circle-ir 3.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (194) hide show
  1. package/LICENSE +15 -0
  2. package/README.md +200 -0
  3. package/configs/sinks/code_injection.yaml +672 -0
  4. package/configs/sinks/command.yaml +917 -0
  5. package/configs/sinks/deserialization.yaml +105 -0
  6. package/configs/sinks/ldap.yaml +136 -0
  7. package/configs/sinks/nodejs.json +629 -0
  8. package/configs/sinks/path.yaml +715 -0
  9. package/configs/sinks/python.json +501 -0
  10. package/configs/sinks/rust.json +339 -0
  11. package/configs/sinks/sql.yaml +233 -0
  12. package/configs/sinks/ssrf.yaml +160 -0
  13. package/configs/sinks/xpath.yaml +121 -0
  14. package/configs/sinks/xss.yaml +727 -0
  15. package/configs/sources/db_sources.yaml +90 -0
  16. package/configs/sources/env_sources.yaml +94 -0
  17. package/configs/sources/express.json +197 -0
  18. package/configs/sources/file_sources.yaml +164 -0
  19. package/configs/sources/http_sources.yaml +379 -0
  20. package/configs/sources/io_sources.yaml +519 -0
  21. package/configs/sources/network_sources.yaml +99 -0
  22. package/configs/sources/python.json +230 -0
  23. package/configs/sources/rust.json +286 -0
  24. package/configs/sources/spring.yaml +70 -0
  25. package/dist/analysis/advisory-db.d.ts +86 -0
  26. package/dist/analysis/advisory-db.js +104 -0
  27. package/dist/analysis/advisory-db.js.map +1 -0
  28. package/dist/analysis/cargo-parser.d.ts +42 -0
  29. package/dist/analysis/cargo-parser.js +102 -0
  30. package/dist/analysis/cargo-parser.js.map +1 -0
  31. package/dist/analysis/config-loader.d.ts +37 -0
  32. package/dist/analysis/config-loader.js +1561 -0
  33. package/dist/analysis/config-loader.js.map +1 -0
  34. package/dist/analysis/constant-propagation/ast-utils.d.ts +25 -0
  35. package/dist/analysis/constant-propagation/ast-utils.js +34 -0
  36. package/dist/analysis/constant-propagation/ast-utils.js.map +1 -0
  37. package/dist/analysis/constant-propagation/evaluator.d.ts +32 -0
  38. package/dist/analysis/constant-propagation/evaluator.js +296 -0
  39. package/dist/analysis/constant-propagation/evaluator.js.map +1 -0
  40. package/dist/analysis/constant-propagation/index.d.ts +62 -0
  41. package/dist/analysis/constant-propagation/index.js +152 -0
  42. package/dist/analysis/constant-propagation/index.js.map +1 -0
  43. package/dist/analysis/constant-propagation/patterns.d.ts +8 -0
  44. package/dist/analysis/constant-propagation/patterns.js +126 -0
  45. package/dist/analysis/constant-propagation/patterns.js.map +1 -0
  46. package/dist/analysis/constant-propagation/propagator.d.ts +180 -0
  47. package/dist/analysis/constant-propagation/propagator.js +1985 -0
  48. package/dist/analysis/constant-propagation/propagator.js.map +1 -0
  49. package/dist/analysis/constant-propagation/types.d.ts +63 -0
  50. package/dist/analysis/constant-propagation/types.js +5 -0
  51. package/dist/analysis/constant-propagation/types.js.map +1 -0
  52. package/dist/analysis/constant-propagation.d.ts +9 -0
  53. package/dist/analysis/constant-propagation.js +18 -0
  54. package/dist/analysis/constant-propagation.js.map +1 -0
  55. package/dist/analysis/dependency-scanner.d.ts +79 -0
  56. package/dist/analysis/dependency-scanner.js +122 -0
  57. package/dist/analysis/dependency-scanner.js.map +1 -0
