circle-ir 3.189.0 → 3.191.0

package/dist/browser/circle-ir.js

@@ -11291,6 +11291,24 @@ var DEFAULT_SOURCES = [
   { method: "text", class: "Request", type: "http_body", severity: "high", return_tainted: true },
   { property: "query", object: "request", type: "http_param", severity: "high", property_tainted: true },
   { property: "match_info", object: "request", type: "http_path", severity: "high", property_tainted: true },
+  //
+  // Extended aiohttp coverage (cognium-dev #213 eleventh slice):
+  //   request.rel_url          — parsed URL; rel_url.query.get('q') is
+  //                              the modern idiom for query params
+  //   request.remote           — client IP (untrusted; can be spoofed
+  //                              via X-Forwarded-For without proxy)
+  //   request.raw_headers      — raw byte-tuple header pairs
+  //   request.transport        — connection metadata (peer_name)
+  { property: "rel_url", object: "request", type: "http_body", severity: "high", property_tainted: true },
+  { property: "remote", object: "request", type: "network_input", severity: "high", property_tainted: true },
+  { property: "raw_headers", object: "request", type: "http_header", severity: "high", property_tainted: true },
+  { property: "transport", object: "request", type: "network_input", severity: "medium", property_tainted: true },
+  // Quart (async Flask) — shares Flask idioms (request.args/form/json)
+  // covered above, plus these method-based accessors:
+  { method: "get_json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "get_data", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
+  { method: "files", class: "Request", type: "file_input", severity: "high", return_tainted: true },
   // =========================================================================
   // Rust Sources (Actix-web, Rocket, Axum)
   // =========================================================================
@@ -11502,6 +11520,27 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  // --- Modern JS/TS framework sources (cognium-dev #213 tenth slice) ---
+  //
+  // NextJS App Router: `req.nextUrl` is a NextURL instance whose
+  // `.searchParams`, `.pathname`, `.hash` carry attacker-controlled
+  // request state.
+  //   req.nextUrl.searchParams.get('id')
+  //   req.nextUrl.pathname
+  { property: "nextUrl", object: "req", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "nextUrl", object: "request", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Angular ActivatedRoute: `route.snapshot.params` / `queryParams` /
+  // `data`, and `route.paramMap` (Observable-based) are the two
+  // idioms for reading URL params.
+  { property: "snapshot", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "paramMap", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryParamMap", object: "route", type: "http_param", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Remix / SvelteKit / Astro / Bun / Deno all destructure `{ params, request, url }`
+  // from a handler-args object. Registering `params` / `url` /
+  // `searchParams` as unqualified properties would over-fire; instead
+  // add regex-based coverage in language-sources-pass.ts so the
+  // taint enters only through the specific request-URL chain
+  // (`url.searchParams.get(...)`, `event.url.pathname`).
   // --- Serverless transport channels (cognium-dev #213 first slice) ---
   //
   // AWS Lambda / API Gateway invocation-event properties. The Lambda
@@ -26006,7 +26045,29 @@ var JS_TAINTED_PATTERNS = [
   { pattern: /\bevent\.multiValueQueryStringParameters\b/, type: "http_param" },
   { pattern: /\bevent\.pathParameters\b/, type: "http_path" },
   { pattern: /\bevent\.headers\b/, type: "http_header" },
-  { pattern: /\bevent\.multiValueHeaders\b/, type: "http_header" }
+  { pattern: /\bevent\.multiValueHeaders\b/, type: "http_header" },
+  // Modern JS/TS framework request-URL / route-args (cognium-dev #213
+  // tenth slice). Scoped enough to avoid unrelated code:
+  //
+  //   NextJS App Router:  req.nextUrl.searchParams
+  //                       req.nextUrl.pathname
+  //   Remix:              params.<id> from ({ params, request })
+  //                       new URL(request.url).searchParams
+  //   SvelteKit:          event.params.<id>
+  //                       event.url.searchParams
+  //                       event.request.formData()
+  //   Angular:            route.snapshot.params
+  //                       route.snapshot.queryParams
+  //                       route.paramMap.get(...)
+  { pattern: /\breq(?:uest)?\.nextUrl\b/, type: "http_body" },
+  { pattern: /\.searchParams\s*\.\s*get\b/, type: "http_param" },
+  { pattern: /\bevent\.params\b/, type: "http_path" },
+  { pattern: /\bevent\.url\b/, type: "http_body" },
+  { pattern: /\bevent\.request\b/, type: "http_body" },
+  { pattern: /\broute\.snapshot\.params\b/, type: "http_path" },
+  { pattern: /\broute\.snapshot\.queryParams\b/, type: "http_param" },
+  { pattern: /\broute\.paramMap\b/, type: "http_path" },
+  { pattern: /\broute\.queryParamMap\b/, type: "http_param" }
 ];
 var PYTHON_TAINTED_PATTERNS2 = [
   { pattern: /\brequest\.args\b/, type: "http_param" },
@@ -26047,7 +26108,15 @@ var PYTHON_TAINTED_PATTERNS2 = [
   // and produce spurious sources on every `x = q.receive()` in the wild.
   { pattern: /\.receive_text\s*\(/, type: "network_input" },
   { pattern: /\.receive_bytes\s*\(/, type: "network_input" },
-  { pattern: /\.receive_json\s*\(/, type: "http_body" }
+  { pattern: /\.receive_json\s*\(/, type: "http_body" },
+  // Async Python framework request-URL / async body accessors
+  // (cognium-dev #213 eleventh slice). Regex layer so
+  // `data = await request.get_json()` adds `data` to pyTaintedVars.
+  { pattern: /\brequest\.rel_url\b/, type: "http_body" },
+  { pattern: /\brequest\.remote\b/, type: "network_input" },
+  { pattern: /\brequest\.match_info\b/, type: "http_path" },
+  { pattern: /\.get_json\s*\(/, type: "http_body" },
+  { pattern: /\.get_data\s*\(/, type: "http_body" }
 ];
 var LanguageSourcesPass = class {
   name = "language-sources";

