cognium-dev 3.131.0 → 3.133.0

package/dist/cli.js

@@ -10902,8 +10902,8 @@ var DEFAULT_SINKS = [
   { method: "unmarshal", class: "Unmarshaller", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
   { method: "newTransformer", class: "TransformerFactory", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
   { method: "transform", class: "Transformer", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
-  { method: "sendRedirect", class: "HttpServletResponse", type: "ssrf", cwe: "CWE-601", severity: "high", arg_positions: [0] },
-  { method: "sendRedirect", type: "ssrf", cwe: "CWE-601", severity: "high", arg_positions: [0] },
+  { method: "sendRedirect", class: "HttpServletResponse", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
+  { method: "sendRedirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
   { method: "openConnection", class: "URL", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
   { method: "openStream", class: "URL", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [] },
   { method: "execute", class: "HttpClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
@@ -13400,19 +13400,19 @@ function formatCallCode(call) {
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment"],
-    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment"],
-    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf"],
-    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf"],
-    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment"],
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect"],
+    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect"],
+    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect"],
+    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect"],
+    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect"],
     io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection"],
     file_input: ["deserialization", "xxe", "path_traversal", "command_injection", "code_injection"],
     network_input: ["sql_injection", "command_injection", "xss", "ssrf"],
     config_param: ["sql_injection", "command_injection", "path_traversal", "xss", "ssrf"],
-    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment"],
+    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect"],
     plugin_param: ["sql_injection", "command_injection", "path_traversal", "xss", "code_injection"]
   };
   const validSinks = sourceToSinkMapping[sourceType];
@@ -22607,6 +22607,12 @@ class LanguageSourcesPass {
       for (const finding of findGoXssFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findGoLocationHeaderOpenRedirectFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findGoPluginOpenCodeInjectionFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python") {
       additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
@@ -22625,6 +22631,12 @@ class LanguageSourcesPass {
       for (const finding of findPythonJinjaMarkupXssFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findPythonHeadersSubscriptOpenRedirectFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findPythonInteractiveInterpreterCodeInjectionFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
@@ -22646,6 +22658,12 @@ class LanguageSourcesPass {
       for (const finding of findRustWeakCryptoEcbFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findRustAppendHeaderTupleOpenRedirectFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findRustEvalCrateCodeInjectionFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "javascript" || language === "typescript" || language === "htmljs") {
       additionalSanitizers.push(...findJsSafeJsonParseSanitizers(code));
@@ -22664,6 +22682,12 @@ class LanguageSourcesPass {
