cognium-dev 3.165.0 → 3.166.1

package/dist/cli.js

@@ -18902,11 +18902,29 @@ function methodIsSupertypeLifecycleEntryPoint(method, enclosingType) {
   return false;
 }
 function classifyEntryPointTier(method, enclosingType, ctx) {
-  const language = (ctx.language ?? "").toLowerCase();
-  if (language !== "java")
-    return "TIER_UNKNOWN";
   if (!method)
     return "TIER_UNKNOWN";
+  const language = (ctx.language ?? "").toLowerCase();
+  switch (language) {
+    case "java":
+      return classifyJavaEntryPoint(method, enclosingType);
+    case "python":
+      return classifyPythonEntryPoint(method, enclosingType, ctx);
+    case "javascript":
+    case "typescript":
+    case "tsx":
+    case "jsx":
+      return classifyJsTsEntryPoint(method, enclosingType, ctx);
+    case "go":
+      return classifyGoEntryPoint(method, enclosingType, ctx);
+    case "bash":
+    case "shell":
+      return classifyBashEntryPoint(method, enclosingType, ctx);
+    default:
+      return "TIER_UNKNOWN";
+  }
+}
+function classifyJavaEntryPoint(method, enclosingType) {
   if (classShapeIsLibraryFacade(enclosingType)) {
     return "TIER_3_LIBRARY_API";
   }
@@ -18932,6 +18950,419 @@ function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingTy
   const tier = classifyEntryPointTier(enclosingMethod, enclosingType, ctx);
   return tier === "TIER_3_LIBRARY_API";
 }
+var POLYGLOT_LIBRARY_PATH_FRAGMENTS = [
+  "/lib/",
+  "/libapi/",
+  "/libs/",
+  "/utils/",
+  "/util/",
+  "/helpers/",
+  "/helper/",
+  "/interop/",
+  "/vendor/",
+  "/vendored/",
+  "/node_modules/",
+  "/dist/",
+  "/build/",
+  "/_internal/",
+  "/__tests__/",
+  "/tests/",
+  "/test/",
+  "/testing/",
+  "/spec/",
+  "/specs/",
+  "/fixtures/",
+  "/mocks/",
+  "/__mocks__/"
+];
+var POLYGLOT_TEST_FILE_MARKERS = [
+  ".test.",
+  ".spec.",
+  "_test.",
+  "_spec.",
+  ".tests."
+];
+function pathLooksLikeLibraryOrTest(filePath) {
+  if (!filePath)
+    return false;
+  const normalized = filePath.replace(/\\/g, "/").toLowerCase();
+  const padded = `/${normalized}/`;
+  for (const frag of POLYGLOT_LIBRARY_PATH_FRAGMENTS) {
+    if (padded.includes(frag))
+      return true;
+  }
+  const slash = normalized.lastIndexOf("/");
+  const base = slash >= 0 ? normalized.slice(slash + 1) : normalized;
+  for (const marker of POLYGLOT_TEST_FILE_MARKERS) {
+    if (base.includes(marker))
+      return true;
+  }
+  return false;
+}
+var PYTHON_TIER_1_DECORATOR_NAMES = new Set([
+  "route",
+  "get",
+  "post",
+  "put",
+  "delete",
+  "patch",
+  "options",
+  "head",
+  "before_request",
+  "after_request",
+  "errorhandler",
+  "teardown_request",
+  "websocket",
+  "websocket_route",
+  "api_route",
+  "middleware",
+  "login_required",
+  "csrf_exempt",
+  "csrf_protect",
+  "require_http_methods",
+  "require_GET",
+  "require_POST",
+  "require_safe",
+  "permission_required",
+  "user_passes_test",
+  "staff_member_required",
+  "api_view",
+  "action",
+  "detail_route",
+  "list_route",
+  "renderer_classes",
+  "authentication_classes",
+  "permission_classes",
+  "command",
+  "group",
+  "task",
+  "shared_task",
+  "periodic_task",
+  "actor",
+  "view",
+  "fixture"
+]);
+function classifyPythonEntryPoint(method, enclosingType, ctx) {
+  if (pathLooksLikeLibraryOrTest(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (pythonDecoratorLooksTier1(method.annotations)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodIsRuntimeRegistrationHandler(method, ctx.runtimeRegistrations)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (method.name === "main" && !enclosingType) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (method.name === "main" && enclosingType && looksLikeModuleType(enclosingType)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (method.name.startsWith("_") && !method.name.startsWith("__")) {
+    return "TIER_3_LIBRARY_API";
+  }
+  return "TIER_UNKNOWN";
+}
+function pythonDecoratorLooksTier1(annotations) {
+  if (!annotations || annotations.length === 0)
+    return false;
+  for (const raw of annotations) {
+    let name2 = raw.replace(/^@/, "").replace(/[<(].*$/, "").trim();
+    if (!name2)
+      continue;
+    const dot = name2.lastIndexOf(".");
+    if (dot >= 0)
+      name2 = name2.slice(dot + 1);
