circle-ir 3.19.0 → 3.19.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -60,7 +60,7 @@ export class SecurityHeadersPass {
60
60
  continue;
61
61
  if (call.arguments.length < 1)
62
62
  continue;
63
- const nameLiteral = literalOf(call.arguments[0]);
63
+ const nameLiteral = resolveHeaderName(call.arguments[0]);
64
64
  if (nameLiteral === null)
65
65
  continue;
66
66
  const key = nameLiteral.toLowerCase();
@@ -186,6 +186,36 @@ function stripQuotes(s) {
186
186
  }
187
187
  return s;
188
188
  }
189
+ /**
190
+ * Resolve the header-name argument to a string value. Handles:
191
+ * 1. String literals: "X-Frame-Options"
192
+ * 2. Java/framework constants: HttpHeaders.X_FRAME_OPTIONS → "X-Frame-Options"
193
+ * Converts SCREAMING_SNAKE_CASE to Header-Case. Works with any framework
194
+ * that follows Java constant naming conventions (Spring, Jakarta, Apache,
195
+ * Guava, etc.).
196
+ */
197
+ function resolveHeaderName(arg) {
198
+ // Try literal first.
199
+ const lit = literalOf(arg);
200
+ if (lit !== null)
201
+ return lit;
202
+ // Fallback: check if expression looks like a constant reference.
203
+ // e.g. "HttpHeaders.X_FRAME_OPTIONS", "CONTENT_TYPE", "Header.X_FRAME_OPTIONS"
204
+ const expr = arg.expression.trim();
205
+ const dotIdx = expr.lastIndexOf('.');
206
+ const fieldName = dotIdx >= 0 ? expr.slice(dotIdx + 1) : expr;
207
+ // Must be SCREAMING_SNAKE_CASE: all uppercase letters, digits, underscores,
208
+ // at least one underscore (to distinguish from simple variable names).
209
+ if (!/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/.test(fieldName))
210
+ return null;
211
+ // Convert SCREAMING_SNAKE_CASE → Header-Case:
212
+ // X_FRAME_OPTIONS → X-Frame-Options
213
+ // ACCESS_CONTROL_ALLOW_ORIGIN → Access-Control-Allow-Origin
214
+ return fieldName
215
+ .split('_')
216
+ .map(part => part.charAt(0) + part.slice(1).toLowerCase())
217
+ .join('-');
218
+ }
189
219
  /**
190
220
  * Heuristic detection of whether the file contains an HTTP request handler.
191
221
  * Used to gate 'missing' rules so they don't fire on library / utility files.
@@ -1 +1 @@
1
- {"version":3,"file":"security-headers-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/security-headers-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAc3D,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,WAAW,EAAE,WAAW,EAAQ,cAAc;IAC9C,KAAK,EAAE,QAAQ,EAAiB,+BAA+B;IAC/D,eAAe,EAAiB,yBAAyB;IACzD,QAAQ,EAAwB,sCAAsC;CACvE,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,qBAAqB,GACzB,oNAAoN,CAAC;AAEvN,kDAAkD;AAClD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS;CACzE,CAAC,CAAC;AAEH,MAAM,OAAO,mBAAmB;IAGrB,IAAI,GAAG,kBAAkB,CAAC;IAC1B,QAAQ,GAAG,UAAmB,CAAC;IAEvB,KAAK,CAAe;IAErC,YAAY,UAAkC,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAAC;IACrD,CAAC;IAED,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;QAE7B,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAExC,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,IAAI,WAAW,KAAK,IAAI;gBAAE,SAAS;YAEnC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,GAAG,EAAE,CAAC;gBAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAAC,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,sEAAsE;QACtE,4DAA4D;QAC5D,4DAA4D;QAC5D,sEAAsE;QACtE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAE/C,sEAAsE;QACtE,0BAA0B;QAC1B,sEAAsE;QACtE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAEnD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,0DAA0D;gBAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBAChC,iEAAiE;gBACjE,2DAA2D;gBAC3D,IAAI,IAAI,CAAC,eAAe,KAAK,KAAK,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAE5D,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE;oBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI;oBACJ,IAAI,EAAE,CAAC;oBACP,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,kDAAkD;YAClD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBAExB,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAEzC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC/B,IAAI,YAAY,KAAK,IAAI;wBAAE,SAAS,CAAC,sCAAsC;oBAC3E,IAAI,CAAC,IAAI,CAAC,YAAY;wBAAE,SAAS;oBACjC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;wBAAE,SAAS;gBACtD,CAAC;qBAAM,CAAC,CAAC,iBAAiB;oBACxB,qEAAqE;oBACrE,IAAI,YAAY,KAAK,IAAI;wBAAE,SAAS;gBACtC,CAAC;gBAED,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI;oBACJ,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;oBACxB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,OAAO,EAAE,YAAY,KAAK,IAAI;wBAC5B,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE;wBACnC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE;oBAC5C,QAAQ,EAAE;wBACR,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,KAAK,EAAE,YAAY;wBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;qBAChB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IACxC,CAAC;CACF;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAoD;IACrE,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5E,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,oEAAoE;IACpE,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACnC,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC5C,CAAC;QACD,kEAAkE;QAClE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7B,IACE,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;QAC/B,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;QAC/B,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAC/B,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,KAAqG,EACrG,KAAiB;IAEjB,0EAA0E;IAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,SAAS;QACtD,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtD,+DAA+D;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,kEAAkE;IAClE,0CAA0C;IAE1C,OAAO,KAAK,CAAC;AACf,CAAC"}
