cognium-dev 3.159.0 → 3.161.0

package/dist/cli.js

@@ -11520,7 +11520,24 @@ var DEFAULT_SINKS = [
   { method: "outerHTML", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "unserialize", class: "serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "unserialize", class: "node-serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
-  { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] }
+  { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "get", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "post", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "request", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
+  { method: "stream", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
+  { method: "delete", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "put", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "patch", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "head", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchrow", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchval", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchrow", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "fetchval", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "Redirect", class: "http", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [2], languages: ["go"] },
+  { method: "Do", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] },
+  { method: "DoTimeout", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] }
 ];
 var DEFAULT_SANITIZERS = [
   { method: "setString", class: "PreparedStatement", removes: ["sql_injection"] },
@@ -12982,7 +12999,10 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       return true;
     }
     const subtypeArgArityOk = !pattern.arg_positions || pattern.arg_positions.length === 0 || pattern.arg_positions.every((pos) => pos < (call.arguments?.length ?? 0));
-    if (call.receiver_type && call.receiver_type === pattern.class) {} else if (call.receiver_type && typeHierarchy && subtypeArgArityOk && typeHierarchy.isSubtypeOf(call.receiver_type, pattern.class)) {} else if (call.receiver_type_fqn && call.receiver_type_fqn.endsWith("." + pattern.class)) {} else if (call.receiver_type_fqn && typeHierarchy && subtypeArgArityOk && typeHierarchy.isSubtypeOf(call.receiver_type_fqn, pattern.class)) {} else if (call.receiver && !receiverMightBeClass(call.receiver, pattern.class)) {
+    if (call.receiver_type && call.receiver_type === pattern.class) {} else if (call.receiver_type && typeHierarchy && subtypeArgArityOk && typeHierarchy.isSubtypeOf(call.receiver_type, pattern.class)) {} else if (call.receiver_type_fqn && call.receiver_type_fqn.endsWith("." + pattern.class)) {} else if (call.receiver_type_fqn && typeHierarchy && subtypeArgArityOk && typeHierarchy.isSubtypeOf(call.receiver_type_fqn, pattern.class)) {} else if (!call.receiver_type && !call.receiver_type_fqn && call.receiver && typeHierarchy && subtypeArgArityOk && (() => {
+      const factoryReturn = typeHierarchy.resolveFactoryReturnType(call.receiver);
+      return factoryReturn !== null && typeHierarchy.isSubtypeOf(factoryReturn, pattern.class);
+    })()) {} else if (call.receiver && !receiverMightBeClass(call.receiver, pattern.class)) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
@@ -13055,7 +13075,7 @@ function receiverMightBeClass(receiver, className) {
   }
   const lowerReceiver = receiver.toLowerCase();
   const lowerClass = className.toLowerCase();
-  if (lowerReceiver.endsWith(lowerClass) || lowerReceiver.endsWith("." + lowerClass)) {
+  if (lowerReceiver === lowerClass || lowerReceiver.endsWith("." + lowerClass)) {
     return true;
   }
   if (receiver.includes(".") && !receiver.endsWith(")")) {
@@ -13915,6 +13935,7 @@ class TypeHierarchyResolver {
   implementations = new Map;
   _subtypeCache = new Map;
   _implCache = new Map;
+  factoryReturnTypes = new Map;
   addFromIR(ir, filePath) {
     for (const type of ir.types) {
       this.addType(type, filePath, ir.meta.package || null);
@@ -14120,11 +14141,22 @@ class TypeHierarchyResolver {
   getAllTypes() {
     return Array.from(this.types.values());
   }
+  registerFactoryReturnType(factoryClass, method, returnFqn) {
+    this.factoryReturnTypes.set(`${factoryClass}.${method}`, returnFqn);
+  }
+  resolveFactoryReturnType(receiver) {
+    const m = receiver.match(/(?:^|\.)([A-Z]\w*)\.(\w+)\(\)$/);
+    if (!m)
+      return null;
+    const key = `${m[1]}.${m[2]}`;
+    return this.factoryReturnTypes.get(key) ?? null;
+  }
   clear() {
     this.types.clear();
     this.nameToFqn.clear();
     this.subtypes.clear();
     this.implementations.clear();
+    this.factoryReturnTypes.clear();
   }
   resolveTypeName(name2, currentPackage) {
     if (name2.includes("."))
