circle-ir 3.187.0 → 3.189.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/dist/analysis/config-loader.d.ts.map +1 -1
  2. package/dist/analysis/config-loader.js +88 -0
  3. package/dist/analysis/config-loader.js.map +1 -1
  4. package/dist/browser/circle-ir.js +116 -1
  5. package/dist/core/circle-ir-core.cjs +116 -1
  6. package/dist/core/circle-ir-core.js +116 -1
  7. package/dist/core/extractors/dfg.js +24 -0
  8. package/dist/core/extractors/dfg.js.map +1 -1
  9. package/package.json +1 -1
package/dist/browser/circle-ir.js CHANGED
@@ -10134,7 +10134,34 @@ var GO_OPAQUE_CODEC_METHODS = /* @__PURE__ */ new Set([
10134
10134
  "UnmarshalYAML",
10135
10135
  "UnmarshalJSON",
10136
10136
  "UnmarshalText",
10137
- "UnmarshalBinary"
10137
+ "UnmarshalBinary",
10138
+ // Go web framework body binders (cognium-dev #213 ninth slice).
10139
+ // `c.BindJSON(&q)` / `c.BodyParser(&q)` / `c.Bind(&q)` /
10140
+ // `c.ShouldBindJSON(&q)` / `c.BindQuery(&q)` etc. populate `q` via
10141
+ // reflection from the HTTP request body — same shape as
10142
+ // json.Unmarshal so we model them as a dest re-def on the call line.
10143
+ // Same source-side entries in DEFAULT_SOURCES flag the return, but
10144
+ // the destination-through-pointer shape needs this DFG hook.
10145
+ "BindJSON",
10146
+ "ShouldBindJSON",
10147
+ "Bind",
10148
+ "ShouldBind",
10149
+ "BindQuery",
10150
+ "ShouldBindQuery",
10151
+ "BindUri",
10152
+ "ShouldBindUri",
10153
+ "BindXML",
10154
+ "ShouldBindXML",
10155
+ "BindYAML",
10156
+ "ShouldBindYAML",
10157
+ "BindHeader",
10158
+ "ShouldBindHeader",
10159
+ "BodyParser",
10160
+ // Fiber
10161
+ "QueryParser",
10162
+ // Fiber
10163
+ "ParamsParser"
10164
+ // Fiber
10138
10165
  ]);
10139
10166
  function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
10140
10167
  const fn = call.childForFieldName("function");
@@ -11210,6 +11237,29 @@ var DEFAULT_SOURCES = [
11210
11237
  { annotation: "Cookie", type: "http_cookie", severity: "high", param_tainted: true },
11211
11238
  { annotation: "Form", type: "http_param", severity: "high", param_tainted: true },
11212
11239
  { annotation: "File", type: "file_input", severity: "high", param_tainted: true },
11240
+ // NestJS controller param decorators (cognium-dev #213 eighth slice).
11241
+ //
11242
+ // NestJS shares @Body/@Query/@Headers/@Body decorator names with FastAPI
11243
+ // and Spring (covered above) but adds a few unique ones:
11244
+ // @Param('id') id: string — route path parameter
11245
+ // @Req() / @Request() req: Request — the whole request object
11246
+ // @Session() session: Session — session data
11247
+ // @Ip() ip: string — client IP
11248
+ // @HostParam('subdomain') sub: string — subdomain of `host` config
11249
+ // @UploadedFile() file: any — multer-uploaded file
11250
+ // @UploadedFiles() files: any[] — multer multi-file
11251
+ // @Next() — not a source (Express next-fn)
11252
+ // Registered without a `languages:` filter so they also credit the shared
11253
+ // decorator names in TypeScript (nestjs is TS-first) and any JS project
11254
+ // adopting the convention.
