circle-ir 3.174.0 → 3.175.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/configs/sinks/open_redirect.yaml +21 -0
  2. package/configs/sinks/trust_boundary.yaml +18 -0
  3. package/dist/analysis/config-loader.d.ts.map +1 -1
  4. package/dist/analysis/config-loader.js +100 -1
  5. package/dist/analysis/config-loader.js.map +1 -1
  6. package/dist/browser/circle-ir.js +72 -2
  7. package/dist/core/circle-ir-core.cjs +72 -2
  8. package/dist/core/circle-ir-core.js +72 -2
  9. package/package.json +1 -1
package/dist/browser/circle-ir.js CHANGED
@@ -11215,6 +11215,66 @@ var DEFAULT_SOURCES = [
11215
11215
  { method: "decode", class: "JWT", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
11216
11216
  { method: "ParseUnverified", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] }
11217
11217
  ];
11218
+ var OPEN_REDIRECT_FRAMEWORK_SINKS = [
11219
+ // --- Python: django / starlette / fastapi -------------------------------
11220
+ { method: "HttpResponseRedirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
11221
+ { method: "HttpResponsePermanentRedirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
11222
+ { method: "RedirectResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
11223
+ // --- JS/TS: koa / fastify / express / next.js ---------------------------
11224
+ { method: "redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
11225
+ { method: "redirect", class: "FastifyReply", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
11226
+ // Express: res.location(url) sets Location header without redirect status,
11227
+ // still an open-redirect vector when combined with a downstream redirect.
11228
+ { method: "location", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
11229
+ // Next.js App Router: NextResponse.redirect(url) — static method matched
11230
+ // by receiver-class name.
11231
+ { method: "redirect", class: "NextResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
11232
+ // --- Java: Spring MVC RedirectView + JAX-RS Response --------------------
11233
+ { method: "RedirectView", class: "RedirectView", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
11234
+ { method: "setUrl", class: "RedirectView", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
11235
+ // JAX-RS Response builder — static factory methods that take a target URI.
11236
+ { method: "seeOther", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
11237
+ { method: "temporaryRedirect", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
11238
+ // --- Go: gin / echo / fiber ---------------------------------------------
11239
+ // gin/echo: c.Redirect(302, url) — status at arg[0], url at arg[1].
11240
+ // fiber: c.Redirect(url) — url at arg[0].
11241
+ // These entries fire once Go local-receiver type resolution lands
11242
+ // (see taint-matcher.ts:2137 receiverMightBeClass — currently returns
11243
+ // false for `c` against 'Context'/'Ctx'). Until then, the
11244
+ // external_taint_escape fallback preserves recall on these call sites.
11245
+ // net/http.Redirect (class 'http') is unaffected — declares class 'http'
11246
+ // and matches via package receiver.
11247
+ { method: "Redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [1], languages: ["go"] },
11248
+ { method: "Redirect", class: "Ctx", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["go"] }
11249
+ ];
11250
+ var TRUST_BOUNDARY_FRAMEWORK_SINKS = [
11251
+ // --- Python: Django cache write -----------------------------------------
11252
+ { method: "set", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["python"] },
11253
+ { method: "set_many", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["python"] },
11254
+ // --- JS/TS: client-side Storage + Express cookie ------------------------
11255
+ // localStorage / sessionStorage — browser Storage.setItem(key, value).
11256
+ { method: "setItem", class: "Storage", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
11257
+ // Express: res.cookie(name, value, opts) — cookie-jar write.
11258
+ { method: "cookie", class: "Response", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
11259
+ // --- Java: Cookie / SecurityContext / System.setProperty ----------------
11260
+ // `new Cookie(name, value)` — constructor with tainted value crosses the
11261
+ // client-server trust boundary via Set-Cookie.
11262
+ { method: "Cookie", class: "Cookie", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["java"] },
11263
+ { method: "setValue", class: "Cookie", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["java"] },
11264
+ // Spring Security: SecurityContext.setAuthentication(userSuppliedAuth) —
11265
+ // installs an untrusted principal into the request-scoped security
11266
+ // context; downstream authz decisions become attacker-controlled.
