cognium-dev 3.106.2 → 3.108.0

package/dist/cli.js

@@ -5,7 +5,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 // src/cli.ts
 import { readFileSync, existsSync } from "fs";
 import { stat as stat2, readdir as readdir2 } from "fs/promises";
-import { join as join2, dirname as dirname2, extname, resolve, relative as relative3 } from "path";
+import { join as join2, dirname as dirname3, extname, resolve as resolve2, relative as relative4 } from "path";
 import { createRequire as createRequire2 } from "module";
 
 // ../../node_modules/web-tree-sitter/web-tree-sitter.js
@@ -23657,6 +23657,17 @@ var SQL_BUILDER_WRAPPER_CALL_RE = /\.(?:wrap|quote|escape|identifier)\s*\(/;
 var SQL_EXTRACTION_RETURN_RE = /^(?:String|CharSequence|Optional\s*<\s*String\s*>)$/;
 var SQL_EXTRACTION_NAME_RE = /^(?:get|extract|build).*(?:[Ss]ql|[Qq]uery)|^toSql|.*Statement.*ToString$|.*Query.*String$/;
 var SQL_EXTRACTION_PRIMITIVE_INPUT_RE = /^(?:String|CharSequence)$/;
+var SQL_EXEC_METHODS = new Set([
+  "prepareStatement",
+  "prepareCall",
+  "execute",
+  "executeQuery",
+  "executeUpdate",
+  "executeLargeUpdate",
+  "addBatch"
+]);
+var JAVA_SQL_ASSIGN_RE_TEMPLATE = "\\b(?:String|CharSequence|final\\s+String|var)\\s+SQLVAR\\b\\s*=\\s*(.+?);";
+var JAVA_INLINE_MATCHES_RE = /\.\s*matches\s*\(\s*"((?:[^"\\]|\\.)*)"\s*\)/g;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
     return null;
@@ -23715,6 +23726,116 @@ function findEnclosingMethodFromIr(types, sinkLine) {
   }
   return null;
 }
+function splitJavaConcatTokens(rhs) {
+  const tokens = [];
+  let cur = "";
+  let depth = 0;
+  let inString = false;
+  let i2 = 0;
+  while (i2 < rhs.length) {
+    const ch = rhs[i2] ?? "";
+    if (inString) {
+      cur += ch;
+      if (ch === "\\" && i2 + 1 < rhs.length) {
+        cur += rhs[i2 + 1] ?? "";
+        i2 += 2;
+        continue;
+      }
+      if (ch === '"')
+        inString = false;
+      i2++;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      cur += ch;
+      i2++;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{") {
+      depth++;
+      cur += ch;
+      i2++;
+      continue;
+    }
+    if (ch === ")" || ch === "]" || ch === "}") {
+      depth--;
+      cur += ch;
+      i2++;
+      continue;
+    }
+    if (ch === "+" && depth === 0) {
+      tokens.push(cur.trim());
+      cur = "";
+      i2++;
+      continue;
+    }
+    cur += ch;
+    i2++;
+  }
+  if (cur.trim())
+    tokens.push(cur.trim());
+  return tokens;
+}
+function isImplicitlyAnchoredAllowlistRegex(re) {
+  if (re === "")
+    return false;
+  const stripped = re.replace(/\[(?:[^\]\\]|\\.)*\]/g, "");
+  const cleaned = stripped.replace(/\\./g, "");
+  if (cleaned.includes("."))
