circle-ir 3.178.0 → 3.180.0

package/dist/analysis/passes/deserialization-safety-gate-pass.js

@@ -38,13 +38,16 @@
  *
  * See `docs/PASSES.md` for the canonical pass registry entry.
  */
-import { resolveFastjsonFromPom, fileReenablesFastjsonAutotype, fileEnablesJacksonPolymorphism, fileConfiguresSnakeYamlSafely, } from '../dependency-versions.js';
+import { resolveFastjsonFromPom, resolveFastjsonFromGradle, resolveFastjsonFromGradleCatalog, resolvePyYamlFromRequirements, resolvePyYamlFromPyproject, fileHasUnsafePyYamlLoader, fileReenablesFastjsonAutotype, fileEnablesJacksonPolymorphism, fileConfiguresSnakeYamlSafely, } from '../dependency-versions.js';
 const FASTJSON_METHODS = new Set(['parseObject', 'parse']);
 const FASTJSON_CLASSES = new Set(['JSON', 'JSONObject']);
 const JACKSON_METHODS = new Set(['readValue', 'convertValue', 'treeToValue']);
 const JACKSON_CLASSES = new Set(['ObjectMapper', 'ObjectReader']);
 const SNAKEYAML_METHODS = new Set(['load', 'loadAs', 'loadAll']);
 const SNAKEYAML_CLASSES = new Set(['Yaml']);
+// Python PyYAML gate (Gate D — cognium-dev #261 Python slice).
+const PYYAML_METHODS = new Set(['load']);
+const PYYAML_CLASSES = new Set(['yaml']);
 export class DeserializationSafetyGatePass {
     dependencyContext;
     name = 'deserialization-safety-gate';
@@ -54,11 +57,11 @@ export class DeserializationSafetyGatePass {
     }
     run(ctx) {
         const { graph, language, code } = ctx;
-        // Java-only for the MVP. Other languages (Python pyyaml, JS
-        // Deserialize, Rust bincode) can extend the gate on their own
-        // manifests in follow-up scopes.
-        if (language !== 'java') {
-            return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0 };
+        // Java + Python for the MVP. Other languages (JS Deserialize,
+        // Rust bincode) can extend the gate on their own manifests in
+        // follow-up scopes.
+        if (language !== 'java' && language !== 'python') {
+            return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0, droppedPyYaml: 0 };
         }
         // Same sink-source discovery as SinkSemanticsPass: prefer
         // SinkFilterResult when the real pipeline has run, otherwise fall
@@ -68,17 +71,48 @@ export class DeserializationSafetyGatePass {
             ? ctx.getResult('sink-filter').sinks
             : graph.ir.taint.sinks;
         // --- Gate A: Fastjson _noneautotype ------------------------------------
+        // Consult pom.xml first; fall back to build.gradle when pom does
+        // not resolve. Both manifests may be supplied by a caller that
+        // scans a multi-build project; either one indicating the hardened
+        // classifier is sufficient to drop the sink.
         const pomXml = this.dependencyContext?.java?.pomXml;
-        const fastjson = pomXml ? resolveFastjsonFromPom(pomXml) : null;
+        const buildGradle = this.dependencyContext?.java?.buildGradle;
+        const libsVersionsToml = this.dependencyContext?.java?.libsVersionsToml;
+        const fastjson = (pomXml ? resolveFastjsonFromPom(pomXml) : null) ??
+            (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null) ??
+            (buildGradle && libsVersionsToml
+                ? resolveFastjsonFromGradleCatalog(buildGradle, libsVersionsToml)
+                : null);
         const fastjsonHardened = fastjson?.noneAutotype === true &&
             !fileReenablesFastjsonAutotype(code);
         // --- Gate B: Jackson polymorphism ---------------------------------------
         const jacksonSafe = !fileEnablesJacksonPolymorphism(code);
         // --- Gate C: SnakeYAML SafeConstructor ----------------------------------
         const snakeYamlSafe = fileConfiguresSnakeYamlSafely(code);
+        // --- Gate D: PyYAML ≥ 6.0 (Python) --------------------------------------
+        // Under pyyaml ≥ 6.0, `yaml.load(x)` without an explicit `Loader=`
+        // keyword arg raises TypeError (safe-by-default); callers that pass
+        // `Loader=SafeLoader` are safe; callers that pass an unsafe Loader
+        // (`Loader=Loader` / `UnsafeLoader` / `FullLoader`) are still
+        // dangerous regardless of the version pin — those need per-call
+        // inspection to preserve.
+        const requirementsTxt = this.dependencyContext?.python?.requirementsTxt;
+        const pyprojectToml = this.dependencyContext?.python?.pyprojectToml;
+        const pyYaml = (requirementsTxt ? resolvePyYamlFromRequirements(requirementsTxt) : null) ??
+            (pyprojectToml ? resolvePyYamlFromPyproject(pyprojectToml) : null);
+        const pyYamlSafeByDefault = pyYaml?.safeByDefault === true;
+        // Lazy: only split source lines when we actually need per-call
+        // inspection (i.e. gate D is active and could fire).
+        let sourceLines = null;
+        const getSourceLines = () => {
+            if (sourceLines === null)
+                sourceLines = code.split('\n');
+            return sourceLines;
+        };
         let droppedFastjson = 0;
         let droppedJackson = 0;
         let droppedSnakeYaml = 0;
+        let droppedPyYaml = 0;
         const kept = sinks.filter((sink) => {
             if (sink.type !== 'deserialization')
                 return true;
@@ -107,16 +141,29 @@ export class DeserializationSafetyGatePass {
                 droppedSnakeYaml++;
                 return false;
             }
+            // Gate D — PyYAML (Python). `sink.class` may be `undefined` for
+            // Python: unlike Java, Python calls do not carry receiver-type
+            // resolution into the CallInfo, so the taint-matcher's sinkMap
+            // assigns undefined for the class field. Accept undefined OR
+            // exact-`'yaml'` (mirrors Gate A's Fastjson check).
+            if (language === 'python' &&
+                pyYamlSafeByDefault &&
+                PYYAML_METHODS.has(sink.method) &&
+                (sink.class === undefined || PYYAML_CLASSES.has(sink.class)) &&
+                !fileHasUnsafePyYamlLoader(getSourceLines(), sink.line)) {
+                droppedPyYaml++;
+                return false;
+            }
             return true;
         });
-        const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml;
+        const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml + droppedPyYaml;
         if (totalDropped > 0) {
             // Mutate in place so downstream passes see the reduced sink set.
             // Matches SinkSemanticsPass's contract.
             sinks.length = 0;
             sinks.push(...kept);
         }
-        return { droppedFastjson, droppedJackson, droppedSnakeYaml };
+        return { droppedFastjson, droppedJackson, droppedSnakeYaml, droppedPyYaml };
     }
 }
 //# sourceMappingURL=deserialization-safety-gate-pass.js.map

