cognium-dev 3.194.0 → 3.195.0

package/dist/cli.js

@@ -10719,7 +10719,7 @@ var DEFAULT_SOURCES = [
   { method: "Json", type: "http_body", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "Query", type: "http_param", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "Path", type: "http_path", severity: "high", return_tainted: true, languages: ["rust"] },
-  { method: "Form", type: "http_param", severity: "high", return_tainted: true, languages: ["rust"] },
+  { method: "Form", type: "http_body", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "var", class: "env", type: "env_input", severity: "medium", return_tainted: true },
   { method: "var_os", class: "env", type: "env_input", severity: "medium", return_tainted: true },
   { method: "args", class: "env", type: "env_input", severity: "medium", return_tainted: true },
@@ -11508,7 +11508,7 @@ var DEFAULT_SINKS = [
   { method: "execSync", class: "child_process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "spawn", class: "child_process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "spawnSync", class: "child_process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "exec", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0] },
+  { method: "exec", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], exclude_languages: ["python"] },
   { method: "execSync", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "spawn", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "spawnSync", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -11528,7 +11528,7 @@ var DEFAULT_SINKS = [
   { method: "query", class: "Client", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "execute", class: "Pool", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
-  { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "all", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "run", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
@@ -12483,6 +12483,17 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
+function sinkPatternAppliesTo(pattern, language) {
+  if (language === undefined)
+    return true;
+  if (pattern.languages && pattern.languages.length > 0 && !pattern.languages.includes(language)) {
+    return false;
+  }
+  if (pattern.exclude_languages && pattern.exclude_languages.includes(language)) {
+    return false;
+  }
+  return true;
+}
 function expandPromisifyAliases(patterns, sourceLines, language) {
   if (!sourceLines || sourceLines.length === 0)
     return patterns;
@@ -12491,7 +12502,7 @@ function expandPromisifyAliases(patterns, sourceLines, language) {
   const PROMISIFY_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:util\s*\.\s*)?promisify\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
   const innerToPattern = new Map;
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language))
+    if (!sinkPatternAppliesTo(p, language))
       continue;
     if (p.class !== undefined)
       continue;
@@ -12499,7 +12510,7 @@ function expandPromisifyAliases(patterns, sourceLines, language) {
       innerToPattern.set(p.method, p);
   }
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language))
+    if (!sinkPatternAppliesTo(p, language))
       continue;
     if (innerToPattern.has(p.method))
       continue;
@@ -12541,7 +12552,7 @@ function expandIndirectEvalAliases(patterns, sourceLines, language) {
   const INDIRECT_EVAL_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*(eval|Function)\b(?!\s*\()/;
   const innerToPattern = new Map;
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language))
+    if (!sinkPatternAppliesTo(p, language))
       continue;
     if (p.class !== undefined)
       continue;
@@ -13301,7 +13312,7 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   return false;
 }
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
-  const patternsForLanguage = language === undefined ? patterns : patterns.filter((p) => !p.languages || p.languages.length === 0 || p.languages.includes(language));
+  const patternsForLanguage = language === undefined ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = new Map;
   for (const call of calls) {
     for (const pattern of patternsForLanguage) {
@@ -13636,10 +13647,8 @@ var SINK_FQN_EXCLUSIONS = {
   ]
 };
 function matchesSinkPattern(call, pattern, typeHierarchy, language) {
-  if (pattern.languages && pattern.languages.length > 0 && language !== undefined) {
-    if (!pattern.languages.includes(language)) {
-      return false;
-    }
+  if (!sinkPatternAppliesTo(pattern, language)) {
+    return false;
   }
   const callMethodName = call.method_name;
   const patternMethod = pattern.method;
@@ -20987,99 +20996,11 @@ class JavaPlugin extends BaseLanguagePlugin {
         severity: "high",
         confidence: 0.9,
         returnTainted: true
-      },
-      {
-        method: "getParameter",
-        class: "HttpServletRequest",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "getParameterValues",
-        class: "HttpServletRequest",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "getHeader",
-        class: "HttpServletRequest",
-        type: "http_header",
-        severity: "high",
-        confidence: 0.9,
-        returnTainted: true
-      },
-      {
-        method: "getCookies",
-        class: "HttpServletRequest",
-        type: "http_cookie",
-        severity: "high",
-        confidence: 0.9,
-        returnTainted: true
-      },
-      {
-        method: "getInputStream",
-        class: "HttpServletRequest",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.85,
-        returnTainted: true
-      },
-      {
-        method: "getReader",
-        class: "HttpServletRequest",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.85,
-        returnTainted: true
       }
     ];
   }
   getBuiltinSinks() {
     return [
-      {
-        method: "executeQuery",
-        class: "Statement",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "executeUpdate",
-        class: "Statement",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "execute",
-        class: "Statement",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "exec",
-        class: "Runtime",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "start",
-        class: "ProcessBuilder",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: []
-      },
       {
         method: "FileInputStream",
         type: "path_traversal",
@@ -21094,38 +21015,6 @@ class JavaPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "write",
-        class: "PrintWriter",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "println",
-        class: "PrintWriter",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "search",
-        class: "DirContext",
-        type: "ldap_injection",
-        cwe: "CWE-90",
-        severity: "high",
-        argPositions: [0, 1]
-      },
-      {
-        method: "evaluate",
-        class: "XPath",
-        type: "xpath_injection",
-        cwe: "CWE-643",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "readObject",
         class: "ObjectInputStream",
@@ -21635,37 +21524,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
   }
   getBuiltinSinks() {
     return [
-      {
-        method: "exec",
-        class: "child_process",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "execSync",
-        class: "child_process",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "spawn",
-        class: "child_process",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0, 1]
-      },
-      {
-        method: "eval",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "Function",
         type: "code_injection",
@@ -21687,44 +21545,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "readFileSync",
-        class: "fs",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "writeFileSync",
-        class: "fs",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "createReadStream",
-        class: "fs",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "innerHTML",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "outerHTML",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "document.write",
         type: "xss",
@@ -21774,13 +21594,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "raw",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "$executeRawUnsafe",
         type: "sql_injection",
@@ -21795,29 +21608,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "fetch",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "get",
-        class: "axios",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "request",
-        class: "http",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "find",
         type: "nosql_injection",
@@ -21825,13 +21615,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "findOne",
-        type: "nosql_injection",
-        cwe: "CWE-943",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "merge",
         type: "prototype_pollution",
@@ -21907,13 +21690,6 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "redirect",
-        type: "open_redirect",
-        cwe: "CWE-601",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "push",
         class: "router",
@@ -22156,13 +21932,6 @@ class PythonPlugin extends BaseLanguagePlugin {
         confidence: 0.9,
         returnTainted: true
       },
-      {
-        method: "input",
-        type: "user_input",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
       {
         method: "argv",
         class: "sys",
@@ -22178,129 +21947,11 @@ class PythonPlugin extends BaseLanguagePlugin {
         severity: "medium",
         confidence: 0.85,
         returnTainted: true
-      },
-      {
-        method: "getenv",
-        class: "os",
-        type: "env_var",
-        severity: "medium",
-        confidence: 0.85,
-        returnTainted: true
-      },
-      {
-        method: "read",
-        type: "file_input",
-        severity: "medium",
-        confidence: 0.8,
-        returnTainted: true
-      },
-      {
-        method: "readline",
-        type: "file_input",
-        severity: "medium",
-        confidence: 0.8,
-        returnTainted: true
-      },
-      {
-        method: "readlines",
-        type: "file_input",
-        severity: "medium",
-        confidence: 0.8,
-        returnTainted: true
       }
     ];
   }
   getBuiltinSinks() {
     return [
-      {
-        method: "system",
-        class: "os",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "popen",
-        class: "os",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "run",
-        class: "subprocess",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "call",
-        class: "subprocess",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "Popen",
-        class: "subprocess",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "eval",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "exec",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "compile",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "execute",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "executemany",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "raw",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "open",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "read",
         class: "pathlib",
@@ -22309,13 +21960,6 @@ class PythonPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "Markup",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "safe",
         type: "xss",
@@ -22323,22 +21967,6 @@ class PythonPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "get",
-        class: "requests",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "post",
-        class: "requests",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "urlopen",
         class: "urllib",
@@ -22363,30 +21991,6 @@ class PythonPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [1]
       },
-      {
-        method: "loads",
-        class: "pickle",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "load",
-        class: "pickle",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "load",
-        class: "yaml",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "unsafe_load",
         class: "yaml",
@@ -22522,34 +22126,6 @@ class RustPlugin extends BaseLanguagePlugin {
   }
   getBuiltinSources() {
     return [
-      {
-        method: "Query",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Json",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Path",
