circle-ir 3.29.0 → 3.31.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/configs/sources/http_sources.yaml +24 -0
  2. package/dist/analysis/config-loader.d.ts.map +1 -1
  3. package/dist/analysis/config-loader.js +42 -0
  4. package/dist/analysis/config-loader.js.map +1 -1
  5. package/dist/analysis/constant-propagation/patterns.d.ts.map +1 -1
  6. package/dist/analysis/constant-propagation/patterns.js +14 -0
  7. package/dist/analysis/constant-propagation/patterns.js.map +1 -1
  8. package/dist/browser/circle-ir.js +57 -1
  9. package/dist/core/circle-ir-core.cjs +57 -1
  10. package/dist/core/circle-ir-core.js +57 -1
  11. package/package.json +1 -1
package/dist/analysis/constant-propagation/patterns.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,eAAO,MAAM,cAAc,UAgE1B,CAAC;AAGF,eAAO,MAAM,mBAAmB,QAE/B,CAAC;AAMF,eAAO,MAAM,iBAAiB,aAwC5B,CAAC;AAOH,eAAO,MAAM,sBAAsB,aAoBjC,CAAC;AAOH,eAAO,MAAM,kBAAkB,aAsB7B,CAAC"}
1
+ {"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,eAAO,MAAM,cAAc,UAgE1B,CAAC;AAGF,eAAO,MAAM,mBAAmB,QAE/B,CAAC;AAMF,eAAO,MAAM,iBAAiB,aAwC5B,CAAC;AAOH,eAAO,MAAM,sBAAsB,aA4BjC,CAAC;AAOH,eAAO,MAAM,kBAAkB,aA8B7B,CAAC"}
package/dist/analysis/constant-propagation/patterns.js CHANGED
@@ -118,6 +118,13 @@ export const ANTI_SANITIZER_METHODS = new Set([
118
118
  'unescapeEcmaScript',
119
119
  'unescapeJson',
120
120
  'unescapeJava',
121
+ // Apache Shiro WebUtils helpers (CVE-2023-34478, CVE-2023-46749 — issue #8).
122
+ // These internally call URLDecoder.decode, so a value that passed a
123
+ // string-level path sanitizer (e.g. Paths.normalize) becomes tainted again
124
+ // after Shiro re-decodes %2e%2e → "..".
125
+ 'getPathWithinApplication',
126
+ 'getRequestUri',
127
+ 'decodeRequestString',
121
128
  // General decoders
122
129
  'unescape',
123
130
  'decompress',
@@ -145,5 +152,12 @@ export const PROPAGATOR_METHODS = new Set([
145
152
  'concat', // String.concat(other)
146
153
  // Object utilities
147
154
  'requireNonNull', // Objects.requireNonNull(obj)
155
+ // Apache Shiro WebUtils — propagate taint from string arg through the wrapper
156
+ // back into the return value (e.g. `WebUtils.decodeRequestString(req, tainted)`).
157
+ // Also covered by ANTI_SANITIZER_METHODS for sanitized-arg re-tainting and by
158
+ // configs/sources/http_sources.yaml for the request-bound overloads. Issue #8.
