cognium-dev 3.167.0 → 3.168.0

package/dist/cli.js

@@ -13624,6 +13624,66 @@ function formatCallCode(call) {
   }
   return `${call.method_name}(${args2})`;
 }
+// ../circle-ir/dist/analysis/non-executable-lines.js
+function isNonExecutableSourceLine(sourceCode, line, language) {
+  if (!sourceCode || line < 1)
+    return false;
+  const lines = sourceCode.split(`
+`);
+  if (line > lines.length)
+    return false;
+  const raw = lines[line - 1] ?? "";
+  const trimmed = raw.trim();
+  if (trimmed === "")
+    return true;
+  const lang = language.toLowerCase();
+  if (trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*/") || trimmed.startsWith("*") || trimmed === "/**") {
+    return true;
+  }
+  switch (lang) {
+    case "java":
+    case "javascript":
+    case "typescript":
+    case "go":
+    case "rust":
+      return isNonExecutableCurly(trimmed);
+    case "python":
+      return isNonExecutablePython(trimmed);
+    default:
+      return false;
+  }
+}
+function isNonExecutableCurly(trimmed) {
+  if (/^(import|package|use|from)\s/.test(trimmed))
+    return true;
+  if (/^@[A-Za-z_][\w.]*(?:\s*\([^)]*\))?\s*$/.test(trimmed))
+    return true;
+  if (/^(?:(?:public|private|protected|internal)\s+)?(?:static\s+)?(?:final\s+|readonly\s+|const\s+)(?:[A-Za-z_][\w<>.\[\]]*\s+)?[A-Za-z_]\w*(?:\s*:\s*[^=]+)?\s*=\s*(?:["'`][^"'`]*["'`]|-?\d+(?:\.\d+)?)\s*;?\s*$/.test(trimmed)) {
+    return true;
+  }
+  if (/^(?:const|let|var|static)\s+[A-Za-z_]\w*(?:\s*:\s*[^=]+)?\s*=\s*(?:["'`][^"'`]*["'`]|-?\d+(?:\.\d+)?)\s*;?\s*$/.test(trimmed)) {
+    return true;
+  }
+  if (/^(?:(?:public|private|protected)\s+)?(?:static\s+)?(?:final\s+)[A-Za-z_][\w<>.\[\]]*\s+[A-Za-z_]\w*\s*;\s*$/.test(trimmed)) {
+    return true;
+  }
+  return false;
+}
+function isNonExecutablePython(trimmed) {
+  if (/^(import|from)\s/.test(trimmed))
+    return true;
+  if (trimmed.startsWith("#"))
+    return true;
+  if (trimmed === '"""' || trimmed === "'''")
+    return true;
+  if (/^@[A-Za-z_][\w.]*(?:\s*\([^)]*\))?\s*$/.test(trimmed))
+    return true;
+  if (/^[A-Z_][A-Z0-9_]*\s*(?::\s*[^=]+)?\s*=\s*(?:["'][^"']*["']|-?\d+(?:\.\d+)?)\s*$/.test(trimmed)) {
+    return true;
+  }
+  return false;
+}
+
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
@@ -30930,7 +30990,8 @@ class SinkFilterPass {
     const taintMatcher = ctx.getResult("taint-matcher");
     const constProp = ctx.getResult("constant-propagation");
     const langSources = ctx.getResult("language-sources");
-    const sources = [...taintMatcher.sources, ...langSources.additionalSources];
+    const mergedSources = [...taintMatcher.sources, ...langSources.additionalSources];
+    const sources = ctx.code && ctx.language ? mergedSources.filter((s) => !isNonExecutableSourceLine(ctx.code, s.line, ctx.language)) : mergedSources;
     const sinks = [...taintMatcher.sinks];
     for (const s of langSources.additionalSinks) {
       if (!sinks.some((x) => x.line === s.line && x.cwe === s.cwe && x.type === s.type)) {
@@ -44534,7 +44595,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.167.0";
+var version = "3.168.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.167.0",
+  "version": "3.168.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.167.0"
+    "circle-ir": "^3.168.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",