circle-ir 3.107.0 → 3.110.0

package/dist/browser/circle-ir.js

@@ -12195,21 +12195,32 @@ var DEFAULT_SINKS = [
   { method: "from_string", class: "Template", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "jinja2", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "mako", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
-  // Python Log Injection
-  { method: "info", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "warning", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  // Python Log Injection — cognium-dev #193: positions [0, 1, 2, 3, 4]
+  // cover both the format string (arg 0) and Python `logging`'s positional
+  // *args (1..N), which get rendered into the log line via `%` substitution
+  // (e.g. `log.warning("user=%s", user)` taints via arg 1). Five-arg cap
+  // matches the established explicit-enumeration pattern used elsewhere in
+  // this file.
+  { method: "info", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warning", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warn", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "fatal", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "exception", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "log", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
   // Python `logging` module top-level functions (e.g. logging.info(...))
   // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
-  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1] },
-  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warn", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "fatal", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
+  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
@@ -13859,6 +13870,9 @@ function receiverMightBeClass(receiver, className) {
         return true;
       }
     }
+    if (className === "Logger" && /\.getLogger\(.*\)$/.test(receiver)) {
+      return true;
+    }
   }
   if (receiver.includes("::") && receiver.endsWith(")")) {
     const scopedMatch = receiver.match(/^(\w+)::(\w+)\(.*\)$/);
@@ -24415,6 +24429,25 @@ var JS_XSS_SANITIZERS = [
   /\bbypassSecurityTrust/
   // Angular
 ];
+var JS_LOG_INJECTION_SANITIZERS = [
+  /\bstripCrlf\s*\(/,
+  /\bstripCRLF\s*\(/,
+  /\bremoveNewlines\s*\(/,
+  /\bsanitizeLogValue\s*\(/,
+  // Inline CRLF-stripping regex literal: .replace(/[\r\n]/g, '')
+  /\.replace\(\s*\/\[\s*\\r\s*\\n\s*\]\/[gimsu]*\s*,\s*['"`]['"`]\s*\)/,
+  // Inline CRLF sequence: .replace(/\r\n/g, '')
+  /\.replace\(\s*\/\\r\\n\/[gimsu]*\s*,\s*['"`]['"`]\s*\)/
+];
+var PY_BUILTIN_LDAP_SANITIZERS = ["escape_filter_chars", "filter_format"];
+var PY_LDAP_METACHARS = ["(", ")", "=", "*", "\\"];
+var PY_DEF_RE = /^\s*def\s+([A-Za-z_]\w*)\s*\(\s*([A-Za-z_]\w*)\s*\)\s*:\s*$/;
+var PY_LDAP_STRIP_RETURN_RE = /^\s*return\s+re\.sub\(\s*r?["']\[([^"'\]]+)\]["']\s*,\s*r?["']["']\s*,\s*([A-Za-z_]\w*)\s*\)\s*$/;
+var PY_XML_PARSER_HARDENED_RE = /\bXMLParser\s*\([^)]*\bresolve_entities\s*=\s*False\b[^)]*\)/;
+var PY_SQL_EXEC_METHODS = /* @__PURE__ */ new Set(["execute", "executemany"]);
+var PY_INLINE_FULLMATCH_RE = /\bre\s*\.\s*fullmatch\s*\(\s*r?"((?:[^"\\]|\\.)*)"/g;
+var PY_INLINE_MATCH_ANCHORED_RE = /\bre\s*\.\s*match\s*\(\s*r?"\^((?:[^"\\]|\\.)*)\$"/g;
+var PY_BIND_PLACEHOLDER_RE = /\?|%s|:[A-Za-z_]\w*/;
 var DATA_PARSER_TYPES = /* @__PURE__ */ new Set([
   "Parser",
   // commonmark, airline, picocli, jcommander
@@ -25082,19 +25115,22 @@ var SinkFilterPass = class {
         const callArgs = extractJavaCallArgs(method, sinkLineText);
         if (!callArgs || callArgs.length === 0) return true;
         const sqlVar = callArgs[0]?.trim() ?? "";
-        if (!/^[A-Za-z_]\w*$/.test(sqlVar)) return true;
-        const lo = Math.max(0, sink.line - 31);
