cognium-dev 3.108.0 → 3.112.0

package/dist/cli.js

@@ -10510,10 +10510,15 @@ var DEFAULT_SINKS = [
   { method: "bash", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "shell", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "sh", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "spawn", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  { method: "spawn", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "spawnSync", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "execFile", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "execFileSync", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "fork", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "popen", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "system", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  { method: "command", class: "execa", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  { method: "commandSync", class: "execa", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "setCommandline", class: "DefaultExecutor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "parse", class: "CommandLine", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "addArgument", class: "CommandLine", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
@@ -11046,7 +11051,17 @@ var DEFAULT_SINKS = [
   { method: "execute", class: "Pool", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "all", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "run", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
+  { method: "bypassSecurityTrustHtml", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustScript", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustStyle", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustUrl", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustResourceUrl", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "send", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "end", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -11057,6 +11072,8 @@ var DEFAULT_SINKS = [
   { method: "runInContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInNewContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInThisContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
+  { method: "Script", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "setImmediate", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "parse", class: "protobuf", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "parse", class: "protobufjs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "parse", class: "Root", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -11102,6 +11119,8 @@ var DEFAULT_SINKS = [
   { method: "request", class: "needle", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "get", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "request", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "get", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "default", class: "node-fetch", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
@@ -11211,6 +11230,8 @@ var DEFAULT_SINKS = [
   { method: "delete_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   { method: "delete_many", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
+  { method: "find", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "aggregate", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "find_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "update_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
   { method: "update_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
@@ -11221,18 +11242,24 @@ var DEFAULT_SINKS = [
   { method: "from_string", class: "Template", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "jinja2", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "mako", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
-  { method: "info", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "warning", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1] },
-  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "info", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warning", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warn", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "fatal", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "exception", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "log", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
+  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warn", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "fatal", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
+  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
   { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "step", class: "StepExecution", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "invokeMethod", class: "Script", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
