circle-ir 4.9.27 → 4.9.29

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAwzB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA8mEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAy0B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAmpEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -137,6 +137,23 @@ export const DEFAULT_SOURCES = [
     { method: 'next', class: 'Scanner', type: 'io_input', severity: 'high', return_tainted: true },
     { method: 'nextInt', class: 'Scanner', type: 'io_input', severity: 'high', return_tainted: true },
     // Database result sources
+    // C# I/O, network and database reads (cognium-dev#502). Mirrors the Java
+    // rows above one-for-one, including the severity split: console/file I/O is
+    // `io_input` at high, a database row read is `db_input` at medium. There is
+    // no separate confidence tier — `type` + `severity` IS the tier, exactly as
+    // for `BufferedReader.readLine` vs `ResultSet.getString`.
+    { method: 'ReadLine', class: 'StreamReader', type: 'io_input', severity: 'high', return_tainted: true, languages: ['csharp'] },
+    { method: 'ReadLineAsync', class: 'StreamReader', type: 'io_input', severity: 'high', return_tainted: true, languages: ['csharp'] },
+    { method: 'ReadToEnd', class: 'StreamReader', type: 'io_input', severity: 'high', return_tainted: true, languages: ['csharp'] },
+    { method: 'ReadToEndAsync', class: 'StreamReader', type: 'io_input', severity: 'high', return_tainted: true, languages: ['csharp'] },
+    // Socket and HTTP-client reads. `GetStream` / `AcceptTcpClient` /
+    // `OpenRead` return the channel; the read off it is covered by the
+    // StreamReader rows above, and seeding the channel too lets a flow form when
+    // the read is inlined.
+    { method: 'GetStream', class: 'TcpClient', type: 'network_input', severity: 'high', return_tainted: true, languages: ['csharp'] },
+    { method: 'AcceptTcpClient', class: 'TcpListener', type: 'network_input', severity: 'high', return_tainted: true, languages: ['csharp'] },
+    { method: 'OpenRead', class: 'WebClient', type: 'network_input', severity: 'high', return_tainted: true, languages: ['csharp'] },
+    { method: 'DownloadString', class: 'WebClient', type: 'network_input', severity: 'high', return_tainted: true, languages: ['csharp'] },
     { method: 'getString', class: 'ResultSet', type: 'db_input', severity: 'medium', return_tainted: true },
     { method: 'getObject', class: 'ResultSet', type: 'db_input', severity: 'medium', return_tainted: true },
     { method: 'getInt', class: 'ResultSet', type: 'db_input', severity: 'medium', return_tainted: true },
@@ -2422,9 +2439,14 @@ export const DEFAULT_SINKS = [
     { method: 'deserialize', class: 'bincode', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
     { method: 'from_str', class: 'toml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
     { method: 'from_str', class: 'ron', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
-    // Generic deserialization patterns
-    { method: 'from_str', type: 'deserialization', cwe: 'CWE-502', severity: 'medium', arg_positions: [0] },
-    { method: 'from_slice', type: 'deserialization', cwe: 'CWE-502', severity: 'medium', arg_positions: [0] },
+    // #294/#484: no classless `from_str` / `from_slice` deserialization sink.
+    // Those rows matched EVERY `T::from_str` / `from_slice` — `u32::from_str`,
+    // `Url::from_str`, `PublicKey::from_slice` — i.e. ordinary `FromStr` / byte
+    // parsing, which cannot instantiate an attacker-chosen type. Removing them
+    // was previously blocked because the class-scoped rows below could not match
+    // the IMPORTED call form (`use serde_json::from_str; from_str(&body)`); the
+    // `::` path-separator fix in taint-matcher.ts makes them match, so the
+    // classless rows are no longer load-bearing.
     // Rust XSS (actix-web, rocket, axum response body)
     { method: 'body', class: 'HttpResponseBuilder', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
     { method: 'body', class: 'HttpResponse', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0] },
@@ -2740,8 +2762,12 @@ export const DEFAULT_SINKS = [
     { method: 'OpenRead', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'OpenWrite', class: 'File', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'FileStream', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
-    { method: 'StreamReader', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
-    { method: 'StreamWriter', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // #502: the `(Stream)` overload takes no path — `new StreamReader(tcp.GetStream())`
+    // is not CWE-22. The `(string path)` overload still matches.
