circle-ir 3.71.0 → 3.72.1

package/dist/browser/circle-ir.js

@@ -12018,6 +12018,41 @@ var DEFAULT_SINKS = [
   // pattern with a language-scoped classless entry. The method name
   // `redirect` is rare outside HTTP frameworks so the FP risk is low.
   { method: "redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Node.js LDAP Injection (ldapjs) — CWE-90
+  // cognium-dev#104 Sprint 22: receiver matches the canonical ldapjs
+  // import name (`const ldap = require('ldapjs')` → ldap.search/...).
+  { method: "search", class: "ldap", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  { method: "searchSync", class: "ldap", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  { method: "search", class: "ldapjs", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  { method: "searchSync", class: "ldapjs", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  // Node.js XPath Injection (xpath module) — CWE-643
+  // cognium-dev#104 Sprint 22: `const xpath = require('xpath')` → xpath.select/select1/evaluate.
+  { method: "select", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "select1", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "evaluate", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parse", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Node.js XXE (libxmljs, xmldom) — CWE-611
+  // cognium-dev#104 Sprint 22: `const libxml = require('libxmljs')` (or 'libxml')
+  // → libxml.parseXml(src, {noent: true}). xmldom DOMParser via parseFromString.
+  { method: "parseXml", class: "libxml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseXmlString", class: "libxml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseXml", class: "libxmljs", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseXmlString", class: "libxmljs", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseFromString", class: "DOMParser", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseFromString", class: "xmldom", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Node.js Server-Side Template Injection (SSTI) — CWE-94
+  // cognium-dev#104 Sprint 22: ejs/handlebars/pug template render with
+  // tainted templates → arbitrary JS execution. Uses `code_injection`
+  // SinkType to mirror the Python Jinja2/Mako pattern above.
+  { method: "render", class: "ejs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "compile", class: "ejs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "compile", class: "handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "pug", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "compile", class: "pug", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "mustache", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "nunjucks", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "renderString", class: "nunjucks", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // =========================================================================
   // Python Sinks
   // =========================================================================
@@ -12127,6 +12162,16 @@ var DEFAULT_SINKS = [
   { method: "delete_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   { method: "delete_many", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
+  // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
+  // class isn't statically known. Method-only entries restricted to Python.
+  // cognium-dev#104 Sprint 22.
+  { method: "find_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "update_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
+  { method: "update_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
+  { method: "delete_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "delete_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "replace_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
+  { method: "count_documents", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   // Python Template Injection (Jinja2, Mako)
   { method: "from_string", class: "Template", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "jinja2", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
@@ -12137,6 +12182,15 @@ var DEFAULT_SINKS = [
   { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
   { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
   { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  // Python `logging` module top-level functions (e.g. logging.info(...))
