circle-ir 3.110.0 → 3.112.0

package/configs/sinks/nodejs.json

@@ -94,6 +94,24 @@
       "arg_positions": [0],
       "note": "Fork new Node.js process"
     },
+    {
+      "method": "command",
+      "class": "execa",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "execa.command(taintedString) — parses string into program+argv; tainted arg is shell-injectable. cognium-dev #187 Sprint 54."
+    },
+    {
+      "method": "commandSync",
+      "class": "execa",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "execa.commandSync(taintedString) — synchronous variant of execa.command."
+    },
     {
       "method": "query",
       "class": "mysql",

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA+/CtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+QhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAsjDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+QhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -567,10 +567,20 @@ export const DEFAULT_SINKS = [
     { method: 'bash', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
     { method: 'shell', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
     { method: 'sh', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
-    { method: 'spawn', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
+    // cognium-dev #187 Sprint 54: arg_positions [0, 1] so the JS shell-mode shape
+    // `spawn('sh', ['-c', tainted])` / `execFile('/bin/sh', ['-c', tainted])`
+    // surfaces taint at the argv-array position (arg[1]).
+    { method: 'spawn', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1] },
+    { method: 'spawnSync', languages: ['javascript', 'typescript'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1] },
+    { method: 'execFile', languages: ['javascript', 'typescript'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1] },
+    { method: 'execFileSync', languages: ['javascript', 'typescript'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1] },
     { method: 'fork', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
     { method: 'popen', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
     { method: 'system', languages: ['java', 'javascript', 'typescript', 'python', 'go', 'rust'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
+    // execa (npm) — parses tainted shell-style strings into program+argv;
+    // arg[0] is shell-injectable. cognium-dev #187 Sprint 54.
+    { method: 'command', class: 'execa', languages: ['javascript', 'typescript'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
+    { method: 'commandSync', class: 'execa', languages: ['javascript', 'typescript'], type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
     // Apache Commons Exec
     // Note: bare class 'Executor' removed (see comment above) — DefaultExecutor matched explicitly.
     { method: 'setCommandline', class: 'DefaultExecutor', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
@@ -1335,8 +1345,27 @@ export const DEFAULT_SINKS = [
     // SQL query calls are covered by class-specific patterns above (Connection, Pool, Client, JdbcTemplate)
     // Note: `raw` is shared with Python (Django ORM) — scoped to JS+TS to avoid leaking.
     { method: 'raw', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    // sqlite3 (npm) — Database/Statement methods. The JS plugin resolves
+    // `const db = new sqlite3.Database(...); db.all(sql)` to the resolution
+    // target `Connection.all`, so class-scoped patterns matching `Connection`
+    // hit (see #186 Sprint 55 matcher extension consulting call.resolution.target).
+    // `exec`/`run`/`all`/`get`/`each` follow the same shape.
+    { method: 'all', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
+    { method: 'run', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
+    { method: 'each', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
+    { method: 'get', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
+    { method: 'exec', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
     // Browser DOM XSS sinks
     { method: 'setAttribute', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [1] },
+    // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
+    // These methods explicitly bypass Angular's built-in sanitizer; passing
+    // tainted strings re-introduces DOM-injection risk. Distinctive method
+    // names — classless + language-scoped is safe.
+    { method: 'bypassSecurityTrustHtml', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    { method: 'bypassSecurityTrustScript', type: 'xss', cwe: 'CWE-79', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    { method: 'bypassSecurityTrustStyle', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    { method: 'bypassSecurityTrustUrl', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    { method: 'bypassSecurityTrustResourceUrl', type: 'xss', cwe: 'CWE-79', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
     // Express.js XSS (response methods)
     { method: 'send', class: 'Response', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
     { method: 'write', class: 'Response', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
@@ -1349,6 +1378,19 @@ export const DEFAULT_SINKS = [
     { method: 'runInContext', class: 'vm', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
     { method: 'runInNewContext', class: 'vm', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
     { method: 'runInThisContext', class: 'vm', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
+    // `new vm.Script(taint)` — Node core `vm` module compiles strings. The
+    // JS plugin emits method_name = 'vm.Script' for the constructor call;
+    // the matcher's dotted-simple-name fallback (taint-matcher.ts:1664) lets
+    // pattern.method = 'Script' hit on method_name = 'vm.Script'. The
+    // `class: 'constructor'` short-circuit accepts the no-receiver shape.
+    // (#188 Sprint 55)
+    { method: 'Script', class: 'constructor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    // `setImmediate(taintedString)` — like setTimeout/setInterval, Node will
+    // evaluate the first argument when it is a string. The callback-shape
+    // suppression in taint-matcher.ts:1342 already covers setTimeout/
+    // setInterval; the Sprint 55 fix extends that gate to setImmediate too.
+    // (#188 Sprint 55)
+    { method: 'setImmediate', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
     // protobufjs Root.parse(schemaText) compiles a textual schema into JS at runtime;
     // tainted schema → code execution (CVE-2026-41242). Issue #94.
     { method: 'parse', class: 'protobuf', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
@@ -1411,6 +1453,14 @@ export const DEFAULT_SINKS = [
     // got library
     { method: 'get', class: 'got', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'post', class: 'got', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
+    // got/request npm packages default-export a callable function:
+    //   const got = require('got'); got(req.query.url)
+    //   const request = require('request'); request(req.query.url, cb)
+    // The classless method names are distinctive enough (`got`, `request`) that
+    // the FP risk is acceptable; both are scoped to JS/TS so they don't leak
+    // into other plugins. (#185 Sprint 55)
+    { method: 'got', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    { method: 'request', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
     // superagent
     { method: 'get', class: 'superagent', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'post', class: 'superagent', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
@@ -1580,7 +1630,9 @@ export const DEFAULT_SINKS = [
     { method: 'aggregate', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0] },
     // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
     // class isn't statically known. Method-only entries restricted to Python.
-    // cognium-dev#104 Sprint 22.
+    // cognium-dev#104 Sprint 22, #194 Sprint 54 added `find`/`aggregate`.
+    { method: 'find', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'aggregate', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0], languages: ['python'] },
     { method: 'find_one', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0], languages: ['python'] },
     { method: 'update_one', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0, 1], languages: ['python'] },
     { method: 'update_many', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0, 1], languages: ['python'] },