circle-ir 4.16.1 → 4.18.1

package/dist/analysis/comment-lines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-lines.js","sourceRoot":"","sources":["../../src/analysis/comment-lines.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,uBAAuB,CAAC,IAAU,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,OAAO,CAAC,IAAY,EAAW,EAAE;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;QAClC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC;gBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1E,IAAI,CAAC,GAAgB,IAAI,CAAC;gBAC1B,yEAAyE;gBACzE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC;oBAChE,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBACpD,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,MAAM,YAAY,GAChB,CAAC,CAAC,aAAa,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC;wBAC9B,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;oBACxE,MAAM,SAAS,GACb,CAAC,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC;wBAC5B,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;oBAClE,MAAM,GAAG,YAAY,IAAI,SAAS,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EA60B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2rEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAkjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAi1B1C,CAAC;AAkLF,eAAO,MAAM,aAAa,EAAE,WAAW,EA4uEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAkjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -780,6 +780,10 @@ export const DEFAULT_SOURCES = [
     { method: 'get', class: 'Redis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['javascript', 'typescript'] },
     { method: 'hget', class: 'Redis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['javascript', 'typescript'] },
     { method: 'mget', class: 'Redis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['javascript', 'typescript'] },
+    // Node redis clients are often bound to `cache` from `createClient()`; class
+    // `cache` is scoped to JS/TS (Python Django cache above) and Map.get is
+    // filtered in sink-filter-pass (#818 src14).
+    { method: 'get', class: 'cache', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['javascript', 'typescript'] },
     { method: 'get', class: 'Jedis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['java'] },
     { method: 'hget', class: 'Jedis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['java'] },
     { method: 'mget', class: 'Jedis', type: 'db_input', severity: 'medium', return_tainted: true, languages: ['java'] },
@@ -1006,6 +1010,8 @@ const TRUST_BOUNDARY_FRAMEWORK_SINKS = [
     { method: 'SetCookie', class: 'http', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [1], languages: ['go'] },
     // gin: c.SetCookie(name, value, maxAge, path, domain, secure, httpOnly).
     { method: 'SetCookie', class: 'Context', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [1], languages: ['go'] },
+    // --- Rust: actix-session / tower-sessions write -------------------------
+    { method: 'insert', class: 'Session', type: 'trust_boundary', cwe: 'CWE-501', severity: 'medium', arg_positions: [1], languages: ['rust'] },
 ];
 export const DEFAULT_SINKS = [
     // SQL Injection (CWE-89)
@@ -1666,7 +1672,9 @@ export const DEFAULT_SINKS = [
     { method: 'addParametersToContext', class: 'StaticParametersInterceptor', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
     { method: 'build', class: 'HttpParameters', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0] },
     // Cron expression parsing (DoS/ReDoS)
-    { method: 'parse', class: 'CronParser', type: 'code_injection', cwe: 'CWE-94', severity: 'high', arg_positions: [0] },
+    // cognium-dev#998 — Java cron-utils `CronParser`; scoped to Java so a JS/TS
+    // `parser.parse(...)` (tree-sitter, a lockfile parser) never matches it by name.
+    { method: 'parse', class: 'CronParser', type: 'code_injection', cwe: 'CWE-94', severity: 'high', arg_positions: [0], languages: ['java'] },
     { method: 'isValid', class: 'CronValidator', type: 'code_injection', cwe: 'CWE-94', severity: 'high', arg_positions: [0] },
     // ff4j feature flags
     { method: 'check', class: 'FF4j', type: 'code_injection', cwe: 'CWE-94', severity: 'high', arg_positions: [0] },
@@ -1762,9 +1770,13 @@ export const DEFAULT_SINKS = [
     { method: 'selectNodes', class: 'Node', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0] },
     { method: 'selectSingleNode', class: 'Node', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0] },
     // XXE - XML External Entity (CWE-611)
-    { method: 'parse', class: 'DocumentBuilder', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0] },
-    { method: 'parse', class: 'SAXParser', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0] },
-    { method: 'parse', class: 'XMLReader', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0] },
+    // cognium-dev#998 — JAXP parsers are JVM classes. Scoped to Java so the
+    // receiver-name heuristic (`parser` → SAXParser) cannot turn a JS/TS
+    // `parser.parse(text)` into an XXE sink. JS/TS XML parsers (sax, xml2js,
+    // libxmljs, DOMParser) have their own entries.
