cognium-dev 3.193.0 → 3.195.0

package/dist/cli.js

@@ -9350,6 +9350,7 @@ var GO_KEYWORDS = new Set([
 function buildGoDFG(tree) {
   const defs = [];
   const uses = [];
+  const extraChains = [];
   let defIdCounter = 1;
   let useIdCounter = 1;
   const scopeStack = [new Map];
@@ -9371,7 +9372,7 @@ function buildGoDFG(tree) {
     }
     const body2 = func2.childForFieldName("body");
     if (body2) {
-      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter });
+      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter }, extraChains);
       defIdCounter = defs.length + 1;
       useIdCounter = uses.length + 1;
     }
@@ -9387,6 +9388,15 @@ function buildGoDFG(tree) {
     }
   }
   const chains = computeChains(defs, uses);
+  const seen = new Set(chains.map((c) => `${c.from_def}|${c.to_def}|${c.via}`));
+  for (const ch of extraChains) {
+    const key = `${ch.from_def}|${ch.to_def}|${ch.via}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      chains.push(ch);
+    }
+  }
+  chains.sort((a, b) => a.from_def - b.from_def || a.to_def - b.to_def);
   return { defs, uses, chains };
 }
 function extractGoParamDefs(params, defs, _startId, scopeStack) {
@@ -9415,28 +9425,51 @@ function extractGoParamDefs(params, defs, _startId, scopeStack) {
     }
   }
 }
-function processGoBlock(node, defs, uses, scopeStack, counters) {
+function processGoBlock(node, defs, uses, scopeStack, counters, extraChains = []) {
+  const linkMultiLineRhs = (right, useStart, useEnd, defStart, defEnd) => {
+    if (right.endPosition.row <= right.startPosition.row)
+      return;
+    for (let ui = useStart;ui < useEnd; ui++) {
+      const u = uses[ui];
+      if (!u || u.def_id === null)
+        continue;
+      for (let di = defStart;di < defEnd; di++) {
+        const d = defs[di];
+        if (d && d.kind === "local" && d.id !== u.def_id) {
+          extraChains.push({ from_def: u.def_id, to_def: d.id, via: u.variable });
+        }
+      }
+    }
+  };
   walkTree(node, (child) => {
     if (child.type === "short_var_declaration") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right)
+        linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "var_declaration") {
       processGoVarDecl(child, defs, scopeStack, counters);
     } else if (child.type === "assignment_statement") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right)
+        linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {
@@ -10686,7 +10719,7 @@ var DEFAULT_SOURCES = [
   { method: "Json", type: "http_body", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "Query", type: "http_param", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "Path", type: "http_path", severity: "high", return_tainted: true, languages: ["rust"] },
-  { method: "Form", type: "http_param", severity: "high", return_tainted: true, languages: ["rust"] },
+  { method: "Form", type: "http_body", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "var", class: "env", type: "env_input", severity: "medium", return_tainted: true },
   { method: "var_os", class: "env", type: "env_input", severity: "medium", return_tainted: true },
   { method: "args", class: "env", type: "env_input", severity: "medium", return_tainted: true },
@@ -11475,7 +11508,7 @@ var DEFAULT_SINKS = [
   { method: "execSync", class: "child_process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "spawn", class: "child_process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "spawnSync", class: "child_process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "exec", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0] },
+  { method: "exec", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], exclude_languages: ["python"] },
   { method: "execSync", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "spawn", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "spawnSync", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -11495,7 +11528,7 @@ var DEFAULT_SINKS = [
   { method: "query", class: "Client", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "execute", class: "Pool", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
-  { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "all", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "run", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
@@ -12450,6 +12483,17 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
+function sinkPatternAppliesTo(pattern, language) {
+  if (language === undefined)
+    return true;
+  if (pattern.languages && pattern.languages.length > 0 && !pattern.languages.includes(language)) {
+    return false;
+  }
+  if (pattern.exclude_languages && pattern.exclude_languages.includes(language)) {
+    return false;
+  }
+  return true;
+}
 function expandPromisifyAliases(patterns, sourceLines, language) {
   if (!sourceLines || sourceLines.length === 0)
     return patterns;
