cognium-dev 3.160.0 → 3.161.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/cli.js +44 -3
  2. package/package.json +2 -2
package/dist/cli.js CHANGED
@@ -11520,7 +11520,24 @@ var DEFAULT_SINKS = [
11520
11520
  { method: "outerHTML", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11521
11521
  { method: "unserialize", class: "serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11522
11522
  { method: "unserialize", class: "node-serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11523
- { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] }
11523
+ { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
11524
+ { method: "get", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
11525
+ { method: "post", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
11526
+ { method: "request", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
11527
+ { method: "stream", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
11528
+ { method: "delete", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
11529
+ { method: "put", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
11530
+ { method: "patch", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
11531
+ { method: "head", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
11532
+ { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
11533
+ { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
11534
+ { method: "fetchrow", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
11535
+ { method: "fetchval", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
11536
+ { method: "fetchrow", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
11537
+ { method: "fetchval", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
11538
+ { method: "Redirect", class: "http", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [2], languages: ["go"] },
11539
+ { method: "Do", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] },
11540
+ { method: "DoTimeout", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] }
11524
11541
  ];
11525
11542
  var DEFAULT_SANITIZERS = [
11526
11543
  { method: "setString", class: "PreparedStatement", removes: ["sql_injection"] },
@@ -13058,7 +13075,7 @@ function receiverMightBeClass(receiver, className) {
13058
13075
  }
13059
13076
  const lowerReceiver = receiver.toLowerCase();
13060
13077
  const lowerClass = className.toLowerCase();
13061
- if (lowerReceiver.endsWith(lowerClass) || lowerReceiver.endsWith("." + lowerClass)) {
13078
+ if (lowerReceiver === lowerClass || lowerReceiver.endsWith("." + lowerClass)) {
13062
13079
  return true;
13063
13080
  }
13064
13081
  if (receiver.includes(".") && !receiver.endsWith(")")) {
@@ -21979,6 +21996,30 @@ class GoPlugin extends BaseLanguagePlugin {
21979
21996
  severity: "high",
21980
21997
  argPositions: [0, 2]
21981
21998
  },
21999
+ {
22000
+ method: "Get",
22001
+ class: "fasthttp",
22002
+ type: "ssrf",
22003
+ cwe: "CWE-918",
22004
+ severity: "high",
22005
+ argPositions: [1]
22006
+ },
22007
+ {
22008
+ method: "Post",
22009
+ class: "fasthttp",
22010
+ type: "ssrf",
22011
+ cwe: "CWE-918",
22012
+ severity: "high",
22013
+ argPositions: [1]
22014
+ },
22015
+ {
22016
+ method: "GetTimeout",
22017
+ class: "fasthttp",
22018
+ type: "ssrf",
22019
+ cwe: "CWE-918",
22020
+ severity: "high",
22021
+ argPositions: [1]
22022
+ },
21982
22023
  {
21983
22024
  method: "Unmarshal",
21984
22025
  class: "json",
@@ -43800,7 +43841,7 @@ var colors = {
43800
43841
  };
43801
43842
 
43802
43843
  // src/version.ts
43803
- var version = "3.160.0";
43844
+ var version = "3.161.0";
43804
43845
 
43805
43846
  // src/formatters.ts
43806
43847
  var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "cognium-dev",
3
- "version": "3.160.0",
3
+ "version": "3.161.0",
4
4
  "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
66
66
  },
67
67
  "dependencies": {
68
68
  "@cognium/project-profile-detect": "^1.1.0",
69
- "circle-ir": "^3.160.0"
69
+ "circle-ir": "^3.161.0"
70
70
  },
71
71
  "devDependencies": {
72
72
  "@types/node": "^25.5.0",