cognium-dev 4.13.1 → 4.14.0

package/README.md

@@ -307,9 +307,9 @@ Filter to security findings only: `cognium-dev scan ./src --category security`
 | Rust | `.rs` | Actix-web, Rocket, Axum |
 | Bash | `.sh`, `.bash` | Shell scripts |
 | HTML | `.html`, `.htm` | Web extraction preprocessor |
-| C#/.NET _(experimental)_ | `.cs` | ASP.NET Core, ADO.NET, EF Core |
+| C#/.NET _(Preview)_ | `.cs` | ASP.NET Core, ADO.NET (EF Core not yet verified) |
 
-> **C#/.NET is experimental / preview** (since 4.0.0). Straight-line taint
+> **C#/.NET is Preview** (since 4.0.0). Straight-line taint
 > analysis across 10 CWE families (SQLi, command injection, path traversal,
 > SSRF, code injection, XSS, deserialization, LDAP, XPath, XXE). Not yet
 > benchmark-verified — expect gaps in branch/alias precision and detector breadth.
@@ -455,15 +455,9 @@ Cognium is built for speed:
 - **Core Engine**: [circle-ir](https://github.com/cogniumhq/cognium-dev/tree/main/packages/circle-ir) - High-performance SAST library
 - **Dependencies**: Only 1 runtime dependency (circle-ir)
 
-## LLM Enhancement (Optional)
+## Data handling
 
-The core static analysis engine runs deterministically without any LLM. Optionally, you can enable LLM-based discovery modes for enhanced detection:
-
-- **Discovery Mode**: LLM reads source code to locate vulnerable methods from scratch
-- **Verification Mode**: Confirms whether static findings are actually exploitable
-- **Semantic Extraction**: Extracts design intent for automated gap analysis
-
-For details on LLM integration and benchmark improvements (42.5% → 78.3% on CWE-Bench with Claude Opus), visit [cognium.net](https://cognium.net).
+cognium-dev is fully deterministic and runs entirely on your machine: source code is not sent to Cognium or any third-party service. Optional AI-assisted analysis is a separate product, [cognium-ai](https://cognium.net), which can send code snippets to a configured model endpoint; use cognium-dev (or cognium-ai with AI-assisted mode off and no remote engine configured) for air-gapped scanning.
 
