cognium-dev 3.209.0 → 3.212.0

package/dist/cli.js

@@ -11840,8 +11840,6 @@ var DEFAULT_SINKS = [
   { method: "setVariable", class: "Context", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [1] },
   { method: "clean", class: "AntiSamy", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "getValidSafeHTML", class: "ESAPI", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "getAttribute", class: "HttpServletRequest", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
-  { method: "getAttribute", class: "HttpSession", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
   { method: "spawn", class: "Command", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "output", class: "Command", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "status", class: "Command", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
@@ -14479,6 +14477,73 @@ function isNonExecutablePython(trimmed) {
   return false;
 }
 
+// ../circle-ir/dist/analysis/sanitizer-index.js
+var SANITIZER_SET_CACHE = new WeakMap;
+function getSanitizesSet(san) {
+  let s = SANITIZER_SET_CACHE.get(san);
+  if (!s) {
+    s = new Set(san.sanitizes);
+    SANITIZER_SET_CACHE.set(san, s);
+  }
+  return s;
+}
+function sanitizerCoversSink(san, sinkType) {
+  return getSanitizesSet(san).has(sinkType);
+}
+
+// ../circle-ir/dist/analysis/dfg-walk.js
+var walkBackwardDefsMemo = new WeakMap;
+function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
+  const maxHops = options.maxHops ?? 32;
+  let perFile = walkBackwardDefsMemo.get(chainsByToDef);
+  if (perFile !== undefined) {
+    const key = `${startDefId}|${maxHops}`;
+    const hit = perFile.get(key);
+    if (hit !== undefined)
+      return hit;
+  }
+  const visited = new Set;
+  const lines = new Set;
+  let hopCapReached = false;
+  const startDef = defById.get(startDefId);
+  if (!startDef) {
+    return { visited, lines, hopCapReached: false };
+  }
+  visited.add(startDefId);
+  lines.add(startDef.line);
+  const queue = [startDefId];
+  let hops = 0;
+  while (queue.length > 0) {
+    if (hops >= maxHops) {
+      hopCapReached = true;
+      break;
+    }
+    hops++;
+    const currentId = queue.shift();
+    const incoming = chainsByToDef.get(currentId);
+    if (!incoming)
+      continue;
+    for (const chain of incoming) {
+      const fromId = chain.from_def;
+      if (visited.has(fromId))
+        continue;
+      visited.add(fromId);
+      const fromDef = defById.get(fromId);
+      if (fromDef) {
+        lines.add(fromDef.line);
+      }
+      queue.push(fromId);
+    }
+  }
+  const result = { visited, lines, hopCapReached };
+  if (perFile === undefined) {
+    perFile = new Map;
+    walkBackwardDefsMemo.set(chainsByToDef, perFile);
+  }
+  perFile.set(`${startDefId}|${maxHops}`, result);
+  return result;
+}
+
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
@@ -16765,73 +16830,6 @@ class AnalysisPipeline {
     return { results, findings };
   }
 }
-// ../circle-ir/dist/analysis/dfg-walk.js
-var walkBackwardDefsMemo = new WeakMap;
-function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
-  const maxHops = options.maxHops ?? 32;
-  let perFile = walkBackwardDefsMemo.get(chainsByToDef);
-  if (perFile !== undefined) {
-    const key = `${startDefId}|${maxHops}`;
-    const hit = perFile.get(key);
-    if (hit !== undefined)
-      return hit;
-  }
-  const visited = new Set;
-  const lines = new Set;
-  let hopCapReached = false;
-  const startDef = defById.get(startDefId);
-  if (!startDef) {
-    return { visited, lines, hopCapReached: false };
-  }
-  visited.add(startDefId);
-  lines.add(startDef.line);
-  const queue = [startDefId];
-  let hops = 0;
-  while (queue.length > 0) {
-    if (hops >= maxHops) {
-      hopCapReached = true;
-      break;
-    }
-    hops++;
-    const currentId = queue.shift();