package/dist/analysis/passes/deserialization-safety-gate-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"deserialization-safety-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AAElE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,MAAM,OAAO,6BAA6B;IAMX;IAHpB,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,iBAAqC;QAArC,sBAAiB,GAAjB,iBAAiB,CAAoB;IAAG,CAAC;IAEtE,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAEtC,4DAA4D;QAC5D,8DAA8D;QAC9D,iCAAiC;QACjC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,0DAA0D;QAC1D,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,MAAM,gBAAgB,GACpB,QAAQ,EAAE,YAAY,KAAK,IAAI;YAC/B,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAEvC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QAEzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAE9B,oBAAoB;YACpB,IACE,gBAAgB;gBAChB,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC9D,CAAC;gBACD,eAAe,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mBAAmB;YACnB,IACE,WAAW;gBACX,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/B,CAAC;gBACD,cAAc,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,qBAAqB;YACrB,IACE,aAAa;gBACb,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,gBAAgB,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,CAAC;QACzE,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,iEAAiE;YACjE,wCAAwC;YACxC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;IAC/D,CAAC;CACF"}
+{"version":3,"file":"deserialization-safety-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAanC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AAElE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,+DAA+D;AAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzC,MAAM,OAAO,6BAA6B;IAMX;IAHpB,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,iBAAqC;QAArC,sBAAiB,GAAjB,iBAAiB,CAAoB;IAAG,CAAC;IAEtE,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAEtC,8DAA8D;QAC9D,8DAA8D;QAC9D,oBAAoB;QACpB,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,0DAA0D;QAC1D,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,0EAA0E;QAC1E,iEAAiE;QACjE,+DAA+D;QAC/D,kEAAkE;QAClE,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,WAAW,CAAC;QAC9D,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,CAAC;QACxE,MAAM,QAAQ,GACZ,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,CAAC,WAAW,IAAI,gBAAgB;gBAC9B,CAAC,CAAC,gCAAgC,CAAC,WAAW,EAAE,gBAAgB,CAAC;gBACjE,CAAC,CAAC,IAAI,CAAC,CAAC;QACZ,MAAM,gBAAgB,GACpB,QAAQ,EAAE,YAAY,KAAK,IAAI;YAC/B,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAEvC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,gEAAgE;QAChE,0BAA0B;QAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,eAAe,CAAC;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,aAAa,CAAC;QACpE,MAAM,MAAM,GACV,CAAC,eAAe,CAAC,CAAC,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzE,CAAC,aAAa,CAAC,CAAC,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;QAC3D,+DAA+D;QAC/D,qDAAqD;QACrD,IAAI,WAAW,GAAoB,IAAI,CAAC;QACxC,MAAM,cAAc,GAAG,GAAa,EAAE;YACpC,IAAI,WAAW,KAAK,IAAI;gBAAE,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzD,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC;QAEF,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAE9B,oBAAoB;YACpB,IACE,gBAAgB;gBAChB,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC9D,CAAC;gBACD,eAAe,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mBAAmB;YACnB,IACE,WAAW;gBACX,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/B,CAAC;gBACD,cAAc,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,qBAAqB;YACrB,IACE,aAAa;gBACb,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,gBAAgB,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,gEAAgE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,6DAA6D;YAC7D,oDAAoD;YACpD,IACE,QAAQ,KAAK,QAAQ;gBACrB,mBAAmB;gBACnB,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5D,CAAC,yBAAyB,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EACvD,CAAC;gBACD,aAAa,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,CAAC;QACzF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,iEAAiE;YACjE,wCAAwC;YACxC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/dist/analysis/passes/python-receiver-taint-format-pass.d.ts

