circle-ir 3.112.0 → 3.114.0

package/dist/browser/circle-ir.js

@@ -12140,6 +12140,11 @@ var DEFAULT_SINKS = [
   { method: "exec", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "compile", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "__import__", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Python dynamic import — `importlib.import_module(taint)` parallels Java's
+  // `Class.forName`. The bare `__import__` entry above also matches the
+  // `importlib.__import__` form because the sink-matcher is class-agnostic
+  // when a classless entry exists. Sprint 56 #183.
+  { method: "import_module", class: "importlib", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   // Python Deserialization — language-scoped so the lowercase `yaml` / `pickle`
   // module names don't collide with Java locals named `yaml` (SnakeYAML usage).
   { method: "loads", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
@@ -12397,6 +12402,15 @@ var DEFAULT_SINKS = [
   // Standard library logging
   { method: "println!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "eprintln!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
+  // log:: namespaced forms — the Rust macro extractor preserves the full
+  // path prefix in `method_name` (`log::info!`), so the bare entries above
+  // only match the imported form `use log::info; info!(...)`. Sprint 56 #182 Slice A.
+  { method: "log::info!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::warn!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::error!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::debug!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::trace!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::log!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
   // Rust sqlx SQL Injection
   { method: "query", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query_as", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -14549,7 +14563,12 @@ function canSourceReachSink(sourceType, sinkType) {
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf"],
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call"],
     http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment"],
-    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss"],
+    // ssrf added Sprint 57 #200: bash CGI/webhook handlers and scripts that
+    // take a URL on stdin or as a positional CLI arg (`curl "$1"`,
+    // `wget "$(read line)"`) and curl/wget it server-side are textbook SSRF
+    // (CVE-2022-41040 ProxyShell-class). Cross-language: `socket.urlopen(input())`
+    // (Python), `axios.get(readline())` (JS) etc. also benefit.
+    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection"],
     // Second-order injection
@@ -21742,20 +21761,24 @@ var BashPlugin = class extends BaseLanguagePlugin {
         severity: "medium",
         argPositions: [1]
       },
-      // SSRF — curl/wget with externally-controlled URL
+      // SSRF — curl/wget with externally-controlled URL.
+      // argPositions: [] (scan all args) — curl/wget invocations commonly
+      // interleave flags (`-s`, `-fsSL`, `-o file`) before the URL, so the
+      // URL position is unpredictable. Sprint 57 #200; mirrors Sprint 23
+      // exec.Command widening pattern.
       {
         method: "curl",
         type: "ssrf",
         cwe: "CWE-918",
         severity: "high",
-        argPositions: [0]
+        argPositions: []
       },
       {
         method: "wget",
         type: "ssrf",
         cwe: "CWE-918",
         severity: "high",
-        argPositions: [0]
+        argPositions: []
       },
       // File inclusion — `source` and POSIX `.` execute arbitrary shell code
       // from the file at the supplied path. With user-controlled input this is
@@ -24004,7 +24027,18 @@ var BASH_UNTRUSTED_ENV_PATTERNS = [
   /^CONTENT_LENGTH$/i,
   /^PATH_INFO$/i,
   /^SCRIPT_NAME$/i,
-  /^SERVER_NAME$/i
+  /^SERVER_NAME$/i,
+  // Sprint 57 #198: RPC/CMD/EXEC/EVAL/SHELL-class env vars seen in recent
+  // CVE intake (CVE-2025-67038 HTTP RPC pattern and similar). These names
+  // are conventionally used to pass attacker-controlled payloads into
+  // shell handlers via HTTP-to-CGI bridges.
+  /^RPC_/i,
+  /^XMLRPC/i,
+  /^JSONRPC/i,
+  /^CMD_/i,
+  /^EXEC_/i,
+  /^EVAL_/i,
+  /^SHELL_/i
 ];
 var BASH_NETWORK_COMMANDS = /* @__PURE__ */ new Set(["curl", "wget", "nc", "ncat"]);
 var BASH_FILE_COMMANDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "awk", "sed", "cut", "grep"]);
