cognium-dev 3.103.0 → 3.105.0

package/dist/cli.js

@@ -18060,6 +18060,18 @@ function isHighConfidence(finding) {
   return finding.confidence === undefined || finding.confidence === "high";
 }
 
+// ../circle-ir/dist/analysis/library-api-surface-downgrade.js
+var LIBRARY_API_SURFACE_TAG = "library-api-surface:caller-responsibility";
+function applyLibraryApiSurfaceDowngrade(findings) {
+  return findings.map((f) => {
+    if (!f.tags?.includes(LIBRARY_API_SURFACE_TAG))
+      return f;
+    if (f.severity === "medium" || f.severity === "low")
+      return f;
+    return { ...f, severity: "medium", level: "warning" };
+  });
+}
+
 // ../circle-ir/dist/languages/registry.js
 class DefaultLanguageRegistry {
   plugins = new Map;
@@ -23545,6 +23557,39 @@ var PROTOCOL_CLIENT_PACKAGES = [
 var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
 var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
 var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b/;
+var JEXL_ENGINE_TYPES = new Set(["JexlEngine", "Jexl", "JxltEngine"]);
+var JEXL_EXPRESSION_TYPE_RE = /(?:Jexl)?(?:Expression|Script|Template)(?:Script)?$/;
+var TEMPLATE_COMPILE_RECEIVER_TYPES = new Set([
+  "Handlebars",
+  "Mustache",
+  "MustacheFactory",
+  "DefaultMustacheFactory",
+  "Pebble",
+  "PebbleEngine",
+  "PebbleEngineBuilder",
+  "VelocityEngine",
+  "Velocity",
+  "Configuration",
+  "Freemarker",
+  "FreeMarker",
+  "TemplateEngine",
+  "SpringTemplateEngine",
+  "Thymeleaf"
+]);
+var SPI_GET_RESOURCES_RE = /\.getResources\s*\(\s*["'][^"']*META-INF\/services\/[^"']*["']\s*\)/;
+var CLASSLOADER_PARENT_TYPES = new Set([
+  "ClassLoader",
+  "URLClassLoader",
+  "SecureClassLoader"
+]);
+var CLASSLOADER_NAME_RE = /(?:CachingProvider|ClassLoader|SpiLoader)$/;
+var LOADCLASS_OVERRIDE_METHOD_RE = /\b(?:public|protected)\s+(?:[\w<>?,\s]+\s+)?(?:loadClass|findClass)\s*\(\s*String\b/;
+var JAVA_CLASS_DECL_RE = /\bclass\s+([A-Z]\w*)\b(?:\s+extends\s+([A-Z][\w.]*))?(?:\s+implements\s+([A-Z][\w.,<>\s?]*))?/;
+var SQL_BUILDER_CLASS_RE = /(?:Dialect|SqlBuilder|Quoter|Wrapper|SqlGenerator|QueryBuilder)$/;
+var SQL_BUILDER_WRAPPER_CALL_RE = /\.(?:wrap|quote|escape|identifier)\s*\(/;
+var SQL_EXTRACTION_RETURN_RE = /^(?:String|CharSequence|Optional\s*<\s*String\s*>)$/;
+var SQL_EXTRACTION_NAME_RE = /^(?:get|extract|build).*(?:[Ss]ql|[Qq]uery)|^toSql|.*Statement.*ToString$|.*Query.*String$/;
+var SQL_EXTRACTION_PRIMITIVE_INPUT_RE = /^(?:String|CharSequence)$/;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
     return null;
@@ -23561,6 +23606,48 @@ function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   }
   return null;
 }
+function findEnclosingClassDecl(sinkLine, sourceLines) {
+  const end = Math.min(sourceLines.length, sinkLine);
+  for (let i2 = end - 1;i2 >= 0; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(JAVA_CLASS_DECL_RE);
+    if (!m)
+      continue;
+    const implementsTypes = m[3] ? m[3].split(",").map((s) => s.replace(/<[^>]*>/g, "").trim()).filter(Boolean).map((s) => {
+      const parts2 = s.split(".");
+      return parts2[parts2.length - 1] ?? s;
+    }) : [];
+    const extendsRaw = m[2] ?? null;
+    const extendsType = extendsRaw ? (() => {
+      const p = extendsRaw.split(".");
+      return p[p.length - 1] ?? extendsRaw;
+    })() : null;
+    return { name: m[1], extendsType, implementsTypes };
+  }
+  return null;
+}
+function isInsideLoadClassOverride(sinkLine, sourceLines) {
+  const limit = Math.max(0, sinkLine - 200);
+  for (let i2 = sinkLine - 2;i2 >= limit; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    if (LOADCLASS_OVERRIDE_METHOD_RE.test(ln))
+      return true;
+    if (/\bclass\s+[A-Z]\w*\b/.test(ln))
+      return false;
+  }
+  return false;
+}
+function findEnclosingMethodFromIr(types, sinkLine) {
+  for (const t of types) {
+    if (sinkLine < t.start_line || sinkLine > t.end_line)
+      continue;
