circle-ir 3.134.0 → 3.136.0

package/dist/browser/circle-ir.js

@@ -23720,6 +23720,18 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findPythonTaintedFormatStringFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findPythonHeaderCrlfInjectionFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
@@ -23783,6 +23795,12 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJsUtilFormatFormatStringFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
@@ -23803,6 +23821,12 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJavaUrlOpenStreamSsrfFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python" || language === "javascript" || language === "typescript" || language === "go") {
       const exfilFindings = findExternalSecretExfiltrationFindings(
@@ -27606,6 +27630,299 @@ function findPythonMongoengineWhereNosqlInjectionFindings(code, file) {
   }
   return findings;
 }
+function findJavaUrlOpenStreamSsrfFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\bnew\s+URL\s*\(/.test(code) && !/\bURI\s*\.\s*create\s*\(/.test(code)) {
+    return findings;
+  }
+  if (!/\.\s*(?:openStream|openConnection|getContent)\s*\(/.test(code)) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const reqExtractRe = /\b\w+\s*\.\s*(?:getParameter|getParameterValues|getHeader|getHeaders|getCookies|getReader|getQueryString|getRequestURI|getInputStream|getPart|getParts)\s*\(/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      const a = t.match(/^(?:final\s+)?(?:[\w<>?,\[\]]+\s+)?(\w+)\s*=\s*(.+?);?$/);
+      if (!a) continue;
+      const lhs = a[1];
+      const rhs = a[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  if (taintedVars.size === 0) return findings;
+  const sinkRe = /\.\s*(openStream|openConnection|getContent)\s*\(/;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const m = line.match(sinkRe);
+    if (!m) continue;
+    const op = m[1];
+    const sinkIdx = line.indexOf(`.${op}`);
+    if (sinkIdx < 0) continue;
+    const head = line.substring(0, sinkIdx + 1);
+    let tainted = reqExtractRe.test(head);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(head)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted) continue;
+    const key = `${i2 + 1}:${op}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    findings.push({
+      id: `ssrf-${file}-${i2 + 1}-java-url-${op.toLowerCase()}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "ssrf",
+      cwe: "CWE-918",
+      severity: "critical",
+      level: "error",
+      message: `SSRF: Java \`URL.${op}()\` invoked on a URL derived from servlet request input. Even when an \`if (url.startsWith("https://"))\` guard is present, the host portion remains attacker-controlled \u2014 use a strict host allowlist (parse the URL, check \`getHost()\`) before issuing the request.`,
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findPythonTaintedFormatStringFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)|flask\.request)\b/.test(
+    code
+  )) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const reqExtractRe = /\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)\b|flask\.request\b)/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("#")) continue;
+      const a = t.match(/^(\w+)\s*=\s*(.+?)$/);
+      if (!a) continue;
+      const lhs = a[1];
+      const rhs = a[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  if (taintedVars.size === 0) return findings;
+  const percentRe = /\b(\w+)\s*%\s*[\(\[\{"'\w]/;
+  const dotFormatRe = /\b(\w+)\s*\.\s*format\s*\(/;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const t = line.trim();
+    if (t.startsWith("#")) continue;
+    const pm = line.match(percentRe);
+    if (pm && taintedVars.has(pm[1])) {
+      const key = `${i2 + 1}:percent`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        findings.push({
+          id: `format_string-${file}-${i2 + 1}-py-percent`,
+          pass: "language-sources",
+          category: "security",
+          rule_id: "format_string",
+          cwe: "CWE-134",
+          severity: "high",
+          level: "error",
+          message: "Format-string injection: Python `<tainted> % args` uses an HTTP-request-controlled format string. Malformed specifiers can crash the handler (TypeError) and `%(name)s` access can reveal arbitrary mapping keys. Use a literal format string and pass untrusted values as arguments only.",
+          file,
+          line: i2 + 1,
+          snippet: line.trim()
+        });
+      }
+    }
+    const dm = line.match(dotFormatRe);
+    if (dm && taintedVars.has(dm[1])) {
