circle-ir 3.144.3 → 3.145.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"entry-point-detection.d.ts","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM9D,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,KAAK,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;
|
|
1
|
+
{"version":3,"file":"entry-point-detection.d.ts","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM9D,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,KAAK,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAqUD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,aAAa,EAAE,QAAQ,GAAG,SAAS,EACnC,GAAG,EAAE,iBAAiB,GACrB,cAAc,CAsChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,UAAU,GAAG,SAAS,EACvC,aAAa,EAAE,QAAQ,GAAG,SAAS,EACnC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAKT"}
|
|
@@ -137,6 +137,14 @@ const TIER_1_METHOD_ANNOTATIONS = new Set([
|
|
|
137
137
|
'PATCH',
|
|
138
138
|
'HEAD',
|
|
139
139
|
'OPTIONS',
|
|
140
|
+
// Jenkins Stapler form-binding (#224 — CVE-2022-20617 docker-commons).
|
|
141
|
+
// `@DataBoundConstructor` / `@DataBoundSetter` mark the trust boundary
|
|
142
|
+
// between Jenkins UI (or `config.xml` unmarshal) and the plugin: the
|
|
143
|
+
// Stapler runtime invokes the annotated constructor / setter with
|
|
144
|
+
// user-supplied strings from a submitted form or a persisted job
|
|
145
|
+
// config. Every parameter is a user-supplied taint source.
|
|
146
|
+
'DataBoundConstructor',
|
|
147
|
+
'DataBoundSetter',
|
|
140
148
|
]);
|
|
141
149
|
/**
|
|
142
150
|
* Class-level annotations that make every public method of the class
|
|
@@ -207,6 +215,29 @@ const TIER_1_BY_SUPERTYPE = new Map([
|
|
|
207
215
|
['ChannelInboundHandlerAdapter', new Set(['channelRead', 'channelReadComplete'])],
|
|
208
216
|
['ChannelDuplexHandler', new Set(['channelRead', 'channelReadComplete'])],
|
|
209
217
|
['NettyRequestProcessor', new Set(['process'])],
|
|
218
|
+
// XStream deserialization converters (#224 — CVE-2020-26217,
|
|
219
|
+
// CVE-2021-21345). The xstream deserializer invokes `unmarshal`
|
|
220
|
+
// with attacker-controlled `HierarchicalStreamReader` state whenever
|
|
221
|
+
// untrusted XML reaches `XStream.fromXML`. Each converter is a
|
|
222
|
+
// deserialization gadget surface — its `unmarshal` parameters are
|
|
223
|
+
// network-facing taint sources even though the enclosing class
|
|
224
|
+
// carries no framework annotation. `marshal` is included for the
|
|
225
|
+
// symmetric round-trip surface but is rarely exploitable on its
|
|
226
|
+
// own; the fixup targets `unmarshal` primarily.
|
|
227
|
+
//
|
|
228
|
+
// `SingleValueConverter` is the string-form variant (fromString
|
|
229
|
+
// parses an attacker string; toString is the sink half of the
|
|
230
|
+
// round-trip). `ConverterMatcher` is the shared base and some
|
|
231
|
+
// downstream projects subclass it directly.
|
|
232
|
+
['Converter', new Set(['marshal', 'unmarshal'])],
|
|
233
|
+
['SingleValueConverter', new Set(['fromString', 'toString'])],
|
|
234
|
+
['ConverterMatcher', new Set(['marshal', 'unmarshal'])],
|
|
235
|
+
// XStream abstract base classes — direct-parent `extends` match
|
|
236
|
+
// covers the common shape where user converters subclass a base
|
|
237
|
+
// rather than implementing `Converter` directly.
