circle-ir 3.180.0 → 3.181.0

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6hB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2wDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2jB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2wDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -540,6 +540,35 @@ export const DEFAULT_SOURCES = [
     { method: 'get', class: 'Jedis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['java'] },
     { method: 'hget', class: 'Jedis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['java'] },
     { method: 'mget', class: 'Jedis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['java'] },
+    // --- Serverless transport channels (cognium-dev #213 first slice) ---
+    //
+    // AWS Lambda / API Gateway invocation-event properties. The Lambda
+    // handler signature `(event, context) => …` (JS/TS) or
+    // `def handler(event, context)` (Python) receives an `event` object
+    // whose properties carry the untrusted HTTP-request-shaped payload:
+    //
+    //   event.body                              — request body (string)
+    //   event.queryStringParameters             — `?a=b` params
+    //   event.multiValueQueryStringParameters   — `?a=1&a=2` params
+    //   event.pathParameters                    — path template captures
+    //   event.headers                           — request headers
+    //   event.multiValueHeaders                 — repeated headers
+    //   event.requestContext                    — API Gateway request context
+    //
+    // Vercel Serverless Functions and Cloudflare Workers both use `req`
+    // / `request` receivers that are already covered by the Express-
+    // style patterns above (line ~398). This block specifically covers
+    // the `event`-shaped API Gateway convention that those don't reach.
+    { property: 'body', object: 'event', type: 'http_body', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    { property: 'queryStringParameters', object: 'event', type: 'http_query', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    { property: 'multiValueQueryStringParameters', object: 'event', type: 'http_query', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    { property: 'pathParameters', object: 'event', type: 'http_path', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    { property: 'headers', object: 'event', type: 'http_header', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    { property: 'multiValueHeaders', object: 'event', type: 'http_header', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    { property: 'body', object: 'event', type: 'http_body', severity: 'high', property_tainted: true, languages: ['python'] },
+    { property: 'queryStringParameters', object: 'event', type: 'http_query', severity: 'high', property_tainted: true, languages: ['python'] },
+    { property: 'pathParameters', object: 'event', type: 'http_path', severity: 'high', property_tainted: true, languages: ['python'] },
+    { property: 'headers', object: 'event', type: 'http_header', severity: 'high', property_tainted: true, languages: ['python'] },
     // --- JWT claims (unverified decode — PyJWT / jose / jsonwebtoken / auth0 java-jwt / golang-jwt) ---
     // A JWT's payload is *always* attacker-authored. Even after verification
     // the *contents* of the claims (username, role, custom fields) are not