       for (const finding of findTsAngularBypassXssFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJsDomOpenRedirectFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findJsIndirectEvalCodeInjectionFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
@@ -25907,6 +25931,755 @@ function findPythonJinjaMarkupXssFindings(code, file) {
   }
   return out2;
 }
+function findGoLocationHeaderOpenRedirectFindings(code, file) {
+  const out2 = [];
+  const lines = code.split(`
+`);
+  const rwNames = new Set;
+  const sigRe = /\(\s*([A-Za-z_]\w*)\s+http\.ResponseWriter\b/g;
+  for (const line of lines) {
+    let m;
+    sigRe.lastIndex = 0;
+    while ((m = sigRe.exec(line)) !== null)
+      rwNames.add(m[1]);
+  }
+  if (rwNames.size === 0)
+    return out2;
+  const safeWrapRe = /\b(?:net\/url|url)\.Parse\b[\s\S]{0,120}?\b(?:IsAbs|Host)\b|\bstrings\.HasPrefix\s*\(/;
+  const callRe = /\b([A-Za-z_]\w*)\s*\.\s*Header\s*\(\s*\)\s*\.\s*(?:Set|Add)\s*\(\s*(['"])([^'"]+)\2\s*,\s*([\s\S]*)\)\s*(?:\/\/.*)?$/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//"))
+      continue;
+    const m = trimmed.match(callRe);
+    if (!m)
+      continue;
+    const recv = m[1];
+    if (!rwNames.has(recv))
+      continue;
+    const key = m[3];
+    if (key.toLowerCase() !== "location")
+      continue;
+    const valExpr = m[4];
+    const valTrim = valExpr.trim();
+    if (/^"(?:\\.|[^"\\])*"$/.test(valTrim))
+      continue;
+    if (safeWrapRe.test(valExpr))
+      continue;
+    out2.push({
+      id: `open_redirect-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "open_redirect",
+      cwe: "CWE-601",
+      severity: "high",
+      level: "error",
+      message: 'Open redirect: ResponseWriter.Header().Set("Location", ...) ' + "writes a user-controlled value into the Location header without " + "validating the target. Restrict to an allow-list of hosts/paths " + "or compare against a known-safe set before issuing the redirect.",
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findPythonHeadersSubscriptOpenRedirectFindings(code, file) {
+  const out2 = [];
+  const lines = code.split(`
+`);
+  const requestSourceRe = /\b([A-Za-z_]\w*)\s*=\s*request\s*\.\s*(?:args|form|values|files|json|cookies|headers)(?:\s*\.\s*get\s*\(|\s*\[)/;
+  const taintedVars = new Set;
+  for (const line of lines) {
+    const m = line.match(requestSourceRe);
+    if (m)
+      taintedVars.add(m[1]);
+  }
+  const safeWrapRe = /\b(?:urllib\.parse\.urlparse|urlparse)\s*\([\s\S]{0,120}?\bnetloc\b|\b(?:startswith)\s*\(/;
+  const subscriptRe = /\b([A-Za-z_]\w*)\s*\.\s*headers\s*\[\s*(['"])([^'"]+)\2\s*\]\s*=\s*(.+)$/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const m = trimmed.match(subscriptRe);
+    if (!m)
+      continue;
+    const key = m[3];
+    if (key.toLowerCase() !== "location")
+      continue;
+    const rhs = m[4].replace(/\s*(?:#.*)?$/, "").trim();
+    if (/^['"](?:\\.|[^'"\\])*['"]$/.test(rhs))
+      continue;
+    if (safeWrapRe.test(rhs))
+      continue;
+    const hasTaintedVar = [...taintedVars].some((v) => new RegExp(`\\b${v}\\b`).test(rhs));
+    const inlineSource = /\brequest\s*\.\s*(?:args|form|values|files|cookies|headers|json)(?:\s*\.\s*get\s*\(|\s*\[)/.test(rhs);
+    if (!hasTaintedVar && !inlineSource)
+      continue;
+    out2.push({
+      id: `open_redirect-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "open_redirect",
+      cwe: "CWE-601",
+      severity: "high",
+      level: "error",
+      message: 'Open redirect: response.headers["Location"] = ... assigns a ' + "user-controlled value to the Location header. Validate the URL " + "against an allow-list of trusted hosts before sending.",
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findRustAppendHeaderTupleOpenRedirectFindings(code, file) {
+  const out2 = [];
+  const lines = code.split(`
+`);
+  const extractorRe = /\b([A-Za-z_]\w*)\s*:\s*(?:web\s*::\s*)?(?:Query|Path|Form|Json)\s*<|\b([A-Za-z_]\w*)\s*:\s*&?\s*HttpRequest\b/g;