 ## Benchmark Results
 

package/dist/cli.js

@@ -5515,6 +5515,14 @@ function csharpBareName(node) {
   }
   return getNodeText(node);
 }
+function csharpCreatedSimpleType(creation) {
+  const typeNode = creation.childForFieldName("type");
+  if (!typeNode)
+    return null;
+  const bare = csharpBareName(typeNode).replace(/<[^>]*>/g, "");
+  const simple = bare.split(".").pop()?.trim() ?? "";
+  return simple && simple !== "var" ? simple : null;
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -5523,11 +5531,15 @@ function extractCSharpCalls(tree, cache) {
     const fn = inv.childForFieldName("function");
     let methodName = "unknown";
     let receiver = null;
+    let receiverTypeFromCreation = null;
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
       methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
+      if (exprNode?.type === "object_creation_expression") {
+        receiverTypeFromCreation = csharpCreatedSimpleType(exprNode);
+      }
     } else if (fn) {
       methodName = csharpBareName(fn);
     }
@@ -5545,7 +5557,7 @@ function extractCSharpCalls(tree, cache) {
     calls.push({
       method_name: methodName,
       receiver,
-      receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
+      receiver_type: receiverTypeFromCreation ?? (receiver ? typeMap.get(receiver) ?? null : null),
       receiver_type_fqn: null,
       arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
@@ -11410,6 +11422,7 @@ var DEFAULT_SOURCES = [
   { method: "getFileName", class: "MimeBodyPart", type: "file_input", severity: "high", return_tainted: true },
   { method: "getDisposition", class: "Part", type: "file_input", severity: "medium", return_tainted: true },
   { method: "getName", class: "ZipEntry", type: "file_input", severity: "high", return_tainted: true },
+  { method: "getName", class: "JarEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ZipArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "TarArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
@@ -11858,7 +11871,7 @@ var DEFAULT_SINKS = [
   { method: "checkout", class: "SCM", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "retrieve", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "add", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "CpsFlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  { method: "CpsFlowExecution", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "CpsFlowDefinition", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "FlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "processControlCommand", class: "TransportConnection", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
@@ -14009,12 +14022,14 @@ function isInterproceduralTaintableType(typeName, language) {
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection")
     return false;
-  const queryArg = call.arguments.find((a) => a.position === 0);
+  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
     const hasPlaceholders = /(\?(?:\s|,|$|\))|\$\d+|:\w+|%s)/.test(queryText);
     const hasConcatenation = /\+\s*[^+]/.test(queryText) || queryText.includes("${");
-    if (hasPlaceholders && !hasConcatenation && call.arguments.length >= 2) {
+    const hasBoundArg = queryPos === 0 ? call.arguments.length >= 2 : call.arguments.some((a) => a.position > queryPos);
+    if (hasPlaceholders && !hasConcatenation && hasBoundArg) {
       return true;
     }
   }
@@ -14757,6 +14772,17 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
+function isArgumentlessJsResponseWriter(call, pattern, language) {
+  if (pattern.type !== "xss" || pattern.class !== "Response")
+    return false;
+  if (language !== "javascript" && language !== "typescript")
+    return false;
+  const positions = pattern.arg_positions;
+  if (!positions || positions.length === 0)
+    return false;
+  const argc = call.arguments?.length ?? 0;
+  return positions.every((pos) => pos >= argc);
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
   const patternsForLanguage = language === undefined ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = new Map;
@@ -14817,6 +14843,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (isArgumentlessJsResponseWriter(call, pattern, language)) {
+          continue;
+        }
         if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }
@@ -24259,6 +24288,17 @@ class VuePlugin extends BaseLanguagePlugin {
 }
 
 // ../circle-ir/dist/languages/plugins/go.js
+function sqlSinks(cls, methods) {
+  return methods.map(([method, argPositions]) => ({
+    method,
+    class: cls,
+    type: "sql_injection",
+    cwe: "CWE-89",
+    severity: "critical",
+    argPositions
+  }));
+}
+
 class GoPlugin extends BaseLanguagePlugin {
   id = "go";
   name = "Go";
@@ -24443,6 +24483,32 @@ class GoPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
+      ...sqlSinks("DB", [
+        ["QueryContext", [1]],
+        ["QueryRowContext", [1]],
+        ["ExecContext", [1]],
+        ["Prepare", [0]],
+        ["PrepareContext", [1]]
+      ]),
+      ...sqlSinks("Tx", [
+        ["Exec", [0]],
+        ["QueryRow", [0]],
+        ["QueryContext", [1]],
+        ["QueryRowContext", [1]],
+        ["ExecContext", [1]],
+        ["Prepare", [0]],
+        ["PrepareContext", [1]]
+      ]),
+      ...sqlSinks("Conn", [
+        ["Query", [0]],
+        ["QueryRow", [0]],
+        ["Exec", [0]],
+        ["QueryContext", [1]],
+        ["QueryRowContext", [1]],
+        ["ExecContext", [1]],
+        ["Prepare", [0]],
+        ["PrepareContext", [1]]
+      ]),
       {
         method: "Command",
         class: "exec",
@@ -34356,8 +34422,7 @@ class CSharpCredit {
     }
     if (tainted.size === 0)
       return false;
-    const call = withoutStringLiterals(this.sinkText(sinkLine));
-    const rest = this.withoutSanitizerCalls(type, lastCallArguments(call) ?? call);
+    const rest = this.withoutSanitizerCalls(type, this.receivedOperands(type, sinkLine));
     if (this.builtinSanitizes(type, rest))
       return false;
     for (const v of tainted)
@@ -34365,6 +34430,23 @@ class CSharpCredit {
         return true;
     return false;
   }
+  receivedOperands(type, sinkLine) {
+    const text = withoutStringLiterals(this.sinkText(sinkLine)).replace(/\s*;?\s*(?:\/\/.*)?$/, "");
+    const property = /^\s*[A-Za-z_][\w.]*\.[A-Za-z_]\w*\s*=(?!=)\s*(.*)$/.exec(text);
+    if (property)
+      return property[1];
+    if (!text.endsWith(")"))
+      return text;
+    const args2 = lastCallArguments(text);
+    if (args2 === null)
+      return text;
+    const open = text.length - args2.length - 2;
+    const callStart = text.slice(0, open).search(/[A-Za-z_][\w.]*\s*$/);
+    const lastCall = callStart < 0 ? "" : text.slice(callStart);
+    if (lastCall && this.withoutSanitizerCalls(type, lastCall).trim() === "")
+      return text;
+    return args2;
+  }
   withoutSanitizerCalls(type, text) {
     const res = [];
     for (const { re, type: t } of CSHARP_SANITIZER_RES)
@@ -39931,6 +40013,8 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     "QueryRowContext",
     "Exec",
     "ExecContext",
+    "Prepare",
+    "PrepareContext",
     "EscapeString",
     "HTMLEscapeString",
     "JSEscapeString",
@@ -44864,7 +44948,7 @@ function isGeneratedFile(file) {
 var PROVIDER_PATTERNS = [
   {
     name: "AWS access key",
-    regex: /\bAKIA[0-9A-Z]{16}\b/,
+    regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,
     severity: "critical",
     level: "error",
     fix: "Rotate the AWS access key immediately and move it to an environment variable or AWS Secrets Manager."
@@ -44932,6 +45016,20 @@ var PROVIDER_PATTERNS = [
     level: "warning",
     fix: "Publishable keys are not secret but should still not be checked in to back-end source files; verify front-end vs back-end context."
   },
+  {
+    name: "Stripe test secret key",
+    regex: /\bsk_test_[A-Za-z0-9]{24,}\b/,
+    severity: "high",
+    level: "warning",
+    fix: "Rotate the Stripe test secret key in the Stripe Dashboard and load it from a secrets manager."
+  },
+  {
+    name: "Stripe test restricted key",
+    regex: /\brk_test_[A-Za-z0-9]{24,}\b/,
+    severity: "high",
+    level: "warning",
+    fix: "Rotate the Stripe test restricted key in the Stripe Dashboard and load it from a secrets manager."
+  },
   {
     name: "OpenAI API key",
     regex: /\bsk-[A-Za-z0-9]{48}\b/,
@@ -45276,7 +45374,7 @@ class ScanSecretsPass {
         const m = pattern.regex.exec(lineText);
         if (!m)
           continue;
-        if ((pattern.name === "Stripe live restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
+        if ((pattern.name === "Stripe live restricted key" || pattern.name === "Stripe test secret key" || pattern.name === "Stripe test restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
           continue;
         }
         if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
@@ -50380,6 +50478,27 @@ function longestLineLength(code) {
   return max;
 }
 var MAX_ANALYZABLE_LINE_LENGTH = 1e4;
+function neutralizeOverlongLines(code) {
+  if (longestLineLength(code) <= MAX_ANALYZABLE_LINE_LENGTH) {
+    return { code, dropped: 0 };
+  }
+  let out2 = "";
+  let start2 = 0;
+  let dropped = 0;
+  for (let i2 = 0;i2 <= code.length; i2++) {
+    if (i2 !== code.length && code.charCodeAt(i2) !== 10)
+      continue;
+    if (i2 - start2 > MAX_ANALYZABLE_LINE_LENGTH)
+      dropped++;
+    else if (i2 > start2)
+      out2 += code.slice(start2, i2);
+    if (i2 < code.length)
+      out2 += `
+`;
+    start2 = i2 + 1;
+  }
+  return { code: out2, dropped };
+}
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
@@ -50398,6 +50517,15 @@ async function analyze(code, filePath, language, options = {}) {
       parseGrammar = "tsx";
     }
   }
+  const neutralized = neutralizeOverlongLines(code);
+  if (neutralized.dropped > 0) {
+    logger.warn("Neutralized over-long lines before analysis", {
+      filePath,
+      language,
+      droppedLines: neutralized.dropped
+    });
+    code = neutralized.code;
+  }
   logger.debug("Analyzing file", { filePath, language, parseGrammar, codeLength: code.length });
   const phaseTimingEnabled = globalThis.__circleIrPassTiming === true;
   const phaseStart = () => phaseTimingEnabled ? Date.now() : 0;
@@ -51970,7 +52098,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.13.1";
+var version = "4.14.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -52431,6 +52559,21 @@ function formatSARIF(results, crossFileData, profileSummary) {
           }
         },
         results: generateSarifResults(results, crossFileData),
+        ...crossFileData?.projectSizeBudgetExceeded ? {
+          invocations: [
+            {
+              executionSuccessful: false,
+              toolExecutionNotifications: [
+                {
+                  level: "warning",
+                  message: {
+                    text: `Project size ceiling reached — analysed ${crossFileData.filesAnalysed ?? "?"} of ${crossFileData.filesTotal ?? "?"} files.`
+                  }
+                }
+              ]
+            }
+          ]
+        } : {},
         ...profileSummary ? { properties: { projectProfile: profileSummary } } : {}
       }
     ]
@@ -52522,8 +52665,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "51b2da7",
-  builtAt: "2026-10-08T18:47:29.958Z"
+  gitSha: "c44e104",
+  builtAt: "2026-10-11T06:19:30.837Z"
 };
 
 // src/utils/args.ts
@@ -52765,6 +52908,38 @@ function spinner(text) {
 }
 
 // src/cli.ts
+function collapseWs(s) {
+  return s.replace(/\s+/g, " ").trim();
+}
+function fileMatches(suppFile, findingFile, basePath) {
+  const wanted = suppFile.replace(/^\.\//, "");
+  const relativeFile = relative4(basePath, findingFile) || findingFile;
+  return wanted === relativeFile || wanted === findingFile;
+}
+function findingMatchesSuppression(supp, finding, basePath, lineAt) {
+  if (supp.pass !== finding.pass && supp.pass !== finding.alsoPass)
+    return false;
+  if (supp.file && !fileMatches(supp.file, finding.file, basePath))
+    return false;
+  const snippet = supp.snippet ? collapseWs(supp.snippet) : "";
+  if (snippet) {
+    const fromFile = lineAt?.(finding.file, finding.line);
+    const text = fromFile !== undefined ? fromFile : finding.lineText;
+    return text !== undefined && collapseWs(text).includes(snippet);
+  }
+  if (supp.line !== undefined && supp.line !== finding.line)
+    return false;
+  return true;
+}
+function staleSuppressions(suppressions, matched) {
+  return suppressions.filter((_, i2) => !matched.has(i2));
+}
+function reportStaleSuppressions(suppressions, matched) {
+  for (const supp of staleSuppressions(suppressions, matched)) {
+    const where = [supp.file, supp.snippet ? "snippet" : "", supp.line !== undefined && !supp.snippet ? `line ${supp.line}` : ""].filter(Boolean).join(" ");
+    console.error(colors.dim(`Suppression for ${supp.pass}${where ? ` (${where})` : ""} matched no finding`));
+  }
+}
 function loadConfig(profilePath) {
   const configPath = profilePath || "cognium.config.json";
   if (!existsSync(configPath)) {
@@ -52817,22 +52992,15 @@ function convertConfigToPassOptions(config) {
   }
   return { passOptions, disabledPasses };
 }
-function applySuppressionsToResults(results, suppressions, basePath) {
+function applySuppressionsToResults(results, suppressions, basePath, match) {
   if (suppressions.length === 0)
     return results;
   return results.map((result) => {
-    const relativeFile = relative4(basePath, result.file) || result.file;
     const filteredVulns = result.vulnerabilities.filter((vuln) => {
-      for (const supp of suppressions) {
-        if (supp.pass !== vuln.type)
-          continue;
-        if (supp.file) {
-          const suppFile = supp.file.replace(/^\.\//, "");
-          if (suppFile !== relativeFile && suppFile !== result.file)
-            continue;
-        }
-        if (supp.line !== undefined && supp.line !== vuln.line)
+      for (let i2 = 0;i2 < suppressions.length; i2++) {
+        if (!findingMatchesSuppression(suppressions[i2], { pass: vuln.type, file: result.file, line: vuln.line }, basePath, match?.lineAt))
           continue;
+        match?.matched?.add(i2);
         return false;
       }
       return true;
@@ -52840,22 +53008,20 @@ function applySuppressionsToResults(results, suppressions, basePath) {
     return { ...result, vulnerabilities: filteredVulns };
   });
 }
-function applySuppressionsToTaintPaths(paths, suppressions, basePath) {
+function applySuppressionsToTaintPaths(paths, suppressions, basePath, match) {
   if (suppressions.length === 0)
     return paths;
   return paths.filter((path) => {
-    for (const supp of suppressions) {
-      const sinkType = path.sink.type;
-      if (supp.pass !== sinkType && supp.pass !== `cross-file-${sinkType}`)
-        continue;
-      if (supp.file) {
-        const suppFile = supp.file.replace(/^\.\//, "");
-        const relativeFile = relative4(basePath, path.sink.file) || path.sink.file;
-        if (suppFile !== relativeFile && suppFile !== path.sink.file)
-          continue;
-      }
-      if (supp.line !== undefined && supp.line !== path.sink.line)
-        continue;
+    for (let i2 = 0;i2 < suppressions.length; i2++) {
+      if (!findingMatchesSuppression(suppressions[i2], {
+        pass: path.sink.type,
+        alsoPass: `cross-file-${path.sink.type}`,
+        file: path.sink.file,
+        line: path.sink.line,
+        lineText: path.sink.code
+      }, basePath, match?.lineAt))
+        continue;
+      match?.matched?.add(i2);
       return false;
     }
     return true;
@@ -53378,14 +53544,35 @@ async function runScan(targetPath, options) {
     }
     if (suppressions.length > 0) {
       const beforeCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0) + (crossFileData?.taintPaths.length ?? 0);
-      results = applySuppressionsToResults(results, suppressions, process.cwd());
+      const matched = new Set;
+      const needsLines = suppressions.some((s) => s.snippet && collapseWs(s.snippet).length > 0);
+      const lineCache = new Map;
+      const lineAt = needsLines ? (file, line) => {
+        let lines = lineCache.get(file);
+        if (lines === undefined) {
+          try {
+            lines = readFileSync(file, "utf-8").split(`
+`);
+          } catch {
+            lines = null;
+          }
+          lineCache.set(file, lines);
+        }
+        if (!lines || line < 1)
+          return;
+        return lines[line - 1];
+      } : undefined;
+      const match = { lineAt, matched };
+      results = applySuppressionsToResults(results, suppressions, process.cwd(), match);
       if (crossFileData) {
-        crossFileData.taintPaths = applySuppressionsToTaintPaths(crossFileData.taintPaths, suppressions, process.cwd());
+        crossFileData.taintPaths = applySuppressionsToTaintPaths(crossFileData.taintPaths, suppressions, process.cwd(), match);
       }
       const afterCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0) + (crossFileData?.taintPaths.length ?? 0);
       if (!options.quiet && beforeCount !== afterCount) {
         console.error(colors.dim(`Suppressed ${beforeCount - afterCount} finding(s) via config`));
       }
+      if (!options.quiet)
+        reportStaleSuppressions(suppressions, matched);
     }
     const severityOrder = ["low", "medium", "high", "critical"];
     if (options.severity) {
@@ -54018,7 +54205,9 @@ main().catch((error) => {
   process.exit(2);
 });
 export {
+  staleSuppressions,
   resolveScanLanguage,
+  reportStaleSuppressions,
   matchesGlob,
   loadConfig,
   isTestFile2 as isTestFile,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.13.1",
+  "version": "4.14.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.13.1"
+    "circle-ir": "4.14.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.4",