cognium-dev 3.160.0 → 3.162.0

package/dist/cli.js

@@ -10226,6 +10226,7 @@ var DEFAULT_SOURCES = [
   { method: "getPathWithinApplication", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
   { method: "getRequestUri", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
   { method: "decodeRequestString", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
+  { method: "decode", class: "URLDecoder", type: "http_path", severity: "high", return_tainted: true },
   { method: "getProtocol", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
   { method: "getScheme", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
   { method: "getAuthType", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
@@ -11520,7 +11521,24 @@ var DEFAULT_SINKS = [
   { method: "outerHTML", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "unserialize", class: "serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "unserialize", class: "node-serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
-  { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] }
+  { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "get", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "post", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "request", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
+  { method: "stream", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
+  { method: "delete", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "put", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "patch", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "head", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchrow", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchval", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchrow", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "fetchval", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "Redirect", class: "http", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [2], languages: ["go"] },
+  { method: "Do", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] },
+  { method: "DoTimeout", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] }
 ];
 var DEFAULT_SANITIZERS = [
   { method: "setString", class: "PreparedStatement", removes: ["sql_injection"] },
@@ -11544,11 +11562,11 @@ var DEFAULT_SANITIZERS = [
   { method: "render", class: "Template", removes: ["xss"] },
   { method: "encodeForJavaScript", removes: ["xss"] },
   { method: "encodeForCSS", removes: ["xss"] },
-  { method: "encodeForURL", removes: ["xss", "ssrf"] },
-  { method: "encodeURL", removes: ["xss", "ssrf"] },
-  { method: "urlEncode", removes: ["xss", "ssrf"] },
-  { method: "escapeUrl", removes: ["xss", "ssrf"] },
-  { method: "escapeURL", removes: ["xss", "ssrf"] },
+  { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "escapeUrl", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "escapeURL", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "normalize", class: "Path", removes: ["path_traversal"] },
   { method: "getCanonicalPath", class: "File", removes: ["path_traversal"] },
   { method: "toRealPath", class: "Path", removes: ["path_traversal"] },
@@ -11574,7 +11592,7 @@ var DEFAULT_SANITIZERS = [
   { method: "setFeature", class: "SAXParserFactory", removes: ["xxe"] },
   { method: "setFeature", class: "XMLReader", removes: ["xxe"] },
   { method: "setProperty", class: "XMLReader", removes: ["xxe"] },
-  { method: "encode", class: "URLEncoder", removes: ["ssrf", "xss", "path_traversal"] },
+  { method: "encode", class: "URLEncoder", removes: ["ssrf", "xss", "path_traversal", "open_redirect"] },
   { method: "validateURL", removes: ["ssrf"] },
   { method: "isAllowedHost", removes: ["ssrf"] },
   { method: "isInternalHost", removes: ["ssrf"] },
@@ -13058,7 +13076,7 @@ function receiverMightBeClass(receiver, className) {
   }
   const lowerReceiver = receiver.toLowerCase();
   const lowerClass = className.toLowerCase();
-  if (lowerReceiver.endsWith(lowerClass) || lowerReceiver.endsWith("." + lowerClass)) {
+  if (lowerReceiver === lowerClass || lowerReceiver.endsWith("." + lowerClass)) {
     return true;
   }
   if (receiver.includes(".") && !receiver.endsWith(")")) {
@@ -16071,7 +16089,7 @@ var KNOWN_SINK_TYPES = new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
+function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);
   if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
@@ -16090,6 +16108,8 @@ function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
     for (const line of walk.lines) {
       if (line === toLine)
         continue;
+      if (line < fromLine)
+        continue;
       const sansAtLine = sanitizersByLine.get(line);
       if (!sansAtLine || sansAtLine.length === 0)
         continue;
@@ -21979,6 +21999,30 @@ class GoPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0, 2]
       },
+      {
+        method: "Get",
+        class: "fasthttp",
+        type: "ssrf",
+        cwe: "CWE-918",
+        severity: "high",
+        argPositions: [1]
+      },
+      {
+        method: "Post",
+        class: "fasthttp",
+        type: "ssrf",
+        cwe: "CWE-918",
+        severity: "high",
+        argPositions: [1]
+      },
+      {
+        method: "GetTimeout",
+        class: "fasthttp",
+        type: "ssrf",
+        cwe: "CWE-918",
+        severity: "high",
+        argPositions: [1]
+      },
       {
         method: "Unmarshal",
         class: "json",
@@ -32041,6 +32085,8 @@ class TaintPropagationPass {
           for (const line of walk.lines) {
             if (line === f.sink_line)
               continue;
+            if (line < f.source_line)
+              continue;
             const sansAtLine = sanitizersByLine.get(line);
             if (!sansAtLine || sansAtLine.length === 0)
               continue;
@@ -43800,7 +43846,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.160.0";
+var version = "3.162.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.160.0",
+  "version": "3.162.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.160.0"
+    "circle-ir": "^3.162.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",