circle-ir 4.11.0 → 4.13.0

package/dist/core/circle-ir-core.cjs

@@ -9667,6 +9667,7 @@ function buildCSharpDFG(tree, cache) {
           currentScope(scopeStack).set(name2, def.id);
         }
       }
+      const plainTargets = [];
       for (const asn of findNodes(body2, "assignment_expression")) {
         const left = asn.childForFieldName("left");
         if (left?.type === "identifier") {
@@ -9674,9 +9675,16 @@ function buildCSharpDFG(tree, cache) {
           const def = { id: defIdCounter++, variable: name2, line: asn.startPosition.row + 1, kind: "local" };
           defs.push(def);
           currentScope(scopeStack).set(name2, def.id);
+          if (asn.children.some((c) => c?.type === "=")) {
+            plainTargets.push({ name: name2, line: left.startPosition.row + 1 });
+          }
         }
       }
       const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      for (const target of plainTargets) {
+        const idx = bodyUses.uses.findIndex((u) => u.variable === target.name && u.line === target.line);
+        if (idx !== -1) bodyUses.uses.splice(idx, 1);
+      }
       resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
       uses.push(...bodyUses.uses);
       useIdCounter = bodyUses.nextId;
@@ -10016,6 +10024,30 @@ function processStatement2(stmt, startDefId, startUseId, scopeStack, isJavaScrip
       }
       break;
     }
+    case "switch_expression":
+    case "switch_statement": {
+      const value = stmt.childForFieldName("condition") ?? stmt.childForFieldName("value");
+      if (value) {
+        const valueUses = extractUses(value, useId, scopeStack, isJavaScript);
+        uses.push(...valueUses.uses);
+        useId = valueUses.nextId;
+      }
+      const body2 = stmt.childForFieldName("body");
+      if (body2) {
+        scopeStack.push(/* @__PURE__ */ new Map());
+        for (let i2 = 0; i2 < body2.childCount; i2++) {
+          const group = body2.child(i2);
+          if (!group) continue;
+          const result = processBlock(group, defId, useId, scopeStack, isJavaScript);
+          defs.push(...result.defs);
+          uses.push(...result.uses);
+          defId = result.nextDefId;
+          useId = result.nextUseId;
+        }
+        scopeStack.pop();
+      }
+      break;
+    }
     case "block":
     case "statement_block": {
       scopeStack.push(/* @__PURE__ */ new Map());
@@ -11416,6 +11448,7 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "ConcurrentHashMap", type: "plugin_param", severity: "high", return_tainted: true },
   { method: "get", class: "Hashtable", type: "plugin_param", severity: "high", return_tainted: true },
   { method: "get", class: "Properties", type: "config_param", severity: "high", return_tainted: true },
+  { method: "getProperty", class: "Properties", type: "config_param", severity: "high", return_tainted: true },
   // Message/Event sources
   { method: "getText", class: "Message", type: "io_input", severity: "high", return_tainted: true },
   { method: "getPayload", type: "io_input", severity: "high", return_tainted: true },
@@ -12393,8 +12426,13 @@ var DEFAULT_SINKS = [
   { method: "write", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "println", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "print", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  { method: "format", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
-  { method: "printf", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
+  // format/printf take `(String fmt, Object... args)` or `(Locale l, String
+  // fmt, Object... args)`. Every argument after the format can reach the page,
+  // and the Locale overload shifts them all one place right, so `[0, 1]` missed
+  // `printf(Locale.US, "%s", tainted)` and any second vararg. Enumerated, not
+  // `[]` — see the ProcessBuilder note above.
+  { method: "format", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+  { method: "printf", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
   // ServletOutputStream
   { method: "write", class: "ServletOutputStream", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "print", class: "ServletOutputStream", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -19309,7 +19347,16 @@ var ConstantPropagator = class _ConstantPropagator {
         break;
       }
     }
-    const switchBlock = node.children.find((c) => c.type === "switch_block");
+    if (!switchValue) {
+      const valueNode = node.childForFieldName("value");
+      if (valueNode) {
+        const literal = this.literalValue(valueNode);
+        switchValue = literal !== null ? { type: typeof literal === "number" ? "int" : "string", value: literal, sourceLine: getNodeLine(valueNode) } : this.evaluateExpression(valueNode);
+      }
+    }
+    const switchBlock = node.children.find(
+      (c) => c.type === "switch_block" || c.type === "switch_body"
+    );
     if (!switchBlock) {
       for (const child of node.children) {
         this.visit(child);
@@ -19317,7 +19364,7 @@ var ConstantPropagator = class _ConstantPropagator {
       return;
     }
     const caseGroups = switchBlock.children.filter(
-      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule"
+      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section"
     );
     if (switchValue && isKnown(switchValue)) {
       let matchingIdx = -1;
@@ -19335,6 +19382,16 @@ var ConstantPropagator = class _ConstantPropagator {
                 matchingIdx = i2;
               }
             }
+          } else if (caseGroup.type === "switch_section") {
+            if (child.type === "default") {
+              defaultIdx = i2;
+            } else if (child.type === "constant_pattern") {
+              const inner = child.children.find((c) => c.isNamed);
+              const caseValue = inner ? this.literalValue(inner) : null;
+              if (caseValue !== null && caseValue === switchValue.value) {
+                matchingIdx = i2;
+              }
+            }
           }
         }
       }
@@ -19355,9 +19412,17 @@ var ConstantPropagator = class _ConstantPropagator {
         }
       }
     } else {
+      const taintedBefore = new Set(this.tainted);
+      const taintedAfter = new Set(taintedBefore);
+      const wasInConditional = this.inConditionalBranch;
+      this.inConditionalBranch = true;
       for (const caseGroup of caseGroups) {
+        this.tainted = new Set(taintedBefore);
         this.visit(caseGroup);
+        for (const v of this.tainted) taintedAfter.add(v);
       }
+      this.inConditionalBranch = wasInConditional;
+      this.tainted = taintedAfter;
     }
   }
   handleTernary(node) {
@@ -19408,6 +19473,18 @@ var ConstantPropagator = class _ConstantPropagator {
     }
     return false;
   }
+  /** The value of an integer, character or string literal node; null for anything else. */
+  literalValue(node) {
+    const text = getNodeText2(node, this.source);
+    if (node.type === "integer_literal" || node.type === "decimal_integer_literal") {
+      const n = Number(text.replace(/_/g, "").replace(/[uUlL]+$/, ""));
+      return Number.isInteger(n) ? n : null;
+    }
+    if (node.type === "character_literal" || node.type === "string_literal") {
+      return text.slice(1, -1);
+    }
+    return null;
+  }
   extractCaseValue(labelNode) {
     for (const child of labelNode.children) {
       if (child.type === "decimal_integer_literal") {

package/dist/core/circle-ir-core.js

@@ -9601,6 +9601,7 @@ function buildCSharpDFG(tree, cache) {
           currentScope(scopeStack).set(name2, def.id);
         }
       }
+      const plainTargets = [];
       for (const asn of findNodes(body2, "assignment_expression")) {
         const left = asn.childForFieldName("left");
         if (left?.type === "identifier") {
@@ -9608,9 +9609,16 @@ function buildCSharpDFG(tree, cache) {
           const def = { id: defIdCounter++, variable: name2, line: asn.startPosition.row + 1, kind: "local" };
           defs.push(def);
           currentScope(scopeStack).set(name2, def.id);
+          if (asn.children.some((c) => c?.type === "=")) {
+            plainTargets.push({ name: name2, line: left.startPosition.row + 1 });
+          }
         }
       }
       const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      for (const target of plainTargets) {
+        const idx = bodyUses.uses.findIndex((u) => u.variable === target.name && u.line === target.line);
+        if (idx !== -1) bodyUses.uses.splice(idx, 1);
+      }
       resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
       uses.push(...bodyUses.uses);
       useIdCounter = bodyUses.nextId;
@@ -9950,6 +9958,30 @@ function processStatement2(stmt, startDefId, startUseId, scopeStack, isJavaScrip
       }
       break;
     }
+    case "switch_expression":
+    case "switch_statement": {
+      const value = stmt.childForFieldName("condition") ?? stmt.childForFieldName("value");
+      if (value) {
+        const valueUses = extractUses(value, useId, scopeStack, isJavaScript);
+        uses.push(...valueUses.uses);
+        useId = valueUses.nextId;
+      }
+      const body2 = stmt.childForFieldName("body");
+      if (body2) {
+        scopeStack.push(/* @__PURE__ */ new Map());
+        for (let i2 = 0; i2 < body2.childCount; i2++) {
+          const group = body2.child(i2);
+          if (!group) continue;
+          const result = processBlock(group, defId, useId, scopeStack, isJavaScript);
