circle-ir 3.6.0 → 3.8.2

package/configs/sinks/nodejs.json

@@ -9,6 +9,14 @@
       "arg_positions": [0],
       "note": "Command execution - extremely dangerous with user input"
     },
+    {
+      "method": "exec",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Destructured child_process.exec import - no receiver"
+    },
     {
       "method": "execSync",
       "class": "child_process",
@@ -18,6 +26,14 @@
       "arg_positions": [0],
       "note": "Synchronous command execution"
     },
+    {
+      "method": "execSync",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Destructured child_process.execSync import - no receiver"
+    },
     {
       "method": "spawn",
       "class": "child_process",
@@ -27,6 +43,14 @@
       "arg_positions": [0, 1],
       "note": "Process spawn - arg[0] is command, arg[1] is args array"
     },
+    {
+      "method": "spawn",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0, 1],
+      "note": "Destructured child_process.spawn import - no receiver"
+    },
     {
       "method": "spawnSync",
       "class": "child_process",
@@ -36,6 +60,14 @@
       "arg_positions": [0, 1],
       "note": "Synchronous process spawn"
     },
+    {
+      "method": "spawnSync",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0, 1],
+      "note": "Destructured child_process.spawnSync import - no receiver"
+    },
     {
       "method": "execFile",
       "class": "child_process",
@@ -45,6 +77,14 @@
       "arg_positions": [0, 1],
       "note": "Execute file with arguments"
     },
+    {
+      "method": "execFile",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0, 1],
+      "note": "Destructured child_process.execFile import - no receiver"
+    },
     {
       "method": "fork",
       "class": "child_process",
@@ -293,6 +333,15 @@
       "arg_positions": [0],
       "note": "Node.js HTTP request"
     },
+    {
+      "method": "get",
+      "class": "http",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Node.js HTTP GET request - validate URL to prevent SSRF"
+    },
     {
       "method": "request",
       "class": "https",
@@ -302,6 +351,15 @@
       "arg_positions": [0],
       "note": "Node.js HTTPS request"
     },
+    {
+      "method": "get",
+      "class": "https",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Node.js HTTPS GET request"
+    },
     {
       "method": "redirect",
       "class": "Response",

package/configs/sinks/python.json

@@ -378,6 +378,15 @@
       "arg_positions": [0],
       "note": "etree.iterfind() with XPath expression"
     },
+    {
+      "method": "select",
+      "class": "elementpath",
+      "type": "xpath_injection",
+      "cwe": "CWE-643",
+      "severity": "high",
+      "arg_positions": [1],
+      "note": "elementpath.select(root, query) - XPath injection via query param"
+    },
     {
       "method": "parse",
       "class": "etree",

package/configs/sources/python.json

@@ -1,21 +1,37 @@
 {
   "sources": [
     {
-      "method": "args.get",
-      "class": "request",
+      "method": "get",
+      "class": "args",
       "type": "http_param",
       "severity": "high",
       "return_tainted": true,
       "note": "Flask request.args.get() - query string parameter"
     },
     {
-      "method": "form.get",
-      "class": "request",
+      "method": "getlist",
+      "class": "args",
       "type": "http_param",
       "severity": "high",
       "return_tainted": true,
+      "note": "Flask request.args.getlist() - multi-value query string parameter"
+    },
+    {
+      "method": "get",
+      "class": "form",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
       "note": "Flask request.form.get() - POST form parameter"
     },
+    {
+      "method": "getlist",
+      "class": "form",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Flask request.form.getlist() - multi-value POST form parameter"
+    },
     {
       "field": "json",
       "class": "request",
@@ -24,6 +40,14 @@
       "return_tainted": true,
       "note": "Flask request.json - parsed JSON body"
     },
+    {
+      "method": "get_json",
+      "class": "request",
+      "type": "http_body",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Flask request.get_json() - parsed JSON body"
+    },
     {
       "field": "data",
       "class": "request",
@@ -33,16 +57,16 @@
       "note": "Flask request.data - raw request body"
     },
     {
-      "method": "headers.get",
-      "class": "request",
+      "method": "get",
+      "class": "headers",
       "type": "http_header",
       "severity": "high",
       "return_tainted": true,
       "note": "Flask request.headers.get() - HTTP header value"
     },
     {
-      "method": "cookies.get",
-      "class": "request",
+      "method": "get",
+      "class": "cookies",
       "type": "http_cookie",
       "severity": "high",
       "return_tainted": true,
@@ -65,17 +89,17 @@
       "note": "Flask request.query_string - raw query string"
     },
     {
-      "method": "GET.get",
-      "class": "request",
+      "method": "get",
+      "class": "GET",
       "type": "http_param",
       "severity": "high",
       "return_tainted": true,
       "note": "Django request.GET.get() - query string parameter"
     },
     {
-      "method": "POST.get",
-      "class": "request",
-      "type": "http_param",
+      "method": "get",
+      "class": "POST",
+      "type": "http_body",
       "severity": "high",
       "return_tainted": true,
       "note": "Django request.POST.get() - POST form parameter"
@@ -89,21 +113,29 @@
       "note": "Django request.body - raw request body"
     },
     {
-      "method": "META.get",
-      "class": "request",
+      "method": "get",
+      "class": "META",
       "type": "http_header",
       "severity": "high",
       "return_tainted": true,
       "note": "Django request.META.get() - HTTP headers and server info"
     },
     {
-      "method": "COOKIES.get",
-      "class": "request",
+      "method": "get",
+      "class": "COOKIES",
       "type": "http_cookie",
       "severity": "high",
       "return_tainted": true,
       "note": "Django request.COOKIES.get() - cookie value"
     },
+    {
+      "field": "FILES",
+      "class": "request",
+      "type": "file_input",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "Django request.FILES - uploaded files"
+    },
     {
       "field": "path_info",
       "class": "request",
@@ -112,6 +144,14 @@
       "return_tainted": true,
       "note": "Django request.path_info - URL path"
     },
+    {
+      "method": "get",
+      "class": "query_params",
+      "type": "http_param",
+      "severity": "high",
+      "return_tainted": true,
+      "note": "FastAPI/Starlette request.query_params.get() - query string parameter"
+    },
     {
       "method": "get",
       "class": "environ",

