circle-ir 3.152.0 → 3.153.0

package/dist/browser/circle-ir.js

@@ -11286,11 +11286,11 @@ var DEFAULT_SINKS = [
   { method: "FileOutputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileReader", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileWriter", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  // ClassLoader/Class resource loading (can be abused for path traversal)
-  { method: "getResource", class: "ClassLoader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResourceAsStream", class: "ClassLoader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResource", class: "Class", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResourceAsStream", class: "Class", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
+  // NOTE: ClassLoader.getResource / Class.getResource were removed in
+  // 3.153.0 (#233). Classpath resource resolution cannot escape the
+  // classpath root via `../` (JAR entries are opaque). If reintroduced,
+  // the correct CWE is CWE-829 (untrusted-classpath-resource), not
+  // CWE-22 path traversal.
   // Paths.get can be used for path traversal
   { method: "get", class: "Paths", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "of", class: "Path", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -11793,6 +11793,15 @@ var DEFAULT_SINKS = [
   { method: "parseObject", class: "JSON", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   { method: "parseObject", class: "JSONObject", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   { method: "fromJson", class: "Gson", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0], safe_if_class_literal_at: 1 },
+  // Jackson ObjectReader — pre-configured reader; typed 2-arg overload is safe
+  // when arg[1] is a class literal or TypeReference<>()/TypeToken<>() (handled
+  // by argIsClassLiteral extension). Added 3.153.0 (cognium-dev #233).
+  { method: "readValue", class: "ObjectReader", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
+  // Jackson ObjectMapper.convertValue — same class-literal shape as readValue.
+  { method: "convertValue", class: "ObjectMapper", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0], safe_if_class_literal_at: 1 },
+  // Kryo.readObject(input, User.class) — typed form is safe; polymorphic form
+  // (Kryo.readClassAndObject or non-literal type) remains a sink.
+  { method: "readObject", class: "Kryo", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   // XMLDecoder
   { method: "readObject", class: "XMLDecoder", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [] },
   // Java serialization constructors
@@ -13652,7 +13661,17 @@ function argIsClassLiteral(call, position) {
   if (!arg) return false;
   const expr = (arg.literal ?? arg.expression ?? "").trim();
   if (!expr) return false;
-  return CLASS_LITERAL_RE.test(expr);
+  if (CLASS_LITERAL_RE.test(expr)) return true;
+  return TYPE_TOKEN_RE.test(expr);
+}
+var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+function argIsStringLiteral(call, position) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg) return false;
+  if (arg.literal !== void 0 && arg.literal !== null && arg.literal !== "") return true;
+  const expr = (arg.expression ?? "").trim();
+  if (!expr) return false;
+  return expr.startsWith('"') && expr.endsWith('"') && expr.length >= 2 || expr.startsWith("'") && expr.endsWith("'") && expr.length >= 2 || expr.startsWith('"""') && expr.endsWith('"""');
 }
 var CWE_78_RECEIVER_ALLOWLIST = /* @__PURE__ */ new Set([
   // java.lang.*
@@ -13827,6 +13846,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }
+        if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
+          continue;
+        }
         if (pattern.type === "command_injection") {
           if (call.is_constructor) {
             if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {
@@ -19553,6 +19575,238 @@ function applyLibraryApiSurfaceDowngrade(findings) {
   });
 }
 
+// src/analysis/entry-point-detection.ts
+var TIER_1_METHOD_ANNOTATIONS = /* @__PURE__ */ new Set([
+  // Spring MVC
+  "RequestMapping",
+  "GetMapping",
+  "PostMapping",
+  "PutMapping",
+  "DeleteMapping",
+  "PatchMapping",
+  // Spring messaging / WebSocket
+  "MessageMapping",
+  "SubscribeMapping",
+  // Spring messaging listeners
+  "KafkaListener",
+  "KafkaHandler",
+  "RabbitListener",
+  "RabbitHandler",
+  "JmsListener",
+  "StreamListener",
+  // Spring Cloud AWS
+  "SqsListener",
+  "SqsHandler",
+  // Spring application events (borderline — inclusive in ship 1)
+  "EventListener",
+  // CRON / scheduled
+  "Scheduled",
+  // JAX-RS
+  "Path",
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS",
+  // Jenkins Stapler form-binding (#224 — CVE-2022-20617 docker-commons).
