circle-ir 3.182.0 → 3.186.0

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2jB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2wDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAwThD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAymB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2wDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA4chD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -522,6 +522,49 @@ export const DEFAULT_SOURCES = [
     // Server-side interceptor receives `Metadata headers`; `headers.get(KEY)`
     // returns caller-supplied header values.
     { method: 'get', class: 'Metadata', type: 'http_header', severity: 'high', return_tainted: true, languages: ['java'] },
+    // --- WebSocket transport channels (cognium-dev #213 second slice) ---
+    //
+    // Server-side WebSocket handlers receive attacker-authored frames on
+    // every call to a receive-shaped method. Untrusted the moment they
+    // return, regardless of any application-level auth on the socket.
+    //
+    // Python — FastAPI / Starlette (`from fastapi import WebSocket`):
+    //   data = await websocket.receive_text()
+    //   data = await websocket.receive_bytes()
+    //   data = await websocket.receive_json()   # parsed dict/list
+    //   data = await websocket.receive()        # {'type', 'text'|'bytes'}
+    { method: 'receive_text', class: 'WebSocket', type: 'network_input', severity: 'high', return_tainted: true, languages: ['python'] },
+    { method: 'receive_bytes', class: 'WebSocket', type: 'network_input', severity: 'high', return_tainted: true, languages: ['python'] },
+    { method: 'receive_json', class: 'WebSocket', type: 'http_body', severity: 'high', return_tainted: true, languages: ['python'] },
+    //
+    // `receive` intentionally class-scoped to WebSocket (Starlette pattern).
+    // Broadening to unqualified would collide with queue/signal `.receive()`.
+    { method: 'receive', class: 'WebSocket', type: 'network_input', severity: 'high', return_tainted: true, languages: ['python'] },
+    // Django Channels `AsyncJsonWebsocketConsumer` / `WebsocketConsumer`
+    // expose the same receive_* names on `self`; the class filter matches
+    // `WebSocket` only, so add unqualified fallbacks for the receive_json /
+    // receive_text convention (broad — no class filter possible without
+    // hardcoding Django's consumer names).
+    { method: 'receive_json', type: 'http_body', severity: 'high', return_tainted: true, languages: ['python'] },
+    { method: 'receive_text', type: 'network_input', severity: 'high', return_tainted: true, languages: ['python'] },
+    { method: 'receive_bytes', type: 'network_input', severity: 'high', return_tainted: true, languages: ['python'] },
+    // Go — gorilla/websocket (`github.com/gorilla/websocket`):
+    //   messageType, message, err := conn.ReadMessage()
+    //   _, r, err := conn.NextReader()
+    { method: 'ReadMessage', class: 'Conn', type: 'network_input', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'NextReader', class: 'Conn', type: 'network_input', severity: 'high', return_tainted: true, languages: ['go'] },
+    // nhooyr.io/websocket exposes a `Read` method on `*websocket.Conn`;
+    // signature is `func (c *Conn) Read(ctx) (MessageType, []byte, error)`.
+    { method: 'Read', class: 'Conn', type: 'network_input', severity: 'high', return_tainted: true, languages: ['go'] },
+    // Java — Jakarta / Java WebSocket API (`javax.websocket` / `jakarta.websocket`):
+    //   session.getBasicRemote().sendText(input);      // OUT (not a source)
+    //   @OnMessage public void onMessage(String msg) — `msg` is a callback
+    //   param, not a return; handled via param_tainted when annotation is set.
+    { annotation: 'OnMessage', type: 'network_input', severity: 'high', param_tainted: true, languages: ['java'] },
+    // Spring `@MessageMapping` STOMP-over-WebSocket handlers receive
+    // untrusted payloads on every dispatched frame.
