circle-ir 3.141.0 → 3.144.3

package/dist/core/circle-ir-core.cjs

@@ -6383,6 +6383,12 @@ function resolveReceiverType(receiver, context) {
     return { simpleName: null, fqn: null };
   }
   if (receiver === "super") return { simpleName: null, fqn: null };
+  const ctorMatch = receiver.match(/^new\s+([A-Za-z_$][\w$.]*)\s*[<(]/);
+  if (ctorMatch) {
+    const ctorClass = ctorMatch[1];
+    const simple = ctorClass.includes(".") ? ctorClass.substring(ctorClass.lastIndexOf(".") + 1) : ctorClass;
+    return resolveFqn(simple, context);
+  }
   const declaredType = context.localVarTypes.get(receiver) ?? context.paramTypes.get(receiver) ?? context.fieldTypes.get(receiver);
   if (declaredType) {
     return resolveFqn(stripGenerics(declaredType), context);
@@ -10109,12 +10115,25 @@ function loadSinkConfigs(configs) {
   }
   return { sinks, sanitizers };
 }
-function createTaintConfig(sourceContents, sinkContents) {
+function loadSinkSemanticsConfigs(configs) {
+  const entries = [];
+  for (const config of configs) {
+    if (config.sinks) {
+      entries.push(...config.sinks);
+    }
+  }
+  return entries;
+}
+function createTaintConfig(sourceContents, sinkContents, sinkSemanticsContents = []) {
   const sourceConfigs = sourceContents.map((c) => parseConfig(c));
   const sinkConfigs = sinkContents.map((c) => parseConfig(c));
+  const sinkSemanticsConfigs = sinkSemanticsContents.map(
+    (c) => parseConfig(c)
+  );
   const sources = loadSourceConfigs(sourceConfigs);
   const { sinks, sanitizers } = loadSinkConfigs(sinkConfigs);
-  return { sources, sinks, sanitizers };
+  const sinkSemantics = loadSinkSemanticsConfigs(sinkSemanticsConfigs);
+  return { sources, sinks, sanitizers, sinkSemantics };
 }
 var DEFAULT_SOURCES = [
   // HTTP Sources (Servlet API)
@@ -10833,6 +10852,14 @@ var DEFAULT_SINKS = [
   // reflection remains a downstream concern of body-writing sinks.
   { method: "setHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
   { method: "addHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
+  // Cookie constructor + addCookie — HTTP response splitting via cookie
+  // name/value (CWE-113). Reflects the #189 Sprint 92 V02SetCookie fixture
+  // where `res.addCookie(new Cookie(name, req.getParameter("v")))` allows
+  // CRLF injection into the Set-Cookie header. Both the ctor arg[1] (value)
+  // and the addCookie arg[0] (Cookie handle) are flagged so intermediate-var
+  // and inline-ctor shapes both surface.
+  { method: "Cookie", class: "constructor", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0, 1] },
+  { method: "addCookie", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0] },
   // Note: `sendRedirect` is primarily classified as `ssrf` / open-redirect
   // (CWE-601) further down — see entry near line 1195. CRLF via Location
   // header is a secondary concern; keeping the canonical SSRF entry avoids
@@ -12272,11 +12299,62 @@ var DEFAULT_SANITIZERS = [
   { method: "UUID", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] }
 ];
+var DEFAULT_SINK_SEMANTICS = [
+  {
+    signature: "Jedis#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Redis wire-protocol serialization, not OS exec"
+  },
+  {
+    signature: "Connection#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis abstract Connection base"
+  },
+  {
+    signature: "JedisCluster#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis cluster client"
+  },
+  {
+    signature: "Func1#exec",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection", "code_injection"],
+    note: "RxJava functional dispatch, not OS exec"
+  },
+  {
+    signature: "Action0#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action0 dispatch"
+  },
+  {
+    signature: "Action1#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action1 dispatch"
+  },
+  {
+    signature: "Unsafe#defineAnonymousClass",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "sun.misc.Unsafe JDK-internal reflective bridge"
+  },
+  {
+    signature: "MethodHandle#invokeExact",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "java.lang.invoke.MethodHandle \u2014 JDK-internal"
+  }
+];
 function getDefaultConfig() {
   return {
     sources: DEFAULT_SOURCES,
     sinks: DEFAULT_SINKS,
-    sanitizers: DEFAULT_SANITIZERS
+    sanitizers: DEFAULT_SANITIZERS,
+    sinkSemantics: DEFAULT_SINK_SEMANTICS
   };
 }
 
