circle-ir 4.7.2 → 4.9.7

package/dist/analysis/taint-matcher.js

@@ -371,9 +371,20 @@ function findSources(calls, types, patterns, sourceLines, language) {
                 // Check if parameter type could carry tainted data
                 // For typed languages (Java), check the type
                 // For untyped languages (JavaScript), treat all params as potentially tainted
-                const isTaintable = param.type
-                    ? isInterproceduralTaintableType(param.type, language)
-                    : true; // JavaScript/Python - no type means any value
+                //
+                // C# ASP.NET model binding: a `[FromBody]`/`[FromQuery]`/`[FromRoute]`/
+                // `[FromForm]`/`[FromHeader]` parameter is attacker-controlled even when
+                // its type is a custom DTO (not a primitive) — the whole object and its
+                // properties come from the request. Seed those regardless of type; the
+                // tainted-var scan bridges `d` and its member accesses (`d.Name`) to
+                // sinks. (cognium-dev#273 DTO-property propagation.)
+                const hasCSharpBindingAttr = language === 'csharp' &&
+                    param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
+                const isTaintable = hasCSharpBindingAttr
+                    ? true
+                    : param.type
+                        ? isInterproceduralTaintableType(param.type, language)
+                        : true; // JavaScript/Python - no type means any value
                 if (isTaintable) {
                     // Use parameter line if available, fallback to method start line
                     const paramLine = param.line ?? method.start_line;
@@ -562,6 +573,10 @@ function findSources(calls, types, patterns, sourceLines, language) {
     }
     return result;
 }
+/** ASP.NET model-binding attributes — a so-annotated parameter is request-controlled. */
+const CSHARP_BINDING_ATTRS = new Set([
+    'FromBody', 'FromQuery', 'FromRoute', 'FromForm', 'FromHeader',
+]);
 /**
  * Check if a parameter type could carry tainted data in inter-procedural analysis.
  * These are types commonly used to pass user-controlled data between methods.
@@ -908,36 +923,283 @@ function isSafeJSChildProcessCall(call, pattern, language) {
  * arg) and a shell executable (`Process.Start("/bin/sh", "-c " + x)` — kept
  * firing for #276) stay dangerous. A variable executable stays dangerous.
  */
-function isSafeCSharpProcessStartCall(call, pattern, language) {
-    if (language !== 'csharp')
+const CSHARP_SHELL_PROGRAMS = new Set([
+    'sh', 'bash', 'zsh', 'dash', 'ash', 'ksh',
+    'cmd', 'powershell', 'pwsh',
+]);
+/** True when a `"prog"` / `@"C:\prog.exe"` literal names a non-shell program. */
+function isConstNonShellExe(raw) {
+    if (!raw)
         return false;
-    if (pattern.type !== 'command_injection')
+    const t = raw.trim();
+    // constant string literal only ("git", @"C:\git.exe"); a variable exe is dangerous.
+    if (!/^@?"[^"]*"$/.test(t))
         return false;
-    if (call.method_name !== 'Start')
+    const program = (t.replace(/^@?"|"$/g, '').split(/[\\/]/).pop() ?? '')
+        .toLowerCase().replace(/\.exe$/, '');
+    return !CSHARP_SHELL_PROGRAMS.has(program);
+}
+// Extract the executable literal from a `new ProcessStartInfo("exe", …)`
+// expression, or by resolving a bare `psi` variable back to its
+// `psi = new ProcessStartInfo("exe", …)` construction in the file. Returns the
+// raw literal (e.g. `"grep"`) or null when it cannot be determined statically.
+const PSI_CTOR_EXE_RE = /\bnew\s+ProcessStartInfo\s*(?:<[^>]*>)?\s*\(\s*(@?"[^"]*")/;
+function processStartInfoExe(expr, sourceLines) {
+    const inline = PSI_CTOR_EXE_RE.exec(expr);
+    if (inline)
+        return inline[1];
+    // Bare identifier — resolve its construction from the file text.
