circle-ir 3.154.0 → 3.156.0

package/dist/browser/circle-ir.js

@@ -12902,6 +12902,9 @@ var DEFAULT_SANITIZERS = [
   { method: "parseDouble", class: "Double", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseShort", class: "Short", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseByte", class: "Byte", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
+  // cognium-dev #238 A.3 — parseBoolean and expanded coercion coverage for XSS/CRLF/log/xpath/ldap/xxe.
+  // A parsed boolean/numeric cannot carry a string-injection payload for any string-based sink.
+  { method: "parseBoolean", class: "Boolean", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection", "xss", "crlf", "log_injection", "xpath_injection", "ldap_injection", "xxe"] },
   // Java UUID parse — UUID.fromString rejects non-UUID strings
   { method: "fromString", class: "UUID", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   // JavaScript numeric coercion (Number/parseInt/parseFloat already covered above; add path_traversal/code_injection)
@@ -14182,8 +14185,11 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
     if (pattern.class === "constructor") {
       return true;
     }
+    const subtypeArgArityOk = !pattern.arg_positions || pattern.arg_positions.length === 0 || pattern.arg_positions.every((pos) => pos < (call.arguments?.length ?? 0));
     if (call.receiver_type && call.receiver_type === pattern.class) {
+    } else if (call.receiver_type && typeHierarchy && subtypeArgArityOk && typeHierarchy.isSubtypeOf(call.receiver_type, pattern.class)) {
     } else if (call.receiver_type_fqn && call.receiver_type_fqn.endsWith("." + pattern.class)) {
+    } else if (call.receiver_type_fqn && typeHierarchy && subtypeArgArityOk && typeHierarchy.isSubtypeOf(call.receiver_type_fqn, pattern.class)) {
     } else if (call.receiver && !receiverMightBeClass(call.receiver, pattern.class)) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
@@ -15033,6 +15039,23 @@ var CodeGraph = class {
     }
     return this._chainsByFromDef;
   }
+  /**
+   * Mirror of chainsByFromDef keyed by chain.to_def. Enables backward
+   * walks from a use's reaching def to earlier defs in the chain
+   * (cognium-dev #238 — DFG-walk sanitizer credit).
+   */
+  _chainsByToDef = null;
+  get chainsByToDef() {
+    if (!this._chainsByToDef) {
+      this._chainsByToDef = /* @__PURE__ */ new Map();
+      for (const chain of this.ir.dfg.chains ?? []) {
+        const arr = this._chainsByToDef.get(chain.to_def) ?? [];
+        arr.push(chain);
+        this._chainsByToDef.set(chain.to_def, arr);
+      }
+    }
+    return this._chainsByToDef;
+  }
   // ---------------------------------------------------------------------------
   // Call indexes
   // ---------------------------------------------------------------------------
@@ -15668,8 +15691,150 @@ function createWithJdkTypes() {
   for (const type of [...jdbcTypes, ...ioTypes, ...servletTypes]) {
     resolver.addType(type, "jdk", type.package);
   }
+  registerCommonLibraries(resolver);
   return resolver;
 }
+function registerCommonLibraries(resolver) {
+  const apacheHttpClient4x = [
+    {
+      name: "HttpClient",
+      kind: "interface",
+      package: "org.apache.http.client",
+      extends: null,
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "AbstractHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: null,
+      implements: ["org.apache.http.client.HttpClient"],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "CloseableHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: null,
