cognium-dev 3.213.0 → 3.215.0

package/dist/cli.js

@@ -11220,8 +11220,8 @@ var DEFAULT_SINKS = [
   { method: "addAttribute", class: "Model", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   { method: "addAttribute", class: "ModelMap", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   { method: "addObject", class: "ModelAndView", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
-  { method: "println", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "print", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
+  { method: "println", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0], languages: ["java"] },
+  { method: "print", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0], languages: ["java"] },
   { method: "handleHyperlinks", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "handleDiv", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "handleImage", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -12752,31 +12752,33 @@ function findSources(calls, types, patterns, sourceLines, language) {
     }
   }
   const RUST_EXTRACTOR_KIND = /(?:^|::)(Json|Form|Query|Path|Extension|Multipart|Body|Bytes)(?:<|$)/;
-  for (const type of types) {
-    for (const method of type.methods) {
-      for (const param of method.parameters) {
-        if (!param.type)
-          continue;
-        const kindMatch = RUST_EXTRACTOR_KIND.exec(param.type);
-        if (!kindMatch)
-          continue;
-        const kind = kindMatch[1];
-        if (kind === "Extension")
-          continue;
-        const sourceType = kind === "Form" || kind === "Query" || kind === "Path" ? "http_param" : "http_body";
-        const paramLine = param.line ?? method.start_line;
-        const alreadyExists = sources.some((s) => s.line === paramLine && s.variable === param.name);
-        if (alreadyExists)
-          continue;
-        sources.push({
-          type: sourceType,
-          location: `${param.type} ${param.name} in ${method.name}`,
-          severity: "high",
-          line: paramLine,
-          confidence: 1,
-          variable: param.name,
-          in_method: method.name
-        });
+  if (language === "rust") {
+    for (const type of types) {
+      for (const method of type.methods) {
+        for (const param of method.parameters) {
+          if (!param.type)
+            continue;
+          const kindMatch = RUST_EXTRACTOR_KIND.exec(param.type);
+          if (!kindMatch)
+            continue;
+          const kind = kindMatch[1];
+          if (kind === "Extension")
+            continue;
+          const sourceType = kind === "Form" || kind === "Query" || kind === "Path" ? "http_param" : "http_body";
+          const paramLine = param.line ?? method.start_line;
+          const alreadyExists = sources.some((s) => s.line === paramLine && s.variable === param.name);
+          if (alreadyExists)
+            continue;
+          sources.push({
+            type: sourceType,
+            location: `${param.type} ${param.name} in ${method.name}`,
+            severity: "high",
+            line: paramLine,
+            confidence: 1,
+            variable: param.name,
+            in_method: method.name
+          });
+        }
       }
     }
   }
@@ -31853,6 +31855,8 @@ var SQL_EXEC_METHODS = new Set([
 var JAVA_SQL_ASSIGN_RE_TEMPLATE = "\\b(?:String|CharSequence|final\\s+String|var)\\s+SQLVAR\\b\\s*=\\s*(.+?);";
 var REPLACE_ALL_TO_PLACEHOLDER_RE = /\.replaceAll\s*\([\s\S]*?,\s*"[\s,?]*\?[\s,?]*"\s*\)/;
 var HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
+var FETCH_GLOBAL_RECEIVER_RE = /(?:^|[^.\w])(?:window|globalThis|self|global)\s*\.\s*fetch\s*\(/;
+var FETCH_MEMBER_RECEIVER_RE = /[\w$)\]]\s*\.\s*fetch\s*\(/;
 function javaTraversalRejectGuardedLines(code) {
   const covered = new Set;
   const lines = code.split(`
@@ -32686,6 +32690,18 @@ class SinkFilterPass {
     }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "ssrf" || sink.method !== "fetch")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        if (FETCH_GLOBAL_RECEIVER_RE.test(sinkLineText))
+          return true;
+        return !FETCH_MEMBER_RECEIVER_RE.test(sinkLineText);
+      });
+    }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split(`
 `);
       filtered = filtered.filter((sink) => {
         if (sink.type !== "log_injection")
@@ -47136,7 +47152,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.213.0";
+var version = "3.215.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.213.0",
+  "version": "3.215.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.213.0"
+    "circle-ir": "^3.215.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",