cognium-dev 4.4.0 → 4.6.0

package/dist/cli.js

@@ -5268,6 +5268,14 @@ function findFirstDescendant(node, type) {
   }
   return null;
 }
+var CSHARP_COMMAND_EXECUTE_METHODS = new Set([
+  "ExecuteScalar",
+  "ExecuteReader",
+  "ExecuteNonQuery",
+  "ExecuteScalarAsync",
+  "ExecuteReaderAsync",
+  "ExecuteNonQueryAsync"
+]);
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -5285,12 +5293,16 @@ function extractCSharpCalls(tree, cache) {
       methodName = getNodeText(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
+    let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
+    if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
+    }
     calls.push({
       method_name: methodName,
       receiver,
       receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
       receiver_type_fqn: null,
-      arguments: argsNode ? extractCSharpArguments(argsNode) : [],
+      arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
       in_method: findEnclosingMethod(inv)
     });
@@ -12314,6 +12326,12 @@ var DEFAULT_SINKS = [
   { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteScalar", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteReader", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteNonQuery", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteScalarAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -25619,18 +25637,20 @@ function findCSharpRequestSources(sourceCode, language) {
 `);
   const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
+  const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m)
       continue;
     const [, varName, rhs] = m;
-    if (!requestReadRe.test(rhs))
+    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : null;
+    if (!type)
       continue;
     const lineNumber = i2 + 1;
     if (sources.some((s) => s.line === lineNumber && s.variable === varName))
       continue;
     sources.push({
-      type: "http_param",
+      type,
       location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? "..." : ""}`,
       severity: "high",
       line: lineNumber,
@@ -36020,6 +36040,33 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  if (language === "csharp" && typeof code === "string" && sourcesWithVar.length > 0) {
+    const lines = code.split(`
+`);
+    const ctRe = /(\w+)\s*\.\s*CommandText\s*\+?=\s*(.+)/;
+    const anchor = sourcesWithVar.reduce((a, s) => s.line < a.line ? s : a, sourcesWithVar[0]);
+    let added = true;
+    let guard = 0;
+    while (added && guard < lines.length + 2) {
+      added = false;
+      guard++;
+      const known = new Set(sourcesWithVar.map((s) => s.variable));
+      for (let i2 = 0;i2 < lines.length; i2++) {
+        const m = ctRe.exec(lines[i2]);
+        if (!m)
+          continue;
+        const [, obj, rhs] = m;
+        if (known.has(obj))
+          continue;
+        const codePart = rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ");
+        const rhsTainted = sourcesWithVar.some((s) => new RegExp(`(?<![\\p{L}\\p{N}_])${s.variable.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}(?![\\p{L}\\p{N}_])`, "u").test(codePart));
+        if (!rhsTainted)
+          continue;
+        sourcesWithVar.push({ ...anchor, variable: obj, line: i2 + 1 });
+        added = true;
+      }
+    }
+  }
   const reCache = new Map;
   for (const s of sourcesWithVar) {
     if (reCache.has(s.variable))
@@ -43859,6 +43906,49 @@ function methodAcceptsHtmlShapedParam(method) {
   return false;
 }
 
+// ../circle-ir/dist/analysis/passes/insecure-deserialization-config-pass.js
+var ANY_TYPE_PERMISSION_RE = /\bAnyTypePermission\b/;
+
+class InsecureDeserializationConfigPass {
+  name = "insecure-deserialization-config";
+  category = "security";
+  run(ctx) {
+    const { graph, language } = ctx;
+    if (language !== "java")
+      return { findings: [] };
+    const file = graph.ir.meta.file;
+    const findings = [];
+    for (const call of graph.ir.calls) {
+      if (!this.isPermissiveXStreamConfig(call))
+        continue;
+      const line = call.location.line;
+      const api = `addPermission(${call.arguments[0]?.expression ?? "AnyTypePermission"})`;
+      findings.push({ line, api });
+      ctx.addFinding({
+        id: `${this.name}-${file}-${line}`,
+        pass: this.name,
+        category: this.category,
+        rule_id: this.name,
+        cwe: "CWE-502",
+        severity: "high",
+        level: "error",
+        message: "XStream configured with AnyTypePermission (grant-all): untrusted XML " + "passed to fromXML/unmarshal can instantiate arbitrary types (deserialization RCE)",
+        file,
+        line,
+        fix: "Replace AnyTypePermission with an explicit type allow-list: xstream.addPermission(NoTypePermission.NONE) then allowTypes/allowTypesByWildcard for the classes you deserialize.",
+        evidence: { api, language }
+      });
+    }
+    return { findings };
+  }
+  isPermissiveXStreamConfig(call) {
+    if (call.method_name !== "addPermission")
+      return false;
+    const arg0 = call.arguments[0]?.expression;
+    return typeof arg0 === "string" && ANY_TYPE_PERMISSION_RE.test(arg0);
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
 function isWriteStorageCall(call, language) {
   const method = call.method_name ?? "";
@@ -46544,6 +46634,8 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new UnrestrictedFileUploadPass);
     if (!disabledPasses.has("missing-sanitizer-gate"))
       pipeline.add(new MissingSanitizerGatePass);
+    if (!disabledPasses.has("insecure-deserialization-config"))
+      pipeline.add(new InsecureDeserializationConfigPass);
     const { results, findings } = pipeline.run(graph, code, language, config);
     const sinkFilter = results.get("sink-filter");
     const interProc = results.get("interprocedural");
@@ -47808,7 +47900,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.4.0";
+var version = "4.6.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.4.0",
+  "version": "4.6.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.4.0"
+    "circle-ir": "^4.6.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",