cognium-dev 4.16.0 → 4.16.1

package/dist/cli.js

@@ -20551,20 +20551,25 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
   const lines = code.split(`
 `);
   const terminatorRe = /\b(throw|return)\b/;
+  const literalArrays = collectCSharpLiteralArrayFields(code);
+  const indexOfRe = /\bif\s*\(\s*(?:System\s*\.\s*)?Array\s*\.\s*IndexOf\s*\(\s*([A-Za-z_]\w*)\s*,\s*([A-Za-z_][\w.]*)\s*\)\s*(?:<\s*0|==\s*-\s*1)\s*\)/;
   const allowlistRes = [
-    /\bif\s*\(\s*Array\s*\.\s*IndexOf\s*\([^,]+,\s*([A-Za-z_][\w.]*)\s*\)\s*<\s*0\s*\)/,
     /\bif\s*\(\s*!\s*[A-Za-z_][\w.]*\s*\.\s*Contains\s*\(\s*([A-Za-z_][\w.]*)\s*\)\s*\)/
   ];
   const charClassRe = /\bif\s*\(\s*!\s*([A-Za-z_][\w.]*)\s*\.\s*All\s*\(\s*char\s*\.\s*Is[A-Za-z]+\s*\)\s*\)/;
   for (let i2 = 0;i2 < lines.length; i2++) {
     let guardedExpr = null;
-    for (const re of allowlistRes) {
-      const m = re.exec(lines[i2]);
-      if (m) {
-        guardedExpr = m[1];
-        break;
+    const im = indexOfRe.exec(lines[i2]);
+    if (im && literalArrays.has(im[1]))
+      guardedExpr = im[2];
+    if (!guardedExpr)
+      for (const re of allowlistRes) {
+        const m = re.exec(lines[i2]);
+        if (m) {
+          guardedExpr = m[1];
+          break;
+        }
       }
-    }
     if (!guardedExpr) {
       const m = charClassRe.exec(lines[i2]);
       if (m)
@@ -20594,6 +20599,8 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
       const a = assignRe.exec(lines[l]);
       if (a && mentions(a[2]))
         guarded.add(a[1]);
+      else if (a)
+        guarded.delete(a[1]);
       if (mentions(lines[l])) {
         sanitizers.push({
           type: "csharp_early_return_guard",
@@ -20614,6 +20621,26 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
   }
   return sanitizers;
 }
+function collectCSharpLiteralArrayFields(code) {
+  const names = new Set;
+  const lit = String.raw`(?:@"(?:[^"]|"")*"|"(?:[^"\\\n]|\\.)*")`;
+  const elems = new RegExp(String.raw`^\s*${lit}(?:\s*,\s*${lit})*\s*,?\s*$`);
+  const declRe = /((?:\b(?:public|private|protected|internal|static|readonly)\s+)+)string\s*\[\s*\]\s+([A-Za-z_]\w*)\s*=\s*(?:new\s+(?:string\s*)?\[\s*\]\s*)?\{([^{}]*)\}\s*;/g;
+  for (const m of code.matchAll(declRe)) {
+    const mods = m[1];
+    const name2 = m[2];
+    if (!/\bstatic\b/.test(mods) || !/\breadonly\b/.test(mods))
+      continue;
+    if (!elems.test(m[3]))
+      continue;
+    const rest = code.slice(0, m.index) + code.slice(m.index + m[0].length);
+    const written = new RegExp(String.raw`\b${name2}\s*(?:\[[^\]]*\]\s*)?(?:[-+*/%&|^]|\?\?)?=(?!=)` + String.raw`|\b(?:ref|out)\s+${name2}\b` + String.raw`|\b${name2}\s*\.\s*SetValue\s*\(` + String.raw`|\bArray\s*\.\s*(?:Clear|Copy|ConstrainedCopy|Fill|Resize|Reverse|Sort)\s*\([^;]*\b${name2}\b`);
+    if (written.test(rest))
+      continue;
+    names.add(name2);
+  }
+  return names;
+}
 function findCSharpFullPathStartsWithGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -38184,6 +38211,12 @@ function bareIdentifiers(text) {
     out2.push(m[1]);
   return out2;
 }
+function isLiteralValue(rhs) {
+  if (/\$"/.test(rhs))
+    return false;
+  const ids = bareIdentifiers(rhs);
+  return ids.every((id) => id === "null" || id === "true" || id === "false" || id === "default") || /^\s*(?:string|String)\s*\.\s*Empty\s*$/.test(rhs);
+}
 function insideParens(text, open) {
   let depth = 0;
   for (let i2 = open;i2 < text.length; i2++) {
@@ -38372,6 +38405,34 @@ class CSharpCredit {
   sanitizedVarsAt(type, sinkLine) {
     return this.sanitizedVarsIn(type, this.methodAt(sinkLine)?.start_line ?? 1, sinkLine, true);
   }
+  fieldWrites(type, fields) {
+    const credited = new Set;
+    const unsanitized = new Set;
+    for (const m of this.methods) {
+      const sanitized = new Set;
+      for (const st of this.statements(m.start_line, m.end_line + 1)) {
+        if (this.methodAt(st.line) !== m)
