cognium-dev 3.161.0 → 3.163.0

package/dist/cli.js

@@ -10226,6 +10226,7 @@ var DEFAULT_SOURCES = [
   { method: "getPathWithinApplication", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
   { method: "getRequestUri", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
   { method: "decodeRequestString", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
+  { method: "decode", class: "URLDecoder", type: "http_path", severity: "high", return_tainted: true },
   { method: "getProtocol", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
   { method: "getScheme", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
   { method: "getAuthType", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
@@ -11561,11 +11562,11 @@ var DEFAULT_SANITIZERS = [
   { method: "render", class: "Template", removes: ["xss"] },
   { method: "encodeForJavaScript", removes: ["xss"] },
   { method: "encodeForCSS", removes: ["xss"] },
-  { method: "encodeForURL", removes: ["xss", "ssrf"] },
-  { method: "encodeURL", removes: ["xss", "ssrf"] },
-  { method: "urlEncode", removes: ["xss", "ssrf"] },
-  { method: "escapeUrl", removes: ["xss", "ssrf"] },
-  { method: "escapeURL", removes: ["xss", "ssrf"] },
+  { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "escapeUrl", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "escapeURL", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "normalize", class: "Path", removes: ["path_traversal"] },
   { method: "getCanonicalPath", class: "File", removes: ["path_traversal"] },
   { method: "toRealPath", class: "Path", removes: ["path_traversal"] },
@@ -11591,7 +11592,7 @@ var DEFAULT_SANITIZERS = [
   { method: "setFeature", class: "SAXParserFactory", removes: ["xxe"] },
   { method: "setFeature", class: "XMLReader", removes: ["xxe"] },
   { method: "setProperty", class: "XMLReader", removes: ["xxe"] },
-  { method: "encode", class: "URLEncoder", removes: ["ssrf", "xss", "path_traversal"] },
+  { method: "encode", class: "URLEncoder", removes: ["ssrf", "xss", "path_traversal", "open_redirect"] },
   { method: "validateURL", removes: ["ssrf"] },
   { method: "isAllowedHost", removes: ["ssrf"] },
   { method: "isInternalHost", removes: ["ssrf"] },
@@ -13630,7 +13631,7 @@ function canSourceReachSink(sourceType, sinkType) {
     http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
     http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary"],
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary"],
-    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary"],
+    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss"],
     http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization"],
     io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf"],
     env_input: ["command_injection", "path_traversal"],
@@ -16088,7 +16089,7 @@ var KNOWN_SINK_TYPES = new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
+function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);
   if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
@@ -16107,6 +16108,8 @@ function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
     for (const line of walk.lines) {
       if (line === toLine)
         continue;
+      if (line < fromLine)
+        continue;
       const sansAtLine = sanitizersByLine.get(line);
       if (!sansAtLine || sansAtLine.length === 0)
         continue;
@@ -32082,6 +32085,8 @@ class TaintPropagationPass {
           for (const line of walk.lines) {
             if (line === f.sink_line)
               continue;
+            if (line < f.source_line)
+              continue;
             const sansAtLine = sanitizersByLine.get(line);
             if (!sansAtLine || sansAtLine.length === 0)
               continue;
@@ -43841,7 +43846,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.161.0";
+var version = "3.163.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.161.0",
+  "version": "3.163.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.161.0"
+    "circle-ir": "^3.163.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",