circle-ir 3.17.0 → 3.17.1

package/README.md

@@ -8,7 +8,7 @@ A high-performance Static Application Security Testing (SAST) library for detect
 ## Features
 
 - **Taint Analysis**: Track data flow from sources (user input) to sinks (dangerous operations)
-- **Multi-language Support**: Java, JavaScript/TypeScript, Python, Rust, Bash/Shell
+- **Multi-language Support**: Java, JavaScript/TypeScript, Python, Rust, Bash/Shell, HTML
 - **High Accuracy**: 100% on OWASP Benchmark, 100% on Juliet Test Suite, 97.7% TPR on SecuriBench Micro
 - **36-Pass Pipeline**: 19 security taint passes + 17 reliability/performance/maintainability/architecture quality passes
 - **Metrics Engine**: 24 software quality metrics (cyclomatic complexity, Halstead, CBO, RFC, LCOM, DIT, and 4 composite scores)
@@ -207,6 +207,9 @@ const response = await analyzeForAPI(code, 'File.java', 'java');
 | **Python** | tree-sitter-python | Flask, Django, FastAPI |
 | **Rust** | tree-sitter-rust | Actix-web, Rocket, Axum |
 | **Bash/Shell** | tree-sitter-bash | Shell scripts (.sh, .bash, .zsh, .ksh) |
+| **HTML** | tree-sitter-html | Web extraction preprocessor (.html, .htm, .xhtml) |
+
+HTML is handled as a preprocessor: `<script>` blocks are extracted and analyzed as JavaScript, inline event handlers are analyzed as JS snippets, and 8 attribute-level security checks (missing noopener, javascript: URIs, missing sandbox/SRI, mixed content, etc.) run directly on the HTML AST.
 
 ### Multi-Language Examples
 
@@ -219,6 +222,9 @@ const pyResult = await analyze(pyCode, 'app.py', 'python');
 
 // Analyze Rust
 const rsResult = await analyze(rsCode, 'main.rs', 'rust');
+
+// Analyze HTML (extracts scripts, checks attributes)
+const htmlResult = await analyze(htmlCode, 'index.html', 'html');
 ```
 
 ## Detected Security Vulnerabilities

package/dist/languages/index.d.ts

@@ -2,7 +2,7 @@
  * Language Plugin System
  *
  * Provides multi-language support through a plugin architecture.
- * Each language (Java, JavaScript, Python, Rust) has its own plugin
+ * Each language (Java, JavaScript, Python, Rust, Bash, HTML) has its own plugin
  * that handles AST node types, taint patterns, and framework detection.
  */
 export type { SupportedLanguage, LanguageNodeTypes, LanguagePlugin, LanguageRegistry, ExtractionContext, FrameworkInfo, TaintSourcePattern, TaintSinkPattern, } from './types.js';

package/dist/languages/index.js

@@ -2,7 +2,7 @@
  * Language Plugin System
  *
  * Provides multi-language support through a plugin architecture.
- * Each language (Java, JavaScript, Python, Rust) has its own plugin
+ * Each language (Java, JavaScript, Python, Rust, Bash, HTML) has its own plugin
  * that handles AST node types, taint patterns, and framework detection.
  */
 // Registry functions

package/dist/languages/types.d.ts

@@ -2,7 +2,7 @@
  * Language Plugin System
  *
  * Defines the interface for language-specific analysis plugins.
- * Each language (Java, JavaScript, Python, Rust) implements this interface.
+ * Each language (Java, JavaScript, Python, Rust, Bash, HTML) implements this interface.
  */
 import type { Parser, Node as SyntaxNode, Tree } from 'web-tree-sitter';
 import type { TypeInfo, CallInfo, ImportInfo } from '../types/index.js';

package/dist/languages/types.js

@@ -2,7 +2,7 @@
  * Language Plugin System
  *
  * Defines the interface for language-specific analysis plugins.
- * Each language (Java, JavaScript, Python, Rust) implements this interface.
+ * Each language (Java, JavaScript, Python, Rust, Bash, HTML) implements this interface.
  */
 export {};
 //# sourceMappingURL=types.js.map

package/docs/SPEC.md

@@ -73,7 +73,7 @@ File metadata and version information.
 interface Meta {
   circle_ir: "3.0";
   file: string;
-  language: "java" | "javascript" | "typescript" | "python" | "rust" | "bash";
+  language: "java" | "javascript" | "typescript" | "python" | "rust" | "bash" | "html";
   loc: number;
   hash: string;           // SHA256 prefix (16 chars)
   package?: string;       // PENDING: Add to implementation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.17.0",
+  "version": "3.17.1",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",