cognium-dev 3.208.0 → 3.209.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +18 -1
- package/package.json +2 -2
package/dist/cli.js
CHANGED
|
@@ -31799,6 +31799,8 @@ var SQL_EXEC_METHODS = new Set([
|
|
|
31799
31799
|
"addBatch"
|
|
31800
31800
|
]);
|
|
31801
31801
|
var JAVA_SQL_ASSIGN_RE_TEMPLATE = "\\b(?:String|CharSequence|final\\s+String|var)\\s+SQLVAR\\b\\s*=\\s*(.+?);";
|
|
31802
|
+
var REPLACE_ALL_TO_PLACEHOLDER_RE = /\.replaceAll\s*\([\s\S]*?,\s*"[\s,?]*\?[\s,?]*"\s*\)/;
|
|
31803
|
+
var HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
|
|
31802
31804
|
var JAVA_INLINE_MATCHES_RE = /\.\s*matches\s*\(\s*"((?:[^"\\]|\\.)*)"\s*\)/g;
|
|
31803
31805
|
function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
|
|
31804
31806
|
if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
|
|
@@ -32563,6 +32565,21 @@ class SinkFilterPass {
|
|
|
32563
32565
|
return true;
|
|
32564
32566
|
});
|
|
32565
32567
|
}
|
|
32568
|
+
if (language === "java") {
|
|
32569
|
+
const sourceLines = ctx.code.split(`
|
|
32570
|
+
`);
|
|
32571
|
+
filtered = filtered.filter((sink) => {
|
|
32572
|
+
if (sink.type !== "sql_injection")
|
|
32573
|
+
return true;
|
|
32574
|
+
if (!SQL_EXEC_METHODS.has(sink.method ?? ""))
|
|
32575
|
+
return true;
|
|
32576
|
+
const sinkLineText = sourceLines[sink.line - 1] ?? "";
|
|
32577
|
+
return !REPLACE_ALL_TO_PLACEHOLDER_RE.test(sinkLineText);
|
|
32578
|
+
});
|
|
32579
|
+
}
|
|
32580
|
+
if (language === "java" && !HTML_CONTENT_TYPE_RE.test(ctx.code)) {
|
|
32581
|
+
filtered = filtered.filter((sink) => !(sink.type === "xss" && sink.method === "body"));
|
|
32582
|
+
}
|
|
32566
32583
|
if (["javascript", "typescript"].includes(language)) {
|
|
32567
32584
|
const sourceLines = ctx.code.split(`
|
|
32568
32585
|
`);
|
|
@@ -47015,7 +47032,7 @@ var colors = {
|
|
|
47015
47032
|
};
|
|
47016
47033
|
|
|
47017
47034
|
// src/version.ts
|
|
47018
|
-
var version = "3.
|
|
47035
|
+
var version = "3.209.0";
|
|
47019
47036
|
|
|
47020
47037
|
// src/formatters.ts
|
|
47021
47038
|
var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cognium-dev",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.209.0",
|
|
4
4
|
"description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -66,7 +66,7 @@
|
|
|
66
66
|
},
|
|
67
67
|
"dependencies": {
|
|
68
68
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
69
|
-
"circle-ir": "^3.
|
|
69
|
+
"circle-ir": "^3.209.0"
|
|
70
70
|
},
|
|
71
71
|
"devDependencies": {
|
|
72
72
|
"@types/node": "^25.5.0",
|