cognium-dev 3.176.0 → 3.178.0

package/dist/cli.js

@@ -6725,8 +6725,16 @@ function extractGoCallInfo(node) {
   if (funcNode.type === "selector_expression") {
     const operand = funcNode.childForFieldName("operand");
     const field = funcNode.childForFieldName("field");
-    receiver = operand ? getNodeText(operand) : null;
     methodName = field ? getNodeText(field) : getNodeText(funcNode);
+    if (operand) {
+      const opText = getNodeText(operand);
+      if (operand.type === "identifier") {
+        const resolved = resolveGoLocalReceiverType(opText, node);
+        receiver = resolved !== null ? resolved : opText;
+      } else {
+        receiver = opText;
+      }
+    }
   } else if (funcNode.type === "identifier") {
     methodName = getNodeText(funcNode);
   } else {
@@ -6806,6 +6814,89 @@ function findGoEnclosingFunction(node) {
   }
   return null;
 }
+function resolveGoLocalReceiverType(operandName, callNode) {
+  let cur = callNode.parent;
+  while (cur) {
+    if (cur.type === "method_declaration") {
+      const receiver = cur.childForFieldName("receiver");
+      if (receiver) {
+        const t = extractGoParamTypeForName(receiver, operandName);
+        if (t !== null)
+          return t;
+      }
+      const params = cur.childForFieldName("parameters");
+      if (params) {
+        const t = extractGoParamTypeForName(params, operandName);
+        if (t !== null)
+          return t;
+      }
+      return null;
+    }
+    if (cur.type === "function_declaration" || cur.type === "func_literal") {
+      const params = cur.childForFieldName("parameters");
+      if (params) {
+        const t = extractGoParamTypeForName(params, operandName);
+        if (t !== null)
+          return t;
+      }
+      return null;
+    }
+    cur = cur.parent;
+  }
+  return null;
+}
+function extractGoParamTypeForName(list, operandName) {
+  for (let i2 = 0;i2 < list.namedChildCount; i2++) {
+    const child = list.namedChild(i2);
+    if (!child || child.type !== "parameter_declaration")
+      continue;
+    const typeNode = child.childForFieldName("type");
+    if (!typeNode)
+      continue;
+    let matched = false;
+    for (let j = 0;j < child.namedChildCount; j++) {
+      const c = child.namedChild(j);
+      if (!c)
+        continue;
+      if (c.type === "identifier" && getNodeText(c) === operandName) {
+        matched = true;
+        break;
+      }
+      if (c.type === "identifier_list") {
+        for (let k = 0;k < c.namedChildCount; k++) {
+          const id = c.namedChild(k);
+          if (id && id.type === "identifier" && getNodeText(id) === operandName) {
+            matched = true;
+            break;
+          }
+        }
+        if (matched)
+          break;
+      }
+    }
+    if (!matched)
+      continue;
+    return extractGoTypeLastSegment(typeNode);
+  }
+  return null;
+}
+function extractGoTypeLastSegment(typeNode) {
+  if (typeNode.type === "pointer_type") {
+    const inner = typeNode.namedChild(0);
+    return inner ? extractGoTypeLastSegment(inner) : null;
+  }
+  if (typeNode.type === "qualified_type") {
+    const name2 = typeNode.childForFieldName("name");
+    if (name2)
+      return getNodeText(name2);
+    const last = typeNode.namedChild(typeNode.namedChildCount - 1);
+    return last ? getNodeText(last) : null;
+  }
+  if (typeNode.type === "type_identifier" || typeNode.type === "identifier") {
+    return getNodeText(typeNode);
+  }
+  return null;
+}
 // ../circle-ir/dist/core/extractors/imports.js
 function detectLanguage2(tree) {
   const root = tree.rootNode;
@@ -7583,10 +7674,10 @@ function buildCFG(tree, language, cache) {
   const allEdges = [];
   let blockIdCounter = 0;
   if (effectiveLanguage === "bash") {
-    return buildBashCFG(tree, blockIdCounter);
+    return buildBashCFG(tree, blockIdCounter, cache);
   }
   if (effectiveLanguage === "go") {
-    return buildGoCFG(tree, blockIdCounter);
+    return buildGoCFG(tree, blockIdCounter, cache);
   }
   if (isJavaScript) {
     const functions = [
@@ -7946,11 +8037,11 @@ function processSwitchStatement(stmt, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function buildBashCFG(tree, startId) {
+function buildBashCFG(tree, startId, cache) {
   const allBlocks = [];
   const allEdges = [];
   let blockIdCounter = startId;
-  const functions = findNodes(tree.rootNode, "function_definition");
+  const functions = getNodesFromCache(tree.rootNode, "function_definition", cache);
   for (const func2 of functions) {
     const body2 = func2.childForFieldName("body");
     if (!body2)
@@ -8068,12 +8159,12 @@ function isStatement(node, isJavaScript) {
   ]);
   return isJavaScript ? jsStatementTypes.has(node.type) : javaStatementTypes.has(node.type);
 }
-function buildGoCFG(tree, blockIdCounter) {
+function buildGoCFG(tree, blockIdCounter, cache) {
   const allBlocks = [];
   const allEdges = [];
   const functions = [
-    ...findNodes(tree.rootNode, "function_declaration"),
-    ...findNodes(tree.rootNode, "method_declaration")
+    ...getNodesFromCache(tree.rootNode, "function_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "method_declaration", cache)
   ];
   for (const func2 of functions) {
     const body2 = func2.childForFieldName("body");
@@ -10568,6 +10659,40 @@ var OPEN_REDIRECT_FRAMEWORK_SINKS = [
   { method: "Redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [1], languages: ["go"] },
   { method: "Redirect", class: "Ctx", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["go"] }
 ];
+var DESERIALIZATION_FRAMEWORK_SINKS = [
+  { method: "loads", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "load", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "loads", class: "cPickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "load", class: "cPickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "loads", class: "marshal", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "load", class: "marshal", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "loads", class: "dill", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "load", class: "dill", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "decode", class: "jsonpickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "Decode", class: "Decoder", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], languages: ["go"] },
+  { method: "Unmarshal", class: "yaml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], languages: ["go"] },
+  { method: "unserialize", class: "nodeSerialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] }
+];
+var NOSQL_FRAMEWORK_SINKS = [
+  { method: "find", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "find_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "update_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0, 1], languages: ["python"] },
+  { method: "update_many", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0, 1], languages: ["python"] },
+  { method: "delete_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "delete_many", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "count_documents", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "find", class: "MongoTemplate", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "findOne", class: "MongoTemplate", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "findAll", class: "MongoTemplate", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "find", class: "MongoCollection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "aggregate", class: "MongoCollection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "Find", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [1], languages: ["go"] },
+  { method: "FindOne", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [1], languages: ["go"] },
+  { method: "UpdateOne", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [1, 2], languages: ["go"] },
+  { method: "UpdateMany", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [1, 2], languages: ["go"] },
+  { method: "DeleteOne", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [1], languages: ["go"] }
+];
 var TRUST_BOUNDARY_FRAMEWORK_SINKS = [
