circle-ir 3.34.0 → 3.36.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/configs/sinks/code_injection.yaml +112 -0
- package/dist/analysis/config-loader.d.ts.map +1 -1
- package/dist/analysis/config-loader.js +26 -0
- package/dist/analysis/config-loader.js.map +1 -1
- package/dist/analysis/passes/taint-propagation-pass.d.ts.map +1 -1
- package/dist/analysis/passes/taint-propagation-pass.js +143 -0
- package/dist/analysis/passes/taint-propagation-pass.js.map +1 -1
- package/dist/browser/circle-ir.js +101 -0
- package/dist/core/circle-ir-core.cjs +26 -0
- package/dist/core/circle-ir-core.js +26 -0
- package/package.json +1 -1
|
@@ -514,6 +514,118 @@
|
|
|
514
514
|
"severity": "critical",
|
|
515
515
|
"note": "Jenkins Groovy sandbox static call interception"
|
|
516
516
|
},
|
|
517
|
+
{
|
|
518
|
+
"method": "onGetProperty",
|
|
519
|
+
"class": "SandboxInterceptor",
|
|
520
|
+
"type": "code_injection",
|
|
521
|
+
"cwe": "CWE-094",
|
|
522
|
+
"severity": "critical",
|
|
523
|
+
"note": "Jenkins Groovy sandbox property read interception (issue #17)"
|
|
524
|
+
},
|
|
525
|
+
{
|
|
526
|
+
"method": "onSetProperty",
|
|
527
|
+
"class": "SandboxInterceptor",
|
|
528
|
+
"type": "code_injection",
|
|
529
|
+
"cwe": "CWE-094",
|
|
530
|
+
"severity": "critical",
|
|
531
|
+
"note": "Jenkins Groovy sandbox property write interception (issue #17)"
|
|
532
|
+
},
|
|
533
|
+
{
|
|
534
|
+
"method": "onGetAttribute",
|
|
535
|
+
"class": "SandboxInterceptor",
|
|
536
|
+
"type": "code_injection",
|
|
537
|
+
"cwe": "CWE-094",
|
|
538
|
+
"severity": "critical",
|
|
539
|
+
"note": "Jenkins Groovy sandbox attribute read interception (issue #17)"
|
|
540
|
+
},
|
|
541
|
+
{
|
|
542
|
+
"method": "onSetAttribute",
|
|
543
|
+
"class": "SandboxInterceptor",
|
|
544
|
+
"type": "code_injection",
|
|
545
|
+
"cwe": "CWE-094",
|
|
546
|
+
"severity": "critical",
|
|
547
|
+
"note": "Jenkins Groovy sandbox attribute write interception (issue #17)"
|
|
548
|
+
},
|
|
549
|
+
{
|
|
550
|
+
"method": "onMethodPointer",
|
|
551
|
+
"class": "SandboxInterceptor",
|
|
552
|
+
"type": "code_injection",
|
|
553
|
+
"cwe": "CWE-094",
|
|
554
|
+
"severity": "critical",
|
|
555
|
+
"note": "Jenkins Groovy sandbox method-pointer interception (issue #17)"
|
|
556
|
+
},
|
|
557
|
+
{
|
|
558
|
+
"method": "onSuperCall",
|
|
559
|
+
"class": "SandboxInterceptor",
|
|
560
|
+
"type": "code_injection",
|
|
561
|
+
"cwe": "CWE-094",
|
|
562
|
+
"severity": "critical",
|
|
563
|
+
"note": "Jenkins Groovy sandbox super-call interception (issue #17)"
|
|
564
|
+
},
|
|
565
|
+
{
|
|
566
|
+
"method": "onSuperConstructor",
|
|
567
|
+
"class": "SandboxInterceptor",
|
|
568
|
+
"type": "code_injection",
|
|
569
|
+
"cwe": "CWE-094",
|
|
570
|
+
"severity": "critical",
|
|
571
|
+
"note": "Jenkins Groovy sandbox super-constructor interception (issue #17)"
|
|
572
|
+
},
|
|
573
|
+
{
|
|
574
|
+
"method": "onMethodCall",
|
|
575
|
+
"class": "GroovyInterceptor",
|
|
576
|
+
"type": "code_injection",
|
|
577
|
+
"cwe": "CWE-094",
|
|
578
|
+
"severity": "critical",
|
|
579
|
+
"note": "Groovy sandbox parent class — some plugins extend GroovyInterceptor directly (issue #17)"
|
|
580
|
+
},
|
|
581
|
+
{
|
|
582
|
+
"method": "onNewInstance",
|
|
583
|
+
"class": "GroovyInterceptor",
|
|
584
|
+
"type": "code_injection",
|
|
585
|
+
"cwe": "CWE-094",
|
|
586
|
+
"severity": "critical",
|
|
587
|
+
"note": "Groovy sandbox parent class — constructor interception (issue #17)"
|
|
588
|
+
},
|
|
589
|
+
{
|
|
590
|
+
"method": "onStaticCall",
|
|
591
|
+
"class": "GroovyInterceptor",
|
|
592
|
+
"type": "code_injection",
|
|
593
|
+
"cwe": "CWE-094",
|
|
594
|
+
"severity": "critical",
|
|
595
|
+
"note": "Groovy sandbox parent class — static-call interception (issue #17)"
|
|
596
|
+
},
|
|
597
|
+
{
|
|
598
|
+
"method": "onGetProperty",
|
|
599
|
+
"class": "GroovyInterceptor",
|
|
600
|
+
"type": "code_injection",
|
|
601
|
+
"cwe": "CWE-094",
|
|
602
|
+
"severity": "critical",
|
|
603
|
+
"note": "Groovy sandbox parent class — property read (issue #17)"
|
|
604
|
+
},
|
|
605
|
+
{
|
|
606
|
+
"method": "onSetProperty",
|
|
607
|
+
"class": "GroovyInterceptor",
|
|
608
|
+
"type": "code_injection",
|
|
609
|
+
"cwe": "CWE-094",
|
|
610
|
+
"severity": "critical",
|
|
611
|
+
"note": "Groovy sandbox parent class — property write (issue #17)"
