cognium-dev 4.3.1 → 4.5.0

package/dist/cli.js

@@ -5268,6 +5268,14 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_COMMAND_EXECUTE_METHODS = new Set([
+  "ExecuteScalar",
+  "ExecuteReader",
+  "ExecuteNonQuery",
+  "ExecuteScalarAsync",
+  "ExecuteReaderAsync",
+  "ExecuteNonQueryAsync"
+]);
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -5285,12 +5293,16 @@ function extractCSharpCalls(tree, cache) {
       methodName = getNodeText(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
+    let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
+    if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
+    }
     calls.push({
       method_name: methodName,
       receiver,
       receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
       receiver_type_fqn: null,
-      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
       in_method: findEnclosingMethod(inv)
     });
@@ -5310,6 +5322,35 @@ function extractCSharpCalls(tree, cache) {
       is_constructor: true
     });
   }
+  const assignments = getNodesFromCache(tree.rootNode, "assignment_expression", cache);
+  for (const asn of assignments) {
+    const left = asn.childForFieldName("left");
+    if (left?.type !== "member_access_expression")
+      continue;
+    const nameNode = left.childForFieldName("name");
+    if (!nameNode || getNodeText(nameNode) !== "CommandText")
+      continue;
+    const right = asn.childForFieldName("right");
+    if (!right)
+      continue;
+    const rhsText = getNodeText(right);
+    const exprNode = left.childForFieldName("expression");
+    calls.push({
+      method_name: "CommandText",
+      receiver: exprNode ? getNodeText(exprNode) : null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: [{
+        position: 0,
+        expression: rhsText,
+        variable: right.type === "identifier" ? rhsText : null,
+        literal: right.type === "string_literal" ? rhsText : null,
+        value: null
+      }],
+      location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+      in_method: findEnclosingMethod(asn)
+    });
+  }
   return calls;
 }
 function extractCSharpArguments(argsNode) {
@@ -12284,6 +12325,13 @@ var DEFAULT_SINKS = [
   { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteScalar", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteReader", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteNonQuery", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteScalarAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -25589,18 +25637,20 @@ function findCSharpRequestSources(sourceCode, language) {
 `);
   const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
+  const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m)
       continue;
     const [, varName, rhs] = m;
-    if (!requestReadRe.test(rhs))
+    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : null;
+    if (!type)
       continue;
     const lineNumber = i2 + 1;
     if (sources.some((s) => s.line === lineNumber && s.variable === varName))
       continue;
     sources.push({
-      type: "http_param",
+      type,
       location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? "..." : ""}`,
       severity: "high",
       line: lineNumber,
@@ -35990,6 +36040,33 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  if (language === "csharp" && typeof code === "string" && sourcesWithVar.length > 0) {
+    const lines = code.split(`
+`);
+    const ctRe = /(\w+)\s*\.\s*CommandText\s*\+?=\s*(.+)/;
+    const anchor = sourcesWithVar.reduce((a, s) => s.line < a.line ? s : a, sourcesWithVar[0]);
+    let added = true;
+    let guard = 0;
+    while (added && guard < lines.length + 2) {
+      added = false;
+      guard++;
+      const known = new Set(sourcesWithVar.map((s) => s.variable));
+      for (let i2 = 0;i2 < lines.length; i2++) {
+        const m = ctRe.exec(lines[i2]);
+        if (!m)
+          continue;
+        const [, obj, rhs] = m;
+        if (known.has(obj))
+          continue;
+        const codePart = rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ");
+        const rhsTainted = sourcesWithVar.some((s) => new RegExp(`(?<![\\p{L}\\p{N}_])${s.variable.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}(?![\\p{L}\\p{N}_])`, "u").test(codePart));
+        if (!rhsTainted)
+          continue;
+        sourcesWithVar.push({ ...anchor, variable: obj, line: i2 + 1 });
+        added = true;
+      }
+    }
+  }
   const reCache = new Map;
   for (const s of sourcesWithVar) {
     if (reCache.has(s.variable))
@@ -47778,7 +47855,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.3.1";
+var version = "4.5.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.3.1",
+  "version": "4.5.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.3.1"
+    "circle-ir": "^4.5.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",