+    if (sourceLines && /^[A-Za-z_]\w*$/.test(expr.trim())) {
+        const varName = expr.trim();
+        const assignRe = new RegExp(`\\b${varName}\\s*=\\s*new\\s+ProcessStartInfo\\s*(?:<[^>]*>)?\\s*\\(\\s*(@?"[^"]*")`);
+        for (const line of sourceLines) {
+            const m = assignRe.exec(line);
+            if (m)
+                return m[1];
+        }
+    }
+    return null;
+}
+function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
+    if (language !== 'csharp')
         return false;
-    // argv form only — needs a separate arguments arg beyond the filename.
-    if (call.arguments.length < 2)
+    if (pattern.type !== 'command_injection')
         return false;
-    const fileArg = call.arguments.find(a => a.position === 0);
-    if (!fileArg)
+    const method = call.method_name;
+    if (method !== 'Start' && method !== 'ProcessStartInfo')
         return false;
-    let raw;
-    if (fileArg.literal !== null && fileArg.literal !== undefined) {
-        raw = String(fileArg.literal).trim();
+    // argv forms: `Process.Start(exe, args)` and the inline
+    // `new ProcessStartInfo(exe, args)` constructor (cognium-ai#328 shape 2) —
+    // executable at [0], argument string at [1]. A constant non-shell exe means
+    // the arguments are passed argv (no shell), so a tainted [1] is not injection.
+    if (call.arguments.length >= 2) {
+        const fileArg = call.arguments.find(a => a.position === 0);
+        const raw = fileArg?.literal != null ? String(fileArg.literal) : fileArg?.expression;
+        return isConstNonShellExe(raw);
+    }
+    // Single-arg `Process.Start(psi)` where `psi` is an inline or variable
+    // ProcessStartInfo built with a constant non-shell exe — argv/`ArgumentList`
+    // or a non-shell `Arguments` string, still no shell (cognium-ai#328 shape 2,
+    // object-carried variant).
+    if (method === 'Start' && call.arguments.length === 1) {
+        const arg0 = call.arguments.find(a => a.position === 0);
+        const expr = (arg0?.expression ?? '').trim();
+        return isConstNonShellExe(processStartInfoExe(expr, sourceLines));
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// C# SSRF inline host-allowlist guard (cognium-ai#328 shape 1).
+//
+// An exact string-equality check against a constant is the strongest allowlist;
+// when it *dominates* the sink the flowing URL/host is pinned to a constant and
+// there is no SSRF. Correctness hinges on the operator AND the sink's position,
+// not merely the guard's presence:
+//   if (host == "c") sink(host);       // == , sink INSIDE then  → SAFE
+//   if (host != "c") return; sink(host);// != , then is early-exit → SAFE
+//   if (host == "c") return; sink(host);// == , early-exit (blocklist) → UNSAFE
+//   if (host != "c") sink(host);        // != , sink INSIDE then     → UNSAFE
+// A naive "an == guard appears above the sink" heuristic would wrongly suppress
+// the two blocklist forms, so we resolve the then-block structurally.
