circle-ir 4.16.1 → 4.18.1

package/dist/analysis/passes/taint-propagation-pass.js

@@ -12,7 +12,7 @@
  */
 import { findJavaSpringReturnXSSSinks } from './language-sources-pass.js';
 import { expressionFullyWrappedBySanitizer, identifierOutsideSanitizerCalls, identifierOutsideSanitizerCallsInText, propagateTaint } from '../taint-propagation.js';
-import { isFalsePositive, isCorrelatedPredicateFP } from '../constant-propagation.js';
+import { isFalsePositive, isCorrelatedPredicateFP, constPropScopedVar } from '../constant-propagation.js';
 import { buildJavaTaintedVars, buildPythonTaintedVars, buildRustTaintedVars, findPythonTrustBoundaryViolations, findPythonReturnXSSSinks, findJavaWikiPluginReturnXSSSinks } from './language-sources-pass.js';
 import { parseJavaArrayAccessExpression } from '../java-array-element-keys.js';
 import { canSourceReachSink, sourceSemanticsAllowed } from '../findings.js';
@@ -20,6 +20,7 @@ import { walkBackwardDefs } from '../dfg-walk.js';
 import { sanitizerCoversSink } from '../sanitizer-index.js';
 import { HTML_CONTEXT_ENCODER_METHODS } from '../constant-propagation/patterns.js';
 import { javaCanonicalStartsWithAllBare } from '../java-canonical-prefix.js';
+import { shouldGateInterproceduralParam } from '../entry-point-detection.js';
 /**
  * cognium-dev#328 — the const-prop per-step veto, with two scoped exemptions.
  *
@@ -385,6 +386,36 @@ function javaReceiverChainDerivedVar(rhsByLocal, localVar, seedVar) {
  * over every line for every (source, derived local) pair, which made large
  * files take seconds. Same per-line matching, done once.
  */
+/** Line whose block scope owns `varName` as read on `useLine` (#476 / #597). */
+function defLineForUse(graph, varName, useLine) {
+    const own = (graph.defsByLine.get(useLine) ?? []).find(d => d.variable === varName);
+    if (own)
+        return own.line;
+    const use = (graph.usesByLine.get(useLine) ?? []).find(u => u.variable === varName && u.def_id != null);
+    const d = use ? graph.defById.get(use.def_id) : undefined;
+    return d?.line ?? useLine;
+}
+/** Const-prop key for a flow step: block locals vs method-body locals (#476 / #597). */
+function constPropFlowLookup(language, method, varName, blockLine, constProp, preferMethodScoped = false) {
+    if (language === 'go') {
+        return constPropScopedVar(method, varName, blockLine, constProp);
+    }
+    if (!method || varName.includes(':'))
+        return varName;
+    const blockScoped = constPropScopedVar(method, varName, blockLine, constProp);
+    const hasTaintBinding = (name) => constProp.tainted.has(name) || constProp.sanitizedVars.has(name);
+    if (blockScoped.includes(':b') && hasTaintBinding(blockScoped)) {
+        return blockScoped;
+    }
+    const methodScoped = `${method}:${varName}`;
+    if (hasTaintBinding(methodScoped)) {
+        return methodScoped;
+    }
+    if (preferMethodScoped && method) {
+        return methodScoped;
+    }
+    return constProp.lineBlockScopes?.has(blockLine) ? blockScoped : varName;
+}
 function indexJavaLocalAssignments(code) {
     const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
     const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
@@ -408,6 +439,40 @@ function indexJavaLocalAssignments(code) {
     }
     return index;
 }
+function goCalleeBaseName(callee) {
+    const dot = callee.lastIndexOf('.');
+    return dot === -1 ? callee : callee.slice(dot + 1);
+}
+/** cognium-dev#783: callee from a Go `:=` or `var x =` assignment line (unqualified or dotted). */
+function goConstantHelperCalleeOnLine(line) {
+    const m = line.match(/:=\s*([\w.]+)\s*\(/) ?? line.match(/\bvar\s+\w+\s*=\s*([\w.]+)\s*\(/);
+    if (!m)
+        return null;
+    return goCalleeBaseName(m[1]);
+}
+/** Same as {@link goConstantHelperCalleeOnLine} when the call spans the next lines after `:=` / `var`. */
+function goConstantHelperCalleeFromLines(lines, lineNumber) {
+    const direct = goConstantHelperCalleeOnLine(lines[lineNumber - 1] ?? '');
+    if (direct)
+        return direct;
+    const cur = lines[lineNumber - 1] ?? '';
+    const partial = cur.match(/:=\s*([\w.]+)\s*$/) ?? cur.match(/\bvar\s+\w+\s*=\s*([\w.]+)\s*$/);
+    if (partial) {
+        const next = (lines[lineNumber] ?? '').trimStart();
+        if (next.startsWith('('))
+            return goCalleeBaseName(partial[1]);
+    }
+    if (!cur.includes(':=') && !/\bvar\s+\w+\s*=/.test(cur))
+        return null;
+    if (cur.includes('('))
+        return null;
+    for (let i = lineNumber + 1; i <= Math.min(lines.length, lineNumber + 4); i++) {
+        const m = (lines[i - 1] ?? '').match(/^\s*([\w.]+)\s*\(/);
+        if (m)
+            return goCalleeBaseName(m[1]);
+    }
+    return null;
+}
 function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers) {
     const lines = typeof code === 'string' ? code.split('\n') : [];
     const selfReassign = new Map();
@@ -442,15 +507,26 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
     };
     return (step, sourceLine, sinkLine, sinkType) => {
         const method = methodAtLine(graph, step.line);
-        const scopedVar = method ? `${method}:${step.variable}` : step.variable;
-        // cognium-dev#751: Go locals are recorded method-scoped only (no unscoped
-        // alias) by handleGoAssignment, so Go looks up the scoped name. Other
-        // languages keep the unscoped lookup (#614).
