cognium-dev 4.9.21 → 4.9.23

package/dist/cli.js

@@ -14400,6 +14400,35 @@ function classifyGoDestinationType(decl) {
     return "unsafe";
   return "safe";
 }
+function isGoFprintToNonResponseWriter(call, pattern, language, sourceLines) {
+  if (language !== "go")
+    return false;
+  if (pattern.type !== "xss" || pattern.class !== "fmt")
+    return false;
+  if (!/^Fprint(?:f|ln)?$/.test(call.method_name))
+    return false;
+  if (!sourceLines)
+    return true;
+  const writer = call.arguments.find((a) => a.position === 0);
+  const name2 = (writer?.expression ?? "").trim();
+  if (!/^[A-Za-z_]\w*$/.test(name2))
+    return true;
+  const rwRe = new RegExp(`\\b${name2}\\s+(?:net/)?http\\.ResponseWriter\\b`);
+  for (let i2 = call.location.line - 1;i2 >= 0; i2--) {
+    const line = sourceLines[i2] ?? "";
+    const funcIdx = line.search(/\bfunc\b/);
+    if (funcIdx < 0)
+      continue;
+    const header = sourceLines.slice(i2, i2 + 4).join(" ");
+    const brace = header.indexOf("{");
+    const params = header.slice(funcIdx, brace >= 0 ? brace : header.length);
+    if (rwRe.test(params))
+      return false;
+    if (/^\s*func\b/.test(line))
+      return true;
+  }
+  return true;
+}
 function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   if (language !== "go")
     return false;
@@ -14545,6 +14574,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isGoFprintToNonResponseWriter(call, pattern, language, sourceLines)) {
+          continue;
+        }
         if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -24126,7 +24158,23 @@ class GoPlugin extends BaseLanguagePlugin {
         type: "xss",
         cwe: "CWE-79",
         severity: "high",
-        argPositions: [1]
+        argPositions: [1, 2, 3, 4, 5, 6]
+      },
+      {
+        method: "Fprint",
+        class: "fmt",
+        type: "xss",
+        cwe: "CWE-79",
+        severity: "high",
+        argPositions: [1, 2, 3, 4, 5, 6]
+      },
+      {
+        method: "Fprintln",
+        class: "fmt",
+        type: "xss",
+        cwe: "CWE-79",
+        severity: "high",
+        argPositions: [1, 2, 3, 4, 5, 6]
       },
       {
         method: "Write",
@@ -24604,16 +24652,22 @@ class CSharpPlugin extends BaseLanguagePlugin {
 }
 
 // ../circle-ir/dist/languages/plugins/index.js
+function createBuiltinPlugins() {
+  return [
+    new JavaPlugin,
+    new JavaScriptPlugin,
+    new PythonPlugin,
+    new RustPlugin,
+    new BashPlugin,
+    new HtmlPlugin,
+    new VuePlugin,
+    new GoPlugin,
+    new CSharpPlugin
+  ];
+}
 function registerBuiltinPlugins() {
-  registerLanguage(new JavaPlugin);
-  registerLanguage(new JavaScriptPlugin);
-  registerLanguage(new PythonPlugin);
-  registerLanguage(new RustPlugin);
-  registerLanguage(new BashPlugin);
-  registerLanguage(new HtmlPlugin);
-  registerLanguage(new VuePlugin);
-  registerLanguage(new GoPlugin);
-  registerLanguage(new CSharpPlugin);
+  for (const plugin of createBuiltinPlugins())
+    registerLanguage(plugin);
 }
 // ../circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
@@ -25804,6 +25858,8 @@ class LanguageSourcesPass {
     additionalSources.push(...findGoArgvSources(code, language));
     additionalSources.push(...findGoArchiveEntrySources(code, language));
     additionalSources.push(...findGoMultipartUploadSources(code, language));
+    additionalSources.push(...findGoGrpcRequestSources(code, language));
+    additionalSources.push(...findGoRequestBodySources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -26549,6 +26605,127 @@ function findGoMultipartUploadSources(sourceCode, language) {
