circle-ir 3.165.0 → 3.166.1

package/dist/browser/circle-ir.js

@@ -20148,9 +20148,28 @@ function methodIsSupertypeLifecycleEntryPoint(method, enclosingType) {
   return false;
 }
 function classifyEntryPointTier(method, enclosingType, ctx) {
-  const language = (ctx.language ?? "").toLowerCase();
-  if (language !== "java") return "TIER_UNKNOWN";
   if (!method) return "TIER_UNKNOWN";
+  const language = (ctx.language ?? "").toLowerCase();
+  switch (language) {
+    case "java":
+      return classifyJavaEntryPoint(method, enclosingType);
+    case "python":
+      return classifyPythonEntryPoint(method, enclosingType, ctx);
+    case "javascript":
+    case "typescript":
+    case "tsx":
+    case "jsx":
+      return classifyJsTsEntryPoint(method, enclosingType, ctx);
+    case "go":
+      return classifyGoEntryPoint(method, enclosingType, ctx);
+    case "bash":
+    case "shell":
+      return classifyBashEntryPoint(method, enclosingType, ctx);
+    default:
+      return "TIER_UNKNOWN";
+  }
+}
+function classifyJavaEntryPoint(method, enclosingType) {
   if (classShapeIsLibraryFacade(enclosingType)) {
     return "TIER_3_LIBRARY_API";
   }
@@ -20174,6 +20193,413 @@ function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingTy
   const tier = classifyEntryPointTier(enclosingMethod, enclosingType, ctx);
   return tier === "TIER_3_LIBRARY_API";
 }
+var POLYGLOT_LIBRARY_PATH_FRAGMENTS = [
+  "/lib/",
+  "/libapi/",
+  "/libs/",
+  "/utils/",
+  "/util/",
+  "/helpers/",
+  "/helper/",
+  "/interop/",
+  "/vendor/",
+  "/vendored/",
+  "/node_modules/",
+  "/dist/",
+  "/build/",
+  "/_internal/",
+  "/__tests__/",
+  "/tests/",
+  "/test/",
+  "/testing/",
+  "/spec/",
+  "/specs/",
+  "/fixtures/",
+  "/mocks/",
+  "/__mocks__/"
+];
+var POLYGLOT_TEST_FILE_MARKERS = [
+  ".test.",
+  ".spec.",
+  "_test.",
+  "_spec.",
+  ".tests."
+];
+function pathLooksLikeLibraryOrTest(filePath) {
+  if (!filePath) return false;
+  const normalized = filePath.replace(/\\/g, "/").toLowerCase();
+  const padded = `/${normalized}/`;
+  for (const frag of POLYGLOT_LIBRARY_PATH_FRAGMENTS) {
+    if (padded.includes(frag)) return true;
+  }
+  const slash = normalized.lastIndexOf("/");
+  const base = slash >= 0 ? normalized.slice(slash + 1) : normalized;
+  for (const marker of POLYGLOT_TEST_FILE_MARKERS) {
+    if (base.includes(marker)) return true;
+  }
+  return false;
+}
+var PYTHON_TIER_1_DECORATOR_NAMES = /* @__PURE__ */ new Set([
+  // Flask
+  "route",
+  "get",
+  "post",
+  "put",
+  "delete",
+  "patch",
+  "options",
+  "head",
+  "before_request",
+  "after_request",
+  "errorhandler",
+  "teardown_request",
+  // FastAPI
+  "websocket",
+  "websocket_route",
+  "api_route",
+  "middleware",
+  // Django
+  "login_required",
+  "csrf_exempt",
+  "csrf_protect",
+  "require_http_methods",
+  "require_GET",
+  "require_POST",
+  "require_safe",
+  "permission_required",
+  "user_passes_test",
+  "staff_member_required",
+  "api_view",
+  "action",
+  "detail_route",
+  "list_route",
+  "renderer_classes",
+  "authentication_classes",
+  "permission_classes",
+  // Click / Typer
+  "command",
+  "group",
+  // Celery / RQ / dramatiq
+  "task",
+  "shared_task",
+  "periodic_task",
+  "actor",
+  // aiohttp
+  "view",
+  // pytest fixtures ARE library callback surfaces (test framework calls
+  // them), so we mark them TIER_1 too — a taint sink inside a fixture
+  // is genuinely reachable when the test runs.
