circle-ir 3.1.0

package/configs/sources/db_sources.yaml

@@ -0,0 +1,90 @@
+{
+  "sources": [
+    {
+      "method": "getString",
+      "class": "ResultSet",
+      "type": "database",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "String column value - could be attacker-controlled if stored from user input"
+    },
+    {
+      "method": "getObject",
+      "class": "ResultSet",
+      "type": "database",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Object column value"
+    },
+    {
+      "method": "getBytes",
+      "class": "ResultSet",
+      "type": "database",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Byte array column value"
+    },
+    {
+      "method": "getClob",
+      "class": "ResultSet",
+      "type": "database",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "CLOB column value"
+    },
+    {
+      "method": "getBlob",
+      "class": "ResultSet",
+      "type": "database",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "BLOB column value"
+    },
+    {
+      "annotation": "@Column",
+      "type": "database",
+      "severity": "medium",
+      "field_tainted": true,
+      "note": "JPA entity field - may contain attacker data"
+    },
+    {
+      "annotation": "@Entity",
+      "type": "database",
+      "severity": "low",
+      "class_fields_tainted": true,
+      "note": "JPA entity - all fields are potentially tainted"
+    },
+    {
+      "method": "findBy.*",
+      "class": ".*Repository",
+      "type": "database",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Spring Data finder method - returns entities from DB"
+    },
+    {
+      "method": "findAll",
+      "class": ".*Repository",
+      "type": "database",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Returns all entities - could contain attacker data"
+    },
+    {
+      "method": "getString",
+      "class": "Document",
+      "type": "database",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "MongoDB document field"
+    },
+    {
+      "method": "get",
+      "class": "Document",
+      "type": "database",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "MongoDB document field (generic)"
+    }
+  ]
+}

package/configs/sources/env_sources.yaml

@@ -0,0 +1,94 @@
+{
+  "sources": [
+    {
+      "method": "getProperty",
+      "class": "System",
+      "type": "system_property",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "System property - could be set by attacker in some contexts"
+    },
+    {
+      "method": "getProperties",
+      "class": "System",
+      "type": "system_property",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "All system properties"
+    },
+    {
+      "method": "getenv",
+      "class": "System",
+      "type": "env_variable",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Environment variable - could be attacker-controlled"
+    },
+    {
+      "method": "lookup",
+      "class": "InitialContext",
+      "type": "jndi",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ],
+      "note": "JNDI lookup - argument is taint source if from user input"
+    },
+    {
+      "method": "lookup",
+      "class": "Context",
+      "type": "jndi",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ],
+      "note": "JNDI context lookup"
+    },
+    {
+      "method": "getProperty",
+      "class": "Environment",
+      "type": "spring_property",
+      "severity": "low",
+      "return_tainted": true,
+      "note": "Spring environment property - usually safe but can be external"
+    },
+    {
+      "method": "getRequiredProperty",
+      "class": "Environment",
+      "type": "spring_property",
+      "severity": "low",
+      "return_tainted": true,
+      "note": "Spring required property"
+    },
+    {
+      "annotation": "@Value",
+      "type": "spring_property",
+      "severity": "low",
+      "param_tainted": true,
+      "note": "Spring @Value injection - from properties file"
+    },
+    {
+      "annotation": "@ConfigurationProperties",
+      "type": "spring_property",
+      "severity": "low",
+      "class_fields_tainted": true,
+      "note": "Spring configuration properties binding"
+    },
+    {
+      "method": "getProperty",
+      "class": "PropertyDescriptor",
+      "type": "reflection",
+      "severity": "low",
+      "return_tainted": true,
+      "note": "Bean property value via reflection"
+    },
+    {
+      "method": "invoke",
+      "class": "Method",
+      "type": "reflection",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Method invocation result via reflection"
+    }
+  ]
+}