-        const r = isFalsePositive(constProp, step.line, language === 'go' ? scopedVar : step.variable);
+        const blockLine = defLineForUse(graph, step.variable, step.line);
+        const fpLookup = constPropFlowLookup(language, method, step.variable, blockLine, constProp);
+        const r = isFalsePositive(constProp, step.line, fpLookup);
         if (!r.isFalsePositive)
             return false;
         if (r.reason !== 'variable_not_tainted')
             return true;
+        if (r.reason === 'variable_not_tainted' &&
+            language === 'java' &&
+            method &&
+            fpLookup === step.variable &&
+            !step.variable.includes('.')) {
+            const v = step.variable;
+            if (constProp.tainted.has(`${method}:${v}`))
+                return false;
+            for (const t of constProp.tainted) {
+                if (t.startsWith(`${method}:b`) && t.endsWith(`:${v}`))
+                    return false;
+            }
+        }
         // #589: the step variable came from a context-specific encoder
         // (`escapeHtml`, `encodeForHTML`, …), which does not clean `trust_boundary`
         // (a `session.setAttribute` sink). It is "not tainted" only for the other
@@ -466,8 +542,9 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
             else {
                 const method = methodAtLine(graph, step.line);
                 if (method) {
-                    if (unc.get(`${method}:${step.variable}`)?.has(sinkType))
+                    if (unc.get(fpLookup)?.has(sinkType)) {
                         return false;
+                    }
                 }
                 else if (unc.get(step.variable)?.has(sinkType)) {
                     return false;
@@ -543,10 +620,11 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
             // cognium-dev#751: sink use after `uid := constantHelper(tainted)` must veto
             // when the helper is in `constantReturningMethods`, even if the flow's
             // source_line is the assignment line (rule E would otherwise keep it).
-            if (step.line === sinkLine && !constProp.tainted.has(scopedVar)) {
+            if (step.line === sinkLine &&
+                !constProp.tainted.has(fpLookup)) {
                 for (let ln = sourceLine; ln <= sinkLine; ln++) {
-                    const calleeMatch = (lines[ln - 1] ?? '').match(/:=\s*(\w+)\s*\(/);
-                    if (calleeMatch && constProp.constantReturningMethods?.has(calleeMatch[1])) {
+                    const callee = goConstantHelperCalleeFromLines(lines, ln);
+                    if (callee && constProp.constantReturningMethods?.has(callee)) {
                         return true;
                     }
                 }
@@ -841,7 +919,7 @@ export class TaintPropagationPass {
             pushIfNew(f);
         }
         // Supplement: collection/iterator flows — with FP filtering
-        const collectionFlows = detectCollectionFlows(calls, sources, sinks, constProp.tainted, constProp.unreachableLines, ctx.code, types) ?? [];
+        const collectionFlows = detectCollectionFlows(calls, sources, sinks, constProp, ctx.code, types, graph) ?? [];
         for (const f of collectionFlows) {
             if (flowKeys.has(flowKey(f)))
                 continue;
@@ -865,7 +943,7 @@ export class TaintPropagationPass {
         }
         // Supplement: direct parameter-to-sink flows
         // Sprint 82 (#189) — sink-type-aware dedup (see arrayFlows comment).
