cognium-dev 3.178.0 → 3.179.0

package/dist/cli.js

@@ -11683,12 +11683,20 @@ var DEFAULT_SINKS = [
   { method: "format", class: "String", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "format", class: "Formatter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "printf", class: "System.out", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "format", class: "MessageFormat", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "printf", class: "PrintStream", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "format", class: "PrintStream", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "printf", class: "PrintWriter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "format", class: "PrintWriter", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "printf", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "fprintf", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [1], languages: ["python"] },
   { method: "Sprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Printf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Errorf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Fprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [1], languages: ["go"] },
+  { method: "Printf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  { method: "Fatalf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  { method: "Panicf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "setHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
   { method: "writeHead", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [2], languages: ["javascript", "typescript"] },
   { method: "cookie", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
@@ -13680,6 +13688,11 @@ function calculateSinkConfidence(call, pattern) {
   if (pattern.class && call.receiver) {
     if (receiverMightBeClass(call.receiver, pattern.class)) {
       confidence += 0.1;
+      const receiverLc = call.receiver.toLowerCase();
+      const classLc = pattern.class.toLowerCase();
+      if (call.receiver === pattern.class || receiverLc === classLc) {
+        confidence += 0.05;
+      }
     }
   }
   if (pattern.severity === "critical") {
@@ -32655,6 +32668,85 @@ function resolveFastjsonFromPom(pomXml) {
   }
   return null;
 }
+function resolveFastjsonFromGradle(buildGradle) {
+  if (!buildGradle)
+    return null;
+  const directRe = /['"(]\s*com\.alibaba:fastjson:([^'"$\s)]+)\s*['")]/;
+  const direct = buildGradle.match(directRe);
+  if (direct) {
+    const version2 = direct[1];
+    return { version: version2, noneAutotype: /_noneautotype/i.test(version2) };
+  }
+  const propRefRe = /['"(]\s*com\.alibaba:fastjson:\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?\s*['")]/;
+  const propRef = buildGradle.match(propRefRe);
+  if (!propRef)
+    return null;
+  const propName = propRef[1];
+  const defRe = new RegExp(`\\b${propName}\\s*[=:]\\s*['"]([^'"\\s]+)['"]`);
+  const def = buildGradle.match(defRe);
+  if (!def)
+    return null;
+  const version = def[1];
+  return { version, noneAutotype: /_noneautotype/i.test(version) };
+}
+function resolvePyYamlFromRequirements(requirementsTxt) {
+  if (!requirementsTxt)
+    return null;
+  for (const rawLine of requirementsTxt.split(/\r?\n/)) {
+    const line = rawLine.replace(/#.*$/, "").trim();
+    if (!line)
+      continue;
+    if (line.startsWith("-"))
+      continue;
+    const m = line.match(/^(pyyaml)\s*(==|>=|~=|>|===)\s*(\d+(?:\.\d+)*)/i);
+    if (!m)
+      continue;
+    const version = m[3];
+    return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+  }
+  return null;
+}
+function resolvePyYamlFromPyproject(pyprojectToml) {
+  if (!pyprojectToml)
+    return null;
+  const poetryLine = pyprojectToml.match(/^\s*(pyyaml)\s*=\s*"([\^~=<>]*)(\d+(?:\.\d+)*)"/im);
+  if (poetryLine) {
+    const version = poetryLine[3];
+    return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+  }
+  const poetryTable = pyprojectToml.match(/^\s*(pyyaml)\s*=\s*\{[^}]*\bversion\s*=\s*"([\^~=<>]*)(\d+(?:\.\d+)*)"/im);
+  if (poetryTable) {
+    const version = poetryTable[3];
+    return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+  }
+  const pep621 = pyprojectToml.match(/"(pyyaml)\s*(==|>=|~=|>|===)\s*(\d+(?:\.\d+)*)/i);
+  if (pep621) {
+    const version = pep621[3];
+    return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+  }
+  return null;
+}
+function isPyYamlVersionSafeByDefault(version) {
+  const parts2 = version.split(".").map((s) => Number.parseInt(s, 10));
+  if (parts2.length === 0 || !Number.isFinite(parts2[0]))
+    return false;
+  return parts2[0] >= 6;
+}
+function fileHasUnsafePyYamlLoader(sourceLines, sinkLine) {
+  const start2 = Math.max(0, sinkLine - 1);
+  const end = Math.min(sourceLines.length, start2 + 10);
+  const unsafeRe = /\bLoader\s*=\s*(?:yaml\s*\.\s*)?(?:Loader|UnsafeLoader|FullLoader)\b/;
+  for (let i2 = start2;i2 < end; i2++) {
+    const ln = sourceLines[i2] ?? "";
+    if (unsafeRe.test(ln))
+      return true;
+    const stripped = ln.trim();
+    if (i2 > start2 && (stripped === ")" || stripped.endsWith(")"))) {
+      return false;
+    }
+  }
+  return false;
+}
 function fileReenablesFastjsonAutotype(source) {
   if (!source)
     return false;
@@ -32688,6 +32780,8 @@ var JACKSON_METHODS = new Set(["readValue", "convertValue", "treeToValue"]);
 var JACKSON_CLASSES = new Set(["ObjectMapper", "ObjectReader"]);
 var SNAKEYAML_METHODS = new Set(["load", "loadAs", "loadAll"]);
 var SNAKEYAML_CLASSES = new Set(["Yaml"]);
+var PYYAML_METHODS = new Set(["load"]);
+var PYYAML_CLASSES = new Set(["yaml"]);
 
 class DeserializationSafetyGatePass {
   dependencyContext;
@@ -32698,18 +32792,31 @@ class DeserializationSafetyGatePass {
   }
   run(ctx) {
     const { graph, language, code } = ctx;
-    if (language !== "java") {
-      return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0 };
+    if (language !== "java" && language !== "python") {
+      return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0, droppedPyYaml: 0 };
     }
     const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
     const pomXml = this.dependencyContext?.java?.pomXml;
-    const fastjson = pomXml ? resolveFastjsonFromPom(pomXml) : null;
+    const buildGradle = this.dependencyContext?.java?.buildGradle;
+    const fastjson = (pomXml ? resolveFastjsonFromPom(pomXml) : null) ?? (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null);
     const fastjsonHardened = fastjson?.noneAutotype === true && !fileReenablesFastjsonAutotype(code);
     const jacksonSafe = !fileEnablesJacksonPolymorphism(code);
     const snakeYamlSafe = fileConfiguresSnakeYamlSafely(code);
+    const requirementsTxt = this.dependencyContext?.python?.requirementsTxt;
+    const pyprojectToml = this.dependencyContext?.python?.pyprojectToml;
+    const pyYaml = (requirementsTxt ? resolvePyYamlFromRequirements(requirementsTxt) : null) ?? (pyprojectToml ? resolvePyYamlFromPyproject(pyprojectToml) : null);
+    const pyYamlSafeByDefault = pyYaml?.safeByDefault === true;
+    let sourceLines = null;
+    const getSourceLines = () => {
+      if (sourceLines === null)
+        sourceLines = code.split(`
+`);
+      return sourceLines;
+    };
     let droppedFastjson = 0;
     let droppedJackson = 0;
     let droppedSnakeYaml = 0;
+    let droppedPyYaml = 0;
     const kept = sinks.filter((sink) => {
       if (sink.type !== "deserialization")
         return true;
@@ -32727,14 +32834,18 @@ class DeserializationSafetyGatePass {
         droppedSnakeYaml++;
         return false;
       }
+      if (language === "python" && pyYamlSafeByDefault && PYYAML_METHODS.has(sink.method) && (sink.class === undefined || PYYAML_CLASSES.has(sink.class)) && !fileHasUnsafePyYamlLoader(getSourceLines(), sink.line)) {
+        droppedPyYaml++;
+        return false;
+      }
       return true;
     });
-    const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml;
+    const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml + droppedPyYaml;
     if (totalDropped > 0) {
       sinks.length = 0;
       sinks.push(...kept);
     }
-    return { droppedFastjson, droppedJackson, droppedSnakeYaml };
+    return { droppedFastjson, droppedJackson, droppedSnakeYaml, droppedPyYaml };
   }
 }
 
@@ -45224,7 +45335,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.178.0";
+var version = "3.179.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.178.0",
+  "version": "3.179.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.178.0"
+    "circle-ir": "^3.179.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",