cognium-dev 4.14.1 → 4.14.2

package/dist/cli.js

@@ -7421,6 +7421,17 @@ function extractGoCallInfo(node) {
       if (operand.type === "identifier") {
         const resolved = resolveGoLocalReceiverType(opText, node);
         receiver = resolved !== null ? resolved : opText;
+      } else if (operand.type === "selector_expression" && methodName === "Get") {
+        const fieldNode = operand.childForFieldName("field");
+        const inner = operand.childForFieldName("operand");
+        const fieldName = fieldNode ? getNodeText(fieldNode) : "";
+        const innerName = inner && inner.type === "identifier" ? getNodeText(inner) : null;
+        const innerType = innerName !== null ? resolveGoLocalReceiverType(innerName, node) : null;
+        if (innerType === "Request" && (fieldName === "PostForm" || fieldName === "Form")) {
+          receiver = fieldName === "PostForm" ? "RequestPostForm" : "RequestForm";
+        } else {
+          receiver = opText;
+        }
       } else {
         receiver = opText;
       }
@@ -12048,7 +12059,11 @@ var DEFAULT_SINKS = [
   { method: "setExpireTimeSeconds", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
   { method: "configureJarCase", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "toString", class: "StringUtils", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
+  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "PathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "FileResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ClassPathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "deleteObject", class: "FileSystemBucket", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "regularExpressionMatcher", class: "Validators", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "checkMessage", class: "Validators", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -14049,7 +14064,8 @@ function isInterproceduralTaintableType(typeName, language) {
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection")
     return false;
-  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const positions = pattern.arg_positions ?? [];
+  const queryPos = positions.length > 0 ? Math.min(...positions) : 0;
   const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
@@ -18374,7 +18390,17 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
                 }
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
-                  const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanitizersByLine, {
+                  let sanMap = sanitizersByLine;
+                  if (identifierOutsideSanitizerCalls(use.variable, callsAtSink, sanitizersByLine.get(sink.line) ?? [], sink.type)) {
+                    const stripped = new Map(sanitizersByLine);
+                    const kept = (sanitizersByLine.get(sink.line) ?? []).filter((s) => !sanitizerCoversSink(s, sink.type));
+                    if (kept.length === 0)
+                      stripped.delete(sink.line);
+                    else
+                      stripped.set(sink.line, kept);
+                    sanMap = stripped;
+                  }
+                  const isSanitized = checkSanitized(taintInfo.line, sink.line, sink.type, sanMap, {
                     startDefId: use.def_id,
                     chainsByToDef: graph.chainsByToDef,
                     defById
@@ -18520,6 +18546,97 @@ var KNOWN_SINK_TYPES = new Set([
   "crlf",
   "mass_assignment"
 ]);
+function readBalancedArg(text, openParen) {
+  let depth = 0;
+  let quote = null;
+  let escaped = false;
+  for (let i2 = openParen;i2 < text.length; i2++) {
+    const c = text[i2];
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (c === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (c === quote)
+        quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (c === "(")
+      depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0)
+        return text.slice(openParen + 1, i2);
+    }
+  }
+  return null;
+}
+function sanitizerCallRefs(sanitizers, sinkType) {
+  const refs = [];
+  for (const san of sanitizers) {
+    if (!sanitizerCoversSink(san, sinkType))
+      continue;
+    const m = /(?:(\w+)\.)?(\w+)\(\)/.exec(san.method);
+    if (!m?.[2])
+      continue;
+    refs.push({ receiver: m[1], methodName: m[2] });
+  }
+  return refs;
+}
+function maskSanitizerCalls(expr, refs) {
+  let out2 = expr;
+  for (const ref of refs) {
+    const needles = ref.receiver ? [`${ref.receiver}.${ref.methodName}`, ref.methodName] : [ref.methodName];
+    for (const needle of needles) {
+      const re = new RegExp(`\\b${needle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\(`);
+      for (let guard = 0;guard < 8; guard++) {
+        const m = re.exec(out2);
+        if (!m)
+          break;
+        const open = m.index + m[0].length - 1;
+        const arg = readBalancedArg(out2, open);
+        if (arg === null)
+          break;
+        out2 = out2.slice(0, m.index) + " " + out2.slice(open + arg.length + 2);
+      }
+    }
+  }
+  return out2;
+}
+function blankStringLiterals(expr) {
+  return expr.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)*'/g, "''");
+}
+function identifierOutsideSanitizerCalls(variable, calls, sanitizers, sinkType) {
+  if (!/^[A-Za-z_$][\w$]*$/.test(variable))
+    return false;
+  const refs = sanitizerCallRefs(sanitizers, sinkType);
+  if (refs.length === 0)
+    return false;
+  const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
+  for (const call of calls) {
+    if (refs.some((r) => r.methodName === call.method_name))
+      continue;
+    for (const arg of call.arguments) {
+      const expr = arg.expression ?? "";
+      if (!expr)
+        continue;
+      const masked = maskSanitizerCalls(expr, refs);
+      if (masked === expr)
+        continue;
+      if (re.test(blankStringLiterals(masked)))
+        return true;
+    }
+  }
+  return false;
+}
 function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);
@@ -24440,6 +24557,22 @@ class GoPlugin extends BaseLanguagePlugin {
         confidence: 0.9,
         returnTainted: true
       },
+      {
+        method: "Get",
+        class: "RequestPostForm",
+        type: "http_body",
+        severity: "high",
+        confidence: 0.9,
+        returnTainted: true
+      },
+      {
+        method: "Get",
+        class: "RequestForm",
+        type: "http_param",
+        severity: "high",
+        confidence: 0.9,
+        returnTainted: true
+      },
       {
         method: "GetRawData",
         class: "Context",
@@ -26338,6 +26471,7 @@ class LanguageSourcesPass {
     additionalSources.push(...findGoMultipartUploadSources(code, language));
     additionalSources.push(...findGoGrpcRequestSources(code, language));
     additionalSources.push(...findGoRequestBodySources(code, language));
+    additionalSources.push(...findGoFormIndexSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -27144,6 +27278,48 @@ function findGoGrpcRequestSources(sourceCode, language) {
   }
   return sources;
 }
+function findGoFormIndexSources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  if (!/\.(?:PostForm|Form|MultipartForm)\b/.test(sourceCode))
+    return [];
+  const lines = sourceCode.split(`
+`);
+  const reqNames = new Set;
+  const paramRe = /([A-Za-z_]\w*)\s+\*http\.Request\b/g;
+  for (const line of lines) {
+    let m;
+    paramRe.lastIndex = 0;
+    while ((m = paramRe.exec(line)) !== null)
+      reqNames.add(m[1]);
+  }
+  if (reqNames.size === 0)
+    return [];
+  const alt = [...reqNames].map((n) => n.replace(/\$/g, "\\$")).join("|");
+  const indexRe = new RegExp(`^\\s*(?:var\\s+)?([A-Za-z_]\\w*)\\s*(?:,\\s*\\w+\\s*)?:?=\\s*(?:${alt})\\s*\\.\\s*(?:(PostForm|Form)|MultipartForm\\s*\\.\\s*Value)\\s*\\[`);
+  const sources = [];
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (/^\s*\/\//.test(line))
+      continue;
+    const m = indexRe.exec(line);
