cognium-dev 4.0.0 → 4.2.0

package/README.md

@@ -65,7 +65,7 @@ Scan files or directories for security vulnerabilities.
 cognium-dev scan <path> [options]
 
 Options:
-  -l, --language <lang>      Force language (java|javascript|typescript|python|go|rust|bash|html)
+  -l, --language <lang>      Force language (java|javascript|typescript|python|go|rust|bash|html|csharp)
   -f, --format <format>      Output format (text|json|sarif) [default: text]
   --threads <n>              Parallel analysis threads [default: 4]
   --severity <level>         Filter by severity:
@@ -307,6 +307,12 @@ Filter to security findings only: `cognium-dev scan ./src --category security`
 | Rust | `.rs` | Actix-web, Rocket, Axum |
 | Bash | `.sh`, `.bash` | Shell scripts |
 | HTML | `.html`, `.htm` | Web extraction preprocessor |
+| C#/.NET _(experimental)_ | `.cs` | ASP.NET Core, ADO.NET, EF Core |
+
+> **C#/.NET is experimental / preview** (since 4.0.0). Straight-line taint
+> analysis across 10 CWE families (SQLi, command injection, path traversal,
+> SSRF, code injection, XSS, deserialization, LDAP, XPath, XXE). Not yet
+> benchmark-verified — expect gaps in branch/alias precision and detector breadth.
 
 ## Configuration
 

package/dist/cli.js

@@ -14877,19 +14877,19 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection"],
-    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
-    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
-    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
-    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection"],
-    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf", "log_injection", "format_string"],
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string", "prompt_injection"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf", "log_injection", "format_string", "prompt_injection"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection", "log_injection"],
     file_input: ["deserialization", "xxe", "path_traversal", "command_injection", "code_injection"],
-    network_input: ["sql_injection", "command_injection", "xss", "ssrf", "log_injection", "format_string", "nosql_injection"],
+    network_input: ["sql_injection", "command_injection", "xss", "ssrf", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     config_param: ["sql_injection", "command_injection", "path_traversal", "xss", "ssrf", "log_injection", "format_string"],
-    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection"],
+    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     plugin_param: ["sql_injection", "command_injection", "path_traversal", "xss", "code_injection", "log_injection", "format_string"]
   };
   const validSinks = sourceToSinkMapping[sourceType];
@@ -20022,6 +20022,10 @@ function applyLibraryApiSurfaceDowngrade(findings) {
 }
 
 // ../circle-ir/dist/analysis/note-coalescer.js
+var CLICKJACKING_PAIR = new Set(["missing-x-frame-options", "missing-csp-frame-ancestors"]);
+function levelRank(level) {
+  return level === "error" ? 0 : level === "warning" ? 1 : 2;
+}
 function coalesceNoteLevelFindings(findings) {
   if (findings.length < 2)
     return [...findings];
@@ -20039,11 +20043,27 @@ function coalesceNoteLevelFindings(findings) {
   }
   const out2 = [];
   for (const key of order) {
-    const bucket = groups.get(key);
+    let bucket = groups.get(key);
     if (bucket.length === 1) {
       out2.push(bucket[0]);
       continue;
     }
+    const cj = bucket.filter((f) => CLICKJACKING_PAIR.has(f.rule_id));
+    if (new Set(cj.map((f) => f.rule_id)).size === CLICKJACKING_PAIR.size) {
+      const primary2 = [...cj].sort((a, b) => levelRank(a.level) - levelRank(b.level) || a.rule_id.localeCompare(b.rule_id))[0];
+      const labels = Array.from(new Set([
+        ...primary2.labels ?? [],
+        ...cj.flatMap((f) => [f.rule_id, ...f.labels ?? []])
+      ])).filter((l) => l !== primary2.rule_id);
+      out2.push({ ...primary2, labels });
+      bucket = bucket.filter((f) => !CLICKJACKING_PAIR.has(f.rule_id));
+      if (bucket.length === 0)
+        continue;
+      if (bucket.length === 1) {
+        out2.push(bucket[0]);
+        continue;
+      }
+    }
     const allNote = bucket.every((f) => f.level === "note");
     if (!allNote) {
       for (const f of bucket)
@@ -25596,6 +25616,8 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
   const sources = [];
   const lines = sourceCode.split(`
 `);
+  const isRouteHandler = /export\s+(?:async\s+)?(?:function\s+(?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|loader|action)\b|const\s+(?:GET|POST|PUT|PATCH|DELETE|loader|action)\b)/.test(sourceCode) && /\{[^}]*\bparams\b[^}]*\}/.test(sourceCode);
+  const patterns = isRouteHandler ? [...JS_TAINTED_PATTERNS, { pattern: /\bparams\s*[.[]/, type: "http_path" }] : JS_TAINTED_PATTERNS;
   for (let lineNum = 0;lineNum < lines.length; lineNum++) {
     const line = lines[lineNum];
     const lineNumber = lineNum + 1;
@@ -25603,7 +25625,7 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
     if (!assignmentMatch)
       continue;
     const [, varName, rhs] = assignmentMatch;
-    for (const { pattern, type } of JS_TAINTED_PATTERNS) {
+    for (const { pattern, type } of patterns) {
       if (pattern.test(rhs)) {
         const alreadyExists = sources.some((s) => s.line === lineNumber && s.type === type);
         if (!alreadyExists) {
@@ -47756,7 +47778,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.0.0";
+var version = "4.2.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.0.0",
+  "version": "4.2.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.0.0"
+    "circle-ir": "^4.2.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",