circle-ir 3.209.0 → 3.212.0

package/dist/browser/circle-ir.js

@@ -13156,9 +13156,16 @@ var DEFAULT_SINKS = [
   // HTML sanitizer bypass markers (known CVE patterns)
   { method: "clean", class: "AntiSamy", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "getValidSafeHTML", class: "ESAPI", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  // Request/session attribute reflection XSS (return value is tainted)
-  { method: "getAttribute", class: "HttpServletRequest", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
-  { method: "getAttribute", class: "HttpSession", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
+  // NOTE (cognium-dev#270): `HttpServletRequest`/`HttpSession.getAttribute()`
+  // were registered here as xss sinks to model "attribute reflection XSS", but
+  // getAttribute is a *read* — its return value is tainted (a SOURCE, already
+  // registered as `io_input` above), never an HTML-output context. With
+  // `arg_positions: []` the entry produced a degenerate source==sink self-flow
+  // (the same getAttribute call flagged as both), firing CWE-79 on route-helper
+  // reads that are never rendered (elide `getPath`). The real sink is wherever
+  // the read value is later written to a response (getWriter/JspWriter/template),
+  // which the io_input source reaches on its own. Same over-broad-sink family as
+  // #268 (StringBuilder.append). Removed.
   // =========================================================================
   // Rust Sinks
   // =========================================================================
@@ -16203,6 +16210,70 @@ function isNonExecutablePython(trimmed) {
   return false;
 }
 
+// src/analysis/sanitizer-index.ts
+var SANITIZER_SET_CACHE = /* @__PURE__ */ new WeakMap();
+function getSanitizesSet(san) {
+  let s = SANITIZER_SET_CACHE.get(san);
+  if (!s) {
+    s = new Set(san.sanitizes);
+    SANITIZER_SET_CACHE.set(san, s);
+  }
+  return s;
+}
+function sanitizerCoversSink(san, sinkType) {
+  return getSanitizesSet(san).has(sinkType);
+}
+
+// src/analysis/dfg-walk.ts
+var walkBackwardDefsMemo = /* @__PURE__ */ new WeakMap();
+function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
+  const maxHops = options.maxHops ?? 32;
+  let perFile = walkBackwardDefsMemo.get(chainsByToDef);
+  if (perFile !== void 0) {
+    const key = `${startDefId}|${maxHops}`;
+    const hit = perFile.get(key);
+    if (hit !== void 0) return hit;
+  }
+  const visited = /* @__PURE__ */ new Set();
+  const lines = /* @__PURE__ */ new Set();
+  let hopCapReached = false;
+  const startDef = defById.get(startDefId);
+  if (!startDef) {
+    return { visited, lines, hopCapReached: false };
+  }
+  visited.add(startDefId);
+  lines.add(startDef.line);
+  const queue = [startDefId];
+  let hops = 0;
+  while (queue.length > 0) {
+    if (hops >= maxHops) {
+      hopCapReached = true;
+      break;
+    }
+    hops++;
+    const currentId = queue.shift();
+    const incoming = chainsByToDef.get(currentId);
+    if (!incoming) continue;
+    for (const chain of incoming) {
+      const fromId = chain.from_def;
+      if (visited.has(fromId)) continue;
+      visited.add(fromId);
+      const fromDef = defById.get(fromId);
+      if (fromDef) {
+        lines.add(fromDef.line);
+      }
+      queue.push(fromId);
+    }
+  }
+  const result = { visited, lines, hopCapReached };
+  if (perFile === void 0) {
+    perFile = /* @__PURE__ */ new Map();
+    walkBackwardDefsMemo.set(chainsByToDef, perFile);
+  }
+  perFile.set(`${startDefId}|${maxHops}`, result);
+  return result;
+}
+
 // src/analysis/findings.ts
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
@@ -17568,70 +17639,6 @@ var AnalysisPipeline = class {
   }
 };
 
