cognium-dev 3.91.0 → 3.95.0

package/dist/cli.js

@@ -17789,6 +17789,124 @@ function normalizeCondition(cond) {
   }
   return normalized;
 }
+// ../circle-ir/dist/utils/logger.js
+var LOG_LEVELS = {
+  trace: 0,
+  debug: 1,
+  info: 2,
+  warn: 3,
+  error: 4,
+  fatal: 5,
+  silent: 6
+};
+var currentLevel = "silent";
+var customLogger = null;
+function shouldLog(level) {
+  return LOG_LEVELS[level] >= LOG_LEVELS[currentLevel];
+}
+function setLogLevel(level) {
+  currentLevel = level;
+}
+var logger = {
+  trace: (msg, obj) => {
+    if (customLogger) {
+      customLogger.trace(msg, obj);
+      return;
+    }
+    if (shouldLog("trace"))
+      console.debug(obj ? `[TRACE] ${msg} ${JSON.stringify(obj)}` : `[TRACE] ${msg}`);
+  },
+  debug: (msg, obj) => {
+    if (customLogger) {
+      customLogger.debug(msg, obj);
+      return;
+    }
+    if (shouldLog("debug"))
+      console.debug(obj ? `[DEBUG] ${msg} ${JSON.stringify(obj)}` : `[DEBUG] ${msg}`);
+  },
+  info: (msg, obj) => {
+    if (customLogger) {
+      customLogger.info(msg, obj);
+      return;
+    }
+    if (shouldLog("info"))
+      console.error(obj ? `[INFO] ${msg} ${JSON.stringify(obj)}` : `[INFO] ${msg}`);
+  },
+  warn: (msg, obj) => {
+    if (customLogger) {
+      customLogger.warn(msg, obj);
+      return;
+    }
+    if (shouldLog("warn"))
+      console.warn(obj ? `[WARN] ${msg} ${JSON.stringify(obj)}` : `[WARN] ${msg}`);
+  },
+  error: (msg, obj) => {
+    if (customLogger) {
+      customLogger.error(msg, obj);
+      return;
+    }
+    if (shouldLog("error"))
+      console.error(obj ? `[ERROR] ${msg} ${JSON.stringify(obj)}` : `[ERROR] ${msg}`);
+  },
+  fatal: (msg, obj) => {
+    if (customLogger) {
+      customLogger.fatal(msg, obj);
+      return;
+    }
+    if (shouldLog("fatal"))
+      console.error(obj ? `[FATAL] ${msg} ${JSON.stringify(obj)}` : `[FATAL] ${msg}`);
+  },
+  isLevelEnabled: (level) => {
+    return shouldLog(level);
+  }
+};
+
+// ../circle-ir/dist/analysis/per-file-finding-cap.js
+var DEFAULT_PER_FILE_FINDING_CAP = 1000;
+var SATURATED_FILE_RULE_ID = "saturated-file";
+function applyPerFileFindingCap(filePath, findings, cap) {
+  if (cap <= 0)
+    return findings;
+  if (findings.length <= cap)
+    return findings;
+  const suppressedCount = findings.length;
+  const byRule = {};
+  const bySeverity = {};
+  for (const f of findings) {
+    byRule[f.rule_id] = (byRule[f.rule_id] ?? 0) + 1;
+    bySeverity[f.severity] = (bySeverity[f.severity] ?? 0) + 1;
+  }
+  logger.warn(`File ${filePath} produced ${suppressedCount} findings (cap=${cap}); ` + "suppressing individual findings and emitting saturated-file advisory.", { file: filePath, suppressedCount, cap, byRule, bySeverity });
+  const advisory = {
+    id: `${SATURATED_FILE_RULE_ID}-${filePath}-1`,
+    pass: SATURATED_FILE_RULE_ID,
+    category: "maintainability",
+    rule_id: SATURATED_FILE_RULE_ID,
+    severity: "low",
+    level: "note",
+    message: `File suppressed: produced ${suppressedCount} findings, exceeding the ` + `per-file cap of ${cap}. This typically indicates cross-product noise, ` + "mislabelled sink class, or pathological generated code rather than a " + "legitimate detection burst. Individual findings dropped; re-run with " + "`perFileFindingCap: 0` to bypass the cap if the volume is intentional.",
+    file: filePath,
+    line: 1,
+    evidence: {
+      suppressed_count: suppressedCount,
+      cap,
+      by_rule: byRule,
+      by_severity: bySeverity
+    }
+  };
+  return [advisory];
+}
+
+// ../circle-ir/dist/analysis/confidence-filter.js
+function applyConfidenceFilter(findings, includeSpeculative) {
+  if (includeSpeculative)
+    return findings;
+  return findings.filter(isHighConfidence);
+}
+function isHighConfidence(finding) {
+  return finding.confidence === undefined || finding.confidence === "high";
+}
+
 // ../circle-ir/dist/languages/registry.js
 class DefaultLanguageRegistry {
   plugins = new Map;
@@ -20800,78 +20918,6 @@ function registerBuiltinPlugins() {
   registerLanguage(new HtmlPlugin);
   registerLanguage(new GoPlugin);
 }
-// ../circle-ir/dist/utils/logger.js
-var LOG_LEVELS = {
-  trace: 0,
-  debug: 1,
-  info: 2,
-  warn: 3,
-  error: 4,
-  fatal: 5,
-  silent: 6
-};
-var currentLevel = "silent";
-var customLogger = null;
-function shouldLog(level) {
-  return LOG_LEVELS[level] >= LOG_LEVELS[currentLevel];
-}
-function setLogLevel(level) {
-  currentLevel = level;
-}
-var logger = {
-  trace: (msg, obj) => {
-    if (customLogger) {
-      customLogger.trace(msg, obj);
-      return;
-    }
-    if (shouldLog("trace"))
-      console.debug(obj ? `[TRACE] ${msg} ${JSON.stringify(obj)}` : `[TRACE] ${msg}`);
-  },
-  debug: (msg, obj) => {
-    if (customLogger) {
-      customLogger.debug(msg, obj);
-      return;
-    }
-    if (shouldLog("debug"))
-      console.debug(obj ? `[DEBUG] ${msg} ${JSON.stringify(obj)}` : `[DEBUG] ${msg}`);
-  },
-  info: (msg, obj) => {
-    if (customLogger) {
-      customLogger.info(msg, obj);
-      return;
-    }
-    if (shouldLog("info"))
-      console.error(obj ? `[INFO] ${msg} ${JSON.stringify(obj)}` : `[INFO] ${msg}`);
-  },
-  warn: (msg, obj) => {
-    if (customLogger) {
-      customLogger.warn(msg, obj);
-      return;
-    }
-    if (shouldLog("warn"))
-      console.warn(obj ? `[WARN] ${msg} ${JSON.stringify(obj)}` : `[WARN] ${msg}`);
-  },
-  error: (msg, obj) => {
-    if (customLogger) {
-      customLogger.error(msg, obj);
-      return;
-    }
-    if (shouldLog("error"))
-      console.error(obj ? `[ERROR] ${msg} ${JSON.stringify(obj)}` : `[ERROR] ${msg}`);
-  },
-  fatal: (msg, obj) => {
-    if (customLogger) {
-      customLogger.fatal(msg, obj);
-      return;
-    }
-    if (shouldLog("fatal"))
-      console.error(obj ? `[FATAL] ${msg} ${JSON.stringify(obj)}` : `[FATAL] ${msg}`);
-  },
-  isLevelEnabled: (level) => {
-    return shouldLog(level);
-  }
-};
-
 // ../circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
   run(projectGraph, sourceLines, options = {}) {
@@ -25016,7 +25062,12 @@ var TIER_1_BY_SUPERTYPE = new Map([
   ["HandlerInterceptor", new Set(["preHandle", "postHandle", "afterCompletion"])],
   ["AsyncHandlerInterceptor", new Set(["preHandle", "postHandle", "afterCompletion", "afterConcurrentHandlingStarted"])],
   ["CommandLineRunner", new Set(["run"])],
-  ["ApplicationRunner", new Set(["run"])]
+  ["ApplicationRunner", new Set(["run"])],
+  ["SimpleChannelInboundHandler", new Set(["channelRead0", "messageReceived"])],
+  ["ChannelInboundHandler", new Set(["channelRead", "channelReadComplete"])],
+  ["ChannelInboundHandlerAdapter", new Set(["channelRead", "channelReadComplete"])],
+  ["ChannelDuplexHandler", new Set(["channelRead", "channelReadComplete"])],
+  ["NettyRequestProcessor", new Set(["process"])]
 ]);
 var TIER_3_CLASS_SUFFIXES = [
   "Util",
@@ -25164,6 +25215,10 @@ function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingTy
 class InterproceduralPass {
   name = "interprocedural";
   category = "security";
+  enableEntryPointGate;
+  constructor(options) {
+    this.enableEntryPointGate = options?.enableEntryPointGate ?? true;
+  }
   run(ctx) {
     const { graph } = ctx;
     const constProp = ctx.getResult("constant-propagation");
@@ -25222,7 +25277,7 @@ class InterproceduralPass {
                 continue;
               if (source.type === "interprocedural_param" && source.confidence < 0.6)
                 continue;
-              if (source.type === "interprocedural_param" && source.in_method) {
+              if (this.enableEntryPointGate && source.type === "interprocedural_param" && source.in_method) {
                 const enclosing = methodNameIndex.get(source.in_method);
                 if (shouldGateInterproceduralParam(source.type, enclosing?.method, enclosing?.type, { language, types: graph.ir.types })) {
                   continue;
@@ -34212,7 +34267,9 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new LanguageSourcesPass);
     pipeline.add(new SinkFilterPass);
     pipeline.add(new TaintPropagationPass);
-    pipeline.add(new InterproceduralPass);
+    pipeline.add(new InterproceduralPass({
+      enableEntryPointGate: options.enableEntryPointGate ?? true
+    }));
     if (!disabledPasses.has("scan-secrets"))
       pipeline.add(new ScanSecretsPass);
     if (!disabledPasses.has("dead-code"))
@@ -34342,6 +34399,8 @@ async function analyze(code, filePath, language, options = {}) {
       unresolvedItems: unresolved.length
     });
     emitFindingsInstrumentation(filePath, findings, taint);
+    const verifiedFindings = applyConfidenceFilter(findings, options.includeSpeculative === true);
+    const cappedFindings = applyPerFileFindingCap(filePath, verifiedFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
     return {
       meta,
       types,
@@ -34353,7 +34412,7 @@ async function analyze(code, filePath, language, options = {}) {
       exports,
       unresolved,
       enriched,
-      findings: findings.length > 0 ? findings : undefined,
+      findings: cappedFindings.length > 0 ? cappedFindings : undefined,
       metrics: { file: filePath, metrics: metricValues },
       runtime_registrations: runtimeRegistrations.length > 0 ? runtimeRegistrations : undefined,
       parse_status: parseStatus
@@ -34520,7 +34579,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.91.0";
+var version = "3.95.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.91.0",
+  "version": "3.95.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.91.0"
+    "circle-ir": "^3.95.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",