circle-ir 4.9.28 → 4.9.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/config-loader.d.ts.map +1 -1
- package/dist/analysis/config-loader.js +40 -2
- package/dist/analysis/config-loader.js.map +1 -1
- package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
- package/dist/analysis/passes/language-sources-pass.js +54 -7
- package/dist/analysis/passes/language-sources-pass.js.map +1 -1
- package/dist/analysis/passes/taint-propagation-pass.js +117 -12
- package/dist/analysis/passes/taint-propagation-pass.js.map +1 -1
- package/dist/analysis/taint-matcher.d.ts.map +1 -1
- package/dist/analysis/taint-matcher.js +41 -0
- package/dist/analysis/taint-matcher.js.map +1 -1
- package/dist/browser/circle-ir.js +165 -24
- package/dist/core/circle-ir-core.cjs +85 -9
- package/dist/core/circle-ir-core.js +85 -9
- package/dist/core/extractors/calls.js +29 -1
- package/dist/core/extractors/calls.js.map +1 -1
- package/dist/core/extractors/types.js +50 -7
- package/dist/core/extractors/types.js.map +1 -1
- package/dist/types/config.d.ts +14 -0
- package/dist/types/config.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyB9E,eAAO,MAAM,mBAAmB;;UACK,YAAY;;;UAEb,WAAW;;;UACR,aAAa;;;UACb,aAAa;;;UACjB,WAAW;;;UAGR,YAAY;;;UAQX,WAAW;;;UACV,UAAU;;;UAIC,WAAW;IA8D7D,CAAC;AAwDF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB,CAqgB3C;CACF;
|
|
1
|
+
{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyB9E,eAAO,MAAM,mBAAmB;;UACK,YAAY;;;UAEb,WAAW;;;UACR,aAAa;;;UACb,aAAa;;;UACjB,WAAW;;;UAGR,YAAY;;;UAQX,WAAW;;;UACV,UAAU;;;UAIC,WAAW;IA8D7D,CAAC;AAwDF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB,CAqgB3C;CACF;AAglDD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmO9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAuBD,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB7B;AAoKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CA8BpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAqFrB;AAyTD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAy/FD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoFf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmGf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsHf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoEf;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA8Ff;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgGf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2If;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Kf;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Jf;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwFf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Ef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Ef;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiFf"}
|
|
@@ -1569,6 +1569,19 @@ function findCSharpRequestSources(sourceCode, language) {
|
|
|
1569
1569
|
// the type token must be followed by whitespace, not more identifier text.
|
|
1570
1570
|
const httpRequestReceivers = new Set(['Request']);
|
|
1571
1571
|
const httpRequestDeclRe = /\b(?:HttpRequest|HttpRequestBase)\??\s+([A-Za-z_]\w*)/g;
|
|
1572
|
+
// cognium-dev#502 — I/O and database reads, mirroring Java's
|
|
1573
|
+
// `BufferedReader.readLine` (io_input) and `ResultSet.getString` (db_input).
|
|
1574
|
+
// Declared-type scoped for the same reason #501 needed it: the method names
|
|
1575
|
+
// are generic (`ReadLine`, `GetString`), so matching them on any receiver
|
|
1576
|
+
// would fire on unrelated types. A registry row cannot do this — the
|
|
1577
|
+
// receiver's type is not resolved for a `SqlDataReader rdr` parameter — and
|
|
1578
|
+
// binding here also gives the LHS a `variable`, which a bare
|
|
1579
|
+
// `return_tainted` row does not, so the flow can form when the read sits
|
|
1580
|
+
// inside a nested `using` / `try` block (the Juliet shape).
