cognium-dev 4.14.0 → 4.14.1

package/dist/cli.js

@@ -9641,6 +9641,38 @@ function extractFieldDefs(body2, startId) {
 function extractJSParameterDefs(params, startId) {
   const defs = [];
   let id = startId;
+  const addPatternDefs = (patternNode, line) => {
+    if (patternNode.type === "identifier" || patternNode.type === "shorthand_property_identifier_pattern") {
+      defs.push({
+        id: id++,
+        variable: getNodeText(patternNode),
+        line,
+        kind: "param"
+      });
+      return;
+    }
+    if (patternNode.type === "rest_pattern" || patternNode.type === "rest_element") {
+      const nameNode = patternNode.namedChildCount > 0 ? patternNode.namedChild(0) : null;
+      if (!nameNode)
+        return;
+      addPatternDefs(nameNode, line);
+      return;
+    }
+    if (patternNode.type === "assignment_pattern") {
+      const leftNode = patternNode.childForFieldName("left");
+      if (leftNode)
+        addPatternDefs(leftNode, line);
+      return;
+    }
+    if (patternNode.type === "object_pattern" || patternNode.type === "array_pattern") {
+      const destructDefs = extractDestructuringDefs(patternNode, id);
+      for (const def of destructDefs) {
+        def.kind = "param";
+        defs.push(def);
+        id++;
+      }
+    }
+  };
   for (let i2 = 0;i2 < params.childCount; i2++) {
     const param = params.child(i2);
     if (!param)
@@ -9690,14 +9722,8 @@ function extractJSParameterDefs(params, startId) {
       }
     } else if (param.type === "required_parameter" || param.type === "optional_parameter") {
       const patternNode = param.childForFieldName("pattern");
-      if (patternNode && patternNode.type === "identifier") {
-        defs.push({
-          id: id++,
-          variable: getNodeText(patternNode),
-          line: param.startPosition.row + 1,
-          kind: "param"
-        });
-      }
+      if (patternNode)
+        addPatternDefs(patternNode, param.startPosition.row + 1);
     }
   }
   return defs;
@@ -13808,7 +13834,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
         continue;
       for (const param of method.parameters) {
         const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
-        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const isDestructureBinding = param.name.startsWith("{") || param.name.startsWith("[");
+        const isTaintable = hasCSharpBindingAttr ? true : isDestructureBinding ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -18264,6 +18291,9 @@ function buildSanitizersByLine(sanitizers) {
   }
   return out2;
 }
+function concatOutsideStrings(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
 function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanitizers, sanitizersArg) {
   let graph;
   let sources;
@@ -18295,6 +18325,7 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
   }
   const taintedVars = [];
   const flows = [];
+  const javaConcat = graph.ir.meta.language === "java";
   const reachableSinks = new Map;
   const defsByLine = graph.defsByLine;
   const usesByLine = graph.usesByLine;
@@ -18327,12 +18358,14 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
             continue;
           }
         }
-        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        const expr = typeof arg.expression === "string" ? arg.expression : "";
+        const compoundConcat = javaConcat && !!arg.variable && expr !== arg.variable && concatOutsideStrings(expr);
+        const candidateUses = arg.variable && !compoundConcat ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
         {
           for (const use of candidateUses) {
             if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
-                if (!arg.variable) {
+                if (!arg.variable || compoundConcat) {
                   if (typeof arg.expression !== "string" || arg.expression.length === 0)
                     continue;
                   const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
@@ -36477,6 +36510,22 @@ function evaluateSimpleExpression(expr, symbols) {
     return String(Math.floor(result));
   return expr;
 }
+var ARGUMENT_IDENT_SKIP = new Set(["new", "true", "false", "null", "this", "super"]);
+function isStringConcat(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
+function argumentIdentifiers(expression) {
+  const stripped = expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ");
+  const found = stripped.match(/[A-Za-z_$][A-Za-z0-9_$]*/g) ?? [];
+  const out2 = [];
+  for (const id of found) {
+    if (ARGUMENT_IDENT_SKIP.has(id))
+      continue;
+    if (!out2.includes(id))
+      out2.push(id);
+  }
+  return out2;
+}
 function isStringLiteralExpression(expr) {
   const trimmed = expr.trim();
   if (trimmed.length < 2)
@@ -36555,22 +36604,30 @@ function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanit
         if (language === "bash" && arg.expression === call.method_name && !arg.variable && arg.literal == null)
           continue;
         if (arg.variable && !arg.expression?.includes("[")) {
-          const varName = arg.variable;
-          const scopedName = methodName ? `${methodName}:${varName}` : varName;
-          if (fieldNames.has(varName) && !isInSynchronizedBlock) {
-            allArgsAreClean = false;
-            continue;
+          const expr = arg.expression ?? "";
+          const concatNames = language === "java" && isStringConcat(expr) ? argumentIdentifiers(expr) : [];
+          const names = concatNames.length > 0 ? concatNames : [arg.variable];
+          let argClean = true;
+          for (const varName of names) {
+            const scopedName = methodName ? `${methodName}:${varName}` : varName;
+            if (fieldNames.has(varName) && !isInSynchronizedBlock) {
+              argClean = false;
+              break;
+            }
+            if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName))
+              continue;
+            if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
+              argClean = false;
+              break;
+            }
+            const symbolValue = symbols.get(scopedName) ?? symbols.get(varName);
+            if (symbolValue && symbolValue.type !== "unknown")
+              continue;
+            argClean = false;
+            break;
           }
-          if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName))
-            continue;
-          if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
+          if (!argClean)
             allArgsAreClean = false;
-            continue;
-          }
-          const symbolValue = symbols.get(scopedName) ?? symbols.get(varName);
-          if (symbolValue && symbolValue.type !== "unknown")
-            continue;
-          allArgsAreClean = false;
         } else {
           if (arg.literal != null)
             continue;
@@ -52098,7 +52155,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.14.0";
+var version = "4.14.1";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -52665,8 +52722,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "c44e104",
-  builtAt: "2026-10-11T06:19:30.837Z"
+  gitSha: "c8c74e9",
+  builtAt: "2026-10-11T07:15:24.915Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.14.0",
+  "version": "4.14.1",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.14.0"
+    "circle-ir": "4.14.1"
   },
   "devDependencies": {
     "@types/node": "^26.6.4",