circle-ir 3.115.0 → 3.117.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/config-loader.d.ts.map +1 -1
- package/dist/analysis/config-loader.js +14 -1
- package/dist/analysis/config-loader.js.map +1 -1
- package/dist/analysis/passes/unrestricted-file-upload-pass.d.ts +1 -0
- package/dist/analysis/passes/unrestricted-file-upload-pass.d.ts.map +1 -1
- package/dist/analysis/passes/unrestricted-file-upload-pass.js +18 -0
- package/dist/analysis/passes/unrestricted-file-upload-pass.js.map +1 -1
- package/dist/browser/circle-ir.js +27 -1
- package/dist/core/circle-ir-core.cjs +14 -1
- package/dist/core/circle-ir-core.js +14 -1
- package/package.json +1 -1
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
* Java (Spring MultipartFile / Servlet Part):
|
|
10
10
|
* - `file.transferTo(new File(dir, file.getOriginalFilename()))`
|
|
11
11
|
* - `Files.copy(part.getInputStream(), Path.of(dir, part.getSubmittedFileName()))`
|
|
12
|
+
* - `part.write(dir + part.getSubmittedFileName())` (Servlet 3.0 Part.write)
|
|
12
13
|
* - Without preceding `ALLOWED_*.contains(ext)` or
|
|
13
14
|
* `FilenameUtils.getExtension(name)` + check.
|
|
14
15
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unrestricted-file-upload-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unrestricted-file-upload-pass.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"unrestricted-file-upload-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unrestricted-file-upload-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AA2BD,qBAAa,0BAA2B,YAAW,YAAY,CAAC,4BAA4B,CAAC;IAC3F,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,4BAA4B;IAyInD,OAAO,CAAC,IAAI;CAgCb"}
|
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
* Java (Spring MultipartFile / Servlet Part):
|
|
10
10
|
* - `file.transferTo(new File(dir, file.getOriginalFilename()))`
|
|
11
11
|
* - `Files.copy(part.getInputStream(), Path.of(dir, part.getSubmittedFileName()))`
|
|
12
|
+
* - `part.write(dir + part.getSubmittedFileName())` (Servlet 3.0 Part.write)
|
|
12
13
|
* - Without preceding `ALLOWED_*.contains(ext)` or
|
|
13
14
|
* `FilenameUtils.getExtension(name)` + check.
|
|
14
15
|
*
|
|
@@ -97,6 +98,23 @@ export class UnrestrictedFileUploadPass {
|
|
|
97
98
|
this.emit(ctx, findings, file, call.location.line, language, 'Files.copy(input, Path.of(dir, <original filename>))');
|
|
98
99
|
}
|
|
99
100
|
}
|
|
101
|
+
// Servlet 3.0 Part.write(filename) — Sprint 59 #201.
|
|
102
|
+
// Receiver is usually a Part variable; we cannot rely on receiver-type
|
|
103
|
+
// resolution here, so we use the call-shape heuristic: method is
|
|
104
|
+
// `write` AND at least one arg expression references an upload-name
|
|
105
|
+
// accessor. Distinct from Java's Files.write (Files receiver) and
|
|
106
|
+
// FilePath.write (Jenkins) which use different sink wiring.
|
|
107
|
+
if (m === 'write' && callHasUploadName(call)) {
|
|
108
|
+
const rec = call.receiver ?? '';
|
|
109
|
+
// Exclude Files.write / FilePath.write which are pre-existing
|
|
110
|
+
// path_traversal sinks; only fire on plain-variable receivers
|
|
111
|
+
// (typical for `part.write(...)`).