@@ -12499,7 +12577,20 @@ function findSources(calls, types, patterns, sourceLines, language) {
             line: paramLine,
             confidence: param.type ? 0.7 : 0.5,
             // Lower confidence for untyped params
-            in_method: method.name
+            in_method: method.name,
+            // cognium-dev #220 — expose the parameter name to variable-scan flow
+            // detection so uses of the param (including through concat-derived
+            // aliases via `buildJavaTaintedVars`) can be bridged to sinks.
+            //
+            // Java-only: the Python/Rust alias-expansion branches in
+            // taint-propagation-pass.ts use the earliest sourcesWithVar entry
+            // as the anchor for synthetic derived sources. Adding
+            // interprocedural_param to sourcesWithVar in those languages
+            // would cause the anchor to become the low-confidence
+            // interprocedural_param at the method decl line instead of the
+            // real HTTP source, breaking downstream sink-type filters
+            // (regressed #78, #92.1, #105 FP-31, #215 recall).
+            ...language === "java" ? { variable: param.name } : {}
           });
         }
       }
@@ -12963,7 +13054,16 @@ function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   return false;
 }
 var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
-function isSafeJinjaRenderCall(call, pattern, language) {
+var JINJA_AUTOESCAPE_TRUE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*True\b/;
+var JINJA_SELECT_AUTOESCAPE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*select_autoescape\s*\(/;
+var JINJA_AUTOESCAPE_FALSE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*False\b/;
+function fileHasSafeJinjaEnvironment(sourceLines) {
+  if (!sourceLines || sourceLines.length === 0) return false;
+  const text = sourceLines.join("\n");
+  if (JINJA_AUTOESCAPE_FALSE_RE.test(text)) return false;
+  return JINJA_AUTOESCAPE_TRUE_RE.test(text) || JINJA_SELECT_AUTOESCAPE_RE.test(text);
+}
+function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   if (language !== "python") return false;
   if (pattern.type !== "xss" && pattern.type !== "code_injection") return false;
   const method = call.method_name;
@@ -12977,7 +13077,8 @@ function isSafeJinjaRenderCall(call, pattern, language) {
   }
   if (method === "render") {
     const receiver = (call.receiver ?? "").trim();
-    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+    if (TEMPLATE_LITERAL_RECEIVER_RE.test(receiver)) return true;
+    if (fileHasSafeJinjaEnvironment(sourceLines)) return true;
   }
   return false;
 }
@@ -13025,7 +13126,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
-        if (isSafeJinjaRenderCall(call, pattern, language)) {
+        if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
         const location = formatCallLocation(call);
@@ -13033,6 +13134,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         const confidence = calculateSinkConfidence(call, pattern);
         const existing = sinkMap.get(key);
         if (!existing || confidence > existing.confidence) {
+          const receiverType = call.receiver_type;
+          const simpleClass = receiverType ? receiverType.split(".").pop() || void 0 : void 0;
           sinkMap.set(key, {
             type: pattern.type,
             cwe: pattern.cwe,
@@ -13040,7 +13143,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             line: call.location.line,
             confidence,
             method: call.method_name,
-            argPositions: pattern.arg_positions
+            argPositions: pattern.arg_positions,
+            class: simpleClass
           });
         }
       }