|
|
612
|
+
},
|
|
613
|
+
{
|
|
614
|
+
"method": "call",
|
|
615
|
+
"class": "SandboxTransformer",
|
|
616
|
+
"type": "code_injection",
|
|
617
|
+
"cwe": "CWE-094",
|
|
618
|
+
"severity": "critical",
|
|
619
|
+
"note": "Groovy AST transformer that wires interceptor callbacks — bypass target (issue #17, CVE-2023-24422)"
|
|
620
|
+
},
|
|
621
|
+
{
|
|
622
|
+
"method": "runInSandbox",
|
|
623
|
+
"class": "GroovySandbox",
|
|
624
|
+
"type": "code_injection",
|
|
625
|
+
"cwe": "CWE-094",
|
|
626
|
+
"severity": "critical",
|
|
627
|
+
"note": "Jenkins script-security outer sandbox wrapper (issue #17)"
|
|
628
|
+
},
|
|
517
629
|
{
|
|
518
630
|
"method": "render",
|
|
519
631
|
"class": "XWikiRenderer",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA4a1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,
|
|
1
|
+
{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA4a1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAkrCtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA6LhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
|
|
@@ -873,6 +873,32 @@ export const DEFAULT_SINKS = [
|
|
|
873
873
|
{ method: 'parse', class: 'GroovyShell', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
|
|
874
874
|
{ method: 'parseClass', class: 'GroovyClassLoader', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
|
|
875
875
|
{ method: 'run', class: 'GroovyScriptEngine', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
|
|
876
|
+
// Jenkins script-security plugin — Groovy sandbox attack surface (issue #17, CVE-2023-24422).
|
|
877
|
+
// The sandbox is a documented-bypassable security control; the dispatch points that
|
|
878
|
+
// route tainted Groovy through the sandbox runtime are code-injection sinks, not
|
|
879
|
+
// sanitizers. SandboxInterceptor.onNewInstance already lives in command_injection above;
|
|
880
|
+
// these add the missing dispatch surface plus the parent GroovyInterceptor class and
|
|
881
|
+
// the AST transformer / outer GroovySandbox wrapper.
|
|
882
|
+
{ method: 'onMethodCall', class: 'SandboxInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
883
|
+
{ method: 'onStaticCall', class: 'SandboxInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
884
|
+
{ method: 'onGetProperty', class: 'SandboxInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
885
|
+
{ method: 'onSetProperty', class: 'SandboxInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
886
|
+
{ method: 'onGetAttribute', class: 'SandboxInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
887
|
+
{ method: 'onSetAttribute', class: 'SandboxInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
888
|
+
{ method: 'onMethodPointer', class: 'SandboxInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
889
|
+
{ method: 'onSuperCall', class: 'SandboxInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
890
|
+
{ method: 'onSuperConstructor', class: 'SandboxInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
891
|
+
// Parent class — some plugins extend GroovyInterceptor directly.
|
|
892
|
+
{ method: 'onMethodCall', class: 'GroovyInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
893
|
+
{ method: 'onNewInstance', class: 'GroovyInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
894
|
+
{ method: 'onStaticCall', class: 'GroovyInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
895
|
+
{ method: 'onGetProperty', class: 'GroovyInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
896
|
+
{ method: 'onSetProperty', class: 'GroovyInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
897
|
+
// AST transformer — converts unsafe Groovy AST into interceptor callbacks; bypasses target this.
|
|
898
|
+
{ method: 'call', class: 'SandboxTransformer', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
899
|
+
// GroovySandbox.runInSandbox — Jenkins script-security outer wrapper (real API; the
|
|
900
|
+
// "sandbox" entry in command.yaml is fictional).
|
|
901
|
+
{ method: 'runInSandbox', class: 'GroovySandbox', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [] },
|
|
876
902
|
// JavaScript engine (Nashorn/Rhino)
|
|
877
903
|
{ method: 'eval', class: 'Bindings', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
|
|
878
904
|
{ method: 'eval', class: 'ScriptContext', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
|