cognium-dev 3.95.0 → 3.97.0

package/dist/cli.js

@@ -12125,6 +12125,126 @@ var CWE_78_RECEIVER_ALLOWLIST = new Set([
   "ProcessExecutor",
   "RuntimeUtil"
 ]);
+function isFunctionCallbackArgument(arg) {
+  if (arg.literal !== null && arg.literal !== undefined)
+    return false;
+  const expr = (arg.expression ?? "").trim();
+  if (expr.length === 0)
+    return false;
+  const body2 = expr.startsWith("async ") ? expr.slice(6).trimStart() : expr;
+  if (body2.startsWith("("))
+    return true;
+  if (/^function\b/.test(body2))
+    return true;
+  return false;
+}
+function findGoLocalDeclaredType(varName, callLine, sourceLines) {
+  if (!varName)
+    return null;
+  const WINDOW = 50;
+  const startIdx = Math.max(0, callLine - 2);
+  const endIdx = Math.max(0, startIdx - WINDOW);
+  const name2 = varName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const VAR_DECL_RE = new RegExp(`^\\s*var\\s+${name2}\\s+([^=\\n][^\\n]*)$`);
+  const VAR_INIT_RE = new RegExp(`^\\s*var\\s+${name2}(?:\\s+[^=\\n]*?)?\\s*=\\s*(.+)$`);
+  const SHORT_INIT_RE = new RegExp(`^\\s*${name2}\\s*:=\\s*(.+)$`);
+  for (let i2 = startIdx;i2 >= endIdx; i2--) {
+    const raw = sourceLines[i2];
+    if (raw === undefined)
+      continue;
+    const line = raw.replace(/\/\/.*$/, "").trimEnd();
+    let m = VAR_DECL_RE.exec(line);
+    if (m) {
+      return { kind: "typed-decl", text: m[1].trim() };
+    }
+    m = VAR_INIT_RE.exec(line);
+    if (m) {
+      return classifyGoRhs(m[1].trim());
+    }
+    m = SHORT_INIT_RE.exec(line);
+    if (m) {
+      return classifyGoRhs(m[1].trim());
+    }
+  }
+  return null;
+}
+function classifyGoRhs(rhs) {
+  const body2 = rhs.startsWith("&") ? rhs.slice(1).trimStart() : rhs;
+  if (/^make\s*\(/.test(body2)) {
+    return { kind: "untyped" };
+  }
+  const parenIdx = body2.indexOf("(");
+  const braceIdx = body2.indexOf("{");
+  if (parenIdx >= 0 && (braceIdx < 0 || parenIdx < braceIdx)) {
+    return { kind: "untyped" };
+  }
+  if (braceIdx > 0) {
+    const tag = body2.slice(0, braceIdx).trim();
+    if (tag.length > 0) {
+      if (/\binterface\s*\{\s*\}/.test(tag))
+        return { kind: "untyped" };
+      if (/\bany\b/.test(tag))
+        return { kind: "untyped" };
+      return { kind: "typed-init", text: tag };
+    }
+  }
+  return { kind: "untyped" };
+}
+function classifyGoDestinationType(decl) {
+  if (decl === null)
+    return "unknown";
+  if (decl.kind === "untyped")
+    return "unknown";
+  const text = decl.text;
+  if (/\binterface\s*\{\s*\}/.test(text))
+    return "unsafe";
+  if (/\bany\b/.test(text))
+    return "unsafe";
+  return "safe";
+}
+function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
+  if (language !== "go")
+    return false;
+  if (pattern.type !== "deserialization")
+    return false;
+  if (!sourceLines)
+    return false;
+  const method = call.method_name;
+  let destPos;
+  if (method === "Unmarshal" && pattern.class === "json") {
+    destPos = 1;
+  } else if (method === "Decode" && pattern.class === "Decoder") {
+    destPos = 0;
+  } else {
+    return false;
+  }
+  const destArg = call.arguments.find((a) => a.position === destPos);
+  if (!destArg)
+    return false;
+  const expr = (destArg.expression ?? "").trim();
+  if (expr.length === 0)
+    return false;
+  if (expr.startsWith("&")) {
+    const inner = expr.slice(1).trimStart();
+    const compIdx = inner.indexOf("{");
+    if (compIdx > 0) {
+      const decl2 = { kind: "typed-init", text: inner.slice(0, compIdx).trim() };
+      return classifyGoDestinationType(decl2) === "safe";
+    }
+    const m = /^&([A-Za-z_]\w*)$/.exec(expr);
+    if (!m)
+      return false;
+    const varName = m[1];
+    const decl = findGoLocalDeclaredType(varName, call.location.line, sourceLines);
+    return classifyGoDestinationType(decl) === "safe";
+  }
+  const idMatch = /^([A-Za-z_]\w*)$/.exec(expr);
+  if (idMatch) {
+    const decl = findGoLocalDeclaredType(idMatch[1], call.location.line, sourceLines);
+    return classifyGoDestinationType(decl) === "safe";
+  }
+  return false;
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
   const sinkMap = new Map;
   for (const call of calls) {
@@ -12157,6 +12277,15 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             }
           }
         }
+        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout")) {
+          const firstArg = call.arguments.find((a) => a.position === 0);
+          if (firstArg && isFunctionCallbackArgument(firstArg)) {
+            continue;
+          }
+        }
+        if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
+          continue;
+        }
         const location = formatCallLocation(call);
         const key = `${location}:${call.location.line}:${pattern.cwe}`;
         const confidence = calculateSinkConfidence(call, pattern);
@@ -34579,7 +34708,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.95.0";
+var version = "3.97.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.95.0",
+  "version": "3.97.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.95.0"
+    "circle-ir": "^3.97.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",