11255
+ { annotation: "Param", type: "http_path", severity: "high", param_tainted: true },
11256
+ { annotation: "Req", type: "http_body", severity: "high", param_tainted: true },
11257
+ { annotation: "Request", type: "http_body", severity: "high", param_tainted: true },
11258
+ { annotation: "Session", type: "http_cookie", severity: "high", param_tainted: true },
11259
+ { annotation: "Ip", type: "network_input", severity: "high", param_tainted: true },
11260
+ { annotation: "HostParam", type: "http_path", severity: "high", param_tainted: true },
11261
+ { annotation: "UploadedFile", type: "file_input", severity: "high", param_tainted: true },
11262
+ { annotation: "UploadedFiles", type: "file_input", severity: "high", param_tainted: true },
11213
11263
  // FastAPI Request object
11214
11264
  { method: "json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
11215
11265
  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
@@ -11311,6 +11361,71 @@ var DEFAULT_SOURCES = [
11311
11361
  { method_annotation: "GraphQLMutation", type: "http_body", severity: "high", languages: ["java"] },
11312
11362
  { annotation: "InputArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
11313
11363
  { annotation: "GraphQLArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
11364
+ // --- Go web framework sources (cognium-dev #213 ninth slice) ---
11365
+ //
11366
+ // Gin `c.Query("id")` / `c.Param("id")` / `c.PostForm("k")` /
11367
+ // `c.GetHeader("H")` / `c.Cookie("c")` / `c.FormFile("f")`.
11368
+ // Also body binders: `c.BindJSON(&d)` / `c.ShouldBindJSON(&d)` /
11369
+ // `c.Bind(&d)`. Class-scoped to `Context` — the Go local-receiver
11370
+ // resolver from #240 3.177.0 puts the resolved type into the
11371
+ // `receiver` field so class-matching works for `func h(c *gin.Context)`.
11372
+ //
11373
+ // Echo `c.QueryParam("id")` / `c.QueryParams()` / `c.Param("id")` /
11374
+ // `c.FormValue("k")` / `c.FormParams()` / `c.Request().Header` /
11375
+ // `c.Cookie("c")` / `c.Bind(&d)`.
11376
+ //
11377
+ // Fiber `c.Query("id")` / `c.Params("id")` / `c.FormValue("k")` /
11378
+ // `c.Cookies("c")` / `c.Get("H")` / `c.Body()` / `c.BodyParser(&d)`.
11379
+ // Distinct receiver type `*fiber.Ctx` — separate class entries.
11380
+ //
11381
+ // Chi `chi.URLParam(r, "id")` — package-level call, matched via
11382
+ // bare-import resolution in matchesSourcePattern.
11383
+ //
11384
+ // Beego `ctx.Input.Query(...)` — `Input` is a struct, so `.Query`
11385
+ // matches on `Input` class.
11386
+ //
11387
+ // Gorilla mux `mux.Vars(r)` — returns map of path vars.
11388
+ { method: "Query", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
11389
+ { method: "Param", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
11390
+ { method: "PostForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
11391
+ { method: "GetHeader", class: "Context", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
11392
+ { method: "Cookie", class: "Context", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
11393
+ { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
11394
+ { method: "BindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
11395
+ { method: "ShouldBindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
11396
+ { method: "Bind", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
11397
+ { method: "BindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
11398
+ { method: "ShouldBindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
11399
+ { method: "BindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
11400
+ { method: "ShouldBindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
11401
+ { method: "MultipartForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
11402
+ // Echo — QueryParam/QueryParams are Echo-distinctive.
11403
+ { method: "QueryParam", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
11404
+ { method: "QueryParams", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
11405
+ { method: "FormValue", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
11406
+ { method: "FormParams", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
11407
+ { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
11408
+ // Fiber — receiver type is `*fiber.Ctx`, distinct class name.
11409
+ { method: "Query", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
11410
+ { method: "Params", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
11411
+ { method: "FormValue", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
11412
+ { method: "FormFile", class: "Ctx", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
11413
+ { method: "Cookies", class: "Ctx", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
11414
+ { method: "Get", class: "Ctx", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
11415
+ { method: "Body", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
11416
+ { method: "BodyParser", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
11417
+ { method: "QueryParser", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
11418
+ { method: "ParamsParser", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
11419
+ // Chi package-level path param.