+  const extractorParams = new Set;
+  for (const line of lines) {
+    let m;
+    extractorRe.lastIndex = 0;
+    while ((m = extractorRe.exec(line)) !== null) {
+      const name2 = m[1] ?? m[2];
+      if (name2)
+        extractorParams.add(name2);
+    }
+  }
+  if (extractorParams.size === 0)
+    return out2;
+  const taintedVars = new Set(extractorParams);
+  const letRe = /\blet\s+(?:mut\s+)?([A-Za-z_]\w*)\s*(?::[^=]+)?=\s*([^;]+);/g;
+  for (let pass = 0;pass < 4; pass++) {
+    const before = taintedVars.size;
+    let lm;
+    letRe.lastIndex = 0;
+    while ((lm = letRe.exec(code)) !== null) {
+      const name2 = lm[1];
+      const rhs = lm[2];
+      if (taintedVars.has(name2))
+        continue;
+      for (const tv of taintedVars) {
+        if (new RegExp(`\\b${tv}\\b`).test(rhs)) {
+          taintedVars.add(name2);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  const safeWrapRe = /\b(?:Url\s*::\s*parse|url\s*::\s*Url\s*::\s*parse)\s*\([\s\S]{0,160}?\b(?:host_str|host|origin)\b/;
+  const tupleCallRe = /\.\s*(?:append_header|insert_header)\s*\(\s*\(\s*(['"])([^'"]+)\1\s*,\s*([^)]*?)\s*\)\s*\)/g;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//"))
+      continue;
+    let cm;
+    tupleCallRe.lastIndex = 0;
+    while ((cm = tupleCallRe.exec(raw)) !== null) {
+      const key = cm[2];
+      if (key.toLowerCase() !== "location")
+        continue;
+      const valExpr = cm[3];
+      if (/^['"](?:\\.|[^'"\\])*['"]$/.test(valExpr.trim()))
+        continue;
+      if (safeWrapRe.test(valExpr))
+        continue;
+      const hasTainted = [...taintedVars].some((v) => new RegExp(`\\b${v}\\b`).test(valExpr));
+      if (!hasTainted)
+        continue;
+      out2.push({
+        id: `open_redirect-${file}-${i2 + 1}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "open_redirect",
+        cwe: "CWE-601",
+        severity: "high",
+        level: "error",
+        message: "Open redirect: HttpResponse builder " + '.append_header(("Location", ...)) sets the Location header from ' + "a request-derived value without allow-list validation. Parse " + "with url::Url::parse and compare host_str against an allow-list.",
+        file,
+        line: i2 + 1,
+        snippet: trimmed.substring(0, 100)
+      });
+      break;
+    }
+  }
+  return out2;
+}
+function findJsDomOpenRedirectFindings(code, file) {
+  const out2 = [];
+  const lines = code.split(`
+`);
+  const domSourceRe = /\blocation\s*\.\s*(?:search|hash|href|pathname)\b|\bwindow\s*\.\s*location\s*\.\s*(?:search|hash|href|pathname)\b|\bURLSearchParams\b|\bdocument\s*\.\s*(?:referrer|URL|location\s*\.\s*(?:search|hash|href|pathname))\b|\bwindow\s*\.\s*name\b/;
+  const taintedVars = new Set;
+  const assignRe = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+  let am;
+  assignRe.lastIndex = 0;
+  while ((am = assignRe.exec(code)) !== null) {
+    if (domSourceRe.test(am[2]))
+      taintedVars.add(am[1]);
+  }
+  for (let pass = 0;pass < 4; pass++) {
+    const before = taintedVars.size;
+    assignRe.lastIndex = 0;
+    while ((am = assignRe.exec(code)) !== null) {
+      if (taintedVars.has(am[1]))
+        continue;
+      for (const tv of taintedVars) {
+        if (new RegExp(`\\b${tv}\\b`).test(am[2])) {
+          taintedVars.add(am[1]);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  const safeWrapRe = /\b(?:startsWith|includes)\s*\(\s*['"`]\/[^'"`]*['"`]\s*\)|\bnew\s+URL\s*\([\s\S]{0,80}?\)\s*\.\s*(?:origin|hostname)\s*===/;
+  const containsTaint = (expr) => {
+    if (domSourceRe.test(expr))
+      return true;
+    for (const tv of taintedVars) {
+      if (new RegExp(`\\b${tv}\\b`).test(expr))
+        return true;
+    }
+    return false;
+  };
+  const hrefSinkRe = /\b(?:(?:window|document|self|top|parent)\s*\.\s*)?location\s*\.\s*href\s*=\s*([^;\n]+?)\s*;?\s*(?:\/\/.*)?$/;
