cognium-dev 4.9.22 → 4.9.23

package/dist/cli.js

@@ -14400,6 +14400,35 @@ function classifyGoDestinationType(decl) {
     return "unsafe";
   return "safe";
 }
+function isGoFprintToNonResponseWriter(call, pattern, language, sourceLines) {
+  if (language !== "go")
+    return false;
+  if (pattern.type !== "xss" || pattern.class !== "fmt")
+    return false;
+  if (!/^Fprint(?:f|ln)?$/.test(call.method_name))
+    return false;
+  if (!sourceLines)
+    return true;
+  const writer = call.arguments.find((a) => a.position === 0);
+  const name2 = (writer?.expression ?? "").trim();
+  if (!/^[A-Za-z_]\w*$/.test(name2))
+    return true;
+  const rwRe = new RegExp(`\\b${name2}\\s+(?:net/)?http\\.ResponseWriter\\b`);
+  for (let i2 = call.location.line - 1;i2 >= 0; i2--) {
+    const line = sourceLines[i2] ?? "";
+    const funcIdx = line.search(/\bfunc\b/);
+    if (funcIdx < 0)
+      continue;
+    const header = sourceLines.slice(i2, i2 + 4).join(" ");
+    const brace = header.indexOf("{");
+    const params = header.slice(funcIdx, brace >= 0 ? brace : header.length);
+    if (rwRe.test(params))
+      return false;
+    if (/^\s*func\b/.test(line))
+      return true;
+  }
+  return true;
+}
 function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   if (language !== "go")
     return false;
@@ -14545,6 +14574,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isGoFprintToNonResponseWriter(call, pattern, language, sourceLines)) {
+          continue;
+        }
         if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -24126,7 +24158,23 @@ class GoPlugin extends BaseLanguagePlugin {
         type: "xss",
         cwe: "CWE-79",
         severity: "high",
-        argPositions: [1]
+        argPositions: [1, 2, 3, 4, 5, 6]
+      },
+      {
+        method: "Fprint",
+        class: "fmt",
+        type: "xss",
+        cwe: "CWE-79",
+        severity: "high",
+        argPositions: [1, 2, 3, 4, 5, 6]
+      },
+      {
+        method: "Fprintln",
+        class: "fmt",
+        type: "xss",
+        cwe: "CWE-79",
+        severity: "high",
+        argPositions: [1, 2, 3, 4, 5, 6]
       },
       {
         method: "Write",
@@ -25810,6 +25858,8 @@ class LanguageSourcesPass {
     additionalSources.push(...findGoArgvSources(code, language));
     additionalSources.push(...findGoArchiveEntrySources(code, language));
     additionalSources.push(...findGoMultipartUploadSources(code, language));
+    additionalSources.push(...findGoGrpcRequestSources(code, language));
+    additionalSources.push(...findGoRequestBodySources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -26555,6 +26605,127 @@ function findGoMultipartUploadSources(sourceCode, language) {
   }
   return sources;
 }
+function findGoGrpcRequestSources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  if (!sourceCode.includes("context.Context"))
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const sigRe = /^func\s*\([^)]*\)\s*[A-Z]\w*\s*\(\s*\w+\s+context\.Context\s*,\s*([A-Za-z_]\w*)\s+\*(?:\w+\.)?\w*(?:Request|Req)\s*\)\s*\(\s*\*[\w.]+\s*,\s*error\s*\)\s*\{/;
+  const controlRe = /^\s*(?:\}\s*else\s+)?(?:if|for|switch|case|return)\b/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const sig = sigRe.exec(lines[i2]);
+    if (!sig)
+      continue;
+    const param = sig[1];
+    if (param === "_")
+      continue;
+    const readRe = new RegExp(`(?<![\\w.])${param}\\s*\\.\\s*(?:Get[A-Z]\\w*\\s*\\(\\s*\\)|[A-Z]\\w*\\b(?!\\s*\\())`);
