circle-ir 4.13.1 → 4.14.0

package/dist/core/circle-ir-core.cjs

@@ -6230,6 +6230,13 @@ function csharpBareName(node) {
   }
   return getNodeText(node);
 }
+function csharpCreatedSimpleType(creation) {
+  const typeNode = creation.childForFieldName("type");
+  if (!typeNode) return null;
+  const bare = csharpBareName(typeNode).replace(/<[^>]*>/g, "");
+  const simple = bare.split(".").pop()?.trim() ?? "";
+  return simple && simple !== "var" ? simple : null;
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -6238,11 +6245,15 @@ function extractCSharpCalls(tree, cache) {
     const fn = inv.childForFieldName("function");
     let methodName = "unknown";
     let receiver = null;
+    let receiverTypeFromCreation = null;
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
       methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
+      if (exprNode?.type === "object_creation_expression") {
+        receiverTypeFromCreation = csharpCreatedSimpleType(exprNode);
+      }
     } else if (fn) {
       methodName = csharpBareName(fn);
     }
@@ -6260,7 +6271,7 @@ function extractCSharpCalls(tree, cache) {
     calls.push({
       method_name: methodName,
       receiver,
-      receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
+      receiver_type: receiverTypeFromCreation ?? (receiver ? typeMap.get(receiver) ?? null : null),
       receiver_type_fqn: null,
       arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
@@ -11414,6 +11425,9 @@ var DEFAULT_SOURCES = [
   // entry.getName() returns a path that may contain ../ — flowing into File()/FileOutputStream()
   // is a classic Zip-Slip vulnerability.
   { method: "getName", class: "ZipEntry", type: "file_input", severity: "high", return_tainted: true },
+  // JarEntry extends ZipEntry. A declared JarEntry does not match the ZipEntry
+  // row, and a receiver not named `entry` misses the name heuristic. cognium-dev#620.
+  { method: "getName", class: "JarEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ZipArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "TarArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
@@ -12170,8 +12184,10 @@ var DEFAULT_SINKS = [
   { method: "checkout", class: "SCM", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "retrieve", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "add", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  // Jenkins CPS Flow Execution (constructor)
-  { method: "CpsFlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // Jenkins CPS compiles the script argument. That is code injection (CWE-94),
+  // the same class as GroovyShell.evaluate. Registered as command_injection it
+  // was dropped by the CWE-78 constructor allowlist (#129). cognium-dev#619.
+  { method: "CpsFlowExecution", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "CpsFlowDefinition", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "FlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // ActiveMQ control commands
@@ -15280,12 +15296,14 @@ function isInterproceduralTaintableType(typeName, language) {
 }
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection") return false;
-  const queryArg = call.arguments.find((a) => a.position === 0);
+  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
     const hasPlaceholders = /(\?(?:\s|,|$|\))|\$\d+|:\w+|%s)/.test(queryText);
     const hasConcatenation = /\+\s*[^+]/.test(queryText) || queryText.includes("${");
-    if (hasPlaceholders && !hasConcatenation && call.arguments.length >= 2) {
+    const hasBoundArg = queryPos === 0 ? call.arguments.length >= 2 : call.arguments.some((a) => a.position > queryPos);
+    if (hasPlaceholders && !hasConcatenation && hasBoundArg) {
       return true;
     }
   }
@@ -15935,6 +15953,14 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
+function isArgumentlessJsResponseWriter(call, pattern, language) {
+  if (pattern.type !== "xss" || pattern.class !== "Response") return false;
+  if (language !== "javascript" && language !== "typescript") return false;
+  const positions = pattern.arg_positions;
+  if (!positions || positions.length === 0) return false;
+  const argc = call.arguments?.length ?? 0;
+  return positions.every((pos) => pos >= argc);
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
   const patternsForLanguage = language === void 0 ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = /* @__PURE__ */ new Map();
@@ -15995,6 +16021,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (isArgumentlessJsResponseWriter(call, pattern, language)) {
+          continue;
+        }
         if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }

package/dist/core/circle-ir-core.js

@@ -6164,6 +6164,13 @@ function csharpBareName(node) {
   }
   return getNodeText(node);
 }
+function csharpCreatedSimpleType(creation) {
+  const typeNode = creation.childForFieldName("type");
+  if (!typeNode) return null;
+  const bare = csharpBareName(typeNode).replace(/<[^>]*>/g, "");
+  const simple = bare.split(".").pop()?.trim() ?? "";
+  return simple && simple !== "var" ? simple : null;
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -6172,11 +6179,15 @@ function extractCSharpCalls(tree, cache) {
     const fn = inv.childForFieldName("function");
     let methodName = "unknown";
     let receiver = null;
+    let receiverTypeFromCreation = null;
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
       methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
+      if (exprNode?.type === "object_creation_expression") {
+        receiverTypeFromCreation = csharpCreatedSimpleType(exprNode);
+      }
     } else if (fn) {
       methodName = csharpBareName(fn);
     }
@@ -6194,7 +6205,7 @@ function extractCSharpCalls(tree, cache) {
     calls.push({
       method_name: methodName,
       receiver,
-      receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
+      receiver_type: receiverTypeFromCreation ?? (receiver ? typeMap.get(receiver) ?? null : null),
       receiver_type_fqn: null,
       arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
@@ -11348,6 +11359,9 @@ var DEFAULT_SOURCES = [
   // entry.getName() returns a path that may contain ../ — flowing into File()/FileOutputStream()
   // is a classic Zip-Slip vulnerability.
   { method: "getName", class: "ZipEntry", type: "file_input", severity: "high", return_tainted: true },
+  // JarEntry extends ZipEntry. A declared JarEntry does not match the ZipEntry
+  // row, and a receiver not named `entry` misses the name heuristic. cognium-dev#620.
+  { method: "getName", class: "JarEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ZipArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "TarArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
@@ -12104,8 +12118,10 @@ var DEFAULT_SINKS = [
   { method: "checkout", class: "SCM", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "retrieve", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "add", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  // Jenkins CPS Flow Execution (constructor)
-  { method: "CpsFlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // Jenkins CPS compiles the script argument. That is code injection (CWE-94),
+  // the same class as GroovyShell.evaluate. Registered as command_injection it
+  // was dropped by the CWE-78 constructor allowlist (#129). cognium-dev#619.
+  { method: "CpsFlowExecution", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "CpsFlowDefinition", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "FlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // ActiveMQ control commands
@@ -15214,12 +15230,14 @@ function isInterproceduralTaintableType(typeName, language) {
 }
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection") return false;
-  const queryArg = call.arguments.find((a) => a.position === 0);
+  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
     const hasPlaceholders = /(\?(?:\s|,|$|\))|\$\d+|:\w+|%s)/.test(queryText);
     const hasConcatenation = /\+\s*[^+]/.test(queryText) || queryText.includes("${");
-    if (hasPlaceholders && !hasConcatenation && call.arguments.length >= 2) {
+    const hasBoundArg = queryPos === 0 ? call.arguments.length >= 2 : call.arguments.some((a) => a.position > queryPos);
+    if (hasPlaceholders && !hasConcatenation && hasBoundArg) {
       return true;
     }
   }
@@ -15869,6 +15887,14 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
+function isArgumentlessJsResponseWriter(call, pattern, language) {
+  if (pattern.type !== "xss" || pattern.class !== "Response") return false;
+  if (language !== "javascript" && language !== "typescript") return false;
+  const positions = pattern.arg_positions;
+  if (!positions || positions.length === 0) return false;
+  const argc = call.arguments?.length ?? 0;
+  return positions.every((pos) => pos >= argc);
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
   const patternsForLanguage = language === void 0 ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = /* @__PURE__ */ new Map();
@@ -15929,6 +15955,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (isArgumentlessJsResponseWriter(call, pattern, language)) {
+          continue;
+        }
         if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }

package/dist/core/extractors/calls.js

@@ -227,6 +227,19 @@ function csharpBareName(node) {
     }
     return getNodeText(node);
 }
+/**
+ * Simple type of `new T(...)`. `new BinaryFormatter().Deserialize(s)` has no
+ * variable for the receiver-type map, so the creation expression itself is
+ * the type (#630).
+ */
+function csharpCreatedSimpleType(creation) {
+    const typeNode = creation.childForFieldName('type');
+    if (!typeNode)
+        return null;
+    const bare = csharpBareName(typeNode).replace(/<[^>]*>/g, '');
+    const simple = bare.split('.').pop()?.trim() ?? '';
+    return simple && simple !== 'var' ? simple : null;
+}
 function extractCSharpCalls(tree, cache) {
     const calls = [];
     const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -235,11 +248,15 @@ function extractCSharpCalls(tree, cache) {
         const fn = inv.childForFieldName('function');
         let methodName = 'unknown';
         let receiver = null;
+        let receiverTypeFromCreation = null;
         if (fn?.type === 'member_access_expression') {
             const nameNode = fn.childForFieldName('name');
             const exprNode = fn.childForFieldName('expression');
             methodName = nameNode ? csharpBareName(nameNode) : 'unknown';
             receiver = exprNode ? getNodeText(exprNode) : null;
+            if (exprNode?.type === 'object_creation_expression') {
+                receiverTypeFromCreation = csharpCreatedSimpleType(exprNode);
+            }
         }
         else if (fn) {
             methodName = csharpBareName(fn);
@@ -271,7 +288,7 @@ function extractCSharpCalls(tree, cache) {
         calls.push({
             method_name: methodName,
             receiver,
-            receiver_type: receiver ? (typeMap.get(receiver) ?? null) : null,
+            receiver_type: receiverTypeFromCreation ?? (receiver ? (typeMap.get(receiver) ?? null) : null),
             receiver_type_fqn: null,
             arguments: args,
             location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },