circle-ir 3.52.0 → 3.53.0

package/configs/sinks/path.yaml

@@ -668,22 +668,6 @@
       "arg_positions": [0],
       "note": "Unzip operation - zip slip"
     },
-    {
-      "method": "getPath",
-      "class": "ZipEntry",
-      "type": "path_traversal",
-      "cwe": "CWE-022",
-      "severity": "high",
-      "note": "Zip entry path - may contain ../"
-    },
-    {
-      "method": "getName",
-      "class": "ZipEntry",
-      "type": "path_traversal",
-      "cwe": "CWE-022",
-      "severity": "high",
-      "note": "Zip entry name - may contain ../"
-    },
     {
       "method": "getEnvironment",
       "class": "ConfigServicePropertySourceLocator",

package/configs/sources/file_sources.yaml

@@ -144,6 +144,38 @@
       "return_tainted": true,
       "note": "File content as InputStream"
     },
+    {
+      "method": "getName",
+      "class": "ZipEntry",
+      "type": "file_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Zip entry name - may contain ../ (Zip-Slip CWE-22, issue #52)"
+    },
+    {
+      "method": "getName",
+      "class": "ZipArchiveEntry",
+      "type": "file_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Apache Commons Compress zip entry name - may contain ../ (Zip-Slip)"
+    },
+    {
+      "method": "getName",
+      "class": "TarArchiveEntry",
+      "type": "file_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Apache Commons Compress tar entry name - may contain ../ (Tar-Slip)"
+    },
+    {
+      "method": "getName",
+      "class": "ArchiveEntry",
+      "type": "file_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Generic archive entry name - may contain ../ (Zip/Tar-Slip)"
+    },
     {
       "method": "getProperty",
       "class": "Properties",

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA4a1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA8wCtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAoMhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAob1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EA8wCtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAoMhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -176,6 +176,13 @@ export const DEFAULT_SOURCES = [
     { method: 'getFileName', class: 'BodyPart', type: 'file_input', severity: 'high', return_tainted: true },
     { method: 'getFileName', class: 'MimeBodyPart', type: 'file_input', severity: 'high', return_tainted: true },
     { method: 'getDisposition', class: 'Part', type: 'file_input', severity: 'medium', return_tainted: true },
+    // Archive entry names (Zip-Slip / Tar-Slip CWE-22, issue #52)
+    // entry.getName() returns a path that may contain ../ — flowing into File()/FileOutputStream()
+    // is a classic Zip-Slip vulnerability.
+    { method: 'getName', class: 'ZipEntry', type: 'file_input', severity: 'high', return_tainted: true },
+    { method: 'getName', class: 'ZipArchiveEntry', type: 'file_input', severity: 'high', return_tainted: true },
+    { method: 'getName', class: 'TarArchiveEntry', type: 'file_input', severity: 'high', return_tainted: true },
+    { method: 'getName', class: 'ArchiveEntry', type: 'file_input', severity: 'high', return_tainted: true },
     // Command line arguments
     { method: 'getArgs', type: 'io_input', severity: 'high', return_tainted: true },
     { method: 'getOptionValue', class: 'CommandLine', type: 'io_input', severity: 'high', return_tainted: true },
@@ -610,7 +617,7 @@ export const DEFAULT_SINKS = [
     { method: 'staticFileLocation', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     // Zip/archive handling
     { method: 'getEntry', class: 'ZipFile', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
-    { method: 'getName', class: 'ZipEntry', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [] },
+    // ZipEntry.getName moved to file_sources.yaml as a taint SOURCE (type=archive_entry, issue #52)
     // Resource loading classes (various frameworks)
     { method: 'ClassPathResource', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'FileSystemResource', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },