circle-ir 3.115.0 → 3.117.0

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAokDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+QhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAokDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA6RhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -2037,6 +2037,14 @@ export const DEFAULT_SANITIZERS = [
     { method: 'escapeshellcmd', removes: ['command_injection'] },
     // Deserialization
     { method: 'setObjectInputFilter', class: 'ObjectInputStream', removes: ['deserialization'] },
+    // Regex consumption — passing tainted text to a compiled `Pattern.matcher()`
+    // does not constitute a wrong-sphere escape: the matcher walks the string
+    // in-process and produces match-state (booleans, captured groups, counts),
+    // not a network/file/process exit. Class-agnostic so it covers receivers
+    // that are Pattern-typed variables (e.g. `DIGITS.matcher(text)`). Sprint 60
+    // (#113 FP-52). Note: this only suppresses the synthetic CWE-668 fallback;
+    // real injection sinks downstream of the matched text still apply.
+    { method: 'matcher', removes: ['external_taint_escape'] },
     // =========================================================================
     // Node.js / JavaScript Sanitizers
     // =========================================================================
@@ -2072,7 +2080,12 @@ export const DEFAULT_SANITIZERS = [
     { method: 'contains', removes: ['external_taint_escape'] },
     { method: 'indexOf', removes: ['external_taint_escape'] },
     // Path sanitization
-    { method: 'basename', class: 'path', removes: ['path_traversal'] },
+    // Sprint 60 (#113 FP-46): include external_taint_escape — `path.basename()`
+    // strips directory components and returns only the leaf filename, so a
+    // tainted-but-basenamed value can no longer carry a traversal payload into
+    // a downstream `fs.open*` / `fs.write*` call. Mirrors Go `filepath.Base`
+    // (line 2187) which already includes external_taint_escape.
+    { method: 'basename', class: 'path', removes: ['path_traversal', 'external_taint_escape'] },
     { method: 'normalize', class: 'path', removes: ['path_traversal'] },
     { method: 'resolve', class: 'path', removes: ['path_traversal'] },
     // SQL - parameterized queries (mysql, pg)