circle-ir 4.9.12 → 4.9.14

package/dist/analysis/passes/sink-filter-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AACzG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA61B9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AA6BD,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;CAmqCxC;AAkRD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA4I1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA6E5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GACvB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2C5B"}
+{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AACzG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAo+B9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AA6BD,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;CAkwCxC;AAkRD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA4I1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA6E5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GACvB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2C5B"}

package/dist/analysis/passes/sink-filter-pass.js

@@ -218,6 +218,47 @@ const OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executo
 //   new ProcessBuilder(new String[]{ ... })
 //   new ProcessBuilder("...", ...)        (varargs ≥2 args; first is string literal)
 const PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
+// Same argv proof, for the `pb.command(...)` setter rather than the ctor.
+// `command(List<String>)` / `command(String...)` feed the same argv array, so
+// a tainted element is one argv slot, not a shell string. Added with #351:
+// that issue widened the `command` sink's `arg_positions` beyond `[0]`, which
+// without this would report `pb.command("ls", userInput)` as CWE-78 when it is
+// at most argument injection (CWE-88) — exactly the FP class #179 removed for
+// the constructor.
+const PROCESS_BUILDER_COMMAND_ARGV_FORM_RE = /\.\s*command\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
+// cognium-dev#351 — the argv proof above holds only while argv[0] is the
+// PROGRAM. When argv[0] is a shell, argv[1..] is a script and a tainted
+// element is a shell command string, so bypassing the shell is exactly what
+// does NOT happen:
+//
+//   new ProcessBuilder("bash", "-c", "cowsay '" + input + "'")   // CWE-78
+//   new ProcessBuilder(List.of("sh", "-c", tainted))             // CWE-78
+//
+// `Runtime.exec(String[])` with the identical array already reported, so the
+// argv-form suppression was the only thing standing between this shape and a
+// finding. Kept deliberately narrow: only a literal, recognisably-shell
+// argv[0] re-opens the sink; anything else keeps #179's suppression.
+const SHELL_PROGRAMS = new Set([
+    'sh', 'bash', 'zsh', 'ksh', 'dash', 'ash', 'csh', 'tcsh', 'fish',
+    'cmd', 'command', 'powershell', 'pwsh',
+]);
+const ARGV_FIRST_LITERAL_RE = /(?:\bnew\s+ProcessBuilder\s*\(|\.\s*command\s*\()\s*(?:Arrays\.asList\s*\(|List\.of\s*\(|Collections\.singletonList\s*\(|new\s+ArrayList\s*(?:<[^>]*>)?\s*\(\s*(?:Arrays\.asList\s*\()?|new\s+String\s*\[\s*\]\s*\{)?\s*"([^"]*)"/;
+/**
+ * True when the first argv literal on the line names a shell interpreter.
+ * Compares the basename so `/bin/bash` and `C:\\Windows\\System32\\cmd.exe`
+ * are recognised as well as a bare `bash`.
+ */
+function argvFirstLiteralIsShell(lineText) {
+    const m = ARGV_FIRST_LITERAL_RE.exec(lineText);
+    if (!m)
+        return false;
+    const base = m[1]
+        .split(/[\\/]/)
+        .pop()
+        .replace(/\.exe$/i, '')
+        .toLowerCase();
+    return SHELL_PROGRAMS.has(base);
+}
 // ---------------------------------------------------------------------------
 // Stage 12 — Java throw-statement FP suppression.
 // (cognium-dev #157 — Sprint 45)
@@ -533,10 +574,94 @@ function jsSsrfHostGuardedLines(code) {
 // C# sanitizers (Phase-1) and the sink types each neutralises. A tainted value
 // that flows through one of these before reaching a sink of the matching type
 // is safe. Method names are C#-distinctive (see config-loader C# sanitizers).
+/**
+ * `Regex.Replace(x, "[^<allowlist>]", "")` — an allowlist character strip
+ * (cognium-dev#272, the LDAP-strip cluster).
