cognium-dev 3.137.0 → 3.139.0

package/dist/cli.js

@@ -22619,6 +22619,12 @@ class LanguageSourcesPass {
       for (const finding of findGoLdapInjectionFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findGoGobDeserializationFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findGoXmlDecoderXxeFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "python") {
       additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
@@ -22652,6 +22658,9 @@ class LanguageSourcesPass {
       for (const finding of findPythonHeaderCrlfInjectionFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findPythonJinjaTemplateSstiFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
@@ -22715,6 +22724,15 @@ class LanguageSourcesPass {
       for (const finding of findJsLdapInjectionFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJsJsonParseBodyFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findJsDomXpathInjectionFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
+      for (const finding of findJsTemplateInjectionSstiFindings(code, graph.ir.meta.file)) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
@@ -27886,6 +27904,466 @@ function findRustLogInjectionFindings(code, file) {
   }
   return findings;
 }
+function findGoGobDeserializationFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/\bgob\s*\.\s*NewDecoder\s*\(/.test(code))
+    return findings;
+  if (!/\*http\.Request\b/.test(code) && !/\bhttp\.HandlerFunc\b/.test(code)) {
+    return findings;
+  }
+  const lines = code.split(`
+`);
+  const decoderFromBody = new Set;
+  const newDecoderAssignRe = /^(\w+)\s*(?::=|=)\s*gob\s*\.\s*NewDecoder\s*\(\s*([^)]+)\)/;
+  for (const raw of lines) {
+    const t = raw.trim();
+    if (t.startsWith("//"))
+      continue;
+    const m = t.match(newDecoderAssignRe);
+    if (!m)
+      continue;
+    const lhs = m[1];
+    const arg = m[2];
+    if (/\b\w+\s*\.\s*Body\b/.test(arg)) {
+      decoderFromBody.add(lhs);
+    }
+  }
+  const seen = new Set;
+  if (decoderFromBody.size > 0) {
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const line = lines[i2];
+      if (line.trim().startsWith("//"))
+        continue;
+      const m = line.match(/\b(\w+)\s*\.\s*Decode\s*\(/);
+      if (!m)
+        continue;
+      if (!decoderFromBody.has(m[1]))
+        continue;
+      if (seen.has(i2 + 1))
+        continue;
+      seen.add(i2 + 1);
+      findings.push({
+        id: `insecure_deserialization-${file}-${i2 + 1}-go-gob`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "insecure_deserialization",
+        cwe: "CWE-502",
+        severity: "critical",
+        level: "error",
+        message: "Insecure deserialization: `gob.NewDecoder(req.Body).Decode(...)` " + "reconstructs arbitrary registered Go types from attacker-controlled " + "bytes. Use an authenticated framing (signed/MAC payloads), avoid " + "decoding interface{} values, or switch to a schema-bound format " + "(JSON with explicit types, Protocol Buffers).",
+        file,
+        line: i2 + 1,
+        snippet: line.trim()
+      });
+    }
+  }
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("//"))
+      continue;
+    if (!/\bgob\s*\.\s*NewDecoder\s*\(\s*\w+\s*\.\s*Body\s*\)\s*\.\s*Decode\s*\(/.test(line)) {
+      continue;
+    }
+    if (seen.has(i2 + 1))
+      continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `insecure_deserialization-${file}-${i2 + 1}-go-gob-inline`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "insecure_deserialization",
+      cwe: "CWE-502",
+      severity: "critical",
+      level: "error",
+      message: "Insecure deserialization: `gob.NewDecoder(req.Body).Decode(...)` " + "reconstructs arbitrary registered Go types from attacker-controlled " + "bytes. Use an authenticated framing (signed/MAC payloads), avoid " + "decoding interface{} values, or switch to a schema-bound format " + "(JSON with explicit types, Protocol Buffers).",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findJsJsonParseBodyFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/\bJSON\s*\.\s*parse\s*\(/.test(code))
