cognium-dev 3.147.0 → 3.150.0

package/dist/cli.js

@@ -26043,6 +26043,18 @@ function findJavaResponseWriterXssFindings(code, file) {
   if (respNames.size === 0)
     return out2;
   const safeWrapRe = /\b(?:Encode\.(?:forHtml|forHtmlAttribute|forHtmlContent|forJavaScript)|StringEscapeUtils\.escape(?:Html3|Html4|EcmaScript|Xml)|HtmlUtils\.htmlEscape(?:Decimal|Hex)?|Escaper\.escapeHtml|HtmlEscapers\.(?:escapeHtml|htmlEscaper)|Encoder\.encodeForHTML(?:Attribute)?|Jsoup\.clean)\s*\(/;
+  const sanitizedVars = new Set;
+  const sanAssignRe = /(?:^|[\s;{},(])(?:final\s+)?(?:[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*[^=]/;
+  for (const line of lines) {
+    const t = line.trim();
+    if (!t || t.startsWith("//") || t.startsWith("*"))
+      continue;
+    if (!safeWrapRe.test(t))
+      continue;
+    const am = t.match(sanAssignRe);
+    if (am)
+      sanitizedVars.add(am[1]);
+  }
   for (let i2 = 0;i2 < lines.length; i2++) {
     const raw = lines[i2];
     const trimmed = raw.trim();
@@ -26063,6 +26075,14 @@ function findJavaResponseWriterXssFindings(code, file) {
       continue;
     if (!/[A-Za-z_]\w*/.test(argsTrim))
       continue;
+    if (sanitizedVars.size > 0) {
+      const stripped = argsTrim.replace(/"(?:\\.|[^"\\])*"/g, "");
+      const idents = stripped.match(/\b[A-Za-z_]\w*\b/g) ?? [];
+      const nonKeyword = idents.filter((x) => x !== "null" && x !== "true" && x !== "false");
+      if (nonKeyword.length > 0 && nonKeyword.every((x) => sanitizedVars.has(x))) {
+        continue;
+      }
+    }
     out2.push({
       id: `xss-${file}-${i2 + 1}`,
       pass: "language-sources",
@@ -30323,7 +30343,7 @@ class SinkSemanticsPass {
       return { droppedCount: 0, registrySize: 0 };
     }
     const registry = buildRegistry(entries);
-    const sinks = graph.ir.taint.sinks;
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
     let droppedCount = 0;
     const kept = sinks.filter((sink) => {
       if (!sink.class || !sink.method)
@@ -30346,6 +30366,194 @@ class SinkSemanticsPass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
+var REFLECTION_SINK_METHODS = new Set([
+  "forName",
+  "newInstance",
+  "invoke",
+  "getMethod",
+  "getDeclaredMethod",
+  "getConstructor",
+  "getDeclaredConstructor",
+  "loadClass",
+  "defineClass"
+]);
+var TIER_1_CLASS_ANNOTATIONS = new Set([
+  "RestController",
+  "Controller",
+  "Service",
+  "Repository",
+  "Component",
+  "Path",
+  "WebServlet",
+  "ServerEndpoint",
+  "FeignClient"
+]);
+var TIER_1_METHOD_ANNOTATIONS = new Set([
+  "RequestMapping",
+  "GetMapping",
+  "PostMapping",
+  "PutMapping",
+  "DeleteMapping",
+  "PatchMapping",
+  "MessageMapping",
+  "SubscribeMapping",
+  "KafkaListener",
+  "KafkaHandler",
+  "RabbitListener",
+  "RabbitHandler",
+  "JmsListener",
+  "StreamListener",
+  "SqsListener",
+  "SqsHandler",
+  "EventListener",
+  "Scheduled",
+  "Path",
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS",
+  "DataBoundConstructor",
+  "DataBoundSetter"
+]);
+var TIER_1_SUPERTYPES = new Set([
+  "HttpServlet",
+  "GenericServlet",
+  "Filter",
+  "HandlerInterceptor",
+  "AsyncHandlerInterceptor",
+  "CommandLineRunner",
+  "ApplicationRunner",
+  "SimpleChannelInboundHandler",
+  "ChannelInboundHandler",
+  "ChannelInboundHandlerAdapter",
+  "ChannelDuplexHandler",
+  "NettyRequestProcessor",
+  "Converter",
+  "SingleValueConverter",
+  "ConverterMatcher",
+  "AbstractReflectionConverter",
+  "AbstractSingleValueConverter",
+  "AbstractCollectionConverter"
+]);
+function normalizeAnnotation(raw) {
+  let s = raw.trim();
+  if (s.startsWith("@"))
+    s = s.slice(1);
+  const parenIdx = s.indexOf("(");
+  if (parenIdx >= 0)
+    s = s.slice(0, parenIdx);
+  const genericIdx = s.indexOf("<");
+  if (genericIdx >= 0)
+    s = s.slice(0, genericIdx);
+  const dotIdx = s.lastIndexOf(".");
+  if (dotIdx >= 0)
+    s = s.slice(dotIdx + 1);
+  return s.trim();
+}
+function normalizeSupertype(raw) {
+  let s = raw.trim();
+  const genericIdx = s.indexOf("<");
+  if (genericIdx >= 0)
+    s = s.slice(0, genericIdx);
+  const dotIdx = s.lastIndexOf(".");
+  if (dotIdx >= 0)
+    s = s.slice(dotIdx + 1);
+  return s.trim();
+}
+function isMainMethod(name2, paramTypes) {
+  if (name2 !== "main")
+    return false;
+  if (paramTypes.length !== 1)
+    return false;
+  const t = paramTypes[0];
+  if (!t)
+    return false;
+  const bare = t.replace(/\s+/g, "");
+  return bare === "String[]" || bare === "java.lang.String[]";
+}
+
+class CliMainReflectionSuppressPass {
+  name = "cli-main-reflection-suppress";
+  category = "security";
+  run(ctx) {
+    const { graph, language } = ctx;
+    if (language !== "java") {
+      return { cliMainSignal: false, droppedCount: 0 };
+    }
+    const types = graph.ir.types;
+    if (!types || types.length === 0) {
+      return { cliMainSignal: false, droppedCount: 0 };
+    }
+    let hasMain = false;
+    let hasFrameworkSignal = false;
+    for (const type of types) {
+      for (const ann of type.annotations) {
+        if (TIER_1_CLASS_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+          hasFrameworkSignal = true;
+          break;
+        }
+      }
+      if (hasFrameworkSignal)
+        break;
+      if (type.extends && TIER_1_SUPERTYPES.has(normalizeSupertype(type.extends))) {
+        hasFrameworkSignal = true;
+        break;
+      }
+      for (const impl of type.implements) {
+        if (TIER_1_SUPERTYPES.has(normalizeSupertype(impl))) {
+          hasFrameworkSignal = true;
+          break;
+        }
+      }
+      if (hasFrameworkSignal)
+        break;
+      for (const method of type.methods) {
+        for (const ann of method.annotations) {
+          if (TIER_1_METHOD_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+            hasFrameworkSignal = true;
+            break;
+          }
+        }
+        if (hasFrameworkSignal)
+          break;
+        if (!hasMain) {
+          const paramTypes = method.parameters.map((p) => p.type);
+          if (isMainMethod(method.name, paramTypes)) {
+            hasMain = true;
+          }
+        }
+      }
+      if (hasFrameworkSignal)
+        break;
+    }
+    const cliMainSignal = hasMain && !hasFrameworkSignal;
+    if (!cliMainSignal) {
+      return { cliMainSignal: false, droppedCount: 0 };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    let droppedCount = 0;
+    const kept = sinks.filter((sink) => {
+      if (sink.type !== "code_injection")
+        return true;
+      if (!sink.method)
+        return true;
+      if (!REFLECTION_SINK_METHODS.has(sink.method))
+        return true;
+      droppedCount++;
+      return false;
+    });
+    if (droppedCount > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { cliMainSignal: true, droppedCount };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
@@ -31713,7 +31921,7 @@ function findTaintBridges2(result) {
 }
 
