cognium-dev 3.95.0 → 3.96.0

package/dist/cli.js

@@ -12125,6 +12125,19 @@ var CWE_78_RECEIVER_ALLOWLIST = new Set([
   "ProcessExecutor",
   "RuntimeUtil"
 ]);
+function isFunctionCallbackArgument(arg) {
+  if (arg.literal !== null && arg.literal !== undefined)
+    return false;
+  const expr = (arg.expression ?? "").trim();
+  if (expr.length === 0)
+    return false;
+  const body2 = expr.startsWith("async ") ? expr.slice(6).trimStart() : expr;
+  if (body2.startsWith("("))
+    return true;
+  if (/^function\b/.test(body2))
+    return true;
+  return false;
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
   const sinkMap = new Map;
   for (const call of calls) {
@@ -12157,6 +12170,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             }
           }
         }
+        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout")) {
+          const firstArg = call.arguments.find((a) => a.position === 0);
+          if (firstArg && isFunctionCallbackArgument(firstArg)) {
+            continue;
+          }
+        }
         const location = formatCallLocation(call);
         const key = `${location}:${call.location.line}:${pattern.cwe}`;
         const confidence = calculateSinkConfidence(call, pattern);
@@ -34579,7 +34598,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.95.0";
+var version = "3.96.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.95.0",
+  "version": "3.96.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.95.0"
+    "circle-ir": "^3.96.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",