+ *
+ * A **negated** class is the whole point: `[^a-zA-Z0-9]` deletes everything
+ * *not* in the set, so the surviving characters are exactly the set. That makes
+ * the result provably inert for the metacharacter-driven injection families
+ * below. A blacklist replace (`"[<>]"`) proves nothing — it enumerates what to
+ * remove and silently misses the rest — and must not match.
+ *
+ * Two conditions, both load-bearing:
+ *
+ *  (a) the pattern is a string literal beginning `[^`. A computed pattern could
+ *      be anything, including attacker-influenced.
+ *  (b) the surviving set contains **no metacharacters**. `[^a-zA-Z0-9']` would
+ *      keep the single quote alive, which breaks SQL and LDAP escaping outright
+ *      — so the class body is restricted to alphanumerics, `\w`, `\d`, `\s`,
+ *      underscore, hyphen and spaces. Anything else (quote, paren, backslash,
+ *      dot, asterisk, semicolon) fails the match and the sink still fires.
+ *
+ * The replacement must be empty or a single safe character, so
+ * `Regex.Replace(x, "[^a-z]", "';DROP")` cannot qualify.
+ */
+const CSHARP_ALLOWLIST_STRIP_RE = /\bRegex\s*\.\s*Replace\s*\([^,]*,\s*@?"\[\^(?:[A-Za-z0-9_\- ]|\\w|\\d|\\s)+\]"\s*,\s*@?"[A-Za-z0-9_]?"\s*\)/;
+/**
+ * Is this `plugin_param` source a map read of a key that was never written, on
+ * a map whose entire contents we can see? (cognium-dev#328 prerequisite.)
+ *
+ * Sound only when the map's provenance is fully known, so all three hold:
+ *
+ *  (a) the receiver is constructed locally — `new HashMap<…>()` and friends. A
+ *      map arriving as a parameter, field or return value may already hold
+ *      anything, which is the case the `plugin_param` registration exists for,
+ *      so it keeps its source.
+ *  (b) the receiver never escapes — it is not passed as an argument to any
+ *      call. `helper(m)` could `put` into it out of sight, so once it escapes
+ *      the contents are no longer knowable from this file.
+ *  (c) the read key is a string literal with **no** `put` of that same literal
+ *      anywhere in the file. A matching `put` keeps the source regardless of
+ *      whether the stored value looks tainted — this gate only removes reads
+ *      that provably yield `null`, never reads whose value it judged clean.
+ *
+ * Deliberately narrow: `plugin_param` only, literal keys only, and any
+ * uncertainty leaves the source untouched. Non-literal keys (`m.get(k)`) are
+ * out of scope because the key is unknown, not because it is safe.
+ */
+function isUnwrittenLocalMapKeyRead(code, source) {
+    if (source.type !== 'plugin_param')
+        return false;
+    const lines = code.split('\n');
+    const lineText = lines[source.line - 1] ?? '';
+    // (c1) the read itself: `<recv>.get("<key>")`
+    const read = /\b([A-Za-z_]\w*)\s*\.\s*get\s*\(\s*"([^"]*)"\s*\)/.exec(lineText);
+    if (!read)
+        return false;
+    const [, recv, key] = read;
+    // (a) locally constructed map
+    const ctorRe = new RegExp(`\\b${recv}\\s*=\\s*new\\s+(?:Hash|Tree|LinkedHash|ConcurrentHash|Concurrent|Identity|Weak)?Map\\s*(?:<[^>]*>)?\\s*\\(`);
+    if (!lines.some(l => ctorRe.test(l)))
+        return false;
+    // (b) no escape: the receiver must not appear inside any call's arguments.
+    //     `m.put(...)` / `m.get(...)` are receiver positions, not arguments.
+    const escapeRe = new RegExp(`\\w\\s*\\([^)]*(?<![\\w.])${recv}(?![\\w.])[^)]*\\)`);
+    for (const l of lines) {
+        if (!escapeRe.test(l))
+            continue;
+        // Allow the map's own keyed calls on this line.
