cognium-dev 3.113.0 → 3.115.0

package/dist/cli.js

@@ -11697,7 +11697,8 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sourceLines = code !== undefined ? code.split(`
 `) : undefined;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
-  const sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
@@ -11752,6 +11753,53 @@ function expandPromisifyAliases(patterns, sourceLines, language) {
   }
   return aliasPatterns.length === 0 ? patterns : patterns.concat(aliasPatterns);
 }
+function expandIndirectEvalAliases(patterns, sourceLines, language) {
+  if (!sourceLines || sourceLines.length === 0)
+    return patterns;
+  if (language !== "javascript" && language !== "typescript")
+    return patterns;
+  const INDIRECT_EVAL_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*(eval|Function)\b(?!\s*\()/;
+  const innerToPattern = new Map;
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language))
+      continue;
+    if (p.class !== undefined)
+      continue;
+    if (p.method !== "eval" && p.method !== "Function")
+      continue;
+    if (!innerToPattern.has(p.method))
+      innerToPattern.set(p.method, p);
+  }
+  if (innerToPattern.size === 0)
+    return patterns;
+  const aliasPatterns = [];
+  const seenAliases = new Set;
+  for (const line of sourceLines) {
+    const m = INDIRECT_EVAL_RE.exec(line);
+    if (!m)
+      continue;
+    const aliasName = m[1];
+    const innerName = m[2];
+    if (!aliasName || !innerName)
+      continue;
+    if (seenAliases.has(aliasName))
+      continue;
+    const template = innerToPattern.get(innerName);
+    if (!template)
+      continue;
+    seenAliases.add(aliasName);
+    aliasPatterns.push({
+      method: aliasName,
+      type: template.type,
+      cwe: template.cwe,
+      severity: template.severity,
+      arg_positions: template.arg_positions,
+      languages: [language],
+      note: `indirect ${innerName} alias — cognium-dev #188`
+    });
+  }
+  return aliasPatterns.length === 0 ? patterns : patterns.concat(aliasPatterns);
+}
 function attachSourceLineCode(sources, sinks, code) {
   const lines = code.split(`
 `);
@@ -13356,7 +13404,7 @@ function canSourceReachSink(sourceType, sinkType) {
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf"],
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call"],
     http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment"],
-    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss"],
+    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection"],
     file_input: ["deserialization", "xxe", "path_traversal", "command_injection", "code_injection"],
@@ -20494,14 +20542,14 @@ class BashPlugin extends BaseLanguagePlugin {
         type: "ssrf",
         cwe: "CWE-918",
         severity: "high",
-        argPositions: [0]
+        argPositions: []
       },
       {
         method: "wget",
         type: "ssrf",
         cwe: "CWE-918",
         severity: "high",
-        argPositions: [0]
+        argPositions: []
       },
       {
         method: "source",
@@ -23091,7 +23139,14 @@ var BASH_UNTRUSTED_ENV_PATTERNS = [
   /^CONTENT_LENGTH$/i,
   /^PATH_INFO$/i,
   /^SCRIPT_NAME$/i,
-  /^SERVER_NAME$/i
+  /^SERVER_NAME$/i,
+  /^RPC_/i,
+  /^XMLRPC/i,
+  /^JSONRPC/i,
+  /^CMD_/i,
+  /^EXEC_/i,
+  /^EVAL_/i,
+  /^SHELL_/i
 ];
 var BASH_NETWORK_COMMANDS = new Set(["curl", "wget", "nc", "ncat"]);
 var BASH_FILE_COMMANDS = new Set(["cat", "head", "tail", "less", "more", "awk", "sed", "cut", "grep"]);
@@ -36773,7 +36828,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.113.0";
+var version = "3.115.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.113.0",
+  "version": "3.115.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.113.0"
+    "circle-ir": "^3.115.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",