circle-ir 3.144.0 → 3.145.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/entry-point-detection.d.ts.map +1 -1
- package/dist/analysis/entry-point-detection.js +31 -0
- package/dist/analysis/entry-point-detection.js.map +1 -1
- package/dist/analysis/passes/language-sources-pass.d.ts +19 -0
- package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
- package/dist/analysis/passes/language-sources-pass.js +133 -3
- package/dist/analysis/passes/language-sources-pass.js.map +1 -1
- package/dist/analysis/passes/taint-propagation-pass.js +31 -1
- package/dist/analysis/passes/taint-propagation-pass.js.map +1 -1
- package/dist/analysis/taint-matcher.d.ts.map +1 -1
- package/dist/analysis/taint-matcher.js +45 -3
- package/dist/analysis/taint-matcher.js.map +1 -1
- package/dist/browser/circle-ir.js +158 -7
- package/dist/core/circle-ir-core.cjs +27 -4
- package/dist/core/circle-ir-core.js +27 -4
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"entry-point-detection.d.ts","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM9D,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,KAAK,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;
|
|
1
|
+
{"version":3,"file":"entry-point-detection.d.ts","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM9D,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,KAAK,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAqUD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,aAAa,EAAE,QAAQ,GAAG,SAAS,EACnC,GAAG,EAAE,iBAAiB,GACrB,cAAc,CAsChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,UAAU,GAAG,SAAS,EACvC,aAAa,EAAE,QAAQ,GAAG,SAAS,EACnC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAKT"}
|
|
@@ -137,6 +137,14 @@ const TIER_1_METHOD_ANNOTATIONS = new Set([
|
|
|
137
137
|
'PATCH',
|
|
138
138
|
'HEAD',
|
|
139
139
|
'OPTIONS',
|
|
140
|
+
// Jenkins Stapler form-binding (#224 — CVE-2022-20617 docker-commons).
|
|
141
|
+
// `@DataBoundConstructor` / `@DataBoundSetter` mark the trust boundary
|
|
142
|
+
// between Jenkins UI (or `config.xml` unmarshal) and the plugin: the
|
|
143
|
+
// Stapler runtime invokes the annotated constructor / setter with
|
|
144
|
+
// user-supplied strings from a submitted form or a persisted job
|
|
145
|
+
// config. Every parameter is a user-supplied taint source.
|
|
146
|
+
'DataBoundConstructor',
|
|
147
|
+
'DataBoundSetter',
|
|
140
148
|
]);
|
|
141
149
|
/**
|
|
142
150
|
* Class-level annotations that make every public method of the class
|
|
@@ -207,6 +215,29 @@ const TIER_1_BY_SUPERTYPE = new Map([
|
|
|
207
215
|
['ChannelInboundHandlerAdapter', new Set(['channelRead', 'channelReadComplete'])],
|
|
208
216
|
['ChannelDuplexHandler', new Set(['channelRead', 'channelReadComplete'])],
|
|
209
217
|
['NettyRequestProcessor', new Set(['process'])],
|
|
218
|
+
// XStream deserialization converters (#224 — CVE-2020-26217,
|
|
219
|
+
// CVE-2021-21345). The xstream deserializer invokes `unmarshal`
|
|
220
|
+
// with attacker-controlled `HierarchicalStreamReader` state whenever
|
|
221
|
+
// untrusted XML reaches `XStream.fromXML`. Each converter is a
|
|
222
|
+
// deserialization gadget surface — its `unmarshal` parameters are
|
|
223
|
+
// network-facing taint sources even though the enclosing class
|
|
224
|
+
// carries no framework annotation. `marshal` is included for the
|
|
225
|
+
// symmetric round-trip surface but is rarely exploitable on its
|
|
226
|
+
// own; the fixup targets `unmarshal` primarily.
|
|
227
|
+
//
|
|
228
|
+
// `SingleValueConverter` is the string-form variant (fromString
|
|
229
|
+
// parses an attacker string; toString is the sink half of the
|
|
230
|
+
// round-trip). `ConverterMatcher` is the shared base and some
|
|
231
|
+
// downstream projects subclass it directly.