+      const key = `${i2 + 1}:dotformat`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        findings.push({
+          id: `format_string-${file}-${i2 + 1}-py-strformat`,
+          pass: "language-sources",
+          category: "security",
+          rule_id: "format_string",
+          cwe: "CWE-134",
+          severity: "high",
+          level: "error",
+          message: "Format-string injection: Python `<tainted>.format(...)` lets the attacker control the format template. Field-access shapes such as `{0.__class__.__init__.__globals__}` can leak module globals (e.g. secret keys). Use a literal template and pass untrusted values as positional/keyword arguments only.",
+          file,
+          line: i2 + 1,
+          snippet: line.trim()
+        });
+      }
+    }
+  }
+  return findings;
+}
+function findJsUtilFormatFormatStringFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\butil\s*\.\s*format\s*\(/.test(code)) return findings;
+  if (!/\breq\s*\.\s*(?:query|body|params|headers|cookies)\b/.test(code)) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const reqExtractRe = /\breq\s*\.\s*(?:query|body|params|headers|cookies)\b/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("//")) continue;
+      const a = t.match(/^(?:const|let|var)\s+(\w+)\s*=\s*(.+?);?$/);
+      if (!a) continue;
+      const lhs = a[1];
+      const rhs = a[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  if (taintedVars.size === 0) return findings;
+  const callRe = /\butil\s*\.\s*format\s*\(\s*([\w.]+)\s*[,)]/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const m = line.match(callRe);
+    if (!m) continue;
+    const arg = m[1];
+    const root = arg.split(".")[0];
+    if (!taintedVars.has(root) && !reqExtractRe.test(arg)) continue;
+    findings.push({
+      id: `format_string-${file}-${i2 + 1}-js-util-format`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "format_string",
+      cwe: "CWE-134",
+      severity: "medium",
+      level: "error",
+      message: "Format-string injection: Node `util.format(<tainted>, ...)` uses an HTTP-request-controlled format string. The attacker can manipulate `%s`/`%j`/`%O` specifiers to alter the rendered output. Pass user input as a subsequent argument with a literal format string.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findPythonHeaderCrlfInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  if (!/\b\w+\s*\.\s*headers\b/.test(code)) return findings;
+  if (!/\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)|flask\.request)\b/.test(
+    code
+  )) {
+    return findings;
+  }
+  const lines = code.split("\n");
+  const reqExtractRe = /\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)\b|flask\.request\b)/;
+  const taintedVars = /* @__PURE__ */ new Set();
+  for (let pass = 0; pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("#")) continue;
+      const a = t.match(/^(\w+)\s*=\s*(.+?)$/);
+      if (!a) continue;
+      const lhs = a[1];
+      const rhs = a[2];
+      if (taintedVars.has(lhs)) continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before) break;
+  }
+  if (taintedVars.size === 0) return findings;
+  const subscriptRe = /\b\w+\s*\.\s*headers\s*\[\s*['"][^'"]+['"]\s*\]\s*=\s*(.+)$/;
+  const methodRe = /\b\w+\s*\.\s*headers\s*\.\s*(?:add|set|setdefault|append)\s*\(\s*['"][^'"]+['"]\s*,\s*(.+?)\)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const t = line.trim();
+    if (t.startsWith("#")) continue;
+    let expr = null;
+    const sm = line.match(subscriptRe);
+    if (sm) expr = sm[1];
+    else {
+      const mm = line.match(methodRe);
+      if (mm) expr = mm[1];
+    }
+    if (!expr) continue;
+    let tainted = reqExtractRe.test(expr);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(expr)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted) continue;
+    findings.push({
+      id: `crlf-${file}-${i2 + 1}-py-headers`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "crlf",
+      cwe: "CWE-113",
+      severity: "medium",
+      level: "error",
+      message: "CRLF / header injection: Python Flask/Werkzeug `response.headers[...] = <tainted>` lets an attacker inject a `\\r\\n` sequence and forge additional headers or split the response body. Validate the value (reject control characters) or use a fixed allowlist.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
 
 // src/analysis/passes/sink-filter-pass.ts
 var JS_XSS_SANITIZERS = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.134.0",
+  "version": "3.136.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",