circle-ir 4.16.0 → 4.17.0

package/dist/analysis/passes/taint-propagation-pass.js

@@ -12,7 +12,7 @@
  */
 import { findJavaSpringReturnXSSSinks } from './language-sources-pass.js';
 import { expressionFullyWrappedBySanitizer, identifierOutsideSanitizerCalls, identifierOutsideSanitizerCallsInText, propagateTaint } from '../taint-propagation.js';
-import { isFalsePositive, isCorrelatedPredicateFP } from '../constant-propagation.js';
+import { isFalsePositive, isCorrelatedPredicateFP, constPropScopedVar } from '../constant-propagation.js';
 import { buildJavaTaintedVars, buildPythonTaintedVars, buildRustTaintedVars, findPythonTrustBoundaryViolations, findPythonReturnXSSSinks, findJavaWikiPluginReturnXSSSinks } from './language-sources-pass.js';
 import { parseJavaArrayAccessExpression } from '../java-array-element-keys.js';
 import { canSourceReachSink, sourceSemanticsAllowed } from '../findings.js';
@@ -369,25 +369,74 @@ function resolveJavaDerivedAnchor(varName, derived, realSourceByVar, codeLines,
  * const-prop never seeds those derived names. Argument-style derivations
  * (`shown = encodeForPage(nick)`) must keep the veto so sanitizer credit holds.
  */
-function javaReceiverChainDerivedVar(code, localVar, seedVar) {
+function javaReceiverChainDerivedVar(rhsByLocal, localVar, seedVar) {
     if (!seedVar || localVar === seedVar)
         return false;
+    const rhsList = rhsByLocal.get(localVar);
+    if (!rhsList)
+        return false;
     const esc = seedVar.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     const receiverOnRhs = new RegExp(`(?:^|[^\\w.$])${esc}\\s*\\.`, 'u');
+    return rhsList.some(rhs => receiverOnRhs.test(rhs));
+}
+/**
+ * cognium-dev#806 — the assignment RHS texts of each Java local, indexed once
+ * per file. `javaReceiverChainDerivedVar` used to re-run its declaration regex
+ * over every line for every (source, derived local) pair, which made large
+ * files take seconds. Same per-line matching, done once.
+ */
+/** Line whose block scope owns `varName` as read on `useLine` (#476 / #597). */
+function defLineForUse(graph, varName, useLine) {
+    const own = (graph.defsByLine.get(useLine) ?? []).find(d => d.variable === varName);
+    if (own)
+        return own.line;
+    const use = (graph.usesByLine.get(useLine) ?? []).find(u => u.variable === varName && u.def_id != null);
+    const d = use ? graph.defById.get(use.def_id) : undefined;
+    return d?.line ?? useLine;
+}
+/** Const-prop key for a flow step: block locals vs method-body locals (#476 / #597). */
+function constPropFlowLookup(language, method, varName, blockLine, constProp, preferMethodScoped = false) {
+    if (language === 'go') {
+        return constPropScopedVar(method, varName, blockLine, constProp);
+    }
+    if (!method || varName.includes(':'))
+        return varName;
+    const blockScoped = constPropScopedVar(method, varName, blockLine, constProp);
+    const hasTaintBinding = (name) => constProp.tainted.has(name) || constProp.sanitizedVars.has(name);
+    if (blockScoped.includes(':b') && hasTaintBinding(blockScoped)) {
+        return blockScoped;
+    }
+    const methodScoped = `${method}:${varName}`;
+    if (hasTaintBinding(methodScoped)) {
+        return methodScoped;
+    }
+    if (preferMethodScoped && method) {
+        return methodScoped;
+    }
+    return constProp.lineBlockScopes?.has(blockLine) ? blockScoped : varName;
+}
+function indexJavaLocalAssignments(code) {
     const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
     const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+    const index = new Map();
     for (const line of code.split('\n')) {
         const trimmed = line.trimStart();
         if (trimmed.startsWith('//') || trimmed.startsWith('*'))
             continue;
+        // Cheap pre-check: neither regex can match a line without `=` and `;`.
+        if (!line.includes('=') || !line.includes(';'))
+            continue;
         const m = declRe.exec(line) ?? assignRe.exec(line);
-        if (!m || m[1] !== localVar)
+        if (!m)
             continue;
+        const list = index.get(m[1]);
         const rhs = stripJavaTrailingComment(m[2]);
-        if (receiverOnRhs.test(rhs))
-            return true;
+        if (list)
+            list.push(rhs);
+        else
+            index.set(m[1], [rhs]);
     }
-    return false;
+    return index;
 }
 function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers) {
     const lines = typeof code === 'string' ? code.split('\n') : [];
@@ -423,15 +472,26 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
     };
     return (step, sourceLine, sinkLine, sinkType) => {
         const method = methodAtLine(graph, step.line);
-        const scopedVar = method ? `${method}:${step.variable}` : step.variable;
-        // cognium-dev#751: Go locals are recorded method-scoped only (no unscoped
-        // alias) by handleGoAssignment, so Go looks up the scoped name. Other
-        // languages keep the unscoped lookup (#614).
