cognium-dev 3.148.0 → 3.151.0

package/dist/cli.js

@@ -28873,6 +28873,61 @@ class SourceSemanticsPass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/library-profile-source-gate-pass.js
+var SPECULATIVE_SOURCE_TYPES = new Set([
+  "interprocedural_param",
+  "constructor_field"
+]);
+function isLibraryShape(profile) {
+  if (!profile || profile === "unknown")
+    return false;
+  return profile.startsWith("library/");
+}
+
+class LibraryProfileSourceGatePass {
+  name = "library-profile-source-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedByType: {}
+      };
+    }
+    const sources = graph.ir.taint.sources;
+    if (sources.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedByType: {}
+      };
+    }
+    const droppedByType = {};
+    const kept = [];
+    for (const src of sources) {
+      if (SPECULATIVE_SOURCE_TYPES.has(src.type)) {
+        droppedByType[src.type] = (droppedByType[src.type] ?? 0) + 1;
+        continue;
+      }
+      kept.push(src);
+    }
+    const dropped = sources.length - kept.length;
+    sources.length = 0;
+    sources.push(...kept);
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedByType
+    };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
   /\bDOMPurify\.sanitize\s*\(/,
@@ -30343,7 +30398,7 @@ class SinkSemanticsPass {
       return { droppedCount: 0, registrySize: 0 };
     }
     const registry = buildRegistry(entries);
-    const sinks = graph.ir.taint.sinks;
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
     let droppedCount = 0;
     const kept = sinks.filter((sink) => {
       if (!sink.class || !sink.method)
@@ -30366,6 +30421,194 @@ class SinkSemanticsPass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
+var REFLECTION_SINK_METHODS = new Set([
+  "forName",
+  "newInstance",
+  "invoke",
+  "getMethod",
+  "getDeclaredMethod",
+  "getConstructor",
+  "getDeclaredConstructor",
+  "loadClass",
+  "defineClass"
+]);
+var TIER_1_CLASS_ANNOTATIONS = new Set([
+  "RestController",
+  "Controller",
+  "Service",
+  "Repository",
+  "Component",
+  "Path",
+  "WebServlet",
+  "ServerEndpoint",
+  "FeignClient"
+]);
+var TIER_1_METHOD_ANNOTATIONS = new Set([
+  "RequestMapping",
+  "GetMapping",
+  "PostMapping",
+  "PutMapping",
+  "DeleteMapping",
+  "PatchMapping",
+  "MessageMapping",
+  "SubscribeMapping",
+  "KafkaListener",
+  "KafkaHandler",
+  "RabbitListener",
+  "RabbitHandler",
+  "JmsListener",
+  "StreamListener",
+  "SqsListener",
+  "SqsHandler",
+  "EventListener",
+  "Scheduled",
+  "Path",
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS",
+  "DataBoundConstructor",
+  "DataBoundSetter"
+]);
+var TIER_1_SUPERTYPES = new Set([
+  "HttpServlet",
+  "GenericServlet",
+  "Filter",
+  "HandlerInterceptor",
+  "AsyncHandlerInterceptor",
+  "CommandLineRunner",
+  "ApplicationRunner",
+  "SimpleChannelInboundHandler",
+  "ChannelInboundHandler",
+  "ChannelInboundHandlerAdapter",
+  "ChannelDuplexHandler",
+  "NettyRequestProcessor",
+  "Converter",
+  "SingleValueConverter",
+  "ConverterMatcher",
+  "AbstractReflectionConverter",
+  "AbstractSingleValueConverter",
+  "AbstractCollectionConverter"
+]);
+function normalizeAnnotation(raw) {
+  let s = raw.trim();
+  if (s.startsWith("@"))
+    s = s.slice(1);
+  const parenIdx = s.indexOf("(");
+  if (parenIdx >= 0)
+    s = s.slice(0, parenIdx);
+  const genericIdx = s.indexOf("<");
+  if (genericIdx >= 0)
+    s = s.slice(0, genericIdx);
+  const dotIdx = s.lastIndexOf(".");
+  if (dotIdx >= 0)
+    s = s.slice(dotIdx + 1);
+  return s.trim();
+}
+function normalizeSupertype(raw) {
+  let s = raw.trim();
+  const genericIdx = s.indexOf("<");
+  if (genericIdx >= 0)
+    s = s.slice(0, genericIdx);
+  const dotIdx = s.lastIndexOf(".");
+  if (dotIdx >= 0)
+    s = s.slice(dotIdx + 1);
+  return s.trim();
+}
+function isMainMethod(name2, paramTypes) {
+  if (name2 !== "main")
+    return false;
+  if (paramTypes.length !== 1)
+    return false;
+  const t = paramTypes[0];
+  if (!t)
+    return false;
+  const bare = t.replace(/\s+/g, "");
+  return bare === "String[]" || bare === "java.lang.String[]";
+}
+
+class CliMainReflectionSuppressPass {
+  name = "cli-main-reflection-suppress";
+  category = "security";
+  run(ctx) {
+    const { graph, language } = ctx;
+    if (language !== "java") {
+      return { cliMainSignal: false, droppedCount: 0 };
+    }
+    const types = graph.ir.types;
+    if (!types || types.length === 0) {
+      return { cliMainSignal: false, droppedCount: 0 };
+    }
+    let hasMain = false;
+    let hasFrameworkSignal = false;
+    for (const type of types) {
+      for (const ann of type.annotations) {
+        if (TIER_1_CLASS_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+          hasFrameworkSignal = true;
+          break;
+        }
+      }
+      if (hasFrameworkSignal)
+        break;
+      if (type.extends && TIER_1_SUPERTYPES.has(normalizeSupertype(type.extends))) {
+        hasFrameworkSignal = true;
+        break;
+      }
+      for (const impl of type.implements) {
+        if (TIER_1_SUPERTYPES.has(normalizeSupertype(impl))) {
+          hasFrameworkSignal = true;
+          break;
+        }
+      }
+      if (hasFrameworkSignal)
+        break;
+      for (const method of type.methods) {
+        for (const ann of method.annotations) {
+          if (TIER_1_METHOD_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+            hasFrameworkSignal = true;
+            break;
+          }
+        }
+        if (hasFrameworkSignal)
+          break;
+        if (!hasMain) {
+          const paramTypes = method.parameters.map((p) => p.type);
+          if (isMainMethod(method.name, paramTypes)) {
+            hasMain = true;
+          }
+        }
+      }
+      if (hasFrameworkSignal)
+        break;
+    }
+    const cliMainSignal = hasMain && !hasFrameworkSignal;
+    if (!cliMainSignal) {
+      return { cliMainSignal: false, droppedCount: 0 };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    let droppedCount = 0;
+    const kept = sinks.filter((sink) => {
+      if (sink.type !== "code_injection")
+        return true;
+      if (!sink.method)
+        return true;
+      if (!REFLECTION_SINK_METHODS.has(sink.method))
+        return true;
+      droppedCount++;
+      return false;
+    });
+    if (droppedCount > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { cliMainSignal: true, droppedCount };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
@@ -31733,7 +31976,7 @@ function findTaintBridges2(result) {
 }
 
