circle-ir 4.9.27 → 4.9.29

package/dist/analysis/passes/language-sources-pass.js

@@ -506,7 +506,7 @@ export class LanguageSourcesPass {
         // guard (the canonicalize-then-contain path-traversal defence). Java and
         // JS/TS already credit their equivalents above; C# was the gap.
         if (language === 'csharp') {
-            additionalSanitizers.push(...findCSharpFullPathStartsWithGuardSanitizers(code));
+            additionalSanitizers.push(...findCSharpFullPathStartsWithGuardSanitizers(code), ...findCSharpEarlyReturnGuardSanitizers(code, language));
         }
         // -- Java: Sprint 73 (#216 Pattern A) — Jackson readValue / Gson
         // fromJson recognized as ETE terminator (does not affect
@@ -1569,6 +1569,19 @@ function findCSharpRequestSources(sourceCode, language) {
     // the type token must be followed by whitespace, not more identifier text.
     const httpRequestReceivers = new Set(['Request']);
     const httpRequestDeclRe = /\b(?:HttpRequest|HttpRequestBase)\??\s+([A-Za-z_]\w*)/g;
+    // cognium-dev#502 — I/O and database reads, mirroring Java's
+    // `BufferedReader.readLine` (io_input) and `ResultSet.getString` (db_input).
+    // Declared-type scoped for the same reason #501 needed it: the method names
+    // are generic (`ReadLine`, `GetString`), so matching them on any receiver
+    // would fire on unrelated types. A registry row cannot do this — the
+    // receiver's type is not resolved for a `SqlDataReader rdr` parameter — and
+    // binding here also gives the LHS a `variable`, which a bare
+    // `return_tainted` row does not, so the flow can form when the read sits
+    // inside a nested `using` / `try` block (the Juliet shape).
+    const streamReaderVars = new Set();
+    const streamReaderDeclRe = /\b(?:StreamReader|TextReader|BinaryReader)\??\s+([A-Za-z_]\w*)/g;
+    const dbReaderVars = new Set();
+    const dbReaderDeclRe = /\b(?:SqlDataReader|DbDataReader|IDataReader|OdbcDataReader|OleDbDataReader)\??\s+([A-Za-z_]\w*)/g;
     for (const line of lines) {
         const formRe = new RegExp(formFileDeclRe.source, 'g');
         let d;
@@ -1577,7 +1590,19 @@ function findCSharpRequestSources(sourceCode, language) {
         const reqRe = new RegExp(httpRequestDeclRe.source, 'g');
         while ((d = reqRe.exec(line)) !== null)
             httpRequestReceivers.add(d[1]);
-    }
+        const srRe = new RegExp(streamReaderDeclRe.source, 'g');
+        while ((d = srRe.exec(line)) !== null)
+            streamReaderVars.add(d[1]);
+        const dbRe = new RegExp(dbReaderDeclRe.source, 'g');
+        while ((d = dbRe.exec(line)) !== null)
+            dbReaderVars.add(d[1]);
+    }
+    const streamReadRe = streamReaderVars.size > 0
+        ? new RegExp(`\\b(?:${[...streamReaderVars].join('|')})\\s*\\.\\s*(?:ReadLine|ReadToEnd|ReadLineAsync|ReadToEndAsync|ReadBlock|Read)\\s*\\(`)
+        : null;
+    const dbReadRe = dbReaderVars.size > 0
+        ? new RegExp(`\\b(?:${[...dbReaderVars].join('|')})\\s*\\.\\s*(?:GetString|GetValue|GetInt32|GetInt64|GetDecimal|GetDateTime|GetFieldValue|\\[)`)
+        : null;
     const formFileReadRe = formFileParams.size > 0
         ? new RegExp(`\\b(?:${[...formFileParams].join('|')})\\s*\\.\\s*(?:FileName|ContentType)\\b`)
         : null;
@@ -1590,7 +1615,11 @@ function findCSharpRequestSources(sourceCode, language) {
                 ? 'io_input'
                 : envReadRe.test(text)
                     ? 'env_input'
-                    : null;
+                    : streamReadRe?.test(text)
+                        ? 'io_input'
+                        : dbReadRe?.test(text)
+                            ? 'db_input'
+                            : null;
     // cognium-dev#339 — a bare expression statement reads the request INLINE in
     // the call, with no local to bind:
     //
@@ -1613,6 +1642,8 @@ function findCSharpRequestSources(sourceCode, language) {
         [formFileReadRe, 'http_param'],
         [consoleReadRe, 'io_input'],
         [envReadRe, 'env_input'],
+        [streamReadRe, 'io_input'],
+        [dbReadRe, 'db_input'],
     ];
     const inlineRead = (text) => {
         const argsStart = text.indexOf('(');
@@ -1641,7 +1672,20 @@ function findCSharpRequestSources(sourceCode, language) {
     const embeddedAssignRe = /(?:^|[{;])\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*([^;{}]+)/;
     for (let i = 0; i < lines.length; i++) {
         const m = assignRe.exec(lines[i]);
-        if (!m) {
+        // cognium-dev#502 — `assignRe` is anchored and greedy, so on a one-line
+        // block header that also contains the real assignment
+        //
+        //   using (StreamReader sr = new StreamReader(tcp.GetStream())) { data = sr.ReadLine(); }
+        //
+        // it captures `sr` with EVERYTHING after `=` as the right-hand side. That
+        // RHS contains `sr.ReadLine()`, so the line was classified as a read and
+        // bound to `sr` — the reader, not `data`. The embedded-assignment path
+        // handles exactly this shape and finds both `sr` and `data`, but it only
+        // ran when `assignRe` failed to match at all. Prefer it whenever the
+        // captured RHS crosses a block boundary. (#504 was the mirror of this:
+        // there `assignRe` did not match and the inner assignment was lost.)
+        const rhsCrossesBlock = m !== null && m[2].includes('{');
+        if (!m || rhsCrossesBlock) {
             const stmt = lines[i];
             if (stmt.includes('{') && !/^\s*(?:\/\/|\/\*|\*)/.test(stmt)) {
                 const emb = new RegExp(embeddedAssignRe.source, 'g');
@@ -1659,7 +1703,8 @@ function findCSharpRequestSources(sourceCode, language) {
                     sources.push({
                         type,
                         location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
-                        severity: 'high',
+                        // #502 — Java parity: a database row read is medium, I/O is high.
+                        severity: type === 'db_input' ? 'medium' : 'high',
                         line: lineNumber,
                         confidence: 1.0,
                         variable: varName,
@@ -1693,7 +1738,7 @@ function findCSharpRequestSources(sourceCode, language) {
             sources.push({
                 type,
                 location: `${read} in ${code.substring(0, 50)}${code.length > 50 ? '...' : ''}`,
-                severity: 'high',
+                severity: type === 'db_input' ? 'medium' : 'high',
                 line: lineNumber,
                 confidence: 1.0,
                 variable: '<inline>',
@@ -1711,7 +1756,8 @@ function findCSharpRequestSources(sourceCode, language) {
         sources.push({
             type,
             location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
-            severity: 'high',
+            // #502 — Java parity: a database row read is medium, I/O is high.
+            severity: type === 'db_input' ? 'medium' : 'high',
             line: lineNumber,
             confidence: 1.0,
             variable: varName,
@@ -1980,7 +2026,8 @@ function findPythonAssignmentSources(sourceCode, language) {
                     sources.push({
                         type,
                         location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
-                        severity: 'high',
+                        // #502 — Java parity: a database row read is medium, I/O is high.
+                        severity: type === 'db_input' ? 'medium' : 'high',
                         line: lineNumber,
                         confidence: 0.95,
                         variable: varName,
@@ -5641,6 +5688,113 @@ function guardRejects(lines, i, terminatorRe, window) {
  * form `if (x.StartsWith(root)) { … }` still reports, and a test pins that so
  * the gap stays visible rather than silently assumed.
  */
+/**
+ * cognium-dev#272 — a validating predicate followed by an EARLY RETURN is a
+ * guard, and the value reaching the sink afterwards is already validated.
+ *
+ *   if (Array.IndexOf(Allowed, u.Host) < 0) return;     // host allow-list
+ *   await client.GetStringAsync(input);                 // reported ssrf
+ *
+ *   if (!input.All(char.IsLetterOrDigit)) return;       // char-class check
+ *   doc.SelectSingleNode("/a[@b='" + input + "']");     // reported xpath
+ *
+ * Both safe mirrors are clean of their *family* finding after #272's earlier
+ * fixes, and both still emit a finding because the guard itself is not
+ * credited. The shape is shared with #286-B and with the Java `Set.contains`
+ * guard in #293, so the recogniser is written around the PREDICATE rather than
+ * around any one sink family.
