circle-ir 3.174.0 → 3.176.0

package/configs/sinks/open_redirect.yaml

@@ -0,0 +1,21 @@
+{
+  "$comment": "Reference-only. Runtime uses OPEN_REDIRECT_FRAMEWORK_SINKS + classless `redirect` + net/http.Redirect + Java sendRedirect in src/analysis/config-loader.ts. See cognium-dev#240.",
+  "sinks": [
+    { "method": "HttpResponseRedirect",          "type": "open_redirect", "cwe": "CWE-601", "severity": "medium", "arg_positions": [0], "languages": ["python"] },
+    { "method": "HttpResponsePermanentRedirect", "type": "open_redirect", "cwe": "CWE-601", "severity": "medium", "arg_positions": [0], "languages": ["python"] },
+    { "method": "RedirectResponse",              "type": "open_redirect", "cwe": "CWE-601", "severity": "medium", "arg_positions": [0], "languages": ["python"] },
+
+    { "method": "redirect", "class": "Context",      "type": "open_redirect", "cwe": "CWE-601", "severity": "medium", "arg_positions": [0], "languages": ["javascript", "typescript"] },
+    { "method": "redirect", "class": "FastifyReply", "type": "open_redirect", "cwe": "CWE-601", "severity": "medium", "arg_positions": [0], "languages": ["javascript", "typescript"] },
+    { "method": "location", "class": "Response",     "type": "open_redirect", "cwe": "CWE-601", "severity": "medium", "arg_positions": [0], "languages": ["javascript", "typescript"] },
+    { "method": "redirect", "class": "NextResponse", "type": "open_redirect", "cwe": "CWE-601", "severity": "medium", "arg_positions": [0], "languages": ["javascript", "typescript"] },
+
+    { "method": "RedirectView",      "class": "RedirectView", "type": "open_redirect", "cwe": "CWE-601", "severity": "high", "arg_positions": [0], "languages": ["java"] },
+    { "method": "setUrl",            "class": "RedirectView", "type": "open_redirect", "cwe": "CWE-601", "severity": "high", "arg_positions": [0], "languages": ["java"] },
+    { "method": "seeOther",          "class": "Response",     "type": "open_redirect", "cwe": "CWE-601", "severity": "high", "arg_positions": [0], "languages": ["java"] },
+    { "method": "temporaryRedirect", "class": "Response",     "type": "open_redirect", "cwe": "CWE-601", "severity": "high", "arg_positions": [0], "languages": ["java"] },
+
+    { "method": "Redirect", "class": "Context", "type": "open_redirect", "cwe": "CWE-601", "severity": "medium", "arg_positions": [1], "languages": ["go"] },
+    { "method": "Redirect", "class": "Ctx",     "type": "open_redirect", "cwe": "CWE-601", "severity": "medium", "arg_positions": [0], "languages": ["go"] }
+  ]
+}

package/configs/sinks/trust_boundary.yaml

@@ -0,0 +1,18 @@
+{
+  "$comment": "Reference-only. Runtime uses TRUST_BOUNDARY_FRAMEWORK_SINKS plus existing HttpSession/ServletContext/HttpServletRequest setAttribute entries in src/analysis/config-loader.ts. See cognium-dev#240 (extends #117).",
+  "sinks": [
+    { "method": "set",      "class": "cache", "type": "trust_boundary", "cwe": "CWE-501", "severity": "medium", "arg_positions": [1], "languages": ["python"] },
+    { "method": "set_many", "class": "cache", "type": "trust_boundary", "cwe": "CWE-501", "severity": "medium", "arg_positions": [0], "languages": ["python"] },
+
+    { "method": "setItem", "class": "Storage",  "type": "trust_boundary", "cwe": "CWE-501", "severity": "medium", "arg_positions": [1], "languages": ["javascript", "typescript"] },
+    { "method": "cookie",  "class": "Response", "type": "trust_boundary", "cwe": "CWE-501", "severity": "medium", "arg_positions": [1], "languages": ["javascript", "typescript"] },
