circle-ir 4.7.1 → 4.8.2

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA28DtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAuiBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAyhEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAuiBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -1091,7 +1091,11 @@ export const DEFAULT_SINKS = [
     // File: covers both File(String pathname) and File(parent, child). The 2-arg
     // overload's child argument carries CVE-2018-8041 (Camel mail Content-Disposition
     // filename written to disk).
-    { method: 'File', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1] },
+    // Java `new File(path)` idiom. Excluded for C#: there is no `new File()` in
+    // .NET (it's `System.IO.File` statics + `FileStream`, covered separately), and
+    // this over-matched ASP.NET `ControllerBase.File(stream|bytes, contentType)` —
+    // a result helper that returns a file, not a path sink (cognium-ai#326 B).
+    { method: 'File', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1], exclude_languages: ['csharp'] },
     { method: 'FileInputStream', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'FileOutputStream', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
     { method: 'FileReader', class: 'constructor', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0] },
@@ -2616,6 +2620,11 @@ export const DEFAULT_SINKS = [
     // ADO.NET `cmd.CommandText = "…" + x` — emitted as a synthetic call by
     // extractCSharpCalls (property-assignment sink; the ctor-arg sink misses it).
     { method: 'CommandText', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    // `DirectorySearcher.Filter = "(uid=" + x + ")"` — LDAP injection (cognium-ai#272).
+    // Emitted as a synthetic call by extractCSharpCalls ONLY when the receiver
+    // resolves to a DirectorySearcher, so this classless entry never over-matches
+    // other `.Filter =` assignments (DataView/BindingSource/collection filters).
+    { method: 'Filter', type: 'ldap_injection', cwe: 'CWE-90', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // ADO.NET `cmd.Execute*()` — object-carried sink (cognium-dev#271). The taint
     // rides the SqlCommand receiver (CommandText set from tainted data); the
     // receiver is surfaced as arg[0] by extractCSharpCalls, and the command object
@@ -2632,6 +2641,9 @@ export const DEFAULT_SINKS = [
     // injectable — the second is the argv path where taint rides arg[1] (#276).
     { method: 'Start', class: 'Process', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1], languages: ['csharp'] },
     { method: 'ProcessStartInfo', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1], languages: ['csharp'] },
+    // P/Invoke of libc `system(cmd)` — lowercase `system` in C# is virtually
+    // always the imported shell entry point (cognium-ai#275 interop/IlPinvoke).
+    { method: 'system', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     // C# path traversal — System.IO file APIs (CWE-22). Distinctive method names.
     { method: 'ReadAllText', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'ReadAllBytes', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
@@ -2644,6 +2656,25 @@ export const DEFAULT_SINKS = [
     { method: 'FileStream', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'StreamReader', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'StreamWriter', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // Remaining System.IO.File path APIs — class-scoped so they don't collide
+    // with unrelated methods. Copy/Move take a source AND destination path (both
+    // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
+    { method: 'Copy', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1], languages: ['csharp'] },
+    { method: 'Move', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0, 1], languages: ['csharp'] },
+    { method: 'Delete', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Open', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'OpenText', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Create', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'WriteAllLines', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'AppendAllLines', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // System.IO.Directory path APIs.
+    { method: 'CreateDirectory', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Delete', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'GetFiles', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'EnumerateFiles', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // ASP.NET `ControllerBase.PhysicalFile(path, contentType)` serves a file from
+    // an absolute disk path — attacker-controllable path is CWE-22 (cognium-ai#326/#275).
+    { method: 'PhysicalFile', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // C# SSRF — HttpClient / WebClient / WebRequest (CWE-918).
     { method: 'GetAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'PostAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
@@ -2660,13 +2691,36 @@ export const DEFAULT_SINKS = [
     // C# code injection — dynamic script/assembly loading (CWE-94).
     { method: 'EvaluateAsync', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     { method: 'RunAsync', class: 'CSharpScript', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
-    // C# insecure deserialization — BinaryFormatter et al. (CWE-502).