@@ -14463,6 +14495,9 @@ function registerCommonLibraries(resolver) {
   for (const type of [...apacheHttpClient4x, ...apacheHttpClient5x]) {
     resolver.addType(type, "common-libraries", type.package);
   }
+  resolver.registerFactoryReturnType("HttpClients", "createDefault", "org.apache.http.impl.client.CloseableHttpClient");
+  resolver.registerFactoryReturnType("HttpClients", "createSystem", "org.apache.http.impl.client.CloseableHttpClient");
+  resolver.registerFactoryReturnType("HttpClients", "createMinimal", "org.apache.http.impl.client.MinimalHttpClient");
 }
 // ../circle-ir/dist/resolution/symbol-table.js
 class SymbolTable {
@@ -21961,6 +21996,30 @@ class GoPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0, 2]
       },
+      {
+        method: "Get",
+        class: "fasthttp",
+        type: "ssrf",
+        cwe: "CWE-918",
+        severity: "high",
+        argPositions: [1]
+      },
+      {
+        method: "Post",
+        class: "fasthttp",
+        type: "ssrf",
+        cwe: "CWE-918",
+        severity: "high",
+        argPositions: [1]
+      },
+      {
+        method: "GetTimeout",
+        class: "fasthttp",
+        type: "ssrf",
+        cwe: "CWE-918",
+        severity: "high",
+        argPositions: [1]
+      },
       {
         method: "Unmarshal",
         class: "json",
@@ -29828,6 +29887,12 @@ function correlateDollarBraceToArgPositions(method, refs) {
       }
     }
   });
+  const declaredNameToIndex = new Map;
+  method.parameters.forEach((param, idx) => {
+    if (param.name && !declaredNameToIndex.has(param.name)) {
+      declaredNameToIndex.set(param.name, idx);
+    }
+  });
   const positions = new Set;
   for (const ref of refs) {
     const namedIdx = paramNameToIndex.get(ref);
@@ -29835,6 +29900,11 @@ function correlateDollarBraceToArgPositions(method, refs) {
       positions.add(namedIdx);
       continue;
     }
+    const declaredIdx = declaredNameToIndex.get(ref);
+    if (declaredIdx !== undefined) {
+      positions.add(declaredIdx);
+      continue;
+    }
     const positionalIdx = parsePositionalRef(ref);
     if (positionalIdx !== null && positionalIdx < method.parameters.length) {
       positions.add(positionalIdx);
@@ -29865,11 +29935,11 @@ class MyBatisAnnotationSqlSinkPass {
   category = "security";
   run(ctx) {
     if (ctx.language !== "java") {
-      return { annotatedMethodCount: 0, addedSinkCount: 0 };
+      return { annotatedMethodCount: 0, addedSinkCount: 0, declarationFindingCount: 0 };
     }
     const { types, imports, calls } = ctx.graph.ir;
     if (!fileImportsMyBatis(imports)) {
-      return { annotatedMethodCount: 0, addedSinkCount: 0 };
+      return { annotatedMethodCount: 0, addedSinkCount: 0, declarationFindingCount: 0 };
     }
     const mapperMethods = [];
     for (const type of types) {
@@ -29898,6 +29968,7 @@ class MyBatisAnnotationSqlSinkPass {
           interfaceSimpleName: type.name,
           interfaceFqn,
           methodName: method.name,
+          declarationLine: method.start_line,
           taintedArgPositions: positions
         });
       }
@@ -29905,9 +29976,27 @@ class MyBatisAnnotationSqlSinkPass {
     if (mapperMethods.length === 0) {
       return {
         annotatedMethodCount: 0,
-        addedSinkCount: 0
+        addedSinkCount: 0,
+        declarationFindingCount: 0
       };
     }
+    const file = ctx.graph.ir.meta.file;
+    let declarationFindingCount = 0;
+    for (const rec of mapperMethods) {
+      ctx.addFinding({
+        id: `${this.name}-${file}-${rec.declarationLine}-${rec.methodName}`,
+        pass: this.name,
+        category: this.category,
+        rule_id: this.name,
+        cwe: "CWE-89",
+        severity: "critical",
+        level: "error",
+        message: `MyBatis Mapper method \`${rec.interfaceSimpleName}.${rec.methodName}\` uses raw ` + `\`\${}\` interpolation in its @Select/@Update/@Insert/@Delete annotation. ` + `Any caller passing dynamic input into arg position(s) ` + `${rec.taintedArgPositions.join(", ")} will execute unbound SQL (CWE-89). ` + `Replace \`\${x}\` with \`#{x}\` to enable JDBC parameter binding.`,
+        file,
+        line: rec.declarationLine
+      });
+      declarationFindingCount++;
+    }
     const sinks = ctx.hasResult("taint-matcher") ? ctx.getResult("taint-matcher").sinks : ctx.graph.ir.taint.sinks;
     let addedSinkCount = 0;
     for (const call of calls) {
@@ -29935,7 +30024,8 @@ class MyBatisAnnotationSqlSinkPass {
     }
     return {
       annotatedMethodCount: mapperMethods.length,
-      addedSinkCount
+      addedSinkCount,
+      declarationFindingCount
     };
   }
 }
@@ -43751,7 +43841,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.159.0";
+var version = "3.161.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.159.0",
+  "version": "3.161.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.159.0"
+    "circle-ir": "^3.161.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",