cognium-dev 3.150.0 → 3.152.0

package/dist/cli.js

@@ -28873,6 +28873,61 @@ class SourceSemanticsPass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/library-profile-source-gate-pass.js
+var SPECULATIVE_SOURCE_TYPES = new Set([
+  "interprocedural_param",
+  "constructor_field"
+]);
+function isLibraryShape(profile) {
+  if (!profile || profile === "unknown")
+    return false;
+  return profile.startsWith("library/");
+}
+
+class LibraryProfileSourceGatePass {
+  name = "library-profile-source-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedByType: {}
+      };
+    }
+    const sources = graph.ir.taint.sources;
+    if (sources.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedByType: {}
+      };
+    }
+    const droppedByType = {};
+    const kept = [];
+    for (const src of sources) {
+      if (SPECULATIVE_SOURCE_TYPES.has(src.type)) {
+        droppedByType[src.type] = (droppedByType[src.type] ?? 0) + 1;
+        continue;
+      }
+      kept.push(src);
+    }
+    const dropped = sources.length - kept.length;
+    sources.length = 0;
+    sources.push(...kept);
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedByType
+    };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
   /\bDOMPurify\.sanitize\s*\(/,
@@ -30554,6 +30609,62 @@ class CliMainReflectionSuppressPass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
+var DROPPED_SINK_TYPES = new Set([
+  "log_injection"
+]);
+function isLibraryShape2(profile) {
+  if (!profile || profile === "unknown")
+    return false;
+  return profile.startsWith("library/");
+}
+
+class LibraryProfileSinkGatePass {
+  name = "library-profile-sink-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape2(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedByType: {}
+      };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedByType: {}
+      };
+    }
+    const droppedByType = {};
+    const kept = [];
+    for (const sink of sinks) {
+      if (DROPPED_SINK_TYPES.has(sink.type)) {
+        droppedByType[sink.type] = (droppedByType[sink.type] ?? 0) + 1;
+        continue;
+      }
+      kept.push(sink);
+    }
+    const dropped = sinks.length - kept.length;
+    if (dropped > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedByType
+    };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
@@ -41571,6 +41682,38 @@ function makeProfileResolver(p) {
     return () => p;
   return (file) => p.get(file) ?? "unknown";
 }
+function computeProjectProfileSummary(fileAnalyses) {
+  const byShape = {
+    library: 0,
+    application: 0,
+    cli: 0,
+    server: 0,
+    plugin: 0,
+    unknown: 0
+  };
+  const byEnv = {
+    production: 0,
+    dev: 0,
+    sample: 0,
+    benchmark: 0,
+    test: 0,
+    unknown: 0
+  };
+  for (const { analysis } of fileAnalyses) {
+    const profile = analysis.meta.projectProfile ?? "unknown";
+    if (profile === "unknown") {
+      byShape.unknown += 1;
+      byEnv.unknown += 1;
+      continue;
+    }
+    const slash = profile.indexOf("/");
+    const shape = profile.slice(0, slash);
+    const env = profile.slice(slash + 1);
+    byShape[shape] += 1;
+    byEnv[env] += 1;
+  }
+  return { byShape, byEnv, totalFiles: fileAnalyses.length };
+}
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
@@ -41600,6 +41743,9 @@ async function analyze(code, filePath, language, options = {}) {
     }
     const nodeCache = collectAllNodes(tree.rootNode, getNodeTypesForLanguage(language));
     const meta = extractMeta(code, tree, filePath, language);
+    if (options.projectProfile !== undefined) {
+      meta.projectProfile = makeProfileResolver(options.projectProfile)(filePath);
+    }
     const types = extractTypes(tree, nodeCache, language);
     const calls = extractCalls(tree, nodeCache, language);
     const imports = extractImports(tree, language);
@@ -41628,11 +41774,15 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new LanguageSourcesPass);
     if (!disabledPasses.has("source-semantics"))
       pipeline.add(new SourceSemanticsPass);
+    if (!disabledPasses.has("library-profile-source-gate"))
+      pipeline.add(new LibraryProfileSourceGatePass);
     pipeline.add(new SinkFilterPass);
     if (!disabledPasses.has("sink-semantics"))
       pipeline.add(new SinkSemanticsPass);
     if (!disabledPasses.has("cli-main-reflection-suppress"))
       pipeline.add(new CliMainReflectionSuppressPass);
+    if (!disabledPasses.has("library-profile-sink-gate"))
+      pipeline.add(new LibraryProfileSinkGatePass);
     pipeline.add(new TaintPropagationPass);
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
@@ -41919,6 +42069,9 @@ async function analyzeProject(files, options = {}) {
     total_loc: totalLoc,
     analyzed_at: new Date().toISOString()
   };
+  if (options.projectProfile !== undefined) {
+    meta.projectProfileSummary = computeProjectProfileSummary(fileAnalyses);
+  }
   const projectAnalysis = {
     meta,
     files: fileAnalyses,
@@ -42560,7 +42713,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.150.0";
+var version = "3.152.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.150.0",
+  "version": "3.152.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.150.0"
+    "circle-ir": "^3.152.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",