cognium-dev 3.38.0 → 3.40.0

package/dist/cli.js

@@ -11092,13 +11092,29 @@ var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.query_params\b/, sourceType: "http_param" },
   { pattern: /\brequest\.path_params\b/, sourceType: "http_param" }
 ];
-function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language) {
-  const sources = findSources(calls, types, config.sources);
-  const sinks = findSinks(calls, config.sinks, typeHierarchy, language);
+function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
+  const sourceLines = code !== undefined ? code.split(`
+`) : undefined;
+  const sources = findSources(calls, types, config.sources, sourceLines);
+  const sinks = findSinks(calls, config.sinks, typeHierarchy, language, sourceLines);
   const sanitizers = findSanitizers(calls, types, config.sanitizers);
   return { sources, sinks, sanitizers };
 }
-function findSources(calls, types, patterns) {
+function attachSourceLineCode(sources, sinks, code) {
+  const lines = code.split(`
+`);
+  for (const s of sources) {
+    if (s.code === undefined) {
+      s.code = lines[s.line - 1]?.trim();
+    }
+  }
+  for (const s of sinks) {
+    if (s.code === undefined) {
+      s.code = lines[s.line - 1]?.trim();
+    }
+  }
+}
+function findSources(calls, types, patterns, sourceLines) {
   const sources = [];
   for (const call of calls) {
     for (const pattern of patterns) {
@@ -11245,7 +11261,13 @@ function findSources(calls, types, patterns) {
       sourceMap.set(key, source);
     }
   }
-  return Array.from(sourceMap.values());
+  const result = Array.from(sourceMap.values());
+  if (sourceLines) {
+    for (const s of result) {
+      s.code = sourceLines[s.line - 1]?.trim();
+    }
+  }
+  return result;
 }
 function isInterproceduralTaintableType(typeName) {
   const baseType = typeName.split("<")[0].trim();
@@ -11341,7 +11363,7 @@ function isParameterizedQueryCall(call, pattern) {
   }
   return false;
 }
-function findSinks(calls, patterns, typeHierarchy, language) {
+function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
   const sinkMap = new Map;
   for (const call of calls) {
     for (const pattern of patterns) {
@@ -11367,7 +11389,13 @@ function findSinks(calls, patterns, typeHierarchy, language) {
       }
     }
   }
-  return Array.from(sinkMap.values());
+  const result = Array.from(sinkMap.values());
+  if (sourceLines) {
+    for (const s of result) {
+      s.code = sourceLines[s.line - 1]?.trim();
+    }
+  }
+  return result;
 }
 function matchesSourcePattern(call, pattern) {
   if (pattern.method) {
@@ -18050,6 +18078,7 @@ class CrossFileResolver {
   typeHierarchy;
   fileIRs = new Map;
   methodTaintInfo = new Map;
+  fieldTaintInfo = new Map;
   resolvedCalls = new Map;
   constructor(symbolTable, typeHierarchy) {
     this.symbolTable = symbolTable;
@@ -18060,6 +18089,7 @@ class CrossFileResolver {
     this.symbolTable.addFromIR(ir, filePath);
     this.typeHierarchy.addFromIR(ir, filePath);
     this.analyzeMethodTaint(ir, filePath);
+    this.analyzeFieldTaint(ir, filePath);
   }
   resolveCall(call, fromFile) {
     const cacheKey = `${fromFile}:${call.location.line}:${call.method_name}`;
@@ -18226,6 +18256,113 @@ class CrossFileResolver {
       }
     }
   }
+  analyzeFieldTaint(ir, filePath) {
+    const pkg = ir.meta.package || "";
+    const ctorFieldRe = /^(\w+)\.(\w+)\(\) returns tainted field '([^']+)' \(from constructor param '([^']+)'\)/;
+    for (const src of ir.taint.sources) {
+      if (src.type !== "constructor_field")
+        continue;
+      const m = ctorFieldRe.exec(src.location);
+      if (!m)
+        continue;
+      const [, className, , fieldName, sourceParam] = m;
+      const typeFqn = pkg ? `${pkg}.${className}` : className;
+      const type = ir.types.find((t) => t.name === className);
+      if (!type)
+        continue;
+      const writerMethod = type.methods.find((mth) => mth.name === className && mth.parameters.some((p) => p.name === sourceParam)) ?? type.methods.find((mth) => mth.parameters.some((p) => p.name === sourceParam));
+      if (!writerMethod)
+        continue;
