circle-ir 3.173.0 → 3.174.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/configs/sinks/prompt_injection.yaml +50 -0
  2. package/dist/analysis/config-loader.d.ts.map +1 -1
  3. package/dist/analysis/config-loader.js +78 -0
  4. package/dist/analysis/config-loader.js.map +1 -1
  5. package/dist/analysis/rules.d.ts.map +1 -1
  6. package/dist/analysis/rules.js +9 -0
  7. package/dist/analysis/rules.js.map +1 -1
  8. package/dist/browser/circle-ir.js +79 -1
  9. package/dist/core/circle-ir-core.cjs +79 -1
  10. package/dist/core/circle-ir-core.js +79 -1
  11. package/dist/types/index.d.ts +1 -1
  12. package/dist/types/index.d.ts.map +1 -1
  13. package/package.json +1 -1
package/configs/sinks/prompt_injection.yaml ADDED
@@ -0,0 +1,50 @@
1
+ {
2
+ "$comment": "Reference-only. Runtime uses DEFAULT_SINKS in src/analysis/config-loader.ts. See cognium-dev#248.",
3
+ "sinks": [
4
+ { "method": "create", "class": "Completions", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
5
+ { "method": "create", "class": "Responses", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
6
+ { "method": "create", "class": "ChatCompletion", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
7
+ { "method": "create", "class": "Completion", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
8
+ { "method": "create", "class": "Messages", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
9
+ { "method": "stream", "class": "Messages", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
10
+ { "method": "completion", "class": "litellm", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
11
+ { "method": "acompletion", "class": "litellm", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
12
+ { "method": "invoke", "class": "ChatOpenAI", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
13
+ { "method": "predict", "class": "ChatOpenAI", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
14
+ { "method": "stream", "class": "ChatOpenAI", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
15
+ { "method": "generate", "class": "ChatOpenAI", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
16
+ { "method": "invoke", "class": "ChatAnthropic", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
17
+ { "method": "invoke", "class": "ChatGoogleGenerativeAI", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
18
+ { "method": "run", "class": "LLMChain", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
19
+ { "method": "invoke", "class": "LLMChain", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["python"] },
20
+
21
+ { "method": "create", "class": "Completions", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["javascript", "typescript"] },
22
+ { "method": "create", "class": "Responses", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["javascript", "typescript"] },
23
+ { "method": "create", "class": "Messages", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["javascript", "typescript"] },
24
+ { "method": "stream", "class": "Messages", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["javascript", "typescript"] },
25
+ { "method": "generateText", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0], "languages": ["javascript", "typescript"] },
26
+ { "method": "streamText", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0], "languages": ["javascript", "typescript"] },
27
+ { "method": "generateObject", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0], "languages": ["javascript", "typescript"] },
28
+ { "method": "streamObject", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0], "languages": ["javascript", "typescript"] },
29
+ { "method": "invoke", "class": "ChatOpenAI", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["javascript", "typescript"] },
30
+ { "method": "invoke", "class": "ChatAnthropic", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["javascript", "typescript"] },
31
+ { "method": "stream", "class": "ChatOpenAI", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["javascript", "typescript"] },
32
+
33
+ { "method": "generate", "class": "ChatLanguageModel", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["java"] },
34
+ { "method": "chat", "class": "ChatLanguageModel", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["java"] },
35
+ { "method": "generate", "class": "StreamingChatLanguageModel", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["java"] },
36
+ { "method": "chat", "class": "StreamingChatLanguageModel", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["java"] },
37
+ { "method": "prompt", "class": "ChatClient", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["java"] },
38
+ { "method": "call", "class": "ChatClient", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["java"] },
39
+ { "method": "call", "class": "ChatModel", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["java"] },
40
+ { "method": "createChatCompletion", "class": "OpenAiService", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["java"] },
41
+ { "method": "createCompletion", "class": "OpenAiService", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["java"] },
42
+
43
+ { "method": "CreateChatCompletion", "class": "Client", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["go"] },
44
+ { "method": "CreateCompletion", "class": "Client", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["go"] },
45
+ { "method": "CreateChatCompletionStream", "class": "Client", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["go"] },
46
+ { "method": "Call", "class": "LLM", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["go"] },
47
+ { "method": "Generate", "class": "LLM", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["go"] },
48
+ { "method": "GenerateContent", "class": "Model", "type": "prompt_injection", "cwe": "CWE-1427", "severity": "high", "arg_positions": [0, 1, 2, 3], "languages": ["go"] }
49
+ ]
50
+ }
package/dist/analysis/config-loader.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6hB1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAioDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
1
+ {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6hB1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA6tDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
package/dist/analysis/config-loader.js CHANGED
@@ -2120,6 +2120,84 @@ export const DEFAULT_SINKS = [
2120
2120
  // they iterate after net/http entries and don't hijack `http.Get`.
2121
2121
  { method: 'Do', class: 'Client', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['go'] }, // *fasthttp.Client.Do(req)
2122
2122
  { method: 'DoTimeout', class: 'Client', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['go'] },
2123
+ // =========================================================================
2124
+ // cognium-dev #248 — prompt-injection sinks (CWE-1427)
2125
+ //
2126
+ // Tainted data reaching a generative-model prompt-construction API is
2127
+ // classified as `prompt_injection`. v1 uses broad positional matching
2128
+ // (arg_positions [0..3]) because these APIs are kwarg-heavy: Python
2129
+ // `openai.chat.completions.create(model=..., messages=...)` may pass the
2130
+ // messages arg at position 0 or 1 depending on caller order, and JS/TS
2131
+ // object-literal `{ messages: [...], model: '...' }` is a single
2132
+ // positional arg whose taint is inherited from any tainted property.
