cognium-dev 3.206.0 → 3.209.0

package/dist/cli.js

@@ -11222,8 +11222,6 @@ var DEFAULT_SINKS = [
   { method: "addObject", class: "ModelAndView", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   { method: "println", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "print", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "append", class: "StringBuilder", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "append", class: "StringBuffer", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "handleHyperlinks", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "handleDiv", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "handleImage", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -31801,6 +31799,8 @@ var SQL_EXEC_METHODS = new Set([
   "addBatch"
 ]);
 var JAVA_SQL_ASSIGN_RE_TEMPLATE = "\\b(?:String|CharSequence|final\\s+String|var)\\s+SQLVAR\\b\\s*=\\s*(.+?);";
+var REPLACE_ALL_TO_PLACEHOLDER_RE = /\.replaceAll\s*\([\s\S]*?,\s*"[\s,?]*\?[\s,?]*"\s*\)/;
+var HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
 var JAVA_INLINE_MATCHES_RE = /\.\s*matches\s*\(\s*"((?:[^"\\]|\\.)*)"\s*\)/g;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
@@ -32565,6 +32565,21 @@ class SinkFilterPass {
         return true;
       });
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "sql_injection")
+          return true;
+        if (!SQL_EXEC_METHODS.has(sink.method ?? ""))
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        return !REPLACE_ALL_TO_PLACEHOLDER_RE.test(sinkLineText);
+      });
+    }
+    if (language === "java" && !HTML_CONTENT_TYPE_RE.test(ctx.code)) {
+      filtered = filtered.filter((sink) => !(sink.type === "xss" && sink.method === "body"));
+    }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split(`
 `);
@@ -40566,6 +40581,39 @@ function shannonEntropy(s) {
   return h;
 }
 var CREDENTIAL_NAME_RE = /(?:key|secret|token|password|passwd|credential|api[_-]?key)/i;
+var CONNECTION_STRING_RE = /\b([a-z][a-z0-9+.-]{1,20}):\/\/([^\s:/@"'`]*):([^\s:/@"'`]{2,})@/i;
+var PASSWORD_INTERPOLATION_RE = /\$\{|\$\(|\{\{|%\([^)]*\)[sd]|%[sdvfeg]\b|[{}<>]/i;
+var PLACEHOLDER_PASSWORD_WORDS = new Set([
+  "password",
+  "passwd",
+  "pass",
+  "pwd",
+  "secret",
+  "user",
+  "username",
+  "changeme",
+  "example",
+  "yourpassword",
+  "your_password",
+  "test",
+  "xxx",
+  "xxxx"
+]);
+function matchConnectionStringCredential(lineText) {
+  const m = CONNECTION_STRING_RE.exec(lineText);
+  if (!m)
+    return null;
+  const password = m[3];
+  if (/^\d+$/.test(password))
+    return null;
+  if (PLACEHOLDER_PASSWORD_WORDS.has(password.toLowerCase()))
+    return null;
+  if (PLACEHOLDER_RE.test(password))
+    return null;
+  if (PASSWORD_INTERPOLATION_RE.test(password))
+    return null;
+  return { scheme: m[1], match: m[0].substring(0, 60) };
+}
 function findAnnotationLineRanges(code) {
   const lines = code.split(`
 `);
@@ -40777,6 +40825,34 @@ class ScanSecretsPass {
       });
       providerFindings += 1;
     }
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const lineText = lines[i2];
+      const lineNum = i2 + 1;
+      const hit = matchConnectionStringCredential(lineText);
+      if (!hit)
+        continue;
+      const key = `${lineNum}:hardcoded-credential`;
+      if (seen.has(key))
+        continue;
+      seen.add(key);
+      const dg = applyDemoDowngrade(demoPath, "high", "error");
+      ctx.addFinding({
+        id: `hardcoded-credential-${file}-${lineNum}`,
+        pass: this.name,
+        category: this.category,
+        rule_id: "hardcoded-credential",
+        cwe: "CWE-798",
+        severity: dg.severity,
+        level: dg.level,
+        message: `Hardcoded credential: password embedded in a ${hit.scheme} connection string`,
+        file,
+        line: lineNum,
+        snippet: lineText.trim().substring(0, 120),
+        fix: "Move the credential out of the connection string into an environment variable or secrets manager, and rotate the exposed password.",
+        evidence: { kind: "connection-string", scheme: hit.scheme, match: hit.match }
+      });
+      providerFindings += 1;
+    }
     if (hasEntropyCandidate)
       for (let i2 = 0;i2 < lines.length; i2++) {
         const lineText = lines[i2];
@@ -46956,7 +47032,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.206.0";
+var version = "3.209.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.206.0",
+  "version": "3.209.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.206.0"
+    "circle-ir": "^3.209.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",