+  // `@DataBoundConstructor` / `@DataBoundSetter` mark the trust boundary
+  // between Jenkins UI (or `config.xml` unmarshal) and the plugin: the
+  // Stapler runtime invokes the annotated constructor / setter with
+  // user-supplied strings from a submitted form or a persisted job
+  // config. Every parameter is a user-supplied taint source.
+  "DataBoundConstructor",
+  "DataBoundSetter"
+]);
+var TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
+  // Spring MVC
+  "RestController",
+  "Controller",
+  // Spring stereotype beans (#136 — see header)
+  "Service",
+  "Repository",
+  "Component",
+  // JAX-RS resource class
+  "Path",
+  // Servlet 3.0 annotation-based servlet
+  "WebServlet",
+  // JSR-356 WebSocket endpoint
+  "ServerEndpoint",
+  // Declarative HTTP client (borderline — inclusive in ship 1; contract-defined
+  // parameter shapes are downstream-relevant trust boundaries)
+  "FeignClient"
+]);
+var TIER_1_BY_SUPERTYPE = /* @__PURE__ */ new Map([
+  // Servlet API
+  ["HttpServlet", /* @__PURE__ */ new Set(["doGet", "doPost", "doPut", "doDelete", "doHead", "doOptions", "doTrace", "service"])],
+  ["GenericServlet", /* @__PURE__ */ new Set(["service"])],
+  ["Filter", /* @__PURE__ */ new Set(["doFilter"])],
+  // Spring web
+  ["HandlerInterceptor", /* @__PURE__ */ new Set(["preHandle", "postHandle", "afterCompletion"])],
+  ["AsyncHandlerInterceptor", /* @__PURE__ */ new Set(["preHandle", "postHandle", "afterCompletion", "afterConcurrentHandlingStarted"])],
+  // Spring boot CLI entry points
+  ["CommandLineRunner", /* @__PURE__ */ new Set(["run"])],
+  ["ApplicationRunner", /* @__PURE__ */ new Set(["run"])],
+  // Netty channel handlers (#154 — CVE-2022-26884 dolphinscheduler).
+  // `SimpleChannelInboundHandler<T>.channelRead0(ctx, msg)` is the
+  // standard typed read entry; `ChannelInboundHandler.channelRead(ctx,
+  // Object)` is the untyped base. `ChannelInboundHandlerAdapter` and
+  // `ChannelDuplexHandler` are the most-common adapter classes user
+  // handlers extend. `NettyRequestProcessor` is the dolphinscheduler-
+  // specific (and other Netty-RPC projects') wire-message processor
+  // surface — `process(channel, command)` is the network entry point.
+  ["SimpleChannelInboundHandler", /* @__PURE__ */ new Set(["channelRead0", "messageReceived"])],
+  ["ChannelInboundHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
+  ["ChannelInboundHandlerAdapter", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
+  ["ChannelDuplexHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
+  ["NettyRequestProcessor", /* @__PURE__ */ new Set(["process"])],
+  // XStream deserialization converters (#224 — CVE-2020-26217,
+  // CVE-2021-21345). The xstream deserializer invokes `unmarshal`
+  // with attacker-controlled `HierarchicalStreamReader` state whenever
+  // untrusted XML reaches `XStream.fromXML`. Each converter is a
+  // deserialization gadget surface — its `unmarshal` parameters are
+  // network-facing taint sources even though the enclosing class
+  // carries no framework annotation. `marshal` is included for the
+  // symmetric round-trip surface but is rarely exploitable on its
+  // own; the fixup targets `unmarshal` primarily.
+  //
+  // `SingleValueConverter` is the string-form variant (fromString
+  // parses an attacker string; toString is the sink half of the
+  // round-trip). `ConverterMatcher` is the shared base and some
+  // downstream projects subclass it directly.
+  ["Converter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
+  ["SingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
+  ["ConverterMatcher", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
+  // XStream abstract base classes — direct-parent `extends` match
+  // covers the common shape where user converters subclass a base
+  // rather than implementing `Converter` directly.
+  ["AbstractReflectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal", "doMarshal", "doUnmarshal"])],
+  ["AbstractSingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
+  ["AbstractCollectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])]
+]);
+var TIER_3_CLASS_SUFFIXES = [
+  "Util",
+  "Utils",
+  "Helper",
+  "Helpers"
+];
+var TIER_3_PACKAGE_FRAGMENTS = [
+  ".template.",
+  ".templates.",
+  ".engine.",
+  ".engines."
+];
+var TIER_3_JDK_FACADE_INTERFACES = /* @__PURE__ */ new Set([
+  // Collection root + common containers
+  "Collection",
+  "List",
+  "Set",
+  "Map",
+  "Queue",
+  "Deque",
+  "SortedSet",
+  "SortedMap",
+  "NavigableSet",
+  "NavigableMap",
+  // Iteration / ordering / equality contracts
+  "Iterator",
+  "Iterable",
+  "ListIterator",
+  "Comparator",
+  "Comparable",
+  // Serialization / cloning contracts
+  "Serializable",
+  "Externalizable",
+  "Cloneable"
+]);
+function classNameLooksLikeUtility(name2) {
+  if (!name2) return false;
+  for (const suffix of TIER_3_CLASS_SUFFIXES) {
+    if (name2.length > suffix.length && name2.endsWith(suffix)) return true;
+  }
+  return false;
+}
+function packageLooksLikeTemplateOrEngine(pkg) {
+  if (!pkg) return false;
+  const padded = `.${pkg}.`;
+  for (const frag of TIER_3_PACKAGE_FRAGMENTS) {
+    if (padded.includes(frag)) return true;
+  }
+  return false;
+}
+function implementsJdkFacade(t) {
+  if (!t) return false;
+  for (const impl of t.implements ?? []) {
+    if (TIER_3_JDK_FACADE_INTERFACES.has(simpleTypeName(impl))) return true;
+  }
+  return false;
+}
+function classShapeIsLibraryFacade(enclosingType) {
+  if (!enclosingType) return false;
+  if (classNameLooksLikeUtility(enclosingType.name)) return true;
+  if (packageLooksLikeTemplateOrEngine(enclosingType.package)) return true;
+  if (implementsJdkFacade(enclosingType)) return true;
+  return false;
+}
+function annotationsInclude(annotations, targets) {
+  if (!annotations || annotations.length === 0) return false;
+  for (const raw of annotations) {
+    const simple = raw.replace(/^@/, "").replace(/[<(].*$/, "").trim();
+    if (targets.has(simple)) return true;
+  }
+  return false;
+}
+function simpleTypeName(ref) {
+  return ref.replace(/<.*$/, "").trim();
+}
+function looksLikeMainMethod(method) {
+  if (method.name !== "main") return false;
+  const params = method.parameters ?? [];
+  if (params.length !== 1) return false;
+  const t = (params[0].type ?? "").replace(/\s+/g, "");
+  return t === "String[]" || t === "String..." || t === "java.lang.String[]";
+}
+function methodIsSupertypeLifecycleEntryPoint(method, enclosingType) {
+  if (!method.name) return false;
+  if (!enclosingType) return false;
+  const candidates = [];
+  if (enclosingType.extends) candidates.push(simpleTypeName(enclosingType.extends));
+  for (const i2 of enclosingType.implements ?? []) candidates.push(simpleTypeName(i2));
+  for (const supertype of candidates) {
+    const lifecycleMethods = TIER_1_BY_SUPERTYPE.get(supertype);
+    if (lifecycleMethods?.has(method.name)) return true;
+  }
+  return false;
+}
+function classifyEntryPointTier(method, enclosingType, ctx) {
+  const language = (ctx.language ?? "").toLowerCase();
+  if (language !== "java") return "TIER_UNKNOWN";
+  if (!method) return "TIER_UNKNOWN";
+  if (classShapeIsLibraryFacade(enclosingType)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (looksLikeMainMethod(method)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_3_LIBRARY_API";
+}
+function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingType, ctx) {
+  if (sourceType !== "interprocedural_param") return false;
+  if (!enclosingMethod) return false;
+  const tier = classifyEntryPointTier(enclosingMethod, enclosingType, ctx);
+  return tier === "TIER_3_LIBRARY_API";
+}
+
 // src/analysis/project-profile-transform.ts
 var DOWNGRADE_ELIGIBLE_RULE_IDS = /* @__PURE__ */ new Set([
   "code_injection",
@@ -30818,7 +31072,7 @@ var REFLECTION_SINK_METHODS = /* @__PURE__ */ new Set([
   "loadClass",
   "defineClass"
 ]);
-var TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
+var TIER_1_CLASS_ANNOTATIONS2 = /* @__PURE__ */ new Set([
   // Spring MVC
   "RestController",
   "Controller",
@@ -30835,7 +31089,7 @@ var TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
   // Declarative HTTP client
   "FeignClient"
 ]);
-var TIER_1_METHOD_ANNOTATIONS = /* @__PURE__ */ new Set([
+var TIER_1_METHOD_ANNOTATIONS2 = /* @__PURE__ */ new Set([
   // Spring MVC
   "RequestMapping",
   "GetMapping",
@@ -30936,7 +31190,7 @@ var CliMainReflectionSuppressPass = class {
     let hasFrameworkSignal = false;
     for (const type of types) {
       for (const ann of type.annotations) {
-        if (TIER_1_CLASS_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+        if (TIER_1_CLASS_ANNOTATIONS2.has(normalizeAnnotation(ann))) {
           hasFrameworkSignal = true;
           break;
         }
@@ -30955,7 +31209,7 @@ var CliMainReflectionSuppressPass = class {
       if (hasFrameworkSignal) break;
       for (const method of type.methods) {
         for (const ann of method.annotations) {
-          if (TIER_1_METHOD_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+          if (TIER_1_METHOD_ANNOTATIONS2.has(normalizeAnnotation(ann))) {
             hasFrameworkSignal = true;
             break;
           }
@@ -31835,238 +32089,6 @@ function pickScopedSource(sources, sinkLine, methodName, types, taintedVar) {
   return sources[0];
 }
 
-// src/analysis/entry-point-detection.ts
-var TIER_1_METHOD_ANNOTATIONS2 = /* @__PURE__ */ new Set([
-  // Spring MVC
-  "RequestMapping",
-  "GetMapping",
-  "PostMapping",
-  "PutMapping",
-  "DeleteMapping",
-  "PatchMapping",
-  // Spring messaging / WebSocket
-  "MessageMapping",
-  "SubscribeMapping",
-  // Spring messaging listeners
-  "KafkaListener",
-  "KafkaHandler",
-  "RabbitListener",
-  "RabbitHandler",
-  "JmsListener",
-  "StreamListener",
-  // Spring Cloud AWS
-  "SqsListener",
-  "SqsHandler",
-  // Spring application events (borderline — inclusive in ship 1)
-  "EventListener",
-  // CRON / scheduled
-  "Scheduled",
-  // JAX-RS
-  "Path",
-  "GET",
-  "POST",
-  "PUT",
-  "DELETE",
-  "PATCH",
-  "HEAD",
-  "OPTIONS",
-  // Jenkins Stapler form-binding (#224 — CVE-2022-20617 docker-commons).
