circle-ir 4.9.8 → 4.9.9

package/dist/core/circle-ir-core.cjs

@@ -14862,15 +14862,25 @@ function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
 function stripCsLiterals(line) {
   return line.replace(/\/\/.*$/, "").replace(/@?"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)'/g, "''");
 }
+var _csDepthLines;
+var _csDepthPrefix;
 function csBraceDepthBefore(lines, idx) {
-  let depth = 0;
-  for (let i2 = 0; i2 < idx && i2 < lines.length; i2++) {
-    for (const ch of stripCsLiterals(lines[i2])) {
-      if (ch === "{") depth++;
-      else if (ch === "}") depth--;
+  if (lines !== _csDepthLines) {
+    const pref = new Int32Array(lines.length + 1);
+    let depth = 0;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      pref[i2] = depth;
+      for (const ch of stripCsLiterals(lines[i2])) {
+        if (ch === "{") depth++;
+        else if (ch === "}") depth--;
+      }
     }
+    pref[lines.length] = depth;
+    _csDepthLines = lines;
+    _csDepthPrefix = pref;
   }
-  return depth;
+  const clamped = idx < 0 ? 0 : idx > lines.length ? lines.length : idx;
+  return _csDepthPrefix[clamped];
 }
 function netBraces(fragment) {
   let n = 0;
@@ -14967,6 +14977,30 @@ function csThenBlock(lines, ifIdx, rest) {
   }
   return { start: ifIdx, end: firstIdx, earlyExit: isExit(firstText.trim()) };
 }
+var _csGuardLines;
+var _csGuardMap;
+function csEqualityGuardIndex(lines) {
+  if (lines === _csGuardLines && _csGuardMap) return _csGuardMap;
+  const map = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const parts2 = splitCsIf(lines[i2]);
+    if (!parts2) continue;
+    const guard = csEqualityGuard(parts2.cond);
+    if (!guard) continue;
+    const entry = { i: i2, rest: parts2.rest, ifCol: parts2.ifCol, op: guard.op };
+    for (const id of csIdentifiers(guard.exprSide)) {
+      let arr = map.get(id);
+      if (!arr) {
+        arr = [];
+        map.set(id, arr);
+      }
+      arr.push(entry);
+    }
+  }
+  _csGuardLines = lines;
+  _csGuardMap = map;
+  return map;
+}
 function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines) {
   if (language !== "csharp") return false;
   if (pattern.type !== "ssrf") return false;
@@ -14979,20 +15013,22 @@ function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)
   if (candidates.size === 0) return false;
   const sinkIdx = call.location.line - 1;
   const sinkDepth = csBraceDepthBefore(sourceLines, sinkIdx);
-  for (let i2 = 0; i2 < sinkIdx; i2++) {
-    const parts2 = splitCsIf(sourceLines[i2]);
-    if (!parts2) continue;
-    const guard = csEqualityGuard(parts2.cond);
-    if (!guard) continue;
-    const guardIds = csIdentifiers(guard.exprSide);
-    if (![...guardIds].some((id) => candidates.has(id))) continue;
-    const block = csThenBlock(sourceLines, i2, parts2.rest);
-    if (guard.op === "==") {
-      if (sinkIdx >= block.start && sinkIdx <= block.end) return true;
-    } else {
-      const guardDepth = csBraceDepthBefore(sourceLines, i2) + netBraces(stripCsLiterals(sourceLines[i2]).slice(0, parts2.ifCol));
-      if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
-        return true;
+  const guardMap = csEqualityGuardIndex(sourceLines);
+  const checked = /* @__PURE__ */ new Set();
+  for (const cand of candidates) {
+    const guards = guardMap.get(cand);
+    if (!guards) continue;
+    for (const g of guards) {
+      if (g.i >= sinkIdx || checked.has(g)) continue;
+      checked.add(g);
+      const block = csThenBlock(sourceLines, g.i, g.rest);
+      if (g.op === "==") {
+        if (sinkIdx >= block.start && sinkIdx <= block.end) return true;
+      } else {
+        const guardDepth = csBraceDepthBefore(sourceLines, g.i) + netBraces(stripCsLiterals(sourceLines[g.i]).slice(0, g.ifCol));
+        if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
+          return true;
+        }
       }
     }
   }