@@ -12458,7 +12502,7 @@ function expandPromisifyAliases(patterns, sourceLines, language) {
   const PROMISIFY_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:util\s*\.\s*)?promisify\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
   const innerToPattern = new Map;
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language))
+    if (!sinkPatternAppliesTo(p, language))
       continue;
     if (p.class !== undefined)
       continue;
@@ -12466,7 +12510,7 @@ function expandPromisifyAliases(patterns, sourceLines, language) {
       innerToPattern.set(p.method, p);
   }
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language))
+    if (!sinkPatternAppliesTo(p, language))
       continue;
     if (innerToPattern.has(p.method))
       continue;
@@ -12508,7 +12552,7 @@ function expandIndirectEvalAliases(patterns, sourceLines, language) {
   const INDIRECT_EVAL_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*(eval|Function)\b(?!\s*\()/;
   const innerToPattern = new Map;
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language))
+    if (!sinkPatternAppliesTo(p, language))
       continue;
     if (p.class !== undefined)
       continue;
@@ -13268,7 +13312,7 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   return false;
 }
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
-  const patternsForLanguage = language === undefined ? patterns : patterns.filter((p) => !p.languages || p.languages.length === 0 || p.languages.includes(language));
+  const patternsForLanguage = language === undefined ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = new Map;
   for (const call of calls) {
     for (const pattern of patternsForLanguage) {
@@ -13603,10 +13647,8 @@ var SINK_FQN_EXCLUSIONS = {
   ]
 };
 function matchesSinkPattern(call, pattern, typeHierarchy, language) {
-  if (pattern.languages && pattern.languages.length > 0 && language !== undefined) {
-    if (!pattern.languages.includes(language)) {
-      return false;
-    }
+  if (!sinkPatternAppliesTo(pattern, language)) {
+    return false;
   }
   const callMethodName = call.method_name;
   const patternMethod = pattern.method;
@@ -20954,99 +20996,11 @@ class JavaPlugin extends BaseLanguagePlugin {
         severity: "high",
         confidence: 0.9,
         returnTainted: true
-      },
-      {
-        method: "getParameter",
-        class: "HttpServletRequest",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "getParameterValues",
-        class: "HttpServletRequest",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "getHeader",
-        class: "HttpServletRequest",
-        type: "http_header",
-        severity: "high",
-        confidence: 0.9,
-        returnTainted: true
-      },
-      {
-        method: "getCookies",
-        class: "HttpServletRequest",
-        type: "http_cookie",
-        severity: "high",
-        confidence: 0.9,
-        returnTainted: true
-      },
-      {
-        method: "getInputStream",
-        class: "HttpServletRequest",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.85,
-        returnTainted: true
-      },
-      {
-        method: "getReader",
-        class: "HttpServletRequest",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.85,
-        returnTainted: true
       }
     ];
   }
   getBuiltinSinks() {
     return [
-      {
-        method: "executeQuery",
-        class: "Statement",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "executeUpdate",
-        class: "Statement",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "execute",
-        class: "Statement",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "exec",
-        class: "Runtime",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "start",
-        class: "ProcessBuilder",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: []
-      },
       {
         method: "FileInputStream",
         type: "path_traversal",
@@ -21061,38 +21015,6 @@ class JavaPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "write",
-        class: "PrintWriter",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "println",
-        class: "PrintWriter",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "search",
-        class: "DirContext",
-        type: "ldap_injection",
-        cwe: "CWE-90",
-        severity: "high",
-        argPositions: [0, 1]
-      },
-      {
-        method: "evaluate",
-        class: "XPath",
-        type: "xpath_injection",
-        cwe: "CWE-643",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "readObject",
         class: "ObjectInputStream",
@@ -21602,37 +21524,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
   }
   getBuiltinSinks() {
     return [
-      {
-        method: "exec",
-        class: "child_process",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "execSync",
-        class: "child_process",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "spawn",