|
|
238
|
+
['AbstractReflectionConverter', new Set(['marshal', 'unmarshal', 'doMarshal', 'doUnmarshal'])],
|
|
239
|
+
['AbstractSingleValueConverter', new Set(['fromString', 'toString'])],
|
|
240
|
+
['AbstractCollectionConverter', new Set(['marshal', 'unmarshal'])],
|
|
210
241
|
]);
|
|
211
242
|
// ---------------------------------------------------------------------------
|
|
212
243
|
// Tier 3 strengthening — library-facade shape heuristics
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"entry-point-detection.js","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AA0BH,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,cAAc;IACd,+BAA+B;IAC/B,gBAAgB;IAChB,kBAAkB;IAClB,6BAA6B;IAC7B,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,+DAA+D;IAC/D,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;
|
|
1
|
+
{"version":3,"file":"entry-point-detection.js","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AA0BH,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,cAAc;IACd,+BAA+B;IAC/B,gBAAgB;IAChB,kBAAkB;IAClB,6BAA6B;IAC7B,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,+DAA+D;IAC/D,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,2DAA2D;IAC3D,sBAAsB;IACtB,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,8CAA8C;IAC9C,SAAS;IACT,YAAY;IACZ,WAAW;IACX,wBAAwB;IACxB,MAAM;IACN,uCAAuC;IACvC,YAAY;IACZ,6BAA6B;IAC7B,gBAAgB;IAChB,8EAA8E;IAC9E,6DAA6D;IAC7D,aAAa;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,mBAAmB,GAA6C,IAAI,GAAG,CAAC;IAC5E,cAAc;IACd,CAAC,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/G,CAAC,gBAAgB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACjC,aAAa;IACb,CAAC,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/E,CAAC,yBAAyB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,gCAAgC,CAAC,CAAC,CAAC;IACtH,+BAA+B;IAC/B,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,mEAAmE;IACnE,iEAAiE;IACjE,qEAAqE;IACrE,mEAAmE;IACnE,kEAAkE;IAClE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,CAAC,6BAA6B,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC7E,CAAC,uBAAuB,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC1E,CAAC,8BAA8B,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACjF,CAAC,sBAAsB,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACzE,CAAC,uBAAuB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,6DAA6D;IAC7D,gEAAgE;IAChE,qEAAqE;IACrE,+DAA+D;IAC/D,kEAAkE;IAClE,+DAA+D;IAC/D,iEAAiE;IACjE,gEAAgE;IAChE,gDAAgD;IAChD,EAAE;IACF,gEAAgE;IAChE,8DAA8D;IAC9D,8DAA8D;IAC9D,4CAA4C;IAC5C,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAChD,CAAC,sBAAsB,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,CAAC,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACvD,gEAAgE;IAChE,gEAAgE;IAChE,iDAAiD;IACjD,CAAC,6BAA6B,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9F,CAAC,8BAA8B,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC,6BAA6B,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;CACnE,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yDAAyD;AACzD,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,qBAAqB,GAA0B;IACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;CACrC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,wBAAwB,GAA0B;IACtD,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;CACrD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IAChE,sCAAsC;IACtC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO;IACpD,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc;IACxD,4CAA4C;IAC5C,UAAU,EAAE,UAAU,EAAE,cAAc;IACtC,YAAY,EAAE,YAAY;IAC1B,oCAAoC;IACpC,cAAc,EAAE,gBAAgB,EAAE,WAAW;CAC9C,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,IAAwB;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gCAAgC,CAAC,GAA8B;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAuB;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,4BAA4B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,yBAAyB,CAAC,aAAmC;IACpE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,gCAAgC,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,mBAAmB,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CACzB,WAA8C,EAC9C,OAA4B;IAE5B,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG;aACf,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;aACjB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;aACtB,IAAI,EAAE,CAAC;QACV,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,oBAAoB,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAS,oCAAoC,CAC3C,MAAkB,EAClB,aAAmC;IAEnC,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,aAAa,CAAC,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,UAAU,IAAI,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA8B,EAC9B,aAAmC,EACnC,GAAsB;IAEtB,uEAAuE;IACvE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IAE/C,IAAI,CAAC,MAAM;QAAE,OAAO,cAAc,CAAC;IAEnC,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,6BAA6B;IAC7B,IAAI,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,IAAI,aAAa,IAAI,kBAAkB,CAAC,aAAa,CAAC,WAAW,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAC7F,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,gCAAgC;IAChC,IAAI,oCAAoC,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAChE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,yCAAyC;IACzC,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,qDAAqD;IACrD,mEAAmE;IAEnE,cAAc;IACd,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAqC,EACrC,eAAuC,EACvC,aAAmC,EACnC,GAAsB;IAEtB,IAAI,UAAU,KAAK,uBAAuB;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC,CAAC,mCAAmC;IACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,IAAI,KAAK,oBAAoB,CAAC;AACvC,CAAC"}
|
|
@@ -31386,7 +31386,15 @@ var TIER_1_METHOD_ANNOTATIONS = /* @__PURE__ */ new Set([
|
|
|
31386
31386
|
"DELETE",
|
|
31387
31387
|
"PATCH",
|
|
31388
31388
|
"HEAD",
|
|
31389
|
-
"OPTIONS"
|
|
31389
|
+
"OPTIONS",
|
|
31390
|
+
// Jenkins Stapler form-binding (#224 — CVE-2022-20617 docker-commons).
