circle-ir 3.144.0 → 3.145.0

package/dist/browser/circle-ir.js

@@ -13269,7 +13269,20 @@ function findSources(calls, types, patterns, sourceLines, language) {
             line: paramLine,
             confidence: param.type ? 0.7 : 0.5,
             // Lower confidence for untyped params
-            in_method: method.name
+            in_method: method.name,
+            // cognium-dev #220 — expose the parameter name to variable-scan flow
+            // detection so uses of the param (including through concat-derived
+            // aliases via `buildJavaTaintedVars`) can be bridged to sinks.
+            //
+            // Java-only: the Python/Rust alias-expansion branches in
+            // taint-propagation-pass.ts use the earliest sourcesWithVar entry
+            // as the anchor for synthetic derived sources. Adding
+            // interprocedural_param to sourcesWithVar in those languages
+            // would cause the anchor to become the low-confidence
+            // interprocedural_param at the method decl line instead of the
+            // real HTTP source, breaking downstream sink-type filters
+            // (regressed #78, #92.1, #105 FP-31, #215 recall).
+            ...language === "java" ? { variable: param.name } : {}
           });
         }
       }
@@ -13733,7 +13746,16 @@ function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   return false;
 }
 var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
-function isSafeJinjaRenderCall(call, pattern, language) {
+var JINJA_AUTOESCAPE_TRUE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*True\b/;
+var JINJA_SELECT_AUTOESCAPE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*select_autoescape\s*\(/;
+var JINJA_AUTOESCAPE_FALSE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*False\b/;
+function fileHasSafeJinjaEnvironment(sourceLines) {
+  if (!sourceLines || sourceLines.length === 0) return false;
+  const text = sourceLines.join("\n");
+  if (JINJA_AUTOESCAPE_FALSE_RE.test(text)) return false;
+  return JINJA_AUTOESCAPE_TRUE_RE.test(text) || JINJA_SELECT_AUTOESCAPE_RE.test(text);
+}
+function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   if (language !== "python") return false;
   if (pattern.type !== "xss" && pattern.type !== "code_injection") return false;
   const method = call.method_name;
@@ -13747,7 +13769,8 @@ function isSafeJinjaRenderCall(call, pattern, language) {
   }
   if (method === "render") {
     const receiver = (call.receiver ?? "").trim();
-    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+    if (TEMPLATE_LITERAL_RECEIVER_RE.test(receiver)) return true;
+    if (fileHasSafeJinjaEnvironment(sourceLines)) return true;
   }
   return false;
 }
@@ -13795,7 +13818,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
-        if (isSafeJinjaRenderCall(call, pattern, language)) {
+        if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
         const location = formatCallLocation(call);
@@ -24734,6 +24757,65 @@ function buildRustTaintedVars(sourceCode, seedVars) {
   }
   return derived;
 }
+function buildJavaTaintedVars(sourceCode, seedVars) {
+  const derived = /* @__PURE__ */ new Map();
+  const knownTainted = new Set(seedVars);
+  const lines = sourceCode.split("\n");
+  const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const JAVA_KEYWORDS = /* @__PURE__ */ new Set([
+    "if",
+    "else",
+    "while",
+    "for",
+    "do",
+    "switch",
+    "case",
+    "return",
+    "throw",
+    "try",
+    "catch",
+    "finally",
+    "new",
+    "this",
+    "super",
+    "break",
+    "continue",
+    "default",
+    "class",
+    "interface",
+    "enum"
+  ]);
+  let changed = true;
+  let guard = 0;
+  while (changed && guard < lines.length + 2) {
+    changed = false;
+    guard++;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const line = lines[i2];
+      const trimmed = line.trimStart();
+      if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+      const declMatch = declRe.exec(line);
+      const assignMatch = !declMatch ? assignRe.exec(line) : null;
+      const m = declMatch ?? assignMatch;
