circle-ir 3.178.0 → 3.180.0

package/dist/browser/circle-ir.js

@@ -12277,6 +12277,20 @@ var DEFAULT_SINKS = [
   // Sandbox/script security
   { method: "onNewInstance", class: "SandboxInterceptor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // Java Log Injection (slf4j / logback / java.util.logging) — CWE-117
+  //
+  // Classification decision — cognium-dev #264: Logger receivers stay
+  // as log_injection (CWE-117), NOT format_string (CWE-134). The real
+  // vulnerability with tainted data flowing into Logger.log(fmt, ...)
+  // is log-forgery via CRLF injection, not format-string exploitation.
+  // A genuine format_string vulnerability requires the FORMAT STRING
+  // itself to be attacker-controlled, which is virtually never the
+  // case in Logger APIs (the format string is a literal at the call
+  // site). Adding format_string sinks for these same receivers would
+  // duplicate the existing log_injection findings on every call site
+  // without adding real signal. The rare edge case where a caller
+  // passes `taintedFmt` at arg[0] is still caught by these entries
+  // (via arg_positions[0] on the SLF4J-family methods), classified as
+  // log_injection.
   // Issue #44: log.info/warn/error/debug emit the message argument and any
   // {} format arguments to the log stream. Untrusted input forwarded into
   // these calls allows log forging (newline injection) and downstream log
@@ -12874,6 +12888,16 @@ var DEFAULT_SINKS = [
   { method: "format", class: "String", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "format", class: "Formatter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "printf", class: "System.out", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  // cognium-dev #264 — extend the Java format-string surface.
+  // MessageFormat.format(pattern, args) — same receiver-family as String.format
+  // but on the java.text side. PrintStream/PrintWriter.{printf,format} —
+  // arbitrary streams (not just System.out) also honour format-string
+  // specifiers, so a tainted first arg is a genuine CWE-134 sink.
+  { method: "format", class: "MessageFormat", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "printf", class: "PrintStream", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "format", class: "PrintStream", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "printf", class: "PrintWriter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "format", class: "PrintWriter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   // NOTE: Python `userFmt.format(...)` and `userFmt % args` require
   // receiver-taint or operator-LHS-taint tracking — the format string is the
   // receiver, not an argument. Deferred to Sprint 6 (#86 follow-up).
@@ -12885,6 +12909,12 @@ var DEFAULT_SINKS = [
   { method: "Printf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Errorf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Fprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [1], languages: ["go"] },
+  // cognium-dev #264 — Go stdlib `log` package format-string entry points.
+  // log.Printf / Fatalf / Panicf take the format string at arg[0]; tainted
+  // format string reaches the same fmt.Sprintf machinery internally.
+  { method: "Printf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  { method: "Fatalf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  { method: "Panicf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   // CRLF / HTTP response splitting (CWE-113) — Sprint 6, #86.
