cognium-dev 3.74.0 → 3.77.0

package/dist/cli.js

@@ -11388,6 +11388,12 @@ var DEFAULT_SINKS = [
   { method: "redirect", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "Set", class: "Header", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["go"] },
   { method: "Add", class: "Header", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["go"] },
+  { method: "set", class: "headers", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["python"] },
+  { method: "add", class: "headers", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["python"] },
+  { method: "setdefault", class: "headers", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["python"] },
+  { method: "extend", class: "headers", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0], languages: ["python"] },
+  { method: "__setitem__", class: "headers", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["python"] },
+  { method: "set_cookie", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["python"] },
   { method: "assign", class: "Object", type: "mass_assignment", cwe: "CWE-1321", severity: "high", arg_positions: [1, 2, 3], languages: ["javascript", "typescript"] },
   { method: "defineProperty", class: "Object", type: "mass_assignment", cwe: "CWE-1321", severity: "high", arg_positions: [1, 2], languages: ["javascript", "typescript"] },
   { method: "defineProperties", class: "Object", type: "mass_assignment", cwe: "CWE-1321", severity: "high", arg_positions: [1], languages: ["javascript", "typescript"] },
@@ -12408,6 +12414,10 @@ function receiverMightBeClass(receiver, className) {
       }
     }
   }
+  const chainedCallSuffix = `.${className}()`;
+  if (receiver.endsWith(chainedCallSuffix) || receiver.toLowerCase().endsWith(chainedCallSuffix.toLowerCase())) {
+    return true;
+  }
   if (receiver.includes("::")) {
     const scopePrefix = receiver.match(/^(\w+)::/);
     if (scopePrefix) {
@@ -23723,6 +23733,48 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
           }
         }
       }
+      const aliasChains = [];
+      {
+        const codeLines2 = code.split(`
+`);
+        for (let i2 = 0;i2 < codeLines2.length; i2++) {
+          const ln = codeLines2[i2];
+          if (ln.trimStart().startsWith("#"))
+            continue;
+          const m = ln.match(/^\s*([\p{L}\p{N}_]+)\s*=\s*([\p{L}\p{N}_]+)\s*$/u);
+          if (!m)
+            continue;
+          const lineNum = i2 + 1;
+          const lhs = m[1];
+          if (derived.get(lhs) !== lineNum)
+            continue;
+          aliasChains.push({ lhs, upstream: m[2], line: lineNum });
+        }
+      }
+      if (aliasChains.length > 0) {
+        let changed = true;
+        let guard = 0;
+        while (changed && guard < aliasChains.length + 2) {
+          changed = false;
+          guard++;
+          for (const { lhs, upstream } of aliasChains) {
+            const upCov = aliasSanitizedFor.get(upstream);
+            if (!upCov || upCov.size === 0)
+              continue;
+            let downCov = aliasSanitizedFor.get(lhs);
+            if (!downCov) {
+              downCov = new Set;
+              aliasSanitizedFor.set(lhs, downCov);
+            }
+            for (const t of upCov) {
+              if (!downCov.has(t)) {
+                downCov.add(t);
+                changed = true;
+              }
+            }
+          }
+        }
+      }
     }
   }
   if (language === "rust" && typeof code === "string" && sourcesWithVar.length > 0) {
@@ -29929,6 +29981,12 @@ class WeakRandomPass {
           return `${rt}.${method}`;
         }
       }
+      if (JAVA_RANDOM_METHODS.has(method)) {
+        if (/^new\s+Random\s*\(/.test(receiver))
+          return `new Random.${method}`;
+        if (/^new\s+SplittableRandom\s*\(/.test(receiver))
+          return `new SplittableRandom.${method}`;
+      }
       if (JAVA_RANDOM_METHODS.has(method) && /ThreadLocalRandom\.current\(\)/.test(receiver)) {
         return `ThreadLocalRandom.current.${method}`;
       }
@@ -30773,7 +30831,7 @@ class JwtVerifyDisabledPass {
           out2.push({ pattern: "Algorithm.none()", api: "JWT.require" });
         }
       }
-      if (method === "parse" && receiver.includes("parser")) {
+      if (method === "parse" && /\bJwts\s*\.\s*parser\s*\(/.test(receiver)) {
         out2.push({ pattern: "parse() instead of parseClaimsJws()", api: "Jwts.parser().parse" });
       }
       return out2;
@@ -32482,7 +32540,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.74.0";
+var version = "3.77.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.74.0",
+  "version": "3.77.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.74.0"
+    "circle-ir": "^3.77.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",