circle-ir 3.110.0 → 3.112.0

package/dist/core/circle-ir-core.cjs

@@ -10551,10 +10551,20 @@ var DEFAULT_SINKS = [
   { method: "bash", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "shell", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "sh", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "spawn", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // cognium-dev #187 Sprint 54: arg_positions [0, 1] so the JS shell-mode shape
+  // `spawn('sh', ['-c', tainted])` / `execFile('/bin/sh', ['-c', tainted])`
+  // surfaces taint at the argv-array position (arg[1]).
+  { method: "spawn", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "spawnSync", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "execFile", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "execFileSync", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "fork", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "popen", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "system", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // execa (npm) — parses tainted shell-style strings into program+argv;
+  // arg[0] is shell-injectable. cognium-dev #187 Sprint 54.
+  { method: "command", class: "execa", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  { method: "commandSync", class: "execa", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // Apache Commons Exec
   // Note: bare class 'Executor' removed (see comment above) — DefaultExecutor matched explicitly.
   { method: "setCommandline", class: "DefaultExecutor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
@@ -11320,8 +11330,27 @@ var DEFAULT_SINKS = [
   // SQL query calls are covered by class-specific patterns above (Connection, Pool, Client, JdbcTemplate)
   // Note: `raw` is shared with Python (Django ORM) — scoped to JS+TS to avoid leaking.
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // sqlite3 (npm) — Database/Statement methods. The JS plugin resolves
+  // `const db = new sqlite3.Database(...); db.all(sql)` to the resolution
+  // target `Connection.all`, so class-scoped patterns matching `Connection`
+  // hit (see #186 Sprint 55 matcher extension consulting call.resolution.target).
+  // `exec`/`run`/`all`/`get`/`each` follow the same shape.
+  { method: "all", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "run", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
+  // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
+  // These methods explicitly bypass Angular's built-in sanitizer; passing
+  // tainted strings re-introduces DOM-injection risk. Distinctive method
+  // names — classless + language-scoped is safe.
+  { method: "bypassSecurityTrustHtml", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustScript", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustStyle", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustUrl", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustResourceUrl", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Express.js XSS (response methods)
   { method: "send", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -11334,6 +11363,19 @@ var DEFAULT_SINKS = [
   { method: "runInContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInNewContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInThisContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
+  // `new vm.Script(taint)` — Node core `vm` module compiles strings. The
+  // JS plugin emits method_name = 'vm.Script' for the constructor call;
+  // the matcher's dotted-simple-name fallback (taint-matcher.ts:1664) lets
+  // pattern.method = 'Script' hit on method_name = 'vm.Script'. The
+  // `class: 'constructor'` short-circuit accepts the no-receiver shape.
+  // (#188 Sprint 55)
+  { method: "Script", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // `setImmediate(taintedString)` — like setTimeout/setInterval, Node will
+  // evaluate the first argument when it is a string. The callback-shape
+  // suppression in taint-matcher.ts:1342 already covers setTimeout/
+  // setInterval; the Sprint 55 fix extends that gate to setImmediate too.
+  // (#188 Sprint 55)
+  { method: "setImmediate", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // protobufjs Root.parse(schemaText) compiles a textual schema into JS at runtime;
   // tainted schema → code execution (CVE-2026-41242). Issue #94.
   { method: "parse", class: "protobuf", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -11396,6 +11438,14 @@ var DEFAULT_SINKS = [
   // got library
   { method: "get", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // got/request npm packages default-export a callable function:
+  //   const got = require('got'); got(req.query.url)
+  //   const request = require('request'); request(req.query.url, cb)
+  // The classless method names are distinctive enough (`got`, `request`) that
+  // the FP risk is acceptable; both are scoped to JS/TS so they don't leak
+  // into other plugins. (#185 Sprint 55)
+  { method: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "request", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // superagent
   { method: "get", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
@@ -11565,7 +11615,9 @@ var DEFAULT_SINKS = [
   { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
   // class isn't statically known. Method-only entries restricted to Python.
-  // cognium-dev#104 Sprint 22.
+  // cognium-dev#104 Sprint 22, #194 Sprint 54 added `find`/`aggregate`.
