circle-ir 4.14.1 → 4.15.0

package/dist/analysis/scalar-derivation.js

@@ -0,0 +1,196 @@
+/**
+ * Scalar-derivation taint barrier (#568, parent #349).
+ *
+ * A local whose whole initializer measures or tests a value — its length, a
+ * match count, a boolean from a regex test or a containment check — holds an
+ * integer or a boolean. That value carries the magnitude of the input, not
+ * its content, so it cannot deliver a string payload to an injection sink.
+ *
+ * This is a type rule, not sanitizer credit for the call: a string-returning
+ * matcher (`re.FindString(text)`, `text.match(re)`) still propagates taint.
+ * Numeric parses (`strconv.Atoi`, `parseInt`) are not covered here; a parsed
+ * number is attacker-chosen and stays tainted for size-sensitive consumers.
+ *
+ * The test reads the definition's own line. An initializer that is not a
+ * single complete expression on that line is not credited.
+ */
+/** Go calls that return an int or a bool computed from their argument. */
+const GO_SCALAR_FUNCS = new Set(['len', 'utf8.RuneCountInString', 'utf8.RuneCount']);
+/** `strings.X` / `bytes.X` functions with an int or bool result. */
+const GO_STRINGS_SCALAR = new Set([
+    'Contains', 'ContainsAny', 'ContainsRune', 'HasPrefix', 'HasSuffix', 'EqualFold',
+    'Count', 'Index', 'IndexAny', 'IndexByte', 'IndexRune', 'LastIndex', 'Compare',
+]);
+/** `*regexp.Regexp` methods with a bool result, on any receiver. */
+const GO_REGEXP_BOOL = new Set(['MatchString', 'Match']);
+/**
+ * JS/TS members that yield a number or a boolean. `search` is left out: on
+ * search-index objects (`idx.search(q)`) it returns result data, not a number.
+ */
+const JS_SCALAR_METHODS = new Set([
+    'test', 'includes', 'startsWith', 'endsWith', 'indexOf', 'lastIndexOf',
+]);
+function scalarLanguage(language) {
+    return language === 'go' || language === 'javascript' || language === 'typescript' ? language : null;
+}
+/**
+ * Split `expr` at depth 0 into its trailing segment. Returns null when the
+ * expression is not one postfix chain (an operator, a comma, whitespace or an
+ * unbalanced bracket at depth 0).
+ *
+ * The result names the last member, whether the chain ends in a call of it,
+ * and `head`, the chain text before that call (or before `.member`). A JS
+ * regex literal may open the chain (`/^\d+$/.test(x)`).
+ */
+function lastChainSegment(expr) {
+    let depth = 0;
+    let lastDot = -1;
+    let lastGroupOpen = -1;
+    let endsWithGroup = false;
+    let start = 0;
+    if (expr.startsWith('/')) {
+        let inClass = false;
+        let j = 1;
+        for (; j < expr.length; j++) {
+            const ch = expr[j];
+            if (ch === '\\') {
+                j++;
+                continue;
+            }
+            if (ch === '[')
+                inClass = true;
+            else if (ch === ']')
+                inClass = false;
+            else if (ch === '/' && !inClass)
+                break;
+        }
+        if (j >= expr.length)
+            return null;
+        start = j + 1;
+    }
+    for (let i = start; i < expr.length; i++) {
+        const c = expr[i];
+        if (c === '"' || c === "'" || c === '`') {
+            if (c === '`' && depth === 0)
+                return null; // template text may interpolate
+            let j = i + 1;
+            for (; j < expr.length && expr[j] !== c; j++)
+                if (expr[j] === '\\')
+                    j++;
+            if (j >= expr.length)
+                return null;
+            i = j;
+            endsWithGroup = false;
+            continue;
+        }
+        if (c === '(' || c === '[' || c === '{') {
+            if (depth === 0)
+                lastGroupOpen = i;
+            depth++;
+            continue;
+        }
+        if (c === ')' || c === ']' || c === '}') {
+            depth--;
+            if (depth < 0)
+                return null;
+            if (depth === 0)
+                endsWithGroup = true;
+            continue;
+        }
+        if (depth > 0)
+            continue;
+        if (c === '.') {
+            // `?.` optional chaining is still one chain
+            lastDot = i;
+            endsWithGroup = false;
+            continue;
+        }
+        if (c === '?' && expr[i + 1] === '.')