+
+    { "method": "Cookie",             "class": "Cookie",          "type": "trust_boundary", "cwe": "CWE-501", "severity": "medium", "arg_positions": [1], "languages": ["java"] },
+    { "method": "setValue",           "class": "Cookie",          "type": "trust_boundary", "cwe": "CWE-501", "severity": "medium", "arg_positions": [0], "languages": ["java"] },
+    { "method": "setAuthentication",  "class": "SecurityContext", "type": "trust_boundary", "cwe": "CWE-501", "severity": "high",   "arg_positions": [0], "languages": ["java"] },
+    { "method": "setProperty",        "class": "System",          "type": "trust_boundary", "cwe": "CWE-501", "severity": "high",   "arg_positions": [1], "languages": ["java"] },
+
+    { "method": "SetCookie", "class": "http",    "type": "trust_boundary", "cwe": "CWE-501", "severity": "medium", "arg_positions": [1], "languages": ["go"] },
+    { "method": "SetCookie", "class": "Context", "type": "trust_boundary", "cwe": "CWE-501", "severity": "medium", "arg_positions": [1], "languages": ["go"] }
+  ]
+}

package/dist/analysis/arg-type-resolver.d.ts

@@ -0,0 +1,90 @@
+/**
+ * cognium-dev #256 — same-file argument-type resolver.
+ *
+ * Two sink-shape gates ship in circle-ir today match only the DIRECT/LITERAL
+ * argument form and miss argument indirection:
+ *
+ *   1. `safe_if_class_literal_at` (taint-matcher.ts, #22) — matches
+ *      `readValue(json, Foo.class)` but not `readValue(json, templateClass)`
+ *      where `templateClass` is a `Class<T>` parameter.
+ *   2. Stage-11 `PROCESS_BUILDER_ARGV_FORM_RE` (sink-filter-pass.ts, #179)
+ *      matches `new ProcessBuilder(Arrays.asList(...))` but not
+ *      `new ProcessBuilder(buildCommand(...))` where `buildCommand` returns
+ *      `List<String>`.
+ *
+ * This module provides two pure, same-file, `TypeInfo[]`-based helpers to
+ * resolve the effective type of an argument that is either:
+ *   - a bare identifier (parameter or field name), or
+ *   - a method-call expression (callee name).
+ *
+ * Same-file only — locals declared inside method bodies and cross-file
+ * resolutions are deferred. Both #256 repros (jib, flyingsaucer) are
+ * same-method-parameter / same-class-static-callee, so this scope suffices.
+ *
+ * Design guarantee: both resolvers return null liberally. A null return
+ * flows to the existing gate's default-dangerous behavior (sink fires) —
+ * so any resolver bug regresses gracefully to current (over-firing)
+ * behavior, never to false-negative.
+ */
+import type { TypeInfo } from '../types/index.js';
+/**
+ * Resolve the declared type of a bare-identifier argument (parameter or
+ * field) visible at `callInMethod` scope.
+ *
+ * Lookup order:
+ *   1. Parameters of the enclosing method (matching `callInMethod`).
+ *   2. Fields of the enclosing type (any visibility).
+ *   3. If enclosing type not found, scan ALL types' method params + fields
+ *      (best-effort for top-level functions or method-name collisions).
+ *
+ * Returns the raw type string as extracted (`"Class<T>"`, `"List<String>"`,
+ * `"java.util.List<String>"`, `"Class<? extends JsonTemplate>"`, …) or null.
+ */
+export declare function resolveIdentifierType(name: string, callInMethod: string | null | undefined, types: TypeInfo[]): string | null;
+/**
+ * Resolve the declared return type of a same-file method invoked by
+ * `calleeName`. Accepts a bare callee name (as extracted into
+ * `ArgumentInfo.variable` for call expressions like `buildCommand(x, y)`).