159
+ 'getPathWithinApplication',
160
+ 'getRequestUri',
161
+ 'decodeRequestString',
148
162
  ]);
149
163
  //# sourceMappingURL=patterns.js.map
package/dist/analysis/constant-propagation/patterns.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,6BAA6B;IAC7B,sBAAsB;IACtB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,mBAAmB;IACnB,gBAAgB;IAChB,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;IACb,cAAc;IACd,YAAY,EAAG,oBAAoB;IACnC,cAAc;IACd,aAAa;IAEb,0DAA0D;IAC1D,sBAAsB;IACtB,oBAAoB;IACpB,eAAe;IAEf,cAAc;IACd,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,gBAAgB;IAChB,qBAAqB;IACrB,eAAe;IAEf,kBAAkB;IAClB,wBAAwB;IACxB,cAAc;IAEd,mBAAmB;IACnB,aAAa;IACb,aAAa;IAEb,eAAe;IACf,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IAErB,mCAAmC;IACnC,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,cAAc;IACd,sBAAsB;IACtB,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,yBAAyB;CAC1B,CAAC;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,MAAM,CAC3C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5E,CAAC;AAEF,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,QAAQ;IACR,eAAe,EAAE,wBAAwB,EAAE,qBAAqB;IAChE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,uBAAuB;IACvE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc;IAChE,aAAa,EAAE,iBAAiB,EAAE,cAAc;IAEhD,qBAAqB;IACrB,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,0BAA0B;IAC3E,eAAe,EAAE,oBAAoB,EAAE,wBAAwB;IAC/D,qBAAqB,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB;IAC/E,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU;IAEzE,iBAAiB;IACjB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa;IACrF,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;IAExE,mBAAmB;IACnB,YAAY,EAAE,mBAAmB,EAAE,eAAe;IAElD,oBAAoB;IACpB,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY;IACvE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe;IAEnE,4BAA4B;IAC5B,kBAAkB,EAAE,WAAW,EAAE,YAAY;IAE7C,qCAAqC;IACrC,oBAAoB,EAAE,WAAW;IAEjC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU;IAEzC,oCAAoC;IACpC,eAAe,EAAE,sBAAsB,EAAE,cAAc,EAAE,gCAAgC;IACzF,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM;IAE9C,UAAU;IACV,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc;IAC7E,kBAAkB,EAAE,eAAe,EAAE,eAAe;CACrD,CAAC,CAAC;AAEH,gFAAgF;AAChF,yBAAyB;AACzB,+FAA+F;AAC/F,gFAAgF;AAEhF,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,uCAAuC;IACvC,QAAQ,EAAY,sBAAsB;IAC1C,oBAAoB;IACpB,WAAW;IAEX,6CAA6C;IAC7C,cAAc;IACd,QAAQ,EAAY,+BAA+B;IAEnD,2CAA2C;IAC3C,cAAc,EAAE,eAAe,EAAE,eAAe;IAChD,aAAa;IACb,oBAAoB;IACpB,cAAc;IACd,cAAc;IAEd,mBAAmB;IACnB,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,gFAAgF;AAChF,qBAAqB;AACrB,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACxC,yBAAyB;IACzB,KAAK,EAAa,qCAAqC;IACvD,IAAI,EAAc,wBAAwB;IAC1C,SAAS,EAAS,sBAAsB;IACxC,gBAAgB,EAAE,6BAA6B;IAC/C,YAAY,EAAM,yBAAyB;IAE3C,UAAU;IACV,QAAQ,EAAU,qBAAqB;IACvC,OAAO,EAAW,eAAe;IACjC,OAAO,EAAW,cAAc;IAChC,QAAQ,EAAU,8BAA8B;IAEhD,mBAAmB;IACnB,SAAS,EAAS,oBAAoB;IACtC,QAAQ,EAAU,qBAAqB;IACvC,MAAM,EAAY,mBAAmB;IACrC,QAAQ,EAAU,uBAAuB;IAEzC,mBAAmB;IACnB,gBAAgB,EAAE,8BAA8B;CACjD,CAAC,CAAC"}
1
