cognium-dev 3.138.0 → 3.140.0

package/dist/cli.js

@@ -5678,8 +5678,32 @@ function resolveReceiverType(receiver, context) {
       return resolveFqn(simple, context);
     }
   }
+  const chained = receiver.match(/^([A-Za-z_$][\w$]*)\.([A-Za-z_$][\w$]*)\s*\([^()]*\)$/);
+  if (chained) {
+    const varName = chained[1];
+    const methodName = chained[2];
+    const varType = context.localVarTypes.get(varName) ?? context.paramTypes.get(varName) ?? context.fieldTypes.get(varName);
+    if (varType) {
+      const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[stripGenerics(varType)]?.[methodName];
+      if (returnType)
+        return resolveFqn(returnType, context);
+    }
+  }
   return { simpleName: null, fqn: null };
 }
+var JAVA_CHAINED_FACTORY_RETURN_TYPES = {
+  HttpServletRequest: {
+    getSession: "HttpSession",
+    getServletContext: "ServletContext",
+    getRequestDispatcher: "RequestDispatcher"
+  },
+  HttpSession: {
+    getServletContext: "ServletContext"
+  },
+  ServletContext: {
+    getRequestDispatcher: "RequestDispatcher"
+  }
+};
 function resolveFqn(simpleName, context) {
   if (!simpleName)
     return { simpleName: null, fqn: null };
@@ -13400,19 +13424,19 @@ function formatCallCode(call) {
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect"],
-    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect"],
-    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect"],
-    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect"],
-    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect"],
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
+    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
+    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary"],
+    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary"],
+    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
     io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection"],
     file_input: ["deserialization", "xxe", "path_traversal", "command_injection", "code_injection"],
     network_input: ["sql_injection", "command_injection", "xss", "ssrf"],
     config_param: ["sql_injection", "command_injection", "path_traversal", "xss", "ssrf"],
-    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect"],
+    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
     plugin_param: ["sql_injection", "command_injection", "path_traversal", "xss", "code_injection"]
   };
   const validSinks = sourceToSinkMapping[sourceType];
@@ -38092,6 +38116,154 @@ class UnrestrictedFileUploadPass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/missing-sanitizer-gate-pass.js
+var HTML_OUTPUT_SINKS = new Set([
+  "addAttribute",
+  "setAttribute",
+  "write",
+  "writeAttribute",
+  "writeRaw",
+  "writeStartElement",
+  "writeEndElement",
+  "writeCharacters",
+  "printXML",
+  "printXMLElement",
+  "printXMLStartElement",
+  "printXMLEndElement",
+  "printRaw",
+  "print",
+  "println",
+  "printf",
+  "append",
+  "format"
+]);
+var SANITIZER_METHODS2 = new Set([
+  "isAttributeAllowed",
+  "isElementAllowed",
+  "isSafe",
+  "sanitize",
+  "clean",
+  "escape",
+  "encode",
+  "forHtml",
+  "forHtmlAttribute",
+  "forHtmlContent",
+  "encodeForHTML",
+  "encodeForHTMLAttribute",
+  "escapeHtml",
+  "escapeHtml4",
+  "escapeXml",
+  "htmlEscape",
+  "xmlEscape"
+]);
+var SANITIZER_PREFIX_RE = /^(?:clean|sanitize|escape|encode)[A-Z]/;
+function isSanitizerCall(methodName) {
+  return SANITIZER_METHODS2.has(methodName) || SANITIZER_PREFIX_RE.test(methodName);
+}
+var STRING_PARAM_NAME_PATTERN = /attr|attribute|html|xml|body|content/i;
+
+class MissingSanitizerGatePass {
+  name = "missing-sanitizer-gate";
+  category = "security";
+  run(ctx) {
+    const { graph, language } = ctx;
+    if (language !== "java")
+      return { findings: 0 };
+    const { cfg, calls, types } = graph.ir;
+    if (cfg.blocks.length === 0 || cfg.edges.length === 0)
+      return { findings: 0 };
+    if (calls.length === 0)
+      return { findings: 0 };
+    const file = graph.ir.meta.file;
+    const sinkCalls = [];
+    const sanitizerLines = [];
+    for (const call of calls) {
+      if (HTML_OUTPUT_SINKS.has(call.method_name)) {
+        sinkCalls.push({ line: call.location.line, method: call.method_name });
+      }
+      if (isSanitizerCall(call.method_name)) {
+        sanitizerLines.push(call.location.line);
+      }
+    }
+    if (sinkCalls.length === 0)
+      return { findings: 0 };
+    const blockContainingLine = (line) => cfg.blocks.find((b) => b.start_line <= line && line <= b.end_line) ?? null;
+    const domByMethodKey = new Map;
+    const getDomForMethod = (methodKey, method) => {
+      if (domByMethodKey.has(methodKey))
+        return domByMethodKey.get(methodKey) ?? null;
+      const entry = cfg.blocks.find((b) => b.type === "entry" && b.start_line >= method.start_line && b.end_line <= method.end_line) ?? cfg.blocks.find((b) => b.start_line >= method.start_line && b.end_line <= method.end_line);
+      const dom = entry ? new DominatorGraph2(cfg, entry.id) : null;
+      domByMethodKey.set(methodKey, dom);
+      return dom;
+    };
+    const reportedMethods = new Set;
+    let count = 0;
+    for (const sink of sinkCalls) {
+      const sinkBlock = blockContainingLine(sink.line);
+      if (!sinkBlock)
+        continue;
+      const methodInfo = graph.methodAtLine(sink.line);
+      if (!methodInfo)
+        continue;
+      const methodKey = `${methodInfo.type.name}::${methodInfo.method.name}`;
+      if (reportedMethods.has(methodKey))
+        continue;
+      const tier = classifyEntryPointTier(methodInfo.method, methodInfo.type, {
+        types,
+        language
+      });
+      if (tier === "TIER_1_ENTRY_POINT")
+        continue;
+      if (!methodAcceptsHtmlShapedParam(methodInfo.method))
+        continue;
+      const dom = getDomForMethod(methodKey, methodInfo.method);
+      if (!dom)
+        continue;
+      const { start_line, end_line } = methodInfo.method;
+      const sanitizersInMethod = sanitizerLines.filter((l) => l >= start_line && l <= end_line);
+      const dominated = sanitizersInMethod.some((sanLine) => {
+        const sanBlock = blockContainingLine(sanLine);
+        return sanBlock !== null && dom.dominates(sanBlock.id, sinkBlock.id);
+      });
+      if (!dominated) {
+        reportedMethods.add(methodKey);
+        count++;
+        ctx.addFinding({
+          id: `missing-sanitizer-gate-${file}-${sink.line}`,
+          pass: this.name,
+          category: this.category,
+          rule_id: this.name,
+          cwe: "CWE-79",
+          severity: "medium",
+          level: "note",
+          confidence: "medium",
+          message: `HTML output sink \`${sink.method}()\` at line ${sink.line} is not ` + `dominated by any sanitizer call in method \`${methodInfo.method.name}\`. ` + `Caller-supplied attribute/HTML values may reach the sink unescaped.`,
+          file,
+          line: sink.line,
+          fix: `Gate the sink on all paths with an allow-list check ` + `(e.g. \`isAttributeAllowed(...)\`) or wrap the argument in an HTML/XML ` + `escaper (\`escapeHtml\`, \`encodeForHTMLAttribute\`, \`forHtmlAttribute\`).`,
+          evidence: { sink: sink.method, method: methodInfo.method.name }
+        });
+      }
+    }
+    return { findings: count };
+  }
+}
+function methodAcceptsHtmlShapedParam(method) {
+  for (const p of method.parameters) {
+    if (!p.type)
+      continue;
+    const type = p.type.replace(/\s+/g, "");
+    if (type === "Attributes")
+      return true;
+    if (type.startsWith("Map<String,String"))
+      return true;
+    if (type === "String" && STRING_PARAM_NAME_PATTERN.test(p.name))
+      return true;
+  }
+  return false;
+}
+
 // ../circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
 function isWriteStorageCall(call, language) {
   const method = call.method_name ?? "";
@@ -40678,6 +40850,8 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new InfoDisclosureStacktracePass);
     if (!disabledPasses.has("unrestricted-file-upload"))
       pipeline.add(new UnrestrictedFileUploadPass);
+    if (!disabledPasses.has("missing-sanitizer-gate"))
+      pipeline.add(new MissingSanitizerGatePass);
     const { results, findings } = pipeline.run(graph, code, language, config);
     const sinkFilter = results.get("sink-filter");
     const interProc = results.get("interprocedural");
@@ -41491,7 +41665,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.138.0";
+var version = "3.140.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.138.0",
+  "version": "3.140.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.138.0"
+    "circle-ir": "^3.140.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",