11420
+ { method: "URLParam", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
11421
+ { method: "URLParamFromCtx", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
11422
+ // Gorilla mux path vars.
11423
+ { method: "Vars", class: "mux", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
11424
+ // Beego — `ctx.Input.Query(...)` etc. `Input` is a struct field on Context.
11425
+ { method: "Query", class: "Input", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
11426
+ { method: "Param", class: "Input", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
11427
+ { method: "Header", class: "Input", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
11428
+ { method: "Cookie", class: "Input", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
11314
11429
  // --- gRPC request metadata (Python — grpcio) ---
11315
11430
  // `context.invocation_metadata()` returns the caller-supplied metadata tuple.
11316
11431
  // No `class` filter — receiver names vary (`context`, `ctx`, `servicer_context`).
package/dist/core/circle-ir-core.cjs CHANGED
@@ -10180,7 +10180,34 @@ var GO_OPAQUE_CODEC_METHODS = /* @__PURE__ */ new Set([
10180
10180
  "UnmarshalYAML",
10181
10181
  "UnmarshalJSON",
10182
10182
  "UnmarshalText",
10183
- "UnmarshalBinary"
10183
+ "UnmarshalBinary",
10184
+ // Go web framework body binders (cognium-dev #213 ninth slice).
10185
+ // `c.BindJSON(&q)` / `c.BodyParser(&q)` / `c.Bind(&q)` /
10186
+ // `c.ShouldBindJSON(&q)` / `c.BindQuery(&q)` etc. populate `q` via
10187
+ // reflection from the HTTP request body — same shape as
10188
+ // json.Unmarshal so we model them as a dest re-def on the call line.
10189
+ // Same source-side entries in DEFAULT_SOURCES flag the return, but
10190
+ // the destination-through-pointer shape needs this DFG hook.
10191
+ "BindJSON",
10192
+ "ShouldBindJSON",
10193
+ "Bind",
10194
+ "ShouldBind",
10195
+ "BindQuery",
10196
+ "ShouldBindQuery",
10197
+ "BindUri",
10198
+ "ShouldBindUri",
10199
+ "BindXML",
10200
+ "ShouldBindXML",
10201
+ "BindYAML",
10202
+ "ShouldBindYAML",
10203
+ "BindHeader",
10204
+ "ShouldBindHeader",
10205
+ "BodyParser",
10206
+ // Fiber
10207
+ "QueryParser",
10208
+ // Fiber
10209
+ "ParamsParser"
10210
+ // Fiber
10184
10211
  ]);
10185
10212
  function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
10186
10213
  const fn = call.childForFieldName("function");
@@ -10605,6 +10632,29 @@ var DEFAULT_SOURCES = [
10605
10632
  { annotation: "Cookie", type: "http_cookie", severity: "high", param_tainted: true },
10606
10633
  { annotation: "Form", type: "http_param", severity: "high", param_tainted: true },
10607
10634
  { annotation: "File", type: "file_input", severity: "high", param_tainted: true },
10635
+ // NestJS controller param decorators (cognium-dev #213 eighth slice).
10636
+ //
10637
+ // NestJS shares @Body/@Query/@Headers/@Body decorator names with FastAPI
10638
+ // and Spring (covered above) but adds a few unique ones:
10639
+ // @Param('id') id: string — route path parameter
10640
+ // @Req() / @Request() req: Request — the whole request object
10641
+ // @Session() session: Session — session data
10642
+ // @Ip() ip: string — client IP
10643
+ // @HostParam('subdomain') sub: string — subdomain of `host` config
10644
+ // @UploadedFile() file: any — multer-uploaded file
10645
+ // @UploadedFiles() files: any[] — multer multi-file
10646
+ // @Next() — not a source (Express next-fn)
10647
+ // Registered without a `languages:` filter so they also credit the shared
10648
+ // decorator names in TypeScript (nestjs is TS-first) and any JS project
10649
+ // adopting the convention.