+  const locSinkRe = /\b(?:window|document|self|top|parent)\s*\.\s*location\s*=\s*([^;\n]+?)\s*;?\s*(?:\/\/.*)?$/;
+  const contentSinkRe = /\.\s*content\s*=\s*([^\n]+?)\s*$/;
+  const callSinkRe = /\b(?:(?:window|document|self|top|parent)\s*\.\s*)?location\s*\.\s*(?:assign|replace)\s*\(\s*([^)]+)\)/;
+  const emit = (line, msg, snippet) => {
+    out2.push({
+      id: `open_redirect-${file}-${line}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "open_redirect",
+      cwe: "CWE-601",
+      severity: "high",
+      level: "error",
+      message: msg,
+      file,
+      line,
+      snippet: snippet.substring(0, 100)
+    });
+  };
+  const isLiteralOnly = (expr) => /^['"`](?:\\.|[^'"`\\])*['"`]$/.test(expr.trim());
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//"))
+      continue;
+    let matched = false;
+    const hm = trimmed.match(hrefSinkRe);
+    if (hm) {
+      const rhs = hm[1].trim();
+      if (!isLiteralOnly(rhs) && containsTaint(rhs) && !safeWrapRe.test(rhs)) {
+        emit(i2 + 1, "Open redirect: assignment to location.href uses a value " + "derived from a URL query/hash without allow-list validation. " + "Compare the target origin to a known-safe set before navigating.", trimmed);
+        matched = true;
+      }
+    }
+    if (!matched) {
+      const lm = trimmed.match(locSinkRe);
+      if (lm) {
+        const rhs = lm[1].trim();
+        if (!isLiteralOnly(rhs) && containsTaint(rhs) && !safeWrapRe.test(rhs)) {
+          emit(i2 + 1, "Open redirect: assignment to window.location uses a value " + "derived from a URL query/hash without allow-list validation. " + "Compare the target origin to a known-safe set before navigating.", trimmed);
+          matched = true;
+        }
+      }
+    }
+    if (!matched) {
+      const cm = trimmed.match(contentSinkRe);
+      if (cm) {
+        const rhs = cm[1].replace(/\s*\/\/.*$/, "").replace(/\s*;\s*$/, "").trim();
+        if (!isLiteralOnly(rhs) && /['"`][^'"`]*\burl\s*=/i.test(rhs) && containsTaint(rhs) && !safeWrapRe.test(rhs)) {
+          emit(i2 + 1, "Open redirect: DOM assignment to <meta>.content with a " + "meta-refresh URL built from a URL query/hash without " + "allow-list validation. Validate origin before navigating.", trimmed);
+          matched = true;
+        }
+      }
+    }
+    if (!matched) {
+      const callm = trimmed.match(callSinkRe);
+      if (callm) {
+        const arg = callm[1].trim();
+        if (!isLiteralOnly(arg) && containsTaint(arg) && !safeWrapRe.test(arg)) {
+          emit(i2 + 1, "Open redirect: location.assign / location.replace invoked " + "with a value derived from a URL query/hash without allow-" + "list validation. Validate origin before navigating.", trimmed);
+        }
+      }
+    }
+  }
+  return out2;
+}
+function findGoPluginOpenCodeInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/\bplugin\s*\.\s*(?:Open|Lookup)\s*\(/.test(code))
+    return findings;
+  const lines = code.split(`
+`);
+  const reqExtractRe = /\b\w+\s*\.\s*(?:FormValue|PostFormValue|URL\.Query\(\)\.Get|Header\.Get|Cookie)\s*\(/;
+  const httpReqParamRe = /\*\s*http\.Request\b/;
+  const callRe = /\bplugin\s*\.\s*(?:Open|Lookup)\s*\(\s*([^)]*)\s*\)/;
+  const sinkLabel = (op) => op === "Lookup" ? "Go plugin.Lookup" : "Go plugin.Open";
+  const funcs = [];
+  let cur = null;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const t = lines[i2].trim();
+    if (/^func\b/.test(t)) {
+      if (cur) {
+        cur.end = i2 - 1;
+        funcs.push(cur);
+      }
+      cur = { start: i2, end: lines.length - 1 };
+    }
+  }
+  if (cur)
+    funcs.push(cur);
+  for (const fn of funcs) {
+    const header = lines[fn.start];
+    if (!httpReqParamRe.test(header))
+      continue;
+    const taintedVars = new Set;
+    for (let pass = 0;pass < 3; pass++) {
