cognium-dev 3.152.0 → 3.154.0

package/dist/cli.js

@@ -10611,10 +10611,6 @@ var DEFAULT_SINKS = [
   { method: "FileOutputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileReader", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileWriter", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResource", class: "ClassLoader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResourceAsStream", class: "ClassLoader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResource", class: "Class", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResourceAsStream", class: "Class", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "get", class: "Paths", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "of", class: "Path", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "readAllBytes", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -10627,9 +10623,6 @@ var DEFAULT_SINKS = [
   { method: "newBufferedWriter", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "copy", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
   { method: "move", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
-  { method: "exists", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isDirectory", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isRegularFile", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
   { method: "RandomAccessFile", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "resolveURI", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "resolve", class: "SourceResolver", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -10968,6 +10961,9 @@ var DEFAULT_SINKS = [
   { method: "parseObject", class: "JSON", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   { method: "parseObject", class: "JSONObject", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   { method: "fromJson", class: "Gson", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0], safe_if_class_literal_at: 1 },
+  { method: "readValue", class: "ObjectReader", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
+  { method: "convertValue", class: "ObjectMapper", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0], safe_if_class_literal_at: 1 },
+  { method: "readObject", class: "Kryo", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   { method: "readObject", class: "XMLDecoder", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [] },
   { method: "ObjectInputStream", class: "constructor", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "search", class: "DirContext", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0, 1] },
@@ -12455,7 +12451,21 @@ function argIsClassLiteral(call, position) {
   const expr = (arg.literal ?? arg.expression ?? "").trim();
   if (!expr)
     return false;
-  return CLASS_LITERAL_RE.test(expr);
+  if (CLASS_LITERAL_RE.test(expr))
+    return true;
+  return TYPE_TOKEN_RE.test(expr);
+}
+var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+function argIsStringLiteral(call, position) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg)
+    return false;
+  if (arg.literal !== undefined && arg.literal !== null && arg.literal !== "")
+    return true;
+  const expr = (arg.expression ?? "").trim();
+  if (!expr)
+    return false;
+  return expr.startsWith('"') && expr.endsWith('"') && expr.length >= 2 || expr.startsWith("'") && expr.endsWith("'") && expr.length >= 2 || expr.startsWith('"""') && expr.endsWith('"""');
 }
 var CWE_78_RECEIVER_ALLOWLIST = new Set([
   "Runtime",
@@ -12649,6 +12659,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (pattern.safe_if_class_literal_at !== undefined && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }
+        if (pattern.safe_if_string_literal_at !== undefined && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
+          continue;
+        }
         if (pattern.type === "command_injection") {
           if (call.is_constructor) {
             if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {
@@ -18460,6 +18473,470 @@ function applyLibraryApiSurfaceDowngrade(findings) {
   });
 }
 
+// ../circle-ir/dist/analysis/entry-point-detection.js
+var TIER_1_METHOD_ANNOTATIONS = new Set([
+  "RequestMapping",
+  "GetMapping",
+  "PostMapping",
+  "PutMapping",
+  "DeleteMapping",
+  "PatchMapping",
+  "MessageMapping",
+  "SubscribeMapping",
+  "KafkaListener",
+  "KafkaHandler",
+  "RabbitListener",
+  "RabbitHandler",
+  "JmsListener",
+  "StreamListener",
+  "SqsListener",
+  "SqsHandler",
+  "EventListener",
+  "Scheduled",
+  "Path",
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS",
+  "DataBoundConstructor",
+  "DataBoundSetter"
+]);
+var TIER_1_CLASS_ANNOTATIONS = new Set([
+  "RestController",
+  "Controller",
+  "Service",
+  "Repository",
+  "Component",
+  "Path",
+  "WebServlet",
+  "ServerEndpoint",
+  "FeignClient"
+]);
+var TIER_1_BY_SUPERTYPE = new Map([
+  ["HttpServlet", new Set(["doGet", "doPost", "doPut", "doDelete", "doHead", "doOptions", "doTrace", "service"])],
+  ["GenericServlet", new Set(["service"])],
+  ["Filter", new Set(["doFilter"])],
+  ["HandlerInterceptor", new Set(["preHandle", "postHandle", "afterCompletion"])],
+  ["AsyncHandlerInterceptor", new Set(["preHandle", "postHandle", "afterCompletion", "afterConcurrentHandlingStarted"])],
+  ["CommandLineRunner", new Set(["run"])],
+  ["ApplicationRunner", new Set(["run"])],
+  ["SimpleChannelInboundHandler", new Set(["channelRead0", "messageReceived"])],
+  ["ChannelInboundHandler", new Set(["channelRead", "channelReadComplete"])],
+  ["ChannelInboundHandlerAdapter", new Set(["channelRead", "channelReadComplete"])],
+  ["ChannelDuplexHandler", new Set(["channelRead", "channelReadComplete"])],
+  ["NettyRequestProcessor", new Set(["process"])],
+  ["Converter", new Set(["marshal", "unmarshal"])],
+  ["SingleValueConverter", new Set(["fromString", "toString"])],
+  ["ConverterMatcher", new Set(["marshal", "unmarshal"])],
+  ["AbstractReflectionConverter", new Set(["marshal", "unmarshal", "doMarshal", "doUnmarshal"])],
+  ["AbstractSingleValueConverter", new Set(["fromString", "toString"])],
+  ["AbstractCollectionConverter", new Set(["marshal", "unmarshal"])]
+]);
+var TIER_3_CLASS_SUFFIXES = [
+  "Util",
+  "Utils",
+  "Helper",
+  "Helpers"
+];
+var TIER_3_PACKAGE_FRAGMENTS = [
+  ".template.",
+  ".templates.",
+  ".engine.",
+  ".engines."
+];
+var TIER_3_JDK_FACADE_INTERFACES = new Set([
+  "Collection",
+  "List",
+  "Set",
+  "Map",
+  "Queue",
+  "Deque",
+  "SortedSet",
+  "SortedMap",
+  "NavigableSet",
+  "NavigableMap",
+  "Iterator",
+  "Iterable",
+  "ListIterator",
+  "Comparator",
+  "Comparable",
+  "Serializable",
+  "Externalizable",
+  "Cloneable"
+]);
+function classNameLooksLikeUtility(name2) {
+  if (!name2)
+    return false;
+  for (const suffix of TIER_3_CLASS_SUFFIXES) {
+    if (name2.length > suffix.length && name2.endsWith(suffix))
+      return true;
+  }
+  return false;
+}
+function packageLooksLikeTemplateOrEngine(pkg) {
+  if (!pkg)
+    return false;
+  const padded = `.${pkg}.`;
+  for (const frag of TIER_3_PACKAGE_FRAGMENTS) {
+    if (padded.includes(frag))
+      return true;
+  }
+  return false;
+}
+function implementsJdkFacade(t) {
+  if (!t)
+    return false;
+  for (const impl of t.implements ?? []) {
+    if (TIER_3_JDK_FACADE_INTERFACES.has(simpleTypeName(impl)))
+      return true;
+  }
+  return false;
+}
+function classShapeIsLibraryFacade(enclosingType) {
+  if (!enclosingType)
+    return false;
+  if (classNameLooksLikeUtility(enclosingType.name))
+    return true;
+  if (packageLooksLikeTemplateOrEngine(enclosingType.package))
+    return true;
+  if (implementsJdkFacade(enclosingType))
+    return true;
+  return false;
+}
+function annotationsInclude(annotations, targets) {
+  if (!annotations || annotations.length === 0)
+    return false;
+  for (const raw of annotations) {
+    const simple = raw.replace(/^@/, "").replace(/[<(].*$/, "").trim();
+    if (targets.has(simple))
+      return true;
+  }
+  return false;
+}
+function simpleTypeName(ref) {
+  return ref.replace(/<.*$/, "").trim();
+}
+function looksLikeMainMethod(method) {
+  if (method.name !== "main")
+    return false;
+  const params = method.parameters ?? [];
+  if (params.length !== 1)
+    return false;
+  const t = (params[0].type ?? "").replace(/\s+/g, "");
+  return t === "String[]" || t === "String..." || t === "java.lang.String[]";
+}
+function methodIsSupertypeLifecycleEntryPoint(method, enclosingType) {
+  if (!method.name)
+    return false;
+  if (!enclosingType)
+    return false;
+  const candidates = [];
+  if (enclosingType.extends)
+    candidates.push(simpleTypeName(enclosingType.extends));
+  for (const i2 of enclosingType.implements ?? [])
+    candidates.push(simpleTypeName(i2));
+  for (const supertype of candidates) {
+    const lifecycleMethods = TIER_1_BY_SUPERTYPE.get(supertype);
+    if (lifecycleMethods?.has(method.name))
+      return true;
+  }
+  return false;
+}
+function classifyEntryPointTier(method, enclosingType, ctx) {
+  const language = (ctx.language ?? "").toLowerCase();
+  if (language !== "java")
+    return "TIER_UNKNOWN";
+  if (!method)
+    return "TIER_UNKNOWN";
+  if (classShapeIsLibraryFacade(enclosingType)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (looksLikeMainMethod(method)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_3_LIBRARY_API";
+}
+function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingType, ctx) {
+  if (sourceType !== "interprocedural_param")
+    return false;
+  if (!enclosingMethod)
+    return false;
+  const tier = classifyEntryPointTier(enclosingMethod, enclosingType, ctx);
+  return tier === "TIER_3_LIBRARY_API";
+}
+
+// ../circle-ir/dist/analysis/require-entry-path.js
+var RULE_ID_REQUIRE_ENTRY_PATH = "require-entry-path";
+var MAX_VISITED_METHODS = 2000;
+function applyRequireEntryPath(fileAnalyses, options = {}) {
+  const disabledSet = normalizeDisabled(options.disabledPasses);
+  if (disabledSet.has(RULE_ID_REQUIRE_ENTRY_PATH))
+    return;
+  const graph = buildProjectMethodGraph(fileAnalyses);
+  if (graph.methodsByKey.size === 0)
+    return;
+  const entryPointKeys = collectEntryPointKeys(graph);
+  const profileResolver = makeProfileResolver(options.projectProfile);
+  for (const fa of fileAnalyses) {
+    const findings = fa.analysis.findings;