-        class: "child_process",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0, 1]
-      },
-      {
-        method: "eval",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "Function",
         type: "code_injection",
@@ -21654,44 +21545,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "readFileSync",
-        class: "fs",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "writeFileSync",
-        class: "fs",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "createReadStream",
-        class: "fs",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "innerHTML",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "outerHTML",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "document.write",
         type: "xss",
@@ -21741,13 +21594,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "raw",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "$executeRawUnsafe",
         type: "sql_injection",
@@ -21762,29 +21608,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "fetch",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "get",
-        class: "axios",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "request",
-        class: "http",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "find",
         type: "nosql_injection",
@@ -21792,13 +21615,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "findOne",
-        type: "nosql_injection",
-        cwe: "CWE-943",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "merge",
         type: "prototype_pollution",
@@ -21874,13 +21690,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "redirect",
-        type: "open_redirect",
-        cwe: "CWE-601",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "push",
         class: "router",
@@ -22123,13 +21932,6 @@ class PythonPlugin extends BaseLanguagePlugin {
         confidence: 0.9,
         returnTainted: true
       },
-      {
-        method: "input",
-        type: "user_input",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
       {
         method: "argv",
         class: "sys",
@@ -22145,129 +21947,11 @@ class PythonPlugin extends BaseLanguagePlugin {
         severity: "medium",
         confidence: 0.85,
         returnTainted: true
-      },
-      {
-        method: "getenv",
-        class: "os",
-        type: "env_var",
-        severity: "medium",
-        confidence: 0.85,
-        returnTainted: true
-      },
-      {
-        method: "read",
-        type: "file_input",
-        severity: "medium",
-        confidence: 0.8,
-        returnTainted: true
-      },
-      {
-        method: "readline",
-        type: "file_input",
-        severity: "medium",
-        confidence: 0.8,
-        returnTainted: true
-      },
-      {
-        method: "readlines",
-        type: "file_input",
-        severity: "medium",
-        confidence: 0.8,
-        returnTainted: true
       }
     ];
   }
   getBuiltinSinks() {
     return [
-      {
-        method: "system",
-        class: "os",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "popen",
-        class: "os",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "run",
-        class: "subprocess",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "call",
-        class: "subprocess",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "Popen",
-        class: "subprocess",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "eval",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "exec",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "compile",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "execute",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "executemany",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "raw",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "open",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "read",
         class: "pathlib",
@@ -22276,13 +21960,6 @@ class PythonPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "Markup",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "safe",
         type: "xss",
@@ -22290,22 +21967,6 @@ class PythonPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "get",
-        class: "requests",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "post",
-        class: "requests",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "urlopen",
         class: "urllib",
@@ -22330,30 +21991,6 @@ class PythonPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [1]
       },
-      {
-        method: "loads",
-        class: "pickle",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "load",
-        class: "pickle",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "load",
-        class: "yaml",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "unsafe_load",
         class: "yaml",
@@ -22489,34 +22126,6 @@ class RustPlugin extends BaseLanguagePlugin {
