circle-ir 3.175.0 → 3.176.0

package/dist/core/circle-ir-core.js

@@ -12602,6 +12602,64 @@ function getDefaultConfig() {
   };
 }
 
+// src/analysis/arg-type-resolver.ts
+function findEnclosingType(callInMethod, types) {
+  if (!callInMethod) return null;
+  for (const t of types) {
+    for (const m of t.methods) {
+      if (m.name === callInMethod) return t;
+    }
+  }
+  return null;
+}
+function resolveIdentifierType(name2, callInMethod, types) {
+  if (!name2) return null;
+  const enclosing = findEnclosingType(callInMethod, types);
+  if (enclosing) {
+    for (const m of enclosing.methods) {
+      if (m.name !== callInMethod) continue;
+      for (const p of m.parameters) {
+        if (p.name === name2 && p.type) return p.type;
+      }
+    }
+    for (const f of enclosing.fields) {
+      if (f.name === name2 && f.type) return f.type;
+    }
+    return null;
+  }
+  for (const t of types) {
+    for (const m of t.methods) {
+      for (const p of m.parameters) {
+        if (p.name === name2 && p.type) return p.type;
+      }
+    }
+    for (const f of t.fields) {
+      if (f.name === name2 && f.type) return f.type;
+    }
+  }
+  return null;
+}
+function resolveCallReturnType(calleeName, callInMethod, types) {
+  if (!calleeName) return null;
+  const enclosing = findEnclosingType(callInMethod, types);
+  if (enclosing) {
+    for (const m of enclosing.methods) {
+      if (m.name === calleeName && m.return_type) return m.return_type;
+    }
+  }
+  for (const t of types) {
+    for (const m of t.methods) {
+      if (m.name === calleeName && m.return_type) return m.return_type;
+    }
+  }
+  return null;
+}
+function isBoundedClassType(rawType) {
+  if (!rawType) return false;
+  const stripped = rawType.trim().replace(/^(?:java\.lang\.)+/, "");
+  return /^Class(?:\s*<[\s\S]*>)?$/.test(stripped);
+}
+
 // src/analysis/taint-matcher.ts
 var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.args\b/, sourceType: "http_param" },
@@ -12627,7 +12685,7 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sources = findSources(calls, types, config.sources, sourceLines, language);
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
-  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
+  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
@@ -13205,13 +13263,30 @@ function isSafeRustCommandCall(call, pattern, language) {
   return false;
 }
 var CLASS_LITERAL_RE = /^(?:[A-Za-z_][\w]*\.)*[A-Z][\w]*(?:\[\])*\.class$/;
-function argIsClassLiteral(call, position) {
+function argIsClassLiteral(call, position, types) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg) return false;
   const expr = (arg.literal ?? arg.expression ?? "").trim();
   if (!expr) return false;
   if (CLASS_LITERAL_RE.test(expr)) return true;
-  return TYPE_TOKEN_RE.test(expr);
+  if (TYPE_TOKEN_RE.test(expr)) return true;
+  if (!types || types.length === 0) return false;
+  const argExpr = (arg.expression ?? "").trim();
+  const varName = arg.variable ?? "";
+  const isBareIdentifier = varName !== "" && argExpr === varName && !/[(.]/.test(argExpr);
+  if (isBareIdentifier) {
+    const t = resolveIdentifierType(varName, call.in_method, types);
+    if (isBoundedClassType(t)) return true;
+  }
+  const isCallExpr = varName !== "" && new RegExp(`^${escapeRe(varName)}\\s*\\(`).test(argExpr);
+  if (isCallExpr) {
+    const t = resolveCallReturnType(varName, call.in_method, types);
+    if (isBoundedClassType(t)) return true;
+  }
+  return false;
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
 function argIsStringLiteral(call, position) {
@@ -13372,7 +13447,7 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
-function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
+function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
   const sinkMap = /* @__PURE__ */ new Map();
   for (const call of calls) {
     for (const pattern of patterns) {
@@ -13392,7 +13467,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeJSChildProcessCall(call, pattern, language)) {
           continue;
         }
-        if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
+        if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }
         if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.175.0",
+  "version": "3.176.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",