|
|
232
|
+
['Converter', new Set(['marshal', 'unmarshal'])],
|
|
233
|
+
['SingleValueConverter', new Set(['fromString', 'toString'])],
|
|
234
|
+
['ConverterMatcher', new Set(['marshal', 'unmarshal'])],
|
|
235
|
+
// XStream abstract base classes — direct-parent `extends` match
|
|
236
|
+
// covers the common shape where user converters subclass a base
|
|
237
|
+
// rather than implementing `Converter` directly.
|
|
238
|
+
['AbstractReflectionConverter', new Set(['marshal', 'unmarshal', 'doMarshal', 'doUnmarshal'])],
|
|
239
|
+
['AbstractSingleValueConverter', new Set(['fromString', 'toString'])],
|
|
240
|
+
['AbstractCollectionConverter', new Set(['marshal', 'unmarshal'])],
|
|
210
241
|
]);
|
|
211
242
|
// ---------------------------------------------------------------------------
|
|
212
243
|
// Tier 3 strengthening — library-facade shape heuristics
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"entry-point-detection.js","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AA0BH,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,cAAc;IACd,+BAA+B;IAC/B,gBAAgB;IAChB,kBAAkB;IAClB,6BAA6B;IAC7B,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,+DAA+D;IAC/D,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;
|
|
1
|
+
{"version":3,"file":"entry-point-detection.js","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AA0BH,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,cAAc;IACd,+BAA+B;IAC/B,gBAAgB;IAChB,kBAAkB;IAClB,6BAA6B;IAC7B,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,+DAA+D;IAC/D,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,2DAA2D;IAC3D,sBAAsB;IACtB,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,8CAA8C;IAC9C,SAAS;IACT,YAAY;IACZ,WAAW;IACX,wBAAwB;IACxB,MAAM;IACN,uCAAuC;IACvC,YAAY;IACZ,6BAA6B;IAC7B,gBAAgB;IAChB,8EAA8E;IAC9E,6DAA6D;IAC7D,aAAa;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,mBAAmB,GAA6C,IAAI,GAAG,CAAC;IAC5E,cAAc;IACd,CAAC,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/G,CAAC,gBAAgB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACjC,aAAa;IACb,CAAC,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/E,CAAC,yBAAyB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,gCAAgC,CAAC,CAAC,CAAC;IACtH,+BAA+B;IAC/B,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,mEAAmE;IACnE,iEAAiE;IACjE,qEAAqE;IACrE,mEAAmE;IACnE,kEAAkE;IAClE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,CAAC,6BAA6B,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC7E,CAAC,uBAAuB,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC1E,CAAC,8BAA8B,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACjF,CAAC,sBAAsB,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACzE,CAAC,uBAAuB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,6DAA6D;IAC7D,gEAAgE;IAChE,qEAAqE;IACrE,+DAA+D;IAC/D,kEAAkE;IAClE,+DAA+D;IAC/D,iEAAiE;IACjE,gEAAgE;IAChE,gDAAgD;IAChD,EAAE;IACF,gEAAgE;IAChE,8DAA8D;IAC9D,8DAA8D;IAC9D,4CAA4C;IAC5C,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAChD,CAAC,sBAAsB,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,CAAC,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACvD,gEAAgE;IAChE,gEAAgE;IAChE,iDAAiD;IACjD,CAAC,6BAA6B,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9F,CAAC,8BAA8B,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC,6BAA6B,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;CACnE,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yDAAyD;AACzD,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,qBAAqB,GAA0B;IACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;CACrC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,wBAAwB,GAA0B;IACtD,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;CACrD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IAChE,sCAAsC;IACtC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO;IACpD,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc;IACxD,4CAA4C;IAC5C,UAAU,EAAE,UAAU,EAAE,cAAc;IACtC,YAAY,EAAE,YAAY;IAC1B,oCAAoC;IACpC,cAAc,EAAE,gBAAgB,EAAE,WAAW;CAC9C,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,IAAwB;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gCAAgC,CAAC,GAA8B;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAuB;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,4BAA4B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,yBAAyB,CAAC,aAAmC;IACpE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,gCAAgC,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,mBAAmB,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CACzB,WAA8C,EAC9C,OAA4B;IAE5B,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG;aACf,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;aACjB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;aACtB,IAAI,EAAE,CAAC;QACV,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,oBAAoB,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAS,oCAAoC,CAC3C,MAAkB,EAClB,aAAmC;IAEnC,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,aAAa,CAAC,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,UAAU,IAAI,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA8B,EAC9B,aAAmC,EACnC,GAAsB;IAEtB,uEAAuE;IACvE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IAE/C,IAAI,CAAC,MAAM;QAAE,OAAO,cAAc,CAAC;IAEnC,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,6BAA6B;IAC7B,IAAI,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,IAAI,aAAa,IAAI,kBAAkB,CAAC,aAAa,CAAC,WAAW,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAC7F,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,gCAAgC;IAChC,IAAI,oCAAoC,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAChE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,yCAAyC;IACzC,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,qDAAqD;IACrD,mEAAmE;IAEnE,cAAc;IACd,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAqC,EACrC,eAAuC,EACvC,aAAmC,EACnC,GAAsB;IAEtB,IAAI,UAAU,KAAK,uBAAuB;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC,CAAC,mCAAmC;IACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,IAAI,KAAK,oBAAoB,CAAC;AACvC,CAAC"}
|
|
@@ -94,6 +94,25 @@ export declare function buildJavaScriptTaintedVars(sourceCode: string, language:
|
|
|
94
94
|
* Rust source file.
