cognium-dev 3.39.0 → 3.40.0

package/dist/cli.js

@@ -11092,13 +11092,29 @@ var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.query_params\b/, sourceType: "http_param" },
   { pattern: /\brequest\.path_params\b/, sourceType: "http_param" }
 ];
-function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language) {
-  const sources = findSources(calls, types, config.sources);
-  const sinks = findSinks(calls, config.sinks, typeHierarchy, language);
+function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
+  const sourceLines = code !== undefined ? code.split(`
+`) : undefined;
+  const sources = findSources(calls, types, config.sources, sourceLines);
+  const sinks = findSinks(calls, config.sinks, typeHierarchy, language, sourceLines);
   const sanitizers = findSanitizers(calls, types, config.sanitizers);
   return { sources, sinks, sanitizers };
 }
-function findSources(calls, types, patterns) {
+function attachSourceLineCode(sources, sinks, code) {
+  const lines = code.split(`
+`);
+  for (const s of sources) {
+    if (s.code === undefined) {
+      s.code = lines[s.line - 1]?.trim();
+    }
+  }
+  for (const s of sinks) {
+    if (s.code === undefined) {
+      s.code = lines[s.line - 1]?.trim();
+    }
+  }
+}
+function findSources(calls, types, patterns, sourceLines) {
   const sources = [];
   for (const call of calls) {
     for (const pattern of patterns) {
@@ -11245,7 +11261,13 @@ function findSources(calls, types, patterns) {
       sourceMap.set(key, source);
     }
   }
-  return Array.from(sourceMap.values());
+  const result = Array.from(sourceMap.values());
+  if (sourceLines) {
+    for (const s of result) {
+      s.code = sourceLines[s.line - 1]?.trim();
+    }
+  }
+  return result;
 }
 function isInterproceduralTaintableType(typeName) {
   const baseType = typeName.split("<")[0].trim();
@@ -11341,7 +11363,7 @@ function isParameterizedQueryCall(call, pattern) {
   }
   return false;
 }
-function findSinks(calls, patterns, typeHierarchy, language) {
+function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
   const sinkMap = new Map;
   for (const call of calls) {
     for (const pattern of patterns) {
@@ -11367,7 +11389,13 @@ function findSinks(calls, patterns, typeHierarchy, language) {
       }
     }
   }
-  return Array.from(sinkMap.values());
+  const result = Array.from(sinkMap.values());
+  if (sourceLines) {
+    for (const s of result) {
+      s.code = sourceLines[s.line - 1]?.trim();
+    }
+  }
+  return result;
 }
 function matchesSourcePattern(call, pattern) {
   if (pattern.method) {
@@ -19694,7 +19722,7 @@ class TaintMatcherPass {
   name = "taint-matcher";
   category = "security";
   run(ctx) {
-    const { graph, language, config } = ctx;
+    const { graph, language, config, code } = ctx;
     const { calls, types } = graph.ir;
     let mergedConfig = config;
     const plugin = getLanguagePlugin(language);
@@ -19731,7 +19759,7 @@ class TaintMatcherPass {
     }
     const hierarchy = createWithJdkTypes();
     hierarchy.addFromIR(graph.ir, graph.ir.meta.file);
-    const taint = analyzeTaint(calls, types, mergedConfig, hierarchy, language);
+    const taint = analyzeTaint(calls, types, mergedConfig, hierarchy, language, code);
     const sanitizerMethods = [];
     for (const type of types) {
       for (const method of type.methods) {
@@ -19913,6 +19941,7 @@ class LanguageSourcesPass {
         ctx.addFinding(finding);
       }
     }
+    attachSourceLineCode(additionalSources, additionalSinks, code);
     return { additionalSources, additionalSinks, pyTaintedVars, pySanitizedVars, jsTaintedVars };
   }
 }
@@ -27590,7 +27619,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.39.0";
+var version = "3.40.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.39.0",
+  "version": "3.40.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.39.0"
+    "circle-ir": "^3.40.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",