circle-ir-ai 2.81.0 → 2.82.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,45 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.82.0] - 2026-08-02
|
|
9
|
+
|
|
10
|
+
### Fixed — trust pass rated 19 of 29 sink types as a flat `medium` (#204 adjacent)
|
|
11
|
+
|
|
12
|
+
`sinkSeverity` in `trust/passes/input-validation.ts` classified sinks from two
|
|
13
|
+
hardcoded sets and returned `'medium'` for anything else. Those sets cover **10
|
|
14
|
+
of circle-ir 3.198.0's 29 sink types**; the other 19 were all reported medium
|
|
15
|
+
regardless of what they are — wrong in both directions:
|
|
16
|
+
|
|
17
|
+
| sink type | registry | was reported |
|
|
18
|
+
|---|---|---|
|
|
19
|
+
| `nosql_injection` | **critical** | medium |
|
|
20
|
+
| `prompt_injection`, `mass_assignment`, `format_string`, `redos`, `prototype_pollution`, `regex_dos`, `unsafe_memory` | high | medium |
|
|
21
|
+
| `log_injection`, `insecure_cookie` | low | medium |
|
|
22
|
+
|
|
23
|
+
The registry is now consulted before falling back to `'medium'`, which fixes all
|
|
24
|
+
19 at once and needs no list maintenance as circle-ir adds types.
|
|
25
|
+
|
|
26
|
+
**Precedence is deliberate: the local sets win, the registry fills gaps.** The
|
|
27
|
+
first attempt derived severity wholesale from the registry and
|
|
28
|
+
`trust-passes.test.ts` failed it — circle-ir rates `xss` as `medium`, while this
|
|
29
|
+
pass rates an unsanitized *flow* into xss as `high`. Those answer different
|
|
30
|
+
questions: the registry gives a baseline for the rule *type*, this pass scores a
|
|
31
|
+
**proven unsanitized flow**, which is strictly worse. Deriving wholesale would
|
|
32
|
+
have silently erased a judgement the pass owns, and quietly demoted every XSS
|
|
33
|
+
flow finding. The existing test caught it; the ordering was inverted rather than
|
|
34
|
+
the test changed.
|
|
35
|
+
|
|
36
|
+
CWE-20 — the registry's "unknown type" placeholder — is never anchored on. LLM
|
|
37
|
+
discovery emits free-form sink types, and treating the placeholder as a
|
|
38
|
+
classification would read as medium-by-fiat, which is the bug this fixes.
|
|
39
|
+
|
|
40
|
+
Also verified against 3.198.0, since 2.79.1's do-not-remove comment asserts it
|
|
41
|
+
as current fact: `user_input` **is** still emitted, by the JavaScript plugin
|
|
42
|
+
only; `env_var` by the go, python, rust and javascript plugins. The comment
|
|
43
|
+
stands.
|
|
44
|
+
|
|
45
|
+
5 tests. Suite 1650 pass + 3 skipped.
|
|
46
|
+
|
|
8
47
|
## [2.81.0] - 2026-08-02
|
|
9
48
|
|
|
10
49
|
### Added — exhaustive source-type classification (circle-ir 3.198.0)
|
|
@@ -9,7 +9,7 @@
|
|
|
9
9
|
*
|
|
10
10
|
* Falls back gracefully (score 100 + info) when no CircleIR data is available.
|
|
11
11
|
*/
|
|
12
|
-
import type
|
|
12
|
+
import { type CircleIR } from 'circle-ir';
|
|
13
13
|
import { type TrustPassResult } from '../types.js';
|
|
14
14
|
/** Source types that represent user/external input needing validation */
|
|
15
15
|
declare const INPUT_SOURCES: Set<string>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,
|
|
1
|
+
{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAC;AAOrB,yEAAyE;AACzE,QAAA,MAAM,aAAa,EAAE,GAAG,CAAC,MAAM,CA0B7B,CAAC;AAEH,8DAA8D;AAC9D,QAAA,MAAM,cAAc,EAAE,GAAG,CAAC,MAAM,CAE9B,CAAC;AACH,QAAA,MAAM,UAAU,EAAE,GAAG,CAAC,MAAM,CAE1B,CAAC;AAMH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAoDD,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CA4G1B;AAGD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}
|
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
*
|
|
10
10
|
* Falls back gracefully (score 100 + info) when no CircleIR data is available.
|
|
11
11
|
*/
|
|
12
|
+
import { getRuleInfo } from 'circle-ir';
|
|
12
13
|
import { isBrowserQueryApi } from '../../security-scan/sink-filters.js';
|
|
13
14
|
// ---------------------------------------------------------------------------
|
|
14
15
|
// Constants
|
|
@@ -51,11 +52,47 @@ const HIGH_SINKS = new Set([
|
|
|
51
52
|
// ---------------------------------------------------------------------------
|
|
52
53
|
// Helpers
|
|
53
54
|
// ---------------------------------------------------------------------------
|
|
55
|
+
/** Registry severities we accept verbatim. */
|
|
56
|
+
const TRUST_SEVERITIES = new Set(['critical', 'high', 'medium', 'low']);
|
|
57
|
+
/**
|
|
58
|
+
* Severity for an unsanitized flow into `sinkType`.
