circle-ir 4.9.13 → 4.9.15

package/dist/core/circle-ir-core.cjs

@@ -6746,6 +6746,14 @@ function buildResolutionContext(tree, cache) {
       }
     }
   }
+  const resourceDecls = getNodesFromCache(tree.rootNode, "resource", cache);
+  for (const res of resourceDecls) {
+    const typeNode = res.childForFieldName("type");
+    const nameNode = res.childForFieldName("name");
+    if (typeNode && nameNode) {
+      context.localVarTypes.set(getNodeText(nameNode), getNodeText(typeNode));
+    }
+  }
   const imports = getNodesFromCache(tree.rootNode, "import_declaration", cache);
   for (const imp of imports) {
     const text = getNodeText(imp);
@@ -10858,6 +10866,30 @@ function extractGoAddressableVarName(node) {
   return null;
 }
 
+// src/analysis/literal-expression.ts
+function isProvablyLiteralExpression(expr) {
+  let e = (expr ?? "").trim();
+  if (e.length === 0) return false;
+  e = e.replace(/\/\/.*$/, "").replace(/;\s*$/, "").trim();
+  if (e.length === 0) return false;
+  if (e.includes("${")) return false;
+  if (/[+]\s*$/.test(e)) return false;
+  const stripped = e.replace(
+    /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\$]|\\.)*`/g,
+    ""
+  );
+  if (/["'`]/.test(stripped)) return false;
+  return /^[\s+()]*$/.test(stripped);
+}
+var DOM_ASSIGNMENT_SINK_METHODS = /* @__PURE__ */ new Set([
+  "innerHTML",
+  "outerHTML",
+  "cssText",
+  "src",
+  "href",
+  "textContent"
+]);
+
 // src/analysis/config-loader.ts
 function parseConfig(content) {
   return JSON.parse(content);
@@ -11767,9 +11799,27 @@ var DEFAULT_SINKS = [
   // Command Injection (CWE-78)
   { method: "exec", class: "Runtime", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "start", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [] },
-  // ProcessBuilder constructor
-  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // ProcessBuilder constructor + command(): cognium-dev#351 — BOTH take
+  // `String...` varargs (or a single List<String>), and EVERY element is a
+  // command token, so no position is safe. Pinning these to `[0]` missed the
+  // canonical shell-wrapper shape, where the payload is the last argument:
+  //
+  //   new ProcessBuilder("bash", "-c", tainted)     // payload at position 2
+  //   pb.command("bash", "-c", tainted)
+  //
+  // `Runtime.exec(String[])` with the identical array already fired, so the
+  // taint was available and only the sink model was wrong.
+  //
+  // The positions are enumerated rather than left `[]` because the two layers
+  // that read this field disagree about what an empty array means:
+  // `isInDangerousPosition` (taint-matcher) does `arg_positions.includes(pos)`,
+  // so `[]` matches NOTHING, while the sink-reachability loop in
+  // taint-propagation treats `length === 0` as "any argument".
+  // `ProcessBuilder.start` gets away with `[]` only because it takes no
+  // arguments at all. Enumerating is unambiguous in both, and matches how the
+  // logging sinks in this file already spell it.
+  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
   // Commons Exec
   // Note: bare class 'Executor' removed — it collided with java.util.concurrent.Executor
   // (Executor.execute(Runnable) is not command injection). Apache Commons Exec users
@@ -13047,8 +13097,10 @@ var DEFAULT_SINKS = [
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
-  // Collection-based command injection (ProcessBuilder with List)
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // Collection-based command injection (ProcessBuilder with List) — the
+  // `ProcessBuilder.command` entry lives with the other ProcessBuilder sinks
+  // above; a second copy here only risked the two drifting apart, which is
+  // what happened (cognium-dev#351).
   // ProcessBuilder.inheritIO removed in 3.83.0 (#124): no args, no command
   // string flows into it. See note above next to the Process-related cluster.
   // Jenkins DSL patterns
@@ -15303,6 +15355,22 @@ function isRegexReceiver(receiver, sourceLines) {
   const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
   return sourceLines.some((l) => decl.test(l));
 }
+function isDeclaredFunctionReference(arg, sourceLines) {
+  if (arg.literal !== null && arg.literal !== void 0) return false;
+  if (!sourceLines) return false;
+  const name2 = (arg.expression ?? "").trim();
+  if (!/^[A-Za-z_$][\w$]*$/.test(name2)) return false;
+  const n = escapeRe(name2);
+  const decls = [
+    // function connect() {}   /   async function connect() {}
+    new RegExp(`\\bfunction\\s+${n}\\s*\\(`),
+    // const connect = () => / function / async () =>
+    new RegExp(
+      `\\b(?:const|let|var)\\s+${n}\\s*=\\s*(?:async\\s+)?(?:function\\b|\\(|[A-Za-z_$][\\w$]*\\s*=>)`
+    )
+  ];
+  return sourceLines.some((l) => decls.some((re) => re.test(l)));
+}
 function isFunctionCallbackArgument(arg) {
   if (arg.literal !== null && arg.literal !== void 0) return false;
   const expr = (arg.expression ?? "").trim();
@@ -15481,11 +15549,17 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         }
         if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout" || call.method_name === "setImmediate")) {
           const firstArg = call.arguments.find((a) => a.position === 0);
-          if (firstArg && isFunctionCallbackArgument(firstArg)) {
+          if (firstArg && (isFunctionCallbackArgument(firstArg) || isDeclaredFunctionReference(firstArg, sourceLines))) {
+            continue;
+          }
+        }
+        if (pattern.type === "xss" && (language === "javascript" || language === "typescript") && DOM_ASSIGNMENT_SINK_METHODS.has(call.method_name) && call.arguments.length > 0) {
+          const rhs = call.arguments.find((a) => a.position === 0);
+          if (rhs && isProvablyLiteralExpression(rhs.expression ?? "")) {
             continue;
           }
         }
-        if (pattern.type === "command_injection" && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
+        if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }
         if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {

package/dist/core/circle-ir-core.js

@@ -6680,6 +6680,14 @@ function buildResolutionContext(tree, cache) {
       }
     }
   }
+  const resourceDecls = getNodesFromCache(tree.rootNode, "resource", cache);
+  for (const res of resourceDecls) {
+    const typeNode = res.childForFieldName("type");
+    const nameNode = res.childForFieldName("name");
+    if (typeNode && nameNode) {
+      context.localVarTypes.set(getNodeText(nameNode), getNodeText(typeNode));
+    }
+  }
   const imports = getNodesFromCache(tree.rootNode, "import_declaration", cache);
   for (const imp of imports) {
     const text = getNodeText(imp);
@@ -10792,6 +10800,30 @@ function extractGoAddressableVarName(node) {
   return null;
 }
 
+// src/analysis/literal-expression.ts
+function isProvablyLiteralExpression(expr) {
+  let e = (expr ?? "").trim();
+  if (e.length === 0) return false;
+  e = e.replace(/\/\/.*$/, "").replace(/;\s*$/, "").trim();
+  if (e.length === 0) return false;
+  if (e.includes("${")) return false;
+  if (/[+]\s*$/.test(e)) return false;
+  const stripped = e.replace(
+    /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\$]|\\.)*`/g,
+    ""
+  );
+  if (/["'`]/.test(stripped)) return false;
+  return /^[\s+()]*$/.test(stripped);
+}
+var DOM_ASSIGNMENT_SINK_METHODS = /* @__PURE__ */ new Set([
+  "innerHTML",
+  "outerHTML",
+  "cssText",
+  "src",
+  "href",
+  "textContent"
+]);
+
 // src/analysis/config-loader.ts
 function parseConfig(content) {
   return JSON.parse(content);
@@ -11701,9 +11733,27 @@ var DEFAULT_SINKS = [
   // Command Injection (CWE-78)
   { method: "exec", class: "Runtime", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "start", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [] },
-  // ProcessBuilder constructor
-  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // ProcessBuilder constructor + command(): cognium-dev#351 — BOTH take
+  // `String...` varargs (or a single List<String>), and EVERY element is a
+  // command token, so no position is safe. Pinning these to `[0]` missed the
+  // canonical shell-wrapper shape, where the payload is the last argument:
+  //
+  //   new ProcessBuilder("bash", "-c", tainted)     // payload at position 2
+  //   pb.command("bash", "-c", tainted)
+  //
+  // `Runtime.exec(String[])` with the identical array already fired, so the
+  // taint was available and only the sink model was wrong.
+  //
+  // The positions are enumerated rather than left `[]` because the two layers
+  // that read this field disagree about what an empty array means:
+  // `isInDangerousPosition` (taint-matcher) does `arg_positions.includes(pos)`,
+  // so `[]` matches NOTHING, while the sink-reachability loop in
+  // taint-propagation treats `length === 0` as "any argument".
+  // `ProcessBuilder.start` gets away with `[]` only because it takes no
+  // arguments at all. Enumerating is unambiguous in both, and matches how the
+  // logging sinks in this file already spell it.
+  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
   // Commons Exec
   // Note: bare class 'Executor' removed — it collided with java.util.concurrent.Executor
   // (Executor.execute(Runnable) is not command injection). Apache Commons Exec users
@@ -12981,8 +13031,10 @@ var DEFAULT_SINKS = [
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
-  // Collection-based command injection (ProcessBuilder with List)
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // Collection-based command injection (ProcessBuilder with List) — the
+  // `ProcessBuilder.command` entry lives with the other ProcessBuilder sinks
+  // above; a second copy here only risked the two drifting apart, which is
+  // what happened (cognium-dev#351).