+    { annotation: 'MessageMapping', type: 'http_body', severity: 'high', param_tainted: true, languages: ['java'] },
+    { annotation: 'SubscribeMapping', type: 'http_body', severity: 'high', param_tainted: true, languages: ['java'] },
     // --- Cache reads (second-order taint — Redis / Memcached / Django cache) ---
     // The cache round-trip is a canonical second-order sink: whatever was
     // written previously (potentially attacker-controlled) resurfaces on read.
@@ -2583,6 +2626,91 @@ export const DEFAULT_SANITIZERS = [
     // Command injection - shell escaping
     { method: 'quote', class: 'shell', removes: ['command_injection'] },
     { method: 'escape', class: 'shell-escape', removes: ['command_injection'] },
+    // JS/Node — additional XSS/HTML encoders (cognium-dev #213 sixth slice).
+    //
+    //   he.encode(x) / he.escape(x)               — `he` npm package
+    //   sanitizeHtml(x)                            — `sanitize-html` npm
+    //   xss(x) / filterXSS(x)                      — `xss` npm (Yahoo)
+    //   escapeHtml(x) / escapeHTML(x)              — common bare helpers
+    //   entities.encode(x) / entities.escape(x)    — `entities` npm
+    //   xssFilters.inHTMLData(x) / inHTMLComment(x) / uriInHTMLData(x)
+    //                                              — `xss-filters` npm (Yahoo)
+    //
+    // `external_taint_escape` is included alongside `xss` — the CWE-668
+    // fallback fires on any call receiving tainted data that the engine
+    // does not otherwise recognize. Since these functions are explicitly
+    // registered as sanitizers (they PURIFY input), they should also
+    // suppress the fallback so a `res.send(sanitizeHtml(x))` flow does
+    // not report an external-taint-escape at the sanitizer call itself.
+    { method: 'encode', class: 'he', removes: ['xss', 'external_taint_escape'] },
+    { method: 'escape', class: 'he', removes: ['xss', 'external_taint_escape'] },
+    { method: 'sanitizeHtml', removes: ['xss', 'external_taint_escape'] },
+    { method: 'xss', removes: ['xss', 'external_taint_escape'] },
+    { method: 'filterXSS', removes: ['xss', 'external_taint_escape'] },
+    { method: 'escapeHtml', removes: ['xss', 'external_taint_escape'] },
+    { method: 'escapeHTML', removes: ['xss', 'external_taint_escape'] },
+    { method: 'encode', class: 'entities', removes: ['xss', 'external_taint_escape'] },
+    { method: 'escape', class: 'entities', removes: ['xss', 'external_taint_escape'] },
+    // xss-filters: context-specific helpers, all XSS-safe by construction.
+    { method: 'inHTMLData', class: 'xssFilters', removes: ['xss', 'external_taint_escape'] },
+    { method: 'inHTMLComment', class: 'xssFilters', removes: ['xss', 'external_taint_escape'] },
+    { method: 'uriInHTMLData', class: 'xssFilters', removes: ['xss', 'external_taint_escape'] },
+    // JS/Node — SQL escaping (in addition to the mysql class above).
+    //
+    //   SqlString.escape / .escapeId               — `sqlstring` npm (raw
+    //                                                escape used by mysql /
+    //                                                node-mysql2 drivers)
+    //   pgFormat(sql, ...args) / format(bare)      — `pg-format` npm
+    //   SQL.raw / SQL(bare)                        — `sql-template-strings`
+    //
+    // Bare `format` is intentionally NOT registered — it collides with
+    // string.format-style helpers unrelated to SQL. Callers should use the
+    // qualified form.
+    { method: 'escape', class: 'SqlString', removes: ['sql_injection', 'external_taint_escape'] },
+    { method: 'escapeId', class: 'SqlString', removes: ['sql_injection', 'external_taint_escape'] },
+    { method: 'format', class: 'SqlString', removes: ['sql_injection', 'external_taint_escape'] },
+    { method: 'format', class: 'pgFormat', removes: ['sql_injection', 'external_taint_escape'] },
+    { method: 'ident', class: 'pgFormat', removes: ['sql_injection', 'external_taint_escape'] },
+    { method: 'literal', class: 'pgFormat', removes: ['sql_injection', 'external_taint_escape'] },
+    // JS/Node — crypto.randomUUID() and Node's crypto.randomBytes(...)toString()
+    // produce cryptographically-secure typed strings that cannot carry
+    // attacker-injected payload. Registered as type coercion.