-        const r = isFalsePositive(constProp, step.line, language === 'go' ? scopedVar : step.variable);
+        const blockLine = defLineForUse(graph, step.variable, step.line);
+        const fpLookup = constPropFlowLookup(language, method, step.variable, blockLine, constProp);
+        const r = isFalsePositive(constProp, step.line, fpLookup);
         if (!r.isFalsePositive)
             return false;
         if (r.reason !== 'variable_not_tainted')
             return true;
+        if (r.reason === 'variable_not_tainted' &&
+            language === 'java' &&
+            method &&
+            fpLookup === step.variable &&
+            !step.variable.includes('.')) {
+            const v = step.variable;
+            if (constProp.tainted.has(`${method}:${v}`))
+                return false;
+            for (const t of constProp.tainted) {
+                if (t.startsWith(`${method}:b`) && t.endsWith(`:${v}`))
+                    return false;
+            }
+        }
         // #589: the step variable came from a context-specific encoder
         // (`escapeHtml`, `encodeForHTML`, …), which does not clean `trust_boundary`
         // (a `session.setAttribute` sink). It is "not tainted" only for the other
@@ -447,8 +507,9 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
             else {
                 const method = methodAtLine(graph, step.line);
                 if (method) {
-                    if (unc.get(`${method}:${step.variable}`)?.has(sinkType))
+                    if (unc.get(fpLookup)?.has(sinkType)) {
                         return false;
+                    }
                 }
                 else if (unc.get(step.variable)?.has(sinkType)) {
                     return false;
@@ -524,7 +585,8 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
             // cognium-dev#751: sink use after `uid := constantHelper(tainted)` must veto
             // when the helper is in `constantReturningMethods`, even if the flow's
             // source_line is the assignment line (rule E would otherwise keep it).
-            if (step.line === sinkLine && !constProp.tainted.has(scopedVar)) {
+            if (step.line === sinkLine &&
+                !constProp.tainted.has(fpLookup)) {
                 for (let ln = sourceLine; ln <= sinkLine; ln++) {
                     const calleeMatch = (lines[ln - 1] ?? '').match(/:=\s*(\w+)\s*\(/);
                     if (calleeMatch && constProp.constantReturningMethods?.has(calleeMatch[1])) {
@@ -553,16 +615,24 @@ export class TaintPropagationPass {
         // into const-prop's tainted set so DFG + expression-scan vetoes keep them.
         // Per-source seeding + receiver filter avoids argument-style derivations
         // (`shown = encodeForPage(nick)`) that must stay vetoed for sanitizer credit.
+        // cognium-dev#806: index the assignments once, visit each seed name once,
+        // and skip the file-wide derivation when no local not already tainted has
+        // a `seed.` receiver on its RHS (only such locals can be added).
         if (ctx.language === 'java' && typeof ctx.code === 'string') {
+            const rhsByLocal = indexJavaLocalAssignments(ctx.code);
+            const seen = new Set();
             for (const s of sources) {
-                if (!s.variable)
+                if (!s.variable || seen.has(s.variable))
                     continue;
-                for (const [v] of buildJavaTaintedVars(ctx.code, new Set([s.variable]))) {
-                    if (v === s.variable)
-                        continue;
-                    if (javaReceiverChainDerivedVar(ctx.code, v, s.variable)) {
+                seen.add(s.variable);
+                const seedVar = s.variable;
+                const candidates = [...rhsByLocal.keys()].filter(v => !constProp.tainted.has(v) && javaReceiverChainDerivedVar(rhsByLocal, v, seedVar));
+                if (candidates.length === 0)
+                    continue;
+                const derived = buildJavaTaintedVars(ctx.code, new Set([seedVar]));
+                for (const v of candidates) {
+                    if (derived.has(v))
                         constProp.tainted.add(v);
-                    }
                 }
             }
         }
@@ -814,7 +884,7 @@ export class TaintPropagationPass {
             pushIfNew(f);
         }
         // Supplement: collection/iterator flows — with FP filtering
-        const collectionFlows = detectCollectionFlows(calls, sources, sinks, constProp.tainted, constProp.unreachableLines, ctx.code, types) ?? [];
+        const collectionFlows = detectCollectionFlows(calls, sources, sinks, constProp, ctx.code, types, graph) ?? [];
         for (const f of collectionFlows) {
             if (flowKeys.has(flowKey(f)))
                 continue;
@@ -896,6 +966,15 @@ export class TaintPropagationPass {
                 pushIfNew(f);
             }
         }
+        // cognium-dev#686 — JS/TS module-scope `let`/`var` store-then-read across
+        // route handlers (variant xss stored). Mirrors #243 Go package globals.
+        if ((ctx.language === 'javascript' || ctx.language === 'typescript') &&
+            typeof ctx.code === 'string') {
+            const jsModuleFlows = detectJsModuleScopeFlows(ctx.code, sources, sinks, constProp.unreachableLines) ?? [];
+            for (const f of jsModuleFlows) {
+                pushIfNew(f);
+            }
+        }
         // Sprint 9 #58.1 — final pass: drop any flow whose source variable was
         // explicitly marked sanitized by a guard (e.g. regex-allowlist).