+    return findings;
+  if (!/\breq\s*\.\s*body\b/.test(code))
+    return findings;
+  const lines = code.split(`
+`);
+  const reqBodyRe = /\breq\s*\.\s*body\b/;
+  const taintedVars = new Set;
+  for (let pass = 0;pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("//"))
+        continue;
+      const m = t.match(/^(?:const|let|var)\s+(\w+)(?:\s*:\s*[^=]+)?\s*=\s*(.+?);?$/);
+      if (!m)
+        continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs))
+        continue;
+      if (reqBodyRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  const callRe = /\bJSON\s*\.\s*parse\s*\(\s*([^)]+?)\s*\)/g;
+  const seen = new Set;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("//"))
+      continue;
+    callRe.lastIndex = 0;
+    let m;
+    while ((m = callRe.exec(line)) !== null) {
+      const arg = m[1];
+      let tainted = reqBodyRe.test(arg);
+      if (!tainted) {
+        for (const v of taintedVars) {
+          if (new RegExp(`\\b${v}\\b`).test(arg)) {
+            tainted = true;
+            break;
+          }
+        }
+      }
+      if (!tainted)
+        continue;
+      if (seen.has(i2 + 1))
+        continue;
+      seen.add(i2 + 1);
+      findings.push({
+        id: `insecure_deserialization-${file}-${i2 + 1}-js-jsonparse-body`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "insecure_deserialization",
+        cwe: "CWE-502",
+        severity: "high",
+        level: "warning",
+        message: "`JSON.parse(req.body)` deserializes attacker-controlled bytes " + "directly. With `express.text()` / `bodyParser.raw()` middleware " + "`req.body` is an unvetted string; the parsed object can carry a " + "`__proto__` payload that pollutes downstream property lookups. " + "Validate against a schema (zod/ajv) before consuming the value.",
+        file,
+        line: i2 + 1,
+        snippet: line.trim()
+      });
+    }
+  }
+  return findings;
+}
+function findJsDomXpathInjectionFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/\.\s*evaluate\s*\(/.test(code))
+    return findings;
+  if (!/\bXPathResult\b/.test(code))
+    return findings;
+  const browserSourceRe = /\b(?:location\s*\.\s*(?:search|hash|href)|URLSearchParams|window\s*\.\s*name|document\s*\.\s*cookie)\b/;
+  if (!browserSourceRe.test(code))
+    return findings;
+  const lines = code.split(`
+`);
+  const taintedVars = new Set;
+  for (let pass = 0;pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("//"))
+        continue;
+      const m = t.match(/^(?:const|let|var)\s+(\w+)(?:\s*:\s*[^=]+)?\s*=\s*(.+?);?$/);
+      if (!m)
+        continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs))
+        continue;
+      if (browserSourceRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  if (taintedVars.size === 0)
+    return findings;
+  const evalRe = /\.\s*evaluate\s*\(\s*([^,)]+)/;
+  const seen = new Set;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("//"))
+      continue;
+    const m = line.match(evalRe);
+    if (!m)
+      continue;
+    const arg = m[1].trim();
+    let tainted = false;
+    for (const v of taintedVars) {
+      if (new RegExp(`\\b${v}\\b`).test(arg)) {
+        tainted = true;
+        break;
+      }
+    }
+    if (!tainted)
+      continue;
+    if (seen.has(i2 + 1))
+      continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `xpath_injection-${file}-${i2 + 1}-js-dom-evaluate`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xpath_injection",
+      cwe: "CWE-643",
+      severity: "high",
+      level: "warning",
+      message: "XPath injection: `document.evaluate(<tainted>, ...)` lets the " + "attacker break out of the XPath expression and read sibling " + "nodes. Bind user input through XPath variables / parameterized " + "expressions, or escape with an allowlist before concatenation.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findGoXmlDecoderXxeFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/\bxml\s*\.\s*NewDecoder\s*\(/.test(code))
+    return findings;