+    if (!findings || findings.length === 0)
+      continue;
+    const kept = [];
+    for (const finding of findings) {
+      const decision = classifyFinding(finding, fa.analysis, graph, entryPointKeys, profileResolver(fa.file));
+      switch (decision.action) {
+        case "keep":
+          kept.push(finding);
+          break;
+        case "annotate":
+          kept.push({
+            ...finding,
+            entryPath: decision.entryPath,
+            entryPathTier: decision.tier
+          });
+          break;
+        case "drop":
+          break;
+      }
+    }
+    fa.analysis.findings = kept.length > 0 ? kept : undefined;
+  }
+}
+function buildProjectMethodGraph(fileAnalyses) {
+  const methodsByKey = new Map;
+  const methodsByName = new Map;
+  const callersOf = new Map;
+  for (const fa of fileAnalyses) {
+    const language = (fa.analysis.meta.language ?? "").toLowerCase();
+    for (const type of fa.analysis.types ?? []) {
+      for (const method of type.methods ?? []) {
+        const key = makeMethodKey(fa.file, type.name, method.name, method.start_line);
+        methodsByKey.set(key, {
+          key,
+          file: fa.file,
+          className: type.name,
+          method,
+          enclosingType: type,
+          language
+        });
+        const bucket = methodsByName.get(method.name);
+        if (bucket)
+          bucket.push(key);
+        else
+          methodsByName.set(method.name, [key]);
+      }
+    }
+  }
+  for (const fa of fileAnalyses) {
+    const calls = fa.analysis.calls ?? [];
+    for (const call of calls) {
+      if (!call.in_method)
+        continue;
+      const callerKey = resolveCallerKey(fa, call.in_method, call.location.line);
+      if (!callerKey)
+        continue;
+      const calleeKeys = resolveCalleeKeys(call, methodsByKey, methodsByName);
+      if (calleeKeys.length === 0)
+        continue;
+      const code = call.receiver ? `${call.receiver}.${call.method_name}(...)` : `${call.method_name}(...)`;
+      for (const calleeKey of calleeKeys) {
+        const edge = {
+          callerKey,
+          calleeKey,
+          callSiteLine: call.location.line,
+          code
+        };
+        const bucket = callersOf.get(calleeKey);
+        if (bucket)
+          bucket.push(edge);
+        else
+          callersOf.set(calleeKey, [edge]);
+      }
+    }
+  }
+  return { methodsByKey, methodsByName, callersOf };
+}
+function makeMethodKey(file, className, methodName, startLine) {
+  return `${file}|${className}#${methodName}@${startLine}`;
+}
+function resolveCallerKey(fa, inMethod, callLine) {
+  for (const type of fa.analysis.types ?? []) {
+    for (const method of type.methods ?? []) {
+      if (method.name !== inMethod)
+        continue;
+      if (callLine >= method.start_line && callLine <= method.end_line) {
+        return makeMethodKey(fa.file, type.name, method.name, method.start_line);
+      }
+    }
+  }
+  return null;
+}
+function resolveCalleeKeys(call, methodsByKey, methodsByName) {
+  const candidates = methodsByName.get(call.method_name);
+  if (!candidates || candidates.length === 0)
+    return [];
+  if (call.receiver_type) {
+    const simple = call.receiver_type.replace(/<.*$/, "").trim();
+    const matches = [];
+    for (const key of candidates) {
+      const rec = methodsByKey.get(key);
+      if (rec?.className === simple)
+        matches.push(key);
+    }
+    if (matches.length > 0)
+      return matches;
+  }
+  return candidates;
+}
+function collectEntryPointKeys(graph) {
+  const entryPoints = new Set;
+  for (const rec of graph.methodsByKey.values()) {
+    const tier = classifyEntryPointTier(rec.method, rec.enclosingType, {
+      types: [rec.enclosingType],
+      language: rec.language
+    });
+    if (tier === "TIER_1_ENTRY_POINT")
+      entryPoints.add(rec.key);
+  }
+  return entryPoints;
+}
+function classifyFinding(finding, ir, graph, entryPointKeys, profile) {
+  if (finding.category !== "security")
+    return { action: "keep" };
+  const isHighOrCritical = finding.severity === "high" || finding.severity === "critical";
+  const language = (ir.meta.language ?? "").toLowerCase();
+  if (language !== "java")
+    return { action: "keep" };
+  const containing = findContainingMethod(finding, ir, graph);
+  if (!containing) {
+    return { action: "keep" };
+  }
+  const bfs = reverseBfsToEntryPoint(containing.key, graph, entryPointKeys);
+  if (bfs.status === "hit") {
+    const entryPath = reconstructPath(bfs.entryKey, containing.key, bfs.parent, graph, finding);
+    return {
+      action: "annotate",
+      entryPath,
+      tier: "tier1-entry-point"
+    };
+  }
+  if (bfs.status === "budget") {
+    return { action: "keep" };
+  }
+  if (!isHighOrCritical)
+    return { action: "keep" };
+  if (!shouldDropUnderProfile(profile))
+    return { action: "keep" };
+  return { action: "drop" };
+}
+function findContainingMethod(finding, ir, graph) {
+  const line = finding.line;
+  for (const type of ir.types ?? []) {
+    for (const method of type.methods ?? []) {
+      if (line >= method.start_line && line <= method.end_line) {
+        const key = makeMethodKey(finding.file, type.name, method.name, method.start_line);
+        const rec = graph.methodsByKey.get(key);
+        if (rec)
+          return rec;
+      }
+    }
+  }
+  return null;
+}
+function reverseBfsToEntryPoint(startKey, graph, entryPointKeys) {
+  const parent = new Map;
+  const visited = new Set([startKey]);
+  const queue = [startKey];
+  if (entryPointKeys.has(startKey)) {
+    return { status: "hit", entryKey: startKey, parent };
+  }
+  while (queue.length > 0) {
+    if (visited.size > MAX_VISITED_METHODS) {
+      return { status: "budget", entryKey: null, parent };
+    }
+    const current = queue.shift();
+    const incoming = graph.callersOf.get(current) ?? [];
+    incoming.sort((a, b) => a.callerKey.localeCompare(b.callerKey));
+    for (const edge of incoming) {
+      if (visited.has(edge.callerKey))
+        continue;
+      visited.add(edge.callerKey);
+      parent.set(edge.callerKey, edge);
+      if (entryPointKeys.has(edge.callerKey)) {
+        return { status: "hit", entryKey: edge.callerKey, parent };
+      }
+      queue.push(edge.callerKey);
+    }
+  }
+  return { status: "miss", entryKey: null, parent };
+}
+function reconstructPath(entryKey, sinkKey, parent, graph, finding) {
+  const hops = [];
+  let cursor = entryKey;
+  const guard = new Set;
+  while (cursor !== sinkKey) {
+    if (guard.has(cursor))
+      break;
+    guard.add(cursor);
+    const rec = graph.methodsByKey.get(cursor);
+    const edge = parent.get(cursor);
+    if (!rec || !edge)
+      break;
+    hops.push({
+      file: rec.file,
+      method: `${rec.className}.${rec.method.name}`,
+      line: edge.callSiteLine,
+      code: edge.code,
+      variable: ""
+    });
+    cursor = edge.calleeKey;
+  }
+  const sinkRec = graph.methodsByKey.get(sinkKey);
+  if (sinkRec) {
+    hops.push({
+      file: sinkRec.file,
+      method: `${sinkRec.className}.${sinkRec.method.name}`,
+      line: finding.line,
+      code: finding.message,
+      variable: ""
+    });
+  }
+  return hops;
+}
+function shouldDropUnderProfile(profile) {
+  if (profile === "unknown")
+    return true;
+  if (profile.startsWith("library/"))
+    return false;
+  return true;
+}
+function makeProfileResolver(input) {
+  if (input === undefined)
+    return () => "unknown";
+  if (typeof input === "string")
+    return () => input;
+  return (file) => input.get(file) ?? "unknown";
+}
+function normalizeDisabled(input) {
+  if (!input)
+    return new Set;
+  if (input instanceof Set)
+    return input;
+  return new Set(input);
+}
+
 // ../circle-ir/dist/analysis/project-profile-transform.js
 var DOWNGRADE_ELIGIBLE_RULE_IDS = new Set([
   "code_injection",
@@ -30433,7 +30910,7 @@ var REFLECTION_SINK_METHODS = new Set([
   "loadClass",
   "defineClass"
 ]);
-var TIER_1_CLASS_ANNOTATIONS = new Set([
+var TIER_1_CLASS_ANNOTATIONS2 = new Set([
   "RestController",
   "Controller",
   "Service",
@@ -30444,7 +30921,7 @@ var TIER_1_CLASS_ANNOTATIONS = new Set([
   "ServerEndpoint",
   "FeignClient"
 ]);
-var TIER_1_METHOD_ANNOTATIONS = new Set([
+var TIER_1_METHOD_ANNOTATIONS2 = new Set([
   "RequestMapping",
   "GetMapping",
   "PostMapping",
@@ -30547,7 +31024,7 @@ class CliMainReflectionSuppressPass {
     let hasFrameworkSignal = false;
     for (const type of types) {
       for (const ann of type.annotations) {
-        if (TIER_1_CLASS_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+        if (TIER_1_CLASS_ANNOTATIONS2.has(normalizeAnnotation(ann))) {
           hasFrameworkSignal = true;
           break;
         }
@@ -30568,7 +31045,7 @@ class CliMainReflectionSuppressPass {
         break;
       for (const method of type.methods) {
         for (const ann of method.annotations) {
-          if (TIER_1_METHOD_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+          if (TIER_1_METHOD_ANNOTATIONS2.has(normalizeAnnotation(ann))) {
             hasFrameworkSignal = true;
             break;
           }
@@ -30585,52 +31062,183 @@ class CliMainReflectionSuppressPass {
       if (hasFrameworkSignal)
         break;
     }
-    const cliMainSignal = hasMain && !hasFrameworkSignal;
-    if (!cliMainSignal) {
-      return { cliMainSignal: false, droppedCount: 0 };
+    const cliMainSignal = hasMain && !hasFrameworkSignal;
+    if (!cliMainSignal) {
+      return { cliMainSignal: false, droppedCount: 0 };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    let droppedCount = 0;
+    const kept = sinks.filter((sink) => {
+      if (sink.type !== "code_injection")
+        return true;
+      if (!sink.method)
+        return true;
+      if (!REFLECTION_SINK_METHODS.has(sink.method))
+        return true;
+      droppedCount++;
+      return false;
+    });
+    if (droppedCount > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { cliMainSignal: true, droppedCount };
+  }
+}
+
+// ../circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
+var DROPPED_SINK_TYPES = new Set([
+  "log_injection"
+]);
+function isLibraryShape2(profile) {
+  if (!profile || profile === "unknown")
+    return false;
+  return profile.startsWith("library/");
+}
+
+class LibraryProfileSinkGatePass {
+  name = "library-profile-sink-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape2(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedByType: {}
+      };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedByType: {}
+      };
+    }
+    const droppedByType = {};
+    const kept = [];
+    for (const sink of sinks) {
+      if (DROPPED_SINK_TYPES.has(sink.type)) {
+        droppedByType[sink.type] = (droppedByType[sink.type] ?? 0) + 1;
+        continue;
+      }
+      kept.push(sink);
+    }
+    const dropped = sinks.length - kept.length;
+    if (dropped > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedByType
+    };
+  }
+}
+var CWE22_SPECULATIVE_SOURCE_TYPES = new Set([
+  "interprocedural_param",
+  "constructor_field"
+]);
+
+class LibraryProfileCwe22PathGatePass {
+  name = "library-profile-cwe22-path-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape2(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedBySourceType: {}
+      };
+    }
+    const flows = graph.ir.taint.flows;
+    if (!flows || flows.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedBySourceType: {}
+      };
+    }
+    const droppedBySourceType = {};
+    const kept = [];
+    for (const flow of flows) {
+      if (flow.sink_type === "path_traversal" && CWE22_SPECULATIVE_SOURCE_TYPES.has(flow.source_type)) {
+        droppedBySourceType[flow.source_type] = (droppedBySourceType[flow.source_type] ?? 0) + 1;
+        continue;
+      }
+      kept.push(flow);
     }
-    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
-    let droppedCount = 0;
-    const kept = sinks.filter((sink) => {