+      const field = type.fields?.find((f) => f.name === fieldName);
+      const key = `${typeFqn}.${fieldName}`;
+      const existing = this.fieldTaintInfo.get(key);
+      const writer = {
+        methodFqn: `${typeFqn}.${writerMethod.name}`,
+        methodName: writerMethod.name,
+        writeLine: writerMethod.start_line,
+        sourceType: "constructor_field",
+        sourceLine: src.line
+      };
+      if (existing) {
+        if (!existing.writers.some((w) => w.methodFqn === writer.methodFqn)) {
+          existing.writers.push(writer);
+        }
+      } else {
+        this.fieldTaintInfo.set(key, {
+          typeFqn,
+          fieldName,
+          fieldType: field?.type ?? null,
+          file: filePath,
+          writers: [writer]
+        });
+      }
+    }
+    for (const type of ir.types) {
+      const typeFqn = pkg ? `${pkg}.${type.name}` : type.name;
+      for (const method of type.methods) {
+        if (!method.name.startsWith("set") || method.name.length <= 3)
+          continue;
+        if (method.parameters.length !== 1)
+          continue;
+        const fieldName = method.name.charAt(3).toLowerCase() + method.name.substring(4);
+        const field = type.fields?.find((f) => f.name === fieldName);
+        if (!field)
+          continue;
+        const key = `${typeFqn}.${fieldName}`;
+        const writer = {
+          methodFqn: `${typeFqn}.${method.name}`,
+          methodName: method.name,
+          writeLine: method.start_line,
+          sourceType: "setter_param",
+          sourceLine: method.start_line
+        };
+        const existing = this.fieldTaintInfo.get(key);
+        if (existing) {
+          if (!existing.writers.some((w) => w.methodFqn === writer.methodFqn)) {
+            existing.writers.push(writer);
+          }
+        } else {
+          this.fieldTaintInfo.set(key, {
+            typeFqn,
+            fieldName,
+            fieldType: field.type ?? null,
+            file: filePath,
+            writers: [writer]
+          });
+        }
+      }
+    }
+    const injectAnnotations = new Set(["Autowired", "Inject", "Resource"]);
+    for (const type of ir.types) {
+      const typeFqn = pkg ? `${pkg}.${type.name}` : type.name;
+      for (const field of type.fields ?? []) {
+        if (!field.annotations?.some((a) => injectAnnotations.has(a)))
+          continue;
+        const key = `${typeFqn}.${field.name}`;
+        const writer = {
+          methodFqn: `${typeFqn}.<injected>`,
+          methodName: "<injected>",
+          writeLine: type.start_line,
+          sourceType: "autowired_field",
+          sourceLine: type.start_line
+        };
+        const existing = this.fieldTaintInfo.get(key);
+        if (existing) {
+          if (!existing.writers.some((w) => w.methodFqn === writer.methodFqn)) {
+            existing.writers.push(writer);
+          }
+        } else {
+          this.fieldTaintInfo.set(key, {
+            typeFqn,
+            fieldName: field.name,
+            fieldType: field.type ?? null,
+            file: filePath,
+            writers: [writer]
+          });
+        }
+      }
+    }
+  }
   isMethodTaintSource(method, sources) {
     const sourceAnnotations = ["RequestParam", "RequestBody", "PathVariable", "QueryParam"];
     for (const param of method.parameters) {
@@ -18493,11 +18630,268 @@ class CrossFileResolver {
               }
             }
           }
+          if (tainted.size > 0) {
+            const sinksInCaller = callerIR.taint.sinks.filter((s) => s.line >= method.start_line && s.line <= method.end_line);
+            for (const sink of sinksInCaller) {
+              const callsAtSink = callerIR.calls.filter((c) => c.location.line === sink.line);
+              for (const sinkCall of callsAtSink) {
+                for (const arg of sinkCall.arguments ?? []) {
+                  const matched = this.matchTaintedArg(arg, tainted);
+                  if (!matched)
+                    continue;
+                  const key = `${matched.origin.file}:${matched.origin.line}→${callerFile}:${sink.line}`;
+                  if (seen.has(key))
