cognium-dev 3.195.0 → 3.198.0

package/dist/cli.js

@@ -24573,6 +24573,9 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
       additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
       additionalSanitizers.push(...findPythonTraversalRejectGuardSanitizers(code));
+      additionalSanitizers.push(...findPythonStringLiteralGuardSanitizers(code));
+      additionalSanitizers.push(...findPythonDefaultSaxParserXxeSanitizers(code));
+      additionalSanitizers.push(...findPythonUrlAllowlistRedirectSanitizers(code));
       additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
       additionalSanitizers.push(...findPythonJinjaAutoescapeSanitizers(code));
       const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
@@ -25167,15 +25170,165 @@ function findPythonAssignmentSources(sourceCode, language) {
   }
   return sources;
 }
+function evaluatePythonConstExpression(expr, consts) {
+  const COMPARISON = /(<=|>=|==|!=|<|>)/;
+  const parts2 = expr.split(COMPARISON);
+  if (parts2.length === 3) {
+    const left = evaluatePythonConstExpression(parts2[0], consts);
+    const right = evaluatePythonConstExpression(parts2[2], consts);
+    if (typeof left !== "number" || typeof right !== "number")
+      return;
+    switch (parts2[1]) {
+      case "<":
+        return left < right;
+      case ">":
+        return left > right;
+      case "<=":
+        return left <= right;
+      case ">=":
+        return left >= right;
+      case "==":
+        return left === right;
+      case "!=":
+        return left !== right;
+      default:
+        return;
+    }
+  }
+  if (parts2.length !== 1)
+    return;
+  const matched = expr.match(/\d+|[A-Za-z_][A-Za-z0-9_]*|\/\/|[-+*/%()]|\S/g);
+  if (!matched)
+    return;
+  const tokens = matched;
+  let pos = 0;
+  const peek = () => tokens[pos];
+  const parseFactor = () => {
+    const tok = tokens[pos++];
+    if (tok === undefined)
+      return;
+    if (tok === "(") {
+      const inner = parseSum();
+      if (tokens[pos++] !== ")")
+        return;
+      return inner;
+    }
+    if (tok === "-") {
+      const operand = parseFactor();
+      return operand === undefined ? undefined : -operand;
+    }
+    if (/^\d+$/.test(tok))
+      return Number(tok);
+    if (/^[A-Za-z_]/.test(tok))
+      return consts.get(tok);
+    return;
+  };
+  const parseTerm = () => {
+    let value = parseFactor();
+    if (value === undefined)
+      return;
+    while (peek() === "*" || peek() === "/" || peek() === "//" || peek() === "%") {
+      const op = tokens[pos++];
+      const rhs = parseFactor();
+      if (rhs === undefined)
+        return;
+      if ((op === "/" || op === "//" || op === "%") && rhs === 0)
+        return;
+      if (op === "*")
+        value *= rhs;
+      else if (op === "/")
+        value /= rhs;
+      else if (op === "//")
+        value = Math.floor(value / rhs);
+      else
+        value = (value % rhs + rhs) % rhs;
+    }
+    return value;
+  };
+  function parseSum() {
+    let value = parseTerm();
+    if (value === undefined)
+      return;
+    while (peek() === "+" || peek() === "-") {
+      const op = tokens[pos++];
+      const rhs = parseTerm();
+      if (rhs === undefined)
+        return;
+      value = op === "+" ? value + rhs : value - rhs;
+    }
+    return value;
+  }
+  const result = parseSum();
+  return pos === tokens.length ? result : undefined;
+}
+function normalizeListIndex(index, length) {
+  const resolved = index < 0 ? length + index : index;
+  return resolved >= 0 && resolved < length ? resolved : undefined;
+}
+function computeDeadPythonBranchLines(lines) {
+  const dead = new Set;
+  const consts = new Map;
+  const indentOf = (line) => line.length - line.trimStart().length;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const assign = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=(?!=)\s*(.+)$/);
+    if (assign) {
+      const value = evaluatePythonConstExpression(assign[2].trim(), consts);
+      if (typeof value === "number")
+        consts.set(assign[1], value);
+      else
+        consts.delete(assign[1]);
+    }
+    const ifMatch = line.match(/^(\s*)if\s+(.+?)\s*:\s*$/);
+    if (!ifMatch)
+      continue;
+    const indent = ifMatch[1].length;
+    const decided = evaluatePythonConstExpression(ifMatch[2].trim(), consts);
+    if (decided !== true && decided !== false)
+      continue;
+    const thenStart = i2 + 1;
+    let cursor = thenStart;
+    while (cursor < lines.length && (lines[cursor].trim() === "" || indentOf(lines[cursor]) > indent)) {
+      cursor++;
+    }
+    const thenEnd = cursor - 1;
+    let elseStart = -1;
+    let elseEnd = -1;
+    if (cursor < lines.length && indentOf(lines[cursor]) === indent) {
+      if (/^\s*elif\b/.test(lines[cursor]))
+        continue;
+      if (/^\s*else\s*:\s*$/.test(lines[cursor])) {
+        elseStart = cursor + 1;
+        let k = elseStart;
+        while (k < lines.length && (lines[k].trim() === "" || indentOf(lines[k]) > indent))
+          k++;
+        elseEnd = k - 1;
+      }
+    }
+    if (decided === true) {
+      for (let l = elseStart;l >= 0 && l <= elseEnd; l++)
+        dead.add(l);
+    } else {
+      for (let l = thenStart;l <= thenEnd; l++)
+        dead.add(l);
+    }
+  }
+  return dead;
+}
 function buildPythonTaintedVars(sourceCode) {
   const tainted = new Map;
   const containerTainted = new Map;
   const lines = sourceCode.split(`
 `);
+  const deadBranchLines = computeDeadPythonBranchLines(lines);
+  const listElems = new Map;
+  const intConsts = new Map;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const line = lines[i2];
     if (line.trimStart().startsWith("#"))
       continue;
+    if (deadBranchLines.has(i2))
+      continue;
     const subscriptAssign = line.match(/^\s*([\p{L}\p{N}_]+)\[(['"])([^'"]+)\2\]\s*=\s*(.+)$/u);
     if (subscriptAssign) {
       const [, container, , key, rhs2] = subscriptAssign;
@@ -25194,11 +25347,54 @@ function buildPythonTaintedVars(sourceCode) {
     }
     const containerAppendMatch = line.match(/^\s*([\p{L}\p{N}_]+)\.(append|extend|insert|add|push|put|appendleft)\s*\(\s*(.+?)\s*\)\s*$/u);
     if (containerAppendMatch) {
-      const [, receiver, , argExpr] = containerAppendMatch;
+      const [, receiver, method, argExpr] = containerAppendMatch;
       const argIsTainted = [...tainted.keys()].some((v) => new RegExp(`(?<![\\p{L}\\p{N}_])${v}(?![\\p{L}\\p{N}_])`, "u").test(argExpr));
       const argIsDirectSource = PYTHON_TAINTED_PATTERNS2.some((p) => p.pattern.test(argExpr));
       if (argIsTainted || argIsDirectSource)
         tainted.set(receiver, tainted.get(receiver) ?? i2 + 1);
+      const elems = listElems.get(receiver);
+      if (elems) {
+        if (method === "append") {
+          elems.push(argIsTainted || argIsDirectSource);
+        } else if (method === "insert") {
+          const insertAt = argExpr.match(/^(-?\d+)\s*,\s*(.+)$/);
+          if (insertAt) {
+            const idx = normalizeListIndex(Number(insertAt[1]), elems.length);
+            const valueExpr = insertAt[2];
+            const valueTainted = [...tainted.keys()].some((v) => new RegExp(`(?<![\\p{L}\\p{N}_])${v}(?![\\p{L}\\p{N}_])`, "u").test(valueExpr)) || PYTHON_TAINTED_PATTERNS2.some((p) => p.pattern.test(valueExpr));
+            if (idx !== undefined)
+              elems.splice(idx, 0, valueTainted);
+            else
+              listElems.delete(receiver);
+          } else {
+            listElems.delete(receiver);
+          }
+        } else {
+          listElems.delete(receiver);
+        }
+      }
+      continue;
+    }
+    const popMatch = line.match(/^\s*(?:([\p{L}\p{N}_]+)\s*=\s*)?([\p{L}\p{N}_]+)\.pop\s*\(\s*(-?\d+)?\s*\)\s*$/u);
+    const delMatch = line.match(/^\s*del\s+([\p{L}\p{N}_]+)\s*\[\s*(-?\d+)\s*\]\s*$/u);
+    if (popMatch || delMatch) {
+      const receiver = popMatch ? popMatch[2] : delMatch[1];
+      const rawIndex = popMatch ? popMatch[3] !== undefined ? Number(popMatch[3]) : -1 : Number(delMatch[2]);
+      const elems = listElems.get(receiver);
+      if (elems) {
+        const idx = normalizeListIndex(rawIndex, elems.length);
+        if (idx === undefined)
+          listElems.delete(receiver);
+        else {
+          const [removed] = elems.splice(idx, 1);
+          if (popMatch && popMatch[1]) {
+            if (removed)
+              tainted.set(popMatch[1], i2 + 1);
+            else
+              tainted.delete(popMatch[1]);
+          }
+        }
+      }
       continue;
     }
     const augAssign = line.match(/^\s*([\p{L}\p{N}_]+)\s*\+=\s*(.+)$/u);
@@ -25221,7 +25417,51 @@ function buildPythonTaintedVars(sourceCode) {
     const assignMatch = line.match(/^\s*([\p{L}\p{N}_]+)\s*=\s*(.+)$/u);
     if (!assignMatch)
       continue;
-    const [, lhs, rhs] = assignMatch;
+    const [, lhs, rhsRaw] = assignMatch;
+    const constValue = evaluatePythonConstExpression(rhsRaw.trim(), intConsts);
+    if (typeof constValue === "number")
+      intConsts.set(lhs, constValue);
+    else
+      intConsts.delete(lhs);
+    let rhs = rhsRaw;
+    const ternary = rhsRaw.match(/^(.+?)\s+if\s+(.+?)\s+else\s+(.+)$/);
+    if (ternary) {
+      const decided = evaluatePythonConstExpression(ternary[2].trim(), intConsts);
+      if (decided === true)
+        rhs = ternary[1].trim();
+      else if (decided === false)
+        rhs = ternary[3].trim();
+    }
+    const listLiteral = rhs.trim().match(/^\[\s*(.*?)\s*\]$/);
+    if (listLiteral) {
+      const inner = listLiteral[1];
+      if (inner === "") {
+        listElems.set(lhs, []);
+      } else if (!inner.includes("[") && !inner.includes("(")) {
+        listElems.set(lhs, inner.split(",").map((part) => {
+          const expr = part.trim();
+          return [...tainted.keys()].some((v) => new RegExp(`(?<![\\p{L}\\p{N}_])${v}(?![\\p{L}\\p{N}_])`, "u").test(expr)) || PYTHON_TAINTED_PATTERNS2.some((p) => p.pattern.test(expr));
+        }));
+      } else {
+        listElems.delete(lhs);
+      }
+    } else {
+      listElems.delete(lhs);
+    }
+    const indexRead = rhs.trim().match(/^([\p{L}\p{N}_]+)\s*\[\s*(-?\d+)\s*\]$/u);
+    if (indexRead) {
+      const elems = listElems.get(indexRead[1]);
+      if (elems) {
+        const idx = normalizeListIndex(Number(indexRead[2]), elems.length);
+        if (idx !== undefined) {
+          if (elems[idx])
+            tainted.set(lhs, i2 + 1);
+          else
+            tainted.delete(lhs);
+          continue;
+        }
+      }
+    }
     const isDirectSource = PYTHON_TAINTED_PATTERNS2.some((p) => p.pattern.test(rhs));
     let propagatedFrom;
     const dictAccessMatch = rhs.trim().match(/^([\p{L}\p{N}_]+)\[(['"])([^'"]+)\2\]$/u);
@@ -26539,6 +26779,147 @@ function findPythonTraversalRejectGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findPythonStringLiteralGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const terminator = /\b(return|raise|abort\s*\(|sys\.exit\s*\()/;
+  const Q = `(?:'(?:\\\\')'|"'"|'"'|"(?:\\\\")")`;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const guard = lines[i2].match(new RegExp(`^(\\s*)if\\s+not\\s+([A-Za-z_][A-Za-z0-9_]*)\\.startswith\\(\\s*${Q}\\s*\\)` + `\\s+or\\s+not\\s+\\2\\.endswith\\(\\s*${Q}\\s*\\)` + `\\s+or\\s+${Q}\\s+in\\s+\\2\\[1:-1\\]\\s*:\\s*$`));