|
|
95
95
|
*/
|
|
96
96
|
export declare function buildRustTaintedVars(sourceCode: string, seedVars: Set<string>): Map<string, number>;
|
|
97
|
+
/**
|
|
98
|
+
* cognium-dev #220 — Java derived-taint expansion.
|
|
99
|
+
*
|
|
100
|
+
* Mirrors {@link buildRustTaintedVars} for Java: given a seed set of
|
|
101
|
+
* already-tainted variable names (real source variables), scan the file
|
|
102
|
+
* for `[Type] lhs = rhs;` declarations and `lhs = rhs;` assignments and
|
|
103
|
+
* propagate taint whenever the RHS references a known tainted name via a
|
|
104
|
+
* word-boundary match. Iterates to a fixpoint to handle multi-hop chains.
|
|
105
|
+
*
|
|
106
|
+
* The primary motivation is Java's array-form `Runtime.exec(String[])`
|
|
107
|
+
* shape:
|
|
108
|
+
* String cmd = "echo " + arg;
|
|
109
|
+
* Runtime.getRuntime().exec(new String[]{"/bin/sh", "-c", cmd});
|
|
110
|
+
* where the variable-scan flow detector would otherwise miss `cmd` since
|
|
111
|
+
* only `arg` is in the source's `variable` field. The alias map is
|
|
112
|
+
* consumed by `detectExpressionScanFlows` in `taint-propagation-pass.ts`
|
|
113
|
+
* to synthesize a virtual source for each derived var.
|
|
114
|
+
*/
|
|
115
|
+
export declare function buildJavaTaintedVars(sourceCode: string, seedVars: Set<string>): Map<string, number>;
|
|
97
116
|
export declare function findBashPatternFindings(sourceCode: string, file: string): SastFinding[];
|
|
98
117
|
export declare function findExternalSecretExfiltrationFindings(code: string, file: string, language: string): SastFinding[];
|
|
99
118
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAud7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;
|
|
1
|
+
{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAud7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAuDrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAq7DD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmGf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkHf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoEf;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA8Ff;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgGf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2If;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Kf;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Jf;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwFf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Ef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Ef;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiFf"}
|
|
@@ -1424,6 +1424,79 @@ export function buildRustTaintedVars(sourceCode, seedVars) {
|
|
|
1424
1424
|
}
|
|
1425
1425
|
return derived;
|
|
1426
1426
|
}
|
|
1427
|
+
/**
|
|
1428
|
+
* cognium-dev #220 — Java derived-taint expansion.
|
|
1429
|
+
*
|
|
1430
|
+
* Mirrors {@link buildRustTaintedVars} for Java: given a seed set of
|
|
1431
|
+
* already-tainted variable names (real source variables), scan the file
|
|
1432
|
+
* for `[Type] lhs = rhs;` declarations and `lhs = rhs;` assignments and
|
|
1433
|
+
* propagate taint whenever the RHS references a known tainted name via a
|
|
1434
|
+
* word-boundary match. Iterates to a fixpoint to handle multi-hop chains.
