circle-ir 4.8.2 → 4.9.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/config-loader.d.ts.map +1 -1
- package/dist/analysis/config-loader.js +11 -0
- package/dist/analysis/config-loader.js.map +1 -1
- package/dist/analysis/passes/insecure-cookie-pass.d.ts +1 -0
- package/dist/analysis/passes/insecure-cookie-pass.d.ts.map +1 -1
- package/dist/analysis/passes/insecure-cookie-pass.js +37 -3
- package/dist/analysis/passes/insecure-cookie-pass.js.map +1 -1
- package/dist/analysis/passes/jwt-verify-disabled-pass.d.ts.map +1 -1
- package/dist/analysis/passes/jwt-verify-disabled-pass.js +48 -21
- package/dist/analysis/passes/jwt-verify-disabled-pass.js.map +1 -1
- package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
- package/dist/analysis/passes/language-sources-pass.js +131 -0
- package/dist/analysis/passes/language-sources-pass.js.map +1 -1
- package/dist/analysis/passes/tls-verify-disabled-pass.d.ts.map +1 -1
- package/dist/analysis/passes/tls-verify-disabled-pass.js +34 -0
- package/dist/analysis/passes/tls-verify-disabled-pass.js.map +1 -1
- package/dist/analysis/passes/weak-crypto-pass.d.ts.map +1 -1
- package/dist/analysis/passes/weak-crypto-pass.js +32 -19
- package/dist/analysis/passes/weak-crypto-pass.js.map +1 -1
- package/dist/analysis/taint-matcher.d.ts.map +1 -1
- package/dist/analysis/taint-matcher.js +237 -3
- package/dist/analysis/taint-matcher.js.map +1 -1
- package/dist/browser/circle-ir.js +409 -43
- package/dist/core/circle-ir-core.cjs +218 -3
- package/dist/core/circle-ir-core.js +218 -3
- package/dist/core/extractors/types.js +77 -2
- package/dist/core/extractors/types.js.map +1 -1
- package/package.json +1 -1
|
@@ -45,6 +45,7 @@ export declare class InsecureCookiePass implements AnalysisPass<InsecureCookieRe
|
|
|
45
45
|
readonly name = "insecure-cookie";
|
|
46
46
|
readonly category: "security";
|
|
47
47
|
run(ctx: PassContext): InsecureCookieResult;
|
|
48
|
+
private detectCSharpCookieOptions;
|
|
48
49
|
private detectJs;
|
|
49
50
|
private detectPython;
|
|
50
51
|
private detectJavaCookieCtor;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"insecure-cookie-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/insecure-cookie-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;
|
|
1
|
+
{"version":3,"file":"insecure-cookie-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/insecure-cookie-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA+C9E,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,KAAK,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC,CAAC;CACJ;AAED,qBAAa,kBAAmB,YAAW,YAAY,CAAC,oBAAoB,CAAC;IAC3E,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,oBAAoB;IAuD3C,OAAO,CAAC,yBAAyB;IAgBjC,OAAO,CAAC,QAAQ;IA2BhB,OAAO,CAAC,YAAY;IAuBpB,OAAO,CAAC,oBAAoB;IAqC5B,OAAO,CAAC,QAAQ;IA8BhB,OAAO,CAAC,yBAAyB;IA0BjC,OAAO,CAAC,IAAI;CAgEb"}
|
|
@@ -60,6 +60,14 @@ const GO_HTTPONLY_TRUE_RE = /\bHttpOnly\s*:\s*true\b/;
|
|
|
60
60
|
// same invocation also contains `Secure` and `HttpOnly` tokens. Sprint 56 #182 Slice C.
|
|
61
61
|
// Multi-line matches are supported via the `s` flag (dotall).
|
|
62
62
|
const RUST_SET_COOKIE_MACRO_RE = /(format!|write!|writeln!)\s*\(([^()]*Set-Cookie[^()]*)\)/gis;
|
|
63
|
+
// ---------- C# ----------
|
|
64
|
+
// `new CookieOptions { Secure = false, HttpOnly = false }` — flag only an
|
|
65
|
+
// EXPLICIT `= false` (absence defaults are often set by framework policy, so
|
|
66
|
+
// treating a missing flag as insecure would be an FP trap). Body is brace-free
|
|
67
|
+
// (`[^{}]*`) — cookie-option initializers do not nest braces.
