circle-ir 4.9.26 → 4.9.28

package/dist/analysis/passes/language-sources-pass.js

@@ -506,7 +506,7 @@ export class LanguageSourcesPass {
         // guard (the canonicalize-then-contain path-traversal defence). Java and
         // JS/TS already credit their equivalents above; C# was the gap.
         if (language === 'csharp') {
-            additionalSanitizers.push(...findCSharpFullPathStartsWithGuardSanitizers(code));
+            additionalSanitizers.push(...findCSharpFullPathStartsWithGuardSanitizers(code), ...findCSharpEarlyReturnGuardSanitizers(code, language));
         }
         // -- Java: Sprint 73 (#216 Pattern A) — Jackson readValue / Gson
         // fromJson recognized as ETE terminator (does not affect
@@ -1542,7 +1542,9 @@ function findCSharpRequestSources(sourceCode, language) {
     // of defect as #350 (Java try-with-resources): a resource-declaration syntax
     // the scanner never looked at.
     const assignRe = /^\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
-    const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
+    // `Request.*` is the inherited controller member. A parameter typed
+    // `HttpRequest` / `HttpRequestBase` is the same surface under whatever
+    // name the method uses (`req` in Juliet) — cognium-dev#501.
     // Console/stdin reads bind their LHS too (dominant source shape in the NIST
     // Juliet C# corpus). Like `Request.*`, a bare `Console.ReadLine()` returns a
     // value that nothing else seeds a variable for, so bind it as `io_input`.
@@ -1562,15 +1564,24 @@ function findCSharpRequestSources(sourceCode, language) {
     // `\s+` after the type name keeps `IFormFileCollection files` from matching.
     const formFileParams = new Set();
     const formFileDeclRe = /\bIFormFile\s+([A-Za-z_]\w*)/g;
+    // Inherited `Request` plus any local declared `HttpRequest` / `HttpRequestBase`
+    // (nullable `HttpRequest?` included). `HttpRequestMessage` does not match:
+    // the type token must be followed by whitespace, not more identifier text.
+    const httpRequestReceivers = new Set(['Request']);
+    const httpRequestDeclRe = /\b(?:HttpRequest|HttpRequestBase)\??\s+([A-Za-z_]\w*)/g;
     for (const line of lines) {
-        const re = new RegExp(formFileDeclRe.source, 'g');
+        const formRe = new RegExp(formFileDeclRe.source, 'g');
         let d;
-        while ((d = re.exec(line)) !== null)
+        while ((d = formRe.exec(line)) !== null)
             formFileParams.add(d[1]);
+        const reqRe = new RegExp(httpRequestDeclRe.source, 'g');
+        while ((d = reqRe.exec(line)) !== null)
+            httpRequestReceivers.add(d[1]);
     }
     const formFileReadRe = formFileParams.size > 0
         ? new RegExp(`\\b(?:${[...formFileParams].join('|')})\\s*\\.\\s*(?:FileName|ContentType)\\b`)
         : null;
+    const requestReadRe = new RegExp(`\\b(?:${[...httpRequestReceivers].join('|')})\\s*\\.\\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\\b`);
     const classify = (text) => requestReadRe.test(text)
         ? 'http_param'
         : formFileReadRe?.test(text)
@@ -1620,10 +1631,44 @@ function findCSharpRequestSources(sourceCode, language) {
     };
     const exprStmtCallRe = /^\s*(?:await\s+)?[A-Za-z_][\w.]*(?:<[^>]*>)?\s*\(.*\)\s*;\s*$/;
     const nonCallKeywordRe = /^\s*(?:await\s+)?(?:if|while|for|foreach|switch|using|lock|return|throw|catch|when|nameof|typeof|sizeof|default)\b/;
+    // cognium-dev#504 — an assignment nested in a same-line block is not the
+    // whole line, so `assignRe` misses it:
+    //   try { data = Console.ReadLine(); } catch (Exception) { }   // was NOT
+    //   data = Console.ReadLine();                                  // bound
+    // `(?!=)` keeps `==` from looking like an assignment. A full-line comment
+    // is skipped; the rest of this scanner already ignores comment text only
+    // when it is not the line's code.
+    const embeddedAssignRe = /(?:^|[{;])\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*([^;{}]+)/;
     for (let i = 0; i < lines.length; i++) {
         const m = assignRe.exec(lines[i]);
         if (!m) {
             const stmt = lines[i];
+            if (stmt.includes('{') && !/^\s*(?:\/\/|\/\*|\*)/.test(stmt)) {
+                const emb = new RegExp(embeddedAssignRe.source, 'g');
+                let em;
+                let seeded = false;
+                while ((em = emb.exec(stmt)) !== null) {
+                    const varName = em[1];
+                    const rhs = em[2];
+                    const type = classify(rhs);
+                    if (!type)
+                        continue;
+                    const lineNumber = i + 1;
+                    if (sources.some(s => s.line === lineNumber && s.variable === varName))
+                        continue;
+                    sources.push({
+                        type,
+                        location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                        severity: 'high',
+                        line: lineNumber,
+                        confidence: 1.0,
+                        variable: varName,
+                    });
+                    seeded = true;
+                }
+                if (seeded)
+                    continue;
+            }
             if (!exprStmtCallRe.test(stmt) || nonCallKeywordRe.test(stmt))
                 continue;
             const hit = inlineRead(stmt);
@@ -5596,6 +5641,113 @@ function guardRejects(lines, i, terminatorRe, window) {
  * form `if (x.StartsWith(root)) { … }` still reports, and a test pins that so
  * the gap stays visible rather than silently assumed.
