cognium-dev 3.177.0 → 3.178.0

package/dist/cli.js

@@ -19183,6 +19183,50 @@ function applyLibraryApiSurfaceDowngrade(findings) {
   });
 }
 
+// ../circle-ir/dist/analysis/note-coalescer.js
+function coalesceNoteLevelFindings(findings) {
+  if (findings.length < 2)
+    return [...findings];
+  const groups = new Map;
+  const order = [];
+  for (const f of findings) {
+    const key = `${f.file}\x00${f.line}`;
+    const bucket = groups.get(key);
+    if (bucket) {
+      bucket.push(f);
+    } else {
+      groups.set(key, [f]);
+      order.push(key);
+    }
+  }
+  const out2 = [];
+  for (const key of order) {
+    const bucket = groups.get(key);
+    if (bucket.length === 1) {
+      out2.push(bucket[0]);
+      continue;
+    }
+    const allNote = bucket.every((f) => f.level === "note");
+    if (!allNote) {
+      for (const f of bucket)
+        out2.push(f);
+      continue;
+    }
+    const uniqueRuleIds = new Set(bucket.map((f) => f.rule_id));
+    if (uniqueRuleIds.size < 2) {
+      for (const f of bucket)
+        out2.push(f);
+      continue;
+    }
+    const sorted = [...bucket].sort((a, b) => a.rule_id.localeCompare(b.rule_id));
+    const primary = sorted[0];
+    const additional = sorted.slice(1).map((f) => f.rule_id).concat(...sorted.map((f) => f.labels ?? []));
+    const uniqueLabels = Array.from(new Set(additional)).filter((l) => l !== primary.rule_id);
+    out2.push({ ...primary, labels: uniqueLabels });
+  }
+  return out2;
+}
+
 // ../circle-ir/dist/analysis/entry-point-detection.js
 var TIER_1_METHOD_ANNOTATIONS = new Set([
   "RequestMapping",
@@ -32583,6 +32627,117 @@ class SinkSemanticsPass {
   }
 }
 
+// ../circle-ir/dist/analysis/dependency-versions.js
+function resolveFastjsonFromPom(pomXml) {
+  if (!pomXml)
+    return null;
+  const propMatch = pomXml.match(/<fastjson\.version>\s*([^<\s]+)\s*<\/fastjson\.version>/);
+  if (propMatch) {
+    const version = propMatch[1];
+    return { version, noneAutotype: /_noneautotype/i.test(version) };
+  }
+  const depRe = /<dependency>[\s\S]*?<\/dependency>/g;
+  let m;
+  while ((m = depRe.exec(pomXml)) !== null) {
+    const block = m[0];
+    const gid = block.match(/<groupId>\s*([^<\s]+)\s*<\/groupId>/)?.[1];
+    const aid = block.match(/<artifactId>\s*([^<\s]+)\s*<\/artifactId>/)?.[1];
+    if (gid !== "com.alibaba")
+      continue;
+    if (aid !== "fastjson" && aid !== "fastjson2")
+      continue;
+    const ver = block.match(/<version>\s*([^<\s]+)\s*<\/version>/)?.[1];
+    if (!ver)
+      continue;
+    if (/^\$\{/.test(ver))
+      return null;
+    return { version: ver, noneAutotype: /_noneautotype/i.test(ver) };
+  }
+  return null;
+}
+function fileReenablesFastjsonAutotype(source) {
+  if (!source)
+    return false;
+  return /\bsetAutoTypeSupport\s*\(\s*true\b/.test(source);
+}
+function fileEnablesJacksonPolymorphism(source) {
+  if (!source)
+    return false;
+  if (/\benableDefaultTyping\s*\(/.test(source))
+    return true;
+  if (/\bactivateDefaultTyping\s*\(/.test(source))
+    return true;
+  if (/@JsonTypeInfo\b/.test(source))
+    return true;
+  return false;
+}
+function fileConfiguresSnakeYamlSafely(source) {
+  if (!source)
+    return false;
+  if (/\bnew\s+SafeConstructor\s*\(/.test(source))
+    return true;
+  if (/\bSafeConstructor\s+\w+\s*=/.test(source))
+    return true;
+  return false;
+}
+
+// ../circle-ir/dist/analysis/passes/deserialization-safety-gate-pass.js
+var FASTJSON_METHODS = new Set(["parseObject", "parse"]);
+var FASTJSON_CLASSES = new Set(["JSON", "JSONObject"]);
+var JACKSON_METHODS = new Set(["readValue", "convertValue", "treeToValue"]);
+var JACKSON_CLASSES = new Set(["ObjectMapper", "ObjectReader"]);
+var SNAKEYAML_METHODS = new Set(["load", "loadAs", "loadAll"]);
+var SNAKEYAML_CLASSES = new Set(["Yaml"]);
+
+class DeserializationSafetyGatePass {
+  dependencyContext;
+  name = "deserialization-safety-gate";
+  category = "security";
+  constructor(dependencyContext) {
+    this.dependencyContext = dependencyContext;
+  }
+  run(ctx) {
+    const { graph, language, code } = ctx;
+    if (language !== "java") {
+      return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0 };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    const pomXml = this.dependencyContext?.java?.pomXml;
+    const fastjson = pomXml ? resolveFastjsonFromPom(pomXml) : null;
+    const fastjsonHardened = fastjson?.noneAutotype === true && !fileReenablesFastjsonAutotype(code);
+    const jacksonSafe = !fileEnablesJacksonPolymorphism(code);
+    const snakeYamlSafe = fileConfiguresSnakeYamlSafely(code);
+    let droppedFastjson = 0;
+    let droppedJackson = 0;
+    let droppedSnakeYaml = 0;
+    const kept = sinks.filter((sink) => {
+      if (sink.type !== "deserialization")
+        return true;
+      if (!sink.method)
+        return true;
+      if (fastjsonHardened && FASTJSON_METHODS.has(sink.method) && (sink.class === undefined || FASTJSON_CLASSES.has(sink.class))) {
+        droppedFastjson++;
+        return false;
+      }
+      if (jacksonSafe && JACKSON_METHODS.has(sink.method) && sink.class !== undefined && JACKSON_CLASSES.has(sink.class)) {
+        droppedJackson++;
+        return false;
+      }
+      if (snakeYamlSafe && SNAKEYAML_METHODS.has(sink.method) && sink.class !== undefined && SNAKEYAML_CLASSES.has(sink.class)) {
+        droppedSnakeYaml++;
+        return false;
+      }
+      return true;
+    });
+    const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml;
+    if (totalDropped > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { droppedFastjson, droppedJackson, droppedSnakeYaml };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
 var REFLECTION_SINK_METHODS = new Set([
   "forName",
@@ -44124,6 +44279,8 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new SinkFilterPass);
     if (!disabledPasses.has("sink-semantics"))
       pipeline.add(new SinkSemanticsPass);
+    if (!disabledPasses.has("deserialization-safety-gate"))
+      pipeline.add(new DeserializationSafetyGatePass(options.dependencyContext));
     if (!disabledPasses.has("cli-main-reflection-suppress"))
       pipeline.add(new CliMainReflectionSuppressPass);
     if (!disabledPasses.has("library-profile-sink-gate"))
@@ -44285,7 +44442,8 @@ async function analyze(code, filePath, language, options = {}) {
     const verifiedFindings = applyConfidenceFilter(findings, options.includeSpeculative === true);
     const downgradedFindings = applyLibraryApiSurfaceDowngrade(verifiedFindings);
     const profiledFindings = applyProjectProfileTransform(downgradedFindings, makeProfileResolver2(options.projectProfile));
-    const cappedFindings = applyPerFileFindingCap(filePath, profiledFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
+    const coalescedFindings = coalesceNoteLevelFindings(profiledFindings);
+    const cappedFindings = applyPerFileFindingCap(filePath, coalescedFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
     return {
       meta,
       types,
@@ -45066,7 +45224,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.177.0";
+var version = "3.178.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.177.0",
+  "version": "3.178.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.177.0"
+    "circle-ir": "^3.178.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",