cognium-dev 3.191.0 → 3.193.0

package/dist/cli.js

@@ -15947,22 +15947,36 @@ class CrossFileResolver {
         if (source.type === "interprocedural_param")
           continue;
         const sourceVar = source.variable ?? this.getLocalDefVarAt(ir, source.line);
+        const reachable = sourceVar ? this.collectTaintReachable(ir, sourceVar, source.line, filePath) : undefined;
         for (const call of ir.calls) {
           if (call.location.line < source.line)
             continue;
           const resolved = this.resolveCall(call, filePath);
           if (!resolved || resolved.targetFile === filePath)
             continue;
-          if (sourceVar) {
-            const argMentions = call.arguments.some((arg) => {
-              if (arg.variable === sourceVar)
-                return true;
-              if (arg.expression && new RegExp(`\\b${sourceVar}\\b`).test(arg.expression))
-                return true;
-              return false;
-            });
-            if (!argMentions)
+          if (reachable) {
+            let matchedName;
+            for (const arg of call.arguments) {
+              if (arg.variable && reachable.names.has(arg.variable)) {
+                matchedName = arg.variable;
+                break;
+              }
+              if (arg.expression) {
+                for (const v of reachable.names) {
+                  if (new RegExp(`\\b${v}\\b`).test(arg.expression)) {
+                    matchedName = v;
+                    break;
+                  }
+                }
+                if (matchedName)
+                  break;
+              }
+            }
+            if (!matchedName)
+              continue;
+            if (this.taintClobbered(ir, call.location.line, matchedName, reachable.defIds)) {
               continue;
+            }
           }
           const targetIR = this.fileIRs.get(resolved.targetFile);
           if (!targetIR || targetIR.taint.sinks.length === 0)
@@ -16023,7 +16037,8 @@ class CrossFileResolver {
               file: callerFile,
               line: src.line,
               type: src.type,
-              hopChain: [{ file: callerFile, line: src.line, method: method.name, kind: "source" }]
+              hopChain: [{ file: callerFile, line: src.line, method: method.name, kind: "source" }],
+              defIds: this.collectTaintReachable(callerIR, src.variable, src.line, callerFile).defIds
             });
           }
           const callsInMethod = callerIdx.callsByMethod.get(method) ?? [];
@@ -16052,7 +16067,8 @@ class CrossFileResolver {
                   file: sourceFile,
                   line: sourceLine,
                   type: sourceType,
-                  hopChain: baseChain
+                  hopChain: baseChain,
+                  defIds: this.forwardReachableDefs(callerIR, [def.id], callerFile)
                 });
               }
             }
@@ -16065,6 +16081,9 @@ class CrossFileResolver {
               const matched = this.matchTaintedArg(arg, tainted);
               if (!matched)
                 continue;
+              if (this.taintClobbered(callerIR, call.location.line, matched.var, matched.origin.defIds)) {
+                continue;
+              }
               const calleeNode = methodIndex.get(resolved.targetMethod);
               if (!calleeNode)
                 continue;
@@ -16398,6 +16417,62 @@ class CrossFileResolver {
     }
     return;
   }
+  collectTaintReachable(ir, sourceVar, sourceLine, filePath) {
+    const defs = ir.dfg.defs;
+    let seedDefs = defs.filter((d) => d.variable === sourceVar && d.line === sourceLine);
+    if (seedDefs.length === 0) {
+      const named = defs.filter((d) => d.variable === sourceVar).sort((a, b) => a.line - b.line);
+      if (named.length > 0)
+        seedDefs = [named[0]];
+    }
+    const defIds = this.forwardReachableDefs(ir, seedDefs.map((d) => d.id), filePath);
+    const names = new Set([sourceVar]);
+    for (const d of defs) {
+      if (d.variable && defIds.has(d.id))
+        names.add(d.variable);
+    }
+    return { names, defIds };
+  }
+  forwardReachableDefs(ir, seedDefIds, filePath) {
+    const defIds = new Set(seedDefIds);
+    const chains = ir.dfg.chains;
+    if (!chains || chains.length === 0 || seedDefIds.length === 0)
+      return defIds;
+    const lineByDefId = new Map;
+    for (const d of ir.dfg.defs)
+      lineByDefId.set(d.id, d.line);
+    const crossFileCallLines = new Set;
+    for (const call of ir.calls) {
+      const resolved = this.resolveCall(call, filePath);
+      if (resolved && resolved.targetFile !== filePath) {
+        crossFileCallLines.add(call.location.line);
+      }
+    }
+    const frontier = [...seedDefIds];
+    const visited = new Set(frontier);
+    while (frontier.length > 0) {
+      const cur = frontier.shift();
+      for (const ch of chains) {
+        if (ch.from_def !== cur || visited.has(ch.to_def))
+          continue;
+        visited.add(ch.to_def);
+        const toLine = lineByDefId.get(ch.to_def);
+        if (toLine !== undefined && crossFileCallLines.has(toLine))
+          continue;
+        defIds.add(ch.to_def);
+        frontier.push(ch.to_def);
+      }
+    }
+    return defIds;
+  }
+  taintClobbered(ir, callLine, varName, taintDefIds) {
+    if (!taintDefIds || taintDefIds.size === 0)
+      return false;
+    const use = ir.dfg.uses.find((u) => u.line === callLine && u.variable === varName && u.def_id !== null);
+    if (!use || use.def_id === null)
+      return false;
+    return !taintDefIds.has(use.def_id);
+  }
   findRealSourceLineInMethod(ir, method) {
     for (const src of ir.taint.sources) {
       if (src.type === "interprocedural_param")
@@ -24977,6 +25052,7 @@ class LanguageSourcesPass {
       }
       additionalSanitizers.push(...findBashRegexAllowlistSanitizers(code));
       additionalSanitizers.push(...findBashRealpathPrefixGuardSanitizers(code));
+      additionalSanitizers.push(...findBashShellQuoteSanitizers(code));
     }
     if (language === "go") {
       additionalSanitizers.push(...findGoMapAllowlistGuardSanitizers(code));
@@ -26426,6 +26502,29 @@ function hasIntegrityVerifierAnywhere(lines) {
   }
   return false;
 }
+function findBashShellQuoteSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const PRINTF_Q_RE = /\$\(\s*printf\s+['"]%q['"]\s+["']?\$/;
+  const AT_Q_RE = /\$\{[A-Za-z_][A-Za-z0-9_]*@Q\}/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trimStart().startsWith("#"))
+      continue;
+    if (!PRINTF_Q_RE.test(line) && !AT_Q_RE.test(line))
+      continue;
+    for (let l = i2 + 1;l <= lines.length; l++) {
+      sanitizers.push({
+        type: "shell_quote",
+        method: PRINTF_Q_RE.test(line) ? "printf '%q'" : "${var@Q}",
+        line: l,
+        sanitizes: ["command_injection", "code_injection"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findBashRegexAllowlistSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -45980,7 +46079,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.191.0";
+var version = "3.193.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.191.0",
+  "version": "3.193.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.191.0"
+    "circle-ir": "^3.193.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",