+      const before = taintedVars.size;
+      for (let i2 = fn.start;i2 <= fn.end; i2++) {
+        const line = lines[i2];
+        const trimmed = line.trim();
+        const assignMatch = trimmed.match(/^(\w+)\s*(?::=|=)\s*(.+?)(?:\s*\/\/.*)?$/);
+        if (!assignMatch)
+          continue;
+        const lhs = assignMatch[1];
+        const rhs = assignMatch[2];
+        if (taintedVars.has(lhs))
+          continue;
+        if (reqExtractRe.test(rhs)) {
+          taintedVars.add(lhs);
+          continue;
+        }
+        for (const v of taintedVars) {
+          const re = new RegExp(`\\b${v}\\b`);
+          if (re.test(rhs)) {
+            taintedVars.add(lhs);
+            break;
+          }
+        }
+      }
+      if (taintedVars.size === before)
+        break;
+    }
+    if (taintedVars.size === 0)
+      continue;
+    for (let i2 = fn.start;i2 <= fn.end; i2++) {
+      const line = lines[i2];
+      const m = line.match(callRe);
+      if (!m)
+        continue;
+      const arg = m[1].trim();
+      if (arg.length === 0)
+        continue;
+      if (/^"[^"]*"$/.test(arg))
+        continue;
+      let tainted = false;
+      if (reqExtractRe.test(arg))
+        tainted = true;
+      else {
+        for (const v of taintedVars) {
+          const re = new RegExp(`\\b${v}\\b`);
+          if (re.test(arg)) {
+            tainted = true;
+            break;
+          }
+        }
+      }
+      if (!tainted)
+        continue;
+      const op = /\bplugin\s*\.\s*Lookup\b/.test(line) ? "Lookup" : "Open";
+      findings.push({
+        id: `code_injection-${file}-${i2 + 1}-go-plugin-${op.toLowerCase()}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "code_injection",
+        cwe: "CWE-94",
+        severity: "critical",
+        level: "error",
+        message: `Code injection: ${sinkLabel(op)} called with a path/symbol derived ` + "from an *http.Request without an allow-list. Loading a plugin " + "runs its init() and exposes arbitrary exported symbols. Restrict " + "the path to a trusted directory or use a fixed allow-list.",
+        file,
+        line: i2 + 1,
+        snippet: line.trim()
+      });
+    }
+  }
+  return findings;
+}
+function findJsIndirectEvalCodeInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/\beval\b/.test(code))
+    return findings;
+  const lines = code.split(`
+`);
+  const reqExtractRe = /\breq(?:uest)?\s*\.\s*(?:body|query|params|headers|cookies)\b/;
+  const aliasRe = /^\s*(?:const|let|var)\s+(\w+)\s*=\s*(?:globalThis\s*\.\s*eval|global\s*\.\s*eval|window\s*\.\s*eval|self\s*\.\s*eval|eval)\s*;?\s*$/;
+  const aliases = new Set;
+  for (const line of lines) {
+    const m = line.match(aliasRe);
+    if (m)
+      aliases.add(m[1]);
+  }
+  const taintedVars = new Set;
+  const assignRe = /^\s*(?:const|let|var)\s+(\w+)\s*=\s*(.+?);?\s*$/;
+  const reassignRe = /^\s*(\w+)\s*=\s*(.+?);?\s*$/;
+  for (let pass = 0;pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (const line of lines) {
+      const m = line.match(assignRe) || line.match(reassignRe);
+      if (!m)
+        continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs))
+        continue;
+      if (lhs === "const" || lhs === "let" || lhs === "var")
+        continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        const re = new RegExp(`\\b${v}\\b`);
+        if (re.test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  const indirectCommaRe = /\(\s*0\s*,\s*eval\s*\)\s*\(\s*([^)]*)\s*\)/;
+  const indirectMemberRe = /\b(?:globalThis|global|window|self)\s*\.\s*eval\s*\(\s*([^)]*)\s*\)/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("//") || trimmed.startsWith("*"))
+      continue;
+    if (aliasRe.test(line))
+      continue;
+    let arg = null;
+    let formLabel = "";
+    let m = trimmed.match(indirectCommaRe);
