cognium-dev 3.140.0 → 3.141.0

package/dist/cli.js

@@ -5678,19 +5678,48 @@ function resolveReceiverType(receiver, context) {
       return resolveFqn(simple, context);
     }
   }
-  const chained = receiver.match(/^([A-Za-z_$][\w$]*)\.([A-Za-z_$][\w$]*)\s*\([^()]*\)$/);
-  if (chained) {
-    const varName = chained[1];
-    const methodName = chained[2];
-    const varType = context.localVarTypes.get(varName) ?? context.paramTypes.get(varName) ?? context.fieldTypes.get(varName);
-    if (varType) {
-      const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[stripGenerics(varType)]?.[methodName];
+  const chain = splitChainedReceiver(receiver);
+  if (chain) {
+    const prefixType = resolveReceiverType(chain.prefix, context);
+    if (prefixType.simpleName) {
+      const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[prefixType.simpleName]?.[chain.methodName];
       if (returnType)
         return resolveFqn(returnType, context);
     }
   }
   return { simpleName: null, fqn: null };
 }
+function splitChainedReceiver(receiver) {
+  if (!receiver.endsWith(")"))
+    return null;
+  let depth = 0;
+  let openIdx = -1;
+  for (let i2 = receiver.length - 1;i2 >= 0; i2--) {
+    const c = receiver[i2];
+    if (c === ")")
+      depth++;
+    else if (c === "(") {
+      depth--;
+      if (depth === 0) {
+        openIdx = i2;
+        break;
+      }
+    }
+  }
+  if (openIdx <= 0)
+    return null;
+  const beforeParen = receiver.substring(0, openIdx);
+  const dotIdx = beforeParen.lastIndexOf(".");
+  if (dotIdx <= 0)
+    return null;
+  const methodName = beforeParen.substring(dotIdx + 1).trim();
+  if (!/^[A-Za-z_$][\w$]*$/.test(methodName))
+    return null;
+  const prefix = beforeParen.substring(0, dotIdx).trim();
+  if (!prefix)
+    return null;
+  return { prefix, methodName };
+}
 var JAVA_CHAINED_FACTORY_RETURN_TYPES = {
   HttpServletRequest: {
     getSession: "HttpSession",
@@ -5702,6 +5731,31 @@ var JAVA_CHAINED_FACTORY_RETURN_TYPES = {
   },
   ServletContext: {
     getRequestDispatcher: "RequestDispatcher"
+  },
+  DocumentBuilderFactory: {
+    newInstance: "DocumentBuilderFactory",
+    newDocumentBuilder: "DocumentBuilder"
+  },
+  SAXParserFactory: {
+    newInstance: "SAXParserFactory",
+    newSAXParser: "SAXParser"
+  },
+  SAXParser: {
+    getXMLReader: "XMLReader"
+  },
+  XPathFactory: {
+    newInstance: "XPathFactory",
+    newXPath: "XPath"
+  },
+  TransformerFactory: {
+    newInstance: "TransformerFactory",
+    newTransformer: "Transformer"
+  },
+  XMLInputFactory: {
+    newInstance: "XMLInputFactory",
+    newFactory: "XMLInputFactory",
+    createXMLStreamReader: "XMLStreamReader",
+    createXMLEventReader: "XMLEventReader"
   }
 };
 function resolveFqn(simpleName, context) {
@@ -41665,7 +41719,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.140.0";
+var version = "3.141.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.140.0",
+  "version": "3.141.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.140.0"
+    "circle-ir": "^3.141.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",