circle-ir 4.13.0 → 4.13.2

package/dist/browser/circle-ir.js

@@ -22021,7 +22021,13 @@ var ConstantPropagator = class _ConstantPropagator {
       }
       return;
     }
-    const condValue = this.evaluateExpression(condition);
+    let condValue = this.evaluateExpression(condition);
+    if (!(isKnown(condValue) && condValue.type === "bool")) {
+      const literal = this.literalCondition(condition);
+      if (literal !== null) {
+        condValue = { type: "bool", value: literal, sourceLine: getNodeLine(condition) };
+      }
+    }
     if (isKnown(condValue) && condValue.type === "bool") {
       if (condValue.value === true) {
         if (alternative) {
@@ -22185,13 +22191,27 @@ var ConstantPropagator = class _ConstantPropagator {
       return;
     }
     const caseGroups = switchBlock.children.filter(
-      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section"
+      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section" || c.type === "switch_case" || c.type === "switch_default"
     );
+    if (caseGroups.length === 0) {
+      this.visit(switchBlock);
+      return;
+    }
     if (switchValue && isKnown(switchValue)) {
       let matchingIdx = -1;
       let defaultIdx = -1;
       for (let i2 = 0; i2 < caseGroups.length; i2++) {
         const caseGroup = caseGroups[i2];
+        if (caseGroup.type === "switch_default") {
+          defaultIdx = i2;
+          continue;
+        }
+        if (caseGroup.type === "switch_case") {
+          const label = caseGroup.childForFieldName("value");
+          const caseValue = label ? this.literalValue(label) : null;
+          if (caseValue !== null && caseValue === switchValue.value) matchingIdx = i2;
+          continue;
+        }
         for (const child of caseGroup.children) {
           if (child.type === "switch_label") {
             const labelText = getNodeText2(child, this.source);
@@ -22294,6 +22314,33 @@ var ConstantPropagator = class _ConstantPropagator {
     }
     return false;
   }
+  /**
+   * A condition written with literals only, in the C# grammar's node names:
+   * `true`, `false`, `5 == 5`, `5 != 5`. Null when it is anything else. The
+   * shared evaluator does not know `boolean_literal` / `integer_literal`.
+   */
+  literalCondition(node) {
+    if (node.type === "parenthesized_expression") {
+      const inner = node.children.find((c) => c.isNamed);
+      return inner ? this.literalCondition(inner) : null;
+    }
+    if (node.type === "boolean_literal") {
+      const text = getNodeText2(node, this.source);
+      return text === "true" ? true : text === "false" ? false : null;
+    }
+    if (node.type === "binary_expression") {
+      const left = node.childForFieldName("left");
+      const right = node.childForFieldName("right");
+      const op = node.childForFieldName("operator");
+      const opText = op ? getNodeText2(op, this.source) : "";
+      if (!left || !right || opText !== "==" && opText !== "!=") return null;
+      const l = this.literalValue(left);
+      const r = this.literalValue(right);
+      if (l === null || r === null) return null;
+      return opText === "==" ? l === r : l !== r;
+    }
+    return null;
+  }
   /** The value of an integer, character or string literal node; null for anything else. */
   literalValue(node) {
     const text = getNodeText2(node, this.source);
@@ -35149,6 +35196,9 @@ var ENDS_STATEMENT_RE = /[;{}]\s*(?:\/\/.*)?$/;
 function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function withoutStringLiterals(text) {
+  return text.replace(/@"(?:[^"]|"")*"|"(?:[^"\\]|\\.)*"/g, '""');
+}
 function mentions(text, name2) {
   return new RegExp(`(?<![\\w])${escapeRegex(name2)}(?![\\w])`).test(text);
 }
@@ -35160,6 +35210,16 @@ function insideParens(text, open) {
   }
   return null;
 }
+function lastCallArguments(text) {
+  const close = text.lastIndexOf(")");
+  if (close < 0) return null;
+  let depth = 0;
+  for (let i2 = close; i2 >= 0; i2--) {
+    if (text[i2] === ")") depth++;
+    else if (text[i2] === "(" && --depth === 0) return text.slice(i2 + 1, close);
+  }
+  return null;
+}
 function leadingIf(text) {
   const m = /^\s*(?:\}\s*)?(?:else\s+)?if\s*\(/.exec(text);
   if (!m) return null;
@@ -35285,6 +35345,84 @@ var CSharpCredit = class {
   sanitizedVarsAt(type, sinkLine) {
     return this.sanitizedVarsIn(type, this.methodAt(sinkLine)?.start_line ?? 1, sinkLine, true);
   }
+  /**
+   * True when the sink on `sinkLine` also receives a tainted value that no
+   * sanitizer covers. In `Write(HtmlEncode(a) + b)` the encoder covers `a`
+   * only: `b` arrives raw, so the sanitizer on the line must not clear the
+   * sink. `credited` are the names already known safe for `type` there;
+   * `seeds` are the taint sources that name a variable.