|
|
59
|
+
*
|
|
60
|
+
* Precedence is deliberate: **the local sets win, the registry fills gaps.**
|
|
61
|
+
*
|
|
62
|
+
* The two are answering different questions. circle-ir's `severityLevel` is a
|
|
63
|
+
* baseline for the rule *type*; this pass is scoring a **proven unsanitized
|
|
64
|
+
* flow** into that sink, which is strictly worse than the baseline. `xss` is
|
|
65
|
+
* the clearest case — `medium` in the registry, but an unsanitized flow
|
|
66
|
+
* reaching it is `high` here, and that is a judgement this pass owns.
|
|
67
|
+
* Deriving severity wholesale from the registry would silently erase it
|
|
68
|
+
* (caught by `trust-passes.test.ts` when it was tried).
|
|
69
|
+
*
|
|
70
|
+
* What the registry *does* fix is the gap: the two sets classify 10 of
|
|
71
|
+
* circle-ir 3.198.0's 29 sink types, and the other 19 previously fell to a flat
|
|
72
|
+
* `'medium'` — wrong in both directions. `nosql_injection` is `critical`
|
|
73
|
+
* upstream and was reported medium; `log_injection` and `insecure_cookie` are
|
|
74
|
+
* `low` and were also reported medium. Consulting the registry before giving up
|
|
75
|
+
* fixes all 19 without touching the 10 the sets speak for.
|
|
76
|
+
*
|
|
77
|
+
* CWE-20 is the registry's "unknown type" placeholder and is never anchored on
|
|
78
|
+
* — LLM discovery emits free-form sink types, and treating the placeholder as a
|
|
79
|
+
* classification would read as medium-by-fiat.
|
|
80
|
+
*/
|
|
54
81
|
function sinkSeverity(sinkType) {
|
|
55
82
|
if (CRITICAL_SINKS.has(sinkType))
|
|
56
83
|
return 'critical';
|
|
57
84
|
if (HIGH_SINKS.has(sinkType))
|
|
58
85
|
return 'high';
|
|
86
|
+
try {
|
|
87
|
+
const info = getRuleInfo(sinkType);
|
|
88
|
+
if (info && info.cwe !== 'CWE-20' && info.severityLevel
|
|
89
|
+
&& TRUST_SEVERITIES.has(info.severityLevel)) {
|
|
90
|
+
return info.severityLevel;
|
|
91
|
+
}
|
|
92
|
+
}
|
|
93
|
+
catch {
|
|
94
|
+
/* registry unavailable — fall through */
|
|
95
|
+
}
|
|
59
96
|
return 'medium';
|
|
60
97
|
}
|
|
61
98
|
// ---------------------------------------------------------------------------
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;
|
|
1
|
+
{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAMvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,yEAAyE;AACzE,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC;IACzC,YAAY;IACZ,cAAc;IACd,aAAa;IACb,aAAa;IACb,WAAW;IACX,uEAAuE;IACvE,wCAAwC;IACxC,YAAY;IACZ,yCAAyC;IACzC,UAAU;IACV,aAAa;IACb,YAAY;IACZ,WAAW;IACX,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,SAAS;IACT,YAAY;IACZ,+DAA+D;IAC/D,WAAW;IACX,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,SAAS;IACT,eAAe;CAChB,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,cAAc,GAAgB,IAAI,GAAG,CAAC;IAC1C,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB;CAC1E,CAAC,CAAC;AACH,MAAM,UAAU,GAAgB,IAAI,GAAG,CAAC;IACtC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB;CAC5E,CAAC,CAAC;AAWH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,8CAA8C;AAC9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa;eAChD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,aAA8B,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,MAAM,WAAW,GACf,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,0EAA0E;oBACnF,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBACrC,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,eAAgB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;QAExC,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEnD,oEAAoE;YACpE,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClE,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAEhE,UAAU,EAAE,CAAC;YAEb,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,cAAc,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,eAAe,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,SAAS,EAAE;oBAC9D,QAAQ;oBACR,OAAO,EAAE,eAAe,IAAI,CAAC,WAAW,YAAY,IAAI,CAAC,SAAS,OAAO,IAAI,UAAU,IAAI,CAAC,WAAW,WAAW,IAAI,CAAC,SAAS,GAAG;oBACnI,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC1C,IAAI,EAAE;wBACJ,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;wBACxB,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;qBACzB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,gBAAgB;oBACxB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,kDAAkD;oBAC3D,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;iBACxB,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IAE9D,uBAAuB;IACvB,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,8BAA8B,cAAc,IAAI,UAAU,qBAAqB,KAAK,IAAI;QACjG,IAAI,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,GAAG,UAAU,EAAE;KACjF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}
|