitized flow**, which is strictly worse. Deriving wholesale would
|
|
32
|
+
have silently erased a judgement the pass owns, and quietly demoted every XSS
|
|
33
|
+
flow finding. The existing test caught it; the ordering was inverted rather than
|
|
34
|
+
the test changed.
|
|
35
|
+
|
|
36
|
+
CWE-20 — the registry's "unknown type" placeholder — is never anchored on. LLM
|
|
37
|
+
discovery emits free-form sink types, and treating the placeholder as a
|
|
38
|
+
classification would read as medium-by-fiat, which is the bug this fixes.
|
|
39
|
+
|
|
40
|
+
Also verified against 3.198.0, since 2.79.1's do-not-remove comment asserts it
|
|
41
|
+
as current fact: `user_input` **is** still emitted, by the JavaScript plugin
|
|
42
|
+
only; `env_var` by the go, python, rust and javascript plugins. The comment
|
|
43
|
+
stands.
|
|
44
|
+
|
|
45
|
+
5 tests. Suite 1650 pass + 3 skipped.
|
|
46
|
+
|
|
47
|
+
## [2.81.0] - 2026-08-02
|
|
48
|
+
|
|
49
|
+
### Added — exhaustive source-type classification (circle-ir 3.198.0)
|
|
50
|
+
|
|
51
|
+
3.198.0 exports `SOURCE_TYPES` (25) and `SINK_TYPES` (29) as runtime arrays.
|
|
52
|
+
That closes the follow-up promised upstream: our classification sets are no
|
|
53
|
+
longer hand-copied, and an unhandled source type is now a **test failure**
|
|
54
|
+
instead of a silent severity demotion.
|
|
55
|
+
|
|
56
|
+
Diffing the real list against what we matched found two more gaps of the same
|
|
57
|
+
kind fixed in 2.79.1:
|
|
58
|
+
|
|
59
|
+
- **`http_query` — the HTTP query string — was classified nowhere.** Every
|
|
60
|
+
query-string source was falling through to `UNKNOWN` and being capped at low
|
|
61
|
+
outside `SINK_SHAPE_SUFFICIENT_CWES`. It is now a trust boundary.
|
|
62
|
+
- **`dom_input`** likewise, another DOM-XSS source.
|
|
63
|
+
|
|
64
|
+
And four values we match are **not declared upstream at all**:
|
|
65
|
+
`external_input`, `http_request`, `request_param`, `request_body`. Retained
|
|
66
|
+
deliberately — LLM discovery emits free-form type strings and has been observed
|
|
67
|
+
using them, so removing them would drop LLM-discovered sources to the UNKNOWN
|
|
68
|
+
cap. Now commented as such rather than looking like live union members.
|
|
69
|
+
|
|
70
|
+
New `NON_TRUST_BOUNDARY_SOURCE_TYPES` records the types considered and
|
|
71
|
+
*rejected*, with a rationale per group: environment (operator-controlled),
|
|
72
|
+
second-order (`db_input`, `file_input`, `network_input`, `http_response`,
|
|
73
|
+
`storage_input` — attacker-controlled only if something else wrote them),
|
|
74
|
+
`cli_arg` (operator-controlled under library/tool profiles), and internal
|
|
75
|
+
plumbing (`config_param`, `interprocedural_param`, `plugin_param`,
|
|
76
|
+
`constructor_field`).
|
|
77
|
+
|
|
78
|
+
`tests/source-type-exhaustive.test.ts` asserts the two sets together cover
|
|
79
|
+
`SOURCE_TYPES` exactly, with no overlap. When circle-ir adds a source type, that
|
|
80
|
+
test fails and forces a deliberate decision — the third instance of this failure
|
|
81
|
+
becomes loud instead of silent.
|
|
82
|
+
|
|
83
|
+
Suite 1646 pass + 3 skipped.
|
|
84
|
+
|
|
8
85
|
## [2.80.0] - 2026-08-01
|
|
9
86
|
|
|
10
87
|
### Changed — bump circle-ir 3.195.0 → 3.197.0
|
|
@@ -80,6 +80,38 @@ export interface SourceShape {
|
|
|
80
80
|
variable?: string | null;
|
|
81
81
|
code?: string | null;
|
|
82
82
|
}
|
|
83
|
+
/**
|
|
84
|
+
* Source `type` field semantic categories that map directly to a trust
|
|
85
|
+
* boundary regardless of surrounding AST context. circle-ir's taint
|
|
86
|
+
* sources are pre-categorized by the engine; when the type is already
|
|
87
|
+
* one of these, classification is unambiguous.
|
|
88
|
+
*/
|
|
89
|
+
export declare const TRUST_BOUNDARY_SOURCE_TYPES: Set<string>;
|
|
90
|
+
/**
|
|
91
|
+
* Source types deliberately NOT treated as a trust boundary.
|
|
92
|
+
*
|
|
93
|
+
* This exists so the two sets together cover circle-ir's entire exported
|
|
94
|
+
* `SOURCE_TYPES` array — `tests/source-type-exhaustive.test.ts` asserts it.
|
|
95
|
+
* A source type added upstream then fails a test here instead of silently
|
|
96
|
+
* falling through to `UNKNOWN`, which `applyClassificationGate` caps at low
|
|
97
|
+
* for any CWE outside `SINK_SHAPE_SUFFICIENT_CWES`.
|
|
98
|
+
*
|
|
99
|
+
* That silent fall-through is the exact failure this package absorbed twice:
|
|
100
|
+
* once when 3.195.0 renamed `user_input` → `io_input` (Python findings demoted
|
|
101
|
+
* critical→low), and again when seven declared browser source types turned out
|
|
102
|
+
* to be matched nowhere at all.
|
|
103
|
+
*
|
|
104
|
+
* Rationale per entry:
|
|
105
|
+
* - `env_input` / `env_var` — environment is operator-controlled, not
|
|
106
|
+
* attacker-controlled at a boundary.
|
|
107
|
+
* - `db_input` / `file_input` / `network_input` / `http_response` /
|
|
108
|
+
* `storage_input` — second-order: attacker-controlled only if something
|
|
109
|
+
* else wrote them first, which is a different flow to prove.
|
|
110
|
+
* - `cli_arg` — operator-controlled under our library and tool profiles.
|
|
111
|
+
* - `config_param` / `interprocedural_param` / `plugin_param` /
|
|
112
|
+
* `constructor_field` — internal plumbing, no boundary crossed.
|
|
113
|
+
*/
|
|
114
|
+
export declare const NON_TRUST_BOUNDARY_SOURCE_TYPES: Set<string>;
|
|
83
115
|
interface EnclosingScope {
|
|
84
116
|
type?: TypeShape;
|
|
85
117
|
method?: MethodShape;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"source-classifier.d.ts","sourceRoot":"","sources":["../../src/security-scan/source-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,QAAQ,GACR,oBAAoB,GACpB,aAAa,GACb,SAAS,CAAC;AAEd;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;
|
|
1
|
+
{"version":3,"file":"source-classifier.d.ts","sourceRoot":"","sources":["../../src/security-scan/source-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,QAAQ,GACR,oBAAoB,GACpB,aAAa,GACb,SAAS,CAAC;AAEd;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAMD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,aAgCtC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,+BAA+B,aAa1C,CAAC;AA0GH,UAAU,cAAc;IACtB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,IAAI,EAClD,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAC9B,cAAc,CA0BhB;AA6BD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,EACtC,KAAK,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,GAAG,IAAI,GACtC,oBAAoB,CAqEtB;AAkCD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,oBAAoB,EACpC,gBAAgB,EAAE,MAAM,EACxB,GAAG,CAAC,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAgBf"}
|
|
@@ -54,37 +54,77 @@
|
|
|
54
54
|
* sources are pre-categorized by the engine; when the type is already
|
|
55
55
|
* one of these, classification is unambiguous.
|
|
56
56
|
*/
|
|
57
|
-
const TRUST_BOUNDARY_SOURCE_TYPES = new Set([
|
|
57
|
+
export const TRUST_BOUNDARY_SOURCE_TYPES = new Set([
|
|
58
58
|
'http_param',
|
|
59
59
|
'http_body',
|
|
60
60
|
'http_header',
|
|
61
61
|
'http_cookie',
|
|
62
62
|
'http_path',
|
|
63
|
-
//
|
|
64
|
-
//
|
|
65
|
-
//
|
|
66
|
-
|
|
67
|
-
//
|
|
63
|
+
// HTTP query string. Declared upstream since forever and matched here for
|
|
64
|
+
// the first time in 2.81.0 — until then every query-string source fell
|
|
65
|
+
// through to UNKNOWN and was capped at low outside a small CWE allowlist.