-        const assignRe = new RegExp(
-          JAVA_SQL_ASSIGN_RE_TEMPLATE.replace("SQLVAR", sqlVar)
-        );
         let rhs = null;
-        for (let i2 = sink.line - 2; i2 >= lo; i2--) {
-          const ln = sourceLines[i2] ?? "";
-          const m = ln.match(assignRe);
-          if (m) {
-            rhs = m[1] ?? null;
-            break;
+        if (/^[A-Za-z_]\w*$/.test(sqlVar)) {
+          const lo = Math.max(0, sink.line - 31);
+          const assignRe = new RegExp(
+            JAVA_SQL_ASSIGN_RE_TEMPLATE.replace("SQLVAR", sqlVar)
+          );
+          for (let i2 = sink.line - 2; i2 >= lo; i2--) {
+            const ln = sourceLines[i2] ?? "";
+            const m = ln.match(assignRe);
+            if (m) {
+              rhs = m[1] ?? null;
+              break;
+            }
           }
+        } else if (/"[^"]*"/.test(sqlVar) && sqlVar.includes("+")) {
+          rhs = sqlVar;
         }
         if (!rhs) return true;
         const tokens = splitJavaConcatTokens(rhs);
@@ -25122,9 +25158,329 @@ var SinkFilterPass = class {
         return true;
       });
     }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split("\n");
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "log_injection") return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        if (JS_LOG_INJECTION_SANITIZERS.some((p) => p.test(sinkLineText))) return false;
+        const varNames = extractSourceIdentifiers(sinkLineText);
+        for (const v of varNames) {
+          if (isAssignedFromSanitizerPattern(sourceLines, sink.line, v, JS_LOG_INJECTION_SANITIZERS)) {
+            return false;
+          }
+        }
+        return true;
+      });
+    }
+    if (language === "python") {
+      const sourceLines = ctx.code.split("\n");
+      const wrappers = findPythonLdapStripWrappers(sourceLines);
+      const allLdapSanitizers = [...PY_BUILTIN_LDAP_SANITIZERS, ...wrappers];
+      if (allLdapSanitizers.length > 0) {
+        const ldapPatterns = allLdapSanitizers.map(
+          (name2) => new RegExp(`\\b${escapeRegex(name2)}\\s*\\(`)
+        );
+        filtered = filtered.filter((sink) => {
+          if (sink.type !== "ldap_injection") return true;
+          const sinkLineText = sourceLines[sink.line - 1] ?? "";
+          if (ldapPatterns.some((p) => p.test(sinkLineText))) return false;
+          const varNames = extractSourceIdentifiers(sinkLineText);
+          for (const v of varNames) {
+            if (isAssignedFromSanitizerPattern(sourceLines, sink.line, v, ldapPatterns)) {
+              return false;
+            }
+          }
+          return true;
+        });
+      }
+    }
+    if (language === "python") {
+      const sourceLines = ctx.code.split("\n");
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "xxe") return true;
+        const lookback = 30;
+        const lo = Math.max(0, sink.line - 1 - lookback);
+        for (let i2 = sink.line - 2; i2 >= lo; i2--) {
+          const ln = sourceLines[i2] ?? "";
+          if (PY_XML_PARSER_HARDENED_RE.test(ln)) return false;
+          if (/^\s*def\s+\w+\s*\(/.test(ln)) break;
+        }
+        return true;
+      });
+    }
+    if (language === "python") {
+      const sourceLines = ctx.code.split("\n");
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "sql_injection") return true;
+        const method = sink.method ?? "";
+        if (!PY_SQL_EXEC_METHODS.has(method)) return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const fstrMatch = sinkLineText.match(/\bf"((?:[^"\\]|\\.)*)"|\bf'((?:[^'\\]|\\.)*)'/);
+        if (!fstrMatch) return true;
+        const fstrBody = fstrMatch[1] ?? fstrMatch[2] ?? "";
+        const { literals, interps } = splitPyFstringTokens(fstrBody);
