circle-ir 3.152.0 → 3.154.0

package/configs/sink-semantics.json

@@ -48,6 +48,108 @@
       "real_class": "jdk_internal",
       "overrides": ["code_injection"],
       "note": "java.lang.invoke.MethodHandle — JDK-internal, not attacker-controllable"
+    },
+    {
+      "signature": "MongoTemplate#execute",
+      "real_class": "nosql_protocol",
+      "overrides": ["sql_injection", "command_injection"],
+      "note": "Spring Data MongoDB template — BSON serialization, not SQL / shell. Added 3.153.0 (#233)."
+    },
+    {
+      "signature": "MongoOperations#execute",
+      "real_class": "nosql_protocol",
+      "overrides": ["sql_injection", "command_injection"],
+      "note": "Spring Data MongoDB interface — same shape as MongoTemplate"
+    },
+    {
+      "signature": "MongoCollection#execute",
+      "real_class": "nosql_protocol",
+      "overrides": ["sql_injection", "command_injection"],
+      "note": "Mongo driver collection — BSON operation dispatch"
+    },
+    {
+      "signature": "CqlSession#execute",
+      "real_class": "nosql_protocol",
+      "overrides": ["command_injection"],
+      "note": "DataStax Cassandra driver — CQL statement dispatch (SQL-injection remains valid; command_injection alias is dropped)"
+    },
+    {
+      "signature": "RedisTemplate#execute",
+      "real_class": "nosql_protocol",
+      "overrides": ["sql_injection", "command_injection"],
+      "note": "Spring Data Redis template — RESP protocol dispatch, not SQL / shell"
+    },
+    {
+      "signature": "StringRedisTemplate#execute",
+      "real_class": "nosql_protocol",
+      "overrides": ["sql_injection", "command_injection"],
+      "note": "Spring Data Redis string-specialised template — same shape as RedisTemplate"
+    },
+    {
+      "signature": "RedissonClient#execute",
+      "real_class": "nosql_protocol",
+      "overrides": ["sql_injection", "command_injection"],
+      "note": "Redisson Redis client — RESP dispatch"
+    },
+    {
+      "signature": "LettuceConnection#execute",
+      "real_class": "nosql_protocol",
+      "overrides": ["sql_injection", "command_injection"],
+      "note": "Lettuce Redis driver connection — RESP dispatch"
+    },
+    {
+      "signature": "RedisConnection#execute",
+      "real_class": "nosql_protocol",
+      "overrides": ["sql_injection", "command_injection"],
+      "note": "Spring Data Redis connection interface — RESP dispatch"
+    },
+    {
+      "signature": "ExecutorService#execute",
+      "real_class": "framework_callback",
+      "overrides": ["command_injection", "sql_injection"],
+      "note": "java.util.concurrent.ExecutorService — Runnable dispatch, not OS exec. JDK concurrency executor callback dispatch. Added 3.153.0 (cognium-dev #233)."
+    },
+    {
+      "signature": "ThreadPoolExecutor#execute",
+      "real_class": "framework_callback",
+      "overrides": ["command_injection", "sql_injection"],
+      "note": "JDK ThreadPoolExecutor — Runnable dispatch"
+    },
+    {
+      "signature": "ForkJoinPool#execute",
+      "real_class": "framework_callback",
+      "overrides": ["command_injection", "sql_injection"],
+      "note": "JDK ForkJoinPool — Runnable/ForkJoinTask dispatch"
+    },
+    {
+      "signature": "ScheduledExecutorService#execute",
+      "real_class": "framework_callback",
+      "overrides": ["command_injection", "sql_injection"],
+      "note": "JDK ScheduledExecutorService — Runnable dispatch"
+    },
+    {
+      "signature": "TaskExecutor#execute",
+      "real_class": "framework_callback",
+      "overrides": ["command_injection", "sql_injection"],
+      "note": "Spring TaskExecutor — Runnable dispatch, not OS exec"
+    },
+    {
+      "signature": "AsyncTaskExecutor#execute",
+      "real_class": "framework_callback",
+      "overrides": ["command_injection", "sql_injection"],
+      "note": "Spring AsyncTaskExecutor — Runnable dispatch"
+    },
+    {
+      "signature": "TransactionTemplate#execute",
+      "real_class": "framework_callback",
+      "overrides": ["sql_injection", "command_injection"],
+      "note": "Spring TransactionTemplate — TransactionCallback dispatch, not raw SQL / shell"
+    },
+    {
+      "signature": "Handler#post",
+      "real_class": "framework_callback",
+      "overrides": ["command_injection"],
+      "note": "Android / Netty Handler — Runnable dispatch, not OS exec"
     }
   ]
 }

package/configs/sinks/command.yaml

@@ -182,16 +182,6 @@
       "cwe": "CWE-078",
       "severity": "high"
     },
-    {
-      "method": "execute",
-      "class": "Executor",
-      "type": "command_injection",
-      "cwe": "CWE-078",
-      "severity": "critical",
-      "arg_positions": [
-        0
-      ]
-    },
     {
       "method": "execute",
       "class": "DefaultExecutor",

package/configs/sinks/deserialization.yaml

@@ -100,6 +100,60 @@
         "insecure_deserialization"
       ],
       "note": "JSON deserialization (safe if default typing disabled)"
+    },
+    {
+      "method": "setupDefaultSecurity",
+      "class": "XStream",
+      "removes": [
+        "insecure_deserialization",
+        "deserialization"
+      ],
+      "note": "XStream 1.4.18+ hardened default security. Added 3.153.0 (#233)."
+    },
+    {
+      "method": "allowTypes",
+      "class": "XStream",
+      "removes": [
+        "insecure_deserialization",
+        "deserialization"
+      ],
+      "note": "XStream type whitelist — restricts deserialized types. Added 3.153.0 (#233)."
+    },
+    {
+      "method": "allowTypeHierarchy",
+      "class": "XStream",
+      "removes": [
+        "insecure_deserialization",
+        "deserialization"
+      ],
+      "note": "XStream type-hierarchy whitelist. Added 3.153.0 (#233)."
+    },
+    {
+      "method": "allowTypesByRegExp",
+      "class": "XStream",
+      "removes": [
+        "insecure_deserialization",
+        "deserialization"
+      ],
+      "note": "XStream regex type whitelist. Added 3.153.0 (#233)."
+    },
+    {
+      "method": "allowTypesByWildcard",
+      "class": "XStream",
+      "removes": [
+        "insecure_deserialization",
+        "deserialization"
+      ],
+      "note": "XStream wildcard type whitelist. Added 3.153.0 (#233)."
+    },
+    {
+      "method": "denyTypes",
+      "class": "XStream",
+      "removes": [
+        "insecure_deserialization",
+        "deserialization"
+      ],
+      "note": "XStream deny-list. Added 3.153.0 (#233)."
     }
   ]
 }

