cognium-dev 4.6.0 → 4.7.0

package/dist/cli.js

@@ -12332,7 +12332,7 @@ var DEFAULT_SINKS = [
   { method: "ExecuteScalarAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
-  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "ReadAllBytes", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12366,6 +12366,11 @@ var DEFAULT_SINKS = [
   { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  { method: "RedirectPermanent", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Compile", class: "XPathExpression", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -25638,12 +25643,13 @@ function findCSharpRequestSources(sourceCode, language) {
   const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
+  const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m)
       continue;
     const [, varName, rhs] = m;
-    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : null;
+    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
     if (!type)
       continue;
     const lineNumber = i2 + 1;
@@ -33360,7 +33366,10 @@ class SinkFilterPass {
       const sourceLines = ctx.code.split(`
 `);
       const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
+      const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
+        if (sink.type === "xxe" && xxeHardened)
+          return false;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
         for (const { re, type } of CSHARP_SANITIZER_RES) {
           if (type === sink.type && re.test(sinkLineText))
@@ -37234,6 +37243,8 @@ function isPublicMethod(method, language) {
   switch (language) {
     case "java":
       return method.modifiers.includes("public");
+    case "csharp":
+      return method.modifiers.includes("public");
     case "javascript":
     case "typescript":
     case "tsx":
@@ -37256,7 +37267,7 @@ class MissingPublicDocPass {
     if (UTIL_DIR_RE.test(graph.ir.meta.file)) {
       return { missingDocMethods: [], missingDocTypes: [] };
     }
-    if (!["java", "javascript", "typescript", "tsx", "python"].includes(language)) {
+    if (!["java", "javascript", "typescript", "tsx", "python", "csharp"].includes(language)) {
       return { missingDocMethods: [], missingDocTypes: [] };
     }
     const lines = code.split(`
@@ -42231,6 +42242,30 @@ var WEAK_HASH_NAMES = new Set([
   "sha-1",
   "sha1"
 ]);
+var CSHARP_WEAK_HASH_CLASSES = new Set(["MD5", "SHA1"]);
+var CSHARP_HASH_FACTORY_RECEIVERS = new Set([
+  "HashAlgorithm",
+  "KeyedHashAlgorithm",
+  "HMAC",
+  "CryptoConfig"
+]);
+var CSHARP_WEAK_HASH_CTORS = {
+  MD5CryptoServiceProvider: "md5",
+  MD5Cng: "md5",
+  SHA1CryptoServiceProvider: "sha1",
+  SHA1Managed: "sha1",
+  SHA1Cng: "sha1",
+  HMACMD5: "md5",
+  HMACSHA1: "sha1"
+};
+function csharpWeakHashAlgo(cleaned) {
+  if (!cleaned)
+    return null;
+  const base = (cleaned.split(".").pop() ?? cleaned).replace(/^hmac/, "");
+  if (base === "sha")
+    return "sha1";
+  return WEAK_HASH_NAMES.has(base) ? base : null;
+}
 var COMMONS_DIGEST_METHODS = new Set([
   "md2",
   "md2Hex",
@@ -42401,6 +42436,20 @@ class WeakHashPass {
       }
       return null;
     }
+    if (language === "csharp") {
+      if ((method === "Create" || method === "HashData") && CSHARP_WEAK_HASH_CLASSES.has(receiver)) {
+        return { algorithm: receiver.toLowerCase(), api: `${receiver}.${method}` };
+      }
+      if ((method === "Create" || method === "CreateFromName") && CSHARP_HASH_FACTORY_RECEIVERS.has(receiver)) {
+        const algo = csharpWeakHashAlgo(literalAlgo(call, 0));
+        if (algo)
+          return { algorithm: algo, api: `${receiver}.${method}` };
+      }
+      if (call.is_constructor && CSHARP_WEAK_HASH_CTORS[method]) {
+        return { algorithm: CSHARP_WEAK_HASH_CTORS[method], api: `new ${method}()` };
+      }
+      return null;
+    }
     return null;
   }
 }
@@ -42457,6 +42506,30 @@ var WEAK_CIPHER_BASES = new Set([
   "seed",
   "cast5"
 ]);
+var CSHARP_WEAK_CIPHER_CLASSES = new Set(["DES", "TripleDES", "RC2", "RC4"]);
+var CSHARP_CIPHER_FACTORY_RECEIVERS = new Set(["SymmetricAlgorithm", "CryptoConfig"]);
+var CSHARP_WEAK_CIPHER_CTORS = {
+  DESCryptoServiceProvider: "des",
+  TripleDESCryptoServiceProvider: "3des",
+  RC2CryptoServiceProvider: "rc2"
+};
+var CSHARP_RSA_FACTORY_CLASSES = new Set(["RSA", "DSA"]);
+var CSHARP_RSA_CTORS = new Set([
+  "RSACryptoServiceProvider",
+  "DSACryptoServiceProvider",
+  "RSACng",
+  "DSACng"
+]);
+function csharpWeakCipher(cleaned) {
+  if (!cleaned)
+    return null;
+  const base = (cleaned.split(".").pop() ?? cleaned).toLowerCase();
+  if (base === "tripledes" || base === "desede")
+    return "3des";
+  if (base === "arc4")
+    return "rc4";
+  return WEAK_CIPHER_BASES.has(base) ? base : null;
+}
 function classifyJavaCipherSpec(spec) {
   const parts2 = spec.split("/").map((p) => p.trim().toLowerCase());
   const base = parts2[0] ?? "";
@@ -42880,6 +42953,35 @@ class WeakCryptoPass {
       }
       return out2;
     }
+    if (language === "csharp") {
+      if (method === "Create" && CSHARP_WEAK_CIPHER_CLASSES.has(receiver)) {
+        const base = receiver === "TripleDES" ? "3des" : receiver.toLowerCase();
+        out2.push({ issue: "weak-cipher", detail: base, api: `${receiver}.Create` });
+      }
+      if ((method === "Create" || method === "CreateFromName") && CSHARP_CIPHER_FACTORY_RECEIVERS.has(receiver)) {
+        const base = csharpWeakCipher(literalAlgo2(call, 0));
+        if (base)
+          out2.push({ issue: "weak-cipher", detail: base, api: `${receiver}.${method}` });
+      }
+      if (call.is_constructor && CSHARP_WEAK_CIPHER_CTORS[method]) {
+        out2.push({ issue: "weak-cipher", detail: CSHARP_WEAK_CIPHER_CTORS[method], api: `new ${method}()` });
+      }
+      const rsaFactory = method === "Create" && CSHARP_RSA_FACTORY_CLASSES.has(receiver);
+      const rsaCtor = call.is_constructor && CSHARP_RSA_CTORS.has(method);
+      if (rsaFactory || rsaCtor) {
+        const sizeArg = call.arguments.find((a) => a.position === 0);
+        const expr = (sizeArg?.literal ?? sizeArg?.expression ?? "").trim();
+        const n = parseInt(expr, 10);
+        if (Number.isFinite(n) && n > 0 && n < 2048) {
+          out2.push({
+            issue: "weak-rsa-key",
+            detail: String(n),
+            api: rsaCtor ? `new ${method}()` : `${receiver}.Create`
+          });
+        }
+      }
+      return out2;
+    }
     return out2;
   }
 }
@@ -47900,7 +48002,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.6.0";
+var version = "4.7.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.6.0",
+  "version": "4.7.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.6.0"
+    "circle-ir": "^4.7.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",