cognium-dev 3.214.0 → 3.216.0

package/dist/cli.js

@@ -11220,8 +11220,8 @@ var DEFAULT_SINKS = [
   { method: "addAttribute", class: "Model", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   { method: "addAttribute", class: "ModelMap", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   { method: "addObject", class: "ModelAndView", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
-  { method: "println", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
-  { method: "print", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
+  { method: "println", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0], languages: ["java"] },
+  { method: "print", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0], languages: ["java"] },
   { method: "handleHyperlinks", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "handleDiv", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "handleImage", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -31855,6 +31855,8 @@ var SQL_EXEC_METHODS = new Set([
 var JAVA_SQL_ASSIGN_RE_TEMPLATE = "\\b(?:String|CharSequence|final\\s+String|var)\\s+SQLVAR\\b\\s*=\\s*(.+?);";
 var REPLACE_ALL_TO_PLACEHOLDER_RE = /\.replaceAll\s*\([\s\S]*?,\s*"[\s,?]*\?[\s,?]*"\s*\)/;
 var HTML_CONTENT_TYPE_RE = /text\/html|TEXT_HTML/;
+var FETCH_GLOBAL_RECEIVER_RE = /(?:^|[^.\w])(?:window|globalThis|self|global)\s*\.\s*fetch\s*\(/;
+var FETCH_MEMBER_RECEIVER_RE = /[\w$)\]]\s*\.\s*fetch\s*\(/;
 function javaTraversalRejectGuardedLines(code) {
   const covered = new Set;
   const lines = code.split(`
@@ -31901,6 +31903,74 @@ function javaTraversalRejectGuardedLines(code) {
   }
   return covered;
 }
+function isAnchoredHostAllowlistRegex(src) {
+  if (!src.startsWith("^"))
+    return false;
+  if (!/https?/i.test(src))
+    return false;
+  return /[A-Za-z][A-Za-z0-9-]+\\?\./.test(src);
+}
+function isSchemeHostPrefix(prefix) {
+  if (!/^https?:\/\//i.test(prefix))
+    return false;
+  const afterScheme = prefix.replace(/^https?:\/\//i, "");
+  return /[A-Za-z][A-Za-z0-9-]*\./.test(afterScheme);
+}
+function jsSsrfHostGuardedLines(code) {
+  const covered = new Set;
+  const lines = code.split(`
+`);
+  const rejectRegexTest = /\bif\s*\(\s*!\s*\/((?:[^/\\]|\\.)*)\/[a-z]*\s*\.\s*test\s*\(\s*([A-Za-z_]\w*)\s*\)/;
+  const rejectStartsWith = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*startsWith\s*\(\s*["'`]([^"'`]+)["'`]/;
+  const terminatorRe = /\b(throw|return)\b/;
+  const assignRe = /^\s*(?:const|let|var\s+)?\s*([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    let guardedVar = null;
+    const rm = rejectRegexTest.exec(lines[i2]);
+    if (rm && isAnchoredHostAllowlistRegex(rm[1]))
+      guardedVar = rm[2];
+    if (!guardedVar) {
+      const sm = rejectStartsWith.exec(lines[i2]);
+      if (sm && isSchemeHostPrefix(sm[2]))
+        guardedVar = sm[1];
+    }
+    if (!guardedVar)
+      continue;
+    let hasTerminator = terminatorRe.test(lines[i2]);
+    if (!hasTerminator) {
+      for (let j = i2 + 1;j < Math.min(lines.length, i2 + 6); j++) {
+        if (terminatorRe.test(lines[j])) {
+          hasTerminator = true;
+          break;
+        }
+        if (lines[j].includes("}"))
+          break;
+      }
+    }
+    if (!hasTerminator)
+      continue;
+    const guarded = new Set([guardedVar]);
+    const mentionsGuarded = (text) => {
+      for (const name2 of guarded)
+        if (new RegExp(`\\b${name2}\\b`).test(text))
+          return true;
+      return false;
+    };
+    for (let l = i2 + 1;l < lines.length; l++) {
+      const lineText = lines[l];
+      const assign = assignRe.exec(lineText);
+      if (assign) {
+        if (mentionsGuarded(assign[2]))
+          guarded.add(assign[1]);
+        else if (assign[1] !== guardedVar)
+          guarded.delete(assign[1]);
+      }
+      if (mentionsGuarded(lineText))
+        covered.add(l + 1);
+    }
+  }
+  return covered;
+}
 var JAVA_INLINE_MATCHES_RE = /\.\s*matches\s*\(\s*"((?:[^"\\]|\\.)*)"\s*\)/g;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
@@ -32688,6 +32758,24 @@ class SinkFilterPass {
     }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "ssrf" || sink.method !== "fetch")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        if (FETCH_GLOBAL_RECEIVER_RE.test(sinkLineText))
+          return true;
+        return !FETCH_MEMBER_RECEIVER_RE.test(sinkLineText);
+      });
+    }
+    if (["javascript", "typescript"].includes(language)) {
+      const guardedLines = jsSsrfHostGuardedLines(ctx.code);
+      if (guardedLines.size > 0) {
+        filtered = filtered.filter((sink) => !(sink.type === "ssrf" && guardedLines.has(sink.line)));
+      }
+    }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split(`
 `);
       filtered = filtered.filter((sink) => {
         if (sink.type !== "log_injection")
@@ -47138,7 +47226,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.214.0";
+var version = "3.216.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.214.0",
+  "version": "3.216.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.214.0"
+    "circle-ir": "^3.216.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",