cognium-dev 3.156.0 → 3.157.0

package/dist/cli.js

@@ -11671,7 +11671,10 @@ var DEFAULT_SANITIZERS = [
   { method: "MustParse", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "bool", removes: ["sql_injection", "command_injection", "xss", "code_injection"] },
   { method: "UUID", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
-  { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] }
+  { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
+  { method: "update", class: "Cipher", removes: ["xss", "sql_injection", "command_injection", "path_traversal", "code_injection", "crlf", "log_injection", "ldap_injection", "xpath_injection"] },
+  { method: "final", class: "Cipher", removes: ["xss", "sql_injection", "command_injection", "path_traversal", "code_injection", "crlf", "log_injection", "ldap_injection", "xpath_injection"] },
+  { method: "doFinal", class: "Cipher", removes: ["xss", "sql_injection", "command_injection", "path_traversal", "code_injection", "crlf", "log_injection", "ldap_injection", "xpath_injection"] }
 ];
 var DEFAULT_SINK_SEMANTICS = [
   {
@@ -31836,11 +31839,36 @@ class TaintPropagationPass {
           return true;
         }
         const sansAtSink = sanitizersByLine.get(f.sink_line);
-        if (!sansAtSink || sansAtSink.length === 0)
+        if (sansAtSink && sansAtSink.length > 0) {
+          for (const san of sansAtSink) {
+            if (san.sanitizes.includes(f.sink_type)) {
+              return false;
+            }
+          }
+        }
+        const usesAtSink = graph.usesByLine.get(f.sink_line);
+        if (!usesAtSink || usesAtSink.length === 0)
           return true;
-        for (const san of sansAtSink) {
-          if (san.sanitizes.includes(f.sink_type)) {
-            return false;
+        const sinkVar = f.path.length > 0 ? f.path[f.path.length - 1].variable : undefined;
+        if (!sinkVar)
+          return true;
+        for (const use of usesAtSink) {
+          if (use.variable !== sinkVar)
+            continue;
+          if (use.def_id === null || use.def_id === undefined)
+            continue;
+          const walk = walkBackwardDefs(use.def_id, graph.chainsByToDef, graph.defById, { maxHops: 32 });
+          for (const line of walk.lines) {
+            if (line === f.sink_line)
+              continue;
+            const sansAtLine = sanitizersByLine.get(line);
+            if (!sansAtLine || sansAtLine.length === 0)
+              continue;
+            for (const san of sansAtLine) {
+              if (san.sanitizes.includes(f.sink_type)) {
+                return false;
+              }
+            }
           }
         }
         return true;
@@ -43580,7 +43608,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.156.0";
+var version = "3.157.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.156.0",
+  "version": "3.157.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.156.0"
+    "circle-ir": "^3.157.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",