-        const paramFlows = detectParameterSinkFlows(types, calls, sources, sinks, constProp.unreachableLines, constProp.tainted, ctx.code) ?? [];
+        const paramFlows = detectParameterSinkFlows(types, calls, sources, sinks, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language, graph.ir.meta.file) ?? [];
         for (const f of paramFlows) {
             pushIfNew(f);
         }
@@ -923,6 +1001,15 @@ export class TaintPropagationPass {
                 pushIfNew(f);
             }
         }
+        // cognium-dev#686 — JS/TS module-scope `let`/`var` store-then-read across
+        // route handlers (variant xss stored). Mirrors #243 Go package globals.
+        if ((ctx.language === 'javascript' || ctx.language === 'typescript') &&
+            typeof ctx.code === 'string') {
+            const jsModuleFlows = detectJsModuleScopeFlows(ctx.code, sources, sinks, constProp.unreachableLines) ?? [];
+            for (const f of jsModuleFlows) {
+                pushIfNew(f);
+            }
+        }
         // Sprint 9 #58.1 — final pass: drop any flow whose source variable was
         // explicitly marked sanitized by a guard (e.g. regex-allowlist).
         // Applied to ALL flow generators (DFG-built and the four supplements)
@@ -970,6 +1057,14 @@ export class TaintPropagationPass {
                 return false;
             return true;
         });
+        if (ctx.language === 'csharp') {
+            finalFlows = finalFlows.filter((f) => !shouldGateCSharpPatPermsLibraryParamFlow(f, sources, sinks, types, {
+                language: ctx.language,
+                types,
+                filePath: graph.ir.meta.file,
+                calls,
+            }));
+        }
         // Sprint 24 (cognium-dev #102) — uniform line-keyed sanitizer
         // suppression. Drop any flow whose sink_line carries a registered
         // sanitizer that covers the flow's sink_type. Several supplementary
@@ -1647,6 +1742,102 @@ function detectGoPackageGlobalFlows(code, _calls, sources, sinks, unreachableLin
     }
     return flows;
 }
+/**
+ * cognium-dev#686 — module-level `let`/`var` written in one handler and read
+ * in another. Per-function DFG cannot link these; text-scan supplement.
+ */
+function detectJsModuleScopeFlows(code, sources, sinks, unreachableLines) {
+    const flows = [];
+    if (!code || sinks.length === 0)
+        return flows;
+    const lines = code.split('\n');
+    const moduleVars = new Set();
+    for (const line of lines) {
+        const stripped = line.replace(/\s+$/, '');
+        if (!stripped || /^[ \t]/.test(line))
+            continue;
+        const m = stripped.match(/^(?:export\s+)?(?:let|var|const)\s+([A-Za-z_$][\w$]*)\b/);
+        if (m)
+            moduleVars.add(m[1]);
+    }
+    if (moduleVars.size === 0)
+        return flows;
+    const sourceVarNames = new Set();
+    for (const s of sources) {
+        if (typeof s.variable === 'string' && s.variable.length > 0) {
+            sourceVarNames.add(s.variable);
+        }
+    }
+    const JS_HTTP_SOURCE_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies|get)\b|\breq\.(?:param|query|body)\(/;
+    const writes = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (unreachableLines.has(i + 1))
+            continue;
+        for (const lhs of moduleVars) {
+            const declRe = new RegExp(`\\b(?:export\\s+)?(?:let|const|var)\\s+${lhs.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
+            if (declRe.test(line))
+                continue;
+            const m = line.match(new RegExp(`\\b${lhs.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=\\s*([^;]+)`));
+            if (!m)
+                continue;
+            const rhs = m[1];
+            let taintedBy = null;
+            const onLine = sources.filter(s => s.line === i + 1);
+            if (onLine.length > 0) {
+                taintedBy = { line: onLine[0].line, type: onLine[0].type };
+            }
+            else if (JS_HTTP_SOURCE_RE.test(rhs)) {
+                taintedBy = { line: i + 1, type: 'http_body' };
+            }
+            else {
+                for (const v of sourceVarNames) {
+                    const re = new RegExp(`(?<![A-Za-z0-9_$])${v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9_$])`);
+                    if (re.test(rhs)) {
+                        const src = sources.find(s => s.variable === v);
+                        if (src) {
+                            taintedBy = { line: src.line, type: src.type };
+                            break;
+                        }
+                    }
+                }
+            }
+            if (!taintedBy)
+                continue;
+            writes.push({ varName: lhs, line: i + 1, sourceLine: taintedBy.line, sourceType: taintedBy.type });
+        }
+    }
+    if (writes.length === 0)
+        return flows;
+    for (const sink of sinks) {
+        if (unreachableLines.has(sink.line))
+            continue;
+        const sinkLineText = lines[sink.line - 1] ?? '';
+        if (!sinkLineText)
+            continue;
+        for (const w of writes) {
+            if (w.line >= sink.line)
+                continue;
+            const re = new RegExp(`(?<![A-Za-z0-9_$])${w.varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9_$])`);
+            if (!re.test(sinkLineText))
+                continue;
+            flows.push({
+                source_line: w.sourceLine,
+                sink_line: sink.line,
+                source_type: w.sourceType,
+                sink_type: sink.type,
+                path: [
+                    { variable: w.varName, line: w.sourceLine, type: 'source' },
+                    { variable: w.varName, line: w.line, type: 'assignment' },
+                    { variable: w.varName, line: sink.line, type: 'sink' },
+                ],
+                confidence: 0.9,
+                sanitized: false,
+            });
+        }
+    }
+    return flows;
+}
 /**
  * #614 — is `varName` tainted in the sink's own method?
