circle-ir 3.126.0 → 3.129.0

package/dist/browser/circle-ir.js

@@ -23650,6 +23650,10 @@ var LanguageSourcesPass = class {
     if (language === "go") {
       additionalSanitizers.push(...findGoMapAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findGoHtmlTemplateImportSanitizers(code));
+      const goMisconfigFindings = findGoPatternFindings(code, graph.ir.meta.file);
+      for (const finding of goMisconfigFindings) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python") {
       additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
@@ -23657,6 +23661,7 @@ var LanguageSourcesPass = class {
       additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
       additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
       additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
+      additionalSanitizers.push(...findPythonJinjaAutoescapeSanitizers(code));
       const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
       for (const finding of pyMisconfigFindings) {
         ctx.addFinding(finding);
@@ -23665,10 +23670,23 @@ var LanguageSourcesPass = class {
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findRustCanonicalizeGuardSanitizers(code));
+      additionalSanitizers.push(...findRustArgvCommandSanitizers(code));
       const rustMisconfigFindings = findRustPatternFindings(code, graph.ir.meta.file);
       for (const finding of rustMisconfigFindings) {
         ctx.addFinding(finding);
       }
+      for (const finding of findRustHardcodedCredentialFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findRustInsecureCookieFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findRustJwtVerifyDisabledFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findRustWeakCryptoEcbFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "javascript" || language === "typescript" || language === "htmljs") {
       additionalSanitizers.push(...findJsSafeJsonParseSanitizers(code));
@@ -23676,9 +23694,20 @@ var LanguageSourcesPass = class {
       additionalSanitizers.push(...findJsCsvFormulaPrefixSanitizers(code));
       additionalSanitizers.push(...findJsWrapperFunctionSanitizers(code));
       additionalSanitizers.push(...findJsSsrfAllowlistGuardSanitizers(code));
+      for (const finding of findJsPatternFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
+      additionalSanitizers.push(
+        ...findJavaPathNormalizeStartsWithGuardSanitizers(code)
+      );
+      additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
+      additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
+      for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python" || language === "javascript" || language === "typescript" || language === "go") {
       const exfilFindings = findExternalSecretExfiltrationFindings(
@@ -25425,6 +25454,136 @@ function findJsSsrfAllowlistGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const resolveNormalizeRe = /\b([A-Za-z_]\w*)\s*=\s*([A-Za-z_]\w*)\s*\.\s*resolve\s*\([^)]*\)\s*\.\s*normalize\s*\(\s*\)/;
+  const startsWithGuardRe = (varName, rootName) => new RegExp(
+    `if\\s*\\(\\s*!\\s*${varName}\\s*\\.\\s*startsWith\\s*\\(\\s*${rootName}\\s*\\)\\s*\\)`
+  );
+  const terminatorRe = /\b(throw|return)\b/;
+  const candidates = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = resolveNormalizeRe.exec(lines[i2]);
+    if (!m) continue;
+    candidates.push({ line: i2 + 1, fullVar: m[1], rootVar: m[2] });
+  }
+  if (candidates.length === 0) return sanitizers;
+  for (const c of candidates) {
+    const guardRe = startsWithGuardRe(c.fullVar, c.rootVar);
+    let guardLine = -1;
+    for (let l = c.line; l < Math.min(lines.length, c.line + 6); l++) {
+      if (!guardRe.test(lines[l])) continue;
+      if (terminatorRe.test(lines[l]) || l + 1 < lines.length && terminatorRe.test(lines[l + 1])) {
+        guardLine = l + 1;
+        break;
+      }
+    }
+    if (guardLine < 0) continue;
+    const varRefRe = new RegExp(`\\b${c.fullVar}\\b`);
+    sanitizers.push({
+      type: "java_path_normalize_startswith_guard",
+      method: "normalize",
+      line: c.line,
+      sanitizes: ["path_traversal", "external_taint_escape"]
+    });
+    for (let l = c.line; l < lines.length; l++) {
+      if (!varRefRe.test(lines[l])) continue;
+      sanitizers.push({
+        type: "java_path_normalize_startswith_guard",
+        method: "normalize",
+        line: l + 1,
+        sanitizes: ["path_traversal", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findJavaInlineCrlfStripLogSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const logCallStart = /\b(?:log|logger|LOG|LOGGER|slog|LOGGER_)\s*\.\s*(?:info|warn|error|debug|trace|fatal|severe|warning|fine|finer|finest|config)\s*\(/;
+  const crlfReplaceAll = /\.\s*replaceAll\s*\(\s*"\[[^"]*\\\\?[rnt][^"]*\]"/;
+  const crlfReplaceChar = /\.\s*replace\s*\(\s*'(?:\\\\?[rnt])'\s*,/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const text = lines[i2];
+    if (!logCallStart.test(text)) continue;
