cognium-dev 3.49.0 → 3.50.0

package/dist/cli.js

@@ -21511,6 +21511,28 @@ function buildTaintFlow(source, sink, taintInfo) {
   };
 }
 
+// ../circle-ir/dist/analysis/findings.js
+function canSourceReachSink(sourceType, sinkType) {
+  const sourceToSinkMapping = {
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection"],
+    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call"],
+    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection"],
+    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection"],
+    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection"],
+    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss"],
+    env_input: ["command_injection", "path_traversal"],
+    db_input: ["xss", "sql_injection"],
+    file_input: ["deserialization", "xxe", "path_traversal", "command_injection", "code_injection"],
+    network_input: ["sql_injection", "command_injection", "xss", "ssrf"],
+    config_param: ["sql_injection", "command_injection", "path_traversal", "xss", "ssrf"],
+    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call"],
+    plugin_param: ["sql_injection", "command_injection", "path_traversal", "xss", "code_injection"]
+  };
+  const validSinks = sourceToSinkMapping[sourceType];
+  return validSinks ? validSinks.includes(sinkType) : false;
+}
+
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
@@ -21521,7 +21543,11 @@ class TaintPropagationPass {
     const constProp = ctx.getResult("constant-propagation");
     const sinkFilter = ctx.getResult("sink-filter");
     const { sources, sinks, sanitizers } = sinkFilter;
-    if (sources.length === 0 || sinks.length === 0) {
+    if (sinks.length === 0) {
+      return { flows: [] };
+    }
+    const canSynthesize = ctx.language === "python" && typeof ctx.code === "string";
+    if (sources.length === 0 && !canSynthesize) {
       return { flows: [] };
     }
     const propagationResult = propagateTaint2(graph, sources, sinks, sanitizers);
@@ -21805,25 +21831,37 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
 function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, code, language) {
   const flows = [];
   const sourcesWithVar = sources.filter((s) => typeof s.variable === "string" && s.variable.length > 0);
-  if (sourcesWithVar.length === 0)
-    return flows;
   const aliasSanitizedFor = new Map;
   if (language === "python" && typeof code === "string") {
     const derived = buildPythonTaintedVars(code);
     if (derived.size > 0) {
+      const existingVars = new Set(sourcesWithVar.map((s) => s.variable));
+      const hasRealSource = sourcesWithVar.length > 0;
       let anchor = sourcesWithVar[0];
-      for (const s of sourcesWithVar) {
-        if (s.line < anchor.line)
-          anchor = s;
+      if (anchor) {
+        for (const s of sourcesWithVar) {
+          if (s.line < anchor.line)
+            anchor = s;
+        }
       }
-      const existingVars = new Set(sourcesWithVar.map((s) => s.variable));
-      for (const [varName] of derived) {
+      for (const [varName, originLine] of derived) {
         if (!varName || existingVars.has(varName))
           continue;
-        sourcesWithVar.push({
-          ...anchor,
-          variable: varName
-        });
+        if (hasRealSource && anchor) {
+          sourcesWithVar.push({
+            ...anchor,
+            variable: varName
+          });
+        } else {
+          sourcesWithVar.push({
+            type: "http_param",
+            location: `<derived> ${varName}`,
+            severity: "high",
+            line: originLine,
+            confidence: 0.9,
+            variable: varName
+          });
+        }
         existingVars.add(varName);
       }
       if (sanitizers && sanitizers.length > 0) {
@@ -21863,7 +21901,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
-  if (language === "rust" && typeof code === "string") {
+  if (language === "rust" && typeof code === "string" && sourcesWithVar.length > 0) {
     const seedVars = new Set(sourcesWithVar.map((s) => s.variable));
     const derived = buildRustTaintedVars(code, seedVars);
     if (derived.size > 0) {
@@ -21937,6 +21975,39 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  const sourcesByLine = new Map;
+  for (const s of sources) {
+    if (s.variable && s.variable.length > 0)
+      continue;
+    const arr = sourcesByLine.get(s.line) ?? [];
+    arr.push(s);
+    sourcesByLine.set(s.line, arr);
+  }
+  for (const sink of sinks) {
+    if (unreachableLines.has(sink.line))
+      continue;
+    const colocSources = sourcesByLine.get(sink.line);
+    if (!colocSources || colocSources.length === 0)
+      continue;
+    for (const source of colocSources) {
+      if (!canSourceReachSink(source.type, sink.type))
+        continue;
+      if (flows.some((f) => f.source_line === source.line && f.sink_line === sink.line && f.sink_type === sink.type))
+        continue;
+      flows.push({
+        source_line: source.line,
+        sink_line: sink.line,
+        source_type: source.type,
+        sink_type: sink.type,
+        path: [
+          { variable: "<inline>", line: source.line, type: "source" },
+          { variable: "<inline>", line: sink.line, type: "sink" }
+        ],
+        confidence: source.confidence * sink.confidence * 0.85,
+        sanitized: false
+      });
+    }
+  }
   return flows;
 }
 
@@ -22373,7 +22444,7 @@ class InterproceduralPass {
     const taintProp = ctx.getResult("taint-propagation");
     const { sources, sinks, sanitizers } = sinkFilter;
     if (sources.length === 0) {
-      return { additionalSinks: [], additionalFlows: [] };
+      return { additionalSinks: [], additionalFlows: [...taintProp.flows] };
     }
     const additionalSinks = [];
     const additionalFlows = [...taintProp.flows];
@@ -28411,7 +28482,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.49.0";
+var version = "3.50.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.49.0",
+  "version": "3.50.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.49.0"
+    "circle-ir": "^3.50.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",