circle-ir 3.8.0 → 3.8.3

package/LICENSE

@@ -1,15 +1,21 @@
-ISC License
+MIT License
 
 Copyright (c) 2025 Cognium Labs
 
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-PERFORMANCE OF THIS SOFTWARE.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,22 +1,17 @@
 # circle-ir
 
-A high-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis. Works in Node.js, browsers, and Cloudflare Workers.
+A high-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis. Works in Node.js and browsers.
 
 ## Features
 
 - **Taint Analysis**: Track data flow from sources (user input) to sinks (dangerous operations)
-- **Multi-language Support**: Java, JavaScript/TypeScript, Python, Rust
+- **Multi-language Support**: Java, JavaScript/TypeScript, Python, Rust, Bash/Shell
 - **High Accuracy**: 100% on OWASP Benchmark, 100% on Juliet Test Suite, 97.7% TPR on SecuriBench Micro
-- **Universal**: Works in Node.js, browsers, and Cloudflare Workers
+- **Universal**: Works in Node.js and browsers with environment-agnostic core
 - **Zero External Dependencies**: Core analysis runs without network calls or external services
 - **Browser Compatible**: Tree-sitter WASM for universal parsing
 - **Configuration-Driven**: YAML/JSON patterns for sources, sinks, and sanitizers
 
