circle-ir 3.110.0 → 3.111.0

package/dist/core/circle-ir-core.js

@@ -10485,10 +10485,20 @@ var DEFAULT_SINKS = [
   { method: "bash", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "shell", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "sh", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "spawn", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // cognium-dev #187 Sprint 54: arg_positions [0, 1] so the JS shell-mode shape
+  // `spawn('sh', ['-c', tainted])` / `execFile('/bin/sh', ['-c', tainted])`
+  // surfaces taint at the argv-array position (arg[1]).
+  { method: "spawn", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "spawnSync", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "execFile", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "execFileSync", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "fork", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "popen", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "system", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // execa (npm) — parses tainted shell-style strings into program+argv;
+  // arg[0] is shell-injectable. cognium-dev #187 Sprint 54.
+  { method: "command", class: "execa", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  { method: "commandSync", class: "execa", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // Apache Commons Exec
   // Note: bare class 'Executor' removed (see comment above) — DefaultExecutor matched explicitly.
   { method: "setCommandline", class: "DefaultExecutor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
@@ -11499,7 +11509,9 @@ var DEFAULT_SINKS = [
   { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
   // class isn't statically known. Method-only entries restricted to Python.
-  // cognium-dev#104 Sprint 22.
+  // cognium-dev#104 Sprint 22, #194 Sprint 54 added `find`/`aggregate`.
+  { method: "find", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "aggregate", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "find_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "update_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
   { method: "update_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
@@ -12079,10 +12091,50 @@ var PYTHON_TAINTED_PATTERNS = [
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
-  const sinks = findSinks(calls, config.sinks, typeHierarchy, language, sourceLines);
+  const sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
+function expandPromisifyAliases(patterns, sourceLines, language) {
+  if (!sourceLines || sourceLines.length === 0) return patterns;
+  if (language !== "javascript" && language !== "typescript") return patterns;
+  const PROMISIFY_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:util\s*\.\s*)?promisify\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
+  const innerToPattern = /* @__PURE__ */ new Map();
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language)) continue;
+    if (p.class !== void 0) continue;
+    if (!innerToPattern.has(p.method)) innerToPattern.set(p.method, p);
+  }
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language)) continue;
+    if (innerToPattern.has(p.method)) continue;
+    innerToPattern.set(p.method, p);
+  }
+  const aliasPatterns = [];
+  const seenAliases = /* @__PURE__ */ new Set();
+  for (const line of sourceLines) {
+    const m = PROMISIFY_RE.exec(line);
+    if (!m) continue;
+    const aliasName = m[1];
+    const innerName = m[2];
+    if (!aliasName || !innerName) continue;
+    if (seenAliases.has(aliasName)) continue;
+    const template = innerToPattern.get(innerName);
+    if (!template) continue;
+    seenAliases.add(aliasName);
+    aliasPatterns.push({
+      method: aliasName,
+      type: template.type,
+      cwe: template.cwe,
+      severity: template.severity,
+      arg_positions: template.arg_positions,
+      languages: [language],
+      note: `util.promisify alias of ${innerName} \u2014 cognium-dev #187`
+    });
+  }
+  return aliasPatterns.length === 0 ? patterns : patterns.concat(aliasPatterns);
+}
 function attachSourceLineCode(sources, sinks, code) {
   const lines = code.split("\n");
   for (const s of sources) {
@@ -12448,6 +12500,41 @@ function isSafeGoExecCommandCall(call, pattern, language) {
   if (SHELL_PROGRAMS.has(program)) return false;
   return true;
 }
+function isSafeJSChildProcessCall(call, pattern, language) {
+  if (language !== "javascript" && language !== "typescript") return false;
+  if (pattern.type !== "command_injection") return false;
+  const m = call.method_name;
+  if (m !== "spawn" && m !== "spawnSync" && m !== "execFile" && m !== "execFileSync") return false;
+  const programArg = call.arguments.find((a) => a.position === 0);
+  if (!programArg) return false;
+  let program;
+  if (programArg.literal !== null && programArg.literal !== void 0) {
+    program = String(programArg.literal).split("/").pop() ?? String(programArg.literal);
+  } else {
+    const expr = (programArg.expression ?? "").trim();
+    if (!(expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'"))) {
+      return false;
+    }
+    const stripped = expr.slice(1, -1);
+    program = stripped.split("/").pop() ?? stripped;
+  }
+  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ash",
+    "ksh",
+    "cmd",
+    "cmd.exe",
+    "powershell",
+    "pwsh",
+    "powershell.exe",
+    "pwsh.exe"
+  ]);
+  if (SHELL_PROGRAMS.has(program)) return false;
+  return true;
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
@@ -12662,6 +12749,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeRustCommandCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeJSChildProcessCall(call, pattern, language)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.110.0",
+  "version": "3.111.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",