  58. package/dist/analysis/dfg-verifier.d.ts +116 -0
  59. package/dist/analysis/dfg-verifier.js +399 -0
  60. package/dist/analysis/dfg-verifier.js.map +1 -0
  61. package/dist/analysis/findings.d.ts +11 -0
  62. package/dist/analysis/findings.js +228 -0
  63. package/dist/analysis/findings.js.map +1 -0
  64. package/dist/analysis/index.d.ts +16 -0
  65. package/dist/analysis/index.js +18 -0
  66. package/dist/analysis/index.js.map +1 -0
  67. package/dist/analysis/interprocedural.d.ts +99 -0
  68. package/dist/analysis/interprocedural.js +526 -0
  69. package/dist/analysis/interprocedural.js.map +1 -0
  70. package/dist/analysis/path-finder.d.ts +133 -0
  71. package/dist/analysis/path-finder.js +354 -0
  72. package/dist/analysis/path-finder.js.map +1 -0
  73. package/dist/analysis/rules.d.ts +75 -0
  74. package/dist/analysis/rules.js +332 -0
  75. package/dist/analysis/rules.js.map +1 -0
  76. package/dist/analysis/semver.d.ts +27 -0
  77. package/dist/analysis/semver.js +127 -0
  78. package/dist/analysis/semver.js.map +1 -0
  79. package/dist/analysis/taint-matcher.d.ts +15 -0
  80. package/dist/analysis/taint-matcher.js +634 -0
  81. package/dist/analysis/taint-matcher.js.map +1 -0
  82. package/dist/analysis/taint-propagation.d.ts +67 -0
  83. package/dist/analysis/taint-propagation.js +298 -0
  84. package/dist/analysis/taint-propagation.js.map +1 -0
  85. package/dist/analysis/unresolved.d.ts +14 -0
  86. package/dist/analysis/unresolved.js +202 -0
  87. package/dist/analysis/unresolved.js.map +1 -0
  88. package/dist/analyzer.d.ts +43 -0
  89. package/dist/analyzer.js +1010 -0
  90. package/dist/analyzer.js.map +1 -0
  91. package/dist/browser/circle-ir.js +16576 -0
  92. package/dist/browser.d.ts +38 -0
  93. package/dist/browser.js +38 -0
  94. package/dist/browser.js.map +1 -0
  95. package/dist/core/circle-ir-core.cjs +13626 -0
  96. package/dist/core/circle-ir-core.d.ts +59 -0
  97. package/dist/core/circle-ir-core.js +13591 -0
  98. package/dist/core/extractors/calls.d.ts +13 -0
  99. package/dist/core/extractors/calls.js +1429 -0
  100. package/dist/core/extractors/calls.js.map +1 -0
  101. package/dist/core/extractors/cfg.d.ts +9 -0
  102. package/dist/core/extractors/cfg.js +519 -0
  103. package/dist/core/extractors/cfg.js.map +1 -0
  104. package/dist/core/extractors/dfg.d.ts +12 -0
  105. package/dist/core/extractors/dfg.js +1081 -0
  106. package/dist/core/extractors/dfg.js.map +1 -0
  107. package/dist/core/extractors/exports.d.ts +14 -0
  108. package/dist/core/extractors/exports.js +80 -0
  109. package/dist/core/extractors/exports.js.map +1 -0
  110. package/dist/core/extractors/imports.d.ts +9 -0
  111. package/dist/core/extractors/imports.js +739 -0
  112. package/dist/core/extractors/imports.js.map +1 -0
  113. package/dist/core/extractors/index.d.ts +10 -0
  114. package/dist/core/extractors/index.js +11 -0
  115. package/dist/core/extractors/index.js.map +1 -0
  116. package/dist/core/extractors/meta.d.ts +10 -0
  117. package/dist/core/extractors/meta.js +109 -0
  118. package/dist/core/extractors/meta.js.map +1 -0
  119. package/dist/core/extractors/types.d.ts +10 -0
  120. package/dist/core/extractors/types.js +1479 -0
  121. package/dist/core/extractors/types.js.map +1 -0
  122. package/dist/core/index.d.ts +5 -0