+/** Strip C# string/char literals and `//` comments so brace/paren scans are clean. */
+function stripCsLiterals(line) {
+    return line
+        .replace(/\/\/.*$/, '')
+        .replace(/@?"(?:[^"\\]|\\.)*"/g, '""')
+        .replace(/'(?:[^'\\]|\\.)'/g, "''");
+}
+/** Cumulative `{` depth before line `idx` (string/comment-safe). */
+function csBraceDepthBefore(lines, idx) {
+    let depth = 0;
+    for (let i = 0; i < idx && i < lines.length; i++) {
+        for (const ch of stripCsLiterals(lines[i])) {
+            if (ch === '{')
+                depth++;
+            else if (ch === '}')
+                depth--;
+        }
+    }
+    return depth;
+}
+/** Net `{` minus `}` in a code fragment (caller strips literals first). */
+function netBraces(fragment) {
+    let n = 0;
+    for (const ch of fragment) {
+        if (ch === '{')
+            n++;
+        else if (ch === '}')
+            n--;
+    }
+    return n;
+}
+/** Split `if (cond) rest…` on one line; null if the condition spans lines. */
+function splitCsIf(line) {
+    const m = /\bif\s*\(/.exec(line);
+    if (!m)
+        return null;
+    const ifCol = m.index;
+    let i = m.index + m[0].length;
+    let depth = 1;
+    let inStr = false;
+    let strCh = '';
+    for (; i < line.length; i++) {
+        const c = line[i];
+        if (inStr) {
+            if (c === '\\') {
+                i++;
+                continue;
+            }
+            if (c === strCh)
+                inStr = false;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            inStr = true;
+            strCh = c;
+            continue;
+        }
+        if (c === '(')
+            depth++;
+        else if (c === ')') {
+            depth--;
+            if (depth === 0)
+                break;
+        }
+    }
+    if (depth !== 0)
+        return null;
+    return { cond: line.slice(m.index + m[0].length, i), rest: line.slice(i + 1), ifCol };
+}
+/** Extract `{op, exprSide}` from a `EXPR == "lit"` / `"lit" != EXPR` condition. */
+function csEqualityGuard(cond) {
+    const c = cond.trim();
+    let m = /^(.*?)\s*(==|!=)\s*@?"[^"]*"\s*$/.exec(c);
+    if (m)
+        return { op: m[2], exprSide: m[1].trim() };
+    m = /^@?"[^"]*"\s*(==|!=)\s*(.*)$/.exec(c);
+    if (m)
+        return { op: m[1], exprSide: m[2].trim() };
+    return null;
+}
+const CS_IDENT_RE = /[A-Za-z_]\w*/g;
+function csIdentifiers(expr) {
+    return new Set((expr.match(CS_IDENT_RE) ?? []));
+}
+/**
+ * Resolve the then-block of an `if` at `ifIdx`, whose condition-line remainder
+ * is `rest`. Returns the inclusive line range plus whether the block is an
+ * early exit (only return/throw/continue/break).
+ */
+function csThenBlock(lines, ifIdx, rest) {
+    const isExit = (s) => /^\s*(?:return|throw|continue|break)\b/.test(s);
+    // The then-target begins in the if-line remainder (`rest`), else on the next
+    // non-empty line. When it starts on the if-line we must scan only `rest`, not
+    // the whole line — earlier braces on that line (class/method `{`) are not ours.
+    let firstIdx;
+    let firstText;
+    if (rest.trim()) {
+        firstIdx = ifIdx;
+        firstText = rest;
     }
     else {
-        raw = (fileArg.expression ?? '').trim();
+        let j = ifIdx + 1;
+        while (j < lines.length && stripCsLiterals(lines[j]).trim() === '')
+            j++;
+        firstIdx = j;
+        firstText = lines[j] ?? '';
+    }
+    if (firstText.trim().startsWith('{')) {
+        // Braced block: brace-match from the block's own `{`, collecting the body so
+        // early-exit is judged from the block's first statement, not the `if` line.
+        let depth = 0;
+        let started = false;
+        let endLine = lines.length - 1;
+        let body = '';
+        for (let i = firstIdx; i < lines.length; i++) {
+            const stripped = stripCsLiterals(i === firstIdx ? firstText : lines[i]);
+            let broke = false;
+            for (const ch of stripped) {
+                if (ch === '{') {
+                    depth++;
+                    started = true;
+                    if (depth === 1)
+                        continue;
+                }
+                else if (ch === '}') {
+                    depth--;
+                    if (depth === 0) {
+                        endLine = i;
+                        broke = true;
+                        break;
+                    }
+                }
+                if (started && depth >= 1)
+                    body += ch;
+            }
+            if (broke)
+                break;
+            if (started)
+                body += ' ';
+        }
+        return { start: ifIdx, end: endLine, earlyExit: isExit(body.trim()) };
     }
-    // constant string literal only ("git", @"C:\git.exe"); a variable exe is dangerous.