+    if (!m)
+      continue;
+    const variable = m[1];
+    if (variable === "_" || variable === "")
+      continue;
+    const kind = m[2];
+    sources.push({
+      type: kind === "Form" ? "http_param" : "http_body",
+      location: "HTTP request form index",
+      severity: "high",
+      line: i2 + 1,
+      confidence: 0.9,
+      variable
+    });
+  }
+  return sources;
+}
 function findGoRequestBodySources(sourceCode, language) {
   if (language !== "go")
     return [];
@@ -35353,7 +35529,7 @@ class SinkFilterPass {
     let filtered = sinks.filter((sink) => !constProp.unreachableLines.has(sink.line));
     filtered = filterCleanArraySinks(filtered, calls, constProp.taintedArrayElements, constProp.symbols);
     filtered = filterCleanVariableSinks(filtered, calls, constProp.tainted, constProp.symbols, dfg, constProp.sanitizedVars, constProp.synchronizedLines, language);
-    filtered = filterSanitizedSinks(filtered, sanitizers, calls);
+    filtered = filterSanitizedSinks(filtered, sanitizers, calls, sources);
     if (language === "python") {
       const { pyTaintedVars, pySanitizedVars } = langSources;
       const sourceLines = ctx.code.split(`
@@ -35423,8 +35599,13 @@ class SinkFilterPass {
         if (sink.type !== "xss")
           return true;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        if (JS_XSS_SANITIZERS.some((p) => p.test(sinkLineText)))
-          return false;
+        if (JS_XSS_SANITIZERS.some((p) => p.test(sinkLineText))) {
+          const callsAtSink = callsByLine.get(sink.line) ?? [];
+          const covering = sanitizers.filter((s) => s.line === sink.line && sanitizerCoversSink(s, sink.type));
+          const rawOperand = sources.some((s) => !!s.variable && identifierOutsideSanitizerCalls(s.variable, callsAtSink, covering, sink.type));
+          if (!rawOperand)
+            return false;
+        }
         const assignmentMatch = sinkLineText.match(/\.(?:innerHTML|outerHTML)\s*=\s*(.+)/);
         if (assignmentMatch) {
           const rhs = assignmentMatch[1].trim().replace(/;$/, "").trim();
@@ -36642,9 +36823,14 @@ function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanit
     return true;
   });
 }
-function filterSanitizedSinks(sinks, sanitizers, calls) {
+function filterSanitizedSinks(sinks, sanitizers, calls, sources) {
   if (!sanitizers || sanitizers.length === 0)
     return sinks;
+  const sourceVars = [];
+  for (const source of sources ?? []) {
+    if (source.variable && /^[A-Za-z_$][\w$]*$/.test(source.variable))
+      sourceVars.push(source.variable);
+  }
   const sanitizersByLine = new Map;
   for (const san of sanitizers) {
     const existing = sanitizersByLine.get(san.line) ?? [];
@@ -36661,23 +36847,30 @@ function filterSanitizedSinks(sinks, sanitizers, calls) {
     const lineSanitizers = sanitizersByLine.get(sink.line);
     if (!lineSanitizers || lineSanitizers.length === 0)
       return true;
-    for (const san of lineSanitizers) {
-      if (sanitizerCoversSink(san, sink.type)) {
-        const lineCalls = callsByLine.get(sink.line) ?? [];
-        for (const call of lineCalls) {
-          for (const arg of call.arguments) {
-            const expr = arg.expression || "";
-            const sanMethodMatch = san.method.match(/(?:(\w+)\.)?(\w+)\(\)/);
-            if (sanMethodMatch) {
-              const sanMethodName = sanMethodMatch[2];
-              const sanClassName = sanMethodMatch[1];
-              if (sanClassName) {
-                if (expr.includes(`${sanClassName}.${sanMethodName}(`))
-                  return false;
-              } else if (expr.includes(`${sanMethodName}(`)) {
-                return false;
-              }
-            }
+    const lineCalls = callsByLine.get(sink.line) ?? [];
+    const covering = lineSanitizers.filter((san) => sanitizerCoversSink(san, sink.type));
+    if (covering.length === 0)
+      return true;
+    for (const variable of sourceVars) {
