cognium-dev 4.9.10 → 4.9.11

package/dist/cli.js

@@ -5,7 +5,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 // src/cli.ts
 import { readFileSync, existsSync, writeFileSync } from "fs";
 import { stat as stat2, readdir as readdir2 } from "fs/promises";
-import { join as join2, dirname as dirname3, extname, resolve as resolve2, relative as relative4, basename } from "path";
+import { join as join2, dirname as dirname2, extname, resolve, relative as relative3, basename } from "path";
 import { createRequire as createRequire2 } from "module";
 
 // ../../node_modules/web-tree-sitter/web-tree-sitter.js
@@ -5338,6 +5338,27 @@ var CSHARP_COMMAND_EXECUTE_METHODS = new Set([
   "ExecuteReaderAsync",
   "ExecuteNonQueryAsync"
 ]);
+var CSHARP_RECEIVER_URL_METHODS = new Set([
+  "GetAsync",
+  "PostAsync",
+  "PutAsync",
+  "PatchAsync",
+  "DeleteAsync",
+  "HeadAsync",
+  "GetStringAsync",
+  "GetByteArrayAsync",
+  "GetStreamAsync",
+  "GetJsonAsync"
+]);
+var CSHARP_HEADER_RECEIVER_RE = /(^|\.)Headers$/;
+function csharpBareName(node) {
+  if (node.type === "generic_name") {
+    const id = node.childForFieldName("name") ?? node.namedChild(0);
+    if (id)
+      return getNodeText(id);
+  }
+  return getNodeText(node);
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -5349,16 +5370,22 @@ function extractCSharpCalls(tree, cache) {
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
-      methodName = nameNode ? getNodeText(nameNode) : "unknown";
+      methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
     } else if (fn) {
-      methodName = getNodeText(fn);
+      methodName = csharpBareName(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
     let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
     if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
       args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
     }
+    if (methodName === "Add" && receiver && CSHARP_HEADER_RECEIVER_RE.test(receiver)) {
+      methodName = "AddHeader";
+    }
+    if (receiver && args2.length === 0 && CSHARP_RECEIVER_URL_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }];
+    }
     calls.push({
       method_name: methodName,
       receiver,
@@ -5374,7 +5401,7 @@ function extractCSharpCalls(tree, cache) {
     const typeNode = creation.childForFieldName("type");
     const argsNode = creation.childForFieldName("arguments");
     calls.push({
-      method_name: typeNode ? getNodeText(typeNode) : "unknown",
+      method_name: typeNode ? csharpBareName(typeNode) : "unknown",
       receiver: null,
       receiver_type: null,
       receiver_type_fqn: null,
@@ -5387,6 +5414,41 @@ function extractCSharpCalls(tree, cache) {
   const assignments = getNodesFromCache(tree.rootNode, "assignment_expression", cache);
   for (const asn of assignments) {
     const left = asn.childForFieldName("left");
+    if (left?.type === "element_access_expression") {
+      const target = left.childForFieldName("expression");
+      const right2 = asn.childForFieldName("right");
+      if (!target || !right2)
+        continue;
+      if (!CSHARP_HEADER_RECEIVER_RE.test(getNodeText(target)))
+        continue;
+      const subscript = left.childForFieldName("subscript") ?? left.namedChild(1);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: "AddHeader",
+        receiver: getNodeText(target),
+        receiver_type: null,
+        receiver_type_fqn: null,
+        arguments: [
+          {
+            position: 0,
+            expression: subscript ? getNodeText(subscript) : "",
+            variable: null,
+            literal: subscript ? getNodeText(subscript) : null,
+            value: null
+          },
+          {
+            position: 1,
+            expression: rhsText2,
+            variable: right2.type === "identifier" ? rhsText2 : null,
+            literal: right2.type === "string_literal" ? rhsText2 : null,
+            value: null
+          }
+        ],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression")
       continue;
     const nameNode = left.childForFieldName("name");
@@ -12474,6 +12536,17 @@ var DEFAULT_SINKS = [
   { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Query", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirst", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefaultAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingle", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingleOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryMultiple", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Execute", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Filter", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteScalar", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -12515,12 +12588,16 @@ var DEFAULT_SINKS = [
