cognium-dev 3.191.0 → 3.192.0

package/dist/cli.js

@@ -24977,6 +24977,7 @@ class LanguageSourcesPass {
       }
       additionalSanitizers.push(...findBashRegexAllowlistSanitizers(code));
       additionalSanitizers.push(...findBashRealpathPrefixGuardSanitizers(code));
+      additionalSanitizers.push(...findBashShellQuoteSanitizers(code));
     }
     if (language === "go") {
       additionalSanitizers.push(...findGoMapAllowlistGuardSanitizers(code));
@@ -26426,6 +26427,29 @@ function hasIntegrityVerifierAnywhere(lines) {
   }
   return false;
 }
+function findBashShellQuoteSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const PRINTF_Q_RE = /\$\(\s*printf\s+['"]%q['"]\s+["']?\$/;
+  const AT_Q_RE = /\$\{[A-Za-z_][A-Za-z0-9_]*@Q\}/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trimStart().startsWith("#"))
+      continue;
+    if (!PRINTF_Q_RE.test(line) && !AT_Q_RE.test(line))
+      continue;
+    for (let l = i2 + 1;l <= lines.length; l++) {
+      sanitizers.push({
+        type: "shell_quote",
+        method: PRINTF_Q_RE.test(line) ? "printf '%q'" : "${var@Q}",
+        line: l,
+        sanitizes: ["command_injection", "code_injection"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findBashRegexAllowlistSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -45980,7 +46004,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.191.0";
+var version = "3.192.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.191.0",
+  "version": "3.192.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.191.0"
+    "circle-ir": "^3.192.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",