cognium-dev 3.180.0 → 3.182.0

package/dist/cli.js

@@ -9440,6 +9440,10 @@ function processGoBlock(node, defs, uses, scopeStack, counters) {
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {
+        const right = rangeClause.childForFieldName("right");
+        if (right) {
+          extractGoUses(right, uses, scopeStack);
+        }
         const left = rangeClause.childForFieldName("left");
         if (left) {
           extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
@@ -9447,6 +9451,7 @@ function processGoBlock(node, defs, uses, scopeStack, counters) {
       }
     } else if (child.type === "call_expression") {
       extractGoUses(child, uses, scopeStack);
+      recordGoOpaqueCodecDestDef(child, defs, scopeStack);
     } else if (child.type === "return_statement") {
       for (let i2 = 0;i2 < child.childCount; i2++) {
         const expr = child.child(i2);
@@ -9546,6 +9551,70 @@ function findChildByTypeGo(node, type) {
   }
   return null;
 }
+var GO_OPAQUE_CODEC_METHODS = new Set([
+  "Unmarshal",
+  "Decode",
+  "NewDecoder",
+  "UnmarshalYAML",
+  "UnmarshalJSON",
+  "UnmarshalText",
+  "UnmarshalBinary"
+]);
+function recordGoOpaqueCodecDestDef(call, defs, scopeStack) {
+  const fn = call.childForFieldName("function");
+  if (!fn || fn.type !== "selector_expression")
+    return;
+  const fieldNode = fn.childForFieldName("field");
+  if (!fieldNode)
+    return;
+  const method = getNodeText(fieldNode);
+  if (!GO_OPAQUE_CODEC_METHODS.has(method))
+    return;
+  const argsNode = call.childForFieldName("arguments");
+  if (!argsNode)
+    return;
+  const args2 = [];
+  for (let i2 = 0;i2 < argsNode.childCount; i2++) {
+    const c = argsNode.child(i2);
+    if (!c)
+      continue;
+    if (c.type === "," || c.type === "(" || c.type === ")")
+      continue;
+    args2.push(c);
+  }
+  if (args2.length === 0)
+    return;
+  const destArg = args2.length >= 2 ? args2[1] : args2[0];
+  const destName = extractGoAddressableVarName(destArg);
+  if (!destName || destName === "_")
+    return;
+  const line = call.startPosition.row + 1;
+  const def = {
+    id: defs.length + 1,
+    variable: destName,
+    kind: "local",
+    line
+  };
+  defs.push(def);
+  currentScope(scopeStack).set(destName, def.id);
+}
+function extractGoAddressableVarName(node) {
+  if (node.type === "unary_expression") {
+    const operand = node.childForFieldName("operand") ?? node.child(1) ?? null;
+    if (operand)
+      return extractGoAddressableVarName(operand);
+    return null;
+  }
+  if (node.type === "identifier") {
+    return getNodeText(node);
+  }
+  if (node.type === "selector_expression") {
+    const field = node.childForFieldName("field");
+    if (field)
+      return getNodeText(field);
+  }
+  return null;
+}
 // ../circle-ir/dist/core/extractors/runtime-registrations.js
 var HTTP_VERB_METHODS = new Set([
   "get",
@@ -10634,6 +10703,16 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  { property: "body", object: "event", type: "http_body", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "queryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "multiValueQueryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "pathParameters", object: "event", type: "http_path", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "headers", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "multiValueHeaders", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["javascript", "typescript"] },
+  { property: "body", object: "event", type: "http_body", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "queryStringParameters", object: "event", type: "http_query", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "pathParameters", object: "event", type: "http_path", severity: "high", property_tainted: true, languages: ["python"] },
+  { property: "headers", object: "event", type: "http_header", severity: "high", property_tainted: true, languages: ["python"] },
   { method: "decode", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["python"] },
   { method: "get_unverified_claims", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["python"] },
   { method: "get_unverified_header", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["python"] },
@@ -16422,15 +16501,23 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
     const callsAtSink = callsByLine.get(sink.line) ?? [];
     for (const call of callsAtSink) {
       for (const arg of call.arguments) {
-        if (arg.variable) {
-          if (sink.argPositions && sink.argPositions.length > 0) {
-            if (!sink.argPositions.includes(arg.position)) {
-              continue;
-            }
+        if (sink.argPositions && sink.argPositions.length > 0) {
+          if (!sink.argPositions.includes(arg.position)) {
+            continue;
           }
-          for (const use of usesAtSink) {
-            if (use.variable === arg.variable && use.def_id !== null) {
+        }
+        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        {
+          for (const use of candidateUses) {
+            if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
+                if (!arg.variable) {
+                  if (typeof arg.expression !== "string" || arg.expression.length === 0)
+                    continue;
+                  const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
+                  if (!re.test(arg.expression))
+                    continue;
+                }
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
                   const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanitizersByLine, {
@@ -16458,7 +16545,16 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
       }
     }
   }
-  return { taintedVars, flows, reachableSinks };
+  const seen = new Set;
+  const deduped = [];
+  for (const f of flows) {
+    const key = `${f.source.line}|${f.sink.line}|${f.sink.type}|${f.path.map((p) => p.variable).join(">")}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    deduped.push(f);
+  }
+  return { taintedVars, flows: deduped, reachableSinks };
 }
 function findInitialTaint(sources, callsByLine, defsByLine) {
   const tainted = [];
@@ -24564,7 +24660,13 @@ var JS_TAINTED_PATTERNS = [
   { pattern: /\bdocument\.title\b/, type: "dom_input" },
   { pattern: /\bhistory\.state\b/, type: "dom_input" },
   { pattern: /\blocalStorage\.getItem\b/, type: "dom_input" },
-  { pattern: /\bsessionStorage\.getItem\b/, type: "dom_input" }
+  { pattern: /\bsessionStorage\.getItem\b/, type: "dom_input" },
+  { pattern: /\bevent\.body\b/, type: "http_body" },
+  { pattern: /\bevent\.queryStringParameters\b/, type: "http_param" },
+  { pattern: /\bevent\.multiValueQueryStringParameters\b/, type: "http_param" },
+  { pattern: /\bevent\.pathParameters\b/, type: "http_path" },
+  { pattern: /\bevent\.headers\b/, type: "http_header" },
+  { pattern: /\bevent\.multiValueHeaders\b/, type: "http_header" }
 ];
 var PYTHON_TAINTED_PATTERNS2 = [
   { pattern: /\brequest\.args\b/, type: "http_param" },
@@ -29469,7 +29571,7 @@ function findPythonTaintedFormatStringFindings(code, file) {
   if (taintedVars.size === 0)
     return findings;
   const percentRe = /\b(\w+)\s*%\s*[\(\[\{"'\w]/;
-  const dotFormatRe = /\b(\w+)\s*\.\s*format\s*\(/;
+  const dotFormatRe = /\b(\w+)\s*\.\s*(?:format|format_map)\s*\(/;
   const seen = new Set;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const line = lines[i2];
@@ -33377,6 +33479,12 @@ class TaintPropagationPass {
         continue;
       pushIfNew(f);
     }
+    if (ctx.language === "go" && typeof ctx.code === "string") {
+      const goGlobalFlows = detectGoPackageGlobalFlows(ctx.code, calls, sources, sinks, constProp.unreachableLines) ?? [];
+      for (const f of goGlobalFlows) {
+        pushIfNew(f);
+      }
+    }
     const sanitizedNames = constProp.sanitizedVars;
     let finalFlows = sanitizedNames.size === 0 ? flows : flows.filter((f) => {
       if (f.path.length === 0)
@@ -33633,6 +33741,113 @@ function isInJavaSanitizedMethod(code, types, sinkLine, sinkType) {
   }
   return false;
 }
+function detectGoPackageGlobalFlows(code, _calls, sources, sinks, unreachableLines) {
+  const flows = [];
+  if (!code || sinks.length === 0)
+    return flows;
+  const lines = code.split(`
+`);
+  const packageVars = new Set;
+  let inVarBlock = false;
+  for (const line of lines) {
+    const stripped = line.replace(/\s+$/, "");
+    if (!stripped)
+      continue;
+    if (/^[ \t]/.test(line)) {
+      if (inVarBlock) {
+        const m = stripped.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s+/);
+        if (m)
+          packageVars.add(m[1]);
+        if (/^\s*\)/.test(stripped))
+          inVarBlock = false;
+      }
+      continue;
+    }
+    if (/^var\s*\(/.test(stripped)) {
+      inVarBlock = true;
+      continue;
+    }
+    if (inVarBlock && /^\)/.test(stripped)) {
+      inVarBlock = false;
+      continue;
+    }
+    const varOne = stripped.match(/^var\s+([A-Za-z_][A-Za-z0-9_]*)\b/);
+    if (varOne)
+      packageVars.add(varOne[1]);
+  }
+  if (packageVars.size === 0)
+    return flows;
+  const sourceVarNames = new Set;
+  for (const s of sources) {
+    if (typeof s.variable === "string" && s.variable.length > 0) {
+      sourceVarNames.add(s.variable);
+    }
+  }
+  const GO_SOURCE_RE = /\b(r\.(?:URL\.Query|Form|PostForm|Header|Cookie|Body)|mux\.Vars|c\.(?:Query|Param|PostForm|GetHeader|Cookie)|ctx\.(?:Query|Param|PostForm|GetHeader|Cookie))\b/;
+  const writes = [];
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (unreachableLines.has(i2 + 1))
+      continue;
+    if (/:=/.test(line))
+      continue;
+    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+)$/);
+    if (!m)