   { method: "set", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["python"] },
   { method: "set_many", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["python"] },
@@ -11653,7 +11778,9 @@ var DEFAULT_SINKS = [
   { method: "Generate", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
   { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
   ...OPEN_REDIRECT_FRAMEWORK_SINKS,
-  ...TRUST_BOUNDARY_FRAMEWORK_SINKS
+  ...TRUST_BOUNDARY_FRAMEWORK_SINKS,
+  ...DESERIALIZATION_FRAMEWORK_SINKS,
+  ...NOSQL_FRAMEWORK_SINKS
 ];
 var DEFAULT_SANITIZERS = [
   { method: "setString", class: "PreparedStatement", removes: ["sql_injection"] },
@@ -12166,11 +12293,9 @@ function attachSourceLineCode(sources, sinks, code) {
 }
 function findSources(calls, types, patterns, sourceLines, language) {
   const sources = [];
+  const patternsForLanguage = language === undefined ? patterns : patterns.filter((p) => !p.languages || p.languages.length === 0 || p.languages.includes(language));
   for (const call of calls) {
-    for (const pattern of patterns) {
-      if (pattern.languages && pattern.languages.length > 0 && language !== undefined && !pattern.languages.includes(language)) {
-        continue;
-      }
+    for (const pattern of patternsForLanguage) {
       if (matchesSourcePattern(call, pattern)) {
         sources.push({
           type: pattern.type,
@@ -12186,11 +12311,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
   for (const type of types) {
     for (const method of type.methods) {
       for (const param of method.parameters) {
-        for (const pattern of patterns) {
+        for (const pattern of patternsForLanguage) {
           if (pattern.annotation && pattern.param_tainted) {
-            if (pattern.languages && pattern.languages.length > 0 && language !== undefined && !pattern.languages.includes(language)) {
-              continue;
-            }
             if (matchesAnnotation(param.annotations, pattern.annotation)) {
               const paramLine = param.line ?? method.start_line;
               sources.push({
@@ -12209,12 +12331,9 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   for (const type of types) {
     for (const method of type.methods) {
-      for (const pattern of patterns) {
+      for (const pattern of patternsForLanguage) {
         if (!pattern.method_annotation)
           continue;
-        if (pattern.languages && pattern.languages.length > 0 && language !== undefined && !pattern.languages.includes(language)) {
-          continue;
-        }
         if (!matchesAnnotation(method.annotations, pattern.method_annotation))
           continue;
         for (const param of method.parameters) {
@@ -12879,9 +12998,10 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   return false;
 }
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
+  const patternsForLanguage = language === undefined ? patterns : patterns.filter((p) => !p.languages || p.languages.length === 0 || p.languages.includes(language));
   const sinkMap = new Map;
   for (const call of calls) {
-    for (const pattern of patterns) {
+    for (const pattern of patternsForLanguage) {
       if (matchesSinkPattern(call, pattern, typeHierarchy, language)) {
         if (isParameterizedQueryCall(call, pattern)) {
           continue;
@@ -13283,7 +13403,21 @@ function matchesAnnotation(annotations, targetAnnotation) {
   }
   return false;
 }
+var RECEIVER_MIGHT_BE_CLASS_CACHE = new Map;
+var RECEIVER_MIGHT_BE_CLASS_CACHE_CAP = 1e4;
 function receiverMightBeClass(receiver, className) {
+  const key = receiver + "\x00" + className;
+  const cached = RECEIVER_MIGHT_BE_CLASS_CACHE.get(key);
+  if (cached !== undefined)
+    return cached;
+  const result = receiverMightBeClassImpl(receiver, className);
+  if (RECEIVER_MIGHT_BE_CLASS_CACHE.size >= RECEIVER_MIGHT_BE_CLASS_CACHE_CAP) {
+    RECEIVER_MIGHT_BE_CLASS_CACHE.clear();
+  }
+  RECEIVER_MIGHT_BE_CLASS_CACHE.set(key, result);
+  return result;
+}
+function receiverMightBeClassImpl(receiver, className) {
   if (className.startsWith("*") && className.length > 1) {
     const suffix = className.slice(1).toLowerCase();
     let simpleReceiver = receiver;
@@ -16139,8 +16273,16 @@ class AnalysisPipeline {
   }
 }
 // ../circle-ir/dist/analysis/dfg-walk.js
+var walkBackwardDefsMemo = new WeakMap;
 function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   const maxHops = options.maxHops ?? 32;
+  let perFile = walkBackwardDefsMemo.get(chainsByToDef);
+  if (perFile !== undefined) {
+    const key = `${startDefId}|${maxHops}`;
+    const hit = perFile.get(key);
+    if (hit !== undefined)
+      return hit;
+  }
   const visited = new Set;
   const lines = new Set;
   let hopCapReached = false;
@@ -16174,7 +16316,13 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
       queue.push(fromId);
     }
   }
-  return { visited, lines, hopCapReached };
+  const result = { visited, lines, hopCapReached };
+  if (perFile === undefined) {
+    perFile = new Map;
+    walkBackwardDefsMemo.set(chainsByToDef, perFile);
+  }
+  perFile.set(`${startDefId}|${maxHops}`, result);
+  return result;
 }
 
 // ../circle-ir/dist/analysis/sanitizer-index.js
@@ -17021,12 +17169,12 @@ class ConstantPropagator {
     this.constructorParamPositions.clear();
     this.safePatternFieldsCache = null;
     this.isTaintedExpressionCache = null;
-    this.collectClassFields(tree.rootNode);
+    const prePassMethods = this.collectClassFieldsAndMethods(tree.rootNode);
     for (const methodName of sanitizerMethods) {
       this.methodReturnsSanitized.add(methodName);
     }
     this.evaluator = new ExpressionEvaluator(this.source, (name2) => this.lookupSymbol(name2));
-    this.analyzeMethodReturns(tree.rootNode);
+    this.analyzeMethodReturns(prePassMethods);
     this.seedPythonModuleConstants(tree.rootNode);
     this.visit(tree.rootNode);
     this.refineTaintFromConstants();
@@ -17078,8 +17226,7 @@ class ConstantPropagator {
   isLineReachable(line) {
     return !this.unreachableLines.has(line);
   }
-  analyzeMethodReturns(root) {
-    const methods = this.findAllMethods(root);
+  analyzeMethodReturns(methods) {
     for (const method of methods) {
       const methodName = this.getMethodName(method);
       if (!methodName)
@@ -17344,12 +17491,16 @@ class ConstantPropagator {
     };
     return findAssignments(methodBody);
   }
-  collectClassFields(root) {
+  collectClassFieldsAndMethods(root) {
+    const methods = [];
     const stack = [root];
     while (stack.length > 0) {
       const n = stack.pop();
       if (!n)
         continue;
+      if (n.type === "method_declaration" || n.type === "function_declaration") {
+        methods.push(n);
+      }
       if (n.type === "class_body") {
         for (const child of n.children) {
           if (child.type === "field_declaration") {
@@ -17363,14 +17514,17 @@ class ConstantPropagator {
               }
             }
           }
-          stack.push(child);
+          if (child)
+            stack.push(child);
         }
         continue;
       }
       for (const child of n.children) {
-        stack.push(child);
+        if (child)
+          stack.push(child);
       }
     }
+    return methods;
   }
   fieldDeclHasPrimitiveLiteralValue(node) {
     const primitive = new Set([
@@ -17507,23 +17661,6 @@ class ConstantPropagator {
       this.symbols.set(name2, value);
     }
   }
-  findAllMethods(node) {
-    const methods = [];
-    const stack = [node];
-    while (stack.length > 0) {
-      const n = stack.pop();
-      if (!n)
-        continue;
-      if (n.type === "method_declaration" || n.type === "function_declaration") {
-        methods.push(n);
-      }
-      for (const child of n.children) {
-        if (child)
-          stack.push(child);
-      }
-    }
-    return methods;
-  }
   getMethodName(method) {
     const nameNode = method.childForFieldName("name");
     if (nameNode) {
@@ -19046,6 +19183,50 @@ function applyLibraryApiSurfaceDowngrade(findings) {
   });
 }
 
+// ../circle-ir/dist/analysis/note-coalescer.js
+function coalesceNoteLevelFindings(findings) {
+  if (findings.length < 2)
+    return [...findings];
+  const groups = new Map;
+  const order = [];
+  for (const f of findings) {
+    const key = `${f.file}\x00${f.line}`;
+    const bucket = groups.get(key);
+    if (bucket) {
+      bucket.push(f);
+    } else {
+      groups.set(key, [f]);
+      order.push(key);
+    }
+  }
+  const out2 = [];
+  for (const key of order) {
+    const bucket = groups.get(key);
+    if (bucket.length === 1) {
+      out2.push(bucket[0]);
+      continue;
+    }
+    const allNote = bucket.every((f) => f.level === "note");
+    if (!allNote) {
+      for (const f of bucket)
+        out2.push(f);
+      continue;
+    }
+    const uniqueRuleIds = new Set(bucket.map((f) => f.rule_id));
+    if (uniqueRuleIds.size < 2) {
+      for (const f of bucket)
+        out2.push(f);
+      continue;
+    }
+    const sorted = [...bucket].sort((a, b) => a.rule_id.localeCompare(b.rule_id));
+    const primary = sorted[0];
+    const additional = sorted.slice(1).map((f) => f.rule_id).concat(...sorted.map((f) => f.labels ?? []));
+    const uniqueLabels = Array.from(new Set(additional)).filter((l) => l !== primary.rule_id);
+    out2.push({ ...primary, labels: uniqueLabels });
+  }
+  return out2;
+}
+
 // ../circle-ir/dist/analysis/entry-point-detection.js
 var TIER_1_METHOD_ANNOTATIONS = new Set([
   "RequestMapping",
@@ -30947,6 +31128,12 @@ var DATA_PARSER_TYPES = new Set([
   "OptionParser",
   "CmdLineParser"
 ]);
+var JAVA_EVAL_PARSER_DENYLIST = new Set([
+  "GroovyShell",
+  "GroovyClassLoader",
+  "ScriptEngine",
+  "CronParser"
+]);
 var COMPILED_TEMPLATE_TYPES = new Set([
   "Template",
   "JetTemplate",
@@ -31416,8 +31603,13 @@ class SinkFilterPass {
         const method = sink.method ?? receiverMatch?.[2];
         if (method === "parse" && receiver) {
           const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
-          if (recvType && DATA_PARSER_TYPES.has(recvType))
-            return false;
+          if (recvType) {
+            if (DATA_PARSER_TYPES.has(recvType))
+              return false;
+            if (recvType.endsWith("Parser") && !JAVA_EVAL_PARSER_DENYLIST.has(recvType)) {
+              return false;
+            }
+          }
         }
         if ((method === "render" || method === "process" || method === "merge" || method === "renderTo") && receiver) {
           const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
@@ -32435,6 +32627,117 @@ class SinkSemanticsPass {
   }
 }
 
+// ../circle-ir/dist/analysis/dependency-versions.js
+function resolveFastjsonFromPom(pomXml) {
+  if (!pomXml)
+    return null;
+  const propMatch = pomXml.match(/<fastjson\.version>\s*([^<\s]+)\s*<\/fastjson\.version>/);
+  if (propMatch) {
+    const version = propMatch[1];
+    return { version, noneAutotype: /_noneautotype/i.test(version) };
+  }
+  const depRe = /<dependency>[\s\S]*?<\/dependency>/g;
+  let m;
+  while ((m = depRe.exec(pomXml)) !== null) {
+    const block = m[0];
+    const gid = block.match(/<groupId>\s*([^<\s]+)\s*<\/groupId>/)?.[1];
+    const aid = block.match(/<artifactId>\s*([^<\s]+)\s*<\/artifactId>/)?.[1];
+    if (gid !== "com.alibaba")
+      continue;
+    if (aid !== "fastjson" && aid !== "fastjson2")
+      continue;
+    const ver = block.match(/<version>\s*([^<\s]+)\s*<\/version>/)?.[1];
+    if (!ver)
+      continue;
+    if (/^\$\{/.test(ver))
+      return null;
+    return { version: ver, noneAutotype: /_noneautotype/i.test(ver) };
+  }
+  return null;
+}
+function fileReenablesFastjsonAutotype(source) {
+  if (!source)
+    return false;
+  return /\bsetAutoTypeSupport\s*\(\s*true\b/.test(source);
+}
+function fileEnablesJacksonPolymorphism(source) {
+  if (!source)
+    return false;
+  if (/\benableDefaultTyping\s*\(/.test(source))
+    return true;
+  if (/\bactivateDefaultTyping\s*\(/.test(source))
+    return true;
+  if (/@JsonTypeInfo\b/.test(source))
+    return true;
+  return false;
+}
+function fileConfiguresSnakeYamlSafely(source) {
+  if (!source)
+    return false;
+  if (/\bnew\s+SafeConstructor\s*\(/.test(source))
+    return true;
