cognium-dev 3.102.0 → 3.104.0

package/dist/cli.js

@@ -23544,6 +23544,7 @@ var PROTOCOL_CLIENT_PACKAGES = [
 ];
 var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
 var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
+var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b/;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
     return null;
@@ -23831,6 +23832,16 @@ class SinkFilterPass {
         return true;
       });
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        if (JAVA_THROW_STATEMENT_RE.test(sinkLineText))
+          return false;
+        return true;
+      });
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 }
@@ -26463,6 +26474,10 @@ class NullDerefPass {
 }
 
 // ../circle-ir/dist/analysis/passes/resource-leak-pass.js
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var FACTORY_METHOD_NAME_RE = /^(?:open|create|new|get|make|build)[A-Z]/;
 var RESOURCE_CTORS = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -26537,7 +26552,18 @@ class ResourceLeakPass {
       const methodInfo = graph.methodAtLine(openLine);
       if (!methodInfo)
         continue;
+      const methodStart = methodInfo.method.start_line;
       const methodEnd = methodInfo.method.end_line;
+      if (this.isReturnedToCaller(codeLines, resourceVar, methodStart, methodEnd)) {
+        continue;
+      }
+      const fieldName = this.fieldStoredName(codeLines, resourceVar, openLine, methodEnd);
+      if (fieldName && this.classHasCloseMethodFor(graph, fieldName, methodInfo.type)) {
+        continue;
+      }
+      if (this.isFactoryMethod(methodInfo.method)) {
+        continue;
+      }
       const closeCall = graph.ir.calls.find((c) => CLOSE_METHODS.has(c.method_name) && c.receiver === resourceVar && c.location.line > openLine && c.location.line <= methodEnd);
       const snippet = (codeLines[openLine - 1] ?? "").trim();
       if (!closeCall) {
@@ -26601,6 +26627,39 @@ class ResourceLeakPass {
     }
     return false;
   }
+  isReturnedToCaller(lines, variable, fromLine, toLine) {
+    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex(variable)}\\b`);
+    for (let l = fromLine;l <= toLine && l <= lines.length; l++) {
+      if (varRe.test(lines[l - 1] ?? ""))
+        return true;
+    }
+    return false;
+  }
+  fieldStoredName(lines, variable, openLine, toLine) {
+    const thisAssignRe = new RegExp(`\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex(variable)}\\b`);
+    for (let l = openLine;l <= toLine && l <= lines.length; l++) {
+      const m = thisAssignRe.exec(lines[l - 1] ?? "");
+      if (m)
+        return m[1];
+    }
+    return null;
+  }
+  classHasCloseMethodFor(graph, fieldName, type) {
+    for (const c of graph.ir.calls) {
+      if (c.location.line < type.start_line || c.location.line > type.end_line)
+        continue;
+      if (c.receiver !== fieldName)
+        continue;
+      if (CLOSE_METHODS.has(c.method_name))
+        return true;
+    }
+    return false;
+  }
+  isFactoryMethod(method) {
+    if (!method.return_type || method.return_type === "void")
+      return false;
+    return FACTORY_METHOD_NAME_RE.test(method.name);
+  }
 }
 
 // ../circle-ir/dist/graph/scope-graph.js
@@ -29844,6 +29903,33 @@ function mapReturnValueToCorsRule(returnValue) {
   };
 }
 
+// ../circle-ir/dist/analysis/passes/_fp-allowlists.js
+var PEM_BODY_RE = /[A-Za-z0-9+/]{30,}/;
+function pemHasInlineBody(lines, hitLineIdx) {
+  const end = Math.min(hitLineIdx + 5, lines.length);
+  for (let l = hitLineIdx;l < end; l++) {
+    if (PEM_BODY_RE.test(lines[l] ?? ""))
+      return true;
+  }
+  return false;
+}
+var CLI_OPTION_KEY_RE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)+$/;
+function isCliOptionKeyValue(value) {
+  return value.length <= 48 && CLI_OPTION_KEY_RE.test(value);
+}
+var PROTOCOL_MANDATED_PATH_RE = /(?:^|[\\/])(?:ntlm|kerberos|krb5|smb1?|sasl[\\/]cram-md5?|digest)(?:[\\/]|$)/i;
+var PROTOCOL_MANDATED_CLASS_RE = /\b(?:N[Tt][Ll][Mm](?:Scheme|Engine|AuthHandler|AuthScheme)|Krb5\w+|KerberosClient|Smb\w*Signing|CramMd5\w*|DigestScheme)\b/;
+var PROTOCOL_MANDATED_CITATION_RE = /\b(?:MS-NLMP|RFC\s*4757|RFC\s*3961|RFC\s*2617|RFC\s*2195|CRAM-MD5)\b/i;
+function isProtocolMandatedCryptoFile(file, code) {
+  if (PROTOCOL_MANDATED_PATH_RE.test(file))
+    return true;
+  if (PROTOCOL_MANDATED_CLASS_RE.test(code))
+    return true;
+  if (PROTOCOL_MANDATED_CITATION_RE.test(code))
+    return true;
+  return false;
+}
+
 // ../circle-ir/dist/analysis/passes/scan-secrets-pass.js
 var TEST_PATH_RE3 = /(?:^|[\\/])(?:test|tests|spec|specs|__tests?__|__mocks?__|fixtures?|testdata)(?:[\\/]|$)/i;
 var TEST_FILENAME_RE = /(?:\.(?:test|spec)\.[cm]?[jt]sx?|_test\.go|_test\.py|Test\.java|Tests\.java)$/i;
@@ -30010,6 +30096,8 @@ function isLikelyCredentialAssignment(line) {
     return null;
   if (/^[0-9]+$/.test(value) && value.length < 16)
     return null;
+  if (isCliOptionKeyValue(value))
+    return null;
   return { name: name2, value };
 }
 var STRING_LITERAL_RE = /(["'`])((?:\\.|(?!\1).){8,200})\1/g;
@@ -30216,6 +30304,9 @@ class ScanSecretsPass {
         const m = pattern.regex.exec(lineText);
         if (!m)
           continue;
+        if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
+          continue;
+        }
         const key = `${lineNum}:hardcoded-credential`;
         if (seen.has(key))
           continue;
@@ -31090,6 +31181,9 @@ class WeakCryptoPass {
   run(ctx) {
     const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
+    if (isProtocolMandatedCryptoFile(file, code)) {
+      return { findings: [] };
+    }
     const findings = [];
     const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
     const literalBindings = scanLiteralBindings(code, language);
@@ -31620,8 +31714,11 @@ class WeakPasswordHashPass {
   name = "weak-password-hash";
   category = "security";
   run(ctx) {
-    const { graph, language } = ctx;
+    const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
+    if (isProtocolMandatedCryptoFile(file, code)) {
+      return { findings: [] };
+    }
     const findings = [];
     for (const call of graph.ir.calls) {
       const detection = this.detect(call, language);
@@ -34956,7 +35053,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.102.0";
+var version = "3.104.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.102.0",
+  "version": "3.104.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.102.0"
+    "circle-ir": "^3.104.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",