circle-ir 3.175.0 → 3.177.0

package/dist/analysis/arg-type-resolver.d.ts

@@ -0,0 +1,90 @@
+/**
+ * cognium-dev #256 — same-file argument-type resolver.
+ *
+ * Two sink-shape gates ship in circle-ir today match only the DIRECT/LITERAL
+ * argument form and miss argument indirection:
+ *
+ *   1. `safe_if_class_literal_at` (taint-matcher.ts, #22) — matches
+ *      `readValue(json, Foo.class)` but not `readValue(json, templateClass)`
+ *      where `templateClass` is a `Class<T>` parameter.
+ *   2. Stage-11 `PROCESS_BUILDER_ARGV_FORM_RE` (sink-filter-pass.ts, #179)
+ *      matches `new ProcessBuilder(Arrays.asList(...))` but not
+ *      `new ProcessBuilder(buildCommand(...))` where `buildCommand` returns
+ *      `List<String>`.
+ *
+ * This module provides two pure, same-file, `TypeInfo[]`-based helpers to
+ * resolve the effective type of an argument that is either:
+ *   - a bare identifier (parameter or field name), or
+ *   - a method-call expression (callee name).
+ *
+ * Same-file only — locals declared inside method bodies and cross-file
+ * resolutions are deferred. Both #256 repros (jib, flyingsaucer) are
+ * same-method-parameter / same-class-static-callee, so this scope suffices.
+ *
+ * Design guarantee: both resolvers return null liberally. A null return
+ * flows to the existing gate's default-dangerous behavior (sink fires) —
+ * so any resolver bug regresses gracefully to current (over-firing)
+ * behavior, never to false-negative.
+ */
+import type { TypeInfo } from '../types/index.js';
+/**
+ * Resolve the declared type of a bare-identifier argument (parameter or
+ * field) visible at `callInMethod` scope.
+ *
+ * Lookup order:
+ *   1. Parameters of the enclosing method (matching `callInMethod`).
+ *   2. Fields of the enclosing type (any visibility).
+ *   3. If enclosing type not found, scan ALL types' method params + fields
+ *      (best-effort for top-level functions or method-name collisions).
+ *
+ * Returns the raw type string as extracted (`"Class<T>"`, `"List<String>"`,
+ * `"java.util.List<String>"`, `"Class<? extends JsonTemplate>"`, …) or null.
+ */
+export declare function resolveIdentifierType(name: string, callInMethod: string | null | undefined, types: TypeInfo[]): string | null;
+/**
+ * Resolve the declared return type of a same-file method invoked by
+ * `calleeName`. Accepts a bare callee name (as extracted into
+ * `ArgumentInfo.variable` for call expressions like `buildCommand(x, y)`).
+ *
+ * Preference order:
+ *   1. Method on the enclosing type matching `callInMethod`.
+ *   2. Method on any type in the file (static call `MyClass.foo()` case).
+ *
+ * Overload handling: if the enclosing type has multiple methods with the
+ * same name, returns the first one whose `return_type` is non-null. Full
+ * overload resolution would need argument-expression typing that we don't
+ * have; ambiguity is rare in practice and biases toward null (which
+ * flows to the current default-dangerous behavior).
+ */
+export declare function resolveCallReturnType(calleeName: string, callInMethod: string | null | undefined, types: TypeInfo[]): string | null;
+/**
+ * true when the raw type string represents a Java `Class` type (any bound):
+ * `Class`, `Class<T>`, `Class<? extends X>`, `Class<Foo>`, `java.lang.Class<...>`.
+ *
+ * NEVER matches:
+ *   - `Class.forName(x)` — that's a call expression, not a declared type;
+ *      lookups against `ir.types` won't find it (JDK reflection isn't
+ *      user code).
+ *   - `getClass()` return type — for the same reason.
+ *   - Raw types missing generic bounds are Jackson-safe in the same way
+ *     as the generic form: a bare `Class` param still has a compile-time
+ *     type identity, so we accept it.
+ */
+export declare function isBoundedClassType(rawType: string | null): boolean;
+/**
+ * true when the raw type resolves to a container shape that
+ * `ProcessBuilder(argv)` accepts as non-exploitable — the JVM passes the
+ * elements to `fork(2)` directly, no shell interpolation:
+ *
+ *   - `List<String>` (any parameterization narrower than `Object`)
+ *   - `ArrayList<String>`, `LinkedList<String>`
+ *   - `Collection<String>`, `Iterable<String>`, `Deque<String>`, `Queue<String>`
+ *   - `String[]`, `String ...` (varargs)
+ *   - Fully qualified variants: `java.util.List<String>`, etc.
+ *
+ * Excludes bare `List` / `List<Object>` / `Collection<?>` — those permit
+ * arbitrary element types that could carry non-String content the JVM
+ * would `.toString()` unsafely.
