circle-ir 3.144.3 → 3.146.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/entry-point-detection.d.ts.map +1 -1
- package/dist/analysis/entry-point-detection.js +31 -0
- package/dist/analysis/entry-point-detection.js.map +1 -1
- package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
- package/dist/analysis/passes/language-sources-pass.js +183 -0
- package/dist/analysis/passes/language-sources-pass.js.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.js +49 -3
- package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
- package/dist/browser/circle-ir.js +176 -3
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"entry-point-detection.d.ts","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM9D,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,KAAK,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;
|
|
1
|
+
{"version":3,"file":"entry-point-detection.d.ts","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM9D,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,KAAK,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAqUD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,aAAa,EAAE,QAAQ,GAAG,SAAS,EACnC,GAAG,EAAE,iBAAiB,GACrB,cAAc,CAsChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,UAAU,GAAG,SAAS,EACvC,aAAa,EAAE,QAAQ,GAAG,SAAS,EACnC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAKT"}
|
|
@@ -137,6 +137,14 @@ const TIER_1_METHOD_ANNOTATIONS = new Set([
|
|
|
137
137
|
'PATCH',
|
|
138
138
|
'HEAD',
|
|
139
139
|
'OPTIONS',
|
|
140
|
+
// Jenkins Stapler form-binding (#224 — CVE-2022-20617 docker-commons).
|
|
141
|
+
// `@DataBoundConstructor` / `@DataBoundSetter` mark the trust boundary
|
|
142
|
+
// between Jenkins UI (or `config.xml` unmarshal) and the plugin: the
|
|
143
|
+
// Stapler runtime invokes the annotated constructor / setter with
|
|
144
|
+
// user-supplied strings from a submitted form or a persisted job
|
|
145
|
+
// config. Every parameter is a user-supplied taint source.
|
|
146
|
+
'DataBoundConstructor',
|
|
147
|
+
'DataBoundSetter',
|
|
140
148
|
]);
|
|
141
149
|
/**
|
|
142
150
|
* Class-level annotations that make every public method of the class
|
|
@@ -207,6 +215,29 @@ const TIER_1_BY_SUPERTYPE = new Map([
|
|
|
207
215
|
['ChannelInboundHandlerAdapter', new Set(['channelRead', 'channelReadComplete'])],
|
|
208
216
|
['ChannelDuplexHandler', new Set(['channelRead', 'channelReadComplete'])],
|
|
209
217
|
['NettyRequestProcessor', new Set(['process'])],
|
|
218
|
+
// XStream deserialization converters (#224 — CVE-2020-26217,
|
|
219
|
+
// CVE-2021-21345). The xstream deserializer invokes `unmarshal`
|
|
220
|
+
// with attacker-controlled `HierarchicalStreamReader` state whenever
|
|
221
|
+
// untrusted XML reaches `XStream.fromXML`. Each converter is a
|
|
222
|
+
// deserialization gadget surface — its `unmarshal` parameters are
|
|
223
|
+
// network-facing taint sources even though the enclosing class
|
|
224
|
+
// carries no framework annotation. `marshal` is included for the
|
|
225
|
+
// symmetric round-trip surface but is rarely exploitable on its
|
|
226
|
+
// own; the fixup targets `unmarshal` primarily.
|
|
227
|
+
//
|
|
228
|
+
// `SingleValueConverter` is the string-form variant (fromString
|
|
229
|
+
// parses an attacker string; toString is the sink half of the
|
|
230
|
+
// round-trip). `ConverterMatcher` is the shared base and some
|
|
231
|
+
// downstream projects subclass it directly.
|
|
232
|
+
['Converter', new Set(['marshal', 'unmarshal'])],
|
|
233
|
+
['SingleValueConverter', new Set(['fromString', 'toString'])],
|
|
234
|
+
['ConverterMatcher', new Set(['marshal', 'unmarshal'])],
|
|
235
|
+
// XStream abstract base classes — direct-parent `extends` match
|
|
236
|
+
// covers the common shape where user converters subclass a base
|
|
237
|
+
// rather than implementing `Converter` directly.
