circle-ir 3.161.0 → 3.162.0

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAioDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+ShD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAoc1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAioDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -107,6 +107,15 @@ export const DEFAULT_SOURCES = [
     { method: 'getPathWithinApplication', class: 'WebUtils', type: 'http_path', severity: 'high', return_tainted: true },
     { method: 'getRequestUri', class: 'WebUtils', type: 'http_path', severity: 'high', return_tainted: true },
     { method: 'decodeRequestString', class: 'WebUtils', type: 'http_path', severity: 'high', return_tainted: true },
+    // cognium-dev #249 3.162.0: java.net.URLDecoder.decode reintroduces taint
+    // by expanding %XX sequences into arbitrary bytes. This is the
+    // decode-after-encode bypass pattern exercised by SecuriBench Micro
+    // `sanitizers/Sanitizers5.java`: encode sanitizes `//evil.com` into
+    // `%2F%2Fevil.com`, then decode restores the redirect payload before
+    // it reaches `sendRedirect`. Registering as a source ensures the
+    // reaching-def walk does not credit an upstream URLEncoder.encode
+    // sanitizer for taint that has since been re-expanded.
+    { method: 'decode', class: 'URLDecoder', type: 'http_path', severity: 'high', return_tainted: true },
     // Additional HTTP request methods that can be attacker-controlled
     { method: 'getProtocol', class: 'HttpServletRequest', type: 'http_header', severity: 'medium', return_tainted: true },
     { method: 'getScheme', class: 'HttpServletRequest', type: 'http_header', severity: 'medium', return_tainted: true },
@@ -2058,12 +2067,17 @@ export const DEFAULT_SANITIZERS = [
     { method: 'render', class: 'Template', removes: ['xss'] }, // Rust askama auto-escapes
     { method: 'encodeForJavaScript', removes: ['xss'] },
     { method: 'encodeForCSS', removes: ['xss'] },
-    { method: 'encodeForURL', removes: ['xss', 'ssrf'] },
+    // cognium-dev #249 3.162.0: `open_redirect` restored to the URL-encoder
+    // sanitizer cluster. Sprint 82 (#189) reclassified `sendRedirect` from
+    // `ssrf` → `open_redirect` (config-loader.ts:1296-1299) without updating
+    // this table; the drift surfaced as a SecuriBench Micro FP on
+    // `sanitizers/Sanitizers3.java` (`URLEncoder.encode` + `sendRedirect`).
+    { method: 'encodeForURL', removes: ['xss', 'ssrf', 'open_redirect'] },
     // URL encoding wrapper aliases (common patterns in benchmarks and real-world code)
-    { method: 'encodeURL', removes: ['xss', 'ssrf'] },
-    { method: 'urlEncode', removes: ['xss', 'ssrf'] },
-    { method: 'escapeUrl', removes: ['xss', 'ssrf'] },
-    { method: 'escapeURL', removes: ['xss', 'ssrf'] },
+    { method: 'encodeURL', removes: ['xss', 'ssrf', 'open_redirect'] },
+    { method: 'urlEncode', removes: ['xss', 'ssrf', 'open_redirect'] },
+    { method: 'escapeUrl', removes: ['xss', 'ssrf', 'open_redirect'] },
+    { method: 'escapeURL', removes: ['xss', 'ssrf', 'open_redirect'] },
     // Path Traversal
     { method: 'normalize', class: 'Path', removes: ['path_traversal'] },
     { method: 'getCanonicalPath', class: 'File', removes: ['path_traversal'] },
@@ -2105,7 +2119,11 @@ export const DEFAULT_SANITIZERS = [
     { method: 'setFeature', class: 'XMLReader', removes: ['xxe'] },
     { method: 'setProperty', class: 'XMLReader', removes: ['xxe'] },
     // SSRF / URL encoding
-    { method: 'encode', class: 'URLEncoder', removes: ['ssrf', 'xss', 'path_traversal'] },
+    // cognium-dev #249 3.162.0: `open_redirect` added — see rationale on the
+    // `encodeForURL` cluster above. `java.net.URLEncoder.encode` is the specific
+    // sanitizer used by SecuriBench Micro `sanitizers/Sanitizers3.java` before
+    // `HttpServletResponse.sendRedirect` (Sprint 82 CWE-601 sink).
+    { method: 'encode', class: 'URLEncoder', removes: ['ssrf', 'xss', 'path_traversal', 'open_redirect'] },
     { method: 'validateURL', removes: ['ssrf'] },
     { method: 'isAllowedHost', removes: ['ssrf'] },
     { method: 'isInternalHost', removes: ['ssrf'] },