cognium-dev 4.9.22 → 4.9.24

package/dist/cli.js

@@ -14400,6 +14400,35 @@ function classifyGoDestinationType(decl) {
     return "unsafe";
   return "safe";
 }
+function isGoFprintToNonResponseWriter(call, pattern, language, sourceLines) {
+  if (language !== "go")
+    return false;
+  if (pattern.type !== "xss" || pattern.class !== "fmt")
+    return false;
+  if (!/^Fprint(?:f|ln)?$/.test(call.method_name))
+    return false;
+  if (!sourceLines)
+    return true;
+  const writer = call.arguments.find((a) => a.position === 0);
+  const name2 = (writer?.expression ?? "").trim();
+  if (!/^[A-Za-z_]\w*$/.test(name2))
+    return true;
+  const rwRe = new RegExp(`\\b${name2}\\s+(?:net/)?http\\.ResponseWriter\\b`);
+  for (let i2 = call.location.line - 1;i2 >= 0; i2--) {
+    const line = sourceLines[i2] ?? "";
+    const funcIdx = line.search(/\bfunc\b/);
+    if (funcIdx < 0)
+      continue;
+    const header = sourceLines.slice(i2, i2 + 4).join(" ");
+    const brace = header.indexOf("{");
+    const params = header.slice(funcIdx, brace >= 0 ? brace : header.length);
+    if (rwRe.test(params))
+      return false;
+    if (/^\s*func\b/.test(line))
+      return true;
+  }
+  return true;
+}
 function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   if (language !== "go")
     return false;
@@ -14545,6 +14574,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isGoFprintToNonResponseWriter(call, pattern, language, sourceLines)) {
+          continue;
+        }
         if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -16814,6 +16846,9 @@ function buildFileIndex(ir) {
   }
   return { callsByLine, defsByLine, usesByLine, callsByMethod, sinksByMethod, defsByMethod };
 }
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 
 class CrossFileResolver {
   fileIndexes = new WeakMap;
@@ -17182,7 +17217,7 @@ class CrossFileResolver {
             candidates.push(arg.variable);
           if (arg.expression) {
             for (const [name2] of paramNameToIndex) {
-              const re = new RegExp(`\\b${name2}\\b`);
+              const re = new RegExp(`\\b${escapeRegExp(name2)}\\b`);
               if (re.test(arg.expression))
                 candidates.push(name2);
             }
@@ -17266,7 +17301,7 @@ class CrossFileResolver {
               }
               if (arg.expression) {
                 for (const v of reachable.names) {
-                  if (new RegExp(`\\b${v}\\b`).test(arg.expression)) {
+                  if (new RegExp(`\\b${escapeRegExp(v)}\\b`).test(arg.expression)) {
                     matchedName = v;
                     break;
                   }
@@ -17697,7 +17732,7 @@ class CrossFileResolver {
     }
     if (arg.expression) {
       for (const [tv, origin] of tainted) {
-        const re = new RegExp(`\\b${tv}\\b`);
+        const re = new RegExp(`\\b${escapeRegExp(tv)}\\b`);
         if (re.test(arg.expression))
           return { var: tv, origin };
       }
@@ -24126,7 +24161,23 @@ class GoPlugin extends BaseLanguagePlugin {
         type: "xss",
         cwe: "CWE-79",
         severity: "high",
-        argPositions: [1]
+        argPositions: [1, 2, 3, 4, 5, 6]
+      },
+      {
+        method: "Fprint",
+        class: "fmt",
+        type: "xss",
+        cwe: "CWE-79",
+        severity: "high",
+        argPositions: [1, 2, 3, 4, 5, 6]
+      },
+      {
+        method: "Fprintln",
+        class: "fmt",
+        type: "xss",
+        cwe: "CWE-79",
+        severity: "high",
+        argPositions: [1, 2, 3, 4, 5, 6]
       },
       {
         method: "Write",
@@ -25810,6 +25861,8 @@ class LanguageSourcesPass {
