cognium-dev 3.23.2 → 3.23.4

package/dist/cli.js

@@ -9017,6 +9017,7 @@ var DEFAULT_SOURCES = [
   { annotation: "FormParam", type: "http_param", severity: "high", param_tainted: true },
   { annotation: "PathParam", type: "http_path", severity: "medium", param_tainted: true },
   { annotation: "HeaderParam", type: "http_header", severity: "high", param_tainted: true },
+  { method_annotation: "DataBoundConstructor", type: "http_param", severity: "high" },
   { method: "getenv", class: "System", type: "env_input", severity: "medium", return_tainted: true },
   { method: "getProperty", class: "System", type: "env_input", severity: "medium", return_tainted: true },
   { method: "getInitParameter", class: "ServletConfig", type: "http_param", severity: "medium", return_tainted: true },
@@ -10324,6 +10325,26 @@ function findSources(calls, types, patterns) {
       }
     }
   }
+  for (const type of types) {
+    for (const method of type.methods) {
+      for (const pattern of patterns) {
+        if (!pattern.method_annotation)
+          continue;
+        if (!matchesAnnotation(method.annotations, pattern.method_annotation))
+          continue;
+        for (const param of method.parameters) {
+          const paramLine = param.line ?? method.start_line;
+          sources.push({
+            type: pattern.type,
+            location: `@${pattern.method_annotation} ${param.name} in ${method.name}`,
+            severity: pattern.severity,
+            line: paramLine,
+            confidence: 1
+          });
+        }
+      }
+    }
+  }
   const RUST_EXTRACTOR_TYPES = /^(?:Json|Form|Query|Path|Extension|Multipart)(?:<|$)|^(?:Body|Bytes)$/;
   for (const type of types) {
     for (const method of type.methods) {
@@ -25714,7 +25735,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.23.2";
+var version = "3.23.4";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.23.2",
+  "version": "3.23.4",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.23.2"
+    "circle-ir": "^3.23.4"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",