circle-ir 3.70.0 → 3.72.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/dist/analysis/config-loader.d.ts.map +1 -1
  2. package/dist/analysis/config-loader.js +54 -0
  3. package/dist/analysis/config-loader.js.map +1 -1
  4. package/dist/analysis/constant-propagation/index.d.ts.map +1 -1
  5. package/dist/analysis/constant-propagation/index.js +14 -0
  6. package/dist/analysis/constant-propagation/index.js.map +1 -1
  7. package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
  8. package/dist/analysis/passes/language-sources-pass.js +93 -22
  9. package/dist/analysis/passes/language-sources-pass.js.map +1 -1
  10. package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
  11. package/dist/analysis/passes/sink-filter-pass.js +19 -0
  12. package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
  13. package/dist/analysis/passes/taint-propagation-pass.d.ts.map +1 -1
  14. package/dist/analysis/passes/taint-propagation-pass.js +131 -0
  15. package/dist/analysis/passes/taint-propagation-pass.js.map +1 -1
  16. package/dist/browser/circle-ir.js +195 -20
  17. package/dist/core/circle-ir-core.cjs +57 -0
  18. package/dist/core/circle-ir-core.js +57 -0
  19. package/package.json +1 -1
package/dist/core/circle-ir-core.cjs CHANGED
@@ -11400,6 +11400,41 @@ var DEFAULT_SINKS = [
11400
11400
  // pattern with a language-scoped classless entry. The method name
11401
11401
  // `redirect` is rare outside HTTP frameworks so the FP risk is low.
11402
11402
  { method: "redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
11403
+ // Node.js LDAP Injection (ldapjs) — CWE-90
11404
+ // cognium-dev#104 Sprint 22: receiver matches the canonical ldapjs
11405
+ // import name (`const ldap = require('ldapjs')` → ldap.search/...).
11406
+ { method: "search", class: "ldap", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
11407
+ { method: "searchSync", class: "ldap", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
11408
+ { method: "search", class: "ldapjs", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
11409
+ { method: "searchSync", class: "ldapjs", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
11410
+ // Node.js XPath Injection (xpath module) — CWE-643
11411
+ // cognium-dev#104 Sprint 22: `const xpath = require('xpath')` → xpath.select/select1/evaluate.
11412
+ { method: "select", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11413
+ { method: "select1", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11414
+ { method: "evaluate", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11415
+ { method: "parse", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11416
+ // Node.js XXE (libxmljs, xmldom) — CWE-611
11417
+ // cognium-dev#104 Sprint 22: `const libxml = require('libxmljs')` (or 'libxml')
11418
+ // → libxml.parseXml(src, {noent: true}). xmldom DOMParser via parseFromString.
11419
+ { method: "parseXml", class: "libxml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11420
+ { method: "parseXmlString", class: "libxml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11421
+ { method: "parseXml", class: "libxmljs", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11422
+ { method: "parseXmlString", class: "libxmljs", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11423
+ { method: "parseFromString", class: "DOMParser", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11424
+ { method: "parseFromString", class: "xmldom", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11425
+ // Node.js Server-Side Template Injection (SSTI) — CWE-94
11426
+ // cognium-dev#104 Sprint 22: ejs/handlebars/pug template render with
11427
+ // tainted templates → arbitrary JS execution. Uses `code_injection`
11428
+ // SinkType to mirror the Python Jinja2/Mako pattern above.
11429
+ { method: "render", class: "ejs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11430
+ { method: "compile", class: "ejs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11431
+ { method: "render", class: "handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11432
+ { method: "compile", class: "handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11433
+ { method: "render", class: "pug", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11434
+ { method: "compile", class: "pug", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11435
+ { method: "render", class: "mustache", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11436
+ { method: "render", class: "nunjucks", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11437
+ { method: "renderString", class: "nunjucks", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11403
11438
  // =========================================================================
11404
11439
  // Python Sinks
11405
11440
  // =========================================================================
@@ -11509,6 +11544,16 @@ var DEFAULT_SINKS = [
11509
11544
  { method: "delete_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
11510
11545
  { method: "delete_many", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
11511
11546
  { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
11547
+ // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
11548
+ // class isn't statically known. Method-only entries restricted to Python.
11549
+ // cognium-dev#104 Sprint 22.
11550
+ { method: "find_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
11551
+ { method: "update_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
11552
+ { method: "update_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
11553
+ { method: "delete_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
11554
+ { method: "delete_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
11555
+ { method: "replace_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
11556
+ { method: "count_documents", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
11512
11557
  // Python Template Injection (Jinja2, Mako)
11513
11558
  { method: "from_string", class: "Template", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
11514
11559
  { method: "Template", class: "jinja2", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
@@ -11519,6 +11564,15 @@ var DEFAULT_SINKS = [
11519
11564
  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11520
11565
  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11521
11566
  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11567
+ // Python `logging` module top-level functions (e.g. logging.info(...))
