circle-ir 3.179.0 → 3.181.0

package/dist/browser/circle-ir.js

@@ -11282,6 +11282,35 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  // --- Serverless transport channels (cognium-dev #213 first slice) ---
+  //
+  // AWS Lambda / API Gateway invocation-event properties. The Lambda
+  // handler signature `(event, context) => …` (JS/TS) or
+  // `def handler(event, context)` (Python) receives an `event` object
+  // whose properties carry the untrusted HTTP-request-shaped payload:
+  //
+  //   event.body                              — request body (string)
+  //   event.queryStringParameters             — `?a=b` params
+  //   event.multiValueQueryStringParameters   — `?a=1&a=2` params
+  //   event.pathParameters                    — path template captures
+  //   event.headers                           — request headers
+  //   event.multiValueHeaders                 — repeated headers
+  //   event.requestContext                    — API Gateway request context
+  //
+  // Vercel Serverless Functions and Cloudflare Workers both use `req`
+  // / `request` receivers that are already covered by the Express-
+  // style patterns above (line ~398). This block specifically covers
+  // the `event`-shaped API Gateway convention that those don't reach.
+  { property: "body", object: "event", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "multiValueQueryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "pathParameters", object: "event", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "headers", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "multiValueHeaders", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "body", object: "event", type: "http_body", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "queryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "pathParameters", object: "event", type: "http_path", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "headers", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["python"] },
   // --- JWT claims (unverified decode — PyJWT / jose / jsonwebtoken / auth0 java-jwt / golang-jwt) ---
   // A JWT's payload is *always* attacker-authored. Even after verification
   // the *contents* of the claims (username, role, custom fields) are not
@@ -12277,6 +12306,20 @@ var DEFAULT_SINKS = [
   // Sandbox/script security
   { method: "onNewInstance", class: "SandboxInterceptor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // Java Log Injection (slf4j / logback / java.util.logging) — CWE-117
+  //
+  // Classification decision — cognium-dev #264: Logger receivers stay
+  // as log_injection (CWE-117), NOT format_string (CWE-134). The real
+  // vulnerability with tainted data flowing into Logger.log(fmt, ...)
+  // is log-forgery via CRLF injection, not format-string exploitation.
+  // A genuine format_string vulnerability requires the FORMAT STRING
+  // itself to be attacker-controlled, which is virtually never the
+  // case in Logger APIs (the format string is a literal at the call
+  // site). Adding format_string sinks for these same receivers would
+  // duplicate the existing log_injection findings on every call site
+  // without adding real signal. The rare edge case where a caller
+  // passes `taintedFmt` at arg[0] is still caught by these entries
+  // (via arg_positions[0] on the SLF4J-family methods), classified as
+  // log_injection.
   // Issue #44: log.info/warn/error/debug emit the message argument and any
   // {} format arguments to the log stream. Untrusted input forwarded into
   // these calls allows log forging (newline injection) and downstream log
@@ -25490,7 +25533,19 @@ var JS_TAINTED_PATTERNS = [
   { pattern: /\bdocument\.title\b/, type: "dom_input" },
   { pattern: /\bhistory\.state\b/, type: "dom_input" },
   { pattern: /\blocalStorage\.getItem\b/, type: "dom_input" },
-  { pattern: /\bsessionStorage\.getItem\b/, type: "dom_input" }
+  { pattern: /\bsessionStorage\.getItem\b/, type: "dom_input" },
+  // AWS Lambda / API Gateway event-shape sources (cognium-dev #213
+  // transport-channel first slice). The `event` parameter of a
+  // Lambda handler carries the untrusted HTTP payload; forward-taint
+  // tracking through `const q = event.body; sink(q)` needs the
+  // regex here in addition to the property patterns in
+  // config-loader.ts:DEFAULT_SOURCES.
+  { pattern: /\bevent\.body\b/, type: "http_body" },
+  { pattern: /\bevent\.queryStringParameters\b/, type: "http_param" },
+  { pattern: /\bevent\.multiValueQueryStringParameters\b/, type: "http_param" },
+  { pattern: /\bevent\.pathParameters\b/, type: "http_path" },