@@ -0,0 +1,48 @@
+/**
+ * PythonReceiverTaintFormatPass — cognium-dev #264 (Python receiver-taint).
+ *
+ * Emits `format_string` (CWE-134) findings for Python `.format(...)`
+ * calls whose RECEIVER is tainted. The pre-#264-Python-slice sink
+ * patterns key exclusively on `arg_positions`, which cannot represent
+ * a taint that lives on the call's receiver — Python's
+ * `str.format(*args)` shape puts the format template AS the receiver,
+ * not as an argument. Same is true of the `%`-operator shape
+ * (`taintedFmt % args`), which lives entirely in a binary-operator
+ * AST node, not a call.
+ *
+ * This pass takes the receiver-taint half of that gap by scanning
+ * `graph.ir.calls` for `.format(...)` calls whose receiver appears in
+ * the constant-propagation `tainted` set. On a hit, emits a direct
+ * `format_string` finding at the call site (severity `medium`, level
+ * `warning`).
+ *
+ * The `%`-operator half is genuinely bigger — needs a new AST scan
+ * over `binary_operator` nodes with format-shape RHS detection — and
+ * remains deferred on #264.
+ *
+ * Python-only. No-op on other languages.
+ *
+ * Pipeline slot: runs after `ConstantPropagationPass` so the
+ * `tainted` set is populated. Any pass position after
+ * `constant-propagation` is safe; placing near the sink-emission
+ * chain keeps like-with-like grouped.
+ *
+ * Direct-finding emission (via `ctx.addFinding`) rather than
+ * synthetic-sink emission because the format-string vulnerability
+ * here doesn't need a taint-source → sink flow trace: the
+ * `constant-propagation.tainted` set implicitly encodes that the
+ * receiver traces back to a source. Emitting a sink would require
+ * TaintPropagationPass to also understand receiver-taint, which
+ * would be a much broader engine change.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+export interface PythonReceiverTaintFormatResult {
+    /** Number of `.format()` calls flagged this run. */
+    findingsEmitted: number;
+}
+export declare class PythonReceiverTaintFormatPass implements AnalysisPass<PythonReceiverTaintFormatResult> {
+    readonly name = "python-receiver-taint-format";
+    readonly category: "security";
+    run(ctx: PassContext): PythonReceiverTaintFormatResult;
+}
+//# sourceMappingURL=python-receiver-taint-format-pass.d.ts.map