+  if (!/\*http\.Request\b/.test(code) && !/\bhttp\.HandlerFunc\b/.test(code)) {
+    return findings;
+  }
+  const lines = code.split(`
+`);
+  const decoderFromBody = new Map;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const t = lines[i2].trim();
+    if (t.startsWith("//"))
+      continue;
+    const m = t.match(/^(\w+)\s*(?::=|=)\s*xml\s*\.\s*NewDecoder\s*\(\s*([^)]+)\)/);
+    if (!m)
+      continue;
+    if (/\b\w+\s*\.\s*Body\b/.test(m[2]))
+      decoderFromBody.set(m[1], i2);
+  }
+  if (decoderFromBody.size === 0)
+    return findings;
+  const seen = new Set;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("//"))
+      continue;
+    const m = line.match(/\b(\w+)\s*\.\s*(?:Strict\s*=\s*false|Entity\s*=)\b/);
+    if (!m)
+      continue;
+    if (!decoderFromBody.has(m[1]))
+      continue;
+    if (seen.has(i2 + 1))
+      continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `xml_entity_expansion-${file}-${i2 + 1}-go-xml-decoder`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xml_entity_expansion",
+      cwe: "CWE-611",
+      severity: "high",
+      level: "warning",
+      message: "XXE: Go `xml.NewDecoder(req.Body)` with `Strict = false` (or a " + "custom `Entity` map) allows entity references that the standard " + "library normally rejects. Keep `Strict = true` and avoid setting " + "`Entity` from attacker-controlled inputs.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findPythonJinjaTemplateSstiFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/\bfrom\s+jinja2\s+import\s+[^#\n]*\bTemplate\b/.test(code) && !/\bjinja2\s*\.\s*Template\b/.test(code)) {
+    return findings;
+  }
+  const reqExtractRe = /\brequest\s*\.\s*(?:args|form|values|json|data|cookies|headers)\b/;
+  if (!reqExtractRe.test(code))
+    return findings;
+  const lines = code.split(`
+`);
+  const taintedVars = new Set;
+  for (let pass = 0;pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("#"))
+        continue;
+      const m = t.match(/^(\w+)\s*=\s*(.+?)$/);
+      if (!m)
+        continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs))
+        continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  if (taintedVars.size === 0)
+    return findings;
+  const ctorRe = /\b(?:jinja2\s*\.\s*)?Template\s*\(\s*([^)]+?)\s*\)/;
+  const seen = new Set;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("#"))
+      continue;
+    const m = line.match(ctorRe);
+    if (!m)
+      continue;
+    const arg = m[1].trim();
+    let tainted = reqExtractRe.test(arg);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(arg)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted)
+      continue;
+    if (seen.has(i2 + 1))
+      continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `template_injection-${file}-${i2 + 1}-py-jinja-template`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "template_injection",
+      cwe: "CWE-1336",
+      severity: "critical",
+      level: "error",
+      message: "Server-side template injection: `jinja2.Template(<tainted>).render()` " + "compiles attacker-controlled source. Sandbox-escape gadgets such as " + "`{{ ().__class__.__bases__[0].__subclasses__() }}` lead to RCE. " + "Render fixed templates with user data passed as context variables.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findJsTemplateInjectionSstiFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0)
+    return findings;
+  if (!/\bHandlebars\s*\.\s*compile\s*\(/.test(code) && !/\bejs\s*\.\s*(?:render|compile)\s*\(/.test(code)) {
+    return findings;
+  }
+  if (!/\breq\s*\.\s*(?:query|body|params|headers|cookies)\b/.test(code)) {
+    return findings;
+  }
+  const lines = code.split(`
+`);
+  const reqExtractRe = /\breq\s*\.\s*(?:query|body|params|headers|cookies)\b/;
+  const taintedVars = new Set;
+  for (let pass = 0;pass < 3; pass++) {
+    const before = taintedVars.size;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const t = lines[i2].trim();
+      if (t.startsWith("//"))
+        continue;
