cognium-dev 4.7.0 → 4.7.1

package/dist/cli.js

@@ -9350,13 +9350,15 @@ function computeChains(defs, uses) {
     existing.push(use);
     usesByLine.set(use.line, existing);
   }
+  const seenChains = new Set;
   for (const def of defs) {
     if (def.kind === "local") {
       const usesOnLine = usesByLine.get(def.line) ?? [];
       for (const use of usesOnLine) {
         if (use.def_id !== null && use.def_id !== def.id) {
-          const exists = chains.some((c) => c.from_def === use.def_id && c.to_def === def.id && c.via === use.variable);
-          if (!exists) {
+          const key = `${use.def_id}\x00${def.id}\x00${use.variable}`;
+          if (!seenChains.has(key)) {
+            seenChains.add(key);
             chains.push({
               from_def: use.def_id,
               to_def: def.id,
@@ -11531,7 +11533,7 @@ var DEFAULT_SINKS = [
   { method: "validate", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "startElement", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
   { method: "characters", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
+  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], exclude_languages: ["rust"] },
   { method: "setOutput", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "writeAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
   { method: "startElement", class: "MagicSAXFilter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
@@ -25032,6 +25034,7 @@ class LanguageSourcesPass {
     additionalSources.push(...findSetterChainSources(types, code, language));
     additionalSources.push(...findJavaScriptAssignmentSources(code, language));
     additionalSources.push(...findCSharpRequestSources(code, language));
+    additionalSources.push(...findGoArgvSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -25634,6 +25637,35 @@ function findSetterChainSources(types, sourceCode, language) {
   }
   return sources;
 }
+function findGoArgvSources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const rangeRe = /\bfor\b[^;{]*?,\s*([A-Za-z_]\w*)\s*:?=\s*range\s+os\.Args\b/;
+  const assignRe = /\b([A-Za-z_]\w*)\s*:?=\s*os\.Args\b/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const rm = rangeRe.exec(line);
+    const m = rm ?? assignRe.exec(line);
+    if (!m)
+      continue;
+    const varName = m[1];
+    const lineNumber = i2 + 1;
+    if (sources.some((s) => s.line === lineNumber && s.variable === varName))
+      continue;
+    sources.push({
+      type: "io_input",
+      location: `${varName} = os.Args`,
+      severity: "high",
+      line: lineNumber,
+      confidence: 1,
+      variable: varName
+    });
+  }
+  return sources;
+}
 function findCSharpRequestSources(sourceCode, language) {
   if (language !== "csharp")
     return [];
@@ -26597,7 +26629,7 @@ function findBashTaintSources(sourceCode, dfg) {
         });
       }
     }
-    const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})\}/g;
+    const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})(?:[:#%/^,@!*+?=-][^}]*)?\}/g;
     let em;
     while ((em = envRe.exec(line)) !== null) {
       const envVar = em[1] ?? em[2];
@@ -36419,6 +36451,26 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     "Command",
     "CommandContext"
   ]);
+  const ormQueryBuilderMethods = new Set([
+    "findMany",
+    "findFirst",
+    "findUnique",
+    "findUniqueOrThrow",
+    "findFirstOrThrow",
+    "findOne",
+    "findAll",
+    "findByPk",
+    "findAndCountAll",
+    "findBy",
+    "findOneBy",
+    "where",
+    "andWhere",
+    "orWhere",
+    "whereIn",
+    "whereNot",
+    "first",
+    "bind"
+  ]);
   const sanitizerMethods = new Set;
   for (const san of sanitizers) {
     sanitizerMethods.add(san.method);
@@ -36443,7 +36495,7 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     }
     const targetMethod = getMethodNode(methodNodes, call.method_name);
     if (!targetMethod) {
-      if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name)) {
+      if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name) && !ormQueryBuilderMethods.has(call.method_name)) {
         const isBash = graph.ir.meta.language === "bash";
         const bashSafeBuiltins = new Set([
           "echo",
@@ -38233,6 +38285,7 @@ var SKIP_NAMES3 = new Set([
   "unknown",
   "bigint"
 ]);
+var EMPTY_LINES = [];
 
 class UnusedVariablePass {
   name = "unused-variable";
@@ -38247,6 +38300,35 @@ class UnusedVariablePass {
 `);
     const unusedVars = [];
     const reported = new Set;
+    const defsByVar = new Map;
+    for (const d of graph.ir.dfg.defs) {
+      const arr = defsByVar.get(d.variable);
+      if (arr)
+        arr.push(d);
+      else
+        defsByVar.set(d.variable, [d]);
+    }
+    const nameLines = new Map;
+    const idRe = /[A-Za-z_][A-Za-z0-9_]*/g;
+    for (let i2 = 0;i2 < codeLines.length; i2++) {
+      const line = codeLines[i2];
+      idRe.lastIndex = 0;
+      let seen = null;
+      let m;
+      while ((m = idRe.exec(line)) !== null) {
+        const w = m[0];
+        if (seen === null)
+          seen = new Set;
+        if (seen.has(w))
+          continue;
+        seen.add(w);
+        const arr = nameLines.get(w);
+        if (arr)
+          arr.push(i2 + 1);
+        else
+          nameLines.set(w, [i2 + 1]);
+      }
+    }
     for (const def of graph.ir.dfg.defs) {
       if (def.kind !== "local")
         continue;
@@ -38263,19 +38345,20 @@ class UnusedVariablePass {
       const uses = graph.usesOfDef(def.id);
       if (uses.length > 0)
         continue;
-      const otherDefs = graph.ir.dfg.defs.filter((d) => d.variable === variable && d.id !== def.id);
+      const otherDefs = (defsByVar.get(variable) ?? []).filter((d) => d.id !== def.id);
       const otherDefLines = new Set(otherDefs.map((d) => d.line));
-      const escapedName = variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const namePattern = new RegExp(`\\b${escapedName}\\b`);
+      const plainName = /^[A-Za-z_][A-Za-z0-9_]*$/.test(variable);
+      const idxLines = plainName ? nameLines.get(variable) ?? EMPTY_LINES : null;
+      const namePattern = plainName ? null : new RegExp(`\\b${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
       if (otherDefLines.size === 0) {
-        const usedElsewhere = codeLines.some((line, idx) => idx !== def.line - 1 && namePattern.test(line));
+        const usedElsewhere = idxLines !== null ? idxLines.some((ln) => ln !== def.line) : codeLines.some((line, idx) => idx !== def.line - 1 && namePattern.test(line));
         if (usedElsewhere)
           continue;
       } else {
         const lineText2 = codeLines[def.line - 1] ?? "";
         const isTrueDeclaration = /\b(?:let|const|var)\s+[\w{[]/.test(lineText2) || /\b(?:int|long|float|double|boolean|byte|char|short|var|final)\b/.test(lineText2) || /\b[A-Z]\w*(?:<[^>]*>)?\s+\w/.test(lineText2) || /\blet\s+(?:mut\s+)?\w/.test(lineText2);
         if (isTrueDeclaration) {
-          const usedBeforeNextDef = codeLines.some((line, idx) => {
+          const usedBeforeNextDef = idxLines !== null ? idxLines.some((ln) => ln !== def.line && !otherDefLines.has(ln) && !otherDefs.some((d) => d.line > def.line && d.line < ln)) : codeLines.some((line, idx) => {
             const lineNum = idx + 1;
             if (lineNum === def.line || otherDefLines.has(lineNum))
               return false;
@@ -38286,7 +38369,7 @@ class UnusedVariablePass {
           if (usedBeforeNextDef)
             continue;
         } else {
-          const usedOnNonDefLine = codeLines.some((line, idx) => {
+          const usedOnNonDefLine = idxLines !== null ? idxLines.some((ln) => ln !== def.line && !otherDefLines.has(ln)) : codeLines.some((line, idx) => {
             const lineNum = idx + 1;
             return lineNum !== def.line && !otherDefLines.has(lineNum) && namePattern.test(line);
           });
@@ -43712,9 +43795,7 @@ class InfoDisclosureStacktracePass {
 // ../circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
 var UPLOAD_NAME_RE = /(?:getOriginalFilename|getSubmittedFileName|originalname|originalName|\.filename|\.Filename|FileHeader\.Filename|UploadFile)/;
 var FILE_SAFE_CALL_RE = /(?:secure_filename|FilenameUtils\.getExtension|\.lastIndexOf\(['"]\.['"]\)|ALLOWED_EXT|ALLOWED_EXTENSIONS|allowedExtensions|\bfileFilter\b|filepath\.Ext|path\.extname)/;
-function lineWindow(code, startLine, endLine) {
-  const lines = code.split(`
-`);
+function lineWindow(lines, startLine, endLine) {
   const s = Math.max(0, startLine - 1);
   const e = Math.min(lines.length, endLine);
   return lines.slice(s, e).join(`
@@ -43738,10 +43819,12 @@ class UnrestrictedFileUploadPass {
     const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
     const findings = [];
+    const codeLines = code.split(`
+`);
     const safeFunctionRanges = [];
     for (const t of graph.ir.types) {
       for (const m of t.methods) {
-        const body2 = lineWindow(code, m.start_line, m.end_line);
+        const body2 = lineWindow(codeLines, m.start_line, m.end_line);
         if (FILE_SAFE_CALL_RE.test(body2)) {
           safeFunctionRanges.push({ start: m.start_line, end: m.end_line });
         }
@@ -43752,7 +43835,7 @@ class UnrestrictedFileUploadPass {
         if (line >= r.start && line <= r.end)
           return true;
       }
-      const win = lineWindow(code, Math.max(1, line - 20), line + 5);
+      const win = lineWindow(codeLines, Math.max(1, line - 20), line + 5);
       return FILE_SAFE_CALL_RE.test(win);
     };
     if (language === "java") {
@@ -48002,7 +48085,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.7.0";
+var version = "4.7.1";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.7.0",
+  "version": "4.7.1",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.7.0"
+    "circle-ir": "^4.7.1"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",