circle-ir 4.9.27 → 4.9.28

package/dist/core/circle-ir-core.js

@@ -6164,6 +6164,31 @@ function extractCSharpCalls(tree, cache) {
       });
       continue;
     }
+    if (left?.type === "identifier" && asn.parent?.type === "initializer_expression") {
+      const creation = asn.parent.parent;
+      if (creation?.type !== "object_creation_expression") continue;
+      const ctorType = creation.childForFieldName("type");
+      const right2 = asn.childForFieldName("right");
+      if (!ctorType || !right2) continue;
+      const typeName = csharpBareName(ctorType);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: getNodeText(left),
+        receiver: typeName,
+        receiver_type: typeName,
+        receiver_type_fqn: null,
+        arguments: [{
+          position: 0,
+          expression: rhsText2,
+          variable: right2.type === "identifier" ? rhsText2 : null,
+          literal: CSHARP_LITERAL_NODE_TYPES.has(right2.type) ? rhsText2 : null,
+          value: null
+        }],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression") continue;
     const nameNode = left.childForFieldName("name");
     if (!nameNode) continue;
@@ -6173,6 +6198,13 @@ function extractCSharpCalls(tree, cache) {
       const recv = exprNode ? getNodeText(exprNode) : null;
       const recvType = recv ? typeMap.get(recv) : void 0;
       if (recvType !== "DirectorySearcher") continue;
+    } else if (propName === "StatusDescription") {
+      const recv = exprNode ? getNodeText(exprNode) : "";
+      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv)) continue;
+    } else if (propName === "BaseAddress") {
+      const recv = exprNode ? getNodeText(exprNode) : null;
+      const recvType = recv ? typeMap.get(recv) : void 0;
+      if (recvType !== "HttpClient") continue;
     } else if (propName !== "CommandText") {
       continue;
     }
@@ -6195,8 +6227,34 @@ function extractCSharpCalls(tree, cache) {
       in_method: findEnclosingMethod(asn)
     });
   }
+  const casts = getNodesFromCache(tree.rootNode, "cast_expression", cache);
+  for (const cast of casts) {
+    const typeNode = cast.childForFieldName("type");
+    const valueNode = cast.childForFieldName("value");
+    if (!typeNode || !valueNode) continue;
+    const typeName = csharpBareName(typeNode);
+    if (!CSHARP_RAW_MARKUP_CAST_TYPES.has(typeName)) continue;
+    const valueText = getNodeText(valueNode);
+    calls.push({
+      method_name: typeName,
+      receiver: null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: [{
+        position: 0,
+        expression: valueText,
+        variable: valueNode.type === "identifier" ? valueText : null,
+        literal: CSHARP_LITERAL_NODE_TYPES.has(valueNode.type) ? valueText : null,
+        value: null
+      }],
+      location: { line: cast.startPosition.row + 1, column: cast.startPosition.column },
+      in_method: findEnclosingMethod(cast),
+      is_constructor: true
+    });
+  }
   return calls;
 }
+var CSHARP_RAW_MARKUP_CAST_TYPES = /* @__PURE__ */ new Set(["MarkupString"]);
 function extractCSharpArguments(argsNode) {
   const args2 = [];
   let position = 0;
@@ -6216,12 +6274,22 @@ function extractCSharpArguments(argsNode) {
       position: position++,
       expression: text,
       variable: expr?.type === "identifier" ? text : null,
-      literal: expr?.type === "string_literal" ? text : null,
+      literal: expr && CSHARP_LITERAL_NODE_TYPES.has(expr.type) ? text : null,
       value: null
     });
   }
   return args2;
 }
+var CSHARP_LITERAL_NODE_TYPES = /* @__PURE__ */ new Set([
+  "string_literal",
+  "verbatim_string_literal",
+  "raw_string_literal",
+  "character_literal",
+  "integer_literal",
+  "real_literal",
+  "boolean_literal",
+  "null_literal"
+]);
 function extractJavaScriptCalls(tree, cache) {
   const calls = [];
   const context = buildJSResolutionContext(tree, cache);
@@ -13245,9 +13313,14 @@ var DEFAULT_SINKS = [
   { method: "deserialize", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "from_str", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
   { method: "from_str", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
-  // Generic deserialization patterns
-  { method: "from_str", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
-  { method: "from_slice", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
+  // #294/#484: no classless `from_str` / `from_slice` deserialization sink.