+    if (PYTHON_TIER_1_DECORATOR_NAMES.has(name2))
+      return true;
+  }
+  return false;
+}
+function looksLikeModuleType(t) {
+  return !t.extends && (!t.implements || t.implements.length === 0) && (!t.annotations || t.annotations.length === 0);
+}
+var JSTS_TIER_1_METHOD_DECORATORS = new Set([
+  "Get",
+  "Post",
+  "Put",
+  "Delete",
+  "Patch",
+  "Head",
+  "Options",
+  "All",
+  "SubscribeMessage",
+  "MessageBody",
+  "ConnectedSocket",
+  "EventPattern",
+  "MessagePattern",
+  "GrpcMethod",
+  "GrpcStreamMethod",
+  "HostListener"
+]);
+var JSTS_TIER_1_CLASS_DECORATORS = new Set([
+  "Controller",
+  "RestController",
+  "Resolver",
+  "WebSocketGateway",
+  "Gateway"
+]);
+var JSTS_TIER_1_MODULE_EXPORTS = new Set([
+  "handler",
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS",
+  "load",
+  "action",
+  "middleware"
+]);
+function classifyJsTsEntryPoint(method, enclosingType, ctx) {
+  if (pathLooksLikeLibraryOrTest(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (annotationsInclude(method.annotations, JSTS_TIER_1_METHOD_DECORATORS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (enclosingType && annotationsInclude(enclosingType.annotations, JSTS_TIER_1_CLASS_DECORATORS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodIsRuntimeRegistrationHandler(method, ctx.runtimeRegistrations)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (JSTS_TIER_1_MODULE_EXPORTS.has(method.name) && (!enclosingType || looksLikeModuleType(enclosingType))) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (method.name === "main" && (!enclosingType || looksLikeModuleType(enclosingType))) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_UNKNOWN";
+}
+var GO_HTTP_REGISTRAR_METHODS = new Set([
+  "HandleFunc",
+  "Handle",
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS",
+  "Any",
+  "Get",
+  "Post",
+  "Put",
+  "Delete",
+  "Patch",
+  "Head",
+  "Options",
+  "Route",
+  "Mount",
+  "Method"
+]);
+var GO_HTTP_REGISTRAR_RECEIVERS = [
+  "http",
+  "mux",
+  "router",
+  "r",
+  "e",
+  "g",
+  "app",
+  "engine",
+  "srv",
+  "server"
+];
+function classifyGoEntryPoint(method, enclosingType, ctx) {
+  if (pathLooksLikeLibraryOrTest(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (ctx.filePath && ctx.filePath.toLowerCase().endsWith("_test.go")) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (method.name === "main" && enclosingType?.package === "main") {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodHasNetHttpHandlerSignature(method)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodLooksLikeGrpcHandler(method, enclosingType)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodIsRegisteredByGoHttpFramework(method, ctx.calls)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_UNKNOWN";
+}
+function methodHasNetHttpHandlerSignature(method) {
+  const params = method.parameters ?? [];
+  if (params.length !== 2)
+    return false;
+  const p0 = normalizeGoType(params[0]?.type ?? "");
+  const p1 = normalizeGoType(params[1]?.type ?? "");
+  const p0IsWriter = p0.includes("http.ResponseWriter") || p0.endsWith("ResponseWriter");
+  const p1IsRequest = p1.includes("http.Request") || p1.endsWith("*Request") || p1.endsWith("Request");
+  return p0IsWriter && p1IsRequest;
+}
+function methodLooksLikeGrpcHandler(method, enclosingType) {
+  if (!enclosingType)
+    return false;
+  const params = method.parameters ?? [];
+  if (params.length < 2)
+    return false;
+  const p0 = normalizeGoType(params[0]?.type ?? "");
+  if (!p0.includes("context.Context") && !p0.endsWith("Context"))
+    return false;
+  const typeName = enclosingType.name ?? "";
+  if (!/(Server|Service|Handler)$/.test(typeName))
+    return false;
+  return true;
+}
+function normalizeGoType(t) {
+  return t.replace(/\s+/g, "").replace(/^\*+/, "");
+}
+function methodIsRegisteredByGoHttpFramework(method, calls) {
+  if (!calls || calls.length === 0)
+    return false;
+  for (const call of calls) {
+    if (!GO_HTTP_REGISTRAR_METHODS.has(call.method_name))
+      continue;
+    const receiver = call.receiver ?? "";
+    if (!goRegistrarReceiverMatches(receiver))
+      continue;
+    const args2 = call.arguments ?? [];
+    for (const arg of args2) {
+      const expr = (arg.expression ?? arg.variable ?? arg.value ?? "").trim();