+  "fixture"
+]);
+function classifyPythonEntryPoint(method, enclosingType, ctx) {
+  if (pathLooksLikeLibraryOrTest(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (pythonDecoratorLooksTier1(method.annotations)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodIsRuntimeRegistrationHandler(method, ctx.runtimeRegistrations)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (method.name === "main" && !enclosingType) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (method.name === "main" && enclosingType && looksLikeModuleType(enclosingType)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (method.name.startsWith("_") && !method.name.startsWith("__")) {
+    return "TIER_3_LIBRARY_API";
+  }
+  return "TIER_UNKNOWN";
+}
+function pythonDecoratorLooksTier1(annotations) {
+  if (!annotations || annotations.length === 0) return false;
+  for (const raw of annotations) {
+    let name2 = raw.replace(/^@/, "").replace(/[<(].*$/, "").trim();
+    if (!name2) continue;
+    const dot = name2.lastIndexOf(".");
+    if (dot >= 0) name2 = name2.slice(dot + 1);
+    if (PYTHON_TIER_1_DECORATOR_NAMES.has(name2)) return true;
+  }
+  return false;
+}
+function looksLikeModuleType(t) {
+  return !t.extends && (!t.implements || t.implements.length === 0) && (!t.annotations || t.annotations.length === 0);
+}
+var JSTS_TIER_1_METHOD_DECORATORS = /* @__PURE__ */ new Set([
+  // NestJS HTTP method decorators
+  "Get",
+  "Post",
+  "Put",
+  "Delete",
+  "Patch",
+  "Head",
+  "Options",
+  "All",
+  // NestJS WebSocket
+  "SubscribeMessage",
+  "MessageBody",
+  "ConnectedSocket",
+  // NestJS microservices / event
+  "EventPattern",
+  "MessagePattern",
+  "GrpcMethod",
+  "GrpcStreamMethod",
+  // Angular / other DI-registered handler hooks
+  "HostListener"
+]);
+var JSTS_TIER_1_CLASS_DECORATORS = /* @__PURE__ */ new Set([
+  "Controller",
+  "RestController",
+  "Resolver",
+  "WebSocketGateway",
+  "Gateway"
+]);
+var JSTS_TIER_1_MODULE_EXPORTS = /* @__PURE__ */ new Set([
+  // AWS Lambda / Google Cloud Functions / Netlify / Vercel
+  "handler",
+  // Next.js App Router — HTTP method exports
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS",
+  // SvelteKit / Remix
+  "load",
+  "action",
+  // Next.js middleware
+  "middleware"
+]);
+function classifyJsTsEntryPoint(method, enclosingType, ctx) {
+  if (pathLooksLikeLibraryOrTest(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (annotationsInclude(method.annotations, JSTS_TIER_1_METHOD_DECORATORS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (enclosingType && annotationsInclude(enclosingType.annotations, JSTS_TIER_1_CLASS_DECORATORS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodIsRuntimeRegistrationHandler(method, ctx.runtimeRegistrations)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (JSTS_TIER_1_MODULE_EXPORTS.has(method.name) && (!enclosingType || looksLikeModuleType(enclosingType))) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (method.name === "main" && (!enclosingType || looksLikeModuleType(enclosingType))) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_UNKNOWN";
+}
+var GO_HTTP_REGISTRAR_METHODS = /* @__PURE__ */ new Set([
+  // net/http
+  "HandleFunc",
+  "Handle",
+  // gorilla/mux, chi, echo, gin
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS",
+  "Any",
+  "Get",
+  "Post",
+  "Put",
+  "Delete",
+  "Patch",
+  "Head",
+  "Options",
+  // gorilla/chi/gin sub-routers
+  "Route",
+  "Mount",
+  "Method"
+]);
+var GO_HTTP_REGISTRAR_RECEIVERS = [
+  "http",
+  // net/http.HandleFunc
+  "mux",
+  // gorilla/mux
+  "router",
+  // chi/gin/gorilla common
+  "r",
+  // gin/chi convention
+  "e",
+  // echo convention
+  "g",
+  // gin group convention
+  "app",
+  // fiber convention
+  "engine",
+  // gin engine convention
+  "srv",
+  "server"
+];
+function classifyGoEntryPoint(method, enclosingType, ctx) {
+  if (pathLooksLikeLibraryOrTest(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (ctx.filePath && ctx.filePath.toLowerCase().endsWith("_test.go")) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (method.name === "main" && enclosingType?.package === "main") {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodHasNetHttpHandlerSignature(method)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodLooksLikeGrpcHandler(method, enclosingType)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodIsRegisteredByGoHttpFramework(method, ctx.calls)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_UNKNOWN";
+}
+function methodHasNetHttpHandlerSignature(method) {
+  const params = method.parameters ?? [];
+  if (params.length !== 2) return false;
+  const p0 = normalizeGoType(params[0]?.type ?? "");
+  const p1 = normalizeGoType(params[1]?.type ?? "");
+  const p0IsWriter = p0.includes("http.ResponseWriter") || p0.endsWith("ResponseWriter");
+  const p1IsRequest = p1.includes("http.Request") || p1.endsWith("*Request") || p1.endsWith("Request");