|
|
112
|
+
if (rec === 'Files' || rec === 'FilePath' || rec.endsWith('.Files'))
|
|
113
|
+
continue;
|
|
114
|
+
if (inSafeRange(call.location.line))
|
|
115
|
+
continue;
|
|
116
|
+
this.emit(ctx, findings, file, call.location.line, language, 'Part.write(<dir> + <original filename>)');
|
|
117
|
+
}
|
|
100
118
|
}
|
|
101
119
|
}
|
|
102
120
|
if (language === 'javascript' || language === 'typescript') {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unrestricted-file-upload-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/unrestricted-file-upload-pass.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"unrestricted-file-upload-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/unrestricted-file-upload-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AASH,qEAAqE;AACrE,MAAM,cAAc,GAClB,8HAA8H,CAAC;AAEjI,qFAAqF;AACrF,MAAM,iBAAiB,GACrB,yKAAyK,CAAC;AAE5K,SAAS,UAAU,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAe;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAc;IACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,wDAAwD;IACxD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,0BAA0B;IAC5B,IAAI,GAAG,0BAA0B,CAAC;IAClC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAA6C,EAAE,CAAC;QAE9D,sEAAsE;QACtE,0EAA0E;QAC1E,cAAc;QACd,MAAM,kBAAkB,GAA0C,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACxD,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjC,kBAAkB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE;YAC5C,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;gBACnC,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;YACpD,CAAC;YACD,0EAA0E;YAC1E,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC,CAAC;QAEF,6EAA6E;QAE7E,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;gBACjC,uBAAuB;gBACvB,IAAI,CAAC,KAAK,YAAY,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClD,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EACjD,+CAA+C,CAAC,CAAC;oBAC3D,SAAS;gBACX,CAAC;gBACD,gEAAgE;gBAChE,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;oBAC5F,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC5B,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;4BAAE,SAAS;wBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EACjD,sDAAsD,CAAC,CAAC;oBACpE,CAAC;gBACH,CAAC;gBACD,qDAAqD;gBACrD,uEAAuE;gBACvE,iEAAiE;gBACjE,oEAAoE;gBACpE,kEAAkE;gBAClE,4DAA4D;gBAC5D,IAAI,CAAC,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;oBAChC,8DAA8D;oBAC9D,8DAA8D;oBAC9D,mCAAmC;oBACnC,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAAE,SAAS;oBAC9E,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EACjD,yCAAyC,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAEhC,uEAAuE;gBACvE,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;oBACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC7C,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC9D,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;4BAAE,SAAS;wBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EACjD,qCAAqC,CAAC,CAAC;wBACjD,SAAS;oBACX,CAAC;gBACH,CAAC;gBAED,iEAAiE;gBACjE,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,YAAY,CAAC,EAAE,CAAC;oBACvF,IAAI,iBAAiB,CAAC,IAAI,CAAC;wBACvB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC/F,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;4BAAE,SAAS;wBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EACjD,MAAM,CAAC,2BAA2B,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;gBACjC,+CAA+C;gBAC/C,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;oBACjB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;oBAChC,4EAA4E;oBAC5E,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE;wBAAE,SAAS;oBACvE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;wBAAE,SAAS;oBACvC,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EACjD,mDAAmD,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAChC,6BAA6B;gBAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;oBACzD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC5B,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;4BAAE,SAAS;wBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EACjD,MAAM,CAAC,uBAAuB,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;gBACD,uCAAuC;gBACvC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;oBAC5D,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC5B,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;4BAAE,SAAS;wBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EACjD,GAAG,GAAG,oCAAoC,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,IAAI,CACV,GAAgB,EAChB,QAAkD,EAClD,IAAY,EACZ,IAAY,EACZ,QAAgB,EAChB,GAAW;QAEX,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvC,GAAG,CAAC,UAAU,CAAC;YACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;YAClC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,OAAO;YACd,OAAO,EACL,2CAA2C,GAAG,iCAAiC;gBAC/E,qFAAqF;gBACrF,wDAAwD;YAC1D,IAAI;YACJ,IAAI;YACJ,GAAG,EACD,8DAA8D;gBAC9D,6EAA6E;gBAC7E,yEAAyE;gBACzE,uEAAuE;gBACvE,aAAa;YACf,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;CACF"}
|
|
@@ -12650,6 +12650,14 @@ var DEFAULT_SANITIZERS = [
|
|
|
12650
12650
|
{ method: "escapeshellcmd", removes: ["command_injection"] },
|
|
12651
12651
|
// Deserialization
|
|
12652
12652
|
{ method: "setObjectInputFilter", class: "ObjectInputStream", removes: ["deserialization"] },
|
|
12653
|
+
// Regex consumption — passing tainted text to a compiled `Pattern.matcher()`
|
|
12654
|
+
// does not constitute a wrong-sphere escape: the matcher walks the string
|
|
12655
|
+
// in-process and produces match-state (booleans, captured groups, counts),
|
|
12656
|
+
// not a network/file/process exit. Class-agnostic so it covers receivers
|
|
12657
|
+
// that are Pattern-typed variables (e.g. `DIGITS.matcher(text)`). Sprint 60
|
|
12658
|
+
// (#113 FP-52). Note: this only suppresses the synthetic CWE-668 fallback;
|
|
12659
|
+
// real injection sinks downstream of the matched text still apply.