+      if (!m) continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (JAVA_KEYWORDS.has(lhs)) continue;
+      if (knownTainted.has(lhs)) continue;
+      const escaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const ref = [...knownTainted].some(
+        (v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhs)
+      );
+      if (ref) {
+        derived.set(lhs, i2 + 1);
+        knownTainted.add(lhs);
+        changed = true;
+      }
+    }
+  }
+  return derived;
+}
 var BASH_UNTRUSTED_ENV_PATTERNS = [
   /^USER_INPUT$/i,
   /^QUERY_STRING$/i,
@@ -25091,7 +25173,7 @@ function findBashRealpathPrefixGuardSanitizers(code) {
   const caseOpen = /^\s*case\s+"?\$\{?\w+\}?"?\s+in\b/;
   const esacClose = /^\s*esac\b/;
   const armOpener = /^\s*([^)\s][^)]*?)\)/;
-  const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|[\w\-./]+)(?:\/|\*)/;
+  const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|https?:\/\/[\w\-.]+|[\w\-./]+)(?:\/|\*)/;
   const catchAllArm = /^(?:\*|\\\*)$/;
   let i2 = 0;
   while (i2 < lines.length) {
@@ -25916,9 +25998,11 @@ function findJavaArgvFormExecSanitizers(code) {
   const lines = code.split("\n");
   const argvExecRe = /\.\s*exec\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
   const argvPbRe = /\bnew\s+ProcessBuilder\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
+  const shellInStringRe = /new\s+String\s*\[\s*\]\s*\{\s*"(?:\/(?:usr\/)?bin\/(?:sh|bash|zsh|ksh|dash)|(?:sh|bash|zsh|ksh|dash)|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh)"\s*,\s*"(?:-c|\/c|-Command|-command)"/i;
   for (let i2 = 0; i2 < lines.length; i2++) {
     const text = lines[i2];
     if (!argvExecRe.test(text) && !argvPbRe.test(text)) continue;
+    if (shellInStringRe.test(text)) continue;
     sanitizers.push({
       type: "java_argv_form_exec",
       method: "exec",
@@ -27855,6 +27939,22 @@ function findPythonMongoengineWhereNosqlInjectionFindings(code, file) {
   }
   return findings;
 }
+function hasHostAllowlistBeforeSink(taintedVars, lines, sinkLineIdx) {
+  for (let i2 = 0; i2 < sinkLineIdx; i2++) {
+    const t = lines[i2];
+    for (const v of taintedVars) {
+      const containsRe = new RegExp(
+        `\\.\\s*contains\\s*\\(\\s*${v}\\s*\\.\\s*getHost\\s*\\(\\s*\\)\\s*\\)`
+      );
+      if (containsRe.test(t)) return true;
+      const equalsRe = new RegExp(
+        `\\b${v}\\s*\\.\\s*getHost\\s*\\(\\s*\\)\\s*\\.\\s*equals(?:IgnoreCase)?\\s*\\(\\s*"[^"]+"\\s*\\)`
+      );
+      if (equalsRe.test(t)) return true;
+    }
+  }
+  return false;
+}
 function findJavaUrlOpenStreamSsrfFindings(code, file) {
   const findings = [];
   if (typeof code !== "string" || code.length === 0) return findings;
@@ -27910,6 +28010,7 @@ function findJavaUrlOpenStreamSsrfFindings(code, file) {
       }
     }
     if (!tainted) continue;
+    if (hasHostAllowlistBeforeSink(taintedVars, lines, i2)) continue;
     const key = `${i2 + 1}:${op}`;
     if (seen.has(key)) continue;
     seen.add(key);
@@ -31090,6 +31191,25 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  if (language === "java" && typeof code === "string" && sourcesWithVar.length > 0) {
+    const seedVars = new Set(sourcesWithVar.map((s) => s.variable));
+    const derived = buildJavaTaintedVars(code, seedVars);
+    if (derived.size > 0) {
+      let anchor = sourcesWithVar[0];
+      for (const s of sourcesWithVar) {
+        if (s.line < anchor.line) anchor = s;
+      }
+      const existingVars = new Set(sourcesWithVar.map((s) => s.variable));
+      for (const [varName] of derived) {
+        if (!varName || existingVars.has(varName)) continue;
+        sourcesWithVar.push({
+          ...anchor,
+          variable: varName
+        });
+        existingVars.add(varName);
+      }
+    }
+  }
   const reCache = /* @__PURE__ */ new Map();
   for (const s of sourcesWithVar) {
     if (reCache.has(s.variable)) continue;
@@ -31266,7 +31386,15 @@ var TIER_1_METHOD_ANNOTATIONS = /* @__PURE__ */ new Set([
   "DELETE",
   "PATCH",
   "HEAD",
-  "OPTIONS"
+  "OPTIONS",
+  // Jenkins Stapler form-binding (#224 — CVE-2022-20617 docker-commons).