     additionalSources.push(...findGoArgvSources(code, language));
     additionalSources.push(...findGoArchiveEntrySources(code, language));
     additionalSources.push(...findGoMultipartUploadSources(code, language));
+    additionalSources.push(...findGoGrpcRequestSources(code, language));
+    additionalSources.push(...findGoRequestBodySources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -26555,6 +26608,127 @@ function findGoMultipartUploadSources(sourceCode, language) {
   }
   return sources;
 }
+function findGoGrpcRequestSources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  if (!sourceCode.includes("context.Context"))
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const sigRe = /^func\s*\([^)]*\)\s*[A-Z]\w*\s*\(\s*\w+\s+context\.Context\s*,\s*([A-Za-z_]\w*)\s+\*(?:\w+\.)?\w*(?:Request|Req)\s*\)\s*\(\s*\*[\w.]+\s*,\s*error\s*\)\s*\{/;
+  const controlRe = /^\s*(?:\}\s*else\s+)?(?:if|for|switch|case|return)\b/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const sig = sigRe.exec(lines[i2]);
+    if (!sig)
+      continue;
+    const param = sig[1];
+    if (param === "_")
+      continue;
+    const readRe = new RegExp(`(?<![\\w.])${param}\\s*\\.\\s*(?:Get[A-Z]\\w*\\s*\\(\\s*\\)|[A-Z]\\w*\\b(?!\\s*\\())`);
+    const directReadRe = new RegExp(`^(?:(?:\\[\\]\\w+|string)\\s*\\(\\s*)*${param}(?:\\s*\\.\\s*(?:Get[A-Z]\\w*\\s*\\(\\s*\\)|[A-Z]\\w*\\b(?!\\s*\\()))+(?:\\s*\\))*$`);
+    const numericParseRe = new RegExp(`\\bstrconv\\s*\\.\\s*(?:Atoi|ParseInt|ParseUint|ParseFloat|ParseBool)\\s*\\(\\s*${param}\\s*\\.`);
+    let end = i2 + 1;
+    while (end < lines.length && !/^\}/.test(lines[end]))
+      end++;
+    for (let j = i2 + 1;j < end; j++) {
+      const line = lines[j];
+      const read = readRe.exec(line);
+      if (!read)
+        continue;
+      if (numericParseRe.test(line))
+        continue;
+      let variable;
+      const unmarshal = /\bUnmarshal\w*\s*\([^&]*&\s*([A-Za-z_]\w*)/.exec(line);
+      const assign = /^\s*(?:var\s+)?([A-Za-z_][\w\s,]*?)\s*:?=(?!=)\s*(.+)$/.exec(line);
+      if (unmarshal && line.indexOf(read[0]) < line.indexOf("&")) {
+        variable = unmarshal[1];
+      } else if (assign && directReadRe.test(assign[2].trim()) && !controlRe.test(line)) {
+        variable = assign[1].split(",").map((v) => v.trim()).find((v) => v !== "_" && v !== "err" && v !== "ok" && /^[A-Za-z_]\w*$/.test(v));
+        if (!variable)
+          continue;
+      } else if (controlRe.test(line)) {
+        continue;
+      } else {
+        variable = param;
+      }
+      const lineNumber = j + 1;
+      if (sources.some((sc) => sc.line === lineNumber && sc.variable === variable))
+        continue;
+      sources.push({
+        type: "http_body",
+        location: `${read[0].replace(/\s+/g, "")} — field of the gRPC request message \`${param}\``,
+        severity: "high",
+        line: lineNumber,
+        confidence: 0.85,
+        variable
+      });
+    }
+    i2 = end;
+  }
+  return sources;
+}
+function findGoRequestBodySources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  if (!sourceCode.includes(".Body"))
+    return [];
+  const lines = sourceCode.split(`
+`);
+  const reqNames = new Set;
+  const paramRe = /([A-Za-z_]\w*)\s+\*http\.Request\b/g;
+  for (const line of lines) {
+    let m;
+    paramRe.lastIndex = 0;
+    while ((m = paramRe.exec(line)) !== null)
+      reqNames.add(m[1]);
+  }
+  if (reqNames.size === 0)
+    return [];
+  const bodyAlt = [...reqNames].map((n) => n.replace(/\$/g, "\\$")).join("|");
+  const bodyRef = `(?<![\\w.])(?:${bodyAlt})\\s*\\.\\s*Body\\b`;
+  const sources = [];
+  const push = (variable, line, how) => {
+    if (variable === "_" || variable === "")
+      return;
+    if (sources.some((s) => s.line === line && s.variable === variable))
+      return;
+    sources.push({
+      type: "http_body",
+      location: `${how} — HTTP request body`,
+      severity: "high",
+      line,
+      confidence: 0.85,
+      ...variable ? { variable } : {}
+    });
+  };
+  const bodyRe = new RegExp(bodyRef);
+  const decodeRe = new RegExp(`(?:json|xml)\\s*\\.\\s*NewDecoder\\s*\\(\\s*(?:io\\.NopCloser\\s*\\(\\s*)?(?:${bodyAlt})\\s*\\.\\s*Body\\b[^)]*\\)\\s*\\)?\\s*\\.\\s*Decode\\s*\\(\\s*&\\s*([A-Za-z_]\\w*)`);
+  const readAllRe = new RegExp(`\\b([A-Za-z_]\\w*)\\s*,\\s*\\w+\\s*:?=\\s*(?:io|ioutil)\\s*\\.\\s*ReadAll\\s*\\(\\s*(?:${bodyAlt})\\s*\\.\\s*Body\\b`);
+  const copyRe = new RegExp(`\\bio\\s*\\.\\s*Copy\\s*\\(\\s*([A-Za-z_]\\w*|&\\s*[A-Za-z_]\\w*)\\s*,\\s*(?:${bodyAlt})\\s*\\.\\s*Body\\b`);
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (!bodyRe.test(line))
+      continue;
+    const n = i2 + 1;
+    const dec = decodeRe.exec(line);
+    if (dec) {
+      push(dec[1], n, `json/xml decode of ${dec[0].split(".")[0]}.Body`);
+      continue;
+    }
+    const ra = readAllRe.exec(line);
+    if (ra) {
+      push(ra[1], n, "io.ReadAll(req.Body)");
+      continue;
+    }
+    const cp = copyRe.exec(line);
+    if (cp) {
+      push(cp[1].replace(/^&\s*/, ""), n, "io.Copy(dst, req.Body)");
+      continue;
+    }
+  }
+  return sources;
+}
 function findCSharpRequestSources(sourceCode, language) {
   if (language !== "csharp")
     return [];
@@ -37487,7 +37661,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             for (const other of taintedVars) {
               if (other === varName)
                 continue;
-              const re = new RegExp(`\\b${other}\\b`);
+              const re = new RegExp(`\\b${other.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
               if (!re.test(rhs))
                 continue;
               anyReferenced = true;
@@ -37718,7 +37892,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         }
         const assignMatch = sinkCode.match(/^\s*(?:[A-Za-z_][\w.<>[\]\s,?]*\s+)?[A-Za-z_]\w*\s*=(?!=)\s*/);
         const rhs = assignMatch ? sinkCode.slice(assignMatch[0].length) : sinkCode;
-        if (new RegExp(`\\b${sourceVar}\\b`).test(rhs)) {
+        if (new RegExp(`\\b${sourceVar.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`).test(rhs)) {
           continue;
         }
       }
@@ -37790,6 +37964,116 @@ function pickScopedSource(sources, sinkLine, methodName, types, taintedVar) {
 }
 
 // ../circle-ir/dist/analysis/interprocedural.js
+var GO_BUILTIN_CALLS = new Set([
+  "len",
+  "cap",
+  "make",
+  "new",
+  "append",
+  "copy",
+  "delete",
+  "close",
+  "panic",
+  "recover",
+  "print",
+  "println",
+  "min",
+  "max",
+  "clear",
+  "string",
+  "int",
+  "int8",
+  "int16",
+  "int32",
+  "int64",
+  "uint",
+  "uint8",
+  "uint16",
+  "uint32",
+  "uint64",
+  "float32",
+  "float64",
+  "bool",
+  "byte",
+  "rune",
+  "error"
+]);
+var GO_ERROR_AND_LOG_CALLS = new Set([
+  "Errorf",
+  "Sprintf",
+  "Sprint",
+  "Sprintln",
+  "Print",
+  "Printf",
+  "Println",
+  "Fatal",
+  "Fatalf",
+  "Fatalln",
+  "Panic",
+  "Panicf",
+  "Panicln",
+  "Debug",
+  "Debugf",
+  "Debugln",
+  "Debugw",
+  "Info",
+  "Infof",
+  "Infoln",
+  "Infow",
+  "InfoS",
+  "Warn",
+  "Warnf",
+  "Warnln",
+  "Warnw",
+  "Warning",
+  "Warningf",
+  "Warningln",
+  "Error",
+  "Errorln",
+  "Errorw",
+  "ErrorS",
+  "Trace",
+  "Tracef",
+  "V",
+  "WithError",
