circle-ir 3.131.0 → 3.133.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/dist/analysis/config-loader.d.ts.map +1 -1
  2. package/dist/analysis/config-loader.js +4 -2
  3. package/dist/analysis/config-loader.js.map +1 -1
  4. package/dist/analysis/findings.d.ts.map +1 -1
  5. package/dist/analysis/findings.js +14 -7
  6. package/dist/analysis/findings.js.map +1 -1
  7. package/dist/analysis/passes/language-sources-pass.d.ts +102 -0
  8. package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
  9. package/dist/analysis/passes/language-sources-pass.js +974 -0
  10. package/dist/analysis/passes/language-sources-pass.js.map +1 -1
  11. package/dist/analysis/passes/taint-propagation-pass.d.ts.map +1 -1
  12. package/dist/analysis/passes/taint-propagation-pass.js +12 -4
  13. package/dist/analysis/passes/taint-propagation-pass.js.map +1 -1
  14. package/dist/browser/circle-ir.js +756 -14
  15. package/dist/core/circle-ir-core.cjs +4 -2
  16. package/dist/core/circle-ir-core.js +4 -2
  17. package/package.json +1 -1
package/dist/core/circle-ir-core.cjs CHANGED
@@ -11114,8 +11114,10 @@ var DEFAULT_SINKS = [
11114
11114
  { method: "newTransformer", class: "TransformerFactory", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
11115
11115
  { method: "transform", class: "Transformer", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
11116
11116
  // SSRF - Server-Side Request Forgery (CWE-918) and Open Redirect (CWE-601)
11117
- { method: "sendRedirect", class: "HttpServletResponse", type: "ssrf", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11118
- { method: "sendRedirect", type: "ssrf", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11117
+ // Sprint 82 (#189): HttpServletResponse.sendRedirect is CWE-601 / open_redirect,
11118
+ // not ssrf. Re-typing so manifest sink_type='open_redirect' matches.
11119
+ { method: "sendRedirect", class: "HttpServletResponse", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11120
+ { method: "sendRedirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11119
11121
  { method: "openConnection", class: "URL", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
11120
11122
  { method: "openStream", class: "URL", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
11121
11123
  // NOTE: URL/URI constructors removed — constructing a URL object doesn't make a network
package/dist/core/circle-ir-core.js CHANGED
@@ -11048,8 +11048,10 @@ var DEFAULT_SINKS = [
11048
11048
  { method: "newTransformer", class: "TransformerFactory", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
11049
11049
  { method: "transform", class: "Transformer", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
11050
11050
  // SSRF - Server-Side Request Forgery (CWE-918) and Open Redirect (CWE-601)
11051
- { method: "sendRedirect", class: "HttpServletResponse", type: "ssrf", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11052
- { method: "sendRedirect", type: "ssrf", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11051
+ // Sprint 82 (#189): HttpServletResponse.sendRedirect is CWE-601 / open_redirect,
11052
+ // not ssrf. Re-typing so manifest sink_type='open_redirect' matches.
11053
+ { method: "sendRedirect", class: "HttpServletResponse", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11054
+ { method: "sendRedirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11053
11055
  { method: "openConnection", class: "URL", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
11054
11056
  { method: "openStream", class: "URL", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
11055
11057
  // NOTE: URL/URI constructors removed — constructing a URL object doesn't make a network
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "circle-ir",
3
- "version": "3.131.0",
3
+ "version": "3.133.0",
4
4
  "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.js",