cognium-dev 3.158.0 → 3.159.0

package/dist/cli.js

@@ -22516,14 +22516,40 @@ class CrossFilePass {
         });
       }
     }
+    const filteredTaintPaths = taintPaths.filter((tp) => {
+      const sinkIR = projectGraph.getIR(tp.sink.file);
+      if (!sinkIR)
+        return true;
+      const sinkTypeStr = tp.sink.type;
+      if (tp.source.file === tp.sink.file) {
+        const lo = Math.min(tp.source.line, tp.sink.line);
+        const hi = Math.max(tp.source.line, tp.sink.line);
+        for (const san of sinkIR.taint.sanitizers ?? []) {
+          if (san.line < lo || san.line > hi)
+            continue;
+          if (san.sanitizes.includes(sinkTypeStr)) {
+            return false;
+          }
+        }
+        return true;
+      }
+      for (const san of sinkIR.taint.sanitizers ?? []) {
+        if (san.line !== tp.sink.line)
+          continue;
+        if (san.sanitizes.includes(sinkTypeStr)) {
+          return false;
+        }
+      }
+      return true;
+    });
     const typeHierarchy = projectGraph.typeHierarchy.toTypeHierarchyData();
     logger.info("cross-file: complete", {
       totalMs: Date.now() - startMs,
-      paths: taintPaths.length,
+      paths: filteredTaintPaths.length,
       crossFileCalls: crossFileCalls.length,
       budgetExceeded: exceeded
     });
-    const result = { crossFileCalls, taintPaths, typeHierarchy };
+    const result = { crossFileCalls, taintPaths: filteredTaintPaths, typeHierarchy };
     if (exceeded)
       result.budgetExceeded = true;
     return result;
@@ -23669,6 +23695,7 @@ class LanguageSourcesPass {
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
       additionalSanitizers.push(...findJavaPathNormalizeStartsWithGuardSanitizers(code));
+      additionalSanitizers.push(...findJavaPathGetFileNameSanitizers(code));
       additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
       additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
@@ -25937,6 +25964,48 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJavaPathGetFileNameSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const assignmentRe = /^\s*(?:(?:final\s+)?[A-Za-z_][\w.<>?,\s\[\]]*?\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const rhsHasGetFileNameRe = /\.\s*getFileName\s*\(\s*\)/;
+  const rhsHasPathsChainRe = /\b(?:Paths\s*\.\s*get|Path\s*\.\s*of)\s*\(/;
+  const candidates = [];
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = assignmentRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    const rhs = m[2];
+    if (!rhsHasGetFileNameRe.test(rhs))
+      continue;
+    if (!rhsHasPathsChainRe.test(rhs))
+      continue;
+    candidates.push({ line: i2 + 1, boundVar: m[1] });
+  }
+  if (candidates.length === 0)
+    return sanitizers;
+  for (const c of candidates) {
+    sanitizers.push({
+      type: "java_path_get_filename",
+      method: "getFileName",
+      line: c.line,
+      sanitizes: ["path_traversal", "external_taint_escape"]
+    });
+    const varRefRe = new RegExp(`\\b${c.boundVar}\\b`);
+    for (let l = c.line;l < lines.length; l++) {
+      if (!varRefRe.test(lines[l]))
+        continue;
+      sanitizers.push({
+        type: "java_path_get_filename",
+        method: "getFileName",
+        line: l + 1,
+        sanitizes: ["path_traversal", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findJavaInlineCrlfStripLogSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -43682,7 +43751,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.158.0";
+var version = "3.159.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.158.0",
+  "version": "3.159.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.158.0"
+    "circle-ir": "^3.159.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",