   // Node.js / Express response header / cookie sinks. The header *name* (arg 0)
   // is also CRLF-sensitive but is almost always a string literal; we model
@@ -15072,6 +15102,11 @@ function calculateSinkConfidence(call, pattern) {
   if (pattern.class && call.receiver) {
     if (receiverMightBeClass(call.receiver, pattern.class)) {
       confidence += 0.1;
+      const receiverLc = call.receiver.toLowerCase();
+      const classLc = pattern.class.toLowerCase();
+      if (call.receiver === pattern.class || receiverLc === classLc) {
+        confidence += 0.05;
+      }
     }
   }
   if (pattern.severity === "critical") {
@@ -32863,6 +32898,136 @@ function resolveFastjsonFromPom(pomXml) {
   }
   return null;
 }
+function resolveFastjsonFromGradle(buildGradle) {
+  if (!buildGradle) return null;
+  const directRe = /['"(]\s*com\.alibaba:fastjson:([^'"$\s)]+)\s*['")]/;
+  const direct = buildGradle.match(directRe);
+  if (direct) {
+    const version2 = direct[1];
+    return { version: version2, noneAutotype: /_noneautotype/i.test(version2) };
+  }
+  const constraintsBlockRe = /['"(]\s*com\.alibaba:fastjson\s*['")]\s*\)?\s*\{[\s\S]*?\bversion\s*\{[\s\S]*?\b(?:strictly|require|prefer)\s+['"]([^'"\s]+)['"]/;
+  const constraintsBlock = buildGradle.match(constraintsBlockRe);
+  if (constraintsBlock) {
+    const version2 = constraintsBlock[1];
+    return { version: version2, noneAutotype: /_noneautotype/i.test(version2) };
+  }
+  const propRefRe = /['"(]\s*com\.alibaba:fastjson:\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?\s*['")]/;
+  const propRef = buildGradle.match(propRefRe);
+  if (!propRef) return null;
+  const propName = propRef[1];
+  const defRe = new RegExp(
+    `\\b${propName}\\s*[=:]\\s*['"]([^'"\\s]+)['"]`
+  );
+  const def = buildGradle.match(defRe);
+  if (!def) return null;
+  const version = def[1];
+  return { version, noneAutotype: /_noneautotype/i.test(version) };
+}
+function resolveFastjsonFromGradleCatalog(buildGradle, libsVersionsToml) {
+  if (!buildGradle || !libsVersionsToml) return null;
+  const librariesMatch = libsVersionsToml.match(
+    /\[libraries\]([\s\S]*?)(?=\n\[|$)/
+  );
+  if (!librariesMatch) return null;
+  const librariesBlock = librariesMatch[1];
+  const moduleForm = librariesBlock.match(
+    /^\s*([\w.-]+)\s*=\s*\{[^}]*\bmodule\s*=\s*"com\.alibaba:fastjson"[^}]*\}/m
+  );
+  const groupNameForm = librariesBlock.match(
+    /^\s*([\w.-]+)\s*=\s*\{[^}]*\bgroup\s*=\s*"com\.alibaba"[^}]*\bname\s*=\s*"fastjson"[^}]*\}/m
+  );
+  const entry = moduleForm ?? groupNameForm;
+  if (!entry) return null;
+  const alias = entry[1];
+  const entryBody = entry[0];
+  const aliasEsc = alias.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const aliasRefRe = new RegExp(`\\blibs\\s*\\.\\s*${aliasEsc}\\b`);
+  if (!aliasRefRe.test(buildGradle)) return null;
+  const inlineVersionM = entryBody.match(
+    /\bversion\s*=\s*"([^"$][^"]*)"/
+  );
+  if (inlineVersionM) {
+    const version2 = inlineVersionM[1];
+    return { version: version2, noneAutotype: /_noneautotype/i.test(version2) };
+  }
+  const versionRefM = entryBody.match(/\bversion\.ref\s*=\s*"([^"]+)"/);
+  if (!versionRefM) return null;
+  const versionAlias = versionRefM[1];
+  const versionsMatch = libsVersionsToml.match(
+    /\[versions\]([\s\S]*?)(?=\n\[|$)/
+  );
+  if (!versionsMatch) return null;
+  const versionsBlock = versionsMatch[1];
+  const versionAliasEsc = versionAlias.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const versionLineRe = new RegExp(
+    `^\\s*${versionAliasEsc}\\s*=\\s*"([^"]+)"`,
+    "m"
+  );
+  const versionLine = versionsBlock.match(versionLineRe);
+  if (!versionLine) return null;
+  const version = versionLine[1];
+  return { version, noneAutotype: /_noneautotype/i.test(version) };
+}
+function resolvePyYamlFromRequirements(requirementsTxt) {
+  if (!requirementsTxt) return null;
+  for (const rawLine of requirementsTxt.split(/\r?\n/)) {
+    const line = rawLine.replace(/#.*$/, "").trim();
+    if (!line) continue;
+    if (line.startsWith("-")) continue;
+    const m = line.match(
+      /^(pyyaml)\s*(==|>=|~=|>|===)\s*(\d+(?:\.\d+)*)/i
+    );
+    if (!m) continue;
+    const version = m[3];
+    return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+  }
+  return null;
+}
+function resolvePyYamlFromPyproject(pyprojectToml) {
+  if (!pyprojectToml) return null;
+  const poetryLine = pyprojectToml.match(
+    /^\s*(pyyaml)\s*=\s*"([\^~=<>]*)(\d+(?:\.\d+)*)"/im
+  );
+  if (poetryLine) {
+    const version = poetryLine[3];
+    return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+  }
+  const poetryTable = pyprojectToml.match(
+    /^\s*(pyyaml)\s*=\s*\{[^}]*\bversion\s*=\s*"([\^~=<>]*)(\d+(?:\.\d+)*)"/im
+  );
+  if (poetryTable) {
+    const version = poetryTable[3];
+    return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+  }
+  const pep621 = pyprojectToml.match(
+    /"(pyyaml)\s*(==|>=|~=|>|===)\s*(\d+(?:\.\d+)*)/i
+  );
+  if (pep621) {
+    const version = pep621[3];
+    return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+  }
+  return null;
+}
+function isPyYamlVersionSafeByDefault(version) {
+  const parts2 = version.split(".").map((s) => Number.parseInt(s, 10));
+  if (parts2.length === 0 || !Number.isFinite(parts2[0])) return false;
+  return parts2[0] >= 6;
+}
+function fileHasUnsafePyYamlLoader(sourceLines, sinkLine) {
+  const start2 = Math.max(0, sinkLine - 1);
+  const end = Math.min(sourceLines.length, start2 + 10);
+  const unsafeRe = /\bLoader\s*=\s*(?:yaml\s*\.\s*)?(?:Loader|UnsafeLoader|FullLoader)\b/;
+  for (let i2 = start2; i2 < end; i2++) {
+    const ln = sourceLines[i2] ?? "";
+    if (unsafeRe.test(ln)) return true;
+    const stripped = ln.trim();
+    if (i2 > start2 && (stripped === ")" || stripped.endsWith(")"))) {
+      return false;
+    }
+  }
+  return false;
+}
 function fileReenablesFastjsonAutotype(source) {
   if (!source) return false;
   return /\bsetAutoTypeSupport\s*\(\s*true\b/.test(source);
@@ -32888,6 +33053,8 @@ var JACKSON_METHODS = /* @__PURE__ */ new Set(["readValue", "convertValue", "tre
 var JACKSON_CLASSES = /* @__PURE__ */ new Set(["ObjectMapper", "ObjectReader"]);
 var SNAKEYAML_METHODS = /* @__PURE__ */ new Set(["load", "loadAs", "loadAll"]);
 var SNAKEYAML_CLASSES = /* @__PURE__ */ new Set(["Yaml"]);
+var PYYAML_METHODS = /* @__PURE__ */ new Set(["load"]);
+var PYYAML_CLASSES = /* @__PURE__ */ new Set(["yaml"]);
 var DeserializationSafetyGatePass = class {
   constructor(dependencyContext) {
     this.dependencyContext = dependencyContext;
@@ -32897,18 +33064,30 @@ var DeserializationSafetyGatePass = class {
   category = "security";
   run(ctx) {
     const { graph, language, code } = ctx;
-    if (language !== "java") {
-      return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0 };
+    if (language !== "java" && language !== "python") {
+      return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0, droppedPyYaml: 0 };
     }
     const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
     const pomXml = this.dependencyContext?.java?.pomXml;
-    const fastjson = pomXml ? resolveFastjsonFromPom(pomXml) : null;
+    const buildGradle = this.dependencyContext?.java?.buildGradle;
+    const libsVersionsToml = this.dependencyContext?.java?.libsVersionsToml;
+    const fastjson = (pomXml ? resolveFastjsonFromPom(pomXml) : null) ?? (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null) ?? (buildGradle && libsVersionsToml ? resolveFastjsonFromGradleCatalog(buildGradle, libsVersionsToml) : null);
     const fastjsonHardened = fastjson?.noneAutotype === true && !fileReenablesFastjsonAutotype(code);
