circle-ir 3.189.0 → 3.190.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/dist/analysis/config-loader.d.ts.map +1 -1
  2. package/dist/analysis/config-loader.js +21 -0
  3. package/dist/analysis/config-loader.js.map +1 -1
  4. package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
  5. package/dist/analysis/passes/language-sources-pass.js +22 -0
  6. package/dist/analysis/passes/language-sources-pass.js.map +1 -1
  7. package/dist/browser/circle-ir.js +44 -1
  8. package/dist/core/circle-ir-core.cjs +21 -0
  9. package/dist/core/circle-ir-core.js +21 -0
  10. package/package.json +1 -1
package/dist/browser/circle-ir.js CHANGED
@@ -11502,6 +11502,27 @@ var DEFAULT_SOURCES = [
11502
11502
  { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
11503
11503
  { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
11504
11504
  { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
11505
+ // --- Modern JS/TS framework sources (cognium-dev #213 tenth slice) ---
11506
+ //
11507
+ // NextJS App Router: `req.nextUrl` is a NextURL instance whose
11508
+ // `.searchParams`, `.pathname`, `.hash` carry attacker-controlled
11509
+ // request state.
11510
+ // req.nextUrl.searchParams.get('id')
11511
+ // req.nextUrl.pathname
11512
+ { property: "nextUrl", object: "req", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
11513
+ { property: "nextUrl", object: "request", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
11514
+ // Angular ActivatedRoute: `route.snapshot.params` / `queryParams` /
11515
+ // `data`, and `route.paramMap` (Observable-based) are the two
11516
+ // idioms for reading URL params.
11517
+ { property: "snapshot", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
11518
+ { property: "paramMap", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
11519
+ { property: "queryParamMap", object: "route", type: "http_param", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
11520
+ // Remix / SvelteKit / Astro / Bun / Deno all destructure `{ params, request, url }`
11521
+ // from a handler-args object. Registering `params` / `url` /
11522
+ // `searchParams` as unqualified properties would over-fire; instead
11523
+ // add regex-based coverage in language-sources-pass.ts so the
11524
+ // taint enters only through the specific request-URL chain
11525
+ // (`url.searchParams.get(...)`, `event.url.pathname`).
11505
11526
  // --- Serverless transport channels (cognium-dev #213 first slice) ---
11506
11527
  //
11507
11528
  // AWS Lambda / API Gateway invocation-event properties. The Lambda
@@ -26006,7 +26027,29 @@ var JS_TAINTED_PATTERNS = [
26006
26027
  { pattern: /\bevent\.multiValueQueryStringParameters\b/, type: "http_param" },
26007
26028
  { pattern: /\bevent\.pathParameters\b/, type: "http_path" },
26008
26029
  { pattern: /\bevent\.headers\b/, type: "http_header" },
26009
- { pattern: /\bevent\.multiValueHeaders\b/, type: "http_header" }
26030
+ { pattern: /\bevent\.multiValueHeaders\b/, type: "http_header" },
26031
+ // Modern JS/TS framework request-URL / route-args (cognium-dev #213
26032
+ // tenth slice). Scoped enough to avoid unrelated code:
26033
+ //
26034
+ // NextJS App Router: req.nextUrl.searchParams
26035
+ // req.nextUrl.pathname
26036
+ // Remix: params.<id> from ({ params, request })
26037
+ // new URL(request.url).searchParams
26038
+ // SvelteKit: event.params.<id>
26039
+ // event.url.searchParams
26040
+ // event.request.formData()
26041
+ // Angular: route.snapshot.params
26042
+ // route.snapshot.queryParams
26043
+ // route.paramMap.get(...)