+  { pattern: /\bevent\.headers\b/, type: "http_header" },
+  { pattern: /\bevent\.multiValueHeaders\b/, type: "http_header" }
 ];
 var PYTHON_TAINTED_PATTERNS2 = [
   { pattern: /\brequest\.args\b/, type: "http_param" },
@@ -30008,7 +30063,7 @@ function findPythonTaintedFormatStringFindings(code, file) {
   }
   if (taintedVars.size === 0) return findings;
   const percentRe = /\b(\w+)\s*%\s*[\(\[\{"'\w]/;
-  const dotFormatRe = /\b(\w+)\s*\.\s*format\s*\(/;
+  const dotFormatRe = /\b(\w+)\s*\.\s*(?:format|format_map)\s*\(/;
   const seen = /* @__PURE__ */ new Set();
   for (let i2 = 0; i2 < lines.length; i2++) {
     const line = lines[i2];
@@ -32892,6 +32947,12 @@ function resolveFastjsonFromGradle(buildGradle) {
     const version2 = direct[1];
     return { version: version2, noneAutotype: /_noneautotype/i.test(version2) };
   }
+  const constraintsBlockRe = /['"(]\s*com\.alibaba:fastjson\s*['")]\s*\)?\s*\{[\s\S]*?\bversion\s*\{[\s\S]*?\b(?:strictly|require|prefer)\s+['"]([^'"\s]+)['"]/;
+  const constraintsBlock = buildGradle.match(constraintsBlockRe);
+  if (constraintsBlock) {
+    const version2 = constraintsBlock[1];
+    return { version: version2, noneAutotype: /_noneautotype/i.test(version2) };
+  }
   const propRefRe = /['"(]\s*com\.alibaba:fastjson:\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?\s*['")]/;
   const propRef = buildGradle.match(propRefRe);
   if (!propRef) return null;
@@ -32904,6 +32965,51 @@ function resolveFastjsonFromGradle(buildGradle) {
   const version = def[1];
   return { version, noneAutotype: /_noneautotype/i.test(version) };
 }
+function resolveFastjsonFromGradleCatalog(buildGradle, libsVersionsToml) {
+  if (!buildGradle || !libsVersionsToml) return null;
+  const librariesMatch = libsVersionsToml.match(
+    /\[libraries\]([\s\S]*?)(?=\n\[|$)/
+  );
+  if (!librariesMatch) return null;
+  const librariesBlock = librariesMatch[1];
+  const moduleForm = librariesBlock.match(
+    /^\s*([\w.-]+)\s*=\s*\{[^}]*\bmodule\s*=\s*"com\.alibaba:fastjson"[^}]*\}/m
+  );
+  const groupNameForm = librariesBlock.match(
+    /^\s*([\w.-]+)\s*=\s*\{[^}]*\bgroup\s*=\s*"com\.alibaba"[^}]*\bname\s*=\s*"fastjson"[^}]*\}/m
+  );
+  const entry = moduleForm ?? groupNameForm;
+  if (!entry) return null;
+  const alias = entry[1];
+  const entryBody = entry[0];
+  const aliasEsc = alias.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const aliasRefRe = new RegExp(`\\blibs\\s*\\.\\s*${aliasEsc}\\b`);
+  if (!aliasRefRe.test(buildGradle)) return null;
+  const inlineVersionM = entryBody.match(
+    /\bversion\s*=\s*"([^"$][^"]*)"/
+  );
+  if (inlineVersionM) {
+    const version2 = inlineVersionM[1];
+    return { version: version2, noneAutotype: /_noneautotype/i.test(version2) };
+  }
+  const versionRefM = entryBody.match(/\bversion\.ref\s*=\s*"([^"]+)"/);
+  if (!versionRefM) return null;
+  const versionAlias = versionRefM[1];
+  const versionsMatch = libsVersionsToml.match(
+    /\[versions\]([\s\S]*?)(?=\n\[|$)/
+  );
+  if (!versionsMatch) return null;
+  const versionsBlock = versionsMatch[1];
+  const versionAliasEsc = versionAlias.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const versionLineRe = new RegExp(
+    `^\\s*${versionAliasEsc}\\s*=\\s*"([^"]+)"`,
+    "m"
+  );
+  const versionLine = versionsBlock.match(versionLineRe);
+  if (!versionLine) return null;
+  const version = versionLine[1];
+  return { version, noneAutotype: /_noneautotype/i.test(version) };
+}
 function resolvePyYamlFromRequirements(requirementsTxt) {
   if (!requirementsTxt) return null;
   for (const rawLine of requirementsTxt.split(/\r?\n/)) {
@@ -33005,7 +33111,8 @@ var DeserializationSafetyGatePass = class {
     const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
     const pomXml = this.dependencyContext?.java?.pomXml;
     const buildGradle = this.dependencyContext?.java?.buildGradle;
-    const fastjson = (pomXml ? resolveFastjsonFromPom(pomXml) : null) ?? (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null);
+    const libsVersionsToml = this.dependencyContext?.java?.libsVersionsToml;
+    const fastjson = (pomXml ? resolveFastjsonFromPom(pomXml) : null) ?? (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null) ?? (buildGradle && libsVersionsToml ? resolveFastjsonFromGradleCatalog(buildGradle, libsVersionsToml) : null);
     const fastjsonHardened = fastjson?.noneAutotype === true && !fileReenablesFastjsonAutotype(code);
     const jacksonSafe = !fileEnablesJacksonPolymorphism(code);
     const snakeYamlSafe = fileConfiguresSnakeYamlSafely(code);
@@ -38822,6 +38929,53 @@ var ScanSecretsPass = class {
   }
 };
 
