circle-ir 3.18.5 → 3.18.6

package/dist/core/circle-ir-core.js

@@ -9154,6 +9154,7 @@ var DEFAULT_SOURCES = [
   { method: "read_line", class: "BufReader", type: "file_input", severity: "medium", return_tainted: true },
   { method: "lines", class: "BufReader", type: "file_input", severity: "medium", return_tainted: true },
   { method: "read_to_string", class: "stdin", type: "io_input", severity: "medium", return_tainted: true },
+  { method: "read_line", class: "stdin", type: "io_input", severity: "medium", return_tainted: true },
   { method: "recv", class: "TcpStream", type: "network_input", severity: "high", return_tainted: true },
   { method: "read", class: "TcpStream", type: "network_input", severity: "high", return_tainted: true },
   { method: "read_to_end", class: "TcpStream", type: "network_input", severity: "high", return_tainted: true },
@@ -9874,6 +9875,8 @@ var DEFAULT_SINKS = [
   { method: "query", class: "Client", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0] },
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0] },
+  // Browser DOM XSS sinks
+  { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   // Express.js XSS (response methods)
   { method: "send", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -10121,6 +10124,14 @@ var DEFAULT_SINKS = [
   // Rust Open Redirect
   { method: "redirect", class: "HttpResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
   { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
+  { method: "see_other", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
+  { method: "to", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
+  { method: "temporary", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
+  { method: "permanent", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
+  { method: "header", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [1] },
+  { method: "insert_header", class: "HttpResponse", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [1] },
+  { method: "append_header", class: "HttpResponse", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [1] },
+  { method: "from_str", class: "HeaderValue", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
   // Rust Log Injection (log crate, tracing)
   { method: "info!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "warn!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
@@ -10155,6 +10166,9 @@ var DEFAULT_SINKS = [
   { method: "body", class: "HttpResponse", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "body", class: "HttpResponseBuilder", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "body", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
+  // warp::reply::html
+  { method: "html", class: "reply", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
+  { method: "html", class: "warp", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   // Rust serde deserialization
   { method: "from_str", class: "serde_yaml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
   { method: "from_reader", class: "serde_yaml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
@@ -10227,6 +10241,8 @@ var DEFAULT_SANITIZERS = [
   // DOMPurify and similar
   { method: "sanitize", class: "DOMPurify", removes: ["xss"] },
   { method: "escape", class: "validator", removes: ["xss"] },
+  // JSON.parse (data is validated against JSON grammar, prevents XSS/code injection)
+  { method: "parse", class: "JSON", removes: ["xss", "code_injection"] },
   // Type coercion (removes string-based injections)
   { method: "parseInt", removes: ["sql_injection", "nosql_injection", "command_injection", "xss"] },
   { method: "parseFloat", removes: ["sql_injection", "nosql_injection", "command_injection"] },
@@ -10753,7 +10769,8 @@ function receiverMightBeClass(receiver, className) {
         "createStatement": ["Statement"],
         "prepareStatement": ["PreparedStatement"],
         "getRuntime": ["Runtime"],
-        "builder": ["Response", "ResponseBuilder", "HttpResponseBuilder"]
+        "builder": ["Response", "ResponseBuilder", "HttpResponseBuilder"],
+        "stdin": ["stdin", "Stdin", "BufReader"]
       };
       const expectedTypes = returnTypeMappings[methodName];
       if (Array.isArray(expectedTypes) && expectedTypes.includes(className)) {
@@ -10762,12 +10779,16 @@ function receiverMightBeClass(receiver, className) {
     }
   }
   if (receiver.includes("::") && receiver.endsWith(")")) {
-    const scopedMatch = receiver.match(/^(\w+)::\w+\(.*\)$/);
+    const scopedMatch = receiver.match(/^(\w+)::(\w+)\(.*\)$/);
     if (scopedMatch) {
       const typeName = scopedMatch[1];
+      const funcName = scopedMatch[2];
       if (typeName === className || typeName.toLowerCase() === lowerClass) {
         return true;
       }
+      if (funcName === className || funcName.toLowerCase() === lowerClass) {
+        return true;
+      }
     }
   }
   if (lowerClass.includes(lowerReceiver)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.18.5",
+  "version": "3.18.6",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",