cognium-dev 4.5.0 → 4.6.0

package/dist/cli.js

@@ -43906,6 +43906,49 @@ function methodAcceptsHtmlShapedParam(method) {
   return false;
 }
 
+// ../circle-ir/dist/analysis/passes/insecure-deserialization-config-pass.js
+var ANY_TYPE_PERMISSION_RE = /\bAnyTypePermission\b/;
+
+class InsecureDeserializationConfigPass {
+  name = "insecure-deserialization-config";
+  category = "security";
+  run(ctx) {
+    const { graph, language } = ctx;
+    if (language !== "java")
+      return { findings: [] };
+    const file = graph.ir.meta.file;
+    const findings = [];
+    for (const call of graph.ir.calls) {
+      if (!this.isPermissiveXStreamConfig(call))
+        continue;
+      const line = call.location.line;
+      const api = `addPermission(${call.arguments[0]?.expression ?? "AnyTypePermission"})`;
+      findings.push({ line, api });
+      ctx.addFinding({
+        id: `${this.name}-${file}-${line}`,
+        pass: this.name,
+        category: this.category,
+        rule_id: this.name,
+        cwe: "CWE-502",
+        severity: "high",
+        level: "error",
+        message: "XStream configured with AnyTypePermission (grant-all): untrusted XML " + "passed to fromXML/unmarshal can instantiate arbitrary types (deserialization RCE)",
+        file,
+        line,
+        fix: "Replace AnyTypePermission with an explicit type allow-list: xstream.addPermission(NoTypePermission.NONE) then allowTypes/allowTypesByWildcard for the classes you deserialize.",
+        evidence: { api, language }
+      });
+    }
+    return { findings };
+  }
+  isPermissiveXStreamConfig(call) {
+    if (call.method_name !== "addPermission")
+      return false;
+    const arg0 = call.arguments[0]?.expression;
+    return typeof arg0 === "string" && ANY_TYPE_PERMISSION_RE.test(arg0);
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
 function isWriteStorageCall(call, language) {
   const method = call.method_name ?? "";
@@ -46591,6 +46634,8 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new UnrestrictedFileUploadPass);
     if (!disabledPasses.has("missing-sanitizer-gate"))
       pipeline.add(new MissingSanitizerGatePass);
+    if (!disabledPasses.has("insecure-deserialization-config"))
+      pipeline.add(new InsecureDeserializationConfigPass);
     const { results, findings } = pipeline.run(graph, code, language, config);
     const sinkFilter = results.get("sink-filter");
     const interProc = results.get("interprocedural");
@@ -47855,7 +47900,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.5.0";
+var version = "4.6.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.5.0"
+    "circle-ir": "^4.6.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",