|
|
1581
|
+
const streamReaderVars = new Set();
|
|
1582
|
+
const streamReaderDeclRe = /\b(?:StreamReader|TextReader|BinaryReader)\??\s+([A-Za-z_]\w*)/g;
|
|
1583
|
+
const dbReaderVars = new Set();
|
|
1584
|
+
const dbReaderDeclRe = /\b(?:SqlDataReader|DbDataReader|IDataReader|OdbcDataReader|OleDbDataReader)\??\s+([A-Za-z_]\w*)/g;
|
|
1572
1585
|
for (const line of lines) {
|
|
1573
1586
|
const formRe = new RegExp(formFileDeclRe.source, 'g');
|
|
1574
1587
|
let d;
|
|
@@ -1577,7 +1590,19 @@ function findCSharpRequestSources(sourceCode, language) {
|
|
|
1577
1590
|
const reqRe = new RegExp(httpRequestDeclRe.source, 'g');
|
|
1578
1591
|
while ((d = reqRe.exec(line)) !== null)
|
|
1579
1592
|
httpRequestReceivers.add(d[1]);
|
|
1580
|
-
|
|
1593
|
+
const srRe = new RegExp(streamReaderDeclRe.source, 'g');
|
|
1594
|
+
while ((d = srRe.exec(line)) !== null)
|
|
1595
|
+
streamReaderVars.add(d[1]);
|
|
1596
|
+
const dbRe = new RegExp(dbReaderDeclRe.source, 'g');
|
|
1597
|
+
while ((d = dbRe.exec(line)) !== null)
|
|
1598
|
+
dbReaderVars.add(d[1]);
|
|
1599
|
+
}
|
|
1600
|
+
const streamReadRe = streamReaderVars.size > 0
|
|
1601
|
+
? new RegExp(`\\b(?:${[...streamReaderVars].join('|')})\\s*\\.\\s*(?:ReadLine|ReadToEnd|ReadLineAsync|ReadToEndAsync|ReadBlock|Read)\\s*\\(`)
|
|
1602
|
+
: null;
|
|
1603
|
+
const dbReadRe = dbReaderVars.size > 0
|
|
1604
|
+
? new RegExp(`\\b(?:${[...dbReaderVars].join('|')})\\s*\\.\\s*(?:GetString|GetValue|GetInt32|GetInt64|GetDecimal|GetDateTime|GetFieldValue|\\[)`)
|
|
1605
|
+
: null;
|
|
1581
1606
|
const formFileReadRe = formFileParams.size > 0
|
|
1582
1607
|
? new RegExp(`\\b(?:${[...formFileParams].join('|')})\\s*\\.\\s*(?:FileName|ContentType)\\b`)
|
|
1583
1608
|
: null;
|
|
@@ -1590,7 +1615,11 @@ function findCSharpRequestSources(sourceCode, language) {
|
|
|
1590
1615
|
? 'io_input'
|
|
1591
1616
|
: envReadRe.test(text)
|
|
1592
1617
|
? 'env_input'
|
|
1593
|
-
:
|
|
1618
|
+
: streamReadRe?.test(text)
|
|
1619
|
+
? 'io_input'
|
|
1620
|
+
: dbReadRe?.test(text)
|
|
1621
|
+
? 'db_input'
|
|
1622
|
+
: null;
|
|
1594
1623
|
// cognium-dev#339 — a bare expression statement reads the request INLINE in
|
|
1595
1624
|
// the call, with no local to bind:
|
|
1596
1625
|
//
|
|
@@ -1613,6 +1642,8 @@ function findCSharpRequestSources(sourceCode, language) {
|
|
|
1613
1642
|
[formFileReadRe, 'http_param'],
|
|
1614
1643
|
[consoleReadRe, 'io_input'],
|
|
1615
1644
|
[envReadRe, 'env_input'],
|
|
1645
|
+
[streamReadRe, 'io_input'],
|
|
1646
|
+
[dbReadRe, 'db_input'],
|
|
1616
1647
|
];
|
|
1617
1648
|
const inlineRead = (text) => {
|
|
1618
1649
|
const argsStart = text.indexOf('(');
|
|
@@ -1641,7 +1672,20 @@ function findCSharpRequestSources(sourceCode, language) {
|
|
|
1641
1672
|
const embeddedAssignRe = /(?:^|[{;])\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*([^;{}]+)/;
|
|
1642
1673
|
for (let i = 0; i < lines.length; i++) {
|
|
1643
1674
|
const m = assignRe.exec(lines[i]);
|
|
1644
|
-
|
|
1675
|
+
// cognium-dev#502 — `assignRe` is anchored and greedy, so on a one-line
|
|
1676
|
+
// block header that also contains the real assignment
|
|
1677
|
+
//
|
|
1678
|
+
// using (StreamReader sr = new StreamReader(tcp.GetStream())) { data = sr.ReadLine(); }
|
|
1679
|
+
//
|
|
1680
|
+
// it captures `sr` with EVERYTHING after `=` as the right-hand side. That
|
|
1681
|
+
// RHS contains `sr.ReadLine()`, so the line was classified as a read and
|
|
1682
|
+
// bound to `sr` — the reader, not `data`. The embedded-assignment path
|
|
1683
|
+
// handles exactly this shape and finds both `sr` and `data`, but it only
|
|
1684
|
+
// ran when `assignRe` failed to match at all. Prefer it whenever the
|
|
1685
|
+
// captured RHS crosses a block boundary. (#504 was the mirror of this:
|
|
1686
|
+
// there `assignRe` did not match and the inner assignment was lost.)
