circle-ir 3.189.0 → 3.191.0

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAksB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2wDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+hBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6uB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2wDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+hBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -460,6 +460,24 @@ export const DEFAULT_SOURCES = [
     { method: 'text', class: 'Request', type: 'http_body', severity: 'high', return_tainted: true },
     { property: 'query', object: 'request', type: 'http_param', severity: 'high', property_tainted: true },
     { property: 'match_info', object: 'request', type: 'http_path', severity: 'high', property_tainted: true },
+    //
+    // Extended aiohttp coverage (cognium-dev #213 eleventh slice):
+    //   request.rel_url          — parsed URL; rel_url.query.get('q') is
+    //                              the modern idiom for query params
+    //   request.remote           — client IP (untrusted; can be spoofed
+    //                              via X-Forwarded-For without proxy)
+    //   request.raw_headers      — raw byte-tuple header pairs
+    //   request.transport        — connection metadata (peer_name)
+    { property: 'rel_url', object: 'request', type: 'http_body', severity: 'high', property_tainted: true },
+    { property: 'remote', object: 'request', type: 'network_input', severity: 'high', property_tainted: true },
+    { property: 'raw_headers', object: 'request', type: 'http_header', severity: 'high', property_tainted: true },
+    { property: 'transport', object: 'request', type: 'network_input', severity: 'medium', property_tainted: true },
+    // Quart (async Flask) — shares Flask idioms (request.args/form/json)
+    // covered above, plus these method-based accessors:
+    { method: 'get_json', class: 'Request', type: 'http_body', severity: 'high', return_tainted: true },
+    { method: 'get_data', class: 'Request', type: 'http_body', severity: 'high', return_tainted: true },
+    { method: 'form', class: 'Request', type: 'http_param', severity: 'high', return_tainted: true },
+    { method: 'files', class: 'Request', type: 'file_input', severity: 'high', return_tainted: true },
     // =========================================================================
     // Rust Sources (Actix-web, Rocket, Axum)
     // =========================================================================
@@ -671,6 +689,27 @@ export const DEFAULT_SOURCES = [
     { method: 'get', class: 'Jedis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['java'] },
     { method: 'hget', class: 'Jedis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['java'] },
     { method: 'mget', class: 'Jedis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['java'] },
+    // --- Modern JS/TS framework sources (cognium-dev #213 tenth slice) ---
+    //
+    // NextJS App Router: `req.nextUrl` is a NextURL instance whose
+    // `.searchParams`, `.pathname`, `.hash` carry attacker-controlled
+    // request state.
+    //   req.nextUrl.searchParams.get('id')
+    //   req.nextUrl.pathname
+    { property: 'nextUrl', object: 'req', type: 'http_body', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    { property: 'nextUrl', object: 'request', type: 'http_body', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    // Angular ActivatedRoute: `route.snapshot.params` / `queryParams` /
+    // `data`, and `route.paramMap` (Observable-based) are the two
+    // idioms for reading URL params.
+    { property: 'snapshot', object: 'route', type: 'http_path', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    { property: 'paramMap', object: 'route', type: 'http_path', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    { property: 'queryParamMap', object: 'route', type: 'http_param', severity: 'high', property_tainted: true, languages: ['javascript', 'typescript'] },
+    // Remix / SvelteKit / Astro / Bun / Deno all destructure `{ params, request, url }`
+    // from a handler-args object. Registering `params` / `url` /
+    // `searchParams` as unqualified properties would over-fire; instead
+    // add regex-based coverage in language-sources-pass.ts so the
+    // taint enters only through the specific request-URL chain
+    // (`url.searchParams.get(...)`, `event.url.pathname`).
     // --- Serverless transport channels (cognium-dev #213 first slice) ---
     //
     // AWS Lambda / API Gateway invocation-event properties. The Lambda