cognium-dev 3.154.0 → 3.155.0

package/dist/cli.js

@@ -11659,6 +11659,7 @@ var DEFAULT_SANITIZERS = [
   { method: "parseDouble", class: "Double", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseShort", class: "Short", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseByte", class: "Byte", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
+  { method: "parseBoolean", class: "Boolean", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection", "xss", "crlf", "log_injection", "xpath_injection", "ldap_injection", "xxe"] },
   { method: "fromString", class: "UUID", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "BigInt", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "Atoi", class: "strconv", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
@@ -13770,6 +13771,18 @@ class CodeGraph {
     }
     return this._chainsByFromDef;
   }
+  _chainsByToDef = null;
+  get chainsByToDef() {
+    if (!this._chainsByToDef) {
+      this._chainsByToDef = new Map;
+      for (const chain of this.ir.dfg.chains ?? []) {
+        const arr = this._chainsByToDef.get(chain.to_def) ?? [];
+        arr.push(chain);
+        this._chainsByToDef.set(chain.to_def, arr);
+      }
+    }
+    return this._chainsByToDef;
+  }
   _callsByLine = null;
   get callsByLine() {
     if (!this._callsByLine) {
@@ -15640,6 +15653,45 @@ class AnalysisPipeline {
     return { results, findings };
   }
 }
+// ../circle-ir/dist/analysis/dfg-walk.js
+function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
+  const maxHops = options.maxHops ?? 32;
+  const visited = new Set;
+  const lines = new Set;
+  let hopCapReached = false;
+  const startDef = defById.get(startDefId);
+  if (!startDef) {
+    return { visited, lines, hopCapReached: false };
+  }
+  visited.add(startDefId);
+  lines.add(startDef.line);
+  const queue = [startDefId];
+  let hops = 0;
+  while (queue.length > 0) {
+    if (hops >= maxHops) {
+      hopCapReached = true;
+      break;
+    }
+    hops++;
+    const currentId = queue.shift();
+    const incoming = chainsByToDef.get(currentId);
+    if (!incoming)
+      continue;
+    for (const chain of incoming) {
+      const fromId = chain.from_def;
+      if (visited.has(fromId))
+        continue;
+      visited.add(fromId);
+      const fromDef = defById.get(fromId);
+      if (fromDef) {
+        lines.add(fromDef.line);
+      }
+      queue.push(fromId);
+    }
+  }
+  return { visited, lines, hopCapReached };
+}
+
 // ../circle-ir/dist/analysis/taint-propagation.js
 function buildSanitizersByLine(sanitizers) {
   const out2 = new Map;
@@ -15721,7 +15773,11 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
               if (allTaintedDefIds.has(use.def_id)) {
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
-                  const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanitizersByLine);
+                  const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanitizersByLine, {
+                    startDefId: use.def_id,
+                    chainsByToDef: graph.chainsByToDef,
+                    defById
+                  });
                   if (!isSanitized.sanitized) {
                     const source = sources.find((s) => s.line === taintInfo.sourceLine);
                     if (source) {
@@ -15851,20 +15907,36 @@ var KNOWN_SINK_TYPES = new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine) {
-  const sanitizersAtTarget = sanitizersByLine.get(toLine);
-  if (!sanitizersAtTarget || sanitizersAtTarget.length === 0) {
-    return { sanitized: false };
-  }
+function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
-  for (const san of sanitizersAtTarget) {
-    if (isKnownSinkType) {
-      if (san.sanitizes.includes(sinkType)) {
+  const sanitizersAtTarget = sanitizersByLine.get(toLine);
+  if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
+    for (const san of sanitizersAtTarget) {
+      if (isKnownSinkType) {
+        if (san.sanitizes.includes(sinkType)) {
+          return { sanitized: true, sanitizer: san };
+        }
+      } else if (san.sanitizes.length > 0) {
         return { sanitized: true, sanitizer: san };
       }
-    } else {
-      if (san.sanitizes.length > 0) {
-        return { sanitized: true, sanitizer: san };
+    }
+  }
+  if (ctx) {
+    const walk = walkBackwardDefs(ctx.startDefId, ctx.chainsByToDef, ctx.defById, { maxHops: ctx.maxHops ?? 32 });
+    for (const line of walk.lines) {
+      if (line === toLine)
+        continue;
+      const sansAtLine = sanitizersByLine.get(line);
+      if (!sansAtLine || sansAtLine.length === 0)
+        continue;
+      for (const san of sansAtLine) {
+        if (isKnownSinkType) {
+          if (san.sanitizes.includes(sinkType)) {
+            return { sanitized: true, sanitizer: san };
+          }
+        } else if (san.sanitizes.length > 0) {
+          return { sanitized: true, sanitizer: san };
+        }
       }
     }
   }
@@ -24132,6 +24204,20 @@ function findJavaScriptDOMSinks(sourceCode, language) {
           method = "cssText";
         else if (line.includes("style.textContent"))
           method = "textContent";
+        if (method === "document.write" || method === "document.writeln") {
+          const argMatch = line.match(/document\.write(?:ln)?\s*\(\s*([^)]*)\)/);
+          if (argMatch) {
+            const arg = argMatch[1].trim();
+            if (!arg.includes("+")) {
+              const doubleQ = /^"(?:[^"\\]|\\.)*"$/;
+              const singleQ = /^'(?:[^'\\]|\\.)*'$/;
+              const backtick = /^`(?:[^`\\$]|\\.|\$(?!\{))*`$/;
+              if (doubleQ.test(arg) || singleQ.test(arg) || backtick.test(arg)) {
+                break;
+              }
+            }
+          }
+        }
         const alreadyExists = sinks.some((s) => s.line === lineNumber && s.cwe === cwe);
         if (!alreadyExists) {
           sinks.push({ type, cwe, severity, line: lineNumber, location: line.trim().substring(0, 80), method });
@@ -38207,6 +38293,31 @@ class WeakHashPass {
   }
 }
 
+// ../circle-ir/dist/analysis/path-classification.js
+var TEST_PATH_PATTERNS = [
+  /(^|\/)test\//i,
+  /(^|\/)tests\//i,
+  /(^|\/)testing\//i,
+  /(^|\/)__tests__\//i,
+  /(^|\/)spec\//i,
+  /_test\.go$/i,
+  /(^|\/)test_[^/]+\.py$/i,
+  /_test\.py$/i,
+  /\.test\.(?:tsx?|jsx?|mjs|cjs)$/i,
+  /\.spec\.(?:tsx?|jsx?|mjs|cjs)$/i,
+  /\.test\.(?:java|kt)$/i
+];
+function isTestPath(filepath) {
+  if (!filepath)
+    return false;
+  const normalized = filepath.replace(/\\/g, "/");
+  for (const pattern of TEST_PATH_PATTERNS) {
+    if (pattern.test(normalized))
+      return true;
+  }
+  return false;
+}
+
 // ../circle-ir/dist/analysis/passes/weak-crypto-pass.js
 var WEAK_CIPHER_BASES = new Set([
   "des",
@@ -38422,6 +38533,9 @@ class WeakCryptoPass {
     if (isProtocolMandatedCryptoFile(file, code)) {
       return { findings: [] };
     }
+    if (isTestPath(file)) {
+      return { findings: [] };
+    }
     const findings = [];
     const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
     const literalBindings = scanLiteralBindings(code, language);
@@ -43125,7 +43239,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.154.0";
+var version = "3.155.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.154.0",
+  "version": "3.155.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.154.0"
+    "circle-ir": "^3.155.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",