|
|
66
|
+
'http_query',
|
|
67
|
+
// DO NOT REMOVE `user_input` AS LEGACY. The JavaScript plugin emits it
|
|
68
|
+
// TODAY. circle-ir 3.195.0 removed only the *Python* duplicates, and it is a
|
|
69
|
+
// `@deprecated` union member whose removal is gated on a release carrying a
|
|
70
|
+
// Consumer Impact section.
|
|
68
71
|
'user_input',
|
|
69
|
-
// circle-ir 3.195.0+ — what Python `input()` emits now.
|
|
70
|
-
// source falls through to UNKNOWN, and `applyClassificationGate` caps
|
|
71
|
-
// UNKNOWN at LOW for every CWE outside SINK_SHAPE_SUFFICIENT_CWES, silently
|
|
72
|
-
// demoting critical/high path-traversal (CWE-22), XSS (CWE-79) and SSRF
|
|
73
|
-
// (CWE-918) findings.
|
|
72
|
+
// circle-ir 3.195.0+ — what Python `input()` emits now.
|
|
74
73
|
'io_input',
|
|
75
|
-
// Browser/DOM trust boundaries
|
|
76
|
-
//
|
|
77
|
-
// cap-at-low. These are textbook DOM-XSS sources: a `location.search`
|
|
78
|
-
// value reaching `innerHTML` is not a low-severity finding.
|
|
74
|
+
// Browser/DOM trust boundaries. Textbook DOM-XSS sources: a
|
|
75
|
+
// `location.search` value reaching `innerHTML` is not a low finding.
|
|
79
76
|
'url_param',
|
|
80
77
|
'navigation_param',
|
|
81
78
|
'message_input',
|
|
82
79
|
'file_upload',
|
|
80
|
+
'dom_input',
|
|
81
|
+
// Not members of circle-ir's `SourceType` union — retained because LLM
|
|
82
|
+
// discovery emits free-form type strings and has been observed using these.
|
|
83
|
+
// Harmless if unmatched; removing them would silently drop LLM-discovered
|
|
84
|
+
// sources to the UNKNOWN cap.
|
|
83
85
|
'external_input',
|
|
84
86
|
'http_request',
|
|
85
87
|
'request_param',
|
|
86
88
|
'request_body',
|
|
87
89
|
]);
|
|
90
|
+
/**
|
|
91
|
+
* Source types deliberately NOT treated as a trust boundary.
|
|
92
|
+
*
|
|
93
|
+
* This exists so the two sets together cover circle-ir's entire exported
|
|
94
|
+
* `SOURCE_TYPES` array — `tests/source-type-exhaustive.test.ts` asserts it.
|
|
95
|
+
* A source type added upstream then fails a test here instead of silently
|
|
96
|
+
* falling through to `UNKNOWN`, which `applyClassificationGate` caps at low
|
|
97
|
+
* for any CWE outside `SINK_SHAPE_SUFFICIENT_CWES`.
|
|
98
|
+
*
|
|
99
|
+
* That silent fall-through is the exact failure this package absorbed twice:
|
|
100
|
+
* once when 3.195.0 renamed `user_input` → `io_input` (Python findings demoted
|
|
101
|
+
* critical→low), and again when seven declared browser source types turned out
|
|
102
|
+
* to be matched nowhere at all.
|
|
103
|
+
*
|
|
104
|
+
* Rationale per entry:
|
|
105
|
+
* - `env_input` / `env_var` — environment is operator-controlled, not
|
|
106
|
+
* attacker-controlled at a boundary.
|
|
107
|
+
* - `db_input` / `file_input` / `network_input` / `http_response` /
|
|
108
|
+
* `storage_input` — second-order: attacker-controlled only if something
|
|
109
|
+
* else wrote them first, which is a different flow to prove.
|
|
110
|
+
* - `cli_arg` — operator-controlled under our library and tool profiles.
|
|
111
|
+
* - `config_param` / `interprocedural_param` / `plugin_param` /
|
|
112
|
+
* `constructor_field` — internal plumbing, no boundary crossed.
