circle-ir 3.1.0 → 3.2.0

package/README.md

@@ -194,6 +194,9 @@ sources:
 
 - [Circle-IR Specification](docs/SPEC.md) - IR format specification
 - [Architecture Guide](docs/ARCHITECTURE.md) - Detailed system architecture
+- [Contributing Guide](CONTRIBUTING.md) - How to contribute
+- [Changelog](CHANGELOG.md) - Version history
+- [TODO](TODO.md) - Pending improvements and roadmap
 
 ## License
 

package/configs/sinks/code_injection.yaml

@@ -621,6 +621,142 @@
       "severity": "critical",
       "arg_positions": [0],
       "note": "Groovy class compilation from string"
+    },
+    {
+      "method": "interpolate",
+      "class": "StringSubstitutor",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Apache Commons Text interpolation - CVE-2022-42889 (script:, dns:, url: lookups)"
+    },
+    {
+      "method": "replace",
+      "class": "StringSubstitutor",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Apache Commons Text substitution with lookup"
+    },
+    {
+      "method": "interpolate",
+      "class": "StringLookupFactory",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Apache Commons Text lookup interpolation"
+    },
+    {
+      "method": "getConnection",
+      "class": "DriverManager",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "JDBC URL injection - can trigger JNDI/RCE via malicious JDBC URLs"
+    },
+    {
+      "method": "createConnection",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Database connection creation with attacker-controlled URL"
+    },
+    {
+      "method": "invoke",
+      "class": "RpcInvocation",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "critical",
+      "note": "Dubbo RPC invocation - may execute arbitrary code"
+    },
+    {
+      "method": "decode",
+      "class": "DecodeableRpcInvocation",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "critical",
+      "note": "Dubbo RPC deserialization"
+    },
+    {
+      "method": "refer",
+      "class": "RegistryProtocol",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "high",
+      "note": "Dubbo registry protocol reference"
+    },
+    {
+      "method": "executeScript",
+      "class": "ScriptingComponentHelper",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Apache NiFi script execution"
+    },
+    {
+      "method": "onTrigger",
+      "class": "ExecuteScript",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "critical",
+      "note": "Apache NiFi ExecuteScript processor"
+    },
+    {
+      "method": "parse",
+      "class": "CronDefinition",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Cron expression parsing - potential injection"
+    },
+    {
+      "method": "parse",
+      "class": "CronParser",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Cron expression parsing"
+    },
+    {
+      "method": "check",
+      "class": "PermitAllPermissionEvaluator",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "high",
+      "note": "Spring Security expression evaluation bypass"
+    },
+    {
+      "method": "evaluate",
+      "class": "SpelExpressionParser",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "SpEL direct evaluation"
+    },
+    {
+      "method": "setPropertyValues",
+      "class": "DataBinder",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "high",
+      "note": "Spring DataBinder property binding - Spring4Shell"
+    },
+    {
+      "method": "bind",
+      "class": "DataBinder",
+      "type": "code_injection",
+      "cwe": "CWE-094",
+      "severity": "high",
+      "note": "Spring DataBinder bind - Spring4Shell"
     }
   ],
   "sanitizers": [

package/configs/sinks/command.yaml

@@ -869,6 +869,115 @@
       "severity": "critical",
       "arg_positions": [0],
       "note": "Shell command execution"
+    },
+    {
+      "method": "cmds",
+      "class": "ProcStarter",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Jenkins Launcher.ProcStarter command list"
+    },
+    {
+      "method": "launch",
+      "class": "Launcher",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "critical",
+      "note": "Jenkins Launcher.launch() - process execution"
+    },
+    {
+      "method": "launch",
+      "class": "ProcStarter",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "critical",
+      "note": "Jenkins ProcStarter.launch() - process execution"
+    },
+    {
+      "method": "start",
+      "class": "ProcStarter",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "critical",
+      "note": "Jenkins ProcStarter.start() - process execution"
+    },
+    {
+      "method": "launchChannel",
+      "class": "Launcher",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Jenkins Launcher channel creation with command"
+    },
+    {
+      "method": "subcommand",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Git CLI subcommand construction"
+    },
+    {
+      "method": "launchCommandIn",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Jenkins Git plugin command launch"
+    },
+    {
+      "method": "fetch",
+      "class": "CliGitAPIImpl",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "high",
+      "note": "Jenkins Git plugin fetch - may inject via refspec"
+    },
+    {
+      "method": "checkout",
+      "class": "CliGitAPIImpl",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "high",
+      "note": "Jenkins Git plugin checkout - may inject via branch name"
+    },
+    {
+      "method": "submoduleUpdate",
+      "class": "CliGitAPIImpl",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "high",
+      "note": "Jenkins Git plugin submodule update - CVE injection vector"
+    },
+    {
+      "method": "interpolate",
+      "class": "StringSubstitutor",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Apache Commons Text string interpolation - CVE-2022-42889"
+    },
+    {
+      "method": "replace",
+      "class": "StringSubstitutor",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Apache Commons Text string substitution"
+    },
+    {
+      "method": "getConnection",
+      "class": "DriverManager",
+      "type": "command_injection",
+      "cwe": "CWE-078",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "JDBC connection with attacker-controlled URL can lead to RCE"
     }
   ],
   "sanitizers": [

package/configs/sinks/javascript_dom_xss.yaml

@@ -0,0 +1,131 @@
+{
+  "sinks": [
+    {
+      "property": "innerHTML",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "critical",
+      "note": "DOM XSS - innerHTML assignment with user input"
+    },
+    {
+      "property": "outerHTML",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "critical",
+      "note": "DOM XSS - outerHTML assignment with user input"
+    },
+    {
+      "method": "write",
+      "class": "document",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "DOM XSS - document.write with user input"
+    },
+    {
+      "method": "writeln",
+      "class": "document",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "DOM XSS - document.writeln with user input"
+    },
+    {
+      "method": "insertAdjacentHTML",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "critical",
+      "arg_positions": [1],
+      "note": "DOM XSS - insertAdjacentHTML with user input"
+    },
+    {
+      "property": "src",
+      "element": "script",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "critical",
+      "note": "DOM XSS - script src manipulation"
+    },
+    {
+      "property": "href",
+      "element": "a",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "high",
+      "note": "DOM XSS - anchor href with javascript: protocol"
+    },
+    {
+      "property": "action",
+      "element": "form",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "high",
+      "note": "DOM XSS - form action manipulation"
+    },
+    {
+      "method": "setAttribute",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "high",
+      "arg_positions": [1],
+      "note": "DOM XSS - setAttribute with event handler or dangerous attributes"
+    },
+    {
+      "method": "setAttributeNS",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "high",
+      "arg_positions": [2],
+      "note": "DOM XSS - setAttributeNS"
+    },
+    {
+      "method": "createContextualFragment",
+      "class": "Range",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "DOM XSS - Range.createContextualFragment"
+    },
+    {
+      "method": "parseFromString",
+      "class": "DOMParser",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "DOM parsing - may lead to XSS if content is rendered"
+    }
+  ],
+  "sanitizers": [
+    {
+      "method": "sanitize",
+      "class": "DOMPurify",
+      "removes": ["xss"],
+      "note": "DOMPurify sanitization"
+    },
+    {
+      "method": "createTextNode",
+      "class": "document",
+      "removes": ["xss"],
+      "note": "Text node creation - safe from XSS"
+    },
+    {
+      "property": "textContent",
+      "removes": ["xss"],
+      "note": "textContent assignment - safe from XSS"
+    },
+    {
+      "property": "innerText",
+      "removes": ["xss"],
+      "note": "innerText assignment - safe from XSS"
+    },
+    {
+      "method": "encodeURIComponent",
+      "removes": ["xss"],
+      "note": "URL encoding - safe for URL parameters"
+    }
+  ]
+}