+      const m = t.match(/^(?:const|let|var)\s+(\w+)(?:\s*:\s*[^=]+)?\s*=\s*(.+?);?$/);
+      if (!m)
+        continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (taintedVars.has(lhs))
+        continue;
+      if (reqExtractRe.test(rhs)) {
+        taintedVars.add(lhs);
+        continue;
+      }
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+          taintedVars.add(lhs);
+          break;
+        }
+      }
+    }
+    if (taintedVars.size === before)
+      break;
+  }
+  if (taintedVars.size === 0)
+    return findings;
+  const callRe = /\b(Handlebars\s*\.\s*compile|ejs\s*\.\s*(?:render|compile))\s*\(\s*([^,)]+)/;
+  const seen = new Set;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trim().startsWith("//"))
+      continue;
+    const m = line.match(callRe);
+    if (!m)
+      continue;
+    const arg = m[2].trim();
+    let tainted = reqExtractRe.test(arg);
+    if (!tainted) {
+      for (const v of taintedVars) {
+        if (new RegExp(`\\b${v}\\b`).test(arg)) {
+          tainted = true;
+          break;
+        }
+      }
+    }
+    if (!tainted)
+      continue;
+    if (seen.has(i2 + 1))
+      continue;
+    seen.add(i2 + 1);
+    findings.push({
+      id: `template_injection-${file}-${i2 + 1}-js-${m[1].replace(/[\s.]/g, "").toLowerCase()}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "template_injection",
+      cwe: "CWE-1336",
+      severity: "critical",
+      level: "error",
+      message: "Server-side template injection: compiling/rendering a template " + "whose source is attacker-controlled (`Handlebars.compile(...)` / " + "`ejs.render(...)`) opens helper-shadowing and prototype-gadget RCE " + "paths. Use a fixed template and pass user data as context.",
+      file,
+      line: i2 + 1,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
 
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
@@ -37614,6 +38092,154 @@ class UnrestrictedFileUploadPass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/missing-sanitizer-gate-pass.js
+var HTML_OUTPUT_SINKS = new Set([
+  "addAttribute",
+  "setAttribute",
+  "write",
+  "writeAttribute",
+  "writeRaw",
+  "writeStartElement",
+  "writeEndElement",
+  "writeCharacters",
+  "printXML",
+  "printXMLElement",
+  "printXMLStartElement",
+  "printXMLEndElement",
+  "printRaw",
+  "print",
+  "println",
+  "printf",
+  "append",
+  "format"
+]);
+var SANITIZER_METHODS2 = new Set([
+  "isAttributeAllowed",
+  "isElementAllowed",
+  "isSafe",
+  "sanitize",
+  "clean",
+  "escape",
+  "encode",
+  "forHtml",
+  "forHtmlAttribute",
+  "forHtmlContent",
+  "encodeForHTML",
+  "encodeForHTMLAttribute",
+  "escapeHtml",
+  "escapeHtml4",
+  "escapeXml",
+  "htmlEscape",
+  "xmlEscape"
+]);
+var SANITIZER_PREFIX_RE = /^(?:clean|sanitize|escape|encode)[A-Z]/;
+function isSanitizerCall(methodName) {
+  return SANITIZER_METHODS2.has(methodName) || SANITIZER_PREFIX_RE.test(methodName);
+}
+var STRING_PARAM_NAME_PATTERN = /attr|attribute|html|xml|body|content/i;
+
+class MissingSanitizerGatePass {
+  name = "missing-sanitizer-gate";
+  category = "security";
+  run(ctx) {
+    const { graph, language } = ctx;
+    if (language !== "java")
+      return { findings: 0 };
+    const { cfg, calls, types } = graph.ir;
+    if (cfg.blocks.length === 0 || cfg.edges.length === 0)
+      return { findings: 0 };
+    if (calls.length === 0)
+      return { findings: 0 };
+    const file = graph.ir.meta.file;
+    const sinkCalls = [];
+    const sanitizerLines = [];
+    for (const call of calls) {
+      if (HTML_OUTPUT_SINKS.has(call.method_name)) {
+        sinkCalls.push({ line: call.location.line, method: call.method_name });
+      }
+      if (isSanitizerCall(call.method_name)) {
+        sanitizerLines.push(call.location.line);
+      }
+    }
+    if (sinkCalls.length === 0)
+      return { findings: 0 };
+    const blockContainingLine = (line) => cfg.blocks.find((b) => b.start_line <= line && line <= b.end_line) ?? null;
+    const domByMethodKey = new Map;
+    const getDomForMethod = (methodKey, method) => {
