cognium-dev 4.7.0 → 4.7.2

package/dist/cli.js

@@ -9350,13 +9350,15 @@ function computeChains(defs, uses) {
     existing.push(use);
     usesByLine.set(use.line, existing);
   }
+  const seenChains = new Set;
   for (const def of defs) {
     if (def.kind === "local") {
       const usesOnLine = usesByLine.get(def.line) ?? [];
       for (const use of usesOnLine) {
         if (use.def_id !== null && use.def_id !== def.id) {
-          const exists = chains.some((c) => c.from_def === use.def_id && c.to_def === def.id && c.via === use.variable);
-          if (!exists) {
+          const key = `${use.def_id}\x00${def.id}\x00${use.variable}`;
+          if (!seenChains.has(key)) {
+            seenChains.add(key);
             chains.push({
               from_def: use.def_id,
               to_def: def.id,
@@ -11384,7 +11386,7 @@ var DEFAULT_SINKS = [
   { method: "setCommandline", class: "DefaultExecutor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "parse", class: "CommandLine", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "addArgument", class: "CommandLine", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "File", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
+  { method: "File", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], exclude_languages: ["csharp"] },
   { method: "FileInputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileOutputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileReader", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -11531,7 +11533,7 @@ var DEFAULT_SINKS = [
   { method: "validate", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "startElement", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
   { method: "characters", class: "ContentHandler", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
-  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
+  { method: "output", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], exclude_languages: ["rust"] },
   { method: "setOutput", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "writeAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1] },
   { method: "startElement", class: "MagicSAXFilter", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0, 1, 2] },
@@ -12345,6 +12347,18 @@ var DEFAULT_SINKS = [
   { method: "FileStream", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "StreamReader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "StreamWriter", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Copy", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Move", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1], languages: ["csharp"] },
+  { method: "Delete", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Open", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "OpenText", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Create", class: "File", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "AppendAllLines", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "CreateDirectory", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Delete", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetFiles", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "EnumerateFiles", class: "Directory", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "PostAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "PutAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12359,8 +12373,14 @@ var DEFAULT_SINKS = [
   { method: "Create", class: "WebRequest", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Load", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "LoadFrom", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "LoadFile", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Deserialize", class: "BinaryFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Deserialize", class: "NetDataContractSerializer", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "SoapFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "LosFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Deserialize", class: "ObjectStateFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Raw", class: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12371,12 +12391,20 @@ var DEFAULT_SINKS = [
   { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
   { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
   { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogInformation", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogWarning", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogError", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogDebug", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogCritical", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "LogTrace", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "Log", class: "ILogger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1], languages: ["csharp"] },
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Compile", class: "XPathExpression", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "LoadXml", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "XmlDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "XDocument", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "XmlTextReader", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "fetchrow", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -13512,6 +13540,40 @@ function isSafeJSChildProcessCall(call, pattern, language) {
     return false;
   return true;
 }
+function isSafeCSharpProcessStartCall(call, pattern, language) {
+  if (language !== "csharp")
+    return false;
+  if (pattern.type !== "command_injection")
+    return false;
+  if (call.method_name !== "Start")
+    return false;
+  if (call.arguments.length < 2)
+    return false;
+  const fileArg = call.arguments.find((a) => a.position === 0);
+  if (!fileArg)
+    return false;
+  let raw;
+  if (fileArg.literal !== null && fileArg.literal !== undefined) {
+    raw = String(fileArg.literal).trim();
+  } else {
+    raw = (fileArg.expression ?? "").trim();
+  }
+  if (!/^@?"[^"]*"$/.test(raw))
+    return false;
+  const program = (raw.replace(/^@?"|"$/g, "").split(/[\\/]/).pop() ?? "").toLowerCase().replace(/\.exe$/, "");
+  const SHELL_PROGRAMS = new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ash",
+    "ksh",
+    "cmd",
+    "powershell",
+    "pwsh"
+  ]);
+  return !SHELL_PROGRAMS.has(program);
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust")
     return false;
@@ -13802,6 +13864,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeJSChildProcessCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeCSharpProcessStartCall(call, pattern, language)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== undefined && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }
@@ -14942,7 +15007,7 @@ function canSourceReachSink(sourceType, sinkType) {
     file_input: ["deserialization", "xxe", "path_traversal", "command_injection", "code_injection"],
     network_input: ["sql_injection", "command_injection", "xss", "ssrf", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     config_param: ["sql_injection", "command_injection", "path_traversal", "xss", "ssrf", "log_injection", "format_string"],
-    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    interprocedural_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection", "xxe", "deserialization"],
     plugin_param: ["sql_injection", "command_injection", "path_traversal", "xss", "code_injection", "log_injection", "format_string"]
   };
   const validSinks = sourceToSinkMapping[sourceType];
@@ -25032,6 +25097,7 @@ class LanguageSourcesPass {
     additionalSources.push(...findSetterChainSources(types, code, language));
     additionalSources.push(...findJavaScriptAssignmentSources(code, language));
     additionalSources.push(...findCSharpRequestSources(code, language));
+    additionalSources.push(...findGoArgvSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -25634,6 +25700,35 @@ function findSetterChainSources(types, sourceCode, language) {
   }
   return sources;
 }
+function findGoArgvSources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const rangeRe = /\bfor\b[^;{]*?,\s*([A-Za-z_]\w*)\s*:?=\s*range\s+os\.Args\b/;
+  const assignRe = /\b([A-Za-z_]\w*)\s*:?=\s*os\.Args\b/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const rm = rangeRe.exec(line);
+    const m = rm ?? assignRe.exec(line);
+    if (!m)
+      continue;
+    const varName = m[1];
+    const lineNumber = i2 + 1;
+    if (sources.some((s) => s.line === lineNumber && s.variable === varName))
+      continue;
+    sources.push({
+      type: "io_input",
+      location: `${varName} = os.Args`,
+      severity: "high",
+      line: lineNumber,
+      confidence: 1,
+      variable: varName
+    });
+  }
+  return sources;
+}
 function findCSharpRequestSources(sourceCode, language) {
   if (language !== "csharp")
     return [];
@@ -26411,7 +26506,8 @@ function buildJavaTaintedVars(sourceCode, seedVars) {
       if (knownTainted.has(lhs))