+ *
+ * Preference order:
+ *   1. Method on the enclosing type matching `callInMethod`.
+ *   2. Method on any type in the file (static call `MyClass.foo()` case).
+ *
+ * Overload handling: if the enclosing type has multiple methods with the
+ * same name, returns the first one whose `return_type` is non-null. Full
+ * overload resolution would need argument-expression typing that we don't
+ * have; ambiguity is rare in practice and biases toward null (which
+ * flows to the current default-dangerous behavior).
+ */
+export declare function resolveCallReturnType(calleeName: string, callInMethod: string | null | undefined, types: TypeInfo[]): string | null;
+/**
+ * true when the raw type string represents a Java `Class` type (any bound):
+ * `Class`, `Class<T>`, `Class<? extends X>`, `Class<Foo>`, `java.lang.Class<...>`.
+ *
+ * NEVER matches:
+ *   - `Class.forName(x)` — that's a call expression, not a declared type;
+ *      lookups against `ir.types` won't find it (JDK reflection isn't
+ *      user code).
+ *   - `getClass()` return type — for the same reason.
+ *   - Raw types missing generic bounds are Jackson-safe in the same way
+ *     as the generic form: a bare `Class` param still has a compile-time
+ *     type identity, so we accept it.
+ */
+export declare function isBoundedClassType(rawType: string | null): boolean;
+/**
+ * true when the raw type resolves to a container shape that
+ * `ProcessBuilder(argv)` accepts as non-exploitable — the JVM passes the
+ * elements to `fork(2)` directly, no shell interpolation:
+ *
+ *   - `List<String>` (any parameterization narrower than `Object`)
+ *   - `ArrayList<String>`, `LinkedList<String>`
+ *   - `Collection<String>`, `Iterable<String>`, `Deque<String>`, `Queue<String>`
+ *   - `String[]`, `String ...` (varargs)
+ *   - Fully qualified variants: `java.util.List<String>`, etc.
+ *
+ * Excludes bare `List` / `List<Object>` / `Collection<?>` — those permit
+ * arbitrary element types that could carry non-String content the JVM
+ * would `.toString()` unsafely.
+ */
+export declare function isArgvContainerType(rawType: string | null): boolean;
+//# sourceMappingURL=arg-type-resolver.d.ts.map

package/dist/analysis/arg-type-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arg-type-resolver.d.ts","sourceRoot":"","sources":["../../src/analysis/arg-type-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAoBlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,KAAK,EAAE,QAAQ,EAAE,GAChB,MAAM,GAAG,IAAI,CA8Bf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,KAAK,EAAE,QAAQ,EAAE,GAChB,MAAM,GAAG,IAAI,CAef;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAIlE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAUnE"}

package/dist/analysis/arg-type-resolver.js

@@ -0,0 +1,174 @@
+/**
+ * cognium-dev #256 — same-file argument-type resolver.
+ *
+ * Two sink-shape gates ship in circle-ir today match only the DIRECT/LITERAL
+ * argument form and miss argument indirection:
+ *
+ *   1. `safe_if_class_literal_at` (taint-matcher.ts, #22) — matches
+ *      `readValue(json, Foo.class)` but not `readValue(json, templateClass)`
+ *      where `templateClass` is a `Class<T>` parameter.
+ *   2. Stage-11 `PROCESS_BUILDER_ARGV_FORM_RE` (sink-filter-pass.ts, #179)
+ *      matches `new ProcessBuilder(Arrays.asList(...))` but not
+ *      `new ProcessBuilder(buildCommand(...))` where `buildCommand` returns
+ *      `List<String>`.
+ *
+ * This module provides two pure, same-file, `TypeInfo[]`-based helpers to
+ * resolve the effective type of an argument that is either:
+ *   - a bare identifier (parameter or field name), or
+ *   - a method-call expression (callee name).
