cognium-dev 3.112.0 → 3.114.0

package/dist/cli.js

@@ -11165,6 +11165,7 @@ var DEFAULT_SINKS = [
   { method: "exec", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "compile", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "__import__", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "import_module", class: "importlib", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "loads", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "load", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "loads", class: "marshal", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
@@ -11348,6 +11349,12 @@ var DEFAULT_SINKS = [
   { method: "log!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "println!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "eprintln!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
+  { method: "log::info!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::warn!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::error!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::debug!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::trace!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::log!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
   { method: "query", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query_as", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query_as", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -13349,7 +13356,7 @@ function canSourceReachSink(sourceType, sinkType) {
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf"],
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call"],
     http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment"],
-    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss"],
+    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection"],
     file_input: ["deserialization", "xxe", "path_traversal", "command_injection", "code_injection"],
@@ -20487,14 +20494,14 @@ class BashPlugin extends BaseLanguagePlugin {
         type: "ssrf",
         cwe: "CWE-918",
         severity: "high",
-        argPositions: [0]
+        argPositions: []
       },
       {
         method: "wget",
         type: "ssrf",
         cwe: "CWE-918",
         severity: "high",
-        argPositions: [0]
+        argPositions: []
       },
       {
         method: "source",
@@ -23084,7 +23091,14 @@ var BASH_UNTRUSTED_ENV_PATTERNS = [
   /^CONTENT_LENGTH$/i,
   /^PATH_INFO$/i,
   /^SCRIPT_NAME$/i,
-  /^SERVER_NAME$/i
+  /^SERVER_NAME$/i,
+  /^RPC_/i,
+  /^XMLRPC/i,
+  /^JSONRPC/i,
+  /^CMD_/i,
+  /^EXEC_/i,
+  /^EVAL_/i,
+  /^SHELL_/i
 ];
 var BASH_NETWORK_COMMANDS = new Set(["curl", "wget", "nc", "ncat"]);
 var BASH_FILE_COMMANDS = new Set(["cat", "head", "tail", "less", "more", "awk", "sed", "cut", "grep"]);
@@ -31691,6 +31705,9 @@ var PY_SECURE_TRUE_RE = /\bsecure\s*=\s*True\b/;
 var PY_HTTPONLY_TRUE_RE = /\bhttponly\s*=\s*True\b/i;
 var JAVA_SET_SECURE_TRUE_RE = /\.setSecure\s*\(\s*true\s*\)/;
 var JAVA_SET_HTTPONLY_TRUE_RE = /\.setHttpOnly\s*\(\s*true\s*\)/;
+var GO_SECURE_TRUE_RE = /\bSecure\s*:\s*true\b/;
+var GO_HTTPONLY_TRUE_RE = /\bHttpOnly\s*:\s*true\b/;
+var RUST_SET_COOKIE_MACRO_RE = /(format!|write!|writeln!)\s*\(([^()]*Set-Cookie[^()]*)\)/gis;
 
 class InsecureCookiePass {
   name = "insecure-cookie";
@@ -31725,6 +31742,20 @@ class InsecureCookiePass {
         insecureCookies.push(det);
         this.emit(ctx, file, det, "java");
       }
+    } else if (language === "go") {
+      for (const call of graph.ir.calls) {
+        const det = this.detectGo(call);
+        if (!det)
+          continue;
+        insecureCookies.push(det);
+        this.emit(ctx, file, det, "go");
+      }
+    } else if (language === "rust") {
+      const dets = this.detectRustSetCookieFormat(code);
+      for (const det of dets) {
+        insecureCookies.push(det);
+        this.emit(ctx, file, det, "rust");
+      }
     }
     return { insecureCookies };
   }
@@ -31792,13 +31823,61 @@ class InsecureCookiePass {
       optionsPresent: false
     };
   }
+  detectGo(call) {
+    if (call.method_name !== "SetCookie")
+      return null;
+    if ((call.receiver ?? "") !== "http")
+      return null;
+    if (call.arguments.length < 2)
+      return null;
+    const cookieArg = call.arguments.find((a) => a.position === 1);
+    const cookieExpr = (cookieArg?.expression ?? "").trim();
+    if (!cookieExpr.includes("{") || !cookieExpr.includes("}"))
+      return null;
+    const missingSecure = !GO_SECURE_TRUE_RE.test(cookieExpr);
+    const missingHttpOnly = !GO_HTTPONLY_TRUE_RE.test(cookieExpr);
+    if (!missingSecure && !missingHttpOnly)
+      return null;
+    return {
+      line: call.location.line,
+      receiver: "http.SetCookie",
+      missingSecure,
+      missingHttpOnly,
+      optionsPresent: true
+    };
+  }
+  detectRustSetCookieFormat(code) {
+    const out2 = [];
+    const re = new RegExp(RUST_SET_COOKIE_MACRO_RE.source, RUST_SET_COOKIE_MACRO_RE.flags);
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const macro = m[1] ?? "";
+      const body2 = m[2] ?? "";
+      const missingSecure = !/\bSecure\b/.test(body2);
+      const missingHttpOnly = !/\bHttpOnly\b/.test(body2);
+      if (!missingSecure && !missingHttpOnly)
+        continue;
+      const line = code.slice(0, m.index).split(`
+`).length;
+      out2.push({
+        line,
+        receiver: macro,
+        missingSecure,
+        missingHttpOnly,
+        optionsPresent: true
+      });
+    }
+    return out2;
+  }
   emit(ctx, file, det, flavor) {
     const missing = [];
-    if (det.missingSecure)
-      missing.push(flavor === "js" ? "`secure: true`" : flavor === "python" ? "`secure=True`" : "`setSecure(true)`");
-    if (det.missingHttpOnly)
-      missing.push(flavor === "js" ? "`httpOnly: true`" : flavor === "python" ? "`httponly=True`" : "`setHttpOnly(true)`");
-    const fix = flavor === "js" ? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.' : flavor === "python" ? 'Pass `secure=True, httponly=True, samesite="Lax"` to `response.set_cookie(...)`.' : "After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response.";
+    if (det.missingSecure) {
+      missing.push(flavor === "js" ? "`secure: true`" : flavor === "python" ? "`secure=True`" : flavor === "java" ? "`setSecure(true)`" : flavor === "go" ? "`Secure: true`" : "`Secure` attribute");
+    }
+    if (det.missingHttpOnly) {
+      missing.push(flavor === "js" ? "`httpOnly: true`" : flavor === "python" ? "`httponly=True`" : flavor === "java" ? "`setHttpOnly(true)`" : flavor === "go" ? "`HttpOnly: true`" : "`HttpOnly` attribute");
+    }
+    const fix = flavor === "js" ? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.' : flavor === "python" ? 'Pass `secure=True, httponly=True, samesite="Lax"` to `response.set_cookie(...)`.' : flavor === "java" ? "After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response." : flavor === "go" ? "Set `Secure: true` and `HttpOnly: true` on the `http.Cookie` struct literal passed to `http.SetCookie`." : "Append `; Secure; HttpOnly` to the `Set-Cookie` header string.";
     ctx.addFinding({
       id: `${this.name}-${file}-${det.line}`,
       pass: this.name,
@@ -36701,7 +36780,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.112.0";
+var version = "3.114.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.112.0",
+  "version": "3.114.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.112.0"
+    "circle-ir": "^3.114.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",