26044
+ { pattern: /\breq(?:uest)?\.nextUrl\b/, type: "http_body" },
26045
+ { pattern: /\.searchParams\s*\.\s*get\b/, type: "http_param" },
26046
+ { pattern: /\bevent\.params\b/, type: "http_path" },
26047
+ { pattern: /\bevent\.url\b/, type: "http_body" },
26048
+ { pattern: /\bevent\.request\b/, type: "http_body" },
26049
+ { pattern: /\broute\.snapshot\.params\b/, type: "http_path" },
26050
+ { pattern: /\broute\.snapshot\.queryParams\b/, type: "http_param" },
26051
+ { pattern: /\broute\.paramMap\b/, type: "http_path" },
26052
+ { pattern: /\broute\.queryParamMap\b/, type: "http_param" }
26010
26053
  ];
26011
26054
  var PYTHON_TAINTED_PATTERNS2 = [
26012
26055
  { pattern: /\brequest\.args\b/, type: "http_param" },
package/dist/core/circle-ir-core.cjs CHANGED
@@ -10897,6 +10897,27 @@ var DEFAULT_SOURCES = [
10897
10897
  { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
10898
10898
  { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
10899
10899
  { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
10900
+ // --- Modern JS/TS framework sources (cognium-dev #213 tenth slice) ---
10901
+ //
10902
+ // NextJS App Router: `req.nextUrl` is a NextURL instance whose
10903
+ // `.searchParams`, `.pathname`, `.hash` carry attacker-controlled
10904
+ // request state.
10905
+ // req.nextUrl.searchParams.get('id')
10906
+ // req.nextUrl.pathname
10907
+ { property: "nextUrl", object: "req", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
10908
+ { property: "nextUrl", object: "request", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
10909
+ // Angular ActivatedRoute: `route.snapshot.params` / `queryParams` /
10910
+ // `data`, and `route.paramMap` (Observable-based) are the two
10911
+ // idioms for reading URL params.
10912
+ { property: "snapshot", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
10913
+ { property: "paramMap", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
10914
+ { property: "queryParamMap", object: "route", type: "http_param", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
10915
+ // Remix / SvelteKit / Astro / Bun / Deno all destructure `{ params, request, url }`
10916
+ // from a handler-args object. Registering `params` / `url` /
10917
+ // `searchParams` as unqualified properties would over-fire; instead
10918
+ // add regex-based coverage in language-sources-pass.ts so the
10919
+ // taint enters only through the specific request-URL chain
10920
+ // (`url.searchParams.get(...)`, `event.url.pathname`).
10900
10921
  // --- Serverless transport channels (cognium-dev #213 first slice) ---
10901
10922
  //
10902
10923
  // AWS Lambda / API Gateway invocation-event properties. The Lambda
package/dist/core/circle-ir-core.js CHANGED
@@ -10831,6 +10831,27 @@ var DEFAULT_SOURCES = [
10831
10831
  { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
10832
10832
  { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
10833
10833
  { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
10834
+ // --- Modern JS/TS framework sources (cognium-dev #213 tenth slice) ---
10835
+ //
10836
+ // NextJS App Router: `req.nextUrl` is a NextURL instance whose
10837
+ // `.searchParams`, `.pathname`, `.hash` carry attacker-controlled
10838
+ // request state.
10839
+ // req.nextUrl.searchParams.get('id')
10840
+ // req.nextUrl.pathname
10841
+ { property: "nextUrl", object: "req", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
10842
+ { property: "nextUrl", object: "request", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
10843
+ // Angular ActivatedRoute: `route.snapshot.params` / `queryParams` /
10844
+ // `data`, and `route.paramMap` (Observable-based) are the two
10845
+ // idioms for reading URL params.
10846
+ { property: "snapshot", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
10847
+ { property: "paramMap", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
10848
+ { property: "queryParamMap", object: "route", type: "http_param", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
10849
+ // Remix / SvelteKit / Astro / Bun / Deno all destructure `{ params, request, url }`
10850
+ // from a handler-args object. Registering `params` / `url` /
10851
+ // `searchParams` as unqualified properties would over-fire; instead
10852
+ // add regex-based coverage in language-sources-pass.ts so the
10853
+ // taint enters only through the specific request-URL chain
10854
+ // (`url.searchParams.get(...)`, `event.url.pathname`).
10834
10855
  // --- Serverless transport channels (cognium-dev #213 first slice) ---
10835
10856
  //
10836
10857
  // AWS Lambda / API Gateway invocation-event properties. The Lambda
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "circle-ir",
3
- "version": "3.189.0",
3
+ "version": "3.190.0",
4
4
  "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.js",