circle-ir 3.148.0 → 3.150.0

package/dist/browser/circle-ir.js

@@ -30732,7 +30732,7 @@ var SinkSemanticsPass = class {
       return { droppedCount: 0, registrySize: 0 };
     }
     const registry = buildRegistry(entries);
-    const sinks = graph.ir.taint.sinks;
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
     let droppedCount = 0;
     const kept = sinks.filter((sink) => {
       if (!sink.class || !sink.method) return true;
@@ -30753,6 +30753,191 @@ var SinkSemanticsPass = class {
   }
 };
 
+// src/analysis/passes/cli-main-reflection-suppress-pass.ts
+var REFLECTION_SINK_METHODS = /* @__PURE__ */ new Set([
+  "forName",
+  "newInstance",
+  "invoke",
+  "getMethod",
+  "getDeclaredMethod",
+  "getConstructor",
+  "getDeclaredConstructor",
+  "loadClass",
+  "defineClass"
+]);
+var TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
+  // Spring MVC
+  "RestController",
+  "Controller",
+  // Spring stereotype beans
+  "Service",
+  "Repository",
+  "Component",
+  // JAX-RS resource class
+  "Path",
+  // Servlet 3.0 annotation-based servlet
+  "WebServlet",
+  // JSR-356 WebSocket endpoint
+  "ServerEndpoint",
+  // Declarative HTTP client
+  "FeignClient"
+]);
+var TIER_1_METHOD_ANNOTATIONS = /* @__PURE__ */ new Set([
+  // Spring MVC
+  "RequestMapping",
+  "GetMapping",
+  "PostMapping",
+  "PutMapping",
+  "DeleteMapping",
+  "PatchMapping",
+  // Spring messaging / WebSocket
+  "MessageMapping",
+  "SubscribeMapping",
+  // Spring messaging listeners
+  "KafkaListener",
+  "KafkaHandler",
+  "RabbitListener",
+  "RabbitHandler",
+  "JmsListener",
+  "StreamListener",
+  // Spring Cloud AWS
+  "SqsListener",
+  "SqsHandler",
+  // Spring application events
+  "EventListener",
+  // CRON / scheduled
+  "Scheduled",
+  // JAX-RS
+  "Path",
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS",
+  // Jenkins Stapler form-binding
+  "DataBoundConstructor",
+  "DataBoundSetter"
+]);
+var TIER_1_SUPERTYPES = /* @__PURE__ */ new Set([
+  "HttpServlet",
+  "GenericServlet",
+  "Filter",
+  "HandlerInterceptor",
+  "AsyncHandlerInterceptor",
+  "CommandLineRunner",
+  "ApplicationRunner",
+  "SimpleChannelInboundHandler",
+  "ChannelInboundHandler",
+  "ChannelInboundHandlerAdapter",
+  "ChannelDuplexHandler",
+  "NettyRequestProcessor",
+  "Converter",
+  "SingleValueConverter",
+  "ConverterMatcher",
+  "AbstractReflectionConverter",
+  "AbstractSingleValueConverter",
+  "AbstractCollectionConverter"
+]);
+function normalizeAnnotation(raw) {
+  let s = raw.trim();
+  if (s.startsWith("@")) s = s.slice(1);
+  const parenIdx = s.indexOf("(");
+  if (parenIdx >= 0) s = s.slice(0, parenIdx);
+  const genericIdx = s.indexOf("<");
+  if (genericIdx >= 0) s = s.slice(0, genericIdx);
+  const dotIdx = s.lastIndexOf(".");
+  if (dotIdx >= 0) s = s.slice(dotIdx + 1);
+  return s.trim();
+}
+function normalizeSupertype(raw) {
+  let s = raw.trim();
+  const genericIdx = s.indexOf("<");
+  if (genericIdx >= 0) s = s.slice(0, genericIdx);
+  const dotIdx = s.lastIndexOf(".");
+  if (dotIdx >= 0) s = s.slice(dotIdx + 1);
+  return s.trim();
+}
+function isMainMethod(name2, paramTypes) {
+  if (name2 !== "main") return false;
+  if (paramTypes.length !== 1) return false;
+  const t = paramTypes[0];
+  if (!t) return false;
+  const bare = t.replace(/\s+/g, "");
+  return bare === "String[]" || bare === "java.lang.String[]";
+}
+var CliMainReflectionSuppressPass = class {
+  name = "cli-main-reflection-suppress";
+  category = "security";
+  run(ctx) {
+    const { graph, language } = ctx;
+    if (language !== "java") {
+      return { cliMainSignal: false, droppedCount: 0 };
+    }
+    const types = graph.ir.types;
+    if (!types || types.length === 0) {
+      return { cliMainSignal: false, droppedCount: 0 };
+    }
+    let hasMain = false;
+    let hasFrameworkSignal = false;
+    for (const type of types) {
+      for (const ann of type.annotations) {
+        if (TIER_1_CLASS_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+          hasFrameworkSignal = true;
+          break;
+        }
+      }
+      if (hasFrameworkSignal) break;
+      if (type.extends && TIER_1_SUPERTYPES.has(normalizeSupertype(type.extends))) {
+        hasFrameworkSignal = true;
+        break;
+      }
+      for (const impl of type.implements) {
+        if (TIER_1_SUPERTYPES.has(normalizeSupertype(impl))) {
+          hasFrameworkSignal = true;
+          break;
+        }
+      }
+      if (hasFrameworkSignal) break;
+      for (const method of type.methods) {
+        for (const ann of method.annotations) {
+          if (TIER_1_METHOD_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+            hasFrameworkSignal = true;
+            break;
+          }
+        }
+        if (hasFrameworkSignal) break;
+        if (!hasMain) {
+          const paramTypes = method.parameters.map((p) => p.type);
+          if (isMainMethod(method.name, paramTypes)) {
+            hasMain = true;
+          }
+        }
+      }
+      if (hasFrameworkSignal) break;
+    }
+    const cliMainSignal = hasMain && !hasFrameworkSignal;
+    if (!cliMainSignal) {
+      return { cliMainSignal: false, droppedCount: 0 };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    let droppedCount = 0;
+    const kept = sinks.filter((sink) => {
+      if (sink.type !== "code_injection") return true;
+      if (!sink.method) return true;
+      if (!REFLECTION_SINK_METHODS.has(sink.method)) return true;
+      droppedCount++;
+      return false;
+    });
+    if (droppedCount > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { cliMainSignal: true, droppedCount };
+  }
+};
+
 // src/analysis/passes/taint-propagation-pass.ts
 var TaintPropagationPass = class {
   name = "taint-propagation";
@@ -31544,7 +31729,7 @@ function pickScopedSource(sources, sinkLine, methodName, types, taintedVar) {
 }
 