+  // Those rows matched EVERY `T::from_str` / `from_slice` — `u32::from_str`,
+  // `Url::from_str`, `PublicKey::from_slice` — i.e. ordinary `FromStr` / byte
+  // parsing, which cannot instantiate an attacker-chosen type. Removing them
+  // was previously blocked because the class-scoped rows below could not match
+  // the IMPORTED call form (`use serde_json::from_str; from_str(&body)`); the
+  // `::` path-separator fix in taint-matcher.ts makes them match, so the
+  // classless rows are no longer load-bearing.
   // Rust XSS (actix-web, rocket, axum response body)
   { method: "body", class: "HttpResponseBuilder", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "body", class: "HttpResponse", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -13653,6 +13726,10 @@ var DEFAULT_SINKS = [
   // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
   // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #503 (part 1): `Response.StatusDescription = "Bad " + data` writes
+  // attacker text into the HTTP status line (CWE-81). Surfaced by the
+  // property-assignment synthesiser in the C# extractor, receiver-gated there.
+  { method: "StatusDescription", class: "Response", type: "xss", cwe: "CWE-81", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   // `return Content(html, "text/html")` on a controller writes arg 0 to the
   // response body unescaped (cognium-dev#275). Taint-gated on arg 0; the common
   // `Content(constantString)` and the JSON/plain-text content types are
@@ -13667,6 +13744,12 @@ var DEFAULT_SINKS = [
   // filter is the constructor argument.
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  // #336: a tainted `HttpClient.BaseAddress` gives the attacker the scheme,
+  // host and port of every RELATIVE request made on that client, so the
+  // request arguments can all be constant and the destination still be
+  // attacker-chosen. Surfaced by the property-assignment synthesiser, which
+  // class-gates it to a resolved `HttpClient`.
+  { method: "BaseAddress", class: "HttpClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
   // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
   // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /
@@ -16011,8 +16094,9 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       return false;
     } else if (!call.receiver && !call.receiver_type) {
       const target = call.resolution?.target;
+      const normalisedTarget = language === "rust" ? target?.replace(/::/g, ".") : target;
       const expectedTail = `${pattern.class}.${pattern.method}`;
-      if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {
+      if (normalisedTarget && (normalisedTarget === expectedTail || normalisedTarget.endsWith("." + expectedTail))) {
       } else {
         return false;
       }

package/dist/core/extractors/calls.js

@@ -320,6 +320,44 @@ function extractCSharpCalls(tree, cache) {
             });
             continue;
         }
+        // cognium-dev#336 — inside an OBJECT INITIALIZER the assignment's left side
+        // is a bare identifier, not a member access:
+        //
+        //   new HttpClient { BaseAddress = new Uri(input) }
+        //     object_creation_expression
+        //       initializer_expression
+        //         assignment_expression   left = identifier 'BaseAddress'
+        //
+        // so the member-access branch below skipped it entirely. Surface it with
+        // the CONSTRUCTED TYPE as the receiver, which is what the class-scoped
+        // registry row needs to match.
+        if (left?.type === 'identifier' && asn.parent?.type === 'initializer_expression') {
+            const creation = asn.parent.parent;
+            if (creation?.type !== 'object_creation_expression')
+                continue;
+            const ctorType = creation.childForFieldName('type');
+            const right = asn.childForFieldName('right');
+            if (!ctorType || !right)
+                continue;
+            const typeName = csharpBareName(ctorType);
+            const rhsText = getNodeText(right);
+            calls.push({
+                method_name: getNodeText(left),
+                receiver: typeName,
+                receiver_type: typeName,
+                receiver_type_fqn: null,
+                arguments: [{
+                        position: 0,
+                        expression: rhsText,
+                        variable: right.type === 'identifier' ? rhsText : null,
+                        literal: CSHARP_LITERAL_NODE_TYPES.has(right.type) ? rhsText : null,
+                        value: null,
+                    }],
+                location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+                in_method: findEnclosingMethod(asn),
+            });
+            continue;
+        }
         if (left?.type !== 'member_access_expression')
             continue;
         const nameNode = left.childForFieldName('name');
@@ -337,6 +375,25 @@ function extractCSharpCalls(tree, cache) {
             if (recvType !== 'DirectorySearcher')
                 continue;
         }
+        else if (propName === 'StatusDescription') {
+            // cognium-dev#503 (part 1) — `Response.StatusDescription = "Bad " + data`
+            // writes attacker text into the status line (CWE-81). Receiver-gated to
+            // a Response-shaped name so an unrelated `.StatusDescription =` on some
+            // other type is not surfaced.