11568
+ // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
11569
+ { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11570
+ { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11571
+ { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11572
+ { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11573
+ { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11574
+ { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1] },
11575
+ { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11522
11576
  // =========================================================================
11523
11577
  // Java CWE-Bench Enhancement Patterns (Collection/Builder)
11524
11578
  // =========================================================================
@@ -16231,6 +16285,9 @@ function isFalsePositive(result, sinkLine, taintedVar) {
16231
16285
  if (varValue && varValue.type !== "unknown" && !result.tainted.has(taintedVar)) {
16232
16286
  return { isFalsePositive: true, reason: `variable_is_constant: ${varValue.value}` };
16233
16287
  }
16288
+ if (taintedVar.startsWith("self.") || taintedVar.startsWith("this.")) {
16289
+ return { isFalsePositive: false, reason: null };
16290
+ }
16234
16291
  if (result.symbols.has(taintedVar) && !result.tainted.has(taintedVar)) {
16235
16292
  return { isFalsePositive: true, reason: "variable_not_tainted" };
16236
16293
  }
package/dist/core/circle-ir-core.js CHANGED
@@ -11334,6 +11334,41 @@ var DEFAULT_SINKS = [
11334
11334
  // pattern with a language-scoped classless entry. The method name
11335
11335
  // `redirect` is rare outside HTTP frameworks so the FP risk is low.
11336
11336
  { method: "redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
11337
+ // Node.js LDAP Injection (ldapjs) — CWE-90
11338
+ // cognium-dev#104 Sprint 22: receiver matches the canonical ldapjs
11339
+ // import name (`const ldap = require('ldapjs')` → ldap.search/...).
11340
+ { method: "search", class: "ldap", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
11341
+ { method: "searchSync", class: "ldap", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
11342
+ { method: "search", class: "ldapjs", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
11343
+ { method: "searchSync", class: "ldapjs", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
11344
+ // Node.js XPath Injection (xpath module) — CWE-643
11345
+ // cognium-dev#104 Sprint 22: `const xpath = require('xpath')` → xpath.select/select1/evaluate.
11346
+ { method: "select", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11347
+ { method: "select1", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11348
+ { method: "evaluate", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11349
+ { method: "parse", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11350
+ // Node.js XXE (libxmljs, xmldom) — CWE-611
11351
+ // cognium-dev#104 Sprint 22: `const libxml = require('libxmljs')` (or 'libxml')
11352
+ // → libxml.parseXml(src, {noent: true}). xmldom DOMParser via parseFromString.
11353
+ { method: "parseXml", class: "libxml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11354
+ { method: "parseXmlString", class: "libxml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11355
+ { method: "parseXml", class: "libxmljs", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11356
+ { method: "parseXmlString", class: "libxmljs", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11357
+ { method: "parseFromString", class: "DOMParser", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11358
+ { method: "parseFromString", class: "xmldom", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
11359
+ // Node.js Server-Side Template Injection (SSTI) — CWE-94
11360
+ // cognium-dev#104 Sprint 22: ejs/handlebars/pug template render with
11361
+ // tainted templates → arbitrary JS execution. Uses `code_injection`
11362
+ // SinkType to mirror the Python Jinja2/Mako pattern above.
11363
+ { method: "render", class: "ejs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11364
+ { method: "compile", class: "ejs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11365
+ { method: "render", class: "handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11366
+ { method: "compile", class: "handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11367
+ { method: "render", class: "pug", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11368
+ { method: "compile", class: "pug", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11369
+ { method: "render", class: "mustache", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11370
+ { method: "render", class: "nunjucks", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11371
+ { method: "renderString", class: "nunjucks", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11337
11372
  // =========================================================================
11338
11373
  // Python Sinks
11339
11374
  // =========================================================================
@@ -11443,6 +11478,16 @@ var DEFAULT_SINKS = [
11443
11478
  { method: "delete_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
11444
11479
  { method: "delete_many", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
11445
11480
  { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
11481
+ // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
11482
+ // class isn't statically known. Method-only entries restricted to Python.
11483
+ // cognium-dev#104 Sprint 22.
11484
+ { method: "find_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
11485
+ { method: "update_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
11486
+ { method: "update_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
11487
+ { method: "delete_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
11488
+ { method: "delete_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
11489
+ { method: "replace_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
11490
+ { method: "count_documents", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
11446
11491
  // Python Template Injection (Jinja2, Mako)
11447
11492
  { method: "from_string", class: "Template", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
11448
11493
  { method: "Template", class: "jinja2", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
@@ -11453,6 +11498,15 @@ var DEFAULT_SINKS = [
11453
11498
  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11454
11499
  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11455
11500
  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11501
+ // Python `logging` module top-level functions (e.g. logging.info(...))
11502
+ // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
11503
+ { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11504
+ { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11505
+ { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11506
+ { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11507
+ { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11508
+ { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1] },
11509
+ { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
11456
11510
  // =========================================================================
11457
11511
  // Java CWE-Bench Enhancement Patterns (Collection/Builder)
11458
11512
  // =========================================================================
@@ -16165,6 +16219,9 @@ function isFalsePositive(result, sinkLine, taintedVar) {
16165
16219
  if (varValue && varValue.type !== "unknown" && !result.tainted.has(taintedVar)) {
16166
16220
  return { isFalsePositive: true, reason: `variable_is_constant: ${varValue.value}` };
16167
16221
  }
16222
+ if (taintedVar.startsWith("self.") || taintedVar.startsWith("this.")) {
16223
+ return { isFalsePositive: false, reason: null };
16224
+ }
16168
16225
  if (result.symbols.has(taintedVar) && !result.tainted.has(taintedVar)) {
16169
16226
  return { isFalsePositive: true, reason: "variable_not_tainted" };
16170
16227
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "circle-ir",
3
- "version": "3.70.0",
3
+ "version": "3.72.0",
4
4
  "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.js",