cognium-dev 3.125.0 → 3.128.0

package/dist/cli.js

@@ -22607,6 +22607,7 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
       additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
       additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
+      additionalSanitizers.push(...findPythonJinjaAutoescapeSanitizers(code));
       const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
       for (const finding of pyMisconfigFindings) {
         ctx.addFinding(finding);
@@ -22615,6 +22616,7 @@ class LanguageSourcesPass {
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findRustCanonicalizeGuardSanitizers(code));
+      additionalSanitizers.push(...findRustArgvCommandSanitizers(code));
       const rustMisconfigFindings = findRustPatternFindings(code, graph.ir.meta.file);
       for (const finding of rustMisconfigFindings) {
         ctx.addFinding(finding);
@@ -22625,9 +22627,13 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findJsCryptoHashSanitizers(code));
       additionalSanitizers.push(...findJsCsvFormulaPrefixSanitizers(code));
       additionalSanitizers.push(...findJsWrapperFunctionSanitizers(code));
+      additionalSanitizers.push(...findJsSsrfAllowlistGuardSanitizers(code));
     }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
+      additionalSanitizers.push(...findJavaPathNormalizeStartsWithGuardSanitizers(code));
+      additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
+      additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
     }
     if (language === "python" || language === "javascript" || language === "typescript" || language === "go") {
       const exfilFindings = findExternalSecretExfiltrationFindings(code, graph.ir.meta.file, language);
@@ -24487,6 +24493,244 @@ function findJsWrapperFunctionSanitizers(code) {
   }
   return sanitizers;
 }
+function findJsSsrfAllowlistGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const urlAliasToHostAlias = new Map;
+  const urlAliasDecl = /\b(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*new\s+URL\s*\(\s*([A-Za-z_][\w.[\]'"`]*)\s*\)/;
+  const hostAliasDecl = /\b(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*([A-Za-z_]\w*)\.(?:hostname|host)\b/;
+  const hostFromUrl = new Map;
+  for (const line of lines) {
+    const ua = urlAliasDecl.exec(line);
+    if (ua)
+      urlAliasToHostAlias.set(ua[1], ua[2]);
+    const ha = hostAliasDecl.exec(line);
+    if (ha)
+      hostFromUrl.set(ha[1], ha[2]);
+  }
+  const allowlistName = /^(?:[A-Z][A-Z0-9_]+|.*?(allowed|accepted|whitelist|permitted|valid|approved).*)$/i;
+  const guardHas = /if\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*(?:has|includes)\s*\(\s*([A-Za-z_]\w*)(?:\s*\.\s*(?:hostname|host))?\s*\)\s*\)/;
+  const guardIndexOf = /if\s*\(\s*([A-Za-z_]\w*)\s*\.\s*indexOf\s*\(\s*([A-Za-z_]\w*)(?:\s*\.\s*(?:hostname|host))?\s*\)\s*<\s*0\s*\)/;
+  const terminator = /\b(return|throw|res\s*\.\s*status\s*\([^)]*\)\s*\.\s*(?:send|end|json)\s*\()/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    let m = guardHas.exec(line);
+    let allow = null;
+    let guardedVar = null;
+    if (m) {
+      allow = m[1];
+      guardedVar = m[2];
+    } else {
+      m = guardIndexOf.exec(line);
+      if (m) {
+        allow = m[1];
+        guardedVar = m[2];
+      }
+    }
+    if (!allow || !guardedVar)
+      continue;
+    if (!allowlistName.test(allow))
+      continue;
+    let bodyHasTerminator = false;
+    let blockEnd = -1;
+    const maxScan = Math.min(lines.length, i2 + 26);
+    let braceDepth = 0;
+    let started = false;
+    for (let j = i2;j < maxScan; j++) {
+      const ln = lines[j];
+      for (const ch of ln) {
+        if (ch === "{") {
+          braceDepth++;
+          started = true;
+        } else if (ch === "}") {
+          braceDepth--;
+          if (started && braceDepth === 0) {
+            blockEnd = j;
+            break;
+          }
+        }
+      }
+      if (started && j > i2 && terminator.test(ln))
+        bodyHasTerminator = true;
+      if (blockEnd !== -1)
+        break;
+    }
+    if (!started)
+      continue;
+    if (blockEnd === -1)
+      continue;
+    if (!bodyHasTerminator)
+      continue;
+    const safeNames = new Set([guardedVar]);
+    if (hostFromUrl.has(guardedVar)) {
+      safeNames.add(hostFromUrl.get(guardedVar));
+    }
+    for (const [hostName, urlName] of hostFromUrl) {
+      if (urlName === guardedVar)
+        safeNames.add(hostName);
+    }
+    const refRes = [...safeNames].map((n) => new RegExp(`\\b${n}\\b`));
+    for (let l = blockEnd + 2;l <= lines.length; l++) {
+      const lineText = lines[l - 1];
+      if (!refRes.some((re) => re.test(lineText)))
+        continue;
+      sanitizers.push({
+        type: "js_ssrf_allowlist_guard",
+        method: "if",
+        line: l,
+        sanitizes: ["ssrf", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const resolveNormalizeRe = /\b([A-Za-z_]\w*)\s*=\s*([A-Za-z_]\w*)\s*\.\s*resolve\s*\([^)]*\)\s*\.\s*normalize\s*\(\s*\)/;
