circle-ir 3.123.0 → 3.125.0

package/dist/browser/circle-ir.js

@@ -23654,6 +23654,9 @@ var LanguageSourcesPass = class {
     if (language === "python") {
       additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findPythonRangeCheckGuardSanitizers(code));
+      additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
+      additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
+      additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
       const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
       for (const finding of pyMisconfigFindings) {
         ctx.addFinding(finding);
@@ -23667,6 +23670,15 @@ var LanguageSourcesPass = class {
         ctx.addFinding(finding);
       }
     }
+    if (language === "javascript" || language === "typescript" || language === "htmljs") {
+      additionalSanitizers.push(...findJsSafeJsonParseSanitizers(code));
+      additionalSanitizers.push(...findJsCryptoHashSanitizers(code));
+      additionalSanitizers.push(...findJsCsvFormulaPrefixSanitizers(code));
+      additionalSanitizers.push(...findJsWrapperFunctionSanitizers(code));
+    }
+    if (language === "java") {
+      additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
+    }
     if (language === "python" || language === "javascript" || language === "typescript" || language === "go") {
       const exfilFindings = findExternalSecretExfiltrationFindings(
         code,
@@ -24911,6 +24923,227 @@ function findPythonRangeCheckGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findPythonRegexAllowlistWrapperSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const defOpen = /^(\s*)def\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*\)\s*:\s*$/;
+  const tightRegex = /r?["'](?:\^)?(?:\\w[+*]|\\d[+*]|\[[A-Za-z0-9_\\\-\.\s]+\][+*]|[A-Za-z0-9_\-\.]+)(?:\$)?["']/;
+  const terminator = /\b(return\s+(?:None|"|'|\(|\[|\{|False|jsonify|make_response|redirect|abort)|raise\s+\w|abort\s*\(|sys\.exit\s*\()/;
+  const wrappers = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = defOpen.exec(lines[i2]);
+    if (!m) continue;
+    const defIndent = m[1].length;
+    const wrapperName = m[2];
+    const argName = m[3];
+    let foundGuard = false;
+    let returnsArg = false;
+    let blockEnd = -1;
+    const maxScan = Math.min(lines.length, i2 + 40);
+    for (let j = i2 + 1; j < maxScan; j++) {
+      const line = lines[j];
+      if (line.trim() === "") continue;
+      const indent = line.length - line.trimStart().length;
+      if (indent <= defIndent) {
+        blockEnd = j - 1;
+        break;
+      }
+      if (!foundGuard) {
+        const guard = new RegExp(
+          `if\\s+not\\s+re\\.(?:fullmatch|match)\\s*\\(\\s*(${tightRegex.source})\\s*,\\s*${argName}\\s*\\)\\s*:`
+        );
+        if (guard.test(line)) {
+          for (let k = j + 1; k < maxScan; k++) {
+            const klin = lines[k];
+            if (klin.trim() === "") continue;
+            const kindent = klin.length - klin.trimStart().length;
+            if (kindent <= indent) break;
+            if (terminator.test(klin)) foundGuard = true;
+            break;
+          }
+        }
+      }
+      if (new RegExp(`^\\s*return\\s+${argName}\\s*$`).test(line)) {
+        returnsArg = true;
+      }
+    }
+    if (blockEnd === -1) blockEnd = Math.min(lines.length - 1, i2 + 39);
+    if (!foundGuard || !returnsArg) continue;
+    wrappers.push({ name: wrapperName, defLine: i2, defIndent });
+  }
+  if (wrappers.length === 0) return sanitizers;
+  const wrapperKinds = [
+    "ldap_injection",
+    "xpath_injection",
+    "sql_injection",
+    "command_injection",
+    "path_traversal",
+    "xss",
+    "external_taint_escape"
+  ];
+  for (const w of wrappers) {
+    const assignedCallRe = new RegExp(
+      `^(\\s*)([A-Za-z_][A-Za-z0-9_]*)\\s*=\\s*${w.name}\\s*\\(`
+    );
+    const bareCallRe = new RegExp(`\\b${w.name}\\s*\\(`);
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      if (i2 === w.defLine) continue;
+      const line = lines[i2];
+      if (!bareCallRe.test(line)) continue;
+      if (i2 > w.defLine) {
+        const lineIndent = line.length - line.trimStart().length;
+        if (lineIndent > w.defIndent) {
+          let stillInside = true;
+          for (let k = w.defLine + 1; k < i2; k++) {
+            const kline = lines[k];
+            if (kline.trim() === "") continue;
