cognium-dev 3.111.0 → 3.113.0

package/dist/cli.js

@@ -11051,7 +11051,17 @@ var DEFAULT_SINKS = [
   { method: "execute", class: "Pool", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "all", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "run", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
+  { method: "bypassSecurityTrustHtml", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustScript", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustStyle", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustUrl", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustResourceUrl", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "send", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "end", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -11062,6 +11072,8 @@ var DEFAULT_SINKS = [
   { method: "runInContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInNewContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInThisContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
+  { method: "Script", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "setImmediate", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "parse", class: "protobuf", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "parse", class: "protobufjs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "parse", class: "Root", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -11107,6 +11119,8 @@ var DEFAULT_SINKS = [
   { method: "request", class: "needle", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "get", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "request", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "get", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "default", class: "node-fetch", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
@@ -11151,6 +11165,7 @@ var DEFAULT_SINKS = [
   { method: "exec", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "compile", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "__import__", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "import_module", class: "importlib", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "loads", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "load", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "loads", class: "marshal", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
@@ -11334,6 +11349,12 @@ var DEFAULT_SINKS = [
   { method: "log!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "println!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "eprintln!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
+  { method: "log::info!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::warn!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::error!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::debug!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::trace!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::log!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
   { method: "query", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query_as", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query_as", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -12405,7 +12426,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             }
           }
         }
-        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout")) {
+        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout" || call.method_name === "setImmediate")) {
           const firstArg = call.arguments.find((a) => a.position === 0);
           if (firstArg && isFunctionCallbackArgument(firstArg)) {
             continue;
@@ -12709,6 +12730,11 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
+      const resolvedTarget = call.resolution?.target;
+      const expectedClassMethodTail = `${pattern.class}.${pattern.method}`;
+      if (resolvedTarget && (resolvedTarget === expectedClassMethodTail || resolvedTarget.endsWith("." + expectedClassMethodTail))) {
+        return true;
+      }
       if (pattern.allow_unresolved_receiver && !call.receiver_type && !call.receiver_type_fqn && call.receiver.includes(".")) {
         return true;
       }
@@ -31672,6 +31698,9 @@ var PY_SECURE_TRUE_RE = /\bsecure\s*=\s*True\b/;
 var PY_HTTPONLY_TRUE_RE = /\bhttponly\s*=\s*True\b/i;
 var JAVA_SET_SECURE_TRUE_RE = /\.setSecure\s*\(\s*true\s*\)/;
 var JAVA_SET_HTTPONLY_TRUE_RE = /\.setHttpOnly\s*\(\s*true\s*\)/;
+var GO_SECURE_TRUE_RE = /\bSecure\s*:\s*true\b/;
+var GO_HTTPONLY_TRUE_RE = /\bHttpOnly\s*:\s*true\b/;
+var RUST_SET_COOKIE_MACRO_RE = /(format!|write!|writeln!)\s*\(([^()]*Set-Cookie[^()]*)\)/gis;
 
 class InsecureCookiePass {
   name = "insecure-cookie";
@@ -31706,6 +31735,20 @@ class InsecureCookiePass {
         insecureCookies.push(det);
         this.emit(ctx, file, det, "java");
       }
+    } else if (language === "go") {
+      for (const call of graph.ir.calls) {
+        const det = this.detectGo(call);
+        if (!det)
+          continue;
+        insecureCookies.push(det);
+        this.emit(ctx, file, det, "go");
+      }
+    } else if (language === "rust") {
+      const dets = this.detectRustSetCookieFormat(code);
+      for (const det of dets) {
+        insecureCookies.push(det);
+        this.emit(ctx, file, det, "rust");
+      }
     }
     return { insecureCookies };
   }
@@ -31773,13 +31816,61 @@ class InsecureCookiePass {
       optionsPresent: false
     };
   }
+  detectGo(call) {
+    if (call.method_name !== "SetCookie")
+      return null;
+    if ((call.receiver ?? "") !== "http")
+      return null;
+    if (call.arguments.length < 2)
+      return null;
+    const cookieArg = call.arguments.find((a) => a.position === 1);
+    const cookieExpr = (cookieArg?.expression ?? "").trim();
+    if (!cookieExpr.includes("{") || !cookieExpr.includes("}"))
+      return null;
+    const missingSecure = !GO_SECURE_TRUE_RE.test(cookieExpr);
+    const missingHttpOnly = !GO_HTTPONLY_TRUE_RE.test(cookieExpr);
+    if (!missingSecure && !missingHttpOnly)
+      return null;
+    return {
+      line: call.location.line,
+      receiver: "http.SetCookie",
+      missingSecure,
+      missingHttpOnly,
+      optionsPresent: true
+    };
+  }
+  detectRustSetCookieFormat(code) {
+    const out2 = [];
+    const re = new RegExp(RUST_SET_COOKIE_MACRO_RE.source, RUST_SET_COOKIE_MACRO_RE.flags);
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const macro = m[1] ?? "";
+      const body2 = m[2] ?? "";
+      const missingSecure = !/\bSecure\b/.test(body2);
+      const missingHttpOnly = !/\bHttpOnly\b/.test(body2);
+      if (!missingSecure && !missingHttpOnly)
+        continue;
+      const line = code.slice(0, m.index).split(`
+`).length;
+      out2.push({
+        line,
+        receiver: macro,
+        missingSecure,
+        missingHttpOnly,
+        optionsPresent: true
+      });
+    }
+    return out2;
+  }
   emit(ctx, file, det, flavor) {
     const missing = [];
-    if (det.missingSecure)
-      missing.push(flavor === "js" ? "`secure: true`" : flavor === "python" ? "`secure=True`" : "`setSecure(true)`");
-    if (det.missingHttpOnly)
-      missing.push(flavor === "js" ? "`httpOnly: true`" : flavor === "python" ? "`httponly=True`" : "`setHttpOnly(true)`");
-    const fix = flavor === "js" ? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.' : flavor === "python" ? 'Pass `secure=True, httponly=True, samesite="Lax"` to `response.set_cookie(...)`.' : "After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response.";
+    if (det.missingSecure) {
+      missing.push(flavor === "js" ? "`secure: true`" : flavor === "python" ? "`secure=True`" : flavor === "java" ? "`setSecure(true)`" : flavor === "go" ? "`Secure: true`" : "`Secure` attribute");
+    }
+    if (det.missingHttpOnly) {
+      missing.push(flavor === "js" ? "`httpOnly: true`" : flavor === "python" ? "`httponly=True`" : flavor === "java" ? "`setHttpOnly(true)`" : flavor === "go" ? "`HttpOnly: true`" : "`HttpOnly` attribute");
+    }
+    const fix = flavor === "js" ? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.' : flavor === "python" ? 'Pass `secure=True, httponly=True, samesite="Lax"` to `response.set_cookie(...)`.' : flavor === "java" ? "After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response." : flavor === "go" ? "Set `Secure: true` and `HttpOnly: true` on the `http.Cookie` struct literal passed to `http.SetCookie`." : "Append `; Secure; HttpOnly` to the `Set-Cookie` header string.";
     ctx.addFinding({
       id: `${this.name}-${file}-${det.line}`,
       pass: this.name,
@@ -36682,7 +36773,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.111.0";
+var version = "3.113.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.111.0",
+  "version": "3.113.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.111.0"
+    "circle-ir": "^3.113.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",