|
|
12660
|
+
{ method: "matcher", removes: ["external_taint_escape"] },
|
|
12653
12661
|
// =========================================================================
|
|
12654
12662
|
// Node.js / JavaScript Sanitizers
|
|
12655
12663
|
// =========================================================================
|
|
@@ -12685,7 +12693,12 @@ var DEFAULT_SANITIZERS = [
|
|
|
12685
12693
|
{ method: "contains", removes: ["external_taint_escape"] },
|
|
12686
12694
|
{ method: "indexOf", removes: ["external_taint_escape"] },
|
|
12687
12695
|
// Path sanitization
|
|
12688
|
-
|
|
12696
|
+
// Sprint 60 (#113 FP-46): include external_taint_escape — `path.basename()`
|
|
12697
|
+
// strips directory components and returns only the leaf filename, so a
|
|
12698
|
+
// tainted-but-basenamed value can no longer carry a traversal payload into
|
|
12699
|
+
// a downstream `fs.open*` / `fs.write*` call. Mirrors Go `filepath.Base`
|
|
12700
|
+
// (line 2187) which already includes external_taint_escape.
|
|
12701
|
+
{ method: "basename", class: "path", removes: ["path_traversal", "external_taint_escape"] },
|
|
12689
12702
|
{ method: "normalize", class: "path", removes: ["path_traversal"] },
|
|
12690
12703
|
{ method: "resolve", class: "path", removes: ["path_traversal"] },
|
|
12691
12704
|
// SQL - parameterized queries (mysql, pg)
|
|
@@ -32899,6 +32912,19 @@ var UnrestrictedFileUploadPass = class {
|
|
|
32899
32912
|
);
|
|
32900
32913
|
}
|
|
32901
32914
|
}
|
|
32915
|
+
if (m === "write" && callHasUploadName(call)) {
|
|
32916
|
+
const rec = call.receiver ?? "";
|
|
32917
|
+
if (rec === "Files" || rec === "FilePath" || rec.endsWith(".Files")) continue;
|
|
32918
|
+
if (inSafeRange(call.location.line)) continue;
|
|
32919
|
+
this.emit(
|
|
32920
|
+
ctx,
|
|
32921
|
+
findings,
|
|
32922
|
+
file,
|
|
32923
|
+
call.location.line,
|
|
32924
|
+
language,
|
|
32925
|
+
"Part.write(<dir> + <original filename>)"
|
|
32926
|
+
);
|
|
32927
|
+
}
|
|
32902
32928
|
}
|
|
32903
32929
|
}
|
|
32904
32930
|
if (language === "javascript" || language === "typescript") {
|
|
@@ -12032,6 +12032,14 @@ var DEFAULT_SANITIZERS = [
|
|
|
12032
12032
|
{ method: "escapeshellcmd", removes: ["command_injection"] },
|
|
12033
12033
|
// Deserialization
|
|
12034
12034
|
{ method: "setObjectInputFilter", class: "ObjectInputStream", removes: ["deserialization"] },
|
|
12035
|
+
// Regex consumption — passing tainted text to a compiled `Pattern.matcher()`
|
|
12036
|
+
// does not constitute a wrong-sphere escape: the matcher walks the string
|
|
12037
|
+
// in-process and produces match-state (booleans, captured groups, counts),
|
|
12038
|
+
// not a network/file/process exit. Class-agnostic so it covers receivers
|
|
12039
|
+
// that are Pattern-typed variables (e.g. `DIGITS.matcher(text)`). Sprint 60
|
|
12040
|
+
// (#113 FP-52). Note: this only suppresses the synthetic CWE-668 fallback;
|
|
12041
|
+
// real injection sinks downstream of the matched text still apply.
