circle-ir 3.40.0 → 3.42.0

package/configs/sinks/sql.yaml

@@ -144,99 +144,99 @@
     {
       "method": "insert",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted fields in entity may be interpolated via ${} syntax"
     },
     {
       "method": "insertSelective",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted fields in entity may be interpolated via ${} syntax"
     },
     {
       "method": "update",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted fields in entity may be interpolated via ${} syntax"
     },
     {
       "method": "updateByPrimaryKey",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted fields in entity may be interpolated via ${} syntax"
     },
     {
       "method": "updateByPrimaryKeySelective",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted fields in entity may be interpolated via ${} syntax"
     },
     {
       "method": "delete",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted parameter may be interpolated via ${} syntax"
     },
     {
       "method": "deleteByPrimaryKey",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted parameter may be interpolated via ${} syntax"
     },
     {
       "method": "selectOne",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted parameter may be interpolated via ${} syntax"
     },
     {
       "method": "selectList",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted parameter may be interpolated via ${} syntax"
     },
     {
       "method": "selectByPrimaryKey",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted parameter may be interpolated via ${} syntax"
     },
     {
       "method": "selectByExample",
       "class": "*Mapper",
-      "type": "sql_injection",
+      "type": "mybatis_mapper_call",
       "cwe": "CWE-89",
-      "severity": "critical",
+      "severity": "medium",
       "arg_positions": [0],
       "note": "MyBatis ORM - tainted fields in example criteria may be interpolated via ${} syntax"
     }

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA4a1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAkrCtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA6LhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA4a1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA4sCtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EA6LhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -459,6 +459,23 @@ export const DEFAULT_SINKS = [
     { method: 'queryForObject', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0] },
     { method: 'queryForList', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0] },
     { method: 'queryForLong', type: 'sql_injection', cwe: 'CWE-89', severity: 'high', arg_positions: [0] },
+    // MyBatis mapper-interface methods (CWE-89, classified as mybatis_mapper_call)
+    // The actual SQL lives in the mapper's XML or @Select/@Update annotation —
+    // exploitability depends on whether the binding uses ${...} interpolation
+    // vs #{...} parameter binding. Surface as a distinct sink type so consumers
+    // can resolve the binding before reporting. See cognium-dev#24.
+    // The `class: '*Mapper'` suffix wildcard matches userMapper, OrderMapper, …
+    { method: 'insert', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    { method: 'insertSelective', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    { method: 'update', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    { method: 'updateByPrimaryKey', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    { method: 'updateByPrimaryKeySelective', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    { method: 'delete', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    { method: 'deleteByPrimaryKey', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    { method: 'selectOne', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    { method: 'selectList', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    { method: 'selectByPrimaryKey', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
+    { method: 'selectByExample', class: '*Mapper', type: 'mybatis_mapper_call', cwe: 'CWE-89', severity: 'medium', arg_positions: [0], languages: ['java'] },
     // Command Injection (CWE-78)
     { method: 'exec', class: 'Runtime', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1] },
     { method: 'start', class: 'ProcessBuilder', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [] },
@@ -1011,15 +1028,22 @@ export const DEFAULT_SINKS = [
     { method: 'readObject', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [] },
     { method: 'readUnshared', class: 'ObjectInputStream', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [] },
     { method: 'fromXML', class: 'XStream', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
-    { method: 'readValue', class: 'ObjectMapper', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
-    // YAML deserialization
-    { method: 'load', class: 'Yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
+    // Jackson ObjectMapper — the 1-arg `readValue(json)` form is polymorphic and
+    // can deserialize attacker-controlled types (default-typing gadget chains).
+    // The 2-arg typed form `readValue(json, User.class)` is safe because the
+    // deserialized type is fixed at compile time; suppressed via
+    // safe_if_class_literal_at. The `readValue(json, Class.forName(x))` shape
+    // is NOT a class literal and remains a sink.
+    { method: 'readValue', class: 'ObjectMapper', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], safe_if_class_literal_at: 1 },
+    // YAML deserialization — `Yaml.load(InputStream, Class<T>)` typed overload
+    // is safe; `Yaml.load(InputStream)` and dynamic-class forms are not.
+    { method: 'load', class: 'Yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], safe_if_class_literal_at: 1 },
     { method: 'loadAll', class: 'Yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
-    { method: 'loadAs', class: 'Yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
+    { method: 'loadAs', class: 'Yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], safe_if_class_literal_at: 1 },
     // JSON deserialization (Java FastJSON / Jackson — NOT JavaScript's safe JSON.parse)
-    { method: 'parseObject', class: 'JSON', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
-    { method: 'parseObject', class: 'JSONObject', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
-    { method: 'fromJson', class: 'Gson', type: 'deserialization', cwe: 'CWE-502', severity: 'medium', arg_positions: [0] },
+    { method: 'parseObject', class: 'JSON', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], safe_if_class_literal_at: 1 },
+    { method: 'parseObject', class: 'JSONObject', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0], safe_if_class_literal_at: 1 },
+    { method: 'fromJson', class: 'Gson', type: 'deserialization', cwe: 'CWE-502', severity: 'medium', arg_positions: [0], safe_if_class_literal_at: 1 },
     // XMLDecoder
     { method: 'readObject', class: 'XMLDecoder', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [] },
     // Java serialization constructors
@@ -1303,12 +1327,13 @@ export const DEFAULT_SINKS = [
     { method: 'exec', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['python'] },
     { method: 'compile', type: 'code_injection', cwe: 'CWE-94', severity: 'high', arg_positions: [0], languages: ['python'] },
     { method: '__import__', type: 'code_injection', cwe: 'CWE-94', severity: 'high', arg_positions: [0], languages: ['python'] },
-    // Python Deserialization
-    { method: 'loads', class: 'pickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
-    { method: 'load', class: 'pickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
-    { method: 'loads', class: 'marshal', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
-    { method: 'load', class: 'yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
-    { method: 'loads', class: 'yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
+    // Python Deserialization — language-scoped so the lowercase `yaml` / `pickle`
+    // module names don't collide with Java locals named `yaml` (SnakeYAML usage).
+    { method: 'loads', class: 'pickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'load', class: 'pickle', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'loads', class: 'marshal', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'load', class: 'yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
+    { method: 'loads', class: 'yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['python'] },
     // Python SQL Injection
     // Language-scoped: classless `execute`/`raw` collide with Java util.concurrent
     // (Executor.execute, ThreadPool.execute) and other languages. See issue #14.