+  { method: "find", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "aggregate", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "find_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "update_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
   { method: "update_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
@@ -12145,10 +12197,50 @@ var PYTHON_TAINTED_PATTERNS = [
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
-  const sinks = findSinks(calls, config.sinks, typeHierarchy, language, sourceLines);
+  const sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
+function expandPromisifyAliases(patterns, sourceLines, language) {
+  if (!sourceLines || sourceLines.length === 0) return patterns;
+  if (language !== "javascript" && language !== "typescript") return patterns;
+  const PROMISIFY_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:util\s*\.\s*)?promisify\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
+  const innerToPattern = /* @__PURE__ */ new Map();
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language)) continue;
+    if (p.class !== void 0) continue;
+    if (!innerToPattern.has(p.method)) innerToPattern.set(p.method, p);
+  }
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language)) continue;
+    if (innerToPattern.has(p.method)) continue;
+    innerToPattern.set(p.method, p);
+  }
+  const aliasPatterns = [];
+  const seenAliases = /* @__PURE__ */ new Set();
+  for (const line of sourceLines) {
+    const m = PROMISIFY_RE.exec(line);
+    if (!m) continue;
+    const aliasName = m[1];
+    const innerName = m[2];
+    if (!aliasName || !innerName) continue;
+    if (seenAliases.has(aliasName)) continue;
+    const template = innerToPattern.get(innerName);
+    if (!template) continue;
+    seenAliases.add(aliasName);
+    aliasPatterns.push({
+      method: aliasName,
+      type: template.type,
+      cwe: template.cwe,
+      severity: template.severity,
+      arg_positions: template.arg_positions,
+      languages: [language],
+      note: `util.promisify alias of ${innerName} \u2014 cognium-dev #187`
+    });
+  }
+  return aliasPatterns.length === 0 ? patterns : patterns.concat(aliasPatterns);
+}
 function attachSourceLineCode(sources, sinks, code) {
   const lines = code.split("\n");
   for (const s of sources) {
@@ -12514,6 +12606,41 @@ function isSafeGoExecCommandCall(call, pattern, language) {
   if (SHELL_PROGRAMS.has(program)) return false;
   return true;
 }
+function isSafeJSChildProcessCall(call, pattern, language) {
+  if (language !== "javascript" && language !== "typescript") return false;
+  if (pattern.type !== "command_injection") return false;
+  const m = call.method_name;
+  if (m !== "spawn" && m !== "spawnSync" && m !== "execFile" && m !== "execFileSync") return false;
+  const programArg = call.arguments.find((a) => a.position === 0);
+  if (!programArg) return false;
+  let program;
+  if (programArg.literal !== null && programArg.literal !== void 0) {
+    program = String(programArg.literal).split("/").pop() ?? String(programArg.literal);
+  } else {
+    const expr = (programArg.expression ?? "").trim();
+    if (!(expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'"))) {
+      return false;
+    }
+    const stripped = expr.slice(1, -1);
+    program = stripped.split("/").pop() ?? stripped;
+  }
+  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ash",
+    "ksh",
+    "cmd",
+    "cmd.exe",
+    "powershell",
+    "pwsh",
+    "powershell.exe",
+    "pwsh.exe"
+  ]);
+  if (SHELL_PROGRAMS.has(program)) return false;
+  return true;
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
@@ -12728,6 +12855,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeRustCommandCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeJSChildProcessCall(call, pattern, language)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }
@@ -12743,7 +12873,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             }
           }
         }
-        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout")) {
+        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout" || call.method_name === "setImmediate")) {
           const firstArg = call.arguments.find((a) => a.position === 0);
           if (firstArg && isFunctionCallbackArgument(firstArg)) {
             continue;
@@ -13060,6 +13190,11 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
+      const resolvedTarget = call.resolution?.target;
+      const expectedClassMethodTail = `${pattern.class}.${pattern.method}`;
+      if (resolvedTarget && (resolvedTarget === expectedClassMethodTail || resolvedTarget.endsWith("." + expectedClassMethodTail))) {
+        return true;
+      }
       if (pattern.allow_unresolved_receiver && !call.receiver_type && !call.receiver_type_fqn && call.receiver.includes(".")) {
         return true;
       }

package/dist/core/circle-ir-core.js

@@ -10485,10 +10485,20 @@ var DEFAULT_SINKS = [
   { method: "bash", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "shell", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "sh", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "spawn", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // cognium-dev #187 Sprint 54: arg_positions [0, 1] so the JS shell-mode shape
+  // `spawn('sh', ['-c', tainted])` / `execFile('/bin/sh', ['-c', tainted])`
+  // surfaces taint at the argv-array position (arg[1]).
