cognium-dev 3.141.0 → 3.146.0

package/dist/cli.js

@@ -5668,6 +5668,12 @@ function resolveReceiverType(receiver, context) {
   }
   if (receiver === "super")
     return { simpleName: null, fqn: null };
+  const ctorMatch = receiver.match(/^new\s+([A-Za-z_$][\w$.]*)\s*[<(]/);
+  if (ctorMatch) {
+    const ctorClass = ctorMatch[1];
+    const simple = ctorClass.includes(".") ? ctorClass.substring(ctorClass.lastIndexOf(".") + 1) : ctorClass;
+    return resolveFqn(simple, context);
+  }
   const declaredType = context.localVarTypes.get(receiver) ?? context.paramTypes.get(receiver) ?? context.fieldTypes.get(receiver);
   if (declaredType) {
     return resolveFqn(stripGenerics(declaredType), context);
@@ -10732,6 +10738,8 @@ var DEFAULT_SINKS = [
   { method: "sendError", class: "HttpServletResponse", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   { method: "setHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
   { method: "addHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
+  { method: "Cookie", class: "constructor", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0, 1] },
+  { method: "addCookie", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0] },
   { method: "setContentType", class: "HttpServletResponse", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "setAttribute", class: "PageContext", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   { method: "addAttribute", class: "Model", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
@@ -11668,11 +11676,62 @@ var DEFAULT_SANITIZERS = [
   { method: "UUID", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] }
 ];
+var DEFAULT_SINK_SEMANTICS = [
+  {
+    signature: "Jedis#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Redis wire-protocol serialization, not OS exec"
+  },
+  {
+    signature: "Connection#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis abstract Connection base"
+  },
+  {
+    signature: "JedisCluster#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis cluster client"
+  },
+  {
+    signature: "Func1#exec",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection", "code_injection"],
+    note: "RxJava functional dispatch, not OS exec"
+  },
+  {
+    signature: "Action0#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action0 dispatch"
+  },
+  {
+    signature: "Action1#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action1 dispatch"
+  },
+  {
+    signature: "Unsafe#defineAnonymousClass",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "sun.misc.Unsafe JDK-internal reflective bridge"
+  },
+  {
+    signature: "MethodHandle#invokeExact",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "java.lang.invoke.MethodHandle — JDK-internal"
+  }
+];
 function getDefaultConfig() {
   return {
     sources: DEFAULT_SOURCES,
     sinks: DEFAULT_SINKS,
-    sanitizers: DEFAULT_SANITIZERS
+    sanitizers: DEFAULT_SANITIZERS,
+    sinkSemantics: DEFAULT_SINK_SEMANTICS
   };
 }
 var DEFAULT_HEADER_RULES = [
@@ -12001,7 +12060,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
             severity: "medium",
             line: paramLine,
             confidence: param.type ? 0.7 : 0.5,
-            in_method: method.name
+            in_method: method.name,
+            ...language === "java" ? { variable: param.name } : {}
           });
         }
       }
@@ -12499,7 +12559,19 @@ function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   return false;
 }
 var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
-function isSafeJinjaRenderCall(call, pattern, language) {
+var JINJA_AUTOESCAPE_TRUE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*True\b/;
