circle-ir 3.186.0 → 3.188.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/analysis/config-loader.d.ts.map +1 -1
  2. package/dist/analysis/config-loader.js +104 -0
  3. package/dist/analysis/config-loader.js.map +1 -1
  4. package/dist/browser/circle-ir.js +104 -0
  5. package/dist/core/circle-ir-core.cjs +104 -0
  6. package/dist/core/circle-ir-core.js +104 -0
  7. package/package.json +1 -1
package/dist/browser/circle-ir.js CHANGED
@@ -11210,6 +11210,29 @@ var DEFAULT_SOURCES = [
11210
11210
  { annotation: "Cookie", type: "http_cookie", severity: "high", param_tainted: true },
11211
11211
  { annotation: "Form", type: "http_param", severity: "high", param_tainted: true },
11212
11212
  { annotation: "File", type: "file_input", severity: "high", param_tainted: true },
11213
+ // NestJS controller param decorators (cognium-dev #213 eighth slice).
11214
+ //
11215
+ // NestJS shares @Body/@Query/@Headers/@Body decorator names with FastAPI
11216
+ // and Spring (covered above) but adds a few unique ones:
11217
+ // @Param('id') id: string — route path parameter
11218
+ // @Req() / @Request() req: Request — the whole request object
11219
+ // @Session() session: Session — session data
11220
+ // @Ip() ip: string — client IP
11221
+ // @HostParam('subdomain') sub: string — subdomain of `host` config
11222
+ // @UploadedFile() file: any — multer-uploaded file
11223
+ // @UploadedFiles() files: any[] — multer multi-file
11224
+ // @Next() — not a source (Express next-fn)
11225
+ // Registered without a `languages:` filter so they also credit the shared
11226
+ // decorator names in TypeScript (nestjs is TS-first) and any JS project
11227
+ // adopting the convention.
11228
+ { annotation: "Param", type: "http_path", severity: "high", param_tainted: true },
11229
+ { annotation: "Req", type: "http_body", severity: "high", param_tainted: true },
11230
+ { annotation: "Request", type: "http_body", severity: "high", param_tainted: true },
11231
+ { annotation: "Session", type: "http_cookie", severity: "high", param_tainted: true },
11232
+ { annotation: "Ip", type: "network_input", severity: "high", param_tainted: true },
11233
+ { annotation: "HostParam", type: "http_path", severity: "high", param_tainted: true },
11234
+ { annotation: "UploadedFile", type: "file_input", severity: "high", param_tainted: true },
11235
+ { annotation: "UploadedFiles", type: "file_input", severity: "high", param_tainted: true },
11213
11236
  // FastAPI Request object
11214
11237
  { method: "json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
11215
11238
  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
@@ -13239,10 +13262,49 @@ var DEFAULT_SINKS = [
13239
13262
  var DEFAULT_SANITIZERS = [
13240
13263
  // SQL Injection - proper parameter binding sanitizes input
13241
13264
  // Note: prepareStatement alone is NOT a sanitizer - it's a sink when used with concatenation
13265
+ //
13266
+ // Full PreparedStatement setter coverage (cognium-dev #213 seventh slice).
13267
+ // Every JDBC PreparedStatement.setXxx binds a parameter placeholder via
13268
+ // the driver wire protocol — the SQL text is fixed, only the value slot
13269
+ // varies. Prior coverage was setString/setInt/setLong only; extending
13270
+ // to the full JDBC 4.x setter surface so real Java apps using date/
13271
+ // decimal/object/binary bindings credit as sanitized.
