circle-ir 3.190.0 → 3.192.0

package/dist/browser/circle-ir.js

@@ -11291,6 +11291,24 @@ var DEFAULT_SOURCES = [
   { method: "text", class: "Request", type: "http_body", severity: "high", return_tainted: true },
   { property: "query", object: "request", type: "http_param", severity: "high", property_tainted: true },
   { property: "match_info", object: "request", type: "http_path", severity: "high", property_tainted: true },
+  //
+  // Extended aiohttp coverage (cognium-dev #213 eleventh slice):
+  //   request.rel_url          — parsed URL; rel_url.query.get('q') is
+  //                              the modern idiom for query params
+  //   request.remote           — client IP (untrusted; can be spoofed
+  //                              via X-Forwarded-For without proxy)
+  //   request.raw_headers      — raw byte-tuple header pairs
+  //   request.transport        — connection metadata (peer_name)
+  { property: "rel_url", object: "request", type: "http_body", severity: "high", property_tainted: true },
+  { property: "remote", object: "request", type: "network_input", severity: "high", property_tainted: true },
+  { property: "raw_headers", object: "request", type: "http_header", severity: "high", property_tainted: true },
+  { property: "transport", object: "request", type: "network_input", severity: "medium", property_tainted: true },
+  // Quart (async Flask) — shares Flask idioms (request.args/form/json)
+  // covered above, plus these method-based accessors:
+  { method: "get_json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "get_data", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
+  { method: "files", class: "Request", type: "file_input", severity: "high", return_tainted: true },
   // =========================================================================
   // Rust Sources (Actix-web, Rocket, Axum)
   // =========================================================================
@@ -26090,7 +26108,15 @@ var PYTHON_TAINTED_PATTERNS2 = [
   // and produce spurious sources on every `x = q.receive()` in the wild.
   { pattern: /\.receive_text\s*\(/, type: "network_input" },
   { pattern: /\.receive_bytes\s*\(/, type: "network_input" },
-  { pattern: /\.receive_json\s*\(/, type: "http_body" }
+  { pattern: /\.receive_json\s*\(/, type: "http_body" },
+  // Async Python framework request-URL / async body accessors
+  // (cognium-dev #213 eleventh slice). Regex layer so
+  // `data = await request.get_json()` adds `data` to pyTaintedVars.
+  { pattern: /\brequest\.rel_url\b/, type: "http_body" },
+  { pattern: /\brequest\.remote\b/, type: "network_input" },
+  { pattern: /\brequest\.match_info\b/, type: "http_path" },
+  { pattern: /\.get_json\s*\(/, type: "http_body" },
+  { pattern: /\.get_data\s*\(/, type: "http_body" }
 ];
 var LanguageSourcesPass = class {
   name = "language-sources";
@@ -26174,6 +26200,7 @@ var LanguageSourcesPass = class {
       }
       additionalSanitizers.push(...findBashRegexAllowlistSanitizers(code));
       additionalSanitizers.push(...findBashRealpathPrefixGuardSanitizers(code));
+      additionalSanitizers.push(...findBashShellQuoteSanitizers(code));
     }
     if (language === "go") {
       additionalSanitizers.push(...findGoMapAllowlistGuardSanitizers(code));
@@ -27579,6 +27606,26 @@ function hasIntegrityVerifierAnywhere(lines) {
   }
   return false;
 }
+function findBashShellQuoteSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const PRINTF_Q_RE = /\$\(\s*printf\s+['"]%q['"]\s+["']?\$/;
+  const AT_Q_RE = /\$\{[A-Za-z_][A-Za-z0-9_]*@Q\}/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trimStart().startsWith("#")) continue;
+    if (!PRINTF_Q_RE.test(line) && !AT_Q_RE.test(line)) continue;
+    for (let l = i2 + 1; l <= lines.length; l++) {
+      sanitizers.push({
+        type: "shell_quote",
+        method: PRINTF_Q_RE.test(line) ? "printf '%q'" : "${var@Q}",
+        line: l,
+        sanitizes: ["command_injection", "code_injection"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findBashRegexAllowlistSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");

package/dist/core/circle-ir-core.cjs

@@ -10686,6 +10686,24 @@ var DEFAULT_SOURCES = [
   { method: "text", class: "Request", type: "http_body", severity: "high", return_tainted: true },
   { property: "query", object: "request", type: "http_param", severity: "high", property_tainted: true },
   { property: "match_info", object: "request", type: "http_path", severity: "high", property_tainted: true },
+  //
+  // Extended aiohttp coverage (cognium-dev #213 eleventh slice):
+  //   request.rel_url          — parsed URL; rel_url.query.get('q') is
+  //                              the modern idiom for query params
+  //   request.remote           — client IP (untrusted; can be spoofed
+  //                              via X-Forwarded-For without proxy)
+  //   request.raw_headers      — raw byte-tuple header pairs
+  //   request.transport        — connection metadata (peer_name)
+  { property: "rel_url", object: "request", type: "http_body", severity: "high", property_tainted: true },
+  { property: "remote", object: "request", type: "network_input", severity: "high", property_tainted: true },
+  { property: "raw_headers", object: "request", type: "http_header", severity: "high", property_tainted: true },
+  { property: "transport", object: "request", type: "network_input", severity: "medium", property_tainted: true },
+  // Quart (async Flask) — shares Flask idioms (request.args/form/json)
+  // covered above, plus these method-based accessors:
+  { method: "get_json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "get_data", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
+  { method: "files", class: "Request", type: "file_input", severity: "high", return_tainted: true },
   // =========================================================================
   // Rust Sources (Actix-web, Rocket, Axum)
   // =========================================================================

package/dist/core/circle-ir-core.js

@@ -10620,6 +10620,24 @@ var DEFAULT_SOURCES = [
   { method: "text", class: "Request", type: "http_body", severity: "high", return_tainted: true },
   { property: "query", object: "request", type: "http_param", severity: "high", property_tainted: true },
   { property: "match_info", object: "request", type: "http_path", severity: "high", property_tainted: true },
+  //
+  // Extended aiohttp coverage (cognium-dev #213 eleventh slice):
+  //   request.rel_url          — parsed URL; rel_url.query.get('q') is
+  //                              the modern idiom for query params
+  //   request.remote           — client IP (untrusted; can be spoofed
+  //                              via X-Forwarded-For without proxy)
+  //   request.raw_headers      — raw byte-tuple header pairs
+  //   request.transport        — connection metadata (peer_name)
+  { property: "rel_url", object: "request", type: "http_body", severity: "high", property_tainted: true },
+  { property: "remote", object: "request", type: "network_input", severity: "high", property_tainted: true },
+  { property: "raw_headers", object: "request", type: "http_header", severity: "high", property_tainted: true },
+  { property: "transport", object: "request", type: "network_input", severity: "medium", property_tainted: true },
+  // Quart (async Flask) — shares Flask idioms (request.args/form/json)
+  // covered above, plus these method-based accessors:
+  { method: "get_json", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "get_data", class: "Request", type: "http_body", severity: "high", return_tainted: true },
+  { method: "form", class: "Request", type: "http_param", severity: "high", return_tainted: true },
+  { method: "files", class: "Request", type: "file_input", severity: "high", return_tainted: true },
   // =========================================================================
   // Rust Sources (Actix-web, Rocket, Axum)
   // =========================================================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.190.0",
+  "version": "3.192.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",