 // ../circle-ir/dist/analysis/entry-point-detection.js
-var TIER_1_METHOD_ANNOTATIONS = new Set([
+var TIER_1_METHOD_ANNOTATIONS2 = new Set([
   "RequestMapping",
   "GetMapping",
   "PostMapping",
@@ -31763,7 +32006,7 @@ var TIER_1_METHOD_ANNOTATIONS = new Set([
   "DataBoundConstructor",
   "DataBoundSetter"
 ]);
-var TIER_1_CLASS_ANNOTATIONS = new Set([
+var TIER_1_CLASS_ANNOTATIONS2 = new Set([
   "RestController",
   "Controller",
   "Service",
@@ -31913,10 +32156,10 @@ function classifyEntryPointTier(method, enclosingType, ctx) {
   if (classShapeIsLibraryFacade(enclosingType)) {
     return "TIER_3_LIBRARY_API";
   }
-  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS)) {
+  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS2)) {
     return "TIER_1_ENTRY_POINT";
   }
-  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS)) {
+  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS2)) {
     return "TIER_1_ENTRY_POINT";
   }
   if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
@@ -32899,6 +33142,37 @@ var CLOSE_METHODS = new Set([
   "shutdownNow",
   "terminate"
 ]);
+var WRAPPER_CTORS = new Set([
+  "BufferedInputStream",
+  "BufferedOutputStream",
+  "BufferedReader",
+  "BufferedWriter",
+  "InputStreamReader",
+  "OutputStreamWriter",
+  "DataInputStream",
+  "DataOutputStream",
+  "PrintStream",
+  "PrintWriter",
+  "LineNumberReader",
+  "PushbackInputStream",
+  "PushbackReader",
+  "SequenceInputStream",
+  "GZIPInputStream",
+  "GZIPOutputStream",
+  "ZipInputStream",
+  "ZipOutputStream",
+  "InflaterInputStream",
+  "DeflaterOutputStream",
+  "CheckedInputStream",
+  "CheckedOutputStream"
+]);
+var WORKER_METHODS = new Set([
+  "run",
+  "call",
+  "accept",
+  "get",
+  "apply"
+]);
 