+ {"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,6BAA6B;IAC7B,sBAAsB;IACtB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,mBAAmB;IACnB,gBAAgB;IAChB,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;IACb,cAAc;IACd,YAAY,EAAG,oBAAoB;IACnC,cAAc;IACd,aAAa;IAEb,0DAA0D;IAC1D,sBAAsB;IACtB,oBAAoB;IACpB,eAAe;IAEf,cAAc;IACd,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,gBAAgB;IAChB,qBAAqB;IACrB,eAAe;IAEf,kBAAkB;IAClB,wBAAwB;IACxB,cAAc;IAEd,mBAAmB;IACnB,aAAa;IACb,aAAa;IAEb,eAAe;IACf,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IAErB,mCAAmC;IACnC,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,cAAc;IACd,sBAAsB;IACtB,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,yBAAyB;CAC1B,CAAC;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,MAAM,CAC3C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5E,CAAC;AAEF,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,QAAQ;IACR,eAAe,EAAE,wBAAwB,EAAE,qBAAqB;IAChE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,uBAAuB;IACvE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc;IAChE,aAAa,EAAE,iBAAiB,EAAE,cAAc;IAEhD,qBAAqB;IACrB,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,0BAA0B;IAC3E,eAAe,EAAE,oBAAoB,EAAE,wBAAwB;IAC/D,qBAAqB,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB;IAC/E,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU;IAEzE,iBAAiB;IACjB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa;IACrF,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;IAExE,mBAAmB;IACnB,YAAY,EAAE,mBAAmB,EAAE,eAAe;IAElD,oBAAoB;IACpB,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY;IACvE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe;IAEnE,4BAA4B;IAC5B,kBAAkB,EAAE,WAAW,EAAE,YAAY;IAE7C,qCAAqC;IACrC,oBAAoB,EAAE,WAAW;IAEjC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU;IAEzC,oCAAoC;IACpC,eAAe,EAAE,sBAAsB,EAAE,cAAc,EAAE,gCAAgC;IACzF,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM;IAE9C,UAAU;IACV,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc;IAC7E,kBAAkB,EAAE,eAAe,EAAE,eAAe;CACrD,CAAC,CAAC;AAEH,gFAAgF;AAChF,yBAAyB;AACzB,+FAA+F;AAC/F,gFAAgF;AAEhF,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,uCAAuC;IACvC,QAAQ,EAAY,sBAAsB;IAC1C,oBAAoB;IACpB,WAAW;IAEX,6CAA6C;IAC7C,cAAc;IACd,QAAQ,EAAY,+BAA+B;IAEnD,2CAA2C;IAC3C,cAAc,EAAE,eAAe,EAAE,eAAe;IAChD,aAAa;IACb,oBAAoB;IACpB,cAAc;IACd,cAAc;IAEd,6EAA6E;IAC7E,oEAAoE;IACpE,2EAA2E;IAC3E,wCAAwC;IACxC,0BAA0B;IAC1B,eAAe;IACf,qBAAqB;IAErB,mBAAmB;IACnB,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,gFAAgF;AAChF,qBAAqB;AACrB,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACxC,yBAAyB;IACzB,KAAK,EAAa,qCAAqC;IACvD,IAAI,EAAc,wBAAwB;IAC1C,SAAS,EAAS,sBAAsB;IACxC,gBAAgB,EAAE,6BAA6B;IAC/C,YAAY,EAAM,yBAAyB;IAE3C,UAAU;IACV,QAAQ,EAAU,qBAAqB;IACvC,OAAO,EAAW,eAAe;IACjC,OAAO,EAAW,cAAc;IAChC,QAAQ,EAAU,8BAA8B;IAEhD,mBAAmB;IACnB,SAAS,EAAS,oBAAoB;IACtC,QAAQ,EAAU,qBAAqB;IACvC,MAAM,EAAY,mBAAmB;IACrC,QAAQ,EAAU,uBAAuB;IAEzC,mBAAmB;IACnB,gBAAgB,EAAE,8BAA8B;IAEhD,8EAA8E;IAC9E,kFAAkF;IAClF,8EAA8E;IAC9E,+EAA+E;IAC/E,0BAA0B;IAC1B,eAAe;IACf,qBAAqB;CACtB,CAAC,CAAC"}
package/dist/browser/circle-ir.js CHANGED
@@ -9626,6 +9626,13 @@ var DEFAULT_SOURCES = [
9626
9626
  { method: "getContextPath", class: "HttpServletRequest", type: "http_path", severity: "medium", return_tainted: true },
9627
9627
  { method: "getRemoteHost", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
9628
9628
  { method: "getRemoteAddr", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
9629
+ // Apache Shiro WebUtils helpers — return URL-decoded request data. The internal
9630
+ // decodeRequestString → URLDecoder.decode chain can re-introduce ../ from
9631
+ // %2e%2e payloads that bypassed auth-time normalization. CVE-2023-34478,
9632
+ // CVE-2023-46749 (issue #8).