+  // `@DataBoundConstructor` / `@DataBoundSetter` mark the trust boundary
+  // between Jenkins UI (or `config.xml` unmarshal) and the plugin: the
+  // Stapler runtime invokes the annotated constructor / setter with
+  // user-supplied strings from a submitted form or a persisted job
+  // config. Every parameter is a user-supplied taint source.
+  "DataBoundConstructor",
+  "DataBoundSetter"
 ]);
 var TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
   // Spring MVC
@@ -31309,7 +31437,30 @@ var TIER_1_BY_SUPERTYPE = /* @__PURE__ */ new Map([
   ["ChannelInboundHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
   ["ChannelInboundHandlerAdapter", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
   ["ChannelDuplexHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
-  ["NettyRequestProcessor", /* @__PURE__ */ new Set(["process"])]
+  ["NettyRequestProcessor", /* @__PURE__ */ new Set(["process"])],
+  // XStream deserialization converters (#224 — CVE-2020-26217,
+  // CVE-2021-21345). The xstream deserializer invokes `unmarshal`
+  // with attacker-controlled `HierarchicalStreamReader` state whenever
+  // untrusted XML reaches `XStream.fromXML`. Each converter is a
+  // deserialization gadget surface — its `unmarshal` parameters are
+  // network-facing taint sources even though the enclosing class
+  // carries no framework annotation. `marshal` is included for the
+  // symmetric round-trip surface but is rarely exploitable on its
+  // own; the fixup targets `unmarshal` primarily.
+  //
+  // `SingleValueConverter` is the string-form variant (fromString
+  // parses an attacker string; toString is the sink half of the
+  // round-trip). `ConverterMatcher` is the shared base and some
+  // downstream projects subclass it directly.
+  ["Converter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
+  ["SingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
+  ["ConverterMatcher", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
+  // XStream abstract base classes — direct-parent `extends` match
+  // covers the common shape where user converters subclass a base
+  // rather than implementing `Converter` directly.
+  ["AbstractReflectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal", "doMarshal", "doUnmarshal"])],
+  ["AbstractSingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
+  ["AbstractCollectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])]
 ]);
 var TIER_3_CLASS_SUFFIXES = [
   "Util",

package/dist/core/circle-ir-core.cjs

@@ -12577,7 +12577,20 @@ function findSources(calls, types, patterns, sourceLines, language) {
             line: paramLine,
             confidence: param.type ? 0.7 : 0.5,
             // Lower confidence for untyped params
-            in_method: method.name
+            in_method: method.name,
+            // cognium-dev #220 — expose the parameter name to variable-scan flow
+            // detection so uses of the param (including through concat-derived
+            // aliases via `buildJavaTaintedVars`) can be bridged to sinks.
+            //
+            // Java-only: the Python/Rust alias-expansion branches in
+            // taint-propagation-pass.ts use the earliest sourcesWithVar entry
+            // as the anchor for synthetic derived sources. Adding
+            // interprocedural_param to sourcesWithVar in those languages
+            // would cause the anchor to become the low-confidence
+            // interprocedural_param at the method decl line instead of the
+            // real HTTP source, breaking downstream sink-type filters
+            // (regressed #78, #92.1, #105 FP-31, #215 recall).