13242
13272
  { method: "setString", class: "PreparedStatement", removes: ["sql_injection"] },
13273
+ { method: "setNString", class: "PreparedStatement", removes: ["sql_injection"] },
13243
13274
  { method: "setInt", class: "PreparedStatement", removes: ["sql_injection"] },
13244
13275
  { method: "setLong", class: "PreparedStatement", removes: ["sql_injection"] },
13276
+ { method: "setShort", class: "PreparedStatement", removes: ["sql_injection"] },
13277
+ { method: "setByte", class: "PreparedStatement", removes: ["sql_injection"] },
13278
+ { method: "setBoolean", class: "PreparedStatement", removes: ["sql_injection"] },
13279
+ { method: "setDouble", class: "PreparedStatement", removes: ["sql_injection"] },
13280
+ { method: "setFloat", class: "PreparedStatement", removes: ["sql_injection"] },
13281
+ { method: "setBigDecimal", class: "PreparedStatement", removes: ["sql_injection"] },
13282
+ { method: "setBytes", class: "PreparedStatement", removes: ["sql_injection"] },
13283
+ { method: "setDate", class: "PreparedStatement", removes: ["sql_injection"] },
13284
+ { method: "setTime", class: "PreparedStatement", removes: ["sql_injection"] },
13285
+ { method: "setTimestamp", class: "PreparedStatement", removes: ["sql_injection"] },
13286
+ { method: "setObject", class: "PreparedStatement", removes: ["sql_injection"] },
13287
+ { method: "setNull", class: "PreparedStatement", removes: ["sql_injection"] },
13288
+ { method: "setArray", class: "PreparedStatement", removes: ["sql_injection"] },
13289
+ { method: "setBlob", class: "PreparedStatement", removes: ["sql_injection"] },
13290
+ { method: "setClob", class: "PreparedStatement", removes: ["sql_injection"] },
13291
+ { method: "setNClob", class: "PreparedStatement", removes: ["sql_injection"] },
13292
+ { method: "setRef", class: "PreparedStatement", removes: ["sql_injection"] },
13293
+ { method: "setRowId", class: "PreparedStatement", removes: ["sql_injection"] },
13294
+ { method: "setSQLXML", class: "PreparedStatement", removes: ["sql_injection"] },
13295
+ { method: "setURL", class: "PreparedStatement", removes: ["sql_injection"] },
13296
+ { method: "setBinaryStream", class: "PreparedStatement", removes: ["sql_injection"] },
13297
+ { method: "setCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
13298
+ { method: "setAsciiStream", class: "PreparedStatement", removes: ["sql_injection"] },
13299
+ { method: "setNCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
13300
+ // JPA / Hibernate Query.setParameter — covered above; add TypedQuery
13301
+ // (same interface but distinct type name).
13245
13302
  { method: "setParameter", class: "Query", removes: ["sql_injection"] },
13303
+ { method: "setParameter", class: "TypedQuery", removes: ["sql_injection"] },
13304
+ // Spring JdbcTemplate `NamedParameterJdbcTemplate.update / queryForObject`
13305
+ // parameterized shapes use SqlParameterSource.addValue — the addValue
13306
+ // call binds the parameter safely.
13307
+ { method: "addValue", class: "MapSqlParameterSource", removes: ["sql_injection"] },
13246
13308
  { annotation: "Param", removes: ["sql_injection"] },
13247
13309
  // XSS
13248
13310
  { method: "escapeHtml", removes: ["xss"] },
@@ -13268,6 +13330,48 @@ var DEFAULT_SANITIZERS = [
13268
13330
  // Rust askama auto-escapes
13269
13331
  { method: "encodeForJavaScript", removes: ["xss"] },
13270
13332
  { method: "encodeForCSS", removes: ["xss"] },
13333
+ // Additional Java XSS sanitizers (cognium-dev #213 seventh slice).
13334
+ //
13335
+ // Guava `HtmlEscapers.htmlEscaper().escape(x)` — the `.escape` call
13336
+ // on the returned Escaper is caught by the generic `escape` rule
13337
+ // above, but explicit registration makes intent clear.
13338
+ // Spring `HtmlUtils.htmlEscape(x)` — htmlEscape already covered
13339
+ // above (bare method name).
13340
+ // Apache Commons Text `StringEscapeUtils.escapeJson / escapeXml11 /
13341
+ // escapeEcmaScript / escapeCsv / escapeXsi`.
