cognium-dev 3.146.0 → 3.148.0

package/dist/cli.js

@@ -12318,6 +12318,38 @@ function isSafeGoExecCommandCall(call, pattern, language) {
   ]);
   if (SHELL_PROGRAMS.has(program))
     return false;
+  const PACKAGE_MANAGER_EXEC_SUBCOMMANDS = {
+    go: new Set(["install", "run", "get"]),
+    npm: new Set(["install", "i", "exec"]),
+    npx: new Set(["*"]),
+    pip: new Set(["install"]),
+    pip3: new Set(["install"]),
+    gem: new Set(["install"]),
+    cargo: new Set(["install", "run"]),
+    yarn: new Set(["add", "install", "exec", "dlx"]),
+    pnpm: new Set(["add", "install", "exec", "dlx"])
+  };
+  const pmSubcommands = PACKAGE_MANAGER_EXEC_SUBCOMMANDS[program];
+  if (pmSubcommands !== undefined) {
+    const subcommandArgPos = pattern.method === "CommandContext" ? 2 : 1;
+    const subcommandArg = call.arguments.find((a) => a.position === subcommandArgPos);
+    if (!subcommandArg)
+      return false;
+    let subcommand;
+    if (subcommandArg.literal !== null && subcommandArg.literal !== undefined) {
+      subcommand = String(subcommandArg.literal);
+    } else {
+      const expr = (subcommandArg.expression ?? "").trim();
+      if (expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'")) {
+        subcommand = expr.slice(1, -1);
+      }
+    }
+    if (subcommand === undefined)
+      return false;
+    if (pmSubcommands.has("*") || pmSubcommands.has(subcommand)) {
+      return false;
+    }
+  }
   return true;
 }
 function isSafeJSChildProcessCall(call, pattern, language) {
@@ -26011,6 +26043,18 @@ function findJavaResponseWriterXssFindings(code, file) {
   if (respNames.size === 0)
     return out2;
   const safeWrapRe = /\b(?:Encode\.(?:forHtml|forHtmlAttribute|forHtmlContent|forJavaScript)|StringEscapeUtils\.escape(?:Html3|Html4|EcmaScript|Xml)|HtmlUtils\.htmlEscape(?:Decimal|Hex)?|Escaper\.escapeHtml|HtmlEscapers\.(?:escapeHtml|htmlEscaper)|Encoder\.encodeForHTML(?:Attribute)?|Jsoup\.clean)\s*\(/;
+  const sanitizedVars = new Set;
+  const sanAssignRe = /(?:^|[\s;{},(])(?:final\s+)?(?:[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*[^=]/;
+  for (const line of lines) {
+    const t = line.trim();
+    if (!t || t.startsWith("//") || t.startsWith("*"))
+      continue;
+    if (!safeWrapRe.test(t))
+      continue;
+    const am = t.match(sanAssignRe);
+    if (am)
+      sanitizedVars.add(am[1]);
+  }
   for (let i2 = 0;i2 < lines.length; i2++) {
     const raw = lines[i2];
     const trimmed = raw.trim();
@@ -26031,6 +26075,14 @@ function findJavaResponseWriterXssFindings(code, file) {
       continue;
     if (!/[A-Za-z_]\w*/.test(argsTrim))
       continue;
+    if (sanitizedVars.size > 0) {
+      const stripped = argsTrim.replace(/"(?:\\.|[^"\\])*"/g, "");
+      const idents = stripped.match(/\b[A-Za-z_]\w*\b/g) ?? [];
+      const nonKeyword = idents.filter((x) => x !== "null" && x !== "true" && x !== "false");
+      if (nonKeyword.length > 0 && nonKeyword.every((x) => sanitizedVars.has(x))) {
+        continue;
+      }
+    }
     out2.push({
       id: `xss-${file}-${i2 + 1}`,
       pass: "language-sources",
@@ -42230,7 +42282,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.146.0";
+var version = "3.148.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.146.0",
+  "version": "3.148.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.146.0"
+    "circle-ir": "^3.148.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",