circle-ir 4.14.1 → 4.15.0

package/dist/analysis/passes/sink-filter-pass.js

@@ -20,6 +20,7 @@ import { JS_TAINTED_PATTERNS } from './language-sources-pass.js';
 import { LIBRARY_API_SURFACE_TAG } from '../library-api-surface-downgrade.js';
 import { isNonExecutableSourceLine } from '../non-executable-lines.js';
 import { sanitizerCoversSink } from '../sanitizer-index.js';
+import { identifierOutsideSanitizerCalls } from '../taint-propagation.js';
 import { resolveIdentifierType, resolveCallReturnType, isArgvContainerType, } from '../arg-type-resolver.js';
 /** Escape regex metacharacters for safe pattern building. */
 function escapeReSf(s) {
@@ -463,6 +464,110 @@ const SERVER_SIGNAL_RE = /["']use server["']|\b(?:getServerSideProps|getStaticPr
 // interpolated, the destination host is not attacker-controlled. Matches a
 // backtick + scheme + a literal host run (no `${` before the first `/`).
 const FIXED_HOST_TEMPLATE_RE = /`https?:\/\/[^/${}\s`]+[/`]/;
+/** A bash URL word whose scheme and host are literal and closed by `/` (#495). */
+const BASH_FIXED_HOST_URL_RE = /^(?:https?|ftp):\/\/[A-Za-z0-9.-]+(?::\d+)?\//;
+/**
+ * True when the string literal that ended at `end` is the WHOLE initializer:
+ * the next code token is `;`, `,`, end of input, or (ASI) a token on a later
+ * line that cannot continue the expression. A same-line operator (`+`, `.`,
+ * `||` …) or a next-line `+` / `.` / `(` / `[` / template continuation means
+ * the literal is only the start of a larger expression, so it is not a
+ * constant. An optional TS `as const` / `as string` suffix is skipped (it may
+ * sit on the next line).
+ * (cognium-dev#680, #681)
+ */
+function literalEndsInitializer(code, end) {
+    let i = end;
+    let crossedNewline = false;
+    const asConst = /^\s+as\s+(?:const|string)\b/.exec(code.slice(i, i + 64));
+    if (asConst) {
+        i += asConst[0].length;
+        crossedNewline = asConst[0].includes('\n');
+    }
+    for (;;) {
+        while (i < code.length && /\s/.test(code[i])) {
+            if (code[i] === '\n')
+                crossedNewline = true;
+            i++;
+        }
+        if (code.startsWith('//', i)) {
+            const nl = code.indexOf('\n', i);
+            i = nl === -1 ? code.length : nl;
+        }
+        else if (code.startsWith('/*', i)) {
+            const close = code.indexOf('*/', i + 2);
+            if (close === -1)
+                return false;
+            if (code.slice(i, close).includes('\n'))
+                crossedNewline = true;
+            i = close + 2;
+        }
+        else
+            break;
+    }
+    if (i >= code.length)
+        return true;
+    const c = code[i];
+    if (c === ';' || c === ',')
+        return true;
+    // ASI: a following line that begins a new statement terminates the initializer.
+    // A line that starts with `as` / `satisfies` / `in` / `instanceof` continues it.
+    if (/^(?:as|satisfies|in|instanceof)(?![\w$])/.test(code.slice(i, i + 12)))
+        return false;
+    return crossedNewline && !/[-+*/%.?:|&<>=!~^(\[`]/.test(c);
+}
+/** Decode `\xNN` / `\uNNNN` / `\u{…}` JS string escapes; other escapes are kept verbatim. */
+function decodeJsHexEscapes(value) {
+    return value.replace(/\\(?:x([0-9a-fA-F]{2})|u([0-9a-fA-F]{4})|u\{([0-9a-fA-F]{1,6})\}|[\s\S])/g, (m, x, u4, ub) => {
+        const hex = x ?? u4 ?? ub;
+        if (hex === undefined)
+            return m;
+        const cp = parseInt(hex, 16);
+        return cp <= 0x10ffff ? String.fromCodePoint(cp) : m;
+    });
+}
+/**
+ * The value of `name` when it is bound exactly once in the file, by `const`,
+ * to a plain string literal (no interpolation) that is the whole initializer,
+ * and has no other `let` / `var` / `function` binding; otherwise null.