+  // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
+  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1] },
+  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
@@ -18361,6 +18415,9 @@ function isFalsePositive(result, sinkLine, taintedVar) {
   if (varValue && varValue.type !== "unknown" && !result.tainted.has(taintedVar)) {
     return { isFalsePositive: true, reason: `variable_is_constant: ${varValue.value}` };
   }
+  if (taintedVar.startsWith("self.") || taintedVar.startsWith("this.")) {
+    return { isFalsePositive: false, reason: null };
+  }
   if (result.symbols.has(taintedVar) && !result.tainted.has(taintedVar)) {
     return { isFalsePositive: true, reason: "variable_not_tainted" };
   }
@@ -22495,13 +22552,16 @@ function findGetterSources(types, instanceFieldTaint, _sourceCode) {
   return sources;
 }
 function findOopFieldReadSources(types, sourceCode, language) {
-  if (language !== "java" && language !== "python") return [];
+  if (language !== "java" && language !== "python" && language !== "javascript" && language !== "typescript") return [];
   const sources = [];
   const lines = sourceCode.split("\n");
   const isPython = language === "python";
+  const isJs = language === "javascript" || language === "typescript";
+  const isJava = language === "java";
   const SELF = isPython ? "self" : "this";
   const javaHttpPattern = /\b(?:req|request|httpRequest|servletRequest|httpServletRequest)\.(?:getParameter|getParameterValues|getParameterMap|getHeader|getHeaders|getCookies|getQueryString|getPathInfo|getRequestURI|getRequestURL|getInputStream|getReader)\b/;
   const fieldAssignRe = new RegExp(`^\\s*${SELF}\\.([A-Za-z_]\\w*)\\s*=\\s*(.+?)(?:;\\s*)?$`);
+  const fieldAssignReG = new RegExp(`${SELF}\\.([A-Za-z_]\\w*)\\s*=\\s*([^;}\\n]+)`, "g");
   const commentPrefix = isPython ? "#" : "//";
   for (const type of types) {
     if (type.kind !== "class") continue;
@@ -22513,7 +22573,12 @@ function findOopFieldReadSources(types, sourceCode, language) {
           ctor = m;
           break;
         }
-      } else {
+      } else if (isJs) {
+        if (m.name === "constructor") {
+          ctor = m;
+          break;
+        }
+      } else if (isJava) {
         if (m.name === type.name) {
           ctor = m;
           break;
@@ -22532,25 +22597,41 @@ function findOopFieldReadSources(types, sourceCode, language) {
     for (let i2 = ctorStart - 1; i2 < Math.min(ctorEnd, lines.length); i2++) {
       const line = lines[i2] ?? "";
       if (line.trim().startsWith(commentPrefix)) continue;
-      const m = line.match(fieldAssignRe);
-      if (!m) continue;
-      const fieldName = m[1];
-      const rhs = m[2].trim().replace(/;\s*$/, "");
-      let sourceType = null;
-      if (paramNames.has(rhs)) {
-        sourceType = "interprocedural_param";
-      } else if (!isPython && javaHttpPattern.test(rhs)) {
-        sourceType = "http_param";
-      } else if (isPython) {
-        for (const { pattern, type: type2 } of PYTHON_TAINTED_PATTERNS2) {
-          if (pattern.test(rhs)) {
-            sourceType = type2;
-            break;
+      const pairs = [];
+      const anchored = line.match(fieldAssignRe);
+      if (anchored) pairs.push({ field: anchored[1], rhs: anchored[2].trim().replace(/;\s*$/, "") });
+      if (isJs) {
+        for (const m of line.matchAll(fieldAssignReG)) {
+          const field = m[1];
+          const rhs = m[2].trim().replace(/;\s*$/, "");
+          if (!pairs.some((p) => p.field === field)) pairs.push({ field, rhs });
+        }
+      }
+      if (pairs.length === 0) continue;
+      for (const { field: fieldName, rhs } of pairs) {
+        let sourceType = null;
+        if (paramNames.has(rhs)) {
+          sourceType = "interprocedural_param";
+        } else if (isJava && javaHttpPattern.test(rhs)) {
+          sourceType = "http_param";
+        } else if (isPython) {
+          for (const { pattern, type: type2 } of PYTHON_TAINTED_PATTERNS2) {
+            if (pattern.test(rhs)) {
+              sourceType = type2;
+              break;
+            }
+          }
+        } else if (isJs) {
+          for (const { pattern, type: type2 } of JS_TAINTED_PATTERNS) {
+            if (pattern.test(rhs)) {
+              sourceType = type2;
+              break;
+            }
           }
         }
-      }
-      if (sourceType) {
-        fieldTaint.set(fieldName, { line: i2 + 1, type: sourceType });
+        if (sourceType) {
+          fieldTaint.set(fieldName, { line: i2 + 1, type: sourceType });
+        }
       }
     }
     if (fieldTaint.size === 0) continue;
@@ -23339,12 +23420,22 @@ var SinkFilterPass = class {
     if (language === "python") {
       const { pyTaintedVars, pySanitizedVars } = langSources;
       const sourceLines = ctx.code.split("\n");
+      const oopFieldVars = /* @__PURE__ */ new Set();
+      for (const s of sources) {
+        if (s.variable && s.variable.startsWith("self.")) {
+          oopFieldVars.add(s.variable);
+        }
+      }