+    return false;
+  if (cleaned.includes("|"))
+    return false;
+  return true;
+}
+function findJavaMethodBody(methodName, sourceLines) {
+  if (!/^[A-Za-z_]\w*$/.test(methodName))
+    return null;
+  const sigRe = new RegExp(`\\b(?:public|private|protected|static|final|synchronized|\\s)+[\\w<>?,\\s\\[\\]]+?\\b${methodName}\\s*\\(`);
+  for (let i2 = 0;i2 < sourceLines.length; i2++) {
+    const ln = sourceLines[i2] ?? "";
+    if (!sigRe.test(ln))
+      continue;
+    let braceLine = -1;
+    for (let j = i2;j < Math.min(sourceLines.length, i2 + 4); j++) {
+      if ((sourceLines[j] ?? "").includes("{")) {
+        braceLine = j;
+        break;
+      }
+    }
+    if (braceLine < 0)
+      continue;
+    let depth = 0;
+    const body2 = [];
+    for (let j = braceLine;j < sourceLines.length; j++) {
+      const ln2 = sourceLines[j] ?? "";
+      body2.push(ln2);
+      for (const ch of ln2) {
+        if (ch === "{")
+          depth++;
+        else if (ch === "}")
+          depth--;
+      }
+      if (depth <= 0 && j > braceLine)
+        return body2;
+    }
+    return null;
+  }
+  return null;
+}
+function javaBodyHasInlineRegexAllowlistThrow(bodyLines) {
+  const text = bodyLines.join(`
+`);
+  if (!/\bthrow\s+/.test(text))
+    return false;
+  JAVA_INLINE_MATCHES_RE.lastIndex = 0;
+  let m;
+  while ((m = JAVA_INLINE_MATCHES_RE.exec(text)) !== null) {
+    if (isImplicitlyAnchoredAllowlistRegex(m[1] ?? ""))
+      return true;
+  }
+  return false;
+}
 function isJavaLiteralOrAnnotationAccessor(expr) {
   const e = expr.trim();
   if (e === "")
@@ -23950,6 +24071,24 @@ class SinkFilterPass {
     }
     if (language === "java") {
       const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "xxe")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const receiverMatch = sinkLineText.match(/\b(\w+)\s*\.\s*(\w+)\s*\(/);
+        const receiver = receiverMatch?.[1];
+        const method = sink.method ?? receiverMatch?.[2];
+        if (method === "parse" && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && DATA_PARSER_TYPES.has(recvType))
+            return false;
+        }
+        return true;
+      });
+    }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
 `);
       filtered = filtered.filter((sink) => {
         if (sink.type !== "command_injection")
@@ -24158,6 +24297,67 @@ class SinkFilterPass {
         });
       }
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "sql_injection")
+          return true;
+        const method = sink.method ?? "";
+        if (!SQL_EXEC_METHODS.has(method))
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const callArgs = extractJavaCallArgs(method, sinkLineText);
+        if (!callArgs || callArgs.length === 0)
+          return true;
+        const sqlVar = callArgs[0]?.trim() ?? "";
+        let rhs = null;
+        if (/^[A-Za-z_]\w*$/.test(sqlVar)) {
+          const lo = Math.max(0, sink.line - 31);
+          const assignRe = new RegExp(JAVA_SQL_ASSIGN_RE_TEMPLATE.replace("SQLVAR", sqlVar));
+          for (let i2 = sink.line - 2;i2 >= lo; i2--) {
+            const ln = sourceLines[i2] ?? "";
+            const m = ln.match(assignRe);
+            if (m) {
+              rhs = m[1] ?? null;
+              break;
+            }
+          }
+        } else if (/"[^"]*"/.test(sqlVar) && sqlVar.includes("+")) {
+          rhs = sqlVar;
+        }
+        if (!rhs)
+          return true;
+        const tokens = splitJavaConcatTokens(rhs);
+        if (tokens.length < 2)
+          return true;
+        let hasPlaceholder = false;
+        const methodCallNames = [];
+        for (const tk of tokens) {
+          if (/^"(?:[^"\\]|\\.)*"$/.test(tk)) {
+            if (tk.includes("?"))
+              hasPlaceholder = true;
+            continue;
+          }
+          const callMatch = tk.match(/^([A-Za-z_]\w*)\s*\(/);
+          if (callMatch) {
+            methodCallNames.push(callMatch[1] ?? "");
+            continue;
+          }
+          return true;
+        }
+        if (!hasPlaceholder)
+          return true;
+        if (methodCallNames.length === 0)
+          return true;
+        for (const mname of methodCallNames) {
+          const body2 = findJavaMethodBody(mname, sourceLines);
+          if (body2 && javaBodyHasInlineRegexAllowlistThrow(body2))
+            return false;
+        }
+        return true;
+      });
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 }
@@ -24580,6 +24780,23 @@ class TaintPropagationPass {
         });
       }
     }
+    const setIntervalLines = new Set;
+    for (const s of sinks) {
+      if (s.type === "code_injection" && (s.method === "setInterval" || s.method === "setTimeout")) {
+        setIntervalLines.add(s.line);
+      }
+    }
+    if (setIntervalLines.size > 0) {
+      finalFlows = finalFlows.filter((f) => {
+        if (f.sink_type !== "code_injection")
+          return true;
+        if (f.source_type !== "interprocedural_param")
+          return true;
+        if (!setIntervalLines.has(f.sink_line))
+          return true;
+        return false;
+      });
+    }
     if (finalFlows.length > 1) {
       const bestByKey = new Map;
       for (const f of finalFlows) {
@@ -35373,11 +35590,11 @@ function deriveProjectRoot(paths) {
   return common.join("/") || "/";
 }
 // ../project-profile-detect/dist/index.js
-import { relative as relative2 } from "path";
+import { relative as relative3 } from "path";
 
 // ../project-profile-detect/dist/walk.js
 import { readdir, readFile, stat } from "fs/promises";
-import { join, relative } from "path";
+import { join, relative as relative2 } from "path";
 
 // ../project-profile-detect/dist/maven-parse.js
 var TAG = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "i");
@@ -35403,7 +35620,12 @@ var MAVEN_PLUGIN_MAP = {
   "exec-maven-plugin": "application",
   "maven-assembly-plugin": "application"
 };
+var MAVEN_PUBLISH_PLUGIN_URLS = {
+  "central-publishing-maven-plugin": "https://central.sonatype.com/",
+  "nexus-staging-maven-plugin": "https://oss.sonatype.org/"
+};
 function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
+  const parentRef = extractParentRef(xml);
   const stripped = xml.replace(/<parent\b[\s\S]*?<\/parent>/i, "");
   const groupId = firstTag(stripped, "groupId");
   const artifactId = firstTag(stripped, "artifactId");
@@ -35412,10 +35634,15 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
   const buildBlock = firstTag(xml, "build") ?? "";
   const pluginBlocks = allTags(buildBlock, "plugin");
   const plugins = new Set;
+  const publishUrls = new Set;
   for (const p of pluginBlocks) {
     const aid = firstTag(p, "artifactId");
-    if (aid && MAVEN_PLUGIN_MAP[aid])
+    if (!aid)
+      continue;
+    if (MAVEN_PLUGIN_MAP[aid])
       plugins.add(MAVEN_PLUGIN_MAP[aid]);
+    if (MAVEN_PUBLISH_PLUGIN_URLS[aid])
+      publishUrls.add(MAVEN_PUBLISH_PLUGIN_URLS[aid]);
   }
   if (/<parent\b[\s\S]*?<artifactId>\s*spring-boot-starter-parent\s*<\/artifactId>/i.test(xml)) {
     plugins.add("spring-boot");
@@ -35428,7 +35655,8 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
     plugins.add("maven-plugin");
   const distBlock = firstTag(xml, "distributionManagement") ?? "";
   const urls = [
-    ...allTags(distBlock, "url")
+    ...allTags(distBlock, "url"),
+    ...publishUrls
   ].map((u) => u.trim()).filter(Boolean);
   const signals = {