+var JINJA_SELECT_AUTOESCAPE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*select_autoescape\s*\(/;
+var JINJA_AUTOESCAPE_FALSE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*False\b/;
+function fileHasSafeJinjaEnvironment(sourceLines) {
+  if (!sourceLines || sourceLines.length === 0)
+    return false;
+  const text = sourceLines.join(`
+`);
+  if (JINJA_AUTOESCAPE_FALSE_RE.test(text))
+    return false;
+  return JINJA_AUTOESCAPE_TRUE_RE.test(text) || JINJA_SELECT_AUTOESCAPE_RE.test(text);
+}
+function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   if (language !== "python")
     return false;
   if (pattern.type !== "xss" && pattern.type !== "code_injection")
@@ -12515,7 +12587,10 @@ function isSafeJinjaRenderCall(call, pattern, language) {
   }
   if (method === "render") {
     const receiver = (call.receiver ?? "").trim();
-    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+    if (TEMPLATE_LITERAL_RECEIVER_RE.test(receiver))
+      return true;
+    if (fileHasSafeJinjaEnvironment(sourceLines))
+      return true;
   }
   return false;
 }
@@ -12563,7 +12638,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
-        if (isSafeJinjaRenderCall(call, pattern, language)) {
+        if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
         const location = formatCallLocation(call);
@@ -12571,6 +12646,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         const confidence = calculateSinkConfidence(call, pattern);
         const existing = sinkMap.get(key);
         if (!existing || confidence > existing.confidence) {
+          const receiverType = call.receiver_type;
+          const simpleClass = receiverType ? receiverType.split(".").pop() || undefined : undefined;
           sinkMap.set(key, {
             type: pattern.type,
             cwe: pattern.cwe,
@@ -12578,7 +12655,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             line: call.location.line,
             confidence,
             method: call.method_name,
-            argPositions: pattern.arg_positions
+            argPositions: pattern.arg_positions,
+            class: simpleClass
           });
         }
       }
@@ -13478,12 +13556,12 @@ function formatCallCode(call) {
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization"],
     http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
     http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary"],
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary"],
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization"],
     io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection"],
@@ -13496,6 +13574,15 @@ function canSourceReachSink(sourceType, sinkType) {
   const validSinks = sourceToSinkMapping[sourceType];
   return validSinks ? validSinks.includes(sinkType) : false;
 }
+function sourceSemanticsAllowed(source, sinkType) {
+  if (source.constant === true) {
+    return false;
+  }
+  if (source.spi === true) {
+    return sinkType === "code_injection";
+  }
+  return true;
+}
 
 // ../circle-ir/dist/analysis/findings-instrumentation.js
 var instrumentEnabled = false;
@@ -22781,6 +22868,8 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findJsSsrfAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findJsArgvFormExecSanitizers(code));
       additionalSanitizers.push(...findJsParameterizedSqlSanitizers(code));
+      additionalSanitizers.push(...findJsPathResolveStartsWithGuardSanitizers(code));
+      additionalSanitizers.push(...findJsCommandAllowlistGuardSanitizers(code));
       for (const finding of findJsPatternFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
@@ -23602,6 +23691,68 @@ function buildRustTaintedVars(sourceCode, seedVars) {
   }
   return derived;
 }
+function buildJavaTaintedVars(sourceCode, seedVars) {
+  const derived = new Map;
+  const knownTainted = new Set(seedVars);
+  const lines = sourceCode.split(`
+`);
+  const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const JAVA_KEYWORDS = new Set([
+    "if",
+    "else",
+    "while",
+    "for",
+    "do",
+    "switch",
+    "case",
+    "return",
+    "throw",
+    "try",
+    "catch",
+    "finally",
+    "new",
+    "this",
+    "super",
+    "break",
+    "continue",
+    "default",
+    "class",
+    "interface",
+    "enum"
+  ]);
+  let changed = true;
+  let guard = 0;
+  while (changed && guard < lines.length + 2) {
+    changed = false;
+    guard++;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const line = lines[i2];
+      const trimmed = line.trimStart();
+      if (trimmed.startsWith("//") || trimmed.startsWith("*"))
+        continue;
+      const declMatch = declRe.exec(line);
+      const assignMatch = !declMatch ? assignRe.exec(line) : null;
+      const m = declMatch ?? assignMatch;
+      if (!m)
+        continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (JAVA_KEYWORDS.has(lhs))
+        continue;
+      if (knownTainted.has(lhs))
+        continue;
+      const escaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const ref = [...knownTainted].some((v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhs));
+      if (ref) {
+        derived.set(lhs, i2 + 1);
+        knownTainted.add(lhs);
+        changed = true;
+      }
+    }
+  }
+  return derived;
+}
 var BASH_POSITIONAL_PARAMS = new Set(["1", "2", "3", "4", "5", "6", "7", "8", "9", "@", "*"]);
 var BASH_UNTRUSTED_ENV_PATTERNS = [
   /^USER_INPUT$/i,
@@ -23982,7 +24133,7 @@ function findBashRealpathPrefixGuardSanitizers(code) {
   const caseOpen = /^\s*case\s+"?\$\{?\w+\}?"?\s+in\b/;
   const esacClose = /^\s*esac\b/;
   const armOpener = /^\s*([^)\s][^)]*?)\)/;
-  const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|[\w\-./]+)(?:\/|\*)/;
+  const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|https?:\/\/[\w\-.]+|[\w\-./]+)(?:\/|\*)/;
   const catchAllArm = /^(?:\*|\\\*)$/;
   let i2 = 0;
   while (i2 < lines.length) {
@@ -24838,6 +24989,126 @@ function findJsParameterizedSqlSanitizers(code) {
   }
   return sanitizers;
 }
+function findJsPathResolveStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const resolveDeclRe = /\b(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*(?:(?:node:)?path|nodePath|Path)\s*\.\s*(?:resolve|join)\s*\(\s*([A-Za-z_]\w*(?:\.\w+)*)\s*,/;
+  const startsWithGuardRe = (varName, rootName) => new RegExp(`if\\s*\\(\\s*!\\s*${varName}\\s*\\.\\s*startsWith\\s*\\(\\s*${rootName}\\b`);
+  const terminatorRe = /\b(?:throw|return|res\s*\.\s*status\s*\([^)]*\)\s*\.\s*(?:send|end|json))/;
+  const candidates = [];
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = resolveDeclRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    candidates.push({ line: i2 + 1, fullVar: m[1], rootVar: m[2] });
+  }
+  if (candidates.length === 0)
+    return sanitizers;
+  for (const c of candidates) {
+    const guardRe = startsWithGuardRe(c.fullVar, c.rootVar);
+    let guardLine = -1;
+    for (let l = c.line;l < Math.min(lines.length, c.line + 6); l++) {
+      if (!guardRe.test(lines[l]))
+        continue;
+      if (terminatorRe.test(lines[l]) || l + 1 < lines.length && terminatorRe.test(lines[l + 1])) {
+        guardLine = l + 1;
+        break;
+      }
+    }
+    if (guardLine < 0)
+      continue;
+    const varRefRe = new RegExp(`\\b${c.fullVar}\\b`);
+    sanitizers.push({
+      type: "js_path_resolve_startswith_guard",
