cognium-dev 3.33.0 → 3.34.0

package/dist/cli.js

@@ -9028,6 +9028,9 @@ function extractRuntimeRegistrations(tree, cache, language, imports) {
   if (language === "python") {
     return extractPythonRuntimeRegistrations(tree, cache, imports);
   }
+  if (language === "rust") {
+    return extractRustRuntimeRegistrations(tree, cache);
+  }
   return [];
 }
 function buildHandlerIndex(tree, cache, imports) {
@@ -9468,6 +9471,273 @@ function isPyRouterReceiver(receiver) {
     return true;
   return false;
 }
+var RUST_STDLIB_TRAITS = new Set([
+  "Display",
+  "Debug",
+  "Write",
+  "From",
+  "Into",
+  "TryFrom",
+  "TryInto",
+  "AsRef",
+  "AsMut",
+  "ToString",
+  "FromStr",
+  "Iterator",
+  "IntoIterator",
+  "FromIterator",
+  "DoubleEndedIterator",
+  "ExactSizeIterator",
+  "FusedIterator",
+  "PartialEq",
+  "Eq",
+  "PartialOrd",
+  "Ord",
+  "Hash",
+  "Default",
+  "Copy",
+  "Clone",
+  "Send",
+  "Sync",
+  "Unpin",
+  "Sized",
+  "Any",
+  "Drop",
+  "Future",
+  "IntoFuture",
+  "Add",
+  "Sub",
+  "Mul",
+  "Div",
+  "Rem",
+  "Neg",
+  "Not",
+  "AddAssign",
+  "SubAssign",
+  "MulAssign",
+  "DivAssign",
+  "RemAssign",
+  "BitAnd",
+  "BitOr",
+  "BitXor",
+  "Shl",
+  "Shr",
+  "Deref",
+  "DerefMut",
+  "Index",
+  "IndexMut",
+  "Fn",
+  "FnMut",
+  "FnOnce",
+  "Error",
+  "Read",
+  "Write",
+  "Seek",
+  "BufRead",
+  "Borrow",
+  "BorrowMut",
+  "ToOwned"
+]);
+var RUST_TRAIT_FRAMEWORK_PREFIXES = [
+  { prefix: /^actix(_web)?(::|$)/, framework: "actix" },
+  { prefix: /^axum(::|$)/, framework: "axum" },
+  { prefix: /^rocket(::|$)/, framework: "rocket" },
+  { prefix: /^tokio(::|$)/, framework: "tokio" },
+  { prefix: /^serde(_\w+)?(::|$)/, framework: "serde" },
+  { prefix: /^std(::|$)/, framework: "stdlib" },
+  { prefix: /^core(::|$)/, framework: "stdlib" },
+  { prefix: /^alloc(::|$)/, framework: "stdlib" }
+];
+function extractRustRuntimeRegistrations(tree, cache) {
+  const regs = [];
+  const implNodes = getNodesFromCache(tree.rootNode, "impl_item", cache);
+  for (const impl of implNodes) {
+    collectRustImplRegistrations(impl, regs);
+  }
+  const macroNodes = getNodesFromCache(tree.rootNode, "macro_invocation", cache);
+  for (const macro of macroNodes) {
+    const rec = parseInventorySubmit(macro);
+    if (rec)
+      regs.push(rec);
+  }
+  const attrNodes = getNodesFromCache(tree.rootNode, "attribute_item", cache);
+  for (const attr of attrNodes) {
+    const rec = parseDistributedSliceAttribute(attr);
+    if (rec)
+      regs.push(rec);
+  }
+  return regs;
+}
+function collectRustImplRegistrations(impl, regs) {
+  const traitNode = impl.childForFieldName("trait");
+  if (!traitNode)
+    return;
+  const typeNode = impl.childForFieldName("type");
+  if (!typeNode)
+    return;
+  const traitText = getNodeText(traitNode).trim();
+  const traitLastSegment = lastRustPathSegment(stripRustGenerics(traitText));
+  const selfType = getNodeText(typeNode).trim();
+  const framework = classifyRustTrait(traitText);
+  const body2 = impl.childForFieldName("body");
+  if (!body2)
+    return;
+  for (let i2 = 0;i2 < body2.childCount; i2++) {
+    const child = body2.child(i2);
+    if (!child || child.type !== "function_item")
+      continue;
+    const nameNode = child.childForFieldName("name");
+    if (!nameNode)
+      continue;
+    const methodName = getNodeText(nameNode);
+    regs.push({
+      kind: "trait_impl",
+      framework,
+      registrar: {
+        method: methodName,
+        receiver: selfType,
+        line: impl.startPosition.row + 1,
+        column: impl.startPosition.column
+      },
+      path: traitLastSegment || traitText,
+      handler: {
+        name: methodName,
+        line: child.startPosition.row + 1,
+        column: child.startPosition.column
+      }
+    });
+  }
+}
+function stripRustGenerics(text) {
+  const idx = text.indexOf("<");
+  return idx >= 0 ? text.slice(0, idx) : text;
+}
+function lastRustPathSegment(path) {
+  const parts2 = path.split("::");
+  return parts2[parts2.length - 1] || path;
+}
+function classifyRustTrait(traitText) {
+  const stripped = stripRustGenerics(traitText).trim();
+  const last = lastRustPathSegment(stripped);
+  if (RUST_STDLIB_TRAITS.has(last))
+    return "stdlib";
+  for (const { prefix, framework } of RUST_TRAIT_FRAMEWORK_PREFIXES) {
+    if (prefix.test(stripped))
+      return framework;
+  }
+  return "unknown";
+}
+function parseInventorySubmit(macro) {
+  const macroName = macro.childForFieldName("macro");
+  if (!macroName)
+    return null;
+  const name2 = getNodeText(macroName).trim();
+  if (name2 !== "inventory::submit" && name2 !== "submit")
+    return null;
+  if (name2 === "submit")
+    return null;
+  let tokenTree = null;
+  for (let i2 = 0;i2 < macro.childCount; i2++) {
+    const c = macro.child(i2);
+    if (c && c.type === "token_tree") {
+      tokenTree = c;
+      break;
+    }
+  }
+  if (!tokenTree)
+    return null;
+  const handlerName = firstIdentifierInTokenTree(tokenTree);
+  return {
+    kind: "trait_impl",
+    framework: "inventory",
+    registrar: {
+      method: "submit",
+      receiver: "inventory",
+      line: macro.startPosition.row + 1,
+      column: macro.startPosition.column
+    },
+    path: "inventory::submit",
+    handler: {
+      name: handlerName,
+      line: tokenTree.startPosition.row + 1,
+      column: tokenTree.startPosition.column
+    }
+  };
+}
+function firstIdentifierInTokenTree(tokenTree) {
+  for (let i2 = 0;i2 < tokenTree.childCount; i2++) {
+    const c = tokenTree.child(i2);
+    if (!c)
+      continue;
+    if (c.type === "identifier" || c.type === "scoped_identifier" || c.type === "type_identifier") {
+      return getNodeText(c).trim();
+    }
+  }
+  return null;
+}
+function parseDistributedSliceAttribute(attrItem) {
+  let attr = null;
+  for (let i2 = 0;i2 < attrItem.childCount; i2++) {
+    const c = attrItem.child(i2);
+    if (c && c.type === "attribute") {
+      attr = c;
+      break;
+    }
+  }
+  if (!attr)
+    return null;
+  const pathNode = attr.child(0);
+  if (!pathNode)
+    return null;
+  const pathText = getNodeText(pathNode).trim();
+  if (pathText !== "linkme::distributed_slice" && pathText !== "distributed_slice")
+    return null;
+  const parent = attrItem.parent;
+  if (!parent)
+    return null;
+  let attrIndex = -1;
+  for (let i2 = 0;i2 < parent.childCount; i2++) {
+    const c = parent.child(i2);
+    if (c && c.id === attrItem.id) {
+      attrIndex = i2;
+      break;
+    }
+  }
+  if (attrIndex < 0)
+    return null;
+  let handlerNode = null;
+  for (let j = attrIndex + 1;j < parent.childCount; j++) {
+    const sib = parent.child(j);
+    if (!sib)
+      continue;
+    if (sib.type === "attribute_item")
+      continue;
+    if (sib.type === "static_item" || sib.type === "function_item") {
+      handlerNode = sib;
+    }
+    break;
+  }
+  if (!handlerNode)
+    return null;
+  const nameNode = handlerNode.childForFieldName("name");
+  const handlerName = nameNode ? getNodeText(nameNode).trim() : null;
+  return {
+    kind: "trait_impl",
+    framework: "linkme",
+    registrar: {
+      method: "distributed_slice",
+      receiver: "linkme",
+      line: attrItem.startPosition.row + 1,
+      column: attrItem.startPosition.column
+    },
+    path: "linkme::distributed_slice",
+    handler: {
+      name: handlerName,
+      line: handlerNode.startPosition.row + 1,
+      column: handlerNode.startPosition.column
+    }
+  };
+}
 // ../circle-ir/dist/analysis/config-loader.js
 var DEFAULT_SOURCES = [
   { method: "getParameter", class: "HttpServletRequest", type: "http_param", severity: "high", return_tainted: true },
@@ -26205,7 +26475,9 @@ function getNodeTypesForLanguage(language) {
         "use_declaration",
         "let_declaration",
         "field_expression",
-        "scoped_identifier"
+        "scoped_identifier",
+        "attribute_item",
+        "static_item"
       ]);
     case "python":
       return new Set([
@@ -26587,7 +26859,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.33.0";
+var version = "3.34.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.33.0",
+  "version": "3.34.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.33.0"
+    "circle-ir": "^3.34.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",