   }
   return sources;
 }
+function findGoGrpcRequestSources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  if (!sourceCode.includes("context.Context"))
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const sigRe = /^func\s*\([^)]*\)\s*[A-Z]\w*\s*\(\s*\w+\s+context\.Context\s*,\s*([A-Za-z_]\w*)\s+\*(?:\w+\.)?\w*(?:Request|Req)\s*\)\s*\(\s*\*[\w.]+\s*,\s*error\s*\)\s*\{/;
+  const controlRe = /^\s*(?:\}\s*else\s+)?(?:if|for|switch|case|return)\b/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const sig = sigRe.exec(lines[i2]);
+    if (!sig)
+      continue;
+    const param = sig[1];
+    if (param === "_")
+      continue;
+    const readRe = new RegExp(`(?<![\\w.])${param}\\s*\\.\\s*(?:Get[A-Z]\\w*\\s*\\(\\s*\\)|[A-Z]\\w*\\b(?!\\s*\\())`);
+    const directReadRe = new RegExp(`^(?:(?:\\[\\]\\w+|string)\\s*\\(\\s*)*${param}(?:\\s*\\.\\s*(?:Get[A-Z]\\w*\\s*\\(\\s*\\)|[A-Z]\\w*\\b(?!\\s*\\()))+(?:\\s*\\))*$`);
+    const numericParseRe = new RegExp(`\\bstrconv\\s*\\.\\s*(?:Atoi|ParseInt|ParseUint|ParseFloat|ParseBool)\\s*\\(\\s*${param}\\s*\\.`);
+    let end = i2 + 1;
+    while (end < lines.length && !/^\}/.test(lines[end]))
+      end++;
+    for (let j = i2 + 1;j < end; j++) {
+      const line = lines[j];
+      const read = readRe.exec(line);
+      if (!read)
+        continue;
+      if (numericParseRe.test(line))
+        continue;
+      let variable;
+      const unmarshal = /\bUnmarshal\w*\s*\([^&]*&\s*([A-Za-z_]\w*)/.exec(line);
+      const assign = /^\s*(?:var\s+)?([A-Za-z_][\w\s,]*?)\s*:?=(?!=)\s*(.+)$/.exec(line);
+      if (unmarshal && line.indexOf(read[0]) < line.indexOf("&")) {
+        variable = unmarshal[1];
+      } else if (assign && directReadRe.test(assign[2].trim()) && !controlRe.test(line)) {
+        variable = assign[1].split(",").map((v) => v.trim()).find((v) => v !== "_" && v !== "err" && v !== "ok" && /^[A-Za-z_]\w*$/.test(v));
+        if (!variable)
+          continue;
+      } else if (controlRe.test(line)) {
+        continue;
+      } else {
+        variable = param;
+      }
+      const lineNumber = j + 1;
+      if (sources.some((sc) => sc.line === lineNumber && sc.variable === variable))
+        continue;
+      sources.push({
+        type: "http_body",
+        location: `${read[0].replace(/\s+/g, "")} — field of the gRPC request message \`${param}\``,
+        severity: "high",
+        line: lineNumber,
+        confidence: 0.85,
+        variable
+      });
+    }
+    i2 = end;
+  }
+  return sources;
+}
+function findGoRequestBodySources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  if (!sourceCode.includes(".Body"))
+    return [];
+  const lines = sourceCode.split(`
+`);
+  const reqNames = new Set;
+  const paramRe = /([A-Za-z_]\w*)\s+\*http\.Request\b/g;
+  for (const line of lines) {
+    let m;
+    paramRe.lastIndex = 0;
+    while ((m = paramRe.exec(line)) !== null)
+      reqNames.add(m[1]);
+  }
+  if (reqNames.size === 0)
+    return [];
+  const bodyAlt = [...reqNames].map((n) => n.replace(/\$/g, "\\$")).join("|");
+  const bodyRef = `(?<![\\w.])(?:${bodyAlt})\\s*\\.\\s*Body\\b`;
+  const sources = [];
+  const push = (variable, line, how) => {
+    if (variable === "_" || variable === "")
+      return;
+    if (sources.some((s) => s.line === line && s.variable === variable))
+      return;
+    sources.push({
+      type: "http_body",
+      location: `${how} — HTTP request body`,
+      severity: "high",
+      line,
+      confidence: 0.85,
+      ...variable ? { variable } : {}
+    });
+  };
+  const bodyRe = new RegExp(bodyRef);
