cognium-dev 3.96.0 → 3.98.0

package/dist/cli.js

@@ -12138,6 +12138,134 @@ function isFunctionCallbackArgument(arg) {
     return true;
   return false;
 }
+function findGoLocalDeclaredType(varName, callLine, sourceLines) {
+  if (!varName)
+    return null;
+  const WINDOW = 50;
+  const startIdx = Math.max(0, callLine - 2);
+  const endIdx = Math.max(0, startIdx - WINDOW);
+  const name2 = varName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const VAR_DECL_RE = new RegExp(`^\\s*var\\s+${name2}\\s+([^=\\n][^\\n]*)$`);
+  const VAR_INIT_RE = new RegExp(`^\\s*var\\s+${name2}(?:\\s+[^=\\n]*?)?\\s*=\\s*(.+)$`);
+  const SHORT_INIT_RE = new RegExp(`^\\s*${name2}\\s*:=\\s*(.+)$`);
+  for (let i2 = startIdx;i2 >= endIdx; i2--) {
+    const raw = sourceLines[i2];
+    if (raw === undefined)
+      continue;
+    const line = raw.replace(/\/\/.*$/, "").trimEnd();
+    let m = VAR_DECL_RE.exec(line);
+    if (m) {
+      return { kind: "typed-decl", text: m[1].trim() };
+    }
+    m = VAR_INIT_RE.exec(line);
+    if (m) {
+      return classifyGoRhs(m[1].trim());
+    }
+    m = SHORT_INIT_RE.exec(line);
+    if (m) {
+      return classifyGoRhs(m[1].trim());
+    }
+  }
+  return null;
+}
+function classifyGoRhs(rhs) {
+  const body2 = rhs.startsWith("&") ? rhs.slice(1).trimStart() : rhs;
+  if (/^make\s*\(/.test(body2)) {
+    return { kind: "untyped" };
+  }
+  const parenIdx = body2.indexOf("(");
+  const braceIdx = body2.indexOf("{");
+  if (parenIdx >= 0 && (braceIdx < 0 || parenIdx < braceIdx)) {
+    return { kind: "untyped" };
+  }
+  if (braceIdx > 0) {
+    const tag = body2.slice(0, braceIdx).trim();
+    if (tag.length > 0) {
+      if (/\binterface\s*\{\s*\}/.test(tag))
+        return { kind: "untyped" };
+      if (/\bany\b/.test(tag))
+        return { kind: "untyped" };
+      return { kind: "typed-init", text: tag };
+    }
+  }
+  return { kind: "untyped" };
+}
+function classifyGoDestinationType(decl) {
+  if (decl === null)
+    return "unknown";
+  if (decl.kind === "untyped")
+    return "unknown";
+  const text = decl.text;
+  if (/\binterface\s*\{\s*\}/.test(text))
+    return "unsafe";
+  if (/\bany\b/.test(text))
+    return "unsafe";
+  return "safe";
+}
+function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
+  if (language !== "go")
+    return false;
+  if (pattern.type !== "deserialization")
+    return false;
+  if (!sourceLines)
+    return false;
+  const method = call.method_name;
+  let destPos;
+  if (method === "Unmarshal" && pattern.class === "json") {
+    destPos = 1;
+  } else if (method === "Decode" && pattern.class === "Decoder") {
+    destPos = 0;
+  } else {
+    return false;
+  }
+  const destArg = call.arguments.find((a) => a.position === destPos);
+  if (!destArg)
+    return false;
+  const expr = (destArg.expression ?? "").trim();
+  if (expr.length === 0)
+    return false;
+  if (expr.startsWith("&")) {
+    const inner = expr.slice(1).trimStart();
+    const compIdx = inner.indexOf("{");
+    if (compIdx > 0) {
+      const decl2 = { kind: "typed-init", text: inner.slice(0, compIdx).trim() };
+      return classifyGoDestinationType(decl2) === "safe";
+    }
+    const m = /^&([A-Za-z_]\w*)$/.exec(expr);
+    if (!m)
+      return false;
+    const varName = m[1];
+    const decl = findGoLocalDeclaredType(varName, call.location.line, sourceLines);
+    return classifyGoDestinationType(decl) === "safe";
+  }
+  const idMatch = /^([A-Za-z_]\w*)$/.exec(expr);
+  if (idMatch) {
+    const decl = findGoLocalDeclaredType(idMatch[1], call.location.line, sourceLines);
+    return classifyGoDestinationType(decl) === "safe";
+  }
+  return false;
+}
+var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
+function isSafeJinjaRenderCall(call, pattern, language) {
+  if (language !== "python")
+    return false;
+  if (pattern.type !== "xss" && pattern.type !== "code_injection")
+    return false;
+  const method = call.method_name;
+  if (method === "render_template_string") {
+    const arg0 = call.arguments.find((a) => a.position === 0);
+    return typeof arg0?.literal === "string";
+  }
+  if (method === "Template" || method === "from_string") {
+    const arg0 = call.arguments.find((a) => a.position === 0);
+    return typeof arg0?.literal === "string";
+  }
+  if (method === "render") {
+    const receiver = (call.receiver ?? "").trim();
+    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+  }
+  return false;
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
   const sinkMap = new Map;
   for (const call of calls) {
@@ -12176,6 +12304,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             continue;
           }
         }
+        if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
+          continue;
+        }
+        if (isSafeJinjaRenderCall(call, pattern, language)) {
+          continue;
+        }
         const location = formatCallLocation(call);
         const key = `${location}:${call.location.line}:${pattern.cwe}`;
         const confidence = calculateSinkConfidence(call, pattern);
@@ -22601,6 +22735,13 @@ function findPythonTrustBoundaryViolations(sourceCode, taintedVars) {
   }
   return violations;
 }
+var JINJA_LITERAL_ARG_RE_FRAG = `(?:"[^"\\\\]*"|'[^'\\\\]*')`;
+var JINJA_SAFE_RTS_RE = new RegExp(`^(?:flask\\.|jinja2\\.)?render_template_string\\s*\\(\\s*${JINJA_LITERAL_ARG_RE_FRAG}\\s*[,)]`);
+var JINJA_SAFE_TEMPLATE_RE = new RegExp(`^(?:jinja2\\.)?Template\\s*\\(\\s*${JINJA_LITERAL_ARG_RE_FRAG}\\s*\\)(?:\\s*\\.render\\s*\\(|\\s*$)`);
+function isSafeJinjaReturnExpr(expr) {
+  const trimmed = expr.trim();
+  return JINJA_SAFE_RTS_RE.test(trimmed) || JINJA_SAFE_TEMPLATE_RE.test(trimmed);
+}
 function findPythonReturnXSSSinks(sourceCode, taintedVars) {
   if (taintedVars.size === 0)
     return [];
@@ -22622,6 +22763,8 @@ function findPythonReturnXSSSinks(sourceCode, taintedVars) {
     const looksLikeHTML = expr.includes("<") || /['"]\s*\+/.test(expr) || /\+\s*['"]/.test(expr) || /f['"][^'"]*\{/.test(expr);
     if (!looksLikeHTML)
       continue;
+    if (isSafeJinjaReturnExpr(expr))
+      continue;
     sinks.push({ sinkLine: i2 + 1 });
   }
   return sinks;
@@ -34598,7 +34741,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.96.0";
+var version = "3.98.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.96.0",
+  "version": "3.98.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.96.0"
+    "circle-ir": "^3.98.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",