package/dist/core/circle-ir-core.js

@@ -6317,6 +6317,12 @@ function resolveReceiverType(receiver, context) {
     return { simpleName: null, fqn: null };
   }
   if (receiver === "super") return { simpleName: null, fqn: null };
+  const ctorMatch = receiver.match(/^new\s+([A-Za-z_$][\w$.]*)\s*[<(]/);
+  if (ctorMatch) {
+    const ctorClass = ctorMatch[1];
+    const simple = ctorClass.includes(".") ? ctorClass.substring(ctorClass.lastIndexOf(".") + 1) : ctorClass;
+    return resolveFqn(simple, context);
+  }
   const declaredType = context.localVarTypes.get(receiver) ?? context.paramTypes.get(receiver) ?? context.fieldTypes.get(receiver);
   if (declaredType) {
     return resolveFqn(stripGenerics(declaredType), context);
@@ -10043,12 +10049,25 @@ function loadSinkConfigs(configs) {
   }
   return { sinks, sanitizers };
 }
-function createTaintConfig(sourceContents, sinkContents) {
+function loadSinkSemanticsConfigs(configs) {
+  const entries = [];
+  for (const config of configs) {
+    if (config.sinks) {
+      entries.push(...config.sinks);
+    }
+  }
+  return entries;
+}
+function createTaintConfig(sourceContents, sinkContents, sinkSemanticsContents = []) {
   const sourceConfigs = sourceContents.map((c) => parseConfig(c));
   const sinkConfigs = sinkContents.map((c) => parseConfig(c));
+  const sinkSemanticsConfigs = sinkSemanticsContents.map(
+    (c) => parseConfig(c)
+  );
   const sources = loadSourceConfigs(sourceConfigs);
   const { sinks, sanitizers } = loadSinkConfigs(sinkConfigs);
-  return { sources, sinks, sanitizers };
+  const sinkSemantics = loadSinkSemanticsConfigs(sinkSemanticsConfigs);
+  return { sources, sinks, sanitizers, sinkSemantics };
 }
 var DEFAULT_SOURCES = [
   // HTTP Sources (Servlet API)
@@ -10767,6 +10786,14 @@ var DEFAULT_SINKS = [
   // reflection remains a downstream concern of body-writing sinks.
   { method: "setHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
   { method: "addHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
+  // Cookie constructor + addCookie — HTTP response splitting via cookie
+  // name/value (CWE-113). Reflects the #189 Sprint 92 V02SetCookie fixture
+  // where `res.addCookie(new Cookie(name, req.getParameter("v")))` allows
+  // CRLF injection into the Set-Cookie header. Both the ctor arg[1] (value)
+  // and the addCookie arg[0] (Cookie handle) are flagged so intermediate-var
+  // and inline-ctor shapes both surface.
+  { method: "Cookie", class: "constructor", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0, 1] },
+  { method: "addCookie", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0] },
   // Note: `sendRedirect` is primarily classified as `ssrf` / open-redirect
   // (CWE-601) further down — see entry near line 1195. CRLF via Location
   // header is a secondary concern; keeping the canonical SSRF entry avoids
@@ -12206,11 +12233,62 @@ var DEFAULT_SANITIZERS = [
   { method: "UUID", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] }
 ];
+var DEFAULT_SINK_SEMANTICS = [
+  {
+    signature: "Jedis#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Redis wire-protocol serialization, not OS exec"
+  },
+  {
+    signature: "Connection#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis abstract Connection base"
+  },
+  {
+    signature: "JedisCluster#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis cluster client"
+  },
+  {
+    signature: "Func1#exec",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection", "code_injection"],
+    note: "RxJava functional dispatch, not OS exec"
+  },
+  {
+    signature: "Action0#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action0 dispatch"
+  },
+  {
+    signature: "Action1#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action1 dispatch"
+  },
+  {
+    signature: "Unsafe#defineAnonymousClass",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "sun.misc.Unsafe JDK-internal reflective bridge"
+  },
+  {
+    signature: "MethodHandle#invokeExact",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "java.lang.invoke.MethodHandle \u2014 JDK-internal"
+  }
+];
 function getDefaultConfig() {
   return {
     sources: DEFAULT_SOURCES,
     sinks: DEFAULT_SINKS,
-    sanitizers: DEFAULT_SANITIZERS
+    sanitizers: DEFAULT_SANITIZERS,
+    sinkSemantics: DEFAULT_SINK_SEMANTICS
   };
 }
 