+    if (!guard)
+      continue;
+    const guardIndent = guard[1].length;
+    const guardedVar = guard[2];
+    let bodyHasTerminator = false;
+    let blockEnd = -1;
+    const maxScan = Math.min(lines.length, i2 + 26);
+    for (let j = i2 + 1;j < maxScan; j++) {
+      const line = lines[j];
+      if (line.trim() === "")
+        continue;
+      const indent = line.length - line.trimStart().length;
+      if (indent <= guardIndent) {
+        blockEnd = j - 1;
+        break;
+      }
+      if (terminator.test(line))
+        bodyHasTerminator = true;
+    }
+    if (blockEnd === -1)
+      blockEnd = Math.min(lines.length - 1, i2 + 25);
+    if (!bodyHasTerminator)
+      continue;
+    const varRe = new RegExp(`\\b${guardedVar}\\b`);
+    for (let l = blockEnd + 2;l <= lines.length; l++) {
+      if (!varRe.test(lines[l - 1]))
+        continue;
+      sanitizers.push({
+        type: "python_string_literal_guard",
+        method: "if",
+        line: l,
+        sanitizes: ["code_injection"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findPythonDefaultSaxParserXxeSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const parserVars = new Set;
+  for (const line of lines) {
+    const made = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(?:xml\.)?sax\.make_parser\s*\(/);
+    if (made)
+      parserVars.add(made[1]);
+  }
+  if (parserVars.size === 0)
+    return sanitizers;
+  for (const line of lines) {
+    for (const parser of [...parserVars]) {
+      const enabled = new RegExp(`\\b${parser}\\.setFeature\\s*\\([^,]*external_(?:ges|pes)[^,]*,\\s*True\\s*\\)`);
+      const resolver = new RegExp(`\\b${parser}\\.setEntityResolver\\s*\\(`);
+      const rebound = new RegExp(`^\\s*${parser}\\s*=(?!=)`);
+      if (enabled.test(line) || resolver.test(line))
+        parserVars.delete(parser);
+      else if (rebound.test(line) && !/make_parser\s*\(/.test(line))
+        parserVars.delete(parser);
+    }
+  }
+  if (parserVars.size === 0)
+    return sanitizers;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const parseCall = /\b(?:minidom\.)?parseString\s*\(|\b(?:minidom\.)?parse\s*\(|\bsax\.parse(?:String)?\s*\(/;
+    if (!parseCall.test(line))
+      continue;
+    const usesDefaultParser = [...parserVars].some((p) => new RegExp(`\\b${p}\\b`).test(line));
+    if (!usesDefaultParser)
+      continue;
+    sanitizers.push({
+      type: "python_default_sax_parser",
+      method: "make_parser",
+      line: i2 + 1,
+      sanitizes: ["xxe"]
+    });
+  }
+  return sanitizers;
+}
+function findPythonUrlAllowlistRedirectSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const parsedFrom = new Map;
+  for (const line of lines) {
+    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(?:urllib\.parse\.)?urlparse\s*\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*\)/);
+    if (m)
+      parsedFrom.set(m[1], m[2]);
+  }
+  if (parsedFrom.size === 0)
+    return sanitizers;
+  const terminator = /\b(return|raise|abort\s*\(|sys\.exit\s*\()/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const guard = lines[i2].match(/^(\s*)if\s+([A-Za-z_][A-Za-z0-9_]*)\.netloc\s+not\s+in\s+[[({]/);
+    if (!guard)
+      continue;
+    const guardIndent = guard[1].length;
+    const rawVar = parsedFrom.get(guard[2]);
+    if (!rawVar)
+      continue;
+    let bodyHasTerminator = false;
+    let blockEnd = -1;
+    const maxScan = Math.min(lines.length, i2 + 26);
+    for (let j = i2 + 1;j < maxScan; j++) {
+      const line = lines[j];
+      if (line.trim() === "")
+        continue;
+      const indent = line.length - line.trimStart().length;
+      if (indent <= guardIndent) {
+        blockEnd = j - 1;
+        break;
+      }
+      if (terminator.test(line))