+   *
+   * Taint is followed through the sink's method top to bottom, last
+   * assignment wins. The sink text is then read without its string literals
+   * and without the sanitizer calls for `type`; a tainted, uncredited name
+   * left over is a raw operand.
+   */
+  rawTaintReaches(type, sinkLine, credited, seeds) {
+    if (seeds.length === 0) return false;
+    const method = this.methodAt(sinkLine);
+    const from = method?.start_line ?? 1;
+    const tainted = /* @__PURE__ */ new Set();
+    const stmts = this.statements(from, sinkLine);
+    for (let i2 = 0; i2 < stmts.length; i2++) {
+      const st = stmts[i2];
+      const end = i2 + 1 < stmts.length ? stmts[i2 + 1].line : sinkLine;
+      const m = ASSIGN_RE.exec(st.text);
+      if (m) {
+        const rhs = withoutStringLiterals(m[2]);
+        if ([...tainted].some((v) => mentions(rhs, v))) tainted.add(m[1]);
+        else tainted.delete(m[1]);
+      }
+      for (const s of seeds) if (s.line >= st.line && s.line < end) tainted.add(s.variable);
+    }
+    if (tainted.size === 0) return false;
+    const rest = this.withoutSanitizerCalls(type, this.receivedOperands(type, sinkLine));
+    if (this.builtinSanitizes(type, rest)) return false;
+    for (const v of tainted) if (!credited.has(v) && mentions(rest, v)) return true;
+    return false;
+  }
+  /**
+   * The operands a sink on `sinkLine` receives, string literals blanked. For a
+   * property sink (`searcher.Filter = rhs;`) that is the right-hand side. For
+   * a call sink it is the call's arguments, so a tainted receiver or cast
+   * target (`((XmlDocument)ctx).SelectSingleNode(q)`) is not an operand. The
+   * last call on the line is the sink only when it is not itself a sanitizer:
+   * in `x.Filter = Escape(input);` it is the sanitizer (cognium-dev#643).
+   */
+  receivedOperands(type, sinkLine) {
+    const text = withoutStringLiterals(this.sinkText(sinkLine)).replace(/\s*;?\s*(?:\/\/.*)?$/, "");
+    const property = /^\s*[A-Za-z_][\w.]*\.[A-Za-z_]\w*\s*=(?!=)\s*(.*)$/.exec(text);
+    if (property) return property[1];
+    if (!text.endsWith(")")) return text;
+    const args2 = lastCallArguments(text);
+    if (args2 === null) return text;
+    const open = text.length - args2.length - 2;
+    const callStart = text.slice(0, open).search(/[A-Za-z_][\w.]*\s*$/);
+    const lastCall = callStart < 0 ? "" : text.slice(callStart);
+    if (lastCall && this.withoutSanitizerCalls(type, lastCall).trim() === "") return text;
+    return args2;
+  }
+  /** `text` with every sanitizer call for `type`, arguments included, removed. */
+  withoutSanitizerCalls(type, text) {
+    const res = [];
+    for (const { re, type: t } of CSHARP_SANITIZER_RES) if (t === type) res.push(re);
+    for (const name2 of this.helpers(type)) res.push(new RegExp(`(?<![\\w.])${escapeRegex(name2)}\\s*\\(`));
+    let out2 = text;
+    for (const re of res) {
+      for (let guard = 0; guard < 16; guard++) {
+        const m = re.exec(out2);
+        if (!m) break;
+        if (!m[0].endsWith("(")) {
+          out2 = out2.slice(0, m.index) + out2.slice(m.index + m[0].length);
+          continue;
+        }
+        const open = m.index + m[0].length - 1;
+        const inner = insideParens(out2, open);
+        if (inner === null) break;
+        out2 = out2.slice(0, m.index) + out2.slice(open + inner.length + 2);
+      }
+    }
+    return out2;
+  }
   /**
    * The text of the statement at `line` that a sink call can be in: for
    * `if (COND) sink(x);` that is `sink(x);`, without the condition. A name
@@ -35501,16 +35639,16 @@ var CSharpCredit = class {
    * sink type. Used for the untyped "tainted data reaches an external call"
    * fallback, which has no sink type of its own to ask about.