+      if (identifierOutsideSanitizerCalls(variable, lineCalls, covering, sink.type))
+        return true;
+    }
+    for (const san of covering) {
+      const sanMethodMatch = san.method.match(/(?:(\w+)\.)?(\w+)\(\)/);
+      if (!sanMethodMatch)
+        continue;
+      const sanMethodName = sanMethodMatch[2];
+      const sanClassName = sanMethodMatch[1];
+      for (const call of lineCalls) {
+        if (call.method_name === sanMethodName)
+          continue;
+        for (const arg of call.arguments) {
+          const expr = arg.expression || "";
+          if (sanClassName) {
+            if (expr.includes(`${sanClassName}.${sanMethodName}(`))
+              return false;
+          } else if (expr.includes(`${sanMethodName}(`)) {
+            return false;
           }
         }
       }
@@ -38123,9 +38316,14 @@ class TaintPropagationPass {
         const sansAtSink = sanitizersByLine.get(f.sink_line);
         if (sansAtSink && sansAtSink.length > 0) {
           for (const san of sansAtSink) {
-            if (sanitizerCoversSink(san, f.sink_type)) {
-              return false;
+            if (!sanitizerCoversSink(san, f.sink_type))
+              continue;
+            const sinkVar2 = f.path.length > 0 ? f.path[f.path.length - 1].variable : undefined;
+            const callsAtSink = graph.callsByLine.get(f.sink_line) ?? [];
+            if (sinkVar2 && identifierOutsideSanitizerCalls(sinkVar2, callsAtSink, sansAtSink, f.sink_type)) {
+              continue;
             }
+            return false;
           }
         }
         const usesAtSink = graph.usesByLine.get(f.sink_line);
@@ -40606,10 +40804,15 @@ class InterproceduralPass {
         const sansAtSink = sanitizersByLine.get(f.sink_line);
         if (!sansAtSink || sansAtSink.length === 0)
           return true;
+        const callsAtSink = graph.callsByLine.get(f.sink_line) ?? [];
+        const sinkVar = f.path.length > 0 ? f.path[f.path.length - 1]?.variable : undefined;
         for (const san of sansAtSink) {
-          if (sanitizerCoversSink(san, f.sink_type)) {
-            return false;
+          if (!sanitizerCoversSink(san, f.sink_type))
+            continue;
+          if (sinkVar && identifierOutsideSanitizerCalls(sinkVar, callsAtSink, sansAtSink, f.sink_type)) {
+            continue;
           }
+          return false;
         }
         return true;
       });
@@ -45045,6 +45248,13 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Revoke the GitHub refresh token and store secrets outside source control."
   },
+  {
+    name: "GitHub fine-grained personal access token",
+    regex: /\bgithub_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}\b/,
+    severity: "critical",
+    level: "error",
+    fix: "Revoke the fine-grained personal access token at https://github.com/settings/tokens and store secrets outside source control."
+  },
   {
     name: "GitLab personal access token",
     regex: /\bglpat-[A-Za-z0-9_-]{20,}\b/,
@@ -45069,9 +45279,9 @@ var PROVIDER_PATTERNS = [
   {
     name: "Stripe live publishable key",
     regex: /\bpk_live_[A-Za-z0-9]{24,}\b/,
-    severity: "high",
-    level: "warning",
-    fix: "Publishable keys are not secret but should still not be checked in to back-end source files; verify front-end vs back-end context."
+    severity: "low",
+    level: "note",
+    fix: "Publishable keys are not secret. Prefer loading them from configuration rather than a backend source file."
   },
   {
     name: "Stripe test secret key",
@@ -45094,6 +45304,13 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Revoke the OpenAI key at https://platform.openai.com/api-keys and load from environment."
   },
+  {
+    name: "OpenAI project API key",
+    regex: /\bsk-proj-[A-Za-z0-9_-]{48,}\b/,
+    severity: "critical",
+    level: "error",
+    fix: "Revoke the OpenAI project key at https://platform.openai.com/api-keys and load from environment."