+        if (interps.length === 0) return true;
+        if (!literals.some((lit) => PY_BIND_PLACEHOLDER_RE.test(lit))) return true;
+        let sawHelperWithGuard = false;
+        for (const interp of interps) {
+          const t = interp.trim();
+          if (t === "") return true;
+          if (/^-?\d+$/.test(t) || /^"(?:[^"\\]|\\.)*"$/.test(t) || /^'(?:[^'\\]|\\.)*'$/.test(t)) {
+            continue;
+          }
+          let helperName = null;
+          const directCall = t.match(/^([A-Za-z_]\w*)\s*\(/);
+          if (directCall) {
+            helperName = directCall[1] ?? null;
+          } else if (/^[A-Za-z_]\w*$/.test(t)) {
+            helperName = findPythonAssignedHelperCall(t, sink.line, sourceLines);
+            if (helperName === null) return true;
+          } else {
+            return true;
+          }
+          const body2 = findPythonFunctionBody(helperName, sourceLines);
+          if (body2 && pythonBodyHasInlineRegexAllowlistRaise(body2)) {
+            sawHelperWithGuard = true;
+          }
+        }
+        if (!sawHelperWithGuard) return true;
+        return false;
+      });
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 };
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var RESERVED_KEYWORDS = /* @__PURE__ */ new Set([
+  // JS/TS
+  "if",
+  "else",
+  "return",
+  "const",
+  "let",
+  "var",
+  "function",
+  "class",
+  "new",
+  "this",
+  "for",
+  "while",
+  "do",
+  "break",
+  "continue",
+  "switch",
+  "case",
+  "default",
+  "try",
+  "catch",
+  "finally",
+  "throw",
+  "typeof",
+  "instanceof",
+  "in",
+  "of",
+  "await",
+  "async",
+  "import",
+  "export",
+  "from",
+  "as",
+  "void",
+  "null",
+  "undefined",
+  "true",
+  "false",
+  "super",
+  "extends",
+  "static",
+  // Python
+  "def",
+  "lambda",
+  "yield",
+  "pass",
+  "with",
+  "global",
+  "nonlocal",
+  "and",
+  "or",
+  "not",
+  "is",
+  "None",
+  "True",
+  "False",
+  "raise",
+  "except",
+  "elif",
+  "self",
+  "cls",
+  "print",
+  // Common stdlib roots that show up everywhere and would balloon scans.
+  "console",
+  "req",
+  "res",
+  "request",
+  "response"
+]);
+function extractSourceIdentifiers(text) {
+  const out2 = [];
+  const re = /\b([A-Za-z_]\w+)\b/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const name2 = m[1];
+    if (!RESERVED_KEYWORDS.has(name2)) out2.push(name2);
+  }
+  return out2;
+}
+function isAssignedFromSanitizerPattern(sourceLines, sinkLine, varName, sanitizerPatterns, lookback = 30) {
+  const escapedVar = escapeRegex(varName);
+  const assignRe = new RegExp(
+    `(?:\\b(?:const|let|var|final|String)\\s+)?\\b${escapedVar}\\s*=\\s*(.+)`
+  );
+  const fnBoundaryRe = /^\s*(?:def\s+\w+\s*\(|function\s+\w+\s*\(|\w+\s*[:=]\s*(?:async\s+)?\(?[^)]*\)?\s*=>)/;
+  const lo = Math.max(0, sinkLine - 1 - lookback);
+  for (let i2 = sinkLine - 2; i2 >= lo; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(assignRe);
+    if (m) {
+      const rhs = (m[1] ?? "").trim();
+      return sanitizerPatterns.some((p) => p.test(rhs));
+    }
+    if (fnBoundaryRe.test(ln)) break;
+  }
+  return false;
+}
+function findPythonLdapStripWrappers(sourceLines) {
+  const out2 = [];
+  for (let i2 = 0; i2 < sourceLines.length; i2++) {
+    const defMatch = sourceLines[i2].match(PY_DEF_RE);
+    if (!defMatch) continue;
+    const fnName = defMatch[1];
+    const param = defMatch[2];
+    for (let j = i2 + 1; j < Math.min(i2 + 4, sourceLines.length); j++) {
+      const body2 = sourceLines[j];
+      if (/^\s*$/.test(body2) || /^\s*#/.test(body2)) continue;
+      const ret = body2.match(PY_LDAP_STRIP_RETURN_RE);
+      if (!ret) break;
+      const charClass = ret[1];
+      const argName = ret[2];