   }
   getBuiltinSources() {
     return [
-      {
-        method: "Query",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Json",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Path",
-        type: "http_path",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Form",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
       {
         method: "args",
         class: "std::env",
@@ -22564,14 +22173,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "medium",
         confidence: 0.8,
         returnTainted: true
-      },
-      {
-        method: "read",
-        class: "TcpStream",
-        type: "network_input",
-        severity: "high",
-        confidence: 0.85,
-        returnTainted: true
       }
     ];
   }
@@ -22585,29 +22186,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "arg",
-        class: "Command",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "args",
-        class: "Command",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "execute",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "query",
         type: "sql_injection",
@@ -22622,22 +22200,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "open",
-        class: "File",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "create",
-        class: "File",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "read_to_string",
         class: "std::fs",
@@ -22675,38 +22237,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "from_str",
-        class: "serde_json",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "medium",
-        argPositions: [0]
-      },
-      {
-        method: "from_slice",
-        class: "serde_json",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "medium",
-        argPositions: [0]
-      },
-      {
-        method: "get",
-        class: "reqwest",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "post",
-        class: "reqwest",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "new",
         class: "Regex",
@@ -22799,13 +22329,6 @@ class BashPlugin extends BaseLanguagePlugin {
   }
   getBuiltinSources() {
     return [
-      {
-        method: "read",
-        type: "io_input",
-        severity: "high",
-        confidence: 0.9,
-        returnTainted: true
-      },
       {
         method: "curl",
         type: "http_response",
@@ -22824,13 +22347,6 @@ class BashPlugin extends BaseLanguagePlugin {
   }
   getBuiltinSinks() {
     return [
-      {
-        method: "eval",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "bash",
         type: "command_injection",
@@ -23226,30 +22742,6 @@ class GoPlugin extends BaseLanguagePlugin {
         confidence: 0.9,
         returnTainted: true
       },
-      {
-        method: "Query",
-        class: "Context",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Param",
-        class: "Context",
-        type: "http_path",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "PostForm",
-        class: "Context",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
       {
         method: "GetRawData",
         class: "Context",
@@ -23446,14 +22938,6 @@ class GoPlugin extends BaseLanguagePlugin {
         severity: "medium",
         argPositions: [0]
       },
-      {
-        method: "Decode",
-        class: "Decoder",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "medium",
-        argPositions: [0]
-      },
       {
         method: "Print",
         class: "log",
@@ -25088,6 +24572,7 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findPythonRangeCheckGuardSanitizers(code));
       additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
       additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
+      additionalSanitizers.push(...findPythonTraversalRejectGuardSanitizers(code));
       additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
       additionalSanitizers.push(...findPythonJinjaAutoescapeSanitizers(code));
       const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
@@ -26991,6 +26476,69 @@ function findPythonSetMembershipXssGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findPythonTraversalRejectGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const guardOpen = /^(\s*)if\s+(['"])(\.\.[/\\]?)\2\s+in\s+([A-Za-z_][A-Za-z0-9_]*)\s*:\s*$/;
+  const terminator = /\b(return|raise|abort\s*\(|sys\.exit\s*\()/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = guardOpen.exec(lines[i2]);
+    if (!m)
+      continue;
+    const guardIndent = m[1].length;
+    const guardedVar = m[4];
+    let bodyHasTerminator = false;
+    let blockEnd = -1;
+    const maxScan = Math.min(lines.length, i2 + 26);
+    for (let j = i2 + 1;j < maxScan; j++) {
+      const line = lines[j];
+      if (line.trim() === "")
+        continue;
+      const indent = line.length - line.trimStart().length;
+      if (indent <= guardIndent) {
+        blockEnd = j - 1;
+        break;
+      }
+      if (terminator.test(line))
+        bodyHasTerminator = true;
+    }
+    if (blockEnd === -1)
+      blockEnd = Math.min(lines.length - 1, i2 + 25);
+    if (!bodyHasTerminator)
+      continue;
+    const guarded = new Set([guardedVar]);
+    const assignRe = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=(?!=)\s*(.*)$/;
+    const mentionsGuarded = (text) => {
+      for (const name2 of guarded) {
+        if (new RegExp(`\\b${name2}\\b`).test(text))
+          return true;
+      }
+      return false;
+    };
+    for (let l = blockEnd + 2;l <= lines.length; l++) {
+      const lineText = lines[l - 1];
+      const assign = assignRe.exec(lineText);
+      if (assign) {
+        const target = assign[1];
+        const rhs = assign[2];
+        if (mentionsGuarded(rhs))
+          guarded.add(target);
+        else if (target !== guardedVar)
+          guarded.delete(target);
+      }
+      if (!mentionsGuarded(lineText))
+        continue;
+      sanitizers.push({
+        type: "python_traversal_reject_guard",
+        method: "if",
+        line: l,
+        sanitizes: ["path_traversal"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findPythonDefusedXmlSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -33426,6 +32974,375 @@ class DeserializationSafetyGatePass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/prompt-injection-safety-gate-pass.js
+function isDelimiterLiteral(lit) {
+  const s = lit.trim();
+  if (s.length === 0)
+    return true;
+  return /^<\/?[\w.-]+\s*\/?>$/.test(s) || /^\[\/?[\w.-]+\]$/.test(s) || /^`{1,3}[\w-]*$/.test(s) || /^"""[\w-]*$/.test(s) || /^[#*=_~-]{2,}$/.test(s) || /^<{2,}[\w-]*$/.test(s) || /^[\w-]*>{2,}$/.test(s);
+}
+function scanValue(code, start2) {
+  let depth = 0;
+  let str = null;
+  let out2 = "";
+  for (let i2 = start2;i2 < code.length; i2++) {
+    const c = code[i2];
+    if (str) {
+      out2 += c;
+      if (c === str && code[i2 - 1] !== "\\")
+        str = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      str = c;
+      out2 += c;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") {
+      depth++;
+      out2 += c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0)
+        break;
+      depth--;
+      out2 += c;
+      continue;
+    }
+    if (c === "," && depth === 0)
+      break;
+    out2 += c;
+  }
+  return out2.trim();
+}
+function stringLiterals(expr) {
+  return [...expr.matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => m[1] ?? m[2] ?? "");
+}
+function hasIdentifier(expr) {
+  return /[A-Za-z_$][\w$]*/.test(expr.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, " "));
+}
+function isPureLiteral(valueExpr) {
+  const stripped = valueExpr.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, " ");
+  return !/[A-Za-z_$][\w$]*/.test(stripped);
+}
+function isInstructionConcat(valueExpr) {
+  if (!valueExpr.includes("+"))
+    return false;
+  if (!hasIdentifier(valueExpr))
+    return false;
+  const lits = stringLiterals(valueExpr);
+  if (lits.length === 0)
+    return false;
+  return !lits.every(isDelimiterLiteral);
+}
+function isMixedTemplate(v) {
+  const fstr = v.match(/\bf(["'])((?:\\.|(?!\1).)*)\1/);
+  if (fstr) {
+    const body2 = fstr[2];
+    if (/\{[^}]+\}/.test(body2) && /\w/.test(body2.replace(/\{[^}]*\}/g, "")))
+      return true;
+  }
+  const tmpl = v.match(/`([^`]*)`/);
+  if (tmpl) {
+    const body2 = tmpl[1];
+    if (/\$\{[^}]+\}/.test(body2) && /\w/.test(body2.replace(/\$\{[^}]*\}/g, "")))
+      return true;
+  }
+  return false;
+}
+function assignmentRe(varName, flags2 = "") {
+  return new RegExp(`\\b${varName}\\s*(?::=|(?<![=<>!])=(?!=))\\s*`, flags2);
+}
+function resolveAssignmentRHS(varName, codeLines) {
+  const re = assignmentRe(varName);
+  for (const line of codeLines) {
+    const m = line.match(re);
+    if (m && m.index !== undefined) {
+      return scanValue(line, m.index + m[0].length);
+    }
+  }
+  return;
+}
+function classifyExpr(v) {
+  if (isMixedTemplate(v))
+    return "unsafe";
+  if (v.includes("+")) {
+    if (isInstructionConcat(v))
+      return "unsafe";
+    const lits = stringLiterals(v);
+    if (lits.length > 0 && lits.every(isDelimiterLiteral) && hasIdentifier(v))
+      return "safe";
+    return "unknown";
+  }
+  return "unknown";
+}
+function classifyContentPlacement(val, codeLines) {
+  const v = val.trim();
+  if (/^[A-Za-z_$][\w$]*$/.test(v)) {
+    const rhs = resolveAssignmentRHS(v, codeLines);
+    if (rhs === undefined)
+      return "unknown";
+    return classifyExpr(rhs);
+  }
+  return classifyExpr(v);
+}
+function classifyPromptCall(callCode, codeLines) {
+  const contentRe = /["']?[Cc]ontent["']?\s*[:=]\s*/g;
+  let m;
+  let sawDynamic = false;
+  let allSafe = true;
+  while ((m = contentRe.exec(callCode)) !== null) {
