cognium-dev 3.154.0 → 3.156.0

package/dist/cli.js

@@ -11659,6 +11659,7 @@ var DEFAULT_SANITIZERS = [
   { method: "parseDouble", class: "Double", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseShort", class: "Short", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseByte", class: "Byte", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
+  { method: "parseBoolean", class: "Boolean", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection", "xss", "crlf", "log_injection", "xpath_injection", "ldap_injection", "xxe"] },
   { method: "fromString", class: "UUID", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "BigInt", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "Atoi", class: "strconv", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
@@ -12977,7 +12978,8 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
     if (pattern.class === "constructor") {
       return true;
     }
-    if (call.receiver_type && call.receiver_type === pattern.class) {} else if (call.receiver_type_fqn && call.receiver_type_fqn.endsWith("." + pattern.class)) {} else if (call.receiver && !receiverMightBeClass(call.receiver, pattern.class)) {
+    const subtypeArgArityOk = !pattern.arg_positions || pattern.arg_positions.length === 0 || pattern.arg_positions.every((pos) => pos < (call.arguments?.length ?? 0));
+    if (call.receiver_type && call.receiver_type === pattern.class) {} else if (call.receiver_type && typeHierarchy && subtypeArgArityOk && typeHierarchy.isSubtypeOf(call.receiver_type, pattern.class)) {} else if (call.receiver_type_fqn && call.receiver_type_fqn.endsWith("." + pattern.class)) {} else if (call.receiver_type_fqn && typeHierarchy && subtypeArgArityOk && typeHierarchy.isSubtypeOf(call.receiver_type_fqn, pattern.class)) {} else if (call.receiver && !receiverMightBeClass(call.receiver, pattern.class)) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
@@ -13770,6 +13772,18 @@ class CodeGraph {
     }
     return this._chainsByFromDef;
   }
+  _chainsByToDef = null;
+  get chainsByToDef() {
+    if (!this._chainsByToDef) {
+      this._chainsByToDef = new Map;
+      for (const chain of this.ir.dfg.chains ?? []) {
+        const arr = this._chainsByToDef.get(chain.to_def) ?? [];
+        arr.push(chain);
+        this._chainsByToDef.set(chain.to_def, arr);
+      }
+    }
+    return this._chainsByToDef;
+  }
   _callsByLine = null;
   get callsByLine() {
     if (!this._callsByLine) {
@@ -14303,8 +14317,150 @@ function createWithJdkTypes() {
   for (const type of [...jdbcTypes, ...ioTypes, ...servletTypes]) {
     resolver.addType(type, "jdk", type.package);
   }
+  registerCommonLibraries(resolver);
   return resolver;
 }
+function registerCommonLibraries(resolver) {
+  const apacheHttpClient4x = [
+    {
+      name: "HttpClient",
+      kind: "interface",
+      package: "org.apache.http.client",
+      extends: null,
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "AbstractHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: null,
+      implements: ["org.apache.http.client.HttpClient"],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "CloseableHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: null,
+      implements: ["org.apache.http.client.HttpClient"],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "InternalHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "MinimalHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "DefaultHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.AbstractHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "SystemDefaultHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.DefaultHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    }
+  ];
+  const apacheHttpClient5x = [
+    {
+      name: "HttpClient",
+      kind: "interface",
+      package: "org.apache.hc.client5.http.classic",
+      extends: null,
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "CloseableHttpClient",
+      kind: "class",
+      package: "org.apache.hc.client5.http.impl.classic",
+      extends: null,
+      implements: ["org.apache.hc.client5.http.classic.HttpClient"],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "InternalHttpClient",
+      kind: "class",
+      package: "org.apache.hc.client5.http.impl.classic",
+      extends: "org.apache.hc.client5.http.impl.classic.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "MinimalHttpClient",
+      kind: "class",
+      package: "org.apache.hc.client5.http.impl.classic",
