circle-ir 3.206.0 → 3.209.0

package/dist/browser/circle-ir.js

@@ -12187,8 +12187,16 @@ var DEFAULT_SINKS = [
   // node ClientRequest.write, etc.) as xss. Real HTML writers are covered
   // by class-scoped entries: PrintWriter.write (line 843), ServletOutputStream.write
   // (line 849), JspWriter.write (xss.yaml), Response.write (nodejs.json).
-  { method: "append", class: "StringBuilder", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "append", class: "StringBuffer", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
+  // NOTE (cognium-ai#268): `StringBuilder.append` / `StringBuffer.append` were
+  // registered here as xss sinks, but string construction is NOT an HTML-output
+  // context — the actual sink is wherever the built string is later written to
+  // a response / template (PrintWriter, ServletOutputStream, JspWriter, etc.,
+  // which taint propagation reaches via `sb.toString()`). This was the #1
+  // crit/high FP bucket on the top-100 Java sweep (fires on every append,
+  // incl. constant args). Removed globally: measured 0 OWASP xss true-positive
+  // loss (every xss TP has a real HTML-output sink), and the #244
+  // LibraryProfileXssGatePass already dropped them for `library/*`. Taint still
+  // flows source → StringBuilder → real write sink.
   // Wiki/CMS XSS sinks (JSPWiki, Confluence, etc.)
   { method: "handleHyperlinks", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "handleDiv", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -32457,6 +32465,8 @@ var SQL_EXEC_METHODS = /* @__PURE__ */ new Set([
   "addBatch"
 ]);
 var JAVA_SQL_ASSIGN_RE_TEMPLATE = "\\b(?:String|CharSequence|final\\s+String|var)\\s+SQLVAR\\b\\s*=\\s*(.+?);";
+var REPLACE_ALL_TO_PLACEHOLDER_RE = /\.replaceAll\s*\([\s\S]*?,\s*"[\s,?]*\?[\s,?]*"\s*\)/;
+var HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
 var JAVA_INLINE_MATCHES_RE = /\.\s*matches\s*\(\s*"((?:[^"\\]|\\.)*)"\s*\)/g;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver)) return null;
@@ -33131,6 +33141,18 @@ var SinkFilterPass = class {
         return true;
       });
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split("\n");
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "sql_injection") return true;
+        if (!SQL_EXEC_METHODS.has(sink.method ?? "")) return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        return !REPLACE_ALL_TO_PLACEHOLDER_RE.test(sinkLineText);
+      });
+    }
+    if (language === "java" && !HTML_CONTENT_TYPE_RE.test(ctx.code)) {
+      filtered = filtered.filter((sink) => !(sink.type === "xss" && sink.method === "body"));
+    }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split("\n");
       filtered = filtered.filter((sink) => {
@@ -39911,6 +39933,34 @@ function shannonEntropy(s) {
   return h;
 }
 var CREDENTIAL_NAME_RE = /(?:key|secret|token|password|passwd|credential|api[_-]?key)/i;
+var CONNECTION_STRING_RE = /\b([a-z][a-z0-9+.-]{1,20}):\/\/([^\s:/@"'`]*):([^\s:/@"'`]{2,})@/i;
+var PASSWORD_INTERPOLATION_RE = /\$\{|\$\(|\{\{|%\([^)]*\)[sd]|%[sdvfeg]\b|[{}<>]/i;
+var PLACEHOLDER_PASSWORD_WORDS = /* @__PURE__ */ new Set([
+  "password",
+  "passwd",
+  "pass",
+  "pwd",
+  "secret",
+  "user",
+  "username",
+  "changeme",
+  "example",
+  "yourpassword",
+  "your_password",
+  "test",
+  "xxx",
+  "xxxx"
+]);
+function matchConnectionStringCredential(lineText) {
+  const m = CONNECTION_STRING_RE.exec(lineText);
+  if (!m) return null;
+  const password = m[3];
+  if (/^\d+$/.test(password)) return null;
+  if (PLACEHOLDER_PASSWORD_WORDS.has(password.toLowerCase())) return null;
+  if (PLACEHOLDER_RE.test(password)) return null;
+  if (PASSWORD_INTERPOLATION_RE.test(password)) return null;
+  return { scheme: m[1], match: m[0].substring(0, 60) };
+}
 function findAnnotationLineRanges(code) {
   const lines = code.split("\n");
   const inAnnotation = /* @__PURE__ */ new Set();
@@ -40106,6 +40156,32 @@ var ScanSecretsPass = class {
       });
       providerFindings += 1;
     }
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const lineText = lines[i2];
+      const lineNum = i2 + 1;
+      const hit = matchConnectionStringCredential(lineText);
+      if (!hit) continue;
+      const key = `${lineNum}:hardcoded-credential`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const dg = applyDemoDowngrade(demoPath, "high", "error");
+      ctx.addFinding({
+        id: `hardcoded-credential-${file}-${lineNum}`,
+        pass: this.name,
+        category: this.category,
+        rule_id: "hardcoded-credential",
+        cwe: "CWE-798",
+        severity: dg.severity,
+        level: dg.level,
+        message: `Hardcoded credential: password embedded in a ${hit.scheme} connection string`,
+        file,
+        line: lineNum,
+        snippet: lineText.trim().substring(0, 120),
+        fix: "Move the credential out of the connection string into an environment variable or secrets manager, and rotate the exposed password.",
+        evidence: { kind: "connection-string", scheme: hit.scheme, match: hit.match }
+      });
+      providerFindings += 1;
+    }
     if (hasEntropyCandidate) for (let i2 = 0; i2 < lines.length; i2++) {
       const lineText = lines[i2];
       const lineNum = i2 + 1;