10650
+ { annotation: "Param", type: "http_path", severity: "high", param_tainted: true },
10651
+ { annotation: "Req", type: "http_body", severity: "high", param_tainted: true },
10652
+ { annotation: "Request", type: "http_body", severity: "high", param_tainted: true },
10653
+ { annotation: "Session", type: "http_cookie", severity: "high", param_tainted: true },
10654
+ { annotation: "Ip", type: "network_input", severity: "high", param_tainted: true },
10655
+ { annotation: "HostParam", type: "http_path", severity: "high", param_tainted: true },
10656
+ { annotation: "UploadedFile", type: "file_input", severity: "high", param_tainted: true },
10657
+ { annotation: "UploadedFiles", type: "file_input", severity: "high", param_tainted: true },
10608
10658
  // FastAPI Request object
10609
10659
  { method: "json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
10610
10660
  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
@@ -10706,6 +10756,71 @@ var DEFAULT_SOURCES = [
10706
10756
  { method_annotation: "GraphQLMutation", type: "http_body", severity: "high", languages: ["java"] },
10707
10757
  { annotation: "InputArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
10708
10758
  { annotation: "GraphQLArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
10759
+ // --- Go web framework sources (cognium-dev #213 ninth slice) ---
10760
+ //
10761
+ // Gin `c.Query("id")` / `c.Param("id")` / `c.PostForm("k")` /
10762
+ // `c.GetHeader("H")` / `c.Cookie("c")` / `c.FormFile("f")`.
10763
+ // Also body binders: `c.BindJSON(&d)` / `c.ShouldBindJSON(&d)` /
10764
+ // `c.Bind(&d)`. Class-scoped to `Context` — the Go local-receiver
10765
+ // resolver from #240 3.177.0 puts the resolved type into the
10766
+ // `receiver` field so class-matching works for `func h(c *gin.Context)`.
10767
+ //
10768
+ // Echo `c.QueryParam("id")` / `c.QueryParams()` / `c.Param("id")` /
10769
+ // `c.FormValue("k")` / `c.FormParams()` / `c.Request().Header` /
10770
+ // `c.Cookie("c")` / `c.Bind(&d)`.
10771
+ //
10772
+ // Fiber `c.Query("id")` / `c.Params("id")` / `c.FormValue("k")` /
10773
+ // `c.Cookies("c")` / `c.Get("H")` / `c.Body()` / `c.BodyParser(&d)`.
10774
+ // Distinct receiver type `*fiber.Ctx` — separate class entries.
10775
+ //
10776
+ // Chi `chi.URLParam(r, "id")` — package-level call, matched via
10777
+ // bare-import resolution in matchesSourcePattern.
10778
+ //
10779
+ // Beego `ctx.Input.Query(...)` — `Input` is a struct, so `.Query`
10780
+ // matches on `Input` class.
10781
+ //
10782
+ // Gorilla mux `mux.Vars(r)` — returns map of path vars.
10783
+ { method: "Query", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10784
+ { method: "Param", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10785
+ { method: "PostForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10786
+ { method: "GetHeader", class: "Context", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
10787
+ { method: "Cookie", class: "Context", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
10788
+ { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
10789
+ { method: "BindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10790
+ { method: "ShouldBindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10791
+ { method: "Bind", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10792
+ { method: "BindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10793
+ { method: "ShouldBindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10794
+ { method: "BindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10795
+ { method: "ShouldBindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10796
+ { method: "MultipartForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10797
+ // Echo — QueryParam/QueryParams are Echo-distinctive.
10798
+ { method: "QueryParam", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10799
+ { method: "QueryParams", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10800
+ { method: "FormValue", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10801
+ { method: "FormParams", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10802
+ { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
10803
+ // Fiber — receiver type is `*fiber.Ctx`, distinct class name.
