circle-ir 3.51.0 → 3.52.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/dist/analysis/config-loader.d.ts.map +1 -1
  2. package/dist/analysis/config-loader.js +9 -19
  3. package/dist/analysis/config-loader.js.map +1 -1
  4. package/dist/analysis/passes/insecure-cookie-pass.d.ts +23 -23
  5. package/dist/analysis/passes/insecure-cookie-pass.d.ts.map +1 -1
  6. package/dist/analysis/passes/insecure-cookie-pass.js +169 -79
  7. package/dist/analysis/passes/insecure-cookie-pass.js.map +1 -1
  8. package/dist/analysis/passes/tls-verify-disabled-pass.d.ts +52 -0
  9. package/dist/analysis/passes/tls-verify-disabled-pass.d.ts.map +1 -0
  10. package/dist/analysis/passes/tls-verify-disabled-pass.js +247 -0
  11. package/dist/analysis/passes/tls-verify-disabled-pass.js.map +1 -0
  12. package/dist/analysis/passes/weak-crypto-pass.d.ts +49 -0
  13. package/dist/analysis/passes/weak-crypto-pass.d.ts.map +1 -0
  14. package/dist/analysis/passes/weak-crypto-pass.js +223 -0
  15. package/dist/analysis/passes/weak-crypto-pass.js.map +1 -0
  16. package/dist/analysis/passes/weak-hash-pass.d.ts +45 -0
  17. package/dist/analysis/passes/weak-hash-pass.d.ts.map +1 -0
  18. package/dist/analysis/passes/weak-hash-pass.js +150 -0
  19. package/dist/analysis/passes/weak-hash-pass.js.map +1 -0
  20. package/dist/analysis/passes/weak-random-pass.d.ts +53 -0
  21. package/dist/analysis/passes/weak-random-pass.d.ts.map +1 -0
  22. package/dist/analysis/passes/weak-random-pass.js +181 -0
  23. package/dist/analysis/passes/weak-random-pass.js.map +1 -0
  24. package/dist/analyzer.d.ts.map +1 -1
  25. package/dist/analyzer.js +12 -0
  26. package/dist/analyzer.js.map +1 -1
  27. package/dist/browser/circle-ir.js +747 -50
  28. package/dist/core/circle-ir-core.cjs +9 -19
  29. package/dist/core/circle-ir-core.js +9 -19
  30. package/package.json +1 -1
package/dist/core/circle-ir-core.cjs CHANGED
@@ -10914,26 +10914,16 @@ var DEFAULT_SINKS = [
10914
10914
  { method: "get", class: "WebClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
10915
10915
  { method: "post", class: "WebClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
10916
10916
  // =============================================================================
10917
- // Weak Cryptography Sinks (no taint flow required - presence alone is vulnerability)
10917
+ // Config / Absence Vulnerabilities (handled by dedicated pattern passes)
10918
10918
  // =============================================================================
10919
- // Weak Random (CWE-330) - java.util.Random is not cryptographically secure
10920
- { method: "Random", class: "constructor", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10921
- { method: "nextInt", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10922
- { method: "nextLong", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10923
- { method: "nextFloat", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10924
- { method: "nextDouble", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10925
- { method: "nextBoolean", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10926
- { method: "nextBytes", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10927
- // Weak Hash (CWE-328) - MD5/SHA1 are cryptographically broken
10928
- // Note: Detection requires checking algorithm argument - handled in runner
10929
- { method: "getInstance", class: "MessageDigest", type: "weak_hash", cwe: "CWE-328", severity: "medium", arg_positions: [0] },
10930
- // Weak Crypto (CWE-327) - DES/RC4/Blowfish are weak ciphers
10931
- // Note: Detection requires checking algorithm argument - handled in runner
10932
- { method: "getInstance", class: "Cipher", type: "weak_crypto", cwe: "CWE-327", severity: "high", arg_positions: [0] },
10933
- { method: "getInstance", class: "KeyGenerator", type: "weak_crypto", cwe: "CWE-327", severity: "high", arg_positions: [0] },
10934
- // Insecure Cookie (CWE-614) - cookies without secure/httpOnly flags
10935
- // Note: Detection requires checking if setSecure(true)/setHttpOnly(true) called - handled in runner
10936
- { method: "Cookie", class: "constructor", type: "insecure_cookie", cwe: "CWE-614", severity: "medium", arg_positions: [] },
10919
+ // weak_random → WeakRandomPass (src/analysis/passes/weak-random-pass.ts)
10920
+ // weak_hash → WeakHashPass (src/analysis/passes/weak-hash-pass.ts)
10921
+ // weak_crypto → WeakCryptoPass (src/analysis/passes/weak-crypto-pass.ts)
10922
+ // insecure_cookie → InsecureCookiePass (src/analysis/passes/insecure-cookie-pass.ts)
10923
+ // tls_verify_disabled → TlsVerifyDisabledPass
10924
+ // These patterns are detected by call-site literal inspection, not taint flow,
10925
+ // so they are NOT registered here as sinks (they could never match a "tainted
10926
+ // value flowing into a sink" because the bad value is a hard-coded constant).
