cognium-dev 3.93.0 → 3.96.0

package/dist/cli.js

@@ -12125,6 +12125,19 @@ var CWE_78_RECEIVER_ALLOWLIST = new Set([
   "ProcessExecutor",
   "RuntimeUtil"
 ]);
+function isFunctionCallbackArgument(arg) {
+  if (arg.literal !== null && arg.literal !== undefined)
+    return false;
+  const expr = (arg.expression ?? "").trim();
+  if (expr.length === 0)
+    return false;
+  const body2 = expr.startsWith("async ") ? expr.slice(6).trimStart() : expr;
+  if (body2.startsWith("("))
+    return true;
+  if (/^function\b/.test(body2))
+    return true;
+  return false;
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
   const sinkMap = new Map;
   for (const call of calls) {
@@ -12157,6 +12170,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             }
           }
         }
+        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout")) {
+          const firstArg = call.arguments.find((a) => a.position === 0);
+          if (firstArg && isFunctionCallbackArgument(firstArg)) {
+            continue;
+          }
+        }
         const location = formatCallLocation(call);
         const key = `${location}:${call.location.line}:${pattern.cwe}`;
         const confidence = calculateSinkConfidence(call, pattern);
@@ -17897,6 +17916,16 @@ function applyPerFileFindingCap(filePath, findings, cap) {
   return [advisory];
 }
 
+// ../circle-ir/dist/analysis/confidence-filter.js
+function applyConfidenceFilter(findings, includeSpeculative) {
+  if (includeSpeculative)
+    return findings;
+  return findings.filter(isHighConfidence);
+}
+function isHighConfidence(finding) {
+  return finding.confidence === undefined || finding.confidence === "high";
+}
+
 // ../circle-ir/dist/languages/registry.js
 class DefaultLanguageRegistry {
   plugins = new Map;
@@ -25205,6 +25234,10 @@ function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingTy
 class InterproceduralPass {
   name = "interprocedural";
   category = "security";
+  enableEntryPointGate;
+  constructor(options) {
+    this.enableEntryPointGate = options?.enableEntryPointGate ?? true;
+  }
   run(ctx) {
     const { graph } = ctx;
     const constProp = ctx.getResult("constant-propagation");
@@ -25263,7 +25296,7 @@ class InterproceduralPass {
                 continue;
               if (source.type === "interprocedural_param" && source.confidence < 0.6)
                 continue;
-              if (source.type === "interprocedural_param" && source.in_method) {
+              if (this.enableEntryPointGate && source.type === "interprocedural_param" && source.in_method) {
                 const enclosing = methodNameIndex.get(source.in_method);
                 if (shouldGateInterproceduralParam(source.type, enclosing?.method, enclosing?.type, { language, types: graph.ir.types })) {
                   continue;
@@ -34253,7 +34286,9 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new LanguageSourcesPass);
     pipeline.add(new SinkFilterPass);
     pipeline.add(new TaintPropagationPass);
-    pipeline.add(new InterproceduralPass);
+    pipeline.add(new InterproceduralPass({
+      enableEntryPointGate: options.enableEntryPointGate ?? true
+    }));
     if (!disabledPasses.has("scan-secrets"))
       pipeline.add(new ScanSecretsPass);
     if (!disabledPasses.has("dead-code"))
@@ -34383,7 +34418,8 @@ async function analyze(code, filePath, language, options = {}) {
       unresolvedItems: unresolved.length
     });
     emitFindingsInstrumentation(filePath, findings, taint);
-    const cappedFindings = applyPerFileFindingCap(filePath, findings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
+    const verifiedFindings = applyConfidenceFilter(findings, options.includeSpeculative === true);
+    const cappedFindings = applyPerFileFindingCap(filePath, verifiedFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
     return {
       meta,
       types,
@@ -34562,7 +34598,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.93.0";
+var version = "3.96.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.93.0",
+  "version": "3.96.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.93.0"
+    "circle-ir": "^3.96.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",