cognium-dev 3.180.0 → 3.181.0

package/dist/cli.js

@@ -10634,6 +10634,16 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  { property: "body", object: "event", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "multiValueQueryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "pathParameters", object: "event", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "headers", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "multiValueHeaders", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "body", object: "event", type: "http_body", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "queryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "pathParameters", object: "event", type: "http_path", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "headers", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["python"] },
   { method: "decode", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["python"] },
   { method: "get_unverified_claims", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["python"] },
   { method: "get_unverified_header", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["python"] },
@@ -24564,7 +24574,13 @@ var JS_TAINTED_PATTERNS = [
   { pattern: /\bdocument\.title\b/, type: "dom_input" },
   { pattern: /\bhistory\.state\b/, type: "dom_input" },
   { pattern: /\blocalStorage\.getItem\b/, type: "dom_input" },
-  { pattern: /\bsessionStorage\.getItem\b/, type: "dom_input" }
+  { pattern: /\bsessionStorage\.getItem\b/, type: "dom_input" },
+  { pattern: /\bevent\.body\b/, type: "http_body" },
+  { pattern: /\bevent\.queryStringParameters\b/, type: "http_param" },
+  { pattern: /\bevent\.multiValueQueryStringParameters\b/, type: "http_param" },
+  { pattern: /\bevent\.pathParameters\b/, type: "http_path" },
+  { pattern: /\bevent\.headers\b/, type: "http_header" },
+  { pattern: /\bevent\.multiValueHeaders\b/, type: "http_header" }
 ];
 var PYTHON_TAINTED_PATTERNS2 = [
   { pattern: /\brequest\.args\b/, type: "http_param" },
@@ -29469,7 +29485,7 @@ function findPythonTaintedFormatStringFindings(code, file) {
   if (taintedVars.size === 0)
     return findings;
   const percentRe = /\b(\w+)\s*%\s*[\(\[\{"'\w]/;
-  const dotFormatRe = /\b(\w+)\s*\.\s*format\s*\(/;
+  const dotFormatRe = /\b(\w+)\s*\.\s*(?:format|format_map)\s*\(/;
   const seen = new Set;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const line = lines[i2];
@@ -39789,30 +39805,41 @@ class PythonReceiverTaintFormatPass {
     if (ctx.language !== "python") {
       return { findingsEmitted: 0 };
     }
-    const { calls, meta } = ctx.graph.ir;
-    const constProp = ctx.getResult("constant-propagation");
-    const tainted = constProp.tainted;
+    const { calls, meta, taint } = ctx.graph.ir;
+    const taintedVarNames = new Set;
+    for (const s of taint.sources) {
+      if (typeof s.variable === "string" && s.variable.length > 0) {
+        taintedVarNames.add(s.variable);
+      }
+    }
+    if (taintedVarNames.size === 0) {
+      return { findingsEmitted: 0 };
+    }
+    const seen = new Set;
     let count = 0;
     for (const call of calls) {
-      if (call.method_name !== "format")
+      if (call.method_name !== "format" && call.method_name !== "format_map")
         continue;
       const receiver = call.receiver;
       if (!receiver)
         continue;
       if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(receiver))
         continue;
-      const scopedName = call.in_method ? `${call.in_method}:${receiver}` : receiver;
-      if (!tainted.has(receiver) && !tainted.has(scopedName))
+      if (!taintedVarNames.has(receiver))
+        continue;
+      const seenKey = `${call.location.line}:${receiver}`;
+      if (seen.has(seenKey))
         continue;
+      seen.add(seenKey);
       ctx.addFinding({
-        id: `format_string-${meta.file}-${call.location.line}-${receiver}`,
+        id: `format_string-${meta.file}-${call.location.line}-${receiver}-${call.method_name}`,
         pass: this.name,
         category: "security",
         rule_id: "format_string",
         cwe: "CWE-134",
         severity: "medium",
         level: "warning",
-        message: `Format-string vulnerability: the format template \`${receiver}\` ` + `is tainted (traces back to a taint source). Attacker can leak ` + `object attributes via \`{obj.__class__.__mro__[…]}\` chains or ` + `crash the process via unbounded specifiers. Use a literal ` + `format string and pass user input as an argument instead.`,
+        message: `Format-string vulnerability: the format template \`${receiver}\` ` + `is tainted (traces back to a taint source) and used as the ` + `receiver of \`${call.method_name}(...)\`. Attacker can leak ` + `object attributes via \`{obj.__class__.__mro__[…]}\` chains or ` + `crash the process via unbounded specifiers. Use a literal ` + `format string and pass user input as an argument instead.`,
         file: meta.file,
         line: call.location.line
       });
@@ -45424,7 +45451,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.180.0";
+var version = "3.181.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.180.0",
+  "version": "3.181.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.180.0"
+    "circle-ir": "^3.181.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",