+ * (cognium-dev#681)
+ */
+function constStringLiteralValue(code, name) {
+    const esc = name.replace(/\$/g, '\\$');
+    const decl = new RegExp(`(?:^|[^\\w$.])const\\s+${esc}\\s*(?::\\s*string\\s*)?=\\s*(?:'((?:\\\\.|[^'\\\\\\n])*)'|"((?:\\\\.|[^"\\\\\\n])*)"|\`([^\`$\\\\]*)\`)`, 'g');
+    const decls = [...code.matchAll(decl)];
+    if (decls.length !== 1)
+        return null;
+    if (!literalEndsInitializer(code, decls[0].index + decls[0][0].length))
+        return null;
+    const anyBinding = new RegExp(`(?:^|[^\\w$.])(?:const|let|var|function)\\s+${esc}\\b`, 'g');
+    if ([...code.matchAll(anyBinding)].length !== 1)
+        return null;
+    return decodeJsHexEscapes(decls[0][1] ?? decls[0][2] ?? decls[0][3] ?? '');
+}
+/** A group that holds an unbounded quantifier and is itself quantified: `(a+)+`, `(x*)*`, `(\w{2,})+`, `(a+){2,}`. */
+const NESTED_QUANTIFIER_RE = /\([^()]*(?:[+*]|\{\d+,\d*\})[^()]*\)\s*[+*{]/;
+/** A template literal that starts with `${IDENT}/` (cognium-dev#680). */
+const CONST_BASE_TEMPLATE_RE = /`\$\{\s*([A-Za-z_$][\w$]*)\s*\}\//g;
+/**
+ * True when `name` is bound exactly once in the file, by `const`, to a string
+ * literal http(s) origin with a literal host, and is never reassigned.
+ */
+function isConstLiteralOrigin(code, name) {
+    const esc = name.replace(/\$/g, '\\$');
+    const decl = new RegExp(`(?:^|[^\\w$.])(const|let|var)\\s+${esc}\\s*(?::\\s*string\\s*)?=\\s*(['"\`])(https?://[^/'"\`\\s$]+(?:/[^'"\`$]*)?)\\2`, 'gm');
+    const decls = [...code.matchAll(decl)];
+    if (decls.length !== 1 || decls[0][1] !== 'const')
+        return false;
+    if (!literalEndsInitializer(code, decls[0].index + decls[0][0].length))
+        return false;
+    const anyBinding = new RegExp(`(?:^|[^\\w$.])(?:const|let|var)\\s+${esc}\\b`, 'g');
+    if ([...code.matchAll(anyBinding)].length !== 1)
+        return false;
+    const reassign = new RegExp(`(?:^|[^\\w$.])${esc}\\s*(?:[-+]?=)(?!=)`, 'g');
+    const rest = code.slice(0, decls[0].index) + code.slice(decls[0].index + decls[0][0].length);
+    return !reassign.test(rest);
+}
 /**
  * Returns the 1-indexed line numbers that a Java `if (x.contains("..")) throw/
  * return` reject-guard makes path-traversal-safe (cognium-dev#269). A line is
@@ -655,6 +760,33 @@ function isUnwrittenLocalMapKeyRead(code, source) {
         return false;
     return true;
 }
+/**
+ * Is this C# `Content(...)` call the controller helper writing an HTML body
+ * (cognium-dev#580)?
+ *
+ *   - The helper is inherited (`ControllerBase.Content`, `PageModel.Content`),
+ *     so it is called unqualified or on `this` / `base`. `note.Content(q)` is
+ *     some other type's method.
+ *   - The content type is argument 1. A literal or `MediaTypeNames` constant
+ *     that is not HTML or a script-capable XML type serves the body as data. A computed content type is unknown and keeps the sink, as does the
+ *     one-argument overload.
+ */
+function csharpContentServesHtml(call) {
+    if (call.receiver !== null && call.receiver !== 'this' && call.receiver !== 'base')
+        return false;
+    const contentType = call.arguments.find(a => a.position === 1)?.expression.trim();
+    if (contentType === undefined)
+        return true;
+    const literal = /^@?"([^"]*)"$/.exec(contentType);
+    // XML types (`text/xml`, `application/xml`, `image/svg+xml`, any `+xml`)
+    // render XHTML / SVG markup and run its scripts, so they count as HTML.
+    if (literal)
+        return /^\s*(?:text\/html|text\/xml|application\/xml|[\w.-]+\/[\w.-]+\+xml)\b/i.test(literal[1]);
+    const named = /^(?:System\s*\.\s*Net\s*\.\s*Mime\s*\.\s*)?MediaTypeNames\s*\.\s*(Text|Application)\s*\.\s*(\w+)$/.exec(contentType);
+    if (named)
+        return named[2] === 'Html' || named[2] === 'Xml';
+    return true;
+}
 /**
  * Compute, per sink type, the set of C# variables whose value has passed through
  * a sanitizer for that type (cognium-dev C#/.NET Phase-1). Seeds from
@@ -1059,8 +1191,9 @@ export class SinkFilterPass {
         filtered = filterCleanArraySinks(filtered, calls, constProp.taintedArrayElements, constProp.symbols);
         // Stage 3 — clean variables
         filtered = filterCleanVariableSinks(filtered, calls, constProp.tainted, constProp.symbols, dfg, constProp.sanitizedVars, constProp.synchronizedLines, language);
-        // Stage 4 — sanitized sinks
-        filtered = filterSanitizedSinks(filtered, sanitizers, calls);
+        // Stage 4 — sanitized sinks. A sanitizer on one operand does not drop
+        // the sink while another source operand is still raw (#641).