|
|
238
|
+
['AbstractReflectionConverter', new Set(['marshal', 'unmarshal', 'doMarshal', 'doUnmarshal'])],
|
|
239
|
+
['AbstractSingleValueConverter', new Set(['fromString', 'toString'])],
|
|
240
|
+
['AbstractCollectionConverter', new Set(['marshal', 'unmarshal'])],
|
|
210
241
|
]);
|
|
211
242
|
// ---------------------------------------------------------------------------
|
|
212
243
|
// Tier 3 strengthening — library-facade shape heuristics
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"entry-point-detection.js","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AA0BH,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,cAAc;IACd,+BAA+B;IAC/B,gBAAgB;IAChB,kBAAkB;IAClB,6BAA6B;IAC7B,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,+DAA+D;IAC/D,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;
|
|
1
|
+
{"version":3,"file":"entry-point-detection.js","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AA0BH,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,cAAc;IACd,+BAA+B;IAC/B,gBAAgB;IAChB,kBAAkB;IAClB,6BAA6B;IAC7B,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,+DAA+D;IAC/D,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,2DAA2D;IAC3D,sBAAsB;IACtB,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,8CAA8C;IAC9C,SAAS;IACT,YAAY;IACZ,WAAW;IACX,wBAAwB;IACxB,MAAM;IACN,uCAAuC;IACvC,YAAY;IACZ,6BAA6B;IAC7B,gBAAgB;IAChB,8EAA8E;IAC9E,6DAA6D;IAC7D,aAAa;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,mBAAmB,GAA6C,IAAI,GAAG,CAAC;IAC5E,cAAc;IACd,CAAC,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/G,CAAC,gBAAgB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACjC,aAAa;IACb,CAAC,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/E,CAAC,yBAAyB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,gCAAgC,CAAC,CAAC,CAAC;IACtH,+BAA+B;IAC/B,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,mEAAmE;IACnE,iEAAiE;IACjE,qEAAqE;IACrE,mEAAmE;IACnE,kEAAkE;IAClE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,CAAC,6BAA6B,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC7E,CAAC,uBAAuB,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC1E,CAAC,8BAA8B,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACjF,CAAC,sBAAsB,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACzE,CAAC,uBAAuB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,6DAA6D;IAC7D,gEAAgE;IAChE,qEAAqE;IACrE,+DAA+D;IAC/D,kEAAkE;IAClE,+DAA+D;IAC/D,iEAAiE;IACjE,gEAAgE;IAChE,gDAAgD;IAChD,EAAE;IACF,gEAAgE;IAChE,8DAA8D;IAC9D,8DAA8D;IAC9D,4CAA4C;IAC5C,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAChD,CAAC,sBAAsB,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,CAAC,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACvD,gEAAgE;IAChE,gEAAgE;IAChE,iDAAiD;IACjD,CAAC,6BAA6B,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9F,CAAC,8BAA8B,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC,6BAA6B,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;CACnE,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yDAAyD;AACzD,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,qBAAqB,GAA0B;IACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;CACrC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,wBAAwB,GAA0B;IACtD,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;CACrD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IAChE,sCAAsC;IACtC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO;IACpD,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc;IACxD,4CAA4C;IAC5C,UAAU,EAAE,UAAU,EAAE,cAAc;IACtC,YAAY,EAAE,YAAY;IAC1B,oCAAoC;IACpC,cAAc,EAAE,gBAAgB,EAAE,WAAW;CAC9C,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,IAAwB;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gCAAgC,CAAC,GAA8B;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAuB;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,4BAA4B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,yBAAyB,CAAC,aAAmC;IACpE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,gCAAgC,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,mBAAmB,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CACzB,WAA8C,EAC9C,OAA4B;IAE5B,