|
|
113
|
+
*/
|
|
114
|
+
export const NON_TRUST_BOUNDARY_SOURCE_TYPES = new Set([
|
|
115
|
+
'env_input',
|
|
116
|
+
'env_var',
|
|
117
|
+
'db_input',
|
|
118
|
+
'file_input',
|
|
119
|
+
'network_input',
|
|
120
|
+
'http_response',
|
|
121
|
+
'storage_input',
|
|
122
|
+
'cli_arg',
|
|
123
|
+
'config_param',
|
|
124
|
+
'interprocedural_param',
|
|
125
|
+
'plugin_param',
|
|
126
|
+
'constructor_field',
|
|
127
|
+
]);
|
|
88
128
|
/**
|
|
89
129
|
* Annotations on the enclosing method's parameters that mark a
|
|
90
130
|
* trust-boundary source — even when the source-line code itself
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"source-classifier.js","sourceRoot":"","sources":["../../src/security-scan/source-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AA+CH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;
|
|
1
|
+
{"version":3,"file":"source-classifier.js","sourceRoot":"","sources":["../../src/security-scan/source-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AA+CH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IACjD,YAAY;IACZ,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,YAAY;IACZ,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,2BAA2B;IAC3B,YAAY;IACZ,wDAAwD;IACxD,UAAU;IACV,4DAA4D;IAC5D,qEAAqE;IACrE,WAAW;IACX,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,WAAW;IACX,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,8BAA8B;IAC9B,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IACrD,WAAW;IACX,SAAS;IACT,UAAU;IACV,YAAY;IACZ,eAAe;IACf,eAAe;IACf,eAAe;IACf,SAAS;IACT,cAAc;IACd,uBAAuB;IACvB,cAAc;IACd,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG;IACjC,uBAAuB;IACvB,cAAc;IACd,aAAa;IACb,eAAe;IACf,cAAc;IACd,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,SAAS;IACT,YAAY;IACZ,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAC;AAEF;;;;;GAKG;AACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,YAAY;IACZ,gBAAgB;IAChB,MAAM,EAAE,SAAS;IACjB,YAAY;CACb,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,eAAe;IACf,aAAa;IACb,UAAU;IACV,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,kBAAkB;IAClB,yBAAyB;IACzB,kBAAkB;IAClB,yBAAyB;IACzB,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,uBAAuB;IACvB,QAAQ;IACR,aAAa;IACb,4BAA4B;IAC5B,oBAAoB;IACpB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,KAAK;IACL,OAAO;IACP,aAAa;IACb,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAa;IAChC,kCAAkC;IAClC,6BAA6B;IAC7B,+CAA+C;IAC/C,aAAa;IACb,6BAA6B;IAC7B,yBAAyB;IACzB,wCAAwC;IACxC,0DAA0D;IAC1D,+BAA+B;IAC/B,gEAAgE;CACjE,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAkD,EAClD,IAA+B;IAE/B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACzD,IAAI,QAA+B,CAAC;IACpC,IAAI,UAAmC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ;YAAE,SAAS;QACvD,6CAA6C;QAC7C,IACE,CAAC,QAAQ;YACT,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,EACvE,CAAC;YACD,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,OAAO,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ;gBAAE,SAAS;YACvD,IACE,CAAC,UAAU;gBACX,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,EAC3E,CAAC;gBACD,UAAU,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,WAA8C,EAC9C,OAAyB;IAEzB,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,GAAG,GAAG,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,4DAA4D;QAC5D,MAAM,MAAM,GAAG,GAAG;aACf,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;aACjB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;aACtB,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAsC,EACtC,KAAuC;IAEvC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,wEAAwE;IACxE,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClD,IAAI,2BAA2B,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAEzE,wEAAwE;IACxE,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC;IACjC,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC;IAErC,qEAAqE;IACrE,kCAAkC;IAClC,IACE,aAAa;QACb,kBAAkB,CAAC,aAAa,CAAC,WAAW,EAAE,4BAA4B,CAAC,EAC3E,CAAC;QACD,8DAA8D;QAC9D,oEAAoE;QACpE,4DAA4D;QAC5D,IAAI,eAAe,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