|
|
1435
|
+
*
|
|
1436
|
+
* The primary motivation is Java's array-form `Runtime.exec(String[])`
|
|
1437
|
+
* shape:
|
|
1438
|
+
* String cmd = "echo " + arg;
|
|
1439
|
+
* Runtime.getRuntime().exec(new String[]{"/bin/sh", "-c", cmd});
|
|
1440
|
+
* where the variable-scan flow detector would otherwise miss `cmd` since
|
|
1441
|
+
* only `arg` is in the source's `variable` field. The alias map is
|
|
1442
|
+
* consumed by `detectExpressionScanFlows` in `taint-propagation-pass.ts`
|
|
1443
|
+
* to synthesize a virtual source for each derived var.
|
|
1444
|
+
*/
|
|
1445
|
+
export function buildJavaTaintedVars(sourceCode, seedVars) {
|
|
1446
|
+
const derived = new Map();
|
|
1447
|
+
const knownTainted = new Set(seedVars);
|
|
1448
|
+
const lines = sourceCode.split('\n');
|
|
1449
|
+
// Declaration: [modifiers] Type[<...>] [ ] lhs = rhs;
|
|
1450
|
+
// Simple assignment: lhs = rhs;
|
|
1451
|
+
// The declaration form is tried first because a Type token in front
|
|
1452
|
+
// would otherwise be matched by the assignment regex as an identifier.
|
|
1453
|
+
//
|
|
1454
|
+
// Kept intentionally conservative:
|
|
1455
|
+
// - single-line RHS only (terminated by `;`)
|
|
1456
|
+
// - no `?:` / `??` fixup — a word-boundary hit anywhere on the RHS
|
|
1457
|
+
// is treated as taint (matches Rust behavior)
|
|
1458
|
+
// - no multi-declaration syntax (`String a, b = x;`) — rare in
|
|
1459
|
+
// tainted contexts and the following-scan will still see the
|
|
1460
|
+
// original var directly.
|
|
1461
|
+
const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
|
|
1462
|
+
const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
|
|
1463
|
+
const JAVA_KEYWORDS = new Set([
|
|
1464
|
+
'if', 'else', 'while', 'for', 'do', 'switch', 'case', 'return',
|
|
1465
|
+
'throw', 'try', 'catch', 'finally', 'new', 'this', 'super',
|
|
1466
|
+
'break', 'continue', 'default', 'class', 'interface', 'enum',
|
|
1467
|
+
]);
|
|
1468
|
+
let changed = true;
|
|
1469
|
+
let guard = 0;
|
|
1470
|
+
while (changed && guard < lines.length + 2) {
|
|
1471
|
+
changed = false;
|
|
1472
|
+
guard++;
|
|
1473
|
+
for (let i = 0; i < lines.length; i++) {
|
|
1474
|
+
const line = lines[i];
|
|
1475
|
+
const trimmed = line.trimStart();
|
|
1476
|
+
if (trimmed.startsWith('//') || trimmed.startsWith('*'))
|
|
1477
|
+
continue;
|
|
1478
|
+
const declMatch = declRe.exec(line);
|
|
1479
|
+
const assignMatch = !declMatch ? assignRe.exec(line) : null;
|
|
1480
|
+
const m = declMatch ?? assignMatch;
|
|
1481
|
+
if (!m)
|
|
1482
|
+
continue;
|
|
1483
|
+
const lhs = m[1];
|
|
1484
|
+
const rhs = m[2];
|
|
1485
|
+
if (JAVA_KEYWORDS.has(lhs))
|
|
1486
|
+
continue;
|
|
1487
|
+
if (knownTainted.has(lhs))
|
|
1488
|
+
continue;
|
|
1489
|
+
const escaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
|
1490
|
+
const ref = [...knownTainted].some(v => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, 'u').test(rhs));
|
|
1491
|
+
if (ref) {
|
|
1492
|
+
derived.set(lhs, i + 1);
|
|
1493
|
+
knownTainted.add(lhs);
|
|
1494
|
+
changed = true;
|
|
1495
|
+
}
|
|
1496
|
+
}
|
|
1497
|
+
}
|
|
1498
|
+
return derived;
|
|
1499
|
+
}
|
|
1427
1500
|
// ---------------------------------------------------------------------------
|
|
1428
1501
|
// Bash/Shell taint sources
|
|
1429
1502
|
// ---------------------------------------------------------------------------
|
|
@@ -1987,10 +2060,11 @@ function findBashRealpathPrefixGuardSanitizers(code) {
|
|
|
1987
2060
|
// An arm pattern is everything up to the first unparenthesised `)`.