+    const val = scanValue(callCode, m.index + m[0].length);
+    if (val === "" || isPureLiteral(val))
+      continue;
+    sawDynamic = true;
+    const ctx = callCode.slice(Math.max(0, m.index - 80), m.index);
+    const roleM = ctx.match(/["']?[Rr]ole["']?\s*[:=]\s*["'](\w+)["'][^"']*$/);
+    const role = roleM ? roleM[1].toLowerCase() : "user";
+    if (role === "system" || role === "assistant")
+      return "unsafe";
+    const placement = classifyContentPlacement(val, codeLines);
+    if (placement === "unsafe")
+      return "unsafe";
+    if (placement !== "safe")
+      allSafe = false;
+  }
+  if (!sawDynamic)
+    return "unknown";
+  return allSafe ? "safe" : "unknown";
+}
+function scanRhsAcrossLines(text, start2) {
+  let depth = 0;
+  let str = null;
+  let out2 = "";
+  for (let i2 = start2;i2 < text.length; i2++) {
+    const c = text[i2];
+    if (str) {
+      out2 += c;
+      if (c === str && text[i2 - 1] !== "\\")
+        str = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      str = c;
+      out2 += c;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") {
+      depth++;
+      out2 += c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0)
+        break;
+      depth--;
+      out2 += c;
+      continue;
+    }
+    if (c === `
+` && depth === 0)
+      break;
+    out2 += c;
+  }
+  return out2.trim();
+}
+function resolveBuilderRhs(varName, joined) {
+  const re = assignmentRe(varName, "g");
+  const m = re.exec(joined);
+  if (m)
+    return scanRhsAcrossLines(joined, m.index + m[0].length);
+  return;
+}
+function collectBuilderRegion(callCode, joined) {
+  const parts2 = [];
+  const seen = new Set;
+  const stack = [...callCode.matchAll(/[A-Za-z_$][\w$]*/g)].map((x) => x[0]);
+  let budget = 40;
+  while (stack.length > 0 && budget-- > 0) {
+    const v = stack.pop();
+    if (seen.has(v))
+      continue;
+    seen.add(v);
+    const rhs = resolveBuilderRhs(v, joined);
+    if (rhs) {
+      parts2.push(rhs);
+      for (const mm of rhs.matchAll(/[A-Za-z_$][\w$]*/g))
+        stack.push(mm[0]);
+    }
+  }
+  return parts2.join(`
+`);
+}
+function classifyPromptSink(callCode, codeLines) {
+  const direct = classifyPromptCall(callCode, codeLines);
+  if (direct !== "unknown")
+    return direct;
+  const region = collectBuilderRegion(callCode, codeLines.join(`
+`));
+  if (!region)
+    return "unknown";
+  return classifyPromptCall(region, codeLines);
+}
+
+class PromptInjectionSafetyGatePass {
+  name = "prompt-injection-safety-gate";
+  category = "security";
+  run(ctx) {
+    const { graph, code } = ctx;
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0)
+      return { droppedSafe: 0 };
+    const codeLines = code.split(`
+`);
+    let droppedSafe = 0;
+    const kept = sinks.filter((sink) => {
+      if (sink.type !== "prompt_injection")
+        return true;
+      const callCode = sink.code ?? codeLines[sink.line - 1] ?? "";
+      if (!callCode)
+        return true;
+      if (classifyPromptSink(callCode, codeLines) === "safe") {
+        droppedSafe++;
+        return false;
+      }
+      return true;
+    });
+    if (droppedSafe > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { droppedSafe };
+  }
+}
+
+// ../circle-ir/dist/analysis/passes/speculative-prompt-param-source-pass.js
+function returnOrAssignRhs(text) {
+  const t = text.trim();
+  const ret = t.match(/^return\s+(.+?);?$/);
+  if (ret)
+    return ret[1];
+  const asg = t.match(/^[A-Za-z_$][\w$.]*\s*(?::=|(?<![=<>!])=(?!=))\s*(.+?);?$/);
+  if (asg)
+    return asg[1];
+  return;
+}
+function looksLikePromptText(lit) {
+  const s = lit.trim();
+  if (/\b(you are|you're|assistant|system prompt|follow (the )?(policy|instructions|rules)|act as|your task|instructions?\s*:|ignore (all )?previous|do not reveal|respond (to|with|as)|answer the (question|user)|you (must|should|will)|helpful (ai|assistant))\b/i.test(s)) {
+    return true;
+  }
+  const words = s.split(/\s+/).filter(Boolean);
+  return words.length >= 4 && s.length >= 20;
+}
+function literalsOf(expr) {
+  return [...expr.matchAll(/"([^"]*)"|'([^']*)'|`([^`]*)`/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "");
+}
+function detectPromptConstructionFlows(codeLines, types) {
+  const flows = [];
+  const seen = new Set;
+  for (const type of types) {
+    for (const method of type.methods) {
+      const params = (method.parameters ?? []).map((p) => ({ name: p.name, line: p.line ?? method.start_line })).filter((p) => p.name && p.name !== "_");
+      if (params.length === 0)
+        continue;
+      for (let line = method.start_line;line <= method.end_line; line++) {
+        const text = codeLines[line - 1] ?? "";
+        const rhs = returnOrAssignRhs(text);
+        if (!rhs || !isInstructionConcat(rhs))
+          continue;
+        if (!literalsOf(rhs).some(looksLikePromptText))
+          continue;
