circle-ir 4.16.0 → 4.16.1

package/dist/browser/circle-ir.js

@@ -21865,14 +21865,17 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
   const sanitizers = [];
   const lines = code.split("\n");
   const terminatorRe = /\b(throw|return)\b/;
+  const literalArrays = collectCSharpLiteralArrayFields(code);
+  const indexOfRe = /\bif\s*\(\s*(?:System\s*\.\s*)?Array\s*\.\s*IndexOf\s*\(\s*([A-Za-z_]\w*)\s*,\s*([A-Za-z_][\w.]*)\s*\)\s*(?:<\s*0|==\s*-\s*1)\s*\)/;
   const allowlistRes = [
-    /\bif\s*\(\s*Array\s*\.\s*IndexOf\s*\([^,]+,\s*([A-Za-z_][\w.]*)\s*\)\s*<\s*0\s*\)/,
     /\bif\s*\(\s*!\s*[A-Za-z_][\w.]*\s*\.\s*Contains\s*\(\s*([A-Za-z_][\w.]*)\s*\)\s*\)/
   ];
   const charClassRe = /\bif\s*\(\s*!\s*([A-Za-z_][\w.]*)\s*\.\s*All\s*\(\s*char\s*\.\s*Is[A-Za-z]+\s*\)\s*\)/;
   for (let i2 = 0; i2 < lines.length; i2++) {
     let guardedExpr = null;
-    for (const re of allowlistRes) {
+    const im = indexOfRe.exec(lines[i2]);
+    if (im && literalArrays.has(im[1])) guardedExpr = im[2];
+    if (!guardedExpr) for (const re of allowlistRes) {
       const m = re.exec(lines[i2]);
       if (m) {
         guardedExpr = m[1];
@@ -21900,6 +21903,7 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
     for (let l = i2 + 1; l < lines.length; l++) {
       const a = assignRe.exec(lines[l]);
       if (a && mentions2(a[2])) guarded.add(a[1]);
+      else if (a) guarded.delete(a[1]);
       if (mentions2(lines[l])) {
         sanitizers.push({
           type: "csharp_early_return_guard",
@@ -21920,6 +21924,25 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
   }
   return sanitizers;
 }
+function collectCSharpLiteralArrayFields(code) {
+  const names = /* @__PURE__ */ new Set();
+  const lit = String.raw`(?:@"(?:[^"]|"")*"|"(?:[^"\\\n]|\\.)*")`;
+  const elems = new RegExp(String.raw`^\s*${lit}(?:\s*,\s*${lit})*\s*,?\s*$`);
+  const declRe = /((?:\b(?:public|private|protected|internal|static|readonly)\s+)+)string\s*\[\s*\]\s+([A-Za-z_]\w*)\s*=\s*(?:new\s+(?:string\s*)?\[\s*\]\s*)?\{([^{}]*)\}\s*;/g;
+  for (const m of code.matchAll(declRe)) {
+    const mods = m[1];
+    const name2 = m[2];
+    if (!/\bstatic\b/.test(mods) || !/\breadonly\b/.test(mods)) continue;
+    if (!elems.test(m[3])) continue;
+    const rest = code.slice(0, m.index) + code.slice(m.index + m[0].length);
+    const written = new RegExp(
+      String.raw`\b${name2}\s*(?:\[[^\]]*\]\s*)?(?:[-+*/%&|^]|\?\?)?=(?!=)` + String.raw`|\b(?:ref|out)\s+${name2}\b` + String.raw`|\b${name2}\s*\.\s*SetValue\s*\(` + String.raw`|\bArray\s*\.\s*(?:Clear|Copy|ConstrainedCopy|Fill|Resize|Reverse|Sort)\s*\([^;]*\b${name2}\b`
+    );
+    if (written.test(rest)) continue;
+    names.add(name2);
+  }
+  return names;
+}
 function findCSharpFullPathStartsWithGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -30968,10 +30991,12 @@ function isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls) {
     if (other === call || other.method_name === "format") continue;
     if (other.arguments.some((a) => a.expression.includes(needle))) return false;
   }
-  const receiver = call.receiver;
+  return isJdkClassReceiver(call.receiver, JAVA_FORMATTER_CLASSES, declaredTypeNames, imports);
+}