13342
+ // OWASP HTML Sanitizer `PolicyFactory.sanitize(html)`.
13343
+ { method: "escape", class: "Escaper", removes: ["xss"] },
13344
+ { method: "escape", class: "HtmlEscapers", removes: ["xss"] },
13345
+ { method: "escapeJson", class: "StringEscapeUtils", removes: ["xss"] },
13346
+ { method: "escapeEcmaScript", class: "StringEscapeUtils", removes: ["xss"] },
13347
+ { method: "escapeXml11", class: "StringEscapeUtils", removes: ["xss"] },
13348
+ { method: "escapeXml10", class: "StringEscapeUtils", removes: ["xss"] },
13349
+ { method: "escapeCsv", class: "StringEscapeUtils", removes: ["xss"] },
13350
+ { method: "escapeXsi", class: "StringEscapeUtils", removes: ["xss"] },
13351
+ { method: "escapeJava", class: "StringEscapeUtils", removes: ["xss"] },
13352
+ // Bare escapeJson / escapeEcmaScript / escapeCsv aliases — common
13353
+ // when statically imported.
13354
+ { method: "escapeJson", removes: ["xss"] },
13355
+ { method: "escapeEcmaScript", removes: ["xss"] },
13356
+ { method: "escapeCsv", removes: ["xss"] },
13357
+ // OWASP HTML sanitizer (`com.googlecode.owasp-java-html-sanitizer`).
13358
+ { method: "sanitize", class: "PolicyFactory", removes: ["xss"] },
13359
+ // Java Base64 / Hex / MessageDigest — encoded output is binary-safe
13360
+ // (cognium-dev #213 seventh slice). None of these carry attacker
13361
+ // shell/SQL/HTML metacharacters through the encoding — Base64 emits
13362
+ // [A-Za-z0-9+/=], Hex emits [0-9a-f], MessageDigest.digest returns
13363
+ // opaque bytes usually toHex/toBase64-encoded downstream.
13364
+ { method: "encodeToString", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
13365
+ { method: "encode", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
13366
+ { method: "encodeHexString", class: "Hex", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
13367
+ { method: "digest", class: "MessageDigest", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
13368
+ // Bare aliases for encoder chains — `Base64.getEncoder().encodeToString(x)`
13369
+ // has a call-expression receiver (`Base64.getEncoder()`) that the Java IR
13370
+ // rarely resolves to `Encoder`. Same story for `Hex.encodeHexString(x)`
13371
+ // when Hex is imported. These bare-method names are dominated by their
13372
+ // encoding use in practice; false-positive risk is low.
13373
+ { method: "encodeToString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
13374
+ { method: "encodeHexString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
13271
13375
  // cognium-dev #249 3.162.0: `open_redirect` restored to the URL-encoder
13272
13376
  // sanitizer cluster. Sprint 82 (#189) reclassified `sendRedirect` from
13273
13377
  // `ssrf` → `open_redirect` (config-loader.ts:1296-1299) without updating
package/dist/core/circle-ir-core.cjs CHANGED
@@ -10605,6 +10605,29 @@ var DEFAULT_SOURCES = [
10605
10605
  { annotation: "Cookie", type: "http_cookie", severity: "high", param_tainted: true },
10606
10606
  { annotation: "Form", type: "http_param", severity: "high", param_tainted: true },
10607
10607
  { annotation: "File", type: "file_input", severity: "high", param_tainted: true },
10608
+ // NestJS controller param decorators (cognium-dev #213 eighth slice).
10609
+ //
10610
+ // NestJS shares @Body/@Query/@Headers/@Body decorator names with FastAPI
10611
+ // and Spring (covered above) but adds a few unique ones:
10612
+ // @Param('id') id: string — route path parameter
10613
+ // @Req() / @Request() req: Request — the whole request object
10614
+ // @Session() session: Session — session data
10615
+ // @Ip() ip: string — client IP
10616
+ // @HostParam('subdomain') sub: string — subdomain of `host` config
10617
+ // @UploadedFile() file: any — multer-uploaded file
10618
+ // @UploadedFiles() files: any[] — multer multi-file
10619
+ // @Next() — not a source (Express next-fn)
10620
+ // Registered without a `languages:` filter so they also credit the shared
10621
+ // decorator names in TypeScript (nestjs is TS-first) and any JS project
10622
+ // adopting the convention.
