circle-ir 3.73.0 → 3.74.0

package/dist/core/circle-ir-core.js

@@ -11818,11 +11818,21 @@ var DEFAULT_SANITIZERS = [
   // (defense-in-depth — mirrors Java getCanonicalPath in this table; the
   // stricter Clean+HasPrefix guard recognition is tracked separately).
   // EvalSymlinks is the Go equivalent of Java's Path.toRealPath.
-  { method: "Base", class: "filepath", removes: ["path_traversal"] },
-  { method: "Base", class: "path", removes: ["path_traversal"] },
-  { method: "Clean", class: "filepath", removes: ["path_traversal"] },
-  { method: "Clean", class: "path", removes: ["path_traversal"] },
-  { method: "EvalSymlinks", class: "filepath", removes: ["path_traversal"] },
+  // Sprint 24 (#102 FP-27): broadened to cover external_taint_escape (CWE-668)
+  // fallback so canonicalised paths don't trigger the synthetic sink.
+  { method: "Base", class: "filepath", removes: ["path_traversal", "external_taint_escape"] },
+  { method: "Base", class: "path", removes: ["path_traversal", "external_taint_escape"] },
+  { method: "Clean", class: "filepath", removes: ["path_traversal", "external_taint_escape"] },
+  { method: "Clean", class: "path", removes: ["path_traversal", "external_taint_escape"] },
+  { method: "EvalSymlinks", class: "filepath", removes: ["path_traversal", "external_taint_escape"] },
+  // Go html/template escape helpers (#102 FP-27) — registered explicitly because
+  // configs/sinks/golang.json is not loaded at runtime.
+  { method: "EscapeString", class: "html", removes: ["xss", "external_taint_escape", "log_injection", "open_redirect"] },
+  { method: "HTMLEscapeString", class: "template", removes: ["xss", "external_taint_escape", "log_injection", "open_redirect"] },
+  { method: "JSEscapeString", class: "template", removes: ["xss", "external_taint_escape", "log_injection"] },
+  { method: "URLQueryEscaper", class: "template", removes: ["xss", "external_taint_escape", "open_redirect"] },
+  { method: "QueryEscape", class: "url", removes: ["xss", "external_taint_escape", "open_redirect"] },
+  { method: "PathEscape", class: "url", removes: ["xss", "external_taint_escape", "open_redirect"] },
   // Log Injection sanitizers
   { method: "replace", removes: ["log_injection"] },
   // Used to remove newlines/control chars
@@ -12342,6 +12352,42 @@ function isSafePythonSubprocessCall(call, pattern, language) {
   }
   return true;
 }
+function isSafeGoExecCommandCall(call, pattern, language) {
+  if (language !== "go") return false;
+  if (pattern.type !== "command_injection") return false;
+  if (pattern.class !== "exec") return false;
+  if (pattern.method !== "Command" && pattern.method !== "CommandContext") return false;
+  const programArgPos = pattern.method === "CommandContext" ? 1 : 0;
+  const programArg = call.arguments.find((a) => a.position === programArgPos);
+  if (!programArg) return false;
+  let program;
+  if (programArg.literal !== null && programArg.literal !== void 0) {
+    program = String(programArg.literal).split("/").pop() ?? String(programArg.literal);
+  } else {
+    const expr = (programArg.expression ?? "").trim();
+    if (!(expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'"))) {
+      return false;
+    }
+    const stripped = expr.slice(1, -1);
+    program = stripped.split("/").pop() ?? stripped;
+  }
+  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ash",
+    "ksh",
+    "cmd",
+    "cmd.exe",
+    "powershell",
+    "pwsh",
+    "powershell.exe",
+    "pwsh.exe"
+  ]);
+  if (SHELL_PROGRAMS.has(program)) return false;
+  return true;
+}
 var CLASS_LITERAL_RE = /^(?:[A-Za-z_][\w]*\.)*[A-Z][\w]*(?:\[\])*\.class$/;
 function argIsClassLiteral(call, position) {
   const arg = call.arguments.find((a) => a.position === position);
@@ -12361,6 +12407,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafePythonSubprocessCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeGoExecCommandCall(call, pattern, language)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.73.0",
+  "version": "3.74.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",