cognium-dev 3.34.0 → 3.36.0

package/dist/cli.js

@@ -10381,6 +10381,22 @@ var DEFAULT_SINKS = [
   { method: "parse", class: "GroovyShell", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "parseClass", class: "GroovyClassLoader", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "run", class: "GroovyScriptEngine", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
+  { method: "onMethodCall", class: "SandboxInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onStaticCall", class: "SandboxInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onGetProperty", class: "SandboxInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onSetProperty", class: "SandboxInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onGetAttribute", class: "SandboxInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onSetAttribute", class: "SandboxInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onMethodPointer", class: "SandboxInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onSuperCall", class: "SandboxInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onSuperConstructor", class: "SandboxInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onMethodCall", class: "GroovyInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onNewInstance", class: "GroovyInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onStaticCall", class: "GroovyInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onGetProperty", class: "GroovyInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "onSetProperty", class: "GroovyInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "call", class: "SandboxTransformer", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
+  { method: "runInSandbox", class: "GroovySandbox", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [] },
   { method: "eval", class: "Bindings", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "eval", class: "ScriptContext", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "forName", class: "Class", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0] },
@@ -20497,6 +20513,28 @@ class TaintPropagationPass {
         flows.push(f);
       }
     }
+    const exprScanFlows = detectExpressionScanFlows(calls, sources, sinks, constProp.unreachableLines) ?? [];
+    for (const f of exprScanFlows) {
+      if (flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type))
+        continue;
+      const flowForCheck = {
+        source: { line: f.source_line },
+        sink: { line: f.sink_line },
+        path: f.path.map((p) => ({ variable: p.variable, line: p.line }))
+      };
+      if (isCorrelatedPredicateFP(constProp, flowForCheck))
+        continue;
+      let isFP = false;
+      for (const step of f.path) {
+        if (isFalsePositive(constProp, step.line, step.variable).isFalsePositive) {
+          isFP = true;
+          break;
+        }
+      }
+      if (isFP)
+        continue;
+      flows.push(f);
+    }
     return { flows };
   }
 }
@@ -20693,6 +20731,63 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
   }
   return flows;
 }
+function detectExpressionScanFlows(calls, sources, sinks, unreachableLines) {
+  const flows = [];
+  const sourcesWithVar = sources.filter((s) => typeof s.variable === "string" && s.variable.length > 0);
+  if (sourcesWithVar.length === 0)
+    return flows;
+  const reCache = new Map;
+  for (const s of sourcesWithVar) {
+    if (reCache.has(s.variable))
+      continue;
+    const escaped = s.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    reCache.set(s.variable, new RegExp(`\\b${escaped}\\b`));
+  }
+  const callsByLine = new Map;
+  for (const call of calls) {
+    const existing = callsByLine.get(call.location.line) ?? [];
+    existing.push(call);
+    callsByLine.set(call.location.line, existing);
+  }
+  for (const sink of sinks) {
+    if (unreachableLines.has(sink.line))
+      continue;
+    const callsAtSink = callsByLine.get(sink.line) ?? [];
+    for (const call of callsAtSink) {
+      for (const arg of call.arguments) {
+        if (sink.argPositions && sink.argPositions.length > 0 && !sink.argPositions.includes(arg.position)) {
+          continue;
+        }
+        const expr = arg.expression;
+        if (!expr)
+          continue;
+        for (const source of sourcesWithVar) {
+          if (source.line >= sink.line)
+            continue;
+          const re = reCache.get(source.variable);
+          if (!re || !re.test(expr))
+            continue;
+          if (flows.some((f) => f.source_line === source.line && f.sink_line === sink.line && f.sink_type === sink.type))
+            continue;
+          flows.push({
+            source_line: source.line,
+            sink_line: sink.line,
+            source_type: source.type,
+            sink_type: sink.type,
+            path: [
+              { variable: source.variable, line: source.line, type: "source" },
+              { variable: source.variable, line: sink.line, type: "sink" }
+            ],
+            confidence: source.confidence * sink.confidence * 0.7,
+            sanitized: false
+          });
+          break;
+        }
+      }
+    }
+  }
+  return flows;
+}
 
 // ../circle-ir/dist/analysis/interprocedural.js
 function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourcesOrSanitizers, sinksOrOptions, sanitizersArg, optionsArg = {}) {
@@ -26859,7 +26954,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.34.0";
+var version = "3.36.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.34.0",
+  "version": "3.36.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.34.0"
+    "circle-ir": "^3.36.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",