-      if (sink.type !== "code_injection")
-        return true;
-      if (!sink.method)
-        return true;
-      if (!REFLECTION_SINK_METHODS.has(sink.method))
-        return true;
-      droppedCount++;
-      return false;
-    });
-    if (droppedCount > 0) {
-      sinks.length = 0;
-      sinks.push(...kept);
+    const dropped = flows.length - kept.length;
+    if (dropped > 0) {
+      flows.length = 0;
+      flows.push(...kept);
     }
-    return { cliMainSignal: true, droppedCount };
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedBySourceType
+    };
   }
 }
 
-// ../circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
-var DROPPED_SINK_TYPES = new Set([
-  "log_injection"
+// ../circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
+var XSS_NON_HTML_OUTPUT_CLASSES = new Set([
+  "StringBuilder",
+  "StringBuffer",
+  "CharArrayWriter",
+  "ByteArrayOutputStream",
+  "PrintStream",
+  "System",
+  "HttpRequest",
+  "HttpRequestBuilder",
+  "HttpResponse",
+  "HttpSession",
+  "ServletRequest",
+  "HttpServletRequest",
+  "RedisOutputStream",
+  "SafeEncoder",
+  "RESP2",
+  "Protocol",
+  "JSONUtil",
+  "JSON",
+  "ObjectMapper",
+  "JsonReader",
+  "Logger",
+  "LoggerFactory",
+  "Log",
+  "Slf4jLogger",
+  "RequestContext",
+  "Context"
 ]);
-function isLibraryShape2(profile) {
+function isLibraryShape3(profile) {
   if (!profile || profile === "unknown")
     return false;
   return profile.startsWith("library/");
 }
 
-class LibraryProfileSinkGatePass {
-  name = "library-profile-sink-gate";
+class LibraryProfileXssGatePass {
+  name = "library-profile-xss-gate";
   category = "security";
   run(ctx) {
     const { graph } = ctx;
     const profile = graph.ir.meta.projectProfile;
-    if (!isLibraryShape2(profile)) {
+    if (!isLibraryShape3(profile)) {
       return {
         profile,
         applied: false,
         dropped: 0,
-        droppedByType: {}
+        droppedByClass: {}
       };
     }
     const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
@@ -30639,14 +31247,14 @@ class LibraryProfileSinkGatePass {
         profile,
         applied: true,
         dropped: 0,
-        droppedByType: {}
+        droppedByClass: {}
       };
     }
-    const droppedByType = {};
+    const droppedByClass = {};
     const kept = [];
     for (const sink of sinks) {
-      if (DROPPED_SINK_TYPES.has(sink.type)) {
-        droppedByType[sink.type] = (droppedByType[sink.type] ?? 0) + 1;
+      if (sink.type === "xss" && sink.class && XSS_NON_HTML_OUTPUT_CLASSES.has(sink.class)) {
+        droppedByClass[sink.class] = (droppedByClass[sink.class] ?? 0) + 1;
         continue;
       }
       kept.push(sink);
@@ -30660,7 +31268,7 @@ class LibraryProfileSinkGatePass {
       profile,
       applied: true,
       dropped,
-      droppedByType
+      droppedByClass
     };
   }
 }
@@ -32031,210 +32639,6 @@ function findTaintBridges2(result) {
   return bridges;
 }
 
-// ../circle-ir/dist/analysis/entry-point-detection.js
-var TIER_1_METHOD_ANNOTATIONS2 = new Set([
-  "RequestMapping",
-  "GetMapping",
-  "PostMapping",
-  "PutMapping",
-  "DeleteMapping",
-  "PatchMapping",
-  "MessageMapping",
-  "SubscribeMapping",
-  "KafkaListener",
-  "KafkaHandler",
-  "RabbitListener",
-  "RabbitHandler",
-  "JmsListener",
-  "StreamListener",
-  "SqsListener",
-  "SqsHandler",
-  "EventListener",
-  "Scheduled",
-  "Path",
-  "GET",
-  "POST",
-  "PUT",
-  "DELETE",
-  "PATCH",
-  "HEAD",
-  "OPTIONS",
-  "DataBoundConstructor",
-  "DataBoundSetter"
-]);
-var TIER_1_CLASS_ANNOTATIONS2 = new Set([
-  "RestController",
-  "Controller",
-  "Service",
-  "Repository",
-  "Component",
-  "Path",
-  "WebServlet",
-  "ServerEndpoint",
-  "FeignClient"
-]);
-var TIER_1_BY_SUPERTYPE = new Map([
-  ["HttpServlet", new Set(["doGet", "doPost", "doPut", "doDelete", "doHead", "doOptions", "doTrace", "service"])],
-  ["GenericServlet", new Set(["service"])],
-  ["Filter", new Set(["doFilter"])],