+ *
+ * Same-file only — locals declared inside method bodies and cross-file
+ * resolutions are deferred. Both #256 repros (jib, flyingsaucer) are
+ * same-method-parameter / same-class-static-callee, so this scope suffices.
+ *
+ * Design guarantee: both resolvers return null liberally. A null return
+ * flows to the existing gate's default-dangerous behavior (sink fires) —
+ * so any resolver bug regresses gracefully to current (over-firing)
+ * behavior, never to false-negative.
+ */
+/**
+ * Locate the TypeInfo whose `methods` list contains a method named
+ * `callInMethod`. Falls back to `null` if not found (e.g. top-level
+ * function, or method name collision that our best-effort match misses).
+ */
+function findEnclosingType(callInMethod, types) {
+    if (!callInMethod)
+        return null;
+    for (const t of types) {
+        for (const m of t.methods) {
+            if (m.name === callInMethod)
+                return t;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the declared type of a bare-identifier argument (parameter or
+ * field) visible at `callInMethod` scope.
+ *
+ * Lookup order:
+ *   1. Parameters of the enclosing method (matching `callInMethod`).
+ *   2. Fields of the enclosing type (any visibility).
+ *   3. If enclosing type not found, scan ALL types' method params + fields
+ *      (best-effort for top-level functions or method-name collisions).
+ *
+ * Returns the raw type string as extracted (`"Class<T>"`, `"List<String>"`,
+ * `"java.util.List<String>"`, `"Class<? extends JsonTemplate>"`, …) or null.
+ */
+export function resolveIdentifierType(name, callInMethod, types) {
+    if (!name)
+        return null;
+    const enclosing = findEnclosingType(callInMethod, types);
+    if (enclosing) {
+        // Parameter check (preferred — narrower scope, shadows fields).
+        for (const m of enclosing.methods) {
+            if (m.name !== callInMethod)
+                continue;
+            for (const p of m.parameters) {
+                if (p.name === name && p.type)
+                    return p.type;
+            }
+        }
+        // Field check on the enclosing type.
+        for (const f of enclosing.fields) {
+            if (f.name === name && f.type)
+                return f.type;
+        }
+        return null;
+    }
+    // Fallback: scan all types (top-level function case, or extractor didn't
+    // populate `in_method` reliably for this language).
+    for (const t of types) {
+        for (const m of t.methods) {
+            for (const p of m.parameters) {
+                if (p.name === name && p.type)
+                    return p.type;
+            }
+        }
+        for (const f of t.fields) {
+            if (f.name === name && f.type)
+                return f.type;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the declared return type of a same-file method invoked by
+ * `calleeName`. Accepts a bare callee name (as extracted into
+ * `ArgumentInfo.variable` for call expressions like `buildCommand(x, y)`).
+ *
+ * Preference order:
+ *   1. Method on the enclosing type matching `callInMethod`.
+ *   2. Method on any type in the file (static call `MyClass.foo()` case).
+ *
+ * Overload handling: if the enclosing type has multiple methods with the
+ * same name, returns the first one whose `return_type` is non-null. Full
+ * overload resolution would need argument-expression typing that we don't
+ * have; ambiguity is rare in practice and biases toward null (which
+ * flows to the current default-dangerous behavior).
+ */
+export function resolveCallReturnType(calleeName, callInMethod, types) {
+    if (!calleeName)
+        return null;
+    const enclosing = findEnclosingType(callInMethod, types);
+    if (enclosing) {
+        for (const m of enclosing.methods) {
+            if (m.name === calleeName && m.return_type)
+                return m.return_type;
+        }
+    }
+    // Fallback: any type in file. Static calls / helper classes.
+    for (const t of types) {
+        for (const m of t.methods) {
+            if (m.name === calleeName && m.return_type)
+                return m.return_type;
+        }
+    }
+    return null;
+}
+/**
+ * true when the raw type string represents a Java `Class` type (any bound):
+ * `Class`, `Class<T>`, `Class<? extends X>`, `Class<Foo>`, `java.lang.Class<...>`.