+ */
+export declare function isArgvContainerType(rawType: string | null): boolean;
+//# sourceMappingURL=arg-type-resolver.d.ts.map

package/dist/analysis/arg-type-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arg-type-resolver.d.ts","sourceRoot":"","sources":["../../src/analysis/arg-type-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAoBlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,KAAK,EAAE,QAAQ,EAAE,GAChB,MAAM,GAAG,IAAI,CA8Bf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,KAAK,EAAE,QAAQ,EAAE,GAChB,MAAM,GAAG,IAAI,CAef;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAIlE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAUnE"}

package/dist/analysis/arg-type-resolver.js

@@ -0,0 +1,174 @@
+/**
+ * cognium-dev #256 — same-file argument-type resolver.
+ *
+ * Two sink-shape gates ship in circle-ir today match only the DIRECT/LITERAL
+ * argument form and miss argument indirection:
+ *
+ *   1. `safe_if_class_literal_at` (taint-matcher.ts, #22) — matches
+ *      `readValue(json, Foo.class)` but not `readValue(json, templateClass)`
+ *      where `templateClass` is a `Class<T>` parameter.
+ *   2. Stage-11 `PROCESS_BUILDER_ARGV_FORM_RE` (sink-filter-pass.ts, #179)
+ *      matches `new ProcessBuilder(Arrays.asList(...))` but not
+ *      `new ProcessBuilder(buildCommand(...))` where `buildCommand` returns
+ *      `List<String>`.
+ *
+ * This module provides two pure, same-file, `TypeInfo[]`-based helpers to
+ * resolve the effective type of an argument that is either:
+ *   - a bare identifier (parameter or field name), or
+ *   - a method-call expression (callee name).
+ *
+ * Same-file only — locals declared inside method bodies and cross-file
+ * resolutions are deferred. Both #256 repros (jib, flyingsaucer) are
+ * same-method-parameter / same-class-static-callee, so this scope suffices.
+ *
+ * Design guarantee: both resolvers return null liberally. A null return
+ * flows to the existing gate's default-dangerous behavior (sink fires) —
+ * so any resolver bug regresses gracefully to current (over-firing)
+ * behavior, never to false-negative.
+ */
+/**
+ * Locate the TypeInfo whose `methods` list contains a method named
+ * `callInMethod`. Falls back to `null` if not found (e.g. top-level
+ * function, or method name collision that our best-effort match misses).
+ */
+function findEnclosingType(callInMethod, types) {
+    if (!callInMethod)
+        return null;
+    for (const t of types) {
+        for (const m of t.methods) {
+            if (m.name === callInMethod)
+                return t;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the declared type of a bare-identifier argument (parameter or
+ * field) visible at `callInMethod` scope.
+ *
+ * Lookup order:
+ *   1. Parameters of the enclosing method (matching `callInMethod`).
+ *   2. Fields of the enclosing type (any visibility).
+ *   3. If enclosing type not found, scan ALL types' method params + fields
+ *      (best-effort for top-level functions or method-name collisions).
+ *
+ * Returns the raw type string as extracted (`"Class<T>"`, `"List<String>"`,
+ * `"java.util.List<String>"`, `"Class<? extends JsonTemplate>"`, …) or null.
+ */
+export function resolveIdentifierType(name, callInMethod, types) {
+    if (!name)
+        return null;
+    const enclosing = findEnclosingType(callInMethod, types);
+    if (enclosing) {
+        // Parameter check (preferred — narrower scope, shadows fields).
+        for (const m of enclosing.methods) {
+            if (m.name !== callInMethod)
+                continue;
+            for (const p of m.parameters) {
+                if (p.name === name && p.type)
+                    return p.type;
+            }
+        }
+        // Field check on the enclosing type.
+        for (const f of enclosing.fields) {
+            if (f.name === name && f.type)
+                return f.type;
+        }
+        return null;
+    }
+    // Fallback: scan all types (top-level function case, or extractor didn't
+    // populate `in_method` reliably for this language).
+    for (const t of types) {
+        for (const m of t.methods) {
+            for (const p of m.parameters) {
+                if (p.name === name && p.type)
+                    return p.type;
+            }
+        }
+        for (const f of t.fields) {
+            if (f.name === name && f.type)
+                return f.type;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the declared return type of a same-file method invoked by
+ * `calleeName`. Accepts a bare callee name (as extracted into
+ * `ArgumentInfo.variable` for call expressions like `buildCommand(x, y)`).
+ *
+ * Preference order:
+ *   1. Method on the enclosing type matching `callInMethod`.
+ *   2. Method on any type in the file (static call `MyClass.foo()` case).