10623
+ { annotation: "Param", type: "http_path", severity: "high", param_tainted: true },
10624
+ { annotation: "Req", type: "http_body", severity: "high", param_tainted: true },
10625
+ { annotation: "Request", type: "http_body", severity: "high", param_tainted: true },
10626
+ { annotation: "Session", type: "http_cookie", severity: "high", param_tainted: true },
10627
+ { annotation: "Ip", type: "network_input", severity: "high", param_tainted: true },
10628
+ { annotation: "HostParam", type: "http_path", severity: "high", param_tainted: true },
10629
+ { annotation: "UploadedFile", type: "file_input", severity: "high", param_tainted: true },
10630
+ { annotation: "UploadedFiles", type: "file_input", severity: "high", param_tainted: true },
10608
10631
  // FastAPI Request object
10609
10632
  { method: "json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
10610
10633
  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
@@ -12634,10 +12657,49 @@ var DEFAULT_SINKS = [
12634
12657
  var DEFAULT_SANITIZERS = [
12635
12658
  // SQL Injection - proper parameter binding sanitizes input
12636
12659
  // Note: prepareStatement alone is NOT a sanitizer - it's a sink when used with concatenation
12660
+ //
12661
+ // Full PreparedStatement setter coverage (cognium-dev #213 seventh slice).
12662
+ // Every JDBC PreparedStatement.setXxx binds a parameter placeholder via
12663
+ // the driver wire protocol — the SQL text is fixed, only the value slot
12664
+ // varies. Prior coverage was setString/setInt/setLong only; extending
12665
+ // to the full JDBC 4.x setter surface so real Java apps using date/
12666
+ // decimal/object/binary bindings credit as sanitized.
12637
12667
  { method: "setString", class: "PreparedStatement", removes: ["sql_injection"] },
12668
+ { method: "setNString", class: "PreparedStatement", removes: ["sql_injection"] },
12638
12669
  { method: "setInt", class: "PreparedStatement", removes: ["sql_injection"] },
12639
12670
  { method: "setLong", class: "PreparedStatement", removes: ["sql_injection"] },
12671
+ { method: "setShort", class: "PreparedStatement", removes: ["sql_injection"] },
12672
+ { method: "setByte", class: "PreparedStatement", removes: ["sql_injection"] },
12673
+ { method: "setBoolean", class: "PreparedStatement", removes: ["sql_injection"] },
12674
+ { method: "setDouble", class: "PreparedStatement", removes: ["sql_injection"] },
12675
+ { method: "setFloat", class: "PreparedStatement", removes: ["sql_injection"] },
12676
+ { method: "setBigDecimal", class: "PreparedStatement", removes: ["sql_injection"] },
12677
+ { method: "setBytes", class: "PreparedStatement", removes: ["sql_injection"] },
12678
+ { method: "setDate", class: "PreparedStatement", removes: ["sql_injection"] },
12679
+ { method: "setTime", class: "PreparedStatement", removes: ["sql_injection"] },
12680
+ { method: "setTimestamp", class: "PreparedStatement", removes: ["sql_injection"] },
12681
+ { method: "setObject", class: "PreparedStatement", removes: ["sql_injection"] },
12682
+ { method: "setNull", class: "PreparedStatement", removes: ["sql_injection"] },
12683
+ { method: "setArray", class: "PreparedStatement", removes: ["sql_injection"] },
12684
+ { method: "setBlob", class: "PreparedStatement", removes: ["sql_injection"] },
12685
+ { method: "setClob", class: "PreparedStatement", removes: ["sql_injection"] },
12686
+ { method: "setNClob", class: "PreparedStatement", removes: ["sql_injection"] },
12687
+ { method: "setRef", class: "PreparedStatement", removes: ["sql_injection"] },
12688
+ { method: "setRowId", class: "PreparedStatement", removes: ["sql_injection"] },
12689
+ { method: "setSQLXML", class: "PreparedStatement", removes: ["sql_injection"] },
12690
+ { method: "setURL", class: "PreparedStatement", removes: ["sql_injection"] },
12691
+ { method: "setBinaryStream", class: "PreparedStatement", removes: ["sql_injection"] },
12692
+ { method: "setCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
12693
+ { method: "setAsciiStream", class: "PreparedStatement", removes: ["sql_injection"] },
12694
+ { method: "setNCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
12695
+ // JPA / Hibernate Query.setParameter — covered above; add TypedQuery
12696
+ // (same interface but distinct type name).