1
+ {"version":3,"file":"security-headers-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/security-headers-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAc3D,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,WAAW,EAAE,WAAW,EAAQ,cAAc;IAC9C,KAAK,EAAE,QAAQ,EAAiB,+BAA+B;IAC/D,eAAe,EAAiB,yBAAyB;IACzD,QAAQ,EAAwB,sCAAsC;CACvE,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,qBAAqB,GACzB,oNAAoN,CAAC;AAEvN,kDAAkD;AAClD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS;CACzE,CAAC,CAAC;AAEH,MAAM,OAAO,mBAAmB;IAGrB,IAAI,GAAG,kBAAkB,CAAC;IAC1B,QAAQ,GAAG,UAAmB,CAAC;IAEvB,KAAK,CAAe;IAErC,YAAY,UAAkC,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAAC;IACrD,CAAC;IAED,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;QAE7B,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAExC,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,WAAW,KAAK,IAAI;gBAAE,SAAS;YAEnC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,GAAG,EAAE,CAAC;gBAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAAC,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,sEAAsE;QACtE,4DAA4D;QAC5D,4DAA4D;QAC5D,sEAAsE;QACtE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAE/C,sEAAsE;QACtE,0BAA0B;QAC1B,sEAAsE;QACtE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAEnD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,0DAA0D;gBAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBAChC,iEAAiE;gBACjE,2DAA2D;gBAC3D,IAAI,IAAI,CAAC,eAAe,KAAK,KAAK,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAE5D,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE;oBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI;oBACJ,IAAI,EAAE,CAAC;oBACP,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,kDAAkD;YAClD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBAExB,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAEzC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC/B,IAAI,YAAY,KAAK,IAAI;wBAAE,SAAS,CAAC,sCAAsC;oBAC3E,IAAI,CAAC,IAAI,CAAC,YAAY;wBAAE,SAAS;oBACjC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;wBAAE,SAAS;gBACtD,CAAC;qBAAM,CAAC,CAAC,iBAAiB;oBACxB,qEAAqE;oBACrE,IAAI,YAAY,KAAK,IAAI;wBAAE,SAAS;gBACtC,CAAC;gBAED,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI;oBACJ,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;oBACxB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,OAAO,EAAE,YAAY,KAAK,IAAI;wBAC5B,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE;wBACnC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE;oBAC5C,QAAQ,EAAE;wBACR,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,KAAK,EAAE,YAAY;wBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;qBAChB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IACxC,CAAC;CACF;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAoD;IACrE,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5E,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,oEAAoE;IACpE,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACnC,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC5C,CAAC;QACD,kEAAkE;QAClE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7B,IACE,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;QAC/B,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;QAC/B,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAC/B,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,GAAoD;IAC7E,qBAAqB;IACrB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAE7B,iEAAiE;IACjE,+EAA+E;IAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9D,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,8CAA8C;IAC9C,sCAAsC;IACtC,8DAA8D;IAC9D,OAAO,SAAS;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SACzD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,KAAqG,EACrG,KAAiB;IAEjB,0EAA0E;IAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,SAAS;QACtD,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtD,+DAA+D;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,kEAAkE;IAClE,0CAA0C;IAE1C,OAAO,KAAK,CAAC;AACf,CAAC"}
@@ -22932,7 +22932,7 @@ var SecurityHeadersPass = class {
22932
22932
  for (const call of calls) {
22933
22933
  if (!HEADER_WRITE_METHODS.has(call.method_name)) continue;
22934
22934
  if (call.arguments.length < 1) continue;
22935
- const nameLiteral = literalOf(call.arguments[0]);
22935
+ const nameLiteral = resolveHeaderName(call.arguments[0]);
22936
22936
  if (nameLiteral === null) continue;
22937
22937
  const key = nameLiteral.toLowerCase();
22938
22938
  let list = writtenHeaders.get(key);
@@ -23020,6 +23020,15 @@ function stripQuotes2(s) {
23020
23020
  }
23021
23021
  return s;
23022
23022
  }
23023
+ function resolveHeaderName(arg) {
23024
+ const lit = literalOf(arg);
23025
+ if (lit !== null) return lit;
23026
+ const expr = arg.expression.trim();
23027
+ const dotIdx = expr.lastIndexOf(".");
23028
+ const fieldName = dotIdx >= 0 ? expr.slice(dotIdx + 1) : expr;
23029
+ if (!/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/.test(fieldName)) return null;
23030
+ return fieldName.split("_").map((part) => part.charAt(0) + part.slice(1).toLowerCase()).join("-");
23031
+ }
23023
23032
  function detectHandler(graph, calls) {
23024
23033
  for (const type of graph.ir.types) {
23025
23034
  if (type.annotations.some((a) => HANDLER_ANNOTATION_RE.test(a))) return true;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "circle-ir",
3
- "version": "3.19.0",
3
+ "version": "3.19.1",
4
4
  "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.js",