+      extends: "org.apache.hc.client5.http.impl.classic.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    }
+  ];
+  for (const type of [...apacheHttpClient4x, ...apacheHttpClient5x]) {
+    resolver.addType(type, "common-libraries", type.package);
+  }
+}
 // ../circle-ir/dist/resolution/symbol-table.js
 class SymbolTable {
   exports = new Map;
@@ -15640,6 +15796,45 @@ class AnalysisPipeline {
     return { results, findings };
   }
 }
+// ../circle-ir/dist/analysis/dfg-walk.js
+function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
+  const maxHops = options.maxHops ?? 32;
+  const visited = new Set;
+  const lines = new Set;
+  let hopCapReached = false;
+  const startDef = defById.get(startDefId);
+  if (!startDef) {
+    return { visited, lines, hopCapReached: false };
+  }
+  visited.add(startDefId);
+  lines.add(startDef.line);
+  const queue = [startDefId];
+  let hops = 0;
+  while (queue.length > 0) {
+    if (hops >= maxHops) {
+      hopCapReached = true;
+      break;
+    }
+    hops++;
+    const currentId = queue.shift();
+    const incoming = chainsByToDef.get(currentId);
+    if (!incoming)
+      continue;
+    for (const chain of incoming) {
+      const fromId = chain.from_def;
+      if (visited.has(fromId))
+        continue;
+      visited.add(fromId);
+      const fromDef = defById.get(fromId);
+      if (fromDef) {
+        lines.add(fromDef.line);
+      }
+      queue.push(fromId);
+    }
+  }
+  return { visited, lines, hopCapReached };
+}
+
 // ../circle-ir/dist/analysis/taint-propagation.js
 function buildSanitizersByLine(sanitizers) {
   const out2 = new Map;
@@ -15721,7 +15916,11 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
               if (allTaintedDefIds.has(use.def_id)) {
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
-                  const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanitizersByLine);
+                  const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanitizersByLine, {
+                    startDefId: use.def_id,
+                    chainsByToDef: graph.chainsByToDef,
+                    defById
+                  });
                   if (!isSanitized.sanitized) {
                     const source = sources.find((s) => s.line === taintInfo.sourceLine);
                     if (source) {
@@ -15851,20 +16050,36 @@ var KNOWN_SINK_TYPES = new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine) {
-  const sanitizersAtTarget = sanitizersByLine.get(toLine);
-  if (!sanitizersAtTarget || sanitizersAtTarget.length === 0) {
-    return { sanitized: false };
-  }
+function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
-  for (const san of sanitizersAtTarget) {
-    if (isKnownSinkType) {
-      if (san.sanitizes.includes(sinkType)) {
+  const sanitizersAtTarget = sanitizersByLine.get(toLine);
+  if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
+    for (const san of sanitizersAtTarget) {
+      if (isKnownSinkType) {
+        if (san.sanitizes.includes(sinkType)) {
+          return { sanitized: true, sanitizer: san };
+        }
+      } else if (san.sanitizes.length > 0) {
         return { sanitized: true, sanitizer: san };
       }
-    } else {
-      if (san.sanitizes.length > 0) {
-        return { sanitized: true, sanitizer: san };
+    }
+  }
+  if (ctx) {
+    const walk = walkBackwardDefs(ctx.startDefId, ctx.chainsByToDef, ctx.defById, { maxHops: ctx.maxHops ?? 32 });
+    for (const line of walk.lines) {
+      if (line === toLine)
+        continue;
+      const sansAtLine = sanitizersByLine.get(line);
+      if (!sansAtLine || sansAtLine.length === 0)
+        continue;
+      for (const san of sansAtLine) {
+        if (isKnownSinkType) {
+          if (san.sanitizes.includes(sinkType)) {
+            return { sanitized: true, sanitizer: san };
+          }
+        } else if (san.sanitizes.length > 0) {
+          return { sanitized: true, sanitizer: san };
+        }
       }
     }
   }
@@ -24132,6 +24347,20 @@ function findJavaScriptDOMSinks(sourceCode, language) {
           method = "cssText";
         else if (line.includes("style.textContent"))
           method = "textContent";
+        if (method === "document.write" || method === "document.writeln") {
+          const argMatch = line.match(/document\.write(?:ln)?\s*\(\s*([^)]*)\)/);
+          if (argMatch) {
+            const arg = argMatch[1].trim();
+            if (!arg.includes("+")) {
+              const doubleQ = /^"(?:[^"\\]|\\.)*"$/;
