circle-ir 4.17.0 → 4.18.1

package/dist/analysis/passes/taint-propagation-pass.js

@@ -20,6 +20,7 @@ import { walkBackwardDefs } from '../dfg-walk.js';
 import { sanitizerCoversSink } from '../sanitizer-index.js';
 import { HTML_CONTEXT_ENCODER_METHODS } from '../constant-propagation/patterns.js';
 import { javaCanonicalStartsWithAllBare } from '../java-canonical-prefix.js';
+import { shouldGateInterproceduralParam } from '../entry-point-detection.js';
 /**
  * cognium-dev#328 — the const-prop per-step veto, with two scoped exemptions.
  *
@@ -438,6 +439,40 @@ function indexJavaLocalAssignments(code) {
     }
     return index;
 }
+function goCalleeBaseName(callee) {
+    const dot = callee.lastIndexOf('.');
+    return dot === -1 ? callee : callee.slice(dot + 1);
+}
+/** cognium-dev#783: callee from a Go `:=` or `var x =` assignment line (unqualified or dotted). */
+function goConstantHelperCalleeOnLine(line) {
+    const m = line.match(/:=\s*([\w.]+)\s*\(/) ?? line.match(/\bvar\s+\w+\s*=\s*([\w.]+)\s*\(/);
+    if (!m)
+        return null;
+    return goCalleeBaseName(m[1]);
+}
+/** Same as {@link goConstantHelperCalleeOnLine} when the call spans the next lines after `:=` / `var`. */
+function goConstantHelperCalleeFromLines(lines, lineNumber) {
+    const direct = goConstantHelperCalleeOnLine(lines[lineNumber - 1] ?? '');
+    if (direct)
+        return direct;
+    const cur = lines[lineNumber - 1] ?? '';
+    const partial = cur.match(/:=\s*([\w.]+)\s*$/) ?? cur.match(/\bvar\s+\w+\s*=\s*([\w.]+)\s*$/);
+    if (partial) {
+        const next = (lines[lineNumber] ?? '').trimStart();
+        if (next.startsWith('('))
+            return goCalleeBaseName(partial[1]);
+    }
+    if (!cur.includes(':=') && !/\bvar\s+\w+\s*=/.test(cur))
+        return null;
+    if (cur.includes('('))
+        return null;
+    for (let i = lineNumber + 1; i <= Math.min(lines.length, lineNumber + 4); i++) {
+        const m = (lines[i - 1] ?? '').match(/^\s*([\w.]+)\s*\(/);
+        if (m)
+            return goCalleeBaseName(m[1]);
+    }
+    return null;
+}
 function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers) {
     const lines = typeof code === 'string' ? code.split('\n') : [];
     const selfReassign = new Map();
@@ -588,8 +623,8 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
             if (step.line === sinkLine &&
                 !constProp.tainted.has(fpLookup)) {
                 for (let ln = sourceLine; ln <= sinkLine; ln++) {
-                    const calleeMatch = (lines[ln - 1] ?? '').match(/:=\s*(\w+)\s*\(/);
-                    if (calleeMatch && constProp.constantReturningMethods?.has(calleeMatch[1])) {
+                    const callee = goConstantHelperCalleeFromLines(lines, ln);
+                    if (callee && constProp.constantReturningMethods?.has(callee)) {
                         return true;
                     }
                 }
@@ -908,7 +943,7 @@ export class TaintPropagationPass {
         }
         // Supplement: direct parameter-to-sink flows
         // Sprint 82 (#189) — sink-type-aware dedup (see arrayFlows comment).
-        const paramFlows = detectParameterSinkFlows(types, calls, sources, sinks, constProp.unreachableLines, constProp.tainted, ctx.code) ?? [];
+        const paramFlows = detectParameterSinkFlows(types, calls, sources, sinks, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language, graph.ir.meta.file) ?? [];
         for (const f of paramFlows) {
             pushIfNew(f);
         }
@@ -1022,6 +1057,14 @@ export class TaintPropagationPass {
                 return false;
             return true;
         });
+        if (ctx.language === 'csharp') {
+            finalFlows = finalFlows.filter((f) => !shouldGateCSharpPatPermsLibraryParamFlow(f, sources, sinks, types, {
+                language: ctx.language,
+                types,
+                filePath: graph.ir.meta.file,
+                calls,
+            }));
+        }
         // Sprint 24 (cognium-dev #102) — uniform line-keyed sanitizer
         // suppression. Drop any flow whose sink_line carries a registered
         // sanitizer that covers the flow's sink_type. Several supplementary
@@ -1713,7 +1756,7 @@ function detectJsModuleScopeFlows(code, sources, sinks, unreachableLines) {
         const stripped = line.replace(/\s+$/, '');
         if (!stripped || /^[ \t]/.test(line))
             continue;
-        const m = stripped.match(/^(?:let|var|const)\s+([A-Za-z_$][\w$]*)\b/);
+        const m = stripped.match(/^(?:export\s+)?(?:let|var|const)\s+([A-Za-z_$][\w$]*)\b/);
         if (m)
             moduleVars.add(m[1]);
     }
@@ -1732,7 +1775,7 @@ function detectJsModuleScopeFlows(code, sources, sinks, unreachableLines) {
         if (unreachableLines.has(i + 1))
             continue;
         for (const lhs of moduleVars) {
-            const declRe = new RegExp(`\\b(?:let|const|var)\\s+${lhs.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
+            const declRe = new RegExp(`\\b(?:export\\s+)?(?:let|const|var)\\s+${lhs.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
             if (declRe.test(line))
                 continue;
             const m = line.match(new RegExp(`\\b${lhs.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=\\s*([^;]+)`));
@@ -1901,6 +1944,18 @@ function isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isField
     }
     return true;
 }
+function mapGetLiteralKeyFromExpr(expr) {
+    const m = expr.match(/\b([A-Za-z_]\w*)\s*\.\s*get\s*\(\s*"([^"]*)"\s*\)/);
+    return m ? { map: m[1], key: m[2] } : null;
+}
+function isMapLiteralKeyTainted(constProp, mapName, key, inMethod) {
+    const scoped = inMethod ? `${inMethod}:${mapName}` : mapName;
+    const keys = constProp.taintedCollections.get(mapName) ??
+        constProp.taintedCollections.get(scoped);
+    if (!keys || keys.size === 0)
+        return false;
+    return keys.has(key) || keys.has('*');
+}
 function detectCollectionFlows(calls, sources, sinks, constProp, code, types, graph) {
     const taintedVars = constProp.tainted;
     const unreachableLines = constProp.unreachableLines;
@@ -1944,7 +1999,12 @@ function detectCollectionFlows(calls, sources, sinks, constProp, code, types, gr
                         && expr === varName
                         && !methodHasLocalDecl(code, call.in_method, varName, call.location.line);
                     const isFieldUse = explicitField || bareFieldRead;
-                    if (isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isFieldUse)) {
+                    const mapKeyRead = mapGetLiteralKeyFromExpr(expr);
+                    let argTainted = isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isFieldUse);
+                    if (mapKeyRead && mapKeyRead.map === varName) {
+                        argTainted = isMapLiteralKeyTainted(constProp, varName, mapKeyRead.key, call.in_method);
+                    }
+                    if (argTainted) {
                         // Sprint 13 #70 — pick a source in the same method scope as the
                         // sink, not blanket sources[0]. The varName-based match is
                         // primary; method-scope is the tiebreaker; sources[0] is the
@@ -1999,12 +2059,19 @@ function detectCollectionFlows(calls, sources, sinks, constProp, code, types, gr
                         { method: 'peek', re: /(\w+)\.peek\(/ },
                         { method: 'toArray', re: /(\w+)\.toArray\(/ },
                     ];
-                    for (const { re } of collectionPatterns) {
+                    for (const { method, re } of collectionPatterns) {
                         const match = expr.match(re);
                         if (match) {
                             const collectionVar = match[1];
                             const scopedCollection = call.in_method ? `${call.in_method}:${collectionVar}` : collectionVar;
-                            if (taintedVars.has(collectionVar) || taintedVars.has(scopedCollection)) {
+                            const mapKey = method === 'get' ? mapGetLiteralKeyFromExpr(expr) : null;
+                            let collectionTainted = taintedVars.has(collectionVar) || taintedVars.has(scopedCollection);
+                            if (mapKey && mapKey.map === collectionVar) {
+                                collectionTainted = isMapLiteralKeyTainted(constProp, collectionVar, mapKey.key, call.in_method);
+                            }
+                            if (!collectionTainted)
+                                continue;
+                            {
                                 // Sprint 13 #70 — same method-scoped picker as above.
                                 const source = pickScopedSource(sources, sink.line, call.in_method ?? null, types, collectionVar);
                                 if (source) {
@@ -2090,6 +2157,40 @@ function detectArrayElementFlows(calls, sources, sinks, taintedArrayElements, un
     }
     return flows;
 }
+/**
+ * cognium-dev #816 — PAT-PERMS-01: suppress only direct library-parameter →
+ * FileStream path_traversal on non-entry methods. Derived paths (Path.Combine,
+ * GetFullPath chains) and other sinks stay gated only by sanitizer / DFG logic.
+ */
+function csharpPatPermsDirectParamSink(sink, paramVar) {
+    const method = (sink.method ?? '').replace(/^.*\./, '');
+    if (method !== 'FileStream')
+        return false;
+    const code = sink.code ?? '';
+    if (!code)
+        return true;
+    const escaped = paramVar.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`\\bFileStream\\s*\\(\\s*${escaped}\\b`).test(code);
+}
+function shouldGateCSharpPatPermsLibraryParamFlow(flow, sources, sinks, types, ctx) {
+    if (flow.source_type !== 'interprocedural_param' || flow.sink_type !== 'path_traversal') {
+        return false;
+    }
+    const srcVar = flow.path?.[0]?.variable;
+    const sinkVar = flow.path?.[flow.path.length - 1]?.variable;
+    if (!srcVar || srcVar !== sinkVar)
+        return false;
+    const sink = sinks.find((s) => s.line === flow.sink_line && s.type === 'path_traversal');
+    if (!sink || !csharpPatPermsDirectParamSink(sink, srcVar))
+        return false;
+    const src = sources.find((s) => s.line === flow.source_line && s.type === 'interprocedural_param');
+    const methodName = src?.in_method;
+    if (!methodName)
+        return false;
+    const enclosingType = types.find((t) => t.methods.some((m) => m.name === methodName));
+    const enclosingMethod = enclosingType?.methods.find((m) => m.name === methodName);
+    return shouldGateInterproceduralParam(flow.source_type, enclosingMethod, enclosingType, ctx);
+}
 /** Parameter names referenced as identifiers inside a compound sink argument (#685). */
 function compoundArgParamNames(expression, paramNames) {
     const stripped = expression.replace(/(['"`])(?:\\.|(?!\1).)*\1/g, (m) => ' '.repeat(m.length));
@@ -2104,7 +2205,7 @@ function compoundArgParamNames(expression, paramNames) {
     }
     return matched;
 }
-function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines, tainted, code) {
+function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines, tainted, code, language, filePath) {
     const flows = [];
     const paramSourcesByMethod = new Map();
     for (const source of sources) {
@@ -2154,6 +2255,16 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
                 for (const varName of varNames) {
                     const paramSource = methodParamSources.get(varName);
                     if (paramSource) {
+                        if (language === 'csharp' &&
+                            paramSource.type === 'interprocedural_param' &&
+                            sink.type === 'path_traversal' &&
+                            csharpPatPermsDirectParamSink(sink, varName)) {
+                            const enclosingType = types.find((t) => t.methods.some((m) => m.name === methodName));
+                            const enclosingMethod = enclosingType?.methods.find((m) => m.name === methodName);
+                            if (shouldGateInterproceduralParam(paramSource.type, enclosingMethod, enclosingType, { language, types, filePath, calls })) {
+                                continue;
+                            }
+                        }
                         // Sprint 82 (#189) — sink-type-aware dedup so a sink registered
                         // under multiple types at the same call site (e.g. `redirect` as
                         // both `open_redirect` and `crlf`) emits a flow for each type.
@@ -3660,10 +3771,22 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                     realSourceByVar.set(s.variable, s);
             }
             for (const [varName, derivedLine] of derived) {
-                if (!varName || existingVars.has(varName))
+                if (!varName)
                     continue;
                 const owner = methodAt(derivedLine);
                 const fieldAlias = isDeclaredField(derivedLine, varName);
+                if (existingVars.has(varName)) {
+                    if (!fieldAlias)
+                        continue;
+                    // cognium-dev#626: a bean setter's `interprocedural_param` stub must not
+                    // block the declared-field alias derived from a tainted `setFoo(...)` /
+                    // `this.foo =` write — otherwise sinks in other methods never see `foo`.
+                    const stubIdx = sourcesWithVar.findIndex(s => s.variable === varName && s.type === 'interprocedural_param');
+                    if (stubIdx < 0)
+                        continue;
+                    sourcesWithVar.splice(stubIdx, 1);
+                    existingVars.delete(varName);
+                }
                 let scopedAnchor = anchor;
                 if (owner) {
                     let best;