+    const directReadRe = new RegExp(`^(?:(?:\\[\\]\\w+|string)\\s*\\(\\s*)*${param}(?:\\s*\\.\\s*(?:Get[A-Z]\\w*\\s*\\(\\s*\\)|[A-Z]\\w*\\b(?!\\s*\\()))+(?:\\s*\\))*$`);
+    const numericParseRe = new RegExp(`\\bstrconv\\s*\\.\\s*(?:Atoi|ParseInt|ParseUint|ParseFloat|ParseBool)\\s*\\(\\s*${param}\\s*\\.`);
+    let end = i2 + 1;
+    while (end < lines.length && !/^\}/.test(lines[end]))
+      end++;
+    for (let j = i2 + 1;j < end; j++) {
+      const line = lines[j];
+      const read = readRe.exec(line);
+      if (!read)
+        continue;
+      if (numericParseRe.test(line))
+        continue;
+      let variable;
+      const unmarshal = /\bUnmarshal\w*\s*\([^&]*&\s*([A-Za-z_]\w*)/.exec(line);
+      const assign = /^\s*(?:var\s+)?([A-Za-z_][\w\s,]*?)\s*:?=(?!=)\s*(.+)$/.exec(line);
+      if (unmarshal && line.indexOf(read[0]) < line.indexOf("&")) {
+        variable = unmarshal[1];
+      } else if (assign && directReadRe.test(assign[2].trim()) && !controlRe.test(line)) {
+        variable = assign[1].split(",").map((v) => v.trim()).find((v) => v !== "_" && v !== "err" && v !== "ok" && /^[A-Za-z_]\w*$/.test(v));
+        if (!variable)
+          continue;
+      } else if (controlRe.test(line)) {
+        continue;
+      } else {
+        variable = param;
+      }
+      const lineNumber = j + 1;
+      if (sources.some((sc) => sc.line === lineNumber && sc.variable === variable))
+        continue;
+      sources.push({
+        type: "http_body",
+        location: `${read[0].replace(/\s+/g, "")} — field of the gRPC request message \`${param}\``,
+        severity: "high",
+        line: lineNumber,
+        confidence: 0.85,
+        variable
+      });
+    }
+    i2 = end;
+  }
+  return sources;
+}
+function findGoRequestBodySources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  if (!sourceCode.includes(".Body"))
+    return [];
+  const lines = sourceCode.split(`
+`);
+  const reqNames = new Set;
+  const paramRe = /([A-Za-z_]\w*)\s+\*http\.Request\b/g;
+  for (const line of lines) {
+    let m;
+    paramRe.lastIndex = 0;
+    while ((m = paramRe.exec(line)) !== null)
+      reqNames.add(m[1]);
+  }
+  if (reqNames.size === 0)
+    return [];
+  const bodyAlt = [...reqNames].map((n) => n.replace(/\$/g, "\\$")).join("|");
+  const bodyRef = `(?<![\\w.])(?:${bodyAlt})\\s*\\.\\s*Body\\b`;
+  const sources = [];
+  const push = (variable, line, how) => {
+    if (variable === "_" || variable === "")
+      return;
+    if (sources.some((s) => s.line === line && s.variable === variable))
+      return;
+    sources.push({
+      type: "http_body",
+      location: `${how} — HTTP request body`,
+      severity: "high",
+      line,
+      confidence: 0.85,
+      ...variable ? { variable } : {}
+    });
+  };
+  const bodyRe = new RegExp(bodyRef);
+  const decodeRe = new RegExp(`(?:json|xml)\\s*\\.\\s*NewDecoder\\s*\\(\\s*(?:io\\.NopCloser\\s*\\(\\s*)?(?:${bodyAlt})\\s*\\.\\s*Body\\b[^)]*\\)\\s*\\)?\\s*\\.\\s*Decode\\s*\\(\\s*&\\s*([A-Za-z_]\\w*)`);
+  const readAllRe = new RegExp(`\\b([A-Za-z_]\\w*)\\s*,\\s*\\w+\\s*:?=\\s*(?:io|ioutil)\\s*\\.\\s*ReadAll\\s*\\(\\s*(?:${bodyAlt})\\s*\\.\\s*Body\\b`);
+  const copyRe = new RegExp(`\\bio\\s*\\.\\s*Copy\\s*\\(\\s*([A-Za-z_]\\w*|&\\s*[A-Za-z_]\\w*)\\s*,\\s*(?:${bodyAlt})\\s*\\.\\s*Body\\b`);
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (!bodyRe.test(line))
+      continue;
+    const n = i2 + 1;
+    const dec = decodeRe.exec(line);
+    if (dec) {
+      push(dec[1], n, `json/xml decode of ${dec[0].split(".")[0]}.Body`);
+      continue;
+    }