|
|
31391
|
+
// `@DataBoundConstructor` / `@DataBoundSetter` mark the trust boundary
|
|
31392
|
+
// between Jenkins UI (or `config.xml` unmarshal) and the plugin: the
|
|
31393
|
+
// Stapler runtime invokes the annotated constructor / setter with
|
|
31394
|
+
// user-supplied strings from a submitted form or a persisted job
|
|
31395
|
+
// config. Every parameter is a user-supplied taint source.
|
|
31396
|
+
"DataBoundConstructor",
|
|
31397
|
+
"DataBoundSetter"
|
|
31390
31398
|
]);
|
|
31391
31399
|
var TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
|
|
31392
31400
|
// Spring MVC
|
|
@@ -31429,7 +31437,30 @@ var TIER_1_BY_SUPERTYPE = /* @__PURE__ */ new Map([
|
|
|
31429
31437
|
["ChannelInboundHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
|
|
31430
31438
|
["ChannelInboundHandlerAdapter", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
|
|
31431
31439
|
["ChannelDuplexHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
|
|
31432
|
-
["NettyRequestProcessor", /* @__PURE__ */ new Set(["process"])]
|
|
31440
|
+
["NettyRequestProcessor", /* @__PURE__ */ new Set(["process"])],
|
|
31441
|
+
// XStream deserialization converters (#224 — CVE-2020-26217,
|
|
31442
|
+
// CVE-2021-21345). The xstream deserializer invokes `unmarshal`
|
|
31443
|
+
// with attacker-controlled `HierarchicalStreamReader` state whenever
|
|
31444
|
+
// untrusted XML reaches `XStream.fromXML`. Each converter is a
|
|
31445
|
+
// deserialization gadget surface — its `unmarshal` parameters are
|
|
31446
|
+
// network-facing taint sources even though the enclosing class
|
|
31447
|
+
// carries no framework annotation. `marshal` is included for the
|
|
31448
|
+
// symmetric round-trip surface but is rarely exploitable on its
|
|
31449
|
+
// own; the fixup targets `unmarshal` primarily.
|
|
31450
|
+
//
|
|
31451
|
+
// `SingleValueConverter` is the string-form variant (fromString
|
|
31452
|
+
// parses an attacker string; toString is the sink half of the
|
|
31453
|
+
// round-trip). `ConverterMatcher` is the shared base and some
|
|
31454
|
+
// downstream projects subclass it directly.
|
|
31455
|
+
["Converter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
|
|
31456
|
+
["SingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
|
|
31457
|
+
["ConverterMatcher", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
|
|
31458
|
+
// XStream abstract base classes — direct-parent `extends` match
|
|
31459
|
+
// covers the common shape where user converters subclass a base
|
|
31460
|
+
// rather than implementing `Converter` directly.
|
|
31461
|
+
["AbstractReflectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal", "doMarshal", "doUnmarshal"])],
|
|
31462
|
+
["AbstractSingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
|
|
31463
|
+
["AbstractCollectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])]
|
|
31433
31464
|
]);
|
|
31434
31465
|
var TIER_3_CLASS_SUFFIXES = [
|
|
31435
31466
|
"Util",
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.145.0",
|
|
4
4
|
"description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|