+    if (!crlfReplaceAll.test(text) && !crlfReplaceChar.test(text)) continue;
+    sanitizers.push({
+      type: "java_inline_crlf_strip_log",
+      method: "replaceAll",
+      line: i2 + 1,
+      sanitizes: ["log_injection", "external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJavaArgvFormExecSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const argvExecRe = /\.\s*exec\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
+  const argvPbRe = /\bnew\s+ProcessBuilder\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const text = lines[i2];
+    if (!argvExecRe.test(text) && !argvPbRe.test(text)) continue;
+    sanitizers.push({
+      type: "java_argv_form_exec",
+      method: "exec",
+      line: i2 + 1,
+      sanitizes: ["command_injection", "external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findRustArgvCommandSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const argvCommandRe = /\bCommand\s*::\s*new\s*\(\s*"[^"]*"\s*\)\s*\.\s*arg\s*\(/;
+  const shellArgvRe = /\bCommand\s*::\s*new\s*\(\s*"(?:sh|bash|zsh|ksh|dash|cmd(?:\.exe)?|powershell|pwsh)"\s*\)\s*\.\s*arg\s*\(\s*"-c"/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const text = lines[i2];
+    if (!argvCommandRe.test(text)) continue;
+    if (shellArgvRe.test(text)) continue;
+    sanitizers.push({
+      type: "rust_argv_command",
+      method: "arg",
+      line: i2 + 1,
+      sanitizes: ["command_injection", "external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findPythonJinjaAutoescapeSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const envAssignRe = /\b([A-Za-z_]\w*)\s*=\s*Environment\s*\(/;
+  const autoescapeOnRe = /\bautoescape\s*=/;
+  const autoescapeOffRe = /\bautoescape\s*=\s*(?:False|None|0)\b/;
+  const envVars = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = envAssignRe.exec(lines[i2]);
+    if (!m) continue;
+    if (!autoescapeOnRe.test(lines[i2])) continue;
+    if (autoescapeOffRe.test(lines[i2])) continue;
+    envVars.add(m[1]);
+  }
+  if (envVars.size === 0) return sanitizers;
+  for (const envVar of envVars) {
+    const renderChainRe = new RegExp(
+      `\\b${envVar}\\s*\\.\\s*get_template\\s*\\([^)]*\\)\\s*\\.\\s*render\\s*\\(`
+    );
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      if (!renderChainRe.test(lines[i2])) continue;
+      sanitizers.push({
+        type: "python_jinja_autoescape",
+        method: "render",
+        line: i2 + 1,
+        sanitizes: ["xss", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function collectEnvSecretVars(lines, language) {
   const out2 = /* @__PURE__ */ new Map();
   for (let i2 = 0; i2 < lines.length; i2++) {
@@ -25807,6 +25966,252 @@ function findRustPatternFindings(code, file) {
   }
   return out2;
 }
+function findRustHardcodedCredentialFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const re = /\b(?:pub\s+)?(?:const|static)\s+([A-Z][A-Z0-9_]*)\s*:\s*&\s*'?[a-z_]*\s*str\s*=\s*"([^"]+)"/;
+  const nameRe = /(?:^|_)(?:API[_]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|AUTH)(?:_|$)/i;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    const m = trimmed.match(re);
+    if (!m) continue;
+    const name2 = m[1];
+    const value = m[2];
+    if (!nameRe.test(name2)) continue;
+    if (value.length < 8) continue;
+    if (/^(?:xxx|todo|fixme|placeholder|changeme)/i.test(value)) continue;
+    out2.push({
+      id: `hardcoded-credential-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "hardcoded-credential",
+      cwe: "CWE-798",
+      severity: "high",
+      level: "error",
+      message: `Hardcoded credential: const ${name2} contains a literal secret value`,
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findRustInsecureCookieFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const builderRe = /\bCookie\s*::\s*build\s*\(/;
+  const insecureFlagRe = /\.\s*(?:secure|http_only)\s*\(\s*false\s*\)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    if (!builderRe.test(trimmed)) continue;
+    if (!insecureFlagRe.test(trimmed)) continue;
+    out2.push({
+      id: `insecure-cookie-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "insecure-cookie",
+      cwe: "CWE-1004",
+      severity: "medium",
+      level: "warning",
+      message: "Insecure cookie: Cookie::build chain disables Secure / HttpOnly flag(s)",
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findRustJwtVerifyDisabledFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const re = /\.\s*insecure_disable_signature_validation\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    if (!re.test(trimmed)) continue;
+    out2.push({
+      id: `jwt-verify-disabled-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "jwt-verify-disabled",
+      cwe: "CWE-347",
+      severity: "critical",
+      level: "error",
+      message: "JWT signature verification disabled: Validation::insecure_disable_signature_validation() forfeits signature enforcement",
