cognium-dev 3.123.0 → 3.124.0

package/dist/cli.js

@@ -22617,6 +22617,15 @@ class LanguageSourcesPass {
         ctx.addFinding(finding);
       }
     }
+    if (language === "javascript" || language === "typescript" || language === "htmljs") {
+      additionalSanitizers.push(...findJsSafeJsonParseSanitizers(code));
+      additionalSanitizers.push(...findJsCryptoHashSanitizers(code));
+      additionalSanitizers.push(...findJsCsvFormulaPrefixSanitizers(code));
+      additionalSanitizers.push(...findJsWrapperFunctionSanitizers(code));
+    }
+    if (language === "java") {
+      additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
+    }
     if (language === "python" || language === "javascript" || language === "typescript" || language === "go") {
       const exfilFindings = findExternalSecretExfiltrationFindings(code, graph.ir.meta.file, language);
       for (const finding of exfilFindings) {
@@ -24112,6 +24121,123 @@ function findRustCanonicalizeGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJavaSafeJsonParseSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const safeParse = /\.(?:readValue|fromJson)\s*\(/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    if (!safeParse.test(lines[i2]))
+      continue;
+    sanitizers.push({
+      type: "java_safe_json_parse",
+      method: "readValue",
+      line: i2 + 1,
+      sanitizes: ["external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJsSafeJsonParseSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const safeParse = /\bJSON\.parse\s*\(/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    if (!safeParse.test(lines[i2]))
+      continue;
+    sanitizers.push({
+      type: "js_safe_json_parse",
+      method: "JSON.parse",
+      line: i2 + 1,
+      sanitizes: ["external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJsCryptoHashSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const hashCall = /\b(?:bcrypt|argon2)\s*\.\s*hash(?:Sync)?\s*\(|\bcrypto\s*\.\s*(?:scrypt(?:Sync)?|createHash)\s*\(|\.digest\s*\(/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    if (!hashCall.test(lines[i2]))
+      continue;
+    sanitizers.push({
+      type: "js_crypto_hash",
+      method: "hash",
+      line: i2 + 1,
+      sanitizes: ["external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJsCsvFormulaPrefixSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const tickPrefix = /`'\$\{/;
+  const concatPrefix = /["']\\?'["']\s*\+\s*[A-Za-z_]/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    if (tickPrefix.test(lines[i2]) || concatPrefix.test(lines[i2])) {
+      sanitizers.push({
+        type: "js_csv_formula_prefix",
+        method: "'-prefix",
+        line: i2 + 1,
+        sanitizes: ["external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findJsWrapperFunctionSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const wrappers = new Map;
+  const fnDeclRe = /\bfunction\s+([A-Za-z_]\w*)\s*\(/;
+  const arrowDeclRe = /\b(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*(?:\([^)]*\)|[A-Za-z_]\w*)\s*=>/;
+  const xssCharClass = /\.replace\s*\(\s*\/[^/]*[&<>"'][^/]*\//;
+  const crlfCharClass = /\.replace\s*\(\s*\/[^/]*(?:\\r|\\n|\\t)[^/]*\//;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = fnDeclRe.exec(lines[i2]) ?? arrowDeclRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    const name2 = m[1];
+    const body2 = lines.slice(i2, Math.min(lines.length, i2 + 8)).join(`
+`);
+    const kinds = new Set;
+    if (xssCharClass.test(body2)) {
+      kinds.add("xss");
+      kinds.add("external_taint_escape");
+    }
+    if (crlfCharClass.test(body2)) {
+      kinds.add("log_injection");
+      kinds.add("external_taint_escape");
+    }
+    if (kinds.size > 0)
+      wrappers.set(name2, kinds);
+  }
+  if (wrappers.size === 0)
+    return sanitizers;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    for (const [name2, kinds] of wrappers) {
+      const declSelf = new RegExp(`\\b(?:function|const|let|var)\\s+${name2}\\b`);
+      if (declSelf.test(lines[i2]))
+        continue;
+      const callRe = new RegExp(`\\b${name2}\\s*\\(`);
+      if (!callRe.test(lines[i2]))
+        continue;
+      sanitizers.push({
+        type: "js_wrapper_function",
+        method: name2,
+        line: i2 + 1,
+        sanitizes: [...kinds]
+      });
+    }
+  }
+  return sanitizers;
+}
 function collectEnvSecretVars(lines, language) {
   const out2 = new Map;
   for (let i2 = 0;i2 < lines.length; i2++) {
@@ -37653,7 +37779,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.123.0";
+var version = "3.124.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.123.0",
+  "version": "3.124.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.123.0"
+    "circle-ir": "^3.124.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",