|
|
68
|
+
const CS_COOKIE_OPTIONS_RE = /\bnew\s+CookieOptions\s*\{([^{}]*)\}/gs;
|
|
69
|
+
const CS_SECURE_FALSE_RE = /\bSecure\s*=\s*false\b/;
|
|
70
|
+
const CS_HTTPONLY_FALSE_RE = /\bHttpOnly\s*=\s*false\b/;
|
|
63
71
|
export class InsecureCookiePass {
|
|
64
72
|
name = 'insecure-cookie';
|
|
65
73
|
category = 'security';
|
|
@@ -115,8 +123,30 @@ export class InsecureCookiePass {
|
|
|
115
123
|
this.emit(ctx, file, det, 'rust');
|
|
116
124
|
}
|
|
117
125
|
}
|
|
126
|
+
else if (language === 'csharp') {
|
|
127
|
+
for (const det of this.detectCSharpCookieOptions(code)) {
|
|
128
|
+
insecureCookies.push(det);
|
|
129
|
+
this.emit(ctx, file, det, 'csharp');
|
|
130
|
+
}
|
|
131
|
+
}
|
|
118
132
|
return { insecureCookies };
|
|
119
133
|
}
|
|
134
|
+
// ---------------- C# ----------------
|
|
135
|
+
detectCSharpCookieOptions(code) {
|
|
136
|
+
const out = [];
|
|
137
|
+
const re = new RegExp(CS_COOKIE_OPTIONS_RE.source, CS_COOKIE_OPTIONS_RE.flags);
|
|
138
|
+
let m;
|
|
139
|
+
while ((m = re.exec(code)) !== null) {
|
|
140
|
+
const body = m[1] ?? '';
|
|
141
|
+
const missingSecure = CS_SECURE_FALSE_RE.test(body);
|
|
142
|
+
const missingHttpOnly = CS_HTTPONLY_FALSE_RE.test(body);
|
|
143
|
+
if (!missingSecure && !missingHttpOnly)
|
|
144
|
+
continue;
|
|
145
|
+
const line = code.slice(0, m.index).split('\n').length;
|
|
146
|
+
out.push({ line, receiver: 'CookieOptions', missingSecure, missingHttpOnly, optionsPresent: true });
|
|
147
|
+
}
|
|
148
|
+
return out;
|
|
149
|
+
}
|
|
120
150
|
// ---------------- JS / TS ----------------
|
|
121
151
|
detectJs(call) {
|
|
122
152
|
if (call.method_name !== 'cookie')
|
|
@@ -262,14 +292,16 @@ export class InsecureCookiePass {
|
|
|
262
292
|
: flavor === 'python' ? '`secure=True`'
|
|
263
293
|
: flavor === 'java' ? '`setSecure(true)`'
|
|
264
294
|
: flavor === 'go' ? '`Secure: true`'
|
|
265
|
-
: '`Secure`
|
|
295
|
+
: flavor === 'csharp' ? '`Secure = true`'
|
|
296
|
+
: '`Secure` attribute');
|
|
266
297
|
}
|
|
267
298
|
if (det.missingHttpOnly) {
|
|
268
299
|
missing.push(flavor === 'js' ? '`httpOnly: true`'
|
|
269
300
|
: flavor === 'python' ? '`httponly=True`'
|
|
270
301
|
: flavor === 'java' ? '`setHttpOnly(true)`'
|
|
271
302
|
: flavor === 'go' ? '`HttpOnly: true`'
|
|
272
|
-
: '`HttpOnly`
|
|
303
|
+
: flavor === 'csharp' ? '`HttpOnly = true`'
|
|
304
|
+
: '`HttpOnly` attribute');
|
|
273
305
|
}
|
|
274
306
|
const fix = flavor === 'js'
|
|
275
307
|
? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.'
|
|
@@ -279,7 +311,9 @@ export class InsecureCookiePass {
|
|
|
279
311
|
? 'After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response.'
|
|
280
312
|
: flavor === 'go'
|
|
281
313
|
? 'Set `Secure: true` and `HttpOnly: true` on the `http.Cookie` struct literal passed to `http.SetCookie`.'
|
|
282
|
-
:
|
|
314
|
+
: flavor === 'csharp'
|
|
315
|
+
? 'Set `Secure = true` and `HttpOnly = true` on the `CookieOptions` (or enforce them globally via `CookiePolicyOptions`).'