+        const stripped = l.replace(new RegExp(`\\b${recv}\\s*\\.\\s*\\w+\\s*\\(`, 'g'), 'X(');
+        if (escapeRe.test(stripped))
+            return false;
+    }
+    // (c2) was this literal key ever written?
+    const putRe = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}"`);
+    if (lines.some(l => putRe.test(l)))
+        return false;
+    return true;
+}
 const CSHARP_SANITIZER_RES = [
     { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: 'xss' },
     { re: /\bHtmlEncoder\s*\.\s*Encode\s*\(/, type: 'xss' },
     { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: 'path_traversal' },
+    // An allowlist strip leaves only inert characters, so it covers every family
+    // whose exploitation needs a metacharacter. Each has a fixture; see
+    // `issue-272-csharp-allowlist-strip.test.ts`.
+    { re: CSHARP_ALLOWLIST_STRIP_RE, type: 'ldap_injection' },
+    { re: CSHARP_ALLOWLIST_STRIP_RE, type: 'xpath_injection' },
+    { re: CSHARP_ALLOWLIST_STRIP_RE, type: 'command_injection' },
+    { re: CSHARP_ALLOWLIST_STRIP_RE, type: 'sql_injection' },
 ];
 /**
  * Compute, per sink type, the set of C# variables whose value has passed through
@@ -903,9 +1028,28 @@ export class SinkFilterPass {
         // `ctx.language` aren't supplied (legacy callers) — this preserves
         // pre-3.168 behaviour for programmatic callers that pass an
         // already-computed source list without file text.
-        const sources = (ctx.code && ctx.language)
+        const executableSources = (ctx.code && ctx.language)
             ? mergedSources.filter(s => !isNonExecutableSourceLine(ctx.code, s.line, ctx.language))
             : mergedSources;
+        // cognium-dev#328 prerequisite — key-aware map reads.
+        //
+        // `Map.get` / `HashMap.get` / … are registered as unconditional
+        // `plugin_param` sources with `return_tainted: true` (config-loader.ts),
+        // which models reading a config/plugin parameter map populated from
+        // outside. Applied to *every* map, it also makes a read of a key that was
+        // never written a source:
+        //
+        //   Map m = new HashMap();
+        //   m.put("a", req.getParameter("name"));
+        //   String s1 = (String) m.get("b");   // <- source today; yields null
+        //
+        // That is SecuriBench Micro `Collections6:47`, an `/* OK */` line. The
+        // false positive is currently masked by the const-prop veto in #328, so
+        // this gate is behaviour-neutral today; its purpose is to make lifting that
+        // veto safe, which is the sequencing chosen on #328.
+        const sources = ctx.code
+            ? executableSources.filter(s => !isUnwrittenLocalMapKeyRead(ctx.code, s))
+            : executableSources;
         // Build merged sinks, deduplicating JS DOM sinks that may overlap with config sinks.
         const sinks = [...taintMatcher.sinks];
         for (const s of langSources.additionalSinks) {
@@ -1394,13 +1538,27 @@ export class SinkFilterPass {
             filtered = filtered.filter(sink => {
                 if (sink.type !== 'command_injection')
                     return true;
-                if (sink.method !== 'ProcessBuilder' && sink.method !== 'start')
+                if (sink.method !== 'ProcessBuilder' &&
+                    sink.method !== 'start' &&
+                    sink.method !== 'command') {
                     return true;
+                }
                 const sinkLineText = sourceLines[sink.line - 1] ?? '';
-                if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText))
+                const isCtorLine = /\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText);
+                const isCommandLine = /\.\s*command\s*\(/.test(sinkLineText);
+                if (!isCtorLine && !isCommandLine)
+                    return true;
+                // #351 — a shell argv[0] means the tainted element IS a shell command
+                // string, so the argv form proves nothing. Keep the sink.