     const jacksonSafe = !fileEnablesJacksonPolymorphism(code);
     const snakeYamlSafe = fileConfiguresSnakeYamlSafely(code);
+    const requirementsTxt = this.dependencyContext?.python?.requirementsTxt;
+    const pyprojectToml = this.dependencyContext?.python?.pyprojectToml;
+    const pyYaml = (requirementsTxt ? resolvePyYamlFromRequirements(requirementsTxt) : null) ?? (pyprojectToml ? resolvePyYamlFromPyproject(pyprojectToml) : null);
+    const pyYamlSafeByDefault = pyYaml?.safeByDefault === true;
+    let sourceLines = null;
+    const getSourceLines = () => {
+      if (sourceLines === null) sourceLines = code.split("\n");
+      return sourceLines;
+    };
     let droppedFastjson = 0;
     let droppedJackson = 0;
     let droppedSnakeYaml = 0;
+    let droppedPyYaml = 0;
     const kept = sinks.filter((sink) => {
       if (sink.type !== "deserialization") return true;
       if (!sink.method) return true;
@@ -32924,14 +33103,18 @@ var DeserializationSafetyGatePass = class {
         droppedSnakeYaml++;
         return false;
       }
+      if (language === "python" && pyYamlSafeByDefault && PYYAML_METHODS.has(sink.method) && (sink.class === void 0 || PYYAML_CLASSES.has(sink.class)) && !fileHasUnsafePyYamlLoader(getSourceLines(), sink.line)) {
+        droppedPyYaml++;
+        return false;
+      }
       return true;
     });
-    const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml;
+    const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml + droppedPyYaml;
     if (totalDropped > 0) {
       sinks.length = 0;
       sinks.push(...kept);
     }
-    return { droppedFastjson, droppedJackson, droppedSnakeYaml };
+    return { droppedFastjson, droppedJackson, droppedSnakeYaml, droppedPyYaml };
   }
 };
 
@@ -38705,6 +38888,45 @@ var ScanSecretsPass = class {
   }
 };
 
+// src/analysis/passes/python-receiver-taint-format-pass.ts
+var PythonReceiverTaintFormatPass = class {
+  name = "python-receiver-taint-format";
+  category = "security";
+  run(ctx) {
+    if (ctx.language !== "python") {
+      return { findingsEmitted: 0 };
+    }
+    const { calls, meta } = ctx.graph.ir;
+    const constProp = ctx.getResult(
+      "constant-propagation"
+    );
+    const tainted = constProp.tainted;
+    let count = 0;
+    for (const call of calls) {
+      if (call.method_name !== "format") continue;
+      const receiver = call.receiver;
+      if (!receiver) continue;
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(receiver)) continue;
+      const scopedName = call.in_method ? `${call.in_method}:${receiver}` : receiver;
+      if (!tainted.has(receiver) && !tainted.has(scopedName)) continue;
+      ctx.addFinding({
+        id: `format_string-${meta.file}-${call.location.line}-${receiver}`,
+        pass: this.name,
+        category: "security",
+        rule_id: "format_string",
+        cwe: "CWE-134",
+        severity: "medium",
+        level: "warning",
+        message: `Format-string vulnerability: the format template \`${receiver}\` is tainted (traces back to a taint source). Attacker can leak object attributes via \`{obj.__class__.__mro__[\u2026]}\` chains or crash the process via unbounded specifiers. Use a literal format string and pass user input as an argument instead.`,
+        file: meta.file,
+        line: call.location.line
+      });
+      count++;
+    }
+    return { findingsEmitted: count };
+  }
+};
+
 // src/analysis/passes/spring4shell-pass.ts
 var CONTROLLER_ANNOTATIONS = /* @__PURE__ */ new Set([
   "Controller",
@@ -43045,6 +43267,8 @@ async function analyze(code, filePath, language, options = {}) {
     if (!disabledPasses.has("library-profile-cwe22-path-gate"))
       pipeline.add(new LibraryProfileCwe22PathGatePass());
     if (!disabledPasses.has("scan-secrets")) pipeline.add(new ScanSecretsPass());