+function isJdkClassReceiver(receiver, classes, declaredTypeNames, imports) {
   const dot = receiver.lastIndexOf(".");
   const simple = dot < 0 ? receiver : receiver.slice(dot + 1);
-  const pkg = JAVA_FORMATTER_CLASSES.get(simple);
+  const pkg = classes.get(simple);
   if (pkg === void 0) return false;
   if (dot >= 0) return receiver === `${pkg}.${simple}`;
   if (declaredTypeNames.has(simple)) return false;
@@ -30982,8 +31007,41 @@ function isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls) {
   if (pkg === "java.lang") return true;
   return imports.some((imp) => imp.from_package === pkg && (imp.imported_name === simple || imp.is_wildcard));
 }
+var JAVA_CHARACTER_CLASS = /* @__PURE__ */ new Map([["Character", "java.lang"]]);
+var JAVA_CHARACTER_PREDICATES = /* @__PURE__ */ new Set([
+  "isLetter",
+  "isDigit",
+  "isLetterOrDigit",
+  "isAlphabetic",
+  "isWhitespace",
+  "isSpaceChar",
+  "isUpperCase",
+  "isLowerCase",
+  "isTitleCase",
+  "isISOControl",
+  "isDefined",
+  "isIdeographic",
+  "isMirrored",
+  "isJavaIdentifierStart",
+  "isJavaIdentifierPart",
+  "isUnicodeIdentifierStart",
+  "isUnicodeIdentifierPart",
+  "isIdentifierIgnorable",
+  "isHighSurrogate",
+  "isLowSurrogate",
+  "isSurrogate",
+  "isSurrogatePair",
+  "isValidCodePoint",
+  "isBmpCodePoint",
+  "isSupplementaryCodePoint"
+]);
+function isJavaCharacterPredicateCall(call, declaredTypeNames, imports) {
+  if (!call.receiver || !JAVA_CHARACTER_PREDICATES.has(call.method_name)) return false;
+  return isJdkClassReceiver(call.receiver, JAVA_CHARACTER_CLASS, declaredTypeNames, imports);
+}
 function isJavaNonEscapeCall(call, declaredTypeNames, imports, calls) {
   if (isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls)) return true;
+  if (isJavaCharacterPredicateCall(call, declaredTypeNames, imports)) return true;
   if (call.receiver) return false;
   const isCtor = call.is_constructor === true || (call.resolution?.target ?? "").endsWith(".<init>");
   if (!isCtor) return false;
@@ -38627,6 +38685,11 @@ function bareIdentifiers(text) {
   for (const m of stripped.matchAll(/\b([A-Za-z_]\w*)\b/g)) out2.push(m[1]);
   return out2;
 }
+function isLiteralValue(rhs) {
+  if (/\$"/.test(rhs)) return false;
+  const ids = bareIdentifiers(rhs);
+  return ids.every((id) => id === "null" || id === "true" || id === "false" || id === "default") || /^\s*(?:string|String)\s*\.\s*Empty\s*$/.test(rhs);
+}
 function insideParens(text, open) {
   let depth = 0;
   for (let i2 = open; i2 < text.length; i2++) {
@@ -38807,6 +38870,36 @@ var CSharpCredit = class {
   sanitizedVarsAt(type, sinkLine) {
     return this.sanitizedVarsIn(type, this.methodAt(sinkLine)?.start_line ?? 1, sinkLine, true);
   }
+  /**
+   * Class fields judged across every method that writes them (cognium-dev#808).
+   * A field is read in one method and written in others, so each write is
+   * judged in its own method with the same in-method credit as a local, and
+   * the field is safe for `type` only when every write is: `sanitized` holds
+   * the fields with at least one credited write and no uncredited one,
+   * `unsanitized` the fields with an uncredited write. A literal write
+   * (`_v = "";`, `_v = null;`) is neutral.