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG;aACf,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;aACjB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;aACtB,IAAI,EAAE,CAAC;QACV,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,oBAAoB,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAS,oCAAoC,CAC3C,MAAkB,EAClB,aAAmC;IAEnC,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,aAAa,CAAC,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,UAAU,IAAI,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA8B,EAC9B,aAAmC,EACnC,GAAsB;IAEtB,uEAAuE;IACvE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IAE/C,IAAI,CAAC,MAAM;QAAE,OAAO,cAAc,CAAC;IAEnC,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,6BAA6B;IAC7B,IAAI,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,IAAI,aAAa,IAAI,kBAAkB,CAAC,aAAa,CAAC,WAAW,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAC7F,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,gCAAgC;IAChC,IAAI,oCAAoC,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAChE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,yCAAyC;IACzC,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,qDAAqD;IACrD,mEAAmE;IAEnE,cAAc;IACd,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAqC,EACrC,eAAuC,EACvC,aAAmC,EACnC,GAAsB;IAEtB,IAAI,UAAU,KAAK,uBAAuB;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC,CAAC,mCAAmC;IACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,IAAI,KAAK,oBAAoB,CAAC;AACvC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;
|
|
1
|
+
{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAge7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAuDrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAynED,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmGf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkHf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoEf;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA8Ff;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgGf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2If;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Kf;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Jf;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwFf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Ef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Ef;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiFf"}
|
|
@@ -364,6 +364,11 @@ export class LanguageSourcesPass {
|
|
|
364
364
|
// parameterized SQL placeholder sanitizers.
|
|
365
365
|
additionalSanitizers.push(...findJsArgvFormExecSanitizers(code));
|
|
366
366
|
additionalSanitizers.push(...findJsParameterizedSqlSanitizers(code));
|
|
367
|
+
// #223 REG-144-20: JS path.resolve/join + startsWith(root) guard.
|
|
368
|
+
additionalSanitizers.push(...findJsPathResolveStartsWithGuardSanitizers(code));
|
|
369
|
+
// #223 REG-144-17/18/19: JS/TS command allowlist guard
|
|
370
|
+
// (Set.has / Array.includes / indexOf) before execFile/spawn.
|
|
371
|
+
additionalSanitizers.push(...findJsCommandAllowlistGuardSanitizers(code));
|
|
367
372
|
// Sprint 78 (#190): JS misconfig pattern findings — libxmljs noent:true.
|
|
368
373
|
for (const finding of findJsPatternFindings(code, graph.ir.meta.file)) {
|
|
369
374
|
ctx.addFinding(finding);
|
|
@@ -3311,6 +3316,184 @@ function findJsParameterizedSqlSanitizers(code) {
|
|
|
3311
3316
|
}
|
|
3312
3317
|
return sanitizers;
|
|
3313
3318
|
}
|
|
3319
|
+
/**
|
|
3320
|
+
* JS/TS: `path.resolve(root, name)` (or `path.join`) + `.startsWith(root)`
|
|
3321
|
+
* guard sanitizer (cognium-dev #223 REG-144-20).
|
|
3322
|
+
*
|
|
3323
|
+
* Pattern recognized:
|
|
3324
|
+
*
|
|
3325
|
+
* const full = path.resolve(root, name);
|
|
3326
|
+
* if (!full.startsWith(root)) throw new Error('escape');
|
|
3327
|
+
* return fs.readFileSync(full);
|
|
3328
|
+
*
|
|
3329
|
+
* The `path.resolve(root, name)` canonicalizes `..` traversal (an
|
|
3330
|
+
* absolute-path `name` replaces `root` entirely — that case is caught
|
|
3331
|
+
* by the subsequent `full.startsWith(root)` guard with a terminator).