+    if (!disabledPasses.has("python-receiver-taint-format"))
+      pipeline.add(new PythonReceiverTaintFormatPass());
     if (!disabledPasses.has("dead-code")) pipeline.add(new DeadCodePass());
     if (!disabledPasses.has("missing-await")) pipeline.add(new MissingAwaitPass());
     if (!disabledPasses.has("n-plus-one")) pipeline.add(new NPlusOnePass());

package/dist/core/circle-ir-core.cjs

@@ -11672,6 +11672,20 @@ var DEFAULT_SINKS = [
   // Sandbox/script security
   { method: "onNewInstance", class: "SandboxInterceptor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // Java Log Injection (slf4j / logback / java.util.logging) — CWE-117
+  //
+  // Classification decision — cognium-dev #264: Logger receivers stay
+  // as log_injection (CWE-117), NOT format_string (CWE-134). The real
+  // vulnerability with tainted data flowing into Logger.log(fmt, ...)
+  // is log-forgery via CRLF injection, not format-string exploitation.
+  // A genuine format_string vulnerability requires the FORMAT STRING
+  // itself to be attacker-controlled, which is virtually never the
+  // case in Logger APIs (the format string is a literal at the call
+  // site). Adding format_string sinks for these same receivers would
+  // duplicate the existing log_injection findings on every call site
+  // without adding real signal. The rare edge case where a caller
+  // passes `taintedFmt` at arg[0] is still caught by these entries
+  // (via arg_positions[0] on the SLF4J-family methods), classified as
+  // log_injection.
   // Issue #44: log.info/warn/error/debug emit the message argument and any
   // {} format arguments to the log stream. Untrusted input forwarded into
   // these calls allows log forging (newline injection) and downstream log
@@ -12269,6 +12283,16 @@ var DEFAULT_SINKS = [
   { method: "format", class: "String", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "format", class: "Formatter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "printf", class: "System.out", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  // cognium-dev #264 — extend the Java format-string surface.
+  // MessageFormat.format(pattern, args) — same receiver-family as String.format
+  // but on the java.text side. PrintStream/PrintWriter.{printf,format} —
+  // arbitrary streams (not just System.out) also honour format-string
+  // specifiers, so a tainted first arg is a genuine CWE-134 sink.
+  { method: "format", class: "MessageFormat", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "printf", class: "PrintStream", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "format", class: "PrintStream", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "printf", class: "PrintWriter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "format", class: "PrintWriter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   // NOTE: Python `userFmt.format(...)` and `userFmt % args` require
   // receiver-taint or operator-LHS-taint tracking — the format string is the
   // receiver, not an argument. Deferred to Sprint 6 (#86 follow-up).
@@ -12280,6 +12304,12 @@ var DEFAULT_SINKS = [
   { method: "Printf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Errorf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Fprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [1], languages: ["go"] },
+  // cognium-dev #264 — Go stdlib `log` package format-string entry points.
+  // log.Printf / Fatalf / Panicf take the format string at arg[0]; tainted
+  // format string reaches the same fmt.Sprintf machinery internally.
+  { method: "Printf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  { method: "Fatalf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  { method: "Panicf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   // CRLF / HTTP response splitting (CWE-113) — Sprint 6, #86.
