cognium-dev 3.182.0 → 3.185.0

package/dist/cli.js

@@ -10691,6 +10691,19 @@ var DEFAULT_SOURCES = [
   { method: "getMap", class: "Metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["javascript", "typescript"] },
   { method: "FromIncomingContext", class: "metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
   { method: "get", class: "Metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
+  { method: "receive_text", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_bytes", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_json", class: "WebSocket", type: "http_body", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive", class: "WebSocket", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_json", type: "http_body", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_text", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "receive_bytes", type: "network_input", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "ReadMessage", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "NextReader", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "Read", class: "Conn", type: "network_input", severity: "high", return_tainted: true, languages: ["go"] },
+  { annotation: "OnMessage", type: "network_input", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "MessageMapping", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "SubscribeMapping", type: "http_body", severity: "high", param_tainted: true, languages: ["java"] },
   { method: "get", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["python"] },
   { method: "hget", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["python"] },
   { method: "mget", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["python"] },
@@ -11982,6 +11995,26 @@ var DEFAULT_SANITIZERS = [
   { method: "resolve", class: "Path", removes: ["path_traversal"] },
   { method: "int", removes: ["sql_injection", "command_injection", "xss"] },
   { method: "float", removes: ["sql_injection", "command_injection"] },
+  { method: "quote", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "quote_plus", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "urlencode", class: "urllib.parse", removes: ["ssrf", "open_redirect", "xss"] },
+  { method: "quote_plus", removes: ["ssrf", "open_redirect", "xss", "path_traversal"] },
+  { method: "urlencode", removes: ["ssrf", "open_redirect", "xss"] },
+  { method: "linkify", class: "bleach", removes: ["xss"] },
+  { method: "linkify", removes: ["xss"] },
+  { method: "escape", class: "django.utils.html", removes: ["xss"] },
+  { method: "strip_tags", class: "django.utils.html", removes: ["xss"] },
+  { method: "escape", class: "jinja2", removes: ["xss"] },
+  { method: "escape", class: "flask", removes: ["xss"] },
+  { method: "escape", class: "saxutils", removes: ["xss"] },
+  { method: "escape", class: "xml.sax.saxutils", removes: ["xss"] },
+  { method: "quoteattr", class: "saxutils", removes: ["xss"] },
+  { method: "quoteattr", class: "xml.sax.saxutils", removes: ["xss"] },
+  { method: "escape", class: "re", removes: ["redos", "code_injection"] },
+  { method: "bindparams", removes: ["sql_injection"] },
+  { method: "Identifier", class: "sql", removes: ["sql_injection"] },
+  { method: "Literal", class: "sql", removes: ["sql_injection"] },
+  { method: "Placeholder", class: "sql", removes: ["sql_injection"] },
   { method: "query!", removes: ["sql_injection"] },
   { method: "query_as!", removes: ["sql_injection"] },
   { method: "query_scalar!", removes: ["sql_injection"] },
@@ -13905,7 +13938,13 @@ function matchesSanitizerPattern(call, pattern) {
       return false;
     }
     if (pattern.class) {
-      if (!call.receiver || !receiverMightBeClass(call.receiver, pattern.class)) {
+      if (!call.receiver) {
+        const target = call.resolution?.target;
+        const expectedTail = `${pattern.class}.${pattern.method}`;
+        if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {} else {
+          return false;
+        }
+      } else if (!receiverMightBeClass(call.receiver, pattern.class)) {
         return false;
       }
     }
@@ -24688,7 +24727,10 @@ var PYTHON_TAINTED_PATTERNS2 = [
   { pattern: /\bget_query_parameter\s*\(/, type: "http_param" },
   { pattern: /\bget_header_value\s*\(/, type: "http_header" },
   { pattern: /\bget_cookie_value\s*\(/, type: "http_cookie" },
-  { pattern: /\binput\s*\(/, type: "io_input" }
+  { pattern: /\binput\s*\(/, type: "io_input" },
+  { pattern: /\.receive_text\s*\(/, type: "network_input" },
+  { pattern: /\.receive_bytes\s*\(/, type: "network_input" },
+  { pattern: /\.receive_json\s*\(/, type: "http_body" }
 ];
 
