cognium-dev 4.9.21 → 4.9.22

package/dist/cli.js

@@ -24604,16 +24604,22 @@ class CSharpPlugin extends BaseLanguagePlugin {
 }
 
 // ../circle-ir/dist/languages/plugins/index.js
+function createBuiltinPlugins() {
+  return [
+    new JavaPlugin,
+    new JavaScriptPlugin,
+    new PythonPlugin,
+    new RustPlugin,
+    new BashPlugin,
+    new HtmlPlugin,
+    new VuePlugin,
+    new GoPlugin,
+    new CSharpPlugin
+  ];
+}
 function registerBuiltinPlugins() {
-  registerLanguage(new JavaPlugin);
-  registerLanguage(new JavaScriptPlugin);
-  registerLanguage(new PythonPlugin);
-  registerLanguage(new RustPlugin);
-  registerLanguage(new BashPlugin);
-  registerLanguage(new HtmlPlugin);
-  registerLanguage(new VuePlugin);
-  registerLanguage(new GoPlugin);
-  registerLanguage(new CSharpPlugin);
+  for (const plugin of createBuiltinPlugins())
+    registerLanguage(plugin);
 }
 // ../circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
@@ -46991,6 +46997,8 @@ var JAVA_XML_OUTPUT_ONLY_RE = /\bnew\s+(?:DOMSource|StreamResult)\s*\(/;
 var JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\s*\(/;
 var JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
 var JAVA_DOC_BUILDER_PARSE_RE = /(?:DocumentBuilder|builder)\s*\.\s*parse\s*\(/;
+var JAVA_HARDENING_SETTER_RE = /\.\s*(?:setFeature|setAttribute|setProperty|setXIncludeAware|setExpandEntityReferences)\s*\(/;
+var JAVA_FACTORY_CHAINED_RE = /\bnewInstance\s*\([^()]*\)\s*\.\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\s*\(/;
 var PY_LXML_PARSER_INSECURE_DEFAULT_RE = /\bresolve_entities\s*=\s*False\b/;
 