|
|
1988
2061
|
// `arm[1]` is the trimmed pattern text.
|
|
1989
2062
|
const armOpener = /^\s*([^)\s][^)]*?)\)/;
|
|
1990
|
-
// A prefix arm starts with a literal path
|
|
1991
|
-
//
|
|
2063
|
+
// A prefix arm starts with a literal path, a `"$VAR"` expansion, or a
|
|
2064
|
+
// literal URL prefix (`https://host.example.com/*` — #222 Sprint 86),
|
|
2065
|
+
// and is followed by `/` (root prefix) or `*` (already anchored). The
|
|
1992
2066
|
// leading character must not itself be `*` — that's the catch-all.
|
|
1993
|
-
const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|[\w\-./]+)(?:\/|\*)/;
|
|
2067
|
+
const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|https?:\/\/[\w\-.]+|[\w\-./]+)(?:\/|\*)/;
|
|
1994
2068
|
// Catch-all is exactly `*` (with optional leading `|`).
|
|
1995
2069
|
const catchAllArm = /^(?:\*|\\\*)$/;
|
|
1996
2070
|
let i = 0;
|
|
@@ -3387,6 +3461,15 @@ function findJavaInlineCrlfStripLogSanitizers(code) {
|
|
|
3387
3461
|
*
|
|
3388
3462
|
* Emits a `command_injection` + `external_taint_escape` sanitizer at
|
|
3389
3463
|
* that line.
|
|
3464
|
+
*
|
|
3465
|
+
* cognium-dev #220 — DO NOT sanitize shell-in-string invocations of the
|
|
3466
|
+
* shape `{"/bin/sh", "-c", cmd}` / `{"bash", "-c", cmd}` /
|
|
3467
|
+
* `{"cmd.exe", "/c", cmd}` etc. In these shapes the shell is explicitly
|
|
3468
|
+
* invoked with a `-c` / `/c` command string, so a tainted trailing
|
|
3469
|
+
* element IS executed as shell code — the argv-splitting protection
|
|
3470
|
+
* does not apply. The exclusion is intentionally conservative: only
|
|
3471
|
+
* lines whose array literal begins with a recognised shell binary
|
|
3472
|
+
* followed by `-c` / `/c` are skipped.
|
|
3390
3473
|
*/
|
|
3391
3474
|
function findJavaArgvFormExecSanitizers(code) {
|
|
3392
3475
|
const sanitizers = [];
|
|
@@ -3395,10 +3478,21 @@ function findJavaArgvFormExecSanitizers(code) {
|
|
|
3395
3478
|
const argvExecRe = /\.\s*exec\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
|
|
3396
3479
|
// new ProcessBuilder(new String[]{...})
|
|
3397
3480
|
const argvPbRe = /\bnew\s+ProcessBuilder\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
|
|
3481
|
+
// Shell-in-string exclusion (cognium-dev #220):
|
|
3482
|
+
// new String[]{"/bin/sh", "-c", ...}
|
|
3483
|
+
// new String[]{"sh", "-c", ...}
|
|
3484
|
+
// new String[]{"bash", "-c", ...}
|
|
3485
|
+
// new String[]{"/usr/bin/sh", "-c", ...}
|
|
3486
|
+
// new String[]{"cmd.exe", "/c", ...} / {"cmd", "/c", ...}
|
|
3487
|
+
// new String[]{"powershell.exe", "-Command", ...}
|
|
3488
|
+
const shellInStringRe = /new\s+String\s*\[\s*\]\s*\{\s*"(?:\/(?:usr\/)?bin\/(?:sh|bash|zsh|ksh|dash)|(?:sh|bash|zsh|ksh|dash)|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh)"\s*,\s*"(?:-c|\/c|-Command|-command)"/i;
|
|
3398
3489
|
for (let i = 0; i < lines.length; i++) {
|
|
3399
3490
|
const text = lines[i];
|
|
3400
3491
|
if (!argvExecRe.test(text) && !argvPbRe.test(text))
|
|
3401
3492
|
continue;
|
|
3493
|
+
// #220: shell-in-string invocations are NOT sanitized by argv splitting.