+ *
+ * NEVER matches:
+ *   - `Class.forName(x)` — that's a call expression, not a declared type;
+ *      lookups against `ir.types` won't find it (JDK reflection isn't
+ *      user code).
+ *   - `getClass()` return type — for the same reason.
+ *   - Raw types missing generic bounds are Jackson-safe in the same way
+ *     as the generic form: a bare `Class` param still has a compile-time
+ *     type identity, so we accept it.
+ */
+export function isBoundedClassType(rawType) {
+    if (!rawType)
+        return false;
+    const stripped = rawType.trim().replace(/^(?:java\.lang\.)+/, '');
+    return /^Class(?:\s*<[\s\S]*>)?$/.test(stripped);
+}
+/**
+ * true when the raw type resolves to a container shape that
+ * `ProcessBuilder(argv)` accepts as non-exploitable — the JVM passes the
+ * elements to `fork(2)` directly, no shell interpolation:
+ *
+ *   - `List<String>` (any parameterization narrower than `Object`)
+ *   - `ArrayList<String>`, `LinkedList<String>`
+ *   - `Collection<String>`, `Iterable<String>`, `Deque<String>`, `Queue<String>`
+ *   - `String[]`, `String ...` (varargs)
+ *   - Fully qualified variants: `java.util.List<String>`, etc.
+ *
+ * Excludes bare `List` / `List<Object>` / `Collection<?>` — those permit
+ * arbitrary element types that could carry non-String content the JVM
+ * would `.toString()` unsafely.
+ */
+export function isArgvContainerType(rawType) {
+    if (!rawType)
+        return false;
+    const s = rawType.trim().replace(/^(?:java\.util\.|java\.lang\.)+/, '');
+    // String[] or String...
+    if (/^String\s*(?:\[\s*\]|\.\.\.)$/.test(s))
+        return true;
+    // Container<String>-like — permit CharSequence too (String subtype narrower
+    // than Object). Reject `<?>`, `<? extends Object>`, bare `<Object>`.
+    return /^(?:List|ArrayList|LinkedList|Collection|Iterable|Deque|Queue)\s*<\s*(?:String|CharSequence|java\.lang\.String)\b/.test(s);
+}
+//# sourceMappingURL=arg-type-resolver.js.map

package/dist/analysis/arg-type-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arg-type-resolver.js","sourceRoot":"","sources":["../../src/analysis/arg-type-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,YAAuC,EACvC,KAAiB;IAEjB,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,YAAuC,EACvC,KAAiB;IAEjB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,gEAAgE;QAChE,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,SAAS;YACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;oBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,qCAAqC;QACrC,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yEAAyE;IACzE,oDAAoD;IACpD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;oBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,YAAuC,EACvC,KAAiB;IAEjB,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,CAAC,CAAC,WAAW,CAAC;QACnE,CAAC;IACH,CAAC;IACD,6DAA6D;IAC7D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,CAAC,CAAC,WAAW,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAsB;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;IACxE,wBAAwB;IACxB,IAAI,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,4EAA4E;IAC5E,qEAAqE;IACrE,OAAO,mHAAmH,CAAC,IAAI,CAC7H,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6hB1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA6tDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6hB1C,CAAC;AAmGF,eAAO,MAAM,aAAa,EAAE,WAAW,EAwuDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -555,6 +555,95 @@ export const DEFAULT_SOURCES = [
     { method: 'decode', class: 'JWT', type: 'http_header', severity: 'high', return_tainted: true, languages: ['java'] },
     { method: 'ParseUnverified', class: 'jwt', type: 'http_header', severity: 'high', return_tainted: true, languages: ['go'] },
 ];
+// =========================================================================
+// cognium-dev #240 ship 1 — extend open_redirect (CWE-601) framework coverage
+//
+// Extracted from DEFAULT_SINKS to keep the main-array literal within the
+// TypeScript union-type inference complexity limit (TS2590). Spread into
+// DEFAULT_SINKS below.