+  const startsWithGuardRe = (varName, rootName) => new RegExp(`if\\s*\\(\\s*!\\s*${varName}\\s*\\.\\s*startsWith\\s*\\(\\s*${rootName}\\s*\\)\\s*\\)`);
+  const terminatorRe = /\b(throw|return)\b/;
+  const candidates = [];
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = resolveNormalizeRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    candidates.push({ line: i2 + 1, fullVar: m[1], rootVar: m[2] });
+  }
+  if (candidates.length === 0)
+    return sanitizers;
+  for (const c of candidates) {
+    const guardRe = startsWithGuardRe(c.fullVar, c.rootVar);
+    let guardLine = -1;
+    for (let l = c.line;l < Math.min(lines.length, c.line + 6); l++) {
+      if (!guardRe.test(lines[l]))
+        continue;
+      if (terminatorRe.test(lines[l]) || l + 1 < lines.length && terminatorRe.test(lines[l + 1])) {
+        guardLine = l + 1;
+        break;
+      }
+    }
+    if (guardLine < 0)
+      continue;
+    const varRefRe = new RegExp(`\\b${c.fullVar}\\b`);
+    sanitizers.push({
+      type: "java_path_normalize_startswith_guard",
+      method: "normalize",
+      line: c.line,
+      sanitizes: ["path_traversal", "external_taint_escape"]
+    });
+    for (let l = c.line;l < lines.length; l++) {
+      if (!varRefRe.test(lines[l]))
+        continue;
+      sanitizers.push({
+        type: "java_path_normalize_startswith_guard",
+        method: "normalize",
+        line: l + 1,
+        sanitizes: ["path_traversal", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findJavaInlineCrlfStripLogSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const logCallStart = /\b(?:log|logger|LOG|LOGGER|slog|LOGGER_)\s*\.\s*(?:info|warn|error|debug|trace|fatal|severe|warning|fine|finer|finest|config)\s*\(/;
+  const crlfReplaceAll = /\.\s*replaceAll\s*\(\s*"\[[^"]*\\\\?[rnt][^"]*\]"/;
+  const crlfReplaceChar = /\.\s*replace\s*\(\s*'(?:\\\\?[rnt])'\s*,/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const text = lines[i2];
+    if (!logCallStart.test(text))
+      continue;
+    if (!crlfReplaceAll.test(text) && !crlfReplaceChar.test(text))
+      continue;
+    sanitizers.push({
+      type: "java_inline_crlf_strip_log",
+      method: "replaceAll",
+      line: i2 + 1,
+      sanitizes: ["log_injection", "external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJavaArgvFormExecSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const argvExecRe = /\.\s*exec\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
+  const argvPbRe = /\bnew\s+ProcessBuilder\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const text = lines[i2];
+    if (!argvExecRe.test(text) && !argvPbRe.test(text))
+      continue;
+    sanitizers.push({
+      type: "java_argv_form_exec",
+      method: "exec",
+      line: i2 + 1,
+      sanitizes: ["command_injection", "external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findRustArgvCommandSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const argvCommandRe = /\bCommand\s*::\s*new\s*\(\s*"[^"]*"\s*\)\s*\.\s*arg\s*\(/;
+  const shellArgvRe = /\bCommand\s*::\s*new\s*\(\s*"(?:sh|bash|zsh|ksh|dash|cmd(?:\.exe)?|powershell|pwsh)"\s*\)\s*\.\s*arg\s*\(\s*"-c"/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const text = lines[i2];
+    if (!argvCommandRe.test(text))
+      continue;
+    if (shellArgvRe.test(text))
+      continue;
+    sanitizers.push({
+      type: "rust_argv_command",
+      method: "arg",
+      line: i2 + 1,
+      sanitizes: ["command_injection", "external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findPythonJinjaAutoescapeSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const envAssignRe = /\b([A-Za-z_]\w*)\s*=\s*Environment\s*\(/;
+  const autoescapeOnRe = /\bautoescape\s*=/;
+  const autoescapeOffRe = /\bautoescape\s*=\s*(?:False|None|0)\b/;
+  const envVars = new Set;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = envAssignRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    if (!autoescapeOnRe.test(lines[i2]))
+      continue;
+    if (autoescapeOffRe.test(lines[i2]))
+      continue;
+    envVars.add(m[1]);
+  }
+  if (envVars.size === 0)
+    return sanitizers;
+  for (const envVar of envVars) {
+    const renderChainRe = new RegExp(`\\b${envVar}\\s*\\.\\s*get_template\\s*\\([^)]*\\)\\s*\\.\\s*render\\s*\\(`);
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      if (!renderChainRe.test(lines[i2]))
+        continue;
+      sanitizers.push({
+        type: "python_jinja_autoescape",
+        method: "render",
+        line: i2 + 1,
+        sanitizes: ["xss", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function collectEnvSecretVars(lines, language) {
   const out2 = new Map;
   for (let i2 = 0;i2 < lines.length; i2++) {
@@ -38028,7 +38272,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.125.0";
+var version = "3.128.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.125.0",
+  "version": "3.128.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.125.0"
+    "circle-ir": "^3.128.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",