|
|
12042
|
+
{ method: "matcher", removes: ["external_taint_escape"] },
|
|
12035
12043
|
// =========================================================================
|
|
12036
12044
|
// Node.js / JavaScript Sanitizers
|
|
12037
12045
|
// =========================================================================
|
|
@@ -12067,7 +12075,12 @@ var DEFAULT_SANITIZERS = [
|
|
|
12067
12075
|
{ method: "contains", removes: ["external_taint_escape"] },
|
|
12068
12076
|
{ method: "indexOf", removes: ["external_taint_escape"] },
|
|
12069
12077
|
// Path sanitization
|
|
12070
|
-
|
|
12078
|
+
// Sprint 60 (#113 FP-46): include external_taint_escape — `path.basename()`
|
|
12079
|
+
// strips directory components and returns only the leaf filename, so a
|
|
12080
|
+
// tainted-but-basenamed value can no longer carry a traversal payload into
|
|
12081
|
+
// a downstream `fs.open*` / `fs.write*` call. Mirrors Go `filepath.Base`
|
|
12082
|
+
// (line 2187) which already includes external_taint_escape.
|
|
12083
|
+
{ method: "basename", class: "path", removes: ["path_traversal", "external_taint_escape"] },
|
|
12071
12084
|
{ method: "normalize", class: "path", removes: ["path_traversal"] },
|
|
12072
12085
|
{ method: "resolve", class: "path", removes: ["path_traversal"] },
|
|
12073
12086
|
// SQL - parameterized queries (mysql, pg)
|
|
@@ -11966,6 +11966,14 @@ var DEFAULT_SANITIZERS = [
|
|
|
11966
11966
|
{ method: "escapeshellcmd", removes: ["command_injection"] },
|
|
11967
11967
|
// Deserialization
|
|
11968
11968
|
{ method: "setObjectInputFilter", class: "ObjectInputStream", removes: ["deserialization"] },
|
|
11969
|
+
// Regex consumption — passing tainted text to a compiled `Pattern.matcher()`
|
|
11970
|
+
// does not constitute a wrong-sphere escape: the matcher walks the string
|
|
11971
|
+
// in-process and produces match-state (booleans, captured groups, counts),
|
|
11972
|
+
// not a network/file/process exit. Class-agnostic so it covers receivers
|
|
11973
|
+
// that are Pattern-typed variables (e.g. `DIGITS.matcher(text)`). Sprint 60
|
|
11974
|
+
// (#113 FP-52). Note: this only suppresses the synthetic CWE-668 fallback;
|
|
11975
|
+
// real injection sinks downstream of the matched text still apply.
|
|
11976
|
+
{ method: "matcher", removes: ["external_taint_escape"] },
|
|
11969
11977
|
// =========================================================================
|
|
11970
11978
|
// Node.js / JavaScript Sanitizers
|
|
11971
11979
|
// =========================================================================
|
|
@@ -12001,7 +12009,12 @@ var DEFAULT_SANITIZERS = [
|
|
|
12001
12009
|
{ method: "contains", removes: ["external_taint_escape"] },
|
|
12002
12010
|
{ method: "indexOf", removes: ["external_taint_escape"] },
|
|
12003
12011
|
// Path sanitization
|
|
12004
|
-
|
|
12012
|
+
// Sprint 60 (#113 FP-46): include external_taint_escape — `path.basename()`
|
|
12013
|
+
// strips directory components and returns only the leaf filename, so a
|
|
12014
|
+
// tainted-but-basenamed value can no longer carry a traversal payload into
|
|
12015
|
+
// a downstream `fs.open*` / `fs.write*` call. Mirrors Go `filepath.Base`
|
|
12016
|
+
// (line 2187) which already includes external_taint_escape.
|
|
12017
|
+
{ method: "basename", class: "path", removes: ["path_traversal", "external_taint_escape"] },
|
|
12005
12018
|
{ method: "normalize", class: "path", removes: ["path_traversal"] },
|
|
12006
12019
|
{ method: "resolve", class: "path", removes: ["path_traversal"] },
|
|
12007
12020
|
// SQL - parameterized queries (mysql, pg)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.117.0",
|
|
4
4
|
"description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|