+          continue;
+        for (const op of this.creditOpsInStatement(st.text)) {
+          const lhs = op.lhs;
+          const keeps = op.kind === "append" ? sanitized.has(lhs) && this.rhsKeepsSanitizerCredit(type, op.rhs, sanitized, true, true) : this.rhsKeepsSanitizerCredit(type, op.rhs, sanitized, true, false);
+          if (keeps)
+            sanitized.add(lhs);
+          else
+            sanitized.delete(lhs);
+          if (!fields.has(lhs) || isLiteralValue(op.rhs))
+            continue;
+          if (keeps)
+            credited.add(lhs);
+          else
+            unsanitized.add(lhs);
+        }
+      }
+    }
+    for (const f of unsanitized)
+      credited.delete(f);
+    return { sanitized: credited, unsanitized };
+  }
   rawTaintReaches(type, sinkLine, credited, seeds) {
     if (seeds.length === 0)
       return false;
@@ -38921,10 +38982,12 @@ function isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls) {
     if (other.arguments.some((a) => a.expression.includes(needle)))
       return false;
   }
-  const receiver = call.receiver;
+  return isJdkClassReceiver(call.receiver, JAVA_FORMATTER_CLASSES, declaredTypeNames, imports);
+}
+function isJdkClassReceiver(receiver, classes, declaredTypeNames, imports) {
   const dot = receiver.lastIndexOf(".");
   const simple = dot < 0 ? receiver : receiver.slice(dot + 1);
-  const pkg = JAVA_FORMATTER_CLASSES.get(simple);
+  const pkg = classes.get(simple);
   if (pkg === undefined)
     return false;
   if (dot >= 0)
@@ -38941,9 +39004,44 @@ function isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls) {
     return true;
   return imports.some((imp) => imp.from_package === pkg && (imp.imported_name === simple || imp.is_wildcard));
 }
+var JAVA_CHARACTER_CLASS = new Map([["Character", "java.lang"]]);
+var JAVA_CHARACTER_PREDICATES = new Set([
+  "isLetter",
+  "isDigit",
+  "isLetterOrDigit",
+  "isAlphabetic",
+  "isWhitespace",
+  "isSpaceChar",
+  "isUpperCase",
+  "isLowerCase",
+  "isTitleCase",
+  "isISOControl",
+  "isDefined",
+  "isIdeographic",
+  "isMirrored",
+  "isJavaIdentifierStart",
+  "isJavaIdentifierPart",
+  "isUnicodeIdentifierStart",
+  "isUnicodeIdentifierPart",
+  "isIdentifierIgnorable",
+  "isHighSurrogate",
+  "isLowSurrogate",
+  "isSurrogate",
+  "isSurrogatePair",
+  "isValidCodePoint",
+  "isBmpCodePoint",
+  "isSupplementaryCodePoint"
+]);
+function isJavaCharacterPredicateCall(call, declaredTypeNames, imports) {
+  if (!call.receiver || !JAVA_CHARACTER_PREDICATES.has(call.method_name))
+    return false;
+  return isJdkClassReceiver(call.receiver, JAVA_CHARACTER_CLASS, declaredTypeNames, imports);
+}
 function isJavaNonEscapeCall(call, declaredTypeNames, imports, calls) {
   if (isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls))
     return true;
+  if (isJavaCharacterPredicateCall(call, declaredTypeNames, imports))
+    return true;
   if (call.receiver)
     return false;
   const isCtor = call.is_constructor === true || (call.resolution?.target ?? "").endsWith(".<init>");
@@ -42804,6 +42902,15 @@ class SinkFilterPass {
       const csFields = new Set(ctx.graph.ir.types.flatMap((t) => (t.fields ?? []).map((f) => f.name)));
       const credit = new CSharpCredit(ctx.code, ctx.graph.ir.types.flatMap((t) => t.methods));
       const csSeeds = mergedSources.flatMap((s) => s.variable ? [{ variable: s.variable, line: s.line }] : []);
+      const fieldWritesByType = new Map;
+      const fieldWritesFor = (type) => {
+        let w = fieldWritesByType.get(type);
+        if (!w) {
+          w = credit.fieldWrites(type, csFields);
+          fieldWritesByType.set(type, w);
+        }
+        return w;
+      };
       const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
         if (sink.type === "xxe" && xxeHardened)
@@ -42815,11 +42922,15 @@ class SinkFilterPass {
         const scoped = credit.sanitizedVarsAt(sink.type, sink.line);
