circle-ir 3.108.0 → 3.111.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/configs/sinks/nodejs.json +18 -0
  2. package/dist/analysis/config-loader.d.ts.map +1 -1
  3. package/dist/analysis/config-loader.js +38 -15
  4. package/dist/analysis/config-loader.js.map +1 -1
  5. package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
  6. package/dist/analysis/passes/sink-filter-pass.js +496 -0
  7. package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
  8. package/dist/analysis/passes/taint-propagation-pass.d.ts.map +1 -1
  9. package/dist/analysis/passes/taint-propagation-pass.js +26 -2
  10. package/dist/analysis/passes/taint-propagation-pass.js.map +1 -1
  11. package/dist/analysis/taint-matcher.d.ts.map +1 -1
  12. package/dist/analysis/taint-matcher.js +145 -1
  13. package/dist/analysis/taint-matcher.js.map +1 -1
  14. package/dist/browser/circle-ir.js +472 -21
  15. package/dist/core/circle-ir-core.cjs +120 -16
  16. package/dist/core/circle-ir-core.js +120 -16
  17. package/package.json +1 -1
package/configs/sinks/nodejs.json CHANGED
@@ -94,6 +94,24 @@
94
94
  "arg_positions": [0],
95
95
  "note": "Fork new Node.js process"
96
96
  },
97
+ {
98
+ "method": "command",
99
+ "class": "execa",
100
+ "type": "command_injection",
101
+ "cwe": "CWE-78",
102
+ "severity": "critical",
103
+ "arg_positions": [0],
104
+ "note": "execa.command(taintedString) — parses string into program+argv; tainted arg is shell-injectable. cognium-dev #187 Sprint 54."
105
+ },
106
+ {
107
+ "method": "commandSync",
108
+ "class": "execa",
109
+ "type": "command_injection",
110
+ "cwe": "CWE-78",
111
+ "severity": "critical",
112
+ "arg_positions": [0],
113
+ "note": "execa.commandSync(taintedString) — synchronous variant of execa.command."
114
+ },
97
115
  {
98
116
  "method": "query",
99
117
  "class": "mysql",
package/dist/analysis/config-loader.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAo/CtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+QhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
1
+ {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA4gDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+QhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
package/dist/analysis/config-loader.js CHANGED
@@ -567,10 +567,20 @@ export const DEFAULT_SINKS = [
567
567
  { method: 'bash', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
568
568
  { method: 'shell', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
569
569
  { method: 'sh', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
570
- { method: 'spawn', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
570
+ // cognium-dev #187 Sprint 54: arg_positions [0, 1] so the JS shell-mode shape
571
+ // `spawn('sh', ['-c', tainted])` / `execFile('/bin/sh', ['-c', tainted])`
572
+ // surfaces taint at the argv-array position (arg[1]).
573
+ { method: 'spawn', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1] },
574
+ { method: 'spawnSync', languages: ['javascript', 'typescript'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1] },
575
+ { method: 'execFile', languages: ['javascript', 'typescript'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1] },
576
+ { method: 'execFileSync', languages: ['javascript', 'typescript'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1] },
571
577
  { method: 'fork', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
572
578
  { method: 'popen', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
573
579
  { method: 'system', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
580
+ // execa (npm) — parses tainted shell-style strings into program+argv;
581
+ // arg[0] is shell-injectable. cognium-dev #187 Sprint 54.
582
+ { method: 'command', class: 'execa', languages: ['javascript', 'typescript'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
583
+ { method: 'commandSync', class: 'execa', languages: ['javascript', 'typescript'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
574
584
  // Apache Commons Exec
575
585
  // Note: bare class 'Executor' removed (see comment above) — DefaultExecutor matched explicitly.
576
586
  { method: 'setCommandline', class: 'DefaultExecutor', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
@@ -1580,7 +1590,9 @@ export const DEFAULT_SINKS = [
1580
1590
  { method: 'aggregate', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0] },
1581
1591
  // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
1582
1592
  // class isn't statically known. Method-only entries restricted to Python.
1583
- // cognium-dev#104 Sprint 22.
1593
+ // cognium-dev#104 Sprint 22, #194 Sprint 54 added `find`/`aggregate`.
1594
+ { method: 'find', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0], languages: ['python'] },
1595
+ { method: 'aggregate', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0], languages: ['python'] },
1584
1596
  { method: 'find_one', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0], languages: ['python'] },
1585
1597
  { method: 'update_one', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0, 1], languages: ['python'] },
1586
1598
  { method: 'update_many', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0, 1], languages: ['python'] },
@@ -1592,21 +1604,32 @@ export const DEFAULT_SINKS = [
1592
1604
  { method: 'from_string', class: 'Template', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
1593
1605
  { method: 'Template', class: 'jinja2', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
1594
1606
  { method: 'Template', class: 'mako', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
1595
- // Python Log Injection
1596
- { method: 'info', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1597
- { method: 'warning', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1598
- { method: 'error', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1599
- { method: 'debug', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1600
- { method: 'critical', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1607
+ // Python Log Injection — cognium-dev #193: positions [0, 1, 2, 3, 4]
1608
+ // cover both the format string (arg 0) and Python `logging`'s positional
1609
+ // *args (1..N), which get rendered into the log line via `%` substitution
1610
+ // (e.g. `log.warning("user=%s", user)` taints via arg 1). Five-arg cap
1611
+ // matches the established explicit-enumeration pattern used elsewhere in
1612
+ // this file.
1613
+ { method: 'info', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1614
+ { method: 'warning', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1615
+ { method: 'warn', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1616
+ { method: 'error', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1617
+ { method: 'debug', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1618
+ { method: 'critical', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1619
+ { method: 'fatal', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1620
+ { method: 'exception', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1621
+ { method: 'log', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [1, 2, 3, 4] },
1601
1622
  // Python `logging` module top-level functions (e.g. logging.info(...))
1602
1623
  // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
1603
- { method: 'info', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1604
- { method: 'warning', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1605
- { method: 'error', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1606
- { method: 'debug', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1607
- { method: 'critical', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1608
- { method: 'log', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [1] },
1609
- { method: 'exception', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1624
+ { method: 'info', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1625
+ { method: 'warning', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1626
+ { method: 'warn', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1627
+ { method: 'error', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1628
+ { method: 'debug', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1629
+ { method: 'critical', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1630
+ { method: 'fatal', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1631
+ { method: 'log', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [1, 2, 3, 4] },
1632
+ { method: 'exception', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2, 3, 4] },
1610
1633
  // =========================================================================
1611
1634
  // Java CWE-Bench Enhancement Patterns (Collection/Builder)
1612
1635
  // =========================================================================