10804
+ { method: "Query", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10805
+ { method: "Params", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10806
+ { method: "FormValue", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10807
+ { method: "FormFile", class: "Ctx", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
10808
+ { method: "Cookies", class: "Ctx", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
10809
+ { method: "Get", class: "Ctx", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
10810
+ { method: "Body", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10811
+ { method: "BodyParser", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10812
+ { method: "QueryParser", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10813
+ { method: "ParamsParser", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10814
+ // Chi package-level path param.
10815
+ { method: "URLParam", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10816
+ { method: "URLParamFromCtx", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10817
+ // Gorilla mux path vars.
10818
+ { method: "Vars", class: "mux", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10819
+ // Beego — `ctx.Input.Query(...)` etc. `Input` is a struct field on Context.
10820
+ { method: "Query", class: "Input", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10821
+ { method: "Param", class: "Input", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10822
+ { method: "Header", class: "Input", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
10823
+ { method: "Cookie", class: "Input", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
10709
10824
  // --- gRPC request metadata (Python — grpcio) ---
10710
10825
  // `context.invocation_metadata()` returns the caller-supplied metadata tuple.
10711
10826
  // No `class` filter — receiver names vary (`context`, `ctx`, `servicer_context`).
package/dist/core/circle-ir-core.js CHANGED
@@ -10114,7 +10114,34 @@ var GO_OPAQUE_CODEC_METHODS = /* @__PURE__ */ new Set([
10114
10114
  "UnmarshalYAML",
10115
10115
  "UnmarshalJSON",
10116
10116
  "UnmarshalText",
10117
- "UnmarshalBinary"
10117
+ "UnmarshalBinary",
10118
+ // Go web framework body binders (cognium-dev #213 ninth slice).
10119
+ // `c.BindJSON(&q)` / `c.BodyParser(&q)` / `c.Bind(&q)` /
10120
+ // `c.ShouldBindJSON(&q)` / `c.BindQuery(&q)` etc. populate `q` via
10121
+ // reflection from the HTTP request body — same shape as
10122
+ // json.Unmarshal so we model them as a dest re-def on the call line.
10123
+ // Same source-side entries in DEFAULT_SOURCES flag the return, but
10124
+ // the destination-through-pointer shape needs this DFG hook.
10125
+ "BindJSON",
10126
+ "ShouldBindJSON",
10127
+ "Bind",
10128
+ "ShouldBind",
10129
+ "BindQuery",
10130
+ "ShouldBindQuery",
10131
+ "BindUri",
10132
+ "ShouldBindUri",
10133
+ "BindXML",
10134
+ "ShouldBindXML",
10135
+ "BindYAML",
10136
+ "ShouldBindYAML",
10137
+ "BindHeader",
10138
+ "ShouldBindHeader",
10139
+ "BodyParser",
10140
+ // Fiber
10141
+ "QueryParser",
10142
+ // Fiber
10143
+ "ParamsParser"
10144
+ // Fiber
10118
10145
  ]);
10119
10146
  function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
10120
10147
  const fn = call.childForFieldName("function");
@@ -10539,6 +10566,29 @@ var DEFAULT_SOURCES = [
10539
10566
  { annotation: "Cookie", type: "http_cookie", severity: "high", param_tainted: true },
10540
10567
  { annotation: "Form", type: "http_param", severity: "high", param_tainted: true },
10541
10568
  { annotation: "File", type: "file_input", severity: "high", param_tainted: true },
10569
+ // NestJS controller param decorators (cognium-dev #213 eighth slice).
