cognium-dev 3.151.0 → 3.152.0

package/dist/cli.js

@@ -30609,6 +30609,62 @@ class CliMainReflectionSuppressPass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
+var DROPPED_SINK_TYPES = new Set([
+  "log_injection"
+]);
+function isLibraryShape2(profile) {
+  if (!profile || profile === "unknown")
+    return false;
+  return profile.startsWith("library/");
+}
+
+class LibraryProfileSinkGatePass {
+  name = "library-profile-sink-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape2(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedByType: {}
+      };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedByType: {}
+      };
+    }
+    const droppedByType = {};
+    const kept = [];
+    for (const sink of sinks) {
+      if (DROPPED_SINK_TYPES.has(sink.type)) {
+        droppedByType[sink.type] = (droppedByType[sink.type] ?? 0) + 1;
+        continue;
+      }
+      kept.push(sink);
+    }
+    const dropped = sinks.length - kept.length;
+    if (dropped > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedByType
+    };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
@@ -41725,6 +41781,8 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new SinkSemanticsPass);
     if (!disabledPasses.has("cli-main-reflection-suppress"))
       pipeline.add(new CliMainReflectionSuppressPass);
+    if (!disabledPasses.has("library-profile-sink-gate"))
+      pipeline.add(new LibraryProfileSinkGatePass);
     pipeline.add(new TaintPropagationPass);
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
@@ -42655,7 +42713,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.151.0";
+var version = "3.152.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.151.0",
+  "version": "3.152.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.151.0"
+    "circle-ir": "^3.152.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",