+      implements: ["org.apache.http.client.HttpClient"],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "InternalHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "MinimalHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "DefaultHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.AbstractHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "SystemDefaultHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.DefaultHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    }
+  ];
+  const apacheHttpClient5x = [
+    {
+      name: "HttpClient",
+      kind: "interface",
+      package: "org.apache.hc.client5.http.classic",
+      extends: null,
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "CloseableHttpClient",
+      kind: "class",
+      package: "org.apache.hc.client5.http.impl.classic",
+      extends: null,
+      implements: ["org.apache.hc.client5.http.classic.HttpClient"],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "InternalHttpClient",
+      kind: "class",
+      package: "org.apache.hc.client5.http.impl.classic",
+      extends: "org.apache.hc.client5.http.impl.classic.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "MinimalHttpClient",
+      kind: "class",
+      package: "org.apache.hc.client5.http.impl.classic",
+      extends: "org.apache.hc.client5.http.impl.classic.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    }
+  ];
+  for (const type of [...apacheHttpClient4x, ...apacheHttpClient5x]) {
+    resolver.addType(type, "common-libraries", type.package);
+  }
+}
 
 // src/graph/dominator-graph.ts
 function computeRPO(cfg, entryId) {
@@ -15957,6 +16122,43 @@ var AnalysisPipeline = class {
   }
 };
 
+// src/analysis/dfg-walk.ts
+function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
+  const maxHops = options.maxHops ?? 32;
+  const visited = /* @__PURE__ */ new Set();
+  const lines = /* @__PURE__ */ new Set();
+  let hopCapReached = false;
+  const startDef = defById.get(startDefId);
+  if (!startDef) {
+    return { visited, lines, hopCapReached: false };
+  }
+  visited.add(startDefId);
+  lines.add(startDef.line);
+  const queue = [startDefId];
+  let hops = 0;
+  while (queue.length > 0) {
+    if (hops >= maxHops) {
+      hopCapReached = true;
+      break;
+    }
+    hops++;
+    const currentId = queue.shift();
+    const incoming = chainsByToDef.get(currentId);
+    if (!incoming) continue;
+    for (const chain of incoming) {
+      const fromId = chain.from_def;
+      if (visited.has(fromId)) continue;
+      visited.add(fromId);
+      const fromDef = defById.get(fromId);
+      if (fromDef) {
+        lines.add(fromDef.line);
+      }
+      queue.push(fromId);
+    }
+  }
+  return { visited, lines, hopCapReached };
+}
+
 // src/analysis/taint-propagation.ts
 function buildSanitizersByLine(sanitizers) {
   const out2 = /* @__PURE__ */ new Map();
@@ -16044,7 +16246,12 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
                     taintInfo.line,
                     sink.line,
                     sink.type,
-                    sanitizersByLine
+                    sanitizersByLine,
+                    {
+                      startDefId: use.def_id,
+                      chainsByToDef: graph.chainsByToDef,
+                      defById
+                    }
                   );
                   if (!isSanitized.sanitized) {
                     const source = sources.find((s) => s.line === taintInfo.sourceLine);
@@ -16182,20 +16389,39 @@ var KNOWN_SINK_TYPES = /* @__PURE__ */ new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine) {
-  const sanitizersAtTarget = sanitizersByLine.get(toLine);
-  if (!sanitizersAtTarget || sanitizersAtTarget.length === 0) {
-    return { sanitized: false };
-  }