     ...directorySignals,
@@ -35443,9 +35671,34 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
     groupId,
     artifactId,
     version,
-    signals
+    signals,
+    parentRef
   };
 }
+function extractParentRef(xml) {
+  const block = TAG("parent").exec(xml);
+  if (!block)
+    return;
+  const inner = block[1];
+  const groupId = firstTag(inner, "groupId");
+  const artifactId = firstTag(inner, "artifactId");
+  const version = firstTag(inner, "version");
+  let relativePath;
+  let emptyRelativePath = false;
+  const selfClosing = /<relativePath\b[^>]*\/\s*>/i.test(inner);
+  if (selfClosing) {
+    emptyRelativePath = true;
+  } else {
+    const rp = firstTag(inner, "relativePath");
+    if (rp !== undefined) {
+      if (rp.length === 0)
+        emptyRelativePath = true;
+      else
+        relativePath = rp;
+    }
+  }
+  return { groupId, artifactId, version, relativePath, emptyRelativePath };
+}
 
 // ../project-profile-detect/dist/gradle-parse.js
 var GRADLE_PLUGIN_MAP = {
@@ -35512,6 +35765,70 @@ function parseGradleBuild(text, moduleRoot, buildFile, buildSystem, directorySig
   };
 }
 
+// ../project-profile-detect/dist/maven-inherit.js
+import { dirname as dirname2, isAbsolute, normalize, relative, resolve } from "path";
+var MAX_DEPTH = 6;
+var DEFAULT_RELATIVE_PATH = "../pom.xml";
+function mergeMavenInheritance(modules, scanRoot) {
+  const normalizedScanRoot = normalize(scanRoot);
+  const byBuildFile = new Map;
+  for (const m of modules) {
+    if (m.buildSystem === "maven") {
+      byBuildFile.set(normalize(m.buildFile), m);
+    }
+  }
+  for (const child of modules) {
+    if (child.buildSystem !== "maven")
+      continue;
+    if (!child.parentRef)
+      continue;
+    const inheritedUrls = new Set;
+    const inheritedPlugins = new Set;
+    walkParents(child, byBuildFile, normalizedScanRoot, inheritedUrls, inheritedPlugins);
+    if (inheritedUrls.size === 0 && inheritedPlugins.size === 0)
+      continue;
+    const existingUrls = new Set(child.signals.distributionUrls);
+    for (const u of inheritedUrls) {
+      if (!existingUrls.has(u))
+        child.signals.distributionUrls.push(u);
+    }
+    const existingPlugins = new Set(child.signals.plugins);
+    for (const p of inheritedPlugins) {
+      if (!existingPlugins.has(p))
+        child.signals.plugins.push(p);
+    }
+  }
+}
+function walkParents(start2, byBuildFile, scanRoot, outUrls, outPlugins) {
+  const visited = new Set([normalize(start2.buildFile)]);
+  let current = start2;
+  for (let depth = 0;depth < MAX_DEPTH; depth++) {
+    const ref = current.parentRef;
+    if (!ref)
+      return;
+    if (ref.emptyRelativePath)
+      return;
+    const childDir = dirname2(current.buildFile);
+    const rel = ref.relativePath ?? DEFAULT_RELATIVE_PATH;
+    const candidateAbs = normalize(isAbsolute(rel) ? rel : resolve(childDir, rel));
+    const parentBuildFile = candidateAbs.endsWith("pom.xml") ? candidateAbs : normalize(resolve(candidateAbs, "pom.xml"));
+    const relToRoot = relative(scanRoot, parentBuildFile);
+    if (relToRoot.startsWith("..") || isAbsolute(relToRoot))
+      return;
+    if (visited.has(parentBuildFile))
+      return;
+    visited.add(parentBuildFile);
+    const parent = byBuildFile.get(parentBuildFile);
+    if (!parent)
+      return;
+    for (const u of parent.signals.distributionUrls)
+      outUrls.add(u);
+    for (const p of parent.signals.plugins)
+      outPlugins.add(p);
+    current = parent;
+  }
+}
+
 // ../project-profile-detect/dist/walk.js
 var BUILD_FILES = ["pom.xml", "build.gradle", "build.gradle.kts"];
 var SKIP_DIRS = new Set([