-  ["HandlerInterceptor", new Set(["preHandle", "postHandle", "afterCompletion"])],
-  ["AsyncHandlerInterceptor", new Set(["preHandle", "postHandle", "afterCompletion", "afterConcurrentHandlingStarted"])],
-  ["CommandLineRunner", new Set(["run"])],
-  ["ApplicationRunner", new Set(["run"])],
-  ["SimpleChannelInboundHandler", new Set(["channelRead0", "messageReceived"])],
-  ["ChannelInboundHandler", new Set(["channelRead", "channelReadComplete"])],
-  ["ChannelInboundHandlerAdapter", new Set(["channelRead", "channelReadComplete"])],
-  ["ChannelDuplexHandler", new Set(["channelRead", "channelReadComplete"])],
-  ["NettyRequestProcessor", new Set(["process"])],
-  ["Converter", new Set(["marshal", "unmarshal"])],
-  ["SingleValueConverter", new Set(["fromString", "toString"])],
-  ["ConverterMatcher", new Set(["marshal", "unmarshal"])],
-  ["AbstractReflectionConverter", new Set(["marshal", "unmarshal", "doMarshal", "doUnmarshal"])],
-  ["AbstractSingleValueConverter", new Set(["fromString", "toString"])],
-  ["AbstractCollectionConverter", new Set(["marshal", "unmarshal"])]
-]);
-var TIER_3_CLASS_SUFFIXES = [
-  "Util",
-  "Utils",
-  "Helper",
-  "Helpers"
-];
-var TIER_3_PACKAGE_FRAGMENTS = [
-  ".template.",
-  ".templates.",
-  ".engine.",
-  ".engines."
-];
-var TIER_3_JDK_FACADE_INTERFACES = new Set([
-  "Collection",
-  "List",
-  "Set",
-  "Map",
-  "Queue",
-  "Deque",
-  "SortedSet",
-  "SortedMap",
-  "NavigableSet",
-  "NavigableMap",
-  "Iterator",
-  "Iterable",
-  "ListIterator",
-  "Comparator",
-  "Comparable",
-  "Serializable",
-  "Externalizable",
-  "Cloneable"
-]);
-function classNameLooksLikeUtility(name2) {
-  if (!name2)
-    return false;
-  for (const suffix of TIER_3_CLASS_SUFFIXES) {
-    if (name2.length > suffix.length && name2.endsWith(suffix))
-      return true;
-  }
-  return false;
-}
-function packageLooksLikeTemplateOrEngine(pkg) {
-  if (!pkg)
-    return false;
-  const padded = `.${pkg}.`;
-  for (const frag of TIER_3_PACKAGE_FRAGMENTS) {
-    if (padded.includes(frag))
-      return true;
-  }
-  return false;
-}
-function implementsJdkFacade(t) {
-  if (!t)
-    return false;
-  for (const impl of t.implements ?? []) {
-    if (TIER_3_JDK_FACADE_INTERFACES.has(simpleTypeName(impl)))
-      return true;
-  }
-  return false;
-}
-function classShapeIsLibraryFacade(enclosingType) {
-  if (!enclosingType)
-    return false;
-  if (classNameLooksLikeUtility(enclosingType.name))
-    return true;
-  if (packageLooksLikeTemplateOrEngine(enclosingType.package))
-    return true;
-  if (implementsJdkFacade(enclosingType))
-    return true;
-  return false;
-}
-function annotationsInclude(annotations, targets) {
-  if (!annotations || annotations.length === 0)
-    return false;
-  for (const raw of annotations) {
-    const simple = raw.replace(/^@/, "").replace(/[<(].*$/, "").trim();
-    if (targets.has(simple))
-      return true;
-  }
-  return false;
-}
-function simpleTypeName(ref) {
-  return ref.replace(/<.*$/, "").trim();
-}
-function looksLikeMainMethod(method) {
-  if (method.name !== "main")
-    return false;
-  const params = method.parameters ?? [];
-  if (params.length !== 1)
-    return false;
-  const t = (params[0].type ?? "").replace(/\s+/g, "");
-  return t === "String[]" || t === "String..." || t === "java.lang.String[]";
-}
-function methodIsSupertypeLifecycleEntryPoint(method, enclosingType) {
-  if (!method.name)
-    return false;
-  if (!enclosingType)
-    return false;
-  const candidates = [];
-  if (enclosingType.extends)
-    candidates.push(simpleTypeName(enclosingType.extends));
-  for (const i2 of enclosingType.implements ?? [])
-    candidates.push(simpleTypeName(i2));
-  for (const supertype of candidates) {
-    const lifecycleMethods = TIER_1_BY_SUPERTYPE.get(supertype);
-    if (lifecycleMethods?.has(method.name))
-      return true;
-  }
-  return false;
-}
-function classifyEntryPointTier(method, enclosingType, ctx) {