   // ProcessBuilder.inheritIO removed in 3.83.0 (#124): no args, no command
   // string flows into it. See note above next to the Process-related cluster.
   // Jenkins DSL patterns
@@ -15237,6 +15289,22 @@ function isRegexReceiver(receiver, sourceLines) {
   const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
   return sourceLines.some((l) => decl.test(l));
 }
+function isDeclaredFunctionReference(arg, sourceLines) {
+  if (arg.literal !== null && arg.literal !== void 0) return false;
+  if (!sourceLines) return false;
+  const name2 = (arg.expression ?? "").trim();
+  if (!/^[A-Za-z_$][\w$]*$/.test(name2)) return false;
+  const n = escapeRe(name2);
+  const decls = [
+    // function connect() {}   /   async function connect() {}
+    new RegExp(`\\bfunction\\s+${n}\\s*\\(`),
+    // const connect = () => / function / async () =>
+    new RegExp(
+      `\\b(?:const|let|var)\\s+${n}\\s*=\\s*(?:async\\s+)?(?:function\\b|\\(|[A-Za-z_$][\\w$]*\\s*=>)`
+    )
+  ];
+  return sourceLines.some((l) => decls.some((re) => re.test(l)));
+}
 function isFunctionCallbackArgument(arg) {
   if (arg.literal !== null && arg.literal !== void 0) return false;
   const expr = (arg.expression ?? "").trim();
@@ -15415,11 +15483,17 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         }
         if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout" || call.method_name === "setImmediate")) {
           const firstArg = call.arguments.find((a) => a.position === 0);
-          if (firstArg && isFunctionCallbackArgument(firstArg)) {
+          if (firstArg && (isFunctionCallbackArgument(firstArg) || isDeclaredFunctionReference(firstArg, sourceLines))) {
+            continue;
+          }
+        }
+        if (pattern.type === "xss" && (language === "javascript" || language === "typescript") && DOM_ASSIGNMENT_SINK_METHODS.has(call.method_name) && call.arguments.length > 0) {
+          const rhs = call.arguments.find((a) => a.position === 0);
+          if (rhs && isProvablyLiteralExpression(rhs.expression ?? "")) {
             continue;
           }
         }
-        if (pattern.type === "command_injection" && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
+        if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }
         if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {

package/dist/core/extractors/calls.js

@@ -1049,6 +1049,25 @@ function buildResolutionContext(tree, cache) {
             }
         }
     }
+    // cognium-dev#350 — try-with-resources declarations are ALSO local variables.
+    //
+    //   try (Connection c = …; Statement s = c.createStatement()) { s.executeQuery(q); }
+    //
+    // A resource is a `resource` node under `resource_specification`, and it holds
+    // its type and name directly — there is no `variable_declarator` child — so
+    // the loop above never sees it. Without an entry here the receiver type stays
+    // `null`, the class-scoped `Statement.executeQuery` sink cannot match, and the
+    // call degrades to the generic `external_taint_escape` fallback: the sink is
+    // still reported, but as CWE-668 instead of CWE-89. That is the idiomatic JDBC
+    // form and the shape most real Spring code uses.
+    const resourceDecls = getNodesFromCache(tree.rootNode, 'resource', cache);
+    for (const res of resourceDecls) {
+        const typeNode = res.childForFieldName('type');
+        const nameNode = res.childForFieldName('name');
+        if (typeNode && nameNode) {
+            context.localVarTypes.set(getNodeText(nameNode), getNodeText(typeNode));
+        }
+    }
     // Collect imports — map simple class name to FQN
     const imports = getNodesFromCache(tree.rootNode, 'import_declaration', cache);
     for (const imp of imports) {