cognium-dev 3.73.0 → 3.74.0

package/dist/cli.js

@@ -11437,11 +11437,17 @@ var DEFAULT_SANITIZERS = [
   { method: "toRealPath", class: "Path", removes: ["path_traversal"] },
   { method: "file_name", removes: ["path_traversal"] },
   { method: "canonicalize", removes: ["path_traversal"] },
-  { method: "Base", class: "filepath", removes: ["path_traversal"] },
-  { method: "Base", class: "path", removes: ["path_traversal"] },
-  { method: "Clean", class: "filepath", removes: ["path_traversal"] },
-  { method: "Clean", class: "path", removes: ["path_traversal"] },
-  { method: "EvalSymlinks", class: "filepath", removes: ["path_traversal"] },
+  { method: "Base", class: "filepath", removes: ["path_traversal", "external_taint_escape"] },
+  { method: "Base", class: "path", removes: ["path_traversal", "external_taint_escape"] },
+  { method: "Clean", class: "filepath", removes: ["path_traversal", "external_taint_escape"] },
+  { method: "Clean", class: "path", removes: ["path_traversal", "external_taint_escape"] },
+  { method: "EvalSymlinks", class: "filepath", removes: ["path_traversal", "external_taint_escape"] },
+  { method: "EscapeString", class: "html", removes: ["xss", "external_taint_escape", "log_injection", "open_redirect"] },
+  { method: "HTMLEscapeString", class: "template", removes: ["xss", "external_taint_escape", "log_injection", "open_redirect"] },
+  { method: "JSEscapeString", class: "template", removes: ["xss", "external_taint_escape", "log_injection"] },
+  { method: "URLQueryEscaper", class: "template", removes: ["xss", "external_taint_escape", "open_redirect"] },
+  { method: "QueryEscape", class: "url", removes: ["xss", "external_taint_escape", "open_redirect"] },
+  { method: "PathEscape", class: "url", removes: ["xss", "external_taint_escape", "open_redirect"] },
   { method: "replace", removes: ["log_injection"] },
   { method: "encodeForLDAP", removes: ["ldap_injection"] },
   { method: "encodeForDN", removes: ["ldap_injection"] },
@@ -11992,6 +11998,48 @@ function isSafePythonSubprocessCall(call, pattern, language) {
   }
   return true;
 }
+function isSafeGoExecCommandCall(call, pattern, language) {
+  if (language !== "go")
+    return false;
+  if (pattern.type !== "command_injection")
+    return false;
+  if (pattern.class !== "exec")
+    return false;
+  if (pattern.method !== "Command" && pattern.method !== "CommandContext")
+    return false;
+  const programArgPos = pattern.method === "CommandContext" ? 1 : 0;
+  const programArg = call.arguments.find((a) => a.position === programArgPos);
+  if (!programArg)
+    return false;
+  let program;
+  if (programArg.literal !== null && programArg.literal !== undefined) {
+    program = String(programArg.literal).split("/").pop() ?? String(programArg.literal);
+  } else {
+    const expr = (programArg.expression ?? "").trim();
+    if (!(expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'"))) {
+      return false;
+    }
+    const stripped = expr.slice(1, -1);
+    program = stripped.split("/").pop() ?? stripped;
+  }
+  const SHELL_PROGRAMS = new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ash",
+    "ksh",
+    "cmd",
+    "cmd.exe",
+    "powershell",
+    "pwsh",
+    "powershell.exe",
+    "pwsh.exe"
+  ]);
+  if (SHELL_PROGRAMS.has(program))
+    return false;
+  return true;
+}
 var CLASS_LITERAL_RE = /^(?:[A-Za-z_][\w]*\.)*[A-Z][\w]*(?:\[\])*\.class$/;
 function argIsClassLiteral(call, position) {
   const arg = call.arguments.find((a) => a.position === position);
@@ -12013,6 +12061,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafePythonSubprocessCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeGoExecCommandCall(call, pattern, language)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== undefined && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }
@@ -21241,6 +21292,10 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findBashRegexAllowlistSanitizers(code));
       additionalSanitizers.push(...findBashRealpathPrefixGuardSanitizers(code));
     }
+    if (language === "go") {
+      additionalSanitizers.push(...findGoMapAllowlistGuardSanitizers(code));
+      additionalSanitizers.push(...findGoHtmlTemplateImportSanitizers(code));
+    }
     attachSourceLineCode(additionalSources, additionalSinks, code);
     return { additionalSources, additionalSinks, additionalSanitizers, pyTaintedVars, pySanitizedVars, jsTaintedVars };
   }
@@ -22279,6 +22334,82 @@ function findBashRealpathPrefixGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findGoMapAllowlistGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const guardOpen = /^\s*if\s+!\s*([A-Za-z_][A-Za-z0-9_]*)\s*\[\s*[A-Za-z_][A-Za-z0-9_]*\s*\]\s*\{/;
+  const allowlistName = /^(?:[A-Z][A-Z0-9_]+|.*?(allowed|accepted|whitelist|permitted|valid|approved).*)$/i;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = guardOpen.exec(lines[i2]);
+    if (!m)
+      continue;
+    const mapName = m[1];
+    if (!allowlistName.test(mapName))
+      continue;
+    let depth = 1;
+    let closeLine = -1;
+    let bodyHasTerminator = false;
+    const maxScan = Math.min(lines.length, i2 + 26);
+    for (let j = i2 + 1;j < maxScan; j++) {
+      const line = lines[j];
+      if (/\b(return|panic\s*\(|os\.Exit\s*\()/.test(line)) {
+        bodyHasTerminator = true;
+      }
+      for (const ch of line) {
+        if (ch === "{")
+          depth++;
+        else if (ch === "}")
+          depth--;
+      }
+      if (depth === 0) {
+        closeLine = j;
+        break;
+      }
+    }
+    if (closeLine === -1 || !bodyHasTerminator)
+      continue;
+    for (let l = closeLine + 2;l <= lines.length; l++) {
+      sanitizers.push({
+        type: "go_map_allowlist_guard",
+        method: "if",
+        line: l,
+        sanitizes: [
+          "ssrf",
+          "open_redirect",
+          "path_traversal",
+          "sql_injection",
+          "command_injection",
+          "external_taint_escape"
+        ]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findGoHtmlTemplateImportSanitizers(code) {
+  const sanitizers = [];
+  const hasHtmlTemplate = /["\s]html\/template["\s]/.test(code);
+  const hasTextTemplate = /["\s]text\/template["\s]/.test(code);
+  if (!hasHtmlTemplate)
+    return sanitizers;
+  if (hasTextTemplate)
+    return sanitizers;
+  const lines = code.split(`
+`);
+  const execCall = /\.(Execute|ExecuteTemplate)\s*\(/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    if (!execCall.test(lines[i2]))
+      continue;
+    sanitizers.push({
+      type: "html_template_auto_escape",
+      method: "Execute",
+      line: i2 + 1,
+      sanitizes: ["xss", "external_taint_escape", "open_redirect"]
+    });
+  }
+  return sanitizers;
+}
 
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
@@ -23103,6 +23234,40 @@ class TaintPropagationPass {
       }
       return true;
     });
+    if (sanitizers && sanitizers.length > 0) {
+      const sanitizersByLine = new Map;
+      for (const san of sanitizers) {
+        const arr = sanitizersByLine.get(san.line) ?? [];
+        arr.push(san);
+        sanitizersByLine.set(san.line, arr);
+      }
+      finalFlows = finalFlows.filter((f) => {
+        if (f.sink_type === "external_taint_escape") {
+          const lo = Math.min(f.source_line, f.sink_line);
+          const hi = Math.max(f.source_line, f.sink_line);
+          for (let line = lo;line <= hi; line++) {
+            const sansAtLine = sanitizersByLine.get(line);
+            if (!sansAtLine)
+              continue;
+            for (const san of sansAtLine) {
+              if (san.sanitizes.includes(f.sink_type)) {
+                return false;
+              }
+            }
+          }
+          return true;
+        }
+        const sansAtSink = sanitizersByLine.get(f.sink_line);
+        if (!sansAtSink || sansAtSink.length === 0)
+          return true;
+        for (const san of sansAtSink) {
+          if (san.sanitizes.includes(f.sink_type)) {
+            return false;
+          }
+        }
+        return true;
+      });
+    }
     if (ctx.language === "java" && typeof ctx.code === "string") {
       finalFlows = finalFlows.filter((f) => {
         if (f.sink_type !== "path_traversal" && f.sink_type !== "xxe")
@@ -23896,7 +24061,19 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     "BufferedWriter",
     "PrintStream",
     "PrintWriter",
-    "ObjectOutputStream"
+    "ObjectOutputStream",
+    "Query",
+    "QueryRow",
+    "QueryContext",
+    "QueryRowContext",
+    "Exec",
+    "ExecContext",
+    "EscapeString",
+    "HTMLEscapeString",
+    "JSEscapeString",
+    "URLQueryEscaper",
+    "Command",
+    "CommandContext"
   ]);
   const sanitizerMethods = new Set;
   for (const san of sanitizers) {
@@ -24314,7 +24491,50 @@ class InterproceduralPass {
     if (additionalSinks.length > 0) {
       attachSourceLineCode([], additionalSinks, ctx.code);
     }
-    return { additionalSinks, additionalFlows, interprocedural };
+    let filteredAdditionalFlows = additionalFlows;
+    let filteredAdditionalSinks = additionalSinks;
+    if (sanitizers && sanitizers.length > 0) {
+      const sanitizersByLine = new Map;
+      for (const san of sanitizers) {
+        const arr = sanitizersByLine.get(san.line) ?? [];
+        arr.push(san);
+        sanitizersByLine.set(san.line, arr);
+      }
+      const sanitizedSinkKeys = new Set;
+      filteredAdditionalFlows = additionalFlows.filter((f) => {
+        if (f.sink_type === "external_taint_escape") {
+          const lo = Math.min(f.source_line, f.sink_line);
+          const hi = Math.max(f.source_line, f.sink_line);
+          for (let line = lo;line <= hi; line++) {
+            const sansAtLine = sanitizersByLine.get(line);
+            if (!sansAtLine)
+              continue;
+            for (const san of sansAtLine) {
+              if (san.sanitizes.includes(f.sink_type)) {
+                sanitizedSinkKeys.add(`${f.sink_line}:${f.sink_type}`);
+                return false;
+              }
+            }
+          }
+          return true;
+        }
+        const sansAtSink = sanitizersByLine.get(f.sink_line);
+        if (!sansAtSink || sansAtSink.length === 0)
+          return true;
+        for (const san of sansAtSink) {
+          if (san.sanitizes.includes(f.sink_type)) {
+            return false;
+          }
+        }
+        return true;
+      });
+      filteredAdditionalSinks = additionalSinks.filter((s) => {
+        if (s.type !== "external_taint_escape")
+          return true;
+        return !sanitizedSinkKeys.has(`${s.line}:${s.type}`);
+      });
+    }
+    return { additionalSinks: filteredAdditionalSinks, additionalFlows: filteredAdditionalFlows, interprocedural };
   }
 }
 
@@ -32262,7 +32482,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.73.0";
+var version = "3.74.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.73.0",
+  "version": "3.74.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.73.0"
+    "circle-ir": "^3.74.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",