+    for (const m of t.methods) {
+      if (sinkLine >= m.start_line && sinkLine <= m.end_line)
+        return m;
+    }
+  }
+  return null;
+}
 function isJavaLiteralOrAnnotationAccessor(expr) {
   const e = expr.trim();
   if (e === "")
@@ -23842,6 +23929,168 @@ class SinkFilterPass {
         return true;
       });
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      for (const sink of filtered) {
+        if (sink.type !== "code_injection")
+          continue;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const receiverMatch = sinkLineText.match(/\b(\w+)\s*\.\s*(\w+)\s*\(/);
+        const receiver = receiverMatch?.[1];
+        const method = sink.method ?? receiverMatch?.[2];
+        let shouldTag = false;
+        if (method === "createExpression" && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && JEXL_ENGINE_TYPES.has(recvType))
+            shouldTag = true;
+        }
+        if (!shouldTag && method === "evaluate" && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && JEXL_EXPRESSION_TYPE_RE.test(recvType))
+            shouldTag = true;
+        }
+        if (!shouldTag && method === "compile" && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && TEMPLATE_COMPILE_RECEIVER_TYPES.has(recvType))
+            shouldTag = true;
+        }
+        if (!shouldTag && method === "forName") {
+          const start2 = Math.max(0, sink.line - 31);
+          const end = Math.min(sourceLines.length, sink.line + 30);
+          for (let i2 = start2;i2 < end; i2++) {
+            if (SPI_GET_RESOURCES_RE.test(sourceLines[i2] ?? "")) {
+              shouldTag = true;
+              break;
+            }
+          }
+        }
+        if (!shouldTag && method && (method === "loadClass" || method === "findClass" || method === "forName")) {
+          const enclosing = findEnclosingClassDecl(sink.line, sourceLines);
+          if (enclosing) {
+            const extendsClassLoader = enclosing.extendsType !== null && CLASSLOADER_PARENT_TYPES.has(enclosing.extendsType);
+            const implementsSpi = enclosing.implementsTypes.some((t) => /CachingProvider$/.test(t));
+            const nameLooksLikeLoader = CLASSLOADER_NAME_RE.test(enclosing.name);
+            if (extendsClassLoader || implementsSpi || nameLooksLikeLoader)
+              shouldTag = true;
+          }
+          if (!shouldTag && isInsideLoadClassOverride(sink.line, sourceLines)) {
+            shouldTag = true;
+          }
+        }
+        if (shouldTag) {
+          const existing = sink.tags ?? [];
+          if (!existing.includes(LIBRARY_API_SURFACE_TAG)) {
+            sink.tags = [...existing, LIBRARY_API_SURFACE_TAG];
+          }
+        }
+      }
+    }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "code_injection")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const receiverMatch = sinkLineText.match(/\b(\w+)\s*\.\s*(\w+)\s*\(/);
+        const receiver = receiverMatch?.[1];
+        if (!receiver)
+          return true;
+        const start2 = Math.max(0, sink.line - 200);
+        let arrayName = null;
+        const foreachRe = new RegExp(`\\bfor\\s*\\(\\s*\\w[\\w<>?]*\\s+${receiver}\\s*:\\s*(\\w+)\\b`);
+        for (let i2 = sink.line - 1;i2 >= start2; i2--) {
+          const ln = sourceLines[i2] ?? "";
+          const fm = ln.match(foreachRe);
+          if (fm) {
+            arrayName = fm[1];
+            break;
+          }
+        }
+        if (!arrayName) {
+          const methodNameMatch = sinkLineText.match(/\.(\w+)\s*\(/);
+          const methodNameRe = methodNameMatch ? methodNameMatch[1] : "\\w+";
+          const idxRe = new RegExp(`\\b(\\w+)\\s*\\[[^\\]]+\\]\\s*\\.\\s*${methodNameRe}\\s*\\(`);
+          const im = sinkLineText.match(idxRe);
+          if (im)
+            arrayName = im[1];
+        }
+        if (!arrayName)
+          return true;