    */
-  creditedOnLine(line) {
+  creditedOnLine(line, seeds = []) {
     const text = this.sinkText(line);
     const types = new Set(CSHARP_SANITIZER_RES.map((r) => r.type));
     for (const t of INERT_WHEN_ALPHANUMERIC) types.add(t);
     types.add("ssrf");
     for (const type of types) {
-      if (this.sanitizes(type, text)) return true;
       const credited = /* @__PURE__ */ new Set([...this.sanitizedVarsAt(type, line), ...this.guardedVarsAt(type, line)]);
       for (const v of this.safeBuilders(credited, line)) credited.add(v);
-      for (const v of credited) if (mentions(text, v)) return true;
+      const covered = this.sanitizes(type, text) || [...credited].some((v) => mentions(text, v));
+      if (covered && !this.rawTaintReaches(type, line, credited, seeds)) return true;
     }
     return this.fixedHostRequest(line);
   }
@@ -36676,11 +36814,12 @@ var SinkFilterPass = class {
       const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
       const csFields = new Set(ctx.graph.ir.types.flatMap((t) => (t.fields ?? []).map((f) => f.name)));
       const credit = new CSharpCredit(ctx.code, ctx.graph.ir.types.flatMap((t) => t.methods));
+      const csSeeds = mergedSources.flatMap((s) => s.variable ? [{ variable: s.variable, line: s.line }] : []);
       const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
         if (sink.type === "xxe" && xxeHardened) return false;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        if (credit.sanitizes(sink.type, sinkLineText)) return false;
+        const inlineSanitized = credit.sanitizes(sink.type, sinkLineText);
         if (sink.type === "ssrf" && credit.fixedHostRequest(sink.line)) return false;
         const scoped = credit.sanitizedVarsAt(sink.type, sink.line);
         const fileWide = sanitizedByType.get(sink.type);
@@ -36691,10 +36830,8 @@ var SinkFilterPass = class {
         for (const v of credit.guardedVarsAt(sink.type, sink.line)) sanitizedVars.add(v);
         for (const v of credit.safeBuilders(sanitizedVars, sink.line)) sanitizedVars.add(v);
         const received = credit.sinkText(sink.line);
-        for (const v of sanitizedVars) {
-          if (new RegExp(`(?<![\\w])${escapeRegex2(v)}(?![\\w])`).test(received)) return false;
-        }
-        return true;
+        const covered = inlineSanitized || [...sanitizedVars].some((v) => new RegExp(`(?<![\\w])${escapeRegex2(v)}(?![\\w])`).test(received));
+        return !covered || credit.rawTaintReaches(sink.type, sink.line, sanitizedVars, csSeeds);
       });
     }
     if (language === "csharp") {
@@ -40223,9 +40360,10 @@ var InterproceduralPass = class {
       });
     }
     if (csCredit) {
+      const csSeeds = sources.flatMap((s) => s.variable ? [{ variable: s.variable, line: s.line }] : []);
       const credited = /* @__PURE__ */ new Set();
       filteredAdditionalFlows = filteredAdditionalFlows.filter((f) => {
-        if (f.sink_type !== "external_taint_escape" || !csCredit.creditedOnLine(f.sink_line)) return true;
+        if (f.sink_type !== "external_taint_escape" || !csCredit.creditedOnLine(f.sink_line, csSeeds)) return true;
         credited.add(f.sink_line);
         return false;
       });

package/dist/core/circle-ir-core.cjs

@@ -19200,7 +19200,13 @@ var ConstantPropagator = class _ConstantPropagator {
       }
       return;
     }
-    const condValue = this.evaluateExpression(condition);
+    let condValue = this.evaluateExpression(condition);
+    if (!(isKnown(condValue) && condValue.type === "bool")) {
+      const literal = this.literalCondition(condition);
+      if (literal !== null) {
+        condValue = { type: "bool", value: literal, sourceLine: getNodeLine(condition) };
+      }
+    }
     if (isKnown(condValue) && condValue.type === "bool") {
       if (condValue.value === true) {
         if (alternative) {
@@ -19364,13 +19370,27 @@ var ConstantPropagator = class _ConstantPropagator {
       return;
     }
     const caseGroups = switchBlock.children.filter(
-      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section"
+      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section" || c.type === "switch_case" || c.type === "switch_default"
     );
+    if (caseGroups.length === 0) {
+      this.visit(switchBlock);
+      return;
+    }
     if (switchValue && isKnown(switchValue)) {
       let matchingIdx = -1;
       let defaultIdx = -1;
       for (let i2 = 0; i2 < caseGroups.length; i2++) {
         const caseGroup = caseGroups[i2];
+        if (caseGroup.type === "switch_default") {
+          defaultIdx = i2;
+          continue;
+        }
+        if (caseGroup.type === "switch_case") {
+          const label = caseGroup.childForFieldName("value");
+          const caseValue = label ? this.literalValue(label) : null;
+          if (caseValue !== null && caseValue === switchValue.value) matchingIdx = i2;
+          continue;
+        }
         for (const child of caseGroup.children) {
           if (child.type === "switch_label") {
             const labelText = getNodeText2(child, this.source);
@@ -19473,6 +19493,33 @@ var ConstantPropagator = class _ConstantPropagator {
     }
     return false;
   }
+  /**
+   * A condition written with literals only, in the C# grammar's node names:
+   * `true`, `false`, `5 == 5`, `5 != 5`. Null when it is anything else. The
+   * shared evaluator does not know `boolean_literal` / `integer_literal`.
