cognium-dev 4.3.1 → 4.4.0

package/dist/cli.js

@@ -5310,6 +5310,35 @@ function extractCSharpCalls(tree, cache) {
       is_constructor: true
     });
   }
+  const assignments = getNodesFromCache(tree.rootNode, "assignment_expression", cache);
+  for (const asn of assignments) {
+    const left = asn.childForFieldName("left");
+    if (left?.type !== "member_access_expression")
+      continue;
+    const nameNode = left.childForFieldName("name");
+    if (!nameNode || getNodeText(nameNode) !== "CommandText")
+      continue;
+    const right = asn.childForFieldName("right");
+    if (!right)
+      continue;
+    const rhsText = getNodeText(right);
+    const exprNode = left.childForFieldName("expression");
+    calls.push({
+      method_name: "CommandText",
+      receiver: exprNode ? getNodeText(exprNode) : null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: [{
+        position: 0,
+        expression: rhsText,
+        variable: right.type === "identifier" ? rhsText : null,
+        literal: right.type === "string_literal" ? rhsText : null,
+        value: null
+      }],
+      location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+      in_method: findEnclosingMethod(asn)
+    });
+  }
   return calls;
 }
 function extractCSharpArguments(argsNode) {
@@ -12284,6 +12313,7 @@ var DEFAULT_SINKS = [
   { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -47778,7 +47808,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.3.1";
+var version = "4.4.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.3.1",
+  "version": "4.4.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.3.1"
+    "circle-ir": "^4.4.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",