cognium-dev 4.13.0 → 4.13.1

package/dist/cli.js

@@ -20039,7 +20039,13 @@ class ConstantPropagator {
       }
       return;
     }
-    const condValue = this.evaluateExpression(condition);
+    let condValue = this.evaluateExpression(condition);
+    if (!(isKnown(condValue) && condValue.type === "bool")) {
+      const literal = this.literalCondition(condition);
+      if (literal !== null) {
+        condValue = { type: "bool", value: literal, sourceLine: getNodeLine(condition) };
+      }
+    }
     if (isKnown(condValue) && condValue.type === "bool") {
       if (condValue.value === true) {
         if (alternative) {
@@ -20188,12 +20194,27 @@ class ConstantPropagator {
       }
       return;
     }
-    const caseGroups = switchBlock.children.filter((c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section");
+    const caseGroups = switchBlock.children.filter((c) => c.type === "switch_block_statement_group" || c.type === "switch_rule" || c.type === "switch_section" || c.type === "switch_case" || c.type === "switch_default");
+    if (caseGroups.length === 0) {
+      this.visit(switchBlock);
+      return;
+    }
     if (switchValue && isKnown(switchValue)) {
       let matchingIdx = -1;
       let defaultIdx = -1;
       for (let i2 = 0;i2 < caseGroups.length; i2++) {
         const caseGroup = caseGroups[i2];
+        if (caseGroup.type === "switch_default") {
+          defaultIdx = i2;
+          continue;
+        }
+        if (caseGroup.type === "switch_case") {
+          const label = caseGroup.childForFieldName("value");
+          const caseValue = label ? this.literalValue(label) : null;
+          if (caseValue !== null && caseValue === switchValue.value)
+            matchingIdx = i2;
+          continue;
+        }
         for (const child of caseGroup.children) {
           if (child.type === "switch_label") {
             const labelText = getNodeText2(child, this.source);
@@ -20297,6 +20318,30 @@ class ConstantPropagator {
     }
     return false;
   }
+  literalCondition(node) {
+    if (node.type === "parenthesized_expression") {
+      const inner = node.children.find((c) => c.isNamed);
+      return inner ? this.literalCondition(inner) : null;
+    }
+    if (node.type === "boolean_literal") {
+      const text = getNodeText2(node, this.source);
+      return text === "true" ? true : text === "false" ? false : null;
+    }
+    if (node.type === "binary_expression") {
+      const left = node.childForFieldName("left");
+      const right = node.childForFieldName("right");
+      const op = node.childForFieldName("operator");
+      const opText = op ? getNodeText2(op, this.source) : "";
+      if (!left || !right || opText !== "==" && opText !== "!=")
+        return null;
+      const l = this.literalValue(left);
+      const r = this.literalValue(right);
+      if (l === null || r === null)
+        return null;
+      return opText === "==" ? l === r : l !== r;
+    }
+    return null;
+  }
   literalValue(node) {
     const text = getNodeText2(node, this.source);
     if (node.type === "integer_literal" || node.type === "decimal_integer_literal") {
@@ -34134,6 +34179,9 @@ var ENDS_STATEMENT_RE = /[;{}]\s*(?:\/\/.*)?$/;
 function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function withoutStringLiterals(text) {
+  return text.replace(/@"(?:[^"]|"")*"|"(?:[^"\\]|\\.)*"/g, '""');
+}
 function mentions(text, name2) {
   return new RegExp(`(?<![\\w])${escapeRegex(name2)}(?![\\w])`).test(text);
 }
@@ -34147,6 +34195,19 @@ function insideParens(text, open) {
   }
   return null;
 }
+function lastCallArguments(text) {
+  const close = text.lastIndexOf(")");
+  if (close < 0)
+    return null;
+  let depth = 0;
+  for (let i2 = close;i2 >= 0; i2--) {
+    if (text[i2] === ")")
+      depth++;
+    else if (text[i2] === "(" && --depth === 0)
+      return text.slice(i2 + 1, close);
+  }
+  return null;
+}
 function leadingIf(text) {
   const m = /^\s*(?:\}\s*)?(?:else\s+)?if\s*\(/.exec(text);
   if (!m)
@@ -34271,6 +34332,65 @@ class CSharpCredit {
   sanitizedVarsAt(type, sinkLine) {
     return this.sanitizedVarsIn(type, this.methodAt(sinkLine)?.start_line ?? 1, sinkLine, true);
   }
+  rawTaintReaches(type, sinkLine, credited, seeds) {
+    if (seeds.length === 0)
+      return false;
+    const method = this.methodAt(sinkLine);
+    const from = method?.start_line ?? 1;
+    const tainted = new Set;
+    const stmts = this.statements(from, sinkLine);
+    for (let i2 = 0;i2 < stmts.length; i2++) {
+      const st = stmts[i2];
+      const end = i2 + 1 < stmts.length ? stmts[i2 + 1].line : sinkLine;
+      const m = ASSIGN_RE.exec(st.text);
+      if (m) {
+        const rhs = withoutStringLiterals(m[2]);
+        if ([...tainted].some((v) => mentions(rhs, v)))
+          tainted.add(m[1]);
+        else
+          tainted.delete(m[1]);
+      }
+      for (const s of seeds)
+        if (s.line >= st.line && s.line < end)
+          tainted.add(s.variable);
+    }
+    if (tainted.size === 0)
+      return false;