@@ -11663,10 +11690,61 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sourceLines = code !== undefined ? code.split(`
 `) : undefined;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
-  const sinks = findSinks(calls, config.sinks, typeHierarchy, language, sourceLines);
+  const sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
+function expandPromisifyAliases(patterns, sourceLines, language) {
+  if (!sourceLines || sourceLines.length === 0)
+    return patterns;
+  if (language !== "javascript" && language !== "typescript")
+    return patterns;
+  const PROMISIFY_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:util\s*\.\s*)?promisify\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
+  const innerToPattern = new Map;
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language))
+      continue;
+    if (p.class !== undefined)
+      continue;
+    if (!innerToPattern.has(p.method))
+      innerToPattern.set(p.method, p);
+  }
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language))
+      continue;
+    if (innerToPattern.has(p.method))
+      continue;
+    innerToPattern.set(p.method, p);
+  }
+  const aliasPatterns = [];
+  const seenAliases = new Set;
+  for (const line of sourceLines) {
+    const m = PROMISIFY_RE.exec(line);
+    if (!m)
+      continue;
+    const aliasName = m[1];
+    const innerName = m[2];
+    if (!aliasName || !innerName)
+      continue;
+    if (seenAliases.has(aliasName))
+      continue;
+    const template = innerToPattern.get(innerName);
+    if (!template)
+      continue;
+    seenAliases.add(aliasName);
+    aliasPatterns.push({
+      method: aliasName,
+      type: template.type,
+      cwe: template.cwe,
+      severity: template.severity,
+      arg_positions: template.arg_positions,
+      languages: [language],
+      note: `util.promisify alias of ${innerName} — cognium-dev #187`
+    });
+  }
+  return aliasPatterns.length === 0 ? patterns : patterns.concat(aliasPatterns);
+}
 function attachSourceLineCode(sources, sinks, code) {
   const lines = code.split(`
 `);
@@ -12047,6 +12125,46 @@ function isSafeGoExecCommandCall(call, pattern, language) {
     return false;
   return true;
 }
+function isSafeJSChildProcessCall(call, pattern, language) {
+  if (language !== "javascript" && language !== "typescript")
+    return false;
+  if (pattern.type !== "command_injection")
+    return false;
+  const m = call.method_name;
+  if (m !== "spawn" && m !== "spawnSync" && m !== "execFile" && m !== "execFileSync")
+    return false;
+  const programArg = call.arguments.find((a) => a.position === 0);
+  if (!programArg)
+    return false;
+  let program;
+  if (programArg.literal !== null && programArg.literal !== undefined) {
+    program = String(programArg.literal).split("/").pop() ?? String(programArg.literal);
+  } else {
+    const expr = (programArg.expression ?? "").trim();
+    if (!(expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'"))) {
+      return false;
+    }
+    const stripped = expr.slice(1, -1);
+    program = stripped.split("/").pop() ?? stripped;
+  }
+  const SHELL_PROGRAMS = new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ash",
+    "ksh",
+    "cmd",
+    "cmd.exe",
+    "powershell",
+    "pwsh",
+    "powershell.exe",
+    "pwsh.exe"
+  ]);
+  if (SHELL_PROGRAMS.has(program))
+    return false;
+  return true;
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust")
     return false;
@@ -12283,6 +12401,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeRustCommandCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeJSChildProcessCall(call, pattern, language)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== undefined && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }
@@ -12298,7 +12419,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             }
           }
         }
-        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout")) {
+        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout" || call.method_name === "setImmediate")) {
           const firstArg = call.arguments.find((a) => a.position === 0);
           if (firstArg && isFunctionCallbackArgument(firstArg)) {
             continue;
@@ -12602,6 +12723,11 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
+      const resolvedTarget = call.resolution?.target;
+      const expectedClassMethodTail = `${pattern.class}.${pattern.method}`;
+      if (resolvedTarget && (resolvedTarget === expectedClassMethodTail || resolvedTarget.endsWith("." + expectedClassMethodTail))) {
+        return true;
+      }
       if (pattern.allow_unresolved_receiver && !call.receiver_type && !call.receiver_type_fqn && call.receiver.includes(".")) {