+  const decodeRe = new RegExp(`(?:json|xml)\\s*\\.\\s*NewDecoder\\s*\\(\\s*(?:io\\.NopCloser\\s*\\(\\s*)?(?:${bodyAlt})\\s*\\.\\s*Body\\b[^)]*\\)\\s*\\)?\\s*\\.\\s*Decode\\s*\\(\\s*&\\s*([A-Za-z_]\\w*)`);
+  const readAllRe = new RegExp(`\\b([A-Za-z_]\\w*)\\s*,\\s*\\w+\\s*:?=\\s*(?:io|ioutil)\\s*\\.\\s*ReadAll\\s*\\(\\s*(?:${bodyAlt})\\s*\\.\\s*Body\\b`);
+  const copyRe = new RegExp(`\\bio\\s*\\.\\s*Copy\\s*\\(\\s*([A-Za-z_]\\w*|&\\s*[A-Za-z_]\\w*)\\s*,\\s*(?:${bodyAlt})\\s*\\.\\s*Body\\b`);
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (!bodyRe.test(line))
+      continue;
+    const n = i2 + 1;
+    const dec = decodeRe.exec(line);
+    if (dec) {
+      push(dec[1], n, `json/xml decode of ${dec[0].split(".")[0]}.Body`);
+      continue;
+    }
+    const ra = readAllRe.exec(line);
+    if (ra) {
+      push(ra[1], n, "io.ReadAll(req.Body)");
+      continue;
+    }
+    const cp = copyRe.exec(line);
+    if (cp) {
+      push(cp[1].replace(/^&\s*/, ""), n, "io.Copy(dst, req.Body)");
+      continue;
+    }
+  }
+  return sources;
+}
 function findCSharpRequestSources(sourceCode, language) {
   if (language !== "csharp")
     return [];
@@ -37784,6 +37961,116 @@ function pickScopedSource(sources, sinkLine, methodName, types, taintedVar) {
 }
 
 // ../circle-ir/dist/analysis/interprocedural.js
+var GO_BUILTIN_CALLS = new Set([
+  "len",
+  "cap",
+  "make",
+  "new",
+  "append",
+  "copy",
+  "delete",
+  "close",
+  "panic",
+  "recover",
+  "print",
+  "println",
+  "min",
+  "max",
+  "clear",
+  "string",
+  "int",
+  "int8",
+  "int16",
+  "int32",
+  "int64",
+  "uint",
+  "uint8",
+  "uint16",
+  "uint32",
+  "uint64",
+  "float32",
+  "float64",
+  "bool",
+  "byte",
+  "rune",
+  "error"
+]);
+var GO_ERROR_AND_LOG_CALLS = new Set([
+  "Errorf",
+  "Sprintf",
+  "Sprint",
+  "Sprintln",
+  "Print",
+  "Printf",
+  "Println",
+  "Fatal",
+  "Fatalf",
+  "Fatalln",
+  "Panic",
+  "Panicf",
+  "Panicln",
+  "Debug",
+  "Debugf",
+  "Debugln",
+  "Debugw",
+  "Info",
+  "Infof",
+  "Infoln",
+  "Infow",
+  "InfoS",
+  "Warn",
+  "Warnf",
+  "Warnln",
+  "Warnw",
+  "Warning",
+  "Warningf",
+  "Warningln",
+  "Error",
+  "Errorln",
+  "Errorw",
+  "ErrorS",
+  "Trace",
+  "Tracef",
+  "V",
+  "WithError",
+  "WithField",
+  "WithFields",
+  "WithValues",
+  "Msg",
+  "Msgf"
+]);
+var GO_ERROR_PACKAGES = new Set(["errors", "status", "xerrors", "multierr", "multierror"]);
+var GO_PURE_PACKAGES = new Set([
+  "strings",
+  "strconv",
+  "bytes",
+  "unicode",
+  "utf8",
+  "path",
+  "filepath",
+  "math",
+  "sort",
+  "slices",
+  "maps",
+  "time",
+  "regexp",
+  "url",
+  "hex",
+  "base64"
+]);
+function isGoNonEscapeCall(call) {
+  const name2 = call.method_name;
+  const recv = (call.receiver ?? "").split(".").pop() ?? "";
+  if (!call.receiver && GO_BUILTIN_CALLS.has(name2))
+    return true;
+  if (GO_ERROR_PACKAGES.has(recv))
+    return true;
+  if (GO_PURE_PACKAGES.has(recv))
+    return true;
+  if (GO_ERROR_AND_LOG_CALLS.has(name2))
+    return true;
+  return false;
+}
 function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourcesOrSanitizers, sinksOrOptions, sanitizersArg, optionsArg = {}) {
   let graph;
   let sources;
@@ -38015,6 +38302,9 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     if (!targetMethod) {
       if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name) && !ormQueryBuilderMethods.has(call.method_name)) {
         const isBash = graph.ir.meta.language === "bash";
+        if (graph.ir.meta.language === "go" && isGoNonEscapeCall(call)) {
+          continue;
