cognium-dev 4.10.0 → 4.12.0

package/dist/cli.js

@@ -9403,6 +9403,31 @@ function processStatement2(stmt, startDefId, startUseId, scopeStack, isJavaScrip
       }
       break;
     }
+    case "switch_expression":
+    case "switch_statement": {
+      const value = stmt.childForFieldName("condition") ?? stmt.childForFieldName("value");
+      if (value) {
+        const valueUses = extractUses(value, useId, scopeStack, isJavaScript);
+        uses.push(...valueUses.uses);
+        useId = valueUses.nextId;
+      }
+      const body2 = stmt.childForFieldName("body");
+      if (body2) {
+        scopeStack.push(new Map);
+        for (let i2 = 0;i2 < body2.childCount; i2++) {
+          const group = body2.child(i2);
+          if (!group)
+            continue;
+          const result = processBlock(group, defId, useId, scopeStack, isJavaScript);
+          defs.push(...result.defs);
+          uses.push(...result.uses);
+          defId = result.nextDefId;
+          useId = result.nextUseId;
+        }
+        scopeStack.pop();
+      }
+      break;
+    }
     case "block":
     case "statement_block": {
       scopeStack.push(new Map);
@@ -11404,6 +11429,7 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "ConcurrentHashMap", type: "plugin_param", severity: "high", return_tainted: true },
   { method: "get", class: "Hashtable", type: "plugin_param", severity: "high", return_tainted: true },
   { method: "get", class: "Properties", type: "config_param", severity: "high", return_tainted: true },
+  { method: "getProperty", class: "Properties", type: "config_param", severity: "high", return_tainted: true },
   { method: "getText", class: "Message", type: "io_input", severity: "high", return_tainted: true },
   { method: "getPayload", type: "io_input", severity: "high", return_tainted: true },
   { method: "getData", type: "io_input", severity: "high", return_tainted: true },
@@ -11986,8 +12012,8 @@ var DEFAULT_SINKS = [
   { method: "write", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "println", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "print", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  { method: "format", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
-  { method: "printf", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
+  { method: "format", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+  { method: "printf", class: "PrintWriter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
   { method: "write", class: "ServletOutputStream", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "print", class: "ServletOutputStream", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "println", class: "ServletOutputStream", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -20183,9 +20209,18 @@ class ConstantPropagator {
         }
       }
     } else {
+      const taintedBefore = new Set(this.tainted);
+      const taintedAfter = new Set(taintedBefore);
+      const wasInConditional = this.inConditionalBranch;
+      this.inConditionalBranch = true;
       for (const caseGroup of caseGroups) {
+        this.tainted = new Set(taintedBefore);
         this.visit(caseGroup);
+        for (const v of this.tainted)
+          taintedAfter.add(v);
       }
+      this.inConditionalBranch = wasInConditional;
+      this.tainted = taintedAfter;
     }
   }
   handleTernary(node) {
@@ -21260,7 +21295,11 @@ function annotationsInclude(annotations, targets) {
   return false;
 }
 function simpleTypeName(ref) {
-  return ref.replace(/<.*$/, "").trim();
+  const name2 = ref.replace(/<.*$/, "").trim();
+  return name2.substring(name2.lastIndexOf(".") + 1);
+}
+function isSupertypeLifecycleMethod(supertype, methodName) {
+  return TIER_1_BY_SUPERTYPE.get(simpleTypeName(supertype))?.has(methodName) ?? false;
 }
 function looksLikeMainMethod(method) {
   if (method.name !== "main")
@@ -21822,7 +21861,7 @@ function applyRequireEntryPath(fileAnalyses, options = {}) {
   if (graph.methodsByKey.size === 0)
     return;
   const fileContext = buildFileContext(fileAnalyses);
-  const entryPointKeys = collectEntryPointKeys(graph, fileContext);
+  const entryPointKeys = collectEntryPointKeys(graph, fileContext, indexTypesByName(fileAnalyses));