+    const call = withoutStringLiterals(this.sinkText(sinkLine));
+    const rest = this.withoutSanitizerCalls(type, lastCallArguments(call) ?? call);
+    if (this.builtinSanitizes(type, rest))
+      return false;
+    for (const v of tainted)
+      if (!credited.has(v) && mentions(rest, v))
+        return true;
+    return false;
+  }
+  withoutSanitizerCalls(type, text) {
+    const res = [];
+    for (const { re, type: t } of CSHARP_SANITIZER_RES)
+      if (t === type)
+        res.push(re);
+    for (const name2 of this.helpers(type))
+      res.push(new RegExp(`(?<![\\w.])${escapeRegex(name2)}\\s*\\(`));
+    let out2 = text;
+    for (const re of res) {
+      for (let guard = 0;guard < 16; guard++) {
+        const m = re.exec(out2);
+        if (!m)
+          break;
+        if (!m[0].endsWith("(")) {
+          out2 = out2.slice(0, m.index) + out2.slice(m.index + m[0].length);
+          continue;
+        }
+        const open = m.index + m[0].length - 1;
+        const inner = insideParens(out2, open);
+        if (inner === null)
+          break;
+        out2 = out2.slice(0, m.index) + out2.slice(open + inner.length + 2);
+      }
+    }
+    return out2;
+  }
   sinkText(line) {
     const text = this.lines[line - 1] ?? "";
     const guarded = leadingIf(text);
@@ -34463,21 +34583,19 @@ class CSharpCredit {
     }
     return new Set([...state].filter(([, safe]) => safe).map(([name2]) => name2));
   }
-  creditedOnLine(line) {
+  creditedOnLine(line, seeds = []) {
     const text = this.sinkText(line);
     const types = new Set(CSHARP_SANITIZER_RES.map((r) => r.type));
     for (const t of INERT_WHEN_ALPHANUMERIC)
       types.add(t);
     types.add("ssrf");
     for (const type of types) {
-      if (this.sanitizes(type, text))
-        return true;
       const credited = new Set([...this.sanitizedVarsAt(type, line), ...this.guardedVarsAt(type, line)]);
       for (const v of this.safeBuilders(credited, line))
         credited.add(v);
-      for (const v of credited)
-        if (mentions(text, v))
-          return true;
+      const covered = this.sanitizes(type, text) || [...credited].some((v) => mentions(text, v));
+      if (covered && !this.rawTaintReaches(type, line, credited, seeds))
+        return true;
     }
     return this.fixedHostRequest(line);
   }
@@ -35764,13 +35882,13 @@ class SinkFilterPass {
       const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
       const csFields = new Set(ctx.graph.ir.types.flatMap((t) => (t.fields ?? []).map((f) => f.name)));
       const credit = new CSharpCredit(ctx.code, ctx.graph.ir.types.flatMap((t) => t.methods));
+      const csSeeds = mergedSources.flatMap((s) => s.variable ? [{ variable: s.variable, line: s.line }] : []);
       const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
         if (sink.type === "xxe" && xxeHardened)
           return false;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        if (credit.sanitizes(sink.type, sinkLineText))
-          return false;
+        const inlineSanitized = credit.sanitizes(sink.type, sinkLineText);
         if (sink.type === "ssrf" && credit.fixedHostRequest(sink.line))
           return false;
         const scoped = credit.sanitizedVarsAt(sink.type, sink.line);
@@ -35786,11 +35904,8 @@ class SinkFilterPass {
         for (const v of credit.safeBuilders(sanitizedVars, sink.line))
           sanitizedVars.add(v);
         const received = credit.sinkText(sink.line);
-        for (const v of sanitizedVars) {
-          if (new RegExp(`(?<![\\w])${escapeRegex2(v)}(?![\\w])`).test(received))
-            return false;
-        }
-        return true;
+        const covered = inlineSanitized || [...sanitizedVars].some((v) => new RegExp(`(?<![\\w])${escapeRegex2(v)}(?![\\w])`).test(received));
+        return !covered || credit.rawTaintReaches(sink.type, sink.line, sanitizedVars, csSeeds);
       });
     }
     if (language === "csharp") {
@@ -40364,9 +40479,10 @@ class InterproceduralPass {
       });
     }
     if (csCredit) {
+      const csSeeds = sources.flatMap((s) => s.variable ? [{ variable: s.variable, line: s.line }] : []);
       const credited = new Set;
       filteredAdditionalFlows = filteredAdditionalFlows.filter((f) => {
-        if (f.sink_type !== "external_taint_escape" || !csCredit.creditedOnLine(f.sink_line))
+        if (f.sink_type !== "external_taint_escape" || !csCredit.creditedOnLine(f.sink_line, csSeeds))
           return true;
         credited.add(f.sink_line);
         return false;
@@ -51854,7 +51970,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.13.0";
+var version = "4.13.1";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -52406,8 +52522,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "a45b21b",
-  builtAt: "2026-10-08T13:38:40.827Z"
+  gitSha: "51b2da7",
+  builtAt: "2026-10-08T18:47:29.958Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.13.0",
+  "version": "4.13.1",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.13.0"
+    "circle-ir": "4.13.1"
   },
   "devDependencies": {
     "@types/node": "^26.6.4",