+                    continue;
+                  seen.add(key);
+                  const hops = [
+                    ...matched.origin.hopChain,
+                    { file: callerFile, line: sink.line, method: method.name, kind: "sink" }
+                  ];
+                  const decay = Math.max(0.3, Math.pow(0.85, Math.max(hops.length - 1, 0)));
+                  paths.push({
+                    source: {
+                      file: matched.origin.file,
+                      line: matched.origin.line,
+                      type: matched.origin.type
+                    },
+                    sink: {
+                      file: callerFile,
+                      line: sink.line,
+                      type: sink.type,
+                      cwe: sink.cwe
+                    },
+                    hops,
+                    confidence: decay
+                  });
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+    return paths;
+  }
+  findFieldBindingTaintPaths() {
+    const paths = [];
+    const seen = new Set;
+    if (this.fieldTaintInfo.size === 0)
+      return paths;
+    const fieldExprRe = /^(\w+)\.(\w+)$/;
+    const methodIndex = this.buildMethodIndex();
+    for (const [callerFile, callerIR] of this.fileIRs) {
+      for (const type of callerIR.types) {
+        const callerTypeFqn = callerIR.meta.package ? `${callerIR.meta.package}.${type.name}` : type.name;
+        for (const method of type.methods) {
+          const tainted = new Map;
+          for (const src of callerIR.taint.sources) {
+            if (src.type === "interprocedural_param")
+              continue;
+            if (src.line < method.start_line || src.line > method.end_line)
+              continue;
+            if (!src.variable)
+              continue;
+            tainted.set(src.variable, {
+              file: callerFile,
+              line: src.line,
+              type: src.type,
+              hopChain: [{ file: callerFile, line: src.line, method: method.name, kind: "source" }]
+            });
+          }
+          const defsInMethod = callerIR.dfg.defs.filter((d) => d.kind === "local" && d.line >= method.start_line && d.line <= method.end_line && !!d.variable);
+          for (const def of defsInMethod) {
+            const usesAtLine = callerIR.dfg.uses.filter((u) => u.line === def.line);
+            if (usesAtLine.length < 2)
+              continue;
+            let receiver = null;
+            let fieldName = null;
+            if (def.expression) {
+              const exprMatch = fieldExprRe.exec(def.expression.trim());
+              if (exprMatch) {
+                receiver = exprMatch[1];
+                fieldName = exprMatch[2];
+              }
+            }
+            const resolveReceiverType = (rcv) => {
+              const param = method.parameters.find((p) => p.name === rcv);
+              if (param?.type)
+                return param.type;
+              const fieldOnSelf = type.fields?.find((f) => f.name === rcv);
+              if (fieldOnSelf?.type)
+                return fieldOnSelf.type;
+              return null;
+            };
+            let receiverType = null;
+            if (receiver && fieldName) {
+              receiverType = resolveReceiverType(receiver);
+            }
+            if (!receiverType) {
+              for (const rcvUse of usesAtLine) {
+                if (!rcvUse.variable || rcvUse.variable === def.variable)
+                  continue;
+                const rt = resolveReceiverType(rcvUse.variable);
+                if (!rt)
+                  continue;
+                const fieldUse = usesAtLine.find((u) => u !== rcvUse && !!u.variable && u.variable !== def.variable && u.variable !== rcvUse.variable && this.typeHasField(rt, u.variable));
+                if (fieldUse) {
+                  receiver = rcvUse.variable;
+                  fieldName = fieldUse.variable;
+                  receiverType = rt;
+                  break;
+                }
+              }
+            }
+            if (!receiver || !fieldName || !receiverType)
+              continue;
