cognium-dev 3.155.0 → 3.157.0

package/dist/cli.js

@@ -11671,7 +11671,10 @@ var DEFAULT_SANITIZERS = [
   { method: "MustParse", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "bool", removes: ["sql_injection", "command_injection", "xss", "code_injection"] },
   { method: "UUID", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
-  { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] }
+  { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
+  { method: "update", class: "Cipher", removes: ["xss", "sql_injection", "command_injection", "path_traversal", "code_injection", "crlf", "log_injection", "ldap_injection", "xpath_injection"] },
+  { method: "final", class: "Cipher", removes: ["xss", "sql_injection", "command_injection", "path_traversal", "code_injection", "crlf", "log_injection", "ldap_injection", "xpath_injection"] },
+  { method: "doFinal", class: "Cipher", removes: ["xss", "sql_injection", "command_injection", "path_traversal", "code_injection", "crlf", "log_injection", "ldap_injection", "xpath_injection"] }
 ];
 var DEFAULT_SINK_SEMANTICS = [
   {
@@ -12978,7 +12981,8 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
     if (pattern.class === "constructor") {
       return true;
     }
-    if (call.receiver_type && call.receiver_type === pattern.class) {} else if (call.receiver_type_fqn && call.receiver_type_fqn.endsWith("." + pattern.class)) {} else if (call.receiver && !receiverMightBeClass(call.receiver, pattern.class)) {
+    const subtypeArgArityOk = !pattern.arg_positions || pattern.arg_positions.length === 0 || pattern.arg_positions.every((pos) => pos < (call.arguments?.length ?? 0));
+    if (call.receiver_type && call.receiver_type === pattern.class) {} else if (call.receiver_type && typeHierarchy && subtypeArgArityOk && typeHierarchy.isSubtypeOf(call.receiver_type, pattern.class)) {} else if (call.receiver_type_fqn && call.receiver_type_fqn.endsWith("." + pattern.class)) {} else if (call.receiver_type_fqn && typeHierarchy && subtypeArgArityOk && typeHierarchy.isSubtypeOf(call.receiver_type_fqn, pattern.class)) {} else if (call.receiver && !receiverMightBeClass(call.receiver, pattern.class)) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
@@ -14316,8 +14320,150 @@ function createWithJdkTypes() {
   for (const type of [...jdbcTypes, ...ioTypes, ...servletTypes]) {
     resolver.addType(type, "jdk", type.package);
   }
+  registerCommonLibraries(resolver);
   return resolver;
 }
+function registerCommonLibraries(resolver) {
+  const apacheHttpClient4x = [
+    {
+      name: "HttpClient",
+      kind: "interface",
+      package: "org.apache.http.client",
+      extends: null,
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "AbstractHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: null,
+      implements: ["org.apache.http.client.HttpClient"],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "CloseableHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: null,
+      implements: ["org.apache.http.client.HttpClient"],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "InternalHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "MinimalHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "DefaultHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.AbstractHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "SystemDefaultHttpClient",
+      kind: "class",
+      package: "org.apache.http.impl.client",
+      extends: "org.apache.http.impl.client.DefaultHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    }
+  ];
+  const apacheHttpClient5x = [
+    {
+      name: "HttpClient",
+      kind: "interface",
+      package: "org.apache.hc.client5.http.classic",
+      extends: null,
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "CloseableHttpClient",
+      kind: "class",
+      package: "org.apache.hc.client5.http.impl.classic",
+      extends: null,
+      implements: ["org.apache.hc.client5.http.classic.HttpClient"],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "InternalHttpClient",
+      kind: "class",
+      package: "org.apache.hc.client5.http.impl.classic",
+      extends: "org.apache.hc.client5.http.impl.classic.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    },
+    {
+      name: "MinimalHttpClient",
+      kind: "class",
+      package: "org.apache.hc.client5.http.impl.classic",
+      extends: "org.apache.hc.client5.http.impl.classic.CloseableHttpClient",
+      implements: [],
+      annotations: [],
+      methods: [],
+      fields: [],
+      start_line: 0,
+      end_line: 0
+    }
+  ];
+  for (const type of [...apacheHttpClient4x, ...apacheHttpClient5x]) {
+    resolver.addType(type, "common-libraries", type.package);
+  }
+}
 // ../circle-ir/dist/resolution/symbol-table.js
 class SymbolTable {
   exports = new Map;
@@ -29491,6 +29637,202 @@ class LibraryProfileSourceGatePass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js
+var MYBATIS_SQL_ANNOTATIONS = new Set([
+  "Select",
+  "Update",
+  "Insert",
+  "Delete",
+  "SelectProvider",
+  "UpdateProvider",
+  "InsertProvider",
+  "DeleteProvider"
+]);
+var DOLLAR_BRACE_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?:\.[A-Za-z0-9_.]+)?\}/g;
+function parsePositionalRef(name2) {
+  const paramMatch = /^param(\d+)$/.exec(name2);
+  if (paramMatch) {
+    const oneBased = Number.parseInt(paramMatch[1], 10);
+    if (Number.isFinite(oneBased) && oneBased >= 1)
+      return oneBased - 1;
+  }
+  const zeroMatch = /^(\d+)$/.exec(name2);
+  if (zeroMatch) {
+    const zeroBased = Number.parseInt(zeroMatch[1], 10);
+    if (Number.isFinite(zeroBased) && zeroBased >= 0)
+      return zeroBased;
+  }
+  return null;
+}
+function extractAnnotationBody(annotation) {
+  const openIdx = annotation.indexOf("(");
+  if (openIdx < 0)
+    return null;
+  const closeIdx = annotation.lastIndexOf(")");
+  if (closeIdx <= openIdx)
+    return null;
+  return annotation.substring(openIdx + 1, closeIdx);
+}
+function annotationName(annotation) {
+  const openIdx = annotation.indexOf("(");
+  return openIdx < 0 ? annotation : annotation.substring(0, openIdx);
+}
+function extractParamName(annotation) {
+  if (annotationName(annotation) !== "Param")
+    return null;
+  const body2 = extractAnnotationBody(annotation);
+  if (body2 === null)
+    return null;
+  const strMatch = /^\s*["']([^"']*)["']/.exec(body2);
+  return strMatch ? strMatch[1] : null;
+}
+function extractDollarBraceRefs(annotationBody) {
+  const seen = new Set;
+  const out2 = [];
+  DOLLAR_BRACE_RE.lastIndex = 0;
+  let m;
+  while ((m = DOLLAR_BRACE_RE.exec(annotationBody)) !== null) {
+    const name2 = m[1];
+    if (!seen.has(name2)) {
+      seen.add(name2);
+      out2.push(name2);
+    }
+  }
+  return out2;
+}
+function fileImportsMyBatis(imports) {
+  for (const imp of imports) {
+    const pkg = imp.from_package;
+    if (!pkg)
+      continue;
+    if (pkg === "org.apache.ibatis.annotations" || pkg.startsWith("org.apache.ibatis.annotations.") || pkg === "org.apache.ibatis" || pkg.startsWith("org.apache.ibatis.")) {
+      return true;
+    }
+  }
+  return false;
+}
+function correlateDollarBraceToArgPositions(method, refs) {
+  const paramNameToIndex = new Map;
+  method.parameters.forEach((param, idx) => {
+    for (const ann of param.annotations) {
+      const paramName = extractParamName(ann);
+      if (paramName !== null) {
+        paramNameToIndex.set(paramName, idx);
+      }
+    }
+  });
+  const positions = new Set;
+  for (const ref of refs) {
+    const namedIdx = paramNameToIndex.get(ref);
+    if (namedIdx !== undefined) {
+      positions.add(namedIdx);
+      continue;
+    }
+    const positionalIdx = parsePositionalRef(ref);
+    if (positionalIdx !== null && positionalIdx < method.parameters.length) {
+      positions.add(positionalIdx);
+    }
+  }
+  return Array.from(positions).sort((a, b) => a - b);
+}
+function isMapperMethodCall(call, interfaceSimpleName, interfaceFqn, methodName) {
+  const target = call.resolution?.target;
+  if (target) {
+    const suffix = `${interfaceSimpleName}.${methodName}`;
+    const suffixFqn = `${interfaceFqn}.${methodName}`;
+    if (target === suffix || target === suffixFqn || target.endsWith("." + suffix) || target.endsWith("." + suffixFqn)) {
+      return true;
+    }
+  }
+  if (call.method_name !== methodName)
+    return false;
+  if (call.receiver_type === interfaceSimpleName)
+    return true;
+  if (call.receiver_type_fqn === interfaceFqn)
+    return true;
+  return false;
+}
+
+class MyBatisAnnotationSqlSinkPass {
+  name = "mybatis-annotation-sql-sink";
+  category = "security";
+  run(ctx) {
+    if (ctx.language !== "java") {
+      return { annotatedMethodCount: 0, addedSinkCount: 0 };
+    }
+    const { types, imports, calls } = ctx.graph.ir;
+    if (!fileImportsMyBatis(imports)) {
+      return { annotatedMethodCount: 0, addedSinkCount: 0 };
+    }
+    const mapperMethods = [];
+    for (const type of types) {
+      if (type.kind !== "interface")
+        continue;
+      for (const method of type.methods) {
+        let matchedRefs = [];
+        for (const ann of method.annotations) {
+          if (!MYBATIS_SQL_ANNOTATIONS.has(annotationName(ann)))
+            continue;
+          const body2 = extractAnnotationBody(ann);
+          if (body2 === null)
+            continue;
+          const refs = extractDollarBraceRefs(body2);
+          if (refs.length > 0) {
+            matchedRefs = [...matchedRefs, ...refs];
+          }
+        }
+        if (matchedRefs.length === 0)
+          continue;
+        const positions = correlateDollarBraceToArgPositions(method, matchedRefs);
+        if (positions.length === 0)
+          continue;
+        const interfaceFqn = type.package ? `${type.package}.${type.name}` : type.name;
+        mapperMethods.push({
+          interfaceSimpleName: type.name,
+          interfaceFqn,
+          methodName: method.name,
+          taintedArgPositions: positions
+        });
+      }
+    }
+    if (mapperMethods.length === 0) {
+      return {
+        annotatedMethodCount: 0,
+        addedSinkCount: 0
+      };
+    }
+    const sinks = ctx.hasResult("taint-matcher") ? ctx.getResult("taint-matcher").sinks : ctx.graph.ir.taint.sinks;
+    let addedSinkCount = 0;
+    for (const call of calls) {
+      for (const rec of mapperMethods) {
+        if (!isMapperMethodCall(call, rec.interfaceSimpleName, rec.interfaceFqn, rec.methodName)) {
+          continue;
+        }
+        const line = call.location.line;
+        if (sinks.some((s) => s.line === line && s.type === "sql_injection" && s.method === rec.methodName)) {
+          continue;
+        }
+        const receiverLoc = call.receiver ? `${call.receiver}.${rec.methodName}()` : `${rec.methodName}()`;
+        sinks.push({
+          type: "sql_injection",
+          cwe: "CWE-89",
+          location: call.in_method ? `${receiverLoc} in ${call.in_method}` : receiverLoc,
+          line,
+          confidence: 0.95,
+          method: rec.methodName,
+          argPositions: rec.taintedArgPositions,
+          class: rec.interfaceSimpleName
+        });
+        addedSinkCount++;
+      }
+    }
+    return {
+      annotatedMethodCount: mapperMethods.length,
+      addedSinkCount
+    };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
   /\bDOMPurify\.sanitize\s*\(/,
@@ -31497,11 +31839,36 @@ class TaintPropagationPass {
           return true;
         }
         const sansAtSink = sanitizersByLine.get(f.sink_line);
-        if (!sansAtSink || sansAtSink.length === 0)
+        if (sansAtSink && sansAtSink.length > 0) {
+          for (const san of sansAtSink) {
+            if (san.sanitizes.includes(f.sink_type)) {
+              return false;
+            }
+          }
+        }
+        const usesAtSink = graph.usesByLine.get(f.sink_line);
+        if (!usesAtSink || usesAtSink.length === 0)
           return true;
-        for (const san of sansAtSink) {
-          if (san.sanitizes.includes(f.sink_type)) {
-            return false;
+        const sinkVar = f.path.length > 0 ? f.path[f.path.length - 1].variable : undefined;
+        if (!sinkVar)
+          return true;
+        for (const use of usesAtSink) {
+          if (use.variable !== sinkVar)
+            continue;
+          if (use.def_id === null || use.def_id === undefined)
+            continue;
+          const walk = walkBackwardDefs(use.def_id, graph.chainsByToDef, graph.defById, { maxHops: 32 });
+          for (const line of walk.lines) {
+            if (line === f.sink_line)
+              continue;
+            const sansAtLine = sanitizersByLine.get(line);
+            if (!sansAtLine || sansAtLine.length === 0)
+              continue;
+            for (const san of sansAtLine) {
+              if (san.sanitizes.includes(f.sink_type)) {
+                return false;
+              }
+            }
           }
         }
         return true;
@@ -42294,6 +42661,8 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new SourceSemanticsPass);
     if (!disabledPasses.has("library-profile-source-gate"))
       pipeline.add(new LibraryProfileSourceGatePass);
+    if (!disabledPasses.has("mybatis-annotation-sql-sink"))
+      pipeline.add(new MyBatisAnnotationSqlSinkPass);
     pipeline.add(new SinkFilterPass);
     if (!disabledPasses.has("sink-semantics"))
       pipeline.add(new SinkSemanticsPass);
@@ -43239,7 +43608,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.155.0";
+var version = "3.157.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.155.0",
+  "version": "3.157.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.155.0"
+    "circle-ir": "^3.157.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",