+        filtered = filterSanitizedSinks(filtered, sanitizers, calls, sources);
         // Stage 5 — Python XPath FP reduction
         if (language === 'python') {
             const { pyTaintedVars, pySanitizedVars } = langSources;
@@ -1166,9 +1299,17 @@ export class SinkFilterPass {
                 if (sink.type !== 'xss')
                     return true;
                 const sinkLineText = sourceLines[sink.line - 1] ?? '';
-                // 6a. If a sanitizer is used on this line, suppress the finding
-                if (JS_XSS_SANITIZERS.some(p => p.test(sinkLineText)))
-                    return false;
+                // 6a. If a sanitizer is used on this line, suppress the finding.
+                // The sanitizer covers its own operand. A source operand that is
+                // still outside that call keeps the sink (#641).
+                if (JS_XSS_SANITIZERS.some(p => p.test(sinkLineText))) {
+                    const callsAtSink = callsByLine.get(sink.line) ?? [];
+                    const covering = sanitizers.filter(s => s.line === sink.line && sanitizerCoversSink(s, sink.type));
+                    const rawOperand = sources.some(s => !!s.variable &&
+                        identifierOutsideSanitizerCalls(s.variable, callsAtSink, covering, sink.type));
+                    if (!rawOperand)
+                        return false;
+                }
                 // 6b. If the RHS is a pure string literal, suppress (e.g., `.innerHTML = "<div>Hello</div>"`)
                 //     Match: `.innerHTML = "..."` or `.innerHTML = '...'` or `.innerHTML = `...``
                 const assignmentMatch = sinkLineText.match(/\.(?:innerHTML|outerHTML)\s*=\s*(.+)/);
@@ -2032,7 +2173,51 @@ export class SinkFilterPass {
                 if (sink.type !== 'ssrf')
                     return true;
                 const sinkLineText = sourceLines[sink.line - 1] ?? '';
-                return !FIXED_HOST_TEMPLATE_RE.test(sinkLineText);
+                if (FIXED_HOST_TEMPLATE_RE.test(sinkLineText))
+                    return false;
+                // `${API_BASE}/path` where API_BASE is bound once by `const` to a
+                // literal origin: the authority is constant and closed by `/` (#680).
+                for (const m of sinkLineText.matchAll(CONST_BASE_TEMPLATE_RE)) {
+                    if (isConstLiteralOrigin(ctx.code, m[1]))
+                        return false;
+                }
+                return true;
+            });
+        }
+        // Stage 15k — JS/TS redos: `new RegExp(`…${CONST}…`)` whose every
+        // interpolation is a module `const` bound to a string literal has a
+        // constant pattern; a tainted subject alone is not ReDoS. (cognium-dev#681)
+        if (['javascript', 'typescript'].includes(language)) {
+            const sourceLines = ctx.code.split('\n');
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'redos')
+                    return true;
+                const m = (sourceLines[sink.line - 1] ?? '').match(/new\s+RegExp\s*\(\s*`((?:\\.|[^`\\])*)`/);
+                if (!m)
+                    return true;
+                let pattern = m[1];
+                let interpolations = 0;
+                let allConst = true;
+                // Replace each `${ NAME }` as written (whitespace inside the braces
+                // included) by the const's literal value.
+                pattern = pattern.replace(/\$\{([^}]*)\}/g, (_full, raw) => {
+                    interpolations++;
+                    const name = raw.trim();
+                    if (!/^[A-Za-z_$][\w$]*$/.test(name)) {
+                        allConst = false;
+                        return '';
+                    }
+                    const value = constStringLiteralValue(ctx.code, name);
+                    if (value === null) {
+                        allConst = false;
+                        return '';
+                    }
+                    return value;
+                });
+                if (interpolations === 0 || !allConst)
+                    return true;
+                // A constant pattern can still backtrack on a tainted subject.
+                return NESTED_QUANTIFIER_RE.test(pattern);
             });
         }
         // Stage 15f — JS/TS ssrf: anchored host allow-list reject-guard.
@@ -2108,6 +2293,37 @@ export class SinkFilterPass {
                 return !covered || credit.rawTaintReaches(sink.type, sink.line, sanitizedVars, csSeeds);
             });
         }
+        // Stage 15k' — C# `Content(body, contentType)` serves HTML only when the
+        // content type is HTML (cognium-dev#580). The `Content` xss sink stays when
+        // at least one `Content` call on its line is the controller helper with an
+        // HTML or unknown content type.