package/configs/sources/express.json

@@ -0,0 +1,197 @@
+{
+  "sources": [
+    {
+      "method": "params",
+      "class": "Request",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express route parameters (req.params)"
+    },
+    {
+      "method": "query",
+      "class": "Request",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express query string parameters (req.query)"
+    },
+    {
+      "method": "body",
+      "class": "Request",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express request body (req.body)"
+    },
+    {
+      "method": "headers",
+      "class": "Request",
+      "type": "http_header",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express request headers (req.headers)"
+    },
+    {
+      "method": "cookies",
+      "class": "Request",
+      "type": "http_cookie",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express cookies (req.cookies)"
+    },
+    {
+      "method": "url",
+      "class": "Request",
+      "type": "http_path",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express request URL (req.url)"
+    },
+    {
+      "method": "path",
+      "class": "Request",
+      "type": "http_path",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express request path (req.path)"
+    },
+    {
+      "method": "originalUrl",
+      "class": "Request",
+      "type": "http_path",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express original URL (req.originalUrl)"
+    },
+    {
+      "method": "get",
+      "class": "Request",
+      "type": "http_header",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express header getter (req.get('header'))"
+    },
+    {
+      "method": "header",
+      "class": "Request",
+      "type": "http_header",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express header getter (req.header('name'))"
+    },
+    {
+      "method": "param",
+      "class": "Request",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express param getter (req.param('name'))"
+    },
+    {
+      "method": "file",
+      "class": "Request",
+      "type": "file_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express file upload (req.file with multer)"
+    },
+    {
+      "method": "files",
+      "class": "Request",
+      "type": "file_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Express multiple file uploads (req.files)"
+    },
+    {
+      "method": "ip",
+      "class": "Request",
+      "type": "http_header",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Express client IP (can be spoofed via X-Forwarded-For)"
+    },
+    {
+      "method": "hostname",
+      "class": "Request",
+      "type": "http_header",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Express hostname from Host header"
+    },
+    {
+      "method": "subdomains",
+      "class": "Request",
+      "type": "http_header",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Express subdomains from Host header"
+    },
+    {
+      "method": "protocol",
+      "class": "Request",
+      "type": "http_header",
+      "severity": "low",
+      "return_tainted": true,
+      "note": "Express protocol (can be influenced by X-Forwarded-Proto)"
+    },
+    {
+      "method": "env",
+      "class": "process",
+      "type": "env_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Environment variables (process.env) - may contain sensitive data"
+    },
+    {
+      "method": "argv",
+      "class": "process",
+      "type": "io_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Command line arguments (process.argv)"
+    },
+    {
+      "method": "stdin",
+      "class": "process",
+      "type": "io_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Standard input stream"
+    },
+    {
+      "method": "on",
+      "class": "WebSocket",
+      "type": "network_input",
+      "severity": "high",
+      "return_tainted": true,
+      "arg_positions": [1],
+      "note": "WebSocket message handler - data from client"
+    },
+    {
+      "method": "message",
+      "class": "WebSocket",
+      "type": "network_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "WebSocket message event"
+    },
+    {
+      "method": "data",
+      "class": "Socket",
+      "type": "network_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Socket data event"
+    },
+    {
+      "method": "signedCookies",
+      "class": "Request",
+      "type": "http_cookie",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Express signed cookies (req.signedCookies)"
+    }
+  ]
+}

package/configs/sources/file_sources.yaml

@@ -0,0 +1,164 @@
+{
+  "sources": [
+    {
+      "method": "readLine",
+      "class": "BufferedReader",
+      "type": "file_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Single line from file - could be attacker-controlled"
+    },
+    {
+      "method": "readAllLines",
+      "class": "Files",
+      "type": "file_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "All lines from file as List<String>"
+    },
+    {
+      "method": "readAllBytes",
+      "class": "Files",
+      "type": "file_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "All bytes from file"
+    },
+    {
+      "method": "readString",
+      "class": "Files",
+      "type": "file_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "File content as String (Java 11+)"
+    },
+    {
+      "method": "lines",
+      "class": "Files",
+      "type": "file_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Stream of lines from file"
+    },
+    {
+      "method": "getOriginalFilename",
+      "class": "MultipartFile",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "User-provided filename - path traversal risk"
+    },
+    {
+      "method": "getName",
+      "class": "MultipartFile",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Form field name for uploaded file"
+    },
+    {
+      "method": "getBytes",
+      "class": "MultipartFile",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "File content as byte array"
+    },
+    {
+      "method": "getInputStream",
+      "class": "MultipartFile",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "File content as InputStream"
+    },
+    {
+      "method": "getSubmittedFileName",
+      "class": "Part",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "User-provided filename from multipart upload (Servlet API)"
+    },
+    {
+      "method": "getFileName",
+      "class": "Part",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "User-provided filename from MIME part (JavaMail API)"
+    },
+    {
+      "method": "getFileName",
+      "class": "MimePart",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "User-provided filename from MIME part (JavaMail API)"
+    },
+    {
+      "method": "getFileName",
+      "class": "BodyPart",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "User-provided filename from email attachment (JavaMail API)"
+    },
+    {
+      "method": "getFileName",
+      "class": "MimeBodyPart",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "User-provided filename from email attachment (JavaMail API)"
+    },
+    {
+      "method": "getInputStream",
+      "class": "Part",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Uploaded file content"
+    },
+    {
+      "method": "getName",
+      "class": "FileItem",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "User-provided filename"
+    },
+    {
+      "method": "getString",
+      "class": "FileItem",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "File content as String"
+    },
+    {
+      "method": "getInputStream",
+      "class": "FileItem",
+      "type": "file_upload",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "File content as InputStream"
+    },
+    {
+      "method": "getProperty",
+      "class": "Properties",
+      "type": "config_file",
+      "severity": "low",
+      "return_tainted": true,
+      "note": "Property value - if loaded from external file, could be tainted"
+    },
+    {
+      "method": "load",
+      "class": "Properties",
+      "type": "config_file",
+      "severity": "low",
+      "return_tainted": true,
+      "note": "Loads properties from InputStream"
+    }
+  ]
+}