cognium-dev 3.153.0 → 3.155.0

package/dist/cli.js

@@ -10623,9 +10623,6 @@ var DEFAULT_SINKS = [
   { method: "newBufferedWriter", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "copy", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
   { method: "move", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
-  { method: "exists", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isDirectory", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isRegularFile", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
   { method: "RandomAccessFile", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "resolveURI", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "resolve", class: "SourceResolver", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -11662,6 +11659,7 @@ var DEFAULT_SANITIZERS = [
   { method: "parseDouble", class: "Double", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseShort", class: "Short", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseByte", class: "Byte", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
+  { method: "parseBoolean", class: "Boolean", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection", "xss", "crlf", "log_injection", "xpath_injection", "ldap_injection", "xxe"] },
   { method: "fromString", class: "UUID", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "BigInt", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "Atoi", class: "strconv", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
@@ -13773,6 +13771,18 @@ class CodeGraph {
     }
     return this._chainsByFromDef;
   }
+  _chainsByToDef = null;
+  get chainsByToDef() {
+    if (!this._chainsByToDef) {
+      this._chainsByToDef = new Map;
+      for (const chain of this.ir.dfg.chains ?? []) {
+        const arr = this._chainsByToDef.get(chain.to_def) ?? [];
+        arr.push(chain);
+        this._chainsByToDef.set(chain.to_def, arr);
+      }
+    }
+    return this._chainsByToDef;
+  }
   _callsByLine = null;
   get callsByLine() {
     if (!this._callsByLine) {
@@ -15643,6 +15653,45 @@ class AnalysisPipeline {
     return { results, findings };
   }
 }
+// ../circle-ir/dist/analysis/dfg-walk.js
+function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
+  const maxHops = options.maxHops ?? 32;
+  const visited = new Set;
+  const lines = new Set;
+  let hopCapReached = false;
+  const startDef = defById.get(startDefId);
+  if (!startDef) {
+    return { visited, lines, hopCapReached: false };
+  }
+  visited.add(startDefId);
+  lines.add(startDef.line);
+  const queue = [startDefId];
+  let hops = 0;
+  while (queue.length > 0) {
+    if (hops >= maxHops) {
+      hopCapReached = true;
+      break;
+    }
+    hops++;
+    const currentId = queue.shift();
+    const incoming = chainsByToDef.get(currentId);
+    if (!incoming)
+      continue;
+    for (const chain of incoming) {
+      const fromId = chain.from_def;
+      if (visited.has(fromId))
+        continue;
+      visited.add(fromId);
+      const fromDef = defById.get(fromId);
+      if (fromDef) {
+        lines.add(fromDef.line);
+      }
+      queue.push(fromId);
+    }
+  }
+  return { visited, lines, hopCapReached };
+}
+
 // ../circle-ir/dist/analysis/taint-propagation.js
 function buildSanitizersByLine(sanitizers) {
   const out2 = new Map;
@@ -15724,7 +15773,11 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
               if (allTaintedDefIds.has(use.def_id)) {
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
-                  const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanitizersByLine);
+                  const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanitizersByLine, {
+                    startDefId: use.def_id,
+                    chainsByToDef: graph.chainsByToDef,
+                    defById
+                  });
                   if (!isSanitized.sanitized) {
                     const source = sources.find((s) => s.line === taintInfo.sourceLine);
                     if (source) {
@@ -15854,20 +15907,36 @@ var KNOWN_SINK_TYPES = new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine) {
-  const sanitizersAtTarget = sanitizersByLine.get(toLine);
-  if (!sanitizersAtTarget || sanitizersAtTarget.length === 0) {
-    return { sanitized: false };
-  }
+function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
-  for (const san of sanitizersAtTarget) {
-    if (isKnownSinkType) {
-      if (san.sanitizes.includes(sinkType)) {
+  const sanitizersAtTarget = sanitizersByLine.get(toLine);
+  if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
+    for (const san of sanitizersAtTarget) {
+      if (isKnownSinkType) {
+        if (san.sanitizes.includes(sinkType)) {
+          return { sanitized: true, sanitizer: san };
+        }
+      } else if (san.sanitizes.length > 0) {
         return { sanitized: true, sanitizer: san };
       }
-    } else {
-      if (san.sanitizes.length > 0) {
-        return { sanitized: true, sanitizer: san };
+    }
+  }
+  if (ctx) {
+    const walk = walkBackwardDefs(ctx.startDefId, ctx.chainsByToDef, ctx.defById, { maxHops: ctx.maxHops ?? 32 });
+    for (const line of walk.lines) {
+      if (line === toLine)
+        continue;
+      const sansAtLine = sanitizersByLine.get(line);
+      if (!sansAtLine || sansAtLine.length === 0)
+        continue;
+      for (const san of sansAtLine) {
+        if (isKnownSinkType) {
+          if (san.sanitizes.includes(sinkType)) {
+            return { sanitized: true, sanitizer: san };
+          }
+        } else if (san.sanitizes.length > 0) {
+          return { sanitized: true, sanitizer: san };
+        }
       }
     }
   }
@@ -24135,6 +24204,20 @@ function findJavaScriptDOMSinks(sourceCode, language) {
           method = "cssText";
         else if (line.includes("style.textContent"))
           method = "textContent";
+        if (method === "document.write" || method === "document.writeln") {
+          const argMatch = line.match(/document\.write(?:ln)?\s*\(\s*([^)]*)\)/);
+          if (argMatch) {
+            const arg = argMatch[1].trim();
+            if (!arg.includes("+")) {
+              const doubleQ = /^"(?:[^"\\]|\\.)*"$/;
+              const singleQ = /^'(?:[^'\\]|\\.)*'$/;
+              const backtick = /^`(?:[^`\\$]|\\.|\$(?!\{))*`$/;
+              if (doubleQ.test(arg) || singleQ.test(arg) || backtick.test(arg)) {
+                break;
+              }
+            }
+          }
+        }
         const alreadyExists = sinks.some((s) => s.line === lineNumber && s.cwe === cwe);
         if (!alreadyExists) {
           sinks.push({ type, cwe, severity, line: lineNumber, location: line.trim().substring(0, 80), method });
@@ -31144,6 +31227,137 @@ class LibraryProfileSinkGatePass {
     };
   }
 }
+var CWE22_SPECULATIVE_SOURCE_TYPES = new Set([
+  "interprocedural_param",
+  "constructor_field"
+]);
+
+class LibraryProfileCwe22PathGatePass {
+  name = "library-profile-cwe22-path-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape2(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedBySourceType: {}
+      };
+    }
+    const flows = graph.ir.taint.flows;
+    if (!flows || flows.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedBySourceType: {}
+      };
+    }
+    const droppedBySourceType = {};
+    const kept = [];
+    for (const flow of flows) {
+      if (flow.sink_type === "path_traversal" && CWE22_SPECULATIVE_SOURCE_TYPES.has(flow.source_type)) {
+        droppedBySourceType[flow.source_type] = (droppedBySourceType[flow.source_type] ?? 0) + 1;
+        continue;
+      }
+      kept.push(flow);
+    }
+    const dropped = flows.length - kept.length;
+    if (dropped > 0) {
+      flows.length = 0;
+      flows.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedBySourceType
+    };
+  }
+}
+
+// ../circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
+var XSS_NON_HTML_OUTPUT_CLASSES = new Set([
+  "StringBuilder",
+  "StringBuffer",
+  "CharArrayWriter",
+  "ByteArrayOutputStream",
+  "PrintStream",
+  "System",
+  "HttpRequest",
+  "HttpRequestBuilder",
+  "HttpResponse",
+  "HttpSession",
+  "ServletRequest",
+  "HttpServletRequest",
+  "RedisOutputStream",
+  "SafeEncoder",
+  "RESP2",
+  "Protocol",
+  "JSONUtil",
+  "JSON",
+  "ObjectMapper",
+  "JsonReader",
+  "Logger",
+  "LoggerFactory",
+  "Log",
+  "Slf4jLogger",
+  "RequestContext",
+  "Context"
+]);
+function isLibraryShape3(profile) {
+  if (!profile || profile === "unknown")
+    return false;
+  return profile.startsWith("library/");
+}
+
+class LibraryProfileXssGatePass {
+  name = "library-profile-xss-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape3(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedByClass: {}
+      };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedByClass: {}
+      };
+    }
+    const droppedByClass = {};
+    const kept = [];
+    for (const sink of sinks) {
+      if (sink.type === "xss" && sink.class && XSS_NON_HTML_OUTPUT_CLASSES.has(sink.class)) {
+        droppedByClass[sink.class] = (droppedByClass[sink.class] ?? 0) + 1;
+        continue;
+      }
+      kept.push(sink);
+    }
+    const dropped = sinks.length - kept.length;
+    if (dropped > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedByClass
+    };
+  }
+}
 