   { method: "DeleteAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStringAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetByteArrayAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetJsonAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PatchAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "HeadAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStreamAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SendAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadString", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadData", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadFile", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1], languages: ["csharp"] },
   { method: "Create", class: "WebRequest", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -12538,6 +12615,7 @@ var DEFAULT_SINKS = [
   { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Content", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Format", class: "String", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12546,12 +12624,18 @@ var DEFAULT_SINKS = [
   { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
   { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
   { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "BsonJavaScript", class: "constructor", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "LogInformation", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogWarning", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogError", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogDebug", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogCritical", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogTrace", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "IsMatch", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Match", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Matches", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Replace", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Regex", class: "constructor", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "Log", class: "ILogger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1], languages: ["csharp"] },
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12691,6 +12775,8 @@ var DEFAULT_SANITIZERS = [
   { method: "encodeToString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   { method: "encodeHexString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "IsLocalUrl", removes: ["open_redirect"] },
+  { method: "LocalRedirect", removes: ["open_redirect"] },
   { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "escapeUrl", removes: ["xss", "ssrf", "open_redirect"] },
@@ -15388,12 +15474,12 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
 // node_modules/circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string", "prompt_injection"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf", "log_injection", "format_string", "prompt_injection"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection", "log_injection"],
@@ -23170,13 +23256,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "format!",
-        type: "format_string",
-        cwe: "CWE-134",
-        severity: "medium",
-        argPositions: [0]
-      },
       {
         method: "from_raw_parts",
         type: "unsafe_memory",
@@ -26134,12 +26213,21 @@ function findCSharpRequestSources(sourceCode, language) {
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
+  const formFileParams = new Set;
+  const formFileDeclRe = /\bIFormFile\s+([A-Za-z_]\w*)/g;
+  for (const line of lines) {
+    const re = new RegExp(formFileDeclRe.source, "g");
+    let d;
+    while ((d = re.exec(line)) !== null)
+      formFileParams.add(d[1]);
+  }
+  const formFileReadRe = formFileParams.size > 0 ? new RegExp(`\\b(?:${[...formFileParams].join("|")})\\s*\\.\\s*(?:FileName|ContentType)\\b`) : null;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m)
       continue;
     const [, varName, rhs] = m;
-    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
+    const type = requestReadRe.test(rhs) ? "http_param" : formFileReadRe?.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
     if (!type)
       continue;
     const lineNumber = i2 + 1;
@@ -48210,14 +48298,14 @@ function toSpdx(deps, meta = {}) {
     relationships
   };
 }
-// ../project-profile-detect/dist/index.js
-import { relative as relative3 } from "path";
+// node_modules/@cognium/project-profile-detect/dist/index.js
+import { relative as relative2 } from "path";
 
