circle-ir 4.9.29 → 4.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/dist/analysis/config-loader.d.ts.map +1 -1
  2. package/dist/analysis/config-loader.js +23 -0
  3. package/dist/analysis/config-loader.js.map +1 -1
  4. package/dist/analyzer.d.ts +12 -0
  5. package/dist/analyzer.d.ts.map +1 -1
  6. package/dist/analyzer.js +1 -1
  7. package/dist/analyzer.js.map +1 -1
  8. package/dist/browser/circle-ir.js +95 -4
  9. package/dist/core/circle-ir-core.cjs +94 -3
  10. package/dist/core/circle-ir-core.js +94 -3
  11. package/dist/core/extractors/types.d.ts +28 -1
  12. package/dist/core/extractors/types.d.ts.map +1 -1
  13. package/dist/core/extractors/types.js +86 -3
  14. package/dist/core/extractors/types.js.map +1 -1
  15. package/dist/index.d.ts +2 -0
  16. package/dist/index.d.ts.map +1 -1
  17. package/dist/index.js +4 -0
  18. package/dist/index.js.map +1 -1
  19. package/dist/navigation/index.d.ts +8 -0
  20. package/dist/navigation/index.d.ts.map +1 -0
  21. package/dist/navigation/index.js +6 -0
  22. package/dist/navigation/index.js.map +1 -0
  23. package/dist/navigation/navigation-index.d.ts +208 -0
  24. package/dist/navigation/navigation-index.d.ts.map +1 -0
  25. package/dist/navigation/navigation-index.js +968 -0
  26. package/dist/navigation/navigation-index.js.map +1 -0
  27. package/dist/navigation/types.d.ts +160 -0
  28. package/dist/navigation/types.d.ts.map +1 -0
  29. package/dist/navigation/types.js +17 -0
  30. package/dist/navigation/types.js.map +1 -0
  31. package/dist/types/index.d.ts +19 -0
  32. package/dist/types/index.d.ts.map +1 -1
  33. package/dist/types/index.js.map +1 -1
  34. package/package.json +1 -1
package/dist/analysis/config-loader.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAy0B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAmpEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
1
+ {"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAy0B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2qEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
package/dist/analysis/config-loader.js CHANGED
@@ -2439,6 +2439,29 @@ export const DEFAULT_SINKS = [
2439
2439
  { method: 'deserialize', class: 'bincode', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
2440
2440
  { method: 'from_str', class: 'toml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2441
2441
  { method: 'from_str', class: 'ron', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2442
+ // cognium-dev#541 — the crates the removed classless rows were silently
2443
+ // covering. #484 replaced a classless `from_str` / `from_slice` with
2444
+ // class-scoped rows, but only for the four formats that already had entries;
2445
+ // every other serde data format lost its sink, and `rmp_serde::from_slice`
2446
+ // on bytes read straight off a `TcpStream` stopped being reported. Each row
2447
+ // below is a serde *data format* entry point — a function whose whole job is
2448
+ // to build a typed value out of untrusted bytes or text.
2449
+ { method: 'from_slice', class: 'rmp_serde', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2450
+ { method: 'from_read', class: 'rmp_serde', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2451
+ { method: 'from_read_ref', class: 'rmp_serde', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2452
+ { method: 'from_slice', class: 'serde_yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2453
+ { method: 'from_slice', class: 'toml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2454
+ { method: 'from_reader', class: 'ron', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2455
+ { method: 'from_bytes', class: 'postcard', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2456
+ { method: 'from_slice', class: 'serde_cbor', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2457
+ { method: 'from_reader', class: 'serde_cbor', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2458
+ { method: 'from_reader', class: 'ciborium', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2459
+ { method: 'from_str', class: 'serde_xml_rs', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2460
+ { method: 'from_reader', class: 'serde_xml_rs', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2461
+ { method: 'from_str', class: 'quick_xml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2462
+ { method: 'from_reader', class: 'quick_xml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
2463
+ { method: 'from_slice', class: 'bincode', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
2464
+ { method: 'deserialize_from', class: 'bincode', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
2442
2465
  // #294/#484: no classless `from_str` / `from_slice` deserialization sink.
2443
2466
  // Those rows matched EVERY `T::from_str` / `from_slice` — `u32::from_str`,
2444
2467
  // `Url::from_str`, `PublicKey::from_slice` — i.e. ordinary `FromStr` / byte