|
|
1687
|
+
const rhsCrossesBlock = m !== null && m[2].includes('{');
|
|
1688
|
+
if (!m || rhsCrossesBlock) {
|
|
1645
1689
|
const stmt = lines[i];
|
|
1646
1690
|
if (stmt.includes('{') && !/^\s*(?:\/\/|\/\*|\*)/.test(stmt)) {
|
|
1647
1691
|
const emb = new RegExp(embeddedAssignRe.source, 'g');
|
|
@@ -1659,7 +1703,8 @@ function findCSharpRequestSources(sourceCode, language) {
|
|
|
1659
1703
|
sources.push({
|
|
1660
1704
|
type,
|
|
1661
1705
|
location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
|
|
1662
|
-
|
|
1706
|
+
// #502 — Java parity: a database row read is medium, I/O is high.
|
|
1707
|
+
severity: type === 'db_input' ? 'medium' : 'high',
|
|
1663
1708
|
line: lineNumber,
|
|
1664
1709
|
confidence: 1.0,
|
|
1665
1710
|
variable: varName,
|
|
@@ -1693,7 +1738,7 @@ function findCSharpRequestSources(sourceCode, language) {
|
|
|
1693
1738
|
sources.push({
|
|
1694
1739
|
type,
|
|
1695
1740
|
location: `${read} in ${code.substring(0, 50)}${code.length > 50 ? '...' : ''}`,
|
|
1696
|
-
severity: 'high',
|
|
1741
|
+
severity: type === 'db_input' ? 'medium' : 'high',
|
|
1697
1742
|
line: lineNumber,
|
|
1698
1743
|
confidence: 1.0,
|
|
1699
1744
|
variable: '<inline>',
|
|
@@ -1711,7 +1756,8 @@ function findCSharpRequestSources(sourceCode, language) {
|
|
|
1711
1756
|
sources.push({
|
|
1712
1757
|
type,
|
|
1713
1758
|
location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
|
|
1714
|
-
|
|
1759
|
+
// #502 — Java parity: a database row read is medium, I/O is high.
|
|
1760
|
+
severity: type === 'db_input' ? 'medium' : 'high',
|
|
1715
1761
|
line: lineNumber,
|
|
1716
1762
|
confidence: 1.0,
|
|
1717
1763
|
variable: varName,
|
|
@@ -1980,7 +2026,8 @@ function findPythonAssignmentSources(sourceCode, language) {
|
|
|
1980
2026
|
sources.push({
|
|
1981
2027
|
type,
|
|
1982
2028
|
location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
|
|
1983
|
-
|
|
2029
|
+
// #502 — Java parity: a database row read is medium, I/O is high.
|
|
2030
|
+
severity: type === 'db_input' ? 'medium' : 'high',
|
|
1984
2031
|
line: lineNumber,
|
|
1985
2032
|
confidence: 0.95,
|
|
1986
2033
|
variable: varName,
|