+//
+// Baseline (variant-coverage.md): 11 probes, 1 fires, 10 FN. Existing
+// coverage: Java HttpServletResponse.sendRedirect, Node classless
+// `redirect`, Go net/http.Redirect, Rust actix Redirect/HttpResponse.
+// Adds Python (django/starlette/fastapi), JS/TS (koa/fastify/express
+// location + next.js), Java (RedirectView + JAX-RS Response), Go
+// (gin/echo/fiber).
+// =========================================================================
+const OPEN_REDIRECT_FRAMEWORK_SINKS = [
+    // --- Python: django / starlette / fastapi -------------------------------
+    { method: 'HttpResponseRedirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['python'] },
+    { method: 'HttpResponsePermanentRedirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['python'] },
+    { method: 'RedirectResponse', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['python'] },
+    // --- JS/TS: koa / fastify / express / next.js ---------------------------
+    { method: 'redirect', class: 'Context', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    { method: 'redirect', class: 'FastifyReply', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    // Express: res.location(url) sets Location header without redirect status,
+    // still an open-redirect vector when combined with a downstream redirect.
+    { method: 'location', class: 'Response', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    // Next.js App Router: NextResponse.redirect(url) — static method matched
+    // by receiver-class name.
+    { method: 'redirect', class: 'NextResponse', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    // --- Java: Spring MVC RedirectView + JAX-RS Response --------------------
+    { method: 'RedirectView', class: 'RedirectView', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'setUrl', class: 'RedirectView', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0], languages: ['java'] },
+    // JAX-RS Response builder — static factory methods that take a target URI.
+    { method: 'seeOther', class: 'Response', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'temporaryRedirect', class: 'Response', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0], languages: ['java'] },
+    // --- Go: gin / echo / fiber ---------------------------------------------
+    // gin/echo: c.Redirect(302, url) — status at arg[0], url at arg[1].
+    // fiber:   c.Redirect(url)         — url at arg[0].
+    // These entries fire once Go local-receiver type resolution lands
+    // (see taint-matcher.ts:2137 receiverMightBeClass — currently returns
+    // false for `c` against 'Context'/'Ctx'). Until then, the
+    // external_taint_escape fallback preserves recall on these call sites.
+    // net/http.Redirect (class 'http') is unaffected — declares class 'http'
+    // and matches via package receiver.
+    { method: 'Redirect', class: 'Context', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [1], languages: ['go'] },
+    { method: 'Redirect', class: 'Ctx', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['go'] },
+];
+// =========================================================================
+// cognium-dev #240 ship 1 — extend trust_boundary (CWE-501) framework coverage
+//
+// Extracted from DEFAULT_SINKS (see note above). Spread into DEFAULT_SINKS
+// below.
+//
+// Baseline (variant-coverage.md): 16 probes, 0 fires, 16 FN. Existing
+// coverage: Java HttpSession / ServletContext / HttpServletRequest
+// setAttribute (issue #117), Python session.__setitem__. Adds Django
+// cache, JS Storage.setItem, Express res.cookie, Java Cookie /
+// SecurityContext / System.setProperty, Go http.SetCookie / gin.SetCookie.
+//
+// Severity `medium` unless the sink pollutes a process-wide store
+// (System.setProperty → high).
+// =========================================================================
+const TRUST_BOUNDARY_FRAMEWORK_SINKS = [
+    // --- Python: Django cache write -----------------------------------------
+    { method: 'set', class: 'cache', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [1], languages: ['python'] },
+    { method: 'set_many', class: 'cache', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [0], languages: ['python'] },
+    // --- JS/TS: client-side Storage + Express cookie ------------------------
+    // localStorage / sessionStorage — browser Storage.setItem(key, value).
