cognium-dev 3.145.0 → 3.147.0

package/dist/cli.js

@@ -12318,6 +12318,38 @@ function isSafeGoExecCommandCall(call, pattern, language) {
   ]);
   if (SHELL_PROGRAMS.has(program))
     return false;
+  const PACKAGE_MANAGER_EXEC_SUBCOMMANDS = {
+    go: new Set(["install", "run", "get"]),
+    npm: new Set(["install", "i", "exec"]),
+    npx: new Set(["*"]),
+    pip: new Set(["install"]),
+    pip3: new Set(["install"]),
+    gem: new Set(["install"]),
+    cargo: new Set(["install", "run"]),
+    yarn: new Set(["add", "install", "exec", "dlx"]),
+    pnpm: new Set(["add", "install", "exec", "dlx"])
+  };
+  const pmSubcommands = PACKAGE_MANAGER_EXEC_SUBCOMMANDS[program];
+  if (pmSubcommands !== undefined) {
+    const subcommandArgPos = pattern.method === "CommandContext" ? 2 : 1;
+    const subcommandArg = call.arguments.find((a) => a.position === subcommandArgPos);
+    if (!subcommandArg)
+      return false;
+    let subcommand;
+    if (subcommandArg.literal !== null && subcommandArg.literal !== undefined) {
+      subcommand = String(subcommandArg.literal);
+    } else {
+      const expr = (subcommandArg.expression ?? "").trim();
+      if (expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'")) {
+        subcommand = expr.slice(1, -1);
+      }
+    }
+    if (subcommand === undefined)
+      return false;
+    if (pmSubcommands.has("*") || pmSubcommands.has(subcommand)) {
+      return false;
+    }
+  }
   return true;
 }
 function isSafeJSChildProcessCall(call, pattern, language) {
@@ -22868,6 +22900,8 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findJsSsrfAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findJsArgvFormExecSanitizers(code));
       additionalSanitizers.push(...findJsParameterizedSqlSanitizers(code));
+      additionalSanitizers.push(...findJsPathResolveStartsWithGuardSanitizers(code));
+      additionalSanitizers.push(...findJsCommandAllowlistGuardSanitizers(code));
       for (const finding of findJsPatternFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
@@ -24987,6 +25021,126 @@ function findJsParameterizedSqlSanitizers(code) {
   }
   return sanitizers;
 }
+function findJsPathResolveStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const resolveDeclRe = /\b(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*(?:(?:node:)?path|nodePath|Path)\s*\.\s*(?:resolve|join)\s*\(\s*([A-Za-z_]\w*(?:\.\w+)*)\s*,/;
+  const startsWithGuardRe = (varName, rootName) => new RegExp(`if\\s*\\(\\s*!\\s*${varName}\\s*\\.\\s*startsWith\\s*\\(\\s*${rootName}\\b`);
+  const terminatorRe = /\b(?:throw|return|res\s*\.\s*status\s*\([^)]*\)\s*\.\s*(?:send|end|json))/;
+  const candidates = [];
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = resolveDeclRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    candidates.push({ line: i2 + 1, fullVar: m[1], rootVar: m[2] });
+  }
+  if (candidates.length === 0)
+    return sanitizers;
+  for (const c of candidates) {
+    const guardRe = startsWithGuardRe(c.fullVar, c.rootVar);
+    let guardLine = -1;
+    for (let l = c.line;l < Math.min(lines.length, c.line + 6); l++) {
+      if (!guardRe.test(lines[l]))
+        continue;
+      if (terminatorRe.test(lines[l]) || l + 1 < lines.length && terminatorRe.test(lines[l + 1])) {
+        guardLine = l + 1;
+        break;
+      }
+    }
+    if (guardLine < 0)
+      continue;
+    const varRefRe = new RegExp(`\\b${c.fullVar}\\b`);
+    sanitizers.push({
+      type: "js_path_resolve_startswith_guard",
+      method: "startsWith",
+      line: c.line,
+      sanitizes: ["path_traversal", "external_taint_escape"]
+    });
+    for (let l = c.line;l < lines.length; l++) {
+      if (!varRefRe.test(lines[l]))
+        continue;
+      sanitizers.push({
+        type: "js_path_resolve_startswith_guard",
+        method: "startsWith",
+        line: l + 1,
+        sanitizes: ["path_traversal", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findJsCommandAllowlistGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const shoutyCase = /^[A-Z][A-Z0-9_]+$/;
+  const allowlistTokens = /(?:allowed|accepted|whitelist|permitted|valid|approved|cmds|commands|tools)/i;
+  const isAllowlistName = (n) => shoutyCase.test(n) || allowlistTokens.test(n);
+  const guardHas = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*(?:has|includes)\s*\(\s*([A-Za-z_]\w*)\s*\)\s*\)/;
+  const guardIndexOf = /\bif\s*\(\s*([A-Za-z_]\w*)\s*\.\s*indexOf\s*\(\s*([A-Za-z_]\w*)\s*\)\s*(?:<\s*0|===\s*-1|==\s*-1)\s*\)/;
+  const terminator = /\b(?:return|throw|res\s*\.\s*status\s*\([^)]*\)\s*\.\s*(?:send|end|json))/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    let m = guardHas.exec(line);
+    let allow = null;
+    let guardedVar = null;
+    if (m) {
+      allow = m[1];
+      guardedVar = m[2];
+    } else {
+      m = guardIndexOf.exec(line);
+      if (m) {
+        allow = m[1];
+        guardedVar = m[2];
+      }
+    }
+    if (!allow || !guardedVar)
+      continue;
+    if (!isAllowlistName(allow))
+      continue;
+    let bodyHasTerminator = terminator.test(line);
+    let blockEnd = i2;
+    if (!bodyHasTerminator) {
+      let braceDepth = 0;
+      let started = false;
+      const maxScan = Math.min(lines.length, i2 + 26);
+      for (let j = i2;j < maxScan; j++) {
+        const ln = lines[j];
+        for (const ch of ln) {
+          if (ch === "{") {
+            braceDepth++;
+            started = true;
+          } else if (ch === "}") {
+            braceDepth--;
+            if (started && braceDepth === 0) {
+              blockEnd = j;
+              break;
+            }
+          }
+        }
+        if (started && j > i2 && terminator.test(ln))
+          bodyHasTerminator = true;
+        if (started && braceDepth === 0 && blockEnd !== i2)
+          break;
+      }
+      if (!started || !bodyHasTerminator)
+        continue;
+    }
+    const varRefRe = new RegExp(`\\b${guardedVar}\\b`);
+    for (let l = blockEnd + 1;l < lines.length; l++) {
+      if (!varRefRe.test(lines[l]))
+        continue;
+      sanitizers.push({
+        type: "js_command_allowlist_guard",
+        method: "if",
+        line: l + 1,
+        sanitizes: ["command_injection", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -28756,6 +28910,16 @@ var COMPILED_TEMPLATE_TYPES = new Set([
   "VelocityTemplate",
   "BeetlTemplate"
 ]);
+var TEMPLATE_ENGINE_LITERAL_TARGETS = new Set([
+  "VelocityEngine",
+  "Velocity",
+  "TemplateEngine",
+  "SpringTemplateEngine",
+  "Configuration",
+  "PebbleEngine",
+  "Pebble",
+  "Handlebars"
+]);
 var REFLECTION_LITERAL_METHODS = new Set([
   "forName",
   "loadClass",
@@ -28788,7 +28952,7 @@ var PROTOCOL_CLIENT_PACKAGES = [
 ];
 var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
 var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
-var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b/;
+var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b[^;]*;\s*(?:\/\/.*|\/\*.*)?$/;
 var JEXL_ENGINE_TYPES = new Set(["JexlEngine", "Jexl", "JxltEngine"]);
 var JEXL_EXPRESSION_TYPE_RE = /(?:Jexl)?(?:Expression|Script|Template)(?:Script)?$/;
 var TEMPLATE_COMPILE_RECEIVER_TYPES = new Set([
@@ -29214,6 +29378,23 @@ class SinkFilterPass {
           const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
           if (recvType && COMPILED_TEMPLATE_TYPES.has(recvType))
             return false;
+          if (recvType && TEMPLATE_ENGINE_LITERAL_TARGETS.has(recvType)) {
+            const args2 = extractJavaCallArgs(method, sinkLineText);
+            if (args2 !== null && args2.length >= 1 && isJavaLiteralOrAnnotationAccessor(args2[0])) {
+              return false;
+            }
+          }
+        }
+        if (method === "evaluate" && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && TEMPLATE_ENGINE_LITERAL_TARGETS.has(recvType)) {
+            const args2 = extractJavaCallArgs(method, sinkLineText);
+            if (args2 !== null && args2.length >= 1) {
+              const last = args2[args2.length - 1] ?? "";
+              if (isJavaLiteralOrAnnotationAccessor(last))
+                return false;
+            }
+          }
         }
         if (method && REFLECTION_LITERAL_METHODS.has(method)) {
           const args2 = extractJavaCallArgs(method, sinkLineText);
@@ -42081,7 +42262,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.145.0";
+var version = "3.147.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.145.0",
+  "version": "3.147.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.145.0"
+    "circle-ir": "^3.147.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",