         // Applied to ALL flow generators (DFG-built and the four supplements)
@@ -1620,6 +1699,102 @@ function detectGoPackageGlobalFlows(code, _calls, sources, sinks, unreachableLin
     }
     return flows;
 }
+/**
+ * cognium-dev#686 — module-level `let`/`var` written in one handler and read
+ * in another. Per-function DFG cannot link these; text-scan supplement.
+ */
+function detectJsModuleScopeFlows(code, sources, sinks, unreachableLines) {
+    const flows = [];
+    if (!code || sinks.length === 0)
+        return flows;
+    const lines = code.split('\n');
+    const moduleVars = new Set();
+    for (const line of lines) {
+        const stripped = line.replace(/\s+$/, '');
+        if (!stripped || /^[ \t]/.test(line))
+            continue;
+        const m = stripped.match(/^(?:let|var|const)\s+([A-Za-z_$][\w$]*)\b/);
+        if (m)
+            moduleVars.add(m[1]);
+    }
+    if (moduleVars.size === 0)
+        return flows;
+    const sourceVarNames = new Set();
+    for (const s of sources) {
+        if (typeof s.variable === 'string' && s.variable.length > 0) {
+            sourceVarNames.add(s.variable);
+        }
+    }
+    const JS_HTTP_SOURCE_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies|get)\b|\breq\.(?:param|query|body)\(/;
+    const writes = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (unreachableLines.has(i + 1))
+            continue;
+        for (const lhs of moduleVars) {
+            const declRe = new RegExp(`\\b(?:let|const|var)\\s+${lhs.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
+            if (declRe.test(line))
+                continue;
+            const m = line.match(new RegExp(`\\b${lhs.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=\\s*([^;]+)`));
+            if (!m)
+                continue;
+            const rhs = m[1];
+            let taintedBy = null;
+            const onLine = sources.filter(s => s.line === i + 1);
+            if (onLine.length > 0) {
+                taintedBy = { line: onLine[0].line, type: onLine[0].type };
+            }
+            else if (JS_HTTP_SOURCE_RE.test(rhs)) {
+                taintedBy = { line: i + 1, type: 'http_body' };
+            }
+            else {
+                for (const v of sourceVarNames) {
+                    const re = new RegExp(`(?<![A-Za-z0-9_$])${v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9_$])`);
+                    if (re.test(rhs)) {
+                        const src = sources.find(s => s.variable === v);
+                        if (src) {
+                            taintedBy = { line: src.line, type: src.type };
+                            break;
+                        }
+                    }
+                }
+            }
+            if (!taintedBy)
+                continue;
+            writes.push({ varName: lhs, line: i + 1, sourceLine: taintedBy.line, sourceType: taintedBy.type });
+        }
+    }
+    if (writes.length === 0)
+        return flows;
+    for (const sink of sinks) {
+        if (unreachableLines.has(sink.line))
+            continue;
+        const sinkLineText = lines[sink.line - 1] ?? '';
+        if (!sinkLineText)
+            continue;
+        for (const w of writes) {
+            if (w.line >= sink.line)
+                continue;
+            const re = new RegExp(`(?<![A-Za-z0-9_$])${w.varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9_$])`);
+            if (!re.test(sinkLineText))
+                continue;
+            flows.push({
+                source_line: w.sourceLine,
+                sink_line: sink.line,
+                source_type: w.sourceType,
+                sink_type: sink.type,
+                path: [
+                    { variable: w.varName, line: w.sourceLine, type: 'source' },
+                    { variable: w.varName, line: w.line, type: 'assignment' },
+                    { variable: w.varName, line: sink.line, type: 'sink' },
+                ],
+                confidence: 0.9,
+                sanitized: false,
+            });
+        }
+    }
+    return flows;
+}
 /**
  * #614 — is `varName` tainted in the sink's own method?
  *
@@ -1726,7 +1901,9 @@ function isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isField
     }
     return true;
 }
-function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLines, code, types) {
+function detectCollectionFlows(calls, sources, sinks, constProp, code, types, graph) {
+    const taintedVars = constProp.tainted;
+    const unreachableLines = constProp.unreachableLines;
     const flows = [];
     const fieldNames = new Set();
     for (const t of types ?? [])
@@ -1751,7 +1928,13 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
                 }
                 if (arg.variable) {
                     const varName = arg.variable;
-                    const scopedName = call.in_method ? `${call.in_method}:${varName}` : varName;
+                    let scopedName = varName;
+                    if (call.in_method) {
+                        const blockLine = graph
+                            ? defLineForUse(graph, varName, call.location.line)
+                            : call.location.line;
+                        scopedName = constPropFlowLookup('java', call.in_method, varName, blockLine, constProp, true);
+                    }
                     // Bare `name` that is a field read (no local of that name in this
                     // method) still counts as a field use — Inter4-style. A shadowing
                     // local declaration in the method does not.