 class XmlEntityExpansionPass {
@@ -47003,8 +47011,10 @@ class XmlEntityExpansionPass {
     const code = ctx.code ?? "";
     if (language === "java") {
       const safeInFile = JAVA_SAFE_EVIDENCE_RE.test(code);
-      if (safeInFile)
-        return { findings };
+      const processWide = safeInFile && /jdk\.xml\./.test(code);
+      const lines = safeInFile ? code.split(`
+`) : [];
+      const methodRanges = safeInFile ? this.methodRanges(graph.ir.types) : [];
       const isXmlOutputOnly = JAVA_XML_OUTPUT_ONLY_RE.test(code) && !JAVA_XML_PARSE_INPUT_RE.test(code);
       const isDocumentBuilderEmptyOnly = JAVA_DOC_BUILDER_NEW_DOCUMENT_RE.test(code) && !JAVA_DOC_BUILDER_PARSE_RE.test(code);
       for (const call of graph.ir.calls) {
@@ -47016,6 +47026,8 @@ class XmlEntityExpansionPass {
         if (det.api === "DocumentBuilderFactory" && isDocumentBuilderEmptyOnly)
           continue;
         const line = call.location.line;
+        if (safeInFile && (processWide || !this.isProvablyUnhardened(lines, line, methodRanges, det.api)))
+          continue;
         findings.push({ line, language, ...det });
         ctx.addFinding({
           id: `${this.name}-${file}-${line}-${det.api}`,
@@ -47025,11 +47037,11 @@ class XmlEntityExpansionPass {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} created without disabling DTD / external-entity ` + "processing. Vulnerable to billion-laughs / quadratic " + "blow-up DoS (CWE-776) and external-entity disclosure " + '(CWE-611). Add `setFeature("http://apache.org/xml/features/' + 'disallow-doctype-decl", true)` (or the equivalent) before ' + "parsing.",
+          message: `${det.api} created without disabling DTD / external-entity ` + "processing. Vulnerable to external-entity disclosure " + "(CWE-611) and billion-laughs / quadratic blow-up DoS " + '(CWE-776). Add `setFeature("http://apache.org/xml/features/' + 'disallow-doctype-decl", true)` (or the equivalent) before ' + "parsing.",
           file,
           line,
           fix: this.fixForJava(det.api),
-          evidence: { ...det, language, safeFeatureInFile: false }
+          evidence: { ...det, language, safeFeatureInFile: safeInFile }
         });
       }
       return { findings };
@@ -47052,7 +47064,7 @@ class XmlEntityExpansionPass {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} called without an entity-safe parser. Vulnerable ` + "to billion-laughs / quadratic blow-up DoS (CWE-776) and " + "external-entity disclosure (CWE-611). Use `defusedxml` or pass " + "an `XMLParser(resolve_entities=False)` to lxml.",
+          message: `${det.api} called without an entity-safe parser. Vulnerable ` + (det.cwe === "CWE-611" ? "to external-entity disclosure (CWE-611) and billion-laughs / " + "quadratic blow-up DoS (CWE-776). " : "to billion-laughs / quadratic blow-up DoS (CWE-776). ") + "Use `defusedxml` or pass " + "an `XMLParser(resolve_entities=False)` to lxml.",
           file,
           line,
           fix: this.fixForPython(det.api),
@@ -47063,6 +47075,63 @@ class XmlEntityExpansionPass {
     }
     return { findings };
   }
+  methodRanges(types) {
+    const out2 = [];
+    for (const t of types ?? []) {
+      for (const m of t.methods ?? []) {
+        if (typeof m.start_line === "number" && typeof m.end_line === "number")
+          out2.push([m.start_line, m.end_line]);
+      }
+    }
+    return out2;
+  }
+  isProvablyUnhardened(lines, line, methodRanges, api) {
+    let range = null;
+    for (const r of methodRanges) {
+      if (line < r[0] || line > r[1])
+        continue;
+      if (!range || r[1] - r[0] < range[1] - range[0])
+        range = r;
+    }
+    if (!range)
+      return false;
+    let decl = "";
+    let declEnd = line;
+    for (;declEnd <= Math.min(line + 3, range[1]); declEnd++) {
+      decl += " " + (lines[declEnd - 1] ?? "").trim();
+      if (decl.includes(";"))
+        break;
+    }
+    const body2 = lines.slice(line - 1, range[1]).join(`
+`);
+    if (api === "TransformerFactory" && !/\bnew\s+StreamSource\s*\(/.test(body2))
+      return false;
+    if (JAVA_HARDENING_SETTER_RE.test(body2))
+      return false;
+    const chained = JAVA_FACTORY_CHAINED_RE.exec(decl);
+    if (chained) {
+      const prod = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=/.exec(decl);
+      if (!prod)
+        return true;
+      const pn = prod[1].replace(/\$/g, "\\$");
+      const after = lines.slice(declEnd, range[1]).join(`
+`);
+      return !new RegExp(`[(,]\\s*${pn}\\s*[,)]|\\breturn\\s+${pn}\\s*;`).test(after);
+    }
+    const m = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.]*\bnewInstance\s*\([^()]*\)\s*;/.exec(decl);
+    if (!m)
+      return false;
+    const name2 = m[1].replace(/\$/g, "\\$");
+    const rest = lines.slice(declEnd, range[1]).join(`
+`);
+    const builds = new RegExp(`\\b${name2}\\s*\\.\\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\\s*\\(`);
+    if (!builds.test(rest))
+      return false;
+    const escapes = new RegExp(`[(,]\\s*${name2}\\s*[,)]|\\breturn\\s+${name2}\\s*;`);
+    if (escapes.test(rest))
+      return false;
+    return true;
+  }
   detectJavaCall(call) {
     if (call.method_name !== "newInstance")
       return null;
@@ -47073,7 +47142,7 @@ class XmlEntityExpansionPass {
         return {
           pattern: `${factory}.newInstance()`,
           api: factory,
-          cwe: "CWE-776"
+          cwe: "CWE-611"
         };
       }
     }
@@ -47086,7 +47155,7 @@ class XmlEntityExpansionPass {
       return {
         pattern: `etree.${method}`,
         api: `lxml.etree.${method}`,
-        cwe: "CWE-776"
+        cwe: "CWE-611"
       };
     }
     if ((method === "parse" || method === "fromstring") && (recv === "ET" || recv === "ElementTree" || recv.endsWith(".ElementTree"))) {
@@ -49777,7 +49846,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.21";
+var version = "4.9.22";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -50322,8 +50391,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "1ac1389",
-  builtAt: "2026-09-21T17:09:28.224Z"
+  gitSha: "54a142d",
+  builtAt: "2026-09-22T01:39:02.544Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.21",
+  "version": "4.9.22",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -67,7 +67,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.1",
-    "circle-ir": "4.9.21"
+    "circle-ir": "4.9.22"
   },
   "devDependencies": {
     "@types/node": "^26.6.1",