+            const kindent = kline.length - kline.trimStart().length;
+            if (kindent <= w.defIndent) {
+              stillInside = false;
+              break;
+            }
+          }
+          if (stillInside) continue;
+        }
+      }
+      sanitizers.push({
+        type: "python_regex_allowlist_wrapper",
+        method: w.name,
+        line: i2 + 1,
+        sanitizes: [...wrapperKinds]
+      });
+      const am = assignedCallRe.exec(line);
+      if (!am) continue;
+      const callIndent = am[1].length;
+      const validated = am[2];
+      const validatedRe = new RegExp(`\\b${validated}\\b`);
+      for (let j = i2 + 1; j < lines.length; j++) {
+        const jline = lines[j];
+        if (jline.trim() === "") continue;
+        const jindent = jline.length - jline.trimStart().length;
+        if (jindent < callIndent) break;
+        if (validatedRe.test(jline)) {
+          sanitizers.push({
+            type: "python_regex_allowlist_wrapper",
+            method: w.name,
+            line: j + 1,
+            sanitizes: [...wrapperKinds]
+          });
+        }
+      }
+    }
+  }
+  return sanitizers;
+}
+function findPythonSetMembershipXssGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const guardOpen = /^(\s*)if\s+([A-Za-z_][A-Za-z0-9_]*)\s+not\s+in\s+([A-Za-z_][A-Za-z0-9_]*)\s*:\s*$/;
+  const allowlistName = /^(?:[A-Z][A-Z0-9_]+|.*?(allowed|accepted|whitelist|permitted|valid|approved).*)$/i;
+  const terminator = /\b(return|raise|abort\s*\(|sys\.exit\s*\()/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = guardOpen.exec(lines[i2]);
+    if (!m) continue;
+    const guardIndent = m[1].length;
+    const guardedVar = m[2];
+    const allowName = m[3];
+    if (!allowlistName.test(allowName)) continue;
+    let bodyHasTerminator = false;
+    let blockEnd = -1;
+    const maxScan = Math.min(lines.length, i2 + 26);
+    for (let j = i2 + 1; j < maxScan; j++) {
+      const line = lines[j];
+      if (line.trim() === "") continue;
+      const indent = line.length - line.trimStart().length;
+      if (indent <= guardIndent) {
+        blockEnd = j - 1;
+        break;
+      }
+      if (terminator.test(line)) bodyHasTerminator = true;
+    }
+    if (blockEnd === -1) blockEnd = Math.min(lines.length - 1, i2 + 25);
+    if (!bodyHasTerminator) continue;
+    const varRe = new RegExp(`\\b${guardedVar}\\b`);
+    for (let l = blockEnd + 2; l <= lines.length; l++) {
+      const lineText = lines[l - 1];
+      if (!varRe.test(lineText)) continue;
+      sanitizers.push({
+        type: "python_set_membership_xss_guard",
+        method: "if",
+        line: l,
+        sanitizes: ["xss", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findPythonDefusedXmlSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const moduleAliases = /* @__PURE__ */ new Set();
+  const fromNames = /* @__PURE__ */ new Set();
+  const importAs = /^\s*import\s+defusedxml(?:\.[A-Za-z_][A-Za-z0-9_.]*)?\s+as\s+([A-Za-z_][A-Za-z0-9_]*)\s*$/;
+  const importBare = /^\s*import\s+defusedxml(?:\.([A-Za-z_][A-Za-z0-9_.]*))?\s*$/;
+  const fromImport = /^\s*from\s+defusedxml(?:\.[A-Za-z_][A-Za-z0-9_.]*)?\s+import\s+(.+)$/;
+  for (const raw of lines) {
+    const line = raw.replace(/#.*$/, "");
+    let m;
+    if (m = importAs.exec(line)) {
+      moduleAliases.add(m[1]);
+      continue;
+    }
+    if (m = importBare.exec(line)) {
+      if (m[1]) {
+        moduleAliases.add(m[1].split(".").pop());
+      }
+      moduleAliases.add("defusedxml");
+      continue;
+    }
+    if (m = fromImport.exec(line)) {
+      const items = m[1].split(",");
+      for (const item of items) {
+        const trimmed = item.trim().replace(/[()\\]/g, "");
+        if (!trimmed) continue;
+        const asMatch = /^([A-Za-z_][A-Za-z0-9_]*)\s+as\s+([A-Za-z_][A-Za-z0-9_]*)$/.exec(trimmed);
+        if (asMatch) {
+          fromNames.add(asMatch[2]);
+        } else if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(trimmed)) {
+          fromNames.add(trimmed);
+        }
+      }
+    }
+  }
+  if (moduleAliases.size === 0 && fromNames.size === 0) return sanitizers;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (/^\s*(?:import|from)\s+/.test(line)) continue;
+    let matched = false;
+    for (const alias of moduleAliases) {