  *
@@ -1753,7 +1944,21 @@ function isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isField
     }
     return true;
 }
-function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLines, code, types) {
+function mapGetLiteralKeyFromExpr(expr) {
+    const m = expr.match(/\b([A-Za-z_]\w*)\s*\.\s*get\s*\(\s*"([^"]*)"\s*\)/);
+    return m ? { map: m[1], key: m[2] } : null;
+}
+function isMapLiteralKeyTainted(constProp, mapName, key, inMethod) {
+    const scoped = inMethod ? `${inMethod}:${mapName}` : mapName;
+    const keys = constProp.taintedCollections.get(mapName) ??
+        constProp.taintedCollections.get(scoped);
+    if (!keys || keys.size === 0)
+        return false;
+    return keys.has(key) || keys.has('*');
+}
+function detectCollectionFlows(calls, sources, sinks, constProp, code, types, graph) {
+    const taintedVars = constProp.tainted;
+    const unreachableLines = constProp.unreachableLines;
     const flows = [];
     const fieldNames = new Set();
     for (const t of types ?? [])
@@ -1778,7 +1983,13 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
                 }
                 if (arg.variable) {
                     const varName = arg.variable;
-                    const scopedName = call.in_method ? `${call.in_method}:${varName}` : varName;
+                    let scopedName = varName;
+                    if (call.in_method) {
+                        const blockLine = graph
+                            ? defLineForUse(graph, varName, call.location.line)
+                            : call.location.line;
+                        scopedName = constPropFlowLookup('java', call.in_method, varName, blockLine, constProp, true);
+                    }
                     // Bare `name` that is a field read (no local of that name in this
                     // method) still counts as a field use — Inter4-style. A shadowing
                     // local declaration in the method does not.
@@ -1788,7 +1999,12 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
                         && expr === varName
                         && !methodHasLocalDecl(code, call.in_method, varName, call.location.line);
                     const isFieldUse = explicitField || bareFieldRead;
-                    if (isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isFieldUse)) {
+                    const mapKeyRead = mapGetLiteralKeyFromExpr(expr);
+                    let argTainted = isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isFieldUse);
+                    if (mapKeyRead && mapKeyRead.map === varName) {
+                        argTainted = isMapLiteralKeyTainted(constProp, varName, mapKeyRead.key, call.in_method);
+                    }
+                    if (argTainted) {
                         // Sprint 13 #70 — pick a source in the same method scope as the
                         // sink, not blanket sources[0]. The varName-based match is
                         // primary; method-scope is the tiebreaker; sources[0] is the
@@ -1843,12 +2059,19 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
                         { method: 'peek', re: /(\w+)\.peek\(/ },
                         { method: 'toArray', re: /(\w+)\.toArray\(/ },
                     ];
-                    for (const { re } of collectionPatterns) {
+                    for (const { method, re } of collectionPatterns) {
                         const match = expr.match(re);
                         if (match) {
                             const collectionVar = match[1];
                             const scopedCollection = call.in_method ? `${call.in_method}:${collectionVar}` : collectionVar;
-                            if (taintedVars.has(collectionVar) || taintedVars.has(scopedCollection)) {
+                            const mapKey = method === 'get' ? mapGetLiteralKeyFromExpr(expr) : null;
+                            let collectionTainted = taintedVars.has(collectionVar) || taintedVars.has(scopedCollection);
+                            if (mapKey && mapKey.map === collectionVar) {
+                                collectionTainted = isMapLiteralKeyTainted(constProp, collectionVar, mapKey.key, call.in_method);
+                            }
+                            if (!collectionTainted)
+                                continue;
+                            {
                                 // Sprint 13 #70 — same method-scoped picker as above.