         return true;
       }
@@ -12706,6 +12832,9 @@ function receiverMightBeClass(receiver, className) {
         return true;
       }
     }
+    if (className === "Logger" && /\.getLogger\(.*\)$/.test(receiver)) {
+      return true;
+    }
   }
   if (receiver.includes("::") && receiver.endsWith(")")) {
     const scopedMatch = receiver.match(/^(\w+)::(\w+)\(.*\)$/);
@@ -23569,6 +23698,23 @@ var JS_XSS_SANITIZERS = [
   /\btrustAsHtml\s*\(/,
   /\bbypassSecurityTrust/
 ];
+var JS_LOG_INJECTION_SANITIZERS = [
+  /\bstripCrlf\s*\(/,
+  /\bstripCRLF\s*\(/,
+  /\bremoveNewlines\s*\(/,
+  /\bsanitizeLogValue\s*\(/,
+  /\.replace\(\s*\/\[\s*\\r\s*\\n\s*\]\/[gimsu]*\s*,\s*['"`]['"`]\s*\)/,
+  /\.replace\(\s*\/\\r\\n\/[gimsu]*\s*,\s*['"`]['"`]\s*\)/
+];
+var PY_BUILTIN_LDAP_SANITIZERS = ["escape_filter_chars", "filter_format"];
+var PY_LDAP_METACHARS = ["(", ")", "=", "*", "\\"];
+var PY_DEF_RE = /^\s*def\s+([A-Za-z_]\w*)\s*\(\s*([A-Za-z_]\w*)\s*\)\s*:\s*$/;
+var PY_LDAP_STRIP_RETURN_RE = /^\s*return\s+re\.sub\(\s*r?["']\[([^"'\]]+)\]["']\s*,\s*r?["']["']\s*,\s*([A-Za-z_]\w*)\s*\)\s*$/;
+var PY_XML_PARSER_HARDENED_RE = /\bXMLParser\s*\([^)]*\bresolve_entities\s*=\s*False\b[^)]*\)/;
+var PY_SQL_EXEC_METHODS = new Set(["execute", "executemany"]);
+var PY_INLINE_FULLMATCH_RE = /\bre\s*\.\s*fullmatch\s*\(\s*r?"((?:[^"\\]|\\.)*)"/g;
+var PY_INLINE_MATCH_ANCHORED_RE = /\bre\s*\.\s*match\s*\(\s*r?"\^((?:[^"\\]|\\.)*)\$"/g;
+var PY_BIND_PLACEHOLDER_RE = /\?|%s|:[A-Za-z_]\w*/;
 var DATA_PARSER_TYPES = new Set([
   "Parser",
   "CommandLine",
@@ -24358,9 +24504,355 @@ class SinkFilterPass {
         return true;
       });
     }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "log_injection")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        if (JS_LOG_INJECTION_SANITIZERS.some((p) => p.test(sinkLineText)))
+          return false;
+        const varNames = extractSourceIdentifiers(sinkLineText);
+        for (const v of varNames) {
+          if (isAssignedFromSanitizerPattern(sourceLines, sink.line, v, JS_LOG_INJECTION_SANITIZERS)) {
+            return false;
+          }
+        }
+        return true;
+      });
+    }
+    if (language === "python") {
+      const sourceLines = ctx.code.split(`
+`);
+      const wrappers = findPythonLdapStripWrappers(sourceLines);
+      const allLdapSanitizers = [...PY_BUILTIN_LDAP_SANITIZERS, ...wrappers];
+      if (allLdapSanitizers.length > 0) {
+        const ldapPatterns = allLdapSanitizers.map((name2) => new RegExp(`\\b${escapeRegex(name2)}\\s*\\(`));
+        filtered = filtered.filter((sink) => {
+          if (sink.type !== "ldap_injection")
+            return true;
+          const sinkLineText = sourceLines[sink.line - 1] ?? "";
+          if (ldapPatterns.some((p) => p.test(sinkLineText)))
+            return false;
+          const varNames = extractSourceIdentifiers(sinkLineText);
+          for (const v of varNames) {
+            if (isAssignedFromSanitizerPattern(sourceLines, sink.line, v, ldapPatterns)) {
+              return false;
+            }
+          }
+          return true;
+        });
+      }
+    }
+    if (language === "python") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "xxe")
+          return true;
+        const lookback = 30;
+        const lo = Math.max(0, sink.line - 1 - lookback);
+        for (let i2 = sink.line - 2;i2 >= lo; i2--) {
+          const ln = sourceLines[i2] ?? "";
+          if (PY_XML_PARSER_HARDENED_RE.test(ln))
+            return false;
+          if (/^\s*def\s+\w+\s*\(/.test(ln))
+            break;
+        }
+        return true;
+      });
+    }
+    if (language === "python") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "sql_injection")
+          return true;
+        const method = sink.method ?? "";
+        if (!PY_SQL_EXEC_METHODS.has(method))
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const fstrMatch = sinkLineText.match(/\bf"((?:[^"\\]|\\.)*)"|\bf'((?:[^'\\]|\\.)*)'/);
+        if (!fstrMatch)
+          return true;
+        const fstrBody = fstrMatch[1] ?? fstrMatch[2] ?? "";
+        const { literals, interps } = splitPyFstringTokens(fstrBody);
+        if (interps.length === 0)
+          return true;
+        if (!literals.some((lit) => PY_BIND_PLACEHOLDER_RE.test(lit)))
+          return true;
+        let sawHelperWithGuard = false;
+        for (const interp of interps) {
+          const t = interp.trim();
+          if (t === "")
+            return true;
+          if (/^-?\d+$/.test(t) || /^"(?:[^"\\]|\\.)*"$/.test(t) || /^'(?:[^'\\]|\\.)*'$/.test(t)) {
+            continue;
+          }
+          let helperName = null;
+          const directCall = t.match(/^([A-Za-z_]\w*)\s*\(/);
+          if (directCall) {
