circle-ir 3.16.8 → 3.17.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,GAEd,MAAM,eAAe,CAAC;AA6EvB,sCAAsC;AACtC,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AAEzB,kBAAkB;AAClB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,qBAAqB;AACrB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,GAMnB,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,WAAW,EACX,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iCAAiC,CAAC;AAExF,uBAAuB;AACvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,mBAAmB;AACnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAY9B,gCAAgC;AAChC,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,GAEd,MAAM,eAAe,CAAC;AA6EvB,sCAAsC;AACtC,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AAEzB,kBAAkB;AAClB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,qBAAqB;AACrB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,GAMnB,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,WAAW,EACX,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iCAAiC,CAAC;AAExF,uBAAuB;AACvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,mBAAmB;AACnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAY9B,gCAAgC;AAChC,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,mBAAmB,CAAC"}

package/dist/languages/index.d.ts

@@ -7,5 +7,5 @@
  */
 export type { SupportedLanguage, LanguageNodeTypes, LanguagePlugin, LanguageRegistry, ExtractionContext, FrameworkInfo, TaintSourcePattern, TaintSinkPattern, } from './types.js';
 export { getLanguageRegistry, registerLanguage, getLanguagePlugin, getLanguageForFile, detectLanguage, isLanguageSupported, } from './registry.js';
-export { JavaPlugin, JavaScriptPlugin, PythonPlugin, RustPlugin, registerBuiltinPlugins, } from './plugins/index.js';
+export { JavaPlugin, JavaScriptPlugin, PythonPlugin, RustPlugin, HtmlPlugin, registerBuiltinPlugins, } from './plugins/index.js';
 export { BaseLanguagePlugin } from './plugins/base.js';

package/dist/languages/index.js

@@ -8,7 +8,7 @@
 // Registry functions
 export { getLanguageRegistry, registerLanguage, getLanguagePlugin, getLanguageForFile, detectLanguage, isLanguageSupported, } from './registry.js';
 // Concrete plugins
-export { JavaPlugin, JavaScriptPlugin, PythonPlugin, RustPlugin, registerBuiltinPlugins, } from './plugins/index.js';
+export { JavaPlugin, JavaScriptPlugin, PythonPlugin, RustPlugin, HtmlPlugin, registerBuiltinPlugins, } from './plugins/index.js';
 // Base class for custom plugins
 export { BaseLanguagePlugin } from './plugins/base.js';
 //# sourceMappingURL=index.js.map

package/dist/languages/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/languages/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,qBAAqB;AACrB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,mBAAmB;AACnB,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,gCAAgC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/languages/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,qBAAqB;AACrB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,mBAAmB;AACnB,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,gCAAgC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/languages/plugins/html.d.ts

@@ -0,0 +1,33 @@
+/**
+ * HTML Language Plugin
+ *
+ * Provides HTML-specific AST handling for the web extraction preprocessor.
+ * HTML is a preprocessor language — it does not produce full IR.
+ * Instead, <script> blocks are extracted and delegated to the JS analyzer,
+ * and attribute-level security checks are run directly on the HTML AST.
+ */
+import type { Node as SyntaxNode } from 'web-tree-sitter';
+import type { TypeInfo, CallInfo, ImportInfo } from '../../types/index.js';
+import type { LanguageNodeTypes, ExtractionContext, FrameworkInfo, TaintSourcePattern, TaintSinkPattern } from '../types.js';
+import { BaseLanguagePlugin } from './base.js';
+/**
+ * HTML language plugin implementation.
+ * Acts as a preprocessor — delegates script analysis to JS plugin.
+ */
+export declare class HtmlPlugin extends BaseLanguagePlugin {
+    readonly id: "html";
+    readonly name = "HTML";
+    readonly extensions: string[];
+    readonly wasmPath = "tree-sitter-html.wasm";
+    readonly nodeTypes: LanguageNodeTypes;
+    detectFramework(_context: ExtractionContext): FrameworkInfo | undefined;
+    getBuiltinSources(): TaintSourcePattern[];
+    getBuiltinSinks(): TaintSinkPattern[];
+    getReceiverType(_node: SyntaxNode, _context: ExtractionContext): string | undefined;
+    isStringLiteral(node: SyntaxNode): boolean;
+    getStringValue(node: SyntaxNode): string | undefined;
+    extractTypes(_context: ExtractionContext): TypeInfo[];
+    extractCalls(_context: ExtractionContext): CallInfo[];
+    extractImports(_context: ExtractionContext): ImportInfo[];
+    extractPackage(_context: ExtractionContext): string | undefined;
+}