10570
+ //
10571
+ // NestJS shares @Body/@Query/@Headers/@Body decorator names with FastAPI
10572
+ // and Spring (covered above) but adds a few unique ones:
10573
+ // @Param('id') id: string — route path parameter
10574
+ // @Req() / @Request() req: Request — the whole request object
10575
+ // @Session() session: Session — session data
10576
+ // @Ip() ip: string — client IP
10577
+ // @HostParam('subdomain') sub: string — subdomain of `host` config
10578
+ // @UploadedFile() file: any — multer-uploaded file
10579
+ // @UploadedFiles() files: any[] — multer multi-file
10580
+ // @Next() — not a source (Express next-fn)
10581
+ // Registered without a `languages:` filter so they also credit the shared
10582
+ // decorator names in TypeScript (nestjs is TS-first) and any JS project
10583
+ // adopting the convention.
10584
+ { annotation: "Param", type: "http_path", severity: "high", param_tainted: true },
10585
+ { annotation: "Req", type: "http_body", severity: "high", param_tainted: true },
10586
+ { annotation: "Request", type: "http_body", severity: "high", param_tainted: true },
10587
+ { annotation: "Session", type: "http_cookie", severity: "high", param_tainted: true },
10588
+ { annotation: "Ip", type: "network_input", severity: "high", param_tainted: true },
10589
+ { annotation: "HostParam", type: "http_path", severity: "high", param_tainted: true },
10590
+ { annotation: "UploadedFile", type: "file_input", severity: "high", param_tainted: true },
10591
+ { annotation: "UploadedFiles", type: "file_input", severity: "high", param_tainted: true },
10542
10592
  // FastAPI Request object
10543
10593
  { method: "json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
10544
10594
  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
@@ -10640,6 +10690,71 @@ var DEFAULT_SOURCES = [
10640
10690
  { method_annotation: "GraphQLMutation", type: "http_body", severity: "high", languages: ["java"] },
10641
10691
  { annotation: "InputArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
10642
10692
  { annotation: "GraphQLArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
10693
+ // --- Go web framework sources (cognium-dev #213 ninth slice) ---
10694
+ //
10695
+ // Gin `c.Query("id")` / `c.Param("id")` / `c.PostForm("k")` /
10696
+ // `c.GetHeader("H")` / `c.Cookie("c")` / `c.FormFile("f")`.
10697
+ // Also body binders: `c.BindJSON(&d)` / `c.ShouldBindJSON(&d)` /
10698
+ // `c.Bind(&d)`. Class-scoped to `Context` — the Go local-receiver
10699
+ // resolver from #240 3.177.0 puts the resolved type into the
10700
+ // `receiver` field so class-matching works for `func h(c *gin.Context)`.
10701
+ //
10702
+ // Echo `c.QueryParam("id")` / `c.QueryParams()` / `c.Param("id")` /
10703
+ // `c.FormValue("k")` / `c.FormParams()` / `c.Request().Header` /
10704
+ // `c.Cookie("c")` / `c.Bind(&d)`.
10705
+ //
10706
+ // Fiber `c.Query("id")` / `c.Params("id")` / `c.FormValue("k")` /
10707
+ // `c.Cookies("c")` / `c.Get("H")` / `c.Body()` / `c.BodyParser(&d)`.
10708
+ // Distinct receiver type `*fiber.Ctx` — separate class entries.
10709
+ //
10710
+ // Chi `chi.URLParam(r, "id")` — package-level call, matched via
10711
+ // bare-import resolution in matchesSourcePattern.
10712
+ //
10713
+ // Beego `ctx.Input.Query(...)` — `Input` is a struct, so `.Query`
10714
+ // matches on `Input` class.
10715
+ //
10716
+ // Gorilla mux `mux.Vars(r)` — returns map of path vars.
10717
+ { method: "Query", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10718
+ { method: "Param", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10719
+ { method: "PostForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10720
+ { method: "GetHeader", class: "Context", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
10721
+ { method: "Cookie", class: "Context", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
10722
+ { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
10723
+ { method: "BindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10724
+ { method: "ShouldBindJSON", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10725
+ { method: "Bind", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10726
+ { method: "BindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10727
+ { method: "ShouldBindQuery", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10728
+ { method: "BindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10729
+ { method: "ShouldBindUri", class: "Context", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10730
+ { method: "MultipartForm", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10731
+ // Echo — QueryParam/QueryParams are Echo-distinctive.