+    { method: 'setItem', class: 'Storage', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [1], languages: ['javascript', 'typescript'] },
+    // Express: res.cookie(name, value, opts) — cookie-jar write.
+    { method: 'cookie', class: 'Response', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [1], languages: ['javascript', 'typescript'] },
+    // --- Java: Cookie / SecurityContext / System.setProperty ----------------
+    // `new Cookie(name, value)` — constructor with tainted value crosses the
+    // client-server trust boundary via Set-Cookie.
+    { method: 'Cookie', class: 'Cookie', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [1], languages: ['java'] },
+    { method: 'setValue', class: 'Cookie', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    // Spring Security: SecurityContext.setAuthentication(userSuppliedAuth) —
+    // installs an untrusted principal into the request-scoped security
+    // context; downstream authz decisions become attacker-controlled.
+    { method: 'setAuthentication', class: 'SecurityContext', type: 'trust_boundary', cwe: 'CWE-501', severity: 'high', arg_positions: [0], languages: ['java'] },
+    // JVM-wide System property write with tainted value pollutes process
+    // state observable to every thread.
+    { method: 'setProperty', class: 'System', type: 'trust_boundary', cwe: 'CWE-501', severity: 'high', arg_positions: [1], languages: ['java'] },
+    // --- Go: http.SetCookie / gin.SetCookie ---------------------------------
+    // Package-level `http.SetCookie(w, &http.Cookie{Value: tainted})` — sink
+    // on arg[1] (the *Cookie) catches struct-literal composite tainting.
+    { method: 'SetCookie', class: 'http', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [1], languages: ['go'] },
+    // gin: c.SetCookie(name, value, maxAge, path, domain, secure, httpOnly).
+    { method: 'SetCookie', class: 'Context', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [1], languages: ['go'] },
+];
 export const DEFAULT_SINKS = [
     // SQL Injection (CWE-89)
     { method: 'executeQuery', class: 'Statement', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0] },
@@ -1915,7 +2004,10 @@ export const DEFAULT_SINKS = [
     { method: 'parse', class: 'Uri', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     // Rust Open Redirect
     { method: 'redirect', class: 'HttpResponse', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0] },
-    { method: 'Redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0] },
+    // Actix/warp `Redirect::to(url)` — scoped to Rust to avoid collision with
+    // Go's `c.Redirect(status, url)` on gin/echo, which lives further down in
+    // the OPEN_REDIRECT_FRAMEWORK_SINKS block with `arg_positions: [0, 1]`.
+    { method: 'Redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['rust'] },
     { method: 'see_other', class: 'Redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0] },
     { method: 'to', class: 'Redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0] },
     { method: 'temporary', class: 'Redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0] },
@@ -2198,6 +2290,13 @@ export const DEFAULT_SINKS = [
     { method: 'Call', class: 'LLM', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['go'] },
     { method: 'Generate', class: 'LLM', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['go'] },
     { method: 'GenerateContent', class: 'Model', type: 'prompt_injection', cwe: 'CWE-1427', severity: 'high', arg_positions: [0, 1, 2, 3], languages: ['go'] },
+    // cognium-dev #240 ship 1 — extended framework sinks for open_redirect
+    // (CWE-601) and trust_boundary (CWE-501). Definitions extracted above
+    // as OPEN_REDIRECT_FRAMEWORK_SINKS / TRUST_BOUNDARY_FRAMEWORK_SINKS to
+    // keep the DEFAULT_SINKS literal within TypeScript's union-type
+    // inference complexity limit (TS2590). See ~lines 661-752.
+    ...OPEN_REDIRECT_FRAMEWORK_SINKS,
+    ...TRUST_BOUNDARY_FRAMEWORK_SINKS,
 ];
 export const DEFAULT_SANITIZERS = [
     // SQL Injection - proper parameter binding sanitizes input