         const fileWide = sanitizedByType.get(sink.type);
         const sanitizedVars = new Set(scoped);
+        const fieldWrites = fieldWritesFor(sink.type);
         if (fileWide) {
-          for (const v of fileWide)
-            if (csFields.has(v))
+          for (const v of fileWide) {
+            if (csFields.has(v) && !fieldWrites.unsanitized.has(v))
               sanitizedVars.add(v);
+          }
         }
+        for (const v of fieldWrites.sanitized)
+          sanitizedVars.add(v);
         for (const v of credit.guardedVarsAt(sink.type, sink.line))
           sanitizedVars.add(v);
         for (const v of credit.safeBuilders(sanitizedVars, sink.line))
@@ -45124,26 +45235,38 @@ function resolveJavaDerivedAnchor(varName, derived, realSourceByVar, codeLines,
   }
   return best;
 }
-function javaReceiverChainDerivedVar(code, localVar, seedVar) {
+function javaReceiverChainDerivedVar(rhsByLocal, localVar, seedVar) {
   if (!seedVar || localVar === seedVar)
     return false;
+  const rhsList = rhsByLocal.get(localVar);
+  if (!rhsList)
+    return false;
   const esc = seedVar.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const receiverOnRhs = new RegExp(`(?:^|[^\\w.$])${esc}\\s*\\.`, "u");
+  return rhsList.some((rhs) => receiverOnRhs.test(rhs));
+}
+function indexJavaLocalAssignments(code) {
   const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const index = new Map;
   for (const line of code.split(`
 `)) {
     const trimmed = line.trimStart();
     if (trimmed.startsWith("//") || trimmed.startsWith("*"))
       continue;
+    if (!line.includes("=") || !line.includes(";"))
+      continue;
     const m = declRe.exec(line) ?? assignRe.exec(line);
-    if (!m || m[1] !== localVar)
+    if (!m)
       continue;
+    const list = index.get(m[1]);
     const rhs = stripJavaTrailingComment(m[2]);
-    if (receiverOnRhs.test(rhs))
-      return true;
+    if (list)
+      list.push(rhs);
+    else
+      index.set(m[1], [rhs]);
   }
-  return false;
+  return index;
 }
 function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers) {
   const lines = typeof code === "string" ? code.split(`
@@ -45264,15 +45387,20 @@ class TaintPropagationPass {
     const sinkFilter = ctx.getResult("sink-filter");
     const { sources, sinks, sanitizers } = sinkFilter;
     if (ctx.language === "java" && typeof ctx.code === "string") {
+      const rhsByLocal = indexJavaLocalAssignments(ctx.code);
+      const seen = new Set;
       for (const s of sources) {
-        if (!s.variable)
+        if (!s.variable || seen.has(s.variable))
           continue;
-        for (const [v] of buildJavaTaintedVars(ctx.code, new Set([s.variable]))) {
-          if (v === s.variable)
-            continue;
-          if (javaReceiverChainDerivedVar(ctx.code, v, s.variable)) {
+        seen.add(s.variable);
+        const seedVar = s.variable;
+        const candidates = [...rhsByLocal.keys()].filter((v) => !constProp.tainted.has(v) && javaReceiverChainDerivedVar(rhsByLocal, v, seedVar));
+        if (candidates.length === 0)
+          continue;
+        const derived = buildJavaTaintedVars(ctx.code, new Set([seedVar]));
+        for (const v of candidates) {
+          if (derived.has(v))
             constProp.tainted.add(v);
-          }
         }
       }
     }
@@ -60106,7 +60234,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.16.0";
+var version = "4.16.1";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -60673,8 +60801,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "d14e309",
-  builtAt: "2026-10-17T21:35:31.408Z"
+  gitSha: "7c01fdc",
+  builtAt: "2026-10-18T03:55:29.307Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.16.0",
+  "version": "4.16.1",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.16.0"
+    "circle-ir": "4.16.1"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",