+// src/analysis/passes/python-receiver-taint-format-pass.ts
+var PythonReceiverTaintFormatPass = class {
+  name = "python-receiver-taint-format";
+  category = "security";
+  run(ctx) {
+    if (ctx.language !== "python") {
+      return { findingsEmitted: 0 };
+    }
+    const { calls, meta, taint } = ctx.graph.ir;
+    const taintedVarNames = /* @__PURE__ */ new Set();
+    for (const s of taint.sources) {
+      if (typeof s.variable === "string" && s.variable.length > 0) {
+        taintedVarNames.add(s.variable);
+      }
+    }
+    if (taintedVarNames.size === 0) {
+      return { findingsEmitted: 0 };
+    }
+    const seen = /* @__PURE__ */ new Set();
+    let count = 0;
+    for (const call of calls) {
+      if (call.method_name !== "format" && call.method_name !== "format_map") continue;
+      const receiver = call.receiver;
+      if (!receiver) continue;
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(receiver)) continue;
+      if (!taintedVarNames.has(receiver)) continue;
+      const seenKey = `${call.location.line}:${receiver}`;
+      if (seen.has(seenKey)) continue;
+      seen.add(seenKey);
+      ctx.addFinding({
+        id: `format_string-${meta.file}-${call.location.line}-${receiver}-${call.method_name}`,
+        pass: this.name,
+        category: "security",
+        rule_id: "format_string",
+        cwe: "CWE-134",
+        severity: "medium",
+        level: "warning",
+        message: `Format-string vulnerability: the format template \`${receiver}\` is tainted (traces back to a taint source) and used as the receiver of \`${call.method_name}(...)\`. Attacker can leak object attributes via \`{obj.__class__.__mro__[\u2026]}\` chains or crash the process via unbounded specifiers. Use a literal format string and pass user input as an argument instead.`,
+        file: meta.file,
+        line: call.location.line
+      });
+      count++;
+    }
+    return { findingsEmitted: count };
+  }
+};
+
 // src/analysis/passes/spring4shell-pass.ts
 var CONTROLLER_ANNOTATIONS = /* @__PURE__ */ new Set([
   "Controller",
@@ -43162,6 +43316,8 @@ async function analyze(code, filePath, language, options = {}) {
     if (!disabledPasses.has("library-profile-cwe22-path-gate"))
       pipeline.add(new LibraryProfileCwe22PathGatePass());
     if (!disabledPasses.has("scan-secrets")) pipeline.add(new ScanSecretsPass());
+    if (!disabledPasses.has("python-receiver-taint-format"))
+      pipeline.add(new PythonReceiverTaintFormatPass());
     if (!disabledPasses.has("dead-code")) pipeline.add(new DeadCodePass());
     if (!disabledPasses.has("missing-await")) pipeline.add(new MissingAwaitPass());
     if (!disabledPasses.has("n-plus-one")) pipeline.add(new NPlusOnePass());

