cognium-dev 3.100.0 → 3.102.0

package/dist/cli.js

@@ -23523,6 +23523,27 @@ var REFLECTION_LITERAL_METHODS = new Set([
   "invoke"
 ]);
 var JAVA_DECL_RE_TEMPLATE = "(?:\\b(?:final|public|private|protected|static)\\s+)*" + "([A-Z]\\w*(?:\\.[A-Z]\\w*)?(?:<[^>]*>)?)\\s+RECV\\b\\s*[=;,)]";
+var PROTOCOL_WIRE_METHODS = new Set([
+  "executeCommand",
+  "execute",
+  "dispatch",
+  "send",
+  "publish",
+  "command",
+  "run"
+]);
+var PROTOCOL_CLIENT_PACKAGES = [
+  "redis.clients.jedis",
+  "io.lettuce",
+  "org.springframework.data.redis",
+  "org.springframework.data.mongodb",
+  "org.springframework.amqp",
+  "com.rabbitmq",
+  "org.apache.kafka",
+  "org.eclipse.paho"
+];
+var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
+var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
     return null;
@@ -23559,6 +23580,17 @@ function extractJavaCallArgs(method, line) {
     return [];
   return argsText.split(",").map((s) => s.trim());
 }
+function hasJavaImportFromPackage(packagePrefix, sourceLines) {
+  if (!/^[A-Za-z_][\w.]*$/.test(packagePrefix))
+    return false;
+  const limit = Math.min(sourceLines.length, 80);
+  const re = new RegExp(`^\\s*import\\s+(?:static\\s+)?${packagePrefix.replace(/\./g, "\\.")}\\b`);
+  for (let i2 = 0;i2 < limit; i2++) {
+    if (re.test(sourceLines[i2] ?? ""))
+      return true;
+  }
+  return false;
+}
 
 class SinkFilterPass {
   name = "sink-filter";
@@ -23761,6 +23793,44 @@ class SinkFilterPass {
         return true;
       });
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "command_injection")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        if (sink.method === "CommandLine" && /\bnew\s+CommandLine\s*\(/.test(sinkLineText) && hasJavaImportFromPackage("picocli", sourceLines)) {
+          return false;
+        }
+        if (sink.method && PROTOCOL_WIRE_METHODS.has(sink.method)) {
+          for (const pkg of PROTOCOL_CLIENT_PACKAGES) {
+            if (hasJavaImportFromPackage(pkg, sourceLines)) {
+              if (!OS_EXEC_RECEIVER_RE.test(sinkLineText)) {
+                return false;
+              }
+            }
+          }
+        }
+        return true;
+      });
+    }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "command_injection")
+          return true;
+        if (sink.method !== "ProcessBuilder")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText))
+          return true;
+        if (PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText))
+          return false;
+        return true;
+      });
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 }
@@ -33310,7 +33380,11 @@ var JAVA_FACTORIES = new Set([
   "SchemaFactory",
   "TransformerFactory"
 ]);
-var JAVA_SAFE_EVIDENCE_RE = /(disallow-doctype-decl|external-general-entities|external-parameter-entities|SUPPORT_DTD|ACCESS_EXTERNAL_DTD|ACCESS_EXTERNAL_SCHEMA|setXIncludeAware\s*\(\s*false\s*\)|setExpandEntityReferences\s*\(\s*false\s*\))/;
+var JAVA_SAFE_EVIDENCE_RE = /(disallow-doctype-decl|external-general-entities|external-parameter-entities|SUPPORT_DTD|ACCESS_EXTERNAL_DTD|ACCESS_EXTERNAL_SCHEMA|load-external-dtd|feature\/secure-processing|FEATURE_SECURE_PROCESSING|jdk\.xml\.(?:totalEntitySizeLimit|entityExpansionLimit|maxGeneralEntitySizeLimit|maxParameterEntitySizeLimit|elementAttributeLimit)|setXIncludeAware\s*\(\s*false\s*\)|setExpandEntityReferences\s*\(\s*false\s*\))/;
+var JAVA_XML_OUTPUT_ONLY_RE = /\bnew\s+(?:DOMSource|StreamResult)\s*\(/;
+var JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\s*\(/;
+var JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
+var JAVA_DOC_BUILDER_PARSE_RE = /(?:DocumentBuilder|builder)\s*\.\s*parse\s*\(/;
 var PY_LXML_PARSER_INSECURE_DEFAULT_RE = /\bresolve_entities\s*=\s*False\b/;
 
 class XmlEntityExpansionPass {
@@ -33325,10 +33399,16 @@ class XmlEntityExpansionPass {
       const safeInFile = JAVA_SAFE_EVIDENCE_RE.test(code);
       if (safeInFile)
         return { findings };
+      const isXmlOutputOnly = JAVA_XML_OUTPUT_ONLY_RE.test(code) && !JAVA_XML_PARSE_INPUT_RE.test(code);
+      const isDocumentBuilderEmptyOnly = JAVA_DOC_BUILDER_NEW_DOCUMENT_RE.test(code) && !JAVA_DOC_BUILDER_PARSE_RE.test(code);
       for (const call of graph.ir.calls) {
         const det = this.detectJavaCall(call);
         if (!det)
           continue;
+        if (det.api === "TransformerFactory" && isXmlOutputOnly)
+          continue;
+        if (det.api === "DocumentBuilderFactory" && isDocumentBuilderEmptyOnly)
+          continue;
         const line = call.location.line;
         findings.push({ line, language, ...det });
         ctx.addFinding({
@@ -34876,7 +34956,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.100.0";
+var version = "3.102.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.100.0",
+  "version": "3.102.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.100.0"
+    "circle-ir": "^3.102.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",