|
|
316
|
+
: 'Append `; Secure; HttpOnly` to the `Set-Cookie` header string.';
|
|
283
317
|
ctx.addFinding({
|
|
284
318
|
id: `${this.name}-${file}-${det.line}`,
|
|
285
319
|
pass: this.name,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"insecure-cookie-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/insecure-cookie-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,gCAAgC;AAChC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,KAAK,EAAE,UAAU,EAAE,OAAO;CAC3B,CAAC,CAAC;AACH,MAAM,cAAc,GAAK,uBAAuB,CAAC;AACjD,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD,+BAA+B;AAC/B,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,UAAU,EAAE,MAAM,EAAE,KAAK;CAC1B,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAK,uBAAuB,CAAC;AACpD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAEvD,6BAA6B;AAC7B,MAAM,uBAAuB,GAAK,8BAA8B,CAAC;AACjE,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAEnE,2BAA2B;AAC3B,yEAAyE;AACzE,0FAA0F;AAC1F,MAAM,iBAAiB,GAAK,uBAAuB,CAAC;AACpD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD,6BAA6B;AAC7B,mEAAmE;AACnE,0EAA0E;AAC1E,4EAA4E;AAC5E,sEAAsE;AACtE,2EAA2E;AAC3E,wFAAwF;AACxF,8DAA8D;AAC9D,MAAM,wBAAwB,GAC5B,6DAA6D,CAAC;
|
|
1
|
+
{"version":3,"file":"insecure-cookie-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/insecure-cookie-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,gCAAgC;AAChC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,KAAK,EAAE,UAAU,EAAE,OAAO;CAC3B,CAAC,CAAC;AACH,MAAM,cAAc,GAAK,uBAAuB,CAAC;AACjD,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD,+BAA+B;AAC/B,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,UAAU,EAAE,MAAM,EAAE,KAAK;CAC1B,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAK,uBAAuB,CAAC;AACpD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAEvD,6BAA6B;AAC7B,MAAM,uBAAuB,GAAK,8BAA8B,CAAC;AACjE,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAEnE,2BAA2B;AAC3B,yEAAyE;AACzE,0FAA0F;AAC1F,MAAM,iBAAiB,GAAK,uBAAuB,CAAC;AACpD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD,6BAA6B;AAC7B,mEAAmE;AACnE,0EAA0E;AAC1E,4EAA4E;AAC5E,sEAAsE;AACtE,2EAA2E;AAC3E,wFAAwF;AACxF,8DAA8D;AAC9D,MAAM,wBAAwB,GAC5B,6DAA6D,CAAC;AAEhE,2BAA2B;AAC3B,0EAA0E;AAC1E,6EAA6E;AAC7E,+EAA+E;AAC/E,8DAA8D;AAC9D,MAAM,oBAAoB,GAAG,wCAAwC,CAAC;AACtE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AACpD,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAYxD,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,iBAAiB,CAAC;IACzB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,eAAe,GAA4C,EAAE,CAAC;QAEpE,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC/B,yEAAyE;YACzE,+EAA+E;YAC/E,kEAAkE;YAClE,MAAM,gBAAgB,GAAK,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;gBAClF,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAClD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7B,CAAC;IAED,uCAAuC;IAC/B,yBAAyB,CAAC,IAAY;QAC5C,MAAM,GAAG,GAA4C,EAAE,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC/E,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;gBAAE,SAAS;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,4CAA4C;IACpC,QAAQ,CAAC,IAAc;QAC7B,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1D,6DAA6D;QAC7D,mEAAmE;QACnE,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAE3C,MAAM,aAAa,GAAK,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAEpD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACxB,QAAQ;YACR,aAAa;YACb,eAAe;YACf,cAAc;SACf,CAAC;IACJ,CAAC;IAED,2CAA2C;IACnC,YAAY,CAAC,IAAc;QACjC,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAExD,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1E,MAAM,aAAa,GAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAEpD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACxB,QAAQ;YACR,aAAa;YACb,eAAe;YACf,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED,yCAAyC;IACjC,oBAAoB,CAC1B,IAAc,EACd,gBAAyB,EACzB,kBAA2B;QAE3B,gFAAgF;QAChF,+DAA+D;QAC/D,qDAAqD;QACrD,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QACtC,MAAM,YAAY,GAChB,MAAM,KAAK,QAAQ;YACnB,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,aAAa,GACjB,IAAI,CAAC,cAAc;YACnB,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACvG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAChC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3C,MAAM,aAAa,GAAK,CAAC,gBAAgB,CAAC;QAC1C,MAAM,eAAe,GAAG,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAEpD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACxB,QAAQ,EAAE,YAAY;YACtB,aAAa;YACb,eAAe;YACf,cAAc,EAAE,KAAK;SACtB,CAAC;IACJ,CAAC;IAED,uCAAuC;IAC/B,QAAQ,CAAC,IAAc;QAC7B,iEAAiE;QACjE,oEAAoE;QACpE,yDAAyD;QACzD,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,4EAA4E;QAC5E,wEAAwE;QACxE,yEAAyE;QACzE,mDAAmD;QACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAExE,MAAM,aAAa,GAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAEpD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACxB,QAAQ,EAAE,gBAAgB;YAC1B,aAAa;YACb,eAAe;YACf,cAAc,EAAE,IAAI;SACrB,CAAC;IACJ,CAAC;IAED,yCAAyC;IACjC,yBAAyB,CAAC,IAAY;QAC5C,0EAA0E;QAC1E,yEAAyE;QACzE,sCAAsC;QACtC,MAAM,GAAG,GAA4C,EAAE,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,GAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,aAAa,GAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,eAAe,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;gBAAE,SAAS;YACjD,qDAAqD;YACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI;gBACJ,QAAQ,EAAE,KAAK;gBACf,aAAa;gBACb,eAAe;gBACf,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,IAAI,CACV,GAAgB,EAChB,IAAY,EACZ,GAAoD,EACpD,MAA2D;QAE3D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CACV,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB;gBAClC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe;oBACvC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,mBAAmB;wBACzC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB;4BACpC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB;gCACzC,CAAC,CAAC,oBAAoB,CACvB,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CACV,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB;gBACpC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB;oBACzC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB;wBAC3C,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB;4BACtC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB;gCAC3C,CAAC,CAAC,sBAAsB,CACzB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GACP,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,mGAAmG;YACrG,CAAC,CAAC,MAAM,KAAK,QAAQ;gBACnB,CAAC,CAAC,kFAAkF;gBACpF,CAAC,CAAC,MAAM,KAAK,MAAM;oBACjB,CAAC,CAAC,+HAA+H;oBACjI,CAAC,CAAC,MAAM,KAAK,IAAI;wBACf,CAAC,CAAC,yGAAyG;wBAC3G,CAAC,CAAC,MAAM,KAAK,QAAQ;4BACnB,CAAC,CAAC,wHAAwH;4BAC1H,CAAC,CAAC,gEAAgE,CAAC;QAE/E,GAAG,CAAC,UAAU,CAAC;YACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE;YACtC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,SAAS;YAChB,OAAO,EACL,sBAAsB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB;gBAC9D,6DAA6D;gBAC7D,aAAa;YACf,IAAI;YACJ,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG;YACH,QAAQ,EAAE;gBACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,eAAe,EAAE,GAAG,CAAC,cAAc;gBACnC,cAAc,EAAE,GAAG,CAAC,aAAa;gBACjC,iBAAiB,EAAE,GAAG,CAAC,eAAe;aACvC;SACF,CAAC,CAAC;IACL,CAAC;CACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt-verify-disabled-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/jwt-verify-disabled-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;
|
|
1
|
+
{"version":3,"file":"jwt-verify-disabled-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/jwt-verify-disabled-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA6B9E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,qBACX,YAAW,YAAY,CAAC,uBAAuB,CAAC;IAEhD,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,uBAAuB;IA+C9C,OAAO,CAAC,MAAM;IAyFd,OAAO,CAAC,MAAM;CAmCf"}
|
|
@@ -34,6 +34,14 @@ const PY_VERIFY_KW_FALSE_RE = /\bverify\s*=\s*False\b/;
|
|
|
34
34
|
const PY_ALG_NONE_RE = /\balgorithms\s*=\s*[\[\(]\s*["']none["']/i;
|
|
35
35
|
// JS `algorithms: ['none']` inside an options literal.
|
|
36
36
|
const JS_ALG_NONE_RE = /\balgorithms\s*:\s*\[\s*["']none["']/i;
|
|
37
|
+
// C# (Microsoft.IdentityModel TokenValidationParameters) — signature-bypass
|
|
38
|
+
// shapes only. `RequireSignedTokens = false` accepts unsigned (alg=none)
|
|
39
|
+
// tokens; a `SignatureValidator` that just wraps the raw token in a
|
|
40
|
+
// `JwtSecurityToken` performs no cryptographic check (the canonical bypass).
|
|
41
|
+
// `ValidateIssuer/Audience/Lifetime = false` are deliberately NOT matched —
|
|
42
|
+
// they weaken claim checks but do not disable signature verification.
