circle-ir 3.126.0 → 3.129.0

package/dist/analysis/passes/language-sources-pass.d.ts

@@ -125,4 +125,76 @@ export declare function findPythonPatternFindings(code: string, file: string): S
  * benign and is ignored.
  */
 export declare function findRustPatternFindings(code: string, file: string): SastFinding[];
+/**
+ * Rust `hardcoded-credential` (CWE-798). Pattern:
+ *   `(pub|const|static) <NAME>: &str = "literal";` where NAME matches
+ *   /api[_]?key|secret|token|password|passwd|pwd|auth/i and the literal is
+ *   non-trivial (length > 8 and not a placeholder).
+ */
+export declare function findRustHardcodedCredentialFindings(code: string, file: string): SastFinding[];
+/**
+ * Rust `insecure-cookie` (CWE-1004 / CWE-614). Pattern:
+ *   `Cookie::build(...)` chain that explicitly calls `.secure(false)` or
+ *   `.http_only(false)` (or both). The dedicated `insecure-cookie-pass.ts`
+ *   handles the `format!("Set-Cookie: ...")` shape but not the actix-web
+ *   builder chain.
+ */
+export declare function findRustInsecureCookieFindings(code: string, file: string): SastFinding[];
+/**
+ * Rust `jwt-verify-disabled` (CWE-347). Pattern:
+ *   `.insecure_disable_signature_validation()` method call on a
+ *   jsonwebtoken `Validation` value. Any presence of this method
+ *   disables the signature check.
+ */
+export declare function findRustJwtVerifyDisabledFindings(code: string, file: string): SastFinding[];
+/**
+ * Rust `weak-crypto` (CWE-327). Pattern (raw ECB via `aes` crate):
+ *   any line that calls `.encrypt_block(` or `.decrypt_block(` on a
+ *   block-cipher receiver constructed via `Aes128::new` / `Aes192::new` /
+ *   `Aes256::new` / `Aes128Ecb` / `Aes256Ecb`. We collect the cipher
+ *   constructor lines in a first pass (variable name → seen) and emit
+ *   on every `.encrypt_block(` / `.decrypt_block(` line in the same file.
+ *
+ *   The wrapped CBC/GCM/CTR forms go through `Cbc::<Aes128, ...>::new`
+ *   or `Aes128Gcm::new` — those do NOT call `.encrypt_block` directly
+ *   and so are not matched.
+ */
+export declare function findRustWeakCryptoEcbFindings(code: string, file: string): SastFinding[];
+/**
+ * Java pattern findings — Sprint 78 (#190):
+ *   - `jwt-verify-disabled` (CWE-347): bare `JWT.decode(<token>)` on the
+ *     auth0 `com.auth0.jwt.JWT` class. `decode` is documented as
+ *     "decode the token without performing any verification"; only
+ *     `JWT.require(...).build().verify(token)` enforces the signature.
+ *   - `tls-verify-disabled` (CWE-295): anonymous `X509TrustManager`
+ *     implementation whose `checkServerTrusted` body is empty
+ *     (returns void without raising). This trust-nothing implementation
+ *     accepts every certificate.
+ */
+export declare function findJavaPatternFindings(code: string, file: string): SastFinding[];
+/**
+ * Go pattern findings — Sprint 78 (#190):
+ *   - `weak-crypto` (CWE-327): raw ECB usage via `aes.NewCipher(...)`
+ *     followed by a direct `<cipher>.Encrypt(` / `.Decrypt(` call on the
+ *     constructed value (no `cipher.NewCBCEncrypter` / `NewGCM` / `NewCTR`
+ *     wrapper). The Go stdlib `aes.Cipher` exposes `Encrypt` / `Decrypt`
+ *     that operate on a single 16-byte block — calling these directly is
+ *     ECB mode.
+ *
+ *   Algorithm:
+ *     1. Collect every `<v>, _ := aes.NewCipher(...)` cipher variable.
+ *     2. If the file contains a `cipher.NewGCM(<v>)` / `cipher.NewCBC*(<v>)`
+ *        / `cipher.NewCTR(<v>)` wrapping line for that variable, skip it
+ *        (wrapped mode is not ECB).
+ *     3. Otherwise emit on every `<v>.Encrypt(` / `<v>.Decrypt(` line.
+ */
+export declare function findGoPatternFindings(code: string, file: string): SastFinding[];
+/**
+ * JS pattern findings — Sprint 78 (#190):
+ *   - `xml-entity-expansion` (CWE-611 / CWE-776): libxmljs `parseXml`
+ *     (and `parseXmlString`) called with `{ noent: true }` resolves
+ *     external entities, enabling XXE / billion-laughs. The default is
+ *     `noent: false`; only the explicit-true form is unsafe.
+ */
+export declare function findJsPatternFindings(code: string, file: string): SastFinding[];
 //# sourceMappingURL=language-sources-pass.d.ts.map

package/dist/analysis/passes/language-sources-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAwM7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AA0+CD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF"}
+{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAmP7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAiyDD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf"}