-    if (!/^@?"[^"]*"$/.test(raw))
+    // Single-statement then (same line as the `if`, or the next line).
+    return { start: ifIdx, end: firstIdx, earlyExit: isExit(firstText.trim()) };
+}
+/**
+ * True when a C# SSRF sink is dominated by an exact-equality host allowlist:
+ * either `if (…var… == "const") <sink>` (sink inside the then-block) or
+ * `if (…var… != "const") <early exit>` with the sink after the guard at the
+ * same block depth. `var` is any identifier flowing into the sink argument.
+ */
+function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines) {
+    if (language !== 'csharp')
         return false;
-    const program = (raw.replace(/^@?"|"$/g, '').split(/[\\/]/).pop() ?? '')
-        .toLowerCase().replace(/\.exe$/, '');
-    const SHELL_PROGRAMS = new Set([
-        'sh', 'bash', 'zsh', 'dash', 'ash', 'ksh',
-        'cmd', 'powershell', 'pwsh',
-    ]);
-    return !SHELL_PROGRAMS.has(program);
+    if (pattern.type !== 'ssrf')
+        return false;
+    if (!sourceLines || sourceLines.length === 0)
+        return false;
+    const candidates = new Set();
+    for (const a of call.arguments) {
+        if (a.variable)
+            candidates.add(a.variable);
+        for (const id of csIdentifiers(a.expression ?? ''))
+            candidates.add(id);
+    }
+    if (candidates.size === 0)
+        return false;
+    const sinkIdx = call.location.line - 1;
+    const sinkDepth = csBraceDepthBefore(sourceLines, sinkIdx);
+    for (let i = 0; i < sinkIdx; i++) {
+        const parts = splitCsIf(sourceLines[i]);
+        if (!parts)
+            continue;
+        const guard = csEqualityGuard(parts.cond);
+        if (!guard)
+            continue;
+        // The compared expression must reference a variable that flows to the sink.
+        const guardIds = csIdentifiers(guard.exprSide);
+        if (![...guardIds].some((id) => candidates.has(id)))
+            continue;
+        const block = csThenBlock(sourceLines, i, parts.rest);
+        if (guard.op === '==') {
+            // Positive allowlist: safe only when the sink sits inside the then-block.
+            if (sinkIdx >= block.start && sinkIdx <= block.end)
+                return true;
+        }
+        else {
+            // Reject guard: safe only when the then-block is an early exit and the
+            // sink follows it at the same enclosing depth (dominated by the guard).
+            // The guard's depth includes any braces opened before `if` on its line
+            // (compact `{ if (…)` layouts), so this is layout-independent.
+            const guardDepth = csBraceDepthBefore(sourceLines, i) +
+                netBraces(stripCsLiterals(sourceLines[i]).slice(0, parts.ifCol));
+            if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
+                return true;
+            }
+        }
+    }
+    return false;
 }
 /**
  * Check if a Rust `Command::new(...).arg(...).args(...).spawn().output()`
@@ -1559,7 +1821,13 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
                 // Skip C# `Process.Start(constNonShellExe, arguments)` argv calls —
                 // a non-shell executable receives the arguments directly (no shell),
                 // so tainted arguments cannot inject a command. cognium-ai#328.
-                if (isSafeCSharpProcessStartCall(call, pattern, language)) {
+                if (isSafeCSharpProcessStartCall(call, pattern, language, sourceLines)) {
+                    continue;
+                }
+                // Skip C# SSRF sinks dominated by an inline exact-equality host
+                // allowlist (`if (host == "c") sink` / `if (host != "c") return; sink`).
+                // cognium-ai#328 shape 1.
+                if (isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)) {
                     continue;
                 }
                 // Skip typed deserialization overloads where the target type is a