+      if (!expr)
+        continue;
+      const short = expr.slice(expr.lastIndexOf(".") + 1);
+      if (short === method.name)
+        return true;
+    }
+  }
+  return false;
+}
+function goRegistrarReceiverMatches(receiver) {
+  const trimmed = receiver.trim();
+  if (!trimmed)
+    return false;
+  for (const target of GO_HTTP_REGISTRAR_RECEIVERS) {
+    if (trimmed === target)
+      return true;
+    if (trimmed.endsWith(`.${target}`))
+      return true;
+  }
+  return false;
+}
+var BASH_POSITIONAL_TOKENS = [
+  "$1",
+  "$2",
+  "$3",
+  "$4",
+  "$5",
+  "$6",
+  "$7",
+  "$8",
+  "$9",
+  "$@",
+  "$*",
+  "$#",
+  "${1",
+  "${2",
+  "${3",
+  "${@",
+  "getopts"
+];
+var BASH_LIBRARY_FILENAME_PREFIXES = [
+  "benign_",
+  "safe_",
+  "lib_",
+  "common_",
+  "helpers_",
+  "_"
+];
+function classifyBashEntryPoint(method, enclosingType, ctx) {
+  if (pathLooksLikeLibraryOrTest(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (bashFilenameLooksLikeLibrary(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (method.name === "main") {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodConsumesPositionalArgs(method, ctx.calls)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (enclosingType && looksLikeModuleType(enclosingType) && fileHasPositionalArgUse(ctx.calls)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_UNKNOWN";
+}
+function bashFilenameLooksLikeLibrary(filePath) {
+  if (!filePath)
+    return false;
+  const normalized = filePath.replace(/\\/g, "/");
+  const slash = normalized.lastIndexOf("/");
+  const base = (slash >= 0 ? normalized.slice(slash + 1) : normalized).toLowerCase();
+  for (const prefix of BASH_LIBRARY_FILENAME_PREFIXES) {
+    if (base.startsWith(prefix))
+      return true;
+  }
+  if (base.includes(".test.") || base.includes("_test."))
+    return true;
+  return false;
+}
+function methodConsumesPositionalArgs(method, calls) {
+  if (!calls || calls.length === 0)
+    return false;
+  for (const call of calls) {
+    if (call.location.line < method.start_line)
+      continue;
+    if (call.location.line > method.end_line)
+      continue;
+    if (callHasPositionalToken(call))
+      return true;
+  }
+  return false;
+}
+function fileHasPositionalArgUse(calls) {
+  if (!calls || calls.length === 0)
+    return false;
+  for (const call of calls) {
+    if (callHasPositionalToken(call))
+      return true;
+  }
+  return false;
+}
+function callHasPositionalToken(call) {
+  for (const arg of call.arguments ?? []) {
+    const expr = arg.expression ?? arg.variable ?? arg.value ?? "";
+    for (const tok of BASH_POSITIONAL_TOKENS) {
+      if (expr.includes(tok))
+        return true;
+    }
+  }
+  if (call.method_name === "getopts")
+    return true;
+  return false;
+}
+function methodIsRuntimeRegistrationHandler(method, regs) {
+  if (!regs || regs.length === 0)
+    return false;
+  for (const reg of regs) {
+    if (reg.kind !== "http_route" && reg.kind !== "decorator" && reg.kind !== "event_listener" && reg.kind !== "middleware") {
+      continue;
+    }
+    const handlerName = reg.handler?.name;
+    if (!handlerName)
+      continue;
+    if (handlerName === method.name)
+      return true;
+  }
+  return false;
+}
 
 // ../circle-ir/dist/analysis/require-entry-path.js
 var RULE_ID_REQUIRE_ENTRY_PATH = "require-entry-path";
@@ -18958,6 +19389,7 @@ var TAINT_FLOW_RULE_IDS = new Set([
   "mybatis_mapper_call",
   "external_taint_escape",
   "template_injection",
+  "xml_entity_expansion",
   "sql-injection",
   "nosql-injection",
   "command-injection",
@@ -18970,7 +19402,8 @@ var TAINT_FLOW_RULE_IDS = new Set([
   "format-string",
   "mass-assignment",
   "template-injection",
-  "insecure-deserialization"
+  "insecure-deserialization",
+  "xml-entity-expansion"
 ]);
 function applyRequireEntryPath(fileAnalyses, options = {}) {
   const disabledSet = normalizeDisabled(options.disabledPasses);
@@ -18979,7 +19412,9 @@ function applyRequireEntryPath(fileAnalyses, options = {}) {
   const graph = buildProjectMethodGraph(fileAnalyses);
   if (graph.methodsByKey.size === 0)
     return;
-  const entryPointKeys = collectEntryPointKeys(graph);
+  const fileContext = buildFileContext(fileAnalyses);
+  const entryPointKeys = collectEntryPointKeys(graph, fileContext);