+      const re = new RegExp(`\\b${alias}\\s*\\.\\s*[A-Za-z_][A-Za-z0-9_]*\\s*\\(`);
+      if (re.test(line)) {
+        matched = true;
+        break;
+      }
+    }
+    if (!matched) {
+      for (const name2 of fromNames) {
+        const re = new RegExp(`\\b${name2}\\s*\\(`);
+        if (re.test(line)) {
+          matched = true;
+          break;
+        }
+      }
+    }
+    if (!matched) continue;
+    sanitizers.push({
+      type: "python_defusedxml_import",
+      method: "defusedxml",
+      line: i2 + 1,
+      sanitizes: ["xxe", "external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
 function findRustSetAllowlistGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -25005,6 +25238,109 @@ function findRustCanonicalizeGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJavaSafeJsonParseSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const safeParse = /\.(?:readValue|fromJson)\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    if (!safeParse.test(lines[i2])) continue;
+    sanitizers.push({
+      type: "java_safe_json_parse",
+      method: "readValue",
+      line: i2 + 1,
+      sanitizes: ["external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJsSafeJsonParseSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const safeParse = /\bJSON\.parse\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    if (!safeParse.test(lines[i2])) continue;
+    sanitizers.push({
+      type: "js_safe_json_parse",
+      method: "JSON.parse",
+      line: i2 + 1,
+      sanitizes: ["external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJsCryptoHashSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const hashCall = /\b(?:bcrypt|argon2)\s*\.\s*hash(?:Sync)?\s*\(|\bcrypto\s*\.\s*(?:scrypt(?:Sync)?|createHash)\s*\(|\.digest\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    if (!hashCall.test(lines[i2])) continue;
+    sanitizers.push({
+      type: "js_crypto_hash",
+      method: "hash",
+      line: i2 + 1,
+      sanitizes: ["external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJsCsvFormulaPrefixSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const tickPrefix = /`'\$\{/;
+  const concatPrefix = /["']\\?'["']\s*\+\s*[A-Za-z_]/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    if (tickPrefix.test(lines[i2]) || concatPrefix.test(lines[i2])) {
+      sanitizers.push({
+        type: "js_csv_formula_prefix",
+        method: "'-prefix",
+        line: i2 + 1,
+        sanitizes: ["external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findJsWrapperFunctionSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const wrappers = /* @__PURE__ */ new Map();
+  const fnDeclRe = /\bfunction\s+([A-Za-z_]\w*)\s*\(/;
+  const arrowDeclRe = /\b(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*(?:\([^)]*\)|[A-Za-z_]\w*)\s*=>/;
+  const xssCharClass = /\.replace\s*\(\s*\/[^/]*[&<>"'][^/]*\//;
+  const crlfCharClass = /\.replace\s*\(\s*\/[^/]*(?:\\r|\\n|\\t)[^/]*\//;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = fnDeclRe.exec(lines[i2]) ?? arrowDeclRe.exec(lines[i2]);
+    if (!m) continue;
+    const name2 = m[1];
+    const body2 = lines.slice(i2, Math.min(lines.length, i2 + 8)).join("\n");
+    const kinds = /* @__PURE__ */ new Set();
+    if (xssCharClass.test(body2)) {
+      kinds.add("xss");
+      kinds.add("external_taint_escape");
+    }
+    if (crlfCharClass.test(body2)) {
+      kinds.add("log_injection");
+      kinds.add("external_taint_escape");
+    }
+    if (kinds.size > 0) wrappers.set(name2, kinds);
+  }
+  if (wrappers.size === 0) return sanitizers;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    for (const [name2, kinds] of wrappers) {
+      const declSelf = new RegExp(`\\b(?:function|const|let|var)\\s+${name2}\\b`);
+      if (declSelf.test(lines[i2])) continue;
+      const callRe = new RegExp(`\\b${name2}\\s*\\(`);
+      if (!callRe.test(lines[i2])) continue;
+      sanitizers.push({
+        type: "js_wrapper_function",
+        method: name2,
+        line: i2 + 1,
+        sanitizes: [...kinds]
+      });
+    }
+  }
+  return sanitizers;
+}
 function collectEnvSecretVars(lines, language) {
   const out2 = /* @__PURE__ */ new Map();
   for (let i2 = 0; i2 < lines.length; i2++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.123.0",
+  "version": "3.125.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",