+            helperName = directCall[1] ?? null;
+          } else if (/^[A-Za-z_]\w*$/.test(t)) {
+            helperName = findPythonAssignedHelperCall(t, sink.line, sourceLines);
+            if (helperName === null)
+              return true;
+          } else {
+            return true;
+          }
+          const body2 = findPythonFunctionBody(helperName, sourceLines);
+          if (body2 && pythonBodyHasInlineRegexAllowlistRaise(body2)) {
+            sawHelperWithGuard = true;
+          }
+        }
+        if (!sawHelperWithGuard)
+          return true;
+        return false;
+      });
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 }
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var RESERVED_KEYWORDS = new Set([
+  "if",
+  "else",
+  "return",
+  "const",
+  "let",
+  "var",
+  "function",
+  "class",
+  "new",
+  "this",
+  "for",
+  "while",
+  "do",
+  "break",
+  "continue",
+  "switch",
+  "case",
+  "default",
+  "try",
+  "catch",
+  "finally",
+  "throw",
+  "typeof",
+  "instanceof",
+  "in",
+  "of",
+  "await",
+  "async",
+  "import",
+  "export",
+  "from",
+  "as",
+  "void",
+  "null",
+  "undefined",
+  "true",
+  "false",
+  "super",
+  "extends",
+  "static",
+  "def",
+  "lambda",
+  "yield",
+  "pass",
+  "with",
+  "global",
+  "nonlocal",
+  "and",
+  "or",
+  "not",
+  "is",
+  "None",
+  "True",
+  "False",
+  "raise",
+  "except",
+  "elif",
+  "self",
+  "cls",
+  "print",
+  "console",
+  "req",
+  "res",
+  "request",
+  "response"
+]);
+function extractSourceIdentifiers(text) {
+  const out2 = [];
+  const re = /\b([A-Za-z_]\w+)\b/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const name2 = m[1];
+    if (!RESERVED_KEYWORDS.has(name2))
+      out2.push(name2);
+  }
+  return out2;
+}
+function isAssignedFromSanitizerPattern(sourceLines, sinkLine, varName, sanitizerPatterns, lookback = 30) {
+  const escapedVar = escapeRegex(varName);
+  const assignRe = new RegExp(`(?:\\b(?:const|let|var|final|String)\\s+)?\\b${escapedVar}\\s*=\\s*(.+)`);
+  const fnBoundaryRe = /^\s*(?:def\s+\w+\s*\(|function\s+\w+\s*\(|\w+\s*[:=]\s*(?:async\s+)?\(?[^)]*\)?\s*=>)/;
+  const lo = Math.max(0, sinkLine - 1 - lookback);
+  for (let i2 = sinkLine - 2;i2 >= lo; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(assignRe);
+    if (m) {
+      const rhs = (m[1] ?? "").trim();
+      return sanitizerPatterns.some((p) => p.test(rhs));
+    }
+    if (fnBoundaryRe.test(ln))
+      break;
+  }
+  return false;
+}
+function findPythonLdapStripWrappers(sourceLines) {
+  const out2 = [];
+  for (let i2 = 0;i2 < sourceLines.length; i2++) {
+    const defMatch = sourceLines[i2].match(PY_DEF_RE);
+    if (!defMatch)
+      continue;
+    const fnName = defMatch[1];
+    const param = defMatch[2];
+    for (let j = i2 + 1;j < Math.min(i2 + 4, sourceLines.length); j++) {
+      const body2 = sourceLines[j];
+      if (/^\s*$/.test(body2) || /^\s*#/.test(body2))
+        continue;
+      const ret = body2.match(PY_LDAP_STRIP_RETURN_RE);
+      if (!ret)
+        break;
+      const charClass = ret[1];
+      const argName = ret[2];
+      if (argName !== param)
+        break;
+      const metaCount = PY_LDAP_METACHARS.filter((c) => charClass.includes(c)).length;
+      if (metaCount >= 3)
+        out2.push(fnName);
+      break;
+    }
+  }
+  return out2;
+}
+function splitPyFstringTokens(body2) {
+  const literals = [];
+  const interps = [];
+  let i2 = 0;
+  let cur = "";
+  while (i2 < body2.length) {
+    const ch = body2[i2] ?? "";
+    if (ch === "{" && body2[i2 + 1] === "{") {
+      cur += "{";
+      i2 += 2;
+      continue;
+    }
+    if (ch === "}" && body2[i2 + 1] === "}") {
+      cur += "}";
+      i2 += 2;
+      continue;
+    }
+    if (ch === "{") {
+      literals.push(cur);
+      cur = "";
+      i2++;
+      let depth = 1;
+      let expr = "";
+      while (i2 < body2.length && depth > 0) {
+        const ch2 = body2[i2] ?? "";
+        if (ch2 === "{") {
+          depth++;
+          expr += ch2;
+          i2++;
+          continue;
+        }
+        if (ch2 === "}") {
+          depth--;
+          if (depth === 0) {
+            i2++;
+            break;
+          }
+          expr += ch2;
+          i2++;
+          continue;
+        }
+        expr += ch2;
+        i2++;
+      }
+      const colonIdx = expr.indexOf(":");
+      const interp = colonIdx >= 0 ? expr.substring(0, colonIdx) : expr;
+      interps.push(interp);
+      continue;
+    }
+    cur += ch;
+    i2++;
+  }
+  literals.push(cur);
+  return { literals, interps };
+}
+function findPythonAssignedHelperCall(varName, sinkLine, sourceLines) {
+  if (!/^[A-Za-z_]\w*$/.test(varName))
+    return null;
+  const lo = Math.max(0, sinkLine - 31);