+      if (domByMethodKey.has(methodKey))
+        return domByMethodKey.get(methodKey) ?? null;
+      const entry = cfg.blocks.find((b) => b.type === "entry" && b.start_line >= method.start_line && b.end_line <= method.end_line) ?? cfg.blocks.find((b) => b.start_line >= method.start_line && b.end_line <= method.end_line);
+      const dom = entry ? new DominatorGraph2(cfg, entry.id) : null;
+      domByMethodKey.set(methodKey, dom);
+      return dom;
+    };
+    const reportedMethods = new Set;
+    let count = 0;
+    for (const sink of sinkCalls) {
+      const sinkBlock = blockContainingLine(sink.line);
+      if (!sinkBlock)
+        continue;
+      const methodInfo = graph.methodAtLine(sink.line);
+      if (!methodInfo)
+        continue;
+      const methodKey = `${methodInfo.type.name}::${methodInfo.method.name}`;
+      if (reportedMethods.has(methodKey))
+        continue;
+      const tier = classifyEntryPointTier(methodInfo.method, methodInfo.type, {
+        types,
+        language
+      });
+      if (tier === "TIER_1_ENTRY_POINT")
+        continue;
+      if (!methodAcceptsHtmlShapedParam(methodInfo.method))
+        continue;
+      const dom = getDomForMethod(methodKey, methodInfo.method);
+      if (!dom)
+        continue;
+      const { start_line, end_line } = methodInfo.method;
+      const sanitizersInMethod = sanitizerLines.filter((l) => l >= start_line && l <= end_line);
+      const dominated = sanitizersInMethod.some((sanLine) => {
+        const sanBlock = blockContainingLine(sanLine);
+        return sanBlock !== null && dom.dominates(sanBlock.id, sinkBlock.id);
+      });
+      if (!dominated) {
+        reportedMethods.add(methodKey);
+        count++;
+        ctx.addFinding({
+          id: `missing-sanitizer-gate-${file}-${sink.line}`,
+          pass: this.name,
+          category: this.category,
+          rule_id: this.name,
+          cwe: "CWE-79",
+          severity: "medium",
+          level: "note",
+          confidence: "medium",
+          message: `HTML output sink \`${sink.method}()\` at line ${sink.line} is not ` + `dominated by any sanitizer call in method \`${methodInfo.method.name}\`. ` + `Caller-supplied attribute/HTML values may reach the sink unescaped.`,
+          file,
+          line: sink.line,
+          fix: `Gate the sink on all paths with an allow-list check ` + `(e.g. \`isAttributeAllowed(...)\`) or wrap the argument in an HTML/XML ` + `escaper (\`escapeHtml\`, \`encodeForHTMLAttribute\`, \`forHtmlAttribute\`).`,
+          evidence: { sink: sink.method, method: methodInfo.method.name }
+        });
+      }
+    }
+    return { findings: count };
+  }
+}
+function methodAcceptsHtmlShapedParam(method) {
+  for (const p of method.parameters) {
+    if (!p.type)
+      continue;
+    const type = p.type.replace(/\s+/g, "");
+    if (type === "Attributes")
+      return true;
+    if (type.startsWith("Map<String,String"))
+      return true;
+    if (type === "String" && STRING_PARAM_NAME_PATTERN.test(p.name))
+      return true;
+  }
+  return false;
+}
+
 // ../circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
 function isWriteStorageCall(call, language) {
   const method = call.method_name ?? "";
@@ -40200,6 +40826,8 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new InfoDisclosureStacktracePass);
     if (!disabledPasses.has("unrestricted-file-upload"))
       pipeline.add(new UnrestrictedFileUploadPass);
+    if (!disabledPasses.has("missing-sanitizer-gate"))
+      pipeline.add(new MissingSanitizerGatePass);
     const { results, findings } = pipeline.run(graph, code, language, config);
     const sinkFilter = results.get("sink-filter");
     const interProc = results.get("interprocedural");
@@ -41013,7 +41641,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.137.0";
+var version = "3.139.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.137.0",
+  "version": "3.139.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.137.0"
+    "circle-ir": "^3.139.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",