+            continue;
+        if (/[\w$]/.test(c)) {
+            endsWithGroup = false;
+            continue;
+        }
+        return null;
+    }
+    if (depth !== 0)
+        return null;
+    if (endsWithGroup) {
+        // Trailing `( … )` must be the call of the last member.
+        if (expr[lastGroupOpen] !== '(')
+            return null;
+        const callee = expr.slice(0, lastGroupOpen).replace(/\?$/, '');
+        const m = /(?:^|\.)([\w$]+)$/.exec(callee);
+        if (!m || lastDot > lastGroupOpen)
+            return null;
+        return { member: m[1], isCall: true, head: callee };
+    }
+    const m = /\.([\w$]+)$/.exec(expr);
+    if (!m)
+        return null;
+    return { member: m[1], isCall: false, head: expr.slice(0, expr.length - m[0].length) };
+}
+/** True when `rhs` is a whole-expression measure or test of a value. */
+export function isScalarDerivation(rhs, language) {
+    const lang = scalarLanguage(language);
+    if (!lang)
+        return false;
+    let e = rhs.trim();
+    // A leading negation keeps a boolean a boolean.
+    while (e.startsWith('!'))
+        e = e.slice(1).trim();
+    if (e.length === 0)
+        return false;
+    const seg = lastChainSegment(e);
+    if (!seg)
+        return false;
+    if (lang === 'go') {
+        if (!seg.isCall)
+            return false;
+        if (GO_SCALAR_FUNCS.has(seg.head))
+            return true;
+        const pkg = /^(strings|bytes)\.(\w+)$/.exec(seg.head);
+        if (pkg)
+            return GO_STRINGS_SCALAR.has(pkg[2]);
+        return seg.head.includes('.') && GO_REGEXP_BOOL.has(seg.member);
+    }
+    if (!seg.isCall)
+        return seg.member === 'length';
+    return seg.head.includes('.') && JS_SCALAR_METHODS.has(seg.member);
+}
+/**
+ * The initializer of a single-variable local declared or assigned on `line`,
+ * or null when the line is not a complete single-target assignment of `name`.
+ */
+function initializerOf(line, name, lang) {
+    const esc = name.replace(/[$]/g, '\\$');
+    const code = line.replace(/\s*\/\/.*$/, '').trim().replace(/;$/, '').trim();
+    const re = lang === 'go'
+        ? new RegExp(`^(?:var\\s+)?${esc}(?:\\s+\\w+)?\\s*(?::=|=)\\s*(.+)$`)
+        : new RegExp(`^(?:(?:const|let|var)\\s+)?${esc}(?:\\s*:\\s*(?:number|boolean))?\\s*=(?!=)\\s*(.+)$`);
+    const m = re.exec(code);
+    return m ? m[1] : null;
+}
+/**
+ * DFG def ids whose value is an integer or boolean derived from another value
+ * by a whole-expression measure or test. Taint does not flow into these defs.
+ */
+export function scalarDerivedDefIds(defs, code, language) {
+    const out = new Set();
+    const lang = scalarLanguage(language);
+    if (!lang)
+        return out;
+    const lines = code.split('\n');
+    for (const def of defs) {
+        if (def.kind !== 'local')
+            continue;
+        const text = lines[def.line - 1];
+        if (text === undefined)
+            continue;
+        const rhs = initializerOf(text, def.variable, lang);
+        if (rhs !== null && isScalarDerivation(rhs, lang))
+            out.add(def.id);
+    }
+    return out;
+}
+//# sourceMappingURL=scalar-derivation.js.map

package/dist/analysis/scalar-derivation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scalar-derivation.js","sourceRoot":"","sources":["../../src/analysis/scalar-derivation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,0EAA0E;AAC1E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,wBAAwB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACrF,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAChF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS;CAC/E,CAAC,CAAC;AACH,oEAAoE;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa;CACvE,CAAC,CAAC;AAIH,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACpB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnC,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAC1B,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,GAAG,KAAK,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO;gBAAE,MAAM;QACzC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAClC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,gCAAgC;YAC3E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAClC,CAAC,GAAG,CAAC,CAAC;YACN,aAAa,GAAG,KAAK,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,KAAK,KAAK,CAAC;gBAAE,aAAa,GAAG,CAAC,CAAC;YACnC,KAAK,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3B,IAAI,KAAK,KAAK,CAAC;gBAAE,aAAa,GAAG,IAAI,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,4CAA4C;YAC5C,OAAO,GAAG,CAAC,CAAC;YACZ,aAAa,GAAG,KAAK,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS;QAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,aAAa,GAAG,KAAK,CAAC;YACtB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