package/dist/core/circle-ir-core.cjs

@@ -10677,6 +10677,35 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  // --- Serverless transport channels (cognium-dev #213 first slice) ---
+  //
+  // AWS Lambda / API Gateway invocation-event properties. The Lambda
+  // handler signature `(event, context) => …` (JS/TS) or
+  // `def handler(event, context)` (Python) receives an `event` object
+  // whose properties carry the untrusted HTTP-request-shaped payload:
+  //
+  //   event.body                              — request body (string)
+  //   event.queryStringParameters             — `?a=b` params
+  //   event.multiValueQueryStringParameters   — `?a=1&a=2` params
+  //   event.pathParameters                    — path template captures
+  //   event.headers                           — request headers
+  //   event.multiValueHeaders                 — repeated headers
+  //   event.requestContext                    — API Gateway request context
+  //
+  // Vercel Serverless Functions and Cloudflare Workers both use `req`
+  // / `request` receivers that are already covered by the Express-
+  // style patterns above (line ~398). This block specifically covers
+  // the `event`-shaped API Gateway convention that those don't reach.
+  { property: "body", object: "event", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "multiValueQueryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "pathParameters", object: "event", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "headers", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "multiValueHeaders", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "body", object: "event", type: "http_body", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "queryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "pathParameters", object: "event", type: "http_path", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "headers", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["python"] },
   // --- JWT claims (unverified decode — PyJWT / jose / jsonwebtoken / auth0 java-jwt / golang-jwt) ---
   // A JWT's payload is *always* attacker-authored. Even after verification
   // the *contents* of the claims (username, role, custom fields) are not
@@ -11672,6 +11701,20 @@ var DEFAULT_SINKS = [
   // Sandbox/script security
   { method: "onNewInstance", class: "SandboxInterceptor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // Java Log Injection (slf4j / logback / java.util.logging) — CWE-117
+  //
+  // Classification decision — cognium-dev #264: Logger receivers stay
+  // as log_injection (CWE-117), NOT format_string (CWE-134). The real
+  // vulnerability with tainted data flowing into Logger.log(fmt, ...)
+  // is log-forgery via CRLF injection, not format-string exploitation.
+  // A genuine format_string vulnerability requires the FORMAT STRING
+  // itself to be attacker-controlled, which is virtually never the
+  // case in Logger APIs (the format string is a literal at the call
+  // site). Adding format_string sinks for these same receivers would
+  // duplicate the existing log_injection findings on every call site
+  // without adding real signal. The rare edge case where a caller
+  // passes `taintedFmt` at arg[0] is still caught by these entries
+  // (via arg_positions[0] on the SLF4J-family methods), classified as
+  // log_injection.
   // Issue #44: log.info/warn/error/debug emit the message argument and any
   // {} format arguments to the log stream. Untrusted input forwarded into
   // these calls allows log forging (newline injection) and downstream log

package/dist/core/circle-ir-core.js

@@ -10611,6 +10611,35 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  // --- Serverless transport channels (cognium-dev #213 first slice) ---
+  //
+  // AWS Lambda / API Gateway invocation-event properties. The Lambda
+  // handler signature `(event, context) => …` (JS/TS) or
+  // `def handler(event, context)` (Python) receives an `event` object
+  // whose properties carry the untrusted HTTP-request-shaped payload:
+  //
+  //   event.body                              — request body (string)
+  //   event.queryStringParameters             — `?a=b` params
+  //   event.multiValueQueryStringParameters   — `?a=1&a=2` params
+  //   event.pathParameters                    — path template captures
+  //   event.headers                           — request headers
+  //   event.multiValueHeaders                 — repeated headers
+  //   event.requestContext                    — API Gateway request context
+  //
+  // Vercel Serverless Functions and Cloudflare Workers both use `req`
+  // / `request` receivers that are already covered by the Express-
+  // style patterns above (line ~398). This block specifically covers
+  // the `event`-shaped API Gateway convention that those don't reach.
+  { property: "body", object: "event", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "multiValueQueryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "pathParameters", object: "event", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "headers", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "multiValueHeaders", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "body", object: "event", type: "http_body", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "queryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "pathParameters", object: "event", type: "http_path", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "headers", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["python"] },
   // --- JWT claims (unverified decode — PyJWT / jose / jsonwebtoken / auth0 java-jwt / golang-jwt) ---
   // A JWT's payload is *always* attacker-authored. Even after verification
   // the *contents* of the claims (username, role, custom fields) are not
@@ -11606,6 +11635,20 @@ var DEFAULT_SINKS = [
   // Sandbox/script security
   { method: "onNewInstance", class: "SandboxInterceptor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // Java Log Injection (slf4j / logback / java.util.logging) — CWE-117
+  //
+  // Classification decision — cognium-dev #264: Logger receivers stay
+  // as log_injection (CWE-117), NOT format_string (CWE-134). The real
+  // vulnerability with tainted data flowing into Logger.log(fmt, ...)
+  // is log-forgery via CRLF injection, not format-string exploitation.
+  // A genuine format_string vulnerability requires the FORMAT STRING
+  // itself to be attacker-controlled, which is virtually never the
+  // case in Logger APIs (the format string is a literal at the call
+  // site). Adding format_string sinks for these same receivers would
+  // duplicate the existing log_injection findings on every call site
+  // without adding real signal. The rare edge case where a caller
+  // passes `taintedFmt` at arg[0] is still caught by these entries
+  // (via arg_positions[0] on the SLF4J-family methods), classified as
+  // log_injection.
   // Issue #44: log.info/warn/error/debug emit the message argument and any
   // {} format arguments to the log stream. Untrusted input forwarded into
   // these calls allows log forging (newline injection) and downstream log

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.179.0",
+  "version": "3.181.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",