cognium-dev 3.156.0 → 3.158.0

package/dist/cli.js

@@ -11671,7 +11671,10 @@ var DEFAULT_SANITIZERS = [
   { method: "MustParse", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "bool", removes: ["sql_injection", "command_injection", "xss", "code_injection"] },
   { method: "UUID", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
-  { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] }
+  { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
+  { method: "update", class: "Cipher", removes: ["xss", "sql_injection", "command_injection", "path_traversal", "code_injection", "crlf", "log_injection", "ldap_injection", "xpath_injection"] },
+  { method: "final", class: "Cipher", removes: ["xss", "sql_injection", "command_injection", "path_traversal", "code_injection", "crlf", "log_injection", "ldap_injection", "xpath_injection"] },
+  { method: "doFinal", class: "Cipher", removes: ["xss", "sql_injection", "command_injection", "path_traversal", "code_injection", "crlf", "log_injection", "ldap_injection", "xpath_injection"] }
 ];
 var DEFAULT_SINK_SEMANTICS = [
   {
@@ -18895,6 +18898,42 @@ function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingTy
 // ../circle-ir/dist/analysis/require-entry-path.js
 var RULE_ID_REQUIRE_ENTRY_PATH = "require-entry-path";
 var MAX_VISITED_METHODS = 2000;
+var TAINT_FLOW_RULE_IDS = new Set([
+  "sql_injection",
+  "nosql_injection",
+  "command_injection",
+  "path_traversal",
+  "xss",
+  "xxe",
+  "deserialization",
+  "insecure_deserialization",
+  "ldap_injection",
+  "xpath_injection",
+  "ssrf",
+  "open_redirect",
+  "code_injection",
+  "log_injection",
+  "redos",
+  "format_string",
+  "crlf",
+  "mass_assignment",
+  "mybatis_mapper_call",
+  "external_taint_escape",
+  "template_injection",
+  "sql-injection",
+  "nosql-injection",
+  "command-injection",
+  "path-traversal",
+  "ldap-injection",
+  "xpath-injection",
+  "open-redirect",
+  "code-injection",
+  "log-injection",
+  "format-string",
+  "mass-assignment",
+  "template-injection",
+  "insecure-deserialization"
+]);
 function applyRequireEntryPath(fileAnalyses, options = {}) {
   const disabledSet = normalizeDisabled(options.disabledPasses);
   if (disabledSet.has(RULE_ID_REQUIRE_ENTRY_PATH))
@@ -19030,6 +19069,8 @@ function collectEntryPointKeys(graph) {
 function classifyFinding(finding, ir, graph, entryPointKeys, profile) {
   if (finding.category !== "security")
     return { action: "keep" };
+  if (!TAINT_FLOW_RULE_IDS.has(finding.rule_id))
+    return { action: "keep" };
   const isHighOrCritical = finding.severity === "high" || finding.severity === "critical";
   const language = (ir.meta.language ?? "").toLowerCase();
   if (language !== "java")
@@ -30412,6 +30453,30 @@ class SinkFilterPass {
     }
     if (language === "java") {
       const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "xss")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const receiverMatch = sinkLineText.match(/\b(\w+)\s*\.\s*(\w+)\s*\(/);
+        const receiver = receiverMatch?.[1];
+        const method = sink.method ?? receiverMatch?.[2];
+        if ((method === "render" || method === "process" || method === "merge" || method === "renderTo" || method === "apply") && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && COMPILED_TEMPLATE_TYPES.has(recvType))
+            return false;
+          if (recvType && TEMPLATE_ENGINE_LITERAL_TARGETS.has(recvType)) {
+            const args2 = extractJavaCallArgs(method, sinkLineText);
+            if (args2 !== null && args2.length >= 1 && isJavaLiteralOrAnnotationAccessor(args2[0])) {
+              return false;
+            }
+          }
+        }
+        return true;
+      });
+    }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
 `);
       filtered = filtered.filter((sink) => {
         if (sink.type !== "command_injection")
@@ -31836,11 +31901,36 @@ class TaintPropagationPass {
           return true;
         }
         const sansAtSink = sanitizersByLine.get(f.sink_line);
-        if (!sansAtSink || sansAtSink.length === 0)
+        if (sansAtSink && sansAtSink.length > 0) {
+          for (const san of sansAtSink) {
+            if (san.sanitizes.includes(f.sink_type)) {
+              return false;
+            }
+          }
+        }
+        const usesAtSink = graph.usesByLine.get(f.sink_line);
+        if (!usesAtSink || usesAtSink.length === 0)
           return true;
-        for (const san of sansAtSink) {
-          if (san.sanitizes.includes(f.sink_type)) {
-            return false;
+        const sinkVar = f.path.length > 0 ? f.path[f.path.length - 1].variable : undefined;
+        if (!sinkVar)
+          return true;
+        for (const use of usesAtSink) {
+          if (use.variable !== sinkVar)
+            continue;
+          if (use.def_id === null || use.def_id === undefined)
+            continue;
+          const walk = walkBackwardDefs(use.def_id, graph.chainsByToDef, graph.defById, { maxHops: 32 });
+          for (const line of walk.lines) {
+            if (line === f.sink_line)
+              continue;
+            const sansAtLine = sanitizersByLine.get(line);
+            if (!sansAtLine || sansAtLine.length === 0)
+              continue;
+            for (const san of sansAtLine) {
+              if (san.sanitizes.includes(f.sink_type)) {
+                return false;
+              }
+            }
           }
         }
         return true;
@@ -38646,10 +38736,22 @@ var TEST_PATH_PATTERNS = [
   /\.spec\.(?:tsx?|jsx?|mjs|cjs)$/i,
   /\.test\.(?:java|kt)$/i
 ];
+var JVM_TEST_FILE_PATTERNS = [
+  /(?:^|\/)[A-Za-z_]\w*(?:Test|Tests|Spec|IT|ITCase|TestCase)\.(?:java|kt|scala|groovy)$/,
+  /(?:^|\/)[A-Za-z_]\w*\.(?:test|spec)\.(?:java|kt|scala|groovy)$/i
+];
+var JVM_SOURCE_FILE_RE = /\.(?:java|kt|scala|groovy)$/i;
 function isTestPath(filepath) {
   if (!filepath)
     return false;
   const normalized = filepath.replace(/\\/g, "/");
+  if (JVM_SOURCE_FILE_RE.test(normalized)) {
+    for (const pattern of JVM_TEST_FILE_PATTERNS) {
+      if (pattern.test(normalized))
+        return true;
+    }
+    return false;
+  }
   for (const pattern of TEST_PATH_PATTERNS) {
     if (pattern.test(normalized))
       return true;
@@ -43580,7 +43682,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.156.0";
+var version = "3.158.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.156.0",
+  "version": "3.158.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.156.0"
+    "circle-ir": "^3.158.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",