+      method: "startsWith",
+      line: c.line,
+      sanitizes: ["path_traversal", "external_taint_escape"]
+    });
+    for (let l = c.line;l < lines.length; l++) {
+      if (!varRefRe.test(lines[l]))
+        continue;
+      sanitizers.push({
+        type: "js_path_resolve_startswith_guard",
+        method: "startsWith",
+        line: l + 1,
+        sanitizes: ["path_traversal", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findJsCommandAllowlistGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const shoutyCase = /^[A-Z][A-Z0-9_]+$/;
+  const allowlistTokens = /(?:allowed|accepted|whitelist|permitted|valid|approved|cmds|commands|tools)/i;
+  const isAllowlistName = (n) => shoutyCase.test(n) || allowlistTokens.test(n);
+  const guardHas = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*(?:has|includes)\s*\(\s*([A-Za-z_]\w*)\s*\)\s*\)/;
+  const guardIndexOf = /\bif\s*\(\s*([A-Za-z_]\w*)\s*\.\s*indexOf\s*\(\s*([A-Za-z_]\w*)\s*\)\s*(?:<\s*0|===\s*-1|==\s*-1)\s*\)/;
+  const terminator = /\b(?:return|throw|res\s*\.\s*status\s*\([^)]*\)\s*\.\s*(?:send|end|json))/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    let m = guardHas.exec(line);
+    let allow = null;
+    let guardedVar = null;
+    if (m) {
+      allow = m[1];
+      guardedVar = m[2];
+    } else {
+      m = guardIndexOf.exec(line);
+      if (m) {
+        allow = m[1];
+        guardedVar = m[2];
+      }
+    }
+    if (!allow || !guardedVar)
+      continue;
+    if (!isAllowlistName(allow))
+      continue;
+    let bodyHasTerminator = terminator.test(line);
+    let blockEnd = i2;
+    if (!bodyHasTerminator) {
+      let braceDepth = 0;
+      let started = false;
+      const maxScan = Math.min(lines.length, i2 + 26);
+      for (let j = i2;j < maxScan; j++) {
+        const ln = lines[j];
+        for (const ch of ln) {
+          if (ch === "{") {
+            braceDepth++;
+            started = true;
+          } else if (ch === "}") {
+            braceDepth--;
+            if (started && braceDepth === 0) {
+              blockEnd = j;
+              break;
+            }
+          }
+        }
+        if (started && j > i2 && terminator.test(ln))
+          bodyHasTerminator = true;
+        if (started && braceDepth === 0 && blockEnd !== i2)
+          break;
+      }
+      if (!started || !bodyHasTerminator)
+        continue;
+    }
+    const varRefRe = new RegExp(`\\b${guardedVar}\\b`);
+    for (let l = blockEnd + 1;l < lines.length; l++) {
+      if (!varRefRe.test(lines[l]))
+        continue;
+      sanitizers.push({
+        type: "js_command_allowlist_guard",
+        method: "if",
+        line: l + 1,
+        sanitizes: ["command_injection", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -24915,10 +25186,13 @@ function findJavaArgvFormExecSanitizers(code) {
 `);
   const argvExecRe = /\.\s*exec\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
   const argvPbRe = /\bnew\s+ProcessBuilder\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
+  const shellInStringRe = /new\s+String\s*\[\s*\]\s*\{\s*"(?:\/(?:usr\/)?bin\/(?:sh|bash|zsh|ksh|dash)|(?:sh|bash|zsh|ksh|dash)|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh)"\s*,\s*"(?:-c|\/c|-Command|-command)"/i;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const text = lines[i2];
     if (!argvExecRe.test(text) && !argvPbRe.test(text))
       continue;
+    if (shellInStringRe.test(text))
+      continue;
     sanitizers.push({
       type: "java_argv_form_exec",
       method: "exec",
@@ -27069,6 +27343,20 @@ function findPythonMongoengineWhereNosqlInjectionFindings(code, file) {
   }
   return findings;
 }
+function hasHostAllowlistBeforeSink(taintedVars, lines, sinkLineIdx) {
+  for (let i2 = 0;i2 < sinkLineIdx; i2++) {
+    const t = lines[i2];
+    for (const v of taintedVars) {
+      const containsRe = new RegExp(`\\.\\s*contains\\s*\\(\\s*${v}\\s*\\.\\s*getHost\\s*\\(\\s*\\)\\s*\\)`);
+      if (containsRe.test(t))
+        return true;
+      const equalsRe = new RegExp(`\\b${v}\\s*\\.\\s*getHost\\s*\\(\\s*\\)\\s*\\.\\s*equals(?:IgnoreCase)?\\s*\\(\\s*"[^"]+"\\s*\\)`);
+      if (equalsRe.test(t))
+        return true;
+    }
+  }
+  return false;
+}
 function findJavaUrlOpenStreamSsrfFindings(code, file) {
   const findings = [];
   if (typeof code !== "string" || code.length === 0)
@@ -27133,6 +27421,8 @@ function findJavaUrlOpenStreamSsrfFindings(code, file) {
     }
     if (!tainted)
       continue;
+    if (hasHostAllowlistBeforeSink(taintedVars, lines, i2))
+      continue;
     const key = `${i2 + 1}:${op}`;
     if (seen.has(key))
       continue;
@@ -28443,6 +28733,94 @@ function findJsTemplateInjectionSstiFindings(code, file) {
   return findings;
 }
 
+// ../circle-ir/dist/analysis/passes/source-semantics-pass.js
+var DEMO_PATH_RE = /(?:^|\/)(?:demo|example|examples|samples|integration-tests|integration_tests)(?:\/|$)/i;
+var CONST_STRING_ASSIGN_RE = /^\s*(?:final\s+|static\s+final\s+)?[A-Za-z_][\w.<>\[\]]*\s+[A-Za-z_]\w*\s*=\s*"[^"]*"\s*;?\s*$/;
+var STATIC_FINAL_RE = /^\s*(?:public\s+|private\s+|protected\s+)?static\s+final\s+/;
+var ENUM_CONST_REF_RE = /=\s*[A-Z][A-Za-z0-9_]*\.[A-Z][A-Z0-9_]*\s*;?\s*$/;
+function isConstantSource(code) {
+  if (!code)
+    return false;
+  if (CONST_STRING_ASSIGN_RE.test(code))
+    return true;
+  if (STATIC_FINAL_RE.test(code)) {
+    const rhs = code.split("=").slice(1).join("=").trim();
+    if (rhs.length === 0)
+      return false;
+    if (/^"[^"]*"\s*;?\s*$/.test(rhs))
+      return true;
+    if (/^-?\d+(?:\.\d+)?[fFdDlL]?\s*;?\s*$/.test(rhs))
+      return true;
+    if (/^(?:true|false)\s*;?\s*$/.test(rhs))
+      return true;
+    if (/^[A-Za-z_][\w.]*\s*;?\s*$/.test(rhs))
+      return true;
+    return false;
+  }
+  if (ENUM_CONST_REF_RE.test(code))
+    return true;
+  return false;
+}
+var SERVICE_LOADER_RE = /\bServiceLoader\.(?:load|loadInstalled|stream)\s*\(/;
+var CLASS_FOR_NAME_RE = /\bClass\.forName\s*\(/;
+var META_INF_SERVICES_RE = /getResources?\s*\(\s*"META-INF\/services\//;
+var SPI_WINDOW = 30;
+function isSpiSource(source, lines) {
+  const code = source.code;
+  if (!code)
+    return false;
+  if (SERVICE_LOADER_RE.test(code))
+    return true;
+  if (CLASS_FOR_NAME_RE.test(code)) {
+    const start2 = Math.max(0, source.line - 1 - SPI_WINDOW);
+    const end = Math.min(lines.length, source.line - 1 + SPI_WINDOW + 1);
+    for (let i2 = start2;i2 < end; i2++) {
+      if (META_INF_SERVICES_RE.test(lines[i2]))
+        return true;
+    }
+  }
+  return false;
+}
+function isDemoPathFile(file) {
+  if (!file)
+    return false;
+  return DEMO_PATH_RE.test(file);
+}
+
+class SourceSemanticsPass {
+  name = "source-semantics";
+  category = "security";
+  run(ctx) {
+    const { graph, code } = ctx;
+    const sources = graph.ir.taint.sources;
+    if (sources.length === 0) {
+      return { constantCount: 0, spiCount: 0, demoPathCount: 0 };
+    }
+    const file = graph.ir.meta.file;
+    const demoPath = isDemoPathFile(file);
+    const lines = code.split(`
+`);
+    let constantCount = 0;
+    let spiCount = 0;
+    let demoPathCount = 0;
+    for (const source of sources) {
+      if (isConstantSource(source.code)) {
+        source.constant = true;
+        constantCount++;
+      }
+      if (isSpiSource(source, lines)) {
+        source.spi = true;
+        spiCount++;
+      }
+      if (demoPath) {
+        source.demoPath = true;
+        demoPathCount++;
+      }
+    }
+    return { constantCount, spiCount, demoPathCount };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
   /\bDOMPurify\.sanitize\s*\(/,
@@ -28500,6 +28878,16 @@ var COMPILED_TEMPLATE_TYPES = new Set([
   "VelocityTemplate",
   "BeetlTemplate"
 ]);
+var TEMPLATE_ENGINE_LITERAL_TARGETS = new Set([
+  "VelocityEngine",
+  "Velocity",
+  "TemplateEngine",
+  "SpringTemplateEngine",
+  "Configuration",
+  "PebbleEngine",
+  "Pebble",
+  "Handlebars"
+]);
 var REFLECTION_LITERAL_METHODS = new Set([
   "forName",
   "loadClass",
@@ -28532,7 +28920,7 @@ var PROTOCOL_CLIENT_PACKAGES = [
 ];
 var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
 var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
-var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b/;
+var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b[^;]*;\s*(?:\/\/.*|\/\*.*)?$/;
 var JEXL_ENGINE_TYPES = new Set(["JexlEngine", "Jexl", "JxltEngine"]);
 var JEXL_EXPRESSION_TYPE_RE = /(?:Jexl)?(?:Expression|Script|Template)(?:Script)?$/;
 var TEMPLATE_COMPILE_RECEIVER_TYPES = new Set([
@@ -28958,6 +29346,23 @@ class SinkFilterPass {
           const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
           if (recvType && COMPILED_TEMPLATE_TYPES.has(recvType))
             return false;
+          if (recvType && TEMPLATE_ENGINE_LITERAL_TARGETS.has(recvType)) {
+            const args2 = extractJavaCallArgs(method, sinkLineText);
+            if (args2 !== null && args2.length >= 1 && isJavaLiteralOrAnnotationAccessor(args2[0])) {
+              return false;
+            }
+          }
+        }
+        if (method === "evaluate" && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && TEMPLATE_ENGINE_LITERAL_TARGETS.has(recvType)) {
+            const args2 = extractJavaCallArgs(method, sinkLineText);
+            if (args2 !== null && args2.length >= 1) {
+              const last = args2[args2.length - 1] ?? "";
+              if (isJavaLiteralOrAnnotationAccessor(last))
+                return false;
+            }
+          }
         }
         if (method && REFLECTION_LITERAL_METHODS.has(method)) {
           const args2 = extractJavaCallArgs(method, sinkLineText);
@@ -29024,7 +29429,7 @@ class SinkFilterPass {
       filtered = filtered.filter((sink) => {
         if (sink.type !== "command_injection")
           return true;
-        if (sink.method !== "ProcessBuilder")
+        if (sink.method !== "ProcessBuilder" && sink.method !== "start")
           return true;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
         if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText))
@@ -29861,6 +30266,54 @@ function filterSanitizedSinks(sinks, sanitizers, calls) {
   });
 }
 
+// ../circle-ir/dist/analysis/passes/sink-semantics-pass.js
+function buildRegistry(entries) {
+  const registry = new Map;
+  for (const entry of entries) {
+    const existing = registry.get(entry.signature);
+    if (existing) {
+      for (const t of entry.overrides)
+        existing.add(t);
+    } else {
+      registry.set(entry.signature, new Set(entry.overrides));
+    }
+  }
+  return registry;
+}
+
+class SinkSemanticsPass {
+  name = "sink-semantics";
+  category = "security";
+  run(ctx) {
+    const { graph, config } = ctx;
+    const entries = config.sinkSemantics ?? [];
+    if (entries.length === 0) {
+      return { droppedCount: 0, registrySize: 0 };
+    }
+    const registry = buildRegistry(entries);
+    const sinks = graph.ir.taint.sinks;
+    let droppedCount = 0;
+    const kept = sinks.filter((sink) => {
+      if (!sink.class || !sink.method)
+        return true;
+      const signature = `${sink.class}#${sink.method}`;
+      const overrides = registry.get(signature);
+      if (!overrides)
+        return true;
+      if (overrides.has(sink.type)) {
+        droppedCount++;
+        return false;
+      }
+      return true;
+    });
+    if (droppedCount > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { droppedCount, registrySize: registry.size };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
@@ -30555,6 +31008,27 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  if (language === "java" && typeof code === "string" && sourcesWithVar.length > 0) {
+    const seedVars = new Set(sourcesWithVar.map((s) => s.variable));
+    const derived = buildJavaTaintedVars(code, seedVars);
+    if (derived.size > 0) {
+      let anchor = sourcesWithVar[0];
+      for (const s of sourcesWithVar) {
+        if (s.line < anchor.line)
+          anchor = s;
+      }
+      const existingVars = new Set(sourcesWithVar.map((s) => s.variable));
+      for (const [varName] of derived) {
+        if (!varName || existingVars.has(varName))
+          continue;
+        sourcesWithVar.push({
+          ...anchor,
+          variable: varName
+        });
+        existingVars.add(varName);
+      }
+    }
+  }
   const reCache = new Map;
   for (const s of sourcesWithVar) {
     if (reCache.has(s.variable))
@@ -30589,6 +31063,8 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
           const re = reCache.get(source.variable);
           if (!re || !re.test(expr))
             continue;
+          if (!sourceSemanticsAllowed(source, sink.type))
+            continue;
           if (flows.some((f) => f.source_line === source.line && f.sink_line === sink.line && f.sink_type === sink.type))
             continue;
           if (aliasSanitizedFor.get(source.variable)?.has(sink.type)) {
@@ -30616,8 +31092,6 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
   }
   const sourcesByLine = new Map;
   for (const s of sources) {
-    if (s.variable && s.variable.length > 0)
-      continue;
     const arr = sourcesByLine.get(s.line) ?? [];
     arr.push(s);
     sourcesByLine.set(s.line, arr);
@@ -30631,6 +31105,20 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     for (const source of colocSources) {
       if (!canSourceReachSink(source.type, sink.type))
         continue;
+      if (!sourceSemanticsAllowed(source, sink.type))
+        continue;
+      const sourceVar = source.variable;
+      if (sourceVar && sourceVar.length > 0) {
+        const sinkCode = sink.code;
+        if (!sinkCode) {
+          continue;
+        }
+        const assignMatch = sinkCode.match(/^\s*(?:[A-Za-z_][\w.<>[\]\s,?]*\s+)?[A-Za-z_]\w*\s*=(?!=)\s*/);
+        const rhs = assignMatch ? sinkCode.slice(assignMatch[0].length) : sinkCode;
+        if (new RegExp(`\\b${sourceVar}\\b`).test(rhs)) {
+          continue;
+        }
+      }
       if (source.type === "file_input" && sink.type === "path_traversal" && sink.method && source.location.includes(`${sink.method}(`)) {
         continue;
       }
@@ -31219,7 +31707,9 @@ var TIER_1_METHOD_ANNOTATIONS = new Set([
   "DELETE",
   "PATCH",
   "HEAD",
-  "OPTIONS"
+  "OPTIONS",
+  "DataBoundConstructor",
+  "DataBoundSetter"
 ]);
 var TIER_1_CLASS_ANNOTATIONS = new Set([
   "RestController",
@@ -31244,7 +31734,13 @@ var TIER_1_BY_SUPERTYPE = new Map([
   ["ChannelInboundHandler", new Set(["channelRead", "channelReadComplete"])],
   ["ChannelInboundHandlerAdapter", new Set(["channelRead", "channelReadComplete"])],
   ["ChannelDuplexHandler", new Set(["channelRead", "channelReadComplete"])],
-  ["NettyRequestProcessor", new Set(["process"])]
+  ["NettyRequestProcessor", new Set(["process"])],
+  ["Converter", new Set(["marshal", "unmarshal"])],
+  ["SingleValueConverter", new Set(["fromString", "toString"])],
+  ["ConverterMatcher", new Set(["marshal", "unmarshal"])],
+  ["AbstractReflectionConverter", new Set(["marshal", "unmarshal", "doMarshal", "doUnmarshal"])],
+  ["AbstractSingleValueConverter", new Set(["fromString", "toString"])],
+  ["AbstractCollectionConverter", new Set(["marshal", "unmarshal"])]
 ]);
 var TIER_3_CLASS_SUFFIXES = [
   "Util",
@@ -35754,6 +36250,14 @@ function isProtocolMandatedCryptoFile(file, code) {
 }
 
 // ../circle-ir/dist/analysis/passes/scan-secrets-pass.js
+function applyDemoDowngrade(demoPath, severity, level) {
+  if (!demoPath)
+    return { severity, level };
+  if (severity === "high") {
+    return { severity: "low", level: "note" };
+  }
+  return { severity, level };
+}
 var TEST_PATH_RE3 = /(?:^|[\\/])(?:test|tests|spec|specs|__tests?__|__mocks?__|fixtures?|testdata)(?:[\\/]|$)/i;
 var TEST_FILENAME_RE = /(?:\.(?:test|spec)\.[cm]?[jt]sx?|_test\.go|_test\.py|Test\.java|Tests\.java)$/i;
 function isTestFile(file) {
@@ -36104,6 +36608,7 @@ class ScanSecretsPass {
     if (isTestFile(file) || isGeneratedFile(file)) {
       return { providerFindings: 0, entropyFindings: 0 };
     }
+    const demoPath = DEMO_PATH_RE.test(file);
     const lines = ctx.code.split(`
 `);
     const prior = ctx.getFindings?.() ?? [];
@@ -36134,14 +36639,15 @@ class ScanSecretsPass {
         if (seen.has(key))
           continue;
         seen.add(key);
+        const dg = applyDemoDowngrade(demoPath, pattern.severity, pattern.level);
         ctx.addFinding({
           id: `hardcoded-credential-${file}-${lineNum}`,
           pass: this.name,
           category: this.category,
           rule_id: "hardcoded-credential",
           cwe: "CWE-798",
-          severity: pattern.severity,
-          level: pattern.level,
+          severity: dg.severity,
+          level: dg.level,
           message: `Hardcoded credential: ${pattern.name} detected`,
           file,
           line: lineNum,
@@ -36163,14 +36669,15 @@ class ScanSecretsPass {
       if (seen.has(key))
         continue;
       seen.add(key);
+      const dg = applyDemoDowngrade(demoPath, "high", "error");
       ctx.addFinding({
         id: `hardcoded-credential-${file}-${lineNum}`,
         pass: this.name,
         category: this.category,
         rule_id: "hardcoded-credential",
         cwe: "CWE-798",
-        severity: "high",
-        level: "error",
+        severity: dg.severity,
+        level: dg.level,
         message: `Hardcoded credential: \`${hit.name}\` assigned a literal value`,
         file,
         line: lineNum,
@@ -40791,7 +41298,11 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new TaintMatcherPass);
     pipeline.add(new ConstantPropagationPass(tree));
     pipeline.add(new LanguageSourcesPass);
+    if (!disabledPasses.has("source-semantics"))
+      pipeline.add(new SourceSemanticsPass);
     pipeline.add(new SinkFilterPass);
+    if (!disabledPasses.has("sink-semantics"))
+      pipeline.add(new SinkSemanticsPass);
     pipeline.add(new TaintPropagationPass);
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
@@ -41719,7 +42230,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.141.0";
+var version = "3.146.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.141.0",
+  "version": "3.146.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.141.0"
+    "circle-ir": "^3.146.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",