+  if (/\bSafeConstructor\s+\w+\s*=/.test(source))
+    return true;
+  return false;
+}
+
+// ../circle-ir/dist/analysis/passes/deserialization-safety-gate-pass.js
+var FASTJSON_METHODS = new Set(["parseObject", "parse"]);
+var FASTJSON_CLASSES = new Set(["JSON", "JSONObject"]);
+var JACKSON_METHODS = new Set(["readValue", "convertValue", "treeToValue"]);
+var JACKSON_CLASSES = new Set(["ObjectMapper", "ObjectReader"]);
+var SNAKEYAML_METHODS = new Set(["load", "loadAs", "loadAll"]);
+var SNAKEYAML_CLASSES = new Set(["Yaml"]);
+
+class DeserializationSafetyGatePass {
+  dependencyContext;
+  name = "deserialization-safety-gate";
+  category = "security";
+  constructor(dependencyContext) {
+    this.dependencyContext = dependencyContext;
+  }
+  run(ctx) {
+    const { graph, language, code } = ctx;
+    if (language !== "java") {
+      return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0 };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    const pomXml = this.dependencyContext?.java?.pomXml;
+    const fastjson = pomXml ? resolveFastjsonFromPom(pomXml) : null;
+    const fastjsonHardened = fastjson?.noneAutotype === true && !fileReenablesFastjsonAutotype(code);
+    const jacksonSafe = !fileEnablesJacksonPolymorphism(code);
+    const snakeYamlSafe = fileConfiguresSnakeYamlSafely(code);
+    let droppedFastjson = 0;
+    let droppedJackson = 0;
+    let droppedSnakeYaml = 0;
+    const kept = sinks.filter((sink) => {
+      if (sink.type !== "deserialization")
+        return true;
+      if (!sink.method)
+        return true;
+      if (fastjsonHardened && FASTJSON_METHODS.has(sink.method) && (sink.class === undefined || FASTJSON_CLASSES.has(sink.class))) {
+        droppedFastjson++;
+        return false;
+      }
+      if (jacksonSafe && JACKSON_METHODS.has(sink.method) && sink.class !== undefined && JACKSON_CLASSES.has(sink.class)) {
+        droppedJackson++;
+        return false;
+      }
+      if (snakeYamlSafe && SNAKEYAML_METHODS.has(sink.method) && sink.class !== undefined && SNAKEYAML_CLASSES.has(sink.class)) {
+        droppedSnakeYaml++;
+        return false;
+      }
+      return true;
+    });
+    const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml;
+    if (totalDropped > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { droppedFastjson, droppedJackson, droppedSnakeYaml };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
 var REFLECTION_SINK_METHODS = new Set([
   "forName",
@@ -43976,6 +44279,8 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new SinkFilterPass);
     if (!disabledPasses.has("sink-semantics"))
       pipeline.add(new SinkSemanticsPass);
+    if (!disabledPasses.has("deserialization-safety-gate"))
+      pipeline.add(new DeserializationSafetyGatePass(options.dependencyContext));
     if (!disabledPasses.has("cli-main-reflection-suppress"))
       pipeline.add(new CliMainReflectionSuppressPass);
     if (!disabledPasses.has("library-profile-sink-gate"))
@@ -44137,7 +44442,8 @@ async function analyze(code, filePath, language, options = {}) {
     const verifiedFindings = applyConfidenceFilter(findings, options.includeSpeculative === true);
     const downgradedFindings = applyLibraryApiSurfaceDowngrade(verifiedFindings);
     const profiledFindings = applyProjectProfileTransform(downgradedFindings, makeProfileResolver2(options.projectProfile));
-    const cappedFindings = applyPerFileFindingCap(filePath, profiledFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
+    const coalescedFindings = coalesceNoteLevelFindings(profiledFindings);
+    const cappedFindings = applyPerFileFindingCap(filePath, coalescedFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
     return {
       meta,
       types,
@@ -44918,7 +45224,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.176.0";
+var version = "3.178.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.176.0",
+  "version": "3.178.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.176.0"
+    "circle-ir": "^3.178.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",