+        const declRe = new RegExp(`\\bprivate\\s+static\\s+final\\s+(?:[\\w<>?,\\s]+)\\[\\s*\\]\\s+${arrayName}\\s*=`);
+        let declStart = -1;
+        for (let i2 = 0;i2 < sink.line; i2++) {
+          if (declRe.test(sourceLines[i2] ?? "")) {
+            declStart = i2;
+            break;
+          }
+        }
+        if (declStart < 0)
+          return true;
+        let body2 = "";
+        for (let i2 = declStart;i2 < Math.min(sourceLines.length, declStart + 40); i2++) {
+          body2 += (sourceLines[i2] ?? "") + `
+`;
+          if (/\}\s*;/.test(sourceLines[i2] ?? ""))
+            break;
+        }
+        const initMatch = body2.match(/=\s*(?:new\s+[\w<>?,\s]+\[\s*\]\s*)?\{([\s\S]*?)\}\s*;/);
+        if (!initMatch)
+          return true;
+        const elements = initMatch[1].split(",").map((s) => s.trim()).filter(Boolean);
+        if (elements.length === 0)
+          return true;
+        const allNewLiterals = elements.every((e) => /^new\s+[A-Z]\w*\s*\([^)]*\)$/.test(e));
+        if (allNewLiterals)
+          return false;
+        return true;
+      });
+    }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "sql_injection")
+          return true;
+        const enclosing = findEnclosingClassDecl(sink.line, sourceLines);
+        if (!enclosing)
+          return true;
+        if (!SQL_BUILDER_CLASS_RE.test(enclosing.name))
+          return true;
+        const lo = Math.max(0, sink.line - 11);
+        const hi = Math.min(sourceLines.length, sink.line + 10);
+        for (let i2 = lo;i2 < hi; i2++) {
+          if (SQL_BUILDER_WRAPPER_CALL_RE.test(sourceLines[i2] ?? ""))
+            return false;
+        }
+        return true;
+      });
+    }
+    if (language === "java") {
+      const types = graph.ir.types ?? [];
+      if (types.length > 0) {
+        filtered = filtered.filter((sink) => {
+          if (sink.type !== "sql_injection")
+            return true;
+          const enclosing = findEnclosingMethodFromIr(types, sink.line);
+          if (!enclosing)
+            return true;
+          const ret = (enclosing.return_type ?? "").replace(/\s+/g, " ").trim();
+          if (!SQL_EXTRACTION_RETURN_RE.test(ret))
+            return true;
+          if (!SQL_EXTRACTION_NAME_RE.test(enclosing.name))
+            return true;
+          const firstParamType = enclosing.parameters[0]?.type ?? null;
+          if (firstParamType === null)
+            return true;
+          const simpleType = firstParamType.replace(/<[^>]*>/g, "").trim();
+          if (SQL_EXTRACTION_PRIMITIVE_INPUT_RE.test(simpleType))
+            return true;
+          return false;
+        });
+      }
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 }
@@ -29903,6 +30152,33 @@ function mapReturnValueToCorsRule(returnValue) {
   };
 }
 
+// ../circle-ir/dist/analysis/passes/_fp-allowlists.js
+var PEM_BODY_RE = /[A-Za-z0-9+/]{30,}/;
+function pemHasInlineBody(lines, hitLineIdx) {
+  const end = Math.min(hitLineIdx + 5, lines.length);
+  for (let l = hitLineIdx;l < end; l++) {
+    if (PEM_BODY_RE.test(lines[l] ?? ""))
+      return true;
+  }
+  return false;
+}
+var CLI_OPTION_KEY_RE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)+$/;
+function isCliOptionKeyValue(value) {
+  return value.length <= 48 && CLI_OPTION_KEY_RE.test(value);
+}
+var PROTOCOL_MANDATED_PATH_RE = /(?:^|[\\/])(?:ntlm|kerberos|krb5|smb1?|sasl[\\/]cram-md5?|digest)(?:[\\/]|$)/i;
+var PROTOCOL_MANDATED_CLASS_RE = /\b(?:N[Tt][Ll][Mm](?:Scheme|Engine|AuthHandler|AuthScheme)|Krb5\w+|KerberosClient|Smb\w*Signing|CramMd5\w*|DigestScheme)\b/;
+var PROTOCOL_MANDATED_CITATION_RE = /\b(?:MS-NLMP|RFC\s*4757|RFC\s*3961|RFC\s*2617|RFC\s*2195|CRAM-MD5)\b/i;
+function isProtocolMandatedCryptoFile(file, code) {
+  if (PROTOCOL_MANDATED_PATH_RE.test(file))
+    return true;
+  if (PROTOCOL_MANDATED_CLASS_RE.test(code))
+    return true;
+  if (PROTOCOL_MANDATED_CITATION_RE.test(code))