+    { method: 'randomUUID', class: 'crypto', removes: ['sql_injection', 'nosql_injection', 'command_injection', 'path_traversal', 'code_injection', 'xss'] },
+    // Bare `randomUUID()` alias — `import { randomUUID } from 'crypto'`.
+    { method: 'randomUUID', removes: ['sql_injection', 'nosql_injection', 'command_injection', 'path_traversal', 'code_injection', 'xss'] },
+    // JS/Node — URL construction. `new URL(x, base)` (constructor-call
+    // matched by method_name === 'URL') and `URLSearchParams.toString()`
+    // safely encode components for URL context.
+    { method: 'toString', class: 'URLSearchParams', removes: ['ssrf', 'open_redirect', 'xss'] },
+    // Go — additional sanitizers (cognium-dev #213 sixth slice).
+    //
+    //   regexp.QuoteMeta(x)  — mirror of Python re.escape; strips regex
+    //                          metacharacters so downstream compile/match
+    //                          cannot execute attacker-crafted patterns.
+    //   bluemonday.Sanitize  — dominant Go HTML sanitizer library
+    //                          (`microcosm-cc/bluemonday`). Called on a
+    //                          Policy value returned by UGCPolicy() /
+    //                          StrictPolicy() / etc. Match by method name
+    //                          alone — Policy is the receiver type.
+    //   net.ParseIP(x)        — validates the input is a well-formed IP;
+    //                          returns nil for bad input (developer must
+    //                          check, but the sanitizer only applies when
+    //                          the parsed IP flows onward).
+    //   sql.Named(name, val) — parameterized query binding.
+    { method: 'QuoteMeta', class: 'regexp', removes: ['redos', 'code_injection', 'external_taint_escape'] },
+    { method: 'Sanitize', class: 'bluemonday', removes: ['xss', 'external_taint_escape'] },
+    { method: 'Sanitize', class: 'Policy', removes: ['xss', 'external_taint_escape'] },
+    // Bare `Sanitize` — the receiver is a Policy variable (`p := bluemonday.UGCPolicy(); p.Sanitize(x)`).
+    // `Policy` class-matching only fires when the IR resolves the receiver type;
+    // since Go DFG rarely propagates the type of a locally-assigned variable
+    // from a package factory call, we also register the bare method name.
+    // Narrow FP risk: `Sanitize` bare is uncommon outside bluemonday context.
+    { method: 'Sanitize', removes: ['xss', 'external_taint_escape'] },
+    { method: 'SanitizeBytes', class: 'bluemonday', removes: ['xss', 'external_taint_escape'] },
+    { method: 'SanitizeBytes', class: 'Policy', removes: ['xss', 'external_taint_escape'] },
+    { method: 'SanitizeBytes', removes: ['xss', 'external_taint_escape'] },
+    { method: 'ParseIP', class: 'net', removes: ['ssrf', 'command_injection', 'path_traversal', 'external_taint_escape'] },
+    { method: 'Named', class: 'sql', removes: ['sql_injection', 'external_taint_escape'] },
     // =========================================================================
     // Python Sanitizers
     // =========================================================================
@@ -2627,6 +2755,60 @@ export const DEFAULT_SANITIZERS = [
     // Python Type coercion
     { method: 'int', removes: ['sql_injection', 'command_injection', 'xss'] },
     { method: 'float', removes: ['sql_injection', 'command_injection'] },
+    // Python URL encoding (cognium-dev #213 fifth slice).
+    //
+    //   urllib.parse.quote(x)      — RFC-3986 percent-encode; safe for URL path
+    //   urllib.parse.quote_plus(x) — same + space→+; safe for query string
+    //   urllib.parse.urlencode(d)  — encode a dict of pairs
+    //
+    // Bounded to URL-context sinks. Class-scoped to the specific
+    // `urllib.parse` receiver to avoid colliding with unrelated bare
+    // `quote(...)` calls in other libraries.
+    { method: 'quote', class: 'urllib.parse', removes: ['ssrf', 'open_redirect', 'xss', 'path_traversal'] },
+    { method: 'quote_plus', class: 'urllib.parse', removes: ['ssrf', 'open_redirect', 'xss', 'path_traversal'] },
+    { method: 'urlencode', class: 'urllib.parse', removes: ['ssrf', 'open_redirect', 'xss'] },
+    // Bare aliases — `from urllib.parse import quote` then unqualified.
+    { method: 'quote_plus', removes: ['ssrf', 'open_redirect', 'xss', 'path_traversal'] },
+    { method: 'urlencode', removes: ['ssrf', 'open_redirect', 'xss'] },
+    // `quote` bare is intentionally NOT registered — it collides with
+    // shlex.quote (bare-imported) which is a command_injection sanitizer,
+    // not a URL sanitizer. The class-scoped variant above catches the
+    // qualified `urllib.parse.quote(...)` shape; unqualified callers who
+    // want URL-context credit should use `quote_plus` (which does not
+    // collide with any command_injection sanitizer).
+    // Python XSS — additional common sanitizers.
+    //
+    //   bleach.clean(...)   — already covered above (line 2898)
+    //   bleach.linkify(...) — turns URLs into anchor tags; sanitizes as well
+    //   django.utils.html.escape / strip_tags — Django's XSS escape helpers
+    //   jinja2.escape       — Jinja2's Markup escape (aliased from markupsafe)
+    //   flask.escape        — Flask re-export of markupsafe.escape
+    //   saxutils.escape     — stdlib xml.sax.saxutils.escape for XML docs
+    { method: 'linkify', class: 'bleach', removes: ['xss'] },
+    // Bare `linkify(...)` alias — `from bleach import linkify`.
+    { method: 'linkify', removes: ['xss'] },
+    { method: 'escape', class: 'django.utils.html', removes: ['xss'] },
+    { method: 'strip_tags', class: 'django.utils.html', removes: ['xss'] },
+    { method: 'escape', class: 'jinja2', removes: ['xss'] },
+    { method: 'escape', class: 'flask', removes: ['xss'] },
+    { method: 'escape', class: 'saxutils', removes: ['xss'] },
+    { method: 'escape', class: 'xml.sax.saxutils', removes: ['xss'] },
+    { method: 'quoteattr', class: 'saxutils', removes: ['xss'] },
+    { method: 'quoteattr', class: 'xml.sax.saxutils', removes: ['xss'] },
+    // Python ReDoS — `re.escape(user)` when building a regex from user input
+    // strips regex metacharacters. Downstream `re.compile / re.match` cannot
+    // interpret user-supplied alternations or quantifiers. Also covers the
+    // `code_injection` categorization that `re.compile` currently emits
+    // (a re.escape-wrapped pattern cannot execute anything, so both are safe).
+    { method: 'escape', class: 're', removes: ['redos', 'code_injection'] },
+    // Python SQLAlchemy — `text(...).bindparams(...)` binds params safely.
+    // The `bindparams` call is the sanitizer; the parent `text` wraps the
+    // template. Also add `expression.literal` for explicit SQL literals.
+    { method: 'bindparams', removes: ['sql_injection'] },
+    // psycopg2 sql-composition helpers
+    { method: 'Identifier', class: 'sql', removes: ['sql_injection'] },
+    { method: 'Literal', class: 'sql', removes: ['sql_injection'] },
+    { method: 'Placeholder', class: 'sql', removes: ['sql_injection'] },
     // =========================================================================
     // Rust Sanitizers
     // =========================================================================