+                if (argvFirstLiteralIsShell(sinkLineText))
                     return true;
-                if (PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText))
+                if (isCtorLine && PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText))
                     return false;
+                if (isCommandLine && PROCESS_BUILDER_COMMAND_ARGV_FORM_RE.test(sinkLineText)) {
+                    return false;
+                }
+                if (!isCtorLine)
+                    return true;
                 // cognium-dev #256 (3.176.0): resolver fallback for method-call and
                 // variable arguments whose declared type is `List<String>` /
                 // `String[]` / etc. The regex above catches literal shapes
@@ -1912,6 +2070,69 @@ export class SinkFilterPass {
                 return true;
             });
         }
+        // Stage 15l — C# ssrf: HttpClient with a constant BaseAddress and a
+        // relative request path. (cognium-dev#286 D)
+        //
+        // The C# analogue of Stage 15i above (JS fixed-host URL template): when the
+        // host is a compile-time constant, attacker input can only extend the path,
+        // so the request cannot be redirected to another host.
+        //
+        //   var client = new HttpClient { BaseAddress = new Uri("https://api.internal/") };
+        //   await client.GetAsync("lookup/" + Uri.EscapeDataString(input));   // not ssrf
+        //
+        // Three conditions, and each one is load-bearing:
+        //
+        //  (a) `BaseAddress` is assigned a *string-literal* Uri. `new Uri(input)`
+        //      means the attacker chooses the host, which is a worse bug than the
+        //      one being suppressed here — it must keep firing.
+        //  (b) the sink call's receiver is that same client variable.
+        //  (c) the argument starts with a *string literal* that is neither absolute
+        //      (`http://`, `https://`) nor protocol-relative (`//host`). This is
+        //      the subtle one: .NET **ignores BaseAddress entirely when the request
+        //      URI is absolute**, so `client.GetAsync(input)` with a bare tainted
+        //      variable is still a genuine SSRF — the attacker supplies
+        //      `https://evil.example` and the base is discarded. Only a literal
+        //      relative prefix proves the attacker cannot reach the host position,
+        //      the same reasoning as the same-origin literal prefix in #284 d1.
+        if (language === 'csharp') {
+            const sourceLines = ctx.code.split('\n');
+            // (a) client variables whose BaseAddress is a constant Uri.
+            const constBaseClients = new Set();
+            const declRe = /\b(?:var|HttpClient)\s+([A-Za-z_]\w*)\s*=\s*new\s+HttpClient\s*\{[^}]*\bBaseAddress\s*=\s*new\s+Uri\s*\(\s*(?:@?"[^"]*"|\$?"[^"{}]*")\s*\)/;
+            for (const line of sourceLines) {
+                const m = declRe.exec(line);
+                if (m)
+                    constBaseClients.add(m[1]);
+            }
+            if (constBaseClients.size > 0) {
+                // (c) the argument's leading string literal must be a relative path.
+                const relativeLiteralArgRe = /\.\s*(?:Get|Post|Put|Patch|Delete|Send|GetString|GetByteArray|GetStream)\w*Async\s*\(\s*(?:@?\$?)"([^"]*)"/;
+                filtered = filtered.filter(sink => {
+                    if (sink.type !== 'ssrf')
+                        return true;
+                    const text = sourceLines[sink.line - 1] ?? '';
+                    // (b) receiver must be a constant-base client.
+                    let onConstClient = false;
+                    for (const v of constBaseClients) {
+                        if (new RegExp(`(?<![\\w])${escapeRegex(v)}\\s*\\.`).test(text)) {
+                            onConstClient = true;
+                            break;
+                        }
+                    }
+                    if (!onConstClient)
+                        return true;
+                    const m = relativeLiteralArgRe.exec(text);
+                    if (!m)
+                        return true; // no leading literal — keep
+                    const lit = m[1];
+                    if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(lit))
+                        return true; // absolute URI
+                    if (lit.startsWith('//'))
+                        return true; // protocol-relative
+                    return false; // fixed host, relative path
+                });
+            }
+        }
         // Stage 16 — JS log_injection (CWE-117) sanitizer suppression.
         // (cognium-dev #216 sanitizer-wrapped FP — Sprint 52)
         //