cognium-dev 3.166.1 → 3.168.0

package/dist/cli.js

@@ -13624,6 +13624,66 @@ function formatCallCode(call) {
   }
   return `${call.method_name}(${args2})`;
 }
+// ../circle-ir/dist/analysis/non-executable-lines.js
+function isNonExecutableSourceLine(sourceCode, line, language) {
+  if (!sourceCode || line < 1)
+    return false;
+  const lines = sourceCode.split(`
+`);
+  if (line > lines.length)
+    return false;
+  const raw = lines[line - 1] ?? "";
+  const trimmed = raw.trim();
+  if (trimmed === "")
+    return true;
+  const lang = language.toLowerCase();
+  if (trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*/") || trimmed.startsWith("*") || trimmed === "/**") {
+    return true;
+  }
+  switch (lang) {
+    case "java":
+    case "javascript":
+    case "typescript":
+    case "go":
+    case "rust":
+      return isNonExecutableCurly(trimmed);
+    case "python":
+      return isNonExecutablePython(trimmed);
+    default:
+      return false;
+  }
+}
+function isNonExecutableCurly(trimmed) {
+  if (/^(import|package|use|from)\s/.test(trimmed))
+    return true;
+  if (/^@[A-Za-z_][\w.]*(?:\s*\([^)]*\))?\s*$/.test(trimmed))
+    return true;
+  if (/^(?:(?:public|private|protected|internal)\s+)?(?:static\s+)?(?:final\s+|readonly\s+|const\s+)(?:[A-Za-z_][\w<>.\[\]]*\s+)?[A-Za-z_]\w*(?:\s*:\s*[^=]+)?\s*=\s*(?:["'`][^"'`]*["'`]|-?\d+(?:\.\d+)?)\s*;?\s*$/.test(trimmed)) {
+    return true;
+  }
+  if (/^(?:const|let|var|static)\s+[A-Za-z_]\w*(?:\s*:\s*[^=]+)?\s*=\s*(?:["'`][^"'`]*["'`]|-?\d+(?:\.\d+)?)\s*;?\s*$/.test(trimmed)) {
+    return true;
+  }
+  if (/^(?:(?:public|private|protected)\s+)?(?:static\s+)?(?:final\s+)[A-Za-z_][\w<>.\[\]]*\s+[A-Za-z_]\w*\s*;\s*$/.test(trimmed)) {
+    return true;
+  }
+  return false;
+}
+function isNonExecutablePython(trimmed) {
+  if (/^(import|from)\s/.test(trimmed))
+    return true;
+  if (trimmed.startsWith("#"))
+    return true;
+  if (trimmed === '"""' || trimmed === "'''")
+    return true;
+  if (/^@[A-Za-z_][\w.]*(?:\s*\([^)]*\))?\s*$/.test(trimmed))
+    return true;
+  if (/^[A-Z_][A-Z0-9_]*\s*(?::\s*[^=]+)?\s*=\s*(?:["'][^"']*["']|-?\d+(?:\.\d+)?)\s*$/.test(trimmed)) {
+    return true;
+  }
+  return false;
+}
+
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
@@ -19132,6 +19192,9 @@ function classifyJsTsEntryPoint(method, enclosingType, ctx) {
   if (methodIsRuntimeRegistrationHandler(method, ctx.runtimeRegistrations)) {
     return "TIER_1_ENTRY_POINT";
   }
+  if (fileHasJsTsFrameworkRegistration(ctx.runtimeRegistrations) && (!enclosingType || looksLikeModuleType(enclosingType))) {
+    return "TIER_1_ENTRY_POINT";
+  }
   if (JSTS_TIER_1_MODULE_EXPORTS.has(method.name) && (!enclosingType || looksLikeModuleType(enclosingType))) {
     return "TIER_1_ENTRY_POINT";
   }
@@ -19140,6 +19203,25 @@ function classifyJsTsEntryPoint(method, enclosingType, ctx) {
   }
   return "TIER_UNKNOWN";
 }
+var JSTS_FILE_LEVEL_TIER_1_FRAMEWORKS = new Set([
+  "express",
+  "fastify",
+  "koa",
+  "nestjs"
+]);
+function fileHasJsTsFrameworkRegistration(regs) {
+  if (!regs || regs.length === 0)
+    return false;
+  for (const reg of regs) {
+    if (reg.kind !== "http_route" && reg.kind !== "middleware" && reg.kind !== "event_listener") {
+      continue;
+    }
+    if (reg.framework && JSTS_FILE_LEVEL_TIER_1_FRAMEWORKS.has(reg.framework)) {
+      return true;
+    }
+  }
+  return false;
+}
 var GO_HTTP_REGISTRAR_METHODS = new Set([
   "HandleFunc",
   "Handle",
@@ -19417,30 +19499,78 @@ function applyRequireEntryPath(fileAnalyses, options = {}) {
   const entryPointKeysByLanguage = countEntryPointKeysByLanguage(graph, entryPointKeys);
   const profileResolver = makeProfileResolver(options.projectProfile);
   for (const fa of fileAnalyses) {
+    const profile = profileResolver(fa.file);
     const findings = fa.analysis.findings;
-    if (!findings || findings.length === 0)