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findRustWeakCryptoEcbFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const ctorRe = /\bAes(?:128|192|256)(?:Ecb)?\s*::\s*new\s*\(/;
+  const blockOpRe = /\.\s*(encrypt_block|decrypt_block)\s*\(/;
+  let sawCtor = false;
+  for (const line of lines) {
+    if (ctorRe.test(line)) {
+      sawCtor = true;
+      break;
+    }
+  }
+  if (!sawCtor) return out2;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    if (!blockOpRe.test(trimmed)) continue;
+    out2.push({
+      id: `weak-crypto-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "weak-crypto",
+      cwe: "CWE-327",
+      severity: "high",
+      level: "error",
+      message: "Weak crypto (ECB mode): raw Aes::encrypt_block/decrypt_block leaks repeating-block patterns. Use AES-GCM, AES-CTR, or AES-CBC with an HMAC.",
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findJavaPatternFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const jwtDecodeRe = /\bJWT\s*\.\s*decode\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+    if (!jwtDecodeRe.test(trimmed)) continue;
+    if (/\.\s*verify\s*\(/.test(trimmed)) continue;
+    out2.push({
+      id: `jwt-verify-disabled-${file}-${i2 + 1}-decode`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "jwt-verify-disabled",
+      cwe: "CWE-347",
+      severity: "critical",
+      level: "error",
+      message: "JWT signature not verified: auth0 `JWT.decode(token)` parses without checking the signature. Use `JWT.require(<algorithm>).build().verify(token)` to enforce verification.",
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  const anonStartRe = /\bnew\s+X509TrustManager\s*\(\s*\)\s*\{/;
+  const checkServerSig = /\bcheckServerTrusted\s*\([^)]*\)\s*(?:throws\s+[^\{]*)?\{\s*\}/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    if (!anonStartRe.test(raw)) continue;
+    const end = Math.min(lines.length, i2 + 16);
+    let foundAt = -1;
+    for (let j = i2; j < end; j++) {
+      if (checkServerSig.test(lines[j])) {
+        foundAt = j;
+        break;
+      }
+    }
+    if (foundAt < 0) continue;
+    out2.push({
+      id: `tls-verify-disabled-${file}-${foundAt + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "tls-verify-disabled",
+      cwe: "CWE-295",
+      severity: "high",
+      level: "error",
+      message: "TLS certificate verification disabled: anonymous X509TrustManager with empty checkServerTrusted body accepts every certificate.",
+      file,
+      line: foundAt + 1,
+      snippet: lines[foundAt].trim().substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findGoPatternFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const cipherVars = /* @__PURE__ */ new Set();
+  const ctorRe = /\b([a-zA-Z_]\w*)\s*(?:,\s*[a-zA-Z_]\w*)?\s*:?=\s*aes\.NewCipher\s*\(/;
+  for (const line of lines) {
+    const m = line.match(ctorRe);
+    if (m) cipherVars.add(m[1]);
+  }
+  if (cipherVars.size === 0) return out2;
+  for (const v of Array.from(cipherVars)) {
+    const wrapRe = new RegExp(
+      `\\bcipher\\.New(?:GCM|CBCEncrypter|CBCDecrypter|CTR|OFB|CFBEncrypter|CFBDecrypter)\\s*\\(\\s*${v}\\b`
+    );
+    for (const line of lines) {
+      if (wrapRe.test(line)) {
+        cipherVars.delete(v);
+        break;
+      }
+    }
+  }
+  if (cipherVars.size === 0) return out2;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    for (const v of cipherVars) {
+      const opRe = new RegExp(`\\b${v}\\s*\\.\\s*(?:Encrypt|Decrypt)\\s*\\(`);
+      if (!opRe.test(trimmed)) continue;
+      out2.push({
+        id: `weak-crypto-${file}-${i2 + 1}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "weak-crypto",
+        cwe: "CWE-327",
+        severity: "high",
+        level: "error",
+        message: "Weak crypto (ECB mode): raw aes.Cipher.Encrypt/Decrypt on a block leaks repeating-block patterns. Wrap with cipher.NewGCM, cipher.NewCTR, or cipher.NewCBCEncrypter + HMAC.",
+        file,
+        line: i2 + 1,
+        snippet: trimmed.substring(0, 100)
+      });
+      break;
+    }
+  }
+  return out2;
+}
+function findJsPatternFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const parseRe = /\blibxml(?:js)?\s*\.\s*parseXml(?:String)?\s*\(/;
+  const noentTrueRe = /\bnoent\s*:\s*true\b/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+    if (!parseRe.test(trimmed)) continue;
+    if (!noentTrueRe.test(trimmed)) continue;
+    out2.push({
+      id: `xml-entity-expansion-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xml-entity-expansion",
+      cwe: "CWE-611",
+      severity: "high",
+      level: "error",
+      message: "XML external entity resolution enabled: libxmljs parseXml called with `noent: true` resolves external entities (XXE / billion-laughs). Omit the flag or set `noent: false`.",
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
 
 // src/analysis/passes/sink-filter-pass.ts
 var JS_XSS_SANITIZERS = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.126.0",
+  "version": "3.129.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",