|
|
3332
|
+
* Both the resolve/join and the matching startsWith guard must be
|
|
3333
|
+
* present to emit the sanitizer. Recall on plain `fs.readFile(name)`
|
|
3334
|
+
* without the canonicalize step is unchanged.
|
|
3335
|
+
*
|
|
3336
|
+
* Emits a `path_traversal` + `external_taint_escape` sanitizer at the
|
|
3337
|
+
* resolve line and at every subsequent line that references the
|
|
3338
|
+
* canonicalized variable.
|
|
3339
|
+
*/
|
|
3340
|
+
function findJsPathResolveStartsWithGuardSanitizers(code) {
|
|
3341
|
+
const sanitizers = [];
|
|
3342
|
+
const lines = code.split('\n');
|
|
3343
|
+
// <var> = path.resolve(<root>, ...) | path.join(<root>, ...) | path.normalize(...)
|
|
3344
|
+
// Also accepts `nodePath` / `Path` aliases (`import Path from 'path'`).
|
|
3345
|
+
const resolveDeclRe = /\b(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*(?:(?:node:)?path|nodePath|Path)\s*\.\s*(?:resolve|join)\s*\(\s*([A-Za-z_]\w*(?:\.\w+)*)\s*,/;
|
|
3346
|
+
const startsWithGuardRe = (varName, rootName) => new RegExp(`if\\s*\\(\\s*!\\s*${varName}\\s*\\.\\s*startsWith\\s*\\(\\s*${rootName}\\b`);
|
|
3347
|
+
const terminatorRe = /\b(?:throw|return|res\s*\.\s*status\s*\([^)]*\)\s*\.\s*(?:send|end|json))/;
|
|
3348
|
+
const candidates = [];
|
|
3349
|
+
for (let i = 0; i < lines.length; i++) {
|
|
3350
|
+
const m = resolveDeclRe.exec(lines[i]);
|
|
3351
|
+
if (!m)
|
|
3352
|
+
continue;
|
|
3353
|
+
candidates.push({ line: i + 1, fullVar: m[1], rootVar: m[2] });
|
|
3354
|
+
}
|
|
3355
|
+
if (candidates.length === 0)
|
|
3356
|
+
return sanitizers;
|
|
3357
|
+
for (const c of candidates) {
|
|
3358
|
+
const guardRe = startsWithGuardRe(c.fullVar, c.rootVar);
|
|
3359
|
+
let guardLine = -1;
|
|
3360
|
+
for (let l = c.line; l < Math.min(lines.length, c.line + 6); l++) {
|
|
3361
|
+
if (!guardRe.test(lines[l]))
|
|
3362
|
+
continue;
|
|
3363
|
+
if (terminatorRe.test(lines[l]) ||
|
|
3364
|
+
(l + 1 < lines.length && terminatorRe.test(lines[l + 1]))) {
|
|
3365
|
+
guardLine = l + 1;
|
|
3366
|
+
break;
|
|
3367
|
+
}
|
|
3368
|
+
}
|
|
3369
|
+
if (guardLine < 0)
|
|
3370
|
+
continue;
|
|
3371
|
+
const varRefRe = new RegExp(`\\b${c.fullVar}\\b`);
|
|
3372
|
+
sanitizers.push({
|
|
3373
|
+
type: 'js_path_resolve_startswith_guard',
|
|
3374
|
+
method: 'startsWith',
|
|
3375
|
+
line: c.line,
|
|
3376
|
+
sanitizes: ['path_traversal', 'external_taint_escape'],
|
|
3377
|
+
});
|
|
3378
|
+
for (let l = c.line; l < lines.length; l++) {
|
|
3379
|
+
if (!varRefRe.test(lines[l]))
|
|
3380
|
+
continue;
|
|
3381
|
+
sanitizers.push({
|
|
3382
|
+
type: 'js_path_resolve_startswith_guard',
|
|
3383
|
+
method: 'startsWith',
|
|
3384
|
+
line: l + 1,
|
|
3385
|
+
sanitizes: ['path_traversal', 'external_taint_escape'],
|
|
3386
|
+
});
|
|
3387
|
+
}
|
|
3388
|
+
}
|
|
3389
|
+
return sanitizers;
|
|
3390
|
+
}
|
|
3391
|
+
/**
|
|
3392
|
+
* JS/TS: bounded-command allowlist guard sanitizer (cognium-dev #223
|
|
3393
|
+
* REG-144-17/18/19).
