cognium-dev 3.75.0 → 3.78.0

package/dist/cli.js

@@ -23733,6 +23733,48 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
           }
         }
       }
+      const aliasChains = [];
+      {
+        const codeLines2 = code.split(`
+`);
+        for (let i2 = 0;i2 < codeLines2.length; i2++) {
+          const ln = codeLines2[i2];
+          if (ln.trimStart().startsWith("#"))
+            continue;
+          const m = ln.match(/^\s*([\p{L}\p{N}_]+)\s*=\s*([\p{L}\p{N}_]+)\s*$/u);
+          if (!m)
+            continue;
+          const lineNum = i2 + 1;
+          const lhs = m[1];
+          if (derived.get(lhs) !== lineNum)
+            continue;
+          aliasChains.push({ lhs, upstream: m[2], line: lineNum });
+        }
+      }
+      if (aliasChains.length > 0) {
+        let changed = true;
+        let guard = 0;
+        while (changed && guard < aliasChains.length + 2) {
+          changed = false;
+          guard++;
+          for (const { lhs, upstream } of aliasChains) {
+            const upCov = aliasSanitizedFor.get(upstream);
+            if (!upCov || upCov.size === 0)
+              continue;
+            let downCov = aliasSanitizedFor.get(lhs);
+            if (!downCov) {
+              downCov = new Set;
+              aliasSanitizedFor.set(lhs, downCov);
+            }
+            for (const t of upCov) {
+              if (!downCov.has(t)) {
+                downCov.add(t);
+                changed = true;
+              }
+            }
+          }
+        }
+      }
     }
   }
   if (language === "rust" && typeof code === "string" && sourcesWithVar.length > 0) {
@@ -29292,6 +29334,17 @@ var COMMONS_DIGEST_METHODS = new Set([
   "sha",
   "shaHex"
 ]);
+var COMMONS_DIGEST_GETTERS = {
+  getMd2Digest: "md2",
+  getMd5Digest: "md5",
+  getSha1Digest: "sha1",
+  getShaDigest: "sha1"
+};
+var COMMONS_ALGO_CONSTANTS = {
+  "MessageDigestAlgorithms.MD2": "md2",
+  "MessageDigestAlgorithms.MD5": "md5",
+  "MessageDigestAlgorithms.SHA_1": "sha1"
+};
 var PY_HASHLIB_WEAK = new Set(["md5", "sha1", "md4", "md2", "new"]);
 function stripQuotes4(s) {
   const trimmed = s.trim();
@@ -29308,16 +29361,68 @@ function literalAlgo(call, position) {
   const cleaned = stripQuotes4(raw).toLowerCase();
   return cleaned || null;
 }
+function resolveJavaAlgo(call, position, constProp, javaBindings) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg)
+    return null;
+  if (arg.literal) {
+    const cleaned = stripQuotes4(arg.literal).toLowerCase();
+    if (cleaned)
+      return cleaned;
+  }
+  const expr = (arg.expression ?? "").trim();
+  if (expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'")) {
+    const cleaned = stripQuotes4(expr).toLowerCase();
+    if (cleaned)
+      return cleaned;
+  }
+  if (COMMONS_ALGO_CONSTANTS[expr])
+    return COMMONS_ALGO_CONSTANTS[expr];
+  const tail = expr.split(".").slice(-2).join(".");
+  if (COMMONS_ALGO_CONSTANTS[tail])
+    return COMMONS_ALGO_CONSTANTS[tail];
+  if (arg.variable && constProp) {
+    const sym = constProp.symbols?.get(arg.variable);
+    if (sym && sym.type === "string" && typeof sym.value === "string") {
+      const cleaned = stripQuotes4(sym.value).toLowerCase();
+      if (cleaned)
+        return cleaned;
+    }
+  }
+  if (arg.variable) {
+    const bound = javaBindings.get(arg.variable);
+    if (bound) {
+      const cleaned = stripQuotes4(bound).toLowerCase();
+      if (cleaned)
+        return cleaned;
+    }
+  }
+  return null;
+}
+function scanJavaStringBindings(code) {
+  const out2 = new Map;
+  if (!code)
+    return out2;
+  const re = /^[ \t]*(?:(?:public|private|protected|static|final|volatile)\s+){0,5}String\s+([A-Za-z_][A-Za-z0-9_]*)\s*=\s*("[^"]*")\s*;/gm;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    if (m[1] && m[2])
+      out2.set(m[1], m[2]);
+  }
+  return out2;
+}
 
 class WeakHashPass {
   name = "weak-hash";
   category = "security";
   run(ctx) {
-    const { graph, language } = ctx;
+    const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
     const findings = [];
+    const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
+    const javaBindings = language === "java" ? scanJavaStringBindings(code) : new Map;
     for (const call of graph.ir.calls) {
-      const detection = this.detect(call, language);
+      const detection = this.detect(call, language, constProp, javaBindings);
       if (!detection)
         continue;
       const { algorithm, api } = detection;
@@ -29340,12 +29445,12 @@ class WeakHashPass {
     }
     return { findings };
   }
-  detect(call, language) {
+  detect(call, language, constProp, javaBindings) {
     const method = call.method_name;
     const receiver = call.receiver ?? "";
     if (language === "java") {
       if (method === "getInstance" && (receiver === "MessageDigest" || receiver.endsWith(".MessageDigest"))) {
-        const algo = literalAlgo(call, 0);
+        const algo = resolveJavaAlgo(call, 0, constProp, javaBindings);
         if (algo && WEAK_HASH_NAMES.has(algo)) {
           return { algorithm: algo, api: "MessageDigest.getInstance" };
         }
@@ -29355,6 +29460,9 @@ class WeakHashPass {
         const normalized = algoFromMethod === "sha" ? "sha1" : algoFromMethod;
         return { algorithm: normalized, api: `DigestUtils.${method}` };
       }
+      if (COMMONS_DIGEST_GETTERS[method] && (receiver === "DigestUtils" || receiver.endsWith(".DigestUtils"))) {
+        return { algorithm: COMMONS_DIGEST_GETTERS[method], api: `DigestUtils.${method}` };
+      }
       return null;
     }
     if (language === "python") {
@@ -30789,7 +30897,7 @@ class JwtVerifyDisabledPass {
           out2.push({ pattern: "Algorithm.none()", api: "JWT.require" });
         }
       }
-      if (method === "parse" && receiver.includes("parser")) {
+      if (method === "parse" && /\bJwts\s*\.\s*parser\s*\(/.test(receiver)) {
         out2.push({ pattern: "parse() instead of parseClaimsJws()", api: "Jwts.parser().parse" });
       }
       return out2;
@@ -32498,7 +32606,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.75.0";
+var version = "3.78.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.75.0",
+  "version": "3.78.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.75.0"
+    "circle-ir": "^3.78.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",