+      if (argName !== param) break;
+      const metaCount = PY_LDAP_METACHARS.filter((c) => charClass.includes(c)).length;
+      if (metaCount >= 3) out2.push(fnName);
+      break;
+    }
+  }
+  return out2;
+}
+function splitPyFstringTokens(body2) {
+  const literals = [];
+  const interps = [];
+  let i2 = 0;
+  let cur = "";
+  while (i2 < body2.length) {
+    const ch = body2[i2] ?? "";
+    if (ch === "{" && body2[i2 + 1] === "{") {
+      cur += "{";
+      i2 += 2;
+      continue;
+    }
+    if (ch === "}" && body2[i2 + 1] === "}") {
+      cur += "}";
+      i2 += 2;
+      continue;
+    }
+    if (ch === "{") {
+      literals.push(cur);
+      cur = "";
+      i2++;
+      let depth = 1;
+      let expr = "";
+      while (i2 < body2.length && depth > 0) {
+        const ch2 = body2[i2] ?? "";
+        if (ch2 === "{") {
+          depth++;
+          expr += ch2;
+          i2++;
+          continue;
+        }
+        if (ch2 === "}") {
+          depth--;
+          if (depth === 0) {
+            i2++;
+            break;
+          }
+          expr += ch2;
+          i2++;
+          continue;
+        }
+        expr += ch2;
+        i2++;
+      }
+      const colonIdx = expr.indexOf(":");
+      const interp = colonIdx >= 0 ? expr.substring(0, colonIdx) : expr;
+      interps.push(interp);
+      continue;
+    }
+    cur += ch;
+    i2++;
+  }
+  literals.push(cur);
+  return { literals, interps };
+}
+function findPythonAssignedHelperCall(varName, sinkLine, sourceLines) {
+  if (!/^[A-Za-z_]\w*$/.test(varName)) return null;
+  const lo = Math.max(0, sinkLine - 31);
+  const assignRe = new RegExp(
+    `^\\s*${varName}\\s*=\\s*([A-Za-z_]\\w*)\\s*\\(`
+  );
+  for (let i2 = sinkLine - 2; i2 >= lo; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(assignRe);
+    if (m) return m[1] ?? null;
+  }
+  return null;
+}
+function findPythonFunctionBody(funcName, sourceLines) {
+  if (!/^[A-Za-z_]\w*$/.test(funcName)) return null;
+  const sigRe = new RegExp(`^(\\s*)def\\s+${funcName}\\s*\\(`);
+  for (let i2 = 0; i2 < sourceLines.length; i2++) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(sigRe);
+    if (!m) continue;
+    const baseIndent = (m[1] ?? "").length;
+    const body2 = [];
+    for (let j = i2 + 1; j < sourceLines.length; j++) {
+      const ln2 = sourceLines[j] ?? "";
+      if (ln2.trim() === "") {
+        body2.push(ln2);
+        continue;
+      }
+      const indentMatch = ln2.match(/^(\s*)/);
+      const indent = (indentMatch?.[1] ?? "").length;
+      if (indent <= baseIndent) break;
+      body2.push(ln2);
+    }
+    return body2;
+  }
+  return null;
+}
+function pythonBodyHasInlineRegexAllowlistRaise(bodyLines) {
+  const stripped = bodyLines.map((ln) => ln.replace(/#.*$/, ""));
+  const text = stripped.join("\n");
+  if (!/\braise\s+/.test(text)) return false;
+  PY_INLINE_FULLMATCH_RE.lastIndex = 0;
+  let m;
+  while ((m = PY_INLINE_FULLMATCH_RE.exec(text)) !== null) {
+    if (isImplicitlyAnchoredAllowlistRegex(m[1] ?? "")) return true;
+  }
+  PY_INLINE_MATCH_ANCHORED_RE.lastIndex = 0;
+  while ((m = PY_INLINE_MATCH_ANCHORED_RE.exec(text)) !== null) {
+    if (isImplicitlyAnchoredAllowlistRegex(m[1] ?? "")) return true;
+  }
+  return false;
+}
 function evalArithmetic(input) {
   let pos = 0;
   const len = input.length;
@@ -27168,7 +27524,7 @@ var NullDerefPass = class {
 };
 
 // src/analysis/passes/resource-leak-pass.ts
-function escapeRegex(s) {
+function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var FACTORY_METHOD_NAME_RE = /^(?:open|create|new|get|make|build)[A-Z]/;
@@ -27331,7 +27687,7 @@ var ResourceLeakPass = class {
    * ownership to the caller (caller is responsible for close).
