cognium-dev 3.97.0 → 3.99.0

package/dist/cli.js

@@ -12245,6 +12245,27 @@ function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
+var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
+function isSafeJinjaRenderCall(call, pattern, language) {
+  if (language !== "python")
+    return false;
+  if (pattern.type !== "xss" && pattern.type !== "code_injection")
+    return false;
+  const method = call.method_name;
+  if (method === "render_template_string") {
+    const arg0 = call.arguments.find((a) => a.position === 0);
+    return typeof arg0?.literal === "string";
+  }
+  if (method === "Template" || method === "from_string") {
+    const arg0 = call.arguments.find((a) => a.position === 0);
+    return typeof arg0?.literal === "string";
+  }
+  if (method === "render") {
+    const receiver = (call.receiver ?? "").trim();
+    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+  }
+  return false;
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
   const sinkMap = new Map;
   for (const call of calls) {
@@ -12286,6 +12307,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isSafeJinjaRenderCall(call, pattern, language)) {
+          continue;
+        }
         const location = formatCallLocation(call);
         const key = `${location}:${call.location.line}:${pattern.cwe}`;
         const confidence = calculateSinkConfidence(call, pattern);
@@ -22711,6 +22735,13 @@ function findPythonTrustBoundaryViolations(sourceCode, taintedVars) {
   }
   return violations;
 }
+var JINJA_LITERAL_ARG_RE_FRAG = `(?:"[^"\\\\]*"|'[^'\\\\]*')`;
+var JINJA_SAFE_RTS_RE = new RegExp(`^(?:flask\\.|jinja2\\.)?render_template_string\\s*\\(\\s*${JINJA_LITERAL_ARG_RE_FRAG}\\s*[,)]`);
+var JINJA_SAFE_TEMPLATE_RE = new RegExp(`^(?:jinja2\\.)?Template\\s*\\(\\s*${JINJA_LITERAL_ARG_RE_FRAG}\\s*\\)(?:\\s*\\.render\\s*\\(|\\s*$)`);
+function isSafeJinjaReturnExpr(expr) {
+  const trimmed = expr.trim();
+  return JINJA_SAFE_RTS_RE.test(trimmed) || JINJA_SAFE_TEMPLATE_RE.test(trimmed);
+}
 function findPythonReturnXSSSinks(sourceCode, taintedVars) {
   if (taintedVars.size === 0)
     return [];
@@ -22732,6 +22763,8 @@ function findPythonReturnXSSSinks(sourceCode, taintedVars) {
     const looksLikeHTML = expr.includes("<") || /['"]\s*\+/.test(expr) || /\+\s*['"]/.test(expr) || /f['"][^'"]*\{/.test(expr);
     if (!looksLikeHTML)
       continue;
+    if (isSafeJinjaReturnExpr(expr))
+      continue;
     sinks.push({ sinkLine: i2 + 1 });
   }
   return sinks;
@@ -23594,7 +23627,7 @@ class SinkFilterPass {
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split(`
 `);
-      const guardPatterns = /\b(?:includes|startsWith|endsWith|indexOf|test|match)\s*\(/;
+      const guardPatterns = /\b(?:includes|startsWith|endsWith|indexOf|test|match|has)\s*\(/;
       filtered = filtered.filter((sink) => {
         if (sink.type !== "open_redirect" && sink.type !== "crlf") {
           return true;
@@ -23614,6 +23647,9 @@ class SinkFilterPass {
         if (setHeaderMatch) {
           return false;
         }
+        if (sink.method === "cookie" && sink.type === "crlf") {
+          return false;
+        }
         return true;
       });
     }
@@ -31655,15 +31691,34 @@ function isExceptionExpression(expr) {
   if (!expr)
     return false;
   const e = expr.trim();
-  return /\b(err|error|exc|exception|e|t|throwable)\.(stack|message|toString\(|getMessage\(|getStackTrace\(|getLocalizedMessage\(|getCause\()/i.test(e) || /\btraceback\.(format_exc|format_exception|print_exc)\b/i.test(e) || /\bdebug\.Stack\(\)/.test(e) || /\bstr\(\s*(err|error|exc|exception|e)\s*\)/i.test(e) || /\bString\(\s*(err|error|exc|exception|e)\s*\)/i.test(e);
