circle-ir 3.1.0

package/configs/sources/python.json

@@ -0,0 +1,230 @@
+{
+  "sources": [
+    {
+      "method": "args.get",
+      "class": "request",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Flask request.args.get() - query string parameter"
+    },
+    {
+      "method": "form.get",
+      "class": "request",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Flask request.form.get() - POST form parameter"
+    },
+    {
+      "field": "json",
+      "class": "request",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Flask request.json - parsed JSON body"
+    },
+    {
+      "field": "data",
+      "class": "request",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Flask request.data - raw request body"
+    },
+    {
+      "method": "headers.get",
+      "class": "request",
+      "type": "http_header",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Flask request.headers.get() - HTTP header value"
+    },
+    {
+      "method": "cookies.get",
+      "class": "request",
+      "type": "http_cookie",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Flask request.cookies.get() - cookie value"
+    },
+    {
+      "field": "path",
+      "class": "request",
+      "type": "http_path",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Flask request.path - URL path"
+    },
+    {
+      "field": "query_string",
+      "class": "request",
+      "type": "http_query",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Flask request.query_string - raw query string"
+    },
+    {
+      "method": "GET.get",
+      "class": "request",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Django request.GET.get() - query string parameter"
+    },
+    {
+      "method": "POST.get",
+      "class": "request",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Django request.POST.get() - POST form parameter"
+    },
+    {
+      "field": "body",
+      "class": "request",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Django request.body - raw request body"
+    },
+    {
+      "method": "META.get",
+      "class": "request",
+      "type": "http_header",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Django request.META.get() - HTTP headers and server info"
+    },
+    {
+      "method": "COOKIES.get",
+      "class": "request",
+      "type": "http_cookie",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Django request.COOKIES.get() - cookie value"
+    },
+    {
+      "field": "path_info",
+      "class": "request",
+      "type": "http_path",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "Django request.path_info - URL path"
+    },
+    {
+      "method": "get",
+      "class": "environ",
+      "type": "env_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "os.environ.get() - environment variable"
+    },
+    {
+      "method": "getenv",
+      "class": "os",
+      "type": "env_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "os.getenv() - environment variable"
+    },
+    {
+      "method": "input",
+      "class": null,
+      "type": "io_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "input() - user console input"
+    },
+    {
+      "method": "read",
+      "class": null,
+      "type": "file_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "file.read() - file content"
+    },
+    {
+      "method": "readline",
+      "class": null,
+      "type": "file_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "file.readline() - single line from file"
+    },
+    {
+      "method": "readlines",
+      "class": null,
+      "type": "file_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "file.readlines() - all lines from file"
+    },
+    {
+      "method": "fetchone",
+      "class": null,
+      "type": "db_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "cursor.fetchone() - database row"
+    },
+    {
+      "method": "fetchall",
+      "class": null,
+      "type": "db_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "cursor.fetchall() - database rows"
+    },
+    {
+      "method": "fetchmany",
+      "class": null,
+      "type": "db_input",
+      "severity": "medium",
+      "return_tainted": true,
+      "note": "cursor.fetchmany() - database rows"
+    },
+    {
+      "method": "recv",
+      "class": "socket",
+      "type": "network_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "socket.recv() - network data"
+    },
+    {
+      "method": "recvfrom",
+      "class": "socket",
+      "type": "network_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "socket.recvfrom() - network data with address"
+    }
+  ],
+  "annotations": [
+    {
+      "annotation": "route",
+      "type": "http_param",
+      "severity": "high",
+      "note": "Flask @app.route() decorated function parameters"
+    },
+    {
+      "annotation": "get",
+      "type": "http_param",
+      "severity": "high",
+      "note": "Flask @app.get() decorated function parameters"
+    },
+    {
+      "annotation": "post",
+      "type": "http_body",
+      "severity": "high",
+      "note": "Flask @app.post() decorated function parameters"
+    },
+    {
+      "annotation": "api_view",
+      "type": "http_param",
+      "severity": "high",
+      "note": "Django REST framework @api_view() decorated function"
+    }
+  ]
+}

