cognium-dev 3.210.0 → 3.213.0

package/dist/cli.js

@@ -11840,8 +11840,6 @@ var DEFAULT_SINKS = [
   { method: "setVariable", class: "Context", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [1] },
   { method: "clean", class: "AntiSamy", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "getValidSafeHTML", class: "ESAPI", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "getAttribute", class: "HttpServletRequest", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
-  { method: "getAttribute", class: "HttpSession", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [] },
   { method: "spawn", class: "Command", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "output", class: "Command", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "status", class: "Command", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
@@ -14479,6 +14477,73 @@ function isNonExecutablePython(trimmed) {
   return false;
 }
 
+// ../circle-ir/dist/analysis/sanitizer-index.js
+var SANITIZER_SET_CACHE = new WeakMap;
+function getSanitizesSet(san) {
+  let s = SANITIZER_SET_CACHE.get(san);
+  if (!s) {
+    s = new Set(san.sanitizes);
+    SANITIZER_SET_CACHE.set(san, s);
+  }
+  return s;
+}
+function sanitizerCoversSink(san, sinkType) {
+  return getSanitizesSet(san).has(sinkType);
+}
+
+// ../circle-ir/dist/analysis/dfg-walk.js
+var walkBackwardDefsMemo = new WeakMap;
+function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
+  const maxHops = options.maxHops ?? 32;
+  let perFile = walkBackwardDefsMemo.get(chainsByToDef);
+  if (perFile !== undefined) {
+    const key = `${startDefId}|${maxHops}`;
+    const hit = perFile.get(key);
+    if (hit !== undefined)
+      return hit;
+  }
+  const visited = new Set;
+  const lines = new Set;
+  let hopCapReached = false;
+  const startDef = defById.get(startDefId);
+  if (!startDef) {
+    return { visited, lines, hopCapReached: false };
+  }
+  visited.add(startDefId);
+  lines.add(startDef.line);
+  const queue = [startDefId];
+  let hops = 0;
+  while (queue.length > 0) {
+    if (hops >= maxHops) {
+      hopCapReached = true;
+      break;
+    }
+    hops++;
+    const currentId = queue.shift();
+    const incoming = chainsByToDef.get(currentId);
+    if (!incoming)
+      continue;
+    for (const chain of incoming) {
+      const fromId = chain.from_def;
+      if (visited.has(fromId))
+        continue;
+      visited.add(fromId);
+      const fromDef = defById.get(fromId);
+      if (fromDef) {
+        lines.add(fromDef.line);
+      }
+      queue.push(fromId);
+    }
+  }
+  const result = { visited, lines, hopCapReached };
+  if (perFile === undefined) {
+    perFile = new Map;
+    walkBackwardDefsMemo.set(chainsByToDef, perFile);
+  }
+  perFile.set(`${startDefId}|${maxHops}`, result);
+  return result;
+}
+
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
@@ -16765,73 +16830,6 @@ class AnalysisPipeline {
     return { results, findings };
   }
 }
-// ../circle-ir/dist/analysis/dfg-walk.js
-var walkBackwardDefsMemo = new WeakMap;
-function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
-  const maxHops = options.maxHops ?? 32;
-  let perFile = walkBackwardDefsMemo.get(chainsByToDef);
-  if (perFile !== undefined) {
-    const key = `${startDefId}|${maxHops}`;
-    const hit = perFile.get(key);
-    if (hit !== undefined)
-      return hit;
-  }
-  const visited = new Set;
-  const lines = new Set;
-  let hopCapReached = false;
-  const startDef = defById.get(startDefId);
-  if (!startDef) {
-    return { visited, lines, hopCapReached: false };
-  }
-  visited.add(startDefId);
-  lines.add(startDef.line);
-  const queue = [startDefId];
-  let hops = 0;
-  while (queue.length > 0) {
-    if (hops >= maxHops) {
-      hopCapReached = true;
-      break;
-    }
-    hops++;
-    const currentId = queue.shift();
-    const incoming = chainsByToDef.get(currentId);
-    if (!incoming)
-      continue;
-    for (const chain of incoming) {
-      const fromId = chain.from_def;
-      if (visited.has(fromId))
-        continue;
-      visited.add(fromId);
-      const fromDef = defById.get(fromId);
-      if (fromDef) {
-        lines.add(fromDef.line);
-      }
-      queue.push(fromId);
-    }
-  }
-  const result = { visited, lines, hopCapReached };
-  if (perFile === undefined) {
-    perFile = new Map;
-    walkBackwardDefsMemo.set(chainsByToDef, perFile);
-  }
-  perFile.set(`${startDefId}|${maxHops}`, result);
-  return result;
-}
-
-// ../circle-ir/dist/analysis/sanitizer-index.js
-var SANITIZER_SET_CACHE = new WeakMap;
-function getSanitizesSet(san) {
-  let s = SANITIZER_SET_CACHE.get(san);
-  if (!s) {
-    s = new Set(san.sanitizes);
-    SANITIZER_SET_CACHE.set(san, s);
-  }
-  return s;
-}
-function sanitizerCoversSink(san, sinkType) {
-  return getSanitizesSet(san).has(sinkType);
-}
-
 // ../circle-ir/dist/analysis/taint-propagation.js
 function buildSanitizersByLine(sanitizers) {
   const out2 = new Map;
@@ -24784,6 +24782,7 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
       additionalSanitizers.push(...findJavaPathNormalizeStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaPathGetFileNameSanitizers(code));
+      additionalSanitizers.push(...findJavaCanonicalPathStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
       additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
@@ -27640,6 +27639,58 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const guardRe = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*getCanonicalPath\s*\(\s*\)\s*\.\s*startsWith\s*\(/;
+  const terminatorRe = /\b(throw|return)\b/;
+  const assignRe = /^\s*(?:[A-Za-z_][\w.<>[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = guardRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    let hasTerminator = terminatorRe.test(lines[i2]);
+    if (!hasTerminator) {
+      for (let j = i2 + 1;j < Math.min(lines.length, i2 + 6); j++) {
+        if (terminatorRe.test(lines[j])) {
+          hasTerminator = true;
+          break;
+        }
+        if (lines[j].includes("}"))
+          break;
+      }
+    }
+    if (!hasTerminator)
+      continue;
+    const guarded = new Set([m[1]]);
+    const mentions = (t) => {
+      for (const n of guarded)
+        if (new RegExp(`\\b${n}\\b`).test(t))
+          return true;
+      return false;
+    };
+    for (let l = 0;l < lines.length; l++) {
+      const lt = lines[l];
+      const a = assignRe.exec(lt);
+      if (a) {
+        if (mentions(a[2]))
+          guarded.add(a[1]);
+        else if (a[1] !== m[1])
+          guarded.delete(a[1]);
+      }
+      if (mentions(lt)) {
+        sanitizers.push({
+          type: "java_canonical_startswith_guard",
+          method: "getCanonicalPath",
+          line: l + 1,
+          sanitizes: ["path_traversal", "external_taint_escape"]
+        });
+      }
+    }
+  }
+  return sanitizers;
+}
 function findJavaPathGetFileNameSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -27647,15 +27698,16 @@ function findJavaPathGetFileNameSanitizers(code) {
   const assignmentRe = /^\s*(?:(?:final\s+)?[A-Za-z_][\w.<>?,\s\[\]]*?\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const rhsHasGetFileNameRe = /\.\s*getFileName\s*\(\s*\)/;
   const rhsHasPathsChainRe = /\b(?:Paths\s*\.\s*get|Path\s*\.\s*of)\s*\(/;
+  const rhsNewFileGetNameRe = /\bnew\s+File\s*\([\s\S]*\)\s*\.\s*getName\s*\(\s*\)/;
   const candidates = [];
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignmentRe.exec(lines[i2]);
     if (!m)
       continue;
     const rhs = m[2];
-    if (!rhsHasGetFileNameRe.test(rhs))
-      continue;
-    if (!rhsHasPathsChainRe.test(rhs))
+    const isNioGetFileName = rhsHasGetFileNameRe.test(rhs) && rhsHasPathsChainRe.test(rhs);
+    const isNewFileGetName = rhsNewFileGetNameRe.test(rhs);
+    if (!isNioGetFileName && !isNewFileGetName)
       continue;
     candidates.push({ line: i2 + 1, boundVar: m[1] });
   }
@@ -47084,7 +47136,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.210.0";
+var version = "3.213.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.210.0",
+  "version": "3.213.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.210.0"
+    "circle-ir": "^3.213.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",