+  },
   {
     name: "Anthropic API key",
     regex: /\bsk-ant-[A-Za-z0-9_-]{90,}\b/,
@@ -45431,7 +45648,7 @@ class ScanSecretsPass {
         const m = pattern.regex.exec(lineText);
         if (!m)
           continue;
-        if ((pattern.name === "Stripe live restricted key" || pattern.name === "Stripe test secret key" || pattern.name === "Stripe test restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
+        if ((pattern.name === "Stripe live restricted key" || pattern.name === "Stripe test secret key" || pattern.name === "Stripe test restricted key" || pattern.name === "GitLab personal access token" || pattern.name === "OpenAI project API key" || pattern.name === "GitHub fine-grained personal access token") && PLACEHOLDER_RE.test(m[0])) {
           continue;
         }
         if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
@@ -45867,8 +46084,6 @@ var PY_SET_COOKIE_RECEIVERS = new Set([
 ]);
 var PY_SECURE_TRUE_RE = /\bsecure\s*=\s*True\b/;
 var PY_HTTPONLY_TRUE_RE = /\bhttponly\s*=\s*True\b/i;
-var JAVA_SET_SECURE_TRUE_RE = /\.setSecure\s*\(\s*true\s*\)/;
-var JAVA_SET_HTTPONLY_TRUE_RE = /\.setHttpOnly\s*\(\s*true\s*\)/;
 var GO_SECURE_TRUE_RE = /\bSecure\s*:\s*true\b/;
 var GO_HTTPONLY_TRUE_RE = /\bHttpOnly\s*:\s*true\b/;
 var RUST_SET_COOKIE_MACRO_RE = /(format!|write!|writeln!)\s*\(([^()]*Set-Cookie[^()]*)\)/gis;
@@ -45900,10 +46115,8 @@ class InsecureCookiePass {
         this.emit(ctx, file, det, "python");
       }
     } else if (language === "java") {
-      const hasSetSecureTrue = JAVA_SET_SECURE_TRUE_RE.test(code);
-      const hasSetHttpOnlyTrue = JAVA_SET_HTTPONLY_TRUE_RE.test(code);
       for (const call of graph.ir.calls) {
-        const det = this.detectJavaCookieCtor(call, hasSetSecureTrue, hasSetHttpOnlyTrue);
+        const det = this.detectJavaCookieCtor(call, code);
         if (!det)
           continue;
         insecureCookies.push(det);
@@ -45989,7 +46202,15 @@ class InsecureCookiePass {
       optionsPresent: call.arguments.length >= 2
     };
   }
-  detectJavaCookieCtor(call, hasSetSecureTrue, hasSetHttpOnlyTrue) {
+  javaCookieSetterTrue(code, call, setter) {
+    const line = code.split(`
+`)[(call.location.line ?? 1) - 1] ?? "";
+    const assign = /\b([A-Za-z_]\w*)\s*=\s*new\s+(?:[\w.]+\.)?Cookie\b/.exec(line);
+    const varName = assign?.[1];
+    const re = varName ? new RegExp(`\\b${varName}\\.${setter}\\s*\\(\\s*true\\s*\\)`) : new RegExp(`\\.${setter}\\s*\\(\\s*true\\s*\\)`);
+    return re.test(varName ? code : line);
+  }
+  detectJavaCookieCtor(call, code) {
     const method = call.method_name ?? "";
     const isCookieCtor = method === "Cookie" || method.endsWith(".Cookie");
     if (!isCookieCtor)
@@ -45999,8 +46220,8 @@ class InsecureCookiePass {
       return null;
     if (call.arguments.length < 2)
       return null;
-    const missingSecure = !hasSetSecureTrue;
-    const missingHttpOnly = !hasSetHttpOnlyTrue;
+    const missingSecure = !this.javaCookieSetterTrue(code, call, "setSecure");
+    const missingHttpOnly = !this.javaCookieSetterTrue(code, call, "setHttpOnly");
     if (!missingSecure && !missingHttpOnly)
       return null;
     return {
@@ -52155,7 +52376,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.14.1";
+var version = "4.14.2";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -52722,8 +52943,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "c8c74e9",
-  builtAt: "2026-10-11T07:15:24.915Z"
+  gitSha: "b1967eb",
+  builtAt: "2026-10-13T06:43:43.278Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.14.1",
+  "version": "4.14.2",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.14.1"
+    "circle-ir": "4.14.2"
   },
   "devDependencies": {
     "@types/node": "^26.6.4",