-// ../project-profile-detect/dist/walk.js
+// node_modules/@cognium/project-profile-detect/dist/walk.js
 import { readdir, readFile, stat } from "fs/promises";
-import { join, relative as relative2 } from "path";
+import { join, relative } from "path";
 
-// ../project-profile-detect/dist/maven-parse.js
+// node_modules/@cognium/project-profile-detect/dist/maven-parse.js
 var TAG = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "i");
 var ALL_TAGS = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "gi");
 function firstTag(xml, name2) {
@@ -48241,12 +48329,7 @@ var MAVEN_PLUGIN_MAP = {
   "exec-maven-plugin": "application",
   "maven-assembly-plugin": "application"
 };
-var MAVEN_PUBLISH_PLUGIN_URLS = {
-  "central-publishing-maven-plugin": "https://central.sonatype.com/",
-  "nexus-staging-maven-plugin": "https://oss.sonatype.org/"
-};
 function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
-  const parentRef = extractParentRef(xml);
   const stripped = xml.replace(/<parent\b[\s\S]*?<\/parent>/i, "");
   const groupId = firstTag(stripped, "groupId");
   const artifactId = firstTag(stripped, "artifactId");
@@ -48255,15 +48338,10 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
   const buildBlock = firstTag(xml, "build") ?? "";
   const pluginBlocks = allTags(buildBlock, "plugin");
   const plugins = new Set;
-  const publishUrls = new Set;
   for (const p of pluginBlocks) {
     const aid = firstTag(p, "artifactId");
-    if (!aid)
-      continue;
-    if (MAVEN_PLUGIN_MAP[aid])
+    if (aid && MAVEN_PLUGIN_MAP[aid])
       plugins.add(MAVEN_PLUGIN_MAP[aid]);
-    if (MAVEN_PUBLISH_PLUGIN_URLS[aid])
-      publishUrls.add(MAVEN_PUBLISH_PLUGIN_URLS[aid]);
   }
   if (/<parent\b[\s\S]*?<artifactId>\s*spring-boot-starter-parent\s*<\/artifactId>/i.test(xml)) {
     plugins.add("spring-boot");
@@ -48276,8 +48354,7 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
     plugins.add("maven-plugin");
   const distBlock = firstTag(xml, "distributionManagement") ?? "";
   const urls = [
-    ...allTags(distBlock, "url"),
-    ...publishUrls
+    ...allTags(distBlock, "url")
   ].map((u) => u.trim()).filter(Boolean);
   const signals = {
     ...directorySignals,
@@ -48292,36 +48369,11 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
     groupId,
     artifactId,
     version,
-    signals,
-    parentRef
+    signals
   };
 }
-function extractParentRef(xml) {
-  const block = TAG("parent").exec(xml);
-  if (!block)
-    return;
-  const inner = block[1];
-  const groupId = firstTag(inner, "groupId");
-  const artifactId = firstTag(inner, "artifactId");
-  const version = firstTag(inner, "version");
-  let relativePath;
-  let emptyRelativePath = false;
-  const selfClosing = /<relativePath\b[^>]*\/\s*>/i.test(inner);
-  if (selfClosing) {
-    emptyRelativePath = true;
-  } else {
-    const rp = firstTag(inner, "relativePath");
-    if (rp !== undefined) {
-      if (rp.length === 0)
-        emptyRelativePath = true;
-      else
-        relativePath = rp;
-    }
-  }
-  return { groupId, artifactId, version, relativePath, emptyRelativePath };
-}
 
-// ../project-profile-detect/dist/gradle-parse.js
+// node_modules/@cognium/project-profile-detect/dist/gradle-parse.js
 var GRADLE_PLUGIN_MAP = {
   "org.springframework.boot": "spring-boot",
   "io.spring.dependency-management": "spring-boot",
@@ -48386,71 +48438,7 @@ function parseGradleBuild(text, moduleRoot, buildFile, buildSystem, directorySig
   };
 }
 
