circle-ir 3.96.0 → 3.98.0

package/dist/core/circle-ir-core.js

@@ -12522,6 +12522,118 @@ function isFunctionCallbackArgument(arg) {
   if (/^function\b/.test(body2)) return true;
   return false;
 }
+function findGoLocalDeclaredType(varName, callLine, sourceLines) {
+  if (!varName) return null;
+  const WINDOW = 50;
+  const startIdx = Math.max(0, callLine - 2);
+  const endIdx = Math.max(0, startIdx - WINDOW);
+  const name2 = varName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const VAR_DECL_RE = new RegExp(`^\\s*var\\s+${name2}\\s+([^=\\n][^\\n]*)$`);
+  const VAR_INIT_RE = new RegExp(`^\\s*var\\s+${name2}(?:\\s+[^=\\n]*?)?\\s*=\\s*(.+)$`);
+  const SHORT_INIT_RE = new RegExp(`^\\s*${name2}\\s*:=\\s*(.+)$`);
+  for (let i2 = startIdx; i2 >= endIdx; i2--) {
+    const raw = sourceLines[i2];
+    if (raw === void 0) continue;
+    const line = raw.replace(/\/\/.*$/, "").trimEnd();
+    let m = VAR_DECL_RE.exec(line);
+    if (m) {
+      return { kind: "typed-decl", text: m[1].trim() };
+    }
+    m = VAR_INIT_RE.exec(line);
+    if (m) {
+      return classifyGoRhs(m[1].trim());
+    }
+    m = SHORT_INIT_RE.exec(line);
+    if (m) {
+      return classifyGoRhs(m[1].trim());
+    }
+  }
+  return null;
+}
+function classifyGoRhs(rhs) {
+  const body2 = rhs.startsWith("&") ? rhs.slice(1).trimStart() : rhs;
+  if (/^make\s*\(/.test(body2)) {
+    return { kind: "untyped" };
+  }
+  const parenIdx = body2.indexOf("(");
+  const braceIdx = body2.indexOf("{");
+  if (parenIdx >= 0 && (braceIdx < 0 || parenIdx < braceIdx)) {
+    return { kind: "untyped" };
+  }
+  if (braceIdx > 0) {
+    const tag = body2.slice(0, braceIdx).trim();
+    if (tag.length > 0) {
+      if (/\binterface\s*\{\s*\}/.test(tag)) return { kind: "untyped" };
+      if (/\bany\b/.test(tag)) return { kind: "untyped" };
+      return { kind: "typed-init", text: tag };
+    }
+  }
+  return { kind: "untyped" };
+}
+function classifyGoDestinationType(decl) {
+  if (decl === null) return "unknown";
+  if (decl.kind === "untyped") return "unknown";
+  const text = decl.text;
+  if (/\binterface\s*\{\s*\}/.test(text)) return "unsafe";
+  if (/\bany\b/.test(text)) return "unsafe";
+  return "safe";
+}
+function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
+  if (language !== "go") return false;
+  if (pattern.type !== "deserialization") return false;
+  if (!sourceLines) return false;
+  const method = call.method_name;
+  let destPos;
+  if (method === "Unmarshal" && pattern.class === "json") {
+    destPos = 1;
+  } else if (method === "Decode" && pattern.class === "Decoder") {
+    destPos = 0;
+  } else {
+    return false;
+  }
+  const destArg = call.arguments.find((a) => a.position === destPos);
+  if (!destArg) return false;
+  const expr = (destArg.expression ?? "").trim();
+  if (expr.length === 0) return false;
+  if (expr.startsWith("&")) {
+    const inner = expr.slice(1).trimStart();
+    const compIdx = inner.indexOf("{");
+    if (compIdx > 0) {
+      const decl2 = { kind: "typed-init", text: inner.slice(0, compIdx).trim() };
+      return classifyGoDestinationType(decl2) === "safe";
+    }
+    const m = /^&([A-Za-z_]\w*)$/.exec(expr);
+    if (!m) return false;
+    const varName = m[1];
+    const decl = findGoLocalDeclaredType(varName, call.location.line, sourceLines);
+    return classifyGoDestinationType(decl) === "safe";
+  }
+  const idMatch = /^([A-Za-z_]\w*)$/.exec(expr);
+  if (idMatch) {
+    const decl = findGoLocalDeclaredType(idMatch[1], call.location.line, sourceLines);
+    return classifyGoDestinationType(decl) === "safe";
+  }
+  return false;
+}
+var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
+function isSafeJinjaRenderCall(call, pattern, language) {
+  if (language !== "python") return false;
+  if (pattern.type !== "xss" && pattern.type !== "code_injection") return false;
+  const method = call.method_name;
+  if (method === "render_template_string") {
+    const arg0 = call.arguments.find((a) => a.position === 0);
+    return typeof arg0?.literal === "string";
+  }
+  if (method === "Template" || method === "from_string") {
+    const arg0 = call.arguments.find((a) => a.position === 0);
+    return typeof arg0?.literal === "string";
+  }
+  if (method === "render") {
+    const receiver = (call.receiver ?? "").trim();
+    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+  }
+  return false;
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
   const sinkMap = /* @__PURE__ */ new Map();
   for (const call of calls) {
@@ -12560,6 +12672,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             continue;
           }
         }
+        if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
+          continue;
+        }
+        if (isSafeJinjaRenderCall(call, pattern, language)) {
+          continue;
+        }
         const location = formatCallLocation(call);
         const key = `${location}:${call.location.line}:${pattern.cwe}`;
         const confidence = calculateSinkConfidence(call, pattern);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.96.0",
+  "version": "3.98.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",