+  const entryPointKeysByLanguage = countEntryPointKeysByLanguage(graph, entryPointKeys);
   const profileResolver = makeProfileResolver(options.projectProfile);
   for (const fa of fileAnalyses) {
     const findings = fa.analysis.findings;
@@ -18987,7 +19422,7 @@ function applyRequireEntryPath(fileAnalyses, options = {}) {
       continue;
     const kept = [];
     for (const finding of findings) {
-      const decision = classifyFinding(finding, fa.analysis, graph, entryPointKeys, profileResolver(fa.file));
+      const decision = classifyFinding(finding, fa.analysis, graph, entryPointKeys, entryPointKeysByLanguage, profileResolver(fa.file));
       switch (decision.action) {
         case "keep":
           kept.push(finding);
@@ -19092,27 +19527,66 @@ function resolveCalleeKeys(call, methodsByKey, methodsByName) {
   }
   return candidates;
 }
-function collectEntryPointKeys(graph) {
+function collectEntryPointKeys(graph, fileContext) {
   const entryPoints = new Set;
   for (const rec of graph.methodsByKey.values()) {
+    const fileCtx = fileContext.get(rec.file);
     const tier = classifyEntryPointTier(rec.method, rec.enclosingType, {
       types: [rec.enclosingType],
-      language: rec.language
+      language: rec.language,
+      filePath: rec.file,
+      calls: fileCtx?.calls ?? null,
+      runtimeRegistrations: fileCtx?.runtimeRegistrations ?? null
     });
     if (tier === "TIER_1_ENTRY_POINT")
       entryPoints.add(rec.key);
   }
   return entryPoints;
 }
-function classifyFinding(finding, ir, graph, entryPointKeys, profile) {
+function buildFileContext(fileAnalyses) {
+  const out2 = new Map;
+  for (const fa of fileAnalyses) {
+    out2.set(fa.file, {
+      language: (fa.analysis.meta.language ?? "").toLowerCase(),
+      calls: fa.analysis.calls ?? null,
+      runtimeRegistrations: fa.analysis.runtime_registrations ?? null
+    });
+  }
+  return out2;
+}
+function countEntryPointKeysByLanguage(graph, entryPointKeys) {
+  const out2 = new Map;
+  for (const key of entryPointKeys) {
+    const rec = graph.methodsByKey.get(key);
+    if (!rec)
+      continue;
+    out2.set(rec.language, (out2.get(rec.language) ?? 0) + 1);
+  }
+  return out2;
+}
+var SUPPORTED_LANGUAGES = new Set([
+  "java",
+  "python",
+  "javascript",
+  "typescript",
+  "tsx",
+  "jsx",
+  "go",
+  "bash",
+  "shell"
+]);
+function classifyFinding(finding, ir, graph, entryPointKeys, entryPointKeysByLanguage, profile) {
   if (finding.category !== "security")
     return { action: "keep" };
   if (!TAINT_FLOW_RULE_IDS.has(finding.rule_id))
     return { action: "keep" };
   const isHighOrCritical = finding.severity === "high" || finding.severity === "critical";
   const language = (ir.meta.language ?? "").toLowerCase();
-  if (language !== "java")
+  if (!SUPPORTED_LANGUAGES.has(language))
+    return { action: "keep" };
+  if ((entryPointKeysByLanguage.get(language) ?? 0) === 0) {
     return { action: "keep" };
+  }
   const containing = findContainingMethod(finding, ir, graph);
   if (!containing) {
     return { action: "keep" };
@@ -33524,7 +33998,13 @@ class InterproceduralPass {
                 continue;
               if (this.enableEntryPointGate && source.type === "interprocedural_param" && source.in_method) {
                 const enclosing = methodNameIndex.get(source.in_method);
-                if (shouldGateInterproceduralParam(source.type, enclosing?.method, enclosing?.type, { language, types: graph.ir.types })) {
+                if (shouldGateInterproceduralParam(source.type, enclosing?.method, enclosing?.type, {
+                  language,
+                  types: graph.ir.types,
+                  filePath: graph.ir.meta.file,
+                  calls: graph.ir.calls,
+                  runtimeRegistrations: graph.ir.runtime_registrations ?? null
+                })) {
                   continue;
                 }
               }
@@ -43984,7 +44464,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.165.0";
+var version = "3.166.1";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.165.0",
+  "version": "3.166.1",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.165.0"
+    "circle-ir": "^3.166.1"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",