cognium-dev 3.133.0 → 3.135.0

package/dist/cli.js

@@ -22613,6 +22613,9 @@ class LanguageSourcesPass {
       for (const finding of findGoPluginOpenCodeInjectionFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findGoMongoNosqlInjectionFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python") {
       additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
@@ -22637,6 +22640,9 @@ class LanguageSourcesPass {
       for (const finding of findPythonInteractiveInterpreterCodeInjectionFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findPythonMongoengineWhereNosqlInjectionFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
@@ -22700,6 +22706,12 @@ class LanguageSourcesPass {
       for (const finding of findJavaResponseWriterXssFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJavaMongoNosqlInjectionFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findJavaUrlOpenStreamSsrfFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python" || language === "javascript" || language === "typescript" || language === "go") {
       const exfilFindings = findExternalSecretExfiltrationFindings(code, graph.ir.meta.file, language);
@@ -26680,6 +26692,350 @@ function findRustEvalCrateCodeInjectionFindings(code, file) {
   }
   return findings;
 }
+function findGoMongoNosqlInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/(\bbson\s*\.\s*[MDAE]\b|mongo-driver|\*\s*mongo\.Collection)/.test(code)) {
+    return findings;
+  }
+  const lines = code.split(`
+`);
+  const reqExtractRe = /\b\w+\s*\.\s*(?:FormValue|PostFormValue|URL\s*\.\s*Query\s*\(\s*\)\s*\.\s*Get|Header\s*\.\s*Get|Cookie)\s*\(/;
+  const httpReqParamRe = /\*\s*http\.Request\b/;
+  const opsAlt = "(?:FindOne|Find|InsertOne|InsertMany|UpdateOne|UpdateMany|DeleteOne|DeleteMany|FindOneAndUpdate|FindOneAndDelete|FindOneAndReplace|Aggregate)";
+  const callHeadRe = new RegExp(`\\.\\s*(${opsAlt})\\s*\\(`);
+  function extractBalanced(line, openIdx) {
+    let depth = 0;
+    for (let k = openIdx;k < line.length; k++) {
+      const ch = line[k];
+      if (ch === "(")
+        depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0)
+          return line.substring(openIdx + 1, k);
+      }
+    }
+    return null;
+  }
+  const funcs = [];
+  let cur = null;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const t = lines[i2].trim();
+    if (/^func\b/.test(t)) {
+      if (cur) {
+        cur.end = i2 - 1;
+        funcs.push(cur);
+      }
+      cur = { start: i2, end: lines.length - 1 };
+    }
+  }
+  if (cur)
+    funcs.push(cur);
+  for (const fn of funcs) {
+    const header = lines[fn.start];
+    if (!httpReqParamRe.test(header))
+      continue;
+    const taintedVars = new Set;
+    for (let pass = 0;pass < 3; pass++) {
+      const before = taintedVars.size;
+      for (let i2 = fn.start;i2 <= fn.end; i2++) {
+        const trimmed = lines[i2].trim();
+        const assignMatch = trimmed.match(/^(\w+)\s*(?::=|=)\s*(.+?)(?:\s*\/\/.*)?$/);
+        if (!assignMatch)
+          continue;
+        const lhs = assignMatch[1];
+        const rhs = assignMatch[2];
+        if (taintedVars.has(lhs))
+          continue;
+        if (reqExtractRe.test(rhs)) {
+          taintedVars.add(lhs);
+          continue;
+        }
+        for (const v of taintedVars) {
+          if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+            taintedVars.add(lhs);
+            break;
+          }
+        }
+      }
+      if (taintedVars.size === before)
+        break;
+    }
+    if (taintedVars.size === 0)
+      continue;
+    for (let i2 = fn.start;i2 <= fn.end; i2++) {
+      const line = lines[i2];
+      const m = callHeadRe.exec(line);
+      if (!m)
+        continue;
+      const op = m[1];
+      const openIdx = m.index + m[0].length - 1;
+      const args2 = extractBalanced(line, openIdx);
+      if (args2 === null || args2.length === 0)
+        continue;
+      let tainted = reqExtractRe.test(args2);
+      if (!tainted) {
+        for (const v of taintedVars) {
+          if (new RegExp(`\\b${v}\\b`).test(args2)) {
+            tainted = true;
+            break;
+          }
+        }
+      }
+      if (!tainted)
+        continue;
+      findings.push({
+        id: `nosql_injection-${file}-${i2 + 1}-go-mongo-${op.toLowerCase()}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "nosql_injection",
+        cwe: "CWE-943",
+        severity: "critical",
+        level: "error",
+        message: `NoSQL injection: Go MongoDB driver \`${op}(...)\` called with a ` + "filter derived from *http.Request input. Untrusted values inside " + "a `bson.M` / `bson.D` filter can be operator objects (e.g. " + '`{"$ne": null}`) and bypass authentication/intent. Validate or ' + "coerce the value to a primitive before building the filter.",
+        file,
+        line: i2 + 1,
+        snippet: line.trim()
+      });
+    }
+  }
+  return findings;
+}
+function findJavaMongoNosqlInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/(MongoCollection\b|com\.mongodb\b|\bFilters\b|\bnew\s+Document\s*\()/.test(code)) {
+    return findings;
+  }
+  const lines = code.split(`
+`);
+  const reqExtractRe = /\b\w+\s*\.\s*(?:getParameter|getParameterValues|getHeader|getHeaders|getCookies|getReader|getQueryString|getRequestURI|getInputStream|getPart|getParts)\s*\(/;
+  const opsAlt = "(?:find|findOne|findOneAndUpdate|findOneAndDelete|findOneAndReplace|insertOne|insertMany|updateOne|updateMany|deleteOne|deleteMany|replaceOne|aggregate|countDocuments|distinct)";
+  const callRe = new RegExp(`\\.\\s*(${opsAlt})\\s*\\(([\\s\\S]*?)\\)`);
+  const taintedVars = new Set;