         continue;
       const escaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const ref = [...knownTainted].some((v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhs));
+      const rhsCode = rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
+      const ref = [...knownTainted].some((v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhsCode));
       if (ref) {
         derived.set(lhs, i2 + 1);
         knownTainted.add(lhs);
@@ -26597,7 +26693,7 @@ function findBashTaintSources(sourceCode, dfg) {
         });
       }
     }
-    const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})\}/g;
+    const envRe = /\$([A-Z][A-Z0-9_]{2,})|\$\{([A-Z][A-Z0-9_]{2,})(?:[:#%/^,@!*+?=-][^}]*)?\}/g;
     let em;
     while ((em = envRe.exec(line)) !== null) {
       const envVar = em[1] ?? em[2];
@@ -36419,6 +36515,26 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     "Command",
     "CommandContext"
   ]);
+  const ormQueryBuilderMethods = new Set([
+    "findMany",
+    "findFirst",
+    "findUnique",
+    "findUniqueOrThrow",
+    "findFirstOrThrow",
+    "findOne",
+    "findAll",
+    "findByPk",
+    "findAndCountAll",
+    "findBy",
+    "findOneBy",
+    "where",
+    "andWhere",
+    "orWhere",
+    "whereIn",
+    "whereNot",
+    "first",
+    "bind"
+  ]);
   const sanitizerMethods = new Set;
   for (const san of sanitizers) {
     sanitizerMethods.add(san.method);
@@ -36443,7 +36559,7 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     }
     const targetMethod = getMethodNode(methodNodes, call.method_name);
     if (!targetMethod) {
-      if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name)) {
+      if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name) && !ormQueryBuilderMethods.has(call.method_name)) {
         const isBash = graph.ir.meta.language === "bash";
         const bashSafeBuiltins = new Set([
           "echo",
@@ -38233,6 +38349,7 @@ var SKIP_NAMES3 = new Set([
   "unknown",
   "bigint"
 ]);
+var EMPTY_LINES = [];
 
 class UnusedVariablePass {
   name = "unused-variable";
@@ -38247,6 +38364,35 @@ class UnusedVariablePass {
 `);
     const unusedVars = [];
     const reported = new Set;
+    const defsByVar = new Map;
+    for (const d of graph.ir.dfg.defs) {
+      const arr = defsByVar.get(d.variable);
+      if (arr)
+        arr.push(d);
+      else
+        defsByVar.set(d.variable, [d]);
+    }
+    const nameLines = new Map;
+    const idRe = /[A-Za-z_][A-Za-z0-9_]*/g;
+    for (let i2 = 0;i2 < codeLines.length; i2++) {
+      const line = codeLines[i2];
+      idRe.lastIndex = 0;
+      let seen = null;
+      let m;
+      while ((m = idRe.exec(line)) !== null) {
+        const w = m[0];
+        if (seen === null)
+          seen = new Set;
+        if (seen.has(w))
+          continue;
+        seen.add(w);
+        const arr = nameLines.get(w);
+        if (arr)
+          arr.push(i2 + 1);
+        else
+          nameLines.set(w, [i2 + 1]);
+      }
+    }
     for (const def of graph.ir.dfg.defs) {
       if (def.kind !== "local")
         continue;
@@ -38263,19 +38409,20 @@ class UnusedVariablePass {
       const uses = graph.usesOfDef(def.id);
       if (uses.length > 0)
         continue;
-      const otherDefs = graph.ir.dfg.defs.filter((d) => d.variable === variable && d.id !== def.id);
+      const otherDefs = (defsByVar.get(variable) ?? []).filter((d) => d.id !== def.id);
       const otherDefLines = new Set(otherDefs.map((d) => d.line));
-      const escapedName = variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const namePattern = new RegExp(`\\b${escapedName}\\b`);
+      const plainName = /^[A-Za-z_][A-Za-z0-9_]*$/.test(variable);
+      const idxLines = plainName ? nameLines.get(variable) ?? EMPTY_LINES : null;
+      const namePattern = plainName ? null : new RegExp(`\\b${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
       if (otherDefLines.size === 0) {
-        const usedElsewhere = codeLines.some((line, idx) => idx !== def.line - 1 && namePattern.test(line));
+        const usedElsewhere = idxLines !== null ? idxLines.some((ln) => ln !== def.line) : codeLines.some((line, idx) => idx !== def.line - 1 && namePattern.test(line));
         if (usedElsewhere)
           continue;
       } else {
         const lineText2 = codeLines[def.line - 1] ?? "";
         const isTrueDeclaration = /\b(?:let|const|var)\s+[\w{[]/.test(lineText2) || /\b(?:int|long|float|double|boolean|byte|char|short|var|final)\b/.test(lineText2) || /\b[A-Z]\w*(?:<[^>]*>)?\s+\w/.test(lineText2) || /\blet\s+(?:mut\s+)?\w/.test(lineText2);
         if (isTrueDeclaration) {
-          const usedBeforeNextDef = codeLines.some((line, idx) => {
+          const usedBeforeNextDef = idxLines !== null ? idxLines.some((ln) => ln !== def.line && !otherDefLines.has(ln) && !otherDefs.some((d) => d.line > def.line && d.line < ln)) : codeLines.some((line, idx) => {
             const lineNum = idx + 1;
             if (lineNum === def.line || otherDefLines.has(lineNum))
               return false;
@@ -38286,7 +38433,7 @@ class UnusedVariablePass {
           if (usedBeforeNextDef)
             continue;
         } else {
-          const usedOnNonDefLine = codeLines.some((line, idx) => {
+          const usedOnNonDefLine = idxLines !== null ? idxLines.some((ln) => ln !== def.line && !otherDefLines.has(ln)) : codeLines.some((line, idx) => {
             const lineNum = idx + 1;
             return lineNum !== def.line && !otherDefLines.has(lineNum) && namePattern.test(line);
           });
@@ -41350,6 +41497,10 @@ function isLikelyCredentialAssignment(line) {
     return null;
   if (isAllSameChar(value))
     return null;
+  if (value.toLowerCase() === name2.toLowerCase())
+    return null;
+  if (/^(?:https?:\/\/|urn:|xmlns)/i.test(value))
+    return null;
   if (value.length < 12)
     return null;
   if (shannonEntropy(value) < 3.5)
@@ -43712,9 +43863,7 @@ class InfoDisclosureStacktracePass {
 // ../circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
 var UPLOAD_NAME_RE = /(?:getOriginalFilename|getSubmittedFileName|originalname|originalName|\.filename|\.Filename|FileHeader\.Filename|UploadFile)/;
 var FILE_SAFE_CALL_RE = /(?:secure_filename|FilenameUtils\.getExtension|\.lastIndexOf\(['"]\.['"]\)|ALLOWED_EXT|ALLOWED_EXTENSIONS|allowedExtensions|\bfileFilter\b|filepath\.Ext|path\.extname)/;
-function lineWindow(code, startLine, endLine) {
-  const lines = code.split(`
-`);
+function lineWindow(lines, startLine, endLine) {
   const s = Math.max(0, startLine - 1);
   const e = Math.min(lines.length, endLine);
   return lines.slice(s, e).join(`
@@ -43738,10 +43887,12 @@ class UnrestrictedFileUploadPass {
     const { graph, language, code } = ctx;
     const file = graph.ir.meta.file;
     const findings = [];
+    const codeLines = code.split(`
+`);
     const safeFunctionRanges = [];
     for (const t of graph.ir.types) {
       for (const m of t.methods) {
-        const body2 = lineWindow(code, m.start_line, m.end_line);
+        const body2 = lineWindow(codeLines, m.start_line, m.end_line);
         if (FILE_SAFE_CALL_RE.test(body2)) {
           safeFunctionRanges.push({ start: m.start_line, end: m.end_line });
         }
@@ -43752,7 +43903,7 @@ class UnrestrictedFileUploadPass {
         if (line >= r.start && line <= r.end)
           return true;
       }
-      const win = lineWindow(code, Math.max(1, line - 20), line + 5);
+      const win = lineWindow(codeLines, Math.max(1, line - 20), line + 5);
       return FILE_SAFE_CALL_RE.test(win);
     };
     if (language === "java") {
@@ -48002,7 +48153,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.7.0";
+var version = "4.7.2";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -49080,7 +49231,9 @@ async function initWasm(spin) {
           typescript: join3(wasmDir, "tree-sitter-javascript.wasm"),
           python: join3(wasmDir, "tree-sitter-python.wasm"),
           rust: join3(wasmDir, "tree-sitter-rust.wasm"),
-          html: join3(wasmDir, "tree-sitter-html.wasm")
+          html: join3(wasmDir, "tree-sitter-html.wasm"),
+          csharp: join3(wasmDir, "tree-sitter-csharp.wasm"),
+          tsx: join3(wasmDir, "tree-sitter-tsx.wasm")
         }
       });
     } else {
@@ -49113,7 +49266,9 @@ Please ensure the wasm/ directory is located next to the binary or in your curre
         typescript: wasmBasePath + "tree-sitter-javascript.wasm",
         python: wasmBasePath + "tree-sitter-python.wasm",
         rust: wasmBasePath + "tree-sitter-rust.wasm",
-        html: wasmBasePath + "tree-sitter-html.wasm"
+        html: wasmBasePath + "tree-sitter-html.wasm",
+        csharp: wasmBasePath + "tree-sitter-csharp.wasm",
+        tsx: wasmBasePath + "tree-sitter-tsx.wasm"
       }
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.7.0",
+  "version": "4.7.2",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.7.0"
+    "circle-ir": "^4.7.2"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",