,aAAa,EAAE,CAAC;QAClB,wDAAwD;QACxD,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,OAAO,GAAG,aAAa;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,QAAgB;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,gDAAgD;IAChD,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,GAAG;YAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC;IAChD,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,IAAU;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,EAAE,GAAG,IAAI,KAAK,IAAI;QACtB,CAAC,CAAC,IAAI,MAAM,CAAC,gBAAgB,GAAG,oCAAoC,CAAC;QACrE,CAAC,CAAC,IAAI,MAAM,CAAC,8BAA8B,GAAG,qDAAqD,CAAC,CAAC;IACvG,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB,EAAE,IAAY,EAAE,QAAgB;IACzF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,IAAI,IAAI,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/analysis/taint-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAElK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAwF7E,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CAWP;AA0JD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AAsjGD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}
+{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAElK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAyF7E,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CAWP;AA0JD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AAgoGD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}

package/dist/analysis/taint-matcher.js

@@ -5,6 +5,7 @@
  */
 import { DOM_ASSIGNMENT_SINK_METHODS, isProvablyLiteralExpression } from './literal-expression.js';
 import { getDefaultConfig } from './config-loader.js';
+import { javaReplaceCrLfCoverage } from './java-crlf-strip.js';
 import { resolveIdentifierType, resolveCallReturnType, isBoundedClassType, } from './arg-type-resolver.js';
 /**
  * Python tainted access patterns (regex-based).
@@ -86,7 +87,7 @@ export function analyzeTaint(calls, types, config = getDefaultConfig(), typeHier
     sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
     const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
     const gatedSinks = language === 'csharp' ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
-    const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
+    const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines, language);
     return { sources, sinks: gatedSinks, sanitizers };
 }
 /**
@@ -735,8 +736,11 @@ function isParameterizedQueryCall(call, pattern) {
     // Arg-0 behaviour is unchanged: a placeholder literal plus any further
     // argument is parameterized. Context forms look at the query argument
     // the sink names, and require a bound argument after it.
-    const queryPos = pattern.arg_positions.length > 0
-        ? Math.min(...pattern.arg_positions)
+    // A sink loaded from an untyped rules file can omit `arg_positions`;
+    // treat that as empty, as the subtype-arity check does (#683).
+    const positions = pattern.arg_positions ?? [];
+    const queryPos = positions.length > 0
+        ? Math.min(...positions)
         : 0;
     const queryArg = call.arguments.find(a => a.position === queryPos);
     if (queryArg) {
@@ -1887,6 +1891,49 @@ function isGoFprintToNonResponseWriter(call, pattern, language, sourceLines) {
     }
     return true;
 }
+/**
+ * JDK types whose `getOutputStream()` is an outbound channel (a remote server,
+ * a peer socket, a child process) rather than the servlet response.
+ */
+const JAVA_OUTBOUND_STREAM_OWNERS = 'HttpURLConnection|HttpsURLConnection|URLConnection|JarURLConnection|Socket|SSLSocket|Process';
+/**
+ * #671 — true when a Java xss sink is `<base>.getOutputStream().<write>(...)`
+ * and `<base>` is declared in this file as a `URLConnection` / `Socket` /
+ * `Process` (or the chain is `….openConnection().getOutputStream()`). Bytes
+ * written there leave for another host or process; nothing is rendered in the
+ * requester's browser. Positive evidence only: an unresolved base keeps the
+ * sink.
+ */
+function isJavaOutboundOutputStreamWrite(call, pattern, language, sourceLines) {
+    if (language !== 'java' || pattern.type !== 'xss')
+        return false;
+    const receiver = (call.receiver ?? '').replace(/\s+/g, '');
+    if (!receiver.endsWith('.getOutputStream()'))
+        return false;
+    if (/\.openConnection\(\)\)?\.getOutputStream\(\)$/.test(receiver))
+        return true;
+    const m = receiver.match(/^\(?([A-Za-z_]\w*)\)?\.getOutputStream\(\)$/);
+    if (!m || !sourceLines)
+        return false;
+    const declRe = new RegExp(`\\b(?:[\\w.]+\\.)?(?:${JAVA_OUTBOUND_STREAM_OWNERS})\\s+${m[1]}\\s*[=;,)]`);
+    // Nearest declaration above the call wins; a re-declaration with another
+    // type (shadowing) stops the walk.
