circle-ir 3.210.0 → 3.213.0

package/dist/browser/circle-ir.js

@@ -13156,9 +13156,16 @@ var DEFAULT_SINKS = [
   // HTML sanitizer bypass markers (known CVE patterns)
   { method: "clean", class: "AntiSamy", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "getValidSafeHTML", class: "ESAPI", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  // Request/session attribute reflection XSS (return value is tainted)
-  { method: "getAttribute", class: "HttpServletRequest", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
-  { method: "getAttribute", class: "HttpSession", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
+  // NOTE (cognium-dev#270): `HttpServletRequest`/`HttpSession.getAttribute()`
+  // were registered here as xss sinks to model "attribute reflection XSS", but
+  // getAttribute is a *read* — its return value is tainted (a SOURCE, already
+  // registered as `io_input` above), never an HTML-output context. With
+  // `arg_positions: []` the entry produced a degenerate source==sink self-flow
+  // (the same getAttribute call flagged as both), firing CWE-79 on route-helper
+  // reads that are never rendered (elide `getPath`). The real sink is wherever
+  // the read value is later written to a response (getWriter/JspWriter/template),
+  // which the io_input source reaches on its own. Same over-broad-sink family as
+  // #268 (StringBuilder.append). Removed.
   // =========================================================================
   // Rust Sinks
   // =========================================================================
@@ -16203,6 +16210,70 @@ function isNonExecutablePython(trimmed) {
   return false;
 }
 
+// src/analysis/sanitizer-index.ts
+var SANITIZER_SET_CACHE = /* @__PURE__ */ new WeakMap();
+function getSanitizesSet(san) {
+  let s = SANITIZER_SET_CACHE.get(san);
+  if (!s) {
+    s = new Set(san.sanitizes);
+    SANITIZER_SET_CACHE.set(san, s);
+  }
+  return s;
+}
+function sanitizerCoversSink(san, sinkType) {
+  return getSanitizesSet(san).has(sinkType);
+}
+
+// src/analysis/dfg-walk.ts
+var walkBackwardDefsMemo = /* @__PURE__ */ new WeakMap();
+function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
+  const maxHops = options.maxHops ?? 32;
+  let perFile = walkBackwardDefsMemo.get(chainsByToDef);
+  if (perFile !== void 0) {
+    const key = `${startDefId}|${maxHops}`;
+    const hit = perFile.get(key);
+    if (hit !== void 0) return hit;
+  }
+  const visited = /* @__PURE__ */ new Set();
+  const lines = /* @__PURE__ */ new Set();
+  let hopCapReached = false;
+  const startDef = defById.get(startDefId);
+  if (!startDef) {
+    return { visited, lines, hopCapReached: false };
+  }
+  visited.add(startDefId);
+  lines.add(startDef.line);
+  const queue = [startDefId];
+  let hops = 0;
+  while (queue.length > 0) {
+    if (hops >= maxHops) {
+      hopCapReached = true;
+      break;
+    }
+    hops++;
+    const currentId = queue.shift();
+    const incoming = chainsByToDef.get(currentId);
+    if (!incoming) continue;
+    for (const chain of incoming) {
+      const fromId = chain.from_def;
+      if (visited.has(fromId)) continue;
+      visited.add(fromId);
+      const fromDef = defById.get(fromId);
+      if (fromDef) {
+        lines.add(fromDef.line);
+      }
+      queue.push(fromId);
+    }
+  }
+  const result = { visited, lines, hopCapReached };
+  if (perFile === void 0) {
+    perFile = /* @__PURE__ */ new Map();
+    walkBackwardDefsMemo.set(chainsByToDef, perFile);
+  }
+  perFile.set(`${startDefId}|${maxHops}`, result);
+  return result;
+}
+
 // src/analysis/findings.ts
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
@@ -17568,70 +17639,6 @@ var AnalysisPipeline = class {
   }
 };
 
-// src/analysis/dfg-walk.ts
-var walkBackwardDefsMemo = /* @__PURE__ */ new WeakMap();
-function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
-  const maxHops = options.maxHops ?? 32;
-  let perFile = walkBackwardDefsMemo.get(chainsByToDef);
-  if (perFile !== void 0) {
-    const key = `${startDefId}|${maxHops}`;
-    const hit = perFile.get(key);
-    if (hit !== void 0) return hit;
-  }
-  const visited = /* @__PURE__ */ new Set();
-  const lines = /* @__PURE__ */ new Set();
-  let hopCapReached = false;
-  const startDef = defById.get(startDefId);
-  if (!startDef) {
-    return { visited, lines, hopCapReached: false };
-  }
-  visited.add(startDefId);
-  lines.add(startDef.line);
-  const queue = [startDefId];
-  let hops = 0;
-  while (queue.length > 0) {
-    if (hops >= maxHops) {
-      hopCapReached = true;
-      break;
-    }
-    hops++;
-    const currentId = queue.shift();
-    const incoming = chainsByToDef.get(currentId);
-    if (!incoming) continue;
-    for (const chain of incoming) {
-      const fromId = chain.from_def;
-      if (visited.has(fromId)) continue;
-      visited.add(fromId);
-      const fromDef = defById.get(fromId);
-      if (fromDef) {
-        lines.add(fromDef.line);
-      }
-      queue.push(fromId);
-    }
-  }
-  const result = { visited, lines, hopCapReached };
-  if (perFile === void 0) {
-    perFile = /* @__PURE__ */ new Map();
-    walkBackwardDefsMemo.set(chainsByToDef, perFile);
-  }
-  perFile.set(`${startDefId}|${maxHops}`, result);
-  return result;
-}
-
-// src/analysis/sanitizer-index.ts
-var SANITIZER_SET_CACHE = /* @__PURE__ */ new WeakMap();
-function getSanitizesSet(san) {
-  let s = SANITIZER_SET_CACHE.get(san);
-  if (!s) {
-    s = new Set(san.sanitizes);
-    SANITIZER_SET_CACHE.set(san, s);
-  }
-  return s;
-}
-function sanitizerCoversSink(san, sinkType) {
-  return getSanitizesSet(san).has(sinkType);
-}
-
 // src/analysis/taint-propagation.ts
 function buildSanitizersByLine(sanitizers) {
   const out2 = /* @__PURE__ */ new Map();
@@ -26168,6 +26175,7 @@ var LanguageSourcesPass = class {
         ...findJavaPathNormalizeStartsWithGuardSanitizers(code)
       );
       additionalSanitizers.push(...findJavaPathGetFileNameSanitizers(code));
+      additionalSanitizers.push(...findJavaCanonicalPathStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
       additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
@@ -28719,19 +28727,65 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const guardRe = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*getCanonicalPath\s*\(\s*\)\s*\.\s*startsWith\s*\(/;
+  const terminatorRe = /\b(throw|return)\b/;
+  const assignRe = /^\s*(?:[A-Za-z_][\w.<>[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = guardRe.exec(lines[i2]);
+    if (!m) continue;
+    let hasTerminator = terminatorRe.test(lines[i2]);
+    if (!hasTerminator) {
+      for (let j = i2 + 1; j < Math.min(lines.length, i2 + 6); j++) {
+        if (terminatorRe.test(lines[j])) {
+          hasTerminator = true;
+          break;
+        }
+        if (lines[j].includes("}")) break;
+      }
+    }
+    if (!hasTerminator) continue;
+    const guarded = /* @__PURE__ */ new Set([m[1]]);
+    const mentions = (t) => {
+      for (const n of guarded) if (new RegExp(`\\b${n}\\b`).test(t)) return true;
+      return false;
+    };
+    for (let l = 0; l < lines.length; l++) {
+      const lt = lines[l];
+      const a = assignRe.exec(lt);
+      if (a) {
+        if (mentions(a[2])) guarded.add(a[1]);
+        else if (a[1] !== m[1]) guarded.delete(a[1]);
+      }
+      if (mentions(lt)) {
+        sanitizers.push({
+          type: "java_canonical_startswith_guard",
+          method: "getCanonicalPath",
+          line: l + 1,
+          sanitizes: ["path_traversal", "external_taint_escape"]
+        });
+      }
+    }
+  }
+  return sanitizers;
+}
 function findJavaPathGetFileNameSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
   const assignmentRe2 = /^\s*(?:(?:final\s+)?[A-Za-z_][\w.<>?,\s\[\]]*?\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const rhsHasGetFileNameRe = /\.\s*getFileName\s*\(\s*\)/;
   const rhsHasPathsChainRe = /\b(?:Paths\s*\.\s*get|Path\s*\.\s*of)\s*\(/;
+  const rhsNewFileGetNameRe = /\bnew\s+File\s*\([\s\S]*\)\s*\.\s*getName\s*\(\s*\)/;
   const candidates = [];
   for (let i2 = 0; i2 < lines.length; i2++) {
     const m = assignmentRe2.exec(lines[i2]);
     if (!m) continue;
     const rhs = m[2];
-    if (!rhsHasGetFileNameRe.test(rhs)) continue;
-    if (!rhsHasPathsChainRe.test(rhs)) continue;
+    const isNioGetFileName = rhsHasGetFileNameRe.test(rhs) && rhsHasPathsChainRe.test(rhs);
+    const isNewFileGetName = rhsNewFileGetNameRe.test(rhs);
+    if (!isNioGetFileName && !isNewFileGetName) continue;
     candidates.push({ line: i2 + 1, boundVar: m[1] });
   }
   if (candidates.length === 0) return sanitizers;

package/dist/core/circle-ir-core.cjs

@@ -12551,9 +12551,16 @@ var DEFAULT_SINKS = [
   // HTML sanitizer bypass markers (known CVE patterns)
   { method: "clean", class: "AntiSamy", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "getValidSafeHTML", class: "ESAPI", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  // Request/session attribute reflection XSS (return value is tainted)
-  { method: "getAttribute", class: "HttpServletRequest", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
-  { method: "getAttribute", class: "HttpSession", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
+  // NOTE (cognium-dev#270): `HttpServletRequest`/`HttpSession.getAttribute()`
+  // were registered here as xss sinks to model "attribute reflection XSS", but
+  // getAttribute is a *read* — its return value is tainted (a SOURCE, already
+  // registered as `io_input` above), never an HTML-output context. With
+  // `arg_positions: []` the entry produced a degenerate source==sink self-flow
+  // (the same getAttribute call flagged as both), firing CWE-79 on route-helper
+  // reads that are never rendered (elide `getPath`). The real sink is wherever
+  // the read value is later written to a response (getWriter/JspWriter/template),
+  // which the io_input source reaches on its own. Same over-broad-sink family as
+  // #268 (StringBuilder.append). Removed.
   // =========================================================================
   // Rust Sinks
   // =========================================================================

package/dist/core/circle-ir-core.js

@@ -12485,9 +12485,16 @@ var DEFAULT_SINKS = [
   // HTML sanitizer bypass markers (known CVE patterns)
   { method: "clean", class: "AntiSamy", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "getValidSafeHTML", class: "ESAPI", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  // Request/session attribute reflection XSS (return value is tainted)
-  { method: "getAttribute", class: "HttpServletRequest", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
-  { method: "getAttribute", class: "HttpSession", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
+  // NOTE (cognium-dev#270): `HttpServletRequest`/`HttpSession.getAttribute()`
+  // were registered here as xss sinks to model "attribute reflection XSS", but
+  // getAttribute is a *read* — its return value is tainted (a SOURCE, already
+  // registered as `io_input` above), never an HTML-output context. With
+  // `arg_positions: []` the entry produced a degenerate source==sink self-flow
+  // (the same getAttribute call flagged as both), firing CWE-79 on route-helper
+  // reads that are never rendered (elide `getPath`). The real sink is wherever
+  // the read value is later written to a response (getWriter/JspWriter/template),
+  // which the io_input source reaches on its own. Same over-broad-sink family as
+  // #268 (StringBuilder.append). Removed.
   // =========================================================================
   // Rust Sinks
   // =========================================================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.210.0",
+  "version": "3.213.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",