circle-ir 3.215.0 → 4.0.0

package/dist/analysis/passes/sink-filter-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AACzG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA2qB9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;CAwiCxC;AAkRD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA4I1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA6E5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GACvB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2C5B"}
+{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AACzG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA61B9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;CAuoCxC;AAkRD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA4I1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA6E5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GACvB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2C5B"}

package/dist/analysis/passes/sink-filter-pass.js

@@ -355,6 +355,42 @@ const HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
 // entries, so dropping the member-receiver form loses no modelled SSRF sink.
 const FETCH_GLOBAL_RECEIVER_RE = /(?:^|[^.\w])(?:window|globalThis|self|global)\s*\.\s*fetch\s*\(/;
 const FETCH_MEMBER_RECEIVER_RE = /[\w$)\]]\s*\.\s*fetch\s*\(/;
+// cognium-ai#279 R-2 — `Array.prototype.find`/`filter`/… take a *function*
+// predicate; a `nosql_injection` sink only makes sense when the argument is a
+// query object. `user.accounts.find(a => a.providerId === x)` is an array scan,
+// not a Mongo query. A function first argument (arrow or `function`) proves it
+// is the Array method, mirroring the `setTimeout(fn)` "arg is a function ⇒ not a
+// sink" test. Real `collection.find({ ... })` passes an object literal and is
+// unaffected.
+const NOSQL_ARRAY_METHODS = new Set(['find', 'filter', 'some', 'every', 'findIndex', 'findLast']);
+const FUNCTION_FIRST_ARG_RE = /\.\s*(?:find|filter|some|every|findIndex|findLast)\s*\(\s*(?:async\s+)?(?:function\b|(?:\([^()]*\)|[A-Za-z_$][\w$]*)\s*=>)/;
+// cognium-ai#279 R-1 — an argument that is an object literal with an ORM
+// query-builder key (`where`/`select`/`populate`/…) is a *builder*, not a raw
+// query string: a value in a `{ field, value }` position binds as a parameter
+// and cannot carry an operator. `adapter.findOne({ where: [...] })` /
+// `repo.findMany({ where: {...} })` are the Node analogue of #247's
+// PreparedStatement class. A real `db.query("SELECT … WHERE …")` has no
+// `key:` colon syntax and is unaffected.
+const ORM_BUILDER_KEY_RE = /[{,]\s*(?:where|select|populate|include|orderBy|relations|attributes)\s*:/;
+// cognium-ai#279 R-3 — SSRF requires a server-side requester; a `fetch`/`axios`
+// call in a browser-rendered client component cannot be SSRF (the browser makes
+// the request, subject to CORS, not the server). Suppress `ssrf` ONLY when all
+// three hold, so real server-side fetches are never touched:
+//   (a) the file is a component extension (.jsx/.tsx/.vue/.svelte), AND
+//   (b) it carries a positive CLIENT signal (`"use client"`, React hooks,
+//       browser globals, JSX event handlers), AND
+//   (c) it carries NO server signal (`"use server"`, next/server, SSR data
+//       hooks, API-route handler, Node server imports).
+// A Next.js Server Component or API route doing `fetch(userUrl)` has no client
+// signal (and usually a server one), so it keeps firing — zero false negatives.
+const BROWSER_COMPONENT_EXT_RE = /\.(?:jsx|tsx|vue|svelte)$/;
+const CLIENT_SIGNAL_RE = /["']use client["']|\buse(?:State|Effect|Ref|Callback|Memo|Context|Reducer|LayoutEffect)\s*\(|\b(?:window|document|localStorage|sessionStorage|navigator)\s*\.|\son(?:Click|Change|Submit|Input|KeyDown|KeyUp|MouseOver|Focus|Blur)\s*=/;
+const SERVER_SIGNAL_RE = /["']use server["']|\b(?:getServerSideProps|getStaticProps|getStaticPaths)\b|from\s+["']next\/server["']|\bNext(?:Api)?(?:Request|Response)\b|from\s+["'](?:node:)?(?:fs|child_process|http|https|net|dns|dgram)["']|\bexport\s+(?:default\s+)?(?:async\s+)?function\s+handler\s*\(/;
+// cognium-ai#279 R-6 — a template-literal URL whose host is a fixed literal
+// (`https://api.github.com/${path}`) is not SSRF: only the path is
+// interpolated, the destination host is not attacker-controlled. Matches a
+// backtick + scheme + a literal host run (no `${` before the first `/`).
+const FIXED_HOST_TEMPLATE_RE = /`https?:\/\/[^/${}\s`]+[/`]/;
 /**
  * Returns the 1-indexed line numbers that a Java `if (x.contains("..")) throw/
  * return` reject-guard makes path-traversal-safe (cognium-dev#269). A line is
@@ -408,6 +444,154 @@ function javaTraversalRejectGuardedLines(code) {
     }
     return covered;
 }
+// skillsregistry#49b — a fetch/HTTP call whose URL is constrained by an anchored
+// host allow-list is not arbitrary-URL SSRF. Recognise reject-guards
+// (throw/return) that pin the tainted URL to a fixed host set:
+//   if (!/^https:\/\/(www\.)?host\.com\//.test(url)) throw ...
+//   if (!url.startsWith("https://api.github.com/")) return ...
+// The guard must name the scheme AND contain a literal domain label (a
+// letter-led run followed by a dot) — a bare `^https?:\/\/` with no host does
+// not constrain the destination and is deliberately NOT credited.
+/** True if a regex source (from `/…/.test(url)`) pins the host to a literal domain. */
+function isAnchoredHostAllowlistRegex(src) {
+    if (!src.startsWith('^'))
+        return false; // must be anchored
+    if (!/https?/i.test(src))
+        return false; // must name the scheme
+    return /[A-Za-z][A-Za-z0-9-]+\\?\./.test(src); // literal host label + (escaped) dot
+}
+/** True if a `startsWith` prefix pins scheme + a literal host (implicitly anchored). */
+function isSchemeHostPrefix(prefix) {
+    if (!/^https?:\/\//i.test(prefix))
+        return false;
+    const afterScheme = prefix.replace(/^https?:\/\//i, '');
+    return /[A-Za-z][A-Za-z0-9-]*\./.test(afterScheme); // has a host label + dot
+}
+/**
+ * Returns the 1-indexed line numbers made SSRF-safe by an anchored host
+ * allow-list reject-guard (skillsregistry#49b). Mirrors the Java traversal
+ * reject-guard: a line is covered when it references a variable that was
+ * host-guarded above (following one-hop derivations), and the guard has a
+ * throwing/returning body (reject polarity — the safe path is everything below).
+ */
+function jsSsrfHostGuardedLines(code) {
+    const covered = new Set();
+    const lines = code.split('\n');
+    // `if ( ! /regex/flags .test( VAR ) )`
+    const rejectRegexTest = /\bif\s*\(\s*!\s*\/((?:[^/\\]|\\.)*)\/[a-z]*\s*\.\s*test\s*\(\s*([A-Za-z_]\w*)\s*\)/;
+    // `if ( ! VAR.startsWith( "prefix" ) )`
+    const rejectStartsWith = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*startsWith\s*\(\s*["'`]([^"'`]+)["'`]/;
+    const terminatorRe = /\b(throw|return)\b/;
+    const assignRe = /^\s*(?:const|let|var\s+)?\s*([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+    for (let i = 0; i < lines.length; i++) {
+        let guardedVar = null;
+        const rm = rejectRegexTest.exec(lines[i]);
+        if (rm && isAnchoredHostAllowlistRegex(rm[1]))
+            guardedVar = rm[2];
+        if (!guardedVar) {
+            const sm = rejectStartsWith.exec(lines[i]);
+            if (sm && isSchemeHostPrefix(sm[2]))
+                guardedVar = sm[1];
+        }
+        if (!guardedVar)
+            continue;
+        let hasTerminator = terminatorRe.test(lines[i]);
+        if (!hasTerminator) {
+            for (let j = i + 1; j < Math.min(lines.length, i + 6); j++) {
+                if (terminatorRe.test(lines[j])) {
+                    hasTerminator = true;
+                    break;
+                }
+                if (lines[j].includes('}'))
+                    break;
+            }
+        }
+        if (!hasTerminator)
+            continue;
+        const guarded = new Set([guardedVar]);
+        const mentionsGuarded = (text) => {
+            for (const name of guarded)
+                if (new RegExp(`\\b${name}\\b`).test(text))
+                    return true;
+            return false;
+        };
+        for (let l = i + 1; l < lines.length; l++) {
+            const lineText = lines[l];
+            const assign = assignRe.exec(lineText);
+            if (assign) {
+                if (mentionsGuarded(assign[2]))
+                    guarded.add(assign[1]);
+                else if (assign[1] !== guardedVar)
+                    guarded.delete(assign[1]);
+            }
+            if (mentionsGuarded(lineText))
+                covered.add(l + 1);
+        }
+    }
+    return covered;
+}
+// C# sanitizers (Phase-1) and the sink types each neutralises. A tainted value
+// that flows through one of these before reaching a sink of the matching type
+// is safe. Method names are C#-distinctive (see config-loader C# sanitizers).
+const CSHARP_SANITIZER_RES = [
+    { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: 'xss' },
+    { re: /\bHtmlEncoder\s*\.\s*Encode\s*\(/, type: 'xss' },
+    { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: 'path_traversal' },
+];
+/**
+ * Compute, per sink type, the set of C# variables whose value has passed through
+ * a sanitizer for that type (cognium-dev C#/.NET Phase-1). Seeds from
+ * `V = <sanitizer_T>(…)` assignments, then takes a transitive closure over
+ * `W = … V …` so downstream derivations (`s = "<div>" + safe`) stay sanitized.
+ * Over-approximates on mixed-source lines (`s = safe + evil`) — an accepted
+ * MVP recall trade for text-scan sanitizer awareness; C#-scoped, so no effect
+ * on other languages.
+ */
+function csharpSanitizedVarsByType(code) {
+    const lines = code.split('\n');
+    const byType = new Map();
+    const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+    for (const { type } of CSHARP_SANITIZER_RES) {
+        if (!byType.has(type))
+            byType.set(type, new Set());
+    }
+    // Seed: direct `V = sanitizer(...)`.
+    for (const line of lines) {
+        const m = assignRe.exec(line);
+        if (!m)
+            continue;
+        const [, lhs, rhs] = m;
+        for (const { re, type } of CSHARP_SANITIZER_RES) {
+            if (re.test(rhs))
+                byType.get(type).add(lhs);
+        }
+    }
+    // Transitive closure: `W = … V …` where V is already sanitized-for-T.
+    let changed = true;
+    let guard = 0;
+    while (changed && guard < lines.length + 2) {
+        changed = false;
+        guard++;
+        for (const line of lines) {
+            const m = assignRe.exec(line);
+            if (!m)
+                continue;
+            const [, lhs, rhs] = m;
+            for (const [type, set] of byType) {
+                if (set.has(lhs))
+                    continue;
+                const refsSanitized = [...set].some(v => new RegExp(`(?<![\\w])${escapeRegex(v)}(?![\\w])`).test(rhs));
+                // Only carry sanitized-ness when the RHS did not itself apply the
+                // sanitizer (already seeded) and references a sanitized var.
+                if (refsSanitized) {
+                    set.add(lhs);
+                    changed = true;
+                }
+            }
+        }
+    }
+    return byType;
+}
 // Recognises Java `String.matches("regex")` — implicitly anchored ^…$.
 const JAVA_INLINE_MATCHES_RE = /\.\s*matches\s*\(\s*"((?:[^"\\]|\\.)*)"\s*\)/g;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
@@ -1579,6 +1763,99 @@ export class SinkFilterPass {
                 return !FETCH_MEMBER_RECEIVER_RE.test(sinkLineText);
             });
         }
+        // Stage 15g — JS/TS nosql: `.find(fn)` etc. is Array.prototype iteration,
+        // not a Mongo query. (cognium-ai#279 R-2) Drop a `nosql_injection` sink on an
+        // array method whose first argument is a function (arrow / `function`);
+        // real `collection.find({query})` passes an object and is kept.
+        if (['javascript', 'typescript'].includes(language)) {
+            const sourceLines = ctx.code.split('\n');
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'nosql_injection')
+                    return true;
+                if (!NOSQL_ARRAY_METHODS.has(sink.method ?? ''))
+                    return true;
+                const sinkLineText = sourceLines[sink.line - 1] ?? '';
+                return !FUNCTION_FIRST_ARG_RE.test(sinkLineText);
+            });
+        }
+        // Stage 15h — JS/TS sql/nosql: ORM query-builder object argument.
+        // (cognium-ai#279 R-1) Drop a sql/nosql injection sink whose call passes an
+        // object literal with an ORM builder key (`where`/`select`/…) — a bound
+        // parameter, not a raw query. Raw `db.query("… WHERE …")` has no `key:`
+        // colon and is kept.
+        if (['javascript', 'typescript'].includes(language)) {
+            const sourceLines = ctx.code.split('\n');
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'sql_injection' && sink.type !== 'nosql_injection')
+                    return true;
+                const sinkLineText = sourceLines[sink.line - 1] ?? '';
+                return !ORM_BUILDER_KEY_RE.test(sinkLineText);
+            });
+        }
+        // Stage 15j — JS/TS ssrf: client-component file. (cognium-ai#279 R-3)
+        // A fetch/axios call in a browser-rendered client component is not SSRF.
+        // Gated on ext + positive client signal + no server signal (zero-FN).
+        if (['javascript', 'typescript', 'tsx'].includes(language)) {
+            const file = ctx.graph?.ir?.meta?.file ?? '';
+            if (BROWSER_COMPONENT_EXT_RE.test(file) &&
+                CLIENT_SIGNAL_RE.test(ctx.code) &&
+                !SERVER_SIGNAL_RE.test(ctx.code)) {
+                filtered = filtered.filter(sink => sink.type !== 'ssrf');
+            }
+        }
+        // Stage 15i — JS/TS ssrf: fixed-host URL template. (cognium-ai#279 R-6)
+        // Drop an ssrf sink whose line builds the URL from a template literal with a
+        // literal host (only the path is interpolated).
+        if (['javascript', 'typescript'].includes(language)) {
+            const sourceLines = ctx.code.split('\n');
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'ssrf')
+                    return true;
+                const sinkLineText = sourceLines[sink.line - 1] ?? '';
+                return !FIXED_HOST_TEMPLATE_RE.test(sinkLineText);
+            });
+        }
+        // Stage 15f — JS/TS ssrf: anchored host allow-list reject-guard.
+        // (skillsregistry#49b) A URL pinned to a fixed host set by an anchored
+        // `^https://host/`.test(url) / url.startsWith("https://host/") reject-guard
+        // (throw/return) before the request cannot target an arbitrary host, so it
+        // is not SSRF. Applied as a sink drop (reaches the generateFindings scan path
+        // too). Scheme-only guards (`^https?://`) are not credited — they don't
+        // constrain the destination.
+        if (['javascript', 'typescript'].includes(language)) {
+            const guardedLines = jsSsrfHostGuardedLines(ctx.code);
+            if (guardedLines.size > 0) {
+                filtered = filtered.filter(sink => !(sink.type === 'ssrf' && guardedLines.has(sink.line)));
+            }
+        }
+        // Stage 15k — C# sanitizer suppression (cognium-dev C#/.NET Phase-1).
+        // C# rides the text-scan propagation, which is not sanitizer-aware; apply
+        // sanitizers here (sink-type-aware, C#-scoped). Drop a sink when its line
+        // inline-applies a sanitizer for that type, or when a variable on the sink
+        // line has passed through a sanitizer for that type upstream.
+        if (language === 'csharp') {
+            const sourceLines = ctx.code.split('\n');
+            const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
+            filtered = filtered.filter(sink => {
+                const sinkLineText = sourceLines[sink.line - 1] ?? '';
+                // (a) inline sanitizer on the sink line, e.g. Html.Raw(HtmlEncode(x)).
+                for (const { re, type } of CSHARP_SANITIZER_RES) {
+                    if (type === sink.type && re.test(sinkLineText))
+                        return false;
+                }
+                // (b) a sink-line variable is sanitized-for-this-type upstream. Tested
+                // per-var (not via extractSourceIdentifiers, which skips single-char
+                // names) so `Html.Raw(s)` with a 1-letter var is covered.
+                const sanitizedVars = sanitizedByType.get(sink.type);
+                if (sanitizedVars && sanitizedVars.size > 0) {
+                    for (const v of sanitizedVars) {
+                        if (new RegExp(`(?<![\\w])${escapeRegex(v)}(?![\\w])`).test(sinkLineText))
+                            return false;
+                    }
+                }
+                return true;
+            });
+        }
         // Stage 16 — JS log_injection (CWE-117) sanitizer suppression.
         // (cognium-dev #216 sanitizer-wrapped FP — Sprint 52)
         //