,KAAK;gBAAE,OAAO,gBAAgB,CAAC;QACrC,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,eAAe,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClF,IAAI,KAAK,IAAI,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,0BAA0B,CAAC,EAAE,CAAC;YAC/E,OAAO,gBAAgB,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,kEAAkE;IAClE,qDAAqD;IACrD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,oBAAoB,CAAC;QACxE,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,IAAI,MAAM,CAAC,QAAQ,IAAI,4BAA4B,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,sEAAsE;IACtE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5C,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,QAAQ,CAAC;QACrC,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,uCAAuC;IACvC,IAAI,eAAe,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClF,IAAI,KAAK;YAAE,OAAO,aAAa,CAAC;IAClC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS;IACjD,QAAQ,EAAI,uBAAuB;IACnC,QAAQ,EAAI,gBAAgB;IAC5B,QAAQ,EAAI,iBAAiB;IAC7B,SAAS,EAAG,2BAA2B;IACvC,SAAS,EAAG,oCAAoC;IAChD,SAAS,EAAG,4BAA4B;IACxC,SAAS,EAAG,wCAAwC;IACpD,SAAS,EAAG,wBAAwB;CACrC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,uBAAuB,CACrC,cAAoC,EACpC,gBAAwB,EACxB,GAAY;IAEZ,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,oBAAoB;YACvB,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC,gBAAgB,CAAC,CAAC;QACvC,KAAK,SAAS;YACZ,IAAI,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YACD,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACpC,KAAK,gBAAgB,CAAC;QACtB;YACE,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
|
@@ -9,7 +9,7 @@
|
|
|
9
9
|
*
|
|
10
10
|
* Falls back gracefully (score 100 + info) when no CircleIR data is available.
|
|
11
11
|
*/
|
|
12
|
-
import type
|
|
12
|
+
import { type CircleIR } from 'circle-ir';
|
|
13
13
|
import { type TrustPassResult } from '../types.js';
|
|
14
14
|
/** Source types that represent user/external input needing validation */
|
|
15
15
|
declare const INPUT_SOURCES: Set<string>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,
|
|
1
|
+
{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAC;AAOrB,yEAAyE;AACzE,QAAA,MAAM,aAAa,EAAE,GAAG,CAAC,MAAM,CA0B7B,CAAC;AAEH,8DAA8D;AAC9D,QAAA,MAAM,cAAc,EAAE,GAAG,CAAC,MAAM,CAE9B,CAAC;AACH,QAAA,MAAM,UAAU,EAAE,GAAG,CAAC,MAAM,CAE1B,CAAC;AAMH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAoDD,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CA4G1B;AAGD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}
|
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
*
|
|
10
10
|
* Falls back gracefully (score 100 + info) when no CircleIR data is available.
|
|
11
11
|
*/
|
|
12
|
+
import { getRuleInfo } from 'circle-ir';
|
|
12
13
|
import { isBrowserQueryApi } from '../../security-scan/sink-filters.js';
|
|
13
14
|
// ---------------------------------------------------------------------------
|
|
14
15
|
// Constants
|
|
@@ -51,11 +52,47 @@ const HIGH_SINKS = new Set([
|
|
|
51
52
|
// ---------------------------------------------------------------------------
|
|
52
53
|
// Helpers
|
|
53
54
|
// ---------------------------------------------------------------------------
|
|
55
|
+
/** Registry severities we accept verbatim. */
|
|
56
|
+
const TRUST_SEVERITIES = new Set(['critical', 'high', 'medium', 'low']);
|
|
57
|
+
/**
|
|
58
|
+
* Severity for an unsanitized flow into `sinkType`.
|
|
59
|
+
*
|
|
60
|
+
* Precedence is deliberate: **the local sets win, the registry fills gaps.**
|
|
61
|
+
*
|
|
62
|
+
* The two are answering different questions. circle-ir's `severityLevel` is a
|
|
63
|
+
* baseline for the rule *type*; this pass is scoring a **proven unsanitized
|
|
64
|
+
* flow** into that sink, which is strictly worse than the baseline. `xss` is
|
|
65
|
+
* the clearest case — `medium` in the registry, but an unsanitized flow
|
|
66
|
+
* reaching it is `high` here, and that is a judgement this pass owns.
|
|
67
|
+
* Deriving severity wholesale from the registry would silently erase it
|
|
68
|
+
* (caught by `trust-passes.test.ts` when it was tried).