package/dist/core/circle-ir-core.cjs

@@ -10686,6 +10686,24 @@ var DEFAULT_SOURCES = [
   { method: "text", class: "Request", type: "http_body", severity: "high", return_tainted: true },
   { property: "query", object: "request", type: "http_param", severity: "high", property_tainted: true },
   { property: "match_info", object: "request", type: "http_path", severity: "high", property_tainted: true },
+  //
+  // Extended aiohttp coverage (cognium-dev #213 eleventh slice):
+  //   request.rel_url          — parsed URL; rel_url.query.get('q') is
+  //                              the modern idiom for query params
+  //   request.remote           — client IP (untrusted; can be spoofed
+  //                              via X-Forwarded-For without proxy)
+  //   request.raw_headers      — raw byte-tuple header pairs
+  //   request.transport        — connection metadata (peer_name)
+  { property: "rel_url", object: "request", type: "http_body", severity: "high", property_tainted: true },
+  { property: "remote", object: "request", type: "network_input", severity: "high", property_tainted: true },
+  { property: "raw_headers", object: "request", type: "http_header", severity: "high", property_tainted: true },
+  { property: "transport", object: "request", type: "network_input", severity: "medium", property_tainted: true },
+  // Quart (async Flask) — shares Flask idioms (request.args/form/json)
+  // covered above, plus these method-based accessors:
+  { method: "get_json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "get_data", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
+  { method: "files", class: "Request", type: "file_input", severity: "high", return_tainted: true },
   // =========================================================================
   // Rust Sources (Actix-web, Rocket, Axum)
   // =========================================================================
@@ -10897,6 +10915,27 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  // --- Modern JS/TS framework sources (cognium-dev #213 tenth slice) ---
+  //
+  // NextJS App Router: `req.nextUrl` is a NextURL instance whose
+  // `.searchParams`, `.pathname`, `.hash` carry attacker-controlled
+  // request state.
+  //   req.nextUrl.searchParams.get('id')
+  //   req.nextUrl.pathname
+  { property: "nextUrl", object: "req", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "nextUrl", object: "request", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Angular ActivatedRoute: `route.snapshot.params` / `queryParams` /
+  // `data`, and `route.paramMap` (Observable-based) are the two
+  // idioms for reading URL params.
+  { property: "snapshot", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "paramMap", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryParamMap", object: "route", type: "http_param", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Remix / SvelteKit / Astro / Bun / Deno all destructure `{ params, request, url }`
+  // from a handler-args object. Registering `params` / `url` /
+  // `searchParams` as unqualified properties would over-fire; instead
+  // add regex-based coverage in language-sources-pass.ts so the
+  // taint enters only through the specific request-URL chain
+  // (`url.searchParams.get(...)`, `event.url.pathname`).
   // --- Serverless transport channels (cognium-dev #213 first slice) ---
   //
   // AWS Lambda / API Gateway invocation-event properties. The Lambda