+    { method: 'parse', class: 'DocumentBuilder', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'parse', class: 'SAXParser', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['java'] },
+    { method: 'parse', class: 'XMLReader', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['java'] },
     { method: 'unmarshal', class: 'Unmarshaller', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0] },
     { method: 'newTransformer', class: 'TransformerFactory', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0] },
     { method: 'transform', class: 'Transformer', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0] },
@@ -2019,6 +2031,46 @@ export const DEFAULT_SINKS = [
     { method: 'each', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
     { method: 'get', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
     { method: 'exec', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], allow_unresolved_receiver: true },
+    // DuckDB from JS/TS: `@duckdb/node-api` (DuckDBConnection), the classic
+    // `duckdb` / `duckdb-async` bindings (Database / Connection) and
+    // `react-native-duckdb` (Database / Transaction). The method names are
+    // generic and the receivers come from factories (`await instance.connect()`,
+    // `open({...})`), so the receiver cannot be typed: the import is the gate
+    // (`requires_import`). Only the SQL text (arg 0) is a sink — values passed
+    // as bound parameters (`run(sql, [v])`, `execute(sql, params)`,
+    // `executeNamed(sql, {k: v})`, `stmt.bind(...)`) are parameterised and do
+    // not reach it.
+    { method: 'run', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api', 'duckdb', 'duckdb-async'] },
+    { method: 'prepare', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api', 'duckdb', 'duckdb-async', 'react-native-duckdb'] },
+    { method: 'stream', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api', 'duckdb', 'duckdb-async', 'react-native-duckdb'] },
+    { method: 'runAndRead', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api'] },
+    { method: 'runAndReadAll', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api'] },
+    { method: 'runAndReadUntil', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api'] },
+    { method: 'streamAndRead', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api'] },
+    { method: 'streamAndReadAll', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api'] },
+    { method: 'streamAndReadUntil', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api'] },
+    { method: 'start', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api'] },
+    { method: 'startStream', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api'] },
+    { method: 'extractStatements', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['@duckdb/node-api'] },
+    { method: 'all', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['duckdb', 'duckdb-async'] },
+    { method: 'each', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['duckdb', 'duckdb-async'] },
+    { method: 'exec', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['duckdb', 'duckdb-async'] },
+    { method: 'arrowIPCAll', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['duckdb', 'duckdb-async'] },
+    { method: 'arrowIPCStream', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['duckdb', 'duckdb-async'] },
+    { method: 'execute', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['react-native-duckdb'] },
+    { method: 'executeSync', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['react-native-duckdb'] },
+    { method: 'executeNamed', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['react-native-duckdb'] },
+    { method: 'executeSyncNamed', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['react-native-duckdb'] },
+    { method: 'streamNamed', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['react-native-duckdb'] },
+    // RxDB (Mango queries, any storage incl. SQLite): a selector or query
+    // object, a field name passed to the query builder, or a `$regex` pattern
+    // under caller control is NoSQL operator injection (CWE-943). Gated on the
+    // `rxdb` import for the same reason as DuckDB above. `find` is already a
+    // classless JS NoSQL sink in the JavaScript plugin.
+    { method: 'findOne', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['rxdb'] },
+    { method: 'count', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['rxdb'] },
+    { method: 'where', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['rxdb'] },
+    { method: 'regex', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'], requires_import: ['rxdb'] },
     // TypeORM QueryBuilder raw fragments (CWE-89). TypeORM's raw `.query(sql)`
     // escape hatch is already covered by the classless `query` sink in the JS
     // plugin (getBuiltinSinks), so it is NOT re-registered here — the dedup
@@ -2129,6 +2181,8 @@ export const DEFAULT_SINKS = [
     { method: 'get', class: 'http', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'request', class: 'https', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'get', class: 'https', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
+    // Node.js dns.promises (CWE-918 / NUL-in-name SSRF class — #895)
+    { method: 'resolve', class: 'dns.promises', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['javascript', 'typescript'] },
     // needle library (used in NodeGoat)
     { method: 'get', class: 'needle', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
     { method: 'post', class: 'needle', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0] },
@@ -2623,7 +2677,7 @@ export const DEFAULT_SINKS = [
     // receiver-taint or operator-LHS-taint tracking — the format string is the
     // receiver, not an argument. Deferred to Sprint 6 (#86 follow-up).
     // C-style: printf / fprintf / sprintf / snprintf via ctypes/cffi.
-    { method: 'printf', type: 'format_string', cwe: 'CWE-134', severity: 'high', arg_positions: [0], languages: ['python'] },
+    { method: 'printf', type: 'format_string', cwe: 'CWE-134', severity: 'high', arg_positions: [0], languages: ['python', 'rust'] },
     { method: 'fprintf', type: 'format_string', cwe: 'CWE-134', severity: 'high', arg_positions: [1], languages: ['python'] },
     // Go: fmt.Sprintf/Printf/Fprintf/Errorf — format string is first/second arg
     { method: 'Sprintf', class: 'fmt', type: 'format_string', cwe: 'CWE-134', severity: 'medium', arg_positions: [0], languages: ['go'] },