+            const fieldKey = this.resolveFieldTaintKey(receiverType, fieldName, callerIR);
+            if (!fieldKey)
+              continue;
+            const fieldInfo = this.fieldTaintInfo.get(fieldKey);
+            if (!fieldInfo || fieldInfo.writers.length === 0)
+              continue;
+            const writer = fieldInfo.writers.find((w) => w.sourceType === "constructor_field" || w.sourceType === "autowired_field") ?? null;
+            if (!writer)
+              continue;
+            const hopChain = [
+              {
+                file: fieldInfo.file,
+                line: writer.sourceLine,
+                method: writer.methodName,
+                kind: "source"
+              },
+              {
+                file: fieldInfo.file,
+                line: writer.writeLine,
+                method: writer.methodName,
+                kind: "field_write"
+              },
+              {
+                file: callerFile,
+                line: def.line,
+                method: method.name,
+                kind: "field_read"
+              }
+            ];
+            tainted.set(def.variable, {
+              file: fieldInfo.file,
+              line: writer.sourceLine,
+              type: writer.sourceType,
+              hopChain
+            });
+          }
+          if (tainted.size === 0)
+            continue;
+          const sinksInCaller = callerIR.taint.sinks.filter((s) => s.line >= method.start_line && s.line <= method.end_line);
+          for (const sink of sinksInCaller) {
+            const callsAtSink = callerIR.calls.filter((c) => c.location.line === sink.line);
+            for (const sinkCall of callsAtSink) {
+              for (const arg of sinkCall.arguments ?? []) {
+                const matched = this.matchTaintedArg(arg, tainted);
+                if (!matched)
+                  continue;
+                const key = `fb:${matched.origin.file}:${matched.origin.line}→${callerFile}:${sink.line}`;
+                if (seen.has(key))
+                  continue;
+                seen.add(key);
+                const hops = [
+                  ...matched.origin.hopChain,
+                  { file: callerFile, line: sink.line, method: method.name, kind: "sink" }
+                ];
+                const decay = Math.max(0.3, Math.pow(0.85, Math.max(hops.length - 1, 0)));
+                paths.push({
+                  source: {
+                    file: matched.origin.file,
+                    line: matched.origin.line,
+                    type: matched.origin.type
+                  },
+                  sink: {
+                    file: callerFile,
+                    line: sink.line,
+                    type: sink.type,
+                    cwe: sink.cwe
+                  },
+                  hops,
+                  confidence: decay
+                });
+              }
+            }
+          }
+          const callsInMethod = callerIR.calls.filter((c) => c.location.line >= method.start_line && c.location.line <= method.end_line).sort((a, b) => a.location.line - b.location.line);
+          for (const call of callsInMethod) {
+            const resolved = this.resolveCall(call, callerFile);
+            if (!resolved)
+              continue;
+            const callee = this.methodTaintInfo.get(resolved.targetMethod);
+            if (!callee || callee.sanitizes || callee.taintedParams.length === 0)
+              continue;
+            for (let argIdx = 0;argIdx < call.arguments.length; argIdx++) {
+              if (!callee.taintedParams.includes(argIdx))
+                continue;
+              const matched = this.matchTaintedArg(call.arguments[argIdx], tainted);
+              if (!matched)
+                continue;
+              const calleeNode = methodIndex.get(resolved.targetMethod);
+              if (!calleeNode)
+                continue;
+              const sinksInCallee = calleeNode.ir.taint.sinks.filter((s) => s.line >= calleeNode.method.start_line && s.line <= calleeNode.method.end_line);
+              for (const sink of sinksInCallee) {