12640
12697
  { method: "setParameter", class: "Query", removes: ["sql_injection"] },
12698
+ { method: "setParameter", class: "TypedQuery", removes: ["sql_injection"] },
12699
+ // Spring JdbcTemplate `NamedParameterJdbcTemplate.update / queryForObject`
12700
+ // parameterized shapes use SqlParameterSource.addValue — the addValue
12701
+ // call binds the parameter safely.
12702
+ { method: "addValue", class: "MapSqlParameterSource", removes: ["sql_injection"] },
12641
12703
  { annotation: "Param", removes: ["sql_injection"] },
12642
12704
  // XSS
12643
12705
  { method: "escapeHtml", removes: ["xss"] },
@@ -12663,6 +12725,48 @@ var DEFAULT_SANITIZERS = [
12663
12725
  // Rust askama auto-escapes
12664
12726
  { method: "encodeForJavaScript", removes: ["xss"] },
12665
12727
  { method: "encodeForCSS", removes: ["xss"] },
12728
+ // Additional Java XSS sanitizers (cognium-dev #213 seventh slice).
12729
+ //
12730
+ // Guava `HtmlEscapers.htmlEscaper().escape(x)` — the `.escape` call
12731
+ // on the returned Escaper is caught by the generic `escape` rule
12732
+ // above, but explicit registration makes intent clear.
12733
+ // Spring `HtmlUtils.htmlEscape(x)` — htmlEscape already covered
12734
+ // above (bare method name).
12735
+ // Apache Commons Text `StringEscapeUtils.escapeJson / escapeXml11 /
12736
+ // escapeEcmaScript / escapeCsv / escapeXsi`.
12737
+ // OWASP HTML Sanitizer `PolicyFactory.sanitize(html)`.
12738
+ { method: "escape", class: "Escaper", removes: ["xss"] },
12739
+ { method: "escape", class: "HtmlEscapers", removes: ["xss"] },
12740
+ { method: "escapeJson", class: "StringEscapeUtils", removes: ["xss"] },
12741
+ { method: "escapeEcmaScript", class: "StringEscapeUtils", removes: ["xss"] },
12742
+ { method: "escapeXml11", class: "StringEscapeUtils", removes: ["xss"] },
12743
+ { method: "escapeXml10", class: "StringEscapeUtils", removes: ["xss"] },
12744
+ { method: "escapeCsv", class: "StringEscapeUtils", removes: ["xss"] },
12745
+ { method: "escapeXsi", class: "StringEscapeUtils", removes: ["xss"] },
12746
+ { method: "escapeJava", class: "StringEscapeUtils", removes: ["xss"] },
12747
+ // Bare escapeJson / escapeEcmaScript / escapeCsv aliases — common
12748
+ // when statically imported.
12749
+ { method: "escapeJson", removes: ["xss"] },
12750
+ { method: "escapeEcmaScript", removes: ["xss"] },
12751
+ { method: "escapeCsv", removes: ["xss"] },
12752
+ // OWASP HTML sanitizer (`com.googlecode.owasp-java-html-sanitizer`).