+    // `var x = …` (inferred type) also shadows, and its type is unknown here.
+    const anyDeclRe = new RegExp(`\\b(?:[A-Z][\\w.<>,\\[\\]]*|var)\\s+${m[1]}\\s*[=;,)]`);
+    for (let i = call.location.line - 1; i >= 0; i--) {
+        // Strip string literals, `//` comments and `/* … */` block comments so a
+        // commented-out declaration cannot match either regex.
+        const line = (sourceLines[i] ?? '')
+            .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+            .replace(/\/\*[\s\S]*?\*\//g, '')
+            .replace(/\/\/.*$/, '');
+        if (declRe.test(line))
+            return true;
+        if (anyDeclRe.test(line))
+            return false;
+    }
+    return false;
+}
 /**
  * Gate for Go `json.Unmarshal(data, &dst)` / `json.NewDecoder(r).Decode(&dst)`
  * deserialization (CWE-502) sinks. Returns `true` when the destination is a
@@ -2268,6 +2315,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
                 if (isGoFprintToNonResponseWriter(call, pattern, language, sourceLines)) {
                     continue;
                 }
+                // #671 — `conn.getOutputStream().write(...)` on an outbound
+                // URLConnection / Socket / Process writes to a remote peer or child
+                // process, not to the HTTP response. Not xss.
+                if (isJavaOutboundOutputStreamWrite(call, pattern, language, sourceLines)) {
+                    continue;
+                }
                 // #147 — Jinja2 safe render-context. Template("literal").render(**ctx)
                 // and render_template_string("literal", **ctx) and Template("literal")
                 // alone are safe: the template SOURCE is a constant string and Jinja2
@@ -2803,6 +2856,21 @@ function receiverMightBeClassImpl(receiver, className) {
     if (receiver === className) {
         return true;
     }
+    // Inline CommonJS require receiver: `require('child_process').exec(x)`.
+    // The module is named at the call, so match it as if it were bound to a
+    // name (`const cp = require('child_process'); cp.exec(x)`). (cognium-dev#682)
+    const inlineRequire = receiver.match(/^require\(\s*['"`](?:node:)?([\w./-]+)['"`]\s*\)$/);
+    if (inlineRequire && inlineRequire[1] === className) {
+        return true;
+    }
+    // Chained JDK ClassLoader accessors: `Thread.currentThread()
+    // .getContextClassLoader().loadClass(x)`, `getClass().getClassLoader()
+    // .loadClass(x)`, `ClassLoader.getSystemClassLoader().loadClass(x)`.
+    // These return a ClassLoader, so match the receiver as one. (cognium-dev#623)
+    if (className === 'ClassLoader' &&
+        /(?:^|\.)(?:getContextClassLoader|getClassLoader|getSystemClassLoader)\(\s*\)$/.test(receiver.replace(/\s+/g, ''))) {
+        return true;
+    }
     // Constructor-call receiver: `ClassName(args)` — Python `Path(raw)`,
     // JS `new URL(s)` (handled separately), etc. When the receiver is a
     // direct function call whose function name equals the target class
@@ -3192,8 +3260,11 @@ export function isInDangerousPosition(argPosition, pattern) {
 /**
  * Find sanitizers in method calls and annotated parameters.