9633
+ { method: "getPathWithinApplication", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
9634
+ { method: "getRequestUri", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
9635
+ { method: "decodeRequestString", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
9629
9636
  // Additional HTTP request methods that can be attacker-controlled
9630
9637
  { method: "getProtocol", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
9631
9638
  { method: "getScheme", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
@@ -9767,6 +9774,14 @@ var DEFAULT_SOURCES = [
9767
9774
  { method: "getContent", class: "Block", type: "io_input", severity: "high", return_tainted: true },
9768
9775
  { method: "getParameters", class: "Block", type: "io_input", severity: "high", return_tainted: true },
9769
9776
  { method: "getRawContent", type: "io_input", severity: "high", return_tainted: true },
9777
+ // XWiki request-bound sources (issue #10, CVE-2022-24897 / 2023-29201 / 2023-29528 /
9778
+ // 2023-36471 / 2023-37908). XWikiRequest.get(name) / .getParameter(name) /
9779
+ // XWikiContext.getRequest().get(...) all return URL/form data unchanged.
9780
+ { method: "get", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9781
+ { method: "getParameter", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9782
+ { method: "getParameterValues", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9783
+ { method: "getParameterMap", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9784
+ { method: "getHeader", class: "XWikiRequest", type: "http_header", severity: "high", return_tainted: true },
9770
9785
  // SAX/XML parsing sources (data from parsed XML)
9771
9786
  { method: "getAttributes", class: "XMLReader", type: "io_input", severity: "high", return_tainted: true },
9772
9787
  { method: "getValue", class: "Attributes", type: "io_input", severity: "high", return_tainted: true },
@@ -10394,6 +10409,12 @@ var DEFAULT_SINKS = [
10394
10409
  { method: "eval", class: "MVEL", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
10395
10410
  { method: "createValueExpression", class: "ExpressionFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1] },
10396
10411
  { method: "createMethodExpression", class: "ExpressionFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1] },
10412
+ // Apache NiFi Expression Language (CVE-2023-36542, issue #11).
10413
+ // PropertyValue.evaluateAttributeExpressions(...) runs NiFi EL against
10414
+ // user-controlled property values — if the property is attacker-influenced
10415
+ // the EL evaluation is a code-injection sink.
10416
+ { method: "evaluateAttributeExpressions", class: "PropertyValue", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
10417
+ { method: "evaluateAttributeExpressions", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
10397
10418
  // Groovy script execution
10398
10419
  { method: "evaluate", class: "GroovyShell", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
10399
10420
  { method: "parse", class: "GroovyShell", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
@@ -10608,6 +10629,27 @@ var DEFAULT_SINKS = [
10608
10629
  { method: "cleanAttributes", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10609
10630
  { method: "printXMLElement", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10610
10631
  { method: "printXMLStartElement", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10632
+ // XWiki rendering output sinks (issue #10, CVE-2022-24897 / 2023-29201 /
10633
+ // 2023-29528 / 2023-36471 / 2023-37908). WikiPrinter is the base output
10634
+ // interface; DefaultWikiPrinter and AnnotatedXHTMLWikiPrinter are the
10635
+ // concrete renderers that emit HTML into the response stream.
10636
+ { method: "print", class: "WikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10637
+ { method: "println", class: "WikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10638
+ { method: "print", class: "DefaultWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10639
+ { method: "println", class: "DefaultWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10640
+ { method: "print", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10641
+ { method: "println", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10642
+ { method: "printXML", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10643
+ { method: "printXMLComment", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10644
+ { method: "print", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10645
+ { method: "println", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10646
+ { method: "printXMLElement", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10647
+ { method: "printXMLStartElement", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10648
+ // Block renderers — `render(block, printer)` writes the block content out.
