circle-ir 4.13.2 → 4.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/README.md +3 -3
  2. package/configs/sinks/golang.json +20 -0
  3. package/dist/analysis/config-loader.d.ts.map +1 -1
  4. package/dist/analysis/config-loader.js +7 -2
  5. package/dist/analysis/config-loader.js.map +1 -1
  6. package/dist/analysis/interprocedural.js +1 -1
  7. package/dist/analysis/interprocedural.js.map +1 -1
  8. package/dist/analysis/passes/library-profile-source-gate-pass.d.ts +19 -18
  9. package/dist/analysis/passes/library-profile-source-gate-pass.d.ts.map +1 -1
  10. package/dist/analysis/passes/library-profile-source-gate-pass.js +16 -15
  11. package/dist/analysis/passes/library-profile-source-gate-pass.js.map +1 -1
  12. package/dist/analysis/passes/scan-secrets-pass.d.ts +2 -2
  13. package/dist/analysis/passes/scan-secrets-pass.d.ts.map +1 -1
  14. package/dist/analysis/passes/scan-secrets-pass.js +23 -7
  15. package/dist/analysis/passes/scan-secrets-pass.js.map +1 -1
  16. package/dist/analysis/taint-matcher.d.ts.map +1 -1
  17. package/dist/analysis/taint-matcher.js +40 -6
  18. package/dist/analysis/taint-matcher.js.map +1 -1
  19. package/dist/analyzer.d.ts.map +1 -1
  20. package/dist/analyzer.js +40 -11
  21. package/dist/analyzer.js.map +1 -1
  22. package/dist/browser/circle-ir.js +118 -7
  23. package/dist/core/circle-ir-core.cjs +34 -5
  24. package/dist/core/circle-ir-core.js +34 -5
  25. package/dist/core/extractors/calls.js +18 -1
  26. package/dist/core/extractors/calls.js.map +1 -1
  27. package/dist/languages/plugins/go.d.ts.map +1 -1
  28. package/dist/languages/plugins/go.js +40 -0
  29. package/dist/languages/plugins/go.js.map +1 -1
  30. package/package.json +1 -1
package/README.md CHANGED
@@ -209,12 +209,12 @@ const response = await analyzeForAPI(code, 'File.java', 'java');
209
209
  | **Rust** | tree-sitter-rust | Actix-web, Rocket, Axum |
210
210
  | **Bash/Shell** | tree-sitter-bash | Shell scripts (.sh, .bash, .zsh, .ksh) |
211
211
  | **HTML** | tree-sitter-html | Web extraction preprocessor (.html, .htm, .xhtml) |
212
- | **C#/.NET** _(experimental)_ | tree-sitter-c-sharp | ASP.NET Core, ADO.NET, EF Core |
212
+ | **C#/.NET** _(Preview)_ | tree-sitter-c-sharp | ASP.NET Core, ADO.NET (EF Core not yet verified) |
213
213
 
214
- **C#/.NET support is experimental / preview** (since 4.0.0). It performs
214
+ **C#/.NET support is Preview** (since 4.0.0). It performs
215
215
  straight-line taint analysis across 10 CWE families — SQL injection, command
216
216
  injection, path traversal, SSRF, code injection, XSS, insecure deserialization,
217
- LDAP, XPath, XXE — on ASP.NET Core / ADO.NET / EF Core / BCL, handling string
217
+ LDAP, XPath, XXE — on ASP.NET Core / ADO.NET / BCL (EF Core sinks are registered but have no measured true positive yet), handling string
218
218
  concatenation and `$"…{tainted}…"` interpolation, with sink-type-aware
219
219
  sanitizer recognition (`HtmlEncode`, `Path.GetFileName`). It is **not yet
220
220
  benchmark-verified** (no published TPR/FPR); expect gaps in branch/alias
package/configs/sinks/golang.json CHANGED
@@ -34,6 +34,26 @@
34
34
  "severity": "critical",
35
35
  "arg_positions": [0]
36
36
  },
37
+ { "method": "QueryContext", "class": "DB", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
38
+ { "method": "QueryRowContext", "class": "DB", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
39
+ { "method": "ExecContext", "class": "DB", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
40
+ { "method": "Prepare", "class": "DB", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [0] },
41
+ { "method": "PrepareContext", "class": "DB", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
42
+ { "method": "Exec", "class": "Tx", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [0] },
43
+ { "method": "QueryRow", "class": "Tx", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [0] },
44
+ { "method": "QueryContext", "class": "Tx", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
45
+ { "method": "QueryRowContext", "class": "Tx", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
46
+ { "method": "ExecContext", "class": "Tx", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
47
+ { "method": "Prepare", "class": "Tx", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [0] },
48
+ { "method": "PrepareContext", "class": "Tx", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
49
+ { "method": "Query", "class": "Conn", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [0] },
50
+ { "method": "QueryRow", "class": "Conn", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [0] },
51
+ { "method": "Exec", "class": "Conn", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [0] },
52
+ { "method": "QueryContext", "class": "Conn", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
53
+ { "method": "QueryRowContext", "class": "Conn", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
54
+ { "method": "ExecContext", "class": "Conn", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
55
+ { "method": "Prepare", "class": "Conn", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [0] },
56
+ { "method": "PrepareContext", "class": "Conn", "type": "sql_injection", "cwe": "CWE-89", "severity": "critical", "arg_positions": [1] },
37
57
  {
38
58
  "method": "Command",
39
59
  "class": "exec",
package/dist/analysis/config-loader.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA00B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAgrEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
1
+ {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA60B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAkrEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
package/dist/analysis/config-loader.js CHANGED
@@ -291,6 +291,9 @@ export const DEFAULT_SOURCES = [
291
291
  // entry.getName() returns a path that may contain ../ — flowing into File()/FileOutputStream()
292
292
  // is a classic Zip-Slip vulnerability.
293
293
  { method: 'getName', class: 'ZipEntry', type: 'file_input', severity: 'high', return_tainted: true },
294
+ // JarEntry extends ZipEntry. A declared JarEntry does not match the ZipEntry
295
+ // row, and a receiver not named `entry` misses the name heuristic. cognium-dev#620.
296
+ { method: 'getName', class: 'JarEntry', type: 'file_input', severity: 'high', return_tainted: true },
294
297
  { method: 'getName', class: 'ZipArchiveEntry', type: 'file_input', severity: 'high', return_tainted: true },
295
298
  { method: 'getName', class: 'TarArchiveEntry', type: 'file_input', severity: 'high', return_tainted: true },
296
299
  { method: 'getName', class: 'ArchiveEntry', type: 'file_input', severity: 'high', return_tainted: true },
@@ -1093,8 +1096,10 @@ export const DEFAULT_SINKS = [
1093
1096
  { method: 'checkout', class: 'SCM', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
1094
1097
  { method: 'retrieve', class: 'LibraryAdder', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
1095
1098
  { method: 'add', class: 'LibraryAdder', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
1096
- // Jenkins CPS Flow Execution (constructor)
1097
- { method: 'CpsFlowExecution', class: 'constructor', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
1099
+ // Jenkins CPS compiles the script argument. That is code injection (CWE-94),
1100
+ // the same class as GroovyShell.evaluate. Registered as command_injection it
1101
+ // was dropped by the CWE-78 constructor allowlist (#129). cognium-dev#619.
1102
+ { method: 'CpsFlowExecution', class: 'constructor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
1098
1103
  { method: 'CpsFlowDefinition', class: 'constructor', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
1099
1104
  { method: 'FlowExecution', class: 'constructor', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
1100
1105
  // ActiveMQ control commands