package/configs/sinks/path.yaml

@@ -275,69 +275,6 @@
         0
       ]
     },
-    {
-      "method": "getResource",
-      "class": "ClassLoader",
-      "type": "path_traversal",
-      "cwe": "CWE-022",
-      "severity": "high",
-      "arg_positions": [
-        0
-      ],
-      "note": "ClassLoader resource path traversal"
-    },
-    {
-      "method": "getResourceAsStream",
-      "class": "ClassLoader",
-      "type": "path_traversal",
-      "cwe": "CWE-022",
-      "severity": "high",
-      "arg_positions": [
-        0
-      ]
-    },
-    {
-      "method": "getResources",
-      "class": "ClassLoader",
-      "type": "path_traversal",
-      "cwe": "CWE-022",
-      "severity": "high",
-      "arg_positions": [
-        0
-      ]
-    },
-    {
-      "method": "getResource",
-      "class": "Class",
-      "type": "path_traversal",
-      "cwe": "CWE-022",
-      "severity": "high",
-      "arg_positions": [
-        0
-      ],
-      "note": "Class.getResource() path traversal"
-    },
-    {
-      "method": "getResourceAsStream",
-      "class": "Class",
-      "type": "path_traversal",
-      "cwe": "CWE-022",
-      "severity": "high",
-      "arg_positions": [
-        0
-      ]
-    },
-    {
-      "method": "getResource",
-      "class": "ResourceLoader",
-      "type": "path_traversal",
-      "cwe": "CWE-022",
-      "severity": "high",
-      "arg_positions": [
-        0
-      ],
-      "note": "Spring ResourceLoader"
-    },
     {
       "method": "PathResource",
       "type": "path_traversal",
@@ -398,26 +335,6 @@
         0
       ]
     },
-    {
-      "method": "getResourceAsStream",
-      "type": "path_traversal",
-      "cwe": "CWE-22",
-      "severity": "high",
-      "arg_positions": [
-        0
-      ],
-      "note": "Auto-mined from CVE analysis"
-    },
-    {
-      "method": "getResource",
-      "type": "path_traversal",
-      "cwe": "CWE-22",
-      "severity": "high",
-      "arg_positions": [
-        0
-      ],
-      "note": "Auto-mined from CVE analysis"
-    },
     {
       "method": "File",
       "class": "constructor",
@@ -430,17 +347,6 @@
       ],
       "note": "Auto-mined from CVE analysis. arg 1 covers File(parent, child) overload (CVE-2018-8041)"
     },
-    {
-      "method": "openStream",
-      "class": "URL",
-      "type": "path_traversal",
-      "cwe": "CWE-22",
-      "severity": "high",
-      "arg_positions": [
-        0
-      ],
-      "note": "Auto-mined from CVE analysis"
-    },
     {
       "method": "resolve",
       "type": "path_traversal",

package/configs/sinks/sql.yaml

@@ -67,9 +67,9 @@
       "type": "sql_injection",
       "cwe": "CWE-89",
       "severity": "critical",
-      "arg_positions": [
-        0
-      ]
+      "arg_positions": [0],
+      "safe_if_string_literal_at": 0,
+      "note": "Parameterised SQL literal with ? placeholders is bound by the driver; only non-literal SQL (variable / concat / format) taints. Added 3.153.0 (#233)."
     },
     {
       "method": "queryForObject",
@@ -77,9 +77,9 @@
       "type": "sql_injection",
       "cwe": "CWE-89",
       "severity": "critical",
-      "arg_positions": [
-        0
-      ]
+      "arg_positions": [0],
+      "safe_if_string_literal_at": 0,
+      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
     },
     {
       "method": "queryForList",
@@ -87,9 +87,9 @@
       "type": "sql_injection",
       "cwe": "CWE-89",
       "severity": "critical",
-      "arg_positions": [
-        0
-      ]
+      "arg_positions": [0],
+      "safe_if_string_literal_at": 0,
+      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
     },
     {
       "method": "update",
@@ -97,9 +97,9 @@
       "type": "sql_injection",
       "cwe": "CWE-89",
       "severity": "critical",
-      "arg_positions": [
-        0
-      ]
+      "arg_positions": [0],
+      "safe_if_string_literal_at": 0,
+      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
     },
     {
       "method": "execute",
@@ -107,9 +107,9 @@
       "type": "sql_injection",
       "cwe": "CWE-89",
       "severity": "critical",
-      "arg_positions": [
-        0
-      ]
+      "arg_positions": [0],
+      "safe_if_string_literal_at": 0,
+      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
     },
     {
       "method": "queryForRowSet",
@@ -117,9 +117,9 @@
       "type": "sql_injection",
       "cwe": "CWE-89",
       "severity": "critical",
-      "arg_positions": [
-        0
-      ]
+      "arg_positions": [0],
+      "safe_if_string_literal_at": 0,
+      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
     },
     {
       "method": "queryForMap",
@@ -127,9 +127,9 @@
       "type": "sql_injection",
       "cwe": "CWE-89",
       "severity": "critical",
-      "arg_positions": [
-        0
-      ]
+      "arg_positions": [0],
+      "safe_if_string_literal_at": 0,
+      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
     },
     {
       "method": "batchUpdate",
@@ -137,9 +137,9 @@
       "type": "sql_injection",
       "cwe": "CWE-89",
       "severity": "critical",
-      "arg_positions": [
-        0
-      ]
+      "arg_positions": [0],
+      "safe_if_string_literal_at": 0,
+      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
     },
     {
       "method": "insert",