@@ -31325,6 +31359,9 @@ var PY_SECURE_TRUE_RE = /\bsecure\s*=\s*True\b/;
 var PY_HTTPONLY_TRUE_RE = /\bhttponly\s*=\s*True\b/i;
 var JAVA_SET_SECURE_TRUE_RE = /\.setSecure\s*\(\s*true\s*\)/;
 var JAVA_SET_HTTPONLY_TRUE_RE = /\.setHttpOnly\s*\(\s*true\s*\)/;
+var GO_SECURE_TRUE_RE = /\bSecure\s*:\s*true\b/;
+var GO_HTTPONLY_TRUE_RE = /\bHttpOnly\s*:\s*true\b/;
+var RUST_SET_COOKIE_MACRO_RE = /(format!|write!|writeln!)\s*\(([^()]*Set-Cookie[^()]*)\)/gis;
 var InsecureCookiePass = class {
   name = "insecure-cookie";
   category = "security";
@@ -31355,6 +31392,19 @@ var InsecureCookiePass = class {
         insecureCookies.push(det);
         this.emit(ctx, file, det, "java");
       }
+    } else if (language === "go") {
+      for (const call of graph.ir.calls) {
+        const det = this.detectGo(call);
+        if (!det) continue;
+        insecureCookies.push(det);
+        this.emit(ctx, file, det, "go");
+      }
+    } else if (language === "rust") {
+      const dets = this.detectRustSetCookieFormat(code);
+      for (const det of dets) {
+        insecureCookies.push(det);
+        this.emit(ctx, file, det, "rust");
+      }
     }
     return { insecureCookies };
   }
@@ -31414,11 +31464,60 @@ var InsecureCookiePass = class {
       optionsPresent: false
     };
   }
+  // ---------------- Go ----------------
+  detectGo(call) {
+    if (call.method_name !== "SetCookie") return null;
+    if ((call.receiver ?? "") !== "http") return null;
+    if (call.arguments.length < 2) return null;
+    const cookieArg = call.arguments.find((a) => a.position === 1);
+    const cookieExpr = (cookieArg?.expression ?? "").trim();
+    if (!cookieExpr.includes("{") || !cookieExpr.includes("}")) return null;
+    const missingSecure = !GO_SECURE_TRUE_RE.test(cookieExpr);
+    const missingHttpOnly = !GO_HTTPONLY_TRUE_RE.test(cookieExpr);
+    if (!missingSecure && !missingHttpOnly) return null;
+    return {
+      line: call.location.line,
+      receiver: "http.SetCookie",
+      missingSecure,
+      missingHttpOnly,
+      optionsPresent: true
+    };
+  }
+  // ---------------- Rust ----------------
+  detectRustSetCookieFormat(code) {
+    const out2 = [];
+    const re = new RegExp(RUST_SET_COOKIE_MACRO_RE.source, RUST_SET_COOKIE_MACRO_RE.flags);
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const macro = m[1] ?? "";
+      const body2 = m[2] ?? "";
+      const missingSecure = !/\bSecure\b/.test(body2);
+      const missingHttpOnly = !/\bHttpOnly\b/.test(body2);
+      if (!missingSecure && !missingHttpOnly) continue;
+      const line = code.slice(0, m.index).split("\n").length;
+      out2.push({
+        line,
+        receiver: macro,
+        missingSecure,
+        missingHttpOnly,
+        optionsPresent: true
+      });
+    }
+    return out2;
+  }
   emit(ctx, file, det, flavor) {
     const missing = [];
-    if (det.missingSecure) missing.push(flavor === "js" ? "`secure: true`" : flavor === "python" ? "`secure=True`" : "`setSecure(true)`");
-    if (det.missingHttpOnly) missing.push(flavor === "js" ? "`httpOnly: true`" : flavor === "python" ? "`httponly=True`" : "`setHttpOnly(true)`");
-    const fix = flavor === "js" ? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.' : flavor === "python" ? 'Pass `secure=True, httponly=True, samesite="Lax"` to `response.set_cookie(...)`.' : "After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response.";
+    if (det.missingSecure) {
+      missing.push(
+        flavor === "js" ? "`secure: true`" : flavor === "python" ? "`secure=True`" : flavor === "java" ? "`setSecure(true)`" : flavor === "go" ? "`Secure: true`" : "`Secure` attribute"
+      );
+    }
+    if (det.missingHttpOnly) {
+      missing.push(
+        flavor === "js" ? "`httpOnly: true`" : flavor === "python" ? "`httponly=True`" : flavor === "java" ? "`setHttpOnly(true)`" : flavor === "go" ? "`HttpOnly: true`" : "`HttpOnly` attribute"
+      );
+    }
+    const fix = flavor === "js" ? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.' : flavor === "python" ? 'Pass `secure=True, httponly=True, samesite="Lax"` to `response.set_cookie(...)`.' : flavor === "java" ? "After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response." : flavor === "go" ? "Set `Secure: true` and `HttpOnly: true` on the `http.Cookie` struct literal passed to `http.SetCookie`." : "Append `; Secure; HttpOnly` to the `Set-Cookie` header string.";
     ctx.addFinding({
       id: `${this.name}-${file}-${det.line}`,
       pass: this.name,

