circle-ir 3.199.0 → 3.201.0

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAivB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA+yDtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+hBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAy0DtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA+hBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -151,6 +151,26 @@ export const DEFAULT_SOURCES = [
     { annotation: 'FormParam', type: 'http_param', severity: 'high', param_tainted: true },
     { annotation: 'PathParam', type: 'http_path', severity: 'medium', param_tainted: true },
     { annotation: 'HeaderParam', type: 'http_header', severity: 'high', param_tainted: true },
+    // JAX-RS params the block was missing (jakarta.ws.rs). Java-scoped — the
+    // JS decorator ecosystem has its own distinct names and should not match.
+    { annotation: 'CookieParam', type: 'http_cookie', severity: 'high', param_tainted: true, languages: ['java'] },
+    { annotation: 'MatrixParam', type: 'http_param', severity: 'high', param_tainted: true, languages: ['java'] },
+    { annotation: 'BeanParam', type: 'http_body', severity: 'high', param_tainted: true, languages: ['java'] },
+    // Micronaut (io.micronaut.http.annotation). @Body / @Header / @CookieValue /
+    // @PathVariable reuse Spring/JAX-RS names already covered above; these three
+    // are Micronaut-specific. Java-scoped.
+    { annotation: 'QueryValue', type: 'http_param', severity: 'high', param_tainted: true, languages: ['java'] },
+    { annotation: 'Part', type: 'http_body', severity: 'high', param_tainted: true, languages: ['java'] },
+    { annotation: 'RequestBean', type: 'http_body', severity: 'high', param_tainted: true, languages: ['java'] },
+    // Quarkus / RESTEasy Reactive (org.jboss.resteasy.reactive) — the `@Rest*`
+    // shortcut annotations that infer the binding name from the parameter name.
+    // Java-scoped.
+    { annotation: 'RestQuery', type: 'http_param', severity: 'high', param_tainted: true, languages: ['java'] },
+    { annotation: 'RestPath', type: 'http_path', severity: 'medium', param_tainted: true, languages: ['java'] },
+    { annotation: 'RestHeader', type: 'http_header', severity: 'high', param_tainted: true, languages: ['java'] },
+    { annotation: 'RestForm', type: 'http_param', severity: 'high', param_tainted: true, languages: ['java'] },
+    { annotation: 'RestCookie', type: 'http_cookie', severity: 'high', param_tainted: true, languages: ['java'] },
+    { annotation: 'RestMatrix', type: 'http_param', severity: 'high', param_tainted: true, languages: ['java'] },
     // Jenkins data-binding: every parameter of an annotated constructor is wired
     // from form/JSON user input at construction time. Method-level annotation —
     // all params tainted.
@@ -1874,6 +1894,25 @@ export const DEFAULT_SINKS = [
     { method: 'each', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
     { method: 'get', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
     { method: 'exec', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
+    // TypeORM QueryBuilder raw fragments (CWE-89). TypeORM's raw `.query(sql)`
+    // escape hatch is already covered by the classless `query` sink in the JS
+    // plugin (getBuiltinSinks), so it is NOT re-registered here — the dedup
+    // would discard the duplicate anyway. What was uncovered is the
+    // QueryBuilder fragment API: `andWhere`/`orWhere`/`andHaving`/`orHaving`
+    // take raw SQL strings. These names are TypeORM-idiomatic, so classless +
+    // language-scoped is safe and recovers the dominant chained-builder shape
+    // (`repo.createQueryBuilder('u').andWhere(raw)`) that class matching cannot
+    // reach — the receiver of `.andWhere(...)` is the factory call, not a
+    // class-named variable. Generic `where`/`having` are deliberately NOT added
+    // (too generic for classless; a `*QueryBuilder`-scoped entry would be
+    // near-dead since receivers are rarely named that). Precision is inherent
+    // to the flow: parameterised use (`:id` placeholders + a params object)
+    // keeps input out of the string literal, so a finding fires only on
+    // concatenation.
+    { method: 'andWhere', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    { method: 'orWhere', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    { method: 'andHaving', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
+    { method: 'orHaving', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
     // Browser DOM XSS sinks
     { method: 'setAttribute', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [1] },
     // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
@@ -2075,6 +2114,12 @@ export const DEFAULT_SINKS = [
     { method: 'executemany', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['python'] },
     { method: 'raw', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['python'] },
     { method: 'extra', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0], languages: ['python'] },
+    // Django RawSQL expression (django.db.models.expressions.RawSQL) — the raw
+    // SQL fragment in arg[0] is embedded verbatim into the query when the
+    // annotate/filter/order_by containing it runs. Distinctive constructor name,
+    // so classless + python-scoped is safe. Parameterised use passes user input
+    // through arg[1] (`RawSQL("... %s", [uid])`), which keeps it out of arg[0].
+    { method: 'RawSQL', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['python'] },
     // Python Path Traversal
     // Language-scoped: classless `open` collides with Java I/O / JS DOM.
     { method: 'open', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['python'] },