-// ../project-profile-detect/dist/maven-inherit.js
-import { dirname as dirname2, isAbsolute, normalize, relative, resolve } from "path";
-var MAX_DEPTH = 6;
-var DEFAULT_RELATIVE_PATH = "../pom.xml";
-function mergeMavenInheritance(modules, scanRoot) {
-  const normalizedScanRoot = normalize(scanRoot);
-  const byBuildFile = new Map;
-  for (const m of modules) {
-    if (m.buildSystem === "maven") {
-      byBuildFile.set(normalize(m.buildFile), m);
-    }
-  }
-  for (const child of modules) {
-    if (child.buildSystem !== "maven")
-      continue;
-    if (!child.parentRef)
-      continue;
-    const inheritedUrls = new Set;
-    const inheritedPlugins = new Set;
-    walkParents(child, byBuildFile, normalizedScanRoot, inheritedUrls, inheritedPlugins);
-    if (inheritedUrls.size === 0 && inheritedPlugins.size === 0)
-      continue;
-    const existingUrls = new Set(child.signals.distributionUrls);
-    for (const u of inheritedUrls) {
-      if (!existingUrls.has(u))
-        child.signals.distributionUrls.push(u);
-    }
-    const existingPlugins = new Set(child.signals.plugins);
-    for (const p of inheritedPlugins) {
-      if (!existingPlugins.has(p))
-        child.signals.plugins.push(p);
-    }
-  }
-}
-function walkParents(start2, byBuildFile, scanRoot, outUrls, outPlugins) {
-  const visited = new Set([normalize(start2.buildFile)]);
-  let current = start2;
-  for (let depth = 0;depth < MAX_DEPTH; depth++) {
-    const ref = current.parentRef;
-    if (!ref)
-      return;
-    if (ref.emptyRelativePath)
-      return;
-    const childDir = dirname2(current.buildFile);
-    const rel = ref.relativePath ?? DEFAULT_RELATIVE_PATH;
-    const candidateAbs = normalize(isAbsolute(rel) ? rel : resolve(childDir, rel));
-    const parentBuildFile = candidateAbs.endsWith("pom.xml") ? candidateAbs : normalize(resolve(candidateAbs, "pom.xml"));
-    const relToRoot = relative(scanRoot, parentBuildFile);
-    if (relToRoot.startsWith("..") || isAbsolute(relToRoot))
-      return;
-    if (visited.has(parentBuildFile))
-      return;
-    visited.add(parentBuildFile);
-    const parent = byBuildFile.get(parentBuildFile);
-    if (!parent)
-      return;
-    for (const u of parent.signals.distributionUrls)
-      outUrls.add(u);
-    for (const p of parent.signals.plugins)
-      outPlugins.add(p);
-    current = parent;
-  }
-}
-
-// ../project-profile-detect/dist/walk.js
+// node_modules/@cognium/project-profile-detect/dist/walk.js
 var BUILD_FILES = ["pom.xml", "build.gradle", "build.gradle.kts"];
 var SKIP_DIRS = new Set([
   "node_modules",
@@ -48470,7 +48458,6 @@ var SKIP_DIRS = new Set([
 async function discoverBuildModules(scanRoot) {
   const modules = [];
   await walk(scanRoot, modules);
-  mergeMavenInheritance(modules, scanRoot);
   return modules;
 }
 async function walk(dir, out2) {
@@ -48612,7 +48599,7 @@ function ownerOf(file, modules) {
   return best;
 }
 
-// ../project-profile-detect/dist/publication-detect.js
+// node_modules/@cognium/project-profile-detect/dist/publication-detect.js
 var PUBLIC_REGISTRY_HOSTS = new Set([
   "repo.maven.apache.org",
   "repo1.maven.org",
@@ -48637,7 +48624,7 @@ function isPubliclyPublished(urls) {
   return false;
 }
 
-// ../project-profile-detect/dist/shape-resolve.js
+// node_modules/@cognium/project-profile-detect/dist/shape-resolve.js
 function resolveShape(mod) {
   const sig = mod.signals;
   const has = (tag) => sig.plugins.includes(tag);
@@ -48678,15 +48665,11 @@ function resolveShape(mod) {
     reasons.push(...libSignals, "no public-registry distribution (internal helper)");
     return { shape: "application", reasons };
   }
-  if (isPubliclyPublished(sig.distributionUrls)) {
-    reasons.push("public-registry distribution", "no application/server/plugin signals → implicit library");
-    return { shape: "library", reasons };
-  }
   reasons.push("no shape signals");
   return { shape: "unknown", reasons };
 }
 