  123. package/dist/core/index.js +8 -0
  124. package/dist/core/index.js.map +1 -0
  125. package/dist/core/parser.d.ts +84 -0
  126. package/dist/core/parser.js +250 -0
  127. package/dist/core/parser.js.map +1 -0
  128. package/dist/core-lib.d.ts +59 -0
  129. package/dist/core-lib.js +62 -0
  130. package/dist/core-lib.js.map +1 -0
  131. package/dist/index.d.ts +15 -0
  132. package/dist/index.js +20 -0
  133. package/dist/index.js.map +1 -0
  134. package/dist/languages/index.d.ts +11 -0
  135. package/dist/languages/index.js +14 -0
  136. package/dist/languages/index.js.map +1 -0
  137. package/dist/languages/plugins/base.d.ts +44 -0
  138. package/dist/languages/plugins/base.js +82 -0
  139. package/dist/languages/plugins/base.js.map +1 -0
  140. package/dist/languages/plugins/index.d.ts +14 -0
  141. package/dist/languages/plugins/index.js +25 -0
  142. package/dist/languages/plugins/index.js.map +1 -0
  143. package/dist/languages/plugins/java.d.ts +49 -0
  144. package/dist/languages/plugins/java.js +402 -0
  145. package/dist/languages/plugins/java.js.map +1 -0
  146. package/dist/languages/plugins/javascript.d.ts +48 -0
  147. package/dist/languages/plugins/javascript.js +445 -0
  148. package/dist/languages/plugins/javascript.js.map +1 -0
  149. package/dist/languages/plugins/python.d.ts +47 -0
  150. package/dist/languages/plugins/python.js +480 -0
  151. package/dist/languages/plugins/python.js.map +1 -0
  152. package/dist/languages/plugins/rust.d.ts +47 -0
  153. package/dist/languages/plugins/rust.js +405 -0
  154. package/dist/languages/plugins/rust.js.map +1 -0
  155. package/dist/languages/registry.d.ts +30 -0
  156. package/dist/languages/registry.js +80 -0
  157. package/dist/languages/registry.js.map +1 -0
  158. package/dist/languages/types.d.ts +184 -0
  159. package/dist/languages/types.js +8 -0
  160. package/dist/languages/types.js.map +1 -0
  161. package/dist/resolution/cross-file.d.ts +146 -0
  162. package/dist/resolution/cross-file.js +439 -0
  163. package/dist/resolution/cross-file.js.map +1 -0
  164. package/dist/resolution/index.d.ts +12 -0
  165. package/dist/resolution/index.js +10 -0
  166. package/dist/resolution/index.js.map +1 -0
  167. package/dist/resolution/symbol-table.d.ts +136 -0
  168. package/dist/resolution/symbol-table.js +336 -0
  169. package/dist/resolution/symbol-table.js.map +1 -0
  170. package/dist/resolution/type-hierarchy.d.ts +124 -0
  171. package/dist/resolution/type-hierarchy.js +515 -0
  172. package/dist/resolution/type-hierarchy.js.map +1 -0
  173. package/dist/types/config.d.ts +45 -0
  174. package/dist/types/config.js +5 -0
  175. package/dist/types/config.js.map +1 -0
  176. package/dist/types/index.d.ts +392 -0
  177. package/dist/types/index.js +7 -0
  178. package/dist/types/index.js.map +1 -0
  179. package/dist/utils/logger.d.ts +85 -0
  180. package/dist/utils/logger.js +198 -0
  181. package/dist/utils/logger.js.map +1 -0
  182. package/dist/wasm/tree-sitter-java.wasm +0 -0
  183. package/dist/wasm/tree-sitter-javascript.wasm +0 -0
  184. package/dist/wasm/tree-sitter-python.wasm +0 -0
  185. package/dist/wasm/tree-sitter-rust.wasm +0 -0
  186. package/dist/wasm/web-tree-sitter.wasm +0 -0
  187. package/docs/SPEC.md +1021 -0
  188. package/examples/browser-example.html +610 -0
  189. package/examples/node-example.ts +215 -0