+    const ra = readAllRe.exec(line);
+    if (ra) {
+      push(ra[1], n, "io.ReadAll(req.Body)");
+      continue;
+    }
+    const cp = copyRe.exec(line);
+    if (cp) {
+      push(cp[1].replace(/^&\s*/, ""), n, "io.Copy(dst, req.Body)");
+      continue;
+    }
+  }
+  return sources;
+}
 function findCSharpRequestSources(sourceCode, language) {
   if (language !== "csharp")
     return [];
@@ -37790,6 +37961,116 @@ function pickScopedSource(sources, sinkLine, methodName, types, taintedVar) {
 }
 
 // ../circle-ir/dist/analysis/interprocedural.js
+var GO_BUILTIN_CALLS = new Set([
+  "len",
+  "cap",
+  "make",
+  "new",
+  "append",
+  "copy",
+  "delete",
+  "close",
+  "panic",
+  "recover",
+  "print",
+  "println",
+  "min",
+  "max",
+  "clear",
+  "string",
+  "int",
+  "int8",
+  "int16",
+  "int32",
+  "int64",
+  "uint",
+  "uint8",
+  "uint16",
+  "uint32",
+  "uint64",
+  "float32",
+  "float64",
+  "bool",
+  "byte",
+  "rune",
+  "error"
+]);
+var GO_ERROR_AND_LOG_CALLS = new Set([
+  "Errorf",
+  "Sprintf",
+  "Sprint",
+  "Sprintln",
+  "Print",
+  "Printf",
+  "Println",
+  "Fatal",
+  "Fatalf",
+  "Fatalln",
+  "Panic",
+  "Panicf",
+  "Panicln",
+  "Debug",
+  "Debugf",
+  "Debugln",
+  "Debugw",
+  "Info",
+  "Infof",
+  "Infoln",
+  "Infow",
+  "InfoS",
+  "Warn",
+  "Warnf",
+  "Warnln",
+  "Warnw",
+  "Warning",
+  "Warningf",
+  "Warningln",
+  "Error",
+  "Errorln",
+  "Errorw",
+  "ErrorS",
+  "Trace",
+  "Tracef",
+  "V",
+  "WithError",
+  "WithField",
+  "WithFields",
+  "WithValues",
+  "Msg",
+  "Msgf"
+]);
+var GO_ERROR_PACKAGES = new Set(["errors", "status", "xerrors", "multierr", "multierror"]);
+var GO_PURE_PACKAGES = new Set([
+  "strings",
+  "strconv",
+  "bytes",
+  "unicode",
+  "utf8",
+  "path",
+  "filepath",
+  "math",
+  "sort",
+  "slices",
+  "maps",
+  "time",
+  "regexp",
+  "url",
+  "hex",
+  "base64"
+]);
+function isGoNonEscapeCall(call) {
+  const name2 = call.method_name;
+  const recv = (call.receiver ?? "").split(".").pop() ?? "";
+  if (!call.receiver && GO_BUILTIN_CALLS.has(name2))
+    return true;
+  if (GO_ERROR_PACKAGES.has(recv))
+    return true;
+  if (GO_PURE_PACKAGES.has(recv))
+    return true;
+  if (GO_ERROR_AND_LOG_CALLS.has(name2))
+    return true;
+  return false;
+}
 function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourcesOrSanitizers, sinksOrOptions, sanitizersArg, optionsArg = {}) {
   let graph;
   let sources;
@@ -38021,6 +38302,9 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     if (!targetMethod) {
       if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name) && !ormQueryBuilderMethods.has(call.method_name)) {
         const isBash = graph.ir.meta.language === "bash";
+        if (graph.ir.meta.language === "go" && isGoNonEscapeCall(call)) {
+          continue;
+        }
         const bashSafeBuiltins = new Set([
           "echo",
           "printf",
@@ -49846,7 +50130,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.22";
+var version = "4.9.23";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -50391,8 +50675,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "54a142d",
-  builtAt: "2026-09-22T01:39:02.544Z"
+  gitSha: "e7e65f8",
+  builtAt: "2026-09-22T22:15:34.355Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.22",
+  "version": "4.9.23",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -67,7 +67,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.1",
-    "circle-ir": "4.9.22"
+    "circle-ir": "4.9.23"
   },
   "devDependencies": {
     "@types/node": "^26.6.1",