|
|
69
|
+
*
|
|
70
|
+
* What the registry *does* fix is the gap: the two sets classify 10 of
|
|
71
|
+
* circle-ir 3.198.0's 29 sink types, and the other 19 previously fell to a flat
|
|
72
|
+
* `'medium'` — wrong in both directions. `nosql_injection` is `critical`
|
|
73
|
+
* upstream and was reported medium; `log_injection` and `insecure_cookie` are
|
|
74
|
+
* `low` and were also reported medium. Consulting the registry before giving up
|
|
75
|
+
* fixes all 19 without touching the 10 the sets speak for.
|
|
76
|
+
*
|
|
77
|
+
* CWE-20 is the registry's "unknown type" placeholder and is never anchored on
|
|
78
|
+
* — LLM discovery emits free-form sink types, and treating the placeholder as a
|
|
79
|
+
* classification would read as medium-by-fiat.
|
|
80
|
+
*/
|
|
54
81
|
function sinkSeverity(sinkType) {
|
|
55
82
|
if (CRITICAL_SINKS.has(sinkType))
|
|
56
83
|
return 'critical';
|
|
57
84
|
if (HIGH_SINKS.has(sinkType))
|
|
58
85
|
return 'high';
|
|
86
|
+
try {
|
|
87
|
+
const info = getRuleInfo(sinkType);
|
|
88
|
+
if (info && info.cwe !== 'CWE-20' && info.severityLevel
|
|
89
|
+
&& TRUST_SEVERITIES.has(info.severityLevel)) {
|
|
90
|
+
return info.severityLevel;
|
|
91
|
+
}
|
|
92
|
+
}
|
|
93
|
+
catch {
|
|
94
|
+
/* registry unavailable — fall through */
|
|
95
|
+
}
|
|
59
96
|
return 'medium';
|
|
60
97
|
}
|
|
61
98
|
// ---------------------------------------------------------------------------
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;
|
|
1
|
+
{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAMvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,yEAAyE;AACzE,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC;IACzC,YAAY;IACZ,cAAc;IACd,aAAa;IACb,aAAa;IACb,WAAW;IACX,uEAAuE;IACvE,wCAAwC;IACxC,YAAY;IACZ,yCAAyC;IACzC,UAAU;IACV,aAAa;IACb,YAAY;IACZ,WAAW;IACX,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,SAAS;IACT,YAAY;IACZ,+DAA+D;IAC/D,WAAW;IACX,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,SAAS;IACT,eAAe;CAChB,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,cAAc,GAAgB,IAAI,GAAG,CAAC;IAC1C,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB;CAC1E,CAAC,CAAC;AACH,MAAM,UAAU,GAAgB,IAAI,GAAG,CAAC;IACtC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB;CAC5E,CAAC,CAAC;AAWH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,8CAA8C;AAC9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa;eAChD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,aAA8B,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,MAAM,WAAW,GACf,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,0EAA0E;oBACnF,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBACrC,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,eAAgB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;QAExC,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEnD,oEAAoE;YACpE,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClE,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAEhE,UAAU,EAAE,CAAC;YAEb,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,cAAc,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,eAAe,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,SAAS,EAAE;oBAC9D,QAAQ;oBACR,OAAO,EAAE,eAAe,IAAI,CAAC,WAAW,YAAY,IAAI,CAAC,SAAS,OAAO,IAAI,UAAU,IAAI,CAAC,WAAW,WAAW,IAAI,CAAC,SAAS,GAAG;oBACnI,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC1C,IAAI,EAAE;wBACJ,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;wBACxB,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;qBACzB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,gBAAgB;oBACxB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,kDAAkD;oBAC3D,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;iBACxB,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IAE9D,uBAAuB;IACvB,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,8BAA8B,cAAc,IAAI,UAAU,qBAAqB,KAAK,IAAI;QACjG,IAAI,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,GAAG,UAAU,EAAE;KACjF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.82.0",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -98,7 +98,7 @@
|
|
|
98
98
|
"@ax-llm/ax": "^20.0.0",
|
|
99
99
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
100
100
|
"@mastra/core": "^1.18.0",
|
|
101
|
-
"circle-ir": "3.
|
|
101
|
+
"circle-ir": "3.198.0",
|
|
102
102
|
"minimatch": "^10.2.5",
|
|
103
103
|
"p-queue": "^9.1.0"
|
|
104
104
|
},
|