       filtered = filtered.filter((sink) => {
         if (sink.type !== "xpath_injection") return true;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
         const taintedVarOnLine = [...pyTaintedVars.keys()].find(
           (v) => new RegExp(`\\b${v}\\b`).test(sinkLineText)
         );
+        const oopVarOnLine = [...oopFieldVars].find(
+          (v) => sinkLineText.includes(v)
+        );
+        if (oopVarOnLine) return true;
         if (!taintedVarOnLine) return false;
         if (pySanitizedVars.has(taintedVarOnLine)) return false;
         if (new RegExp(`\\.xpath\\s*\\([^)]*\\b\\w+\\s*=\\s*\\b${taintedVarOnLine}\\b`).test(sinkLineText)) return false;

package/dist/core/circle-ir-core.cjs

@@ -11400,6 +11400,41 @@ var DEFAULT_SINKS = [
   // pattern with a language-scoped classless entry. The method name
   // `redirect` is rare outside HTTP frameworks so the FP risk is low.
   { method: "redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Node.js LDAP Injection (ldapjs) — CWE-90
+  // cognium-dev#104 Sprint 22: receiver matches the canonical ldapjs
+  // import name (`const ldap = require('ldapjs')` → ldap.search/...).
+  { method: "search", class: "ldap", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  { method: "searchSync", class: "ldap", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  { method: "search", class: "ldapjs", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  { method: "searchSync", class: "ldapjs", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  // Node.js XPath Injection (xpath module) — CWE-643
+  // cognium-dev#104 Sprint 22: `const xpath = require('xpath')` → xpath.select/select1/evaluate.
+  { method: "select", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "select1", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "evaluate", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parse", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Node.js XXE (libxmljs, xmldom) — CWE-611
+  // cognium-dev#104 Sprint 22: `const libxml = require('libxmljs')` (or 'libxml')
+  // → libxml.parseXml(src, {noent: true}). xmldom DOMParser via parseFromString.
+  { method: "parseXml", class: "libxml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseXmlString", class: "libxml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseXml", class: "libxmljs", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseXmlString", class: "libxmljs", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseFromString", class: "DOMParser", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseFromString", class: "xmldom", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Node.js Server-Side Template Injection (SSTI) — CWE-94
+  // cognium-dev#104 Sprint 22: ejs/handlebars/pug template render with
+  // tainted templates → arbitrary JS execution. Uses `code_injection`
+  // SinkType to mirror the Python Jinja2/Mako pattern above.
+  { method: "render", class: "ejs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "compile", class: "ejs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "compile", class: "handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "pug", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "compile", class: "pug", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "mustache", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "nunjucks", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "renderString", class: "nunjucks", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // =========================================================================
   // Python Sinks
   // =========================================================================
@@ -11509,6 +11544,16 @@ var DEFAULT_SINKS = [
   { method: "delete_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   { method: "delete_many", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
+  // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
+  // class isn't statically known. Method-only entries restricted to Python.
+  // cognium-dev#104 Sprint 22.
+  { method: "find_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "update_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
+  { method: "update_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
+  { method: "delete_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "delete_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "replace_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
+  { method: "count_documents", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   // Python Template Injection (Jinja2, Mako)
   { method: "from_string", class: "Template", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "jinja2", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
@@ -11519,6 +11564,15 @@ var DEFAULT_SINKS = [
   { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
   { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
   { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  // Python `logging` module top-level functions (e.g. logging.info(...))
