cognium-dev 3.163.0 → 3.164.0

package/dist/cli.js

@@ -32644,6 +32644,144 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         });
         existingVars.add(varName);
       }
+      if (sanitizers && sanitizers.length > 0) {
+        const sanitizersByLine = new Map;
+        for (const s of sanitizers) {
+          const arr = sanitizersByLine.get(s.line) ?? [];
+          arr.push(s);
+          sanitizersByLine.set(s.line, arr);
+        }
+        const codeLines = code.split(`
+`);
+        for (const [varName, originLine] of derived) {
+          const lineSans = sanitizersByLine.get(originLine);
+          if (!lineSans || lineSans.length === 0)
+            continue;
+          const lineText = codeLines[originLine - 1] ?? "";
+          const rhsMatch = lineText.match(/^\s*(?:let\s+(?:mut\s+)?)?[A-Za-z_]\w*(?:\s*:\s*[^=]+)?\s*=\s*(.+?)(?:;\s*)?$/);
+          if (!rhsMatch)
+            continue;
+          const rhs = rhsMatch[1];
+          for (const san of lineSans) {
+            const sanMatch = san.method.match(/(\w+)\(\)$/);
+            if (!sanMatch)
+              continue;
+            const sanName = sanMatch[1];
+            if (!rhs.includes(`${sanName}(`))
+              continue;
+            let set = aliasSanitizedFor.get(varName);
+            if (!set) {
+              set = new Set;
+              aliasSanitizedFor.set(varName, set);
+            }
+            for (const t of san.sanitizes)
+              set.add(t);
+          }
+        }
+      }
+      const aliasChains = [];
+      {
+        const codeLines2 = code.split(`
+`);
+        for (let i2 = 0;i2 < codeLines2.length; i2++) {
+          const ln = codeLines2[i2];
+          if (ln.trimStart().startsWith("//"))
+            continue;
+          const m = ln.match(/^\s*(?:let\s+(?:mut\s+)?)?([\p{L}\p{N}_]+)\s*(?::\s*[^=]+)?\s*=\s*([\p{L}\p{N}_]+)\s*;?\s*$/u);
+          if (!m)
+            continue;
+          const lineNum = i2 + 1;
+          const lhs = m[1];
+          if (derived.get(lhs) !== lineNum)
+            continue;
+          aliasChains.push({ lhs, upstream: m[2], line: lineNum });
+        }
+      }
+      if (aliasChains.length > 0) {
+        let changed = true;
+        let guard = 0;
+        while (changed && guard < aliasChains.length + 2) {
+          changed = false;
+          guard++;
+          for (const { lhs, upstream } of aliasChains) {
+            const upCov = aliasSanitizedFor.get(upstream);
+            if (!upCov || upCov.size === 0)
+              continue;
+            let downCov = aliasSanitizedFor.get(lhs);
+            if (!downCov) {
+              downCov = new Set;
+              aliasSanitizedFor.set(lhs, downCov);
+            }
+            for (const t of upCov) {
+              if (!downCov.has(t)) {
+                downCov.add(t);
+                changed = true;
+              }
+            }
+          }
+        }
+      }
+      {
+        const codeLines3 = code.split(`
+`);
+        let changed = true;
+        let guard = 0;
+        const derivedList = [...derived.entries()];
+        const taintedVars = new Set([
+          ...seedVars,
+          ...derivedList.map(([v]) => v)
+        ]);
+        while (changed && guard < derivedList.length + 2) {
+          changed = false;
+          guard++;
+          for (const [varName, originLine] of derivedList) {
+            const lineText = codeLines3[originLine - 1] ?? "";
+            if (lineText.trimStart().startsWith("//"))
+              continue;
+            const rhsMatch = lineText.match(/^\s*(?:let\s+(?:mut\s+)?)?[A-Za-z_]\w*(?:\s*:\s*[^=]+)?\s*=\s*(.+?)(?:;\s*)?$/);
+            if (!rhsMatch)
+              continue;
+            const rhs = rhsMatch[1];
+            let anyReferenced = false;
+            let intersection = null;
+            let blocked = false;
+            for (const other of taintedVars) {
+              if (other === varName)
+                continue;
+              const re = new RegExp(`\\b${other}\\b`);
+              if (!re.test(rhs))
+                continue;
+              anyReferenced = true;
+              const cov = aliasSanitizedFor.get(other);
+              if (!cov || cov.size === 0) {
+                blocked = true;
+                break;
+              }
+              if (intersection === null) {
+                intersection = new Set(cov);
+              } else {
+                for (const t of [...intersection]) {
+                  if (!cov.has(t))
+                    intersection.delete(t);
+                }
+              }
+            }
+            if (blocked || !anyReferenced || !intersection || intersection.size === 0)
+              continue;
+            let downCov = aliasSanitizedFor.get(varName);
+            if (!downCov) {
+              downCov = new Set;
+              aliasSanitizedFor.set(varName, downCov);
+            }
+            for (const t of intersection) {
+              if (!downCov.has(t)) {
+                downCov.add(t);
+                changed = true;
+              }
+            }
+          }
+        }
+      }
     }
   }
   if (language === "java" && typeof code === "string" && sourcesWithVar.length > 0) {
@@ -43846,7 +43984,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.163.0";
+var version = "3.164.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.163.0",
+  "version": "3.164.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.163.0"
+    "circle-ir": "^3.164.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",