11267
+ { method: "setAuthentication", class: "SecurityContext", type: "trust_boundary", cwe: "CWE-501", severity: "high", arg_positions: [0], languages: ["java"] },
11268
+ // JVM-wide System property write with tainted value pollutes process
11269
+ // state observable to every thread.
11270
+ { method: "setProperty", class: "System", type: "trust_boundary", cwe: "CWE-501", severity: "high", arg_positions: [1], languages: ["java"] },
11271
+ // --- Go: http.SetCookie / gin.SetCookie ---------------------------------
11272
+ // Package-level `http.SetCookie(w, &http.Cookie{Value: tainted})` — sink
11273
+ // on arg[1] (the *Cookie) catches struct-literal composite tainting.
11274
+ { method: "SetCookie", class: "http", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] },
11275
+ // gin: c.SetCookie(name, value, maxAge, path, domain, secure, httpOnly).
11276
+ { method: "SetCookie", class: "Context", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] }
11277
+ ];
11218
11278
  var DEFAULT_SINKS = [
11219
11279
  // SQL Injection (CWE-89)
11220
11280
  { method: "executeQuery", class: "Statement", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -12576,7 +12636,10 @@ var DEFAULT_SINKS = [
12576
12636
  { method: "parse", class: "Uri", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
12577
12637
  // Rust Open Redirect
12578
12638
  { method: "redirect", class: "HttpResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
12579
- { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
12639
+ // Actix/warp `Redirect::to(url)` — scoped to Rust to avoid collision with
12640
+ // Go's `c.Redirect(status, url)` on gin/echo, which lives further down in
12641
+ // the OPEN_REDIRECT_FRAMEWORK_SINKS block with `arg_positions: [0, 1]`.
12642
+ { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["rust"] },
12580
12643
  { method: "see_other", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
12581
12644
  { method: "to", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
12582
12645
  { method: "temporary", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
@@ -12860,7 +12923,14 @@ var DEFAULT_SINKS = [
12860
12923
  // --- Go: langchaingo ----------------------------------------------------
12861
12924
  { method: "Call", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
12862
12925
  { method: "Generate", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
12863
- { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] }
12926
+ { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
12927
+ // cognium-dev #240 ship 1 — extended framework sinks for open_redirect
12928
+ // (CWE-601) and trust_boundary (CWE-501). Definitions extracted above
12929
+ // as OPEN_REDIRECT_FRAMEWORK_SINKS / TRUST_BOUNDARY_FRAMEWORK_SINKS to
12930
+ // keep the DEFAULT_SINKS literal within TypeScript's union-type
12931
+ // inference complexity limit (TS2590). See ~lines 661-752.
12932
+ ...OPEN_REDIRECT_FRAMEWORK_SINKS,
12933
+ ...TRUST_BOUNDARY_FRAMEWORK_SINKS
12864
12934
  ];
12865
12935
  var DEFAULT_SANITIZERS = [
12866
12936
  // SQL Injection - proper parameter binding sanitizes input
package/dist/core/circle-ir-core.cjs CHANGED
@@ -10610,6 +10610,66 @@ var DEFAULT_SOURCES = [
10610
10610
  { method: "decode", class: "JWT", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
10611
10611
  { method: "ParseUnverified", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] }
10612
10612
  ];
10613
+ var OPEN_REDIRECT_FRAMEWORK_SINKS = [
10614
+ // --- Python: django / starlette / fastapi -------------------------------
10615
+ { method: "HttpResponseRedirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
10616
+ { method: "HttpResponsePermanentRedirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
10617
+ { method: "RedirectResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
10618
+ // --- JS/TS: koa / fastify / express / next.js ---------------------------
10619
+ { method: "redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
10620
+ { method: "redirect", class: "FastifyReply", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
10621
+ // Express: res.location(url) sets Location header without redirect status,
10622
+ // still an open-redirect vector when combined with a downstream redirect.
10623
+ { method: "location", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
10624
+ // Next.js App Router: NextResponse.redirect(url) — static method matched
10625
+ // by receiver-class name.