   const entryPointKeysByLanguage = countEntryPointKeysByLanguage(graph, entryPointKeys);
   const profileResolver = makeProfileResolver(options.projectProfile);
   for (const fa of fileAnalyses) {
@@ -21984,7 +22023,7 @@ function resolveCalleeKeys(call, methodsByKey, methodsByName) {
   }
   return candidates;
 }
-function collectEntryPointKeys(graph, fileContext) {
+function collectEntryPointKeys(graph, fileContext, typesByName) {
   const entryPoints = new Set;
   for (const rec of graph.methodsByKey.values()) {
     const fileCtx = fileContext.get(rec.file);
@@ -21995,11 +22034,48 @@ function collectEntryPointKeys(graph, fileContext) {
       calls: fileCtx?.calls ?? null,
       runtimeRegistrations: fileCtx?.runtimeRegistrations ?? null
     });
-    if (tier === "TIER_1_ENTRY_POINT")
+    if (tier === "TIER_1_ENTRY_POINT" || inheritsLifecycleEntry(rec.method.name, rec.enclosingType, typesByName)) {
       entryPoints.add(rec.key);
+    }
   }
   return entryPoints;
 }
+function indexTypesByName(fileAnalyses) {
+  const byName = new Map;
+  for (const fa of fileAnalyses) {
+    for (const t of fa.analysis.types ?? []) {
+      const list = byName.get(t.name) ?? [];
+      list.push(t);
+      byName.set(t.name, list);
+    }
+  }
+  return byName;
+}
+var simpleName = (ref) => {
+  const name2 = ref.replace(/<.*$/, "").trim();
+  return name2.substring(name2.lastIndexOf(".") + 1);
+};
+function inheritsLifecycleEntry(methodName, enclosingType, typesByName) {
+  if (!methodName || !enclosingType?.extends)
+    return false;
+  const seen = new Set([enclosingType]);
+  let frontier = typesByName.get(simpleName(enclosingType.extends)) ?? [];
+  for (let depth = 0;depth < 8 && frontier.length > 0; depth++) {
+    const next = [];
+    for (const ancestor of frontier) {
+      if (seen.has(ancestor))
+        continue;
+      seen.add(ancestor);
+      const supers = [ancestor.extends, ...ancestor.implements ?? []].filter((x) => !!x);
+      if (supers.some((sup) => isSupertypeLifecycleMethod(sup, methodName)))
+        return true;
+      if (ancestor.extends)
+        next.push(...typesByName.get(simpleName(ancestor.extends)) ?? []);
+    }
+    frontier = next;
+  }
+  return false;
+}
 function buildFileContext(fileAnalyses) {
   const out2 = new Map;
   for (const fa of fileAnalyses) {
@@ -26307,7 +26383,8 @@ class LanguageSourcesPass {
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
-      for (const finding of findJavaResponseWriterXssFindings(code, graph.ir.meta.file)) {
+      const xssSinkLines = new Set(ctx.getResult("taint-matcher").sinks.filter((s) => s.type === "xss").map((s) => s.line));
+      for (const finding of findJavaResponseWriterXssFindings(code, graph.ir.meta.file, xssSinkLines)) {
         ctx.addFinding(finding);
       }
       for (const finding of findJavaMongoNosqlInjectionFindings(code, graph.ir.meta.file)) {
@@ -27299,6 +27376,27 @@ function findPythonAssignmentSources(sourceCode, language) {
     const lineNumber = lineNum + 1;
     if (line.trimStart().startsWith("#"))
       continue;
+    const forTargetMatch = line.match(/^\s*for\s+([\p{L}\p{N}_]+)\s+in\s+(.+?)\s*:\s*$/u);
+    if (forTargetMatch) {
+      const [, iterVar, iterExpr] = forTargetMatch;
+      for (const { pattern, type } of PYTHON_TAINTED_PATTERNS2) {
+        if (!pattern.test(iterExpr))
+          continue;
+        const alreadyExists = sources.some((s2) => s2.line === lineNumber && s2.type === type);
+        if (!alreadyExists) {
+          sources.push({
+            type,
+            location: `for ${iterVar} in ${iterExpr.trim().substring(0, 50)}${iterExpr.length > 50 ? "..." : ""}`,
+            severity: "high",
+            line: lineNumber,
+            confidence: 0.95,
+            variable: iterVar
+          });
+        }
+        break;
+      }
+      continue;
+    }
     const assignmentMatch = line.match(/^(\s*\w[\w.]*)\s*(?::\s*\w[\w\[\], .]*)?\s*=\s*(.+)/);
     if (!assignmentMatch)
       continue;
@@ -30840,7 +30938,7 @@ function findGoXssFindings(code, file) {
   }
   return out2;
 }
-function findJavaResponseWriterXssFindings(code, file) {
+function findJavaResponseWriterXssFindings(code, file, taintSinkLines = new Set) {
   const out2 = [];
   const lines = code.split(`
 `);
@@ -30876,6 +30974,8 @@ function findJavaResponseWriterXssFindings(code, file) {
     const m = trimmed.match(chainRe);
     if (!m)
       continue;
+    if (taintSinkLines.has(i2 + 1))
+      continue;
     const recv = m[1];
     if (!respNames.has(recv))
       continue;
@@ -36572,6 +36672,103 @@ class SpeculativePromptParamSourcePass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/param-source-flow-gate-pass.js
+var EXEMPT_LANGUAGES = new Set(["java", "csharp"]);
+var ROUTE_ANNOTATION = /(?:^|[.\s@])(?:route|api_route|get|post|put|patch|delete|head|options|websocket|api_view|view_config|RequestMapping|GetMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping|All)\s*(?:\(|$)/i;
+var RUST_ROUTE_ATTR = /^\s*#\[\s*(?:[A-Za-z_][\w]*::)*(?:get|post|put|patch|delete|head|options|route|handler)\s*[(\]]/;
+var RUST_HANDLER_RETURN = /\b(?:HttpResponse|Responder|Reply|IntoResponse|Response(?:<[^>]*>)?)\b/;
+function enclosingMethod(methods, line) {
+  let best;
+  for (const m of methods) {
+    if (m.start_line <= line && line <= m.end_line) {
+      if (!best || m.end_line - m.start_line < best.end_line - best.start_line)
+        best = m;
+    }
+  }
+  return best;
+}
+function rustAttributesAbove(lines, startLine) {
+  const out2 = [];
+  for (let i2 = startLine - 2;i2 >= 0; i2--) {
+    const t = (lines[i2] ?? "").trim();
+    if (t.startsWith("#[")) {
+      out2.push(t);
+      continue;
+    }
+    if (t === "" || t.startsWith("//"))
+      continue;
+    break;
+  }
+  return out2;
+}
+function isFrameworkHandler(method, language, lines) {
+  if (method.annotations.some((a) => ROUTE_ANNOTATION.test(a)))
+    return true;
+  if (language === "rust") {
+    if (rustAttributesAbove(lines, method.start_line).some((a) => RUST_ROUTE_ATTR.test(a)))
+      return true;
+    if (method.return_type && RUST_HANDLER_RETURN.test(method.return_type))
+      return true;
+  }
+  return false;
+}
+
+class ParamSourceFlowGatePass {
+  keepParamSourcedFlows;
+  name = "param-source-flow-gate";
+  category = "security";
+  constructor(keepParamSourcedFlows) {
+    this.keepParamSourcedFlows = keepParamSourcedFlows;
+  }
+  run(ctx) {
+    const result = { applied: false, dropped: 0, droppedBySinkType: {} };
+    if (this.keepParamSourcedFlows || EXEMPT_LANGUAGES.has(ctx.language))
+      return result;
+    if (!ctx.hasResult("interprocedural"))
+      return result;
+    const flows = ctx.getResult("interprocedural").additionalFlows;
+    result.applied = true;
+    if (flows.length === 0)
+      return result;
+    const methods = ctx.graph.ir.types.flatMap((t) => t.methods);
+    const lines = ctx.code.split(`
+`);
+    const handlerCache = new Map;
+    const isHandler = (m) => {
+      let v = handlerCache.get(m);
+      if (v === undefined) {
+        v = isFrameworkHandler(m, ctx.language, lines);
+        handlerCache.set(m, v);
+      }
+      return v;
+    };
+    const realSourceLines = new Set;
+    if (ctx.hasResult("sink-filter")) {
+      const sources = ctx.getResult("sink-filter").sources;
+      for (const s of sources) {
+        if (s.type !== "interprocedural_param")
+          realSourceLines.add(s.line);
+      }
+    }
+    let w = 0;
+    for (const f of flows) {
+      let keep = true;
+      if (f.source_type === "interprocedural_param" && !realSourceLines.has(f.source_line)) {
+        const m = enclosingMethod(methods, f.source_line);
+        keep = m !== undefined && isHandler(m);
+      }
+      if (keep)
+        flows[w++] = f;
+      else {
+        result.dropped++;
+        result.droppedBySinkType[f.sink_type] = (result.droppedBySinkType[f.sink_type] ?? 0) + 1;
+      }
+    }
+    flows.length = w;
+    return result;
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
 var REFLECTION_SINK_METHODS = new Set([
   "forName",
@@ -37801,8 +37998,53 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
     const line = lines[i2];
     if (!line)
       continue;
-    if (reNaked.test(line) || reGuarded.test(line) || reSwitchCase.test(line))
+    if (reGuarded.test(line))
       return true;
+    if (!reNaked.test(line) && !reSwitchCase.test(line))
+      continue;
+    if (switchAlsoAssignsNonLiteral(lines, i2, variable, strLit))
+      continue;
+    return true;
+  }
+  return false;
+}
+function switchAlsoAssignsNonLiteral(lines, idx, variable, strLit) {
+  let depth = 0;
+  let start2 = -1;
+  for (let i2 = idx;i2 >= 0; i2--) {
+    const line = lines[i2];
+    for (let c = line.length - 1;c >= 0; c--) {
+      if (line[c] === "}")
+        depth++;
+      else if (line[c] === "{")
+        depth--;
+    }
+    if (depth < 0) {
+      if (/\bswitch\b/.test(line))
+        start2 = i2;
+      break;
+    }
+  }
+  if (start2 < 0)
+    return false;
+  const assign = new RegExp(`(?:^|[^\\w.$])${variable}\\s*(?::?=)(?!=)\\s*(.*?)\\s*;?\\s*(?:break\\s*;?)?\\s*$`);
+  const literalOnly = new RegExp(`^${strLit}$`);
+  depth = 0;
+  for (let i2 = start2;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (i2 > start2 || line.includes("{")) {
+      const m = assign.exec(line);
+      if (m && m[1] && !literalOnly.test(m[1]))
+        return true;
+    }
+    for (const ch of line) {
+      if (ch === "{")
+        depth++;
+      else if (ch === "}")
+        depth--;
+    }
+    if (i2 > start2 && depth <= 0)
+      break;
   }
   return false;
 }
@@ -43827,6 +44069,13 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Revoke the GitHub refresh token and store secrets outside source control."
   },
+  {
+    name: "GitLab personal access token",
+    regex: /\bglpat-[A-Za-z0-9_-]{20,}\b/,
+    severity: "critical",
+    level: "error",
+    fix: "Revoke the GitLab personal access token and store it outside source control."
+  },
   {
     name: "Stripe live secret key",
     regex: /\bsk_live_[A-Za-z0-9]{24,}\b/,
@@ -43834,6 +44083,13 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Rotate the Stripe secret key in the Stripe Dashboard and load it from a secrets manager."
   },
+  {
+    name: "Stripe live restricted key",
+    regex: /\brk_live_[A-Za-z0-9]{24,}\b/,
+    severity: "critical",
+    level: "error",
+    fix: "Rotate the Stripe restricted key in the Stripe Dashboard and load it from a secrets manager."
+  },
   {
     name: "Stripe live publishable key",
     regex: /\bpk_live_[A-Za-z0-9]{24,}\b/,
@@ -44185,6 +44441,9 @@ class ScanSecretsPass {
         const m = pattern.regex.exec(lineText);
         if (!m)
           continue;
+        if ((pattern.name === "Stripe live restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
+          continue;
+        }
         if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
           continue;
         }
@@ -49424,6 +49683,8 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
     }));
+    if (!disabledPasses.has("param-source-flow-gate"))
+      pipeline.add(new ParamSourceFlowGatePass(options.speculativeParamSources === true));
     if (!disabledPasses.has("library-profile-cwe22-path-gate"))
       pipeline.add(new LibraryProfileCwe22PathGatePass);
     if (!disabledPasses.has("scan-secrets"))
@@ -50874,7 +51135,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.10.0";
+var version = "4.12.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -51426,8 +51687,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "598f8fc",
-  builtAt: "2026-10-02T23:23:28.653Z"
+  gitSha: "8c284bc",
+  builtAt: "2026-10-08T00:42:12.776Z"
 };
 
 // src/utils/args.ts
@@ -51678,7 +51939,7 @@ function loadConfig(profilePath) {
     const content = readFileSync(configPath, "utf-8");
     return JSON.parse(content);
   } catch (err2) {
-    throw new Error(`Failed to parse ${configPath}: ${err2 instanceof Error ? err2.message : String(err2)}. ` + "Fix the JSON or remove the file.");
+    throw new Error(`Failed to parse ${configPath}: ${err2 instanceof Error ? err2.message : String(err2)}. ` + "Fix the JSON or remove the file.", { cause: err2 });
   }
 }
 function convertConfigToPassOptions(config) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.10.0",
+  "version": "4.12.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -65,10 +65,10 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.10.0"
+    "circle-ir": "4.12.0"
   },
   "devDependencies": {
-    "@types/node": "^26.6.2",
+    "@types/node": "^26.6.4",
     "ajv": "^8.17.1",
     "ajv-draft-04": "^1.0.0",
     "bun-types": "^1.4.2",