+                const key = `fb:${matched.origin.file}:${matched.origin.line}→${callee.file}:${sink.line}`;
+                if (seen.has(key))
+                  continue;
+                seen.add(key);
+                const hops = [
+                  ...matched.origin.hopChain,
+                  { file: callerFile, line: call.location.line, method: method.name, kind: "sink_call" },
+                  { file: callee.file, line: sink.line, method: resolved.targetMethod, kind: "sink" }
+                ];
+                const decay = Math.max(0.3, Math.pow(0.85, Math.max(hops.length - 1, 0)));
+                paths.push({
+                  source: {
+                    file: matched.origin.file,
+                    line: matched.origin.line,
+                    type: matched.origin.type
+                  },
+                  sink: {
+                    file: callee.file,
+                    line: sink.line,
+                    type: sink.type,
+                    cwe: sink.cwe
+                  },
+                  hops,
+                  confidence: decay
+                });
+              }
+            }
+          }
         }
       }
     }
     return paths;
   }
+  typeHasField(typeName, fieldName) {
+    for (const [, ir] of this.fileIRs) {
+      for (const t of ir.types) {
+        if (t.name !== typeName)
+          continue;
+        if ((t.fields ?? []).some((f) => f.name === fieldName))
+          return true;
+      }
+    }
+    return false;
+  }
+  resolveFieldTaintKey(receiverType, fieldName, _callerIR) {
+    const direct = `${receiverType}.${fieldName}`;
+    if (this.fieldTaintInfo.has(direct))
+      return direct;
+    const suffix = `.${receiverType}.${fieldName}`;
+    for (const key of this.fieldTaintInfo.keys()) {
+      if (key === direct)
+        return key;
+      if (key.endsWith(suffix))
+        return key;
+    }
+    return;
+  }
   matchTaintedArg(arg, tainted) {
     if (tainted.size === 0)
       return null;
@@ -18582,8 +18976,12 @@ class CrossFileResolver {
   clear() {
     this.fileIRs.clear();
     this.methodTaintInfo.clear();
+    this.fieldTaintInfo.clear();
     this.resolvedCalls.clear();
   }
+  getFieldTaintInfo(typeFqn, fieldName) {
+    return this.fieldTaintInfo.get(`${typeFqn}.${fieldName}`);
+  }
 }
 // ../circle-ir/dist/graph/project-graph.js
 class ProjectGraph {
@@ -18725,7 +19123,10 @@ class CrossFilePass {
         confidence: 0.7
       }];
     });
-    const ipPaths = resolver.findInterproceduralTaintPaths();
+    const ipPaths = [
+      ...resolver.findInterproceduralTaintPaths(),
+      ...resolver.findFieldBindingTaintPaths()
+    ];
     for (let i2 = 0;i2 < ipPaths.length; i2++) {
       const p = ipPaths[i2];
       const sinkIR = projectGraph.getIR(p.sink.file);
@@ -19321,7 +19722,7 @@ class TaintMatcherPass {
   name = "taint-matcher";
   category = "security";
   run(ctx) {
-    const { graph, language, config } = ctx;
+    const { graph, language, config, code } = ctx;
     const { calls, types } = graph.ir;
     let mergedConfig = config;
     const plugin = getLanguagePlugin(language);
@@ -19358,7 +19759,7 @@ class TaintMatcherPass {
     }
     const hierarchy = createWithJdkTypes();
     hierarchy.addFromIR(graph.ir, graph.ir.meta.file);
-    const taint = analyzeTaint(calls, types, mergedConfig, hierarchy, language);
+    const taint = analyzeTaint(calls, types, mergedConfig, hierarchy, language, code);
     const sanitizerMethods = [];
     for (const type of types) {
       for (const method of type.methods) {
@@ -19540,6 +19941,7 @@ class LanguageSourcesPass {
         ctx.addFinding(finding);
       }
     }
+    attachSourceLineCode(additionalSources, additionalSinks, code);
     return { additionalSources, additionalSinks, pyTaintedVars, pySanitizedVars, jsTaintedVars };
   }
 }
@@ -27217,7 +27619,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.38.0";
+var version = "3.40.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.38.0",
+  "version": "3.40.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.38.0"
+    "circle-ir": "^3.40.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",