package/dist/core/circle-ir-core.js

@@ -10620,6 +10620,24 @@ var DEFAULT_SOURCES = [
   { method: "text", class: "Request", type: "http_body", severity: "high", return_tainted: true },
   { property: "query", object: "request", type: "http_param", severity: "high", property_tainted: true },
   { property: "match_info", object: "request", type: "http_path", severity: "high", property_tainted: true },
+  //
+  // Extended aiohttp coverage (cognium-dev #213 eleventh slice):
+  //   request.rel_url          — parsed URL; rel_url.query.get('q') is
+  //                              the modern idiom for query params
+  //   request.remote           — client IP (untrusted; can be spoofed
+  //                              via X-Forwarded-For without proxy)
+  //   request.raw_headers      — raw byte-tuple header pairs
+  //   request.transport        — connection metadata (peer_name)
+  { property: "rel_url", object: "request", type: "http_body", severity: "high", property_tainted: true },
+  { property: "remote", object: "request", type: "network_input", severity: "high", property_tainted: true },
+  { property: "raw_headers", object: "request", type: "http_header", severity: "high", property_tainted: true },
+  { property: "transport", object: "request", type: "network_input", severity: "medium", property_tainted: true },
+  // Quart (async Flask) — shares Flask idioms (request.args/form/json)
+  // covered above, plus these method-based accessors:
+  { method: "get_json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "get_data", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
+  { method: "files", class: "Request", type: "file_input", severity: "high", return_tainted: true },
   // =========================================================================
   // Rust Sources (Actix-web, Rocket, Axum)
   // =========================================================================
@@ -10831,6 +10849,27 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  // --- Modern JS/TS framework sources (cognium-dev #213 tenth slice) ---
+  //
+  // NextJS App Router: `req.nextUrl` is a NextURL instance whose
+  // `.searchParams`, `.pathname`, `.hash` carry attacker-controlled
+  // request state.
+  //   req.nextUrl.searchParams.get('id')
+  //   req.nextUrl.pathname
+  { property: "nextUrl", object: "req", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "nextUrl", object: "request", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Angular ActivatedRoute: `route.snapshot.params` / `queryParams` /
+  // `data`, and `route.paramMap` (Observable-based) are the two
+  // idioms for reading URL params.
+  { property: "snapshot", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "paramMap", object: "route", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryParamMap", object: "route", type: "http_param", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  // Remix / SvelteKit / Astro / Bun / Deno all destructure `{ params, request, url }`
+  // from a handler-args object. Registering `params` / `url` /
+  // `searchParams` as unqualified properties would over-fire; instead
+  // add regex-based coverage in language-sources-pass.ts so the
+  // taint enters only through the specific request-URL chain
+  // (`url.searchParams.get(...)`, `event.url.pathname`).
   // --- Serverless transport channels (cognium-dev #213 first slice) ---
   //
   // AWS Lambda / API Gateway invocation-event properties. The Lambda

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.189.0",
+  "version": "3.191.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",