|
|
3394
|
+
*
|
|
3395
|
+
* Pattern recognized:
|
|
3396
|
+
*
|
|
3397
|
+
* const ALLOWED = ['npm', 'yarn', 'pnpm'];
|
|
3398
|
+
* if (!ALLOWED.includes(tool)) throw new Error('unknown tool');
|
|
3399
|
+
* execFile(tool, args);
|
|
3400
|
+
*
|
|
3401
|
+
* When a tainted variable is guarded by an `if (!ALLOW.includes(v))` /
|
|
3402
|
+
* `if (!ALLOW.has(v))` / `if (ALLOW.indexOf(v) < 0)` check followed by
|
|
3403
|
+
* a terminating `throw` / `return`, subsequent references to that
|
|
3404
|
+
* variable point at a value from the allowlist. The value is one of a
|
|
3405
|
+
* fixed set of literals — exec with that value as the program slot
|
|
3406
|
+
* cannot smuggle shell metacharacters. Emits a `command_injection` +
|
|
3407
|
+
* `external_taint_escape` sanitizer for every downstream reference.
|
|
3408
|
+
*
|
|
3409
|
+
* The allowlist name must look like an allowlist: SHOUTY_CASE
|
|
3410
|
+
* (`ALLOWED`, `TOOLS`, `CMDS`) OR contain a substring like `allowed`,
|
|
3411
|
+
* `accepted`, `whitelist`, `permitted`, `valid`, `approved`, `cmds`,
|
|
3412
|
+
* `commands`, `tools`. Conservative bias: an untyped
|
|
3413
|
+
* `if (!x.includes(v))` on an arbitrary `x` does NOT emit the
|
|
3414
|
+
* sanitizer.
|
|
3415
|
+
*/
|
|
3416
|
+
function findJsCommandAllowlistGuardSanitizers(code) {
|
|
3417
|
+
const sanitizers = [];
|
|
3418
|
+
const lines = code.split('\n');
|
|
3419
|
+
// Two-branch match: SHOUTY_CASE (case-sensitive) OR name containing
|
|
3420
|
+
// a known allowlist token (case-insensitive substring test done in
|
|
3421
|
+
// code, not via /i flag, so SHOUTY_CASE stays strict).
|
|
3422
|
+
const shoutyCase = /^[A-Z][A-Z0-9_]+$/;
|
|
3423
|
+
const allowlistTokens = /(?:allowed|accepted|whitelist|permitted|valid|approved|cmds|commands|tools)/i;
|
|
3424
|
+
const isAllowlistName = (n) => shoutyCase.test(n) || allowlistTokens.test(n);
|
|
3425
|
+
// `if (!ALLOW.has(v))` / `if (!ALLOW.includes(v))`
|
|
3426
|
+
const guardHas = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*(?:has|includes)\s*\(\s*([A-Za-z_]\w*)\s*\)\s*\)/;
|
|
3427
|
+
// `if (ALLOW.indexOf(v) < 0)` / `=== -1`
|
|
3428
|
+
const guardIndexOf = /\bif\s*\(\s*([A-Za-z_]\w*)\s*\.\s*indexOf\s*\(\s*([A-Za-z_]\w*)\s*\)\s*(?:<\s*0|===\s*-1|==\s*-1)\s*\)/;
|
|
3429
|
+
const terminator = /\b(?:return|throw|res\s*\.\s*status\s*\([^)]*\)\s*\.\s*(?:send|end|json))/;
|
|
3430
|
+
for (let i = 0; i < lines.length; i++) {
