cognium-dev 3.66.0 → 3.68.0

package/dist/cli.js

@@ -6279,6 +6279,12 @@ function extractPythonLiteral(node) {
   if (literalTypes.includes(node.type)) {
     const text = getNodeText(node);
     if (node.type === "string") {
+      for (let i2 = 0;i2 < node.childCount; i2++) {
+        const child = node.child(i2);
+        if (child && child.type === "interpolation") {
+          return null;
+        }
+      }
       return text.replace(/^['"]|['"]$/g, "").replace(/^f['"]|['"]$/g, "");
     }
     return text;
@@ -11038,9 +11044,11 @@ var DEFAULT_SINKS = [
   { method: "rmdir", class: "fs", type: "path_traversal", cwe: "CWE-22", severity: "critical", arg_positions: [0] },
   { method: "createReadStream", class: "fs", type: "path_traversal", cwe: "CWE-22", severity: "critical", arg_positions: [0] },
   { method: "createWriteStream", class: "fs", type: "path_traversal", cwe: "CWE-22", severity: "critical", arg_positions: [0] },
-  { method: "query", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
-  { method: "query", class: "Pool", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
-  { method: "query", class: "Client", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "query", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "query", class: "Pool", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "query", class: "Client", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "execute", class: "Pool", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   { method: "send", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -11053,6 +11061,9 @@ var DEFAULT_SINKS = [
   { method: "runInContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInNewContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInThisContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
+  { method: "parse", class: "protobuf", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parse", class: "protobufjs", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "parse", class: "Root", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "find", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0] },
   { method: "findOne", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0] },
   { method: "updateOne", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0] },
@@ -12249,6 +12260,9 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
+      if (pattern.allow_unresolved_receiver && !call.receiver_type && !call.receiver_type_fqn && call.receiver.includes(".")) {
+        return true;
+      }
       return false;
     } else if (!call.receiver && !call.receiver_type) {
       const target = call.resolution?.target;
@@ -15265,6 +15279,9 @@ class DefaultLanguageRegistry {
     if (language === "tsx") {
       return this.plugins.get("javascript");
     }
+    if (language === "typescript") {
+      return this.plugins.get("javascript");
+    }
     return this.plugins.get(language);
   }
   getForFile(filePath) {
@@ -16853,6 +16870,22 @@ class PythonPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
+      {
+        method: "urlretrieve",
+        class: "urllib.request",
+        type: "ssrf",
+        cwe: "CWE-918",
+        severity: "high",
+        argPositions: [0]
+      },
+      {
+        method: "urlretrieve",
+        class: "urllib.request",
+        type: "path_traversal",
+        cwe: "CWE-22",
+        severity: "high",
+        argPositions: [1]
+      },
       {
         method: "loads",
         class: "pickle",
@@ -22122,6 +22155,32 @@ class SinkFilterPass {
         return true;
       });
     }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split(`
+`);
+      const guardPatterns = /\b(?:includes|startsWith|endsWith|indexOf|test|match)\s*\(/;
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "open_redirect" && sink.type !== "crlf") {
+          return true;
+        }
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const startLine = Math.max(0, sink.line - 7);
+        for (let i2 = startLine;i2 < sink.line - 1; i2++) {
+          const line = sourceLines[i2] ?? "";
+          if (/\bif\s*\(/.test(line) && guardPatterns.test(line)) {
+            return false;
+          }
+        }
+        if (/\bencodeURIComponent\s*\(|\bencodeURI\s*\(/.test(sinkLineText)) {
+          return false;
+        }
+        const setHeaderMatch = sinkLineText.match(/setHeader\s*\(\s*[^,]+,\s*(['"`])([^'"`]*)\1\s*\)/);
+        if (setHeaderMatch) {
+          return false;
+        }
+        return true;
+      });
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 }
@@ -31317,7 +31376,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.66.0";
+var version = "3.68.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.66.0",
+  "version": "3.68.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.66.0"
+    "circle-ir": "^3.68.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",