   // Node.js / Express response header / cookie sinks. The header *name* (arg 0)
   // is also CRLF-sensitive but is almost always a string literal; we model
@@ -14372,6 +14402,11 @@ function calculateSinkConfidence(call, pattern) {
   if (pattern.class && call.receiver) {
     if (receiverMightBeClass(call.receiver, pattern.class)) {
       confidence += 0.1;
+      const receiverLc = call.receiver.toLowerCase();
+      const classLc = pattern.class.toLowerCase();
+      if (call.receiver === pattern.class || receiverLc === classLc) {
+        confidence += 0.05;
+      }
     }
   }
   if (pattern.severity === "critical") {

package/dist/core/circle-ir-core.js

@@ -11606,6 +11606,20 @@ var DEFAULT_SINKS = [
   // Sandbox/script security
   { method: "onNewInstance", class: "SandboxInterceptor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // Java Log Injection (slf4j / logback / java.util.logging) — CWE-117
+  //
+  // Classification decision — cognium-dev #264: Logger receivers stay
+  // as log_injection (CWE-117), NOT format_string (CWE-134). The real
+  // vulnerability with tainted data flowing into Logger.log(fmt, ...)
+  // is log-forgery via CRLF injection, not format-string exploitation.
+  // A genuine format_string vulnerability requires the FORMAT STRING
+  // itself to be attacker-controlled, which is virtually never the
+  // case in Logger APIs (the format string is a literal at the call
+  // site). Adding format_string sinks for these same receivers would
+  // duplicate the existing log_injection findings on every call site
+  // without adding real signal. The rare edge case where a caller
+  // passes `taintedFmt` at arg[0] is still caught by these entries
+  // (via arg_positions[0] on the SLF4J-family methods), classified as
+  // log_injection.
   // Issue #44: log.info/warn/error/debug emit the message argument and any
   // {} format arguments to the log stream. Untrusted input forwarded into
   // these calls allows log forging (newline injection) and downstream log
@@ -12203,6 +12217,16 @@ var DEFAULT_SINKS = [
   { method: "format", class: "String", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "format", class: "Formatter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "printf", class: "System.out", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  // cognium-dev #264 — extend the Java format-string surface.
+  // MessageFormat.format(pattern, args) — same receiver-family as String.format
+  // but on the java.text side. PrintStream/PrintWriter.{printf,format} —
+  // arbitrary streams (not just System.out) also honour format-string
+  // specifiers, so a tainted first arg is a genuine CWE-134 sink.
+  { method: "format", class: "MessageFormat", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "printf", class: "PrintStream", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "format", class: "PrintStream", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "printf", class: "PrintWriter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "format", class: "PrintWriter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   // NOTE: Python `userFmt.format(...)` and `userFmt % args` require
   // receiver-taint or operator-LHS-taint tracking — the format string is the
   // receiver, not an argument. Deferred to Sprint 6 (#86 follow-up).
@@ -12214,6 +12238,12 @@ var DEFAULT_SINKS = [
   { method: "Printf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Errorf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Fprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [1], languages: ["go"] },
+  // cognium-dev #264 — Go stdlib `log` package format-string entry points.
+  // log.Printf / Fatalf / Panicf take the format string at arg[0]; tainted
+  // format string reaches the same fmt.Sprintf machinery internally.
+  { method: "Printf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  { method: "Fatalf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  { method: "Panicf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   // CRLF / HTTP response splitting (CWE-113) — Sprint 6, #86.
   // Node.js / Express response header / cookie sinks. The header *name* (arg 0)
   // is also CRLF-sensitive but is almost always a string literal; we model
@@ -14306,6 +14336,11 @@ function calculateSinkConfidence(call, pattern) {
   if (pattern.class && call.receiver) {
     if (receiverMightBeClass(call.receiver, pattern.class)) {
       confidence += 0.1;
+      const receiverLc = call.receiver.toLowerCase();
+      const classLc = pattern.class.toLowerCase();
+      if (call.receiver === pattern.class || receiverLc === classLc) {
+        confidence += 0.05;
+      }
     }
   }
   if (pattern.severity === "critical") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.178.0",
+  "version": "3.180.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",