+    if (m) {
+      arg = m[1].trim();
+      formLabel = "(0, eval)(...) indirect eval";
+    }
+    if (!arg) {
+      m = trimmed.match(indirectMemberRe);
+      if (m) {
+        arg = m[1].trim();
+        formLabel = "globalThis.eval / window.eval / self.eval indirect eval";
+      }
+    }
+    if (!arg && aliases.size > 0) {
+      for (const a of aliases) {
+        const aliasCallRe = new RegExp(`\\b${a}\\s*\\(\\s*([^)]*)\\s*\\)`);
+        const mm = trimmed.match(aliasCallRe);
+        if (mm) {
+          arg = mm[1].trim();
+          formLabel = `aliased eval reference \`${a}(...)\``;
+          break;
+        }
+      }
+    }
+    if (arg === null)
+      continue;
+    if (arg.length === 0)
+      continue;
+    if (/^['"`][^'"`]*['"`]$/.test(arg))
+      continue;
+    let tainted = false;
+    if (reqExtractRe.test(arg))
+      tainted = true;
+    else {
+      for (const v of taintedVars) {
+        const re = new RegExp(`\\b${v}\\b`);
+        if (re.test(arg)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted)
+      continue;
+    findings.push({
+      id: `code_injection-${file}-${i2 + 1}-js-indirect-eval`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "code_injection",
+      cwe: "CWE-94",
+      severity: "critical",
+      level: "error",
+      message: `Code injection: ${formLabel} called with a value derived from ` + "an HTTP request body/query/headers. Indirect eval forms still " + "execute arbitrary code in the global scope. Remove the eval and " + "parse the input with a safe data parser instead.",
+      file,
+      line: i2 + 1,
+      snippet: trimmed
+    });
+  }
+  return findings;
+}
+function findPythonInteractiveInterpreterCodeInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/^\s*import\s+code\b/m.test(code))
+    return findings;
+  if (!/\bcode\s*\.\s*(?:InteractiveInterpreter|InteractiveConsole|compile_command)\b/.test(code)) {
+    return findings;
+  }
+  const lines = code.split(`
+`);
+  const reqExtractRe = /\brequest\s*\.\s*(?:args|form|values|files|json|cookies|headers|get_data|get_json)\b/;
+  const taintedVars = new Set;
+  const assignRe = /^\s*(\w+)\s*=\s*(.+?)\s*(?:#.*)?$/;
+  for (let pass = 0;pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (const line of lines) {
+      const m = line.match(assignRe);
+      if (!m)
+        continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs))
+        continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        const re = new RegExp(`\\b${v}\\b`);
+        if (re.test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  const callRe = /\bcode\s*\.\s*(?:InteractiveInterpreter|InteractiveConsole)\s*\([^)]*\)\s*\.\s*(runsource|runcode|push|interact)\s*\(\s*([^),]+)/;
+  const compileRe = /\bcode\s*\.\s*compile_command\s*\(\s*([^),]+)/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const trimmed = line.trim();
+    let arg = null;
+    let formLabel = "";
+    const m1 = trimmed.match(callRe);
+    if (m1) {
+      arg = m1[2].trim();
+      formLabel = `code.${/Interpreter/.test(trimmed) ? "InteractiveInterpreter" : "InteractiveConsole"}().${m1[1]}`;
+    }
+    if (!arg) {
+      const m2 = trimmed.match(compileRe);
+      if (m2) {
+        arg = m2[1].trim();
+        formLabel = "code.compile_command";
+      }
+    }
+    if (arg === null)
+      continue;
+    if (arg.length === 0)
+      continue;
+    if (/^['"][^'"]*['"]$/.test(arg))
+      continue;
+    let tainted = false;
+    if (reqExtractRe.test(arg))
+      tainted = true;
+    else {
+      for (const v of taintedVars) {
+        const re = new RegExp(`\\b${v}\\b`);
+        if (re.test(arg)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted)
+      continue;
+    findings.push({
+      id: `code_injection-${file}-${i2 + 1}-py-interactive-interpreter`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "code_injection",
