circle-ir 3.71.0 → 3.72.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/dist/analysis/config-loader.d.ts.map +1 -1
  2. package/dist/analysis/config-loader.js +54 -0
  3. package/dist/analysis/config-loader.js.map +1 -1
  4. package/dist/analysis/constant-propagation/index.d.ts.map +1 -1
  5. package/dist/analysis/constant-propagation/index.js +14 -0
  6. package/dist/analysis/constant-propagation/index.js.map +1 -1
  7. package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
  8. package/dist/analysis/passes/language-sources-pass.js +62 -21
  9. package/dist/analysis/passes/language-sources-pass.js.map +1 -1
  10. package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
  11. package/dist/analysis/passes/sink-filter-pass.js +19 -0
  12. package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
  13. package/dist/browser/circle-ir.js +110 -19
  14. package/dist/core/circle-ir-core.cjs +57 -0
  15. package/dist/core/circle-ir-core.js +57 -0
  16. package/package.json +1 -1
package/dist/analysis/config-loader.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAy5CtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAiPhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
1
+ {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,CAQb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA2b1C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,EAm9CtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAiPhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
package/dist/analysis/config-loader.js CHANGED
@@ -1415,6 +1415,41 @@ export const DEFAULT_SINKS = [
1415
1415
  // pattern with a language-scoped classless entry. The method name
1416
1416
  // `redirect` is rare outside HTTP frameworks so the FP risk is low.
1417
1417
  { method: 'redirect', type: 'open_redirect', cwe: 'CWE-601', severity: 'medium', arg_positions: [0], languages: ['javascript', 'typescript'] },
1418
+ // Node.js LDAP Injection (ldapjs) — CWE-90
1419
+ // cognium-dev#104 Sprint 22: receiver matches the canonical ldapjs
1420
+ // import name (`const ldap = require('ldapjs')` → ldap.search/...).
1421
+ { method: 'search', class: 'ldap', type: 'ldap_injection', cwe: 'CWE-90', severity: 'high', arg_positions: [1, 2], languages: ['javascript', 'typescript'] },
1422
+ { method: 'searchSync', class: 'ldap', type: 'ldap_injection', cwe: 'CWE-90', severity: 'high', arg_positions: [1, 2], languages: ['javascript', 'typescript'] },
1423
+ { method: 'search', class: 'ldapjs', type: 'ldap_injection', cwe: 'CWE-90', severity: 'high', arg_positions: [1, 2], languages: ['javascript', 'typescript'] },
1424
+ { method: 'searchSync', class: 'ldapjs', type: 'ldap_injection', cwe: 'CWE-90', severity: 'high', arg_positions: [1, 2], languages: ['javascript', 'typescript'] },
1425
+ // Node.js XPath Injection (xpath module) — CWE-643
1426
+ // cognium-dev#104 Sprint 22: `const xpath = require('xpath')` → xpath.select/select1/evaluate.
1427
+ { method: 'select', class: 'xpath', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
1428
+ { method: 'select1', class: 'xpath', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
1429
+ { method: 'evaluate', class: 'xpath', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
1430
+ { method: 'parse', class: 'xpath', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
1431
+ // Node.js XXE (libxmljs, xmldom) — CWE-611
1432
+ // cognium-dev#104 Sprint 22: `const libxml = require('libxmljs')` (or 'libxml')
1433
+ // → libxml.parseXml(src, {noent: true}). xmldom DOMParser via parseFromString.
1434
+ { method: 'parseXml', class: 'libxml', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
1435
+ { method: 'parseXmlString', class: 'libxml', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
1436
+ { method: 'parseXml', class: 'libxmljs', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
1437
+ { method: 'parseXmlString', class: 'libxmljs', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
1438
+ { method: 'parseFromString', class: 'DOMParser', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
1439
+ { method: 'parseFromString', class: 'xmldom', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
1440
+ // Node.js Server-Side Template Injection (SSTI) — CWE-94
1441
+ // cognium-dev#104 Sprint 22: ejs/handlebars/pug template render with
1442
+ // tainted templates → arbitrary JS execution. Uses `code_injection`
1443
+ // SinkType to mirror the Python Jinja2/Mako pattern above.
1444
+ { method: 'render', class: 'ejs', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
1445
+ { method: 'compile', class: 'ejs', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
1446
+ { method: 'render', class: 'handlebars', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
1447
+ { method: 'compile', class: 'handlebars', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
1448
+ { method: 'render', class: 'pug', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
1449
+ { method: 'compile', class: 'pug', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
1450
+ { method: 'render', class: 'mustache', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
1451
+ { method: 'render', class: 'nunjucks', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
1452
+ { method: 'renderString', class: 'nunjucks', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'] },
1418
1453
  // =========================================================================
1419
1454
  // Python Sinks
1420
1455
  // =========================================================================
@@ -1524,6 +1559,16 @@ export const DEFAULT_SINKS = [
1524
1559
  { method: 'delete_one', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0] },
1525
1560
  { method: 'delete_many', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0] },
1526
1561
  { method: 'aggregate', class: 'Collection', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0] },
1562
+ // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
1563
+ // class isn't statically known. Method-only entries restricted to Python.
1564
+ // cognium-dev#104 Sprint 22.
1565
+ { method: 'find_one', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0], languages: ['python'] },
1566
+ { method: 'update_one', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0, 1], languages: ['python'] },
1567
+ { method: 'update_many', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0, 1], languages: ['python'] },
1568
+ { method: 'delete_one', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0], languages: ['python'] },
1569
+ { method: 'delete_many', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0], languages: ['python'] },
1570
+ { method: 'replace_one', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0, 1], languages: ['python'] },
1571
+ { method: 'count_documents', type: 'nosql_injection', cwe: 'CWE-943', severity: 'critical', arg_positions: [0], languages: ['python'] },
1527
1572
  // Python Template Injection (Jinja2, Mako)
1528
1573
  { method: 'from_string', class: 'Template', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
1529
1574
  { method: 'Template', class: 'jinja2', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
@@ -1534,6 +1579,15 @@ export const DEFAULT_SINKS = [
1534
1579
  { method: 'error', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1535
1580
  { method: 'debug', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1536
1581
  { method: 'critical', class: 'logger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1582
+ // Python `logging` module top-level functions (e.g. logging.info(...))
1583
+ // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
1584
+ { method: 'info', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1585
+ { method: 'warning', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1586
+ { method: 'error', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1587
+ { method: 'debug', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1588
+ { method: 'critical', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1589
+ { method: 'log', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [1] },
1590
+ { method: 'exception', class: 'logging', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0] },
1537
1591
  // =========================================================================
1538
1592
  // Java CWE-Bench Enhancement Patterns (Collection/Builder)
1539
1593
  // =========================================================================