-  // `@DataBoundConstructor` / `@DataBoundSetter` mark the trust boundary
-  // between Jenkins UI (or `config.xml` unmarshal) and the plugin: the
-  // Stapler runtime invokes the annotated constructor / setter with
-  // user-supplied strings from a submitted form or a persisted job
-  // config. Every parameter is a user-supplied taint source.
-  "DataBoundConstructor",
-  "DataBoundSetter"
-]);
-var TIER_1_CLASS_ANNOTATIONS2 = /* @__PURE__ */ new Set([
-  // Spring MVC
-  "RestController",
-  "Controller",
-  // Spring stereotype beans (#136 — see header)
-  "Service",
-  "Repository",
-  "Component",
-  // JAX-RS resource class
-  "Path",
-  // Servlet 3.0 annotation-based servlet
-  "WebServlet",
-  // JSR-356 WebSocket endpoint
-  "ServerEndpoint",
-  // Declarative HTTP client (borderline — inclusive in ship 1; contract-defined
-  // parameter shapes are downstream-relevant trust boundaries)
-  "FeignClient"
-]);
-var TIER_1_BY_SUPERTYPE = /* @__PURE__ */ new Map([
-  // Servlet API
-  ["HttpServlet", /* @__PURE__ */ new Set(["doGet", "doPost", "doPut", "doDelete", "doHead", "doOptions", "doTrace", "service"])],
-  ["GenericServlet", /* @__PURE__ */ new Set(["service"])],
-  ["Filter", /* @__PURE__ */ new Set(["doFilter"])],
-  // Spring web
-  ["HandlerInterceptor", /* @__PURE__ */ new Set(["preHandle", "postHandle", "afterCompletion"])],
-  ["AsyncHandlerInterceptor", /* @__PURE__ */ new Set(["preHandle", "postHandle", "afterCompletion", "afterConcurrentHandlingStarted"])],
-  // Spring boot CLI entry points
-  ["CommandLineRunner", /* @__PURE__ */ new Set(["run"])],
-  ["ApplicationRunner", /* @__PURE__ */ new Set(["run"])],
-  // Netty channel handlers (#154 — CVE-2022-26884 dolphinscheduler).
-  // `SimpleChannelInboundHandler<T>.channelRead0(ctx, msg)` is the
-  // standard typed read entry; `ChannelInboundHandler.channelRead(ctx,
-  // Object)` is the untyped base. `ChannelInboundHandlerAdapter` and
-  // `ChannelDuplexHandler` are the most-common adapter classes user
-  // handlers extend. `NettyRequestProcessor` is the dolphinscheduler-
-  // specific (and other Netty-RPC projects') wire-message processor
-  // surface — `process(channel, command)` is the network entry point.
-  ["SimpleChannelInboundHandler", /* @__PURE__ */ new Set(["channelRead0", "messageReceived"])],
-  ["ChannelInboundHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
-  ["ChannelInboundHandlerAdapter", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
-  ["ChannelDuplexHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
-  ["NettyRequestProcessor", /* @__PURE__ */ new Set(["process"])],
-  // XStream deserialization converters (#224 — CVE-2020-26217,
-  // CVE-2021-21345). The xstream deserializer invokes `unmarshal`
-  // with attacker-controlled `HierarchicalStreamReader` state whenever
-  // untrusted XML reaches `XStream.fromXML`. Each converter is a
-  // deserialization gadget surface — its `unmarshal` parameters are
-  // network-facing taint sources even though the enclosing class
-  // carries no framework annotation. `marshal` is included for the
-  // symmetric round-trip surface but is rarely exploitable on its
-  // own; the fixup targets `unmarshal` primarily.
-  //
-  // `SingleValueConverter` is the string-form variant (fromString
-  // parses an attacker string; toString is the sink half of the
-  // round-trip). `ConverterMatcher` is the shared base and some
-  // downstream projects subclass it directly.
