cognium-dev 3.166.0 → 3.167.0

package/dist/cli.js

@@ -19132,6 +19132,9 @@ function classifyJsTsEntryPoint(method, enclosingType, ctx) {
   if (methodIsRuntimeRegistrationHandler(method, ctx.runtimeRegistrations)) {
     return "TIER_1_ENTRY_POINT";
   }
+  if (fileHasJsTsFrameworkRegistration(ctx.runtimeRegistrations) && (!enclosingType || looksLikeModuleType(enclosingType))) {
+    return "TIER_1_ENTRY_POINT";
+  }
   if (JSTS_TIER_1_MODULE_EXPORTS.has(method.name) && (!enclosingType || looksLikeModuleType(enclosingType))) {
     return "TIER_1_ENTRY_POINT";
   }
@@ -19140,6 +19143,25 @@ function classifyJsTsEntryPoint(method, enclosingType, ctx) {
   }
   return "TIER_UNKNOWN";
 }
+var JSTS_FILE_LEVEL_TIER_1_FRAMEWORKS = new Set([
+  "express",
+  "fastify",
+  "koa",
+  "nestjs"
+]);
+function fileHasJsTsFrameworkRegistration(regs) {
+  if (!regs || regs.length === 0)
+    return false;
+  for (const reg of regs) {
+    if (reg.kind !== "http_route" && reg.kind !== "middleware" && reg.kind !== "event_listener") {
+      continue;
+    }
+    if (reg.framework && JSTS_FILE_LEVEL_TIER_1_FRAMEWORKS.has(reg.framework)) {
+      return true;
+    }
+  }
+  return false;
+}
 var GO_HTTP_REGISTRAR_METHODS = new Set([
   "HandleFunc",
   "Handle",
@@ -19389,6 +19411,7 @@ var TAINT_FLOW_RULE_IDS = new Set([
   "mybatis_mapper_call",
   "external_taint_escape",
   "template_injection",
+  "xml_entity_expansion",
   "sql-injection",
   "nosql-injection",
   "command-injection",
@@ -19401,7 +19424,8 @@ var TAINT_FLOW_RULE_IDS = new Set([
   "format-string",
   "mass-assignment",
   "template-injection",
-  "insecure-deserialization"
+  "insecure-deserialization",
+  "xml-entity-expansion"
 ]);
 function applyRequireEntryPath(fileAnalyses, options = {}) {
   const disabledSet = normalizeDisabled(options.disabledPasses);
@@ -19415,30 +19439,78 @@ function applyRequireEntryPath(fileAnalyses, options = {}) {
   const entryPointKeysByLanguage = countEntryPointKeysByLanguage(graph, entryPointKeys);
   const profileResolver = makeProfileResolver(options.projectProfile);
   for (const fa of fileAnalyses) {
+    const profile = profileResolver(fa.file);
     const findings = fa.analysis.findings;
-    if (!findings || findings.length === 0)
-      continue;
-    const kept = [];
-    for (const finding of findings) {
-      const decision = classifyFinding(finding, fa.analysis, graph, entryPointKeys, entryPointKeysByLanguage, profileResolver(fa.file));
-      switch (decision.action) {
-        case "keep":
-          kept.push(finding);
-          break;
-        case "annotate":
-          kept.push({
-            ...finding,
-            entryPath: decision.entryPath,
-            entryPathTier: decision.tier
-          });
-          break;
-        case "drop":
-          break;
+    if (findings && findings.length > 0) {
+      const kept = [];
+      for (const finding of findings) {
+        const decision = classifyFinding(finding, fa.analysis, graph, entryPointKeys, entryPointKeysByLanguage, profile);
+        switch (decision.action) {
+          case "keep":
+            kept.push(finding);
+            break;
+          case "annotate":
+            kept.push({
+              ...finding,
+              entryPath: decision.entryPath,
+              entryPathTier: decision.tier
+            });
+            break;
+          case "drop":
+            break;
+        }
       }
+      fa.analysis.findings = kept.length > 0 ? kept : undefined;
+    }
+    const flows = fa.analysis.taint?.flows;
+    if (flows && flows.length > 0) {
+      const keptFlows = [];
+      for (const flow of flows) {
+        const pseudo = flowToPseudoFinding(fa.file, flow);
+        if (!pseudo) {
+          keptFlows.push(flow);
+          continue;
+        }
+        const decision = classifyFinding(pseudo, fa.analysis, graph, entryPointKeys, entryPointKeysByLanguage, profile);
+        if (decision.action !== "drop")
+          keptFlows.push(flow);
+      }
+      fa.analysis.taint.flows = keptFlows;
     }
-    fa.analysis.findings = kept.length > 0 ? kept : undefined;
   }
 }
+var SINK_HC_SEVERITY = {
+  sql_injection: "critical",
+  nosql_injection: "high",
+  command_injection: "critical",
+  path_traversal: "high",
+  xss: "high",
+  xxe: "critical",
+  deserialization: "critical",
+  ldap_injection: "high",
+  xpath_injection: "high",
+  ssrf: "high",
+  code_injection: "critical",
+  format_string: "high",
+  mass_assignment: "high"
+};
+function flowToPseudoFinding(file, flow) {
+  const severity = SINK_HC_SEVERITY[flow.sink_type];
+  if (!severity)
+    return null;
+  return {
+    id: `taint-flow:${file}:${flow.sink_line}:${flow.sink_type}`,
+    pass: "taint-propagation",
+    category: "security",
+    rule_id: flow.sink_type,
+    cwe: "",
+    severity,
+    level: "error",
+    message: `${flow.sink_type} at line ${flow.sink_line}`,
+    file,
+    line: flow.sink_line
+  };
+}
 function buildProjectMethodGraph(fileAnalyses) {
   const methodsByKey = new Map;
   const methodsByName = new Map;
@@ -44462,7 +44534,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.166.0";
+var version = "3.167.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.166.0",
+  "version": "3.167.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.166.0"
+    "circle-ir": "^3.167.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",