-// ../project-profile-detect/dist/env-resolve.js
+// node_modules/@cognium/project-profile-detect/dist/env-resolve.js
 var TEST_RE = /(?:^|\/)tests?\//;
 var SAMPLE_RE = /(?:^|\/)(?:samples?|examples?|demos?|fixtures?)\//;
 var BENCHMARK_RE = /(?:^|\/)benchmarks?\//;
@@ -48704,7 +48687,7 @@ function resolveEnv(absoluteFile) {
   return "dev";
 }
 
-// ../project-profile-detect/dist/overrides.js
+// node_modules/@cognium/project-profile-detect/dist/overrides.js
 function compileGlob(glob) {
   let re = "";
   let i2 = 0;
@@ -48751,7 +48734,7 @@ function applyOverrides(relativePath, compiled) {
   return;
 }
 
-// ../project-profile-detect/dist/index.js
+// node_modules/@cognium/project-profile-detect/dist/index.js
 async function detectProjectProfiles(scanRoot, options = {}) {
   const modules = await discoverBuildModules(scanRoot);
   const files = await enumerateScanFiles(scanRoot);
@@ -48769,7 +48752,7 @@ async function detectProjectProfiles(scanRoot, options = {}) {
   const profileByFile = new Map;
   const unknownFiles = [];
   for (const file of files) {
-    const rel = relative3(scanRoot, file);
+    const rel = relative2(scanRoot, file);
     const ov = applyOverrides(rel, compiledOverrides);
     if (ov) {
       profileByFile.set(file, ov.profile);
@@ -48821,7 +48804,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.10";
+var version = "4.9.11";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -49374,8 +49357,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "132eaf6",
-  builtAt: "2026-09-02T06:21:26.855Z"
+  gitSha: "6c811aa",
+  builtAt: "2026-09-10T06:22:49.258Z"
 };
 