+        bodyHasTerminator = true;
+    }
+    if (blockEnd === -1)
+      blockEnd = Math.min(lines.length - 1, i2 + 25);
+    if (!bodyHasTerminator)
+      continue;
+    const varRe = new RegExp(`\\b${rawVar}\\b`);
+    for (let l = blockEnd + 2;l <= lines.length; l++) {
+      if (!varRe.test(lines[l - 1]))
+        continue;
+      sanitizers.push({
+        type: "python_url_allowlist_guard",
+        method: "if",
+        line: l,
+        sanitizes: ["open_redirect"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findPythonDefusedXmlSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -31559,14 +31940,20 @@ class SinkFilterPass {
         if (sink.type !== "xpath_injection")
           return true;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        const taintedVarOnLine = [...pyTaintedVars.keys()].find((v) => new RegExp(`\\b${v}\\b`).test(sinkLineText));
+        const taintedValueVars = [...pyTaintedVars.keys()].filter((v) => new RegExp(`(?<![\\w.])${v}\\b(?!\\s*=(?!=))`).test(sinkLineText));
+        const taintedVarOnLine = taintedValueVars[0];
         const oopVarOnLine = [...oopFieldVars].find((v) => sinkLineText.includes(v));
         if (oopVarOnLine)
           return true;
         if (!taintedVarOnLine)
           return false;
+        const neutralised = (v) => pySanitizedVars.has(v) || new RegExp(`\\.xpath\\s*\\([^)]*\\b\\w+\\s*=\\s*\\b${v}\\b`).test(sinkLineText) || isXPathQuoteEscapedOnLine(sinkLineText, v);
+        if (taintedValueVars.every(neutralised))
+          return false;
         if (pySanitizedVars.has(taintedVarOnLine))
           return false;
+        if (isXPathQuoteEscapedOnLine(sinkLineText, taintedVarOnLine))
+          return false;
         if (new RegExp(`\\.xpath\\s*\\([^)]*\\b\\w+\\s*=\\s*\\b${taintedVarOnLine}\\b`).test(sinkLineText))
           return false;
         return true;
@@ -32670,6 +33057,28 @@ function filterSanitizedSinks(sinks, sanitizers, calls) {
     return true;
   });
 }
+function isXPathQuoteEscapedOnLine(lineText, varName) {
+  const STRING_LITERAL = `'(?:[^'\\\\]|\\\\.)*'|"(?:[^"\\\\]|\\\\.)*"`;
+  const replaceCall = new RegExp(`^${varName}\\.replace\\s*\\(\\s*(${STRING_LITERAL})\\s*,\\s*(${STRING_LITERAL})\\s*\\)`);
+  const decode = (literal) => literal.slice(1, -1).replace(/\\(.)/g, "$1");
+  const occurrence = new RegExp(`(?<![\\w.])${varName}\\b`, "g");
+  let match;
+  let seen = 0;
+  while ((match = occurrence.exec(lineText)) !== null) {
+    seen++;
+    const rest = lineText.slice(match.index);
+    const call = replaceCall.exec(rest);
+    if (!call)
+      return false;
+    const searched = decode(call[1]);
+    const replacement = decode(call[2]);
+    if (searched !== "'" && searched !== '"')
+      return false;
+    if (replacement.includes("'") || replacement.includes('"'))
+      return false;
+  }
+  return seen > 0;
+}
 
 // ../circle-ir/dist/analysis/passes/sink-semantics-pass.js
 function buildRegistry(entries) {
@@ -44959,6 +45368,10 @@ async function analyze(code, filePath, language, options = {}) {
     return analyzeMarkupFile(code, filePath, options, language);
   }
   let parseGrammar = language;
+  if (language === "tsx") {
+    parseGrammar = "tsx";
+    language = "typescript";
+  }
   if (language === "javascript" || language === "typescript") {
     const lower = filePath.toLowerCase();
     if (lower.endsWith(".tsx") || lower.endsWith(".jsx")) {
@@ -46007,7 +46420,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.195.0";
+var version = "3.198.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.195.0",
+  "version": "3.198.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.195.0"
+    "circle-ir": "^3.198.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",