circle-ir 4.4.0 → 4.6.0

package/dist/browser/circle-ir.js

@@ -5941,6 +5941,14 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
+  "ExecuteScalar",
+  "ExecuteReader",
+  "ExecuteNonQuery",
+  "ExecuteScalarAsync",
+  "ExecuteReaderAsync",
+  "ExecuteNonQueryAsync"
+]);
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -5958,12 +5966,16 @@ function extractCSharpCalls(tree, cache) {
       methodName = getNodeText(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
+    let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
+    if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
+    }
     calls.push({
       method_name: methodName,
       receiver,
       receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
       receiver_type_fqn: null,
-      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
       in_method: findEnclosingMethod(inv)
     });
@@ -13770,6 +13782,16 @@ var DEFAULT_SINKS = [
   // ADO.NET `cmd.CommandText = "…" + x` — emitted as a synthetic call by
   // extractCSharpCalls (property-assignment sink; the ctor-arg sink misses it).
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // ADO.NET `cmd.Execute*()` — object-carried sink (cognium-dev#271). The taint
+  // rides the SqlCommand receiver (CommandText set from tainted data); the
+  // receiver is surfaced as arg[0] by extractCSharpCalls, and the command object
+  // is tainted in taint-propagation when its CommandText takes a tainted value.
+  { method: "ExecuteScalar", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteReader", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteNonQuery", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteScalarAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# command injection — Process.Start / ProcessStartInfo (CWE-78).
   { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
@@ -27013,15 +27035,17 @@ function findCSharpRequestSources(sourceCode, language) {
   const lines = sourceCode.split("\n");
   const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
+  const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   for (let i2 = 0; i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m) continue;
     const [, varName, rhs] = m;
-    if (!requestReadRe.test(rhs)) continue;
+    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : null;
+    if (!type) continue;
     const lineNumber = i2 + 1;
     if (sources.some((s) => s.line === lineNumber && s.variable === varName)) continue;
     sources.push({
-      type: "http_param",
+      type,
       location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? "..." : ""}`,
       severity: "high",
       line: lineNumber,
@@ -36385,6 +36409,31 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  if (language === "csharp" && typeof code === "string" && sourcesWithVar.length > 0) {
+    const lines = code.split("\n");
+    const ctRe = /(\w+)\s*\.\s*CommandText\s*\+?=\s*(.+)/;
+    const anchor = sourcesWithVar.reduce((a, s) => s.line < a.line ? s : a, sourcesWithVar[0]);
+    let added = true;
+    let guard = 0;
+    while (added && guard < lines.length + 2) {
+      added = false;
+      guard++;
+      const known = new Set(sourcesWithVar.map((s) => s.variable));
+      for (let i2 = 0; i2 < lines.length; i2++) {
+        const m = ctRe.exec(lines[i2]);
+        if (!m) continue;
+        const [, obj, rhs] = m;
+        if (known.has(obj)) continue;
+        const codePart = rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ");
+        const rhsTainted = sourcesWithVar.some(
+          (s) => new RegExp(`(?<![\\p{L}\\p{N}_])${s.variable.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}(?![\\p{L}\\p{N}_])`, "u").test(codePart)
+        );
+        if (!rhsTainted) continue;
+        sourcesWithVar.push({ ...anchor, variable: obj, line: i2 + 1 });
+        added = true;
+      }
+    }
+  }
   const reCache = /* @__PURE__ */ new Map();
   for (const s of sourcesWithVar) {
     if (reCache.has(s.variable)) continue;
@@ -43113,6 +43162,45 @@ function methodAcceptsHtmlShapedParam(method) {
   return false;
 }
 
+// src/analysis/passes/insecure-deserialization-config-pass.ts
+var ANY_TYPE_PERMISSION_RE = /\bAnyTypePermission\b/;
+var InsecureDeserializationConfigPass = class {
+  name = "insecure-deserialization-config";
+  category = "security";
+  run(ctx) {
+    const { graph, language } = ctx;
+    if (language !== "java") return { findings: [] };
+    const file = graph.ir.meta.file;
+    const findings = [];
+    for (const call of graph.ir.calls) {
+      if (!this.isPermissiveXStreamConfig(call)) continue;
+      const line = call.location.line;
+      const api = `addPermission(${call.arguments[0]?.expression ?? "AnyTypePermission"})`;
+      findings.push({ line, api });
+      ctx.addFinding({
+        id: `${this.name}-${file}-${line}`,
+        pass: this.name,
+        category: this.category,
+        rule_id: this.name,
+        cwe: "CWE-502",
+        severity: "high",
+        level: "error",
+        message: "XStream configured with AnyTypePermission (grant-all): untrusted XML passed to fromXML/unmarshal can instantiate arbitrary types (deserialization RCE)",
+        file,
+        line,
+        fix: "Replace AnyTypePermission with an explicit type allow-list: xstream.addPermission(NoTypePermission.NONE) then allowTypes/allowTypesByWildcard for the classes you deserialize.",
+        evidence: { api, language }
+      });
+    }
+    return { findings };
+  }
+  isPermissiveXStreamConfig(call) {
+    if (call.method_name !== "addPermission") return false;
+    const arg0 = call.arguments[0]?.expression;
+    return typeof arg0 === "string" && ANY_TYPE_PERMISSION_RE.test(arg0);
+  }
+};
+
 // src/analysis/passes/plaintext-password-storage-pass.ts
 function isWriteStorageCall(call, language) {
   const method = call.method_name ?? "";
@@ -45469,6 +45557,7 @@ async function analyze(code, filePath, language, options = {}) {
     if (!disabledPasses.has("info-disclosure-stacktrace")) pipeline.add(new InfoDisclosureStacktracePass());
     if (!disabledPasses.has("unrestricted-file-upload")) pipeline.add(new UnrestrictedFileUploadPass());
     if (!disabledPasses.has("missing-sanitizer-gate")) pipeline.add(new MissingSanitizerGatePass());
+    if (!disabledPasses.has("insecure-deserialization-config")) pipeline.add(new InsecureDeserializationConfigPass());
     const { results, findings } = pipeline.run(graph, code, language, config);
     const sinkFilter = results.get("sink-filter");
     const interProc = results.get("interprocedural");