+function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
-  for (const san of sanitizersAtTarget) {
-    if (isKnownSinkType) {
-      if (san.sanitizes.includes(sinkType)) {
+  const sanitizersAtTarget = sanitizersByLine.get(toLine);
+  if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
+    for (const san of sanitizersAtTarget) {
+      if (isKnownSinkType) {
+        if (san.sanitizes.includes(sinkType)) {
+          return { sanitized: true, sanitizer: san };
+        }
+      } else if (san.sanitizes.length > 0) {
         return { sanitized: true, sanitizer: san };
       }
-    } else {
-      if (san.sanitizes.length > 0) {
-        return { sanitized: true, sanitizer: san };
+    }
+  }
+  if (ctx) {
+    const walk = walkBackwardDefs(
+      ctx.startDefId,
+      ctx.chainsByToDef,
+      ctx.defById,
+      { maxHops: ctx.maxHops ?? 32 }
+    );
+    for (const line of walk.lines) {
+      if (line === toLine) continue;
+      const sansAtLine = sanitizersByLine.get(line);
+      if (!sansAtLine || sansAtLine.length === 0) continue;
+      for (const san of sansAtLine) {
+        if (isKnownSinkType) {
+          if (san.sanitizes.includes(sinkType)) {
+            return { sanitized: true, sanitizer: san };
+          }
+        } else if (san.sanitizes.length > 0) {
+          return { sanitized: true, sanitizer: san };
+        }
       }
     }
   }
@@ -24995,6 +25221,20 @@ function findJavaScriptDOMSinks(sourceCode, language) {
         else if (line.includes(".href")) method = "href";
         else if (line.includes(".cssText")) method = "cssText";
         else if (line.includes("style.textContent")) method = "textContent";
+        if (method === "document.write" || method === "document.writeln") {
+          const argMatch = line.match(/document\.write(?:ln)?\s*\(\s*([^)]*)\)/);
+          if (argMatch) {
+            const arg = argMatch[1].trim();
+            if (!arg.includes("+")) {
+              const doubleQ = /^"(?:[^"\\]|\\.)*"$/;
+              const singleQ = /^'(?:[^'\\]|\\.)*'$/;
+              const backtick = /^`(?:[^`\\$]|\\.|\$(?!\{))*`$/;
+              if (doubleQ.test(arg) || singleQ.test(arg) || backtick.test(arg)) {
+                break;
+              }
+            }
+          }
+        }
         const alreadyExists = sinks.some((s) => s.line === lineNumber && s.cwe === cwe);
         if (!alreadyExists) {
           sinks.push({ type, cwe, severity, line: lineNumber, location: line.trim().substring(0, 80), method });
@@ -29705,6 +29945,196 @@ var LibraryProfileSourceGatePass = class {
   }
 };
 
+// src/analysis/passes/mybatis-annotation-sql-sink-pass.ts
+var MYBATIS_SQL_ANNOTATIONS = /* @__PURE__ */ new Set([
+  "Select",
+  "Update",
+  "Insert",
+  "Delete",
+  "SelectProvider",
+  "UpdateProvider",
+  "InsertProvider",
+  "DeleteProvider"
+]);
+var DOLLAR_BRACE_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?:\.[A-Za-z0-9_.]+)?\}/g;
+function parsePositionalRef(name2) {
+  const paramMatch = /^param(\d+)$/.exec(name2);
+  if (paramMatch) {
+    const oneBased = Number.parseInt(paramMatch[1], 10);
+    if (Number.isFinite(oneBased) && oneBased >= 1) return oneBased - 1;
+  }
+  const zeroMatch = /^(\d+)$/.exec(name2);
+  if (zeroMatch) {
+    const zeroBased = Number.parseInt(zeroMatch[1], 10);
+    if (Number.isFinite(zeroBased) && zeroBased >= 0) return zeroBased;
+  }
+  return null;
+}
+function extractAnnotationBody(annotation) {
+  const openIdx = annotation.indexOf("(");
+  if (openIdx < 0) return null;
+  const closeIdx = annotation.lastIndexOf(")");
+  if (closeIdx <= openIdx) return null;
+  return annotation.substring(openIdx + 1, closeIdx);
+}
+function annotationName(annotation) {