+   */
+  fieldWrites(type, fields) {
+    const credited = /* @__PURE__ */ new Set();
+    const unsanitized = /* @__PURE__ */ new Set();
+    for (const m of this.methods) {
+      const sanitized = /* @__PURE__ */ new Set();
+      for (const st of this.statements(m.start_line, m.end_line + 1)) {
+        if (this.methodAt(st.line) !== m) continue;
+        for (const op of this.creditOpsInStatement(st.text)) {
+          const lhs = op.lhs;
+          const keeps = op.kind === "append" ? sanitized.has(lhs) && this.rhsKeepsSanitizerCredit(type, op.rhs, sanitized, true, true) : this.rhsKeepsSanitizerCredit(type, op.rhs, sanitized, true, false);
+          if (keeps) sanitized.add(lhs);
+          else sanitized.delete(lhs);
+          if (!fields.has(lhs) || isLiteralValue(op.rhs)) continue;
+          if (keeps) credited.add(lhs);
+          else unsanitized.add(lhs);
+        }
+      }
+    }
+    for (const f of unsanitized) credited.delete(f);
+    return { sanitized: credited, unsanitized };
+  }
   /**
    * True when the sink on `sinkLine` also receives a tainted value that no
    * sanitizer covers. In `Write(HtmlEncode(a) + b)` the encoder covers `a`
@@ -41832,6 +41925,15 @@ var SinkFilterPass = class {
       const csFields = new Set(ctx.graph.ir.types.flatMap((t) => (t.fields ?? []).map((f) => f.name)));
       const credit = new CSharpCredit(ctx.code, ctx.graph.ir.types.flatMap((t) => t.methods));
       const csSeeds = mergedSources.flatMap((s) => s.variable ? [{ variable: s.variable, line: s.line }] : []);
+      const fieldWritesByType = /* @__PURE__ */ new Map();
+      const fieldWritesFor = (type) => {
+        let w = fieldWritesByType.get(type);
+        if (!w) {
+          w = credit.fieldWrites(type, csFields);
+          fieldWritesByType.set(type, w);
+        }
+        return w;
+      };
       const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
         if (sink.type === "xxe" && xxeHardened) return false;
@@ -41841,9 +41943,13 @@ var SinkFilterPass = class {
         const scoped = credit.sanitizedVarsAt(sink.type, sink.line);
         const fileWide = sanitizedByType.get(sink.type);
         const sanitizedVars = new Set(scoped);
+        const fieldWrites = fieldWritesFor(sink.type);
         if (fileWide) {
-          for (const v of fileWide) if (csFields.has(v)) sanitizedVars.add(v);
+          for (const v of fileWide) {
+            if (csFields.has(v) && !fieldWrites.unsanitized.has(v)) sanitizedVars.add(v);
+          }
         }
+        for (const v of fieldWrites.sanitized) sanitizedVars.add(v);
         for (const v of credit.guardedVarsAt(sink.type, sink.line)) sanitizedVars.add(v);
         for (const v of credit.safeBuilders(sanitizedVars, sink.line)) sanitizedVars.add(v);
         const received = credit.sinkText(sink.line);
@@ -43954,21 +44060,30 @@ function resolveJavaDerivedAnchor(varName, derived, realSourceByVar, codeLines,
   }
   return best;
 }
-function javaReceiverChainDerivedVar(code, localVar, seedVar) {
+function javaReceiverChainDerivedVar(rhsByLocal, localVar, seedVar) {
   if (!seedVar || localVar === seedVar) return false;
+  const rhsList = rhsByLocal.get(localVar);
+  if (!rhsList) return false;
   const esc = seedVar.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const receiverOnRhs = new RegExp(`(?:^|[^\\w.$])${esc}\\s*\\.`, "u");
+  return rhsList.some((rhs) => receiverOnRhs.test(rhs));
+}
+function indexJavaLocalAssignments(code) {
   const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const index = /* @__PURE__ */ new Map();
   for (const line of code.split("\n")) {
     const trimmed = line.trimStart();
     if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+    if (!line.includes("=") || !line.includes(";")) continue;
     const m = declRe.exec(line) ?? assignRe.exec(line);
-    if (!m || m[1] !== localVar) continue;
+    if (!m) continue;
+    const list = index.get(m[1]);
     const rhs = stripJavaTrailingComment(m[2]);
-    if (receiverOnRhs.test(rhs)) return true;
+    if (list) list.push(rhs);
+    else index.set(m[1], [rhs]);
   }
-  return false;
+  return index;
 }
 function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers) {
   const lines = typeof code === "string" ? code.split("\n") : [];
@@ -44071,13 +44186,17 @@ var TaintPropagationPass = class {
     const sinkFilter = ctx.getResult("sink-filter");
     const { sources, sinks, sanitizers } = sinkFilter;
     if (ctx.language === "java" && typeof ctx.code === "string") {
+      const rhsByLocal = indexJavaLocalAssignments(ctx.code);
+      const seen = /* @__PURE__ */ new Set();
       for (const s of sources) {
-        if (!s.variable) continue;
-        for (const [v] of buildJavaTaintedVars(ctx.code, /* @__PURE__ */ new Set([s.variable]))) {
-          if (v === s.variable) continue;
-          if (javaReceiverChainDerivedVar(ctx.code, v, s.variable)) {
-            constProp.tainted.add(v);
-          }
+        if (!s.variable || seen.has(s.variable)) continue;
+        seen.add(s.variable);
+        const seedVar = s.variable;
+        const candidates = [...rhsByLocal.keys()].filter((v) => !constProp.tainted.has(v) && javaReceiverChainDerivedVar(rhsByLocal, v, seedVar));
+        if (candidates.length === 0) continue;
+        const derived = buildJavaTaintedVars(ctx.code, /* @__PURE__ */ new Set([seedVar]));
+        for (const v of candidates) {
+          if (derived.has(v)) constProp.tainted.add(v);
         }
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "4.16.0",
+  "version": "4.16.1",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",