cognium-dev 3.153.0 → 3.154.0

package/dist/cli.js

@@ -10623,9 +10623,6 @@ var DEFAULT_SINKS = [
   { method: "newBufferedWriter", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "copy", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
   { method: "move", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
-  { method: "exists", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isDirectory", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isRegularFile", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
   { method: "RandomAccessFile", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "resolveURI", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "resolve", class: "SourceResolver", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -31144,6 +31141,137 @@ class LibraryProfileSinkGatePass {
     };
   }
 }
+var CWE22_SPECULATIVE_SOURCE_TYPES = new Set([
+  "interprocedural_param",
+  "constructor_field"
+]);
+
+class LibraryProfileCwe22PathGatePass {
+  name = "library-profile-cwe22-path-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape2(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedBySourceType: {}
+      };
+    }
+    const flows = graph.ir.taint.flows;
+    if (!flows || flows.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedBySourceType: {}
+      };
+    }
+    const droppedBySourceType = {};
+    const kept = [];
+    for (const flow of flows) {
+      if (flow.sink_type === "path_traversal" && CWE22_SPECULATIVE_SOURCE_TYPES.has(flow.source_type)) {
+        droppedBySourceType[flow.source_type] = (droppedBySourceType[flow.source_type] ?? 0) + 1;
+        continue;
+      }
+      kept.push(flow);
+    }
+    const dropped = flows.length - kept.length;
+    if (dropped > 0) {
+      flows.length = 0;
+      flows.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedBySourceType
+    };
+  }
+}
+
+// ../circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
+var XSS_NON_HTML_OUTPUT_CLASSES = new Set([
+  "StringBuilder",
+  "StringBuffer",
+  "CharArrayWriter",
+  "ByteArrayOutputStream",
+  "PrintStream",
+  "System",
+  "HttpRequest",
+  "HttpRequestBuilder",
+  "HttpResponse",
+  "HttpSession",
+  "ServletRequest",
+  "HttpServletRequest",
+  "RedisOutputStream",
+  "SafeEncoder",
+  "RESP2",
+  "Protocol",
+  "JSONUtil",
+  "JSON",
+  "ObjectMapper",
+  "JsonReader",
+  "Logger",
+  "LoggerFactory",
+  "Log",
+  "Slf4jLogger",
+  "RequestContext",
+  "Context"
+]);
+function isLibraryShape3(profile) {
+  if (!profile || profile === "unknown")
+    return false;
+  return profile.startsWith("library/");
+}
+
+class LibraryProfileXssGatePass {
+  name = "library-profile-xss-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape3(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedByClass: {}
+      };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedByClass: {}
+      };
+    }
+    const droppedByClass = {};
+    const kept = [];
+    for (const sink of sinks) {
+      if (sink.type === "xss" && sink.class && XSS_NON_HTML_OUTPUT_CLASSES.has(sink.class)) {
+        droppedByClass[sink.class] = (droppedByClass[sink.class] ?? 0) + 1;
+        continue;
+      }
+      kept.push(sink);
+    }
+    const dropped = sinks.length - kept.length;
+    if (dropped > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedByClass
+    };
+  }
+}
 
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
@@ -42059,10 +42187,14 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new CliMainReflectionSuppressPass);
     if (!disabledPasses.has("library-profile-sink-gate"))
       pipeline.add(new LibraryProfileSinkGatePass);
+    if (!disabledPasses.has("library-profile-xss-gate"))
+      pipeline.add(new LibraryProfileXssGatePass);
     pipeline.add(new TaintPropagationPass);
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
     }));
+    if (!disabledPasses.has("library-profile-cwe22-path-gate"))
+      pipeline.add(new LibraryProfileCwe22PathGatePass);
     if (!disabledPasses.has("scan-secrets"))
       pipeline.add(new ScanSecretsPass);
     if (!disabledPasses.has("dead-code"))
@@ -42993,7 +43125,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.153.0";
+var version = "3.154.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.153.0",
+  "version": "3.154.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.153.0"
+    "circle-ir": "^3.154.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",