cognium-dev 3.101.0 → 3.102.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +19 -2
- package/package.json +2 -2
package/dist/cli.js
CHANGED
|
@@ -23543,6 +23543,7 @@ var PROTOCOL_CLIENT_PACKAGES = [
|
|
|
23543
23543
|
"org.eclipse.paho"
|
|
23544
23544
|
];
|
|
23545
23545
|
var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
|
|
23546
|
+
var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
|
|
23546
23547
|
function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
|
|
23547
23548
|
if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
|
|
23548
23549
|
return null;
|
|
@@ -23814,6 +23815,22 @@ class SinkFilterPass {
|
|
|
23814
23815
|
return true;
|
|
23815
23816
|
});
|
|
23816
23817
|
}
|
|
23818
|
+
if (language === "java") {
|
|
23819
|
+
const sourceLines = ctx.code.split(`
|
|
23820
|
+
`);
|
|
23821
|
+
filtered = filtered.filter((sink) => {
|
|
23822
|
+
if (sink.type !== "command_injection")
|
|
23823
|
+
return true;
|
|
23824
|
+
if (sink.method !== "ProcessBuilder")
|
|
23825
|
+
return true;
|
|
23826
|
+
const sinkLineText = sourceLines[sink.line - 1] ?? "";
|
|
23827
|
+
if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText))
|
|
23828
|
+
return true;
|
|
23829
|
+
if (PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText))
|
|
23830
|
+
return false;
|
|
23831
|
+
return true;
|
|
23832
|
+
});
|
|
23833
|
+
}
|
|
23817
23834
|
return { sources, sinks: filtered, sanitizers };
|
|
23818
23835
|
}
|
|
23819
23836
|
}
|
|
@@ -33363,7 +33380,7 @@ var JAVA_FACTORIES = new Set([
|
|
|
33363
33380
|
"SchemaFactory",
|
|
33364
33381
|
"TransformerFactory"
|
|
33365
33382
|
]);
|
|
33366
|
-
var JAVA_SAFE_EVIDENCE_RE = /(disallow-doctype-decl|external-general-entities|external-parameter-entities|SUPPORT_DTD|ACCESS_EXTERNAL_DTD|ACCESS_EXTERNAL_SCHEMA|setXIncludeAware\s*\(\s*false\s*\)|setExpandEntityReferences\s*\(\s*false\s*\))/;
|
|
33383
|
+
var JAVA_SAFE_EVIDENCE_RE = /(disallow-doctype-decl|external-general-entities|external-parameter-entities|SUPPORT_DTD|ACCESS_EXTERNAL_DTD|ACCESS_EXTERNAL_SCHEMA|load-external-dtd|feature\/secure-processing|FEATURE_SECURE_PROCESSING|jdk\.xml\.(?:totalEntitySizeLimit|entityExpansionLimit|maxGeneralEntitySizeLimit|maxParameterEntitySizeLimit|elementAttributeLimit)|setXIncludeAware\s*\(\s*false\s*\)|setExpandEntityReferences\s*\(\s*false\s*\))/;
|
|
33367
33384
|
var JAVA_XML_OUTPUT_ONLY_RE = /\bnew\s+(?:DOMSource|StreamResult)\s*\(/;
|
|
33368
33385
|
var JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\s*\(/;
|
|
33369
33386
|
var JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
|
|
@@ -34939,7 +34956,7 @@ var colors = {
|
|
|
34939
34956
|
};
|
|
34940
34957
|
|
|
34941
34958
|
// src/version.ts
|
|
34942
|
-
var version = "3.
|
|
34959
|
+
var version = "3.102.0";
|
|
34943
34960
|
|
|
34944
34961
|
// src/formatters.ts
|
|
34945
34962
|
var SINK_SEVERITY = {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cognium-dev",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.102.0",
|
|
4
4
|
"description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -65,7 +65,7 @@
|
|
|
65
65
|
"registry": "https://registry.npmjs.org/"
|
|
66
66
|
},
|
|
67
67
|
"dependencies": {
|
|
68
|
-
"circle-ir": "^3.
|
|
68
|
+
"circle-ir": "^3.102.0"
|
|
69
69
|
},
|
|
70
70
|
"devDependencies": {
|
|
71
71
|
"@types/node": "^25.5.0",
|