package/configs/sinks/path.yaml

@@ -684,6 +684,119 @@
       "cwe": "CWE-022",
       "severity": "high",
       "note": "Jenkins FilePath recursive delete"
+    },
+    {
+      "method": "createRelative",
+      "class": "Resource",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Spring Resource.createRelative() - path traversal via relative path"
+    },
+    {
+      "method": "createRelative",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Resource createRelative without class qualifier"
+    },
+    {
+      "method": "sendFile",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Vert.x/HTTP file sending - path traversal"
+    },
+    {
+      "method": "sendStatic",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Static file serving - path traversal"
+    },
+    {
+      "method": "handle",
+      "class": "StaticHandler",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "note": "Vert.x static file handler"
+    },
+    {
+      "method": "handle",
+      "class": "StaticHandlerImpl",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "note": "Vert.x static file handler implementation"
+    },
+    {
+      "method": "getFile",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Generic getFile with user input"
+    },
+    {
+      "method": "extractEntry",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Archive entry extraction - zip slip"
+    },
+    {
+      "method": "extractAll",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Archive extraction - zip slip"
+    },
+    {
+      "method": "unzip",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Unzip operation - zip slip"
+    },
+    {
+      "method": "getPath",
+      "class": "ZipEntry",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "note": "Zip entry path - may contain ../"
+    },
+    {
+      "method": "getName",
+      "class": "ZipEntry",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "note": "Zip entry name - may contain ../"
+    },
+    {
+      "method": "getEnvironment",
+      "class": "ConfigServicePropertySourceLocator",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "note": "Spring Cloud Config path traversal"
+    },
+    {
+      "method": "findOne",
+      "class": "GenericResourceRepository",
+      "type": "path_traversal",
+      "cwe": "CWE-022",
+      "severity": "high",
+      "note": "Spring Cloud Config resource repository"
     }
   ],
   "sanitizers": [

package/configs/sources/http_sources.yaml

@@ -374,6 +374,157 @@
       "severity": "high",
       "return_tainted": true,
       "note": "Model object getter - may contain HTTP request data"
+    },
+    {
+      "method": "getParameter",
+      "class": "StaplerRequest",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Jenkins StaplerRequest parameter - attacker-controlled"
+    },
+    {
+      "method": "getSubmittedForm",
+      "class": "StaplerRequest",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Jenkins StaplerRequest form submission"
+    },
+    {
+      "method": "bindJSON",
+      "class": "StaplerRequest",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Jenkins StaplerRequest JSON binding"
+    },
+    {
+      "method": "getRequestURI",
+      "class": "StaplerRequest",
+      "type": "http_path",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Jenkins StaplerRequest URI"
+    },
+    {
+      "method": "getRestOfPath",
+      "class": "StaplerRequest",
+      "type": "http_path",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Jenkins StaplerRequest rest of path"
+    },
+    {
+      "method": "getPathParameter",
+      "class": "HandlerRequest",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Apache Flink HandlerRequest path parameter"
+    },
+    {
+      "method": "getQueryParameter",
+      "class": "HandlerRequest",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Apache Flink HandlerRequest query parameter"
+    },
+    {
+      "method": "getRequestBody",
+      "class": "HandlerRequest",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Apache Flink HandlerRequest body"
+    },
+    {
+      "method": "path",
+      "class": "HttpServerRequest",
+      "type": "http_path",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Vert.x HTTP request path"
+    },
+    {
+      "method": "getParam",
+      "class": "HttpServerRequest",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Vert.x HTTP request parameter"
+    },
+    {
+      "method": "getHeader",
+      "class": "HttpServerRequest",
+      "type": "http_header",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Vert.x HTTP request header"
+    },
+    {
+      "method": "request",
+      "class": "RoutingContext",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Vert.x RoutingContext request access"
+    },
+    {
+      "method": "pathParam",
+      "class": "RoutingContext",
+      "type": "http_path",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Vert.x RoutingContext path parameter"
+    },
+    {
+      "method": "queryParam",
+      "class": "RoutingContext",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Vert.x RoutingContext query parameter"
+    },
+    {
+      "method": "getBodyAsString",
+      "class": "RoutingContext",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Vert.x RoutingContext body"
+    },
+    {
+      "method": "normalisedPath",
+      "class": "RoutingContext",
+      "type": "http_path",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Vert.x RoutingContext normalized path"
+    },
+    {
+      "method": "getRemoteEnvironment",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Spring Cloud Config remote environment fetch"
+    },
+    {
+      "method": "getHeader",
+      "class": "ServerWebExchange",
+      "type": "http_header",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Spring WebFlux exchange header"
+    },
+    {
+      "method": "getExchange",
+      "class": "GatewayFilter",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Spring Cloud Gateway exchange"
     }
   ]
 }