circle-ir 3.214.0 → 3.216.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/config-loader.d.ts.map +1 -1
- package/dist/analysis/config-loader.js +9 -3
- package/dist/analysis/config-loader.js.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.js +126 -0
- package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
- package/dist/browser/circle-ir.js +82 -3
- package/dist/core/circle-ir-core.cjs +9 -3
- package/dist/core/circle-ir-core.js +9 -3
- package/package.json +1 -1
|
@@ -11507,9 +11507,15 @@ var DEFAULT_SINKS = [
|
|
|
11507
11507
|
{ method: "addAttribute", class: "Model", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
|
|
11508
11508
|
{ method: "addAttribute", class: "ModelMap", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
|
|
11509
11509
|
{ method: "addObject", class: "ModelAndView", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
|
|
11510
|
-
// Class-less XSS patterns for cases where receiver type is inferred
|
|
11511
|
-
|
|
11512
|
-
|
|
11510
|
+
// Class-less XSS patterns for cases where the receiver type is inferred.
|
|
11511
|
+
// Scoped to Java (skillsregistry#51): these exist to catch servlet-output
|
|
11512
|
+
// writers (`PrintWriter`/`JspWriter`) whose receiver type Tree-sitter did not
|
|
11513
|
+
// resolve. Without the `languages` scope they leaked to other ecosystems —
|
|
11514
|
+
// notably Python `print(user_input)`, which writes to stdout and is never an
|
|
11515
|
+
// XSS sink. Java `PrintWriter.print`/`println` (class-scoped above) plus these
|
|
11516
|
+
// inferred-receiver fallbacks keep real Java servlet XSS firing.
|
|
11517
|
+
{ method: "println", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0], languages: ["java"] },
|
|
11518
|
+
{ method: "print", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0], languages: ["java"] },
|
|
11513
11519
|
// NOTE: the unscoped { method: 'write', type: 'xss' } entry was removed in
|
|
11514
11520
|
// Sprint 28 (#110). It mistyped every non-XSS .write() across all languages
|
|
11515
11521
|
// (fs.writeFile, open().write, bcrypt callbacks, credential file writes,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.216.0",
|
|
4
4
|
"description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|