cognium-dev 3.101.0 → 3.103.0

package/dist/cli.js

@@ -23543,6 +23543,8 @@ var PROTOCOL_CLIENT_PACKAGES = [
   "org.eclipse.paho"
 ];
 var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
+var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
+var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b/;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
     return null;
@@ -23814,6 +23816,32 @@ class SinkFilterPass {
         return true;
       });
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "command_injection")
+          return true;
+        if (sink.method !== "ProcessBuilder")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText))
+          return true;
+        if (PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText))
+          return false;
+        return true;
+      });
+    }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        if (JAVA_THROW_STATEMENT_RE.test(sinkLineText))
+          return false;
+        return true;
+      });
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 }
@@ -26446,6 +26474,10 @@ class NullDerefPass {
 }
 
 // ../circle-ir/dist/analysis/passes/resource-leak-pass.js
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var FACTORY_METHOD_NAME_RE = /^(?:open|create|new|get|make|build)[A-Z]/;
 var RESOURCE_CTORS = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -26520,7 +26552,18 @@ class ResourceLeakPass {
       const methodInfo = graph.methodAtLine(openLine);
       if (!methodInfo)
         continue;
+      const methodStart = methodInfo.method.start_line;
       const methodEnd = methodInfo.method.end_line;
+      if (this.isReturnedToCaller(codeLines, resourceVar, methodStart, methodEnd)) {
+        continue;
+      }
+      const fieldName = this.fieldStoredName(codeLines, resourceVar, openLine, methodEnd);
+      if (fieldName && this.classHasCloseMethodFor(graph, fieldName, methodInfo.type)) {
+        continue;
+      }
+      if (this.isFactoryMethod(methodInfo.method)) {
+        continue;
+      }
       const closeCall = graph.ir.calls.find((c) => CLOSE_METHODS.has(c.method_name) && c.receiver === resourceVar && c.location.line > openLine && c.location.line <= methodEnd);
       const snippet = (codeLines[openLine - 1] ?? "").trim();
       if (!closeCall) {
@@ -26584,6 +26627,39 @@ class ResourceLeakPass {
     }
     return false;
   }
+  isReturnedToCaller(lines, variable, fromLine, toLine) {
+    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex(variable)}\\b`);
+    for (let l = fromLine;l <= toLine && l <= lines.length; l++) {
+      if (varRe.test(lines[l - 1] ?? ""))
+        return true;
+    }
+    return false;
+  }
+  fieldStoredName(lines, variable, openLine, toLine) {
+    const thisAssignRe = new RegExp(`\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex(variable)}\\b`);
+    for (let l = openLine;l <= toLine && l <= lines.length; l++) {
+      const m = thisAssignRe.exec(lines[l - 1] ?? "");
+      if (m)
+        return m[1];
+    }
+    return null;
+  }
+  classHasCloseMethodFor(graph, fieldName, type) {
+    for (const c of graph.ir.calls) {
+      if (c.location.line < type.start_line || c.location.line > type.end_line)
+        continue;
+      if (c.receiver !== fieldName)
+        continue;
+      if (CLOSE_METHODS.has(c.method_name))
+        return true;
+    }
+    return false;
+  }
+  isFactoryMethod(method) {
+    if (!method.return_type || method.return_type === "void")
+      return false;
+    return FACTORY_METHOD_NAME_RE.test(method.name);
+  }
 }
 
 // ../circle-ir/dist/graph/scope-graph.js
@@ -33363,7 +33439,7 @@ var JAVA_FACTORIES = new Set([
   "SchemaFactory",
   "TransformerFactory"
 ]);
-var JAVA_SAFE_EVIDENCE_RE = /(disallow-doctype-decl|external-general-entities|external-parameter-entities|SUPPORT_DTD|ACCESS_EXTERNAL_DTD|ACCESS_EXTERNAL_SCHEMA|setXIncludeAware\s*\(\s*false\s*\)|setExpandEntityReferences\s*\(\s*false\s*\))/;
+var JAVA_SAFE_EVIDENCE_RE = /(disallow-doctype-decl|external-general-entities|external-parameter-entities|SUPPORT_DTD|ACCESS_EXTERNAL_DTD|ACCESS_EXTERNAL_SCHEMA|load-external-dtd|feature\/secure-processing|FEATURE_SECURE_PROCESSING|jdk\.xml\.(?:totalEntitySizeLimit|entityExpansionLimit|maxGeneralEntitySizeLimit|maxParameterEntitySizeLimit|elementAttributeLimit)|setXIncludeAware\s*\(\s*false\s*\)|setExpandEntityReferences\s*\(\s*false\s*\))/;
 var JAVA_XML_OUTPUT_ONLY_RE = /\bnew\s+(?:DOMSource|StreamResult)\s*\(/;
 var JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\s*\(/;
 var JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
@@ -34939,7 +35015,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.101.0";
+var version = "3.103.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.101.0",
+  "version": "3.103.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.101.0"
+    "circle-ir": "^3.103.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",