|
|
43
|
+
const CS_REQUIRE_SIGNED_FALSE_RE = /\bRequireSignedTokens\s*=\s*false\b/;
|
|
44
|
+
const CS_SIGNATURE_VALIDATOR_BYPASS_RE = /\bSignatureValidator\s*=\s*[^;]*=>\s*new\s+JwtSecurityToken\b/;
|
|
37
45
|
export class JwtVerifyDisabledPass {
|
|
38
46
|
name = 'jwt-verify-disabled';
|
|
39
47
|
category = 'security';
|
|
@@ -41,28 +49,41 @@ export class JwtVerifyDisabledPass {
|
|
|
41
49
|
const { graph, language } = ctx;
|
|
42
50
|
const file = graph.ir.meta.file;
|
|
43
51
|
const findings = [];
|
|
52
|
+
const emit = (line, det) => {
|
|
53
|
+
findings.push({ line, language, ...det });
|
|
54
|
+
ctx.addFinding({
|
|
55
|
+
id: `${this.name}-${file}-${line}-${det.pattern}`,
|
|
56
|
+
pass: this.name,
|
|
57
|
+
category: this.category,
|
|
58
|
+
rule_id: this.name,
|
|
59
|
+
cwe: 'CWE-347',
|
|
60
|
+
severity: 'critical',
|
|
61
|
+
level: 'error',
|
|
62
|
+
message: `JWT signature verification disabled via \`${det.pattern}\` in ` +
|
|
63
|
+
`\`${det.api}\`. Any attacker can forge a token with arbitrary ` +
|
|
64
|
+
'claims (user id, roles, expiry) since the signature is not ' +
|
|
65
|
+
'checked.',
|
|
66
|
+
file,
|
|
67
|
+
line,
|
|
68
|
+
fix: this.fixFor(language),
|
|
69
|
+
evidence: { ...det, language },
|
|
70
|
+
});
|
|
71
|
+
};
|
|
44
72
|
for (const call of graph.ir.calls) {
|
|
45
|
-
const
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
'claims (user id, roles, expiry) since the signature is not ' +
|
|
60
|
-
'checked.',
|
|
61
|
-
file,
|
|
62
|
-
line,
|
|
63
|
-
fix: this.fixFor(language),
|
|
64
|
-
evidence: { ...det, language },
|
|
65
|
-
});
|
|
73
|
+
for (const det of this.detect(call, language))
|
|
74
|
+
emit(call.location.line, det);
|
|
75
|
+
}
|
|
76
|
+
// C# TokenValidationParameters signature-bypass is an object-initializer
|
|
77
|
+
// assignment, not a call — scan the source text.
|
|
78
|
+
if (language === 'csharp') {
|
|
79
|
+
const lines = ctx.code.split('\n');
|
|
80
|
+
for (let i = 0; i < lines.length; i++) {
|
|
81
|
+
if (CS_REQUIRE_SIGNED_FALSE_RE.test(lines[i])) {
|
|
82
|
+
emit(i + 1, { pattern: 'RequireSignedTokens = false', api: 'TokenValidationParameters' });
|
|
83
|
+
}
|
|
84
|
+
else if (CS_SIGNATURE_VALIDATOR_BYPASS_RE.test(lines[i])) {
|
|
85
|
+
emit(i + 1, { pattern: 'SignatureValidator returns an unvalidated token', api: 'TokenValidationParameters' });
|
|
86
|
+
}
|
|
66
87
|
}
|
|
67
88
|
}
|
|
68
89
|
return { findings };
|
|
@@ -169,6 +190,12 @@ export class JwtVerifyDisabledPass {
|
|
|
169
190
|
'an RSA algorithm. For jjwt: call `parseClaimsJws(token)` (signature ' +
|
|
170
191
|
'enforced) rather than `parse(token)` (signature ignored).');
|
|
171
192
|
}
|
|
193
|
+
if (language === 'csharp') {
|
|
194
|
+
return ('Leave `RequireSignedTokens = true` and do not install a custom ' +
|
|
195
|
+
'`SignatureValidator` that returns the token unverified. Configure ' +
|
|
196
|
+
'`IssuerSigningKey`/`IssuerSigningKeys` and let the handler validate ' +
|
|
197
|
+
'the signature.');
|
|
198
|
+
}
|
|
172
199
|
return ('Enforce JWT signature verification with a concrete algorithm ' +
|
|
173
200
|
'(HS256/RS256/ES256). Never accept `alg: none`.');
|
|
174
201
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt-verify-disabled-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/jwt-verify-disabled-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,+DAA+D;AAC/D,MAAM,4BAA4B,GAChC,wCAAwC,CAAC;AAC3C,wCAAwC;AACxC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AACvD,2EAA2E;AAC3E,MAAM,cAAc,GAAG,2CAA2C,CAAC;AAEnE,uDAAuD;AACvD,MAAM,cAAc,GAAG,uCAAuC,CAAC;
|
|
1
|
+
{"version":3,"file":"jwt-verify-disabled-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/jwt-verify-disabled-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,+DAA+D;AAC/D,MAAM,4BAA4B,GAChC,wCAAwC,CAAC;AAC3C,wCAAwC;AACxC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AACvD,2EAA2E;AAC3E,MAAM,cAAc,GAAG,2CAA2C,CAAC;AAEnE,uDAAuD;AACvD,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAE/D,4EAA4E;AAC5E,yEAAyE;AACzE,oEAAoE;AACpE,6EAA6E;AAC7E,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;AACzE,MAAM,gCAAgC,GACpC,+DAA+D,CAAC;AAgBlE,MAAM,OAAO,qBAAqB;IAGvB,IAAI,GAAG,qBAAqB,CAAC;IAC7B,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAwC,EAAE,CAAC;QAEzD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAc,EAAE,EAAE;YAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YAC1C,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,OAAO;gBACd,OAAO,EACL,6CAA6C,GAAG,CAAC,OAAO,QAAQ;oBAChE,KAAK,GAAG,CAAC,GAAG,oDAAoD;oBAChE,6DAA6D;oBAC7D,UAAU;gBACZ,IAAI;gBACJ,IAAI;gBACJ,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC1B,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QAED,yEAAyE;QACzE,iDAAiD;QACjD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBAC5F,CAAC;qBAAM,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBAChH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,IAAc,EAAE,QAAgB;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAgB,EAAE,CAAC;QAE5B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,6EAA6E;YAC7E,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC3C,IAAI,CAAC,IAAI;wBAAE,SAAS;oBACpB,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;oBACtE,CAAC;oBACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACrC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC3D,CAAC;oBACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;oBAClE,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,mDAAmD;YACnD,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,kEAAkE;gBAClE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC3C,IAAI,CAAC,IAAI;wBAAE,SAAS;oBACpB,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;oBACnE,CAAC;oBACD,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACzC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBACD,+BAA+B;gBAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;gBAC5D,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,UAAU,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrE,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,WAAW;oBAC7C,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,OAAO,IAAI,SAAS,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,gDAAgD;YAChD,4DAA4D;YAC5D,IAAI,MAAM,KAAK,SAAS;gBACpB,CAAC,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACtD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;gBACzD,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YACD,uEAAuE;YACvE,yDAAyD;YACzD,EAAE;YACF,qEAAqE;YACrE,mEAAmE;YACnE,+DAA+D;YAC/D,gEAAgE;YAChE,+DAA+D;YAC/D,kEAAkE;YAClE,mEAAmE;YACnE,EAAE;YACF,oEAAoE;YACpE,gEAAgE;YAChE,6BAA6B;YAC7B,6BAA6B;YAC7B,8CAA8C;YAC9C,gEAAgE;YAChE,8CAA8C;YAC9C,qEAAqE;YACrE,IAAI,MAAM,KAAK,OAAO,IAAI,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,MAAM,CAAC,QAAgB;QAC7B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,CACL,mEAAmE;gBACnE,kEAAkE;gBAClE,sBAAsB,CACvB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,OAAO,CACL,wEAAwE;gBACxE,iEAAiE;gBACjE,2BAA2B,CAC5B,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,CACL,sEAAsE;gBACtE,sEAAsE;gBACtE,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,CACL,iEAAiE;gBACjE,oEAAoE;gBACpE,sEAAsE;gBACtE,gBAAgB,CACjB,CAAC;QACJ,CAAC;QACD,OAAO,CACL,+DAA+D;YAC/D,gDAAgD,CACjD,CAAC;IACJ,CAAC;CACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoF/B,CAAC;AAwDF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;
|
|
1
|
+
{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoF/B,CAAC;AAwDF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAmf7C;AAihCD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmO9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAgMD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CA8BpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkErB;AAyTD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAgoFD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoFf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmGf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsHf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoEf;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA8Ff;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgGf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2If;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Kf;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Jf;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwFf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Ef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Ef;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiFf"}
|
|
@@ -195,6 +195,8 @@ export class LanguageSourcesPass {
|
|
|
195
195
|
additionalSources.push(...findJavaScriptAssignmentSources(code, language));
|
|
196
196
|
// -- C#: explicit ASP.NET request sources --------------------------------
|
|
197
197
|
additionalSources.push(...findCSharpRequestSources(code, language));
|
|
198
|
+
additionalSources.push(...findCSharpBindingAttributeSources(code, language));
|
|
199
|
+
additionalSources.push(...findCSharpMinimalApiSources(code, language));
|
|
198
200
|
additionalSources.push(...findGoArgvSources(code, language));
|
|
199
201
|
const jsDOMSinks = findJavaScriptDOMSinks(code, language);
|
|
200
202
|
for (const s of jsDOMSinks) {
|
|
@@ -1142,6 +1144,135 @@ function findCSharpRequestSources(sourceCode, language) {
|
|
|
1142
1144
|
}
|
|
1143
1145
|
return sources;
|
|
1144
1146
|
}
|
|
1147
|
+
// ASP.NET binding attributes for Minimal-API lambda params. `FromServices`
|
|
1148
|
+
// binds a DI service (not attacker-controlled) and is intentionally excluded.
