circle-ir 3.190.0 → 3.192.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/config-loader.d.ts.map +1 -1
- package/dist/analysis/config-loader.js +18 -0
- package/dist/analysis/config-loader.js.map +1 -1
- package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
- package/dist/analysis/passes/language-sources-pass.js +64 -0
- package/dist/analysis/passes/language-sources-pass.js.map +1 -1
- package/dist/browser/circle-ir.js +48 -1
- package/dist/core/circle-ir-core.cjs +18 -0
- package/dist/core/circle-ir-core.js +18 -0
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,
|
|
1
|
+
{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA6uB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2wDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+hBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
|
|
@@ -460,6 +460,24 @@ export const DEFAULT_SOURCES = [
|
|
|
460
460
|
{ method: 'text', class: 'Request', type: 'http_body', severity: 'high', return_tainted: true },
|
|
461
461
|
{ property: 'query', object: 'request', type: 'http_param', severity: 'high', property_tainted: true },
|
|
462
462
|
{ property: 'match_info', object: 'request', type: 'http_path', severity: 'high', property_tainted: true },
|
|
463
|
+
//
|
|
464
|
+
// Extended aiohttp coverage (cognium-dev #213 eleventh slice):
|
|
465
|
+
// request.rel_url — parsed URL; rel_url.query.get('q') is
|
|
466
|
+
// the modern idiom for query params
|
|
467
|
+
// request.remote — client IP (untrusted; can be spoofed
|
|
468
|
+
// via X-Forwarded-For without proxy)
|
|
469
|
+
// request.raw_headers — raw byte-tuple header pairs
|
|
470
|
+
// request.transport — connection metadata (peer_name)
|
|
471
|
+
{ property: 'rel_url', object: 'request', type: 'http_body', severity: 'high', property_tainted: true },
|
|
472
|
+
{ property: 'remote', object: 'request', type: 'network_input', severity: 'high', property_tainted: true },
|
|
473
|
+
{ property: 'raw_headers', object: 'request', type: 'http_header', severity: 'high', property_tainted: true },
|
|
474
|
+
{ property: 'transport', object: 'request', type: 'network_input', severity: 'medium', property_tainted: true },
|
|
475
|
+
// Quart (async Flask) — shares Flask idioms (request.args/form/json)
|
|
476
|
+
// covered above, plus these method-based accessors:
|
|
477
|
+
{ method: 'get_json', class: 'Request', type: 'http_body', severity: 'high', return_tainted: true },
|
|
478
|
+
{ method: 'get_data', class: 'Request', type: 'http_body', severity: 'high', return_tainted: true },
|
|
479
|
+
{ method: 'form', class: 'Request', type: 'http_param', severity: 'high', return_tainted: true },
|
|
480
|
+
{ method: 'files', class: 'Request', type: 'file_input', severity: 'high', return_tainted: true },
|
|
463
481
|
// =========================================================================
|
|
464
482
|
// Rust Sources (Actix-web, Rocket, Axum)
|
|
465
483
|
// =========================================================================
|