circle-ir 3.108.0 → 3.110.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/config-loader.d.ts.map +1 -1
- package/dist/analysis/config-loader.js +24 -13
- package/dist/analysis/config-loader.js.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.js +496 -0
- package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
- package/dist/analysis/taint-matcher.d.ts.map +1 -1
- package/dist/analysis/taint-matcher.js +11 -0
- package/dist/analysis/taint-matcher.js.map +1 -1
- package/dist/browser/circle-ir.js +369 -16
- package/dist/core/circle-ir-core.cjs +27 -13
- package/dist/core/circle-ir-core.js +27 -13
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,
|
|
1
|
+
{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA+/CtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+QhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
|
|
@@ -1592,21 +1592,32 @@ export const DEFAULT_SINKS = [
|
|
|
1592
1592
|
{ method: 'from_string', class: 'Template', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
|
|
1593
1593
|
{ method: 'Template', class: 'jinja2', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
|
|
1594
1594
|
{ method: 'Template', class: 'mako', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
|
|
1595
|
-
// Python Log Injection
|
|
1596
|
-
|
|
1597
|
-
|
|
1598
|
-
|
|
1599
|
-
|
|
1600
|
-
|
|
1595
|
+
// Python Log Injection — cognium-dev #193: positions [0, 1, 2, 3, 4]
|
|
1596
|
+
// cover both the format string (arg 0) and Python `logging`'s positional
|
|
1597
|
+
// *args (1..N), which get rendered into the log line via `%` substitution
|
|
1598
|
+
// (e.g. `log.warning("user=%s", user)` taints via arg 1). Five-arg cap
|
|
1599
|
+
// matches the established explicit-enumeration pattern used elsewhere in
|
|
1600
|
+
// this file.
|
|
1601
|
+
{ method: 'info', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1602
|
+
{ method: 'warning', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1603
|
+
{ method: 'warn', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1604
|
+
{ method: 'error', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1605
|
+
{ method: 'debug', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1606
|
+
{ method: 'critical', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1607
|
+
{ method: 'fatal', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1608
|
+
{ method: 'exception', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1609
|
+
{ method: 'log', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [1, 2, 3, 4] },
|
|
1601
1610
|
// Python `logging` module top-level functions (e.g. logging.info(...))
|
|
1602
1611
|
// — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
|
|
1603
|
-
{ method: 'info', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
|
|
1604
|
-
{ method: 'warning', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
|
|
1605
|
-
{ method: '
|
|
1606
|
-
{ method: '
|
|
1607
|
-
{ method: '
|
|
1608
|
-
{ method: '
|
|
1609
|
-
{ method: '
|
|
1612
|
+
{ method: 'info', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1613
|
+
{ method: 'warning', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1614
|
+
{ method: 'warn', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1615
|
+
{ method: 'error', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1616
|
+
{ method: 'debug', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1617
|
+
{ method: 'critical', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1618
|
+
{ method: 'fatal', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1619
|
+
{ method: 'log', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [1, 2, 3, 4] },
|
|
1620
|
+
{ method: 'exception', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
|
|
1610
1621
|
// =========================================================================
|
|
1611
1622
|
// Java CWE-Bench Enhancement Patterns (Collection/Builder)
|
|
1612
1623
|
// =========================================================================
|