package/dist/core/circle-ir-core.cjs

@@ -11522,6 +11522,11 @@ var DEFAULT_SINKS = [
   { method: "exec", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "compile", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "__import__", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Python dynamic import — `importlib.import_module(taint)` parallels Java's
+  // `Class.forName`. The bare `__import__` entry above also matches the
+  // `importlib.__import__` form because the sink-matcher is class-agnostic
+  // when a classless entry exists. Sprint 56 #183.
+  { method: "import_module", class: "importlib", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   // Python Deserialization — language-scoped so the lowercase `yaml` / `pickle`
   // module names don't collide with Java locals named `yaml` (SnakeYAML usage).
   { method: "loads", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
@@ -11779,6 +11784,15 @@ var DEFAULT_SINKS = [
   // Standard library logging
   { method: "println!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "eprintln!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
+  // log:: namespaced forms — the Rust macro extractor preserves the full
+  // path prefix in `method_name` (`log::info!`), so the bare entries above
+  // only match the imported form `use log::info; info!(...)`. Sprint 56 #182 Slice A.
+  { method: "log::info!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::warn!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::error!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::debug!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::trace!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::log!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
   // Rust sqlx SQL Injection
   { method: "query", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query_as", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },

package/dist/core/circle-ir-core.js

@@ -11456,6 +11456,11 @@ var DEFAULT_SINKS = [
   { method: "exec", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "compile", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "__import__", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Python dynamic import — `importlib.import_module(taint)` parallels Java's
+  // `Class.forName`. The bare `__import__` entry above also matches the
+  // `importlib.__import__` form because the sink-matcher is class-agnostic
+  // when a classless entry exists. Sprint 56 #183.
+  { method: "import_module", class: "importlib", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   // Python Deserialization — language-scoped so the lowercase `yaml` / `pickle`
   // module names don't collide with Java locals named `yaml` (SnakeYAML usage).
   { method: "loads", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
@@ -11713,6 +11718,15 @@ var DEFAULT_SINKS = [
   // Standard library logging
   { method: "println!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "eprintln!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
+  // log:: namespaced forms — the Rust macro extractor preserves the full
+  // path prefix in `method_name` (`log::info!`), so the bare entries above
+  // only match the imported form `use log::info; info!(...)`. Sprint 56 #182 Slice A.
+  { method: "log::info!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::warn!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::error!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::debug!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::trace!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::log!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
   // Rust sqlx SQL Injection
   { method: "query", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query_as", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },

package/dist/languages/plugins/bash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bash.d.ts","sourceRoot":"","sources":["../../../src/languages/plugins/bash.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,qBAAa,UAAW,SAAQ,kBAAkB;IAChD,QAAQ,CAAC,EAAE,EAAG,MAAM,CAAU;IAC9B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,UAAU,WAAoC;IACvD,QAAQ,CAAC,QAAQ,2BAA2B;IAE5C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CA+BnC;IAEF;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS;IAIvE;;;;OAIG;IACH,iBAAiB,IAAI,kBAAkB,EAAE;IA6BzC;;;;OAIG;IACH,eAAe,IAAI,gBAAgB,EAAE;IAgJrC;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;IAInF;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAQ1C;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IAqBpD,YAAY,CAAC,QAAQ,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IAIrD,YAAY,CAAC,QAAQ,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IAIrD,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,UAAU,EAAE;IAIzD,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;CAGhE"}
+{"version":3,"file":"bash.d.ts","sourceRoot":"","sources":["../../../src/languages/plugins/bash.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,qBAAa,UAAW,SAAQ,kBAAkB;IAChD,QAAQ,CAAC,EAAE,EAAG,MAAM,CAAU;IAC9B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,UAAU,WAAoC;IACvD,QAAQ,CAAC,QAAQ,2BAA2B;IAE5C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CA+BnC;IAEF;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS;IAIvE;;;;OAIG;IACH,iBAAiB,IAAI,kBAAkB,EAAE;IA6BzC;;;;OAIG;IACH,eAAe,IAAI,gBAAgB,EAAE;IAoJrC;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;IAInF;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAQ1C;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IAqBpD,YAAY,CAAC,QAAQ,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IAIrD,YAAY,CAAC,QAAQ,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IAIrD,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,UAAU,EAAE;IAIzD,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;CAGhE"}

package/dist/languages/plugins/bash.js

@@ -187,20 +187,24 @@ export class BashPlugin extends BaseLanguagePlugin {
                 severity: 'medium',
                 argPositions: [1],
             },
-            // SSRF — curl/wget with externally-controlled URL
+            // SSRF — curl/wget with externally-controlled URL.
+            // argPositions: [] (scan all args) — curl/wget invocations commonly
+            // interleave flags (`-s`, `-fsSL`, `-o file`) before the URL, so the
+            // URL position is unpredictable. Sprint 57 #200; mirrors Sprint 23
+            // exec.Command widening pattern.
             {
                 method: 'curl',
                 type: 'ssrf',
                 cwe: 'CWE-918',
                 severity: 'high',
-                argPositions: [0],
+                argPositions: [],
             },
             {
                 method: 'wget',
                 type: 'ssrf',
                 cwe: 'CWE-918',
                 severity: 'high',
-                argPositions: [0],
+                argPositions: [],
             },
             // File inclusion — `source` and POSIX `.` execute arbitrary shell code
             // from the file at the supplied path. With user-controlled input this is

