circle-ir 3.18.5 → 3.18.7

package/dist/analysis/config-loader.js

@@ -406,6 +406,8 @@ export const DEFAULT_SOURCES = [
     { method: 'read_line', class: 'BufReader', type: 'file_input', severity: 'medium', return_tainted: true },
     { method: 'lines', class: 'BufReader', type: 'file_input', severity: 'medium', return_tainted: true },
     { method: 'read_to_string', class: 'stdin', type: 'io_input', severity: 'medium', return_tainted: true },
+    { method: 'read_line', class: 'stdin', type: 'io_input', severity: 'medium', return_tainted: true },
+    { method: 'lines', class: 'stdin', type: 'io_input', severity: 'medium', return_tainted: true },
     { method: 'recv', class: 'TcpStream', type: 'network_input', severity: 'high', return_tainted: true },
     { method: 'read', class: 'TcpStream', type: 'network_input', severity: 'high', return_tainted: true },
     { method: 'read_to_end', class: 'TcpStream', type: 'network_input', severity: 'high', return_tainted: true },
@@ -926,9 +928,8 @@ export const DEFAULT_SINKS = [
     { method: 'load', class: 'Yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
     { method: 'loadAll', class: 'Yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
     { method: 'loadAs', class: 'Yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
-    // JSON deserialization
+    // JSON deserialization (Java FastJSON / Jackson — NOT JavaScript's safe JSON.parse)
     { method: 'parseObject', class: 'JSON', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
-    { method: 'parse', class: 'JSON', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
     { method: 'parseObject', class: 'JSONObject', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
     { method: 'fromJson', class: 'Gson', type: 'deserialization', cwe: 'CWE-502', severity: 'medium', arg_positions: [0] },
     // XMLDecoder
@@ -961,8 +962,8 @@ export const DEFAULT_SINKS = [
     { method: 'sendRedirect', type: 'ssrf', cwe: 'CWE-601', severity: 'high', arg_positions: [0] },
     { method: 'openConnection', class: 'URL', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [] },
     { method: 'openStream', class: 'URL', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [] },
-    { method: 'URL', class: 'constructor', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
-    { method: 'URI', class: 'constructor', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
+    // NOTE: URL/URI constructors removed — constructing a URL object doesn't make a network
+    // request in any language. The real SSRF sinks are openConnection/openStream/execute/etc.
     { method: 'execute', class: 'HttpClient', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'send', class: 'HttpClient', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'getForObject', class: 'RestTemplate', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
@@ -1126,6 +1127,8 @@ export const DEFAULT_SINKS = [
     { method: 'query', class: 'Client', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0] },
     { method: 'query', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0] },
     { method: 'raw', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0] },
+    // Browser DOM XSS sinks
+    { method: 'setAttribute', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [1] },
     // Express.js XSS (response methods)
     { method: 'send', class: 'Response', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
     { method: 'write', class: 'Response', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
@@ -1373,6 +1376,14 @@ export const DEFAULT_SINKS = [
     // Rust Open Redirect
     { method: 'redirect', class: 'HttpResponse', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0] },
     { method: 'Redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0] },
+    { method: 'see_other', class: 'Redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0] },
+    { method: 'to', class: 'Redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0] },
+    { method: 'temporary', class: 'Redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0] },
+    { method: 'permanent', class: 'Redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0] },
+    { method: 'header', class: 'Response', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [1] },
+    { method: 'insert_header', class: 'HttpResponse', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [1] },
+    { method: 'append_header', class: 'HttpResponse', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [1] },
+    { method: 'from_str', class: 'HeaderValue', type: 'open_redirect', cwe: 'CWE-601', severity: 'high', arg_positions: [0] },
     // Rust Log Injection (log crate, tracing)
     { method: 'info!', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2] },
     { method: 'warn!', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0, 1, 2] },
@@ -1407,6 +1418,9 @@ export const DEFAULT_SINKS = [
     { method: 'body', class: 'HttpResponse', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
     { method: 'body', class: 'HttpResponseBuilder', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
     { method: 'body', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
+    // warp::reply::html
+    { method: 'html', class: 'reply', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
+    { method: 'html', class: 'warp', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
     // Rust serde deserialization
     { method: 'from_str', class: 'serde_yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
     { method: 'from_reader', class: 'serde_yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
@@ -1473,6 +1487,8 @@ export const DEFAULT_SANITIZERS = [
     // DOMPurify and similar
     { method: 'sanitize', class: 'DOMPurify', removes: ['xss'] },
     { method: 'escape', class: 'validator', removes: ['xss'] },
+    // JSON.parse (data is validated against JSON grammar, prevents XSS/code injection)
+    { method: 'parse', class: 'JSON', removes: ['xss', 'code_injection'] },
     // Type coercion (removes string-based injections)
     { method: 'parseInt', removes: ['sql_injection', 'nosql_injection', 'command_injection', 'xss'] },
     { method: 'parseFloat', removes: ['sql_injection', 'nosql_injection', 'command_injection'] },
@@ -1543,9 +1559,9 @@ export const DEFAULT_SANITIZERS = [
     { method: 'extension', removes: ['path_traversal'] },
     { method: 'canonicalize', removes: ['path_traversal'] }, // Resolves symlinks, validates path exists
     // Rust Command Injection - allowlist validation
-    { method: 'contains', removes: ['command_injection', 'ssrf'] }, // Used for allowlist checks
-    { method: 'starts_with', removes: ['path_traversal', 'ssrf'] }, // Path/URL prefix validation
-    { method: 'ends_with', removes: ['path_traversal'] },
+    { method: 'contains', removes: ['command_injection', 'ssrf', 'open_redirect'] }, // Used for allowlist checks
+    { method: 'starts_with', removes: ['path_traversal', 'ssrf', 'open_redirect'] }, // Path/URL prefix validation
+    { method: 'ends_with', removes: ['path_traversal', 'open_redirect'] },
     // Rust XSS - HTML escaping
     { method: 'escape', class: 'html_escape', removes: ['xss'] },
     { method: 'encode_text', class: 'html_escape', removes: ['xss'] },