+  for (let pass = 0;pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      const a = t.match(/^(?:final\s+)?(?:[\w<>?,\[\]]+\s+)?(\w+)\s*=\s*(.+?);?$/);
+      if (!a)
+        continue;
+      const lhs = a[1];
+      const rhs = a[2];
+      if (taintedVars.has(lhs))
+        continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  if (taintedVars.size === 0)
+    return findings;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const m = line.match(callRe);
+    if (!m)
+      continue;
+    const op = m[1];
+    const args2 = m[2];
+    if (args2.trim().length === 0)
+      continue;
+    let tainted = reqExtractRe.test(args2);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(args2)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted)
+      continue;
+    findings.push({
+      id: `nosql_injection-${file}-${i2 + 1}-java-mongo-${op.toLowerCase()}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "nosql_injection",
+      cwe: "CWE-943",
+      severity: "critical",
+      level: "error",
+      message: `NoSQL injection: Java Mongo driver \`${op}(...)\` called with a ` + "filter derived from servlet request input. Untrusted values can " + "reach BSON operator positions and bypass intent. Validate the " + "input type before constructing the filter (e.g. require String).",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findPythonMongoengineWhereNosqlInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/['"]\$where['"]/.test(code))
+    return findings;
+  const lines = code.split(`
+`);
+  const reqExtractRe = /\b(?:request\.(?:args|form|values|json|files|cookies|headers|data)\b|flask\.request\b)/;
+  const taintedVars = new Set;
+  for (let pass = 0;pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("#"))
+        continue;
+      const a = t.match(/^(\w+)\s*=\s*(.+?)$/);
+      if (!a)
+        continue;
+      const lhs = a[1];
+      const rhs = a[2];
+      if (taintedVars.has(lhs))
+        continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  const whereRe = /['"]\$where['"]\s*:\s*([^,}\n]+)/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const m = line.match(whereRe);
+    if (!m)
+      continue;
+    const valueExpr = m[1].trim();
+    if (/^"[^"]*"$/.test(valueExpr) || /^'[^']*'$/.test(valueExpr))
+      continue;
+    let tainted = reqExtractRe.test(valueExpr);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(valueExpr)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted)
+      continue;
+    findings.push({
+      id: `nosql_injection-${file}-${i2 + 1}-py-mongoengine-where`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "nosql_injection",
+      cwe: "CWE-943",
+      severity: "critical",
+      level: "error",
+      message: 'NoSQL injection: mongoengine `__raw__={"$where": ...}` payload ' + "derived from HTTP request input. The `$where` operator evaluates " + "JavaScript on the server; tainted string concatenation lets an " + "attacker inject arbitrary JS. Replace `$where` with field-based " + "operators or validate the input.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findJavaUrlOpenStreamSsrfFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/\bnew\s+URL\s*\(/.test(code) && !/\bURI\s*\.\s*create\s*\(/.test(code)) {
+    return findings;
+  }
+  if (!/\.\s*(?:openStream|openConnection|getContent)\s*\(/.test(code)) {
+    return findings;
+  }
+  const lines = code.split(`
+`);
+  const reqExtractRe = /\b\w+\s*\.\s*(?:getParameter|getParameterValues|getHeader|getHeaders|getCookies|getReader|getQueryString|getRequestURI|getInputStream|getPart|getParts)\s*\(/;
+  const taintedVars = new Set;
+  for (let pass = 0;pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      const a = t.match(/^(?:final\s+)?(?:[\w<>?,\[\]]+\s+)?(\w+)\s*=\s*(.+?);?$/);
+      if (!a)
+        continue;
+      const lhs = a[1];
+      const rhs = a[2];
+      if (taintedVars.has(lhs))
+        continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  if (taintedVars.size === 0)
+    return findings;
+  const sinkRe = /\.\s*(openStream|openConnection|getContent)\s*\(/;
+  const seen = new Set;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const m = line.match(sinkRe);
+    if (!m)
+      continue;
+    const op = m[1];
+    const sinkIdx = line.indexOf(`.${op}`);
+    if (sinkIdx < 0)
+      continue;
+    const head = line.substring(0, sinkIdx + 1);
+    let tainted = reqExtractRe.test(head);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(head)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted)
+      continue;
+    const key = `${i2 + 1}:${op}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    findings.push({
+      id: `ssrf-${file}-${i2 + 1}-java-url-${op.toLowerCase()}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "ssrf",
+      cwe: "CWE-918",
+      severity: "critical",
+      level: "error",
+      message: `SSRF: Java \`URL.${op}()\` invoked on a URL derived from servlet ` + 'request input. Even when an `if (url.startsWith("https://"))` ' + "guard is present, the host portion remains attacker-controlled — " + "use a strict host allowlist (parse the URL, check `getHost()`) " + "before issuing the request.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
 
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
@@ -39807,7 +40163,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.133.0";
+var version = "3.135.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.133.0",
+  "version": "3.135.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.133.0"
+    "circle-ir": "^3.135.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",