  */
-function findSanitizers(calls, types, patterns, sourceLines) {
+function findSanitizers(calls, types, patterns, sourceLines, language) {
     const sanitizers = [];
+    const javaReplace = (call) => language === 'java' && sourceLines && (call.method_name === 'replace' || call.method_name === 'replaceAll')
+        ? javaReplaceChainCredit(javaChainTextAt(sourceLines, call.location.line, call.location.column))
+        : null;
     // Build a set of method names with @sanitizer annotation (from Javadoc comments)
     const sanitizerMethods = new Set();
     for (const type of types) {
@@ -3237,10 +3308,16 @@ function findSanitizers(calls, types, patterns, sourceLines) {
                 continue;
             const innerCall = inside[0];
             let matched;
-            for (const pattern of patterns) {
-                if (matchesSanitizerPattern(innerCall, pattern)) {
-                    matched = pattern;
-                    break;
+            const replaceCredit = javaReplace(innerCall);
+            if (replaceCredit) {
+                matched = replaceCredit.length > 0 ? { method: innerCall.method_name, removes: replaceCredit } : undefined;
+            }
+            else {
+                for (const pattern of patterns) {
+                    if (matchesSanitizerPattern(innerCall, pattern)) {
+                        matched = pattern;
+                        break;
+                    }
                 }
             }
             if (!matched || !matched.removes || matched.removes.length === 0)
@@ -3303,6 +3380,18 @@ function findSanitizers(calls, types, patterns, sourceLines) {
             });
             continue; // Skip pattern matching - already added as sanitizer
         }
+        const replaceCredit = javaReplace(call);
+        if (replaceCredit) {
+            if (replaceCredit.length > 0) {
+                sanitizers.push({
+                    type: 'method_call',
+                    method: formatSanitizerMethod(call),
+                    line: call.location.line,
+                    sanitizes: replaceCredit,
+                });
+            }
+            continue;
+        }
         for (const pattern of patterns) {
             if (matchesSanitizerPattern(call, pattern)) {
                 sanitizers.push({
@@ -3333,6 +3422,81 @@ function findSanitizers(calls, types, patterns, sourceLines) {
     }
     return sanitizers;
 }
+const JAVA_LIT = String.raw `(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)')`;
+const JAVA_REPLACE_ARGS_RE = new RegExp(String.raw `\.(replace|replaceAll)\(\s*${JAVA_LIT}\s*,\s*${JAVA_LIT}\s*\)`, 'g');
+/**
+ * The text of the call chain that starts at (line, column): the receiver
+ * expression plus the `.method(...)` segments after it, up to the first
+ * character that cannot continue the chain at nesting depth 0 (`;`, `,`, an
+ * operator, an unmatched closing bracket). A call reports the start of the
+ * whole chain it ends, so `a.replace("\n", "")` and `b.replace("\r", "")` on one
+ * line start at different columns and never credit each other. The chain may
+ * continue over following lines.
+ */
+function javaChainTextAt(sourceLines, line, column) {
+    const text = [(sourceLines[line - 1] ?? '').slice(column), ...sourceLines.slice(line, line + 7)].join('\n');
+    let depth = 0;
+    let i = 0;
+    for (; i < text.length; i++) {
+        const c = text[i];
+        if (c === '"' || c === "'") {
+            for (i++; i < text.length && text[i] !== c; i++)
+                if (text[i] === '\\')
+                    i++;
+            continue;
+        }
+        if (c === '(' || c === '[') {
+            depth++;
+            continue;
+        }
+        if (c === ')' || c === ']') {
+            if (depth === 0)
+                break;
+            depth--;
+            continue;
+        }
+        if (depth === 0 && !/[\w$.\s]/.test(c))
+            break;
+    }
+    return text.slice(0, i);
+}
+/**
+ * Java `String.replace` / `replaceAll` credit, decided from the literal
+ * arguments of the replace chain that contains the call instead of the method name
+ * (cognium-dev#562 / #605 / #517). The class-less `replace` row credited any
+ * replace as a log-injection sanitizer, so an LF-only strip silenced the
+ * finding while `replaceAll("[\r\n]", "")` got no credit at all.
+ *   - `log_injection`: the chain strips both CR and LF (double-quoted String or single-quoted char literals).
+ *   - `xss`: the chain maps both `<` and `>` to an entity.
+ * Returns the credited sink types (possibly empty).
+ */
+function javaReplaceChainCredit(chainText) {
+    let cr = false;
+    let lf = false;
+    let lt = false;
+    let gt = false;
+    for (const m of chainText.matchAll(JAVA_REPLACE_ARGS_RE)) {
+        const kind = m[1];
+        const rawFrom = m[2] ?? m[3] ?? '';
+        const from = rawFrom.replace(/\\\\/g, '\\');
+        const to = m[4] ?? m[5] ?? '';
+        const cov = javaReplaceCrLfCoverage(kind, rawFrom);
+        if (cov.cr)
+            cr = true;
+        if (cov.lf)
+            lf = true;
+        if (from === '<' && to.startsWith('&'))
+            lt = true;
+        if (from === '>' && to.startsWith('&'))
+            gt = true;
+    }
+    const out = [];
+    if (cr && lf)
+        out.push('log_injection');
+    if (lt && gt)
+        out.push('xss');
+    return out;
+}
 /**
  * Check if a call matches a sanitizer pattern.
  */