circle-ir 3.199.0 → 3.201.0

package/dist/browser/circle-ir.js

@@ -11082,6 +11082,26 @@ var DEFAULT_SOURCES = [
   { annotation: "FormParam", type: "http_param", severity: "high", param_tainted: true },
   { annotation: "PathParam", type: "http_path", severity: "medium", param_tainted: true },
   { annotation: "HeaderParam", type: "http_header", severity: "high", param_tainted: true },
+  // JAX-RS params the block was missing (jakarta.ws.rs). Java-scoped — the
+  // JS decorator ecosystem has its own distinct names and should not match.
+  { annotation: "CookieParam", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "MatrixParam", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "BeanParam", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Micronaut (io.micronaut.http.annotation). @Body / @Header / @CookieValue /
+  // @PathVariable reuse Spring/JAX-RS names already covered above; these three
+  // are Micronaut-specific. Java-scoped.
+  { annotation: "QueryValue", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "Part", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RequestBean", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Quarkus / RESTEasy Reactive (org.jboss.resteasy.reactive) — the `@Rest*`
+  // shortcut annotations that infer the binding name from the parameter name.
+  // Java-scoped.
+  { annotation: "RestQuery", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestPath", type: "http_path", severity: "medium", param_tainted: true, languages: ["java"] },
+  { annotation: "RestHeader", type: "http_header", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestForm", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestCookie", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestMatrix", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
   // Jenkins data-binding: every parameter of an annotated constructor is wired
   // from form/JSON user input at construction time. Method-level annotation —
   // all params tainted.
@@ -12760,6 +12780,25 @@ var DEFAULT_SINKS = [
   { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  // TypeORM QueryBuilder raw fragments (CWE-89). TypeORM's raw `.query(sql)`
+  // escape hatch is already covered by the classless `query` sink in the JS
+  // plugin (getBuiltinSinks), so it is NOT re-registered here — the dedup
+  // would discard the duplicate anyway. What was uncovered is the
+  // QueryBuilder fragment API: `andWhere`/`orWhere`/`andHaving`/`orHaving`
+  // take raw SQL strings. These names are TypeORM-idiomatic, so classless +
+  // language-scoped is safe and recovers the dominant chained-builder shape
+  // (`repo.createQueryBuilder('u').andWhere(raw)`) that class matching cannot
+  // reach — the receiver of `.andWhere(...)` is the factory call, not a
+  // class-named variable. Generic `where`/`having` are deliberately NOT added
+  // (too generic for classless; a `*QueryBuilder`-scoped entry would be
+  // near-dead since receivers are rarely named that). Precision is inherent
+  // to the flow: parameterised use (`:id` placeholders + a params object)
+  // keeps input out of the string literal, so a finding fires only on
+  // concatenation.
+  { method: "andWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "andHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
@@ -12961,6 +13000,12 @@ var DEFAULT_SINKS = [
   { method: "executemany", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "extra", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Django RawSQL expression (django.db.models.expressions.RawSQL) — the raw
+  // SQL fragment in arg[0] is embedded verbatim into the query when the
+  // annotate/filter/order_by containing it runs. Distinctive constructor name,
+  // so classless + python-scoped is safe. Parameterised use passes user input
+  // through arg[1] (`RawSQL("... %s", [uid])`), which keeps it out of arg[0].
+  { method: "RawSQL", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   // Python Path Traversal
   // Language-scoped: classless `open` collides with Java I/O / JS DOM.
   { method: "open", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["python"] },
@@ -25682,6 +25727,14 @@ var JS_TAINTED_PATTERNS = [
   { pattern: /\blocation\.href\b/, type: "http_path" },
   { pattern: /\bdocument\.getElementById\b/, type: "dom_input" },
   { pattern: /\bdocument\.querySelector\b/, type: "dom_input" },
+  // Remaining DOM element-accessor siblings — a `.value` read off any of these
+  // (`document.getElementsByName('q')[0].value`) is the same DOM-input source as
+  // getElementById/querySelector above. Kept narrow by requiring the `document.`
+  // receiver so they cannot match unrelated `.getElementsByTagName`-named helpers.
+  { pattern: /\bdocument\.getElementsByName\b/, type: "dom_input" },
+  { pattern: /\bdocument\.getElementsByClassName\b/, type: "dom_input" },
+  { pattern: /\bdocument\.getElementsByTagName\b/, type: "dom_input" },
+  { pattern: /\bdocument\.querySelectorAll\b/, type: "dom_input" },
   // Narrow to event-based DOM input reads: `e.target.value`, `event.target.value`.
   // The formerly broad `/\.value\b/` matched any `.value` property (e.g. `result.value`,
   // `node.value` in TypeScript) generating false positives in non-browser code.