+    return true;
+  return false;
+}
+
 // ../circle-ir/dist/analysis/passes/scan-secrets-pass.js
 var TEST_PATH_RE3 = /(?:^|[\\/])(?:test|tests|spec|specs|__tests?__|__mocks?__|fixtures?|testdata)(?:[\\/]|$)/i;
 var TEST_FILENAME_RE = /(?:\.(?:test|spec)\.[cm]?[jt]sx?|_test\.go|_test\.py|Test\.java|Tests\.java)$/i;
@@ -30069,6 +30345,8 @@ function isLikelyCredentialAssignment(line) {
     return null;
   if (/^[0-9]+$/.test(value) && value.length < 16)
     return null;
+  if (isCliOptionKeyValue(value))
+    return null;
   return { name: name2, value };
 }
 var STRING_LITERAL_RE = /(["'`])((?:\\.|(?!\1).){8,200})\1/g;
@@ -30275,6 +30553,9 @@ class ScanSecretsPass {
         const m = pattern.regex.exec(lineText);
         if (!m)
           continue;
+        if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
+          continue;
+        }
         const key = `${lineNum}:hardcoded-credential`;
         if (seen.has(key))
           continue;
@@ -31149,6 +31430,9 @@ class WeakCryptoPass {
   run(ctx) {
     const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
+    if (isProtocolMandatedCryptoFile(file, code)) {
+      return { findings: [] };
+    }
     const findings = [];
     const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
     const literalBindings = scanLiteralBindings(code, language);
@@ -31679,8 +31963,11 @@ class WeakPasswordHashPass {
   name = "weak-password-hash";
   category = "security";
   run(ctx) {
-    const { graph, language } = ctx;
+    const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
+    if (isProtocolMandatedCryptoFile(file, code)) {
+      return { findings: [] };
+    }
     const findings = [];
     for (const call of graph.ir.calls) {
       const detection = this.detect(call, language);
@@ -34824,6 +35111,21 @@ async function analyze(code, filePath, language, options = {}) {
       flows: interProc.additionalFlows,
       interprocedural: interProc.interprocedural
     };
+    if (taint.flows && taint.flows.length > 0 && taint.sinks.length > 0) {
+      const sinkTagsByKey = new Map;
+      for (const s of taint.sinks) {
+        if (!s.tags || s.tags.length === 0)
+          continue;
+        sinkTagsByKey.set(`${s.line}:${s.type}`, s.tags);
+      }
+      if (sinkTagsByKey.size > 0) {
+        for (const f of taint.flows) {
+          const tags = sinkTagsByKey.get(`${f.sink_line}:${f.sink_type}`);
+          if (tags && !f.tags)
+            f.tags = [...tags];
+        }
+      }
+    }
     const unresolved = detectUnresolved(calls, types, dfg);
     const enriched = buildEnriched(types, calls, taint.sources, taint.sinks);
     const metricValues = new MetricRunner().run({ meta, types, calls, cfg, dfg, taint, imports, exports, unresolved, enriched }, code, language);
@@ -34836,7 +35138,8 @@ async function analyze(code, filePath, language, options = {}) {
     });
     emitFindingsInstrumentation(filePath, findings, taint);
     const verifiedFindings = applyConfidenceFilter(findings, options.includeSpeculative === true);
-    const cappedFindings = applyPerFileFindingCap(filePath, verifiedFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
+    const downgradedFindings = applyLibraryApiSurfaceDowngrade(verifiedFindings);
+    const cappedFindings = applyPerFileFindingCap(filePath, downgradedFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
     return {
       meta,
       types,
@@ -35015,9 +35318,17 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.103.0";
+var version = "3.105.0";
 
 // src/formatters.ts
+var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
+function applyTagSeverityDowngrade(severity, tags) {
+  if (!tags || !tags.includes(LIBRARY_API_SURFACE_TAG2))
+    return severity;
+  if (severity === "critical" || severity === "high")
+    return "medium";
+  return severity;
+}
 var SINK_SEVERITY = {
   sql_injection: "critical",