package/configs/sources/rust.json

@@ -0,0 +1,286 @@
+{
+  "name": "Rust Sources",
+  "description": "Taint sources for Rust web frameworks and standard library",
+  "sources": [
+    {
+      "method": "query_string",
+      "class": "HttpRequest",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "actix-web"
+    },
+    {
+      "method": "path",
+      "class": "Path",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "actix-web"
+    },
+    {
+      "method": "into_inner",
+      "class": "Path",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "actix-web"
+    },
+    {
+      "method": "into_inner",
+      "class": "Query",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "actix-web"
+    },
+    {
+      "method": "into_inner",
+      "class": "Json",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "actix-web"
+    },
+    {
+      "method": "into_inner",
+      "class": "Form",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "actix-web"
+    },
+    {
+      "method": "match_info",
+      "class": "HttpRequest",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "actix-web"
+    },
+    {
+      "method": "headers",
+      "class": "HttpRequest",
+      "type": "http_header",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "actix-web"
+    },
+    {
+      "method": "cookie",
+      "class": "HttpRequest",
+      "type": "http_cookie",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "actix-web"
+    },
+    {
+      "method": "param",
+      "class": "Request",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "rocket"
+    },
+    {
+      "method": "into_inner",
+      "class": "Form",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "rocket"
+    },
+    {
+      "method": "into_inner",
+      "class": "Json",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "rocket"
+    },
+    {
+      "method": "cookies",
+      "class": "Request",
+      "type": "http_cookie",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "rocket"
+    },
+    {
+      "method": "headers",
+      "class": "Request",
+      "type": "http_header",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "rocket"
+    },
+    {
+      "method": "body",
+      "class": "Request",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "axum"
+    },
+    {
+      "method": "extract",
+      "class": "Query",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "axum"
+    },
+    {
+      "method": "extract",
+      "class": "Path",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "axum"
+    },
+    {
+      "method": "extract",
+      "class": "Json",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "axum"
+    },
+    {
+      "method": "var",
+      "class": "env",
+      "type": "env_var",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "var_os",
+      "class": "env",
+      "type": "env_var",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "args",
+      "class": "env",
+      "type": "cli_arg",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "args_os",
+      "class": "env",
+      "type": "cli_arg",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "read_to_string",
+      "class": "File",
+      "type": "file_read",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "read",
+      "class": "File",
+      "type": "file_read",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "read_to_end",
+      "class": "File",
+      "type": "file_read",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "read_line",
+      "class": "BufReader",
+      "type": "file_read",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "lines",
+      "class": "BufReader",
+      "type": "file_read",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "read_to_string",
+      "class": "stdin",
+      "type": "stdin",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "read_line",
+      "class": "stdin",
+      "type": "stdin",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "recv",
+      "class": "TcpStream",
+      "type": "network",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "read",
+      "class": "TcpStream",
+      "type": "network",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "recv",
+      "class": "UdpSocket",
+      "type": "network",
+      "severity": "high",
+      "return_tainted": true,
+      "framework": "std"
+    },
+    {
+      "method": "query",
+      "class": "Client",
+      "type": "db_result",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "sqlx"
+    },
+    {
+      "method": "fetch_one",
+      "class": "Client",
+      "type": "db_result",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "sqlx"
+    },
+    {
+      "method": "fetch_all",
+      "class": "Client",
+      "type": "db_result",
+      "severity": "medium",
+      "return_tainted": true,
+      "framework": "sqlx"
+    }
+  ]
+}

