circle-ir 4.9.10 → 4.9.12

package/dist/browser/circle-ir.js

@@ -15056,14 +15056,30 @@ var PYTHON_TAINTED_PATTERNS = [
   // regex registry so it's recognized in subscript/var contexts.
   { pattern: /\binput\s*\(/, sourceType: "io_input" }
 ];
+function dropCSharpObjectCarriedWaypoints(sinks, calls) {
+  const zeroArgCtors = /* @__PURE__ */ new Set();
+  for (const call of calls) {
+    if (call.is_constructor && call.arguments.length === 0) {
+      zeroArgCtors.add(`${call.location.line}:${call.method_name}`);
+    }
+  }
+  return sinks.filter((sink) => {
+    if (sink.type !== "sql_injection") return true;
+    if (sink.method && zeroArgCtors.has(`${sink.line}:${sink.method}`)) {
+      return false;
+    }
+    return true;
+  });
+}
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
+  const gatedSinks = language === "csharp" ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
-  return { sources, sinks, sanitizers };
+  return { sources, sinks: gatedSinks, sanitizers };
 }
 function sinkPatternAppliesTo(pattern, language) {
   if (language === void 0) return true;
@@ -15334,7 +15350,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   const sourceMap = /* @__PURE__ */ new Map();
   for (const source of sources) {
-    const key = `${source.line}:${source.type}`;
+    const key = source.type === "interprocedural_param" && source.variable ? `${source.line}:${source.type}:${source.variable}` : `${source.line}:${source.type}`;
     const existing = sourceMap.get(key);
     if (!existing || source.confidence > existing.confidence) {
       sourceMap.set(key, source);
@@ -15834,7 +15850,7 @@ function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)
     const guards = guardMap.get(cand);
     if (!guards) continue;
     for (const g of guards) {
-      if (g.i >= sinkIdx || checked.has(g)) continue;
+      if (g.i > sinkIdx || checked.has(g)) continue;
       checked.add(g);
       const block = csThenBlock(sourceLines, g.i, g.rest);
       if (g.op === "==") {
@@ -15952,6 +15968,15 @@ var CWE_78_RECEIVER_ALLOWLIST = /* @__PURE__ */ new Set([
   // hutool
   "RuntimeUtil"
 ]);
+function isRegexReceiver(receiver, sourceLines) {
+  const r = (receiver ?? "").trim();
+  if (r.length === 0) return false;
+  if (r.startsWith("/") && /\/[a-z]*$/.test(r)) return true;
+  if (/^(?:new\s+)?RegExp\s*\(/.test(r)) return true;
+  if (!/^[A-Za-z_$][\w$]*$/.test(r) || !sourceLines) return false;
+  const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
+  return sourceLines.some((l) => decl.test(l));
+}
 function isFunctionCallbackArgument(arg) {
   if (arg.literal !== null && arg.literal !== void 0) return false;
   const expr = (arg.expression ?? "").trim();
@@ -16134,6 +16159,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (pattern.type === "command_injection" && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
+          continue;
+        }
+        if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {
+          continue;
+        }
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -18784,6 +18815,9 @@ function findInitialTaint(sources, callsByLine, defsByLine) {
   for (const source of sources) {
     const defsOnLine = defsByLine.get(source.line) ?? [];
     for (const def of defsOnLine) {
+      if (source.type === "interprocedural_param" && source.variable && def.kind === "param" && def.variable !== source.variable) {
+        continue;
+      }
       tainted.push({
         variable: def.variable,
         defId: def.id,
@@ -34110,6 +34144,21 @@ function hasJavaImportFromPackage(packagePrefix, sourceLines) {
   }
   return false;
 }
+function hasSameOriginLiteralPrefix(lineText) {
+  const m = lineText.match(/\(\s*(['"`])([^'"`]*)\1\s*(?:\+|,|\))/);
+  const prefix = m?.[2];
+  if (prefix === void 0) {
+    const t = lineText.match(/\(\s*`([^`$]*)\$\{/);
+    if (!t) return false;
+    return isSameOriginQueryPrefix(t[1]);
+  }
+  return isSameOriginQueryPrefix(prefix);
+}
+function isSameOriginQueryPrefix(prefix) {
+  if (!prefix.startsWith("/")) return false;
+  if (prefix.startsWith("//")) return false;
+  return prefix.includes("?");
+}
 var SinkFilterPass = class {
   name = "sink-filter";
   category = "security";
@@ -34265,6 +34314,9 @@ var SinkFilterPass = class {
         if (setHeaderMatch) {
           return false;
         }
+        if (sink.type === "open_redirect" && hasSameOriginLiteralPrefix(sinkLineText)) {
+          return false;
+        }
         if (sink.method === "cookie" && sink.type === "crlf") {
           return false;
         }
@@ -36332,7 +36384,7 @@ var TaintPropagationPass = class {
     for (const f of paramFlows) {
       pushIfNew(f);
     }
-    const exprScanFlows = detectExpressionScanFlows(calls, sources, sinks, sanitizers, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language) ?? [];
+    const exprScanFlows = detectExpressionScanFlows(calls, sources, sinks, sanitizers, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language, types) ?? [];
     for (const f of exprScanFlows) {
       if (flowKeys.has(flowKey(f))) continue;
       const flowForCheck = {
@@ -36484,6 +36536,36 @@ var TaintPropagationPass = class {
         return bestByKey.get(key) === f;
       });
     }
+    if (ctx.language === "csharp" && finalFlows.length > 1) {
+      const CSHARP_ADO_EXECUTE = /^Execute(?:Reader|NonQuery|Scalar)(?:Async)?$/;
+      const commandTextReceiverByLine = /* @__PURE__ */ new Map();
+      const execLinesByReceiver = /* @__PURE__ */ new Map();
+      for (const call of calls) {
+        const receiver = (call.receiver ?? "").trim();
+        if (!receiver) continue;
+        if (call.method_name === "CommandText") {
+          commandTextReceiverByLine.set(call.location.line, receiver);
+        } else if (CSHARP_ADO_EXECUTE.test(call.method_name)) {
+          const lines = execLinesByReceiver.get(receiver) ?? [];
+          lines.push(call.location.line);
+          execLinesByReceiver.set(receiver, lines);
+        }
+      }
+      if (commandTextReceiverByLine.size > 0) {
+        const reportedSqlSinkLines = new Set(
+          finalFlows.filter((f) => f.sink_type === "sql_injection").map((f) => f.sink_line)
+        );
+        finalFlows = finalFlows.filter((f) => {
+          if (f.sink_type !== "sql_injection") return true;
+          const receiver = commandTextReceiverByLine.get(f.sink_line);
+          if (receiver === void 0) return true;
+          const execLines = execLinesByReceiver.get(receiver) ?? [];
+          return !execLines.some(
+            (line) => line > f.sink_line && reportedSqlSinkLines.has(line)
+          );
+        });
+      }
+    }
     return { flows: finalFlows };
   }
 };
@@ -36901,7 +36983,7 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
   }
   return false;
 }
-function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language) {
+function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language, types) {
   const flows = [];
   const sourcesWithVar = sources.filter(
     (s) => typeof s.variable === "string" && s.variable.length > 0
@@ -37158,12 +37240,32 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       for (const s of sourcesWithVar) {
         if (s.line < anchor.line) anchor = s;
       }
+      const methodAt = (line) => {
+        for (const t of types ?? []) {
+          for (const m of t.methods) {
+            if (line >= m.start_line && line <= m.end_line) return m.name;
+          }
+        }
+        return null;
+      };
       const existingVars = new Set(sourcesWithVar.map((s) => s.variable));
-      for (const [varName] of derived) {
+      for (const [varName, derivedLine] of derived) {
         if (!varName || existingVars.has(varName)) continue;
+        const owner = methodAt(derivedLine);
+        let scopedAnchor = anchor;
+        if (owner) {
+          let best;
+          for (const s of sourcesWithVar) {
+            const sOwner = s.in_method ?? methodAt(s.line);
+            if (sOwner !== owner) continue;
+            if (!best || s.line < best.line) best = s;
+          }
+          if (best) scopedAnchor = best;
+        }
         sourcesWithVar.push({
-          ...anchor,
-          variable: varName
+          ...scopedAnchor,
+          variable: varName,
+          ...owner ? { in_method: owner } : {}
         });
         existingVars.add(varName);
       }

