cognium-dev 3.179.0 → 3.180.0

package/dist/cli.js

@@ -32677,6 +32677,12 @@ function resolveFastjsonFromGradle(buildGradle) {
     const version2 = direct[1];
     return { version: version2, noneAutotype: /_noneautotype/i.test(version2) };
   }
+  const constraintsBlockRe = /['"(]\s*com\.alibaba:fastjson\s*['")]\s*\)?\s*\{[\s\S]*?\bversion\s*\{[\s\S]*?\b(?:strictly|require|prefer)\s+['"]([^'"\s]+)['"]/;
+  const constraintsBlock = buildGradle.match(constraintsBlockRe);
+  if (constraintsBlock) {
+    const version2 = constraintsBlock[1];
+    return { version: version2, noneAutotype: /_noneautotype/i.test(version2) };
+  }
   const propRefRe = /['"(]\s*com\.alibaba:fastjson:\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?\s*['")]/;
   const propRef = buildGradle.match(propRefRe);
   if (!propRef)
@@ -32689,6 +32695,45 @@ function resolveFastjsonFromGradle(buildGradle) {
   const version = def[1];
   return { version, noneAutotype: /_noneautotype/i.test(version) };
 }
+function resolveFastjsonFromGradleCatalog(buildGradle, libsVersionsToml) {
+  if (!buildGradle || !libsVersionsToml)
+    return null;
+  const librariesMatch = libsVersionsToml.match(/\[libraries\]([\s\S]*?)(?=\n\[|$)/);
+  if (!librariesMatch)
+    return null;
+  const librariesBlock = librariesMatch[1];
+  const moduleForm = librariesBlock.match(/^\s*([\w.-]+)\s*=\s*\{[^}]*\bmodule\s*=\s*"com\.alibaba:fastjson"[^}]*\}/m);
+  const groupNameForm = librariesBlock.match(/^\s*([\w.-]+)\s*=\s*\{[^}]*\bgroup\s*=\s*"com\.alibaba"[^}]*\bname\s*=\s*"fastjson"[^}]*\}/m);
+  const entry = moduleForm ?? groupNameForm;
+  if (!entry)
+    return null;
+  const alias = entry[1];
+  const entryBody = entry[0];
+  const aliasEsc = alias.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const aliasRefRe = new RegExp(`\\blibs\\s*\\.\\s*${aliasEsc}\\b`);
+  if (!aliasRefRe.test(buildGradle))
+    return null;
+  const inlineVersionM = entryBody.match(/\bversion\s*=\s*"([^"$][^"]*)"/);
+  if (inlineVersionM) {
+    const version2 = inlineVersionM[1];
+    return { version: version2, noneAutotype: /_noneautotype/i.test(version2) };
+  }
+  const versionRefM = entryBody.match(/\bversion\.ref\s*=\s*"([^"]+)"/);
+  if (!versionRefM)
+    return null;
+  const versionAlias = versionRefM[1];
+  const versionsMatch = libsVersionsToml.match(/\[versions\]([\s\S]*?)(?=\n\[|$)/);
+  if (!versionsMatch)
+    return null;
+  const versionsBlock = versionsMatch[1];
+  const versionAliasEsc = versionAlias.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const versionLineRe = new RegExp(`^\\s*${versionAliasEsc}\\s*=\\s*"([^"]+)"`, "m");
+  const versionLine = versionsBlock.match(versionLineRe);
+  if (!versionLine)
+    return null;
+  const version = versionLine[1];
+  return { version, noneAutotype: /_noneautotype/i.test(version) };
+}
 function resolvePyYamlFromRequirements(requirementsTxt) {
   if (!requirementsTxt)
     return null;
@@ -32798,7 +32843,8 @@ class DeserializationSafetyGatePass {
     const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
     const pomXml = this.dependencyContext?.java?.pomXml;
     const buildGradle = this.dependencyContext?.java?.buildGradle;
-    const fastjson = (pomXml ? resolveFastjsonFromPom(pomXml) : null) ?? (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null);
+    const libsVersionsToml = this.dependencyContext?.java?.libsVersionsToml;
+    const fastjson = (pomXml ? resolveFastjsonFromPom(pomXml) : null) ?? (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null) ?? (buildGradle && libsVersionsToml ? resolveFastjsonFromGradleCatalog(buildGradle, libsVersionsToml) : null);
     const fastjsonHardened = fastjson?.noneAutotype === true && !fileReenablesFastjsonAutotype(code);
     const jacksonSafe = !fileEnablesJacksonPolymorphism(code);
     const snakeYamlSafe = fileConfiguresSnakeYamlSafely(code);
@@ -39735,6 +39781,47 @@ class ScanSecretsPass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/python-receiver-taint-format-pass.js
+class PythonReceiverTaintFormatPass {
+  name = "python-receiver-taint-format";
+  category = "security";
+  run(ctx) {
+    if (ctx.language !== "python") {
+      return { findingsEmitted: 0 };
+    }
+    const { calls, meta } = ctx.graph.ir;
+    const constProp = ctx.getResult("constant-propagation");
+    const tainted = constProp.tainted;
+    let count = 0;
+    for (const call of calls) {
+      if (call.method_name !== "format")
+        continue;
+      const receiver = call.receiver;
+      if (!receiver)
+        continue;
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(receiver))
+        continue;
+      const scopedName = call.in_method ? `${call.in_method}:${receiver}` : receiver;
+      if (!tainted.has(receiver) && !tainted.has(scopedName))
+        continue;
+      ctx.addFinding({
+        id: `format_string-${meta.file}-${call.location.line}-${receiver}`,
+        pass: this.name,
+        category: "security",
+        rule_id: "format_string",
+        cwe: "CWE-134",
+        severity: "medium",
+        level: "warning",
+        message: `Format-string vulnerability: the format template \`${receiver}\` ` + `is tainted (traces back to a taint source). Attacker can leak ` + `object attributes via \`{obj.__class__.__mro__[…]}\` chains or ` + `crash the process via unbounded specifiers. Use a literal ` + `format string and pass user input as an argument instead.`,
+        file: meta.file,
+        line: call.location.line
+      });
+      count++;
+    }
+    return { findingsEmitted: count };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/spring4shell-pass.js
 var CONTROLLER_ANNOTATIONS = new Set([
   "Controller",
@@ -44406,6 +44493,8 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new LibraryProfileCwe22PathGatePass);
     if (!disabledPasses.has("scan-secrets"))
       pipeline.add(new ScanSecretsPass);
+    if (!disabledPasses.has("python-receiver-taint-format"))
+      pipeline.add(new PythonReceiverTaintFormatPass);
     if (!disabledPasses.has("dead-code"))
       pipeline.add(new DeadCodePass);
     if (!disabledPasses.has("missing-await"))
@@ -45335,7 +45424,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.179.0";
+var version = "3.180.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.179.0",
+  "version": "3.180.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.179.0"
+    "circle-ir": "^3.180.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",