package/dist/analysis/passes/python-receiver-taint-format-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-receiver-taint-format-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/python-receiver-taint-format-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,+BAA+B;IAC9C,oDAAoD;IACpD,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAExD,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAsDvD"}

package/dist/analysis/passes/python-receiver-taint-format-pass.js

@@ -0,0 +1,91 @@
+/**
+ * PythonReceiverTaintFormatPass — cognium-dev #264 (Python receiver-taint).
+ *
+ * Emits `format_string` (CWE-134) findings for Python `.format(...)`
+ * calls whose RECEIVER is tainted. The pre-#264-Python-slice sink
+ * patterns key exclusively on `arg_positions`, which cannot represent
+ * a taint that lives on the call's receiver — Python's
+ * `str.format(*args)` shape puts the format template AS the receiver,
+ * not as an argument. Same is true of the `%`-operator shape
+ * (`taintedFmt % args`), which lives entirely in a binary-operator
+ * AST node, not a call.
+ *
+ * This pass takes the receiver-taint half of that gap by scanning
+ * `graph.ir.calls` for `.format(...)` calls whose receiver appears in
+ * the constant-propagation `tainted` set. On a hit, emits a direct
+ * `format_string` finding at the call site (severity `medium`, level
+ * `warning`).
+ *
+ * The `%`-operator half is genuinely bigger — needs a new AST scan
+ * over `binary_operator` nodes with format-shape RHS detection — and
+ * remains deferred on #264.
+ *
+ * Python-only. No-op on other languages.
+ *
+ * Pipeline slot: runs after `ConstantPropagationPass` so the
+ * `tainted` set is populated. Any pass position after
+ * `constant-propagation` is safe; placing near the sink-emission
+ * chain keeps like-with-like grouped.
+ *
+ * Direct-finding emission (via `ctx.addFinding`) rather than
+ * synthetic-sink emission because the format-string vulnerability
+ * here doesn't need a taint-source → sink flow trace: the
+ * `constant-propagation.tainted` set implicitly encodes that the
+ * receiver traces back to a source. Emitting a sink would require
+ * TaintPropagationPass to also understand receiver-taint, which
+ * would be a much broader engine change.
+ */
+export class PythonReceiverTaintFormatPass {
+    name = 'python-receiver-taint-format';
+    category = 'security';
+    run(ctx) {
+        if (ctx.language !== 'python') {
+            return { findingsEmitted: 0 };
+        }
+        const { calls, meta } = ctx.graph.ir;
+        const constProp = ctx.getResult('constant-propagation');
+        const tainted = constProp.tainted;
+        let count = 0;
+        for (const call of calls) {
+            if (call.method_name !== 'format')
+                continue;
+            const receiver = call.receiver;
+            if (!receiver)
+                continue;
+            // Only bare-identifier receivers can be looked up in the tainted
+            // set. Skip complex receivers (`obj.attr.format()`, `f(x).format()`)
+            // — those don't correspond to a variable name the taint tracker
+            // would have on file. Recall may improve later with attribute-
+            // chain resolution, but the direct-identifier form is the common
+            // shape for user-controlled templates.
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(receiver))
+                continue;
+            // constant-propagation stores both scoped (`method:var`) and
+            // unscoped forms in the tainted set. Check both.
+            const scopedName = call.in_method
+                ? `${call.in_method}:${receiver}`
+                : receiver;
+            if (!tainted.has(receiver) && !tainted.has(scopedName))
+                continue;
+            ctx.addFinding({
+                id: `format_string-${meta.file}-${call.location.line}-${receiver}`,
+                pass: this.name,
+                category: 'security',
+                rule_id: 'format_string',
+                cwe: 'CWE-134',
+                severity: 'medium',
+                level: 'warning',
+                message: `Format-string vulnerability: the format template \`${receiver}\` ` +
+                    `is tainted (traces back to a taint source). Attacker can leak ` +
+                    `object attributes via \`{obj.__class__.__mro__[…]}\` chains or ` +
+                    `crash the process via unbounded specifiers. Use a literal ` +
+                    `format string and pass user input as an argument instead.`,
+                file: meta.file,
+                line: call.location.line,
+            });
+            count++;
+        }
+        return { findingsEmitted: count };
+    }
+}
+//# sourceMappingURL=python-receiver-taint-format-pass.js.map