+ *
+ * Overload handling: if the enclosing type has multiple methods with the
+ * same name, returns the first one whose `return_type` is non-null. Full
+ * overload resolution would need argument-expression typing that we don't
+ * have; ambiguity is rare in practice and biases toward null (which
+ * flows to the current default-dangerous behavior).
+ */
+export function resolveCallReturnType(calleeName, callInMethod, types) {
+    if (!calleeName)
+        return null;
+    const enclosing = findEnclosingType(callInMethod, types);
+    if (enclosing) {
+        for (const m of enclosing.methods) {
+            if (m.name === calleeName && m.return_type)
+                return m.return_type;
+        }
+    }
+    // Fallback: any type in file. Static calls / helper classes.
+    for (const t of types) {
+        for (const m of t.methods) {
+            if (m.name === calleeName && m.return_type)
+                return m.return_type;
+        }
+    }
+    return null;
+}
+/**
+ * true when the raw type string represents a Java `Class` type (any bound):
+ * `Class`, `Class<T>`, `Class<? extends X>`, `Class<Foo>`, `java.lang.Class<...>`.
+ *
+ * NEVER matches:
+ *   - `Class.forName(x)` — that's a call expression, not a declared type;
+ *      lookups against `ir.types` won't find it (JDK reflection isn't
+ *      user code).
+ *   - `getClass()` return type — for the same reason.
+ *   - Raw types missing generic bounds are Jackson-safe in the same way
+ *     as the generic form: a bare `Class` param still has a compile-time
+ *     type identity, so we accept it.
+ */
+export function isBoundedClassType(rawType) {
+    if (!rawType)
+        return false;
+    const stripped = rawType.trim().replace(/^(?:java\.lang\.)+/, '');
+    return /^Class(?:\s*<[\s\S]*>)?$/.test(stripped);
+}
+/**
+ * true when the raw type resolves to a container shape that
+ * `ProcessBuilder(argv)` accepts as non-exploitable — the JVM passes the
+ * elements to `fork(2)` directly, no shell interpolation:
+ *
+ *   - `List<String>` (any parameterization narrower than `Object`)
+ *   - `ArrayList<String>`, `LinkedList<String>`
+ *   - `Collection<String>`, `Iterable<String>`, `Deque<String>`, `Queue<String>`
+ *   - `String[]`, `String ...` (varargs)
+ *   - Fully qualified variants: `java.util.List<String>`, etc.
+ *
+ * Excludes bare `List` / `List<Object>` / `Collection<?>` — those permit
+ * arbitrary element types that could carry non-String content the JVM
+ * would `.toString()` unsafely.
+ */
+export function isArgvContainerType(rawType) {
+    if (!rawType)
+        return false;
+    const s = rawType.trim().replace(/^(?:java\.util\.|java\.lang\.)+/, '');
+    // String[] or String...
+    if (/^String\s*(?:\[\s*\]|\.\.\.)$/.test(s))
+        return true;
+    // Container<String>-like — permit CharSequence too (String subtype narrower
+    // than Object). Reject `<?>`, `<? extends Object>`, bare `<Object>`.
+    return /^(?:List|ArrayList|LinkedList|Collection|Iterable|Deque|Queue)\s*<\s*(?:String|CharSequence|java\.lang\.String)\b/.test(s);
+}
+//# sourceMappingURL=arg-type-resolver.js.map

package/dist/analysis/arg-type-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arg-type-resolver.js","sourceRoot":"","sources":["../../src/analysis/arg-type-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,YAAuC,EACvC,KAAiB;IAEjB,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,YAAuC,EACvC,KAAiB;IAEjB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,gEAAgE;QAChE,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,SAAS;YACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;oBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,qCAAqC;QACrC,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yEAAyE;IACzE,oDAAoD;IACpD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;oBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,YAAuC,EACvC,KAAiB;IAEjB,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,CAAC,CAAC,WAAW,CAAC;QACnE,CAAC;IACH,CAAC;IACD,6DAA6D;IAC7D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,CAAC,CAAC,WAAW,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAsB;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;IACxE,wBAAwB;IACxB,IAAI,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,4EAA4E;IAC5E,qEAAqE;IACrE,OAAO,mHAAmH,CAAC,IAAI,CAC7H,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6hB1C,CAAC;AAmGF,eAAO,MAAM,aAAa,EAAE,WAAW,EAwuDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6hB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA6uDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -602,6 +602,76 @@ const OPEN_REDIRECT_FRAMEWORK_SINKS = [
     { method: 'Redirect', class: 'Ctx', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['go'] },
 ];
 // =========================================================================
+// cognium-dev #240 ship 2 — extend deserialization (CWE-502) framework
+// coverage across Python (pickle / marshal / dill / jsonpickle) and Go
+// (encoding/gob, gopkg.in/yaml). Java coverage (readObject / XStream /
+// ObjectMapper / Yaml SnakeYAML / Kryo / XMLDecoder) is already extensive
+// via DEFAULT_SINKS below; JS/TS `node-serialize.unserialize` added here.
