cognium-dev 3.119.0 → 3.121.0

package/dist/cli.js

@@ -22082,6 +22082,126 @@ function truncate(s, maxLen) {
   return s.length > maxLen ? s.slice(0, maxLen) + "..." : s;
 }
 
+// ../circle-ir/dist/analysis/html/vue-template-xss-pass.js
+var DANGEROUS_BINDINGS = new Set([
+  "v-html",
+  "v-bind:innerhtml",
+  ":innerhtml",
+  "v-bind:outerhtml",
+  ":outerhtml"
+]);
+var ID_RE = /\b([A-Za-z_$][A-Za-z0-9_$]*)\b/g;
+var RESERVED = new Set([
+  "true",
+  "false",
+  "null",
+  "undefined",
+  "this",
+  "new",
+  "typeof",
+  "void",
+  "delete",
+  "instanceof",
+  "in",
+  "of",
+  "Math",
+  "Number",
+  "String",
+  "Boolean",
+  "Array",
+  "Object",
+  "JSON"
+]);
+function runVueTemplateXssChecks(rootNode, filePath, scriptResults) {
+  const taintedNames = collectTaintedNames(scriptResults);
+  if (taintedNames.size === 0)
+    return [];
+  const findings = [];
+  const stack = [rootNode];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (node.type === "start_tag" || node.type === "self_closing_tag") {
+      checkElementBindings(node, filePath, taintedNames, findings);
+    }
+    for (let i2 = node.childCount - 1;i2 >= 0; i2--) {
+      const c = node.child(i2);
+      if (c)
+        stack.push(c);
+    }
+  }
+  return findings;
+}
+function checkElementBindings(tag, filePath, tainted, out2) {
+  for (let i2 = 0;i2 < tag.childCount; i2++) {
+    const attr = tag.child(i2);
+    if (!attr || attr.type !== "attribute")
+      continue;
+    const nameNode = findChildByType2(attr, "attribute_name");
+    if (!nameNode)
+      continue;
+    const lcName = nameNode.text.toLowerCase();
+    if (!DANGEROUS_BINDINGS.has(lcName))
+      continue;
+    const valueNode = findChildByType2(attr, "quoted_attribute_value") ?? findChildByType2(attr, "attribute_value");
+    if (!valueNode)
+      continue;
+    const rhs = stripQuotes2(valueNode.text);
+    if (!rhs.trim())
+      continue;
+    const matched = matchTaint(rhs, tainted);
+    if (!matched)
+      continue;
+    const line = nameNode.startPosition.row + 1;
+    out2.push({
+      id: `vue-template-xss-${filePath}-${line}-${lcName}`,
+      pass: "vue-template-xss",
+      category: "security",
+      rule_id: "vue-template-xss",
+      cwe: "CWE-79",
+      severity: "high",
+      level: "error",
+      message: `Vue template attribute "${nameNode.text}" binds tainted identifier "${matched}" — writes raw HTML (XSS risk).`,
+      file: filePath,
+      line,
+      snippet: `${nameNode.text}="${rhs}"`
+    });
+  }
+}
+function matchTaint(rhs, tainted) {
+  ID_RE.lastIndex = 0;
+  let m;
+  while ((m = ID_RE.exec(rhs)) !== null) {
+    const id = m[1];
+    if (RESERVED.has(id))
+      continue;
+    if (tainted.has(id))
+      return id;
+  }
+  return;
+}
+function collectTaintedNames(blocks) {
+  const names = new Set;
+  for (const { ir } of blocks) {
+    const sourceLines = new Set;
+    for (const source of ir.taint.sources) {
+      sourceLines.add(source.line);
+      if (source.variable)
+        names.add(source.variable);
+    }
+    for (const def of ir.dfg.defs) {
+      if (sourceLines.has(def.line) && def.variable)
+        names.add(def.variable);
+    }
+    for (const flow of ir.taint.flows ?? []) {
+      for (const step of flow.path ?? []) {
+        if (step.variable)
+          names.add(step.variable);
+      }
+    }
+  }
+  return names;
+}
+
 // ../circle-ir/dist/analysis/html/html-merge.js
 function mergeHtmlResults(htmlMeta, scriptResults, attributeFindings) {
   const allTypes = [];
@@ -23309,10 +23429,43 @@ function findBashTaintSources(sourceCode, dfg) {
   return sources;
 }
 var BASH_CREDENTIAL_PATTERN = /^(.*?)(password|passwd|secret|api_?key|token|auth_token|private_key|access_key)\s*=\s*["']?([^"'\s$][^"'\s]*)["']?\s*$/i;
+var BASH_CHECKSUM_VERIFY_PATTERN = /\b(?:sha(?:1|224|256|384|512)sum|md5sum|cksum|b2sum)\s+(?:-c\b|--check\b)/;
