circle-ir 3.187.0 → 3.189.0

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAymB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2wDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+hBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAksB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2wDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+hBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -406,6 +406,29 @@ export const DEFAULT_SOURCES = [
     { annotation: 'Cookie', type: 'http_cookie', severity: 'high', param_tainted: true },
     { annotation: 'Form', type: 'http_param', severity: 'high', param_tainted: true },
     { annotation: 'File', type: 'file_input', severity: 'high', param_tainted: true },
+    // NestJS controller param decorators (cognium-dev #213 eighth slice).
+    //
+    // NestJS shares @Body/@Query/@Headers/@Body decorator names with FastAPI
+    // and Spring (covered above) but adds a few unique ones:
+    //   @Param('id') id: string             — route path parameter
+    //   @Req() / @Request() req: Request     — the whole request object
+    //   @Session() session: Session          — session data
+    //   @Ip() ip: string                      — client IP
+    //   @HostParam('subdomain') sub: string  — subdomain of `host` config
+    //   @UploadedFile() file: any             — multer-uploaded file
+    //   @UploadedFiles() files: any[]         — multer multi-file
+    //   @Next()                               — not a source (Express next-fn)
+    // Registered without a `languages:` filter so they also credit the shared
+    // decorator names in TypeScript (nestjs is TS-first) and any JS project
+    // adopting the convention.
+    { annotation: 'Param', type: 'http_path', severity: 'high', param_tainted: true },
+    { annotation: 'Req', type: 'http_body', severity: 'high', param_tainted: true },
+    { annotation: 'Request', type: 'http_body', severity: 'high', param_tainted: true },
+    { annotation: 'Session', type: 'http_cookie', severity: 'high', param_tainted: true },
+    { annotation: 'Ip', type: 'network_input', severity: 'high', param_tainted: true },
+    { annotation: 'HostParam', type: 'http_path', severity: 'high', param_tainted: true },
+    { annotation: 'UploadedFile', type: 'file_input', severity: 'high', param_tainted: true },
+    { annotation: 'UploadedFiles', type: 'file_input', severity: 'high', param_tainted: true },
     // FastAPI Request object
     { method: 'json', class: 'Request', type: 'http_body', severity: 'high', return_tainted: true },
     { method: 'form', class: 'Request', type: 'http_param', severity: 'high', return_tainted: true },
@@ -507,6 +530,71 @@ export const DEFAULT_SOURCES = [
     { method_annotation: 'GraphQLMutation', type: 'http_body', severity: 'high', languages: ['java'] },
     { annotation: 'InputArgument', type: 'http_param', severity: 'high', param_tainted: true, languages: ['java'] },
     { annotation: 'GraphQLArgument', type: 'http_param', severity: 'high', param_tainted: true, languages: ['java'] },
+    // --- Go web framework sources (cognium-dev #213 ninth slice) ---
+    //
+    // Gin `c.Query("id")` / `c.Param("id")` / `c.PostForm("k")` /
+    //     `c.GetHeader("H")` / `c.Cookie("c")` / `c.FormFile("f")`.
+    //     Also body binders: `c.BindJSON(&d)` / `c.ShouldBindJSON(&d)` /
+    //     `c.Bind(&d)`. Class-scoped to `Context` — the Go local-receiver
+    //     resolver from #240 3.177.0 puts the resolved type into the
+    //     `receiver` field so class-matching works for `func h(c *gin.Context)`.
+    //
+    // Echo `c.QueryParam("id")` / `c.QueryParams()` / `c.Param("id")` /
+    //     `c.FormValue("k")` / `c.FormParams()` / `c.Request().Header` /
+    //     `c.Cookie("c")` / `c.Bind(&d)`.
+    //
+    // Fiber `c.Query("id")` / `c.Params("id")` / `c.FormValue("k")` /
+    //     `c.Cookies("c")` / `c.Get("H")` / `c.Body()` / `c.BodyParser(&d)`.
+    //     Distinct receiver type `*fiber.Ctx` — separate class entries.
+    //
+    // Chi `chi.URLParam(r, "id")` — package-level call, matched via
+    //     bare-import resolution in matchesSourcePattern.
+    //
+    // Beego `ctx.Input.Query(...)` — `Input` is a struct, so `.Query`
+    //     matches on `Input` class.
+    //
+    // Gorilla mux `mux.Vars(r)` — returns map of path vars.
+    { method: 'Query', class: 'Context', type: 'http_param', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'Param', class: 'Context', type: 'http_path', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'PostForm', class: 'Context', type: 'http_body', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'GetHeader', class: 'Context', type: 'http_header', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'Cookie', class: 'Context', type: 'http_cookie', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'FormFile', class: 'Context', type: 'file_input', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'BindJSON', class: 'Context', type: 'http_body', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'ShouldBindJSON', class: 'Context', type: 'http_body', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'Bind', class: 'Context', type: 'http_body', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'BindQuery', class: 'Context', type: 'http_param', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'ShouldBindQuery', class: 'Context', type: 'http_param', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'BindUri', class: 'Context', type: 'http_path', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'ShouldBindUri', class: 'Context', type: 'http_path', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'MultipartForm', class: 'Context', type: 'http_body', severity: 'high', return_tainted: true, languages: ['go'] },
+    // Echo — QueryParam/QueryParams are Echo-distinctive.
+    { method: 'QueryParam', class: 'Context', type: 'http_param', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'QueryParams', class: 'Context', type: 'http_param', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'FormValue', class: 'Context', type: 'http_body', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'FormParams', class: 'Context', type: 'http_body', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'FormFile', class: 'Context', type: 'file_input', severity: 'high', return_tainted: true, languages: ['go'] },
+    // Fiber — receiver type is `*fiber.Ctx`, distinct class name.
+    { method: 'Query', class: 'Ctx', type: 'http_param', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'Params', class: 'Ctx', type: 'http_path', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'FormValue', class: 'Ctx', type: 'http_body', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'FormFile', class: 'Ctx', type: 'file_input', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'Cookies', class: 'Ctx', type: 'http_cookie', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'Get', class: 'Ctx', type: 'http_header', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'Body', class: 'Ctx', type: 'http_body', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'BodyParser', class: 'Ctx', type: 'http_body', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'QueryParser', class: 'Ctx', type: 'http_param', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'ParamsParser', class: 'Ctx', type: 'http_path', severity: 'high', return_tainted: true, languages: ['go'] },
+    // Chi package-level path param.
+    { method: 'URLParam', class: 'chi', type: 'http_path', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'URLParamFromCtx', class: 'chi', type: 'http_path', severity: 'high', return_tainted: true, languages: ['go'] },
+    // Gorilla mux path vars.
+    { method: 'Vars', class: 'mux', type: 'http_path', severity: 'high', return_tainted: true, languages: ['go'] },
+    // Beego — `ctx.Input.Query(...)` etc. `Input` is a struct field on Context.
+    { method: 'Query', class: 'Input', type: 'http_param', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'Param', class: 'Input', type: 'http_path', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'Header', class: 'Input', type: 'http_header', severity: 'high', return_tainted: true, languages: ['go'] },
+    { method: 'Cookie', class: 'Input', type: 'http_cookie', severity: 'high', return_tainted: true, languages: ['go'] },
     // --- gRPC request metadata (Python — grpcio) ---
     // `context.invocation_metadata()` returns the caller-supplied metadata tuple.
     // No `class` filter — receiver names vary (`context`, `ctx`, `servicer_context`).