+//
+// Spread into DEFAULT_SINKS below (per the ship-1 pattern).
+// =========================================================================
+const DESERIALIZATION_FRAMEWORK_SINKS = [
+    // --- Python: stdlib + popular third-party --------------------------------
+    // pickle: known-dangerous, any unpickle on untrusted bytes is RCE.
+    { method: 'loads', class: 'pickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'load', class: 'pickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    // cPickle alias (Python 2 name, still around in older codebases).
+    { method: 'loads', class: 'cPickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'load', class: 'cPickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    // marshal: stdlib code-object deserializer. Loading a tainted bytestring
+    // as a code object followed by `exec` is arbitrary-code execution.
+    { method: 'loads', class: 'marshal', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'load', class: 'marshal', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    // dill: pickle superset — same RCE profile.
+    { method: 'loads', class: 'dill', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'load', class: 'dill', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    // jsonpickle: JSON wrapper around pickle — trusts `py/object` marker.
+    { method: 'decode', class: 'jsonpickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    // --- Go: encoding/gob + yaml.Unmarshal -----------------------------------
+    // gob.NewDecoder(r).Decode(&v): tainted io.Reader → arbitrary Go values.
+    { method: 'Decode', class: 'Decoder', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], languages: ['go'] },
+    // gopkg.in/yaml.v2 + v3 top-level function; interface{} target is unsafe.
+    { method: 'Unmarshal', class: 'yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], languages: ['go'] },
+    // --- JS/TS: node-serialize ------------------------------------------------
+    // Known-dangerous — accepts embedded IIFE that runs during deserialize.
+    { method: 'unserialize', class: 'nodeSerialize', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
+];
+// =========================================================================
+// cognium-dev #240 ship 2 — extend nosql_injection (CWE-943) framework
+// coverage. JS/TS MongoDB Collection + Mongoose Model are already covered
+// at line 1776+. This ship adds Python (pymongo), Java (Spring Data
+// MongoTemplate + native MongoCollection), and Go (mongo-driver Collection).
+//
+// Spread into DEFAULT_SINKS below.
+// =========================================================================
+const NOSQL_FRAMEWORK_SINKS = [
+    // --- Python: pymongo Collection ------------------------------------------
+    // Every filter-taking Collection method; filter arg[0] is the query dict.
+    { method: 'find', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'find_one', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'aggregate', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'update_one', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0, 1], languages: ['python'] },
+    { method: 'update_many', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0, 1], languages: ['python'] },
+    { method: 'delete_one', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'delete_many', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'count_documents', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    // --- Java: Spring Data MongoTemplate + native MongoCollection ------------
+    { method: 'find', class: 'MongoTemplate', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'findOne', class: 'MongoTemplate', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'findAll', class: 'MongoTemplate', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'find', class: 'MongoCollection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'aggregate', class: 'MongoCollection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['java'] },
+    // --- Go: go.mongodb.org/mongo-driver Collection --------------------------
+    // These fire once Go local-receiver type resolution lands (see
+    // taint-matcher.ts + #240 ship 2 Go receiver work). Same gate as the
+    // gin/fiber Ctx sinks in ship 1.
+    { method: 'Find', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [1], languages: ['go'] },
+    { method: 'FindOne', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [1], languages: ['go'] },
+    { method: 'UpdateOne', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [1, 2], languages: ['go'] },
+    { method: 'UpdateMany', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [1, 2], languages: ['go'] },
+    { method: 'DeleteOne', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [1], languages: ['go'] },
+];
+// =========================================================================
 // cognium-dev #240 ship 1 — extend trust_boundary (CWE-501) framework coverage
 //
 // Extracted from DEFAULT_SINKS (see note above). Spread into DEFAULT_SINKS
@@ -2297,6 +2367,11 @@ export const DEFAULT_SINKS = [
     // inference complexity limit (TS2590). See ~lines 661-752.
     ...OPEN_REDIRECT_FRAMEWORK_SINKS,
     ...TRUST_BOUNDARY_FRAMEWORK_SINKS,
+    // cognium-dev #240 ship 2 — extended framework sinks for
+    // deserialization (CWE-502) and nosql_injection (CWE-943). Same
+    // pattern: constants defined near the ship-1 blocks and spread here.
+    ...DESERIALIZATION_FRAMEWORK_SINKS,
+    ...NOSQL_FRAMEWORK_SINKS,
 ];
 export const DEFAULT_SANITIZERS = [
     // SQL Injection - proper parameter binding sanitizes input