+   */
+  literalCondition(node) {
+    if (node.type === "parenthesized_expression") {
+      const inner = node.children.find((c) => c.isNamed);
+      return inner ? this.literalCondition(inner) : null;
+    }
+    if (node.type === "boolean_literal") {
+      const text = getNodeText2(node, this.source);
+      return text === "true" ? true : text === "false" ? false : null;
+    }
+    if (node.type === "binary_expression") {
+      const left = node.childForFieldName("left");
+      const right = node.childForFieldName("right");
+      const op = node.childForFieldName("operator");
+      const opText = op ? getNodeText2(op, this.source) : "";
+      if (!left || !right || opText !== "==" && opText !== "!=") return null;
+      const l = this.literalValue(left);
+      const r = this.literalValue(right);
+      if (l === null || r === null) return null;
+      return opText === "==" ? l === r : l !== r;
+    }
+    return null;
+  }
   /** The value of an integer, character or string literal node; null for anything else. */
   literalValue(node) {
     const text = getNodeText2(node, this.source);

package/dist/core/circle-ir-core.js

@@ -19134,7 +19134,13 @@ var ConstantPropagator = class _ConstantPropagator {
       }
       return;
     }
-    const condValue = this.evaluateExpression(condition);
+    let condValue = this.evaluateExpression(condition);
+    if (!(isKnown(condValue) && condValue.type === "bool")) {
+      const literal = this.literalCondition(condition);
+      if (literal !== null) {
+        condValue = { type: "bool", value: literal, sourceLine: getNodeLine(condition) };
+      }
+    }
     if (isKnown(condValue) && condValue.type === "bool") {
       if (condValue.value === true) {
         if (alternative) {
@@ -19298,13 +19304,27 @@ var ConstantPropagator = class _ConstantPropagator {
       return;
     }
     const caseGroups = switchBlock.children.filter(
-      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section"
+      (c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section" || c.type === "switch_case" || c.type === "switch_default"
     );
+    if (caseGroups.length === 0) {
+      this.visit(switchBlock);
+      return;
+    }
     if (switchValue && isKnown(switchValue)) {
       let matchingIdx = -1;
       let defaultIdx = -1;
       for (let i2 = 0; i2 < caseGroups.length; i2++) {
         const caseGroup = caseGroups[i2];
+        if (caseGroup.type === "switch_default") {
+          defaultIdx = i2;
+          continue;
+        }
+        if (caseGroup.type === "switch_case") {
+          const label = caseGroup.childForFieldName("value");
+          const caseValue = label ? this.literalValue(label) : null;
+          if (caseValue !== null && caseValue === switchValue.value) matchingIdx = i2;
+          continue;
+        }
         for (const child of caseGroup.children) {
           if (child.type === "switch_label") {
             const labelText = getNodeText2(child, this.source);
@@ -19407,6 +19427,33 @@ var ConstantPropagator = class _ConstantPropagator {
     }
     return false;
   }
+  /**
+   * A condition written with literals only, in the C# grammar's node names:
+   * `true`, `false`, `5 == 5`, `5 != 5`. Null when it is anything else. The
+   * shared evaluator does not know `boolean_literal` / `integer_literal`.
+   */
+  literalCondition(node) {
+    if (node.type === "parenthesized_expression") {
+      const inner = node.children.find((c) => c.isNamed);
+      return inner ? this.literalCondition(inner) : null;
+    }
+    if (node.type === "boolean_literal") {
+      const text = getNodeText2(node, this.source);
+      return text === "true" ? true : text === "false" ? false : null;
+    }
+    if (node.type === "binary_expression") {
+      const left = node.childForFieldName("left");
+      const right = node.childForFieldName("right");
+      const op = node.childForFieldName("operator");
+      const opText = op ? getNodeText2(op, this.source) : "";
+      if (!left || !right || opText !== "==" && opText !== "!=") return null;
+      const l = this.literalValue(left);
+      const r = this.literalValue(right);
+      if (l === null || r === null) return null;
+      return opText === "==" ? l === r : l !== r;
+    }
+    return null;
+  }
   /** The value of an integer, character or string literal node; null for anything else. */
   literalValue(node) {
     const text = getNodeText2(node, this.source);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "4.13.0",
+  "version": "4.13.2",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",