-// src/analysis/dfg-walk.ts
-var walkBackwardDefsMemo = /* @__PURE__ */ new WeakMap();
-function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
-  const maxHops = options.maxHops ?? 32;
-  let perFile = walkBackwardDefsMemo.get(chainsByToDef);
-  if (perFile !== void 0) {
-    const key = `${startDefId}|${maxHops}`;
-    const hit = perFile.get(key);
-    if (hit !== void 0) return hit;
-  }
-  const visited = /* @__PURE__ */ new Set();
-  const lines = /* @__PURE__ */ new Set();
-  let hopCapReached = false;
-  const startDef = defById.get(startDefId);
-  if (!startDef) {
-    return { visited, lines, hopCapReached: false };
-  }
-  visited.add(startDefId);
-  lines.add(startDef.line);
-  const queue = [startDefId];
-  let hops = 0;
-  while (queue.length > 0) {
-    if (hops >= maxHops) {
-      hopCapReached = true;
-      break;
-    }
-    hops++;
-    const currentId = queue.shift();
-    const incoming = chainsByToDef.get(currentId);
-    if (!incoming) continue;
-    for (const chain of incoming) {
-      const fromId = chain.from_def;
-      if (visited.has(fromId)) continue;
-      visited.add(fromId);
-      const fromDef = defById.get(fromId);
-      if (fromDef) {
-        lines.add(fromDef.line);
-      }
-      queue.push(fromId);
-    }
-  }
-  const result = { visited, lines, hopCapReached };
-  if (perFile === void 0) {
-    perFile = /* @__PURE__ */ new Map();
-    walkBackwardDefsMemo.set(chainsByToDef, perFile);
-  }
-  perFile.set(`${startDefId}|${maxHops}`, result);
-  return result;
-}
-
-// src/analysis/sanitizer-index.ts
-var SANITIZER_SET_CACHE = /* @__PURE__ */ new WeakMap();
-function getSanitizesSet(san) {
-  let s = SANITIZER_SET_CACHE.get(san);
-  if (!s) {
-    s = new Set(san.sanitizes);
-    SANITIZER_SET_CACHE.set(san, s);
-  }
-  return s;
-}
-function sanitizerCoversSink(san, sinkType) {
-  return getSanitizesSet(san).has(sinkType);
-}
-
 // src/analysis/taint-propagation.ts
 function buildSanitizersByLine(sanitizers) {
   const out2 = /* @__PURE__ */ new Map();
@@ -32467,6 +32474,43 @@ var SQL_EXEC_METHODS = /* @__PURE__ */ new Set([
 var JAVA_SQL_ASSIGN_RE_TEMPLATE = "\\b(?:String|CharSequence|final\\s+String|var)\\s+SQLVAR\\b\\s*=\\s*(.+?);";
 var REPLACE_ALL_TO_PLACEHOLDER_RE = /\.replaceAll\s*\([\s\S]*?,\s*"[\s,?]*\?[\s,?]*"\s*\)/;
 var HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
+function javaTraversalRejectGuardedLines(code) {
+  const covered = /* @__PURE__ */ new Set();
+  const lines = code.split("\n");
+  const guardOpen = /\bif\s*\(\s*([A-Za-z_]\w*)\s*\.\s*contains\s*\(\s*"[^"]*\.\.[^"]*"\s*\)/;
+  const terminatorRe = /\b(throw|return)\b/;
+  const assignRe = /^\s*(?:[A-Za-z_][\w.<>[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = guardOpen.exec(lines[i2]);
+    if (!m) continue;
+    let hasTerminator = terminatorRe.test(lines[i2]);
+    if (!hasTerminator) {
+      for (let j = i2 + 1; j < Math.min(lines.length, i2 + 6); j++) {
+        if (terminatorRe.test(lines[j])) {
+          hasTerminator = true;
+          break;
+        }
+        if (lines[j].includes("}")) break;
+      }
+    }
+    if (!hasTerminator) continue;
+    const guarded = /* @__PURE__ */ new Set([m[1]]);
+    const mentionsGuarded = (text) => {
+      for (const name2 of guarded) if (new RegExp(`\\b${name2}\\b`).test(text)) return true;
+      return false;
+    };
+    for (let l = i2 + 1; l < lines.length; l++) {
+      const lineText = lines[l];
+      const assign = assignRe.exec(lineText);
+      if (assign) {
+        if (mentionsGuarded(assign[2])) guarded.add(assign[1]);
+        else if (assign[1] !== m[1]) guarded.delete(assign[1]);
+      }
+      if (mentionsGuarded(lineText)) covered.add(l + 1);
+    }
+  }
+  return covered;
+}
 var JAVA_INLINE_MATCHES_RE = /\.\s*matches\s*\(\s*"((?:[^"\\]|\\.)*)"\s*\)/g;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver)) return null;
@@ -33153,6 +33197,14 @@ var SinkFilterPass = class {
     if (language === "java" && !HTML_CONTENT_TYPE_RE.test(ctx.code)) {
       filtered = filtered.filter((sink) => !(sink.type === "xss" && sink.method === "body"));
     }
+    if (language === "java") {
+      const guardedLines = javaTraversalRejectGuardedLines(ctx.code);
+      if (guardedLines.size > 0) {
+        filtered = filtered.filter(
+          (sink) => !(sink.type === "path_traversal" && guardedLines.has(sink.line))
+        );
+      }
+    }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split("\n");
       filtered = filtered.filter((sink) => {