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
@@ -38079,6 +38293,31 @@ class WeakHashPass {
   }
 }
 
+// ../circle-ir/dist/analysis/path-classification.js
+var TEST_PATH_PATTERNS = [
+  /(^|\/)test\//i,
+  /(^|\/)tests\//i,
+  /(^|\/)testing\//i,
+  /(^|\/)__tests__\//i,
+  /(^|\/)spec\//i,
+  /_test\.go$/i,
+  /(^|\/)test_[^/]+\.py$/i,
+  /_test\.py$/i,
+  /\.test\.(?:tsx?|jsx?|mjs|cjs)$/i,
+  /\.spec\.(?:tsx?|jsx?|mjs|cjs)$/i,
+  /\.test\.(?:java|kt)$/i
+];
+function isTestPath(filepath) {
+  if (!filepath)
+    return false;
+  const normalized = filepath.replace(/\\/g, "/");
+  for (const pattern of TEST_PATH_PATTERNS) {
+    if (pattern.test(normalized))
+      return true;
+  }
+  return false;
+}
+
 // ../circle-ir/dist/analysis/passes/weak-crypto-pass.js
 var WEAK_CIPHER_BASES = new Set([
   "des",
@@ -38294,6 +38533,9 @@ class WeakCryptoPass {
     if (isProtocolMandatedCryptoFile(file, code)) {
       return { findings: [] };
     }
+    if (isTestPath(file)) {
+      return { findings: [] };
+    }
     const findings = [];
     const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
     const literalBindings = scanLiteralBindings(code, language);
@@ -42059,10 +42301,14 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new CliMainReflectionSuppressPass);
     if (!disabledPasses.has("library-profile-sink-gate"))
       pipeline.add(new LibraryProfileSinkGatePass);
+    if (!disabledPasses.has("library-profile-xss-gate"))
+      pipeline.add(new LibraryProfileXssGatePass);
     pipeline.add(new TaintPropagationPass);
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
     }));
+    if (!disabledPasses.has("library-profile-cwe22-path-gate"))
+      pipeline.add(new LibraryProfileCwe22PathGatePass);
     if (!disabledPasses.has("scan-secrets"))
       pipeline.add(new ScanSecretsPass);
     if (!disabledPasses.has("dead-code"))
@@ -42993,7 +43239,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.153.0";
+var version = "3.155.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.153.0",
+  "version": "3.155.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.153.0"
+    "circle-ir": "^3.155.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",