cognium-dev 3.77.0 → 3.78.0

package/dist/cli.js

@@ -29334,6 +29334,17 @@ var COMMONS_DIGEST_METHODS = new Set([
   "sha",
   "shaHex"
 ]);
+var COMMONS_DIGEST_GETTERS = {
+  getMd2Digest: "md2",
+  getMd5Digest: "md5",
+  getSha1Digest: "sha1",
+  getShaDigest: "sha1"
+};
+var COMMONS_ALGO_CONSTANTS = {
+  "MessageDigestAlgorithms.MD2": "md2",
+  "MessageDigestAlgorithms.MD5": "md5",
+  "MessageDigestAlgorithms.SHA_1": "sha1"
+};
 var PY_HASHLIB_WEAK = new Set(["md5", "sha1", "md4", "md2", "new"]);
 function stripQuotes4(s) {
   const trimmed = s.trim();
@@ -29350,16 +29361,68 @@ function literalAlgo(call, position) {
   const cleaned = stripQuotes4(raw).toLowerCase();
   return cleaned || null;
 }
+function resolveJavaAlgo(call, position, constProp, javaBindings) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg)
+    return null;
+  if (arg.literal) {
+    const cleaned = stripQuotes4(arg.literal).toLowerCase();
+    if (cleaned)
+      return cleaned;
+  }
+  const expr = (arg.expression ?? "").trim();
+  if (expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'")) {
+    const cleaned = stripQuotes4(expr).toLowerCase();
+    if (cleaned)
+      return cleaned;
+  }
+  if (COMMONS_ALGO_CONSTANTS[expr])
+    return COMMONS_ALGO_CONSTANTS[expr];
+  const tail = expr.split(".").slice(-2).join(".");
+  if (COMMONS_ALGO_CONSTANTS[tail])
+    return COMMONS_ALGO_CONSTANTS[tail];
+  if (arg.variable && constProp) {
+    const sym = constProp.symbols?.get(arg.variable);
+    if (sym && sym.type === "string" && typeof sym.value === "string") {
+      const cleaned = stripQuotes4(sym.value).toLowerCase();
+      if (cleaned)
+        return cleaned;
+    }
+  }
+  if (arg.variable) {
+    const bound = javaBindings.get(arg.variable);
+    if (bound) {
+      const cleaned = stripQuotes4(bound).toLowerCase();
+      if (cleaned)
+        return cleaned;
+    }
+  }
+  return null;
+}
+function scanJavaStringBindings(code) {
+  const out2 = new Map;
+  if (!code)
+    return out2;
+  const re = /^[ \t]*(?:(?:public|private|protected|static|final|volatile)\s+){0,5}String\s+([A-Za-z_][A-Za-z0-9_]*)\s*=\s*("[^"]*")\s*;/gm;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    if (m[1] && m[2])
+      out2.set(m[1], m[2]);
+  }
+  return out2;
+}
 
 class WeakHashPass {
   name = "weak-hash";
   category = "security";
   run(ctx) {
-    const { graph, language } = ctx;
+    const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
     const findings = [];
+    const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
+    const javaBindings = language === "java" ? scanJavaStringBindings(code) : new Map;
     for (const call of graph.ir.calls) {
-      const detection = this.detect(call, language);
+      const detection = this.detect(call, language, constProp, javaBindings);
       if (!detection)
         continue;
       const { algorithm, api } = detection;
@@ -29382,12 +29445,12 @@ class WeakHashPass {
     }
     return { findings };
   }
-  detect(call, language) {
+  detect(call, language, constProp, javaBindings) {
     const method = call.method_name;
     const receiver = call.receiver ?? "";
     if (language === "java") {
       if (method === "getInstance" && (receiver === "MessageDigest" || receiver.endsWith(".MessageDigest"))) {
-        const algo = literalAlgo(call, 0);
+        const algo = resolveJavaAlgo(call, 0, constProp, javaBindings);
         if (algo && WEAK_HASH_NAMES.has(algo)) {
           return { algorithm: algo, api: "MessageDigest.getInstance" };
         }
@@ -29397,6 +29460,9 @@ class WeakHashPass {
         const normalized = algoFromMethod === "sha" ? "sha1" : algoFromMethod;
         return { algorithm: normalized, api: `DigestUtils.${method}` };
       }
+      if (COMMONS_DIGEST_GETTERS[method] && (receiver === "DigestUtils" || receiver.endsWith(".DigestUtils"))) {
+        return { algorithm: COMMONS_DIGEST_GETTERS[method], api: `DigestUtils.${method}` };
+      }
       return null;
     }
     if (language === "python") {
@@ -32540,7 +32606,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.77.0";
+var version = "3.78.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.77.0",
+  "version": "3.78.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.77.0"
+    "circle-ir": "^3.78.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",