+    { method: 'StreamReader', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], safe_if_stream_arg_at: 0, languages: ['csharp'] },
+    // #502: the `(Stream)` overload takes no path — `new StreamWriter(tcp.GetStream())`
+    // is not CWE-22. The `(string path)` overload still matches.
+    { method: 'StreamWriter', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], safe_if_stream_arg_at: 0, languages: ['csharp'] },
     // Remaining System.IO.File path APIs — class-scoped so they don't collide
     // with unrelated methods. Copy/Move take a source AND destination path (both
     // attacker-controllable → read-anywhere / write-anywhere), hence [0, 1].
@@ -2785,6 +2811,23 @@ export const DEFAULT_SINKS = [
     // `new RestClient(userUrl)` points every later request at attacker-controlled
     // infrastructure. Ctor arg 0, taint-gated.
     { method: 'RestClient', class: 'constructor', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // C# code injection — CodeDOM runtime compilation (CWE-94), cognium-dev#503
+    // part 2. `provider.CompileAssemblyFromSource(parameters, source)` compiles
+    // and can then execute attacker-supplied C#, so the source argument is the
+    // injection point. The signature is
+    // `CompileAssemblyFromSource(CompilerParameters, params string[] sources)`,
+    // so the sources begin at position 1 — position 0 is the options object.
+    //
+    // These rows are only useful together with the #530 StringBuilder
+    // propagation fix: the Juliet CWE-94 corpus accumulates the compiled source
+    // through `sb.Append(...)` and reads it back with `ToString()`, so before
+    // that fix the sink registered but no taint ever reached it.
+    { method: 'CompileAssemblyFromSource', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [1, 2], languages: ['csharp'] },
+    { method: 'CompileAssemblyFromSourceBatch', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [1, 2], languages: ['csharp'] },
+    // Roslyn's equivalent pair. `ParseText` turns text into a syntax tree and
+    // `Create` compiles it; either is the point where attacker text becomes code.
+    { method: 'ParseText', class: 'CSharpSyntaxTree', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'ParseText', class: 'SyntaxFactory', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     // C# code injection — dynamic script/assembly loading (CWE-94).
     { method: 'EvaluateAsync', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     { method: 'RunAsync', class: 'CSharpScript', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
@@ -2829,6 +2872,10 @@ export const DEFAULT_SINKS = [
     // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
     // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
     { method: 'MarkupString', class: 'constructor', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // #503 (part 1): `Response.StatusDescription = "Bad " + data` writes
+    // attacker text into the HTTP status line (CWE-81). Surfaced by the
+    // property-assignment synthesiser in the C# extractor, receiver-gated there.
+    { method: 'StatusDescription', class: 'Response', type: 'xss', cwe: 'CWE-81', severity: 'medium', arg_positions: [0], languages: ['csharp'] },
     // `return Content(html, "text/html")` on a controller writes arg 0 to the
     // response body unescaped (cognium-dev#275). Taint-gated on arg 0; the common
     // `Content(constantString)` and the JSON/plain-text content types are
@@ -2843,6 +2890,12 @@ export const DEFAULT_SINKS = [
     // filter is the constructor argument.
     { method: 'DirectorySearcher', type: 'ldap_injection', cwe: 'CWE-90', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'DirectoryEntry', type: 'ldap_injection', cwe: 'CWE-90', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // #336: a tainted `HttpClient.BaseAddress` gives the attacker the scheme,
+    // host and port of every RELATIVE request made on that client, so the
+    // request arguments can all be constant and the destination still be
+    // attacker-chosen. Surfaced by the property-assignment synthesiser, which
+    // class-gates it to a resolved `HttpClient`.
+    { method: 'BaseAddress', class: 'HttpClient', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // C# open redirect — ASP.NET MVC / Minimal API redirect helpers (CWE-601,
     // cognium-dev#273/#275). Classless: `return Redirect(url)` on a controller is
     // an implicit-`this` call (no receiver), and `Results.Redirect(url)` /