cognium-dev 3.115.0 → 3.117.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +11 -2
- package/package.json +2 -2
package/dist/cli.js
CHANGED
|
@@ -11499,6 +11499,7 @@ var DEFAULT_SANITIZERS = [
|
|
|
11499
11499
|
{ method: "escapeshellarg", removes: ["command_injection"] },
|
|
11500
11500
|
{ method: "escapeshellcmd", removes: ["command_injection"] },
|
|
11501
11501
|
{ method: "setObjectInputFilter", class: "ObjectInputStream", removes: ["deserialization"] },
|
|
11502
|
+
{ method: "matcher", removes: ["external_taint_escape"] },
|
|
11502
11503
|
{ method: "encodeURIComponent", removes: ["xss", "ssrf", "path_traversal"] },
|
|
11503
11504
|
{ method: "encodeURI", removes: ["xss", "ssrf"] },
|
|
11504
11505
|
{ method: "escape", removes: ["xss"] },
|
|
@@ -11515,7 +11516,7 @@ var DEFAULT_SANITIZERS = [
|
|
|
11515
11516
|
{ method: "has", removes: ["external_taint_escape"] },
|
|
11516
11517
|
{ method: "contains", removes: ["external_taint_escape"] },
|
|
11517
11518
|
{ method: "indexOf", removes: ["external_taint_escape"] },
|
|
11518
|
-
{ method: "basename", class: "path", removes: ["path_traversal"] },
|
|
11519
|
+
{ method: "basename", class: "path", removes: ["path_traversal", "external_taint_escape"] },
|
|
11519
11520
|
{ method: "normalize", class: "path", removes: ["path_traversal"] },
|
|
11520
11521
|
{ method: "resolve", class: "path", removes: ["path_traversal"] },
|
|
11521
11522
|
{ method: "escape", class: "mysql", removes: ["sql_injection"] },
|
|
@@ -33354,6 +33355,14 @@ class UnrestrictedFileUploadPass {
|
|
|
33354
33355
|
this.emit(ctx, findings, file, call.location.line, language, "Files.copy(input, Path.of(dir, <original filename>))");
|
|
33355
33356
|
}
|
|
33356
33357
|
}
|
|
33358
|
+
if (m === "write" && callHasUploadName(call)) {
|
|
33359
|
+
const rec = call.receiver ?? "";
|
|
33360
|
+
if (rec === "Files" || rec === "FilePath" || rec.endsWith(".Files"))
|
|
33361
|
+
continue;
|
|
33362
|
+
if (inSafeRange(call.location.line))
|
|
33363
|
+
continue;
|
|
33364
|
+
this.emit(ctx, findings, file, call.location.line, language, "Part.write(<dir> + <original filename>)");
|
|
33365
|
+
}
|
|
33357
33366
|
}
|
|
33358
33367
|
}
|
|
33359
33368
|
if (language === "javascript" || language === "typescript") {
|
|
@@ -36828,7 +36837,7 @@ var colors = {
|
|
|
36828
36837
|
};
|
|
36829
36838
|
|
|
36830
36839
|
// src/version.ts
|
|
36831
|
-
var version = "3.
|
|
36840
|
+
var version = "3.117.0";
|
|
36832
36841
|
|
|
36833
36842
|
// src/formatters.ts
|
|
36834
36843
|
var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cognium-dev",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.117.0",
|
|
4
4
|
"description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -66,7 +66,7 @@
|
|
|
66
66
|
},
|
|
67
67
|
"dependencies": {
|
|
68
68
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
69
|
-
"circle-ir": "^3.
|
|
69
|
+
"circle-ir": "^3.117.0"
|
|
70
70
|
},
|
|
71
71
|
"devDependencies": {
|
|
72
72
|
"@types/node": "^25.5.0",
|