+        }
         const bashSafeBuiltins = new Set([
           "echo",
           "printf",
@@ -46991,6 +47281,8 @@ var JAVA_XML_OUTPUT_ONLY_RE = /\bnew\s+(?:DOMSource|StreamResult)\s*\(/;
 var JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\s*\(/;
 var JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
 var JAVA_DOC_BUILDER_PARSE_RE = /(?:DocumentBuilder|builder)\s*\.\s*parse\s*\(/;
+var JAVA_HARDENING_SETTER_RE = /\.\s*(?:setFeature|setAttribute|setProperty|setXIncludeAware|setExpandEntityReferences)\s*\(/;
+var JAVA_FACTORY_CHAINED_RE = /\bnewInstance\s*\([^()]*\)\s*\.\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\s*\(/;
 var PY_LXML_PARSER_INSECURE_DEFAULT_RE = /\bresolve_entities\s*=\s*False\b/;
 
 class XmlEntityExpansionPass {
@@ -47003,8 +47295,10 @@ class XmlEntityExpansionPass {
     const code = ctx.code ?? "";
     if (language === "java") {
       const safeInFile = JAVA_SAFE_EVIDENCE_RE.test(code);
-      if (safeInFile)
-        return { findings };
+      const processWide = safeInFile && /jdk\.xml\./.test(code);
+      const lines = safeInFile ? code.split(`
+`) : [];
+      const methodRanges = safeInFile ? this.methodRanges(graph.ir.types) : [];
       const isXmlOutputOnly = JAVA_XML_OUTPUT_ONLY_RE.test(code) && !JAVA_XML_PARSE_INPUT_RE.test(code);
       const isDocumentBuilderEmptyOnly = JAVA_DOC_BUILDER_NEW_DOCUMENT_RE.test(code) && !JAVA_DOC_BUILDER_PARSE_RE.test(code);
       for (const call of graph.ir.calls) {
@@ -47016,6 +47310,8 @@ class XmlEntityExpansionPass {
         if (det.api === "DocumentBuilderFactory" && isDocumentBuilderEmptyOnly)
           continue;
         const line = call.location.line;
+        if (safeInFile && (processWide || !this.isProvablyUnhardened(lines, line, methodRanges, det.api)))
+          continue;
         findings.push({ line, language, ...det });
         ctx.addFinding({
           id: `${this.name}-${file}-${line}-${det.api}`,
@@ -47025,11 +47321,11 @@ class XmlEntityExpansionPass {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} created without disabling DTD / external-entity ` + "processing. Vulnerable to billion-laughs / quadratic " + "blow-up DoS (CWE-776) and external-entity disclosure " + '(CWE-611). Add `setFeature("http://apache.org/xml/features/' + 'disallow-doctype-decl", true)` (or the equivalent) before ' + "parsing.",
+          message: `${det.api} created without disabling DTD / external-entity ` + "processing. Vulnerable to external-entity disclosure " + "(CWE-611) and billion-laughs / quadratic blow-up DoS " + '(CWE-776). Add `setFeature("http://apache.org/xml/features/' + 'disallow-doctype-decl", true)` (or the equivalent) before ' + "parsing.",
           file,
           line,
           fix: this.fixForJava(det.api),
-          evidence: { ...det, language, safeFeatureInFile: false }
+          evidence: { ...det, language, safeFeatureInFile: safeInFile }
         });
       }
       return { findings };
@@ -47052,7 +47348,7 @@ class XmlEntityExpansionPass {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} called without an entity-safe parser. Vulnerable ` + "to billion-laughs / quadratic blow-up DoS (CWE-776) and " + "external-entity disclosure (CWE-611). Use `defusedxml` or pass " + "an `XMLParser(resolve_entities=False)` to lxml.",
+          message: `${det.api} called without an entity-safe parser. Vulnerable ` + (det.cwe === "CWE-611" ? "to external-entity disclosure (CWE-611) and billion-laughs / " + "quadratic blow-up DoS (CWE-776). " : "to billion-laughs / quadratic blow-up DoS (CWE-776). ") + "Use `defusedxml` or pass " + "an `XMLParser(resolve_entities=False)` to lxml.",
