cognium-dev 3.72.0 → 3.73.0

package/dist/cli.js

@@ -11865,6 +11865,17 @@ function findSources(calls, types, patterns, sourceLines, language) {
       s.variable = m[1];
     }
   }
+  if (language === "go" && sourceLines) {
+    const GO_ASSIGN_LHS = /^\s*(?:var\s+)?([A-Za-z_]\w*)(?:\s*,\s*[A-Za-z_]\w*)*\s*(?::\s*[A-Za-z_][\w.]*\s*)?(?::?=)(?!=)/;
+    for (const s of result) {
+      if (s.variable && s.variable.length > 0)
+        continue;
+      const lineText = sourceLines[s.line - 1] ?? "";
+      const m = GO_ASSIGN_LHS.exec(lineText);
+      if (m)
+        s.variable = m[1];
+    }
+  }
   return result;
 }
 function isInterproceduralTaintableType(typeName) {
@@ -17863,7 +17874,7 @@ class GoPlugin extends BaseLanguagePlugin {
         type: "command_injection",
         cwe: "CWE-78",
         severity: "critical",
-        argPositions: [0]
+        argPositions: []
       },
       {
         method: "CommandContext",
@@ -17871,7 +17882,7 @@ class GoPlugin extends BaseLanguagePlugin {
         type: "command_injection",
         cwe: "CWE-78",
         severity: "critical",
-        argPositions: [1]
+        argPositions: []
       },
       {
         method: "Open",
@@ -17960,6 +17971,110 @@ class GoPlugin extends BaseLanguagePlugin {
         cwe: "CWE-502",
         severity: "medium",
         argPositions: [0]
+      },
+      {
+        method: "Print",
+        class: "log",
+        type: "log_injection",
+        cwe: "CWE-117",
+        severity: "medium",
+        argPositions: []
+      },
+      {
+        method: "Println",
+        class: "log",
+        type: "log_injection",
+        cwe: "CWE-117",
+        severity: "medium",
+        argPositions: []
+      },
+      {
+        method: "Printf",
+        class: "log",
+        type: "log_injection",
+        cwe: "CWE-117",
+        severity: "medium",
+        argPositions: []
+      },
+      {
+        method: "Fatal",
+        class: "log",
+        type: "log_injection",
+        cwe: "CWE-117",
+        severity: "medium",
+        argPositions: []
+      },
+      {
+        method: "Fatalln",
+        class: "log",
+        type: "log_injection",
+        cwe: "CWE-117",
+        severity: "medium",
+        argPositions: []
+      },
+      {
+        method: "Fatalf",
+        class: "log",
+        type: "log_injection",
+        cwe: "CWE-117",
+        severity: "medium",
+        argPositions: []
+      },
+      {
+        method: "Panic",
+        class: "log",
+        type: "log_injection",
+        cwe: "CWE-117",
+        severity: "medium",
+        argPositions: []
+      },
+      {
+        method: "Panicln",
+        class: "log",
+        type: "log_injection",
+        cwe: "CWE-117",
+        severity: "medium",
+        argPositions: []
+      },
+      {
+        method: "Panicf",
+        class: "log",
+        type: "log_injection",
+        cwe: "CWE-117",
+        severity: "medium",
+        argPositions: []
+      },
+      {
+        method: "Parse",
+        class: "Template",
+        type: "code_injection",
+        cwe: "CWE-94",
+        severity: "high",
+        argPositions: [0]
+      },
+      {
+        method: "ParseFiles",
+        class: "template",
+        type: "code_injection",
+        cwe: "CWE-94",
+        severity: "high",
+        argPositions: []
+      },
+      {
+        method: "ParseGlob",
+        class: "template",
+        type: "code_injection",
+        cwe: "CWE-94",
+        severity: "high",
+        argPositions: [0]
+      },
+      {
+        method: "ParseFS",
+        class: "template",
+        type: "code_injection",
+        cwe: "CWE-94",
+        severity: "high",
+        argPositions: []
       }
     ];
   }
@@ -21124,6 +21239,7 @@ class LanguageSourcesPass {
         ctx.addFinding(finding);
       }
       additionalSanitizers.push(...findBashRegexAllowlistSanitizers(code));
+      additionalSanitizers.push(...findBashRealpathPrefixGuardSanitizers(code));
     }
     attachSourceLineCode(additionalSources, additionalSinks, code);
     return { additionalSources, additionalSinks, additionalSanitizers, pyTaintedVars, pySanitizedVars, jsTaintedVars };
@@ -22093,6 +22209,76 @@ function isSafeBashAllowlistRegex(literal) {
   }
   return consumed === body2.length;
 }
+function findBashRealpathPrefixGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const caseOpen = /^\s*case\s+"?\$\{?\w+\}?"?\s+in\b/;
+  const esacClose = /^\s*esac\b/;
+  const armOpener = /^\s*([^)\s][^)]*?)\)/;
+  const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|[\w\-./]+)(?:\/|\*)/;
+  const catchAllArm = /^(?:\*|\\\*)$/;
+  let i2 = 0;
+  while (i2 < lines.length) {
+    if (!caseOpen.test(lines[i2])) {
+      i2++;
+      continue;
+    }
+    let caseEnd = -1;
+    for (let j = i2 + 1;j < lines.length; j++) {
+      if (esacClose.test(lines[j])) {
+        caseEnd = j;
+        break;
+      }
+    }
+    if (caseEnd === -1) {
+      i2++;
+      continue;
+    }
+    let hasPrefixArm = false;
+    let hasTerminalCatchAll = false;
+    for (let j = i2 + 1;j < caseEnd; j++) {
+      const armMatch = armOpener.exec(lines[j]);
+      if (!armMatch)
+        continue;
+      const pattern = armMatch[1].trim();
+      if (catchAllArm.test(pattern)) {
+        let bodyEnd = caseEnd;
+        for (let k = j + 1;k < caseEnd; k++) {
+          if (armOpener.test(lines[k])) {
+            bodyEnd = k;
+            break;
+          }
+        }
+        const armBody = lines.slice(j, bodyEnd).join(" ");
+        if (/\b(exit|return|die)\b/.test(armBody)) {
+          hasTerminalCatchAll = true;
+        }
+      } else if (prefixArm.test(pattern)) {
+        hasPrefixArm = true;
+      }
+    }
+    if (hasPrefixArm && hasTerminalCatchAll) {
+      for (let l = i2 + 1;l <= caseEnd + 1; l++) {
+        sanitizers.push({
+          type: "realpath_prefix_guard",
+          method: "case",
+          line: l,
+          sanitizes: [
+            "path_traversal",
+            "command_injection",
+            "code_injection",
+            "ssrf",
+            "open_redirect",
+            "log_injection"
+          ]
+        });
+      }
+    }
+    i2 = caseEnd + 1;
+  }
+  return sanitizers;
+}
 
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
@@ -32076,7 +32262,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.72.0";
+var version = "3.73.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.72.0",
+  "version": "3.73.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.72.0"
+    "circle-ir": "^3.73.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",