+    // Loading an assembly from an attacker-controlled name/path is arbitrary code
+    // execution. Class-scoped to `Assembly` (low FP — a tainted arg here is rare
+    // in benign code). `Type.GetType`/`Activator.CreateInstance` are intentionally
+    // NOT added — reflection with config-driven type names is common in DI, an FP
+    // trap without the reflection-suppress machinery.
+    { method: 'Load', class: 'Assembly', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LoadFrom', class: 'Assembly', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LoadFile', class: 'Assembly', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    // C# insecure deserialization — the polymorphic BCL formatters that can
+    // instantiate arbitrary types named in the payload (CWE-502, cognium-ai#318).
+    // Each of these classes exists only to deserialize and is unsafe on untrusted
+    // input; class-scoped, so no collision with safe JSON APIs (System.Text.Json /
+    // Newtonsoft-default, which are intentionally NOT sinks).
     { method: 'Deserialize', class: 'BinaryFormatter', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     { method: 'Deserialize', class: 'NetDataContractSerializer', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Deserialize', class: 'SoapFormatter', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Deserialize', class: 'LosFormatter', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Deserialize', class: 'ObjectStateFormatter', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     // C# XSS — raw HTML output (CWE-79).
     { method: 'Raw', class: 'Html', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'Write', class: 'Response', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'HtmlString', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
+    // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
+    { method: 'MarkupString', class: 'constructor', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // `String.Format(fmt, …)` with an attacker-controlled FORMAT string — CWE-134.
+    // Taint-gated on arg 0 (the format), so ordinary `String.Format("...", user)` where
+    // only an argument is tainted never fires. .NET composite formatting can't corrupt
+    // memory, so medium (FormatException DoS / unintended arg access), unlike C printf.
+    { method: 'Format', class: 'String', type: 'format_string', cwe: 'CWE-134', severity: 'medium', arg_positions: [0], languages: ['csharp'] },
     // C# LDAP injection — System.DirectoryServices (CWE-90). The user-built
     // filter is the constructor argument.
     { method: 'DirectorySearcher', type: 'ldap_injection', cwe: 'CWE-90', severity: 'high', arg_positions: [0], languages: ['csharp'] },
@@ -2687,14 +2741,37 @@ export const DEFAULT_SINKS = [
     // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
     // attacker-controlled query document. Class-scoped (static receiver resolves).
     { method: 'Parse', class: 'BsonDocument', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // C# log injection — Microsoft.Extensions.Logging `ILogger` (CWE-117,
+    // cognium-ai#318). Only the message TEMPLATE (arg[0]) is the injectable
+    // position; the structured form `LogInformation("… {Id}", id)` keeps taint in
+    // later args (the logger renders them as data), so arg_positions:[0] does not
+    // flag it. Mirrors the Java `Logger` sinks; severity low.
+    { method: 'LogInformation', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LogWarning', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LogError', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LogDebug', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LogCritical', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    { method: 'LogTrace', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    // Generic `ILogger.Log(logLevel, message, …)` — class-scoped (`Log` alone is
+    // too generic); the message is arg[1].
+    { method: 'Log', class: 'ILogger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [1], languages: ['csharp'] },
     // C# XPath injection — System.Xml.XPath (CWE-643). Distinctive selector methods.
     { method: 'SelectSingleNode', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'SelectNodes', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'Compile', class: 'XPathExpression', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // XPathNavigator.Select/Evaluate — class-scoped (both names collide with LINQ
+    // `.Select`/`.Evaluate`, so they must resolve to an XPathNavigator receiver).
+    { method: 'Select', class: 'XPathNavigator', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Evaluate', class: 'XPathNavigator', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // C# XXE — untrusted XML into a parser without DTD hardening (CWE-611).
     { method: 'LoadXml', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'Load', class: 'XmlDocument', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'Load', class: 'XDocument', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // `new XmlTextReader(input)` — its DtdProcessing defaults to Parse (resolves
+    // external entities), unlike `XmlReader.Create` (Prohibit). CWE-611,
+    // cognium-ai#318. The 4.7.0 XmlResolver=null / DtdProcessing=Prohibit
+    // hardening still suppresses the safe shape.
+    { method: 'XmlTextReader', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // Python SQLi — asyncpg Connection.*
     { method: 'execute', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0] },
     { method: 'fetch', class: 'Connection', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0] },