+  // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
+  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1] },
+  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
@@ -16231,6 +16285,9 @@ function isFalsePositive(result, sinkLine, taintedVar) {
   if (varValue && varValue.type !== "unknown" && !result.tainted.has(taintedVar)) {
     return { isFalsePositive: true, reason: `variable_is_constant: ${varValue.value}` };
   }
+  if (taintedVar.startsWith("self.") || taintedVar.startsWith("this.")) {
+    return { isFalsePositive: false, reason: null };
+  }
   if (result.symbols.has(taintedVar) && !result.tainted.has(taintedVar)) {
     return { isFalsePositive: true, reason: "variable_not_tainted" };
   }

package/dist/core/circle-ir-core.js

@@ -11334,6 +11334,41 @@ var DEFAULT_SINKS = [
   // pattern with a language-scoped classless entry. The method name
   // `redirect` is rare outside HTTP frameworks so the FP risk is low.
   { method: "redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Node.js LDAP Injection (ldapjs) — CWE-90
+  // cognium-dev#104 Sprint 22: receiver matches the canonical ldapjs
+  // import name (`const ldap = require('ldapjs')` → ldap.search/...).
+  { method: "search", class: "ldap", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  { method: "searchSync", class: "ldap", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  { method: "search", class: "ldapjs", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  { method: "searchSync", class: "ldapjs", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
+  // Node.js XPath Injection (xpath module) — CWE-643
+  // cognium-dev#104 Sprint 22: `const xpath = require('xpath')` → xpath.select/select1/evaluate.
+  { method: "select", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "select1", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "evaluate", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parse", class: "xpath", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Node.js XXE (libxmljs, xmldom) — CWE-611
+  // cognium-dev#104 Sprint 22: `const libxml = require('libxmljs')` (or 'libxml')
+  // → libxml.parseXml(src, {noent: true}). xmldom DOMParser via parseFromString.
+  { method: "parseXml", class: "libxml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseXmlString", class: "libxml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseXml", class: "libxmljs", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseXmlString", class: "libxmljs", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseFromString", class: "DOMParser", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parseFromString", class: "xmldom", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Node.js Server-Side Template Injection (SSTI) — CWE-94
+  // cognium-dev#104 Sprint 22: ejs/handlebars/pug template render with
+  // tainted templates → arbitrary JS execution. Uses `code_injection`
+  // SinkType to mirror the Python Jinja2/Mako pattern above.
+  { method: "render", class: "ejs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "compile", class: "ejs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "compile", class: "handlebars", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "pug", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "compile", class: "pug", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "mustache", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "render", class: "nunjucks", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "renderString", class: "nunjucks", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // =========================================================================
   // Python Sinks
   // =========================================================================
@@ -11443,6 +11478,16 @@ var DEFAULT_SINKS = [
   { method: "delete_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   { method: "delete_many", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
+  // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
+  // class isn't statically known. Method-only entries restricted to Python.
+  // cognium-dev#104 Sprint 22.
+  { method: "find_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "update_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
+  { method: "update_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
+  { method: "delete_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "delete_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "replace_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
+  { method: "count_documents", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   // Python Template Injection (Jinja2, Mako)
   { method: "from_string", class: "Template", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "jinja2", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
@@ -11453,6 +11498,15 @@ var DEFAULT_SINKS = [
   { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
   { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
   { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  // Python `logging` module top-level functions (e.g. logging.info(...))
+  // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
+  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1] },
+  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
@@ -16165,6 +16219,9 @@ function isFalsePositive(result, sinkLine, taintedVar) {
   if (varValue && varValue.type !== "unknown" && !result.tainted.has(taintedVar)) {
     return { isFalsePositive: true, reason: `variable_is_constant: ${varValue.value}` };
   }
+  if (taintedVar.startsWith("self.") || taintedVar.startsWith("this.")) {
+    return { isFalsePositive: false, reason: null };
+  }
   if (result.symbols.has(taintedVar) && !result.tainted.has(taintedVar)) {
     return { isFalsePositive: true, reason: "variable_not_tainted" };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.71.0",
+  "version": "3.72.1",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",