+  return p0IsWriter && p1IsRequest;
+}
+function methodLooksLikeGrpcHandler(method, enclosingType) {
+  if (!enclosingType) return false;
+  const params = method.parameters ?? [];
+  if (params.length < 2) return false;
+  const p0 = normalizeGoType(params[0]?.type ?? "");
+  if (!p0.includes("context.Context") && !p0.endsWith("Context")) return false;
+  const typeName = enclosingType.name ?? "";
+  if (!/(Server|Service|Handler)$/.test(typeName)) return false;
+  return true;
+}
+function normalizeGoType(t) {
+  return t.replace(/\s+/g, "").replace(/^\*+/, "");
+}
+function methodIsRegisteredByGoHttpFramework(method, calls) {
+  if (!calls || calls.length === 0) return false;
+  for (const call of calls) {
+    if (!GO_HTTP_REGISTRAR_METHODS.has(call.method_name)) continue;
+    const receiver = call.receiver ?? "";
+    if (!goRegistrarReceiverMatches(receiver)) continue;
+    const args2 = call.arguments ?? [];
+    for (const arg of args2) {
+      const expr = (arg.expression ?? arg.variable ?? arg.value ?? "").trim();
+      if (!expr) continue;
+      const short = expr.slice(expr.lastIndexOf(".") + 1);
+      if (short === method.name) return true;
+    }
+  }
+  return false;
+}
+function goRegistrarReceiverMatches(receiver) {
+  const trimmed = receiver.trim();
+  if (!trimmed) return false;
+  for (const target of GO_HTTP_REGISTRAR_RECEIVERS) {
+    if (trimmed === target) return true;
+    if (trimmed.endsWith(`.${target}`)) return true;
+  }
+  return false;
+}
+var BASH_POSITIONAL_TOKENS = [
+  "$1",
+  "$2",
+  "$3",
+  "$4",
+  "$5",
+  "$6",
+  "$7",
+  "$8",
+  "$9",
+  "$@",
+  "$*",
+  "$#",
+  "${1",
+  "${2",
+  "${3",
+  "${@",
+  "getopts"
+];
+var BASH_LIBRARY_FILENAME_PREFIXES = [
+  "benign_",
+  "safe_",
+  "lib_",
+  "common_",
+  "helpers_",
+  "_"
+];
+function classifyBashEntryPoint(method, enclosingType, ctx) {
+  if (pathLooksLikeLibraryOrTest(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (bashFilenameLooksLikeLibrary(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (method.name === "main") {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodConsumesPositionalArgs(method, ctx.calls)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (enclosingType && looksLikeModuleType(enclosingType) && fileHasPositionalArgUse(ctx.calls)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_UNKNOWN";
+}
+function bashFilenameLooksLikeLibrary(filePath) {
+  if (!filePath) return false;
+  const normalized = filePath.replace(/\\/g, "/");
+  const slash = normalized.lastIndexOf("/");
+  const base = (slash >= 0 ? normalized.slice(slash + 1) : normalized).toLowerCase();
+  for (const prefix of BASH_LIBRARY_FILENAME_PREFIXES) {
+    if (base.startsWith(prefix)) return true;
+  }
+  if (base.includes(".test.") || base.includes("_test.")) return true;
+  return false;
+}
+function methodConsumesPositionalArgs(method, calls) {
+  if (!calls || calls.length === 0) return false;
+  for (const call of calls) {
+    if (call.location.line < method.start_line) continue;
+    if (call.location.line > method.end_line) continue;
+    if (callHasPositionalToken(call)) return true;
+  }
+  return false;
+}
+function fileHasPositionalArgUse(calls) {
+  if (!calls || calls.length === 0) return false;
+  for (const call of calls) {
+    if (callHasPositionalToken(call)) return true;
+  }
+  return false;
+}
+function callHasPositionalToken(call) {
+  for (const arg of call.arguments ?? []) {
+    const expr = arg.expression ?? arg.variable ?? arg.value ?? "";
+    for (const tok of BASH_POSITIONAL_TOKENS) {
+      if (expr.includes(tok)) return true;
+    }
+  }
+  if (call.method_name === "getopts") return true;
+  return false;
+}
+function methodIsRuntimeRegistrationHandler(method, regs) {
+  if (!regs || regs.length === 0) return false;
+  for (const reg of regs) {
+    if (reg.kind !== "http_route" && reg.kind !== "decorator" && reg.kind !== "event_listener" && reg.kind !== "middleware") {
+      continue;
+    }
+    const handlerName = reg.handler?.name;
+    if (!handlerName) continue;
+    if (handlerName === method.name) return true;
+  }
+  return false;
+}
 
 // src/analysis/project-profile-transform.ts
 var DOWNGRADE_ELIGIBLE_RULE_IDS = /* @__PURE__ */ new Set([
@@ -33145,7 +33571,13 @@ var InterproceduralPass = class {
                   source.type,
                   enclosing?.method,
                   enclosing?.type,
-                  { language, types: graph.ir.types }
+                  {
+                    language,
+                    types: graph.ir.types,
+                    filePath: graph.ir.meta.file,
+                    calls: graph.ir.calls,
+                    runtimeRegistrations: graph.ir.runtime_registrations ?? null
+                  }
                 )) {
                   continue;
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.165.0",
+  "version": "3.166.1",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",