circle-ir 4.14.1 → 4.15.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (95) hide show
  1. package/dist/analysis/config-loader.d.ts.map +1 -1
  2. package/dist/analysis/config-loader.js +9 -2
  3. package/dist/analysis/config-loader.js.map +1 -1
  4. package/dist/analysis/const-table-lookup.d.ts +29 -0
  5. package/dist/analysis/const-table-lookup.d.ts.map +1 -0
  6. package/dist/analysis/const-table-lookup.js +145 -0
  7. package/dist/analysis/const-table-lookup.js.map +1 -0
  8. package/dist/analysis/findings.d.ts.map +1 -1
  9. package/dist/analysis/findings.js +15 -4
  10. package/dist/analysis/findings.js.map +1 -1
  11. package/dist/analysis/go-strings-replacer.d.ts +21 -0
  12. package/dist/analysis/go-strings-replacer.d.ts.map +1 -0
  13. package/dist/analysis/go-strings-replacer.js +145 -0
  14. package/dist/analysis/go-strings-replacer.js.map +1 -0
  15. package/dist/analysis/interprocedural.d.ts.map +1 -1
  16. package/dist/analysis/interprocedural.js +53 -0
  17. package/dist/analysis/interprocedural.js.map +1 -1
  18. package/dist/analysis/java-canonical-prefix.d.ts +42 -0
  19. package/dist/analysis/java-canonical-prefix.d.ts.map +1 -0
  20. package/dist/analysis/java-canonical-prefix.js +145 -0
  21. package/dist/analysis/java-canonical-prefix.js.map +1 -0
  22. package/dist/analysis/java-crlf-strip.d.ts +30 -0
  23. package/dist/analysis/java-crlf-strip.d.ts.map +1 -0
  24. package/dist/analysis/java-crlf-strip.js +195 -0
  25. package/dist/analysis/java-crlf-strip.js.map +1 -0
  26. package/dist/analysis/passes/cleartext-credential-transport-pass.d.ts +2 -0
  27. package/dist/analysis/passes/cleartext-credential-transport-pass.d.ts.map +1 -1
  28. package/dist/analysis/passes/cleartext-credential-transport-pass.js +64 -12
  29. package/dist/analysis/passes/cleartext-credential-transport-pass.js.map +1 -1
  30. package/dist/analysis/passes/cross-file-pass.d.ts.map +1 -1
  31. package/dist/analysis/passes/cross-file-pass.js +43 -0
  32. package/dist/analysis/passes/cross-file-pass.js.map +1 -1
  33. package/dist/analysis/passes/csharp-sanitizer-credit.d.ts.map +1 -1
  34. package/dist/analysis/passes/csharp-sanitizer-credit.js +18 -0
  35. package/dist/analysis/passes/csharp-sanitizer-credit.js.map +1 -1
  36. package/dist/analysis/passes/insecure-cookie-pass.d.ts +11 -4
  37. package/dist/analysis/passes/insecure-cookie-pass.d.ts.map +1 -1
  38. package/dist/analysis/passes/insecure-cookie-pass.js +30 -15
  39. package/dist/analysis/passes/insecure-cookie-pass.js.map +1 -1
  40. package/dist/analysis/passes/interprocedural-pass.d.ts +28 -0
  41. package/dist/analysis/passes/interprocedural-pass.d.ts.map +1 -1
  42. package/dist/analysis/passes/interprocedural-pass.js +31 -3
  43. package/dist/analysis/passes/interprocedural-pass.js.map +1 -1
  44. package/dist/analysis/passes/language-sources-pass.d.ts +41 -2
  45. package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
  46. package/dist/analysis/passes/language-sources-pass.js +894 -10
  47. package/dist/analysis/passes/language-sources-pass.js.map +1 -1
  48. package/dist/analysis/passes/param-source-flow-gate-pass.d.ts +8 -0
  49. package/dist/analysis/passes/param-source-flow-gate-pass.d.ts.map +1 -1
  50. package/dist/analysis/passes/param-source-flow-gate-pass.js +162 -6
  51. package/dist/analysis/passes/param-source-flow-gate-pass.js.map +1 -1
  52. package/dist/analysis/passes/scan-secrets-pass.d.ts.map +1 -1
  53. package/dist/analysis/passes/scan-secrets-pass.js +24 -3
  54. package/dist/analysis/passes/scan-secrets-pass.js.map +1 -1
  55. package/dist/analysis/passes/sink-filter-pass.d.ts +1 -1
  56. package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
  57. package/dist/analysis/passes/sink-filter-pass.js +255 -25
  58. package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
  59. package/dist/analysis/passes/taint-propagation-pass.d.ts.map +1 -1
  60. package/dist/analysis/passes/taint-propagation-pass.js +268 -5