-        type: "http_path",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Form",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
       {
         method: "args",
         class: "std::env",
@@ -22597,14 +22173,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "medium",
         confidence: 0.8,
         returnTainted: true
-      },
-      {
-        method: "read",
-        class: "TcpStream",
-        type: "network_input",
-        severity: "high",
-        confidence: 0.85,
-        returnTainted: true
       }
     ];
   }
@@ -22618,29 +22186,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "arg",
-        class: "Command",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "args",
-        class: "Command",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "execute",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "query",
         type: "sql_injection",
@@ -22655,22 +22200,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "open",
-        class: "File",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "create",
-        class: "File",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "read_to_string",
         class: "std::fs",
@@ -22708,38 +22237,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "from_str",
-        class: "serde_json",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "medium",
-        argPositions: [0]
-      },
-      {
-        method: "from_slice",
-        class: "serde_json",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "medium",
-        argPositions: [0]
-      },
-      {
-        method: "get",
-        class: "reqwest",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "post",
-        class: "reqwest",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "new",
         class: "Regex",
@@ -22832,13 +22329,6 @@ class BashPlugin extends BaseLanguagePlugin {
   }
   getBuiltinSources() {
     return [
-      {
-        method: "read",
-        type: "io_input",
-        severity: "high",
-        confidence: 0.9,
-        returnTainted: true
-      },
       {
         method: "curl",
         type: "http_response",
@@ -22857,13 +22347,6 @@ class BashPlugin extends BaseLanguagePlugin {
   }
   getBuiltinSinks() {
     return [
-      {
-        method: "eval",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "bash",
         type: "command_injection",
@@ -23259,30 +22742,6 @@ class GoPlugin extends BaseLanguagePlugin {
         confidence: 0.9,
         returnTainted: true
       },
-      {
-        method: "Query",
-        class: "Context",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Param",
-        class: "Context",
-        type: "http_path",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "PostForm",
-        class: "Context",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
       {
         method: "GetRawData",
         class: "Context",
@@ -23479,14 +22938,6 @@ class GoPlugin extends BaseLanguagePlugin {
         severity: "medium",
         argPositions: [0]
       },
-      {
-        method: "Decode",
-        class: "Decoder",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "medium",
-        argPositions: [0]
-      },
       {
         method: "Print",
         class: "log",
@@ -25121,6 +24572,7 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findPythonRangeCheckGuardSanitizers(code));
       additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
       additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
+      additionalSanitizers.push(...findPythonTraversalRejectGuardSanitizers(code));
       additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
       additionalSanitizers.push(...findPythonJinjaAutoescapeSanitizers(code));
       const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
@@ -27024,6 +26476,69 @@ function findPythonSetMembershipXssGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findPythonTraversalRejectGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const guardOpen = /^(\s*)if\s+(['"])(\.\.[/\\]?)\2\s+in\s+([A-Za-z_][A-Za-z0-9_]*)\s*:\s*$/;
+  const terminator = /\b(return|raise|abort\s*\(|sys\.exit\s*\()/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = guardOpen.exec(lines[i2]);
+    if (!m)
+      continue;
+    const guardIndent = m[1].length;
+    const guardedVar = m[4];
+    let bodyHasTerminator = false;
+    let blockEnd = -1;
+    const maxScan = Math.min(lines.length, i2 + 26);
+    for (let j = i2 + 1;j < maxScan; j++) {
+      const line = lines[j];
+      if (line.trim() === "")
+        continue;
+      const indent = line.length - line.trimStart().length;
+      if (indent <= guardIndent) {
+        blockEnd = j - 1;
+        break;
+      }
+      if (terminator.test(line))
+        bodyHasTerminator = true;
+    }
+    if (blockEnd === -1)
+      blockEnd = Math.min(lines.length - 1, i2 + 25);
+    if (!bodyHasTerminator)
+      continue;
+    const guarded = new Set([guardedVar]);
+    const assignRe = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=(?!=)\s*(.*)$/;
+    const mentionsGuarded = (text) => {
+      for (const name2 of guarded) {
+        if (new RegExp(`\\b${name2}\\b`).test(text))
+          return true;
+      }
+      return false;
+    };
+    for (let l = blockEnd + 2;l <= lines.length; l++) {
+      const lineText = lines[l - 1];
+      const assign = assignRe.exec(lineText);
+      if (assign) {
+        const target = assign[1];
+        const rhs = assign[2];
+        if (mentionsGuarded(rhs))
+          guarded.add(target);
+        else if (target !== guardedVar)
+          guarded.delete(target);
+      }
+      if (!mentionsGuarded(lineText))
+        continue;
+      sanitizers.push({
+        type: "python_traversal_reject_guard",
+        method: "if",
+        line: l,
+        sanitizes: ["path_traversal"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findPythonDefusedXmlSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -46492,7 +46007,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.194.0";
+var version = "3.195.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.194.0",
+  "version": "3.195.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.194.0"
+    "circle-ir": "^3.195.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",