package/dist/core/circle-ir-core.js

@@ -14796,15 +14796,25 @@ function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
 function stripCsLiterals(line) {
   return line.replace(/\/\/.*$/, "").replace(/@?"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)'/g, "''");
 }
+var _csDepthLines;
+var _csDepthPrefix;
 function csBraceDepthBefore(lines, idx) {
-  let depth = 0;
-  for (let i2 = 0; i2 < idx && i2 < lines.length; i2++) {
-    for (const ch of stripCsLiterals(lines[i2])) {
-      if (ch === "{") depth++;
-      else if (ch === "}") depth--;
+  if (lines !== _csDepthLines) {
+    const pref = new Int32Array(lines.length + 1);
+    let depth = 0;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      pref[i2] = depth;
+      for (const ch of stripCsLiterals(lines[i2])) {
+        if (ch === "{") depth++;
+        else if (ch === "}") depth--;
+      }
     }
+    pref[lines.length] = depth;
+    _csDepthLines = lines;
+    _csDepthPrefix = pref;
   }
-  return depth;
+  const clamped = idx < 0 ? 0 : idx > lines.length ? lines.length : idx;
+  return _csDepthPrefix[clamped];
 }
 function netBraces(fragment) {
   let n = 0;
@@ -14901,6 +14911,30 @@ function csThenBlock(lines, ifIdx, rest) {
   }
   return { start: ifIdx, end: firstIdx, earlyExit: isExit(firstText.trim()) };
 }
+var _csGuardLines;
+var _csGuardMap;
+function csEqualityGuardIndex(lines) {
+  if (lines === _csGuardLines && _csGuardMap) return _csGuardMap;
+  const map = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const parts2 = splitCsIf(lines[i2]);
+    if (!parts2) continue;
+    const guard = csEqualityGuard(parts2.cond);
+    if (!guard) continue;
+    const entry = { i: i2, rest: parts2.rest, ifCol: parts2.ifCol, op: guard.op };
+    for (const id of csIdentifiers(guard.exprSide)) {
+      let arr = map.get(id);
+      if (!arr) {
+        arr = [];
+        map.set(id, arr);
+      }
+      arr.push(entry);
+    }
+  }
+  _csGuardLines = lines;
+  _csGuardMap = map;
+  return map;
+}
 function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines) {
   if (language !== "csharp") return false;
   if (pattern.type !== "ssrf") return false;
@@ -14913,20 +14947,22 @@ function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)
   if (candidates.size === 0) return false;
   const sinkIdx = call.location.line - 1;
   const sinkDepth = csBraceDepthBefore(sourceLines, sinkIdx);
-  for (let i2 = 0; i2 < sinkIdx; i2++) {
-    const parts2 = splitCsIf(sourceLines[i2]);
-    if (!parts2) continue;
-    const guard = csEqualityGuard(parts2.cond);
-    if (!guard) continue;
-    const guardIds = csIdentifiers(guard.exprSide);
-    if (![...guardIds].some((id) => candidates.has(id))) continue;
-    const block = csThenBlock(sourceLines, i2, parts2.rest);
-    if (guard.op === "==") {
-      if (sinkIdx >= block.start && sinkIdx <= block.end) return true;
-    } else {
-      const guardDepth = csBraceDepthBefore(sourceLines, i2) + netBraces(stripCsLiterals(sourceLines[i2]).slice(0, parts2.ifCol));
-      if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
-        return true;
+  const guardMap = csEqualityGuardIndex(sourceLines);
+  const checked = /* @__PURE__ */ new Set();
+  for (const cand of candidates) {
+    const guards = guardMap.get(cand);
+    if (!guards) continue;
+    for (const g of guards) {
+      if (g.i >= sinkIdx || checked.has(g)) continue;
+      checked.add(g);
+      const block = csThenBlock(sourceLines, g.i, g.rest);
+      if (g.op === "==") {
+        if (sinkIdx >= block.start && sinkIdx <= block.end) return true;
+      } else {
+        const guardDepth = csBraceDepthBefore(sourceLines, g.i) + netBraces(stripCsLiterals(sourceLines[g.i]).slice(0, g.ifCol));
+        if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
+          return true;
+        }
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "4.9.8",
+  "version": "4.9.9",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",