+ *
+ * Deliberately limited to predicates that are self-evidently validating:
+ * allow-list membership and character-class validation. A user-defined
+ * boolean helper (`if (!IsAllowed(input)) return;`, #286-B) is NOT credited
+ * here — crediting an arbitrary predicate by name would silence a real flow
+ * whenever the helper does not actually validate, which is a false negative no
+ * test would catch. That half needs its own evidence.
+ *
+ * Only the REJECTING direction counts, via `guardRejects`: a guard whose body
+ * falls through has not stopped anything.
+ */
+function findCSharpEarlyReturnGuardSanitizers(code, language) {
+    if (language !== 'csharp')
+        return [];
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const terminatorRe = /\b(throw|return)\b/;
+    // Allow-list membership, rejecting form:
+    //   if (Array.IndexOf(Allowed, x) < 0) return;
+    //   if (!Allowed.Contains(x)) return;
+    const allowlistRes = [
+        /\bif\s*\(\s*Array\s*\.\s*IndexOf\s*\([^,]+,\s*([A-Za-z_][\w.]*)\s*\)\s*<\s*0\s*\)/,
+        /\bif\s*\(\s*!\s*[A-Za-z_][\w.]*\s*\.\s*Contains\s*\(\s*([A-Za-z_][\w.]*)\s*\)\s*\)/,
+    ];
+    // Character-class validation, rejecting form:
+    //   if (!input.All(char.IsLetterOrDigit)) return;
+    const charClassRe = /\bif\s*\(\s*!\s*([A-Za-z_][\w.]*)\s*\.\s*All\s*\(\s*char\s*\.\s*Is[A-Za-z]+\s*\)\s*\)/;
+    for (let i = 0; i < lines.length; i++) {
+        let guardedExpr = null;
+        for (const re of allowlistRes) {
+            const m = re.exec(lines[i]);
+            if (m) {
+                guardedExpr = m[1];
+                break;
+            }
+        }
+        if (!guardedExpr) {
+            const m = charClassRe.exec(lines[i]);
+            if (m)
+                guardedExpr = m[1];
+        }
+        if (!guardedExpr)
+            continue;
+        if (!guardRejects(lines, i, terminatorRe, 6))
+            continue;
+        // The guarded expression may be a derivation of the tainted value
+        // (`u.Host` guards `u`, and `u` came from `input`), so credit the root
+        // identifier as well as the full expression.
+        const root = guardedExpr.split('.')[0];
+        const guarded = new Set([guardedExpr, root]);
+        const assignRe = /^\s*(?:(?:var|string)\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+        // Walk BACKWARD first: the guard often validates a DERIVATION of the
+        // tainted value while the sink uses the original.
+        //
+        //   var u = new Uri(input);
+        //   if (Array.IndexOf(Allowed, u.Host) < 0) return;   // guards u.Host
+        //   await client.GetStringAsync(input);               // uses input
+        //
+        // Allow-listing the host of the URI built from `input` constrains where
+        // `input` can point, so the original is guarded too. Bounded to the
+        // identifiers that actually fed the guarded root, transitively.
+        for (let b = i - 1; b >= 0; b--) {
+            const a = assignRe.exec(lines[b]);
+            if (!a || !guarded.has(a[1]))
+                continue;
+            for (const id of a[2].match(/[A-Za-z_]\w*/g) ?? [])
+                guarded.add(id);
+        }
+        // Anything assigned FROM a guarded value downstream is guarded too.
+        const mentions = (t) => {
+            for (const n of guarded)
+                if (new RegExp(`\\b${n.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`).test(t))
+                    return true;
+            return false;
+        };
+        for (let l = i + 1; l < lines.length; l++) {
+            const a = assignRe.exec(lines[l]);
+            if (a && mentions(a[2]))
+                guarded.add(a[1]);
+            if (mentions(lines[l])) {
+                sanitizers.push({
+                    type: 'csharp_early_return_guard',
+                    method: 'guard',
+                    line: l + 1,
+                    sanitizes: ['ssrf', 'xpath_injection', 'ldap_injection', 'path_traversal',
+                        'command_injection', 'sql_injection', 'external_taint_escape'],
+                });
+            }
+        }
+    }
+    return sanitizers;
+}
 function findCSharpFullPathStartsWithGuardSanitizers(code) {
     const sanitizers = [];
     const lines = code.split('\n');