+          defs.push(...result.defs);
+          uses.push(...result.uses);
+          defId = result.nextDefId;
+          useId = result.nextUseId;
+        }
+        scopeStack.pop();
+      }
+      break;
+    }
     case "block":
     case "statement_block": {
       scopeStack.push(/* @__PURE__ */ new Map());
@@ -11350,6 +11382,7 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "ConcurrentHashMap", type: "plugin_param", severity: "high", return_tainted: true },
   { method: "get", class: "Hashtable", type: "plugin_param", severity: "high", return_tainted: true },
   { method: "get", class: "Properties", type: "config_param", severity: "high", return_tainted: true },
+  { method: "getProperty", class: "Properties", type: "config_param", severity: "high", return_tainted: true },
   // Message/Event sources
   { method: "getText", class: "Message", type: "io_input", severity: "high", return_tainted: true },
   { method: "getPayload", type: "io_input", severity: "high", return_tainted: true },
@@ -12327,8 +12360,13 @@ var DEFAULT_SINKS = [
   { method: "write", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "println", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "print", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  { method: "format", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
-  { method: "printf", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
+  // format/printf take `(String fmt, Object... args)` or `(Locale l, String
+  // fmt, Object... args)`. Every argument after the format can reach the page,
+  // and the Locale overload shifts them all one place right, so `[0, 1]` missed
+  // `printf(Locale.US, "%s", tainted)` and any second vararg. Enumerated, not
+  // `[]` — see the ProcessBuilder note above.
+  { method: "format", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+  { method: "printf", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
   // ServletOutputStream
   { method: "write", class: "ServletOutputStream", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "print", class: "ServletOutputStream", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -19243,7 +19281,16 @@ var ConstantPropagator = class _ConstantPropagator {
         break;
       }
     }
-    const switchBlock = node.children.find((c) => c.type === "switch_block");
+    if (!switchValue) {
+      const valueNode = node.childForFieldName("value");
+      if (valueNode) {
+        const literal = this.literalValue(valueNode);
+        switchValue = literal !== null ? { type: typeof literal === "number" ? "int" : "string", value: literal, sourceLine: getNodeLine(valueNode) } : this.evaluateExpression(valueNode);
+      }
+    }
+    const switchBlock = node.children.find(
+      (c) => c.type === "switch_block" || c.type === "switch_body"
+    );
     if (!switchBlock) {
       for (const child of node.children) {
         this.visit(child);
@@ -19251,7 +19298,7 @@ var ConstantPropagator = class _ConstantPropagator {
       return;
     }
     const caseGroups = switchBlock.children.filter(
-      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule"
+      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section"
     );
     if (switchValue && isKnown(switchValue)) {
       let matchingIdx = -1;
@@ -19269,6 +19316,16 @@ var ConstantPropagator = class _ConstantPropagator {
                 matchingIdx = i2;
               }
             }
+          } else if (caseGroup.type === "switch_section") {
+            if (child.type === "default") {
+              defaultIdx = i2;
+            } else if (child.type === "constant_pattern") {
+              const inner = child.children.find((c) => c.isNamed);
+              const caseValue = inner ? this.literalValue(inner) : null;
+              if (caseValue !== null && caseValue === switchValue.value) {
+                matchingIdx = i2;
+              }
+            }
           }
         }
       }
@@ -19289,9 +19346,17 @@ var ConstantPropagator = class _ConstantPropagator {
         }
       }
     } else {
+      const taintedBefore = new Set(this.tainted);
+      const taintedAfter = new Set(taintedBefore);
+      const wasInConditional = this.inConditionalBranch;
+      this.inConditionalBranch = true;
       for (const caseGroup of caseGroups) {
+        this.tainted = new Set(taintedBefore);
         this.visit(caseGroup);
+        for (const v of this.tainted) taintedAfter.add(v);
       }
+      this.inConditionalBranch = wasInConditional;
+      this.tainted = taintedAfter;
     }
   }
   handleTernary(node) {
@@ -19342,6 +19407,18 @@ var ConstantPropagator = class _ConstantPropagator {
     }
     return false;
   }
+  /** The value of an integer, character or string literal node; null for anything else. */
+  literalValue(node) {
+    const text = getNodeText2(node, this.source);
+    if (node.type === "integer_literal" || node.type === "decimal_integer_literal") {
+      const n = Number(text.replace(/_/g, "").replace(/[uUlL]+$/, ""));
+      return Number.isInteger(n) ? n : null;
+    }
+    if (node.type === "character_literal" || node.type === "string_literal") {
+      return text.slice(1, -1);
+    }
+    return null;
+  }
   extractCaseValue(labelNode) {
     for (const child of labelNode.children) {
       if (child.type === "decimal_integer_literal") {

package/dist/core/extractors/dfg.js

@@ -115,6 +115,9 @@ function buildCSharpDFG(tree, cache) {
                 }
             }
             // Assignment target defs: `x = …;` → assignment_expression.left.