+              const singleQ = /^'(?:[^'\\]|\\.)*'$/;
+              const backtick = /^`(?:[^`\\$]|\\.|\$(?!\{))*`$/;
+              if (doubleQ.test(arg) || singleQ.test(arg) || backtick.test(arg)) {
+                break;
+              }
+            }
+          }
+        }
         const alreadyExists = sinks.some((s) => s.line === lineNumber && s.cwe === cwe);
         if (!alreadyExists) {
           sinks.push({ type, cwe, severity, line: lineNumber, location: line.trim().substring(0, 80), method });
@@ -29405,6 +29634,202 @@ class LibraryProfileSourceGatePass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js
+var MYBATIS_SQL_ANNOTATIONS = new Set([
+  "Select",
+  "Update",
+  "Insert",
+  "Delete",
+  "SelectProvider",
+  "UpdateProvider",
+  "InsertProvider",
+  "DeleteProvider"
+]);
+var DOLLAR_BRACE_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?:\.[A-Za-z0-9_.]+)?\}/g;
+function parsePositionalRef(name2) {
+  const paramMatch = /^param(\d+)$/.exec(name2);
+  if (paramMatch) {
+    const oneBased = Number.parseInt(paramMatch[1], 10);
+    if (Number.isFinite(oneBased) && oneBased >= 1)
+      return oneBased - 1;
+  }
+  const zeroMatch = /^(\d+)$/.exec(name2);
+  if (zeroMatch) {
+    const zeroBased = Number.parseInt(zeroMatch[1], 10);
+    if (Number.isFinite(zeroBased) && zeroBased >= 0)
+      return zeroBased;
+  }
+  return null;
+}
+function extractAnnotationBody(annotation) {
+  const openIdx = annotation.indexOf("(");
+  if (openIdx < 0)
+    return null;
+  const closeIdx = annotation.lastIndexOf(")");
+  if (closeIdx <= openIdx)
+    return null;
+  return annotation.substring(openIdx + 1, closeIdx);
+}
+function annotationName(annotation) {
+  const openIdx = annotation.indexOf("(");
+  return openIdx < 0 ? annotation : annotation.substring(0, openIdx);
+}
+function extractParamName(annotation) {
+  if (annotationName(annotation) !== "Param")
+    return null;
+  const body2 = extractAnnotationBody(annotation);
+  if (body2 === null)
+    return null;
+  const strMatch = /^\s*["']([^"']*)["']/.exec(body2);
+  return strMatch ? strMatch[1] : null;
+}
+function extractDollarBraceRefs(annotationBody) {
+  const seen = new Set;
+  const out2 = [];
+  DOLLAR_BRACE_RE.lastIndex = 0;
+  let m;
+  while ((m = DOLLAR_BRACE_RE.exec(annotationBody)) !== null) {
+    const name2 = m[1];
+    if (!seen.has(name2)) {
+      seen.add(name2);
+      out2.push(name2);
+    }
+  }
+  return out2;
+}
+function fileImportsMyBatis(imports) {
+  for (const imp of imports) {
+    const pkg = imp.from_package;
+    if (!pkg)
+      continue;
+    if (pkg === "org.apache.ibatis.annotations" || pkg.startsWith("org.apache.ibatis.annotations.") || pkg === "org.apache.ibatis" || pkg.startsWith("org.apache.ibatis.")) {
+      return true;
+    }
+  }
+  return false;
+}
+function correlateDollarBraceToArgPositions(method, refs) {
+  const paramNameToIndex = new Map;
+  method.parameters.forEach((param, idx) => {
+    for (const ann of param.annotations) {
+      const paramName = extractParamName(ann);
+      if (paramName !== null) {
+        paramNameToIndex.set(paramName, idx);
+      }
+    }
+  });
+  const positions = new Set;
+  for (const ref of refs) {
+    const namedIdx = paramNameToIndex.get(ref);
+    if (namedIdx !== undefined) {
+      positions.add(namedIdx);
+      continue;
+    }
+    const positionalIdx = parsePositionalRef(ref);
+    if (positionalIdx !== null && positionalIdx < method.parameters.length) {
+      positions.add(positionalIdx);
+    }
+  }
+  return Array.from(positions).sort((a, b) => a - b);
+}
+function isMapperMethodCall(call, interfaceSimpleName, interfaceFqn, methodName) {
+  const target = call.resolution?.target;
+  if (target) {
+    const suffix = `${interfaceSimpleName}.${methodName}`;
+    const suffixFqn = `${interfaceFqn}.${methodName}`;
+    if (target === suffix || target === suffixFqn || target.endsWith("." + suffix) || target.endsWith("." + suffixFqn)) {
+      return true;
+    }
+  }
+  if (call.method_name !== methodName)
+    return false;
+  if (call.receiver_type === interfaceSimpleName)
+    return true;
+  if (call.receiver_type_fqn === interfaceFqn)
+    return true;
+  return false;
+}
+
+class MyBatisAnnotationSqlSinkPass {
+  name = "mybatis-annotation-sql-sink";
+  category = "security";
+  run(ctx) {
+    if (ctx.language !== "java") {
+      return { annotatedMethodCount: 0, addedSinkCount: 0 };
+    }
+    const { types, imports, calls } = ctx.graph.ir;