+function collectChecksumVerifiedTmpPaths(lines) {
+  const verified = new Set;
+  for (const line of lines) {
+    if (!BASH_CHECKSUM_VERIFY_PATTERN.test(line))
+      continue;
+    const matches = line.match(/\/tmp\/[^\s"'$|`]+/g);
+    if (!matches)
+      continue;
+    for (const p of matches)
+      verified.add(p);
+  }
+  return verified;
+}
+var BASH_ARCHIVE_EXT_PATTERN = /\.(?:tgz|tar\.gz|tar\.bz2|tar\.xz|tar|tbz2|txz|zip|gz|bz2|xz|7z)$/i;
+function isArchiveOutputContext(line, tmpRel) {
+  if (!BASH_ARCHIVE_EXT_PATTERN.test(tmpRel))
+    return false;
+  if (/\btar\b/.test(line) && /(?:^|\s)-?[A-Za-z]*c[A-Za-z]*\b/.test(line))
+    return true;
+  if (/\bzip\b/.test(line) && !/\bunzip\b/.test(line))
+    return true;
+  if (/\bgzip\b/.test(line) && /(?:-c\b|--stdout\b|>)/.test(line))
+    return true;
+  if (/\bbzip2\b/.test(line) && /(?:-c\b|--stdout\b|>)/.test(line))
+    return true;
+  if (/\bxz\b/.test(line) && /(?:-c\b|--stdout\b|>)/.test(line))
+    return true;
+  if (/\b7z\s+a\b/.test(line))
+    return true;
+  return false;
+}
 function findBashPatternFindings(sourceCode, file) {
   const findings = [];
   const lines = sourceCode.split(`
 `);
+  const checksumVerifiedTmpPaths = collectChecksumVerifiedTmpPaths(lines);
   for (let i2 = 0;i2 < lines.length; i2++) {
     const line = lines[i2];
     const trimmed = line.trim();
@@ -23355,19 +23508,25 @@ function findBashPatternFindings(sourceCode, file) {
     }
     const tmpMatch = trimmed.match(/\/tmp\/([^\s"'$]+)/);
     if (tmpMatch && !/mktemp/.test(trimmed)) {
-      findings.push({
-        id: `predictable-temp-file-${file}-${lineNumber}`,
-        pass: "language-sources",
-        category: "security",
-        rule_id: "predictable-temp-file",
-        cwe: "CWE-377",
-        severity: "medium",
-        level: "warning",
-        message: `Predictable temp file: /tmp/${tmpMatch[1]}. Use mktemp instead`,
-        file,
-        line: lineNumber,
-        snippet: trimmed.substring(0, 80)
-      });
+      const tmpRel = tmpMatch[1];
+      const tmpPath = `/tmp/${tmpRel}`;
+      const isChecksumVerified = checksumVerifiedTmpPaths.has(tmpPath);
+      const isArchiveOutput = isArchiveOutputContext(trimmed, tmpRel);
+      if (!isChecksumVerified && !isArchiveOutput) {
+        findings.push({
+          id: `predictable-temp-file-${file}-${lineNumber}`,
+          pass: "language-sources",
+          category: "security",
+          rule_id: "predictable-temp-file",
+          cwe: "CWE-377",
+          severity: "medium",
+          level: "warning",
+          message: `Predictable temp file: /tmp/${tmpRel}. Use mktemp instead`,
+          file,
+          line: lineNumber,
+          snippet: trimmed.substring(0, 80)
+        });
+      }
     }
     if (/\bchmod\b/.test(trimmed) && /\b(777|666)\b/.test(trimmed)) {
       const mode = trimmed.match(/\b(777|666)\b/)[1];
@@ -36208,6 +36367,11 @@ async function analyzeMarkupFile(code, filePath, options, language) {
       }
     }
     const attributeFindings = runHtmlAttributeSecurityChecks(tree.rootNode, filePath);
+    if (language === "vue") {
+      const vueXss = runVueTemplateXssChecks(tree.rootNode, filePath, scriptResults);
+      if (vueXss.length > 0)
+        attributeFindings.push(...vueXss);
+    }
     const result = mergeHtmlResults(meta, scriptResults, attributeFindings);
     result.parse_status = htmlParseStatus;
     logger.debug("HTML analysis complete", {
@@ -36904,7 +37068,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.119.0";
+var version = "3.121.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.119.0",
+  "version": "3.121.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.119.0"
+    "circle-ir": "^3.121.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",