 // ../circle-ir/dist/analysis/entry-point-detection.js
-var TIER_1_METHOD_ANNOTATIONS = new Set([
+var TIER_1_METHOD_ANNOTATIONS2 = new Set([
   "RequestMapping",
   "GetMapping",
   "PostMapping",
@@ -31743,7 +31951,7 @@ var TIER_1_METHOD_ANNOTATIONS = new Set([
   "DataBoundConstructor",
   "DataBoundSetter"
 ]);
-var TIER_1_CLASS_ANNOTATIONS = new Set([
+var TIER_1_CLASS_ANNOTATIONS2 = new Set([
   "RestController",
   "Controller",
   "Service",
@@ -31893,10 +32101,10 @@ function classifyEntryPointTier(method, enclosingType, ctx) {
   if (classShapeIsLibraryFacade(enclosingType)) {
     return "TIER_3_LIBRARY_API";
   }
-  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS)) {
+  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS2)) {
     return "TIER_1_ENTRY_POINT";
   }
-  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS)) {
+  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS2)) {
     return "TIER_1_ENTRY_POINT";
   }
   if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
@@ -32879,6 +33087,37 @@ var CLOSE_METHODS = new Set([
   "shutdownNow",
   "terminate"
 ]);
+var WRAPPER_CTORS = new Set([
+  "BufferedInputStream",
+  "BufferedOutputStream",
+  "BufferedReader",
+  "BufferedWriter",
+  "InputStreamReader",
+  "OutputStreamWriter",
+  "DataInputStream",
+  "DataOutputStream",
+  "PrintStream",
+  "PrintWriter",
+  "LineNumberReader",
+  "PushbackInputStream",
+  "PushbackReader",
+  "SequenceInputStream",
+  "GZIPInputStream",
+  "GZIPOutputStream",
+  "ZipInputStream",
+  "ZipOutputStream",
+  "InflaterInputStream",
+  "DeflaterOutputStream",
+  "CheckedInputStream",
+  "CheckedOutputStream"
+]);
+var WORKER_METHODS = new Set([
+  "run",
+  "call",
+  "accept",
+  "get",
+  "apply"
+]);
 