-  const language = (ctx.language ?? "").toLowerCase();
-  if (language !== "java")
-    return "TIER_UNKNOWN";
-  if (!method)
-    return "TIER_UNKNOWN";
-  if (classShapeIsLibraryFacade(enclosingType)) {
-    return "TIER_3_LIBRARY_API";
-  }
-  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS2)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS2)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  if (looksLikeMainMethod(method)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  return "TIER_3_LIBRARY_API";
-}
-function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingType, ctx) {
-  if (sourceType !== "interprocedural_param")
-    return false;
-  if (!enclosingMethod)
-    return false;
-  const tier = classifyEntryPointTier(enclosingMethod, enclosingType, ctx);
-  return tier === "TIER_3_LIBRARY_API";
-}
-
 // ../circle-ir/dist/analysis/passes/interprocedural-pass.js
 class InterproceduralPass {
   name = "interprocedural";
@@ -41675,7 +42079,7 @@ function getNodeTypesForLanguage(language) {
       ]);
   }
 }
-function makeProfileResolver(p) {
+function makeProfileResolver2(p) {
   if (p === undefined)
     return () => "unknown";
   if (typeof p === "string")
@@ -41744,7 +42148,7 @@ async function analyze(code, filePath, language, options = {}) {
     const nodeCache = collectAllNodes(tree.rootNode, getNodeTypesForLanguage(language));
     const meta = extractMeta(code, tree, filePath, language);
     if (options.projectProfile !== undefined) {
-      meta.projectProfile = makeProfileResolver(options.projectProfile)(filePath);
+      meta.projectProfile = makeProfileResolver2(options.projectProfile)(filePath);
     }
     const types = extractTypes(tree, nodeCache, language);
     const calls = extractCalls(tree, nodeCache, language);
@@ -41783,10 +42187,14 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new CliMainReflectionSuppressPass);
     if (!disabledPasses.has("library-profile-sink-gate"))
       pipeline.add(new LibraryProfileSinkGatePass);
+    if (!disabledPasses.has("library-profile-xss-gate"))
+      pipeline.add(new LibraryProfileXssGatePass);
     pipeline.add(new TaintPropagationPass);
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
     }));
+    if (!disabledPasses.has("library-profile-cwe22-path-gate"))
+      pipeline.add(new LibraryProfileCwe22PathGatePass);
     if (!disabledPasses.has("scan-secrets"))
       pipeline.add(new ScanSecretsPass);
     if (!disabledPasses.has("dead-code"))
@@ -41935,7 +42343,7 @@ async function analyze(code, filePath, language, options = {}) {
     emitFindingsInstrumentation(filePath, findings, taint);
     const verifiedFindings = applyConfidenceFilter(findings, options.includeSpeculative === true);
     const downgradedFindings = applyLibraryApiSurfaceDowngrade(verifiedFindings);
-    const profiledFindings = applyProjectProfileTransform(downgradedFindings, makeProfileResolver(options.projectProfile));
+    const profiledFindings = applyProjectProfileTransform(downgradedFindings, makeProfileResolver2(options.projectProfile));
     const cappedFindings = applyPerFileFindingCap(filePath, profiledFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
     return {
       meta,
@@ -42059,6 +42467,10 @@ async function analyzeProject(files, options = {}) {
       fa.analysis.findings = [...fa.analysis.findings ?? [], finding];
     }
   }
+  applyRequireEntryPath(fileAnalyses, {
+    projectProfile: options.projectProfile,
+    disabledPasses: options.disabledPasses
+  });
   const filePaths = files.map((f) => f.filePath);
   const totalLoc = fileAnalyses.reduce((sum, f) => sum + (f.analysis.meta.loc ?? 0), 0);
   const meta = {
@@ -42713,7 +43125,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.152.0";
+var version = "3.154.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.152.0",
+  "version": "3.154.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.152.0"
+    "circle-ir": "^3.154.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",