2133
+ // Argname-precise matching (messages=/prompt=/content=) and
2134
+ // sanitizer credit for prompt-template libraries (PromptTemplate,
2135
+ // ChatPromptTemplate) are follow-ups.
2136
+ //
2137
+ // Class-qualified entries prevent bare `create()` / `generate()` calls
2138
+ // with no receiver from matching (per taint-matcher.ts:1696 guard).
2139
+ // =========================================================================
2140
+ // --- Python: openai (v1 SDK) --------------------------------------------
2141
+ { method: 'create', class: 'Completions', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2142
+ { method: 'create', class: 'Responses', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2143
+ // openai <1.0 legacy top-level API — `openai.ChatCompletion.create(...)` / `openai.Completion.create(...)`
2144
+ { method: 'create', class: 'ChatCompletion', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2145
+ { method: 'create', class: 'Completion', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2146
+ // --- Python: anthropic ---------------------------------------------------
2147
+ { method: 'create', class: 'Messages', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2148
+ { method: 'stream', class: 'Messages', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2149
+ // --- Python: litellm (bare functions from the litellm module) -----------
2150
+ { method: 'completion', class: 'litellm', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2151
+ { method: 'acompletion', class: 'litellm', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2152
+ // --- Python: langchain chat/llm models ----------------------------------
2153
+ // Common concrete classes; matching the class name catches typical usage
2154
+ // `ChatOpenAI().invoke(prompt)` where the receiver-type resolver identifies
2155
+ // the class from the constructor.
2156
+ { method: 'invoke', class: 'ChatOpenAI', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2157
+ { method: 'predict', class: 'ChatOpenAI', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2158
+ { method: 'stream', class: 'ChatOpenAI', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2159
+ { method: 'generate', class: 'ChatOpenAI', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2160
+ { method: 'invoke', class: 'ChatAnthropic', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2161
+ { method: 'invoke', class: 'ChatGoogleGenerativeAI', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2162
+ { method: 'run', class: 'LLMChain', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2163
+ { method: 'invoke', class: 'LLMChain', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['python'] },
2164
+ // --- JS/TS: openai node SDK ---------------------------------------------
2165
+ { method: 'create', class: 'Completions', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['javascript', 'typescript'] },
2166
+ { method: 'create', class: 'Responses', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['javascript', 'typescript'] },
2167
+ // --- JS/TS: @anthropic-ai/sdk -------------------------------------------
2168
+ { method: 'create', class: 'Messages', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['javascript', 'typescript'] },
2169
+ { method: 'stream', class: 'Messages', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['javascript', 'typescript'] },
2170
+ // --- JS/TS: Vercel AI SDK (bare functions from the `ai` package) --------
2171
+ // generateText/streamText/generateObject take a single options object;
2172
+ // taint reaches the sink when a tainted variable flows into any property.
2173
+ { method: 'generateText', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
2174
+ { method: 'streamText', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
2175
+ { method: 'generateObject', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
2176
+ { method: 'streamObject', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
2177
+ // --- JS/TS: langchain.js ------------------------------------------------
2178
+ { method: 'invoke', class: 'ChatOpenAI', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['javascript', 'typescript'] },
2179
+ { method: 'invoke', class: 'ChatAnthropic', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['javascript', 'typescript'] },
2180
+ { method: 'stream', class: 'ChatOpenAI', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['javascript', 'typescript'] },
2181
+ // --- Java: LangChain4j --------------------------------------------------
2182
+ { method: 'generate', class: 'ChatLanguageModel', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['java'] },
2183
+ { method: 'chat', class: 'ChatLanguageModel', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['java'] },
2184
+ { method: 'generate', class: 'StreamingChatLanguageModel', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['java'] },
2185
+ { method: 'chat', class: 'StreamingChatLanguageModel', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['java'] },
2186
+ // --- Java: Spring AI ----------------------------------------------------
2187
+ { method: 'prompt', class: 'ChatClient', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['java'] },
2188
+ { method: 'call', class: 'ChatClient', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['java'] },
2189
+ { method: 'call', class: 'ChatModel', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['java'] },
2190
+ // --- Java: OpenAI Java SDK (theokanning) --------------------------------
2191
+ { method: 'createChatCompletion', class: 'OpenAiService', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['java'] },
2192
+ { method: 'createCompletion', class: 'OpenAiService', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['java'] },
2193
+ // --- Go: go-openai (sashabaranov/go-openai) -----------------------------
2194
+ { method: 'CreateChatCompletion', class: 'Client', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['go'] },
2195
+ { method: 'CreateCompletion', class: 'Client', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['go'] },
2196
+ { method: 'CreateChatCompletionStream', class: 'Client', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['go'] },
2197
+ // --- Go: langchaingo ----------------------------------------------------
2198
+ { method: 'Call', class: 'LLM', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['go'] },
2199
+ { method: 'Generate', class: 'LLM', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['go'] },
2200
+ { method: 'GenerateContent', class: 'Model', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['go'] },
2123
2201
  ];
2124
2202
  export const DEFAULT_SANITIZERS = [
2125
2203
  // SQL Injection - proper parameter binding sanitizes input