circle-ir 4.9.8 → 4.9.10

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAoiEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAuiBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAqlEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAgjBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -2617,6 +2617,23 @@ export const DEFAULT_SINKS = [
     { method: 'ExecuteSqlRawAsync', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     { method: 'FromSqlRaw', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     { method: 'FromSqlRawAsync', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    // Dapper micro-ORM (cognium-dev#275). Every Dapper entry point is an
+    // `IDbConnection` extension whose arg 0 is raw SQL text — `conn.Query<T>(sql)`
+    // is exactly as injectable as `new SqlCommand(sql)`. Taint-gated on arg 0, so
+    // a constant/interpolation-free query never fires, and a same-named method on
+    // an unrelated receiver (e.g. RestSharp's `client.Execute(request)`, whose
+    // arg 0 is a request object rather than a tainted string) stays clean.
+    { method: 'Query', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'QueryAsync', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'QueryFirst', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'QueryFirstAsync', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'QueryFirstOrDefault', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'QueryFirstOrDefaultAsync', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'QuerySingle', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'QuerySingleOrDefault', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'QueryMultiple', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Execute', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'ExecuteAsync', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     // ADO.NET `cmd.CommandText = "…" + x` — emitted as a synthetic call by
     // extractCSharpCalls (property-assignment sink; the ctor-arg sink misses it).
     { method: 'CommandText', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
@@ -2682,12 +2699,23 @@ export const DEFAULT_SINKS = [
     { method: 'DeleteAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'GetStringAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'GetByteArrayAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // Remaining HttpClient/Flurl verbs (cognium-dev#275). For HttpClient these
+    // take the URL at arg 0; for Flurl's fluent form the receiver is surfaced as
+    // arg 0 by CSHARP_RECEIVER_URL_METHODS. Taint-gated either way.
+    // (GetStreamAsync / PutAsync / DeleteAsync are already registered below.)
+    { method: 'GetJsonAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'PatchAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'HeadAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'GetStreamAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'SendAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'DownloadString', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'DownloadData', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'DownloadFile', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [1], languages: ['csharp'] },
     { method: 'Create', class: 'WebRequest', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // RestSharp (cognium-dev#275) — the base URL is fixed at construction, so
+    // `new RestClient(userUrl)` points every later request at attacker-controlled
+    // infrastructure. Ctor arg 0, taint-gated.
+    { method: 'RestClient', class: 'constructor', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // C# code injection — dynamic script/assembly loading (CWE-94).
     { method: 'EvaluateAsync', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     { method: 'RunAsync', class: 'CSharpScript', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
@@ -2727,6 +2755,11 @@ export const DEFAULT_SINKS = [
     // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
     // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
     { method: 'MarkupString', class: 'constructor', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // `return Content(html, "text/html")` on a controller writes arg 0 to the
+    // response body unescaped (cognium-dev#275). Taint-gated on arg 0; the common
+    // `Content(constantString)` and the JSON/plain-text content types are
+    // unaffected because a constant argument carries no taint.
+    { method: 'Content', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // `String.Format(fmt, …)` with an attacker-controlled FORMAT string — CWE-134.
     // Taint-gated on arg 0 (the format), so ordinary `String.Format("...", user)` where
     // only an argument is tainted never fires. .NET composite formatting can't corrupt
@@ -2752,6 +2785,10 @@ export const DEFAULT_SINKS = [
     // cognium-dev#273/#275). `BsonDocument.Parse(userJson)` deserializes an
     // attacker-controlled query document. Class-scoped (static receiver resolves).
     { method: 'Parse', class: 'BsonDocument', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // `new BsonJavaScript(userCode)` wraps a server-side JS string — the payload
+    // MongoDB's `$where` / `$function` operators execute. Unconditionally
+    // dangerous when tainted, so no literal gating is needed (cognium-dev#275).
+    { method: 'BsonJavaScript', class: 'constructor', type: 'nosql_injection', cwe: 'CWE-943', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // C# log injection — Microsoft.Extensions.Logging `ILogger` (CWE-117,
     // cognium-ai#318). Only the message TEMPLATE (arg[0]) is the injectable
     // position; the structured form `LogInformation("… {Id}", id)` keeps taint in
@@ -2763,6 +2800,16 @@ export const DEFAULT_SINKS = [
     { method: 'LogDebug', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
     { method: 'LogCritical', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
     { method: 'LogTrace', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [0], languages: ['csharp'] },
+    // C# ReDoS (CWE-1333, cognium-dev#275). The injectable position is the
+    // PATTERN, not the input: a user-supplied regex can be crafted with
+    // catastrophic backtracking. `Regex.IsMatch(input, pattern)` and friends take
+    // the pattern at arg 1; the `new Regex(pattern)` ctor takes it at arg 0. A
+    // tainted *input* with a constant pattern is not ReDoS and does not fire.
+    { method: 'IsMatch', class: 'Regex', type: 'redos', cwe: 'CWE-1333', severity: 'medium', arg_positions: [1], languages: ['csharp'] },
+    { method: 'Match', class: 'Regex', type: 'redos', cwe: 'CWE-1333', severity: 'medium', arg_positions: [1], languages: ['csharp'] },
+    { method: 'Matches', class: 'Regex', type: 'redos', cwe: 'CWE-1333', severity: 'medium', arg_positions: [1], languages: ['csharp'] },
+    { method: 'Replace', class: 'Regex', type: 'redos', cwe: 'CWE-1333', severity: 'medium', arg_positions: [1], languages: ['csharp'] },
+    { method: 'Regex', class: 'constructor', type: 'redos', cwe: 'CWE-1333', severity: 'medium', arg_positions: [0], languages: ['csharp'] },
     // Generic `ILogger.Log(logLevel, message, …)` — class-scoped (`Log` alone is
     // too generic); the message is arg[1].
     { method: 'Log', class: 'ILogger', type: 'log_injection', cwe: 'CWE-117', severity: 'low', arg_positions: [1], languages: ['csharp'] },
@@ -3011,6 +3058,15 @@ export const DEFAULT_SANITIZERS = [
     // this table; the drift surfaced as a SecuriBench Micro FP on
     // `sanitizers/Sanitizers3.java` (`URLEncoder.encode` + `sendRedirect`).
     { method: 'encodeForURL', removes: ['xss', 'ssrf', 'open_redirect'] },
+    // ASP.NET Core local-redirect guards (cognium-dev#275). `Url.IsLocalUrl(x)`
+    // returns false for any absolute/scheme-relative URL, so a `Redirect(x)` gated
+    // on it cannot leave the site — without this credit the guarded form is a
+    // false positive. `LocalRedirect(x)` is the same check applied by the
+    // framework itself: it THROWS on a non-local URL, which is why it is
+    // deliberately not registered as an open_redirect sink. Recording it here
+    // states that intent in the model rather than leaving it as a silent omission.
+    { method: 'IsLocalUrl', removes: ['open_redirect'] },
+    { method: 'LocalRedirect', removes: ['open_redirect'] },
     // URL encoding wrapper aliases (common patterns in benchmarks and real-world code)
     { method: 'encodeURL', removes: ['xss', 'ssrf', 'open_redirect'] },
     { method: 'urlEncode', removes: ['xss', 'ssrf', 'open_redirect'] },