package/dist/languages/plugins/bash.js.map

@@ -1 +1 @@
-{"version":3,"file":"bash.js","sourceRoot":"","sources":["../../../src/languages/plugins/bash.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,kBAAkB;IACvC,EAAE,GAAG,MAAe,CAAC;IACrB,IAAI,GAAG,YAAY,CAAC;IACpB,UAAU,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,GAAG,uBAAuB,CAAC;IAEnC,SAAS,GAAsB;QACtC,6CAA6C;QAC7C,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE,EAAE;QACxB,eAAe,EAAE,EAAE;QACnB,mBAAmB,EAAE,CAAC,qBAAqB,CAAC;QAC5C,iBAAiB,EAAE,CAAC,qBAAqB,CAAC;QAE1C,8CAA8C;QAC9C,UAAU,EAAE,CAAC,SAAS,CAAC;QACvB,YAAY,EAAE,CAAC,SAAS,CAAC;QACzB,UAAU,EAAE,CAAC,qBAAqB,CAAC;QACnC,mBAAmB,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;QAEnE,6DAA6D;QAC7D,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QAEZ,yCAAyC;QACzC,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;QAEb,kEAAkE;QAClE,eAAe,EAAE,EAAE;QAEnB,eAAe;QACf,WAAW,EAAE,CAAC,cAAc,CAAC;QAC7B,YAAY,EAAE,CAAC,eAAe,EAAE,uBAAuB,CAAC;QACxD,cAAc,EAAE,CAAC,iBAAiB,CAAC;QACnC,YAAY,EAAE,EAAE;QAChB,eAAe,EAAE,EAAE;KACpB,CAAC;IAEF;;OAEG;IACH,eAAe,CAAC,QAA2B;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,iBAAiB;QACf,OAAO;YACL,6CAA6C;YAC7C;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD,qEAAqE;YACrE,yDAAyD;YACzD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;SACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,eAAe;QACb,OAAO;YACL,oCAAoC;YACpC;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,uDAAuD;YACvD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,mEAAmE;YACnE;gBACE,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,yDAAyD;YACzD;gBACE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,kDAAkD;YAClD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,uEAAuE;YACvE,yEAAyE;YACzE,mEAAmE;YACnE;gBACE,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAiB,EAAE,QAA2B;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB;QAC9B,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,QAAQ;YACtB,IAAI,CAAC,IAAI,KAAK,YAAY;YAC1B,IAAI,CAAC,IAAI,KAAK,eAAe,CAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAElD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,8CAA8C;QAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,6CAA6C;QAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,0CAA0C;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAE3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IAEtE,YAAY,CAAC,QAA2B;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,QAA2B;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,QAA2B;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,QAA2B;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"bash.js","sourceRoot":"","sources":["../../../src/languages/plugins/bash.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,kBAAkB;IACvC,EAAE,GAAG,MAAe,CAAC;IACrB,IAAI,GAAG,YAAY,CAAC;IACpB,UAAU,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,GAAG,uBAAuB,CAAC;IAEnC,SAAS,GAAsB;QACtC,6CAA6C;QAC7C,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE,EAAE;QACxB,eAAe,EAAE,EAAE;QACnB,mBAAmB,EAAE,CAAC,qBAAqB,CAAC;QAC5C,iBAAiB,EAAE,CAAC,qBAAqB,CAAC;QAE1C,8CAA8C;QAC9C,UAAU,EAAE,CAAC,SAAS,CAAC;QACvB,YAAY,EAAE,CAAC,SAAS,CAAC;QACzB,UAAU,EAAE,CAAC,qBAAqB,CAAC;QACnC,mBAAmB,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;QAEnE,6DAA6D;QAC7D,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QAEZ,yCAAyC;QACzC,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;QAEb,kEAAkE;QAClE,eAAe,EAAE,EAAE;QAEnB,eAAe;QACf,WAAW,EAAE,CAAC,cAAc,CAAC;QAC7B,YAAY,EAAE,CAAC,eAAe,EAAE,uBAAuB,CAAC;QACxD,cAAc,EAAE,CAAC,iBAAiB,CAAC;QACnC,YAAY,EAAE,EAAE;QAChB,eAAe,EAAE,EAAE;KACpB,CAAC;IAEF;;OAEG;IACH,eAAe,CAAC,QAA2B;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,iBAAiB;QACf,OAAO;YACL,6CAA6C;YAC7C;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD,qEAAqE;YACrE,yDAAyD;YACzD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;SACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,eAAe;QACb,OAAO;YACL,oCAAoC;YACpC;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,uDAAuD;YACvD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,mEAAmE;YACnE;gBACE,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,yDAAyD;YACzD;gBACE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,mDAAmD;YACnD,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,iCAAiC;YACjC;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,EAAE;aACjB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,EAAE;aACjB;YAED,uEAAuE;YACvE,yEAAyE;YACzE,mEAAmE;YACnE;gBACE,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAiB,EAAE,QAA2B;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB;QAC9B,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,QAAQ;YACtB,IAAI,CAAC,IAAI,KAAK,YAAY;YAC1B,IAAI,CAAC,IAAI,KAAK,eAAe,CAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAElD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,8CAA8C;QAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,6CAA6C;QAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,0CAA0C;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAE3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IAEtE,YAAY,CAAC,QAA2B;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,QAA2B;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,QAA2B;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,QAA2B;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.112.0",
+  "version": "3.114.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",