+  "WithField",
+  "WithFields",
+  "WithValues",
+  "Msg",
+  "Msgf"
+]);
+var GO_ERROR_PACKAGES = new Set(["errors", "status", "xerrors", "multierr", "multierror"]);
+var GO_PURE_PACKAGES = new Set([
+  "strings",
+  "strconv",
+  "bytes",
+  "unicode",
+  "utf8",
+  "path",
+  "filepath",
+  "math",
+  "sort",
+  "slices",
+  "maps",
+  "time",
+  "regexp",
+  "url",
+  "hex",
+  "base64"
+]);
+function isGoNonEscapeCall(call) {
+  const name2 = call.method_name;
+  const recv = (call.receiver ?? "").split(".").pop() ?? "";
+  if (!call.receiver && GO_BUILTIN_CALLS.has(name2))
+    return true;
+  if (GO_ERROR_PACKAGES.has(recv))
+    return true;
+  if (GO_PURE_PACKAGES.has(recv))
+    return true;
+  if (GO_ERROR_AND_LOG_CALLS.has(name2))
+    return true;
+  return false;
+}
 function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourcesOrSanitizers, sinksOrOptions, sanitizersArg, optionsArg = {}) {
   let graph;
   let sources;
@@ -38021,6 +38305,9 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     if (!targetMethod) {
       if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name) && !ormQueryBuilderMethods.has(call.method_name)) {
         const isBash = graph.ir.meta.language === "bash";
+        if (graph.ir.meta.language === "go" && isGoNonEscapeCall(call)) {
+          continue;
+        }
         const bashSafeBuiltins = new Set([
           "echo",
           "printf",
@@ -48324,6 +48611,20 @@ function computeProjectProfileSummary(fileAnalyses) {
   }
   return { byShape, byEnv, totalFiles: fileAnalyses.length };
 }
+function longestLineLength(code) {
+  let max = 0, start2 = 0;
+  for (let i2 = 0;i2 < code.length; i2++) {
+    if (code.charCodeAt(i2) === 10) {
+      if (i2 - start2 > max)
+        max = i2 - start2;
+      start2 = i2 + 1;
+    }
+  }
+  if (code.length - start2 > max)
+    max = code.length - start2;
+  return max;
+}
+var MAX_ANALYZABLE_LINE_LENGTH = 1e4;
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
@@ -48375,6 +48676,27 @@ async function analyze(code, filePath, language, options = {}) {
       meta.projectProfile = makeProfileResolver2(options.projectProfile)(filePath);
     }
     phaseEnd("extractMeta", tMeta);
+    if (longestLineLength(code) > MAX_ANALYZABLE_LINE_LENGTH) {
+      logger.warn("Skipping analysis of a minified / single-line file", {
+        filePath,
+        language,
+        codeLength: code.length
+      });
+      return {
+        meta,
+        types: [],
+        calls: [],
+        cfg: { blocks: [], edges: [] },
+        dfg: { defs: [], uses: [], chains: [] },
+        taint: { sources: [], sinks: [], sanitizers: [] },
+        imports: [],
+        exports: [],
+        unresolved: [],
+        enriched: {},
+        metrics: { file: filePath, metrics: [] },
+        parse_status: parseStatus
+      };
+    }
     const tTypes = phaseStart();
     const types = extractTypes(tree, nodeCache, language);
     phaseEnd("extractTypes", tTypes);
@@ -49846,7 +50168,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.22";
+var version = "4.9.24";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -50391,8 +50713,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "54a142d",
-  builtAt: "2026-09-22T01:39:02.544Z"
+  gitSha: "527cda0",
+  builtAt: "2026-09-23T02:30:52.145Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.22",
+  "version": "4.9.24",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -67,7 +67,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.1",
-    "circle-ir": "4.9.22"
+    "circle-ir": "4.9.24"
   },
   "devDependencies": {
     "@types/node": "^26.6.1",