|
|
3494
|
+
if (shellInStringRe.test(text))
|
|
3495
|
+
continue;
|
|
3402
3496
|
sanitizers.push({
|
|
3403
3497
|
type: 'java_argv_form_exec',
|
|
3404
3498
|
method: 'exec',
|
|
@@ -6088,6 +6182,37 @@ export function findPythonMongoengineWhereNosqlInjectionFindings(code, file) {
|
|
|
6088
6182
|
}
|
|
6089
6183
|
return findings;
|
|
6090
6184
|
}
|
|
6185
|
+
/**
|
|
6186
|
+
* #221 (3.144.1) — host-allowlist sanitizer gate.
|
|
6187
|
+
*
|
|
6188
|
+
* Returns true when a line strictly BEFORE the sink line applies a
|
|
6189
|
+
* narrow host-allowlist check to a tainted variable that reaches the
|
|
6190
|
+
* sink. Two shapes are recognized (both deliberately narrow):
|
|
6191
|
+
*
|
|
6192
|
+
* 1. `<ALLOWLIST>.contains(<var>.getHost())` — Set/List membership
|
|
6193
|
+
* 2. `<var>.getHost().equals(literal)` /
|
|
6194
|
+
* `<var>.getHost().equalsIgnoreCase(literal)`
|
|
6195
|
+
*
|
|
6196
|
+
* Per Sprint 85 design, scheme-only checks like
|
|
6197
|
+
* `url.startsWith("https://")` are NOT recognized — the host portion
|
|
6198
|
+
* remains attacker-controlled.
|
|
6199
|
+
*/
|
|
6200
|
+
function hasHostAllowlistBeforeSink(taintedVars, lines, sinkLineIdx) {
|
|
6201
|
+
for (let i = 0; i < sinkLineIdx; i++) {
|
|
6202
|
+
const t = lines[i];
|
|
6203
|
+
for (const v of taintedVars) {
|
|
6204
|
+
// Pattern 1: <ALLOWLIST>.contains(<var>.getHost())
|
|
6205
|
+
const containsRe = new RegExp(`\\.\\s*contains\\s*\\(\\s*${v}\\s*\\.\\s*getHost\\s*\\(\\s*\\)\\s*\\)`);
|
|
6206
|
+
if (containsRe.test(t))
|
|
6207
|
+
return true;
|
|
6208
|
+
// Pattern 2: <var>.getHost().equals(literal) / equalsIgnoreCase(literal)
|
|
6209
|
+
const equalsRe = new RegExp(`\\b${v}\\s*\\.\\s*getHost\\s*\\(\\s*\\)\\s*\\.\\s*equals(?:IgnoreCase)?\\s*\\(\\s*"[^"]+"\\s*\\)`);
|
|
6210
|
+
if (equalsRe.test(t))
|
|
6211
|
+
return true;
|
|
6212
|
+
}
|
|
6213
|
+
}
|
|
6214
|
+
return false;
|
|
6215
|
+
}
|
|
6091
6216
|
/**
|
|
6092
6217
|
* Sprint 85 detector (#189) — Java SSRF via `new URL(<tainted>)` →
|
|
6093
6218
|
* `.openStream()` / `.openConnection()` / `.getContent()` receiver chains
|
|
@@ -6172,6 +6297,11 @@ export function findJavaUrlOpenStreamSsrfFindings(code, file) {
|
|
|
6172
6297
|
}
|
|
6173
6298
|
if (!tainted)
|
|
6174
6299
|
continue;
|
|
6300
|
+
// #221 (3.144.1) — host-allowlist sanitizer gate. Suppress the
|
|
6301
|
+
// finding when a narrow allowlist check on the tainted var's
|
|
6302
|
+
// `.getHost()` dominates the sink line.
|
|
6303
|
+
if (hasHostAllowlistBeforeSink(taintedVars, lines, i))
|
|
6304
|
+
continue;
|
|
6175
6305
|
const key = `${i + 1}:${op}`;
|
|
6176
6306
|
if (seen.has(key))
|
|
6177
6307
|
continue;
|