10649
+ // The block argument carries the parsed (possibly tainted) wiki content.
10650
+ { method: "render", class: "BlockRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10651
+ { method: "render", class: "AbstractBlockRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10652
+ { method: "render", class: "DefaultBlockRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10611
10653
  // XHTML renderer chains
10612
10654
  { method: "initialize", class: "HTML5Renderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10613
10655
  { method: "initialize", class: "XHTMLRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -14533,6 +14575,13 @@ var ANTI_SANITIZER_METHODS = /* @__PURE__ */ new Set([
14533
14575
  "unescapeEcmaScript",
14534
14576
  "unescapeJson",
14535
14577
  "unescapeJava",
14578
+ // Apache Shiro WebUtils helpers (CVE-2023-34478, CVE-2023-46749 — issue #8).
14579
+ // These internally call URLDecoder.decode, so a value that passed a
14580
+ // string-level path sanitizer (e.g. Paths.normalize) becomes tainted again
14581
+ // after Shiro re-decodes %2e%2e → "..".
14582
+ "getPathWithinApplication",
14583
+ "getRequestUri",
14584
+ "decodeRequestString",
14536
14585
  // General decoders
14537
14586
  "unescape",
14538
14587
  "decompress"
@@ -14568,8 +14617,15 @@ var PROPAGATOR_METHODS = /* @__PURE__ */ new Set([
14568
14617
  "concat",
14569
14618
  // String.concat(other)
14570
14619
  // Object utilities
14571
- "requireNonNull"
14620
+ "requireNonNull",
14572
14621
  // Objects.requireNonNull(obj)
14622
+ // Apache Shiro WebUtils — propagate taint from string arg through the wrapper
14623
+ // back into the return value (e.g. `WebUtils.decodeRequestString(req, tainted)`).
14624
+ // Also covered by ANTI_SANITIZER_METHODS for sanitized-arg re-tainting and by
14625
+ // configs/sources/http_sources.yaml for the request-bound overloads. Issue #8.
14626
+ "getPathWithinApplication",
14627
+ "getRequestUri",
14628
+ "decodeRequestString"
14573
14629
  ]);
14574
14630
 
14575
14631
  // src/analysis/constant-propagation/propagator.ts
package/dist/core/circle-ir-core.cjs CHANGED
@@ -9742,6 +9742,13 @@ var DEFAULT_SOURCES = [
9742
9742
  { method: "getContextPath", class: "HttpServletRequest", type: "http_path", severity: "medium", return_tainted: true },
9743
9743
  { method: "getRemoteHost", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
9744
9744
  { method: "getRemoteAddr", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
9745
+ // Apache Shiro WebUtils helpers — return URL-decoded request data. The internal
9746
+ // decodeRequestString → URLDecoder.decode chain can re-introduce ../ from
9747
+ // %2e%2e payloads that bypassed auth-time normalization. CVE-2023-34478,
9748
+ // CVE-2023-46749 (issue #8).
9749
+ { method: "getPathWithinApplication", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
9750
+ { method: "getRequestUri", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
9751
+ { method: "decodeRequestString", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
9745
9752
  // Additional HTTP request methods that can be attacker-controlled
9746
9753
  { method: "getProtocol", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
9747
9754
  { method: "getScheme", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
@@ -9883,6 +9890,14 @@ var DEFAULT_SOURCES = [
9883
9890
  { method: "getContent", class: "Block", type: "io_input", severity: "high", return_tainted: true },
9884
9891
  { method: "getParameters", class: "Block", type: "io_input", severity: "high", return_tainted: true },
9885
9892
  { method: "getRawContent", type: "io_input", severity: "high", return_tainted: true },
9893
+ // XWiki request-bound sources (issue #10, CVE-2022-24897 / 2023-29201 / 2023-29528 /
9894
+ // 2023-36471 / 2023-37908). XWikiRequest.get(name) / .getParameter(name) /
9895
+ // XWikiContext.getRequest().get(...) all return URL/form data unchanged.