+      cwe: "CWE-94",
+      severity: "critical",
+      level: "error",
+      message: `Code injection: ${formLabel}(...) called with a value derived from ` + "a Flask request extractor. The Python `code` module compiles and " + "executes arbitrary source. Remove the call and validate input " + "against a fixed allow-list instead.",
+      file,
+      line: i2 + 1,
+      snippet: trimmed
+    });
+  }
+  return findings;
+}
+function findRustEvalCrateCodeInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/\b(?:evalexpr\s*::\s*eval|libloading\s*::\s*Library\s*::\s*new|\.\s*load\s*\([^)]*\)\s*\.\s*(?:exec|eval|call))/.test(code)) {
+    return findings;
+  }
+  const lines = code.split(`
+`);
+  const extractorTypeRe = /:\s*(?:String|Bytes|bytes::Bytes|axum::body::Bytes|web::Query\b|web::Path\b|web::Form\b|web::Json\b|HttpRequest\b|actix_web::HttpRequest\b)/;
+  const fns = [];
+  let cur = null;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const t = lines[i2];
+    if (/^\s*(?:pub\s+)?(?:async\s+)?fn\s+\w+\s*\(/.test(t)) {
+      if (cur) {
+        cur.end = i2 - 1;
+        fns.push(cur);
+      }
+      cur = { start: i2, end: lines.length - 1, tainted: new Set };
+      const headerJoined = (() => {
+        let j = i2;
+        let s = "";
+        while (j < lines.length && !/\{\s*$/.test(s)) {
+          s += lines[j];
+          if (/\{\s*$/.test(lines[j]))
+            break;
+          j++;
+          if (j - i2 > 12)
+            break;
+        }
+        return s;
+      })();
+      const open = headerJoined.indexOf("(");
+      const close = headerJoined.lastIndexOf(")");
+      if (open !== -1 && close > open) {
+        const params = headerJoined.substring(open + 1, close);
+        let depth = 0;
+        let buf = "";
+        const parts2 = [];
+        for (const ch of params) {
+          if (ch === "<" || ch === "(")
+            depth++;
+          else if (ch === ">" || ch === ")")
+            depth--;
+          if (ch === "," && depth === 0) {
+            parts2.push(buf);
+            buf = "";
+            continue;
+          }
+          buf += ch;
+        }
+        if (buf.trim().length > 0)
+          parts2.push(buf);
+        for (const p of parts2) {
+          const pm = p.match(/(?:mut\s+)?(\w+)\s*:/);
+          if (!pm)
+            continue;
+          if (extractorTypeRe.test(p))
+            cur.tainted.add(pm[1]);
+        }
+      }
+    }
+  }
+  if (cur)
+    fns.push(cur);
+  for (const fn of fns) {
+    for (let pass = 0;pass < 3; pass++) {
+      const before = fn.tainted.size;
+      for (let i2 = fn.start;i2 <= fn.end; i2++) {
+        const t = lines[i2].trim();
+        const m = t.match(/^let\s+(?:mut\s+)?(\w+)\s*(?::\s*[^=]+)?=\s*(.+?);?$/);
+        if (!m)
+          continue;
+        const lhs = m[1];
+        const rhs = m[2];
+        if (fn.tainted.has(lhs))
+          continue;
+        for (const v of fn.tainted) {
+          const re = new RegExp(`\\b${v}\\b`);
+          if (re.test(rhs)) {
+            fn.tainted.add(lhs);
+            break;
+          }
+        }
+      }
+      if (fn.tainted.size === before)
+        break;
+    }
+  }
+  const evalExprRe = /\bevalexpr\s*::\s*eval(?:_with_context|_boolean|_int|_float|_string|_tuple|_empty)?\s*\(\s*([^)]+)\s*\)/;
+  const libloadingRe = /\blibloading\s*::\s*Library\s*::\s*new\s*\(\s*([^)]+)\s*\)/;
+  const luaLoadRe = /\.\s*load\s*\(\s*([^)]+)\s*\)\s*\.\s*(?:exec|eval|call)\b/;
+  for (const fn of fns) {
+    if (fn.tainted.size === 0)
+      continue;
+    for (let i2 = fn.start;i2 <= fn.end; i2++) {
+      const line = lines[i2];
+      const trimmed = line.trim();
+      let arg = null;
+      let formLabel = "";
+      let m = trimmed.match(evalExprRe);
+      if (m) {
