cognium-dev 4.9.23 → 4.9.24

package/dist/cli.js

@@ -16846,6 +16846,9 @@ function buildFileIndex(ir) {
   }
   return { callsByLine, defsByLine, usesByLine, callsByMethod, sinksByMethod, defsByMethod };
 }
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 
 class CrossFileResolver {
   fileIndexes = new WeakMap;
@@ -17214,7 +17217,7 @@ class CrossFileResolver {
             candidates.push(arg.variable);
           if (arg.expression) {
             for (const [name2] of paramNameToIndex) {
-              const re = new RegExp(`\\b${name2}\\b`);
+              const re = new RegExp(`\\b${escapeRegExp(name2)}\\b`);
               if (re.test(arg.expression))
                 candidates.push(name2);
             }
@@ -17298,7 +17301,7 @@ class CrossFileResolver {
               }
               if (arg.expression) {
                 for (const v of reachable.names) {
-                  if (new RegExp(`\\b${v}\\b`).test(arg.expression)) {
+                  if (new RegExp(`\\b${escapeRegExp(v)}\\b`).test(arg.expression)) {
                     matchedName = v;
                     break;
                   }
@@ -17729,7 +17732,7 @@ class CrossFileResolver {
     }
     if (arg.expression) {
       for (const [tv, origin] of tainted) {
-        const re = new RegExp(`\\b${tv}\\b`);
+        const re = new RegExp(`\\b${escapeRegExp(tv)}\\b`);
         if (re.test(arg.expression))
           return { var: tv, origin };
       }
@@ -37658,7 +37661,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             for (const other of taintedVars) {
               if (other === varName)
                 continue;
-              const re = new RegExp(`\\b${other}\\b`);
+              const re = new RegExp(`\\b${other.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
               if (!re.test(rhs))
                 continue;
               anyReferenced = true;
@@ -37889,7 +37892,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         }
         const assignMatch = sinkCode.match(/^\s*(?:[A-Za-z_][\w.<>[\]\s,?]*\s+)?[A-Za-z_]\w*\s*=(?!=)\s*/);
         const rhs = assignMatch ? sinkCode.slice(assignMatch[0].length) : sinkCode;
-        if (new RegExp(`\\b${sourceVar}\\b`).test(rhs)) {
+        if (new RegExp(`\\b${sourceVar.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`).test(rhs)) {
           continue;
         }
       }
@@ -48608,6 +48611,20 @@ function computeProjectProfileSummary(fileAnalyses) {
   }
   return { byShape, byEnv, totalFiles: fileAnalyses.length };
 }
+function longestLineLength(code) {
+  let max = 0, start2 = 0;
+  for (let i2 = 0;i2 < code.length; i2++) {
+    if (code.charCodeAt(i2) === 10) {
+      if (i2 - start2 > max)
+        max = i2 - start2;
+      start2 = i2 + 1;
+    }
+  }
+  if (code.length - start2 > max)
+    max = code.length - start2;
+  return max;
+}
+var MAX_ANALYZABLE_LINE_LENGTH = 1e4;
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
@@ -48659,6 +48676,27 @@ async function analyze(code, filePath, language, options = {}) {
       meta.projectProfile = makeProfileResolver2(options.projectProfile)(filePath);
     }
     phaseEnd("extractMeta", tMeta);
+    if (longestLineLength(code) > MAX_ANALYZABLE_LINE_LENGTH) {
+      logger.warn("Skipping analysis of a minified / single-line file", {
+        filePath,
+        language,
+        codeLength: code.length
+      });
+      return {
+        meta,
+        types: [],
+        calls: [],
+        cfg: { blocks: [], edges: [] },
+        dfg: { defs: [], uses: [], chains: [] },
+        taint: { sources: [], sinks: [], sanitizers: [] },
+        imports: [],
+        exports: [],
+        unresolved: [],
+        enriched: {},
+        metrics: { file: filePath, metrics: [] },
+        parse_status: parseStatus
+      };
+    }
     const tTypes = phaseStart();
     const types = extractTypes(tree, nodeCache, language);
     phaseEnd("extractTypes", tTypes);
@@ -50130,7 +50168,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.23";
+var version = "4.9.24";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -50675,8 +50713,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "e7e65f8",
-  builtAt: "2026-09-22T22:15:34.355Z"
+  gitSha: "527cda0",
+  builtAt: "2026-09-23T02:30:52.145Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.23",
+  "version": "4.9.24",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -67,7 +67,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.1",
-    "circle-ir": "4.9.23"
+    "circle-ir": "4.9.24"
   },
   "devDependencies": {
     "@types/node": "^26.6.1",