circle-ir 3.157.0 → 3.159.0

package/dist/browser/circle-ir.js

@@ -24592,6 +24592,7 @@ var LanguageSourcesPass = class {
       additionalSanitizers.push(
         ...findJavaPathNormalizeStartsWithGuardSanitizers(code)
       );
+      additionalSanitizers.push(...findJavaPathGetFileNameSanitizers(code));
       additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
       additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
@@ -26634,6 +26635,42 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJavaPathGetFileNameSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const assignmentRe = /^\s*(?:(?:final\s+)?[A-Za-z_][\w.<>?,\s\[\]]*?\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const rhsHasGetFileNameRe = /\.\s*getFileName\s*\(\s*\)/;
+  const rhsHasPathsChainRe = /\b(?:Paths\s*\.\s*get|Path\s*\.\s*of)\s*\(/;
+  const candidates = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = assignmentRe.exec(lines[i2]);
+    if (!m) continue;
+    const rhs = m[2];
+    if (!rhsHasGetFileNameRe.test(rhs)) continue;
+    if (!rhsHasPathsChainRe.test(rhs)) continue;
+    candidates.push({ line: i2 + 1, boundVar: m[1] });
+  }
+  if (candidates.length === 0) return sanitizers;
+  for (const c of candidates) {
+    sanitizers.push({
+      type: "java_path_get_filename",
+      method: "getFileName",
+      line: c.line,
+      sanitizes: ["path_traversal", "external_taint_escape"]
+    });
+    const varRefRe = new RegExp(`\\b${c.boundVar}\\b`);
+    for (let l = c.line; l < lines.length; l++) {
+      if (!varRefRe.test(lines[l])) continue;
+      sanitizers.push({
+        type: "java_path_get_filename",
+        method: "getFileName",
+        line: l + 1,
+        sanitizes: ["path_traversal", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findJavaInlineCrlfStripLogSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -30699,6 +30736,27 @@ var SinkFilterPass = class {
         return true;
       });
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split("\n");
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "xss") return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const receiverMatch = sinkLineText.match(/\b(\w+)\s*\.\s*(\w+)\s*\(/);
+        const receiver = receiverMatch?.[1];
+        const method = sink.method ?? receiverMatch?.[2];
+        if ((method === "render" || method === "process" || method === "merge" || method === "renderTo" || method === "apply") && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && COMPILED_TEMPLATE_TYPES.has(recvType)) return false;
+          if (recvType && TEMPLATE_ENGINE_LITERAL_TARGETS.has(recvType)) {
+            const args2 = extractJavaCallArgs(method, sinkLineText);
+            if (args2 !== null && args2.length >= 1 && isJavaLiteralOrAnnotationAccessor(args2[0])) {
+              return false;
+            }
+          }
+        }
+        return true;
+      });
+    }
     if (language === "java") {
       const sourceLines = ctx.code.split("\n");
       filtered = filtered.filter((sink) => {
@@ -37749,9 +37807,23 @@ var TEST_PATH_PATTERNS = [
   // JVM alt naming
   /\.test\.(?:java|kt)$/i
 ];
+var JVM_TEST_FILE_PATTERNS = [
+  // JUnit/Spock/Spring convention: FooTest.java, FooTests.java,
+  // FooSpec.java, FooIT.java, FooITCase.java, FooTestCase.java.
+  /(?:^|\/)[A-Za-z_]\w*(?:Test|Tests|Spec|IT|ITCase|TestCase)\.(?:java|kt|scala|groovy)$/,
+  // Alt naming: Foo.test.java, Foo.spec.java.
+  /(?:^|\/)[A-Za-z_]\w*\.(?:test|spec)\.(?:java|kt|scala|groovy)$/i
+];
+var JVM_SOURCE_FILE_RE = /\.(?:java|kt|scala|groovy)$/i;
 function isTestPath(filepath) {
   if (!filepath) return false;
   const normalized = filepath.replace(/\\/g, "/");
+  if (JVM_SOURCE_FILE_RE.test(normalized)) {
+    for (const pattern of JVM_TEST_FILE_PATTERNS) {
+      if (pattern.test(normalized)) return true;
+    }
+    return false;
+  }
   for (const pattern of TEST_PATH_PATTERNS) {
     if (pattern.test(normalized)) return true;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.157.0",
+  "version": "3.159.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",