                                 const source = pickScopedSource(sources, sink.line, call.in_method ?? null, types, collectionVar);
                                 if (source) {
@@ -1934,6 +2157,40 @@ function detectArrayElementFlows(calls, sources, sinks, taintedArrayElements, un
     }
     return flows;
 }
+/**
+ * cognium-dev #816 — PAT-PERMS-01: suppress only direct library-parameter →
+ * FileStream path_traversal on non-entry methods. Derived paths (Path.Combine,
+ * GetFullPath chains) and other sinks stay gated only by sanitizer / DFG logic.
+ */
+function csharpPatPermsDirectParamSink(sink, paramVar) {
+    const method = (sink.method ?? '').replace(/^.*\./, '');
+    if (method !== 'FileStream')
+        return false;
+    const code = sink.code ?? '';
+    if (!code)
+        return true;
+    const escaped = paramVar.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`\\bFileStream\\s*\\(\\s*${escaped}\\b`).test(code);
+}
+function shouldGateCSharpPatPermsLibraryParamFlow(flow, sources, sinks, types, ctx) {
+    if (flow.source_type !== 'interprocedural_param' || flow.sink_type !== 'path_traversal') {
+        return false;
+    }
+    const srcVar = flow.path?.[0]?.variable;
+    const sinkVar = flow.path?.[flow.path.length - 1]?.variable;
+    if (!srcVar || srcVar !== sinkVar)
+        return false;
+    const sink = sinks.find((s) => s.line === flow.sink_line && s.type === 'path_traversal');
+    if (!sink || !csharpPatPermsDirectParamSink(sink, srcVar))
+        return false;
+    const src = sources.find((s) => s.line === flow.source_line && s.type === 'interprocedural_param');
+    const methodName = src?.in_method;
+    if (!methodName)
+        return false;
+    const enclosingType = types.find((t) => t.methods.some((m) => m.name === methodName));
+    const enclosingMethod = enclosingType?.methods.find((m) => m.name === methodName);
+    return shouldGateInterproceduralParam(flow.source_type, enclosingMethod, enclosingType, ctx);
+}
 /** Parameter names referenced as identifiers inside a compound sink argument (#685). */
 function compoundArgParamNames(expression, paramNames) {
     const stripped = expression.replace(/(['"`])(?:\\.|(?!\1).)*\1/g, (m) => ' '.repeat(m.length));
@@ -1948,7 +2205,7 @@ function compoundArgParamNames(expression, paramNames) {
     }
     return matched;
 }
-function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines, tainted, code) {
+function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines, tainted, code, language, filePath) {
     const flows = [];
     const paramSourcesByMethod = new Map();
     for (const source of sources) {
@@ -1998,6 +2255,16 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
                 for (const varName of varNames) {
                     const paramSource = methodParamSources.get(varName);
                     if (paramSource) {
+                        if (language === 'csharp' &&
+                            paramSource.type === 'interprocedural_param' &&
+                            sink.type === 'path_traversal' &&
+                            csharpPatPermsDirectParamSink(sink, varName)) {
+                            const enclosingType = types.find((t) => t.methods.some((m) => m.name === methodName));
+                            const enclosingMethod = enclosingType?.methods.find((m) => m.name === methodName);
+                            if (shouldGateInterproceduralParam(paramSource.type, enclosingMethod, enclosingType, { language, types, filePath, calls })) {
+                                continue;
+                            }
+                        }
                         // Sprint 82 (#189) — sink-type-aware dedup so a sink registered
                         // under multiple types at the same call site (e.g. `redirect` as
                         // both `open_redirect` and `crlf`) emits a flow for each type.
@@ -3504,10 +3771,22 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                     realSourceByVar.set(s.variable, s);
             }
             for (const [varName, derivedLine] of derived) {
-                if (!varName || existingVars.has(varName))
+                if (!varName)
                     continue;
                 const owner = methodAt(derivedLine);
                 const fieldAlias = isDeclaredField(derivedLine, varName);
+                if (existingVars.has(varName)) {
+                    if (!fieldAlias)
+                        continue;
+                    // cognium-dev#626: a bean setter's `interprocedural_param` stub must not
+                    // block the declared-field alias derived from a tainted `setFoo(...)` /
+                    // `this.foo =` write — otherwise sinks in other methods never see `foo`.
+                    const stubIdx = sourcesWithVar.findIndex(s => s.variable === varName && s.type === 'interprocedural_param');
+                    if (stubIdx < 0)
+                        continue;
+                    sourcesWithVar.splice(stubIdx, 1);
+                    existingVars.delete(varName);
+                }
                 let scopedAnchor = anchor;
                 if (owner) {
                     let best;