 class ResourceLeakPass {
   name = "resource-leak";
@@ -32915,6 +33154,12 @@ class ResourceLeakPass {
       if (this.isFactoryMethod(methodInfo.method)) {
         continue;
       }
+      if (this.isWrappedByCloseableCtor(graph.ir.calls, resourceVar, openLine, methodEnd)) {
+        continue;
+      }
+      if (this.isClosedInNestedWorker(graph, codeLines, resourceVar, methodInfo, openLine, methodEnd)) {
+        continue;
+      }
       const closeCall = graph.ir.calls.find((c) => CLOSE_METHODS.has(c.method_name) && c.receiver === resourceVar && c.location.line > openLine && c.location.line <= methodEnd);
       const snippet = (codeLines[openLine - 1] ?? "").trim();
       if (!closeCall) {
@@ -33011,6 +33256,57 @@ class ResourceLeakPass {
       return false;
     return FACTORY_METHOD_NAME_RE.test(method.name);
   }
+  isWrappedByCloseableCtor(calls, variable, fromLine, toLine) {
+    for (const call of calls) {
+      if (!WRAPPER_CTORS.has(call.method_name))
+        continue;
+      if (call.location.line < fromLine || call.location.line > toLine)
+        continue;
+      for (const arg of call.arguments) {
+        if (arg.variable === variable)
+          return true;
+      }
+    }
+    return false;
+  }
+  isClosedInNestedWorker(graph, lines, variable, methodInfo, fromLine, toLine) {
+    const fieldNames = new Set(methodInfo.type.fields.map((f) => f.name));
+    let candidateField = null;
+    if (fieldNames.has(variable)) {
+      candidateField = variable;
+    } else {
+      const thisAssignRe = new RegExp(`(?:\\bthis\\s*\\.\\s*)?(\\w+)\\s*=\\s*${escapeRegex2(variable)}\\b`);
+      for (let l = fromLine;l <= toLine && l <= lines.length; l++) {
+        const m = thisAssignRe.exec(lines[l - 1] ?? "");
+        if (m && fieldNames.has(m[1])) {
+          candidateField = m[1];
+          break;
+        }
+      }
+    }
+    if (!candidateField)
+      return false;
+    for (const call of graph.ir.calls) {
+      if (call.receiver !== candidateField)
+        continue;
+      if (!CLOSE_METHODS.has(call.method_name))
+        continue;
+      const closeLine = call.location.line;
+      if (closeLine < fromLine || closeLine > toLine)
+        continue;
+      const enclosing = graph.methodAtLine(closeLine);
+      if (!enclosing)
+        continue;
+      if (enclosing.method === methodInfo.method)
+        continue;
+      if (!WORKER_METHODS.has(enclosing.method.name))
+        continue;
+      if (enclosing.method.start_line > fromLine && enclosing.method.start_line <= toLine) {
+        return true;
+      }
+    }
+    return false;
+  }
 }
 
 // ../circle-ir/dist/graph/scope-graph.js
@@ -41335,6 +41631,8 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new SinkFilterPass);
     if (!disabledPasses.has("sink-semantics"))
       pipeline.add(new SinkSemanticsPass);
+    if (!disabledPasses.has("cli-main-reflection-suppress"))
+      pipeline.add(new CliMainReflectionSuppressPass);
     pipeline.add(new TaintPropagationPass);
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
@@ -42262,7 +42560,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.147.0";
+var version = "3.150.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.147.0",
+  "version": "3.150.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.147.0"
+    "circle-ir": "^3.150.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",