10937
10927
  // Trust Boundary (CWE-501) - using untrusted data as session attribute NAME
10938
10928
  // The vulnerability is attacker controlling which key to use, not the value
10939
10929
  { method: "setAttribute", class: "HttpSession", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0] },
package/dist/core/circle-ir-core.js CHANGED
@@ -10848,26 +10848,16 @@ var DEFAULT_SINKS = [
10848
10848
  { method: "get", class: "WebClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
10849
10849
  { method: "post", class: "WebClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
10850
10850
  // =============================================================================
10851
- // Weak Cryptography Sinks (no taint flow required - presence alone is vulnerability)
10851
+ // Config / Absence Vulnerabilities (handled by dedicated pattern passes)
10852
10852
  // =============================================================================
10853
- // Weak Random (CWE-330) - java.util.Random is not cryptographically secure
10854
- { method: "Random", class: "constructor", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10855
- { method: "nextInt", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10856
- { method: "nextLong", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10857
- { method: "nextFloat", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10858
- { method: "nextDouble", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10859
- { method: "nextBoolean", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10860
- { method: "nextBytes", class: "Random", type: "weak_random", cwe: "CWE-330", severity: "medium", arg_positions: [] },
10861
- // Weak Hash (CWE-328) - MD5/SHA1 are cryptographically broken
10862
- // Note: Detection requires checking algorithm argument - handled in runner
10863
- { method: "getInstance", class: "MessageDigest", type: "weak_hash", cwe: "CWE-328", severity: "medium", arg_positions: [0] },
10864
- // Weak Crypto (CWE-327) - DES/RC4/Blowfish are weak ciphers
10865
- // Note: Detection requires checking algorithm argument - handled in runner
10866
- { method: "getInstance", class: "Cipher", type: "weak_crypto", cwe: "CWE-327", severity: "high", arg_positions: [0] },
10867
- { method: "getInstance", class: "KeyGenerator", type: "weak_crypto", cwe: "CWE-327", severity: "high", arg_positions: [0] },
10868
- // Insecure Cookie (CWE-614) - cookies without secure/httpOnly flags
10869
- // Note: Detection requires checking if setSecure(true)/setHttpOnly(true) called - handled in runner
10870
- { method: "Cookie", class: "constructor", type: "insecure_cookie", cwe: "CWE-614", severity: "medium", arg_positions: [] },
10853
+ // weak_random → WeakRandomPass (src/analysis/passes/weak-random-pass.ts)
10854
+ // weak_hash → WeakHashPass (src/analysis/passes/weak-hash-pass.ts)
10855
+ // weak_crypto → WeakCryptoPass (src/analysis/passes/weak-crypto-pass.ts)
10856
+ // insecure_cookie → InsecureCookiePass (src/analysis/passes/insecure-cookie-pass.ts)
10857
+ // tls_verify_disabled → TlsVerifyDisabledPass
10858
+ // These patterns are detected by call-site literal inspection, not taint flow,
10859
+ // so they are NOT registered here as sinks (they could never match a "tainted
10860
+ // value flowing into a sink" because the bad value is a hard-coded constant).
10871
10861
  // Trust Boundary (CWE-501) - using untrusted data as session attribute NAME
10872
10862
  // The vulnerability is attacker controlling which key to use, not the value
10873
10863
  { method: "setAttribute", class: "HttpSession", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0] },
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "circle-ir",
3
- "version": "3.51.0",
3
+ "version": "3.52.0",
4
4
  "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.js",