package/dist/core/circle-ir-core.cjs

@@ -12551,9 +12551,16 @@ var DEFAULT_SINKS = [
   // HTML sanitizer bypass markers (known CVE patterns)
   { method: "clean", class: "AntiSamy", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "getValidSafeHTML", class: "ESAPI", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  // Request/session attribute reflection XSS (return value is tainted)
-  { method: "getAttribute", class: "HttpServletRequest", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
-  { method: "getAttribute", class: "HttpSession", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
+  // NOTE (cognium-dev#270): `HttpServletRequest`/`HttpSession.getAttribute()`
+  // were registered here as xss sinks to model "attribute reflection XSS", but
+  // getAttribute is a *read* — its return value is tainted (a SOURCE, already
+  // registered as `io_input` above), never an HTML-output context. With
+  // `arg_positions: []` the entry produced a degenerate source==sink self-flow
+  // (the same getAttribute call flagged as both), firing CWE-79 on route-helper
+  // reads that are never rendered (elide `getPath`). The real sink is wherever
+  // the read value is later written to a response (getWriter/JspWriter/template),
+  // which the io_input source reaches on its own. Same over-broad-sink family as
+  // #268 (StringBuilder.append). Removed.
   // =========================================================================
   // Rust Sinks
   // =========================================================================

package/dist/core/circle-ir-core.js

@@ -12485,9 +12485,16 @@ var DEFAULT_SINKS = [
   // HTML sanitizer bypass markers (known CVE patterns)
   { method: "clean", class: "AntiSamy", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "getValidSafeHTML", class: "ESAPI", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  // Request/session attribute reflection XSS (return value is tainted)
-  { method: "getAttribute", class: "HttpServletRequest", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
-  { method: "getAttribute", class: "HttpSession", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
+  // NOTE (cognium-dev#270): `HttpServletRequest`/`HttpSession.getAttribute()`
+  // were registered here as xss sinks to model "attribute reflection XSS", but
+  // getAttribute is a *read* — its return value is tainted (a SOURCE, already
+  // registered as `io_input` above), never an HTML-output context. With
+  // `arg_positions: []` the entry produced a degenerate source==sink self-flow
+  // (the same getAttribute call flagged as both), firing CWE-79 on route-helper
+  // reads that are never rendered (elide `getPath`). The real sink is wherever
+  // the read value is later written to a response (getWriter/JspWriter/template),
+  // which the io_input source reaches on its own. Same over-broad-sink family as
+  // #268 (StringBuilder.append). Removed.
   // =========================================================================
   // Rust Sinks
   // =========================================================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.209.0",
+  "version": "3.212.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",