package/dist/core/circle-ir-core.cjs

@@ -11582,8 +11582,16 @@ var DEFAULT_SINKS = [
   // node ClientRequest.write, etc.) as xss. Real HTML writers are covered
   // by class-scoped entries: PrintWriter.write (line 843), ServletOutputStream.write
   // (line 849), JspWriter.write (xss.yaml), Response.write (nodejs.json).
-  { method: "append", class: "StringBuilder", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "append", class: "StringBuffer", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
+  // NOTE (cognium-ai#268): `StringBuilder.append` / `StringBuffer.append` were
+  // registered here as xss sinks, but string construction is NOT an HTML-output
+  // context — the actual sink is wherever the built string is later written to
+  // a response / template (PrintWriter, ServletOutputStream, JspWriter, etc.,
+  // which taint propagation reaches via `sb.toString()`). This was the #1
+  // crit/high FP bucket on the top-100 Java sweep (fires on every append,
+  // incl. constant args). Removed globally: measured 0 OWASP xss true-positive
+  // loss (every xss TP has a real HTML-output sink), and the #244
+  // LibraryProfileXssGatePass already dropped them for `library/*`. Taint still
+  // flows source → StringBuilder → real write sink.
   // Wiki/CMS XSS sinks (JSPWiki, Confluence, etc.)
   { method: "handleHyperlinks", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "handleDiv", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },

package/dist/core/circle-ir-core.js

@@ -11516,8 +11516,16 @@ var DEFAULT_SINKS = [
   // node ClientRequest.write, etc.) as xss. Real HTML writers are covered
   // by class-scoped entries: PrintWriter.write (line 843), ServletOutputStream.write
   // (line 849), JspWriter.write (xss.yaml), Response.write (nodejs.json).
-  { method: "append", class: "StringBuilder", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "append", class: "StringBuffer", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
+  // NOTE (cognium-ai#268): `StringBuilder.append` / `StringBuffer.append` were
+  // registered here as xss sinks, but string construction is NOT an HTML-output
+  // context — the actual sink is wherever the built string is later written to
+  // a response / template (PrintWriter, ServletOutputStream, JspWriter, etc.,
+  // which taint propagation reaches via `sb.toString()`). This was the #1
+  // crit/high FP bucket on the top-100 Java sweep (fires on every append,
+  // incl. constant args). Removed globally: measured 0 OWASP xss true-positive
+  // loss (every xss TP has a real HTML-output sink), and the #244
+  // LibraryProfileXssGatePass already dropped them for `library/*`. Taint still
+  // flows source → StringBuilder → real write sink.
   // Wiki/CMS XSS sinks (JSPWiki, Confluence, etc.)
   { method: "handleHyperlinks", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "handleDiv", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.206.0",
+  "version": "3.209.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",