 // src/utils/args.ts
@@ -49663,7 +49646,7 @@ function applySuppressionsToResults(results, suppressions, basePath) {
   if (suppressions.length === 0)
     return results;
   return results.map((result) => {
-    const relativeFile = relative4(basePath, result.file) || result.file;
+    const relativeFile = relative3(basePath, result.file) || result.file;
     const filteredVulns = result.vulnerabilities.filter((vuln) => {
       for (const supp of suppressions) {
         if (supp.pass !== vuln.type)
@@ -49719,6 +49702,22 @@ var LANG_MAP = {
   ".html": "html",
   ".htm": "html"
 };
+var VULN_SEVERITY_RANK = { critical: 3, high: 2, medium: 1, low: 0 };
+function dedupeVulnerabilities(vulns) {
+  const best = new Map;
+  const order = [];
+  for (const v of vulns) {
+    const key = `${v.type}:${v.line}`;
+    const current = best.get(key);
+    if (current === undefined) {
+      best.set(key, v);
+      order.push(key);
+    } else if ((VULN_SEVERITY_RANK[v.severity] ?? -1) > (VULN_SEVERITY_RANK[current.severity] ?? -1)) {
+      best.set(key, v);
+    }
+  }
+  return order.map((k) => best.get(k));
+}
 function detectLanguage7(filePath) {
   const ext = extname(filePath).toLowerCase();
   return LANG_MAP[ext] || null;
@@ -49753,7 +49752,7 @@ async function collectFiles(targetPath, options = {}) {
       return files;
     }
     if (fileMatchesLanguage(targetPath, language)) {
-      const relativePath = basePath ? relative4(basePath, targetPath) : targetPath;
+      const relativePath = basePath ? relative3(basePath, targetPath) : targetPath;
       if (includePatterns && includePatterns.length > 0) {
         if (!matchesAnyPattern(relativePath, includePatterns)) {
           return files;
@@ -49772,7 +49771,7 @@ async function collectFiles(targetPath, options = {}) {
       if (excludeTests && /^(test|tests|__tests__|spec|__mocks__)$/i.test(entry.name))
         continue;
       const fullPath = join2(targetPath, entry.name);
-      const relativePath = basePath ? relative4(basePath, fullPath) : fullPath;
+      const relativePath = basePath ? relative3(basePath, fullPath) : fullPath;
       if (excludePatterns && entry.isDirectory()) {
         const dirPattern = relativePath + "/";
         if (excludePatterns.some((p) => matchesGlob(dirPattern, p) || matchesGlob(relativePath, p))) {
@@ -49813,7 +49812,7 @@ async function scanFile(filePath, language, analyzeOpts) {
         ...finding.tags && finding.tags.length > 0 ? { tags: [...finding.tags] } : {}
       });
     }
-    return { file: filePath, vulnerabilities };
+    return { file: filePath, vulnerabilities: dedupeVulnerabilities(vulnerabilities) };
   } catch (error) {
     return {
       file: filePath,
@@ -49856,7 +49855,7 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
         ...finding.tags && finding.tags.length > 0 ? { tags: [...finding.tags] } : {}
       });
     }
-    return { file, vulnerabilities };
+    return { file, vulnerabilities: dedupeVulnerabilities(vulnerabilities) };
   });
   return {
     results,
@@ -49870,14 +49869,14 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
 async function initWasm(spin) {
   const isStandalone = import.meta.url.includes("/$bunfs/");
   if (isStandalone) {
-    const { dirname: dirname4, join: join3 } = await import("path");
-    const binaryDir = dirname4(process.execPath);
+    const { dirname: dirname3, join: join3 } = await import("path");
+    const binaryDir = dirname3(process.execPath);
     const cwd = process.cwd();
     let scriptDir = null;
     if (!import.meta.url.includes("/$bunfs/")) {
       try {
         const { fileURLToPath } = await import("url");
-        scriptDir = dirname4(fileURLToPath(import.meta.url));
+        scriptDir = dirname3(fileURLToPath(import.meta.url));
       } catch {}
     }
     const wasmLocations = [
@@ -49932,7 +49931,7 @@ Please ensure the wasm/ directory is located next to the binary or in your curre
   } else {
     const require2 = createRequire2(import.meta.url);
     const circleIrPkg = require2.resolve("circle-ir/package.json");
-    const wasmBasePath = join2(dirname3(circleIrPkg), "dist", "wasm") + "/";
+    const wasmBasePath = join2(dirname2(circleIrPkg), "dist", "wasm") + "/";
     await initAnalyzer({
       wasmPath: wasmBasePath + "web-tree-sitter.wasm",
       languagePaths: {
@@ -49963,7 +49962,7 @@ function buildProfileSummary(scanRoot, modules, resolvedProfiles) {
   return {
     scanRoot,
     modules: modules.map((m) => ({
-      root: relative4(scanRoot, m.module.root) || ".",
+      root: relative3(scanRoot, m.module.root) || ".",
       profile: m.profile,
       reasons: m.reasons,
       buildSystem: m.module.buildSystem
@@ -49992,9 +49991,9 @@ function printProfileExplain(scanRoot, detection) {
     out2.push("  (no pom.xml, build.gradle, or build.gradle.kts found)");
   } else {
     for (const r of detection.modules) {
-      const rel = relative4(scanRoot, r.module.root) || ".";
+      const rel = relative3(scanRoot, r.module.root) || ".";
       out2.push(`  ${colors.cyan(rel || ".")}  →  ${colors.bold(r.profile)}`);
-      out2.push(`     build: ${r.module.buildSystem}  (${relative4(scanRoot, r.module.buildFile)})`);
+      out2.push(`     build: ${r.module.buildSystem}  (${relative3(scanRoot, r.module.buildFile)})`);
       if (r.module.artifactId) {
         out2.push(`     coords: ${r.module.groupId ?? "?"}:${r.module.artifactId}:${r.module.version ?? "?"}`);
       }
@@ -50039,7 +50038,7 @@ async function runScan(targetPath, options) {
     await initWasm(spin);
     if (spin)
       spin.text = "Collecting files...";
-    const absPath = resolve2(targetPath);
+    const absPath = resolve(targetPath);
     if (!existsSync(absPath)) {
       if (spin)
         spin.fail(`Path not found: ${absPath}`);
@@ -50103,7 +50102,7 @@ async function runScan(targetPath, options) {
       results = [];
       let processed = 0;
       const formatCurrentFile = (file) => {
-        const rel = relative4(absPath, file) || file;
+        const rel = relative3(absPath, file) || file;
         return rel.length > 80 ? `...${rel.slice(-77)}` : rel;
       };
       const concurrency = options.threads;
@@ -50279,7 +50278,7 @@ async function runMetrics(targetPath, options) {
     await initWasm(spin);
     if (spin)
       spin.text = "Collecting files...";
-    const absPath = resolve2(targetPath);
+    const absPath = resolve(targetPath);
     if (!existsSync(absPath)) {
       if (spin)
         spin.fail(`Path not found: ${absPath}`);
@@ -50307,7 +50306,7 @@ async function runMetrics(targetPath, options) {
         continue;
       }
       if (spin) {
-        const rel = relative4(absPath, file) || file;
+        const rel = relative3(absPath, file) || file;
         const maxLen = 80;
         const label = rel.length > maxLen ? `...${rel.slice(-(maxLen - 3))}` : rel;
         spin.text = `Analyzing ${label}... (${processed}/${totalFiles})`;
@@ -50352,7 +50351,7 @@ async function runMetrics(targetPath, options) {
     } else {
       const lines = [];
       for (const fm of filtered) {
-        const rel = relative4(absPath, fm.file) || fm.file;
+        const rel = relative3(absPath, fm.file) || fm.file;
         lines.push(rel);
         const byCategory = new Map;
         for (const m of fm.metrics) {
@@ -50580,7 +50579,7 @@ async function collectManifestFiles(targetPath) {
   return found;
 }
 async function runSbom(targetPath, options) {
-  const absPath = resolve2(targetPath);
+  const absPath = resolve(targetPath);
   if (!existsSync(absPath)) {
     console.error(colors.red(`Error: path not found: ${targetPath}`));
     process.exit(2);
@@ -50594,9 +50593,9 @@ async function runSbom(targetPath, options) {
   for (const m of manifests) {
     const superseded = SBOM_SUPERSEDES[basename(m)];
     if (superseded)
-      supersededInDir.add(`${dirname3(m)}\x00${superseded}`);
+      supersededInDir.add(`${dirname2(m)}\x00${superseded}`);
   }
-  const effective = manifests.filter((m) => !supersededInDir.has(`${dirname3(m)}\x00${basename(m)}`));
+  const effective = manifests.filter((m) => !supersededInDir.has(`${dirname2(m)}\x00${basename(m)}`));
   let projectName = options.name;
   let projectLicense;
   {
@@ -50756,6 +50755,7 @@ export {
   loadConfig,
   isTestFile2 as isTestFile,
   detectLanguage7 as detectLanguage,
+  dedupeVulnerabilities,
   convertConfigToPassOptions,
   applySuppressionsToResults,
   PASS_REGISTRY

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.10",
+  "version": "4.9.11",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,7 +14,7 @@
     "test": "bun test",
     "clean": "rm -rf dist cognium-dev cognium-dev-* *.bun-build wasm",
     "typecheck": "tsc --noEmit",
-    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually — use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
+    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually \u2014 use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
     "dogfood": "bun run src/cli.ts scan src/ -q",
     "prepublishOnly": "bun run build"
   },
@@ -65,8 +65,8 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@cognium/project-profile-detect": "1.1.0",
-    "circle-ir": "4.9.10"
+    "@cognium/project-profile-detect": "1.1.1",
+    "circle-ir": "4.9.11"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",