cognium-dev 3.214.0 → 3.215.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +17 -3
- package/package.json +2 -2
package/dist/cli.js
CHANGED
|
@@ -11220,8 +11220,8 @@ var DEFAULT_SINKS = [
|
|
|
11220
11220
|
{ method: "addAttribute", class: "Model", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
|
|
11221
11221
|
{ method: "addAttribute", class: "ModelMap", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
|
|
11222
11222
|
{ method: "addObject", class: "ModelAndView", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
|
|
11223
|
-
{ method: "println", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
|
|
11224
|
-
{ method: "print", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
|
|
11223
|
+
{ method: "println", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0], languages: ["java"] },
|
|
11224
|
+
{ method: "print", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0], languages: ["java"] },
|
|
11225
11225
|
{ method: "handleHyperlinks", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
|
|
11226
11226
|
{ method: "handleDiv", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
|
|
11227
11227
|
{ method: "handleImage", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
|
|
@@ -31855,6 +31855,8 @@ var SQL_EXEC_METHODS = new Set([
|
|
|
31855
31855
|
var JAVA_SQL_ASSIGN_RE_TEMPLATE = "\\b(?:String|CharSequence|final\\s+String|var)\\s+SQLVAR\\b\\s*=\\s*(.+?);";
|
|
31856
31856
|
var REPLACE_ALL_TO_PLACEHOLDER_RE = /\.replaceAll\s*\([\s\S]*?,\s*"[\s,?]*\?[\s,?]*"\s*\)/;
|
|
31857
31857
|
var HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
|
|
31858
|
+
var FETCH_GLOBAL_RECEIVER_RE = /(?:^|[^.\w])(?:window|globalThis|self|global)\s*\.\s*fetch\s*\(/;
|
|
31859
|
+
var FETCH_MEMBER_RECEIVER_RE = /[\w$)\]]\s*\.\s*fetch\s*\(/;
|
|
31858
31860
|
function javaTraversalRejectGuardedLines(code) {
|
|
31859
31861
|
const covered = new Set;
|
|
31860
31862
|
const lines = code.split(`
|
|
@@ -32688,6 +32690,18 @@ class SinkFilterPass {
|
|
|
32688
32690
|
}
|
|
32689
32691
|
if (["javascript", "typescript"].includes(language)) {
|
|
32690
32692
|
const sourceLines = ctx.code.split(`
|
|
32693
|
+
`);
|
|
32694
|
+
filtered = filtered.filter((sink) => {
|
|
32695
|
+
if (sink.type !== "ssrf" || sink.method !== "fetch")
|
|
32696
|
+
return true;
|
|
32697
|
+
const sinkLineText = sourceLines[sink.line - 1] ?? "";
|
|
32698
|
+
if (FETCH_GLOBAL_RECEIVER_RE.test(sinkLineText))
|
|
32699
|
+
return true;
|
|
32700
|
+
return !FETCH_MEMBER_RECEIVER_RE.test(sinkLineText);
|
|
32701
|
+
});
|
|
32702
|
+
}
|
|
32703
|
+
if (["javascript", "typescript"].includes(language)) {
|
|
32704
|
+
const sourceLines = ctx.code.split(`
|
|
32691
32705
|
`);
|
|
32692
32706
|
filtered = filtered.filter((sink) => {
|
|
32693
32707
|
if (sink.type !== "log_injection")
|
|
@@ -47138,7 +47152,7 @@ var colors = {
|
|
|
47138
47152
|
};
|
|
47139
47153
|
|
|
47140
47154
|
// src/version.ts
|
|
47141
|
-
var version = "3.
|
|
47155
|
+
var version = "3.215.0";
|
|
47142
47156
|
|
|
47143
47157
|
// src/formatters.ts
|
|
47144
47158
|
var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cognium-dev",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.215.0",
|
|
4
4
|
"description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -66,7 +66,7 @@
|
|
|
66
66
|
},
|
|
67
67
|
"dependencies": {
|
|
68
68
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
69
|
-
"circle-ir": "^3.
|
|
69
|
+
"circle-ir": "^3.215.0"
|
|
70
70
|
},
|
|
71
71
|
"devDependencies": {
|
|
72
72
|
"@types/node": "^25.5.0",
|