10626
+ { method: "redirect", class: "NextResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
10627
+ // --- Java: Spring MVC RedirectView + JAX-RS Response --------------------
10628
+ { method: "RedirectView", class: "RedirectView", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
10629
+ { method: "setUrl", class: "RedirectView", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
10630
+ // JAX-RS Response builder — static factory methods that take a target URI.
10631
+ { method: "seeOther", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
10632
+ { method: "temporaryRedirect", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
10633
+ // --- Go: gin / echo / fiber ---------------------------------------------
10634
+ // gin/echo: c.Redirect(302, url) — status at arg[0], url at arg[1].
10635
+ // fiber: c.Redirect(url) — url at arg[0].
10636
+ // These entries fire once Go local-receiver type resolution lands
10637
+ // (see taint-matcher.ts:2137 receiverMightBeClass — currently returns
10638
+ // false for `c` against 'Context'/'Ctx'). Until then, the
10639
+ // external_taint_escape fallback preserves recall on these call sites.
10640
+ // net/http.Redirect (class 'http') is unaffected — declares class 'http'
10641
+ // and matches via package receiver.
10642
+ { method: "Redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [1], languages: ["go"] },
10643
+ { method: "Redirect", class: "Ctx", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["go"] }
10644
+ ];
10645
+ var TRUST_BOUNDARY_FRAMEWORK_SINKS = [
10646
+ // --- Python: Django cache write -----------------------------------------
10647
+ { method: "set", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["python"] },
10648
+ { method: "set_many", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["python"] },
10649
+ // --- JS/TS: client-side Storage + Express cookie ------------------------
10650
+ // localStorage / sessionStorage — browser Storage.setItem(key, value).
10651
+ { method: "setItem", class: "Storage", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
10652
+ // Express: res.cookie(name, value, opts) — cookie-jar write.
10653
+ { method: "cookie", class: "Response", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
10654
+ // --- Java: Cookie / SecurityContext / System.setProperty ----------------
10655
+ // `new Cookie(name, value)` — constructor with tainted value crosses the
10656
+ // client-server trust boundary via Set-Cookie.
10657
+ { method: "Cookie", class: "Cookie", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["java"] },
10658
+ { method: "setValue", class: "Cookie", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["java"] },
10659
+ // Spring Security: SecurityContext.setAuthentication(userSuppliedAuth) —
10660
+ // installs an untrusted principal into the request-scoped security
10661
+ // context; downstream authz decisions become attacker-controlled.
10662
+ { method: "setAuthentication", class: "SecurityContext", type: "trust_boundary", cwe: "CWE-501", severity: "high", arg_positions: [0], languages: ["java"] },
10663
+ // JVM-wide System property write with tainted value pollutes process
10664
+ // state observable to every thread.
10665
+ { method: "setProperty", class: "System", type: "trust_boundary", cwe: "CWE-501", severity: "high", arg_positions: [1], languages: ["java"] },
10666
+ // --- Go: http.SetCookie / gin.SetCookie ---------------------------------
10667
+ // Package-level `http.SetCookie(w, &http.Cookie{Value: tainted})` — sink
10668
+ // on arg[1] (the *Cookie) catches struct-literal composite tainting.
10669
+ { method: "SetCookie", class: "http", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] },
10670
+ // gin: c.SetCookie(name, value, maxAge, path, domain, secure, httpOnly).
10671
+ { method: "SetCookie", class: "Context", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] }
10672
+ ];
10613
10673
  var DEFAULT_SINKS = [
10614
10674
  // SQL Injection (CWE-89)
10615
10675
  { method: "executeQuery", class: "Statement", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -11971,7 +12031,10 @@ var DEFAULT_SINKS = [
11971
12031
  { method: "parse", class: "Uri", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
11972
12032
  // Rust Open Redirect
11973
12033
  { method: "redirect", class: "HttpResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
11974
- { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
12034
+ // Actix/warp `Redirect::to(url)` — scoped to Rust to avoid collision with
12035
+ // Go's `c.Redirect(status, url)` on gin/echo, which lives further down in
12036
+ // the OPEN_REDIRECT_FRAMEWORK_SINKS block with `arg_positions: [0, 1]`.
