circle-ir 4.0.0 → 4.3.0

package/dist/browser/circle-ir.js

@@ -16657,33 +16657,39 @@ function canSourceReachSink(sourceType, sinkType) {
     // disagreed. log_injection (CWE-117) and format_string (CWE-134) are
     // reachable from any user-controlled value that is logged / used as a
     // format string; nosql_injection (CWE-943) mirrors sql_injection's sources.
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection"],
-    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
-    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
-    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
+    // prompt_injection (CWE-1427 / OWASP LLM01) added cognium-ai#281: an
+    // attacker-controlled value reaching an LLM prompt sink (CreateChatCompletion
+    // et al.) is prompt injection. The reach map omitted it entirely, so the
+    // scan path (`generateFindings`) dropped every `http_*/io/network/interproc →
+    // prompt_injection` flow even though `taint.flows` / the trust pass reported
+    // it — the same "two paths disagree" shape as #129. Now emitted from scan too.
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     // xss added cognium-dev 3.163.0: URL path components (getRequestURI,
     // getRequestURL, getPathInfo, getServletPath) reflected back into HTML
     // output are a classic reflected-XSS vector — cf. Basic35 in
     // SecuriBench Micro where `writer.println(req.getRequestURL())` is
     // annotated `/* BAD */`. Prior to 3.163.0 the reach map omitted xss
     // so http_path → xss inline-colocation flows were silently dropped.
-    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection"],
+    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string", "prompt_injection"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     // ssrf added Sprint 57 #200: bash CGI/webhook handlers and scripts that
     // take a URL on stdin or as a positional CLI arg (`curl "$1"`,
     // `wget "$(read line)"`) and curl/wget it server-side are textbook SSRF
     // (CVE-2022-41040 ProxyShell-class). Cross-language: `socket.urlopen(input())`
     // (Python), `axios.get(readline())` (JS) etc. also benefit.
-    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf", "log_injection", "format_string"],
+    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf", "log_injection", "format_string", "prompt_injection"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection", "log_injection"],
     // Second-order injection
     file_input: ["deserialization", "xxe", "path_traversal", "command_injection", "code_injection"],
-    network_input: ["sql_injection", "command_injection", "xss", "ssrf", "log_injection", "format_string", "nosql_injection"],
+    network_input: ["sql_injection", "command_injection", "xss", "ssrf", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     config_param: ["sql_injection", "command_injection", "path_traversal", "xss", "ssrf", "log_injection", "format_string"],
     // Servlet init params
-    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
-    // Cross-method taint; Sprint 82 (#189) — open_redirect added; Sprint 91 (#117) — trust_boundary added; cognium-ai#129 — log_injection/format_string/nosql_injection added
+    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    // Cross-method taint; Sprint 82 (#189) — open_redirect added; Sprint 91 (#117) — trust_boundary added; cognium-ai#129 — log_injection/format_string/nosql_injection added; cognium-ai#281 — prompt_injection added
     plugin_param: ["sql_injection", "command_injection", "path_traversal", "xss", "code_injection", "log_injection", "format_string"]
     // Plugin/config parameters
   };
@@ -21635,6 +21641,10 @@ function applyLibraryApiSurfaceDowngrade(findings) {
 }
 
 // src/analysis/note-coalescer.ts
+var CLICKJACKING_PAIR = /* @__PURE__ */ new Set(["missing-x-frame-options", "missing-csp-frame-ancestors"]);
+function levelRank(level) {
+  return level === "error" ? 0 : level === "warning" ? 1 : 2;
+}
 function coalesceNoteLevelFindings(findings) {
   if (findings.length < 2) return [...findings];
   const groups = /* @__PURE__ */ new Map();
@@ -21651,11 +21661,30 @@ function coalesceNoteLevelFindings(findings) {
   }
   const out2 = [];
   for (const key of order) {
-    const bucket = groups.get(key);
+    let bucket = groups.get(key);
     if (bucket.length === 1) {
       out2.push(bucket[0]);
       continue;
     }
+    const cj = bucket.filter((f) => CLICKJACKING_PAIR.has(f.rule_id));
+    if (new Set(cj.map((f) => f.rule_id)).size === CLICKJACKING_PAIR.size) {
+      const primary2 = [...cj].sort(
+        (a, b) => levelRank(a.level) - levelRank(b.level) || a.rule_id.localeCompare(b.rule_id)
+      )[0];
+      const labels = Array.from(
+        /* @__PURE__ */ new Set([
+          ...primary2.labels ?? [],
+          ...cj.flatMap((f) => [f.rule_id, ...f.labels ?? []])
+        ])
+      ).filter((l) => l !== primary2.rule_id);
+      out2.push({ ...primary2, labels });
+      bucket = bucket.filter((f) => !CLICKJACKING_PAIR.has(f.rule_id));
+      if (bucket.length === 0) continue;
+      if (bucket.length === 1) {
+        out2.push(bucket[0]);
+        continue;
+      }
+    }
     const allNote = bucket.every((f) => f.level === "note");
     if (!allNote) {
       for (const f of bucket) out2.push(f);
@@ -26977,13 +27006,15 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
   if (!["javascript", "typescript"].includes(language)) return [];
   const sources = [];
   const lines = sourceCode.split("\n");
+  const isRouteHandler2 = /export\s+(?:async\s+)?(?:function\s+(?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|loader|action)\b|const\s+(?:GET|POST|PUT|PATCH|DELETE|loader|action)\b)/.test(sourceCode) && /\{[^}]*\bparams\b[^}]*\}/.test(sourceCode);
+  const patterns = isRouteHandler2 ? [...JS_TAINTED_PATTERNS, { pattern: /\bparams\s*[.[]/, type: "http_path" }] : JS_TAINTED_PATTERNS;
   for (let lineNum = 0; lineNum < lines.length; lineNum++) {
     const line = lines[lineNum];
     const lineNumber = lineNum + 1;
     const assignmentMatch = line.match(/(?:(?:var|let|const)\s+)?(\w+)\s*=\s*(.+)/);
     if (!assignmentMatch) continue;
     const [, varName, rhs] = assignmentMatch;
-    for (const { pattern, type } of JS_TAINTED_PATTERNS) {
+    for (const { pattern, type } of patterns) {
       if (pattern.test(rhs)) {
         const alreadyExists = sources.some((s) => s.line === lineNumber && s.type === type);
         if (!alreadyExists) {

package/docs/SPEC.md

@@ -90,7 +90,7 @@ File metadata and version information.
 interface Meta {
   circle_ir: "3.0";
   file: string;
-  language: "java" | "javascript" | "typescript" | "python" | "go" | "rust" | "bash" | "html";
+  language: "java" | "javascript" | "typescript" | "python" | "go" | "rust" | "bash" | "html" | "csharp";  // "csharp" experimental (4.0.0+)
   loc: number;
   hash: string;           // SHA256 prefix (16 chars)
   package?: string;       // PENDING: Add to implementation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "4.0.0",
+  "version": "4.3.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",