|
|
1149
|
+
const CSHARP_MINIMAL_API_BINDING = new Map([
|
|
1150
|
+
['FromBody', 'http_body'],
|
|
1151
|
+
['FromForm', 'http_body'],
|
|
1152
|
+
['FromQuery', 'http_param'],
|
|
1153
|
+
['FromRoute', 'http_path'],
|
|
1154
|
+
['FromHeader', 'http_param'],
|
|
1155
|
+
]);
|
|
1156
|
+
// Framework / DI parameter types a route handler receives that are NOT request
|
|
1157
|
+
// data — never seeded as sources.
|
|
1158
|
+
const CSHARP_NON_INPUT_TYPES = new Set([
|
|
1159
|
+
'HttpContext', 'HttpRequest', 'HttpResponse', 'CancellationToken',
|
|
1160
|
+
'ClaimsPrincipal', 'ILogger', 'IFormFileCollection',
|
|
1161
|
+
]);
|
|
1162
|
+
/**
|
|
1163
|
+
* C# parameters carrying an ASP.NET binding attribute (`[FromQuery]`/`[FromRoute]`/
|
|
1164
|
+
* `[FromBody]`/`[FromForm]`/`[FromHeader]`) — on a controller action or a Minimal-API
|
|
1165
|
+
* lambda — as CONFIRMED request sources (cognium-dev#273 cross-file).
|
|
1166
|
+
*
|
|
1167
|
+
* The interprocedural-param seeding already treats these as speculative
|
|
1168
|
+
* `interprocedural_param` sources, which fire single-file but are deliberately
|
|
1169
|
+
* excluded from cross-file taint flows (they would over-fire on every typed
|
|
1170
|
+
* library parameter). Emitting the confirmed `http_param`/`http_body`/
|
|
1171
|
+
* `http_path` type — the same class Java's `@RequestParam` gets — lets a
|
|
1172
|
+
* controller source reach a sink in a helper file. The `http_*` reach-maps are
|
|
1173
|
+
* a subset of `interprocedural_param`'s, so no new single-file flow appears.
|
|
1174
|
+
*/
|
|
1175
|
+
function findCSharpBindingAttributeSources(sourceCode, language) {
|
|
1176
|
+
if (language !== 'csharp')
|
|
1177
|
+
return [];
|
|
1178
|
+
const sources = [];
|
|
1179
|
+
const lines = sourceCode.split('\n');
|
|
1180
|
+
const re = /\[\s*(FromQuery|FromBody|FromForm|FromRoute|FromHeader)(?:\s*\([^)]*\))?\s*\]\s*(?:\[[^\]]*\]\s*)*[\w.<>[\]?]+\s+([A-Za-z_]\w*)/g;
|
|
1181
|
+
for (let i = 0; i < lines.length; i++) {
|
|
1182
|
+
const lineRe = new RegExp(re.source, 'g');
|
|
1183
|
+
let m;
|
|
1184
|
+
while ((m = lineRe.exec(lines[i])) !== null) {
|
|
1185
|
+
const attr = m[1];
|
|
1186
|
+
const name = m[2];
|
|
1187
|
+
const type = attr === 'FromBody' || attr === 'FromForm' ? 'http_body'
|
|
1188
|
+
: attr === 'FromRoute' ? 'http_path'
|
|
1189
|
+
: 'http_param';
|
|
1190
|
+
if (sources.some((s) => s.line === i + 1 && s.variable === name))
|
|
1191
|
+
continue;
|
|
1192
|
+
sources.push({
|
|
1193
|
+
type,
|
|
1194
|
+
location: `[${attr}] ${name}`,
|
|
1195
|
+
severity: 'high',
|
|
1196
|
+
line: i + 1,
|
|
1197
|
+
confidence: 1.0,
|
|
1198
|
+
variable: name,
|
|
1199
|
+
});
|
|
1200
|
+
}
|
|
1201
|
+
}
|
|
1202
|
+
return sources;
|
|
1203
|
+
}
|
|
1204
|
+
/**
|
|
1205
|
+
* ASP.NET Core Minimal-API route-handler parameters (cognium-dev#273).
|
|
1206
|
+
* `app.MapGet("/u/{id}", (string id) => …)` / `app.MapPost("/u", ([FromBody]
|
|
1207
|
+
* Dto d) => …)` — the lambda parameters are request-bound but live inside a
|
|
1208
|
+
* `MapX(...)` call, not a method declaration, so the interprocedural-param
|
|
1209
|
+
* seeding never sees them. Text-scan the `MapGet/Post/Put/Delete/Patch(route,
|
|
1210
|
+
* (params) => …)` shape and seed each request-bound parameter.