-      continue;
-    const kept = [];
-    for (const finding of findings) {
-      const decision = classifyFinding(finding, fa.analysis, graph, entryPointKeys, entryPointKeysByLanguage, profileResolver(fa.file));
-      switch (decision.action) {
-        case "keep":
-          kept.push(finding);
-          break;
-        case "annotate":
-          kept.push({
-            ...finding,
-            entryPath: decision.entryPath,
-            entryPathTier: decision.tier
-          });
-          break;
-        case "drop":
-          break;
+    if (findings && findings.length > 0) {
+      const kept = [];
+      for (const finding of findings) {
+        const decision = classifyFinding(finding, fa.analysis, graph, entryPointKeys, entryPointKeysByLanguage, profile);
+        switch (decision.action) {
+          case "keep":
+            kept.push(finding);
+            break;
+          case "annotate":
+            kept.push({
+              ...finding,
+              entryPath: decision.entryPath,
+              entryPathTier: decision.tier
+            });
+            break;
+          case "drop":
+            break;
+        }
+      }
+      fa.analysis.findings = kept.length > 0 ? kept : undefined;
+    }
+    const flows = fa.analysis.taint?.flows;
+    if (flows && flows.length > 0) {
+      const keptFlows = [];
+      for (const flow of flows) {
+        const pseudo = flowToPseudoFinding(fa.file, flow);
+        if (!pseudo) {
+          keptFlows.push(flow);
+          continue;
+        }
+        const decision = classifyFinding(pseudo, fa.analysis, graph, entryPointKeys, entryPointKeysByLanguage, profile);
+        if (decision.action !== "drop")
+          keptFlows.push(flow);
       }
+      fa.analysis.taint.flows = keptFlows;
     }
-    fa.analysis.findings = kept.length > 0 ? kept : undefined;
   }
 }
+var SINK_HC_SEVERITY = {
+  sql_injection: "critical",
+  nosql_injection: "high",
+  command_injection: "critical",
+  path_traversal: "high",
+  xss: "high",
+  xxe: "critical",
+  deserialization: "critical",
+  ldap_injection: "high",
+  xpath_injection: "high",
+  ssrf: "high",
+  code_injection: "critical",
+  format_string: "high",
+  mass_assignment: "high"
+};
+function flowToPseudoFinding(file, flow) {
+  const severity = SINK_HC_SEVERITY[flow.sink_type];
+  if (!severity)
+    return null;
+  return {
+    id: `taint-flow:${file}:${flow.sink_line}:${flow.sink_type}`,
+    pass: "taint-propagation",
+    category: "security",
+    rule_id: flow.sink_type,
+    cwe: "",
+    severity,
+    level: "error",
+    message: `${flow.sink_type} at line ${flow.sink_line}`,
+    file,
+    line: flow.sink_line
+  };
+}
 function buildProjectMethodGraph(fileAnalyses) {
   const methodsByKey = new Map;
   const methodsByName = new Map;
@@ -30860,7 +30990,8 @@ class SinkFilterPass {
     const taintMatcher = ctx.getResult("taint-matcher");
     const constProp = ctx.getResult("constant-propagation");
     const langSources = ctx.getResult("language-sources");
-    const sources = [...taintMatcher.sources, ...langSources.additionalSources];
+    const mergedSources = [...taintMatcher.sources, ...langSources.additionalSources];
+    const sources = ctx.code && ctx.language ? mergedSources.filter((s) => !isNonExecutableSourceLine(ctx.code, s.line, ctx.language)) : mergedSources;
     const sinks = [...taintMatcher.sinks];
     for (const s of langSources.additionalSinks) {
       if (!sinks.some((x) => x.line === s.line && x.cwe === s.cwe && x.type === s.type)) {
@@ -44464,7 +44595,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.166.1";
+var version = "3.168.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.166.1",
+  "version": "3.168.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.166.1"
+    "circle-ir": "^3.168.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",