circle-ir 4.16.0 → 4.17.0

package/dist/analysis/passes/language-sources-pass.js

@@ -1701,6 +1701,9 @@ function findCSharpRequestSources(sourceCode, language) {
     // cognium-dev#638 step 3 — `box.value = req.QueryString["k"]` seeds the
     // container local so cross-file calls that pass `box` carry taint.
     const memberFieldAssignRe = /^\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+    // cognium-dev#638 step 5 — `list.Add(req.QueryString["k"])` seeds the list
+    // local so cross-file calls that pass `list` carry taint into callee reads.
+    const collectionAddRe = /^\s*([A-Za-z_]\w*)\s*\.\s*Add\s*\(\s*(.+?)\s*\)\s*;?\s*$/;
     // `Request.*` is the inherited controller member. A parameter typed
     // `HttpRequest` / `HttpRequestBase` is the same surface under whatever
     // name the method uses (`req` in Juliet) — cognium-dev#501.
@@ -1869,6 +1872,25 @@ function findCSharpRequestSources(sourceCode, language) {
                     continue;
                 }
             }
+            const addEl = collectionAddRe.exec(stmt);
+            if (addEl) {
+                const [, baseName, rhs] = addEl;
+                const type = classify(rhs);
+                if (type && baseName) {
+                    const lineNumber = i + 1;
+                    if (!sources.some(s => s.line === lineNumber && s.variable === baseName)) {
+                        sources.push({
+                            type,
+                            location: `${baseName}.Add(${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''})`,
+                            severity: type === 'db_input' ? 'medium' : 'high',
+                            line: lineNumber,
+                            confidence: 1.0,
+                            variable: baseName,
+                        });
+                    }
+                    continue;
+                }
+            }
             const m = assignRe.exec(stmt);
             // cognium-dev#502 — `assignRe` is anchored and greedy, so on a one-line
             // block header that also contains the real assignment
@@ -7446,10 +7468,14 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
     const lines = code.split('\n');
     const terminatorRe = /\b(throw|return)\b/;
     // Allow-list membership, rejecting form:
-    //   if (Array.IndexOf(Allowed, x) < 0) return;
+    //   if (Array.IndexOf(Allowed, x) < 0) return;          (also System.Array, == -1)
     //   if (!Allowed.Contains(x)) return;
+    // cognium-dev#809: the IndexOf form credits only a `static readonly`
+    // string-literal array field the file never writes (see
+    // `collectCSharpLiteralArrayFields`); any other array may hold the value.
+    const literalArrays = collectCSharpLiteralArrayFields(code);
+    const indexOfRe = /\bif\s*\(\s*(?:System\s*\.\s*)?Array\s*\.\s*IndexOf\s*\(\s*([A-Za-z_]\w*)\s*,\s*([A-Za-z_][\w.]*)\s*\)\s*(?:<\s*0|==\s*-\s*1)\s*\)/;
     const allowlistRes = [
-        /\bif\s*\(\s*Array\s*\.\s*IndexOf\s*\([^,]+,\s*([A-Za-z_][\w.]*)\s*\)\s*<\s*0\s*\)/,
         /\bif\s*\(\s*!\s*[A-Za-z_][\w.]*\s*\.\s*Contains\s*\(\s*([A-Za-z_][\w.]*)\s*\)\s*\)/,
     ];
     // Character-class validation, rejecting form:
@@ -7457,13 +7483,17 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
     const charClassRe = /\bif\s*\(\s*!\s*([A-Za-z_][\w.]*)\s*\.\s*All\s*\(\s*char\s*\.\s*Is[A-Za-z]+\s*\)\s*\)/;
     for (let i = 0; i < lines.length; i++) {
         let guardedExpr = null;
-        for (const re of allowlistRes) {
-            const m = re.exec(lines[i]);
-            if (m) {
-                guardedExpr = m[1];
-                break;
+        const im = indexOfRe.exec(lines[i]);
+        if (im && literalArrays.has(im[1]))
+            guardedExpr = im[2];
+        if (!guardedExpr)
+            for (const re of allowlistRes) {
+                const m = re.exec(lines[i]);
+                if (m) {
+                    guardedExpr = m[1];
+                    break;
+                }
             }
-        }
         if (!guardedExpr) {
             const m = charClassRe.exec(lines[i]);
             if (m)
@@ -7507,6 +7537,10 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
             const a = assignRe.exec(lines[l]);
             if (a && mentions(a[2]))
                 guarded.add(a[1]);
+            // cognium-dev#809: a reassignment from anything unguarded ends the
+            // credit (`target = Console.ReadLine();` after the guard).
+            else if (a)
+                guarded.delete(a[1]);
             if (mentions(lines[l])) {
                 sanitizers.push({
                     type: 'csharp_early_return_guard',
@@ -7520,6 +7554,44 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
     }
     return sanitizers;
 }
+/**
+ * cognium-dev#809 — names of `static readonly string[]` fields initialised
+ * with string literals only, that the file never writes:
+ *
+ *   private static readonly string[] KnownHosts = { "a.example", "b.example" };
+ *
+ * Past `if (Array.IndexOf(KnownHosts, x) < 0) throw …;`, `x` is one of those
+ * literals. The C# counterpart of the Python literal-collection membership
+ * guard (#563) and the Rust literal-equality guard (#293).
+ *
+ * `readonly` stops the field being rebound outside an initialiser, but array
+ * elements stay writable, so any element store, `ref`/`out` pass,
+ * `SetValue`, `Array.<mutator>(…)` naming the field, or plain assignment
+ * after the declaration disqualifies it.
+ */
+function collectCSharpLiteralArrayFields(code) {
+    const names = new Set();
+    const lit = String.raw `(?:@"(?:[^"]|"")*"|"(?:[^"\\\n]|\\.)*")`;
+    const elems = new RegExp(String.raw `^\s*${lit}(?:\s*,\s*${lit})*\s*,?\s*$`);
+    const declRe = /((?:\b(?:public|private|protected|internal|static|readonly)\s+)+)string\s*\[\s*\]\s+([A-Za-z_]\w*)\s*=\s*(?:new\s+(?:string\s*)?\[\s*\]\s*)?\{([^{}]*)\}\s*;/g;
+    for (const m of code.matchAll(declRe)) {
+        const mods = m[1];
+        const name = m[2];
+        if (!/\bstatic\b/.test(mods) || !/\breadonly\b/.test(mods))
+            continue;
+        if (!elems.test(m[3]))
+            continue;
+        const rest = code.slice(0, m.index) + code.slice(m.index + m[0].length);
+        const written = new RegExp(String.raw `\b${name}\s*(?:\[[^\]]*\]\s*)?(?:[-+*/%&|^]|\?\?)?=(?!=)` +
+            String.raw `|\b(?:ref|out)\s+${name}\b` +
+            String.raw `|\b${name}\s*\.\s*SetValue\s*\(` +
+            String.raw `|\bArray\s*\.\s*(?:Clear|Copy|ConstrainedCopy|Fill|Resize|Reverse|Sort)\s*\([^;]*\b${name}\b`);
+        if (written.test(rest))
+            continue;
+        names.add(name);
+    }
+    return names;
+}
 function findCSharpFullPathStartsWithGuardSanitizers(code) {
     const sanitizers = [];
     const lines = code.split('\n');