+  { method: "spawn", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "spawnSync", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "execFile", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "execFileSync", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "fork", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "popen", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "system", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // execa (npm) — parses tainted shell-style strings into program+argv;
+  // arg[0] is shell-injectable. cognium-dev #187 Sprint 54.
+  { method: "command", class: "execa", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  { method: "commandSync", class: "execa", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // Apache Commons Exec
   // Note: bare class 'Executor' removed (see comment above) — DefaultExecutor matched explicitly.
   { method: "setCommandline", class: "DefaultExecutor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
@@ -11254,8 +11264,27 @@ var DEFAULT_SINKS = [
   // SQL query calls are covered by class-specific patterns above (Connection, Pool, Client, JdbcTemplate)
   // Note: `raw` is shared with Python (Django ORM) — scoped to JS+TS to avoid leaking.
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // sqlite3 (npm) — Database/Statement methods. The JS plugin resolves
+  // `const db = new sqlite3.Database(...); db.all(sql)` to the resolution
+  // target `Connection.all`, so class-scoped patterns matching `Connection`
+  // hit (see #186 Sprint 55 matcher extension consulting call.resolution.target).
+  // `exec`/`run`/`all`/`get`/`each` follow the same shape.
+  { method: "all", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "run", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
+  // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
+  // These methods explicitly bypass Angular's built-in sanitizer; passing
+  // tainted strings re-introduces DOM-injection risk. Distinctive method
+  // names — classless + language-scoped is safe.
+  { method: "bypassSecurityTrustHtml", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustScript", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustStyle", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustUrl", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustResourceUrl", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Express.js XSS (response methods)
   { method: "send", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -11268,6 +11297,19 @@ var DEFAULT_SINKS = [
   { method: "runInContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInNewContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInThisContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
+  // `new vm.Script(taint)` — Node core `vm` module compiles strings. The
+  // JS plugin emits method_name = 'vm.Script' for the constructor call;
+  // the matcher's dotted-simple-name fallback (taint-matcher.ts:1664) lets
+  // pattern.method = 'Script' hit on method_name = 'vm.Script'. The
+  // `class: 'constructor'` short-circuit accepts the no-receiver shape.
+  // (#188 Sprint 55)
+  { method: "Script", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // `setImmediate(taintedString)` — like setTimeout/setInterval, Node will
+  // evaluate the first argument when it is a string. The callback-shape
+  // suppression in taint-matcher.ts:1342 already covers setTimeout/
+  // setInterval; the Sprint 55 fix extends that gate to setImmediate too.
+  // (#188 Sprint 55)
+  { method: "setImmediate", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // protobufjs Root.parse(schemaText) compiles a textual schema into JS at runtime;
   // tainted schema → code execution (CVE-2026-41242). Issue #94.
   { method: "parse", class: "protobuf", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -11330,6 +11372,14 @@ var DEFAULT_SINKS = [
   // got library
   { method: "get", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // got/request npm packages default-export a callable function:
+  //   const got = require('got'); got(req.query.url)
+  //   const request = require('request'); request(req.query.url, cb)
+  // The classless method names are distinctive enough (`got`, `request`) that
+  // the FP risk is acceptable; both are scoped to JS/TS so they don't leak
+  // into other plugins. (#185 Sprint 55)
+  { method: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "request", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // superagent
   { method: "get", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
@@ -11499,7 +11549,9 @@ var DEFAULT_SINKS = [
   { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
   // class isn't statically known. Method-only entries restricted to Python.
-  // cognium-dev#104 Sprint 22.
+  // cognium-dev#104 Sprint 22, #194 Sprint 54 added `find`/`aggregate`.