@@ -12433,7 +12511,20 @@ function findSources(calls, types, patterns, sourceLines, language) {
             line: paramLine,
             confidence: param.type ? 0.7 : 0.5,
             // Lower confidence for untyped params
-            in_method: method.name
+            in_method: method.name,
+            // cognium-dev #220 — expose the parameter name to variable-scan flow
+            // detection so uses of the param (including through concat-derived
+            // aliases via `buildJavaTaintedVars`) can be bridged to sinks.
+            //
+            // Java-only: the Python/Rust alias-expansion branches in
+            // taint-propagation-pass.ts use the earliest sourcesWithVar entry
+            // as the anchor for synthetic derived sources. Adding
+            // interprocedural_param to sourcesWithVar in those languages
+            // would cause the anchor to become the low-confidence
+            // interprocedural_param at the method decl line instead of the
+            // real HTTP source, breaking downstream sink-type filters
+            // (regressed #78, #92.1, #105 FP-31, #215 recall).
+            ...language === "java" ? { variable: param.name } : {}
           });
         }
       }
@@ -12897,7 +12988,16 @@ function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   return false;
 }
 var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
-function isSafeJinjaRenderCall(call, pattern, language) {
+var JINJA_AUTOESCAPE_TRUE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*True\b/;
+var JINJA_SELECT_AUTOESCAPE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*select_autoescape\s*\(/;
+var JINJA_AUTOESCAPE_FALSE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*False\b/;
+function fileHasSafeJinjaEnvironment(sourceLines) {
+  if (!sourceLines || sourceLines.length === 0) return false;
+  const text = sourceLines.join("\n");
+  if (JINJA_AUTOESCAPE_FALSE_RE.test(text)) return false;
+  return JINJA_AUTOESCAPE_TRUE_RE.test(text) || JINJA_SELECT_AUTOESCAPE_RE.test(text);
+}
+function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   if (language !== "python") return false;
   if (pattern.type !== "xss" && pattern.type !== "code_injection") return false;
   const method = call.method_name;
@@ -12911,7 +13011,8 @@ function isSafeJinjaRenderCall(call, pattern, language) {
   }
   if (method === "render") {
     const receiver = (call.receiver ?? "").trim();
-    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+    if (TEMPLATE_LITERAL_RECEIVER_RE.test(receiver)) return true;
+    if (fileHasSafeJinjaEnvironment(sourceLines)) return true;
   }
   return false;
 }
@@ -12959,7 +13060,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
-        if (isSafeJinjaRenderCall(call, pattern, language)) {
+        if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
         const location = formatCallLocation(call);
@@ -12967,6 +13068,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         const confidence = calculateSinkConfidence(call, pattern);
         const existing = sinkMap.get(key);
         if (!existing || confidence > existing.confidence) {
+          const receiverType = call.receiver_type;
+          const simpleClass = receiverType ? receiverType.split(".").pop() || void 0 : void 0;
           sinkMap.set(key, {
             type: pattern.type,
             cwe: pattern.cwe,
@@ -12974,7 +13077,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             line: call.location.line,
             confidence,
             method: call.method_name,
-            argPositions: pattern.arg_positions
+            argPositions: pattern.arg_positions,
+            class: simpleClass
           });
         }
       }

package/dist/core/extractors/calls.js

@@ -828,6 +828,20 @@ function resolveReceiverType(receiver, context) {
     // `super` — defer; cannot determine parent class without hierarchy
     if (receiver === 'super')
         return { simpleName: null, fqn: null };
+    // Constructor receiver: `new X(...)` or `new pkg.X(...)` — resolves to the
+    // constructed class. Enables sink matching on inline receivers built via
+    // `new Yaml().load(taint)` (#189 Sprint 92 SnakeYAML) or
+    // `new ObjectMapper().readValue(taint)` (#189 Sprint 92 Jackson). Nested
+    // constructor arguments are ignored — only the outer class name matters
+    // for method-receiver resolution.
+    const ctorMatch = receiver.match(/^new\s+([A-Za-z_$][\w$.]*)\s*[<(]/);
+    if (ctorMatch) {
+        const ctorClass = ctorMatch[1];
+        const simple = ctorClass.includes('.')
+            ? ctorClass.substring(ctorClass.lastIndexOf('.') + 1)
+            : ctorClass;
+        return resolveFqn(simple, context);
+    }
     // Local variable, parameter, or field declared in this file
     const declaredType = context.localVarTypes.get(receiver) ??
         context.paramTypes.get(receiver) ??