circle-ir 4.9.29 → 4.11.0

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAy0B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAmpEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAy0B1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EA2qEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -2439,6 +2439,29 @@ export const DEFAULT_SINKS = [
     { method: 'deserialize', class: 'bincode', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
     { method: 'from_str', class: 'toml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
     { method: 'from_str', class: 'ron', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    // cognium-dev#541 — the crates the removed classless rows were silently
+    // covering. #484 replaced a classless `from_str` / `from_slice` with
+    // class-scoped rows, but only for the four formats that already had entries;
+    // every other serde data format lost its sink, and `rmp_serde::from_slice`
+    // on bytes read straight off a `TcpStream` stopped being reported. Each row
+    // below is a serde *data format* entry point — a function whose whole job is
+    // to build a typed value out of untrusted bytes or text.
+    { method: 'from_slice', class: 'rmp_serde', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_read', class: 'rmp_serde', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_read_ref', class: 'rmp_serde', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_slice', class: 'serde_yaml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_slice', class: 'toml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_reader', class: 'ron', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_bytes', class: 'postcard', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_slice', class: 'serde_cbor', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_reader', class: 'serde_cbor', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_reader', class: 'ciborium', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_str', class: 'serde_xml_rs', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_reader', class: 'serde_xml_rs', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_str', class: 'quick_xml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_reader', class: 'quick_xml', type: 'deserialization', cwe: 'CWE-502', severity: 'high', arg_positions: [0] },
+    { method: 'from_slice', class: 'bincode', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
+    { method: 'deserialize_from', class: 'bincode', type: 'deserialization', cwe: 'CWE-502', severity: 'critical', arg_positions: [0] },
     // #294/#484: no classless `from_str` / `from_slice` deserialization sink.
     // Those rows matched EVERY `T::from_str` / `from_slice` — `u32::from_str`,
     // `Url::from_str`, `PublicKey::from_slice` — i.e. ordinary `FromStr` / byte