+  const openIdx = annotation.indexOf("(");
+  return openIdx < 0 ? annotation : annotation.substring(0, openIdx);
+}
+function extractParamName(annotation) {
+  if (annotationName(annotation) !== "Param") return null;
+  const body2 = extractAnnotationBody(annotation);
+  if (body2 === null) return null;
+  const strMatch = /^\s*["']([^"']*)["']/.exec(body2);
+  return strMatch ? strMatch[1] : null;
+}
+function extractDollarBraceRefs(annotationBody) {
+  const seen = /* @__PURE__ */ new Set();
+  const out2 = [];
+  DOLLAR_BRACE_RE.lastIndex = 0;
+  let m;
+  while ((m = DOLLAR_BRACE_RE.exec(annotationBody)) !== null) {
+    const name2 = m[1];
+    if (!seen.has(name2)) {
+      seen.add(name2);
+      out2.push(name2);
+    }
+  }
+  return out2;
+}
+function fileImportsMyBatis(imports) {
+  for (const imp of imports) {
+    const pkg = imp.from_package;
+    if (!pkg) continue;
+    if (pkg === "org.apache.ibatis.annotations" || pkg.startsWith("org.apache.ibatis.annotations.") || pkg === "org.apache.ibatis" || pkg.startsWith("org.apache.ibatis.")) {
+      return true;
+    }
+  }
+  return false;
+}
+function correlateDollarBraceToArgPositions(method, refs) {
+  const paramNameToIndex = /* @__PURE__ */ new Map();
+  method.parameters.forEach((param, idx) => {
+    for (const ann of param.annotations) {
+      const paramName = extractParamName(ann);
+      if (paramName !== null) {
+        paramNameToIndex.set(paramName, idx);
+      }
+    }
+  });
+  const positions = /* @__PURE__ */ new Set();
+  for (const ref of refs) {
+    const namedIdx = paramNameToIndex.get(ref);
+    if (namedIdx !== void 0) {
+      positions.add(namedIdx);
+      continue;
+    }
+    const positionalIdx = parsePositionalRef(ref);
+    if (positionalIdx !== null && positionalIdx < method.parameters.length) {
+      positions.add(positionalIdx);
+    }
+  }
+  return Array.from(positions).sort((a, b) => a - b);
+}
+function isMapperMethodCall(call, interfaceSimpleName, interfaceFqn, methodName) {
+  const target = call.resolution?.target;
+  if (target) {
+    const suffix = `${interfaceSimpleName}.${methodName}`;
+    const suffixFqn = `${interfaceFqn}.${methodName}`;
+    if (target === suffix || target === suffixFqn || target.endsWith("." + suffix) || target.endsWith("." + suffixFqn)) {
+      return true;
+    }
+  }
+  if (call.method_name !== methodName) return false;
+  if (call.receiver_type === interfaceSimpleName) return true;
+  if (call.receiver_type_fqn === interfaceFqn) return true;
+  return false;
+}
+var MyBatisAnnotationSqlSinkPass = class {
+  name = "mybatis-annotation-sql-sink";
+  category = "security";
+  run(ctx) {
+    if (ctx.language !== "java") {
+      return { annotatedMethodCount: 0, addedSinkCount: 0 };
+    }
+    const { types, imports, calls } = ctx.graph.ir;
+    if (!fileImportsMyBatis(imports)) {
+      return { annotatedMethodCount: 0, addedSinkCount: 0 };
+    }
+    const mapperMethods = [];
+    for (const type of types) {
+      if (type.kind !== "interface") continue;
+      for (const method of type.methods) {
+        let matchedRefs = [];
+        for (const ann of method.annotations) {
+          if (!MYBATIS_SQL_ANNOTATIONS.has(annotationName(ann))) continue;
+          const body2 = extractAnnotationBody(ann);
+          if (body2 === null) continue;
+          const refs = extractDollarBraceRefs(body2);
+          if (refs.length > 0) {
+            matchedRefs = [...matchedRefs, ...refs];
+          }
+        }
+        if (matchedRefs.length === 0) continue;
+        const positions = correlateDollarBraceToArgPositions(
+          method,
+          matchedRefs
