circle-ir 3.79.0 → 3.81.0

package/dist/core/circle-ir-core.cjs

@@ -10759,7 +10759,12 @@ var DEFAULT_SINKS = [
   // Class-less XSS patterns for cases where receiver type is inferred
   { method: "println", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "print", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "write", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
+  // NOTE: the unscoped { method: 'write', type: 'xss' } entry was removed in
+  // Sprint 28 (#110). It mistyped every non-XSS .write() across all languages
+  // (fs.writeFile, open().write, bcrypt callbacks, credential file writes,
+  // node ClientRequest.write, etc.) as xss. Real HTML writers are covered
+  // by class-scoped entries: PrintWriter.write (line 843), ServletOutputStream.write
+  // (line 849), JspWriter.write (xss.yaml), Response.write (nodejs.json).
   { method: "append", class: "StringBuilder", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "append", class: "StringBuffer", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   // Wiki/CMS XSS sinks (JSPWiki, Confluence, etc.)
@@ -11118,10 +11123,17 @@ var DEFAULT_SINKS = [
   // These patterns are detected by call-site literal inspection, not taint flow,
   // so they are NOT registered here as sinks (they could never match a "tainted
   // value flowing into a sink" because the bad value is a hard-coded constant).
-  // Trust Boundary (CWE-501) - using untrusted data as session attribute NAME
-  // The vulnerability is attacker controlling which key to use, not the value
-  { method: "setAttribute", class: "HttpSession", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0] },
-  { method: "putValue", class: "HttpSession", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0] },
+  // Trust Boundary (CWE-501) — tainted VALUE crossing into shared session
+  // state. OWASP/CWE-501 treats `session.setAttribute("k", taintedValue)` as
+  // the violation: untrusted data enters server-side state where downstream
+  // code reads it as if trusted. Both arg positions are flagged so either a
+  // tainted key (rare) or tainted value (the OWASP shape, 83 cases) trips
+  // the sink. (cognium-dev #117)
+  { method: "setAttribute", class: "HttpSession", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0, 1] },
+  { method: "putValue", class: "HttpSession", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0, 1] },
+  // ServletContext + request scopes — same trust-boundary semantics.
+  { method: "setAttribute", class: "ServletContext", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0, 1] },
+  { method: "setAttribute", class: "HttpServletRequest", type: "trust_boundary", cwe: "CWE-501", severity: "low", arg_positions: [0, 1] },
   // Additional XSS patterns (JDOM/XML output)
   { method: "outputElementContent", class: "XMLOutputter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "output", class: "XMLOutputter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },

package/dist/core/circle-ir-core.js

@@ -10693,7 +10693,12 @@ var DEFAULT_SINKS = [
   // Class-less XSS patterns for cases where receiver type is inferred
   { method: "println", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "print", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "write", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
+  // NOTE: the unscoped { method: 'write', type: 'xss' } entry was removed in
+  // Sprint 28 (#110). It mistyped every non-XSS .write() across all languages
+  // (fs.writeFile, open().write, bcrypt callbacks, credential file writes,
+  // node ClientRequest.write, etc.) as xss. Real HTML writers are covered
+  // by class-scoped entries: PrintWriter.write (line 843), ServletOutputStream.write
+  // (line 849), JspWriter.write (xss.yaml), Response.write (nodejs.json).
   { method: "append", class: "StringBuilder", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "append", class: "StringBuffer", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   // Wiki/CMS XSS sinks (JSPWiki, Confluence, etc.)
@@ -11052,10 +11057,17 @@ var DEFAULT_SINKS = [
   // These patterns are detected by call-site literal inspection, not taint flow,
   // so they are NOT registered here as sinks (they could never match a "tainted
   // value flowing into a sink" because the bad value is a hard-coded constant).
-  // Trust Boundary (CWE-501) - using untrusted data as session attribute NAME
-  // The vulnerability is attacker controlling which key to use, not the value
-  { method: "setAttribute", class: "HttpSession", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0] },
-  { method: "putValue", class: "HttpSession", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0] },
+  // Trust Boundary (CWE-501) — tainted VALUE crossing into shared session
+  // state. OWASP/CWE-501 treats `session.setAttribute("k", taintedValue)` as
+  // the violation: untrusted data enters server-side state where downstream
+  // code reads it as if trusted. Both arg positions are flagged so either a
+  // tainted key (rare) or tainted value (the OWASP shape, 83 cases) trips
+  // the sink. (cognium-dev #117)
+  { method: "setAttribute", class: "HttpSession", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0, 1] },
+  { method: "putValue", class: "HttpSession", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0, 1] },
+  // ServletContext + request scopes — same trust-boundary semantics.
+  { method: "setAttribute", class: "ServletContext", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0, 1] },
+  { method: "setAttribute", class: "HttpServletRequest", type: "trust_boundary", cwe: "CWE-501", severity: "low", arg_positions: [0, 1] },
   // Additional XSS patterns (JDOM/XML output)
   { method: "outputElementContent", class: "XMLOutputter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "output", class: "XMLOutputter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.79.0",
+  "version": "3.81.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",