package/dist/core/circle-ir-core.cjs

@@ -14356,14 +14356,30 @@ var PYTHON_TAINTED_PATTERNS = [
   // regex registry so it's recognized in subscript/var contexts.
   { pattern: /\binput\s*\(/, sourceType: "io_input" }
 ];
+function dropCSharpObjectCarriedWaypoints(sinks, calls) {
+  const zeroArgCtors = /* @__PURE__ */ new Set();
+  for (const call of calls) {
+    if (call.is_constructor && call.arguments.length === 0) {
+      zeroArgCtors.add(`${call.location.line}:${call.method_name}`);
+    }
+  }
+  return sinks.filter((sink) => {
+    if (sink.type !== "sql_injection") return true;
+    if (sink.method && zeroArgCtors.has(`${sink.line}:${sink.method}`)) {
+      return false;
+    }
+    return true;
+  });
+}
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
+  const gatedSinks = language === "csharp" ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
-  return { sources, sinks, sanitizers };
+  return { sources, sinks: gatedSinks, sanitizers };
 }
 function sinkPatternAppliesTo(pattern, language) {
   if (language === void 0) return true;
@@ -14634,7 +14650,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   const sourceMap = /* @__PURE__ */ new Map();
   for (const source of sources) {
-    const key = `${source.line}:${source.type}`;
+    const key = source.type === "interprocedural_param" && source.variable ? `${source.line}:${source.type}:${source.variable}` : `${source.line}:${source.type}`;
     const existing = sourceMap.get(key);
     if (!existing || source.confidence > existing.confidence) {
       sourceMap.set(key, source);
@@ -15134,7 +15150,7 @@ function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)
     const guards = guardMap.get(cand);
     if (!guards) continue;
     for (const g of guards) {
-      if (g.i >= sinkIdx || checked.has(g)) continue;
+      if (g.i > sinkIdx || checked.has(g)) continue;
       checked.add(g);
       const block = csThenBlock(sourceLines, g.i, g.rest);
       if (g.op === "==") {
@@ -15252,6 +15268,15 @@ var CWE_78_RECEIVER_ALLOWLIST = /* @__PURE__ */ new Set([
   // hutool
   "RuntimeUtil"
 ]);
+function isRegexReceiver(receiver, sourceLines) {
+  const r = (receiver ?? "").trim();
+  if (r.length === 0) return false;
+  if (r.startsWith("/") && /\/[a-z]*$/.test(r)) return true;
+  if (/^(?:new\s+)?RegExp\s*\(/.test(r)) return true;
+  if (!/^[A-Za-z_$][\w$]*$/.test(r) || !sourceLines) return false;
+  const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
+  return sourceLines.some((l) => decl.test(l));
+}
 function isFunctionCallbackArgument(arg) {
   if (arg.literal !== null && arg.literal !== void 0) return false;
   const expr = (arg.expression ?? "").trim();
@@ -15434,6 +15459,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (pattern.type === "command_injection" && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
+          continue;
+        }
+        if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {
+          continue;
+        }
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -16749,6 +16780,9 @@ function findInitialTaint(sources, callsByLine, defsByLine) {
   for (const source of sources) {
     const defsOnLine = defsByLine.get(source.line) ?? [];
     for (const def of defsOnLine) {
+      if (source.type === "interprocedural_param" && source.variable && def.kind === "param" && def.variable !== source.variable) {
+        continue;
+      }
       tainted.push({
         variable: def.variable,
         defId: def.id,