 // src/analysis/entry-point-detection.ts
-var TIER_1_METHOD_ANNOTATIONS = /* @__PURE__ */ new Set([
+var TIER_1_METHOD_ANNOTATIONS2 = /* @__PURE__ */ new Set([
   // Spring MVC
   "RequestMapping",
   "GetMapping",
@@ -31587,7 +31772,7 @@ var TIER_1_METHOD_ANNOTATIONS = /* @__PURE__ */ new Set([
   "DataBoundConstructor",
   "DataBoundSetter"
 ]);
-var TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
+var TIER_1_CLASS_ANNOTATIONS2 = /* @__PURE__ */ new Set([
   // Spring MVC
   "RestController",
   "Controller",
@@ -31754,10 +31939,10 @@ function classifyEntryPointTier(method, enclosingType, ctx) {
   if (classShapeIsLibraryFacade(enclosingType)) {
     return "TIER_3_LIBRARY_API";
   }
-  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS)) {
+  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS2)) {
     return "TIER_1_ENTRY_POINT";
   }
-  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS)) {
+  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS2)) {
     return "TIER_1_ENTRY_POINT";
   }
   if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
@@ -32710,6 +32895,44 @@ var CLOSE_METHODS = /* @__PURE__ */ new Set([
   "shutdownNow",
   "terminate"
 ]);
+var WRAPPER_CTORS = /* @__PURE__ */ new Set([
+  // java.io wrappers
+  "BufferedInputStream",
+  "BufferedOutputStream",
+  "BufferedReader",
+  "BufferedWriter",
+  "InputStreamReader",
+  "OutputStreamWriter",
+  "DataInputStream",
+  "DataOutputStream",
+  "PrintStream",
+  "PrintWriter",
+  "LineNumberReader",
+  "PushbackInputStream",
+  "PushbackReader",
+  "SequenceInputStream",
+  // java.util.zip wrappers
+  "GZIPInputStream",
+  "GZIPOutputStream",
+  "ZipInputStream",
+  "ZipOutputStream",
+  "InflaterInputStream",
+  "DeflaterOutputStream",
+  "CheckedInputStream",
+  "CheckedOutputStream"
+]);
+var WORKER_METHODS = /* @__PURE__ */ new Set([
+  "run",
+  // Runnable, Thread
+  "call",
+  // Callable
+  "accept",
+  // Consumer
+  "get",
+  // Supplier
+  "apply"
+  // Function
+]);
 var ResourceLeakPass = class {
   name = "resource-leak";
   category = "reliability";
@@ -32741,6 +32964,24 @@ var ResourceLeakPass = class {
       if (this.isFactoryMethod(methodInfo.method)) {
         continue;
       }
+      if (this.isWrappedByCloseableCtor(
+        graph.ir.calls,
+        resourceVar,
+        openLine,
+        methodEnd
+      )) {
+        continue;
+      }
+      if (this.isClosedInNestedWorker(
+        graph,
+        codeLines,
+        resourceVar,
+        methodInfo,
+        openLine,
+        methodEnd
+      )) {
+        continue;
+      }
       const closeCall = graph.ir.calls.find(
         (c) => CLOSE_METHODS.has(c.method_name) && c.receiver === resourceVar && c.location.line > openLine && c.location.line <= methodEnd
       );
@@ -32860,6 +33101,73 @@ var ResourceLeakPass = class {
     if (!method.return_type || method.return_type === "void") return false;
     return FACTORY_METHOD_NAME_RE.test(method.name);
   }
+  /**
+   * #226 — true if `variable` is passed as a constructor argument to a
+   * known Closeable wrapper call within the enclosing method's line
+   * range. Ownership of the inner stream transfers to the wrapper.
+   *
+   * The check is deliberately per-method: cross-method wrapping does