|
|
3431
|
+
const line = lines[i];
|
|
3432
|
+
let m = guardHas.exec(line);
|
|
3433
|
+
let allow = null;
|
|
3434
|
+
let guardedVar = null;
|
|
3435
|
+
if (m) {
|
|
3436
|
+
allow = m[1];
|
|
3437
|
+
guardedVar = m[2];
|
|
3438
|
+
}
|
|
3439
|
+
else {
|
|
3440
|
+
m = guardIndexOf.exec(line);
|
|
3441
|
+
if (m) {
|
|
3442
|
+
allow = m[1];
|
|
3443
|
+
guardedVar = m[2];
|
|
3444
|
+
}
|
|
3445
|
+
}
|
|
3446
|
+
if (!allow || !guardedVar)
|
|
3447
|
+
continue;
|
|
3448
|
+
if (!isAllowlistName(allow))
|
|
3449
|
+
continue;
|
|
3450
|
+
// Confirm the guard body terminates (throw / return). Same-line
|
|
3451
|
+
// single-statement form is common: `if (!A.includes(v)) throw ...;`
|
|
3452
|
+
let bodyHasTerminator = terminator.test(line);
|
|
3453
|
+
let blockEnd = i;
|
|
3454
|
+
if (!bodyHasTerminator) {
|
|
3455
|
+
// Block-form: scan forward for the closing brace and require a
|
|
3456
|
+
// terminator inside.
|
|
3457
|
+
let braceDepth = 0;
|
|
3458
|
+
let started = false;
|
|
3459
|
+
const maxScan = Math.min(lines.length, i + 26);
|
|
3460
|
+
for (let j = i; j < maxScan; j++) {
|
|
3461
|
+
const ln = lines[j];
|
|
3462
|
+
for (const ch of ln) {
|
|
3463
|
+
if (ch === '{') {
|
|
3464
|
+
braceDepth++;
|
|
3465
|
+
started = true;
|
|
3466
|
+
}
|
|
3467
|
+
else if (ch === '}') {
|
|
3468
|
+
braceDepth--;
|
|
3469
|
+
if (started && braceDepth === 0) {
|
|
3470
|
+
blockEnd = j;
|
|
3471
|
+
break;
|
|
3472
|
+
}
|
|
3473
|
+
}
|
|
3474
|
+
}
|
|
3475
|
+
if (started && j > i && terminator.test(ln))
|
|
3476
|
+
bodyHasTerminator = true;
|
|
3477
|
+
if (started && braceDepth === 0 && blockEnd !== i)
|
|
3478
|
+
break;
|
|
3479
|
+
}
|
|
3480
|
+
if (!started || !bodyHasTerminator)
|
|
3481
|
+
continue;
|
|
3482
|
+
}
|
|
3483
|
+
const varRefRe = new RegExp(`\\b${guardedVar}\\b`);
|
|
3484
|
+
for (let l = blockEnd + 1; l < lines.length; l++) {
|
|
3485
|
+
if (!varRefRe.test(lines[l]))
|
|
3486
|
+
continue;
|
|
3487
|
+
sanitizers.push({
|
|
3488
|
+
type: 'js_command_allowlist_guard',
|
|
3489
|
+
method: 'if',
|
|
3490
|
+
line: l + 1,
|
|
3491
|
+
sanitizes: ['command_injection', 'external_taint_escape'],
|
|
3492
|
+
});
|
|
3493
|
+
}
|
|
3494
|
+
}
|
|
3495
|
+
return sanitizers;
|
|
3496
|
+
}
|
|
3314
3497
|
/**
|
|
3315
3498
|
* Java: Path.resolve(...).normalize() + startsWith(ROOT) guard
|
|
3316
3499
|
* sanitizer (cognium-dev #216 Sprint 76 Pattern B).
|