circle-ir 4.7.0 → 4.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/config-loader.d.ts.map +1 -1
- package/dist/analysis/config-loader.js +5 -2
- package/dist/analysis/config-loader.js.map +1 -1
- package/dist/analysis/interprocedural.d.ts.map +1 -1
- package/dist/analysis/interprocedural.js +16 -1
- package/dist/analysis/interprocedural.js.map +1 -1
- package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
- package/dist/analysis/passes/language-sources-pass.js +42 -2
- package/dist/analysis/passes/language-sources-pass.js.map +1 -1
- package/dist/analysis/passes/unrestricted-file-upload-pass.d.ts.map +1 -1
- package/dist/analysis/passes/unrestricted-file-upload-pass.js +6 -4
- package/dist/analysis/passes/unrestricted-file-upload-pass.js.map +1 -1
- package/dist/analysis/passes/unused-variable-pass.d.ts.map +1 -1
- package/dist/analysis/passes/unused-variable-pass.js +69 -20
- package/dist/analysis/passes/unused-variable-pass.js.map +1 -1
- package/dist/browser/circle-ir.js +92 -22
- package/dist/core/circle-ir-core.cjs +9 -6
- package/dist/core/circle-ir-core.js +9 -6
- package/dist/core/extractors/dfg.js +6 -3
- package/dist/core/extractors/dfg.js.map +1 -1
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,
|
|
1
|
+
{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA28DtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAuiBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
|
|
@@ -1334,8 +1334,11 @@ export const DEFAULT_SINKS = [
|
|
|
1334
1334
|
// SAX handler sinks (can lead to XSS in parsed content)
|
|
1335
1335
|
{ method: 'startElement', class: 'ContentHandler', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0, 1, 2] },
|
|
1336
1336
|
{ method: 'characters', class: 'ContentHandler', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
|
|
1337
|
-
// Template output sinks
|
|
1338
|
-
|
|
1337
|
+
// Template output sinks. `output` is classless (Java template engines /
|
|
1338
|
+
// Velocity), but Rust `std::process::Command::…output()` is process
|
|
1339
|
+
// execution, not HTML — it already fires the CWE-78 command_injection sink,
|
|
1340
|
+
// so exclude Rust here to drop the spurious xss (cognium-dev#146).
|
|
1341
|
+
{ method: 'output', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], exclude_languages: ['rust'] },
|
|
1339
1342
|
{ method: 'setOutput', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
|
|
1340
1343
|
{ method: 'writeAttribute', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0, 1] },
|
|
1341
1344
|
// AntiSamy specific (SAX filters)
|