-## Related Packages
-
-- **[circle-ir-ai](https://github.com/cogniumhq/circle-ir-ai)**: LLM-enhanced analysis with CLI
-- **[circle-pack](https://github.com/cogniumhq/circle-pack)**: Cloudflare Workers API deployment
-
 ## Installation
 
 ```bash
@@ -127,9 +122,10 @@ const response = await analyzeForAPI(code, 'File.java', 'java');
 | Language | Parser | Frameworks |
 |----------|--------|------------|
 | **Java** | tree-sitter-java | Spring, JAX-RS, Servlet API |
-| **JavaScript/TypeScript** | tree-sitter-javascript | Express, Fastify, Node.js |
+| **JavaScript/TypeScript** | tree-sitter-javascript | Express, Fastify, Koa, Node.js |
 | **Python** | tree-sitter-python | Flask, Django, FastAPI |
 | **Rust** | tree-sitter-rust | Actix-web, Rocket, Axum |
+| **Bash/Shell** | tree-sitter-bash | Shell scripts (.sh, .bash, .zsh, .ksh) |
 
 ### Multi-Language Examples
 
@@ -183,12 +179,15 @@ sources:
 
 ## Benchmark Results
 
+All scores below are for **circle-ir static analysis only** (no LLM).
+
 | Benchmark | Score | Details |
 |-----------|-------|---------|
 | **OWASP Benchmark** | +100% | TPR 100%, FPR 0% (1415 test cases) |
 | **Juliet Test Suite** | +100% | 156/156 test cases, 9 CWEs |
 | **SecuriBench Micro** | 97.7% TPR | 105/108 vulns detected, 6.7% FPR |
-| **CWE-Bench-Java** | 81.7% (with LLM) | 98/120 projects (vs CodeQL 22.5%, IRIS+GPT-4 45.8%) |
+| **CWE-Bench-Java** | 42.5% | 51/120 real-world CVEs (vs CodeQL 22.5%, IRIS+GPT-4 45.8%) |
+| **Bash Synthetic** | 68.2% TPR | 15 TP, 9 TN, 0 FP on 31 synthetic test cases |
 
 ## Documentation
 
@@ -200,4 +199,4 @@ sources:
 
 ## License
 
-ISC
+MIT

package/configs/sinks/nodejs.json

@@ -9,6 +9,14 @@
       "arg_positions": [0],
       "note": "Command execution - extremely dangerous with user input"
     },
+    {
+      "method": "exec",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Destructured child_process.exec import - no receiver"
+    },
     {
       "method": "execSync",
       "class": "child_process",
@@ -18,6 +26,14 @@
       "arg_positions": [0],
       "note": "Synchronous command execution"
     },
+    {
+      "method": "execSync",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0],
+      "note": "Destructured child_process.execSync import - no receiver"
+    },
     {
       "method": "spawn",
       "class": "child_process",
@@ -27,6 +43,14 @@
       "arg_positions": [0, 1],
       "note": "Process spawn - arg[0] is command, arg[1] is args array"
     },
+    {
+      "method": "spawn",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0, 1],
+      "note": "Destructured child_process.spawn import - no receiver"
+    },
     {
       "method": "spawnSync",
       "class": "child_process",
@@ -36,6 +60,14 @@
       "arg_positions": [0, 1],
       "note": "Synchronous process spawn"
     },
+    {
+      "method": "spawnSync",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0, 1],
+      "note": "Destructured child_process.spawnSync import - no receiver"
+    },
     {
       "method": "execFile",
       "class": "child_process",
@@ -45,6 +77,14 @@
       "arg_positions": [0, 1],
       "note": "Execute file with arguments"
     },
+    {
+      "method": "execFile",
+      "type": "command_injection",
+      "cwe": "CWE-78",
+      "severity": "critical",
+      "arg_positions": [0, 1],
+      "note": "Destructured child_process.execFile import - no receiver"
+    },
     {
       "method": "fork",
       "class": "child_process",
@@ -293,6 +333,15 @@
       "arg_positions": [0],
       "note": "Node.js HTTP request"
     },
+    {
+      "method": "get",
+      "class": "http",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Node.js HTTP GET request - validate URL to prevent SSRF"
+    },
     {
       "method": "request",
       "class": "https",
@@ -302,6 +351,15 @@
       "arg_positions": [0],
       "note": "Node.js HTTPS request"
     },
+    {
+      "method": "get",
+      "class": "https",
+      "type": "ssrf",
+      "cwe": "CWE-918",
+      "severity": "high",
+      "arg_positions": [0],
+      "note": "Node.js HTTPS GET request"
+    },
     {
       "method": "redirect",
       "class": "Response",

package/dist/analysis/config-loader.js

@@ -539,9 +539,7 @@ export const DEFAULT_SINKS = [
     { method: 'resolveURI', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'resolve', class: 'SourceResolver', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'getSource', class: 'SourceResolver', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
-    // URL-based resource loading
-    { method: 'URL', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [0] },
-    { method: 'openStream', class: 'URL', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
+    // NOTE: new URL(userInput) is SSRF (CWE-918), not path traversal — see ssrf section below
     // Servlet context resource loading
     { method: 'getResource', class: 'ServletContext', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'getResourceAsStream', class: 'ServletContext', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
@@ -578,8 +576,7 @@ export const DEFAULT_SINKS = [
     { method: 'extract', type: 'path_traversal', cwe: 'CWE-22', severity: 'critical', arg_positions: [0, 1] },
     { method: 'extractAll', type: 'path_traversal', cwe: 'CWE-22', severity: 'critical', arg_positions: [0, 1] },
     { method: 'unjar', type: 'path_traversal', cwe: 'CWE-22', severity: 'critical', arg_positions: [0, 1] },
-    // Additional file constructors
-    { method: 'BufferedReader', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
+    // Additional file constructors — BufferedReader(Reader) is NOT a path traversal sink; it wraps a Reader, not a file path
     { method: 'PrintWriter', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'Scanner', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     // Topic/queue names (for message queue systems - can be exploited for path traversal)
@@ -606,7 +603,6 @@ export const DEFAULT_SINKS = [
     { method: 'getPath', class: 'BaseFileSystem', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'getPathMatcher', class: 'BaseFileSystem', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'getFileStores', class: 'RootedFileSystem', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
-    { method: 'deleteRecursive', class: 'CommonTestSupportUtils', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     // SftpFileSystemProvider
     { method: 'move', class: 'SftpFileSystemProvider', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1] },
     { method: 'copy', class: 'SftpFileSystemProvider', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1] },
@@ -656,18 +652,6 @@ export const DEFAULT_SINKS = [
     { method: 'createPlainAccessConfig', class: 'MQClientAPIImpl', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     // XWiki velocity introspector
     { method: 'SecureIntrospector', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
-    // Generic test methods that process paths
-    { method: 'testLifeCycle', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
-    { method: 'testPathAccess', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
-    { method: 'single', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
-    { method: 'invalidPath', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
-    { method: 'invalidPathWithPreviousDirectoryAllEncoded', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
-    // Embedded server test methods
-    { method: 'create', class: 'EmbeddedJettyFactoryTest', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
-    { method: 'create_withThreadPool', class: 'EmbeddedJettyFactoryTest', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
-    { method: 'create_withNullThreadPool', class: 'EmbeddedJettyFactoryTest', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
-    // Camel file tests
-    { method: 'testProducerComplexByExpression', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [] },
     // XSS (CWE-79)
     { method: 'write', class: 'PrintWriter', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
     { method: 'println', class: 'PrintWriter', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
@@ -1102,9 +1086,12 @@ export const DEFAULT_SINKS = [
     { method: 'execSync', class: 'child_process', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
     { method: 'spawn', class: 'child_process', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
     { method: 'spawnSync', class: 'child_process', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
-    // Also match without receiver (destructured imports)
+    // Also match without receiver (destructured imports: const { exec } = require('child_process'))
     { method: 'exec', type: 'command_injection', cwe: 'CWE-78', severity: 'high', arg_positions: [0] },
     { method: 'execSync', type: 'command_injection', cwe: 'CWE-78', severity: 'high', arg_positions: [0] },
+    { method: 'spawn', type: 'command_injection', cwe: 'CWE-78', severity: 'high', arg_positions: [0] },
+    { method: 'spawnSync', type: 'command_injection', cwe: 'CWE-78', severity: 'high', arg_positions: [0] },
+    { method: 'execFile', type: 'command_injection', cwe: 'CWE-78', severity: 'high', arg_positions: [0] },
     // Node.js File System (path traversal)
     { method: 'readFile', class: 'fs', type: 'path_traversal', cwe: 'CWE-22', severity: 'critical', arg_positions: [0] },
     { method: 'readFileSync', class: 'fs', type: 'path_traversal', cwe: 'CWE-22', severity: 'critical', arg_positions: [0] },
@@ -1147,7 +1134,9 @@ export const DEFAULT_SINKS = [
     { method: 'request', class: 'axios', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'fetch', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'request', class: 'http', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
+    { method: 'get', class: 'http', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'request', class: 'https', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
+    { method: 'get', class: 'https', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     // needle library (used in NodeGoat)
     { method: 'get', class: 'needle', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'post', class: 'needle', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },