cognium-dev 3.113.0 → 3.114.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +12 -5
- package/package.json +2 -2
package/dist/cli.js
CHANGED
|
@@ -13356,7 +13356,7 @@ function canSourceReachSink(sourceType, sinkType) {
|
|
|
13356
13356
|
http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf"],
|
|
13357
13357
|
http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call"],
|
|
13358
13358
|
http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment"],
|
|
13359
|
-
io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss"],
|
|
13359
|
+
io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf"],
|
|
13360
13360
|
env_input: ["command_injection", "path_traversal"],
|
|
13361
13361
|
db_input: ["xss", "sql_injection"],
|
|
13362
13362
|
file_input: ["deserialization", "xxe", "path_traversal", "command_injection", "code_injection"],
|
|
@@ -20494,14 +20494,14 @@ class BashPlugin extends BaseLanguagePlugin {
|
|
|
20494
20494
|
type: "ssrf",
|
|
20495
20495
|
cwe: "CWE-918",
|
|
20496
20496
|
severity: "high",
|
|
20497
|
-
argPositions: [
|
|
20497
|
+
argPositions: []
|
|
20498
20498
|
},
|
|
20499
20499
|
{
|
|
20500
20500
|
method: "wget",
|
|
20501
20501
|
type: "ssrf",
|
|
20502
20502
|
cwe: "CWE-918",
|
|
20503
20503
|
severity: "high",
|
|
20504
|
-
argPositions: [
|
|
20504
|
+
argPositions: []
|
|
20505
20505
|
},
|
|
20506
20506
|
{
|
|
20507
20507
|
method: "source",
|
|
@@ -23091,7 +23091,14 @@ var BASH_UNTRUSTED_ENV_PATTERNS = [
|
|
|
23091
23091
|
/^CONTENT_LENGTH$/i,
|
|
23092
23092
|
/^PATH_INFO$/i,
|
|
23093
23093
|
/^SCRIPT_NAME$/i,
|
|
23094
|
-
/^SERVER_NAME$/i
|
|
23094
|
+
/^SERVER_NAME$/i,
|
|
23095
|
+
/^RPC_/i,
|
|
23096
|
+
/^XMLRPC/i,
|
|
23097
|
+
/^JSONRPC/i,
|
|
23098
|
+
/^CMD_/i,
|
|
23099
|
+
/^EXEC_/i,
|
|
23100
|
+
/^EVAL_/i,
|
|
23101
|
+
/^SHELL_/i
|
|
23095
23102
|
];
|
|
23096
23103
|
var BASH_NETWORK_COMMANDS = new Set(["curl", "wget", "nc", "ncat"]);
|
|
23097
23104
|
var BASH_FILE_COMMANDS = new Set(["cat", "head", "tail", "less", "more", "awk", "sed", "cut", "grep"]);
|
|
@@ -36773,7 +36780,7 @@ var colors = {
|
|
|
36773
36780
|
};
|
|
36774
36781
|
|
|
36775
36782
|
// src/version.ts
|
|
36776
|
-
var version = "3.
|
|
36783
|
+
var version = "3.114.0";
|
|
36777
36784
|
|
|
36778
36785
|
// src/formatters.ts
|
|
36779
36786
|
var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cognium-dev",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.114.0",
|
|
4
4
|
"description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -66,7 +66,7 @@
|
|
|
66
66
|
},
|
|
67
67
|
"dependencies": {
|
|
68
68
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
69
|
-
"circle-ir": "^3.
|
|
69
|
+
"circle-ir": "^3.114.0"
|
|
70
70
|
},
|
|
71
71
|
"devDependencies": {
|
|
72
72
|
"@types/node": "^25.5.0",
|