+  { method: "find", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "aggregate", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "find_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "update_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
   { method: "update_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
@@ -12079,10 +12131,50 @@ var PYTHON_TAINTED_PATTERNS = [
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
-  const sinks = findSinks(calls, config.sinks, typeHierarchy, language, sourceLines);
+  const sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
+function expandPromisifyAliases(patterns, sourceLines, language) {
+  if (!sourceLines || sourceLines.length === 0) return patterns;
+  if (language !== "javascript" && language !== "typescript") return patterns;
+  const PROMISIFY_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:util\s*\.\s*)?promisify\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
+  const innerToPattern = /* @__PURE__ */ new Map();
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language)) continue;
+    if (p.class !== void 0) continue;
+    if (!innerToPattern.has(p.method)) innerToPattern.set(p.method, p);
+  }
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language)) continue;
+    if (innerToPattern.has(p.method)) continue;
+    innerToPattern.set(p.method, p);
+  }
+  const aliasPatterns = [];
+  const seenAliases = /* @__PURE__ */ new Set();
+  for (const line of sourceLines) {
+    const m = PROMISIFY_RE.exec(line);
+    if (!m) continue;
+    const aliasName = m[1];
+    const innerName = m[2];
+    if (!aliasName || !innerName) continue;
+    if (seenAliases.has(aliasName)) continue;
+    const template = innerToPattern.get(innerName);
+    if (!template) continue;
+    seenAliases.add(aliasName);
+    aliasPatterns.push({
+      method: aliasName,
+      type: template.type,
+      cwe: template.cwe,
+      severity: template.severity,
+      arg_positions: template.arg_positions,
+      languages: [language],
+      note: `util.promisify alias of ${innerName} \u2014 cognium-dev #187`
+    });
+  }
+  return aliasPatterns.length === 0 ? patterns : patterns.concat(aliasPatterns);
+}
 function attachSourceLineCode(sources, sinks, code) {
   const lines = code.split("\n");
   for (const s of sources) {
@@ -12448,6 +12540,41 @@ function isSafeGoExecCommandCall(call, pattern, language) {
   if (SHELL_PROGRAMS.has(program)) return false;
   return true;
 }
+function isSafeJSChildProcessCall(call, pattern, language) {
+  if (language !== "javascript" && language !== "typescript") return false;
+  if (pattern.type !== "command_injection") return false;
+  const m = call.method_name;
+  if (m !== "spawn" && m !== "spawnSync" && m !== "execFile" && m !== "execFileSync") return false;
+  const programArg = call.arguments.find((a) => a.position === 0);
+  if (!programArg) return false;
+  let program;
+  if (programArg.literal !== null && programArg.literal !== void 0) {
+    program = String(programArg.literal).split("/").pop() ?? String(programArg.literal);
+  } else {
+    const expr = (programArg.expression ?? "").trim();
+    if (!(expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'"))) {
+      return false;
+    }
+    const stripped = expr.slice(1, -1);
+    program = stripped.split("/").pop() ?? stripped;
+  }
+  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ash",
+    "ksh",
+    "cmd",
+    "cmd.exe",
+    "powershell",
+    "pwsh",
+    "powershell.exe",
+    "pwsh.exe"
+  ]);
+  if (SHELL_PROGRAMS.has(program)) return false;
+  return true;
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
@@ -12662,6 +12789,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeRustCommandCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeJSChildProcessCall(call, pattern, language)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }
@@ -12677,7 +12807,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             }
           }
         }
-        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout")) {
+        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout" || call.method_name === "setImmediate")) {
           const firstArg = call.arguments.find((a) => a.position === 0);
           if (firstArg && isFunctionCallbackArgument(firstArg)) {
             continue;
@@ -12994,6 +13124,11 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
+      const resolvedTarget = call.resolution?.target;
+      const expectedClassMethodTail = `${pattern.class}.${pattern.method}`;
+      if (resolvedTarget && (resolvedTarget === expectedClassMethodTail || resolvedTarget.endsWith("." + expectedClassMethodTail))) {
+        return true;
+      }
       if (pattern.allow_unresolved_receiver && !call.receiver_type && !call.receiver_type_fqn && call.receiver.includes(".")) {
         return true;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.110.0",
+  "version": "3.112.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",