cognium-dev 3.99.0 → 3.100.0

package/dist/cli.js

@@ -23490,6 +23490,75 @@ var JS_XSS_SANITIZERS = [
   /\btrustAsHtml\s*\(/,
   /\bbypassSecurityTrust/
 ];
+var DATA_PARSER_TYPES = new Set([
+  "Parser",
+  "CommandLine",
+  "JCommander",
+  "DateParser",
+  "FastDateFormat",
+  "FastDatePrinter",
+  "ResultParser",
+  "DateFormat",
+  "SimpleDateFormat",
+  "NumberFormat",
+  "DecimalFormat",
+  "OptionParser",
+  "CmdLineParser"
+]);
+var COMPILED_TEMPLATE_TYPES = new Set([
+  "Template",
+  "JetTemplate",
+  "ITemplate",
+  "VelocityTemplate",
+  "BeetlTemplate"
+]);
+var REFLECTION_LITERAL_METHODS = new Set([
+  "forName",
+  "loadClass",
+  "getMethod",
+  "getDeclaredMethod",
+  "getConstructor",
+  "getDeclaredConstructor",
+  "parseExpression",
+  "invoke"
+]);
+var JAVA_DECL_RE_TEMPLATE = "(?:\\b(?:final|public|private|protected|static)\\s+)*" + "([A-Z]\\w*(?:\\.[A-Z]\\w*)?(?:<[^>]*>)?)\\s+RECV\\b\\s*[=;,)]";
+function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
+  if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
+    return null;
+  const start2 = Math.max(0, sinkLine - 31);
+  const declRe = new RegExp(JAVA_DECL_RE_TEMPLATE.replace("RECV", receiver));
+  for (let i2 = sinkLine - 2;i2 >= start2; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(declRe);
+    if (m) {
+      const raw = m[1].replace(/<[^>]*>/g, "").trim();
+      const parts2 = raw.split(".");
+      return parts2[parts2.length - 1] ?? null;
+    }
+  }
+  return null;
+}
+function isJavaLiteralOrAnnotationAccessor(expr) {
+  const e = expr.trim();
+  if (e === "")
+    return true;
+  if (/^"(?:[^"\\]|\\.)*"$/.test(e))
+    return true;
+  if (/^[A-Za-z_]\w*\s*\.\s*(?:value|name|key)\s*\(\s*\)$/.test(e))
+    return true;
+  return false;
+}
+function extractJavaCallArgs(method, line) {
+  const re = new RegExp(`\\b${method}\\s*\\(([^()]*(?:\\([^()]*\\)[^()]*)*)\\)`);
+  const m = line.match(re);
+  if (!m)
+    return null;
+  const argsText = m[1].trim();
+  if (argsText === "")
+    return [];
+  return argsText.split(",").map((s) => s.trim());
+}
 
 class SinkFilterPass {
   name = "sink-filter";
@@ -23653,6 +23722,45 @@ class SinkFilterPass {
         return true;
       });
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "code_injection")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const receiverMatch = sinkLineText.match(/\b(\w+)\s*\.\s*(\w+)\s*\(/);
+        const receiver = receiverMatch?.[1];
+        const method = sink.method ?? receiverMatch?.[2];
+        if (method === "parse" && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && DATA_PARSER_TYPES.has(recvType))
+            return false;
+        }
+        if ((method === "render" || method === "process" || method === "merge" || method === "renderTo") && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && COMPILED_TEMPLATE_TYPES.has(recvType))
+            return false;
+        }
+        if (method && REFLECTION_LITERAL_METHODS.has(method)) {
+          const args2 = extractJavaCallArgs(method, sinkLineText);
+          if (args2 !== null) {
+            if (method === "invoke") {
+              if (args2.length <= 1)
+                return false;
+            } else {
+              const firstArg = args2[0] ?? "";
+              if (isJavaLiteralOrAnnotationAccessor(firstArg))
+                return false;
+            }
+          }
+        }
+        if (method === "newInstance" && /\.\s*newInstance\s*\(\s*\)/.test(sinkLineText)) {
+          return false;
+        }
+        return true;
+      });
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 }
@@ -34768,7 +34876,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.99.0";
+var version = "3.100.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.99.0",
+  "version": "3.100.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.99.0"
+    "circle-ir": "^3.100.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",