cognium-dev 3.147.0 → 3.148.0

package/dist/cli.js

@@ -26043,6 +26043,18 @@ function findJavaResponseWriterXssFindings(code, file) {
   if (respNames.size === 0)
     return out2;
   const safeWrapRe = /\b(?:Encode\.(?:forHtml|forHtmlAttribute|forHtmlContent|forJavaScript)|StringEscapeUtils\.escape(?:Html3|Html4|EcmaScript|Xml)|HtmlUtils\.htmlEscape(?:Decimal|Hex)?|Escaper\.escapeHtml|HtmlEscapers\.(?:escapeHtml|htmlEscaper)|Encoder\.encodeForHTML(?:Attribute)?|Jsoup\.clean)\s*\(/;
+  const sanitizedVars = new Set;
+  const sanAssignRe = /(?:^|[\s;{},(])(?:final\s+)?(?:[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*[^=]/;
+  for (const line of lines) {
+    const t = line.trim();
+    if (!t || t.startsWith("//") || t.startsWith("*"))
+      continue;
+    if (!safeWrapRe.test(t))
+      continue;
+    const am = t.match(sanAssignRe);
+    if (am)
+      sanitizedVars.add(am[1]);
+  }
   for (let i2 = 0;i2 < lines.length; i2++) {
     const raw = lines[i2];
     const trimmed = raw.trim();
@@ -26063,6 +26075,14 @@ function findJavaResponseWriterXssFindings(code, file) {
       continue;
     if (!/[A-Za-z_]\w*/.test(argsTrim))
       continue;
+    if (sanitizedVars.size > 0) {
+      const stripped = argsTrim.replace(/"(?:\\.|[^"\\])*"/g, "");
+      const idents = stripped.match(/\b[A-Za-z_]\w*\b/g) ?? [];
+      const nonKeyword = idents.filter((x) => x !== "null" && x !== "true" && x !== "false");
+      if (nonKeyword.length > 0 && nonKeyword.every((x) => sanitizedVars.has(x))) {
+        continue;
+      }
+    }
     out2.push({
       id: `xss-${file}-${i2 + 1}`,
       pass: "language-sources",
@@ -42262,7 +42282,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.147.0";
+var version = "3.148.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.147.0",
+  "version": "3.148.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.147.0"
+    "circle-ir": "^3.148.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",