circle-ir 4.9.13 → 4.9.14

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAqlEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAymEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -984,9 +984,27 @@ export const DEFAULT_SINKS = [
     // Command Injection (CWE-78)
     { method: 'exec', class: 'Runtime', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1] },
     { method: 'start', class: 'ProcessBuilder', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [] },
-    // ProcessBuilder constructor
-    { method: 'ProcessBuilder', class: 'constructor', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
-    { method: 'command', class: 'ProcessBuilder', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
+    // ProcessBuilder constructor + command(): cognium-dev#351 — BOTH take
+    // `String...` varargs (or a single List<String>), and EVERY element is a
+    // command token, so no position is safe. Pinning these to `[0]` missed the
+    // canonical shell-wrapper shape, where the payload is the last argument:
+    //
+    //   new ProcessBuilder("bash", "-c", tainted)     // payload at position 2
+    //   pb.command("bash", "-c", tainted)
+    //
+    // `Runtime.exec(String[])` with the identical array already fired, so the
+    // taint was available and only the sink model was wrong.
+    //
+    // The positions are enumerated rather than left `[]` because the two layers
+    // that read this field disagree about what an empty array means:
+    // `isInDangerousPosition` (taint-matcher) does `arg_positions.includes(pos)`,
+    // so `[]` matches NOTHING, while the sink-reachability loop in
+    // taint-propagation treats `length === 0` as "any argument".
+    // `ProcessBuilder.start` gets away with `[]` only because it takes no
+    // arguments at all. Enumerating is unambiguous in both, and matches how the
+    // logging sinks in this file already spell it.
+    { method: 'ProcessBuilder', class: 'constructor', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+    { method: 'command', class: 'ProcessBuilder', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
     // Commons Exec
     // Note: bare class 'Executor' removed — it collided with java.util.concurrent.Executor
     // (Executor.execute(Runnable) is not command injection). Apache Commons Exec users
@@ -2263,8 +2281,10 @@ export const DEFAULT_SINKS = [
     // =========================================================================
     // Java CWE-Bench Enhancement Patterns (Collection/Builder)
     // =========================================================================
-    // Collection-based command injection (ProcessBuilder with List)
-    { method: 'command', class: 'ProcessBuilder', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0] },
+    // Collection-based command injection (ProcessBuilder with List) — the
+    // `ProcessBuilder.command` entry lives with the other ProcessBuilder sinks
+    // above; a second copy here only risked the two drifting apart, which is
+    // what happened (cognium-dev#351).
     // ProcessBuilder.inheritIO removed in 3.83.0 (#124): no args, no command
     // string flows into it. See note above next to the Process-related cluster.
     // Jenkins DSL patterns