+    if (!fileImportsMyBatis(imports)) {
+      return { annotatedMethodCount: 0, addedSinkCount: 0 };
+    }
+    const mapperMethods = [];
+    for (const type of types) {
+      if (type.kind !== "interface")
+        continue;
+      for (const method of type.methods) {
+        let matchedRefs = [];
+        for (const ann of method.annotations) {
+          if (!MYBATIS_SQL_ANNOTATIONS.has(annotationName(ann)))
+            continue;
+          const body2 = extractAnnotationBody(ann);
+          if (body2 === null)
+            continue;
+          const refs = extractDollarBraceRefs(body2);
+          if (refs.length > 0) {
+            matchedRefs = [...matchedRefs, ...refs];
+          }
+        }
+        if (matchedRefs.length === 0)
+          continue;
+        const positions = correlateDollarBraceToArgPositions(method, matchedRefs);
+        if (positions.length === 0)
+          continue;
+        const interfaceFqn = type.package ? `${type.package}.${type.name}` : type.name;
+        mapperMethods.push({
+          interfaceSimpleName: type.name,
+          interfaceFqn,
+          methodName: method.name,
+          taintedArgPositions: positions
+        });
+      }
+    }
+    if (mapperMethods.length === 0) {
+      return {
+        annotatedMethodCount: 0,
+        addedSinkCount: 0
+      };
+    }
+    const sinks = ctx.hasResult("taint-matcher") ? ctx.getResult("taint-matcher").sinks : ctx.graph.ir.taint.sinks;
+    let addedSinkCount = 0;
+    for (const call of calls) {
+      for (const rec of mapperMethods) {
+        if (!isMapperMethodCall(call, rec.interfaceSimpleName, rec.interfaceFqn, rec.methodName)) {
+          continue;
+        }
+        const line = call.location.line;
+        if (sinks.some((s) => s.line === line && s.type === "sql_injection" && s.method === rec.methodName)) {
+          continue;
+        }
+        const receiverLoc = call.receiver ? `${call.receiver}.${rec.methodName}()` : `${rec.methodName}()`;
+        sinks.push({
+          type: "sql_injection",
+          cwe: "CWE-89",
+          location: call.in_method ? `${receiverLoc} in ${call.in_method}` : receiverLoc,
+          line,
+          confidence: 0.95,
+          method: rec.methodName,
+          argPositions: rec.taintedArgPositions,
+          class: rec.interfaceSimpleName
+        });
+        addedSinkCount++;
+      }
+    }
+    return {
+      annotatedMethodCount: mapperMethods.length,
+      addedSinkCount
+    };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
   /\bDOMPurify\.sanitize\s*\(/,
@@ -38207,6 +38632,31 @@ class WeakHashPass {
   }
 }
 
+// ../circle-ir/dist/analysis/path-classification.js
+var TEST_PATH_PATTERNS = [
+  /(^|\/)test\//i,
+  /(^|\/)tests\//i,
+  /(^|\/)testing\//i,
+  /(^|\/)__tests__\//i,
+  /(^|\/)spec\//i,
+  /_test\.go$/i,
+  /(^|\/)test_[^/]+\.py$/i,
+  /_test\.py$/i,
+  /\.test\.(?:tsx?|jsx?|mjs|cjs)$/i,
+  /\.spec\.(?:tsx?|jsx?|mjs|cjs)$/i,
+  /\.test\.(?:java|kt)$/i
+];
+function isTestPath(filepath) {
+  if (!filepath)
+    return false;
+  const normalized = filepath.replace(/\\/g, "/");
+  for (const pattern of TEST_PATH_PATTERNS) {
+    if (pattern.test(normalized))
+      return true;
+  }
+  return false;
+}
+
 // ../circle-ir/dist/analysis/passes/weak-crypto-pass.js
 var WEAK_CIPHER_BASES = new Set([
   "des",
@@ -38422,6 +38872,9 @@ class WeakCryptoPass {
     if (isProtocolMandatedCryptoFile(file, code)) {
       return { findings: [] };
     }
+    if (isTestPath(file)) {
+      return { findings: [] };
+    }
     const findings = [];
     const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
     const literalBindings = scanLiteralBindings(code, language);
@@ -42180,6 +42633,8 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new SourceSemanticsPass);
     if (!disabledPasses.has("library-profile-source-gate"))
       pipeline.add(new LibraryProfileSourceGatePass);
+    if (!disabledPasses.has("mybatis-annotation-sql-sink"))
+      pipeline.add(new MyBatisAnnotationSqlSinkPass);
     pipeline.add(new SinkFilterPass);
     if (!disabledPasses.has("sink-semantics"))
       pipeline.add(new SinkSemanticsPass);
@@ -43125,7 +43580,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.154.0";
+var version = "3.156.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.154.0",
+  "version": "3.156.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.154.0"
+    "circle-ir": "^3.156.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",