10732
+ { method: "QueryParam", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10733
+ { method: "QueryParams", class: "Context", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10734
+ { method: "FormValue", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10735
+ { method: "FormParams", class: "Context", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10736
+ { method: "FormFile", class: "Context", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
10737
+ // Fiber — receiver type is `*fiber.Ctx`, distinct class name.
10738
+ { method: "Query", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10739
+ { method: "Params", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10740
+ { method: "FormValue", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10741
+ { method: "FormFile", class: "Ctx", type: "file_input", severity: "high", return_tainted: true, languages: ["go"] },
10742
+ { method: "Cookies", class: "Ctx", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
10743
+ { method: "Get", class: "Ctx", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
10744
+ { method: "Body", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10745
+ { method: "BodyParser", class: "Ctx", type: "http_body", severity: "high", return_tainted: true, languages: ["go"] },
10746
+ { method: "QueryParser", class: "Ctx", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10747
+ { method: "ParamsParser", class: "Ctx", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10748
+ // Chi package-level path param.
10749
+ { method: "URLParam", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10750
+ { method: "URLParamFromCtx", class: "chi", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10751
+ // Gorilla mux path vars.
10752
+ { method: "Vars", class: "mux", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10753
+ // Beego — `ctx.Input.Query(...)` etc. `Input` is a struct field on Context.
10754
+ { method: "Query", class: "Input", type: "http_param", severity: "high", return_tainted: true, languages: ["go"] },
10755
+ { method: "Param", class: "Input", type: "http_path", severity: "high", return_tainted: true, languages: ["go"] },
10756
+ { method: "Header", class: "Input", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
10757
+ { method: "Cookie", class: "Input", type: "http_cookie", severity: "high", return_tainted: true, languages: ["go"] },
10643
10758
  // --- gRPC request metadata (Python — grpcio) ---
10644
10759
  // `context.invocation_metadata()` returns the caller-supplied metadata tuple.
10645
10760
  // No `class` filter — receiver names vary (`context`, `ctx`, `servicer_context`).
package/dist/core/extractors/dfg.js CHANGED
@@ -1546,6 +1546,30 @@ const GO_OPAQUE_CODEC_METHODS = new Set([
1546
1546
  'UnmarshalJSON',
1547
1547
  'UnmarshalText',
1548
1548
  'UnmarshalBinary',
1549
+ // Go web framework body binders (cognium-dev #213 ninth slice).
1550
+ // `c.BindJSON(&q)` / `c.BodyParser(&q)` / `c.Bind(&q)` /
1551
+ // `c.ShouldBindJSON(&q)` / `c.BindQuery(&q)` etc. populate `q` via
1552
+ // reflection from the HTTP request body — same shape as
1553
+ // json.Unmarshal so we model them as a dest re-def on the call line.
1554
+ // Same source-side entries in DEFAULT_SOURCES flag the return, but
1555
+ // the destination-through-pointer shape needs this DFG hook.
1556
+ 'BindJSON',
1557
+ 'ShouldBindJSON',
1558
+ 'Bind',
1559
+ 'ShouldBind',
1560
+ 'BindQuery',
1561
+ 'ShouldBindQuery',
1562
+ 'BindUri',
1563
+ 'ShouldBindUri',
1564
+ 'BindXML',
1565
+ 'ShouldBindXML',
1566
+ 'BindYAML',
1567
+ 'ShouldBindYAML',
1568
+ 'BindHeader',
1569
+ 'ShouldBindHeader',
1570
+ 'BodyParser', // Fiber
1571
+ 'QueryParser', // Fiber
1572
+ 'ParamsParser', // Fiber
1549
1573
  ]);
1550
1574
  function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
1551
1575
  // Only handle direct selector calls: `pkg.Method(...)` or `receiver.Decode(...)`.