           file,
           line,
           fix: this.fixForPython(det.api),
@@ -47063,6 +47359,63 @@ class XmlEntityExpansionPass {
     }
     return { findings };
   }
+  methodRanges(types) {
+    const out2 = [];
+    for (const t of types ?? []) {
+      for (const m of t.methods ?? []) {
+        if (typeof m.start_line === "number" && typeof m.end_line === "number")
+          out2.push([m.start_line, m.end_line]);
+      }
+    }
+    return out2;
+  }
+  isProvablyUnhardened(lines, line, methodRanges, api) {
+    let range = null;
+    for (const r of methodRanges) {
+      if (line < r[0] || line > r[1])
+        continue;
+      if (!range || r[1] - r[0] < range[1] - range[0])
+        range = r;
+    }
+    if (!range)
+      return false;
+    let decl = "";
+    let declEnd = line;
+    for (;declEnd <= Math.min(line + 3, range[1]); declEnd++) {
+      decl += " " + (lines[declEnd - 1] ?? "").trim();
+      if (decl.includes(";"))
+        break;
+    }
+    const body2 = lines.slice(line - 1, range[1]).join(`
+`);
+    if (api === "TransformerFactory" && !/\bnew\s+StreamSource\s*\(/.test(body2))
+      return false;
+    if (JAVA_HARDENING_SETTER_RE.test(body2))
+      return false;
+    const chained = JAVA_FACTORY_CHAINED_RE.exec(decl);
+    if (chained) {
+      const prod = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=/.exec(decl);
+      if (!prod)
+        return true;
+      const pn = prod[1].replace(/\$/g, "\\$");
+      const after = lines.slice(declEnd, range[1]).join(`
+`);
+      return !new RegExp(`[(,]\\s*${pn}\\s*[,)]|\\breturn\\s+${pn}\\s*;`).test(after);
+    }
+    const m = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.]*\bnewInstance\s*\([^()]*\)\s*;/.exec(decl);
+    if (!m)
+      return false;
+    const name2 = m[1].replace(/\$/g, "\\$");
+    const rest = lines.slice(declEnd, range[1]).join(`
+`);
+    const builds = new RegExp(`\\b${name2}\\s*\\.\\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\\s*\\(`);
+    if (!builds.test(rest))
+      return false;
+    const escapes = new RegExp(`[(,]\\s*${name2}\\s*[,)]|\\breturn\\s+${name2}\\s*;`);
+    if (escapes.test(rest))
+      return false;
+    return true;
+  }
   detectJavaCall(call) {
     if (call.method_name !== "newInstance")
       return null;
@@ -47073,7 +47426,7 @@ class XmlEntityExpansionPass {
         return {
           pattern: `${factory}.newInstance()`,
           api: factory,
-          cwe: "CWE-776"
+          cwe: "CWE-611"
         };
       }
     }
@@ -47086,7 +47439,7 @@ class XmlEntityExpansionPass {
       return {
         pattern: `etree.${method}`,
         api: `lxml.etree.${method}`,
-        cwe: "CWE-776"
+        cwe: "CWE-611"
       };
     }
     if ((method === "parse" || method === "fromstring") && (recv === "ET" || recv === "ElementTree" || recv.endsWith(".ElementTree"))) {
@@ -49777,7 +50130,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.21";
+var version = "4.9.23";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -50322,8 +50675,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "1ac1389",
-  builtAt: "2026-09-21T17:09:28.224Z"
+  gitSha: "e7e65f8",
+  builtAt: "2026-09-22T22:15:34.355Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.21",
+  "version": "4.9.23",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -67,7 +67,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.1",
-    "circle-ir": "4.9.21"
+    "circle-ir": "4.9.23"
   },
   "devDependencies": {
     "@types/node": "^26.6.1",