cognium-dev 3.90.0 → 3.90.1

package/dist/cli.js

@@ -15075,8 +15075,17 @@ class AnalysisPipeline {
         return findings;
       }
     };
+    const timingEnabled = globalThis.__circleIrPassTiming === true;
     for (const pass of this.passes) {
+      if (timingEnabled) {
+        console.error(`[pass-start] ${pass.name} file=${graph.ir.meta.file}`);
+      }
+      const t0 = timingEnabled ? Date.now() : 0;
       const result = pass.run(context);
+      if (timingEnabled) {
+        const dt = Date.now() - t0;
+        console.error(`[pass-timing] ${pass.name} ${dt}ms file=${graph.ir.meta.file}`);
+      }
       results.set(pass.name, result);
     }
     return { results, findings };
@@ -15857,6 +15866,7 @@ class ConstantPropagator {
   inConstructor = false;
   constructorParamPositions = new Map;
   safePatternFieldsCache = null;
+  isTaintedExpressionCache = null;
   analyze(tree, sourceCode, additionalTaintPatterns = [], sanitizerMethods = [], taintedParameters = []) {
     this.source = sourceCode;
     this.additionalTaintPatterns = additionalTaintPatterns;
@@ -15888,6 +15898,7 @@ class ConstantPropagator {
     this.inConstructor = false;
     this.constructorParamPositions.clear();
     this.safePatternFieldsCache = null;
+    this.isTaintedExpressionCache = null;
     this.collectClassFields(tree.rootNode);
     for (const methodName of sanitizerMethods) {
       this.methodReturnsSanitized.add(methodName);
@@ -17237,18 +17248,52 @@ class ConstantPropagator {
     return null;
   }
   isTaintedExpression(node) {
+    const isTopLevel = this.isTaintedExpressionCache === null;
+    if (isTopLevel) {
+      this.isTaintedExpressionCache = new Map;
+    }
+    try {
+      return this.isTaintedExpressionImpl(node);
+    } finally {
+      if (isTopLevel) {
+        this.isTaintedExpressionCache = null;
+      }
+    }
+  }
+  isTaintedExpressionImpl(node) {
+    const cache = this.isTaintedExpressionCache;
+    const rootId = node.id;
+    const cachedRoot = cache.get(rootId);
+    if (cachedRoot !== undefined) {
+      return cachedRoot;
+    }
     const stack = [node];
     while (stack.length > 0) {
       const current = stack.pop();
+      const currentId = current.id;
+      const cached = cache.get(currentId);
+      if (cached !== undefined) {
+        if (cached) {
+          cache.set(rootId, true);
+          return true;
+        }
+        continue;
+      }
       const result = this.isTaintedExpressionStep(current);
-      if (result === true)
+      if (result === true) {
+        cache.set(currentId, true);
+        cache.set(rootId, true);
         return true;
-      if (result === false)
+      }
+      if (result === false) {
+        cache.set(currentId, false);
         continue;
+      }
       for (let i2 = current.children.length - 1;i2 >= 0; i2--) {
         stack.push(current.children[i2]);
       }
     }
+    cache.set(rootId, false);
     return false;
   }
   isTaintedExpressionStep(node) {
@@ -34472,7 +34517,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.90.0";
+var version = "3.90.1";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.90.0",
+  "version": "3.90.1",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.90.0"
+    "circle-ir": "^3.90.1"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",