  190. package/package.json +107 -0
  191. package/wasm/tree-sitter-java.wasm +0 -0
  192. package/wasm/tree-sitter-javascript.wasm +0 -0
  193. package/wasm/tree-sitter-python.wasm +0 -0
  194. package/wasm/tree-sitter-rust.wasm +0 -0
package/configs/sinks/ssrf.yaml ADDED
@@ -0,0 +1,160 @@
1
+ {
2
+ "sinks": [
3
+ {
4
+ "method": "sendRedirect",
5
+ "class": "HttpServletResponse",
6
+ "type": "ssrf",
7
+ "cwe": "CWE-601",
8
+ "severity": "high",
9
+ "arg_positions": [0],
10
+ "note": "Open redirect - user-controlled URL can redirect to malicious site"
11
+ },
12
+ {
13
+ "method": "setHeader",
14
+ "class": "HttpServletResponse",
15
+ "type": "ssrf",
16
+ "cwe": "CWE-601",
17
+ "severity": "medium",
18
+ "arg_positions": [1],
19
+ "note": "Header injection - especially dangerous for Location header"
20
+ },
21
+ {
22
+ "method": "addHeader",
23
+ "class": "HttpServletResponse",
24
+ "type": "ssrf",
25
+ "cwe": "CWE-601",
26
+ "severity": "medium",
27
+ "arg_positions": [1],
28
+ "note": "Header injection"
29
+ },
30
+ {
31
+ "method": "openConnection",
32
+ "class": "URL",
33
+ "type": "ssrf",
34
+ "cwe": "CWE-918",
35
+ "severity": "critical",
36
+ "arg_positions": [],
37
+ "note": "SSRF - server-side request to user-controlled URL"
38
+ },
39
+ {
40
+ "method": "openStream",
41
+ "class": "URL",
42
+ "type": "ssrf",
43
+ "cwe": "CWE-918",
44
+ "severity": "critical",
45
+ "arg_positions": [],
46
+ "note": "SSRF - fetches content from user-controlled URL"
47
+ },
48
+ {
49
+ "method": "URL",
50
+ "class": "constructor",
51
+ "type": "ssrf",
52
+ "cwe": "CWE-918",
53
+ "severity": "high",
54
+ "arg_positions": [0],
55
+ "note": "URL construction with user input"
56
+ },
57
+ {
58
+ "method": "URI",
59
+ "class": "constructor",
60
+ "type": "ssrf",
61
+ "cwe": "CWE-918",
62
+ "severity": "high",
63
+ "arg_positions": [0],
64
+ "note": "URI construction with user input"
65
+ },
66
+ {
67
+ "method": "create",
68
+ "class": "URI",
69
+ "type": "ssrf",
70
+ "cwe": "CWE-918",
71
+ "severity": "high",
72
+ "arg_positions": [0],
73
+ "note": "URI.create with user input"
74
+ },
75
+ {
76
+ "method": "get",
77
+ "class": "HttpClient",
78
+ "type": "ssrf",
79
+ "cwe": "CWE-918",
80
+ "severity": "critical",
81
+ "arg_positions": [0],
82
+ "note": "HTTP client GET request to user-controlled URL"
83
+ },
84
+ {
85
+ "method": "post",
86
+ "class": "HttpClient",
87
+ "type": "ssrf",
88
+ "cwe": "CWE-918",
89
+ "severity": "critical",
90
+ "arg_positions": [0],
91
+ "note": "HTTP client POST request to user-controlled URL"
92
+ },
93
+ {
94
+ "method": "execute",
95
+ "class": "HttpClient",
96
+ "type": "ssrf",
97
+ "cwe": "CWE-918",
98
+ "severity": "critical",
99
+ "arg_positions": [0],
100
+ "note": "HTTP client execute with user-controlled request"
101
+ },
102
+ {
103
+ "method": "getForObject",
104
+ "class": "RestTemplate",
105
+ "type": "ssrf",
106
+ "cwe": "CWE-918",
107
+ "severity": "critical",
108
+ "arg_positions": [0],
109
+ "note": "Spring RestTemplate GET request"
110
+ },
111
+ {
112
+ "method": "getForEntity",
113
+ "class": "RestTemplate",
114
+ "type": "ssrf",
115
+ "cwe": "CWE-918",
116
+ "severity": "critical",
117
+ "arg_positions": [0],
118
+ "note": "Spring RestTemplate GET request"
119
+ },
120
+ {
121
+ "method": "postForObject",