+        );
+        if (positions.length === 0) continue;
+        const interfaceFqn = type.package ? `${type.package}.${type.name}` : type.name;
+        mapperMethods.push({
+          interfaceSimpleName: type.name,
+          interfaceFqn,
+          methodName: method.name,
+          taintedArgPositions: positions
+        });
+      }
+    }
+    if (mapperMethods.length === 0) {
+      return {
+        annotatedMethodCount: 0,
+        addedSinkCount: 0
+      };
+    }
+    const sinks = ctx.hasResult("taint-matcher") ? ctx.getResult("taint-matcher").sinks : ctx.graph.ir.taint.sinks;
+    let addedSinkCount = 0;
+    for (const call of calls) {
+      for (const rec of mapperMethods) {
+        if (!isMapperMethodCall(
+          call,
+          rec.interfaceSimpleName,
+          rec.interfaceFqn,
+          rec.methodName
+        )) {
+          continue;
+        }
+        const line = call.location.line;
+        if (sinks.some(
+          (s) => s.line === line && s.type === "sql_injection" && s.method === rec.methodName
+        )) {
+          continue;
+        }
+        const receiverLoc = call.receiver ? `${call.receiver}.${rec.methodName}()` : `${rec.methodName}()`;
+        sinks.push({
+          type: "sql_injection",
+          cwe: "CWE-89",
+          location: call.in_method ? `${receiverLoc} in ${call.in_method}` : receiverLoc,
+          line,
+          confidence: 0.95,
+          method: rec.methodName,
+          argPositions: rec.taintedArgPositions,
+          class: rec.interfaceSimpleName
+        });
+        addedSinkCount++;
+      }
+    }
+    return {
+      annotatedMethodCount: mapperMethods.length,
+      addedSinkCount
+    };
+  }
+};
+
 // src/analysis/passes/sink-filter-pass.ts
 var JS_XSS_SANITIZERS = [
   /\bDOMPurify\.sanitize\s*\(/,
@@ -37261,6 +37691,34 @@ var WeakHashPass = class {
   }
 };
 
+// src/analysis/path-classification.ts
+var TEST_PATH_PATTERNS = [
+  // Directory-based conventions
+  /(^|\/)test\//i,
+  /(^|\/)tests\//i,
+  /(^|\/)testing\//i,
+  /(^|\/)__tests__\//i,
+  /(^|\/)spec\//i,
+  // Go test file suffix
+  /_test\.go$/i,
+  // Python pytest naming
+  /(^|\/)test_[^/]+\.py$/i,
+  /_test\.py$/i,
+  // JS/TS unit / spec naming
+  /\.test\.(?:tsx?|jsx?|mjs|cjs)$/i,
+  /\.spec\.(?:tsx?|jsx?|mjs|cjs)$/i,
+  // JVM alt naming
+  /\.test\.(?:java|kt)$/i
+];
+function isTestPath(filepath) {
+  if (!filepath) return false;
+  const normalized = filepath.replace(/\\/g, "/");
+  for (const pattern of TEST_PATH_PATTERNS) {
+    if (pattern.test(normalized)) return true;
+  }
+  return false;
+}
+
 // src/analysis/passes/weak-crypto-pass.ts
 var WEAK_CIPHER_BASES = /* @__PURE__ */ new Set([
   "des",
@@ -37449,6 +37907,9 @@ var WeakCryptoPass = class {
     if (isProtocolMandatedCryptoFile(file, code)) {
       return { findings: [] };
     }
+    if (isTestPath(file)) {
+      return { findings: [] };
+    }
     const findings = [];
     const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
     const literalBindings = scanLiteralBindings(code, language);
@@ -40913,6 +41374,8 @@ async function analyze(code, filePath, language, options = {}) {
     if (!disabledPasses.has("source-semantics")) pipeline.add(new SourceSemanticsPass());
     if (!disabledPasses.has("library-profile-source-gate"))
       pipeline.add(new LibraryProfileSourceGatePass());
+    if (!disabledPasses.has("mybatis-annotation-sql-sink"))
+      pipeline.add(new MyBatisAnnotationSqlSinkPass());
     pipeline.add(new SinkFilterPass());
     if (!disabledPasses.has("sink-semantics")) pipeline.add(new SinkSemanticsPass());
     if (!disabledPasses.has("cli-main-reflection-suppress"))