@@ -35532,6 +35849,7 @@ var SKIP_DIRS = new Set([
 async function discoverBuildModules(scanRoot) {
   const modules = [];
   await walk(scanRoot, modules);
+  mergeMavenInheritance(modules, scanRoot);
   return modules;
 }
 async function walk(dir, out2) {
@@ -35739,6 +36057,10 @@ function resolveShape(mod) {
     reasons.push(...libSignals, "no public-registry distribution (internal helper)");
     return { shape: "application", reasons };
   }
+  if (isPubliclyPublished(sig.distributionUrls)) {
+    reasons.push("public-registry distribution", "no application/server/plugin signals → implicit library");
+    return { shape: "library", reasons };
+  }
   reasons.push("no shape signals");
   return { shape: "unknown", reasons };
 }
@@ -35826,7 +36148,7 @@ async function detectProjectProfiles(scanRoot, options = {}) {
   const profileByFile = new Map;
   const unknownFiles = [];
   for (const file of files) {
-    const rel = relative2(scanRoot, file);
+    const rel = relative3(scanRoot, file);
     const ov = applyOverrides(rel, compiledOverrides);
     if (ov) {
       profileByFile.set(file, ov.profile);
@@ -35878,7 +36200,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.106.1";
+var version = "3.108.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -36679,7 +37001,7 @@ function applySuppressionsToResults(results, suppressions, basePath) {
   if (suppressions.length === 0)
     return results;
   return results.map((result) => {
-    const relativeFile = relative3(basePath, result.file) || result.file;
+    const relativeFile = relative4(basePath, result.file) || result.file;
     const filteredVulns = result.vulnerabilities.filter((vuln) => {
       for (const supp of suppressions) {
         if (supp.pass !== vuln.type)
@@ -36768,7 +37090,7 @@ async function collectFiles(targetPath, options = {}) {
       return files;
     }
     if (fileMatchesLanguage(targetPath, language)) {
-      const relativePath = basePath ? relative3(basePath, targetPath) : targetPath;
+      const relativePath = basePath ? relative4(basePath, targetPath) : targetPath;
       if (includePatterns && includePatterns.length > 0) {
         if (!matchesAnyPattern(relativePath, includePatterns)) {
           return files;
@@ -36787,7 +37109,7 @@ async function collectFiles(targetPath, options = {}) {
       if (excludeTests && /^(test|tests|__tests__|spec|__mocks__)$/i.test(entry.name))
         continue;
       const fullPath = join2(targetPath, entry.name);
-      const relativePath = basePath ? relative3(basePath, fullPath) : fullPath;
+      const relativePath = basePath ? relative4(basePath, fullPath) : fullPath;
       if (excludePatterns && entry.isDirectory()) {
         const dirPattern = relativePath + "/";
         if (excludePatterns.some((p) => matchesGlob(dirPattern, p) || matchesGlob(relativePath, p))) {
@@ -36885,14 +37207,14 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
 async function initWasm(spin) {
   const isStandalone = import.meta.url.includes("/$bunfs/");
   if (isStandalone) {
-    const { dirname: dirname3, join: join3 } = await import("path");
-    const binaryDir = dirname3(process.execPath);
+    const { dirname: dirname4, join: join3 } = await import("path");
+    const binaryDir = dirname4(process.execPath);
     const cwd = process.cwd();
     let scriptDir = null;
     if (!import.meta.url.includes("/$bunfs/")) {
       try {
         const { fileURLToPath } = await import("url");
-        scriptDir = dirname3(fileURLToPath(import.meta.url));
+        scriptDir = dirname4(fileURLToPath(import.meta.url));
       } catch {}
     }
     const wasmLocations = [
@@ -36945,7 +37267,7 @@ Please ensure the wasm/ directory is located next to the binary or in your curre
   } else {
     const require2 = createRequire2(import.meta.url);
     const circleIrPkg = require2.resolve("circle-ir/package.json");
-    const wasmBasePath = join2(dirname2(circleIrPkg), "dist", "wasm") + "/";
+    const wasmBasePath = join2(dirname3(circleIrPkg), "dist", "wasm") + "/";
     await initAnalyzer({
       wasmPath: wasmBasePath + "web-tree-sitter.wasm",
       languagePaths: {
@@ -36974,7 +37296,7 @@ function buildProfileSummary(scanRoot, modules, resolvedProfiles) {
   return {
     scanRoot,
     modules: modules.map((m) => ({
-      root: relative3(scanRoot, m.module.root) || ".",
+      root: relative4(scanRoot, m.module.root) || ".",
       profile: m.profile,
       reasons: m.reasons,
       buildSystem: m.module.buildSystem
@@ -37003,9 +37325,9 @@ function printProfileExplain(scanRoot, detection) {
     out2.push("  (no pom.xml, build.gradle, or build.gradle.kts found)");
   } else {
     for (const r of detection.modules) {
-      const rel = relative3(scanRoot, r.module.root) || ".";
+      const rel = relative4(scanRoot, r.module.root) || ".";
       out2.push(`  ${colors.cyan(rel || ".")}  →  ${colors.bold(r.profile)}`);
-      out2.push(`     build: ${r.module.buildSystem}  (${relative3(scanRoot, r.module.buildFile)})`);
+      out2.push(`     build: ${r.module.buildSystem}  (${relative4(scanRoot, r.module.buildFile)})`);
       if (r.module.artifactId) {
         out2.push(`     coords: ${r.module.groupId ?? "?"}:${r.module.artifactId}:${r.module.version ?? "?"}`);
       }
@@ -37050,7 +37372,7 @@ async function runScan(targetPath, options) {
     await initWasm(spin);
     if (spin)
       spin.text = "Collecting files...";
-    const absPath = resolve(targetPath);
+    const absPath = resolve2(targetPath);
     if (!existsSync(absPath)) {
       if (spin)
         spin.fail(`Path not found: ${absPath}`);
@@ -37114,7 +37436,7 @@ async function runScan(targetPath, options) {
       results = [];
       let processed = 0;
       const formatCurrentFile = (file) => {
-        const rel = relative3(absPath, file) || file;
+        const rel = relative4(absPath, file) || file;
         return rel.length > 80 ? `...${rel.slice(-77)}` : rel;
       };
       const concurrency = options.threads;
@@ -37290,7 +37612,7 @@ async function runMetrics(targetPath, options) {
     await initWasm(spin);
     if (spin)
       spin.text = "Collecting files...";
-    const absPath = resolve(targetPath);
+    const absPath = resolve2(targetPath);
     if (!existsSync(absPath)) {
       if (spin)
         spin.fail(`Path not found: ${absPath}`);
@@ -37318,7 +37640,7 @@ async function runMetrics(targetPath, options) {
         continue;
       }
       if (spin) {
-        const rel = relative3(absPath, file) || file;
+        const rel = relative4(absPath, file) || file;
         const maxLen = 80;
         const label = rel.length > maxLen ? `...${rel.slice(-(maxLen - 3))}` : rel;
         spin.text = `Analyzing ${label}... (${processed}/${totalFiles})`;
@@ -37363,7 +37685,7 @@ async function runMetrics(targetPath, options) {
     } else {
       const lines = [];
       for (const fm of filtered) {
-        const rel = relative3(absPath, fm.file) || fm.file;
+        const rel = relative4(absPath, fm.file) || fm.file;
         lines.push(rel);
         const byCategory = new Map;
         for (const m of fm.metrics) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.106.2",
+  "version": "3.108.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.106.0"
+    "circle-ir": "^3.108.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",