circle-ir 3.176.0 → 3.178.0

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6hB1C,CAAC;AAmGF,eAAO,MAAM,aAAa,EAAE,WAAW,EAwuDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6hB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA6uDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -602,6 +602,76 @@ const OPEN_REDIRECT_FRAMEWORK_SINKS = [
     { method: 'Redirect', class: 'Ctx', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['go'] },
 ];
 // =========================================================================
+// cognium-dev #240 ship 2 — extend deserialization (CWE-502) framework
+// coverage across Python (pickle / marshal / dill / jsonpickle) and Go
+// (encoding/gob, gopkg.in/yaml). Java coverage (readObject / XStream /
+// ObjectMapper / Yaml SnakeYAML / Kryo / XMLDecoder) is already extensive
+// via DEFAULT_SINKS below; JS/TS `node-serialize.unserialize` added here.
+//
+// Spread into DEFAULT_SINKS below (per the ship-1 pattern).
+// =========================================================================
+const DESERIALIZATION_FRAMEWORK_SINKS = [
+    // --- Python: stdlib + popular third-party --------------------------------
+    // pickle: known-dangerous, any unpickle on untrusted bytes is RCE.
+    { method: 'loads', class: 'pickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'load', class: 'pickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    // cPickle alias (Python 2 name, still around in older codebases).
+    { method: 'loads', class: 'cPickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'load', class: 'cPickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    // marshal: stdlib code-object deserializer. Loading a tainted bytestring
+    // as a code object followed by `exec` is arbitrary-code execution.
+    { method: 'loads', class: 'marshal', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'load', class: 'marshal', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    // dill: pickle superset — same RCE profile.
+    { method: 'loads', class: 'dill', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'load', class: 'dill', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    // jsonpickle: JSON wrapper around pickle — trusts `py/object` marker.
+    { method: 'decode', class: 'jsonpickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    // --- Go: encoding/gob + yaml.Unmarshal -----------------------------------
+    // gob.NewDecoder(r).Decode(&v): tainted io.Reader → arbitrary Go values.
+    { method: 'Decode', class: 'Decoder', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], languages: ['go'] },
+    // gopkg.in/yaml.v2 + v3 top-level function; interface{} target is unsafe.
+    { method: 'Unmarshal', class: 'yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], languages: ['go'] },
+    // --- JS/TS: node-serialize ------------------------------------------------
+    // Known-dangerous — accepts embedded IIFE that runs during deserialize.
+    { method: 'unserialize', class: 'nodeSerialize', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
+];
+// =========================================================================
+// cognium-dev #240 ship 2 — extend nosql_injection (CWE-943) framework
+// coverage. JS/TS MongoDB Collection + Mongoose Model are already covered
+// at line 1776+. This ship adds Python (pymongo), Java (Spring Data
+// MongoTemplate + native MongoCollection), and Go (mongo-driver Collection).
+//
+// Spread into DEFAULT_SINKS below.
+// =========================================================================
+const NOSQL_FRAMEWORK_SINKS = [
+    // --- Python: pymongo Collection ------------------------------------------
+    // Every filter-taking Collection method; filter arg[0] is the query dict.
+    { method: 'find', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'find_one', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'aggregate', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'update_one', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0, 1], languages: ['python'] },
+    { method: 'update_many', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0, 1], languages: ['python'] },
+    { method: 'delete_one', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'delete_many', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'count_documents', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['python'] },
+    // --- Java: Spring Data MongoTemplate + native MongoCollection ------------
+    { method: 'find', class: 'MongoTemplate', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'findOne', class: 'MongoTemplate', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'findAll', class: 'MongoTemplate', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'find', class: 'MongoCollection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'aggregate', class: 'MongoCollection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['java'] },
+    // --- Go: go.mongodb.org/mongo-driver Collection --------------------------
+    // These fire once Go local-receiver type resolution lands (see
+    // taint-matcher.ts + #240 ship 2 Go receiver work). Same gate as the
+    // gin/fiber Ctx sinks in ship 1.
+    { method: 'Find', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [1], languages: ['go'] },
+    { method: 'FindOne', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [1], languages: ['go'] },
+    { method: 'UpdateOne', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [1, 2], languages: ['go'] },
+    { method: 'UpdateMany', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [1, 2], languages: ['go'] },
+    { method: 'DeleteOne', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [1], languages: ['go'] },
+];
+// =========================================================================
 // cognium-dev #240 ship 1 — extend trust_boundary (CWE-501) framework coverage
 //
 // Extracted from DEFAULT_SINKS (see note above). Spread into DEFAULT_SINKS
@@ -2297,6 +2367,11 @@ export const DEFAULT_SINKS = [
     // inference complexity limit (TS2590). See ~lines 661-752.
     ...OPEN_REDIRECT_FRAMEWORK_SINKS,
     ...TRUST_BOUNDARY_FRAMEWORK_SINKS,
+    // cognium-dev #240 ship 2 — extended framework sinks for
+    // deserialization (CWE-502) and nosql_injection (CWE-943). Same
+    // pattern: constants defined near the ship-1 blocks and spread here.
+    ...DESERIALIZATION_FRAMEWORK_SINKS,
+    ...NOSQL_FRAMEWORK_SINKS,
 ];
 export const DEFAULT_SANITIZERS = [
     // SQL Injection - proper parameter binding sanitizes input