+            ...language === "java" ? { variable: param.name } : {}
           });
         }
       }
@@ -13041,7 +13054,16 @@ function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   return false;
 }
 var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
-function isSafeJinjaRenderCall(call, pattern, language) {
+var JINJA_AUTOESCAPE_TRUE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*True\b/;
+var JINJA_SELECT_AUTOESCAPE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*select_autoescape\s*\(/;
+var JINJA_AUTOESCAPE_FALSE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*False\b/;
+function fileHasSafeJinjaEnvironment(sourceLines) {
+  if (!sourceLines || sourceLines.length === 0) return false;
+  const text = sourceLines.join("\n");
+  if (JINJA_AUTOESCAPE_FALSE_RE.test(text)) return false;
+  return JINJA_AUTOESCAPE_TRUE_RE.test(text) || JINJA_SELECT_AUTOESCAPE_RE.test(text);
+}
+function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   if (language !== "python") return false;
   if (pattern.type !== "xss" && pattern.type !== "code_injection") return false;
   const method = call.method_name;
@@ -13055,7 +13077,8 @@ function isSafeJinjaRenderCall(call, pattern, language) {
   }
   if (method === "render") {
     const receiver = (call.receiver ?? "").trim();
-    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+    if (TEMPLATE_LITERAL_RECEIVER_RE.test(receiver)) return true;
+    if (fileHasSafeJinjaEnvironment(sourceLines)) return true;
   }
   return false;
 }
@@ -13103,7 +13126,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
-        if (isSafeJinjaRenderCall(call, pattern, language)) {
+        if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
         const location = formatCallLocation(call);

package/dist/core/circle-ir-core.js

@@ -12511,7 +12511,20 @@ function findSources(calls, types, patterns, sourceLines, language) {
             line: paramLine,
             confidence: param.type ? 0.7 : 0.5,
             // Lower confidence for untyped params
-            in_method: method.name
+            in_method: method.name,
+            // cognium-dev #220 — expose the parameter name to variable-scan flow
+            // detection so uses of the param (including through concat-derived
+            // aliases via `buildJavaTaintedVars`) can be bridged to sinks.
+            //
+            // Java-only: the Python/Rust alias-expansion branches in
+            // taint-propagation-pass.ts use the earliest sourcesWithVar entry
+            // as the anchor for synthetic derived sources. Adding
+            // interprocedural_param to sourcesWithVar in those languages
+            // would cause the anchor to become the low-confidence
+            // interprocedural_param at the method decl line instead of the
+            // real HTTP source, breaking downstream sink-type filters
+            // (regressed #78, #92.1, #105 FP-31, #215 recall).
+            ...language === "java" ? { variable: param.name } : {}
           });
         }
       }
@@ -12975,7 +12988,16 @@ function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   return false;
 }
 var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
-function isSafeJinjaRenderCall(call, pattern, language) {
+var JINJA_AUTOESCAPE_TRUE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*True\b/;
+var JINJA_SELECT_AUTOESCAPE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*select_autoescape\s*\(/;
+var JINJA_AUTOESCAPE_FALSE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*False\b/;
+function fileHasSafeJinjaEnvironment(sourceLines) {
+  if (!sourceLines || sourceLines.length === 0) return false;
+  const text = sourceLines.join("\n");
+  if (JINJA_AUTOESCAPE_FALSE_RE.test(text)) return false;
+  return JINJA_AUTOESCAPE_TRUE_RE.test(text) || JINJA_SELECT_AUTOESCAPE_RE.test(text);
+}
+function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   if (language !== "python") return false;
   if (pattern.type !== "xss" && pattern.type !== "code_injection") return false;
   const method = call.method_name;
@@ -12989,7 +13011,8 @@ function isSafeJinjaRenderCall(call, pattern, language) {
   }
   if (method === "render") {
     const receiver = (call.receiver ?? "").trim();
-    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+    if (TEMPLATE_LITERAL_RECEIVER_RE.test(receiver)) return true;
+    if (fileHasSafeJinjaEnvironment(sourceLines)) return true;
   }
   return false;
 }
@@ -13037,7 +13060,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
-        if (isSafeJinjaRenderCall(call, pattern, language)) {
+        if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
         const location = formatCallLocation(call);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.144.0",
+  "version": "3.145.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",