+  const assignRe = new RegExp(`^\\s*${varName}\\s*=\\s*([A-Za-z_]\\w*)\\s*\\(`);
+  for (let i2 = sinkLine - 2;i2 >= lo; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(assignRe);
+    if (m)
+      return m[1] ?? null;
+  }
+  return null;
+}
+function findPythonFunctionBody(funcName, sourceLines) {
+  if (!/^[A-Za-z_]\w*$/.test(funcName))
+    return null;
+  const sigRe = new RegExp(`^(\\s*)def\\s+${funcName}\\s*\\(`);
+  for (let i2 = 0;i2 < sourceLines.length; i2++) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(sigRe);
+    if (!m)
+      continue;
+    const baseIndent = (m[1] ?? "").length;
+    const body2 = [];
+    for (let j = i2 + 1;j < sourceLines.length; j++) {
+      const ln2 = sourceLines[j] ?? "";
+      if (ln2.trim() === "") {
+        body2.push(ln2);
+        continue;
+      }
+      const indentMatch = ln2.match(/^(\s*)/);
+      const indent = (indentMatch?.[1] ?? "").length;
+      if (indent <= baseIndent)
+        break;
+      body2.push(ln2);
+    }
+    return body2;
+  }
+  return null;
+}
+function pythonBodyHasInlineRegexAllowlistRaise(bodyLines) {
+  const stripped = bodyLines.map((ln) => ln.replace(/#.*$/, ""));
+  const text = stripped.join(`
+`);
+  if (!/\braise\s+/.test(text))
+    return false;
+  PY_INLINE_FULLMATCH_RE.lastIndex = 0;
+  let m;
+  while ((m = PY_INLINE_FULLMATCH_RE.exec(text)) !== null) {
+    if (isImplicitlyAnchoredAllowlistRegex(m[1] ?? ""))
+      return true;
+  }
+  PY_INLINE_MATCH_ANCHORED_RE.lastIndex = 0;
+  while ((m = PY_INLINE_MATCH_ANCHORED_RE.exec(text)) !== null) {
+    if (isImplicitlyAnchoredAllowlistRegex(m[1] ?? ""))
+      return true;
+  }
+  return false;
+}
 function evalArithmetic(input) {
   let pos = 0;
   const len = input.length;
@@ -24776,7 +25268,10 @@ class TaintPropagationPass {
           const sink = sinkByLine.get(f.sink_line);
           if (!sink || !sink.code || !sink.method)
             return true;
-          return !isMongoValueBoundFilter(sink.code, sink.method);
+          const sourceVar = f.path && f.path.length > 0 ? f.path[0].variable : null;
+          const isHttpSource = typeof f.source_type === "string" && f.source_type.startsWith("http_");
+          const sourceVarForFilter = isHttpSource ? sourceVar : null;
+          return !isMongoValueBoundFilter(sink.code, sink.method, sourceVarForFilter);
         });
       }
     }
@@ -24814,7 +25309,7 @@ class TaintPropagationPass {
     return { flows: finalFlows };
   }
 }
-function isMongoValueBoundFilter(sinkCode, sinkMethod) {
+function isMongoValueBoundFilter(sinkCode, sinkMethod, sourceVar) {
   if (!sinkCode || !sinkMethod)
     return false;
   const callIdx = sinkCode.indexOf(`${sinkMethod}(`);
@@ -24882,6 +25377,12 @@ function isMongoValueBoundFilter(sinkCode, sinkMethod) {
     return false;
   if (/(['"])\$[A-Za-z_]\w*\1\s*:/.test(body2))
     return false;
+  if (sourceVar && /^[A-Za-z_]\w*$/.test(sourceVar)) {
+    const escaped = sourceVar.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const tokenRe = new RegExp(`(?<![\\p{L}\\p{N}_])${escaped}(?![\\p{L}\\p{N}_])`, "u");
+    if (tokenRe.test(stripped))
+      return false;
+  }
   return true;
 }
 function isInJavaSanitizedMethod(code, types, sinkLine, sinkType) {
@@ -27007,7 +27508,7 @@ class NullDerefPass {
 }
 
 // ../circle-ir/dist/analysis/passes/resource-leak-pass.js
-function escapeRegex(s) {
+function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var FACTORY_METHOD_NAME_RE = /^(?:open|create|new|get|make|build)[A-Z]/;
@@ -27161,7 +27662,7 @@ class ResourceLeakPass {
     return false;
   }
   isReturnedToCaller(lines, variable, fromLine, toLine) {
-    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex(variable)}\\b`);
+    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex2(variable)}\\b`);
     for (let l = fromLine;l <= toLine && l <= lines.length; l++) {
       if (varRe.test(lines[l - 1] ?? ""))
         return true;
@@ -27169,7 +27670,7 @@ class ResourceLeakPass {
     return false;
   }
   fieldStoredName(lines, variable, openLine, toLine) {
-    const thisAssignRe = new RegExp(`\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex(variable)}\\b`);
+    const thisAssignRe = new RegExp(`\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex2(variable)}\\b`);
     for (let l = openLine;l <= toLine && l <= lines.length; l++) {
       const m = thisAssignRe.exec(lines[l - 1] ?? "");
       if (m)
@@ -36200,7 +36701,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.108.0";
+var version = "3.112.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.108.0",
+  "version": "3.112.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.108.0"
+    "circle-ir": "^3.112.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",