-  ["Converter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
-  ["SingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
-  ["ConverterMatcher", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
-  // XStream abstract base classes — direct-parent `extends` match
-  // covers the common shape where user converters subclass a base
-  // rather than implementing `Converter` directly.
-  ["AbstractReflectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal", "doMarshal", "doUnmarshal"])],
-  ["AbstractSingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
-  ["AbstractCollectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])]
-]);
-var TIER_3_CLASS_SUFFIXES = [
-  "Util",
-  "Utils",
-  "Helper",
-  "Helpers"
-];
-var TIER_3_PACKAGE_FRAGMENTS = [
-  ".template.",
-  ".templates.",
-  ".engine.",
-  ".engines."
-];
-var TIER_3_JDK_FACADE_INTERFACES = /* @__PURE__ */ new Set([
-  // Collection root + common containers
-  "Collection",
-  "List",
-  "Set",
-  "Map",
-  "Queue",
-  "Deque",
-  "SortedSet",
-  "SortedMap",
-  "NavigableSet",
-  "NavigableMap",
-  // Iteration / ordering / equality contracts
-  "Iterator",
-  "Iterable",
-  "ListIterator",
-  "Comparator",
-  "Comparable",
-  // Serialization / cloning contracts
-  "Serializable",
-  "Externalizable",
-  "Cloneable"
-]);
-function classNameLooksLikeUtility(name2) {
-  if (!name2) return false;
-  for (const suffix of TIER_3_CLASS_SUFFIXES) {
-    if (name2.length > suffix.length && name2.endsWith(suffix)) return true;
-  }
-  return false;
-}
-function packageLooksLikeTemplateOrEngine(pkg) {
-  if (!pkg) return false;
-  const padded = `.${pkg}.`;
-  for (const frag of TIER_3_PACKAGE_FRAGMENTS) {
-    if (padded.includes(frag)) return true;
-  }
-  return false;
-}
-function implementsJdkFacade(t) {
-  if (!t) return false;
-  for (const impl of t.implements ?? []) {
-    if (TIER_3_JDK_FACADE_INTERFACES.has(simpleTypeName(impl))) return true;
-  }
-  return false;
-}
-function classShapeIsLibraryFacade(enclosingType) {
-  if (!enclosingType) return false;
-  if (classNameLooksLikeUtility(enclosingType.name)) return true;
-  if (packageLooksLikeTemplateOrEngine(enclosingType.package)) return true;
-  if (implementsJdkFacade(enclosingType)) return true;
-  return false;
-}
-function annotationsInclude(annotations, targets) {
-  if (!annotations || annotations.length === 0) return false;
-  for (const raw of annotations) {
-    const simple = raw.replace(/^@/, "").replace(/[<(].*$/, "").trim();
-    if (targets.has(simple)) return true;
-  }
-  return false;
-}
-function simpleTypeName(ref) {
-  return ref.replace(/<.*$/, "").trim();
-}
-function looksLikeMainMethod(method) {
-  if (method.name !== "main") return false;
-  const params = method.parameters ?? [];
-  if (params.length !== 1) return false;
-  const t = (params[0].type ?? "").replace(/\s+/g, "");
-  return t === "String[]" || t === "String..." || t === "java.lang.String[]";
-}
-function methodIsSupertypeLifecycleEntryPoint(method, enclosingType) {
-  if (!method.name) return false;
-  if (!enclosingType) return false;
-  const candidates = [];
-  if (enclosingType.extends) candidates.push(simpleTypeName(enclosingType.extends));
-  for (const i2 of enclosingType.implements ?? []) candidates.push(simpleTypeName(i2));
-  for (const supertype of candidates) {
-    const lifecycleMethods = TIER_1_BY_SUPERTYPE.get(supertype);
-    if (lifecycleMethods?.has(method.name)) return true;
-  }
-  return false;
-}
-function classifyEntryPointTier(method, enclosingType, ctx) {
-  const language = (ctx.language ?? "").toLowerCase();
-  if (language !== "java") return "TIER_UNKNOWN";
-  if (!method) return "TIER_UNKNOWN";
-  if (classShapeIsLibraryFacade(enclosingType)) {
-    return "TIER_3_LIBRARY_API";
-  }
-  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS2)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS2)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  if (looksLikeMainMethod(method)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  return "TIER_3_LIBRARY_API";
-}
-function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingType, ctx) {