package/dist/core/circle-ir-core.js

@@ -14290,14 +14290,30 @@ var PYTHON_TAINTED_PATTERNS = [
   // regex registry so it's recognized in subscript/var contexts.
   { pattern: /\binput\s*\(/, sourceType: "io_input" }
 ];
+function dropCSharpObjectCarriedWaypoints(sinks, calls) {
+  const zeroArgCtors = /* @__PURE__ */ new Set();
+  for (const call of calls) {
+    if (call.is_constructor && call.arguments.length === 0) {
+      zeroArgCtors.add(`${call.location.line}:${call.method_name}`);
+    }
+  }
+  return sinks.filter((sink) => {
+    if (sink.type !== "sql_injection") return true;
+    if (sink.method && zeroArgCtors.has(`${sink.line}:${sink.method}`)) {
+      return false;
+    }
+    return true;
+  });
+}
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
+  const gatedSinks = language === "csharp" ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
-  return { sources, sinks, sanitizers };
+  return { sources, sinks: gatedSinks, sanitizers };
 }
 function sinkPatternAppliesTo(pattern, language) {
   if (language === void 0) return true;
@@ -14568,7 +14584,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   const sourceMap = /* @__PURE__ */ new Map();
   for (const source of sources) {
-    const key = `${source.line}:${source.type}`;
+    const key = source.type === "interprocedural_param" && source.variable ? `${source.line}:${source.type}:${source.variable}` : `${source.line}:${source.type}`;
     const existing = sourceMap.get(key);
     if (!existing || source.confidence > existing.confidence) {
       sourceMap.set(key, source);
@@ -15068,7 +15084,7 @@ function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)
     const guards = guardMap.get(cand);
     if (!guards) continue;
     for (const g of guards) {
-      if (g.i >= sinkIdx || checked.has(g)) continue;
+      if (g.i > sinkIdx || checked.has(g)) continue;
       checked.add(g);
       const block = csThenBlock(sourceLines, g.i, g.rest);
       if (g.op === "==") {
@@ -15186,6 +15202,15 @@ var CWE_78_RECEIVER_ALLOWLIST = /* @__PURE__ */ new Set([
   // hutool
   "RuntimeUtil"
 ]);
+function isRegexReceiver(receiver, sourceLines) {
+  const r = (receiver ?? "").trim();
+  if (r.length === 0) return false;
+  if (r.startsWith("/") && /\/[a-z]*$/.test(r)) return true;
+  if (/^(?:new\s+)?RegExp\s*\(/.test(r)) return true;
+  if (!/^[A-Za-z_$][\w$]*$/.test(r) || !sourceLines) return false;
+  const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
+  return sourceLines.some((l) => decl.test(l));
+}
 function isFunctionCallbackArgument(arg) {
   if (arg.literal !== null && arg.literal !== void 0) return false;
   const expr = (arg.expression ?? "").trim();
@@ -15368,6 +15393,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (pattern.type === "command_injection" && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
+          continue;
+        }
+        if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {
+          continue;
+        }
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -16683,6 +16714,9 @@ function findInitialTaint(sources, callsByLine, defsByLine) {
   for (const source of sources) {
     const defsOnLine = defsByLine.get(source.line) ?? [];
     for (const def of defsOnLine) {
+      if (source.type === "interprocedural_param" && source.variable && def.kind === "param" && def.variable !== source.variable) {
+        continue;
+      }
       tainted.push({
         variable: def.variable,
         defId: def.id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "4.9.10",
+  "version": "4.9.12",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",