circle-ir 3.1.0

package/configs/sinks/rust.json

@@ -0,0 +1,339 @@
+{
+  "name": "Rust Sinks",
+  "description": "Taint sinks for Rust web frameworks and standard library",
+  "sinks": [
+    {
+      "method": "query",
+      "class": "sqlx",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "sqlx raw query execution"
+    },
+    {
+      "method": "query_as",
+      "class": "sqlx",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "sqlx query_as with raw SQL"
+    },
+    {
+      "method": "query_scalar",
+      "class": "sqlx",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "sqlx query_scalar with raw SQL"
+    },
+    {
+      "method": "execute",
+      "class": "sqlx",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "sqlx execute with raw SQL"
+    },
+    {
+      "method": "fetch_one",
+      "class": "sqlx",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "sqlx fetch_one with raw SQL"
+    },
+    {
+      "method": "fetch_all",
+      "class": "sqlx",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "sqlx fetch_all with raw SQL"
+    },
+    {
+      "method": "arg",
+      "class": "Command",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "Command argument with user input"
+    },
+    {
+      "method": "args",
+      "class": "Command",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "Command arguments with user input"
+    },
+    {
+      "method": "new",
+      "class": "Command",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "Command creation with user-controlled program"
+    },
+    {
+      "method": "spawn",
+      "class": "Command",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "Command spawn"
+    },
+    {
+      "method": "output",
+      "class": "Command",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "tainted_args": [],
+      "note": "Command output execution"
+    },
+    {
+      "method": "get",
+      "class": "reqwest",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "HTTP GET request with user-controlled URL"
+    },
+    {
+      "method": "post",
+      "class": "reqwest",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "HTTP POST request with user-controlled URL"
+    },
+    {
+      "method": "put",
+      "class": "reqwest",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "HTTP PUT request with user-controlled URL"
+    },
+    {
+      "method": "delete",
+      "class": "reqwest",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "HTTP DELETE request with user-controlled URL"
+    },
+    {
+      "method": "get",
+      "class": "Client",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "HTTP client GET with user-controlled URL"
+    },
+    {
+      "method": "post",
+      "class": "Client",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "HTTP client POST with user-controlled URL"
+    },
+    {
+      "method": "send",
+      "class": "Client",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "HTTP client send request"
+    },
+    {
+      "method": "body",
+      "class": "HttpResponse",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "Actix-web response body with user input"
+    },
+    {
+      "method": "body",
+      "class": "HttpResponseBuilder",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "Actix-web response builder body"
+    },
+    {
+      "method": "json",
+      "class": "HttpResponse",
+      "type": "xss",
+      "cwe": "CWE-79",
+      "severity": "medium",
+      "tainted_args": [0],
+      "note": "JSON response (lower risk)"
+    },
+    {
+      "method": "read_to_string",
+      "class": "fs",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "File read with user-controlled path"
+    },
+    {
+      "method": "read",
+      "class": "fs",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "File read with user-controlled path"
+    },
+    {
+      "method": "write",
+      "class": "fs",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "File write with user-controlled path"
+    },
+    {
+      "method": "create",
+      "class": "File",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "File creation with user-controlled path"
+    },
+    {
+      "method": "open",
+      "class": "File",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "File open with user-controlled path"
+    },
+    {
+      "method": "remove_file",
+      "class": "fs",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "File deletion with user-controlled path"
+    },
+    {
+      "method": "remove_dir",
+      "class": "fs",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "Directory deletion with user-controlled path"
+    },
+    {
+      "method": "remove_dir_all",
+      "class": "fs",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "critical",
+      "tainted_args": [0],
+      "note": "Recursive directory deletion with user-controlled path"
+    },
+    {
+      "method": "from_str",
+      "class": "serde_yaml",
+      "type": "deserialization",
+      "cwe": "CWE-502",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "YAML deserialization of untrusted data"
+    },
+    {
+      "method": "from_reader",
+      "class": "serde_yaml",
+      "type": "deserialization",
+      "cwe": "CWE-502",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "YAML deserialization from reader"
+    },
+    {
+      "method": "from_str",
+      "class": "serde_json",
+      "type": "deserialization",
+      "cwe": "CWE-502",
+      "severity": "medium",
+      "tainted_args": [0],
+      "note": "JSON deserialization (lower risk than YAML)"
+    },
+    {
+      "method": "from_slice",
+      "class": "serde_json",
+      "type": "deserialization",
+      "cwe": "CWE-502",
+      "severity": "medium",
+      "tainted_args": [0],
+      "note": "JSON deserialization from bytes"
+    },
+    {
+      "method": "join",
+      "class": "Path",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "Path join with user input (doesn't prevent traversal)"
+    },
+    {
+      "method": "new",
+      "class": "Path",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "Path creation with user input"
+    },
+    {
+      "method": "new",
+      "class": "PathBuf",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "PathBuf creation with user input"
+    },
+    {
+      "method": "push",
+      "class": "PathBuf",
+      "type": "path_traversal",
+      "cwe": "CWE-22",
+      "severity": "high",
+      "tainted_args": [0],
+      "note": "PathBuf push with user input"
+    }
+  ]
+}

package/configs/sinks/sql.yaml

@@ -0,0 +1,233 @@
+{
+  "sinks": [
+    {
+      "method": "createNativeQuery",
+      "class": "EntityManager",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "createQuery",
+      "class": "EntityManager",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "high",
+      "arg_positions": [
+        0
+      ],
+      "note": "HQL injection if string concat used"
+    },
+    {
+      "method": "executeQuery",
+      "class": "Statement",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "execute",
+      "class": "Statement",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "executeUpdate",
+      "class": "Statement",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "addBatch",
+      "class": "Statement",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "query",
+      "class": "JdbcTemplate",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "queryForObject",
+      "class": "JdbcTemplate",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "queryForList",
+      "class": "JdbcTemplate",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "update",
+      "class": "JdbcTemplate",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "execute",
+      "class": "JdbcTemplate",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "queryForRowSet",
+      "class": "JdbcTemplate",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "queryForMap",
+      "class": "JdbcTemplate",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "batchUpdate",
+      "class": "JdbcTemplate",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ]
+    },
+    {
+      "method": "File",
+      "class": "constructor",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ],
+      "note": "Auto-mined from CVE analysis"
+    },
+    {
+      "method": "FileInputStream",
+      "class": "constructor",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ],
+      "note": "Auto-mined from CVE analysis"
+    },
+    {
+      "method": "getResource",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ],
+      "note": "Auto-mined from CVE analysis"
+    },
+    {
+      "method": "openConnection",
+      "class": "URL",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ],
+      "note": "Auto-mined from CVE analysis"
+    },
+    {
+      "method": "openStream",
+      "class": "URL",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ],
+      "note": "Auto-mined from CVE analysis"
+    },
+    {
+      "method": "forName",
+      "class": "Class",
+      "type": "sql_injection",
+      "cwe": "CWE-89",
+      "severity": "critical",
+      "arg_positions": [
+        0
+      ],
+      "note": "Auto-mined from CVE analysis"
+    }
+  ],
+  "sanitizers": [
+    {
+      "method": "prepareStatement",
+      "class": "Connection",
+      "removes": [
+        "sql_injection"
+      ],
+      "note": "Safe if parameters are bound with setX methods"
+    },
+    {
+      "method": "setParameter",
+      "class": "Query",
+      "removes": [
+        "sql_injection"
+      ]
+    },
+    {
+      "annotation": "@Param",
+      "removes": [
+        "sql_injection"
+      ]
+    }
+  ]
+}