circle-ir 3.153.0 → 3.155.0

package/configs/sinks/code_injection.yaml

@@ -109,7 +109,8 @@
       "arg_positions": [
         0
       ],
-      "note": "Can load arbitrary classes with user input"
+      "safe_if_string_literal_at": 0,
+      "note": "Can load arbitrary classes with user input. Literal FQN (Class.forName(\"com.foo.Bar\")) is safe; tainted argument still fires (cognium-dev #239 C.1)."
     },
     {
       "method": "newInstance",

package/configs/sinks/javascript_dom_xss.yaml

@@ -21,7 +21,8 @@
       "cwe": "CWE-79",
       "severity": "critical",
       "arg_positions": [0],
-      "note": "DOM XSS - document.write with user input"
+      "safe_if_string_literal_at": 0,
+      "note": "DOM XSS - document.write with user input. Literal-only argument is safe (cognium-dev #239 C.4)."
     },
     {
       "method": "writeln",
@@ -30,7 +31,8 @@
       "cwe": "CWE-79",
       "severity": "critical",
       "arg_positions": [0],
-      "note": "DOM XSS - document.writeln with user input"
+      "safe_if_string_literal_at": 0,
+      "note": "DOM XSS - document.writeln with user input. Literal-only argument is safe (cognium-dev #239 C.4)."
     },
     {
       "method": "insertAdjacentHTML",

package/configs/sinks/xpath.yaml

@@ -111,11 +111,51 @@
       ],
       "note": "Using variables is safe"
     },
+    {
+      "method": "setXPathVariableResolver",
+      "class": "XPathExpression",
+      "removes": [
+        "xpath_injection"
+      ],
+      "note": "cognium-dev #238 A.2 — XPathExpression receiver variant"
+    },
     {
       "method": "encodeForXPath",
       "removes": [
         "xpath_injection"
       ]
+    },
+    {
+      "method": "encodeForXPath",
+      "class": "Encoder",
+      "removes": [
+        "xpath_injection"
+      ],
+      "note": "cognium-dev #238 A.2 — ESAPI.encoder().encodeForXPath()"
+    },
+    {
+      "method": "escapeXml",
+      "class": "StringEscapeUtils",
+      "removes": [
+        "xpath_injection"
+      ],
+      "note": "cognium-dev #238 A.2 — commons-text / commons-lang3"
+    },
+    {
+      "method": "escapeXml10",
+      "class": "StringEscapeUtils",
+      "removes": [
+        "xpath_injection"
+      ],
+      "note": "cognium-dev #238 A.2 — commons-text"
+    },
+    {
+      "method": "escapeXml11",
+      "class": "StringEscapeUtils",
+      "removes": [
+        "xpath_injection"
+      ],
+      "note": "cognium-dev #238 A.2 — commons-text"
     }
   ]
 }

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAulDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA6RhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA8lDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgShD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -644,9 +644,16 @@ export const DEFAULT_SINKS = [
     { method: 'newBufferedWriter', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'copy', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1] },
     { method: 'move', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1] },
-    { method: 'exists', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [0] },
-    { method: 'isDirectory', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [0] },
-    { method: 'isRegularFile', class: 'Files', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [0] },
+    // NOTE: `Files.exists`, `Files.isDirectory`, `Files.isRegularFile`
+    // were removed in 3.154.0 (#245 RC2). These NIO methods are pure
+    // boolean queries — they read a filesystem attribute and cannot
+    // cause traversal escape. A CWE-22 sink must consume the path to
+    // open, read, write, delete, list, or link a filesystem entry;
+    // check-only receivers reveal at most a boolean. Empirically
+    // ~12 H+C FPs across the 10-repo Tier 2 cohort
+    // (cognium-ai#189 §4). `java.io.File` instance methods
+    // (`file.isDirectory()`, `file.exists()`, `file.canRead()`, …)
+    // are already not registered as CWE-22 sinks.
     // RandomAccessFile
     { method: 'RandomAccessFile', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     // Framework-specific resource loading (Cocoon, Spring, etc.)
@@ -2220,6 +2227,9 @@ export const DEFAULT_SANITIZERS = [
     { method: 'parseDouble', class: 'Double', removes: ['sql_injection', 'command_injection', 'path_traversal', 'code_injection'] },
     { method: 'parseShort', class: 'Short', removes: ['sql_injection', 'command_injection', 'path_traversal', 'code_injection'] },
     { method: 'parseByte', class: 'Byte', removes: ['sql_injection', 'command_injection', 'path_traversal', 'code_injection'] },
+    // cognium-dev #238 A.3 — parseBoolean and expanded coercion coverage for XSS/CRLF/log/xpath/ldap/xxe.
+    // A parsed boolean/numeric cannot carry a string-injection payload for any string-based sink.
+    { method: 'parseBoolean', class: 'Boolean', removes: ['sql_injection', 'command_injection', 'path_traversal', 'code_injection', 'xss', 'crlf', 'log_injection', 'xpath_injection', 'ldap_injection', 'xxe'] },
     // Java UUID parse — UUID.fromString rejects non-UUID strings
     { method: 'fromString', class: 'UUID', removes: ['sql_injection', 'command_injection', 'path_traversal', 'code_injection'] },
     // JavaScript numeric coercion (Number/parseInt/parseFloat already covered above; add path_traversal/code_injection)