+   * not apply because the inner reference has already escaped the
+   * scope by then.
+   */
+  isWrappedByCloseableCtor(calls, variable, fromLine, toLine) {
+    for (const call of calls) {
+      if (!WRAPPER_CTORS.has(call.method_name)) continue;
+      if (call.location.line < fromLine || call.location.line > toLine) continue;
+      for (const arg of call.arguments) {
+        if (arg.variable === variable) return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * #227 — true if `variable` refers to a field of the enclosing class
+   * that is closed inside a worker-literal method (Runnable#run,
+   * Callable#call, Consumer#accept, ...) declared in the same enclosing
+   * method. Ownership transfers to the executor thread.
+   *
+   * The heuristic is intentionally conservative: it requires both
+   *  (a) the resource variable to match a declared field name on the
+   *      enclosing class (so a stray local named `selector` cannot
+   *      accidentally opt in to the suppression), AND
+   *  (b) a `<field>.close()` (or CLOSE_METHODS) call to appear on a
+   *      line inside a method whose name is one of WORKER_METHODS and
+   *      whose start_line is strictly within the enclosing method's
+   *      body (nested literal indicator).
+   */
+  isClosedInNestedWorker(graph, lines, variable, methodInfo, fromLine, toLine) {
+    const fieldNames = new Set(methodInfo.type.fields.map((f) => f.name));
+    let candidateField = null;
+    if (fieldNames.has(variable)) {
+      candidateField = variable;
+    } else {
+      const thisAssignRe = new RegExp(
+        `(?:\\bthis\\s*\\.\\s*)?(\\w+)\\s*=\\s*${escapeRegex2(variable)}\\b`
+      );
+      for (let l = fromLine; l <= toLine && l <= lines.length; l++) {
+        const m = thisAssignRe.exec(lines[l - 1] ?? "");
+        if (m && fieldNames.has(m[1])) {
+          candidateField = m[1];
+          break;
+        }
+      }
+    }
+    if (!candidateField) return false;
+    for (const call of graph.ir.calls) {
+      if (call.receiver !== candidateField) continue;
+      if (!CLOSE_METHODS.has(call.method_name)) continue;
+      const closeLine = call.location.line;
+      if (closeLine < fromLine || closeLine > toLine) continue;
+      const enclosing = graph.methodAtLine(closeLine);
+      if (!enclosing) continue;
+      if (enclosing.method === methodInfo.method) continue;
+      if (!WORKER_METHODS.has(enclosing.method.name)) continue;
+      if (enclosing.method.start_line > fromLine && enclosing.method.start_line <= toLine) {
+        return true;
+      }
+    }
+    return false;
+  }
 };
 
 // src/graph/scope-graph.ts
@@ -40319,6 +40627,8 @@ async function analyze(code, filePath, language, options = {}) {
     if (!disabledPasses.has("source-semantics")) pipeline.add(new SourceSemanticsPass());
     pipeline.add(new SinkFilterPass());
     if (!disabledPasses.has("sink-semantics")) pipeline.add(new SinkSemanticsPass());
+    if (!disabledPasses.has("cli-main-reflection-suppress"))
+      pipeline.add(new CliMainReflectionSuppressPass());
     pipeline.add(new TaintPropagationPass());
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.148.0",
+  "version": "3.150.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",