package/dist/core/circle-ir-core.cjs

@@ -5987,6 +5987,14 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
+  "ExecuteScalar",
+  "ExecuteReader",
+  "ExecuteNonQuery",
+  "ExecuteScalarAsync",
+  "ExecuteReaderAsync",
+  "ExecuteNonQueryAsync"
+]);
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -6004,12 +6012,16 @@ function extractCSharpCalls(tree, cache) {
       methodName = getNodeText(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
+    let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
+    if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
+    }
     calls.push({
       method_name: methodName,
       receiver,
       receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
       receiver_type_fqn: null,
-      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
       in_method: findEnclosingMethod(inv)
     });
@@ -13165,6 +13177,16 @@ var DEFAULT_SINKS = [
   // ADO.NET `cmd.CommandText = "…" + x` — emitted as a synthetic call by
   // extractCSharpCalls (property-assignment sink; the ctor-arg sink misses it).
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // ADO.NET `cmd.Execute*()` — object-carried sink (cognium-dev#271). The taint
+  // rides the SqlCommand receiver (CommandText set from tainted data); the
+  // receiver is surfaced as arg[0] by extractCSharpCalls, and the command object
+  // is tainted in taint-propagation when its CommandText takes a tainted value.
+  { method: "ExecuteScalar", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteReader", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteNonQuery", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteScalarAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# command injection — Process.Start / ProcessStartInfo (CWE-78).
   { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },

package/dist/core/circle-ir-core.js

@@ -5921,6 +5921,14 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_COMMAND_EXECUTE_METHODS = /* @__PURE__ */ new Set([
+  "ExecuteScalar",
+  "ExecuteReader",
+  "ExecuteNonQuery",
+  "ExecuteScalarAsync",
+  "ExecuteReaderAsync",
+  "ExecuteNonQueryAsync"
+]);
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -5938,12 +5946,16 @@ function extractCSharpCalls(tree, cache) {
       methodName = getNodeText(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
+    let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
+    if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
+    }
     calls.push({
       method_name: methodName,
       receiver,
       receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
       receiver_type_fqn: null,
-      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
       in_method: findEnclosingMethod(inv)
     });
@@ -13099,6 +13111,16 @@ var DEFAULT_SINKS = [
   // ADO.NET `cmd.CommandText = "…" + x` — emitted as a synthetic call by
   // extractCSharpCalls (property-assignment sink; the ctor-arg sink misses it).
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // ADO.NET `cmd.Execute*()` — object-carried sink (cognium-dev#271). The taint
+  // rides the SqlCommand receiver (CommandText set from tainted data); the
+  // receiver is surfaced as arg[0] by extractCSharpCalls, and the command object
+  // is tainted in taint-propagation when its CommandText takes a tainted value.
+  { method: "ExecuteScalar", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteReader", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteNonQuery", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteScalarAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# command injection — Process.Start / ProcessStartInfo (CWE-78).
   { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },

package/dist/core/extractors/calls.js

@@ -155,6 +155,11 @@ function findFirstDescendant(node, type) {
     }
     return null;
 }
+/** ADO.NET command-execution methods whose taint rides the receiver object. */
+const CSHARP_COMMAND_EXECUTE_METHODS = new Set([
+    'ExecuteScalar', 'ExecuteReader', 'ExecuteNonQuery',
+    'ExecuteScalarAsync', 'ExecuteReaderAsync', 'ExecuteNonQueryAsync',
+]);
 function extractCSharpCalls(tree, cache) {
     const calls = [];
     const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -173,12 +178,21 @@ function extractCSharpCalls(tree, cache) {
             methodName = getNodeText(fn);
         }
         const argsNode = inv.childForFieldName('arguments');
+        let args = argsNode ? extractCSharpArguments(argsNode) : [];
+        // ADO.NET `Execute*()` carries taint via the RECEIVER (a SqlCommand whose
+        // CommandText was set from tainted data), not an argument. Surface the
+        // receiver as arg[0] so the arg-based flow scan can match a tainted command
+        // object (cognium-dev#271 — the canonical `cmd.CommandText=…; cmd.Execute*()`
+        // Juliet shape). The command-object taint is seeded in taint-propagation.
+        if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
+            args = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args];
+        }
         calls.push({
             method_name: methodName,
             receiver,
             receiver_type: receiver ? (typeMap.get(receiver) ?? null) : null,
             receiver_type_fqn: null,
-            arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+            arguments: args,
             location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
             in_method: findEnclosingMethod(inv),
         });