122
+ "class": "RestTemplate",
123
+ "type": "ssrf",
124
+ "cwe": "CWE-918",
125
+ "severity": "critical",
126
+ "arg_positions": [0],
127
+ "note": "Spring RestTemplate POST request"
128
+ },
129
+ {
130
+ "method": "postForEntity",
131
+ "class": "RestTemplate",
132
+ "type": "ssrf",
133
+ "cwe": "CWE-918",
134
+ "severity": "critical",
135
+ "arg_positions": [0],
136
+ "note": "Spring RestTemplate POST request"
137
+ },
138
+ {
139
+ "method": "exchange",
140
+ "class": "RestTemplate",
141
+ "type": "ssrf",
142
+ "cwe": "CWE-918",
143
+ "severity": "critical",
144
+ "arg_positions": [0],
145
+ "note": "Spring RestTemplate exchange request"
146
+ }
147
+ ],
148
+ "sanitizers": [
149
+ {
150
+ "method": "validateUrl",
151
+ "removes": ["ssrf"],
152
+ "note": "URL validation function"
153
+ },
154
+ {
155
+ "method": "isAllowedHost",
156
+ "removes": ["ssrf"],
157
+ "note": "Host allowlist check"
158
+ }
159
+ ]
160
+ }
package/configs/sinks/xpath.yaml ADDED
@@ -0,0 +1,121 @@
1
+ {
2
+ "sinks": [
3
+ {
4
+ "method": "evaluate",
5
+ "class": "XPath",
6
+ "type": "xpath_injection",
7
+ "cwe": "CWE-643",
8
+ "severity": "critical",
9
+ "arg_positions": [
10
+ 0
11
+ ],
12
+ "note": "XPath injection if user input in expression"
13
+ },
14
+ {
15
+ "method": "compile",
16
+ "class": "XPath",
17
+ "type": "xpath_injection",
18
+ "cwe": "CWE-643",
19
+ "severity": "critical",
20
+ "arg_positions": [
21
+ 0
22
+ ]
23
+ },
24
+ {
25
+ "method": "evaluate",
26
+ "class": "XPathExpression",
27
+ "type": "xpath_injection",
28
+ "cwe": "CWE-643",
29
+ "severity": "critical",
30
+ "arg_positions": [
31
+ 0
32
+ ]
33
+ },
34
+ {
35
+ "method": "evaluate",
36
+ "class": "XPathEvaluator",
37
+ "type": "xpath_injection",
38
+ "cwe": "CWE-643",
39
+ "severity": "critical",
40
+ "arg_positions": [
41
+ 0
42
+ ]
43
+ },
44
+ {
45
+ "method": "selectNodes",
46
+ "class": "XPath",
47
+ "type": "xpath_injection",
48
+ "cwe": "CWE-643",
49
+ "severity": "critical",
50
+ "arg_positions": [
51
+ 0
52
+ ]
53
+ },
54
+ {
55
+ "method": "selectSingleNode",
56
+ "class": "XPath",
57
+ "type": "xpath_injection",
58
+ "cwe": "CWE-643",
59
+ "severity": "critical",
60
+ "arg_positions": [
61
+ 0
62
+ ]
63
+ },
64
+ {
65
+ "method": "selectNodes",
66
+ "class": "Node",
67
+ "type": "xpath_injection",
68
+ "cwe": "CWE-643",
69
+ "severity": "critical",
70
+ "arg_positions": [
71
+ 0
72
+ ]
73
+ },
74
+ {
75
+ "method": "selectSingleNode",
76
+ "class": "Node",
77
+ "type": "xpath_injection",
78
+ "cwe": "CWE-643",
79
+ "severity": "critical",
80
+ "arg_positions": [
81
+ 0
82
+ ]
83
+ },
84
+ {
85
+ "method": "createXPath",
86
+ "class": "DocumentHelper",
87
+ "type": "xpath_injection",
88
+ "cwe": "CWE-643",
89
+ "severity": "critical",
90
+ "arg_positions": [
91
+ 0
92
+ ]
93
+ },
94
+ {
95
+ "method": "setQuery",
96
+ "class": "XQPreparedExpression",
97
+ "type": "xpath_injection",
98
+ "cwe": "CWE-643",
99
+ "severity": "critical",
100
+ "arg_positions": [
101
+ 0
102
+ ]
103
+ }
104
+ ],
105
+ "sanitizers": [
106
+ {
107
+ "method": "setXPathVariableResolver",
108
+ "class": "XPath",
109
+ "removes": [
110
+ "xpath_injection"
111
+ ],
112
+ "note": "Using variables is safe"
113
+ },
114
+ {
115
+ "method": "encodeForXPath",
116
+ "removes": [
117
+ "xpath_injection"
118
+ ]
119
+ }
120
+ ]
121
+ }