+        const param = params.find((p) => new RegExp(`\\b${p.name}\\b`).test(rhs));
+        if (!param)
+          continue;
+        const key = `${param.line}|${line}`;
+        if (seen.has(key))
+          continue;
+        seen.add(key);
+        flows.push({
+          source_line: param.line,
+          sink_line: line,
+          source_type: "http_body",
+          sink_type: "prompt_injection",
+          path: [
+            { variable: param.name, line: param.line, type: "source" },
+            { variable: param.name, line, type: "sink" }
+          ],
+          confidence: 1,
+          sanitized: false
+        });
+      }
+    }
+  }
+  return flows;
+}
+function looksLikeTextParam(type) {
+  if (!type)
+    return true;
+  const t = type.trim();
+  if (t.startsWith("*") || t.startsWith("&"))
+    return false;
+  if (/\b(Client|Context|Writer|Reader|Conn|DB|Logger|Handler|Server|Request|Response|Pool|Session|Engine|Service|Repository|Config)\b/.test(t)) {
+    return false;
+  }
+  return /(?:^|\b)(string|str|String|text|any|object|interface\{\}|\[\]byte|\[\]string|List\[str\]|Optional\[str\])(?:\b|$)/i.test(t) || /^[A-Za-z_$][\w$<>[\], |]*$/.test(t);
+}
+
+class SpeculativePromptParamSourcePass {
+  enabled;
+  name = "speculative-prompt-param-source";
+  category = "security";
+  constructor(enabled) {
+    this.enabled = enabled;
+  }
+  run(ctx) {
+    if (!this.enabled)
+      return { added: 0 };
+    if (!ctx.hasResult("sink-filter"))
+      return { added: 0 };
+    const sinkFilter = ctx.getResult("sink-filter");
+    const { types } = ctx.graph.ir;
+    const promptSinks = sinkFilter.sinks.filter((s) => s.type === "prompt_injection");
+    if (promptSinks.length === 0)
+      return { added: 0 };
+    const existing = new Set(sinkFilter.sources.filter((s) => typeof s.variable === "string").map((s) => `${s.variable}:${s.line}`));
+    const added = [];
+    for (const type of types) {
+      for (const method of type.methods) {
+        const hasPromptSink = promptSinks.some((s) => s.line >= method.start_line && s.line <= method.end_line);
+        if (!hasPromptSink)
+          continue;
+        for (const param of method.parameters) {
+          if (!param.name || param.name === "_")
+            continue;
+          if (!looksLikeTextParam(param.type))
+            continue;
+          const line = param.line ?? method.start_line;
+          const key = `${param.name}:${line}`;
+          if (existing.has(key))
+            continue;
+          existing.add(key);
+          added.push({
+            type: "http_body",
+            location: `speculative untrusted parameter '${param.name}' in ${method.name}`,
+            severity: "high",
+            line,
+            confidence: 1,
+            variable: param.name,
+            in_method: method.name
+          });
+        }
+      }
+    }
+    if (added.length > 0) {
+      sinkFilter.sources.push(...added);
+    }
+    return { added: added.length };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
 var REFLECTION_SINK_METHODS = new Set([
   "forName",
@@ -45134,6 +45051,9 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new SinkSemanticsPass);
     if (!disabledPasses.has("deserialization-safety-gate"))
       pipeline.add(new DeserializationSafetyGatePass(options.dependencyContext));
+    if (!disabledPasses.has("prompt-injection-safety-gate"))
+      pipeline.add(new PromptInjectionSafetyGatePass);
+    pipeline.add(new SpeculativePromptParamSourcePass(options.speculativeParamSources === true));
     if (!disabledPasses.has("cli-main-reflection-suppress"))
       pipeline.add(new CliMainReflectionSuppressPass);
     if (!disabledPasses.has("library-profile-sink-gate"))
@@ -45268,6 +45188,14 @@ async function analyze(code, filePath, language, options = {}) {
       flows: interProc.additionalFlows,
       interprocedural: interProc.interprocedural
     };
+    if (options.speculativeParamSources === true) {
+      const existingFlowKeys = new Set((taint.flows ?? []).map((f) => `${f.source_line}|${f.sink_line}|${f.sink_type}`));
+      const constructionFlows = detectPromptConstructionFlows(code.split(`
+`), types).filter((f) => !existingFlowKeys.has(`${f.source_line}|${f.sink_line}|${f.sink_type}`));
+      if (constructionFlows.length > 0) {
+        taint.flows = [...taint.flows ?? [], ...constructionFlows];
+      }
+    }
     if (taint.flows && taint.flows.length > 0 && taint.sinks.length > 0) {
       const sinkTagsByKey = new Map;
       for (const s of taint.sinks) {
@@ -46079,7 +46007,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.193.0";
+var version = "3.195.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.193.0",
+  "version": "3.195.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.193.0"
+    "circle-ir": "^3.195.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",