package/dist/analysis/passes/python-receiver-taint-format-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-receiver-taint-format-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/python-receiver-taint-format-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,MAAM,OAAO,6BAA6B;IAG/B,IAAI,GAAG,8BAA8B,CAAC;IACtC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAC7B,sBAAsB,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAElC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ;gBAAE,SAAS;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,iEAAiE;YACjE,qEAAqE;YACrE,gEAAgE;YAChE,+DAA+D;YAC/D,iEAAiE;YACjE,uCAAuC;YACvC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEzD,6DAA6D;YAC7D,iDAAiD;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS;gBAC/B,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,EAAE;gBACjC,CAAC,CAAC,QAAQ,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YAEjE,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,iBAAiB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,EAAE;gBAClE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,eAAe;gBACxB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,sDAAsD,QAAQ,KAAK;oBACnE,gEAAgE;oBAChE,iEAAiE;oBACjE,4DAA4D;oBAC5D,2DAA2D;gBAC7D,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;aACzB,CAAC,CAAC;YACH,KAAK,EAAE,CAAC;QACV,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;CACF"}

package/dist/analysis/taint-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAgC7E;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CASP;AAqID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AA02ED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}
+{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAgC7E;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CASP;AAqID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AA43ED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}

package/dist/analysis/taint-matcher.js

@@ -2407,6 +2407,24 @@ function calculateSinkConfidence(call, pattern) {
     if (pattern.class && call.receiver) {
         if (receiverMightBeClass(call.receiver, pattern.class)) {
             confidence += 0.1;
+            // cognium-dev #260 — EXACT-match tiebreaker. When two patterns
+            // for the same `(method, cwe)` both accept the receiver — one
+            // exactly (e.g. class: 'Ctx' vs receiver 'Ctx') and one via
+            // `receiverMightBeClass` fuzzy heuristics (e.g. class: 'Context'
+            // vs receiver 'Ctx' via the includes/40%-length rule at
+            // taint-matcher.ts:2366) — the fuzzy match used to win the
+            // `sinkMap` dedup slot when it iterated first (both had the same
+            // 0.9 confidence). The extra boost here guarantees the exact-
+            // match pattern's `arg_positions` are the ones emitted on the
+            // final sink. Fixes the fiber `c.Redirect(next)` shape whose
+            // sink was emitted with the gin `class: 'Context'` pattern's
+            // `arg_positions: [1]` instead of fiber `class: 'Ctx'`'s
+            // `arg_positions: [0]`, dropping the taint flow silently.
+            const receiverLc = call.receiver.toLowerCase();
+            const classLc = pattern.class.toLowerCase();
+            if (call.receiver === pattern.class || receiverLc === classLc) {
+                confidence += 0.05;
+            }
         }
     }
     // Higher confidence for critical severity patterns