cognium-dev 3.212.0 → 3.213.0

package/dist/cli.js

@@ -24782,6 +24782,7 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
       additionalSanitizers.push(...findJavaPathNormalizeStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaPathGetFileNameSanitizers(code));
+      additionalSanitizers.push(...findJavaCanonicalPathStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
       additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
@@ -27638,6 +27639,58 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const guardRe = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*getCanonicalPath\s*\(\s*\)\s*\.\s*startsWith\s*\(/;
+  const terminatorRe = /\b(throw|return)\b/;
+  const assignRe = /^\s*(?:[A-Za-z_][\w.<>[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = guardRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    let hasTerminator = terminatorRe.test(lines[i2]);
+    if (!hasTerminator) {
+      for (let j = i2 + 1;j < Math.min(lines.length, i2 + 6); j++) {
+        if (terminatorRe.test(lines[j])) {
+          hasTerminator = true;
+          break;
+        }
+        if (lines[j].includes("}"))
+          break;
+      }
+    }
+    if (!hasTerminator)
+      continue;
+    const guarded = new Set([m[1]]);
+    const mentions = (t) => {
+      for (const n of guarded)
+        if (new RegExp(`\\b${n}\\b`).test(t))
+          return true;
+      return false;
+    };
+    for (let l = 0;l < lines.length; l++) {
+      const lt = lines[l];
+      const a = assignRe.exec(lt);
+      if (a) {
+        if (mentions(a[2]))
+          guarded.add(a[1]);
+        else if (a[1] !== m[1])
+          guarded.delete(a[1]);
+      }
+      if (mentions(lt)) {
+        sanitizers.push({
+          type: "java_canonical_startswith_guard",
+          method: "getCanonicalPath",
+          line: l + 1,
+          sanitizes: ["path_traversal", "external_taint_escape"]
+        });
+      }
+    }
+  }
+  return sanitizers;
+}
 function findJavaPathGetFileNameSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -27645,15 +27698,16 @@ function findJavaPathGetFileNameSanitizers(code) {
   const assignmentRe = /^\s*(?:(?:final\s+)?[A-Za-z_][\w.<>?,\s\[\]]*?\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const rhsHasGetFileNameRe = /\.\s*getFileName\s*\(\s*\)/;
   const rhsHasPathsChainRe = /\b(?:Paths\s*\.\s*get|Path\s*\.\s*of)\s*\(/;
+  const rhsNewFileGetNameRe = /\bnew\s+File\s*\([\s\S]*\)\s*\.\s*getName\s*\(\s*\)/;
   const candidates = [];
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignmentRe.exec(lines[i2]);
     if (!m)
       continue;
     const rhs = m[2];
-    if (!rhsHasGetFileNameRe.test(rhs))
-      continue;
-    if (!rhsHasPathsChainRe.test(rhs))
+    const isNioGetFileName = rhsHasGetFileNameRe.test(rhs) && rhsHasPathsChainRe.test(rhs);
+    const isNewFileGetName = rhsNewFileGetNameRe.test(rhs);
+    if (!isNioGetFileName && !isNewFileGetName)
       continue;
     candidates.push({ line: i2 + 1, boundVar: m[1] });
   }
@@ -47082,7 +47136,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.212.0";
+var version = "3.213.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.212.0",
+  "version": "3.213.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.212.0"
+    "circle-ir": "^3.213.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",