12753
+ { method: "sanitize", class: "PolicyFactory", removes: ["xss"] },
12754
+ // Java Base64 / Hex / MessageDigest — encoded output is binary-safe
12755
+ // (cognium-dev #213 seventh slice). None of these carry attacker
12756
+ // shell/SQL/HTML metacharacters through the encoding — Base64 emits
12757
+ // [A-Za-z0-9+/=], Hex emits [0-9a-f], MessageDigest.digest returns
12758
+ // opaque bytes usually toHex/toBase64-encoded downstream.
12759
+ { method: "encodeToString", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12760
+ { method: "encode", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12761
+ { method: "encodeHexString", class: "Hex", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12762
+ { method: "digest", class: "MessageDigest", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12763
+ // Bare aliases for encoder chains — `Base64.getEncoder().encodeToString(x)`
12764
+ // has a call-expression receiver (`Base64.getEncoder()`) that the Java IR
12765
+ // rarely resolves to `Encoder`. Same story for `Hex.encodeHexString(x)`
12766
+ // when Hex is imported. These bare-method names are dominated by their
12767
+ // encoding use in practice; false-positive risk is low.
12768
+ { method: "encodeToString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12769
+ { method: "encodeHexString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12666
12770
  // cognium-dev #249 3.162.0: `open_redirect` restored to the URL-encoder
12667
12771
  // sanitizer cluster. Sprint 82 (#189) reclassified `sendRedirect` from
12668
12772
  // `ssrf` → `open_redirect` (config-loader.ts:1296-1299) without updating
package/dist/core/circle-ir-core.js CHANGED
@@ -10539,6 +10539,29 @@ var DEFAULT_SOURCES = [
10539
10539
  { annotation: "Cookie", type: "http_cookie", severity: "high", param_tainted: true },
10540
10540
  { annotation: "Form", type: "http_param", severity: "high", param_tainted: true },
10541
10541
  { annotation: "File", type: "file_input", severity: "high", param_tainted: true },
10542
+ // NestJS controller param decorators (cognium-dev #213 eighth slice).
10543
+ //
10544
+ // NestJS shares @Body/@Query/@Headers/@Body decorator names with FastAPI
10545
+ // and Spring (covered above) but adds a few unique ones:
10546
+ // @Param('id') id: string — route path parameter
10547
+ // @Req() / @Request() req: Request — the whole request object
10548
+ // @Session() session: Session — session data
10549
+ // @Ip() ip: string — client IP
10550
+ // @HostParam('subdomain') sub: string — subdomain of `host` config
10551
+ // @UploadedFile() file: any — multer-uploaded file
10552
+ // @UploadedFiles() files: any[] — multer multi-file
10553
+ // @Next() — not a source (Express next-fn)
10554
+ // Registered without a `languages:` filter so they also credit the shared
10555
+ // decorator names in TypeScript (nestjs is TS-first) and any JS project
10556
+ // adopting the convention.
10557
+ { annotation: "Param", type: "http_path", severity: "high", param_tainted: true },
10558
+ { annotation: "Req", type: "http_body", severity: "high", param_tainted: true },
10559
+ { annotation: "Request", type: "http_body", severity: "high", param_tainted: true },
10560
+ { annotation: "Session", type: "http_cookie", severity: "high", param_tainted: true },
10561
+ { annotation: "Ip", type: "network_input", severity: "high", param_tainted: true },
10562
+ { annotation: "HostParam", type: "http_path", severity: "high", param_tainted: true },
10563
+ { annotation: "UploadedFile", type: "file_input", severity: "high", param_tainted: true },
10564
+ { annotation: "UploadedFiles", type: "file_input", severity: "high", param_tainted: true },
10542
10565
  // FastAPI Request object
10543
10566
  { method: "json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
10544
10567
  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
@@ -12568,10 +12591,49 @@ var DEFAULT_SINKS = [
12568
12591
  var DEFAULT_SANITIZERS = [
12569
12592
  // SQL Injection - proper parameter binding sanitizes input
12570
12593
  // Note: prepareStatement alone is NOT a sanitizer - it's a sink when used with concatenation
12594
+ //
12595
+ // Full PreparedStatement setter coverage (cognium-dev #213 seventh slice).