  */
+/**
+ * cognium-dev#272 — a validating predicate followed by an EARLY RETURN is a
+ * guard, and the value reaching the sink afterwards is already validated.
+ *
+ *   if (Array.IndexOf(Allowed, u.Host) < 0) return;     // host allow-list
+ *   await client.GetStringAsync(input);                 // reported ssrf
+ *
+ *   if (!input.All(char.IsLetterOrDigit)) return;       // char-class check
+ *   doc.SelectSingleNode("/a[@b='" + input + "']");     // reported xpath
+ *
+ * Both safe mirrors are clean of their *family* finding after #272's earlier
+ * fixes, and both still emit a finding because the guard itself is not
+ * credited. The shape is shared with #286-B and with the Java `Set.contains`
+ * guard in #293, so the recogniser is written around the PREDICATE rather than
+ * around any one sink family.
+ *
+ * Deliberately limited to predicates that are self-evidently validating:
+ * allow-list membership and character-class validation. A user-defined
+ * boolean helper (`if (!IsAllowed(input)) return;`, #286-B) is NOT credited
+ * here — crediting an arbitrary predicate by name would silence a real flow
+ * whenever the helper does not actually validate, which is a false negative no
+ * test would catch. That half needs its own evidence.
+ *
+ * Only the REJECTING direction counts, via `guardRejects`: a guard whose body
+ * falls through has not stopped anything.
+ */
+function findCSharpEarlyReturnGuardSanitizers(code, language) {
+    if (language !== 'csharp')
+        return [];
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const terminatorRe = /\b(throw|return)\b/;
+    // Allow-list membership, rejecting form:
+    //   if (Array.IndexOf(Allowed, x) < 0) return;
+    //   if (!Allowed.Contains(x)) return;
+    const allowlistRes = [
+        /\bif\s*\(\s*Array\s*\.\s*IndexOf\s*\([^,]+,\s*([A-Za-z_][\w.]*)\s*\)\s*<\s*0\s*\)/,
+        /\bif\s*\(\s*!\s*[A-Za-z_][\w.]*\s*\.\s*Contains\s*\(\s*([A-Za-z_][\w.]*)\s*\)\s*\)/,
+    ];
+    // Character-class validation, rejecting form:
+    //   if (!input.All(char.IsLetterOrDigit)) return;
+    const charClassRe = /\bif\s*\(\s*!\s*([A-Za-z_][\w.]*)\s*\.\s*All\s*\(\s*char\s*\.\s*Is[A-Za-z]+\s*\)\s*\)/;
+    for (let i = 0; i < lines.length; i++) {
+        let guardedExpr = null;
+        for (const re of allowlistRes) {
+            const m = re.exec(lines[i]);
+            if (m) {
+                guardedExpr = m[1];
+                break;
+            }
+        }
+        if (!guardedExpr) {
+            const m = charClassRe.exec(lines[i]);
+            if (m)
+                guardedExpr = m[1];
+        }
+        if (!guardedExpr)
+            continue;
+        if (!guardRejects(lines, i, terminatorRe, 6))
+            continue;
+        // The guarded expression may be a derivation of the tainted value
+        // (`u.Host` guards `u`, and `u` came from `input`), so credit the root
+        // identifier as well as the full expression.
+        const root = guardedExpr.split('.')[0];
+        const guarded = new Set([guardedExpr, root]);
+        const assignRe = /^\s*(?:(?:var|string)\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+        // Walk BACKWARD first: the guard often validates a DERIVATION of the
+        // tainted value while the sink uses the original.
+        //
+        //   var u = new Uri(input);
+        //   if (Array.IndexOf(Allowed, u.Host) < 0) return;   // guards u.Host
+        //   await client.GetStringAsync(input);               // uses input
+        //
+        // Allow-listing the host of the URI built from `input` constrains where
+        // `input` can point, so the original is guarded too. Bounded to the
+        // identifiers that actually fed the guarded root, transitively.
+        for (let b = i - 1; b >= 0; b--) {
+            const a = assignRe.exec(lines[b]);
+            if (!a || !guarded.has(a[1]))
+                continue;
+            for (const id of a[2].match(/[A-Za-z_]\w*/g) ?? [])
+                guarded.add(id);
+        }
+        // Anything assigned FROM a guarded value downstream is guarded too.
+        const mentions = (t) => {
+            for (const n of guarded)
+                if (new RegExp(`\\b${n.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`).test(t))
+                    return true;
+            return false;
+        };
+        for (let l = i + 1; l < lines.length; l++) {
+            const a = assignRe.exec(lines[l]);
+            if (a && mentions(a[2]))
+                guarded.add(a[1]);
+            if (mentions(lines[l])) {
+                sanitizers.push({
+                    type: 'csharp_early_return_guard',
+                    method: 'guard',
+                    line: l + 1,
+                    sanitizes: ['ssrf', 'xpath_injection', 'ldap_injection', 'path_traversal',
+                        'command_injection', 'sql_injection', 'external_taint_escape'],
+                });
+            }
+        }
+    }
+    return sanitizers;
+}
 function findCSharpFullPathStartsWithGuardSanitizers(code) {
     const sanitizers = [];
     const lines = code.split('\n');