circle-ir 4.7.0 → 4.7.2

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAw8DtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAuiBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAkgEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAuiBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -1091,7 +1091,11 @@ export const DEFAULT_SINKS = [
     // File: covers both File(String pathname) and File(parent, child). The 2-arg
     // overload's child argument carries CVE-2018-8041 (Camel mail Content-Disposition
     // filename written to disk).
-    { method: 'File', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1] },
+    // Java `new File(path)` idiom. Excluded for C#: there is no `new File()` in
+    // .NET (it's `System.IO.File` statics + `FileStream`, covered separately), and
+    // this over-matched ASP.NET `ControllerBase.File(stream|bytes, contentType)` —
+    // a result helper that returns a file, not a path sink (cognium-ai#326 B).
+    { method: 'File', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1], exclude_languages: ['csharp'] },
     { method: 'FileInputStream', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'FileOutputStream', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'FileReader', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
@@ -1334,8 +1338,11 @@ export const DEFAULT_SINKS = [
     // SAX handler sinks (can lead to XSS in parsed content)
     { method: 'startElement', class: 'ContentHandler', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0, 1, 2] },
     { method: 'characters', class: 'ContentHandler', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
-    // Template output sinks
-    { method: 'output', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
+    // Template output sinks. `output` is classless (Java template engines /
+    // Velocity), but Rust `std::process::Command::…output()` is process
+    // execution, not HTML — it already fires the CWE-78 command_injection sink,
+    // so exclude Rust here to drop the spurious xss (cognium-dev#146).
+    { method: 'output', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], exclude_languages: ['rust'] },
     { method: 'setOutput', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
     { method: 'writeAttribute', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0, 1] },
     // AntiSamy specific (SAX filters)
@@ -2641,6 +2648,22 @@ export const DEFAULT_SINKS = [
     { method: 'FileStream', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'StreamReader', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'StreamWriter', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // Remaining System.IO.File path APIs — class-scoped so they don't collide
+    // with unrelated methods. Copy/Move take a source AND destination path (both
+    // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
+    { method: 'Copy', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1], languages: ['csharp'] },
+    { method: 'Move', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1], languages: ['csharp'] },
+    { method: 'Delete', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Open', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'OpenText', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Create', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'WriteAllLines', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'AppendAllLines', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // System.IO.Directory path APIs.
+    { method: 'CreateDirectory', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Delete', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'GetFiles', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'EnumerateFiles', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // C# SSRF — HttpClient / WebClient / WebRequest (CWE-918).
     { method: 'GetAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'PostAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
@@ -2657,9 +2680,24 @@ export const DEFAULT_SINKS = [
     // C# code injection — dynamic script/assembly loading (CWE-94).
     { method: 'EvaluateAsync', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     { method: 'RunAsync', class: 'CSharpScript', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
-    // C# insecure deserialization — BinaryFormatter et al. (CWE-502).
+    // Loading an assembly from an attacker-controlled name/path is arbitrary code
+    // execution. Class-scoped to `Assembly` (low FP — a tainted arg here is rare
+    // in benign code). `Type.GetType`/`Activator.CreateInstance` are intentionally
+    // NOT added — reflection with config-driven type names is common in DI, an FP
+    // trap without the reflection-suppress machinery.
+    { method: 'Load', class: 'Assembly', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LoadFrom', class: 'Assembly', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LoadFile', class: 'Assembly', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    // C# insecure deserialization — the polymorphic BCL formatters that can
+    // instantiate arbitrary types named in the payload (CWE-502, cognium-ai#318).
+    // Each of these classes exists only to deserialize and is unsafe on untrusted
+    // input; class-scoped, so no collision with safe JSON APIs (System.Text.Json /
+    // Newtonsoft-default, which are intentionally NOT sinks).
     { method: 'Deserialize', class: 'BinaryFormatter', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     { method: 'Deserialize', class: 'NetDataContractSerializer', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Deserialize', class: 'SoapFormatter', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Deserialize', class: 'LosFormatter', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Deserialize', class: 'ObjectStateFormatter', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     // C# XSS — raw HTML output (CWE-79).
     { method: 'Raw', class: 'Html', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'Write', class: 'Response', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
@@ -2684,6 +2722,20 @@ export const DEFAULT_SINKS = [
     // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
     // attacker-controlled query document. Class-scoped (static receiver resolves).
     { method: 'Parse', class: 'BsonDocument', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // C# log injection — Microsoft.Extensions.Logging `ILogger` (CWE-117,
+    // cognium-ai#318). Only the message TEMPLATE (arg[0]) is the injectable
+    // position; the structured form `LogInformation("… {Id}", id)` keeps taint in
+    // later args (the logger renders them as data), so arg_positions:[0] does not
+    // flag it. Mirrors the Java `Logger` sinks; severity low.
+    { method: 'LogInformation', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LogWarning', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LogError', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LogDebug', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LogCritical', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LogTrace', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    // Generic `ILogger.Log(logLevel, message, …)` — class-scoped (`Log` alone is
+    // too generic); the message is arg[1].
+    { method: 'Log', class: 'ILogger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [1], languages: ['csharp'] },
     // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
     { method: 'SelectSingleNode', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'SelectNodes', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
@@ -2692,6 +2744,11 @@ export const DEFAULT_SINKS = [
     { method: 'LoadXml', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'Load', class: 'XmlDocument', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'Load', class: 'XDocument', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // `new XmlTextReader(input)` — its DtdProcessing defaults to Parse (resolves
+    // external entities), unlike `XmlReader.Create` (Prohibit). CWE-611,
+    // cognium-ai#318. The 4.7.0 XmlResolver=null / DtdProcessing=Prohibit
+    // hardening still suppresses the safe shape.
+    { method: 'XmlTextReader', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // Python SQLi — asyncpg Connection.*
     { method: 'execute', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0] },
     { method: 'fetch', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0] },