-  if (sourceType !== "interprocedural_param") return false;
-  if (!enclosingMethod) return false;
-  const tier = classifyEntryPointTier(enclosingMethod, enclosingType, ctx);
-  return tier === "TIER_3_LIBRARY_API";
-}
-
 // src/analysis/passes/interprocedural-pass.ts
 var InterproceduralPass = class {
   name = "interprocedural";

package/dist/core/circle-ir-core.cjs

@@ -10681,11 +10681,11 @@ var DEFAULT_SINKS = [
   { method: "FileOutputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileReader", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileWriter", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  // ClassLoader/Class resource loading (can be abused for path traversal)
-  { method: "getResource", class: "ClassLoader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResourceAsStream", class: "ClassLoader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResource", class: "Class", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResourceAsStream", class: "Class", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
+  // NOTE: ClassLoader.getResource / Class.getResource were removed in
+  // 3.153.0 (#233). Classpath resource resolution cannot escape the
+  // classpath root via `../` (JAR entries are opaque). If reintroduced,
+  // the correct CWE is CWE-829 (untrusted-classpath-resource), not
+  // CWE-22 path traversal.
   // Paths.get can be used for path traversal
   { method: "get", class: "Paths", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "of", class: "Path", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -11188,6 +11188,15 @@ var DEFAULT_SINKS = [
   { method: "parseObject", class: "JSON", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   { method: "parseObject", class: "JSONObject", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   { method: "fromJson", class: "Gson", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0], safe_if_class_literal_at: 1 },
+  // Jackson ObjectReader — pre-configured reader; typed 2-arg overload is safe
+  // when arg[1] is a class literal or TypeReference<>()/TypeToken<>() (handled
+  // by argIsClassLiteral extension). Added 3.153.0 (cognium-dev #233).
+  { method: "readValue", class: "ObjectReader", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
+  // Jackson ObjectMapper.convertValue — same class-literal shape as readValue.
+  { method: "convertValue", class: "ObjectMapper", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0], safe_if_class_literal_at: 1 },
+  // Kryo.readObject(input, User.class) — typed form is safe; polymorphic form
+  // (Kryo.readClassAndObject or non-literal type) remains a sink.
+  { method: "readObject", class: "Kryo", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   // XMLDecoder
   { method: "readObject", class: "XMLDecoder", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [] },
   // Java serialization constructors
@@ -12960,7 +12969,17 @@ function argIsClassLiteral(call, position) {
   if (!arg) return false;
   const expr = (arg.literal ?? arg.expression ?? "").trim();
   if (!expr) return false;
-  return CLASS_LITERAL_RE.test(expr);
+  if (CLASS_LITERAL_RE.test(expr)) return true;
+  return TYPE_TOKEN_RE.test(expr);
+}
+var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+function argIsStringLiteral(call, position) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg) return false;
+  if (arg.literal !== void 0 && arg.literal !== null && arg.literal !== "") return true;
+  const expr = (arg.expression ?? "").trim();
+  if (!expr) return false;
+  return expr.startsWith('"') && expr.endsWith('"') && expr.length >= 2 || expr.startsWith("'") && expr.endsWith("'") && expr.length >= 2 || expr.startsWith('"""') && expr.endsWith('"""');
 }
 var CWE_78_RECEIVER_ALLOWLIST = /* @__PURE__ */ new Set([
   // java.lang.*
@@ -13135,6 +13154,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }
+        if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
+          continue;
+        }
         if (pattern.type === "command_injection") {
           if (call.is_constructor) {
             if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {