cognium-dev 4.6.0 → 4.7.1

package/dist/cli.js

@@ -9350,13 +9350,15 @@ function computeChains(defs, uses) {
     existing.push(use);
     usesByLine.set(use.line, existing);
   }
+  const seenChains = new Set;
   for (const def of defs) {
     if (def.kind === "local") {
       const usesOnLine = usesByLine.get(def.line) ?? [];
       for (const use of usesOnLine) {
         if (use.def_id !== null && use.def_id !== def.id) {
-          const exists = chains.some((c) => c.from_def === use.def_id && c.to_def === def.id && c.via === use.variable);
-          if (!exists) {
+          const key = `${use.def_id}\x00${def.id}\x00${use.variable}`;
+          if (!seenChains.has(key)) {
+            seenChains.add(key);
             chains.push({
               from_def: use.def_id,
               to_def: def.id,
@@ -11531,7 +11533,7 @@ var DEFAULT_SINKS = [
   { method: "validate", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "startElement", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
   { method: "characters", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
+  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], exclude_languages: ["rust"] },
   { method: "setOutput", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "writeAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
   { method: "startElement", class: "MagicSAXFilter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
@@ -12332,7 +12334,7 @@ var DEFAULT_SINKS = [
   { method: "ExecuteScalarAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteReaderAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteNonQueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
-  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Start", class: "Process", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ProcessStartInfo", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1], languages: ["csharp"] },
   { method: "ReadAllText", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "ReadAllBytes", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12366,6 +12368,11 @@ var DEFAULT_SINKS = [
   { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  { method: "RedirectPermanent", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
+  { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Compile", class: "XPathExpression", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -25027,6 +25034,7 @@ class LanguageSourcesPass {
     additionalSources.push(...findSetterChainSources(types, code, language));
     additionalSources.push(...findJavaScriptAssignmentSources(code, language));
     additionalSources.push(...findCSharpRequestSources(code, language));
+    additionalSources.push(...findGoArgvSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -25629,6 +25637,35 @@ function findSetterChainSources(types, sourceCode, language) {
   }
   return sources;
 }
+function findGoArgvSources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const rangeRe = /\bfor\b[^;{]*?,\s*([A-Za-z_]\w*)\s*:?=\s*range\s+os\.Args\b/;
+  const assignRe = /\b([A-Za-z_]\w*)\s*:?=\s*os\.Args\b/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const rm = rangeRe.exec(line);
+    const m = rm ?? assignRe.exec(line);
+    if (!m)
+      continue;
+    const varName = m[1];
+    const lineNumber = i2 + 1;
+    if (sources.some((s) => s.line === lineNumber && s.variable === varName))
+      continue;
+    sources.push({
+      type: "io_input",
+      location: `${varName} = os.Args`,
+      severity: "high",
+      line: lineNumber,
+      confidence: 1,
+      variable: varName
+    });
+  }
+  return sources;
+}
 function findCSharpRequestSources(sourceCode, language) {
   if (language !== "csharp")
     return [];
@@ -25638,12 +25675,13 @@ function findCSharpRequestSources(sourceCode, language) {
   const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
+  const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m)
       continue;
     const [, varName, rhs] = m;
-    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : null;
+    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
     if (!type)
       continue;
     const lineNumber = i2 + 1;
@@ -26591,7 +26629,7 @@ function findBashTaintSources(sourceCode, dfg) {
         });
       }
     }
-    const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})\}/g;
+    const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})(?:[:#%/^,@!*+?=-][^}]*)?\}/g;
     let em;
     while ((em = envRe.exec(line)) !== null) {
       const envVar = em[1] ?? em[2];
@@ -33360,7 +33398,10 @@ class SinkFilterPass {
       const sourceLines = ctx.code.split(`
 `);
       const sanitizedByType = csharpSanitizedVarsByType(ctx.code);
+      const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
+        if (sink.type === "xxe" && xxeHardened)
+          return false;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
         for (const { re, type } of CSHARP_SANITIZER_RES) {
           if (type === sink.type && re.test(sinkLineText))
@@ -36410,6 +36451,26 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     "Command",
     "CommandContext"
   ]);
+  const ormQueryBuilderMethods = new Set([
+    "findMany",
+    "findFirst",
+    "findUnique",
+    "findUniqueOrThrow",
+    "findFirstOrThrow",
+    "findOne",
+    "findAll",
+    "findByPk",
+    "findAndCountAll",
+    "findBy",
+    "findOneBy",
+    "where",
+    "andWhere",
+    "orWhere",
+    "whereIn",
+    "whereNot",
+    "first",
+    "bind"
+  ]);
   const sanitizerMethods = new Set;
   for (const san of sanitizers) {
     sanitizerMethods.add(san.method);
@@ -36434,7 +36495,7 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     }
     const targetMethod = getMethodNode(methodNodes, call.method_name);
     if (!targetMethod) {
-      if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name)) {
+      if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name) && !ormQueryBuilderMethods.has(call.method_name)) {
         const isBash = graph.ir.meta.language === "bash";
         const bashSafeBuiltins = new Set([
           "echo",
@@ -37234,6 +37295,8 @@ function isPublicMethod(method, language) {
   switch (language) {
     case "java":
       return method.modifiers.includes("public");
+    case "csharp":
+      return method.modifiers.includes("public");
     case "javascript":
     case "typescript":
     case "tsx":
@@ -37256,7 +37319,7 @@ class MissingPublicDocPass {
     if (UTIL_DIR_RE.test(graph.ir.meta.file)) {
       return { missingDocMethods: [], missingDocTypes: [] };
     }
-    if (!["java", "javascript", "typescript", "tsx", "python"].includes(language)) {
+    if (!["java", "javascript", "typescript", "tsx", "python", "csharp"].includes(language)) {
       return { missingDocMethods: [], missingDocTypes: [] };
     }
     const lines = code.split(`
@@ -38222,6 +38285,7 @@ var SKIP_NAMES3 = new Set([
   "unknown",
   "bigint"
 ]);
+var EMPTY_LINES = [];
 
 class UnusedVariablePass {
   name = "unused-variable";
@@ -38236,6 +38300,35 @@ class UnusedVariablePass {
 `);
     const unusedVars = [];
     const reported = new Set;
+    const defsByVar = new Map;
+    for (const d of graph.ir.dfg.defs) {
+      const arr = defsByVar.get(d.variable);
+      if (arr)
+        arr.push(d);
+      else
+        defsByVar.set(d.variable, [d]);
+    }
+    const nameLines = new Map;
+    const idRe = /[A-Za-z_][A-Za-z0-9_]*/g;
+    for (let i2 = 0;i2 < codeLines.length; i2++) {
+      const line = codeLines[i2];
+      idRe.lastIndex = 0;
+      let seen = null;
+      let m;
+      while ((m = idRe.exec(line)) !== null) {
+        const w = m[0];
+        if (seen === null)
+          seen = new Set;
+        if (seen.has(w))
+          continue;
+        seen.add(w);
+        const arr = nameLines.get(w);
+        if (arr)
+          arr.push(i2 + 1);
+        else
+          nameLines.set(w, [i2 + 1]);
+      }
+    }
     for (const def of graph.ir.dfg.defs) {
       if (def.kind !== "local")
         continue;
@@ -38252,19 +38345,20 @@ class UnusedVariablePass {
       const uses = graph.usesOfDef(def.id);
       if (uses.length > 0)
         continue;
-      const otherDefs = graph.ir.dfg.defs.filter((d) => d.variable === variable && d.id !== def.id);
+      const otherDefs = (defsByVar.get(variable) ?? []).filter((d) => d.id !== def.id);
       const otherDefLines = new Set(otherDefs.map((d) => d.line));
-      const escapedName = variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const namePattern = new RegExp(`\\b${escapedName}\\b`);
+      const plainName = /^[A-Za-z_][A-Za-z0-9_]*$/.test(variable);
+      const idxLines = plainName ? nameLines.get(variable) ?? EMPTY_LINES : null;
+      const namePattern = plainName ? null : new RegExp(`\\b${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
       if (otherDefLines.size === 0) {
-        const usedElsewhere = codeLines.some((line, idx) => idx !== def.line - 1 && namePattern.test(line));
+        const usedElsewhere = idxLines !== null ? idxLines.some((ln) => ln !== def.line) : codeLines.some((line, idx) => idx !== def.line - 1 && namePattern.test(line));
         if (usedElsewhere)
           continue;
       } else {
         const lineText2 = codeLines[def.line - 1] ?? "";
         const isTrueDeclaration = /\b(?:let|const|var)\s+[\w{[]/.test(lineText2) || /\b(?:int|long|float|double|boolean|byte|char|short|var|final)\b/.test(lineText2) || /\b[A-Z]\w*(?:<[^>]*>)?\s+\w/.test(lineText2) || /\blet\s+(?:mut\s+)?\w/.test(lineText2);
         if (isTrueDeclaration) {
-          const usedBeforeNextDef = codeLines.some((line, idx) => {
+          const usedBeforeNextDef = idxLines !== null ? idxLines.some((ln) => ln !== def.line && !otherDefLines.has(ln) && !otherDefs.some((d) => d.line > def.line && d.line < ln)) : codeLines.some((line, idx) => {
             const lineNum = idx + 1;
             if (lineNum === def.line || otherDefLines.has(lineNum))
               return false;
@@ -38275,7 +38369,7 @@ class UnusedVariablePass {
           if (usedBeforeNextDef)
             continue;
         } else {
-          const usedOnNonDefLine = codeLines.some((line, idx) => {
+          const usedOnNonDefLine = idxLines !== null ? idxLines.some((ln) => ln !== def.line && !otherDefLines.has(ln)) : codeLines.some((line, idx) => {
             const lineNum = idx + 1;
             return lineNum !== def.line && !otherDefLines.has(lineNum) && namePattern.test(line);
           });
@@ -42231,6 +42325,30 @@ var WEAK_HASH_NAMES = new Set([
   "sha-1",
   "sha1"
 ]);
+var CSHARP_WEAK_HASH_CLASSES = new Set(["MD5", "SHA1"]);
+var CSHARP_HASH_FACTORY_RECEIVERS = new Set([
+  "HashAlgorithm",
+  "KeyedHashAlgorithm",
+  "HMAC",
+  "CryptoConfig"
+]);
+var CSHARP_WEAK_HASH_CTORS = {
+  MD5CryptoServiceProvider: "md5",
+  MD5Cng: "md5",
+  SHA1CryptoServiceProvider: "sha1",
+  SHA1Managed: "sha1",
+  SHA1Cng: "sha1",
+  HMACMD5: "md5",
+  HMACSHA1: "sha1"
+};
+function csharpWeakHashAlgo(cleaned) {
+  if (!cleaned)
+    return null;
+  const base = (cleaned.split(".").pop() ?? cleaned).replace(/^hmac/, "");
+  if (base === "sha")
+    return "sha1";
+  return WEAK_HASH_NAMES.has(base) ? base : null;
+}
 var COMMONS_DIGEST_METHODS = new Set([
   "md2",
   "md2Hex",
@@ -42401,6 +42519,20 @@ class WeakHashPass {
       }
       return null;
     }
+    if (language === "csharp") {
+      if ((method === "Create" || method === "HashData") && CSHARP_WEAK_HASH_CLASSES.has(receiver)) {
+        return { algorithm: receiver.toLowerCase(), api: `${receiver}.${method}` };
+      }
+      if ((method === "Create" || method === "CreateFromName") && CSHARP_HASH_FACTORY_RECEIVERS.has(receiver)) {
+        const algo = csharpWeakHashAlgo(literalAlgo(call, 0));
+        if (algo)
+          return { algorithm: algo, api: `${receiver}.${method}` };
+      }
+      if (call.is_constructor && CSHARP_WEAK_HASH_CTORS[method]) {
+        return { algorithm: CSHARP_WEAK_HASH_CTORS[method], api: `new ${method}()` };
+      }
+      return null;
+    }
     return null;
   }
 }
@@ -42457,6 +42589,30 @@ var WEAK_CIPHER_BASES = new Set([
   "seed",
   "cast5"
 ]);
+var CSHARP_WEAK_CIPHER_CLASSES = new Set(["DES", "TripleDES", "RC2", "RC4"]);
+var CSHARP_CIPHER_FACTORY_RECEIVERS = new Set(["SymmetricAlgorithm", "CryptoConfig"]);
+var CSHARP_WEAK_CIPHER_CTORS = {
+  DESCryptoServiceProvider: "des",
+  TripleDESCryptoServiceProvider: "3des",
+  RC2CryptoServiceProvider: "rc2"
+};
+var CSHARP_RSA_FACTORY_CLASSES = new Set(["RSA", "DSA"]);
+var CSHARP_RSA_CTORS = new Set([
+  "RSACryptoServiceProvider",
+  "DSACryptoServiceProvider",
+  "RSACng",
+  "DSACng"
+]);
+function csharpWeakCipher(cleaned) {
+  if (!cleaned)
+    return null;
+  const base = (cleaned.split(".").pop() ?? cleaned).toLowerCase();
+  if (base === "tripledes" || base === "desede")
+    return "3des";
+  if (base === "arc4")
+    return "rc4";
+  return WEAK_CIPHER_BASES.has(base) ? base : null;
+}
 function classifyJavaCipherSpec(spec) {
   const parts2 = spec.split("/").map((p) => p.trim().toLowerCase());
   const base = parts2[0] ?? "";
@@ -42880,6 +43036,35 @@ class WeakCryptoPass {
       }
       return out2;
     }
+    if (language === "csharp") {
+      if (method === "Create" && CSHARP_WEAK_CIPHER_CLASSES.has(receiver)) {
+        const base = receiver === "TripleDES" ? "3des" : receiver.toLowerCase();
+        out2.push({ issue: "weak-cipher", detail: base, api: `${receiver}.Create` });
+      }
+      if ((method === "Create" || method === "CreateFromName") && CSHARP_CIPHER_FACTORY_RECEIVERS.has(receiver)) {
+        const base = csharpWeakCipher(literalAlgo2(call, 0));
+        if (base)
+          out2.push({ issue: "weak-cipher", detail: base, api: `${receiver}.${method}` });
+      }
+      if (call.is_constructor && CSHARP_WEAK_CIPHER_CTORS[method]) {
+        out2.push({ issue: "weak-cipher", detail: CSHARP_WEAK_CIPHER_CTORS[method], api: `new ${method}()` });
+      }
+      const rsaFactory = method === "Create" && CSHARP_RSA_FACTORY_CLASSES.has(receiver);
+      const rsaCtor = call.is_constructor && CSHARP_RSA_CTORS.has(method);
+      if (rsaFactory || rsaCtor) {
+        const sizeArg = call.arguments.find((a) => a.position === 0);
+        const expr = (sizeArg?.literal ?? sizeArg?.expression ?? "").trim();
+        const n = parseInt(expr, 10);
+        if (Number.isFinite(n) && n > 0 && n < 2048) {
+          out2.push({
+            issue: "weak-rsa-key",
+            detail: String(n),
+            api: rsaCtor ? `new ${method}()` : `${receiver}.Create`
+          });
+        }
+      }
+      return out2;
+    }
     return out2;
   }
 }
@@ -43610,9 +43795,7 @@ class InfoDisclosureStacktracePass {
 // ../circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
 var UPLOAD_NAME_RE = /(?:getOriginalFilename|getSubmittedFileName|originalname|originalName|\.filename|\.Filename|FileHeader\.Filename|UploadFile)/;
 var FILE_SAFE_CALL_RE = /(?:secure_filename|FilenameUtils\.getExtension|\.lastIndexOf\(['"]\.['"]\)|ALLOWED_EXT|ALLOWED_EXTENSIONS|allowedExtensions|\bfileFilter\b|filepath\.Ext|path\.extname)/;
-function lineWindow(code, startLine, endLine) {
-  const lines = code.split(`
-`);
+function lineWindow(lines, startLine, endLine) {
   const s = Math.max(0, startLine - 1);
   const e = Math.min(lines.length, endLine);
   return lines.slice(s, e).join(`
@@ -43636,10 +43819,12 @@ class UnrestrictedFileUploadPass {
     const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
     const findings = [];
+    const codeLines = code.split(`
+`);
     const safeFunctionRanges = [];
     for (const t of graph.ir.types) {
       for (const m of t.methods) {
-        const body2 = lineWindow(code, m.start_line, m.end_line);
+        const body2 = lineWindow(codeLines, m.start_line, m.end_line);
         if (FILE_SAFE_CALL_RE.test(body2)) {
           safeFunctionRanges.push({ start: m.start_line, end: m.end_line });
         }
@@ -43650,7 +43835,7 @@ class UnrestrictedFileUploadPass {
         if (line >= r.start && line <= r.end)
           return true;
       }
-      const win = lineWindow(code, Math.max(1, line - 20), line + 5);
+      const win = lineWindow(codeLines, Math.max(1, line - 20), line + 5);
       return FILE_SAFE_CALL_RE.test(win);
     };
     if (language === "java") {
@@ -47900,7 +48085,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.6.0";
+var version = "4.7.1";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.6.0",
+  "version": "4.7.1",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.6.0"
+    "circle-ir": "^4.7.1"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",