 class ResourceLeakPass {
   name = "resource-leak";
@@ -32935,6 +33209,12 @@ class ResourceLeakPass {
       if (this.isFactoryMethod(methodInfo.method)) {
         continue;
       }
+      if (this.isWrappedByCloseableCtor(graph.ir.calls, resourceVar, openLine, methodEnd)) {
+        continue;
+      }
+      if (this.isClosedInNestedWorker(graph, codeLines, resourceVar, methodInfo, openLine, methodEnd)) {
+        continue;
+      }
       const closeCall = graph.ir.calls.find((c) => CLOSE_METHODS.has(c.method_name) && c.receiver === resourceVar && c.location.line > openLine && c.location.line <= methodEnd);
       const snippet = (codeLines[openLine - 1] ?? "").trim();
       if (!closeCall) {
@@ -33031,6 +33311,57 @@ class ResourceLeakPass {
       return false;
     return FACTORY_METHOD_NAME_RE.test(method.name);
   }
+  isWrappedByCloseableCtor(calls, variable, fromLine, toLine) {
+    for (const call of calls) {
+      if (!WRAPPER_CTORS.has(call.method_name))
+        continue;
+      if (call.location.line < fromLine || call.location.line > toLine)
+        continue;
+      for (const arg of call.arguments) {
+        if (arg.variable === variable)
+          return true;
+      }
+    }
+    return false;
+  }
+  isClosedInNestedWorker(graph, lines, variable, methodInfo, fromLine, toLine) {
+    const fieldNames = new Set(methodInfo.type.fields.map((f) => f.name));
+    let candidateField = null;
+    if (fieldNames.has(variable)) {
+      candidateField = variable;
+    } else {
+      const thisAssignRe = new RegExp(`(?:\\bthis\\s*\\.\\s*)?(\\w+)\\s*=\\s*${escapeRegex2(variable)}\\b`);
+      for (let l = fromLine;l <= toLine && l <= lines.length; l++) {
+        const m = thisAssignRe.exec(lines[l - 1] ?? "");
+        if (m && fieldNames.has(m[1])) {
+          candidateField = m[1];
+          break;
+        }
+      }
+    }
+    if (!candidateField)
+      return false;
+    for (const call of graph.ir.calls) {
+      if (call.receiver !== candidateField)
+        continue;
+      if (!CLOSE_METHODS.has(call.method_name))
+        continue;
+      const closeLine = call.location.line;
+      if (closeLine < fromLine || closeLine > toLine)
+        continue;
+      const enclosing = graph.methodAtLine(closeLine);
+      if (!enclosing)
+        continue;
+      if (enclosing.method === methodInfo.method)
+        continue;
+      if (!WORKER_METHODS.has(enclosing.method.name))
+        continue;
+      if (enclosing.method.start_line > fromLine && enclosing.method.start_line <= toLine) {
+        return true;
+      }
+    }
+    return false;
+  }
 }
 
 // ../circle-ir/dist/graph/scope-graph.js
@@ -41295,6 +41626,38 @@ function makeProfileResolver(p) {
     return () => p;
   return (file) => p.get(file) ?? "unknown";
 }
+function computeProjectProfileSummary(fileAnalyses) {
+  const byShape = {
+    library: 0,
+    application: 0,
+    cli: 0,
+    server: 0,
+    plugin: 0,
+    unknown: 0
+  };
+  const byEnv = {
+    production: 0,
+    dev: 0,
+    sample: 0,
+    benchmark: 0,
+    test: 0,
+    unknown: 0
+  };
+  for (const { analysis } of fileAnalyses) {
+    const profile = analysis.meta.projectProfile ?? "unknown";
+    if (profile === "unknown") {
+      byShape.unknown += 1;
+      byEnv.unknown += 1;
+      continue;
+    }
+    const slash = profile.indexOf("/");
+    const shape = profile.slice(0, slash);
+    const env = profile.slice(slash + 1);
+    byShape[shape] += 1;
+    byEnv[env] += 1;
+  }
+  return { byShape, byEnv, totalFiles: fileAnalyses.length };
+}
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
@@ -41324,6 +41687,9 @@ async function analyze(code, filePath, language, options = {}) {
     }
     const nodeCache = collectAllNodes(tree.rootNode, getNodeTypesForLanguage(language));
     const meta = extractMeta(code, tree, filePath, language);
+    if (options.projectProfile !== undefined) {
+      meta.projectProfile = makeProfileResolver(options.projectProfile)(filePath);
+    }
     const types = extractTypes(tree, nodeCache, language);
     const calls = extractCalls(tree, nodeCache, language);
     const imports = extractImports(tree, language);
@@ -41352,9 +41718,13 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new LanguageSourcesPass);
     if (!disabledPasses.has("source-semantics"))
       pipeline.add(new SourceSemanticsPass);
+    if (!disabledPasses.has("library-profile-source-gate"))
+      pipeline.add(new LibraryProfileSourceGatePass);
     pipeline.add(new SinkFilterPass);
     if (!disabledPasses.has("sink-semantics"))
       pipeline.add(new SinkSemanticsPass);
+    if (!disabledPasses.has("cli-main-reflection-suppress"))
+      pipeline.add(new CliMainReflectionSuppressPass);
     pipeline.add(new TaintPropagationPass);
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
@@ -41641,6 +42011,9 @@ async function analyzeProject(files, options = {}) {
     total_loc: totalLoc,
     analyzed_at: new Date().toISOString()
   };
+  if (options.projectProfile !== undefined) {
+    meta.projectProfileSummary = computeProjectProfileSummary(fileAnalyses);
+  }
   const projectAnalysis = {
     meta,
     files: fileAnalyses,
@@ -42282,7 +42655,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.148.0";
+var version = "3.151.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.148.0",
+  "version": "3.151.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.148.0"
+    "circle-ir": "^3.151.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",