    */
   isReturnedToCaller(lines, variable, fromLine, toLine) {
-    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex(variable)}\\b`);
+    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex2(variable)}\\b`);
     for (let l = fromLine; l <= toLine && l <= lines.length; l++) {
       if (varRe.test(lines[l - 1] ?? "")) return true;
     }
@@ -27344,7 +27700,7 @@ var ResourceLeakPass = class {
    */
   fieldStoredName(lines, variable, openLine, toLine) {
     const thisAssignRe = new RegExp(
-      `\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex(variable)}\\b`
+      `\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex2(variable)}\\b`
     );
     for (let l = openLine; l <= toLine && l <= lines.length; l++) {
       const m = thisAssignRe.exec(lines[l - 1] ?? "");

package/dist/core/circle-ir-core.cjs

@@ -11577,21 +11577,32 @@ var DEFAULT_SINKS = [
   { method: "from_string", class: "Template", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "jinja2", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "mako", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
-  // Python Log Injection
-  { method: "info", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "warning", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  // Python Log Injection — cognium-dev #193: positions [0, 1, 2, 3, 4]
+  // cover both the format string (arg 0) and Python `logging`'s positional
+  // *args (1..N), which get rendered into the log line via `%` substitution
+  // (e.g. `log.warning("user=%s", user)` taints via arg 1). Five-arg cap
+  // matches the established explicit-enumeration pattern used elsewhere in
+  // this file.
+  { method: "info", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warning", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warn", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "fatal", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "exception", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "log", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
   // Python `logging` module top-level functions (e.g. logging.info(...))
   // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
-  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1] },
-  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warn", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "fatal", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
+  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
@@ -13154,6 +13165,9 @@ function receiverMightBeClass(receiver, className) {
         return true;
       }
     }
+    if (className === "Logger" && /\.getLogger\(.*\)$/.test(receiver)) {
+      return true;
+    }
   }
   if (receiver.includes("::") && receiver.endsWith(")")) {
     const scopedMatch = receiver.match(/^(\w+)::(\w+)\(.*\)$/);

package/dist/core/circle-ir-core.js

@@ -11511,21 +11511,32 @@ var DEFAULT_SINKS = [
   { method: "from_string", class: "Template", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "jinja2", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "mako", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
-  // Python Log Injection
-  { method: "info", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "warning", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  // Python Log Injection — cognium-dev #193: positions [0, 1, 2, 3, 4]
+  // cover both the format string (arg 0) and Python `logging`'s positional
+  // *args (1..N), which get rendered into the log line via `%` substitution
+  // (e.g. `log.warning("user=%s", user)` taints via arg 1). Five-arg cap
+  // matches the established explicit-enumeration pattern used elsewhere in
+  // this file.
+  { method: "info", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warning", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warn", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "fatal", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "exception", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "log", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
   // Python `logging` module top-level functions (e.g. logging.info(...))
   // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
-  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1] },
-  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warn", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "fatal", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
+  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
@@ -13088,6 +13099,9 @@ function receiverMightBeClass(receiver, className) {
         return true;
       }
     }
+    if (className === "Logger" && /\.getLogger\(.*\)$/.test(receiver)) {
+      return true;
+    }
   }
   if (receiver.includes("::") && receiver.endsWith(")")) {
     const scopedMatch = receiver.match(/^(\w+)::(\w+)\(.*\)$/);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.107.0",
+  "version": "3.110.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",