 class LanguageSourcesPass {
@@ -25332,6 +25374,36 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
       }
     }
   }
+  sources.push(...findJavaScriptCallbackParamSources(sourceCode));
+  return sources;
+}
+function findJavaScriptCallbackParamSources(sourceCode) {
+  const sources = [];
+  const CB_EVENT_RE = /\.on\s*\(\s*['"](?:message|text|binary)['"]\s*,\s*(?:async\s+)?(?:function\s*\*?\s*(?:\w+\s*)?\(\s*(\w+)|\(\s*(\w+)\s*(?:[,):]|$)|(\w+)\s*=>)/;
+  const lines = sourceCode.split(`
+`);
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const trimmed = line.trimStart();
+    if (trimmed.startsWith("//") || trimmed.startsWith("*"))
+      continue;
+    const m = line.match(CB_EVENT_RE);
+    if (!m)
+      continue;
+    const paramName = m[1] ?? m[2] ?? m[3];
+    if (!paramName)
+      continue;
+    if (paramName === "err" || paramName === "error")
+      continue;
+    sources.push({
+      type: "network_input",
+      location: `WebSocket .on(...) callback param '${paramName}' at line ${i2 + 1}`,
+      severity: "high",
+      line: i2 + 1,
+      confidence: 0.95,
+      variable: paramName
+    });
+  }
   return sources;
 }
 function findPythonAssignmentSources(sourceCode, language) {
@@ -25664,6 +25736,16 @@ function buildJavaScriptTaintedVars(sourceCode, language) {
   const tainted = new Map;
   const lines = sourceCode.split(`
 `);
+  const CB_EVENT_RE = /\.on\s*\(\s*['"](?:message|text|binary)['"]\s*,\s*(?:async\s+)?(?:function\s*\*?\s*(?:\w+\s*)?\(\s*(\w+)|\(\s*(\w+)\s*(?:[,):]|$)|(\w+)\s*=>)/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = lines[i2].match(CB_EVENT_RE);
+    if (!m)
+      continue;
+    const paramName = m[1] ?? m[2] ?? m[3];
+    if (!paramName || paramName === "err" || paramName === "error")
+      continue;
+    tainted.set(paramName, i2 + 1);
+  }
   for (let i2 = 0;i2 < lines.length; i2++) {
     const line = lines[i2];
     const trimmed = line.trimStart();
@@ -25870,6 +25952,90 @@ function findBashTaintSources(sourceCode, dfg) {
         });
       }
     }
+    const readMatch = /^read\s*\(/.test(trimmed) ? null : trimmed.match(/^read\b([^#(]*)$/);
+    if (readMatch) {
+      const argStr = readMatch[1].trim();
+      const noRedirect = argStr.replace(/\s*<[^<].*$/, "").trim();
+      const tokens = noRedirect.split(/\s+/);
+      const varNames = [];
+      for (let ti = 0;ti < tokens.length; ti++) {
+        const tok = tokens[ti];
+        if (!tok)
+          continue;
+        if (tok.startsWith("-")) {
+          if (/^-[antpidu]$|^-N$/.test(tok))
+            ti++;
+          continue;
+        }
+        if (/^[A-Za-z_][\w]*$/.test(tok))
+          varNames.push(tok);
+      }
+      if (varNames.length === 0)
+        varNames.push("REPLY");
+      for (const v of varNames) {
+        const already = sources.some((s) => s.line === lineNumber && s.variable === v);
+        if (already)
+          continue;
+        sources.push({
+          type: "io_input",
+          location: `read → $${v} (stdin)`,
+          severity: "high",
+          line: lineNumber,
+          confidence: 0.9,
+          variable: v
+        });
+      }
+    }
+    const mapfileMatch = /^(?:mapfile|readarray)\s*\(/.test(trimmed) ? null : trimmed.match(/^(?:mapfile|readarray)\b([^#(]*)$/);
+    if (mapfileMatch) {
+      const argStr = mapfileMatch[1].trim();
+      const tokens = argStr.split(/\s+/);
+      const varNames = [];
+      for (let ti = 0;ti < tokens.length; ti++) {
+        const tok = tokens[ti];
+        if (!tok)
+          continue;
+        if (tok.startsWith("-")) {
+          if (/^-[cCnOsud]$/.test(tok))
+            ti++;
+          continue;
+        }
+        if (/^[A-Za-z_][\w]*$/.test(tok))
+          varNames.push(tok);
+      }
+      if (varNames.length === 0)
+        varNames.push("MAPFILE");
+      for (const v of varNames) {
+        const already = sources.some((s) => s.line === lineNumber && s.variable === v);
+        if (already)
+          continue;
+        sources.push({
+          type: "io_input",
+          location: `mapfile → $${v} (stdin array)`,
+          severity: "high",
+          line: lineNumber,
+          confidence: 0.9,
+          variable: v
+        });
+      }
+    }
+    const getoptsMatch = trimmed.match(/\bgetopts\s+["'][^"']+["']\s+(\w+)/);
+    if (getoptsMatch) {
+      const flagVar = getoptsMatch[1];
+      for (const v of [flagVar, "OPTARG"]) {
+        const already = sources.some((s) => s.line === lineNumber && s.variable === v);
+        if (already)
+          continue;
+        sources.push({
+          type: "io_input",
+          location: `getopts → $${v} (CLI arg)`,
+          severity: "high",
+          line: lineNumber,
+          confidence: 0.9,
+          variable: v
+        });
+      }
+    }
     const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})\}/g;
     let em;
     while ((em = envRe.exec(line)) !== null) {
@@ -45650,7 +45816,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.182.0";
+var version = "3.185.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.182.0",
+  "version": "3.185.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.182.0"
+    "circle-ir": "^3.185.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",