|
|
1211
|
+
*
|
|
1212
|
+
* Conservative: seeds a param only when it carries a binding attribute
|
|
1213
|
+
* (except `[FromServices]`) or is a bare `string` (the common route/query
|
|
1214
|
+
* binding). DI services, `HttpContext`, `CancellationToken`, etc. are skipped,
|
|
1215
|
+
* so no framework parameter becomes a spurious source.
|
|
1216
|
+
*/
|
|
1217
|
+
function findCSharpMinimalApiSources(sourceCode, language) {
|
|
1218
|
+
if (language !== 'csharp')
|
|
1219
|
+
return [];
|
|
1220
|
+
const sources = [];
|
|
1221
|
+
const lines = sourceCode.split('\n');
|
|
1222
|
+
// MapX( <route>, [lambda-attr] [async] ( <params> ) => … (params on the decl line)
|
|
1223
|
+
const mapRe = /\bMap(?:Get|Post|Put|Delete|Patch)\s*\(\s*(?:@?"[^"]*"|[\w.]+)\s*,\s*(?:\[[^\]]*\]\s*)?(?:async\s*)?\(([^)]*)\)\s*=>/;
|
|
1224
|
+
for (let i = 0; i < lines.length; i++) {
|
|
1225
|
+
const m = mapRe.exec(lines[i]);
|
|
1226
|
+
if (!m || !m[1].trim())
|
|
1227
|
+
continue;
|
|
1228
|
+
for (const rawParam of m[1].split(',')) {
|
|
1229
|
+
const seed = classifyCSharpLambdaParam(rawParam);
|
|
1230
|
+
if (!seed)
|
|
1231
|
+
continue;
|
|
1232
|
+
if (sources.some((s) => s.line === i + 1 && s.variable === seed.name))
|
|
1233
|
+
continue;
|
|
1234
|
+
sources.push({
|
|
1235
|
+
type: seed.type,
|
|
1236
|
+
location: `${seed.name} (Minimal API ${seed.via})`,
|
|
1237
|
+
severity: 'high',
|
|
1238
|
+
line: i + 1,
|
|
1239
|
+
confidence: 1.0,
|
|
1240
|
+
variable: seed.name,
|
|
1241
|
+
});
|
|
1242
|
+
}
|
|
1243
|
+
}
|
|
1244
|
+
return sources;
|
|
1245
|
+
}
|
|
1246
|
+
/** Classify one Minimal-API lambda parameter as a request source (or null). */
|
|
1247
|
+
function classifyCSharpLambdaParam(raw) {
|
|
1248
|
+
const attrs = [...raw.matchAll(/\[([^\]]*)\]/g)].map((a) => a[1].split('(')[0].trim());
|
|
1249
|
+
if (attrs.includes('FromServices'))
|
|
1250
|
+
return null;
|
|
1251
|
+
// Binding-attributed params are seeded by findCSharpBindingAttributeSources;
|
|
1252
|
+
// this function owns only the un-attributed bare `string` route/query param.
|
|
1253
|
+
if (attrs.some((a) => CSHARP_MINIMAL_API_BINDING.has(a)))
|
|
1254
|
+
return null;
|
|
1255
|
+
const noAttr = raw.replace(/\[[^\]]*\]/g, '').trim();
|
|
1256
|
+
const parts = noAttr.split(/\s+/).filter(Boolean);
|
|
1257
|
+
if (parts.length < 2)
|
|
1258
|
+
return null; // need `type name`
|
|
1259
|
+
const name = parts[parts.length - 1];
|
|
1260
|
+
if (!/^[A-Za-z_]\w*$/.test(name))
|
|
1261
|
+
return null;
|
|
1262
|
+
const baseType = (parts[parts.length - 2] ?? '')
|
|
1263
|
+
.replace(/[?\[\]]/g, '').split('<')[0].split('.').pop() ?? '';
|
|
1264
|
+
if (CSHARP_NON_INPUT_TYPES.has(baseType))
|
|
1265
|
+
return null;
|
|
1266
|
+
for (const a of attrs) {
|
|
1267
|
+
const t = CSHARP_MINIMAL_API_BINDING.get(a);
|
|
1268
|
+
if (t)
|
|
1269
|
+
return { type: t, name, via: `[${a}]` };
|
|
1270
|
+
}
|
|
1271
|
+
// Bare `string` param = route/query binding; DI services are never `string`.
|
|
1272
|
+
if (baseType === 'string')
|
|
1273
|
+
return { type: 'http_param', name, via: 'string param' };
|
|
1274
|
+
return null;
|
|
1275
|
+
}
|
|
1145
1276
|
function findJavaScriptAssignmentSources(sourceCode, language) {
|
|
1146
1277
|
if (!['javascript', 'typescript'].includes(language))
|
|
1147
1278
|
return [];
|