-    const incoming = chainsByToDef.get(currentId);
-    if (!incoming)
-      continue;
-    for (const chain of incoming) {
-      const fromId = chain.from_def;
-      if (visited.has(fromId))
-        continue;
-      visited.add(fromId);
-      const fromDef = defById.get(fromId);
-      if (fromDef) {
-        lines.add(fromDef.line);
-      }
-      queue.push(fromId);
-    }
-  }
-  const result = { visited, lines, hopCapReached };
-  if (perFile === undefined) {
-    perFile = new Map;
-    walkBackwardDefsMemo.set(chainsByToDef, perFile);
-  }
-  perFile.set(`${startDefId}|${maxHops}`, result);
-  return result;
-}
-
-// ../circle-ir/dist/analysis/sanitizer-index.js
-var SANITIZER_SET_CACHE = new WeakMap;
-function getSanitizesSet(san) {
-  let s = SANITIZER_SET_CACHE.get(san);
-  if (!s) {
-    s = new Set(san.sanitizes);
-    SANITIZER_SET_CACHE.set(san, s);
-  }
-  return s;
-}
-function sanitizerCoversSink(san, sinkType) {
-  return getSanitizesSet(san).has(sinkType);
-}
-
 // ../circle-ir/dist/analysis/taint-propagation.js
 function buildSanitizersByLine(sanitizers) {
   const out2 = new Map;
@@ -31801,6 +31799,52 @@ var SQL_EXEC_METHODS = new Set([
 var JAVA_SQL_ASSIGN_RE_TEMPLATE = "\\b(?:String|CharSequence|final\\s+String|var)\\s+SQLVAR\\b\\s*=\\s*(.+?);";
 var REPLACE_ALL_TO_PLACEHOLDER_RE = /\.replaceAll\s*\([\s\S]*?,\s*"[\s,?]*\?[\s,?]*"\s*\)/;
 var HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
+function javaTraversalRejectGuardedLines(code) {
+  const covered = new Set;
+  const lines = code.split(`
+`);
+  const guardOpen = /\bif\s*\(\s*([A-Za-z_]\w*)\s*\.\s*contains\s*\(\s*"[^"]*\.\.[^"]*"\s*\)/;
+  const terminatorRe = /\b(throw|return)\b/;
+  const assignRe = /^\s*(?:[A-Za-z_][\w.<>[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = guardOpen.exec(lines[i2]);
+    if (!m)
+      continue;
+    let hasTerminator = terminatorRe.test(lines[i2]);
+    if (!hasTerminator) {
+      for (let j = i2 + 1;j < Math.min(lines.length, i2 + 6); j++) {
+        if (terminatorRe.test(lines[j])) {
+          hasTerminator = true;
+          break;
+        }
+        if (lines[j].includes("}"))
+          break;
+      }
+    }
+    if (!hasTerminator)
+      continue;
+    const guarded = new Set([m[1]]);
+    const mentionsGuarded = (text) => {
+      for (const name2 of guarded)
+        if (new RegExp(`\\b${name2}\\b`).test(text))
+          return true;
+      return false;
+    };
+    for (let l = i2 + 1;l < lines.length; l++) {
+      const lineText = lines[l];
+      const assign = assignRe.exec(lineText);
+      if (assign) {
+        if (mentionsGuarded(assign[2]))
+          guarded.add(assign[1]);
+        else if (assign[1] !== m[1])
+          guarded.delete(assign[1]);
+      }
+      if (mentionsGuarded(lineText))
+        covered.add(l + 1);
+    }
+  }
+  return covered;
+}
 var JAVA_INLINE_MATCHES_RE = /\.\s*matches\s*\(\s*"((?:[^"\\]|\\.)*)"\s*\)/g;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
@@ -32580,6 +32624,12 @@ class SinkFilterPass {
     if (language === "java" && !HTML_CONTENT_TYPE_RE.test(ctx.code)) {
       filtered = filtered.filter((sink) => !(sink.type === "xss" && sink.method === "body"));
     }
+    if (language === "java") {
+      const guardedLines = javaTraversalRejectGuardedLines(ctx.code);
+      if (guardedLines.size > 0) {
+        filtered = filtered.filter((sink) => !(sink.type === "path_traversal" && guardedLines.has(sink.line)));
+      }
+    }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split(`
 `);
@@ -47032,7 +47082,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.209.0";
+var version = "3.212.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.209.0",
+  "version": "3.212.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.209.0"
+    "circle-ir": "^3.212.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",