package/configs/sources/spring.yaml

@@ -0,0 +1,70 @@
+{
+  "sources": [
+    {
+      "annotation": "@RequestBody",
+      "type": "http_body",
+      "severity": "high",
+      "cwe": null
+    },
+    {
+      "annotation": "@RequestParam",
+      "type": "http_param",
+      "severity": "high",
+      "cwe": null
+    },
+    {
+      "annotation": "@PathVariable",
+      "type": "http_path",
+      "severity": "medium",
+      "cwe": null
+    },
+    {
+      "annotation": "@RequestHeader",
+      "type": "http_header",
+      "severity": "medium",
+      "cwe": null
+    },
+    {
+      "annotation": "@CookieValue",
+      "type": "http_cookie",
+      "severity": "high",
+      "cwe": null
+    },
+    {
+      "annotation": "@MatrixVariable",
+      "type": "http_matrix",
+      "severity": "medium",
+      "cwe": null
+    },
+    {
+      "method": "getParameter",
+      "class": "HttpServletRequest",
+      "type": "http_param",
+      "severity": "high"
+    },
+    {
+      "method": "getInputStream",
+      "class": "HttpServletRequest",
+      "type": "http_body",
+      "severity": "high"
+    },
+    {
+      "method": "getReader",
+      "class": "HttpServletRequest",
+      "type": "http_body",
+      "severity": "high"
+    },
+    {
+      "method": "getHeader",
+      "class": "HttpServletRequest",
+      "type": "http_header",
+      "severity": "medium"
+    },
+    {
+      "method": "getCookies",
+      "class": "HttpServletRequest",
+      "type": "http_cookie",
+      "severity": "high"
+    }
+  ]
+}

package/dist/analysis/advisory-db.d.ts

@@ -0,0 +1,86 @@
+/**
+ * RustSec Advisory Database Integration
+ *
+ * Provides vulnerability data from the RustSec advisory database.
+ * Advisory data is bundled at build time for offline/deterministic usage.
+ */
+import type { Severity } from '../types/index.js';
+export interface AdvisoryVulnerability {
+    /** Unique advisory ID (RUSTSEC-YYYY-NNNN) */
+    id: string;
+    /** Crate name */
+    package: string;
+    /** Advisory date (RFC 3339) */
+    date: string;
+    /** Advisory URL */
+    url: string;
+    /** CVSS score string */
+    cvss?: string;
+    /** Vulnerability categories */
+    categories: string[];
+    /** Search keywords */
+    keywords: string[];
+    /** Related identifiers (CVE, etc.) */
+    aliases: string[];
+    /** Affected functions with version constraints */
+    affectedFunctions?: {
+        name: string;
+        versions: string[];
+    }[];
+    /** Version constraints */
+    versions: {
+        patched?: string[];
+        unaffected?: string[];
+    };
+    /** Affected architectures */
+    affectedArch?: string[];
+    /** Affected operating systems */
+    affectedOs?: string[];
+    /** Human-readable description */
+    description: string;
+    /** Title/summary of the vulnerability */
+    title?: string;
+}
+export interface AdvisoryDatabase {
+    /** Map of crate name to list of advisories */
+    advisories: Map<string, AdvisoryVulnerability[]>;
+    /** When the database was last updated */
+    lastUpdated: string;
+    /** Source of the database */
+    source: 'bundled' | 'fetched';
+    /** Database format version */
+    version: string;
+    /** Statistics */
+    stats?: {
+        totalAdvisories: number;
+        uniqueCrates: number;
+    };
+}
+/**
+ * Load the bundled advisory database
+ */
+export declare function loadBundledAdvisories(): AdvisoryDatabase;
+/**
+ * Parse advisory JSON into database structure
+ */
+export declare function parseAdvisoryJson(json: {
+    version: string;
+    lastUpdated: string;
+    advisories: AdvisoryVulnerability[];
+}): AdvisoryDatabase;
+/**
+ * Map RustSec categories to severity levels
+ */
+export declare function categoryToSeverity(categories: string[]): Severity;
+/**
+ * Get advisories for a specific crate
+ */
+export declare function getAdvisoriesForCrate(db: AdvisoryDatabase, crateName: string): AdvisoryVulnerability[];
+/**
+ * Search advisories by CVE ID
+ */
+export declare function findAdvisoryByCve(db: AdvisoryDatabase, cveId: string): AdvisoryVulnerability | undefined;
+/**
+ * Get all unique crate names with advisories
+ */
+export declare function getVulnerableCrates(db: AdvisoryDatabase): string[];