circle-ir 4.5.0 → 4.7.0

package/dist/browser/circle-ir.js

@@ -13793,7 +13793,10 @@ var DEFAULT_SINKS = [
   { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# command injection — Process.Start / ProcessStartInfo (CWE-78).
-  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // Both the single-string overload `Process.Start("sh -c " + x)` and the
+  // `(fileName, arguments)` overload `Process.Start("/bin/sh", "-c " + x)` are
+  // injectable — the second is the argv path where taint rides arg[1] (#276).
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   // C# path traversal — System.IO file APIs (CWE-22). Distinctive method names.
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13834,6 +13837,22 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
+  // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
+  // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
+  // `TypedResults.Redirect(url)` also route through the same method name. Taint-
+  // gated, so a constant URL never fires. `LocalRedirect` is deliberately NOT
+  // registered — it rejects non-local URLs and is the documented mitigation.
+  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  { method: "RedirectPermanent", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  // C# CRLF / HTTP response-header injection — classic ASP.NET header writers
+  // (CWE-113, cognium-dev#273/#275). The injectable value is the second arg.
+  { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  // C# NoSQL injection — MongoDB filter built from raw JSON (CWE-943,
+  // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
+  // attacker-controlled query document. Class-scoped (static receiver resolves).
+  { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -27036,11 +27055,12 @@ function findCSharpRequestSources(sourceCode, language) {
   const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
+  const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
   for (let i2 = 0; i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m) continue;
     const [, varName, rhs] = m;
-    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : null;
+    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
     if (!type) continue;
     const lineNumber = i2 + 1;
     if (sources.some((s) => s.line === lineNumber && s.variable === varName)) continue;
@@ -33928,7 +33948,9 @@ var SinkFilterPass = class {
     if (language === "csharp") {
       const sourceLines = ctx.code.split("\n");
       const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
+      const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
+        if (sink.type === "xxe" && xxeHardened) return false;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
         for (const { re, type } of CSHARP_SANITIZER_RES) {
           if (type === sink.type && re.test(sinkLineText)) return false;
@@ -37084,6 +37106,8 @@ function isPublicMethod(method, language) {
   switch (language) {
     case "java":
       return method.modifiers.includes("public");
+    case "csharp":
+      return method.modifiers.includes("public");
     case "javascript":
     case "typescript":
     case "tsx":
@@ -37105,7 +37129,7 @@ var MissingPublicDocPass = class {
     if (UTIL_DIR_RE.test(graph.ir.meta.file)) {
       return { missingDocMethods: [], missingDocTypes: [] };
     }
-    if (!["java", "javascript", "typescript", "tsx", "python"].includes(language)) {
+    if (!["java", "javascript", "typescript", "tsx", "python", "csharp"].includes(language)) {
       return { missingDocMethods: [], missingDocTypes: [] };
     }
     const lines = code.split("\n");
@@ -41538,6 +41562,28 @@ var WEAK_HASH_NAMES = /* @__PURE__ */ new Set([
   "sha-1",
   "sha1"
 ]);
+var CSHARP_WEAK_HASH_CLASSES = /* @__PURE__ */ new Set(["MD5", "SHA1"]);
+var CSHARP_HASH_FACTORY_RECEIVERS = /* @__PURE__ */ new Set([
+  "HashAlgorithm",
+  "KeyedHashAlgorithm",
+  "HMAC",
+  "CryptoConfig"
+]);
+var CSHARP_WEAK_HASH_CTORS = {
+  MD5CryptoServiceProvider: "md5",
+  MD5Cng: "md5",
+  SHA1CryptoServiceProvider: "sha1",
+  SHA1Managed: "sha1",
+  SHA1Cng: "sha1",
+  HMACMD5: "md5",
+  HMACSHA1: "sha1"
+};
+function csharpWeakHashAlgo(cleaned) {
+  if (!cleaned) return null;
+  const base = (cleaned.split(".").pop() ?? cleaned).replace(/^hmac/, "");
+  if (base === "sha") return "sha1";
+  return WEAK_HASH_NAMES.has(base) ? base : null;
+}
 var COMMONS_DIGEST_METHODS = /* @__PURE__ */ new Set([
   "md2",
   "md2Hex",
@@ -41697,6 +41743,19 @@ var WeakHashPass = class {
       }
       return null;
     }
+    if (language === "csharp") {
+      if ((method === "Create" || method === "HashData") && CSHARP_WEAK_HASH_CLASSES.has(receiver)) {
+        return { algorithm: receiver.toLowerCase(), api: `${receiver}.${method}` };
+      }
+      if ((method === "Create" || method === "CreateFromName") && CSHARP_HASH_FACTORY_RECEIVERS.has(receiver)) {
+        const algo = csharpWeakHashAlgo(literalAlgo(call, 0));
+        if (algo) return { algorithm: algo, api: `${receiver}.${method}` };
+      }
+      if (call.is_constructor && CSHARP_WEAK_HASH_CTORS[method]) {
+        return { algorithm: CSHARP_WEAK_HASH_CTORS[method], api: `new ${method}()` };
+      }
+      return null;
+    }
     return null;
   }
 };
@@ -41758,6 +41817,27 @@ var WEAK_CIPHER_BASES = /* @__PURE__ */ new Set([
   "seed",
   "cast5"
 ]);
+var CSHARP_WEAK_CIPHER_CLASSES = /* @__PURE__ */ new Set(["DES", "TripleDES", "RC2", "RC4"]);
+var CSHARP_CIPHER_FACTORY_RECEIVERS = /* @__PURE__ */ new Set(["SymmetricAlgorithm", "CryptoConfig"]);
+var CSHARP_WEAK_CIPHER_CTORS = {
+  DESCryptoServiceProvider: "des",
+  TripleDESCryptoServiceProvider: "3des",
+  RC2CryptoServiceProvider: "rc2"
+};
+var CSHARP_RSA_FACTORY_CLASSES = /* @__PURE__ */ new Set(["RSA", "DSA"]);
+var CSHARP_RSA_CTORS = /* @__PURE__ */ new Set([
+  "RSACryptoServiceProvider",
+  "DSACryptoServiceProvider",
+  "RSACng",
+  "DSACng"
+]);
+function csharpWeakCipher(cleaned) {
+  if (!cleaned) return null;
+  const base = (cleaned.split(".").pop() ?? cleaned).toLowerCase();
+  if (base === "tripledes" || base === "desede") return "3des";
+  if (base === "arc4") return "rc4";
+  return WEAK_CIPHER_BASES.has(base) ? base : null;
+}
 function classifyJavaCipherSpec(spec) {
   const parts2 = spec.split("/").map((p) => p.trim().toLowerCase());
   const base = parts2[0] ?? "";
@@ -42149,6 +42229,34 @@ var WeakCryptoPass = class {
       }
       return out2;
     }
+    if (language === "csharp") {
+      if (method === "Create" && CSHARP_WEAK_CIPHER_CLASSES.has(receiver)) {
+        const base = receiver === "TripleDES" ? "3des" : receiver.toLowerCase();
+        out2.push({ issue: "weak-cipher", detail: base, api: `${receiver}.Create` });
+      }
+      if ((method === "Create" || method === "CreateFromName") && CSHARP_CIPHER_FACTORY_RECEIVERS.has(receiver)) {
+        const base = csharpWeakCipher(literalAlgo2(call, 0));
+        if (base) out2.push({ issue: "weak-cipher", detail: base, api: `${receiver}.${method}` });
+      }
+      if (call.is_constructor && CSHARP_WEAK_CIPHER_CTORS[method]) {
+        out2.push({ issue: "weak-cipher", detail: CSHARP_WEAK_CIPHER_CTORS[method], api: `new ${method}()` });
+      }
+      const rsaFactory = method === "Create" && CSHARP_RSA_FACTORY_CLASSES.has(receiver);
+      const rsaCtor = call.is_constructor && CSHARP_RSA_CTORS.has(method);
+      if (rsaFactory || rsaCtor) {
+        const sizeArg = call.arguments.find((a) => a.position === 0);
+        const expr = (sizeArg?.literal ?? sizeArg?.expression ?? "").trim();
+        const n = parseInt(expr, 10);
+        if (Number.isFinite(n) && n > 0 && n < 2048) {
+          out2.push({
+            issue: "weak-rsa-key",
+            detail: String(n),
+            api: rsaCtor ? `new ${method}()` : `${receiver}.Create`
+          });
+        }
+      }
+      return out2;
+    }
     return out2;
   }
 };
@@ -43162,6 +43270,45 @@ function methodAcceptsHtmlShapedParam(method) {
   return false;
 }
 
+// src/analysis/passes/insecure-deserialization-config-pass.ts
+var ANY_TYPE_PERMISSION_RE = /\bAnyTypePermission\b/;
+var InsecureDeserializationConfigPass = class {
+  name = "insecure-deserialization-config";
+  category = "security";
+  run(ctx) {
+    const { graph, language } = ctx;
+    if (language !== "java") return { findings: [] };
+    const file = graph.ir.meta.file;
+    const findings = [];
+    for (const call of graph.ir.calls) {
+      if (!this.isPermissiveXStreamConfig(call)) continue;
+      const line = call.location.line;
+      const api = `addPermission(${call.arguments[0]?.expression ?? "AnyTypePermission"})`;
+      findings.push({ line, api });
+      ctx.addFinding({
+        id: `${this.name}-${file}-${line}`,
+        pass: this.name,
+        category: this.category,
+        rule_id: this.name,
+        cwe: "CWE-502",
+        severity: "high",
+        level: "error",
+        message: "XStream configured with AnyTypePermission (grant-all): untrusted XML passed to fromXML/unmarshal can instantiate arbitrary types (deserialization RCE)",
+        file,
+        line,
+        fix: "Replace AnyTypePermission with an explicit type allow-list: xstream.addPermission(NoTypePermission.NONE) then allowTypes/allowTypesByWildcard for the classes you deserialize.",
+        evidence: { api, language }
+      });
+    }
+    return { findings };
+  }
+  isPermissiveXStreamConfig(call) {
+    if (call.method_name !== "addPermission") return false;
+    const arg0 = call.arguments[0]?.expression;
+    return typeof arg0 === "string" && ANY_TYPE_PERMISSION_RE.test(arg0);
+  }
+};
+
 // src/analysis/passes/plaintext-password-storage-pass.ts
 function isWriteStorageCall(call, language) {
   const method = call.method_name ?? "";
@@ -45518,6 +45665,7 @@ async function analyze(code, filePath, language, options = {}) {
     if (!disabledPasses.has("info-disclosure-stacktrace")) pipeline.add(new InfoDisclosureStacktracePass());
     if (!disabledPasses.has("unrestricted-file-upload")) pipeline.add(new UnrestrictedFileUploadPass());
     if (!disabledPasses.has("missing-sanitizer-gate")) pipeline.add(new MissingSanitizerGatePass());
+    if (!disabledPasses.has("insecure-deserialization-config")) pipeline.add(new InsecureDeserializationConfigPass());
     const { results, findings } = pipeline.run(graph, code, language, config);
     const sinkFilter = results.get("sink-filter");
     const interProc = results.get("interprocedural");

package/dist/core/circle-ir-core.cjs

@@ -13188,7 +13188,10 @@ var DEFAULT_SINKS = [
   { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# command injection — Process.Start / ProcessStartInfo (CWE-78).
-  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // Both the single-string overload `Process.Start("sh -c " + x)` and the
+  // `(fileName, arguments)` overload `Process.Start("/bin/sh", "-c " + x)` are
+  // injectable — the second is the argv path where taint rides arg[1] (#276).
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   // C# path traversal — System.IO file APIs (CWE-22). Distinctive method names.
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13229,6 +13232,22 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
+  // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
+  // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
+  // `TypedResults.Redirect(url)` also route through the same method name. Taint-
+  // gated, so a constant URL never fires. `LocalRedirect` is deliberately NOT
+  // registered — it rejects non-local URLs and is the documented mitigation.
+  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  { method: "RedirectPermanent", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  // C# CRLF / HTTP response-header injection — classic ASP.NET header writers
+  // (CWE-113, cognium-dev#273/#275). The injectable value is the second arg.
+  { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  // C# NoSQL injection — MongoDB filter built from raw JSON (CWE-943,
+  // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
+  // attacker-controlled query document. Class-scoped (static receiver resolves).
+  { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },

package/dist/core/circle-ir-core.js

@@ -13122,7 +13122,10 @@ var DEFAULT_SINKS = [
   { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   // C# command injection — Process.Start / ProcessStartInfo (CWE-78).
-  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  // Both the single-string overload `Process.Start("sh -c " + x)` and the
+  // `(fileName, arguments)` overload `Process.Start("/bin/sh", "-c " + x)` are
+  // injectable — the second is the argv path where taint rides arg[1] (#276).
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   // C# path traversal — System.IO file APIs (CWE-22). Distinctive method names.
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -13163,6 +13166,22 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
+  // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
+  // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
+  // `TypedResults.Redirect(url)` also route through the same method name. Taint-
+  // gated, so a constant URL never fires. `LocalRedirect` is deliberately NOT
+  // registered — it rejects non-local URLs and is the documented mitigation.
+  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  { method: "RedirectPermanent", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  // C# CRLF / HTTP response-header injection — classic ASP.NET header writers
+  // (CWE-113, cognium-dev#273/#275). The injectable value is the second arg.
+  { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  // C# NoSQL injection — MongoDB filter built from raw JSON (CWE-943,
+  // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
+  // attacker-controlled query document. Class-scoped (static receiver resolves).
+  { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "4.5.0",
+  "version": "4.7.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",