cognium-dev 3.103.0 → 3.104.0

package/dist/cli.js

@@ -29903,6 +29903,33 @@ function mapReturnValueToCorsRule(returnValue) {
   };
 }
 
+// ../circle-ir/dist/analysis/passes/_fp-allowlists.js
+var PEM_BODY_RE = /[A-Za-z0-9+/]{30,}/;
+function pemHasInlineBody(lines, hitLineIdx) {
+  const end = Math.min(hitLineIdx + 5, lines.length);
+  for (let l = hitLineIdx;l < end; l++) {
+    if (PEM_BODY_RE.test(lines[l] ?? ""))
+      return true;
+  }
+  return false;
+}
+var CLI_OPTION_KEY_RE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)+$/;
+function isCliOptionKeyValue(value) {
+  return value.length <= 48 && CLI_OPTION_KEY_RE.test(value);
+}
+var PROTOCOL_MANDATED_PATH_RE = /(?:^|[\\/])(?:ntlm|kerberos|krb5|smb1?|sasl[\\/]cram-md5?|digest)(?:[\\/]|$)/i;
+var PROTOCOL_MANDATED_CLASS_RE = /\b(?:N[Tt][Ll][Mm](?:Scheme|Engine|AuthHandler|AuthScheme)|Krb5\w+|KerberosClient|Smb\w*Signing|CramMd5\w*|DigestScheme)\b/;
+var PROTOCOL_MANDATED_CITATION_RE = /\b(?:MS-NLMP|RFC\s*4757|RFC\s*3961|RFC\s*2617|RFC\s*2195|CRAM-MD5)\b/i;
+function isProtocolMandatedCryptoFile(file, code) {
+  if (PROTOCOL_MANDATED_PATH_RE.test(file))
+    return true;
+  if (PROTOCOL_MANDATED_CLASS_RE.test(code))
+    return true;
+  if (PROTOCOL_MANDATED_CITATION_RE.test(code))
+    return true;
+  return false;
+}
+
 // ../circle-ir/dist/analysis/passes/scan-secrets-pass.js
 var TEST_PATH_RE3 = /(?:^|[\\/])(?:test|tests|spec|specs|__tests?__|__mocks?__|fixtures?|testdata)(?:[\\/]|$)/i;
 var TEST_FILENAME_RE = /(?:\.(?:test|spec)\.[cm]?[jt]sx?|_test\.go|_test\.py|Test\.java|Tests\.java)$/i;
@@ -30069,6 +30096,8 @@ function isLikelyCredentialAssignment(line) {
     return null;
   if (/^[0-9]+$/.test(value) && value.length < 16)
     return null;
+  if (isCliOptionKeyValue(value))
+    return null;
   return { name: name2, value };
 }
 var STRING_LITERAL_RE = /(["'`])((?:\\.|(?!\1).){8,200})\1/g;
@@ -30275,6 +30304,9 @@ class ScanSecretsPass {
         const m = pattern.regex.exec(lineText);
         if (!m)
           continue;
+        if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
+          continue;
+        }
         const key = `${lineNum}:hardcoded-credential`;
         if (seen.has(key))
           continue;
@@ -31149,6 +31181,9 @@ class WeakCryptoPass {
   run(ctx) {
     const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
+    if (isProtocolMandatedCryptoFile(file, code)) {
+      return { findings: [] };
+    }
     const findings = [];
     const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
     const literalBindings = scanLiteralBindings(code, language);
@@ -31679,8 +31714,11 @@ class WeakPasswordHashPass {
   name = "weak-password-hash";
   category = "security";
   run(ctx) {
-    const { graph, language } = ctx;
+    const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
+    if (isProtocolMandatedCryptoFile(file, code)) {
+      return { findings: [] };
+    }
     const findings = [];
     for (const call of graph.ir.calls) {
       const detection = this.detect(call, language);
@@ -35015,7 +35053,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.103.0";
+var version = "3.104.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.103.0",
+  "version": "3.104.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.103.0"
+    "circle-ir": "^3.104.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",