+            const recv = exprNode ? getNodeText(exprNode) : '';
+            if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv))
+                continue;
+        }
+        else if (propName === 'BaseAddress') {
+            // cognium-dev#336 — `new HttpClient { BaseAddress = new Uri(input) }`
+            // hands the attacker the scheme, host and port of every relative request
+            // on that client (CWE-918). Class-gated to a resolved HttpClient so an
+            // unrelated `.BaseAddress =` is not surfaced.
+            const recv = exprNode ? getNodeText(exprNode) : null;
+            const recvType = recv ? typeMap.get(recv) : undefined;
+            if (recvType !== 'HttpClient')
+                continue;
+        }
         else if (propName !== 'CommandText') {
             continue;
         }
@@ -360,8 +417,51 @@ function extractCSharpCalls(tree, cache) {
             in_method: findEnclosingMethod(asn),
         });
     }
+    // cognium-dev#340 — a C# CAST is not a call node, so `(MarkupString)html`
+    // could not be reached by any registry row while `new MarkupString(html)`
+    // could. The two are interchangeable in Blazor and the cast is the more
+    // common of the pair, since `@((MarkupString)html)` in a `.razor` component
+    // compiles from it. Emitted as a constructor-shaped call so the EXISTING
+    // `{ method: 'MarkupString', class: 'constructor' }` row matches, which keeps
+    // the taint engine in charge: a constant operand carries no taint and so
+    // still reports nothing.
+    //
+    // Restricted to an allowlist rather than surfacing every cast: `(string)x`,
+    // `(int)x` and friends are ubiquitous and must not become synthetic calls.
+    const casts = getNodesFromCache(tree.rootNode, 'cast_expression', cache);
+    for (const cast of casts) {
+        const typeNode = cast.childForFieldName('type');
+        const valueNode = cast.childForFieldName('value');
+        if (!typeNode || !valueNode)
+            continue;
+        const typeName = csharpBareName(typeNode);
+        if (!CSHARP_RAW_MARKUP_CAST_TYPES.has(typeName))
+            continue;
+        const valueText = getNodeText(valueNode);
+        calls.push({
+            method_name: typeName,
+            receiver: null,
+            receiver_type: null,
+            receiver_type_fqn: null,
+            arguments: [{
+                    position: 0,
+                    expression: valueText,
+                    variable: valueNode.type === 'identifier' ? valueText : null,
+                    literal: CSHARP_LITERAL_NODE_TYPES.has(valueNode.type) ? valueText : null,
+                    value: null,
+                }],
+            location: { line: cast.startPosition.row + 1, column: cast.startPosition.column },
+            in_method: findEnclosingMethod(cast),
+            is_constructor: true,
+        });
+    }
     return calls;
 }
+/**
+ * Cast target types whose cast renders its operand as raw markup, so the cast
+ * is exactly as dangerous as the constructor. Deliberately tiny — see #340.
+ */
+const CSHARP_RAW_MARKUP_CAST_TYPES = new Set(['MarkupString']);
 /** Extract args from a C# `argument_list` (each child is an `argument` wrapper). */
 function extractCSharpArguments(argsNode) {
     const args = [];
@@ -384,12 +484,38 @@ function extractCSharpArguments(argsNode) {
             position: position++,
             expression: text,
             variable: expr?.type === 'identifier' ? text : null,
-            literal: expr?.type === 'string_literal' ? text : null,
+            literal: expr && CSHARP_LITERAL_NODE_TYPES.has(expr.type) ? text : null,
             value: null,
         });
     }
     return args;
 }
+/**
+ * C# compile-time literal node types — cognium-dev#502.
+ *
+ * Only `string_literal` was recognised, so `null`, `true`, `42` and `'c'` all
+ * came back with `literal: null` and were indistinguishable from a variable.
+ * A sink taint-gated on that argument therefore registered: the measured case
+ * is Juliet's `new SqlCommand(null, connection)` DB-setup helper, reported as
+ * CWE-89 with a SQL argument that is literally `null` — 1,523 signatures over
+ * the 10 scored CWE families once #502 gave those files a source.
+ *
+ * A compile-time constant cannot carry taint, so registering a sink on one is
+ * always wrong; widening this removes false positives only.
+ *
+ * `interpolated_string_expression` is deliberately ABSENT: `$"SELECT {input}"`
+ * interpolates and is the genuine C# injection shape.
+ */
+const CSHARP_LITERAL_NODE_TYPES = new Set([
+    'string_literal',
+    'verbatim_string_literal',
+    'raw_string_literal',
+    'character_literal',
+    'integer_literal',
+    'real_literal',
+    'boolean_literal',
+    'null_literal',
+]);
 function extractJavaScriptCalls(tree, cache) {
     const calls = [];
     // Build JS resolution context