   nosql_injection: "high",
@@ -35359,7 +35670,8 @@ function formatResults(results, verbose, crossFileData) {
       const cweTag = vuln.cwe ? ` [${vuln.cwe}]` : "";
       const severityUpper = vuln.severity.charAt(0).toUpperCase() + vuln.severity.slice(1);
       const categoryTag = vuln.category && vuln.category !== "security" ? ` [${vuln.category}]` : "";
-      lines.push(`  ${colorFn(`[${icon}]`)} ${colorFn(vuln.type)} (${severityUpper})${cweTag}${categoryTag}`);
+      const libraryApiTag = vuln.tags?.includes(LIBRARY_API_SURFACE_TAG2) ? ` ${colors.cyan("[library-api-surface]")}` : "";
+      lines.push(`  ${colorFn(`[${icon}]`)} ${colorFn(vuln.type)} (${severityUpper})${cweTag}${categoryTag}${libraryApiTag}`);
       lines.push(`      Line ${vuln.line}: ${vuln.message}`);
       const help = VULNERABILITY_HELP[vuln.type];
       const fixText = vuln.fix ?? help?.fix;
@@ -35484,7 +35796,8 @@ function generateSarifResults(results, crossFileData) {
         properties: {
           cwe: vuln.cwe,
           severity: vuln.severity,
-          ...vuln.fix ? { fix: vuln.fix } : {}
+          ...vuln.fix ? { fix: vuln.fix } : {},
+          ...vuln.tags && vuln.tags.length > 0 ? { tags: vuln.tags } : {}
         }
       });
     }
@@ -35911,11 +36224,12 @@ async function scanFile(filePath, language, analyzeOpts) {
     });
     const vulnerabilities = (result.taint.flows || []).map((flow) => ({
       type: flow.sink_type,
-      severity: SINK_SEVERITY[flow.sink_type] ?? "high",
+      severity: applyTagSeverityDowngrade(SINK_SEVERITY[flow.sink_type] ?? "high", flow.tags),
       message: `${flow.sink_type} vulnerability: tainted data flows from line ${flow.source_line} to line ${flow.sink_line}`,
       line: flow.sink_line,
       cwe: SINK_CWE[flow.sink_type],
-      category: "security"
+      category: "security",
+      ...flow.tags && flow.tags.length > 0 ? { tags: [...flow.tags] } : {}
     }));
     for (const finding of result.findings ?? []) {
       vulnerabilities.push({
@@ -35925,7 +36239,8 @@ async function scanFile(filePath, language, analyzeOpts) {
         line: finding.line,
         cwe: finding.cwe,
         fix: finding.fix,
-        category: finding.category ?? "reliability"
+        category: finding.category ?? "reliability",
+        ...finding.tags && finding.tags.length > 0 ? { tags: [...finding.tags] } : {}
       });
     }
     return { file: filePath, vulnerabilities };
@@ -35951,11 +36266,12 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
   const results = projectResult.files.map(({ file, analysis }) => {
     const vulnerabilities = (analysis.taint.flows || []).map((flow) => ({
       type: flow.sink_type,
-      severity: SINK_SEVERITY[flow.sink_type] ?? "high",
+      severity: applyTagSeverityDowngrade(SINK_SEVERITY[flow.sink_type] ?? "high", flow.tags),
       message: `${flow.sink_type} vulnerability: tainted data flows from line ${flow.source_line} to line ${flow.sink_line}`,
       line: flow.sink_line,
       cwe: SINK_CWE[flow.sink_type],
-      category: "security"
+      category: "security",
+      ...flow.tags && flow.tags.length > 0 ? { tags: [...flow.tags] } : {}
     }));
     for (const finding of analysis.findings ?? []) {
       vulnerabilities.push({
@@ -35965,7 +36281,8 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
         line: finding.line,
         cwe: finding.cwe,
         fix: finding.fix,
-        category: finding.category ?? "reliability"
+        category: finding.category ?? "reliability",
+        ...finding.tags && finding.tags.length > 0 ? { tags: [...finding.tags] } : {}
       });
     }
     return { file, vulnerabilities };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.103.0",
+  "version": "3.105.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.103.0"
+    "circle-ir": "^3.105.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",