package/dist/core/circle-ir-core.cjs

@@ -10477,6 +10477,26 @@ var DEFAULT_SOURCES = [
   { annotation: "FormParam", type: "http_param", severity: "high", param_tainted: true },
   { annotation: "PathParam", type: "http_path", severity: "medium", param_tainted: true },
   { annotation: "HeaderParam", type: "http_header", severity: "high", param_tainted: true },
+  // JAX-RS params the block was missing (jakarta.ws.rs). Java-scoped — the
+  // JS decorator ecosystem has its own distinct names and should not match.
+  { annotation: "CookieParam", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "MatrixParam", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "BeanParam", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Micronaut (io.micronaut.http.annotation). @Body / @Header / @CookieValue /
+  // @PathVariable reuse Spring/JAX-RS names already covered above; these three
+  // are Micronaut-specific. Java-scoped.
+  { annotation: "QueryValue", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "Part", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RequestBean", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Quarkus / RESTEasy Reactive (org.jboss.resteasy.reactive) — the `@Rest*`
+  // shortcut annotations that infer the binding name from the parameter name.
+  // Java-scoped.
+  { annotation: "RestQuery", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestPath", type: "http_path", severity: "medium", param_tainted: true, languages: ["java"] },
+  { annotation: "RestHeader", type: "http_header", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestForm", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestCookie", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestMatrix", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
   // Jenkins data-binding: every parameter of an annotated constructor is wired
   // from form/JSON user input at construction time. Method-level annotation —
   // all params tainted.
@@ -12155,6 +12175,25 @@ var DEFAULT_SINKS = [
   { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  // TypeORM QueryBuilder raw fragments (CWE-89). TypeORM's raw `.query(sql)`
+  // escape hatch is already covered by the classless `query` sink in the JS
+  // plugin (getBuiltinSinks), so it is NOT re-registered here — the dedup
+  // would discard the duplicate anyway. What was uncovered is the
+  // QueryBuilder fragment API: `andWhere`/`orWhere`/`andHaving`/`orHaving`
+  // take raw SQL strings. These names are TypeORM-idiomatic, so classless +
+  // language-scoped is safe and recovers the dominant chained-builder shape
+  // (`repo.createQueryBuilder('u').andWhere(raw)`) that class matching cannot
+  // reach — the receiver of `.andWhere(...)` is the factory call, not a
+  // class-named variable. Generic `where`/`having` are deliberately NOT added
+  // (too generic for classless; a `*QueryBuilder`-scoped entry would be
+  // near-dead since receivers are rarely named that). Precision is inherent
+  // to the flow: parameterised use (`:id` placeholders + a params object)
+  // keeps input out of the string literal, so a finding fires only on
+  // concatenation.
+  { method: "andWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "andHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
@@ -12356,6 +12395,12 @@ var DEFAULT_SINKS = [
   { method: "executemany", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "extra", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Django RawSQL expression (django.db.models.expressions.RawSQL) — the raw
+  // SQL fragment in arg[0] is embedded verbatim into the query when the
+  // annotate/filter/order_by containing it runs. Distinctive constructor name,
+  // so classless + python-scoped is safe. Parameterised use passes user input
+  // through arg[1] (`RawSQL("... %s", [uid])`), which keeps it out of arg[0].
+  { method: "RawSQL", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   // Python Path Traversal
   // Language-scoped: classless `open` collides with Java I/O / JS DOM.
   { method: "open", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["python"] },

package/dist/core/circle-ir-core.js

@@ -10411,6 +10411,26 @@ var DEFAULT_SOURCES = [
   { annotation: "FormParam", type: "http_param", severity: "high", param_tainted: true },
   { annotation: "PathParam", type: "http_path", severity: "medium", param_tainted: true },
   { annotation: "HeaderParam", type: "http_header", severity: "high", param_tainted: true },
+  // JAX-RS params the block was missing (jakarta.ws.rs). Java-scoped — the
+  // JS decorator ecosystem has its own distinct names and should not match.
+  { annotation: "CookieParam", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "MatrixParam", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "BeanParam", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Micronaut (io.micronaut.http.annotation). @Body / @Header / @CookieValue /
+  // @PathVariable reuse Spring/JAX-RS names already covered above; these three
+  // are Micronaut-specific. Java-scoped.
+  { annotation: "QueryValue", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "Part", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RequestBean", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  // Quarkus / RESTEasy Reactive (org.jboss.resteasy.reactive) — the `@Rest*`
+  // shortcut annotations that infer the binding name from the parameter name.
+  // Java-scoped.
+  { annotation: "RestQuery", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestPath", type: "http_path", severity: "medium", param_tainted: true, languages: ["java"] },
+  { annotation: "RestHeader", type: "http_header", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestForm", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestCookie", type: "http_cookie", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "RestMatrix", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
   // Jenkins data-binding: every parameter of an annotated constructor is wired
   // from form/JSON user input at construction time. Method-level annotation —
   // all params tainted.
@@ -12089,6 +12109,25 @@ var DEFAULT_SINKS = [
   { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  // TypeORM QueryBuilder raw fragments (CWE-89). TypeORM's raw `.query(sql)`
+  // escape hatch is already covered by the classless `query` sink in the JS
+  // plugin (getBuiltinSinks), so it is NOT re-registered here — the dedup
+  // would discard the duplicate anyway. What was uncovered is the
+  // QueryBuilder fragment API: `andWhere`/`orWhere`/`andHaving`/`orHaving`
+  // take raw SQL strings. These names are TypeORM-idiomatic, so classless +
+  // language-scoped is safe and recovers the dominant chained-builder shape
+  // (`repo.createQueryBuilder('u').andWhere(raw)`) that class matching cannot
+  // reach — the receiver of `.andWhere(...)` is the factory call, not a
+  // class-named variable. Generic `where`/`having` are deliberately NOT added
+  // (too generic for classless; a `*QueryBuilder`-scoped entry would be
+  // near-dead since receivers are rarely named that). Precision is inherent
+  // to the flow: parameterised use (`:id` placeholders + a params object)
+  // keeps input out of the string literal, so a finding fires only on
+  // concatenation.
+  { method: "andWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orWhere", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "andHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "orHaving", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
@@ -12290,6 +12329,12 @@ var DEFAULT_SINKS = [
   { method: "executemany", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "extra", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Django RawSQL expression (django.db.models.expressions.RawSQL) — the raw
+  // SQL fragment in arg[0] is embedded verbatim into the query when the
+  // annotate/filter/order_by containing it runs. Distinctive constructor name,
+  // so classless + python-scoped is safe. Parameterised use passes user input
+  // through arg[1] (`RawSQL("... %s", [uid])`), which keeps it out of arg[0].
+  { method: "RawSQL", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
   // Python Path Traversal
   // Language-scoped: classless `open` collides with Java I/O / JS DOM.
   { method: "open", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["python"] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.199.0",
+  "version": "3.201.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",