12037
+ { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["rust"] },
11975
12038
  { method: "see_other", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11976
12039
  { method: "to", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11977
12040
  { method: "temporary", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
@@ -12255,7 +12318,14 @@ var DEFAULT_SINKS = [
12255
12318
  // --- Go: langchaingo ----------------------------------------------------
12256
12319
  { method: "Call", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
12257
12320
  { method: "Generate", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
12258
- { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] }
12321
+ { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
12322
+ // cognium-dev #240 ship 1 — extended framework sinks for open_redirect
12323
+ // (CWE-601) and trust_boundary (CWE-501). Definitions extracted above
12324
+ // as OPEN_REDIRECT_FRAMEWORK_SINKS / TRUST_BOUNDARY_FRAMEWORK_SINKS to
12325
+ // keep the DEFAULT_SINKS literal within TypeScript's union-type
12326
+ // inference complexity limit (TS2590). See ~lines 661-752.
12327
+ ...OPEN_REDIRECT_FRAMEWORK_SINKS,
12328
+ ...TRUST_BOUNDARY_FRAMEWORK_SINKS
12259
12329
  ];
12260
12330
  var DEFAULT_SANITIZERS = [
12261
12331
  // SQL Injection - proper parameter binding sanitizes input
package/dist/core/circle-ir-core.js CHANGED
@@ -10544,6 +10544,66 @@ var DEFAULT_SOURCES = [
10544
10544
  { method: "decode", class: "JWT", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
10545
10545
  { method: "ParseUnverified", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] }
10546
10546
  ];
10547
+ var OPEN_REDIRECT_FRAMEWORK_SINKS = [
10548
+ // --- Python: django / starlette / fastapi -------------------------------
10549
+ { method: "HttpResponseRedirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
10550
+ { method: "HttpResponsePermanentRedirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
10551
+ { method: "RedirectResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
10552
+ // --- JS/TS: koa / fastify / express / next.js ---------------------------
10553
+ { method: "redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
10554
+ { method: "redirect", class: "FastifyReply", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
10555
+ // Express: res.location(url) sets Location header without redirect status,
10556
+ // still an open-redirect vector when combined with a downstream redirect.
10557
+ { method: "location", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
10558
+ // Next.js App Router: NextResponse.redirect(url) — static method matched
10559
+ // by receiver-class name.
10560
+ { method: "redirect", class: "NextResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
10561
+ // --- Java: Spring MVC RedirectView + JAX-RS Response --------------------
10562
+ { method: "RedirectView", class: "RedirectView", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
10563
+ { method: "setUrl", class: "RedirectView", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
10564
+ // JAX-RS Response builder — static factory methods that take a target URI.
10565
+ { method: "seeOther", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
10566
+ { method: "temporaryRedirect", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
10567
+ // --- Go: gin / echo / fiber ---------------------------------------------
10568
+ // gin/echo: c.Redirect(302, url) — status at arg[0], url at arg[1].
10569
+ // fiber: c.Redirect(url) — url at arg[0].
10570
+ // These entries fire once Go local-receiver type resolution lands
10571
+ // (see taint-matcher.ts:2137 receiverMightBeClass — currently returns
10572
+ // false for `c` against 'Context'/'Ctx'). Until then, the
10573
+ // external_taint_escape fallback preserves recall on these call sites.
10574
+ // net/http.Redirect (class 'http') is unaffected — declares class 'http'
10575
+ // and matches via package receiver.
10576
+ { method: "Redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [1], languages: ["go"] },
10577
+ { method: "Redirect", class: "Ctx", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["go"] }
10578
+ ];
10579
+ var TRUST_BOUNDARY_FRAMEWORK_SINKS = [
10580
+ // --- Python: Django cache write -----------------------------------------
10581
+ { method: "set", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["python"] },
10582
+ { method: "set_many", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["python"] },
10583
+ // --- JS/TS: client-side Storage + Express cookie ------------------------
10584
+ // localStorage / sessionStorage — browser Storage.setItem(key, value).