+        arg = m[1].trim();
+        formLabel = "evalexpr::eval";
+      }
+      if (!arg) {
+        m = trimmed.match(libloadingRe);
+        if (m) {
+          arg = m[1].trim();
+          formLabel = "libloading::Library::new";
+        }
+      }
+      if (!arg) {
+        m = trimmed.match(luaLoadRe);
+        if (m) {
+          arg = m[1].trim();
+          formLabel = "mlua/rlua Lua::load().{exec|eval|call}";
+        }
+      }
+      if (arg === null)
+        continue;
+      if (arg.length === 0)
+        continue;
+      let unwrapped = arg.replace(/^&\s*/, "").trim();
+      if (/^"[^"]*"$/.test(unwrapped))
+        continue;
+      let tainted = false;
+      for (const v of fn.tainted) {
+        const re = new RegExp(`\\b${v}\\b`);
+        if (re.test(unwrapped)) {
+          tainted = true;
+          break;
+        }
+      }
+      if (!tainted)
+        continue;
+      findings.push({
+        id: `code_injection-${file}-${i2 + 1}-rust-eval-crate`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "code_injection",
+        cwe: "CWE-94",
+        severity: "critical",
+        level: "error",
+        message: `Code injection: ${formLabel}(...) called with a value derived ` + "from an HTTP request extractor (body / Query / Path / Form / " + "Json / HttpRequest). The expression / library / Lua chunk is " + "executed as code. Remove the dynamic-eval path or restrict " + "input to a fixed allow-list.",
+        file,
+        line: i2 + 1,
+        snippet: trimmed
+      });
+    }
+  }
+  return findings;
+}
 
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
@@ -27371,13 +28144,13 @@ class TaintPropagationPass {
     }));
     const arrayFlows = detectArrayElementFlows(calls, sources, sinks, constProp.taintedArrayElements, constProp.unreachableLines, types) ?? [];
     for (const f of arrayFlows) {
-      if (!flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line)) {
+      if (!flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type)) {
         flows.push(f);
       }
     }
     const collectionFlows = detectCollectionFlows(calls, sources, sinks, constProp.tainted, constProp.unreachableLines, ctx.code, types) ?? [];
     for (const f of collectionFlows) {
-      if (flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line))
+      if (flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type))
         continue;
       const flowForCheck = {
         source: { line: f.source_line },
@@ -27399,7 +28172,7 @@ class TaintPropagationPass {
     }
     const paramFlows = detectParameterSinkFlows(types, calls, sources, sinks, constProp.unreachableLines, constProp.tainted, ctx.code) ?? [];
     for (const f of paramFlows) {
-      if (!flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line)) {
+      if (!flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type)) {
         flows.push(f);
       }
     }
@@ -27837,7 +28610,7 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
           }
           const paramSource = methodParamSources.get(arg.variable);
           if (paramSource) {
-            const exists = flows.some((f) => f.source_line === paramSource.line && f.sink_line === sink.line);
+            const exists = flows.some((f) => f.source_line === paramSource.line && f.sink_line === sink.line && f.sink_type === sink.type);
             if (!exists) {
               if (typeof code === "string" && isReassignedToLiteralBetween(code, arg.variable, paramSource.line, sink.line)) {
                 continue;
@@ -39034,7 +39807,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.131.0";
+var version = "3.133.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.131.0",
+  "version": "3.133.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.131.0"
+    "circle-ir": "^3.133.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",