+      continue;
+    const [, lhs, rhs] = m;
+    if (!packageVars.has(lhs))
+      continue;
+    let taintedBy = null;
+    if (GO_SOURCE_RE.test(rhs)) {
+      const src = sources.find((s) => s.line === i2 + 1);
+      taintedBy = src ? { line: src.line, type: src.type } : { line: i2 + 1, type: "http_param" };
+    } else {
+      for (const v of sourceVarNames) {
+        const re = new RegExp(`(?<![A-Za-z0-9_$])${v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_$])`);
+        if (re.test(rhs)) {
+          const src = sources.find((s) => s.variable === v);
+          if (src) {
+            taintedBy = { line: src.line, type: src.type };
+            break;
+          }
+        }
+      }
+    }
+    if (!taintedBy)
+      continue;
+    writes.push({ varName: lhs, line: i2 + 1, sourceLine: taintedBy.line, sourceType: taintedBy.type });
+  }
+  if (writes.length === 0)
+    return flows;
+  for (const sink of sinks) {
+    if (unreachableLines.has(sink.line))
+      continue;
+    const sinkLineText = lines[sink.line - 1] ?? "";
+    if (!sinkLineText)
+      continue;
+    for (const w of writes) {
+      if (w.line >= sink.line)
+        continue;
+      const re = new RegExp(`(?<![A-Za-z0-9_$])${w.varName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_$])`);
+      if (!re.test(sinkLineText))
+        continue;
+      flows.push({
+        source_line: w.sourceLine,
+        sink_line: sink.line,
+        source_type: w.sourceType,
+        sink_type: sink.type,
+        path: [
+          { variable: w.varName, line: w.sourceLine, type: "source" },
+          { variable: w.varName, line: w.line, type: "assignment" },
+          { variable: w.varName, line: sink.line, type: "sink" }
+        ],
+        confidence: 0.9,
+        sanitized: false
+      });
+    }
+  }
+  return flows;
+}
 function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLines, code, types) {
   const flows = [];
   const callsByLine = new Map;
@@ -39789,30 +40004,41 @@ class PythonReceiverTaintFormatPass {
     if (ctx.language !== "python") {
       return { findingsEmitted: 0 };
     }
-    const { calls, meta } = ctx.graph.ir;
-    const constProp = ctx.getResult("constant-propagation");
-    const tainted = constProp.tainted;
+    const { calls, meta, taint } = ctx.graph.ir;
+    const taintedVarNames = new Set;
+    for (const s of taint.sources) {
+      if (typeof s.variable === "string" && s.variable.length > 0) {
+        taintedVarNames.add(s.variable);
+      }
+    }
+    if (taintedVarNames.size === 0) {
+      return { findingsEmitted: 0 };
+    }
+    const seen = new Set;
     let count = 0;
     for (const call of calls) {
-      if (call.method_name !== "format")
+      if (call.method_name !== "format" && call.method_name !== "format_map")
         continue;
       const receiver = call.receiver;
       if (!receiver)
         continue;
       if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(receiver))
         continue;
-      const scopedName = call.in_method ? `${call.in_method}:${receiver}` : receiver;
-      if (!tainted.has(receiver) && !tainted.has(scopedName))
+      if (!taintedVarNames.has(receiver))
+        continue;
+      const seenKey = `${call.location.line}:${receiver}`;
+      if (seen.has(seenKey))
         continue;
+      seen.add(seenKey);
       ctx.addFinding({
-        id: `format_string-${meta.file}-${call.location.line}-${receiver}`,
+        id: `format_string-${meta.file}-${call.location.line}-${receiver}-${call.method_name}`,
         pass: this.name,
         category: "security",
         rule_id: "format_string",
         cwe: "CWE-134",
         severity: "medium",
         level: "warning",
-        message: `Format-string vulnerability: the format template \`${receiver}\` ` + `is tainted (traces back to a taint source). Attacker can leak ` + `object attributes via \`{obj.__class__.__mro__[…]}\` chains or ` + `crash the process via unbounded specifiers. Use a literal ` + `format string and pass user input as an argument instead.`,
+        message: `Format-string vulnerability: the format template \`${receiver}\` ` + `is tainted (traces back to a taint source) and used as the ` + `receiver of \`${call.method_name}(...)\`. Attacker can leak ` + `object attributes via \`{obj.__class__.__mro__[…]}\` chains or ` + `crash the process via unbounded specifiers. Use a literal ` + `format string and pass user input as an argument instead.`,
         file: meta.file,
         line: call.location.line
       });
@@ -45424,7 +45650,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.180.0";
+var version = "3.182.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.180.0",
+  "version": "3.182.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.180.0"
+    "circle-ir": "^3.182.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",