9896
+ { method: "get", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9897
+ { method: "getParameter", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9898
+ { method: "getParameterValues", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9899
+ { method: "getParameterMap", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9900
+ { method: "getHeader", class: "XWikiRequest", type: "http_header", severity: "high", return_tainted: true },
9886
9901
  // SAX/XML parsing sources (data from parsed XML)
9887
9902
  { method: "getAttributes", class: "XMLReader", type: "io_input", severity: "high", return_tainted: true },
9888
9903
  { method: "getValue", class: "Attributes", type: "io_input", severity: "high", return_tainted: true },
@@ -10510,6 +10525,12 @@ var DEFAULT_SINKS = [
10510
10525
  { method: "eval", class: "MVEL", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
10511
10526
  { method: "createValueExpression", class: "ExpressionFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1] },
10512
10527
  { method: "createMethodExpression", class: "ExpressionFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1] },
10528
+ // Apache NiFi Expression Language (CVE-2023-36542, issue #11).
10529
+ // PropertyValue.evaluateAttributeExpressions(...) runs NiFi EL against
10530
+ // user-controlled property values — if the property is attacker-influenced
10531
+ // the EL evaluation is a code-injection sink.
10532
+ { method: "evaluateAttributeExpressions", class: "PropertyValue", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
10533
+ { method: "evaluateAttributeExpressions", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
10513
10534
  // Groovy script execution
10514
10535
  { method: "evaluate", class: "GroovyShell", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
10515
10536
  { method: "parse", class: "GroovyShell", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
@@ -10724,6 +10745,27 @@ var DEFAULT_SINKS = [
10724
10745
  { method: "cleanAttributes", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10725
10746
  { method: "printXMLElement", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10726
10747
  { method: "printXMLStartElement", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10748
+ // XWiki rendering output sinks (issue #10, CVE-2022-24897 / 2023-29201 /
10749
+ // 2023-29528 / 2023-36471 / 2023-37908). WikiPrinter is the base output
10750
+ // interface; DefaultWikiPrinter and AnnotatedXHTMLWikiPrinter are the
10751
+ // concrete renderers that emit HTML into the response stream.
10752
+ { method: "print", class: "WikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10753
+ { method: "println", class: "WikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10754
+ { method: "print", class: "DefaultWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10755
+ { method: "println", class: "DefaultWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10756
+ { method: "print", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10757
+ { method: "println", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10758
+ { method: "printXML", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10759
+ { method: "printXMLComment", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10760
+ { method: "print", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10761
+ { method: "println", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10762
+ { method: "printXMLElement", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10763
+ { method: "printXMLStartElement", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10764
+ // Block renderers — `render(block, printer)` writes the block content out.
10765
+ // The block argument carries the parsed (possibly tainted) wiki content.
10766
+ { method: "render", class: "BlockRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10767
+ { method: "render", class: "AbstractBlockRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10768
+ { method: "render", class: "DefaultBlockRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10727
10769
  // XHTML renderer chains
10728
10770
  { method: "initialize", class: "HTML5Renderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10729
10771
  { method: "initialize", class: "XHTMLRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -13207,6 +13249,13 @@ var ANTI_SANITIZER_METHODS = /* @__PURE__ */ new Set([
13207
13249
  "unescapeEcmaScript",
13208
13250
  "unescapeJson",
13209
13251
  "unescapeJava",
13252
+ // Apache Shiro WebUtils helpers (CVE-2023-34478, CVE-2023-46749 — issue #8).
13253
+ // These internally call URLDecoder.decode, so a value that passed a
13254
+ // string-level path sanitizer (e.g. Paths.normalize) becomes tainted again
13255
+ // after Shiro re-decodes %2e%2e → "..".
