circle-ir 4.14.2 → 4.16.0

package/configs/sinks/golang.json

@@ -169,14 +169,14 @@
     {
       "method": "EscapeString",
       "class": "html",
-      "removes": ["xss", "external_taint_escape", "log_injection", "open_redirect"],
-      "note": "html.EscapeString escapes HTML entities — safe for HTML output and structured logs"
+      "removes": ["xss", "external_taint_escape", "open_redirect"],
+      "note": "html.EscapeString escapes HTML entities — safe for HTML output; it does not strip CR/LF, so no log_injection credit"
     },
     {
       "method": "HTMLEscapeString",
       "class": "template",
-      "removes": ["xss", "external_taint_escape", "log_injection", "open_redirect"],
-      "note": "template.HTMLEscapeString escapes HTML"
+      "removes": ["xss", "external_taint_escape", "open_redirect"],
+      "note": "template.HTMLEscapeString escapes HTML; it does not strip CR/LF, so no log_injection credit"
     },
     {
       "method": "Atoi",

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA60B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAyrEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA60B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2rEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAkjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -1190,11 +1190,13 @@ export const DEFAULT_SINKS = [
     { method: 'FileOutputStream', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'FileReader', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'FileWriter', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
-    // NOTE: ClassLoader.getResource / Class.getResource were removed in
-    // 3.153.0 (#233). Classpath resource resolution cannot escape the
-    // classpath root via `../` (JAR entries are opaque). If reintroduced,
-    // the correct CWE is CWE-829 (untrusted-classpath-resource), not
-    // CWE-22 path traversal.
+    // ClassLoader.getResource / getResourceAsStream: re-added as CWE-22 in #621
+    // (Spark CVE-2018-9159, a request-derived name read through a classLoader
+    // field). Class.getResource and Spring ResourceLoader.getResource stay out
+    // (#233). A string-literal name is dropped by the constant-argument filter,
+    // so only a non-constant name reaches this sink.
+    { method: 'getResource', class: 'ClassLoader', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'getResourceAsStream', class: 'ClassLoader', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['java'] },
     // Paths.get can be used for path traversal
     { method: 'get', class: 'Paths', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'of', class: 'Path', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
@@ -3261,8 +3263,10 @@ export const DEFAULT_SANITIZERS = [
     { method: 'EvalSymlinks', class: 'filepath', removes: ['path_traversal', 'external_taint_escape'] },
     // Go html/template escape helpers (#102 FP-27) — registered explicitly because
     // configs/sinks/golang.json is not loaded at runtime.
-    { method: 'EscapeString', class: 'html', removes: ['xss', 'external_taint_escape', 'log_injection', 'open_redirect'] },
-    { method: 'HTMLEscapeString', class: 'template', removes: ['xss', 'external_taint_escape', 'log_injection', 'open_redirect'] },
+    // html.EscapeString / template.HTMLEscapeString escape HTML metacharacters, not
+    // CR/LF, so they carry no log_injection credit (#605); JSEscapeString is left as is.
+    { method: 'EscapeString', class: 'html', removes: ['xss', 'external_taint_escape', 'open_redirect'] },
+    { method: 'HTMLEscapeString', class: 'template', removes: ['xss', 'external_taint_escape', 'open_redirect'] },
     { method: 'JSEscapeString', class: 'template', removes: ['xss', 'external_taint_escape', 'log_injection'] },
     { method: 'URLQueryEscaper', class: 'template', removes: ['xss', 'external_taint_escape', 'open_redirect'] },
     { method: 'QueryEscape', class: 'url', removes: ['xss', 'external_taint_escape', 'open_redirect'] },