cognium-dev 3.175.0 → 3.176.0

package/dist/cli.js

@@ -11948,6 +11948,84 @@ var DEFAULT_HEADER_RULES = [
     note: "Fires when the value is not a string literal (likely reflected from request)"
   }
 ];
+// ../circle-ir/dist/analysis/arg-type-resolver.js
+function findEnclosingType(callInMethod, types) {
+  if (!callInMethod)
+    return null;
+  for (const t of types) {
+    for (const m of t.methods) {
+      if (m.name === callInMethod)
+        return t;
+    }
+  }
+  return null;
+}
+function resolveIdentifierType(name2, callInMethod, types) {
+  if (!name2)
+    return null;
+  const enclosing = findEnclosingType(callInMethod, types);
+  if (enclosing) {
+    for (const m of enclosing.methods) {
+      if (m.name !== callInMethod)
+        continue;
+      for (const p of m.parameters) {
+        if (p.name === name2 && p.type)
+          return p.type;
+      }
+    }
+    for (const f of enclosing.fields) {
+      if (f.name === name2 && f.type)
+        return f.type;
+    }
+    return null;
+  }
+  for (const t of types) {
+    for (const m of t.methods) {
+      for (const p of m.parameters) {
+        if (p.name === name2 && p.type)
+          return p.type;
+      }
+    }
+    for (const f of t.fields) {
+      if (f.name === name2 && f.type)
+        return f.type;
+    }
+  }
+  return null;
+}
+function resolveCallReturnType(calleeName, callInMethod, types) {
+  if (!calleeName)
+    return null;
+  const enclosing = findEnclosingType(callInMethod, types);
+  if (enclosing) {
+    for (const m of enclosing.methods) {
+      if (m.name === calleeName && m.return_type)
+        return m.return_type;
+    }
+  }
+  for (const t of types) {
+    for (const m of t.methods) {
+      if (m.name === calleeName && m.return_type)
+        return m.return_type;
+    }
+  }
+  return null;
+}
+function isBoundedClassType(rawType) {
+  if (!rawType)
+    return false;
+  const stripped = rawType.trim().replace(/^(?:java\.lang\.)+/, "");
+  return /^Class(?:\s*<[\s\S]*>)?$/.test(stripped);
+}
+function isArgvContainerType(rawType) {
+  if (!rawType)
+    return false;
+  const s = rawType.trim().replace(/^(?:java\.util\.|java\.lang\.)+/, "");
+  if (/^String\s*(?:\[\s*\]|\.\.\.)$/.test(s))
+    return true;
+  return /^(?:List|ArrayList|LinkedList|Collection|Iterable|Deque|Queue)\s*<\s*(?:String|CharSequence|java\.lang\.String)\b/.test(s);
+}
+
 // ../circle-ir/dist/analysis/taint-matcher.js
 var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.args\b/, sourceType: "http_param" },
@@ -11971,7 +12049,7 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sources = findSources(calls, types, config.sources, sourceLines, language);
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
-  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
+  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
@@ -12587,7 +12665,7 @@ function isSafeRustCommandCall(call, pattern, language) {
   return false;
 }
 var CLASS_LITERAL_RE = /^(?:[A-Za-z_][\w]*\.)*[A-Z][\w]*(?:\[\])*\.class$/;
-function argIsClassLiteral(call, position) {
+function argIsClassLiteral(call, position, types) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg)
     return false;
@@ -12596,7 +12674,28 @@ function argIsClassLiteral(call, position) {
     return false;
   if (CLASS_LITERAL_RE.test(expr))
     return true;
-  return TYPE_TOKEN_RE.test(expr);
+  if (TYPE_TOKEN_RE.test(expr))
+    return true;
+  if (!types || types.length === 0)
+    return false;
+  const argExpr = (arg.expression ?? "").trim();
+  const varName = arg.variable ?? "";
+  const isBareIdentifier = varName !== "" && argExpr === varName && !/[(.]/.test(argExpr);
+  if (isBareIdentifier) {
+    const t = resolveIdentifierType(varName, call.in_method, types);
+    if (isBoundedClassType(t))
+      return true;
+  }
+  const isCallExpr = varName !== "" && new RegExp(`^${escapeRe(varName)}\\s*\\(`).test(argExpr);
+  if (isCallExpr) {
+    const t = resolveCallReturnType(varName, call.in_method, types);
+    if (isBoundedClassType(t))
+      return true;
+  }
+  return false;
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
 function argIsStringLiteral(call, position) {
@@ -12779,7 +12878,7 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
-function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
+function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
   const sinkMap = new Map;
   for (const call of calls) {
     for (const pattern of patterns) {
@@ -12799,7 +12898,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeJSChildProcessCall(call, pattern, language)) {
           continue;
         }
-        if (pattern.safe_if_class_literal_at !== undefined && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
+        if (pattern.safe_if_class_literal_at !== undefined && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }
         if (pattern.safe_if_string_literal_at !== undefined && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
@@ -30796,6 +30895,9 @@ class MyBatisAnnotationSqlSinkPass {
 }
 
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
+function escapeReSf(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 var JS_XSS_SANITIZERS = [
   /\bDOMPurify\.sanitize\s*\(/,
   /\bsanitizeHtml\s*\(/,
@@ -31425,6 +31527,8 @@ class SinkFilterPass {
     if (language === "java") {
       const sourceLines = ctx.code.split(`
 `);
+      const irCalls = ctx.graph.ir.calls;
+      const irTypes = ctx.graph.ir.types;
       filtered = filtered.filter((sink) => {
         if (sink.type !== "command_injection")
           return true;
@@ -31435,6 +31539,24 @@ class SinkFilterPass {
           return true;
         if (PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText))
           return false;
+        const ctorCall = irCalls.find((c) => c.method_name === "ProcessBuilder" && c.location.line === sink.line && (c.receiver === null || c.receiver === undefined));
+        if (!ctorCall || ctorCall.arguments.length === 0)
+          return true;
+        const arg0 = ctorCall.arguments[0];
+        if (!arg0)
+          return true;
+        const argExpr = (arg0.expression ?? "").trim();
+        const varName = arg0.variable ?? "";
+        if (varName !== "" && argExpr === varName && !/[(.]/.test(argExpr)) {
+          const t = resolveIdentifierType(varName, ctorCall.in_method, irTypes);
+          if (isArgvContainerType(t))
+            return false;
+        }
+        if (varName !== "" && new RegExp(`^${escapeReSf(varName)}\\s*\\(`).test(argExpr)) {
+          const t = resolveCallReturnType(varName, ctorCall.in_method, irTypes);
+          if (isArgvContainerType(t))
+            return false;
+        }
         return true;
       });
     }
@@ -44796,7 +44918,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.175.0";
+var version = "3.176.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.175.0",
+  "version": "3.176.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.175.0"
+    "circle-ir": "^3.176.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",