package/dist/languages/plugins/html.js

@@ -0,0 +1,84 @@
+/**
+ * HTML Language Plugin
+ *
+ * Provides HTML-specific AST handling for the web extraction preprocessor.
+ * HTML is a preprocessor language — it does not produce full IR.
+ * Instead, <script> blocks are extracted and delegated to the JS analyzer,
+ * and attribute-level security checks are run directly on the HTML AST.
+ */
+import { BaseLanguagePlugin } from './base.js';
+/**
+ * HTML language plugin implementation.
+ * Acts as a preprocessor — delegates script analysis to JS plugin.
+ */
+export class HtmlPlugin extends BaseLanguagePlugin {
+    id = 'html';
+    name = 'HTML';
+    extensions = ['.html', '.htm', '.xhtml'];
+    wasmPath = 'tree-sitter-html.wasm';
+    nodeTypes = {
+        // HTML has no OOP constructs
+        classDeclaration: [],
+        interfaceDeclaration: [],
+        enumDeclaration: [],
+        functionDeclaration: [],
+        methodDeclaration: [],
+        // No expressions in HTML
+        methodCall: [],
+        functionCall: [],
+        assignment: [],
+        variableDeclaration: [],
+        // No parameters
+        parameter: [],
+        argument: [],
+        // No annotations
+        annotation: [],
+        decorator: [],
+        // No imports
+        importStatement: [],
+        // No control flow
+        ifStatement: [],
+        forStatement: [],
+        whileStatement: [],
+        tryStatement: [],
+        returnStatement: [],
+    };
+    detectFramework(_context) {
+        return undefined;
+    }
+    getBuiltinSources() {
+        return [];
+    }
+    getBuiltinSinks() {
+        return [];
+    }
+    getReceiverType(_node, _context) {
+        return undefined;
+    }
+    isStringLiteral(node) {
+        return node.type === 'attribute_value' || node.type === 'quoted_attribute_value';
+    }
+    getStringValue(node) {
+        if (!this.isStringLiteral(node))
+            return undefined;
+        const text = node.text;
+        if ((text.startsWith('"') && text.endsWith('"')) ||
+            (text.startsWith("'") && text.endsWith("'"))) {
+            return text.slice(1, -1);
+        }
+        return text;
+    }
+    extractTypes(_context) {
+        return [];
+    }
+    extractCalls(_context) {
+        return [];
+    }
+    extractImports(_context) {
+        return [];
+    }
+    extractPackage(_context) {
+        return undefined;
+    }
+}
+//# sourceMappingURL=html.js.map

package/dist/languages/plugins/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../../src/languages/plugins/html.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,kBAAkB;IACvC,EAAE,GAAG,MAAe,CAAC;IACrB,IAAI,GAAG,MAAM,CAAC;IACd,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,QAAQ,GAAG,uBAAuB,CAAC;IAEnC,SAAS,GAAsB;QACtC,6BAA6B;QAC7B,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE,EAAE;QACxB,eAAe,EAAE,EAAE;QACnB,mBAAmB,EAAE,EAAE;QACvB,iBAAiB,EAAE,EAAE;QAErB,yBAAyB;QACzB,UAAU,EAAE,EAAE;QACd,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,EAAE;QACd,mBAAmB,EAAE,EAAE;QAEvB,gBAAgB;QAChB,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QAEZ,iBAAiB;QACjB,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;QAEb,aAAa;QACb,eAAe,EAAE,EAAE;QAEnB,kBAAkB;QAClB,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,EAAE;QAChB,eAAe,EAAE,EAAE;KACpB,CAAC;IAEF,eAAe,CAAC,QAA2B;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,iBAAiB;QACf,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,eAAe;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,eAAe,CAAC,KAAiB,EAAE,QAA2B;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,eAAe,CAAC,IAAgB;QAC9B,OAAO,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,wBAAwB,CAAC;IACnF,CAAC;IAED,cAAc,CAAC,IAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,QAA2B;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,QAA2B;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,QAA2B;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,QAA2B;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/languages/plugins/index.d.ts

@@ -8,6 +8,7 @@ export { JavaScriptPlugin } from './javascript.js';
 export { PythonPlugin } from './python.js';
 export { RustPlugin } from './rust.js';
 export { BashPlugin } from './bash.js';
+export { HtmlPlugin } from './html.js';
 /**
  * Register all built-in language plugins with the global registry.
  * Call this during analyzer initialization.

package/dist/languages/plugins/index.js

@@ -8,12 +8,14 @@ export { JavaScriptPlugin } from './javascript.js';
 export { PythonPlugin } from './python.js';
 export { RustPlugin } from './rust.js';
 export { BashPlugin } from './bash.js';
+export { HtmlPlugin } from './html.js';
 import { registerLanguage } from '../registry.js';
 import { JavaPlugin } from './java.js';
 import { JavaScriptPlugin } from './javascript.js';
 import { PythonPlugin } from './python.js';
 import { RustPlugin } from './rust.js';
 import { BashPlugin } from './bash.js';
+import { HtmlPlugin } from './html.js';
 /**
  * Register all built-in language plugins with the global registry.
  * Call this during analyzer initialization.
@@ -24,5 +26,6 @@ export function registerBuiltinPlugins() {
     registerLanguage(new PythonPlugin());
     registerLanguage(new RustPlugin());
     registerLanguage(new BashPlugin());
+    registerLanguage(new HtmlPlugin());
 }
 //# sourceMappingURL=index.js.map

package/dist/languages/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/languages/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;IACrC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/languages/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;IACrC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;AACrC,CAAC"}

package/dist/languages/types.d.ts

@@ -9,7 +9,7 @@ import type { TypeInfo, CallInfo, ImportInfo } from '../types/index.js';
 /**
  * Supported languages for analysis
  */
-export type SupportedLanguage = 'java' | 'c' | 'cpp' | 'javascript' | 'typescript' | 'python' | 'rust' | 'bash';
+export type SupportedLanguage = 'java' | 'c' | 'cpp' | 'javascript' | 'typescript' | 'python' | 'rust' | 'bash' | 'html';
 /**
  * AST node type mappings for a language
  */

package/dist/types/index.d.ts

@@ -3,7 +3,7 @@
  *
  * These types conform to docs/SPEC.md
  */
-export type SupportedLanguage = "java" | "c" | "cpp" | "javascript" | "typescript" | "python" | "rust" | "bash";
+export type SupportedLanguage = "java" | "c" | "cpp" | "javascript" | "typescript" | "python" | "rust" | "bash" | "html";
 export interface Meta {
     circle_ir: "3.0";
     file: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.16.8",
+  "version": "3.17.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -97,6 +97,7 @@
     "@vitest/coverage-v8": "^4.1.2",
     "esbuild": "^0.28.0",
     "tree-sitter-bash": "^0.25.1",
+    "tree-sitter-html": "^0.23.2",
     "tree-sitter-java": "^0.23.5",
     "tree-sitter-python": "^0.25.0",
     "tree-sitter-rust": "^0.24.0",