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA8kDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA6RhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA8lDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA6RhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -626,11 +626,11 @@ export const DEFAULT_SINKS = [
     { method: 'FileOutputStream', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'FileReader', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'FileWriter', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
-    // ClassLoader/Class resource loading (can be abused for path traversal)
-    { method: 'getResource', class: 'ClassLoader', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
-    { method: 'getResourceAsStream', class: 'ClassLoader', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
-    { method: 'getResource', class: 'Class', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
-    { method: 'getResourceAsStream', class: 'Class', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
+    // NOTE: ClassLoader.getResource / Class.getResource were removed in
+    // 3.153.0 (#233). Classpath resource resolution cannot escape the
+    // classpath root via `../` (JAR entries are opaque). If reintroduced,
+    // the correct CWE is CWE-829 (untrusted-classpath-resource), not
+    // CWE-22 path traversal.
     // Paths.get can be used for path traversal
     { method: 'get', class: 'Paths', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'of', class: 'Path', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
@@ -644,9 +644,16 @@ export const DEFAULT_SINKS = [
     { method: 'newBufferedWriter', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'copy', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1] },
     { method: 'move', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1] },
-    { method: 'exists', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [0] },
-    { method: 'isDirectory', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [0] },
-    { method: 'isRegularFile', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [0] },
+    // NOTE: `Files.exists`, `Files.isDirectory`, `Files.isRegularFile`
+    // were removed in 3.154.0 (#245 RC2). These NIO methods are pure
+    // boolean queries — they read a filesystem attribute and cannot
+    // cause traversal escape. A CWE-22 sink must consume the path to
+    // open, read, write, delete, list, or link a filesystem entry;
+    // check-only receivers reveal at most a boolean. Empirically
+    // ~12 H+C FPs across the 10-repo Tier 2 cohort
+    // (cognium-ai#189 §4). `java.io.File` instance methods
+    // (`file.isDirectory()`, `file.exists()`, `file.canRead()`, …)
+    // are already not registered as CWE-22 sinks.
     // RandomAccessFile
     { method: 'RandomAccessFile', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     // Framework-specific resource loading (Cocoon, Spring, etc.)
@@ -1132,6 +1139,15 @@ export const DEFAULT_SINKS = [
     { method: 'parseObject', class: 'JSON', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], safe_if_class_literal_at: 1 },
     { method: 'parseObject', class: 'JSONObject', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], safe_if_class_literal_at: 1 },
     { method: 'fromJson', class: 'Gson', type: 'deserialization', cwe: 'CWE-502', severity: 'medium', arg_positions: [0], safe_if_class_literal_at: 1 },
+    // Jackson ObjectReader — pre-configured reader; typed 2-arg overload is safe
+    // when arg[1] is a class literal or TypeReference<>()/TypeToken<>() (handled
+    // by argIsClassLiteral extension). Added 3.153.0 (cognium-dev #233).
+    { method: 'readValue', class: 'ObjectReader', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], safe_if_class_literal_at: 1 },
+    // Jackson ObjectMapper.convertValue — same class-literal shape as readValue.
+    { method: 'convertValue', class: 'ObjectMapper', type: 'deserialization', cwe: 'CWE-502', severity: 'medium', arg_positions: [0], safe_if_class_literal_at: 1 },
+    // Kryo.readObject(input, User.class) — typed form is safe; polymorphic form
+    // (Kryo.readClassAndObject or non-literal type) remains a sink.
+    { method: 'readObject', class: 'Kryo', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], safe_if_class_literal_at: 1 },
     // XMLDecoder
     { method: 'readObject', class: 'XMLDecoder', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [] },
     // Java serialization constructors