13256
+ "getPathWithinApplication",
13257
+ "getRequestUri",
13258
+ "decodeRequestString",
13210
13259
  // General decoders
13211
13260
  "unescape",
13212
13261
  "decompress"
@@ -13242,8 +13291,15 @@ var PROPAGATOR_METHODS = /* @__PURE__ */ new Set([
13242
13291
  "concat",
13243
13292
  // String.concat(other)
13244
13293
  // Object utilities
13245
- "requireNonNull"
13294
+ "requireNonNull",
13246
13295
  // Objects.requireNonNull(obj)
13296
+ // Apache Shiro WebUtils — propagate taint from string arg through the wrapper
13297
+ // back into the return value (e.g. `WebUtils.decodeRequestString(req, tainted)`).
13298
+ // Also covered by ANTI_SANITIZER_METHODS for sanitized-arg re-tainting and by
13299
+ // configs/sources/http_sources.yaml for the request-bound overloads. Issue #8.
13300
+ "getPathWithinApplication",
13301
+ "getRequestUri",
13302
+ "decodeRequestString"
13247
13303
  ]);
13248
13304
 
13249
13305
  // src/analysis/constant-propagation/propagator.ts
package/dist/core/circle-ir-core.js CHANGED
@@ -9677,6 +9677,13 @@ var DEFAULT_SOURCES = [
9677
9677
  { method: "getContextPath", class: "HttpServletRequest", type: "http_path", severity: "medium", return_tainted: true },
9678
9678
  { method: "getRemoteHost", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
9679
9679
  { method: "getRemoteAddr", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
9680
+ // Apache Shiro WebUtils helpers — return URL-decoded request data. The internal
9681
+ // decodeRequestString → URLDecoder.decode chain can re-introduce ../ from
9682
+ // %2e%2e payloads that bypassed auth-time normalization. CVE-2023-34478,
9683
+ // CVE-2023-46749 (issue #8).
9684
+ { method: "getPathWithinApplication", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
9685
+ { method: "getRequestUri", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
9686
+ { method: "decodeRequestString", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
9680
9687
  // Additional HTTP request methods that can be attacker-controlled
9681
9688
  { method: "getProtocol", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
9682
9689
  { method: "getScheme", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
@@ -9818,6 +9825,14 @@ var DEFAULT_SOURCES = [
9818
9825
  { method: "getContent", class: "Block", type: "io_input", severity: "high", return_tainted: true },
9819
9826
  { method: "getParameters", class: "Block", type: "io_input", severity: "high", return_tainted: true },
9820
9827
  { method: "getRawContent", type: "io_input", severity: "high", return_tainted: true },
9828
+ // XWiki request-bound sources (issue #10, CVE-2022-24897 / 2023-29201 / 2023-29528 /
9829
+ // 2023-36471 / 2023-37908). XWikiRequest.get(name) / .getParameter(name) /
9830
+ // XWikiContext.getRequest().get(...) all return URL/form data unchanged.
9831
+ { method: "get", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9832
+ { method: "getParameter", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9833
+ { method: "getParameterValues", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9834
+ { method: "getParameterMap", class: "XWikiRequest", type: "http_param", severity: "high", return_tainted: true },
9835
+ { method: "getHeader", class: "XWikiRequest", type: "http_header", severity: "high", return_tainted: true },
9821
9836
  // SAX/XML parsing sources (data from parsed XML)
9822
9837
  { method: "getAttributes", class: "XMLReader", type: "io_input", severity: "high", return_tainted: true },
9823
9838
  { method: "getValue", class: "Attributes", type: "io_input", severity: "high", return_tainted: true },
@@ -10445,6 +10460,12 @@ var DEFAULT_SINKS = [
10445
10460
  { method: "eval", class: "MVEL", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
10446
10461
  { method: "createValueExpression", class: "ExpressionFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1] },
10447
10462
  { method: "createMethodExpression", class: "ExpressionFactory", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [1] },
10463
+ // Apache NiFi Expression Language (CVE-2023-36542, issue #11).
10464
+ // PropertyValue.evaluateAttributeExpressions(...) runs NiFi EL against
10465
+ // user-controlled property values — if the property is attacker-influenced
10466
+ // the EL evaluation is a code-injection sink.
10467
+ { method: "evaluateAttributeExpressions", class: "PropertyValue", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
10468
+ { method: "evaluateAttributeExpressions", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
10448
10469
  // Groovy script execution
10449
10470
  { method: "evaluate", class: "GroovyShell", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
10450
10471
  { method: "parse", class: "GroovyShell", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
@@ -10659,6 +10680,27 @@ var DEFAULT_SINKS = [
10659
10680
  { method: "cleanAttributes", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10660
10681
  { method: "printXMLElement", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10661
10682
  { method: "printXMLStartElement", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10683
+ // XWiki rendering output sinks (issue #10, CVE-2022-24897 / 2023-29201 /
10684
+ // 2023-29528 / 2023-36471 / 2023-37908). WikiPrinter is the base output
10685
+ // interface; DefaultWikiPrinter and AnnotatedXHTMLWikiPrinter are the
10686
+ // concrete renderers that emit HTML into the response stream.
10687
+ { method: "print", class: "WikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10688
+ { method: "println", class: "WikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10689
+ { method: "print", class: "DefaultWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10690
+ { method: "println", class: "DefaultWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10691
+ { method: "print", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10692
+ { method: "println", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10693
+ { method: "printXML", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10694
+ { method: "printXMLComment", class: "XHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10695
+ { method: "print", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10696
+ { method: "println", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10697
+ { method: "printXMLElement", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10698
+ { method: "printXMLStartElement", class: "AnnotatedXHTMLWikiPrinter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10699
+ // Block renderers — `render(block, printer)` writes the block content out.
10700
+ // The block argument carries the parsed (possibly tainted) wiki content.
10701
+ { method: "render", class: "BlockRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10702
+ { method: "render", class: "AbstractBlockRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10703
+ { method: "render", class: "DefaultBlockRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10662
10704
  // XHTML renderer chains
10663
10705
  { method: "initialize", class: "HTML5Renderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
10664
10706
  { method: "initialize", class: "XHTMLRenderer", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -13142,6 +13184,13 @@ var ANTI_SANITIZER_METHODS = /* @__PURE__ */ new Set([
13142
13184
  "unescapeEcmaScript",
13143
13185
  "unescapeJson",
13144
13186
  "unescapeJava",
13187
+ // Apache Shiro WebUtils helpers (CVE-2023-34478, CVE-2023-46749 — issue #8).
13188
+ // These internally call URLDecoder.decode, so a value that passed a
13189
+ // string-level path sanitizer (e.g. Paths.normalize) becomes tainted again
13190
+ // after Shiro re-decodes %2e%2e → "..".
13191
+ "getPathWithinApplication",
13192
+ "getRequestUri",
13193
+ "decodeRequestString",
13145
13194
  // General decoders
13146
13195
  "unescape",
13147
13196
  "decompress"
@@ -13177,8 +13226,15 @@ var PROPAGATOR_METHODS = /* @__PURE__ */ new Set([
13177
13226
  "concat",
13178
13227
  // String.concat(other)
13179
13228
  // Object utilities
13180
- "requireNonNull"
13229
+ "requireNonNull",
13181
13230
  // Objects.requireNonNull(obj)
13231
+ // Apache Shiro WebUtils — propagate taint from string arg through the wrapper
13232
+ // back into the return value (e.g. `WebUtils.decodeRequestString(req, tainted)`).
13233
+ // Also covered by ANTI_SANITIZER_METHODS for sanitized-arg re-tainting and by
13234
+ // configs/sources/http_sources.yaml for the request-bound overloads. Issue #8.
13235
+ "getPathWithinApplication",
13236
+ "getRequestUri",
13237
+ "decodeRequestString"
13182
13238
  ]);
13183
13239
 
13184
13240
  // src/analysis/constant-propagation/propagator.ts
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "circle-ir",
3
- "version": "3.29.0",
3
+ "version": "3.31.0",
4
4
  "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.js",