+        if (language === 'csharp') {
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'xss' || sink.method !== 'Content')
+                    return true;
+                const contentCalls = callsByLine.get(sink.line)?.filter(c => c.method_name === 'Content') ?? [];
+                return contentCalls.length === 0 || contentCalls.some(csharpContentServesHtml);
+            });
+        }
+        // Stage 15m — bash ssrf: fixed-host URL word (cognium-dev#495, #669).
+        // The bash analogue of Stage 15i: `curl -- "https://api.example.com/${p}"`
+        // can only reach the literal host, whatever `$p` holds. Every word on the
+        // line that expands a variable must be such a URL; a word like `"$url"`,
+        // `"https://${host}/x"` or `"https://api.example.com${p}"` (no `/` to
+        // close the authority, so `$p` may be `@evil.com`) keeps the sink.
+        if (language === 'bash') {
+            const sourceLines = ctx.code.split('\n');
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'ssrf')
+                    return true;
+                const words = (sourceLines[sink.line - 1] ?? '').match(/"[^"]*"|'[^']*'|[^\s"']+/g) ?? [];
+                const expanding = words.filter(w => !w.startsWith("'") && w.includes('$'));
+                // Unquoted (`https://h/$p`), the expansion is word-split, so `$p`
+                // can add a second URL or a flag: only a double-quoted word counts.
+                return expanding.length === 0 ||
+                    !expanding.every(w => w.startsWith('"') && BASH_FIXED_HOST_URL_RE.test(w.slice(1, -1)));
+            });
+        }
         // Stage 15l — C# ssrf: HttpClient with a constant BaseAddress and a
         // relative request path. (cognium-dev#286 D)
         //
@@ -2881,9 +3097,14 @@ export function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg
         return true;
     });
 }
-export function filterSanitizedSinks(sinks, sanitizers, calls) {
+export function filterSanitizedSinks(sinks, sanitizers, calls, sources) {
     if (!sanitizers || sanitizers.length === 0)
         return sinks;
+    const sourceVars = [];
+    for (const source of sources ?? []) {
+        if (source.variable && /^[A-Za-z_$][\w$]*$/.test(source.variable))
+            sourceVars.push(source.variable);
+    }
     const sanitizersByLine = new Map();
     for (const san of sanitizers) {
         const existing = sanitizersByLine.get(san.line) ?? [];
@@ -2900,24 +3121,33 @@ export function filterSanitizedSinks(sinks, sanitizers, calls) {
         const lineSanitizers = sanitizersByLine.get(sink.line);
         if (!lineSanitizers || lineSanitizers.length === 0)
             return true;
-        for (const san of lineSanitizers) {
-            if (sanitizerCoversSink(san, sink.type)) {
-                const lineCalls = callsByLine.get(sink.line) ?? [];
-                for (const call of lineCalls) {
-                    for (const arg of call.arguments) {
-                        const expr = arg.expression || '';
-                        const sanMethodMatch = san.method.match(/(?:(\w+)\.)?(\w+)\(\)/);
-                        if (sanMethodMatch) {
-                            const sanMethodName = sanMethodMatch[2];
-                            const sanClassName = sanMethodMatch[1];
-                            if (sanClassName) {
-                                if (expr.includes(`${sanClassName}.${sanMethodName}(`))
-                                    return false;
-                            }
-                            else if (expr.includes(`${sanMethodName}(`)) {
-                                return false;
-                            }
-                        }
+        const lineCalls = callsByLine.get(sink.line) ?? [];
+        const covering = lineSanitizers.filter(san => sanitizerCoversSink(san, sink.type));
+        if (covering.length === 0)
+            return true;
+        // A raw source operand keeps the sink (#641). The fully wrapped twin,
+        // and a sanitizer call with no known source operand, still drops it.
+        for (const variable of sourceVars) {
+            if (identifierOutsideSanitizerCalls(variable, lineCalls, covering, sink.type))
+                return true;
+        }
+        for (const san of covering) {
+            const sanMethodMatch = san.method.match(/(?:(\w+)\.)?(\w+)\(\)/);
+            if (!sanMethodMatch)
+                continue;
+            const sanMethodName = sanMethodMatch[2];
+            const sanClassName = sanMethodMatch[1];
+            for (const call of lineCalls) {
+                if (call.method_name === sanMethodName)
+                    continue;
+                for (const arg of call.arguments) {
+                    const expr = arg.expression || '';
+                    if (sanClassName) {
+                        if (expr.includes(`${sanClassName}.${sanMethodName}(`))
+                            return false;
+                    }
+                    else if (expr.includes(`${sanMethodName}(`)) {
+                        return false;
                     }
                 }
             }