circle-ir 3.97.0 → 3.99.0

package/dist/core/circle-ir-core.js

@@ -12615,6 +12615,25 @@ function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
+var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
+function isSafeJinjaRenderCall(call, pattern, language) {
+  if (language !== "python") return false;
+  if (pattern.type !== "xss" && pattern.type !== "code_injection") return false;
+  const method = call.method_name;
+  if (method === "render_template_string") {
+    const arg0 = call.arguments.find((a) => a.position === 0);
+    return typeof arg0?.literal === "string";
+  }
+  if (method === "Template" || method === "from_string") {
+    const arg0 = call.arguments.find((a) => a.position === 0);
+    return typeof arg0?.literal === "string";
+  }
+  if (method === "render") {
+    const receiver = (call.receiver ?? "").trim();
+    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+  }
+  return false;
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
   const sinkMap = /* @__PURE__ */ new Map();
   for (const call of calls) {
@@ -12656,6 +12675,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isSafeJinjaRenderCall(call, pattern, language)) {
+          continue;
+        }
         const location = formatCallLocation(call);
         const key = `${location}:${call.location.line}:${pattern.cwe}`;
         const confidence = calculateSinkConfidence(call, pattern);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.97.0",
+  "version": "3.99.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",