12596
+ // Every JDBC PreparedStatement.setXxx binds a parameter placeholder via
12597
+ // the driver wire protocol — the SQL text is fixed, only the value slot
12598
+ // varies. Prior coverage was setString/setInt/setLong only; extending
12599
+ // to the full JDBC 4.x setter surface so real Java apps using date/
12600
+ // decimal/object/binary bindings credit as sanitized.
12571
12601
  { method: "setString", class: "PreparedStatement", removes: ["sql_injection"] },
12602
+ { method: "setNString", class: "PreparedStatement", removes: ["sql_injection"] },
12572
12603
  { method: "setInt", class: "PreparedStatement", removes: ["sql_injection"] },
12573
12604
  { method: "setLong", class: "PreparedStatement", removes: ["sql_injection"] },
12605
+ { method: "setShort", class: "PreparedStatement", removes: ["sql_injection"] },
12606
+ { method: "setByte", class: "PreparedStatement", removes: ["sql_injection"] },
12607
+ { method: "setBoolean", class: "PreparedStatement", removes: ["sql_injection"] },
12608
+ { method: "setDouble", class: "PreparedStatement", removes: ["sql_injection"] },
12609
+ { method: "setFloat", class: "PreparedStatement", removes: ["sql_injection"] },
12610
+ { method: "setBigDecimal", class: "PreparedStatement", removes: ["sql_injection"] },
12611
+ { method: "setBytes", class: "PreparedStatement", removes: ["sql_injection"] },
12612
+ { method: "setDate", class: "PreparedStatement", removes: ["sql_injection"] },
12613
+ { method: "setTime", class: "PreparedStatement", removes: ["sql_injection"] },
12614
+ { method: "setTimestamp", class: "PreparedStatement", removes: ["sql_injection"] },
12615
+ { method: "setObject", class: "PreparedStatement", removes: ["sql_injection"] },
12616
+ { method: "setNull", class: "PreparedStatement", removes: ["sql_injection"] },
12617
+ { method: "setArray", class: "PreparedStatement", removes: ["sql_injection"] },
12618
+ { method: "setBlob", class: "PreparedStatement", removes: ["sql_injection"] },
12619
+ { method: "setClob", class: "PreparedStatement", removes: ["sql_injection"] },
12620
+ { method: "setNClob", class: "PreparedStatement", removes: ["sql_injection"] },
12621
+ { method: "setRef", class: "PreparedStatement", removes: ["sql_injection"] },
12622
+ { method: "setRowId", class: "PreparedStatement", removes: ["sql_injection"] },
12623
+ { method: "setSQLXML", class: "PreparedStatement", removes: ["sql_injection"] },
12624
+ { method: "setURL", class: "PreparedStatement", removes: ["sql_injection"] },
12625
+ { method: "setBinaryStream", class: "PreparedStatement", removes: ["sql_injection"] },
12626
+ { method: "setCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
12627
+ { method: "setAsciiStream", class: "PreparedStatement", removes: ["sql_injection"] },
12628
+ { method: "setNCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
12629
+ // JPA / Hibernate Query.setParameter — covered above; add TypedQuery
12630
+ // (same interface but distinct type name).
12574
12631
  { method: "setParameter", class: "Query", removes: ["sql_injection"] },
12632
+ { method: "setParameter", class: "TypedQuery", removes: ["sql_injection"] },
12633
+ // Spring JdbcTemplate `NamedParameterJdbcTemplate.update / queryForObject`
12634
+ // parameterized shapes use SqlParameterSource.addValue — the addValue
12635
+ // call binds the parameter safely.
12636
+ { method: "addValue", class: "MapSqlParameterSource", removes: ["sql_injection"] },
12575
12637
  { annotation: "Param", removes: ["sql_injection"] },
12576
12638
  // XSS
12577
12639
  { method: "escapeHtml", removes: ["xss"] },
@@ -12597,6 +12659,48 @@ var DEFAULT_SANITIZERS = [
12597
12659
  // Rust askama auto-escapes
12598
12660
  { method: "encodeForJavaScript", removes: ["xss"] },
12599
12661
  { method: "encodeForCSS", removes: ["xss"] },
12662
+ // Additional Java XSS sanitizers (cognium-dev #213 seventh slice).
12663
+ //
12664
+ // Guava `HtmlEscapers.htmlEscaper().escape(x)` — the `.escape` call
12665
+ // on the returned Escaper is caught by the generic `escape` rule
12666
+ // above, but explicit registration makes intent clear.
12667
+ // Spring `HtmlUtils.htmlEscape(x)` — htmlEscape already covered
12668
+ // above (bare method name).
12669
+ // Apache Commons Text `StringEscapeUtils.escapeJson / escapeXml11 /
12670
+ // escapeEcmaScript / escapeCsv / escapeXsi`.
12671
+ // OWASP HTML Sanitizer `PolicyFactory.sanitize(html)`.
12672
+ { method: "escape", class: "Escaper", removes: ["xss"] },
12673
+ { method: "escape", class: "HtmlEscapers", removes: ["xss"] },
12674
+ { method: "escapeJson", class: "StringEscapeUtils", removes: ["xss"] },
12675
+ { method: "escapeEcmaScript", class: "StringEscapeUtils", removes: ["xss"] },
12676
+ { method: "escapeXml11", class: "StringEscapeUtils", removes: ["xss"] },
12677
+ { method: "escapeXml10", class: "StringEscapeUtils", removes: ["xss"] },
12678
+ { method: "escapeCsv", class: "StringEscapeUtils", removes: ["xss"] },
12679
+ { method: "escapeXsi", class: "StringEscapeUtils", removes: ["xss"] },
12680
+ { method: "escapeJava", class: "StringEscapeUtils", removes: ["xss"] },
12681
+ // Bare escapeJson / escapeEcmaScript / escapeCsv aliases — common
12682
+ // when statically imported.
12683
+ { method: "escapeJson", removes: ["xss"] },
12684
+ { method: "escapeEcmaScript", removes: ["xss"] },
12685
+ { method: "escapeCsv", removes: ["xss"] },
12686
+ // OWASP HTML sanitizer (`com.googlecode.owasp-java-html-sanitizer`).
12687
+ { method: "sanitize", class: "PolicyFactory", removes: ["xss"] },
12688
+ // Java Base64 / Hex / MessageDigest — encoded output is binary-safe
12689
+ // (cognium-dev #213 seventh slice). None of these carry attacker
12690
+ // shell/SQL/HTML metacharacters through the encoding — Base64 emits
12691
+ // [A-Za-z0-9+/=], Hex emits [0-9a-f], MessageDigest.digest returns
12692
+ // opaque bytes usually toHex/toBase64-encoded downstream.
12693
+ { method: "encodeToString", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12694
+ { method: "encode", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12695
+ { method: "encodeHexString", class: "Hex", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12696
+ { method: "digest", class: "MessageDigest", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12697
+ // Bare aliases for encoder chains — `Base64.getEncoder().encodeToString(x)`
12698
+ // has a call-expression receiver (`Base64.getEncoder()`) that the Java IR
12699
+ // rarely resolves to `Encoder`. Same story for `Hex.encodeHexString(x)`
12700
+ // when Hex is imported. These bare-method names are dominated by their
12701
+ // encoding use in practice; false-positive risk is low.
12702
+ { method: "encodeToString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12703
+ { method: "encodeHexString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
12600
12704
  // cognium-dev #249 3.162.0: `open_redirect` restored to the URL-encoder
12601
12705
  // sanitizer cluster. Sprint 82 (#189) reclassified `sendRedirect` from
12602
12706
  // `ssrf` → `open_redirect` (config-loader.ts:1296-1299) without updating
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "circle-ir",
3
- "version": "3.186.0",
3
+ "version": "3.188.0",
4
4
  "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.js",