+            // `plainTargets` collects the targets of plain `=` assignments: the name
+            // on the left is written, not read (`x += …` does read it).
+            const plainTargets = [];
             for (const asn of findNodes(body, 'assignment_expression')) {
                 const left = asn.childForFieldName('left');
                 if (left?.type === 'identifier') {
@@ -122,10 +125,24 @@ function buildCSharpDFG(tree, cache) {
                     const def = { id: defIdCounter++, variable: name, line: asn.startPosition.row + 1, kind: 'local' };
                     defs.push(def);
                     currentScope(scopeStack).set(name, def.id);
+                    if (asn.children.some(c => c?.type === '=')) {
+                        plainTargets.push({ name, line: left.startPosition.row + 1 });
+                    }
                 }
             }
             // Uses: all identifier references, reaching defs resolved from scope.
             const bodyUses = extractUses(body, useIdCounter, scopeStack, false);
+            // `extractUses` reports the left-hand name of `s = q;` as a read of `s`,
+            // which chains the previous `s` into the new one although nothing flows
+            // between them. A sanitizer on the old value was then credited to the
+            // new one (cognium-dev#579: encode, reassign to raw input, write). Uses
+            // arrive in source order, so the target is the first use of that name on
+            // its line.
+            for (const target of plainTargets) {
+                const idx = bodyUses.uses.findIndex(u => u.variable === target.name && u.line === target.line);
+                if (idx !== -1)
+                    bodyUses.uses.splice(idx, 1);
+            }
             resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
             uses.push(...bodyUses.uses);
             useIdCounter = bodyUses.nextId;
@@ -516,6 +533,38 @@ function processStatement(stmt, startDefId, startUseId, scopeStack, isJavaScript
             }
             break;
         }
+        case 'switch_expression':
+        case 'switch_statement': {
+            // Java parses a switch statement as `switch_expression` (condition +
+            // switch_block of statement groups / `->` rules); JS as
+            // `switch_statement` (value + switch_body of switch_case). Without this
+            // case a switch fell to `default` and only had its uses extracted, so
+            // `case 'A': bar = param;` recorded no def of `bar` and its taint never
+            // reached a later sink.
+            const value = stmt.childForFieldName('condition') ?? stmt.childForFieldName('value');
+            if (value) {
+                const valueUses = extractUses(value, useId, scopeStack, isJavaScript);
+                uses.push(...valueUses.uses);
+                useId = valueUses.nextId;
+            }
+            const body = stmt.childForFieldName('body');
+            if (body) {
+                // One scope for the whole body: Java and JS cases share it.
+                scopeStack.push(new Map());
+                for (let i = 0; i < body.childCount; i++) {
+                    const group = body.child(i);
+                    if (!group)
+                        continue;
+                    const result = processBlock(group, defId, useId, scopeStack, isJavaScript);
+                    defs.push(...result.defs);
+                    uses.push(...result.uses);
+                    defId = result.nextDefId;
+                    useId = result.nextUseId;
+                }
+                scopeStack.pop();
+            }
+            break;
+        }
         case 'block':
         case 'statement_block': {
             // New scope for block