+  return /\b(err|error|exc|exception|e|t|throwable)\.(stack|toString\(|getStackTrace\(|getLocalizedMessage\(|getCause\()/i.test(e) || /\btraceback\.(format_exc|format_exception|print_exc)\b/i.test(e) || /\bdebug\.Stack\(\)/.test(e) || /\bstr\(\s*(err|error|exc|exception|e)\s*\)/i.test(e) || /\bString\(\s*(err|error|exc|exception|e)\s*\)/i.test(e);
+}
+var PY_FILE_HANDLE_OPEN_RE = /^\s*(?:with\s+open\s*\([^)]*\)\s+as\s+(\w+)\s*:|(\w+)\s*=\s*open\s*\()/;
+function isPythonFileHandle(receiver, callLine, sourceLines) {
+  if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
+    return false;
+  const start2 = Math.max(0, callLine - 11);
+  for (let i2 = callLine - 2;i2 >= start2; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(PY_FILE_HANDLE_OPEN_RE);
+    if (!m)
+      continue;
+    const name2 = m[1] ?? m[2];
+    if (name2 === receiver)
+      return true;
+  }
+  return false;
 }
 function argIsException(arg) {
   if (!arg)
     return false;
+  const expr = (arg.expression ?? "").trim();
   if (arg.variable && /^(err|error|exc|exception|e|t|throwable)$/i.test(arg.variable)) {
-    return true;
+    if (!expr || expr === arg.variable)
+      return true;
+    return isExceptionExpression(expr);
   }
-  return isExceptionExpression(arg.expression);
+  return isExceptionExpression(expr);
 }
 function detectJavaPrintStackTrace(call) {
   if (call.method_name !== "printStackTrace")
@@ -31680,13 +31735,16 @@ function detectJavaPrintStackTrace(call) {
   }
   return null;
 }
-function detectResponseLeakCall(call) {
+function detectResponseLeakCall(call, language, sourceLines) {
   const method = call.method_name ?? "";
   const receiver = call.receiver ?? "";
   if (!RESPONSE_SEND_METHODS.has(method))
     return null;
   if (LOGGER_RECEIVER_RE.test(receiver))
     return null;
+  if (language === "python" && (method === "write" || method === "writelines") && sourceLines && isPythonFileHandle(receiver, call.location.line, sourceLines)) {
+    return null;
+  }
   const recTail = receiver.split(".").pop() ?? receiver;
   const recHead = receiver.split(".")[0] ?? receiver;
   if (!RESPONSE_RECEIVER_RE.test(recTail) && !RESPONSE_RECEIVER_RE.test(recHead)) {
@@ -31731,6 +31789,8 @@ class InfoDisclosureStacktracePass {
     const { graph, language } = ctx;
     const file = graph.ir.meta.file;
     const findings = [];
+    const sourceLines = ctx.code.split(`
+`);
     if (language === "python") {
       for (const f of detectPythonTracebackReturn(ctx)) {
         findings.push({ line: f.line, api: f.api, language });
@@ -31742,9 +31802,9 @@ class InfoDisclosureStacktracePass {
       if (language === "java") {
         api = detectJavaPrintStackTrace(call);
         if (!api)
-          api = detectResponseLeakCall(call);
+          api = detectResponseLeakCall(call, language, sourceLines);
       } else if (language === "javascript" || language === "typescript") {
-        api = detectResponseLeakCall(call);
+        api = detectResponseLeakCall(call, language, sourceLines);
       } else if (language === "go") {
         const method = call.method_name ?? "";
         const rec = call.receiver ?? "";
@@ -31765,10 +31825,10 @@ class InfoDisclosureStacktracePass {
             }
           }
         } else {
-          api = detectResponseLeakCall(call);
+          api = detectResponseLeakCall(call, language, sourceLines);
         }
       } else if (language === "python") {
-        api = detectResponseLeakCall(call);
+        api = detectResponseLeakCall(call, language, sourceLines);
       }
       if (!api)
         continue;
@@ -34708,7 +34768,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.97.0";
+var version = "3.99.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.97.0",
+  "version": "3.99.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.97.0"
+    "circle-ir": "^3.99.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",