package/dist/analysis/config-loader.js

@@ -539,9 +539,7 @@ export const DEFAULT_SINKS = [
     { method: 'resolveURI', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'resolve', class: 'SourceResolver', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'getSource', class: 'SourceResolver', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
-    // URL-based resource loading
-    { method: 'URL', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [0] },
-    { method: 'openStream', class: 'URL', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
+    // NOTE: new URL(userInput) is SSRF (CWE-918), not path traversal — see ssrf section below
     // Servlet context resource loading
     { method: 'getResource', class: 'ServletContext', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'getResourceAsStream', class: 'ServletContext', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
@@ -578,8 +576,7 @@ export const DEFAULT_SINKS = [
     { method: 'extract', type: 'path_traversal', cwe: 'CWE-22', severity: 'critical', arg_positions: [0, 1] },
     { method: 'extractAll', type: 'path_traversal', cwe: 'CWE-22', severity: 'critical', arg_positions: [0, 1] },
     { method: 'unjar', type: 'path_traversal', cwe: 'CWE-22', severity: 'critical', arg_positions: [0, 1] },
-    // Additional file constructors
-    { method: 'BufferedReader', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
+    // Additional file constructors — BufferedReader(Reader) is NOT a path traversal sink; it wraps a Reader, not a file path
     { method: 'PrintWriter', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'Scanner', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     // Topic/queue names (for message queue systems - can be exploited for path traversal)
@@ -1102,9 +1099,12 @@ export const DEFAULT_SINKS = [
     { method: 'execSync', class: 'child_process', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
     { method: 'spawn', class: 'child_process', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
     { method: 'spawnSync', class: 'child_process', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
-    // Also match without receiver (destructured imports)
+    // Also match without receiver (destructured imports: const { exec } = require('child_process'))
     { method: 'exec', type: 'command_injection', cwe: 'CWE-78', severity: 'high', arg_positions: [0] },
     { method: 'execSync', type: 'command_injection', cwe: 'CWE-78', severity: 'high', arg_positions: [0] },
+    { method: 'spawn', type: 'command_injection', cwe: 'CWE-78', severity: 'high', arg_positions: [0] },
+    { method: 'spawnSync', type: 'command_injection', cwe: 'CWE-78', severity: 'high', arg_positions: [0] },
+    { method: 'execFile', type: 'command_injection', cwe: 'CWE-78', severity: 'high', arg_positions: [0] },
     // Node.js File System (path traversal)
     { method: 'readFile', class: 'fs', type: 'path_traversal', cwe: 'CWE-22', severity: 'critical', arg_positions: [0] },
     { method: 'readFileSync', class: 'fs', type: 'path_traversal', cwe: 'CWE-22', severity: 'critical', arg_positions: [0] },
@@ -1147,7 +1147,9 @@ export const DEFAULT_SINKS = [
     { method: 'request', class: 'axios', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'fetch', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'request', class: 'http', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
+    { method: 'get', class: 'http', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'request', class: 'https', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
+    { method: 'get', class: 'https', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     // needle library (used in NodeGoat)
     { method: 'get', class: 'needle', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'post', class: 'needle', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },