cognium-dev 4.14.0 → 4.14.2

package/dist/cli.js

@@ -7421,6 +7421,17 @@ function extractGoCallInfo(node) {
       if (operand.type === "identifier") {
         const resolved = resolveGoLocalReceiverType(opText, node);
         receiver = resolved !== null ? resolved : opText;
+      } else if (operand.type === "selector_expression" && methodName === "Get") {
+        const fieldNode = operand.childForFieldName("field");
+        const inner = operand.childForFieldName("operand");
+        const fieldName = fieldNode ? getNodeText(fieldNode) : "";
+        const innerName = inner && inner.type === "identifier" ? getNodeText(inner) : null;
+        const innerType = innerName !== null ? resolveGoLocalReceiverType(innerName, node) : null;
+        if (innerType === "Request" && (fieldName === "PostForm" || fieldName === "Form")) {
+          receiver = fieldName === "PostForm" ? "RequestPostForm" : "RequestForm";
+        } else {
+          receiver = opText;
+        }
       } else {
         receiver = opText;
       }
@@ -9641,6 +9652,38 @@ function extractFieldDefs(body2, startId) {
 function extractJSParameterDefs(params, startId) {
   const defs = [];
   let id = startId;
+  const addPatternDefs = (patternNode, line) => {
+    if (patternNode.type === "identifier" || patternNode.type === "shorthand_property_identifier_pattern") {
+      defs.push({
+        id: id++,
+        variable: getNodeText(patternNode),
+        line,
+        kind: "param"
+      });
+      return;
+    }
+    if (patternNode.type === "rest_pattern" || patternNode.type === "rest_element") {
+      const nameNode = patternNode.namedChildCount > 0 ? patternNode.namedChild(0) : null;
+      if (!nameNode)
+        return;
+      addPatternDefs(nameNode, line);
+      return;
+    }
+    if (patternNode.type === "assignment_pattern") {
+      const leftNode = patternNode.childForFieldName("left");
+      if (leftNode)
+        addPatternDefs(leftNode, line);
+      return;
+    }
+    if (patternNode.type === "object_pattern" || patternNode.type === "array_pattern") {
+      const destructDefs = extractDestructuringDefs(patternNode, id);
+      for (const def of destructDefs) {
+        def.kind = "param";
+        defs.push(def);
+        id++;
+      }
+    }
+  };
   for (let i2 = 0;i2 < params.childCount; i2++) {
     const param = params.child(i2);
     if (!param)
@@ -9690,14 +9733,8 @@ function extractJSParameterDefs(params, startId) {
       }
     } else if (param.type === "required_parameter" || param.type === "optional_parameter") {
       const patternNode = param.childForFieldName("pattern");
-      if (patternNode && patternNode.type === "identifier") {
-        defs.push({
-          id: id++,
-          variable: getNodeText(patternNode),
-          line: param.startPosition.row + 1,
-          kind: "param"
-        });
-      }
+      if (patternNode)
+        addPatternDefs(patternNode, param.startPosition.row + 1);
     }
   }
   return defs;
@@ -12022,7 +12059,11 @@ var DEFAULT_SINKS = [
   { method: "setExpireTimeSeconds", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
   { method: "configureJarCase", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "toString", class: "StringUtils", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
+  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "PathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "FileResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ClassPathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "deleteObject", class: "FileSystemBucket", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "regularExpressionMatcher", class: "Validators", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "checkMessage", class: "Validators", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -13808,7 +13849,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
         continue;
       for (const param of method.parameters) {
         const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
-        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const isDestructureBinding = param.name.startsWith("{") || param.name.startsWith("[");
+        const isTaintable = hasCSharpBindingAttr ? true : isDestructureBinding ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -14022,7 +14064,8 @@ function isInterproceduralTaintableType(typeName, language) {
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection")
     return false;
-  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const positions = pattern.arg_positions ?? [];
+  const queryPos = positions.length > 0 ? Math.min(...positions) : 0;
   const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
@@ -18264,6 +18307,9 @@ function buildSanitizersByLine(sanitizers) {
   }
   return out2;
 }
+function concatOutsideStrings(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
 function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanitizers, sanitizersArg) {
   let graph;
   let sources;
@@ -18295,6 +18341,7 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
   }
   const taintedVars = [];
   const flows = [];
+  const javaConcat = graph.ir.meta.language === "java";
   const reachableSinks = new Map;
   const defsByLine = graph.defsByLine;
   const usesByLine = graph.usesByLine;
@@ -18327,12 +18374,14 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
             continue;
           }
         }
-        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        const expr = typeof arg.expression === "string" ? arg.expression : "";
+        const compoundConcat = javaConcat && !!arg.variable && expr !== arg.variable && concatOutsideStrings(expr);
+        const candidateUses = arg.variable && !compoundConcat ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
         {
           for (const use of candidateUses) {
             if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
-                if (!arg.variable) {
+                if (!arg.variable || compoundConcat) {
                   if (typeof arg.expression !== "string" || arg.expression.length === 0)
                     continue;
                   const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
@@ -18341,7 +18390,17 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
                 }
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
-                  const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanitizersByLine, {
+                  let sanMap = sanitizersByLine;
+                  if (identifierOutsideSanitizerCalls(use.variable, callsAtSink, sanitizersByLine.get(sink.line) ?? [], sink.type)) {
+                    const stripped = new Map(sanitizersByLine);
+                    const kept = (sanitizersByLine.get(sink.line) ?? []).filter((s) => !sanitizerCoversSink(s, sink.type));
+                    if (kept.length === 0)
+                      stripped.delete(sink.line);
+                    else
+                      stripped.set(sink.line, kept);
+                    sanMap = stripped;
+                  }
+                  const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanMap, {
                     startDefId: use.def_id,
                     chainsByToDef: graph.chainsByToDef,
                     defById
@@ -18487,6 +18546,97 @@ var KNOWN_SINK_TYPES = new Set([
   "crlf",
   "mass_assignment"
 ]);
+function readBalancedArg(text, openParen) {
+  let depth = 0;
+  let quote = null;
+  let escaped = false;
+  for (let i2 = openParen;i2 < text.length; i2++) {
+    const c = text[i2];
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (c === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (c === quote)
+        quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (c === "(")
+      depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0)
+        return text.slice(openParen + 1, i2);
+    }
+  }
+  return null;
+}
+function sanitizerCallRefs(sanitizers, sinkType) {
+  const refs = [];
+  for (const san of sanitizers) {
+    if (!sanitizerCoversSink(san, sinkType))
+      continue;
+    const m = /(?:(\w+)\.)?(\w+)\(\)/.exec(san.method);
+    if (!m?.[2])
+      continue;
+    refs.push({ receiver: m[1], methodName: m[2] });
+  }
+  return refs;
+}
+function maskSanitizerCalls(expr, refs) {
+  let out2 = expr;
+  for (const ref of refs) {
+    const needles = ref.receiver ? [`${ref.receiver}.${ref.methodName}`, ref.methodName] : [ref.methodName];
+    for (const needle of needles) {
+      const re = new RegExp(`\\b${needle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\(`);
+      for (let guard = 0;guard < 8; guard++) {
+        const m = re.exec(out2);
+        if (!m)
+          break;
+        const open = m.index + m[0].length - 1;
+        const arg = readBalancedArg(out2, open);
+        if (arg === null)
+          break;
+        out2 = out2.slice(0, m.index) + " " + out2.slice(open + arg.length + 2);
+      }
+    }
+  }
+  return out2;
+}
+function blankStringLiterals(expr) {
+  return expr.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)*'/g, "''");
+}
+function identifierOutsideSanitizerCalls(variable, calls, sanitizers, sinkType) {
+  if (!/^[A-Za-z_$][\w$]*$/.test(variable))
+    return false;
+  const refs = sanitizerCallRefs(sanitizers, sinkType);
+  if (refs.length === 0)
+    return false;
+  const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
+  for (const call of calls) {
+    if (refs.some((r) => r.methodName === call.method_name))
+      continue;
+    for (const arg of call.arguments) {
+      const expr = arg.expression ?? "";
+      if (!expr)
+        continue;
+      const masked = maskSanitizerCalls(expr, refs);
+      if (masked === expr)
+        continue;
+      if (re.test(blankStringLiterals(masked)))
+        return true;
+    }
+  }
+  return false;
+}
 function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);
@@ -24407,6 +24557,22 @@ class GoPlugin extends BaseLanguagePlugin {
         confidence: 0.9,
         returnTainted: true
       },
+      {
+        method: "Get",
+        class: "RequestPostForm",
+        type: "http_body",
+        severity: "high",
+        confidence: 0.9,
+        returnTainted: true
+      },
+      {
+        method: "Get",
+        class: "RequestForm",
+        type: "http_param",
+        severity: "high",
+        confidence: 0.9,
+        returnTainted: true
+      },
       {
         method: "GetRawData",
         class: "Context",
@@ -26305,6 +26471,7 @@ class LanguageSourcesPass {
     additionalSources.push(...findGoMultipartUploadSources(code, language));
     additionalSources.push(...findGoGrpcRequestSources(code, language));
     additionalSources.push(...findGoRequestBodySources(code, language));
+    additionalSources.push(...findGoFormIndexSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -27111,6 +27278,48 @@ function findGoGrpcRequestSources(sourceCode, language) {
   }
   return sources;
 }
+function findGoFormIndexSources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  if (!/\.(?:PostForm|Form|MultipartForm)\b/.test(sourceCode))
+    return [];
+  const lines = sourceCode.split(`
+`);
+  const reqNames = new Set;
+  const paramRe = /([A-Za-z_]\w*)\s+\*http\.Request\b/g;
+  for (const line of lines) {
+    let m;
+    paramRe.lastIndex = 0;
+    while ((m = paramRe.exec(line)) !== null)
+      reqNames.add(m[1]);
+  }
+  if (reqNames.size === 0)
+    return [];
+  const alt = [...reqNames].map((n) => n.replace(/\$/g, "\\$")).join("|");
+  const indexRe = new RegExp(`^\\s*(?:var\\s+)?([A-Za-z_]\\w*)\\s*(?:,\\s*\\w+\\s*)?:?=\\s*(?:${alt})\\s*\\.\\s*(?:(PostForm|Form)|MultipartForm\\s*\\.\\s*Value)\\s*\\[`);
+  const sources = [];
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (/^\s*\/\//.test(line))
+      continue;
+    const m = indexRe.exec(line);
+    if (!m)
+      continue;
+    const variable = m[1];
+    if (variable === "_" || variable === "")
+      continue;
+    const kind = m[2];
+    sources.push({
+      type: kind === "Form" ? "http_param" : "http_body",
+      location: "HTTP request form index",
+      severity: "high",
+      line: i2 + 1,
+      confidence: 0.9,
+      variable
+    });
+  }
+  return sources;
+}
 function findGoRequestBodySources(sourceCode, language) {
   if (language !== "go")
     return [];
@@ -35320,7 +35529,7 @@ class SinkFilterPass {
     let filtered = sinks.filter((sink) => !constProp.unreachableLines.has(sink.line));
     filtered = filterCleanArraySinks(filtered, calls, constProp.taintedArrayElements, constProp.symbols);
     filtered = filterCleanVariableSinks(filtered, calls, constProp.tainted, constProp.symbols, dfg, constProp.sanitizedVars, constProp.synchronizedLines, language);
-    filtered = filterSanitizedSinks(filtered, sanitizers, calls);
+    filtered = filterSanitizedSinks(filtered, sanitizers, calls, sources);
     if (language === "python") {
       const { pyTaintedVars, pySanitizedVars } = langSources;
       const sourceLines = ctx.code.split(`
@@ -35390,8 +35599,13 @@ class SinkFilterPass {
         if (sink.type !== "xss")
           return true;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        if (JS_XSS_SANITIZERS.some((p) => p.test(sinkLineText)))
-          return false;
+        if (JS_XSS_SANITIZERS.some((p) => p.test(sinkLineText))) {
+          const callsAtSink = callsByLine.get(sink.line) ?? [];
+          const covering = sanitizers.filter((s) => s.line === sink.line && sanitizerCoversSink(s, sink.type));
+          const rawOperand = sources.some((s) => !!s.variable && identifierOutsideSanitizerCalls(s.variable, callsAtSink, covering, sink.type));
+          if (!rawOperand)
+            return false;
+        }
         const assignmentMatch = sinkLineText.match(/\.(?:innerHTML|outerHTML)\s*=\s*(.+)/);
         if (assignmentMatch) {
           const rhs = assignmentMatch[1].trim().replace(/;$/, "").trim();
@@ -36477,6 +36691,22 @@ function evaluateSimpleExpression(expr, symbols) {
     return String(Math.floor(result));
   return expr;
 }
+var ARGUMENT_IDENT_SKIP = new Set(["new", "true", "false", "null", "this", "super"]);
+function isStringConcat(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
+function argumentIdentifiers(expression) {
+  const stripped = expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ");
+  const found = stripped.match(/[A-Za-z_$][A-Za-z0-9_$]*/g) ?? [];
+  const out2 = [];
+  for (const id of found) {
+    if (ARGUMENT_IDENT_SKIP.has(id))
+      continue;
+    if (!out2.includes(id))
+      out2.push(id);
+  }
+  return out2;
+}
 function isStringLiteralExpression(expr) {
   const trimmed = expr.trim();
   if (trimmed.length < 2)
@@ -36555,22 +36785,30 @@ function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanit
         if (language === "bash" && arg.expression === call.method_name && !arg.variable && arg.literal == null)
           continue;
         if (arg.variable && !arg.expression?.includes("[")) {
-          const varName = arg.variable;
-          const scopedName = methodName ? `${methodName}:${varName}` : varName;
-          if (fieldNames.has(varName) && !isInSynchronizedBlock) {
-            allArgsAreClean = false;
-            continue;
+          const expr = arg.expression ?? "";
+          const concatNames = language === "java" && isStringConcat(expr) ? argumentIdentifiers(expr) : [];
+          const names = concatNames.length > 0 ? concatNames : [arg.variable];
+          let argClean = true;
+          for (const varName of names) {
+            const scopedName = methodName ? `${methodName}:${varName}` : varName;
+            if (fieldNames.has(varName) && !isInSynchronizedBlock) {
+              argClean = false;
+              break;
+            }
+            if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName))
+              continue;
+            if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
+              argClean = false;
+              break;
+            }
+            const symbolValue = symbols.get(scopedName) ?? symbols.get(varName);
+            if (symbolValue && symbolValue.type !== "unknown")
+              continue;
+            argClean = false;
+            break;
           }
-          if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName))
-            continue;
-          if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
+          if (!argClean)
             allArgsAreClean = false;
-            continue;
-          }
-          const symbolValue = symbols.get(scopedName) ?? symbols.get(varName);
-          if (symbolValue && symbolValue.type !== "unknown")
-            continue;
-          allArgsAreClean = false;
         } else {
           if (arg.literal != null)
             continue;
@@ -36585,9 +36823,14 @@ function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanit
     return true;
   });
 }
-function filterSanitizedSinks(sinks, sanitizers, calls) {
+function filterSanitizedSinks(sinks, sanitizers, calls, sources) {
   if (!sanitizers || sanitizers.length === 0)
     return sinks;
+  const sourceVars = [];
+  for (const source of sources ?? []) {
+    if (source.variable && /^[A-Za-z_$][\w$]*$/.test(source.variable))
+      sourceVars.push(source.variable);
+  }
   const sanitizersByLine = new Map;
   for (const san of sanitizers) {
     const existing = sanitizersByLine.get(san.line) ?? [];
@@ -36604,23 +36847,30 @@ function filterSanitizedSinks(sinks, sanitizers, calls) {
     const lineSanitizers = sanitizersByLine.get(sink.line);
     if (!lineSanitizers || lineSanitizers.length === 0)
       return true;
-    for (const san of lineSanitizers) {
-      if (sanitizerCoversSink(san, sink.type)) {
-        const lineCalls = callsByLine.get(sink.line) ?? [];
-        for (const call of lineCalls) {
-          for (const arg of call.arguments) {
-            const expr = arg.expression || "";
-            const sanMethodMatch = san.method.match(/(?:(\w+)\.)?(\w+)\(\)/);
-            if (sanMethodMatch) {
-              const sanMethodName = sanMethodMatch[2];
-              const sanClassName = sanMethodMatch[1];
-              if (sanClassName) {
-                if (expr.includes(`${sanClassName}.${sanMethodName}(`))
-                  return false;
-              } else if (expr.includes(`${sanMethodName}(`)) {
-                return false;
-              }
-            }
+    const lineCalls = callsByLine.get(sink.line) ?? [];
+    const covering = lineSanitizers.filter((san) => sanitizerCoversSink(san, sink.type));
+    if (covering.length === 0)
+      return true;
+    for (const variable of sourceVars) {
+      if (identifierOutsideSanitizerCalls(variable, lineCalls, covering, sink.type))
+        return true;
+    }
+    for (const san of covering) {
+      const sanMethodMatch = san.method.match(/(?:(\w+)\.)?(\w+)\(\)/);
+      if (!sanMethodMatch)
+        continue;
+      const sanMethodName = sanMethodMatch[2];
+      const sanClassName = sanMethodMatch[1];
+      for (const call of lineCalls) {
+        if (call.method_name === sanMethodName)
+          continue;
+        for (const arg of call.arguments) {
+          const expr = arg.expression || "";
+          if (sanClassName) {
+            if (expr.includes(`${sanClassName}.${sanMethodName}(`))
+              return false;
+          } else if (expr.includes(`${sanMethodName}(`)) {
+            return false;
           }
         }
       }
@@ -38066,9 +38316,14 @@ class TaintPropagationPass {
         const sansAtSink = sanitizersByLine.get(f.sink_line);
         if (sansAtSink && sansAtSink.length > 0) {
           for (const san of sansAtSink) {
-            if (sanitizerCoversSink(san, f.sink_type)) {
-              return false;
+            if (!sanitizerCoversSink(san, f.sink_type))
+              continue;
+            const sinkVar2 = f.path.length > 0 ? f.path[f.path.length - 1].variable : undefined;
+            const callsAtSink = graph.callsByLine.get(f.sink_line) ?? [];
+            if (sinkVar2 && identifierOutsideSanitizerCalls(sinkVar2, callsAtSink, sansAtSink, f.sink_type)) {
+              continue;
             }
+            return false;
           }
         }
         const usesAtSink = graph.usesByLine.get(f.sink_line);
@@ -40549,10 +40804,15 @@ class InterproceduralPass {
         const sansAtSink = sanitizersByLine.get(f.sink_line);
         if (!sansAtSink || sansAtSink.length === 0)
           return true;
+        const callsAtSink = graph.callsByLine.get(f.sink_line) ?? [];
+        const sinkVar = f.path.length > 0 ? f.path[f.path.length - 1]?.variable : undefined;
         for (const san of sansAtSink) {
-          if (sanitizerCoversSink(san, f.sink_type)) {
-            return false;
+          if (!sanitizerCoversSink(san, f.sink_type))
+            continue;
+          if (sinkVar && identifierOutsideSanitizerCalls(sinkVar, callsAtSink, sansAtSink, f.sink_type)) {
+            continue;
           }
+          return false;
         }
         return true;
       });
@@ -44988,6 +45248,13 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Revoke the GitHub refresh token and store secrets outside source control."
   },
+  {
+    name: "GitHub fine-grained personal access token",
+    regex: /\bgithub_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}\b/,
+    severity: "critical",
+    level: "error",
+    fix: "Revoke the fine-grained personal access token at https://github.com/settings/tokens and store secrets outside source control."
+  },
   {
     name: "GitLab personal access token",
     regex: /\bglpat-[A-Za-z0-9_-]{20,}\b/,
@@ -45012,9 +45279,9 @@ var PROVIDER_PATTERNS = [
   {
     name: "Stripe live publishable key",
     regex: /\bpk_live_[A-Za-z0-9]{24,}\b/,
-    severity: "high",
-    level: "warning",
-    fix: "Publishable keys are not secret but should still not be checked in to back-end source files; verify front-end vs back-end context."
+    severity: "low",
+    level: "note",
+    fix: "Publishable keys are not secret. Prefer loading them from configuration rather than a backend source file."
   },
   {
     name: "Stripe test secret key",
@@ -45037,6 +45304,13 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Revoke the OpenAI key at https://platform.openai.com/api-keys and load from environment."
   },
+  {
+    name: "OpenAI project API key",
+    regex: /\bsk-proj-[A-Za-z0-9_-]{48,}\b/,
+    severity: "critical",
+    level: "error",
+    fix: "Revoke the OpenAI project key at https://platform.openai.com/api-keys and load from environment."
+  },
   {
     name: "Anthropic API key",
     regex: /\bsk-ant-[A-Za-z0-9_-]{90,}\b/,
@@ -45374,7 +45648,7 @@ class ScanSecretsPass {
         const m = pattern.regex.exec(lineText);
         if (!m)
           continue;
-        if ((pattern.name === "Stripe live restricted key" || pattern.name === "Stripe test secret key" || pattern.name === "Stripe test restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
+        if ((pattern.name === "Stripe live restricted key" || pattern.name === "Stripe test secret key" || pattern.name === "Stripe test restricted key" || pattern.name === "GitLab personal access token" || pattern.name === "OpenAI project API key" || pattern.name === "GitHub fine-grained personal access token") && PLACEHOLDER_RE.test(m[0])) {
           continue;
         }
         if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
@@ -45810,8 +46084,6 @@ var PY_SET_COOKIE_RECEIVERS = new Set([
 ]);
 var PY_SECURE_TRUE_RE = /\bsecure\s*=\s*True\b/;
 var PY_HTTPONLY_TRUE_RE = /\bhttponly\s*=\s*True\b/i;
-var JAVA_SET_SECURE_TRUE_RE = /\.setSecure\s*\(\s*true\s*\)/;
-var JAVA_SET_HTTPONLY_TRUE_RE = /\.setHttpOnly\s*\(\s*true\s*\)/;
 var GO_SECURE_TRUE_RE = /\bSecure\s*:\s*true\b/;
 var GO_HTTPONLY_TRUE_RE = /\bHttpOnly\s*:\s*true\b/;
 var RUST_SET_COOKIE_MACRO_RE = /(format!|write!|writeln!)\s*\(([^()]*Set-Cookie[^()]*)\)/gis;
@@ -45843,10 +46115,8 @@ class InsecureCookiePass {
         this.emit(ctx, file, det, "python");
       }
     } else if (language === "java") {
-      const hasSetSecureTrue = JAVA_SET_SECURE_TRUE_RE.test(code);
-      const hasSetHttpOnlyTrue = JAVA_SET_HTTPONLY_TRUE_RE.test(code);
       for (const call of graph.ir.calls) {
-        const det = this.detectJavaCookieCtor(call, hasSetSecureTrue, hasSetHttpOnlyTrue);
+        const det = this.detectJavaCookieCtor(call, code);
         if (!det)
           continue;
         insecureCookies.push(det);
@@ -45932,7 +46202,15 @@ class InsecureCookiePass {
       optionsPresent: call.arguments.length >= 2
     };
   }
-  detectJavaCookieCtor(call, hasSetSecureTrue, hasSetHttpOnlyTrue) {
+  javaCookieSetterTrue(code, call, setter) {
+    const line = code.split(`
+`)[(call.location.line ?? 1) - 1] ?? "";
+    const assign = /\b([A-Za-z_]\w*)\s*=\s*new\s+(?:[\w.]+\.)?Cookie\b/.exec(line);
+    const varName = assign?.[1];
+    const re = varName ? new RegExp(`\\b${varName}\\.${setter}\\s*\\(\\s*true\\s*\\)`) : new RegExp(`\\.${setter}\\s*\\(\\s*true\\s*\\)`);
+    return re.test(varName ? code : line);
+  }
+  detectJavaCookieCtor(call, code) {
     const method = call.method_name ?? "";
     const isCookieCtor = method === "Cookie" || method.endsWith(".Cookie");
     if (!isCookieCtor)
@@ -45942,8 +46220,8 @@ class InsecureCookiePass {
       return null;
     if (call.arguments.length < 2)
       return null;
-    const missingSecure = !hasSetSecureTrue;
-    const missingHttpOnly = !hasSetHttpOnlyTrue;
+    const missingSecure = !this.javaCookieSetterTrue(code, call, "setSecure");
+    const missingHttpOnly = !this.javaCookieSetterTrue(code, call, "setHttpOnly");
     if (!missingSecure && !missingHttpOnly)
       return null;
     return {
@@ -52098,7 +52376,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.14.0";
+var version = "4.14.2";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -52665,8 +52943,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "c44e104",
-  builtAt: "2026-10-11T06:19:30.837Z"
+  gitSha: "b1967eb",
+  builtAt: "2026-10-13T06:43:43.278Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.14.0",
+  "version": "4.14.2",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.14.0"
+    "circle-ir": "4.14.2"
   },
   "devDependencies": {
     "@types/node": "^26.6.4",