10585
+ { method: "setItem", class: "Storage", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
10586
+ // Express: res.cookie(name, value, opts) — cookie-jar write.
10587
+ { method: "cookie", class: "Response", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
10588
+ // --- Java: Cookie / SecurityContext / System.setProperty ----------------
10589
+ // `new Cookie(name, value)` — constructor with tainted value crosses the
10590
+ // client-server trust boundary via Set-Cookie.
10591
+ { method: "Cookie", class: "Cookie", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["java"] },
10592
+ { method: "setValue", class: "Cookie", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["java"] },
10593
+ // Spring Security: SecurityContext.setAuthentication(userSuppliedAuth) —
10594
+ // installs an untrusted principal into the request-scoped security
10595
+ // context; downstream authz decisions become attacker-controlled.
10596
+ { method: "setAuthentication", class: "SecurityContext", type: "trust_boundary", cwe: "CWE-501", severity: "high", arg_positions: [0], languages: ["java"] },
10597
+ // JVM-wide System property write with tainted value pollutes process
10598
+ // state observable to every thread.
10599
+ { method: "setProperty", class: "System", type: "trust_boundary", cwe: "CWE-501", severity: "high", arg_positions: [1], languages: ["java"] },
10600
+ // --- Go: http.SetCookie / gin.SetCookie ---------------------------------
10601
+ // Package-level `http.SetCookie(w, &http.Cookie{Value: tainted})` — sink
10602
+ // on arg[1] (the *Cookie) catches struct-literal composite tainting.
10603
+ { method: "SetCookie", class: "http", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] },
10604
+ // gin: c.SetCookie(name, value, maxAge, path, domain, secure, httpOnly).
10605
+ { method: "SetCookie", class: "Context", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] }
10606
+ ];
10547
10607
  var DEFAULT_SINKS = [
10548
10608
  // SQL Injection (CWE-89)
10549
10609
  { method: "executeQuery", class: "Statement", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -11905,7 +11965,10 @@ var DEFAULT_SINKS = [
11905
11965
  { method: "parse", class: "Uri", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
11906
11966
  // Rust Open Redirect
11907
11967
  { method: "redirect", class: "HttpResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
11908
- { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
11968
+ // Actix/warp `Redirect::to(url)` — scoped to Rust to avoid collision with
11969
+ // Go's `c.Redirect(status, url)` on gin/echo, which lives further down in
11970
+ // the OPEN_REDIRECT_FRAMEWORK_SINKS block with `arg_positions: [0, 1]`.
11971
+ { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["rust"] },
11909
11972
  { method: "see_other", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11910
11973
  { method: "to", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
11911
11974
  { method: "temporary", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
@@ -12189,7 +12252,14 @@ var DEFAULT_SINKS = [
12189
12252
  // --- Go: langchaingo ----------------------------------------------------
12190
12253
  { method: "Call", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
12191
12254
  { method: "Generate", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
12192
- { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] }
12255
+ { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
12256
+ // cognium-dev #240 ship 1 — extended framework sinks for open_redirect
12257
+ // (CWE-601) and trust_boundary (CWE-501). Definitions extracted above
12258
+ // as OPEN_REDIRECT_FRAMEWORK_SINKS / TRUST_BOUNDARY_FRAMEWORK_SINKS to
12259
+ // keep the DEFAULT_SINKS literal within TypeScript's union-type
12260
+ // inference complexity limit (TS2590). See ~lines 661-752.
12261
+ ...OPEN_REDIRECT_FRAMEWORK_SINKS,
12262
+ ...TRUST_BOUNDARY_FRAMEWORK_SINKS
12193
12263
  ];
12194
12264
  var DEFAULT_SANITIZERS = [
12195
12265
  // SQL Injection - proper parameter binding sanitizes input
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "circle-ir",
3
- "version": "3.174.0",
3
+ "version": "3.175.0",
4
4
  "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.js",