  61. package/dist/analysis/passes/taint-propagation-pass.js.map +1 -1
  62. package/dist/analysis/scalar-derivation.d.ts +25 -0
  63. package/dist/analysis/scalar-derivation.d.ts.map +1 -0
  64. package/dist/analysis/scalar-derivation.js +196 -0
  65. package/dist/analysis/scalar-derivation.js.map +1 -0
  66. package/dist/analysis/taint-matcher.d.ts.map +1 -1
  67. package/dist/analysis/taint-matcher.js +172 -8
  68. package/dist/analysis/taint-matcher.js.map +1 -1
  69. package/dist/analysis/taint-propagation.d.ts +9 -0
  70. package/dist/analysis/taint-propagation.d.ts.map +1 -1
  71. package/dist/analysis/taint-propagation.js +260 -11
  72. package/dist/analysis/taint-propagation.js.map +1 -1
  73. package/dist/analyzer.d.ts.map +1 -1
  74. package/dist/analyzer.js +8 -1
  75. package/dist/analyzer.js.map +1 -1
  76. package/dist/browser/circle-ir.js +3403 -1225
  77. package/dist/core/circle-ir-core.cjs +598 -26
  78. package/dist/core/circle-ir-core.js +598 -26
  79. package/dist/core/extractors/calls.js +19 -0
  80. package/dist/core/extractors/calls.js.map +1 -1
  81. package/dist/core/extractors/dfg.js +240 -6
  82. package/dist/core/extractors/dfg.js.map +1 -1
  83. package/dist/graph/code-graph.d.ts +9 -0
  84. package/dist/graph/code-graph.d.ts.map +1 -1
  85. package/dist/graph/code-graph.js +11 -0
  86. package/dist/graph/code-graph.js.map +1 -1
  87. package/dist/languages/plugins/go.d.ts.map +1 -1
  88. package/dist/languages/plugins/go.js +19 -0
  89. package/dist/languages/plugins/go.js.map +1 -1
  90. package/dist/resolution/cross-file.d.ts +7 -0
  91. package/dist/resolution/cross-file.d.ts.map +1 -1
  92. package/dist/resolution/cross-file.js +10 -1
  93. package/dist/resolution/cross-file.js.map +1 -1
  94. package/dist/wasm/web-tree-sitter.wasm +0 -0
  95. package/package.json +3 -3
package/dist/analysis/config-loader.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA60B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAkrEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
1
+ {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA60B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAyrEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
package/dist/analysis/config-loader.js CHANGED
@@ -1337,8 +1337,15 @@ export const DEFAULT_SINKS = [
1337
1337
  { method: 'setExpireTimeSeconds', class: 'StaticFilesConfiguration', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [0] },
1338
1338
  { method: 'configureJarCase', class: 'StaticFilesConfiguration', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
1339
1339
  { method: 'toString', class: 'StringUtils', type: 'path_traversal', cwe: 'CWE-22', severity: 'medium', arg_positions: [0] },
1340
- // Wildfly/Undertow servlet resource manager
1341
- { method: 'getResource', class: 'ServletResourceManager', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
1340
+ // Wildfly/Undertow servlet resource manager.
1341
+ // ResourceManager / PathResourceManager / FileResourceManager /
1342
+ // ClassPathResourceManager are the interface and implementations WildFly
1343
+ // calls through (cognium-dev#622, CVE-2018-1047). Class-qualified only.
1344
+ { method: 'getResource', class: 'ServletResourceManager', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['java'] },
1345
+ { method: 'getResource', class: 'ResourceManager', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['java'] },
1346
+ { method: 'getResource', class: 'PathResourceManager', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['java'] },
1347
+ { method: 'getResource', class: 'FileResourceManager', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['java'] },
1348
+ { method: 'getResource', class: 'ClassPathResourceManager', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['java'] },
1342
1349
  // Yamcs file system bucket
1343
1350
  { method: 'deleteObject', class: 'FileSystemBucket', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
1344
1351
  // RocketMQ validators