cognium-dev 4.9.26 → 4.9.28

package/dist/cli.js

@@ -7,6 +7,7 @@ import { readFileSync, existsSync, writeFileSync } from "fs";
 import { stat as stat2, readdir as readdir2 } from "fs/promises";
 import { join as join2, dirname as dirname3, extname, resolve as resolve2, relative as relative4, basename } from "path";
 import { createRequire as createRequire2 } from "module";
+import { getHeapStatistics } from "v8";
 
 // ../../node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp = Object.defineProperty;
@@ -5505,6 +5506,33 @@ function extractCSharpCalls(tree, cache) {
       });
       continue;
     }
+    if (left?.type === "identifier" && asn.parent?.type === "initializer_expression") {
+      const creation = asn.parent.parent;
+      if (creation?.type !== "object_creation_expression")
+        continue;
+      const ctorType = creation.childForFieldName("type");
+      const right2 = asn.childForFieldName("right");
+      if (!ctorType || !right2)
+        continue;
+      const typeName = csharpBareName(ctorType);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: getNodeText(left),
+        receiver: typeName,
+        receiver_type: typeName,
+        receiver_type_fqn: null,
+        arguments: [{
+          position: 0,
+          expression: rhsText2,
+          variable: right2.type === "identifier" ? rhsText2 : null,
+          literal: CSHARP_LITERAL_NODE_TYPES.has(right2.type) ? rhsText2 : null,
+          value: null
+        }],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression")
       continue;
     const nameNode = left.childForFieldName("name");
@@ -5517,6 +5545,15 @@ function extractCSharpCalls(tree, cache) {
       const recvType = recv ? typeMap.get(recv) : undefined;
       if (recvType !== "DirectorySearcher")
         continue;
+    } else if (propName === "StatusDescription") {
+      const recv = exprNode ? getNodeText(exprNode) : "";
+      if (!/(^|\.)(Response|HttpResponse|Context\.Response)$/.test(recv))
+        continue;
+    } else if (propName === "BaseAddress") {
+      const recv = exprNode ? getNodeText(exprNode) : null;
+      const recvType = recv ? typeMap.get(recv) : undefined;
+      if (recvType !== "HttpClient")
+        continue;
     } else if (propName !== "CommandText") {
       continue;
     }
@@ -5540,8 +5577,36 @@ function extractCSharpCalls(tree, cache) {
       in_method: findEnclosingMethod(asn)
     });
   }
+  const casts = getNodesFromCache(tree.rootNode, "cast_expression", cache);
+  for (const cast of casts) {
+    const typeNode = cast.childForFieldName("type");
+    const valueNode = cast.childForFieldName("value");
+    if (!typeNode || !valueNode)
+      continue;
+    const typeName = csharpBareName(typeNode);
+    if (!CSHARP_RAW_MARKUP_CAST_TYPES.has(typeName))
+      continue;
+    const valueText = getNodeText(valueNode);
+    calls.push({
+      method_name: typeName,
+      receiver: null,
+      receiver_type: null,
+      receiver_type_fqn: null,
+      arguments: [{
+        position: 0,
+        expression: valueText,
+        variable: valueNode.type === "identifier" ? valueText : null,
+        literal: CSHARP_LITERAL_NODE_TYPES.has(valueNode.type) ? valueText : null,
+        value: null
+      }],
+      location: { line: cast.startPosition.row + 1, column: cast.startPosition.column },
+      in_method: findEnclosingMethod(cast),
+      is_constructor: true
+    });
+  }
   return calls;
 }
+var CSHARP_RAW_MARKUP_CAST_TYPES = new Set(["MarkupString"]);
 function extractCSharpArguments(argsNode) {
   const args2 = [];
   let position = 0;
@@ -5562,12 +5627,22 @@ function extractCSharpArguments(argsNode) {
       position: position++,
       expression: text,
       variable: expr?.type === "identifier" ? text : null,
-      literal: expr?.type === "string_literal" ? text : null,
+      literal: expr && CSHARP_LITERAL_NODE_TYPES.has(expr.type) ? text : null,
       value: null
     });
   }
   return args2;
 }
+var CSHARP_LITERAL_NODE_TYPES = new Set([
+  "string_literal",
+  "verbatim_string_literal",
+  "raw_string_literal",
+  "character_literal",
+  "integer_literal",
+  "real_literal",
+  "boolean_literal",
+  "null_literal"
+]);
 function extractJavaScriptCalls(tree, cache) {
   const calls = [];
   const context = buildJSResolutionContext(tree, cache);
@@ -12481,8 +12556,6 @@ var DEFAULT_SINKS = [
   { method: "deserialize", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "from_str", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
   { method: "from_str", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
-  { method: "from_str", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
-  { method: "from_slice", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0] },
   { method: "body", class: "HttpResponseBuilder", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "body", class: "HttpResponse", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -12703,12 +12776,15 @@ var DEFAULT_SINKS = [
   { method: "Deserialize", class: "ObjectStateFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Raw", class: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAsync", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "StatusDescription", class: "Response", type: "xss", cwe: "CWE-81", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "Content", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Format", class: "String", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "BaseAddress", class: "HttpClient", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "RedirectPermanent", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
@@ -14918,8 +14994,9 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       return false;
     } else if (!call.receiver && !call.receiver_type) {
       const target = call.resolution?.target;
+      const normalisedTarget = language === "rust" ? target?.replace(/::/g, ".") : target;
       const expectedTail = `${pattern.class}.${pattern.method}`;
-      if (target && (target === expectedTail || target.endsWith("." + expectedTail))) {} else {
+      if (normalisedTarget && (normalisedTarget === expectedTail || normalisedTarget.endsWith("." + expectedTail))) {} else {
         return false;
       }
     }
@@ -26077,7 +26154,7 @@ class LanguageSourcesPass {
       }
     }
     if (language === "csharp") {
-      additionalSanitizers.push(...findCSharpFullPathStartsWithGuardSanitizers(code));
+      additionalSanitizers.push(...findCSharpFullPathStartsWithGuardSanitizers(code), ...findCSharpEarlyReturnGuardSanitizers(code, language));
     }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
@@ -26783,18 +26860,23 @@ function findCSharpRequestSources(sourceCode, language) {
   const lines = sourceCode.split(`
 `);
   const assignRe = /^\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
-  const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
   const formFileParams = new Set;
   const formFileDeclRe = /\bIFormFile\s+([A-Za-z_]\w*)/g;
+  const httpRequestReceivers = new Set(["Request"]);
+  const httpRequestDeclRe = /\b(?:HttpRequest|HttpRequestBase)\??\s+([A-Za-z_]\w*)/g;
   for (const line of lines) {
-    const re = new RegExp(formFileDeclRe.source, "g");
+    const formRe = new RegExp(formFileDeclRe.source, "g");
     let d;
-    while ((d = re.exec(line)) !== null)
+    while ((d = formRe.exec(line)) !== null)
       formFileParams.add(d[1]);
+    const reqRe = new RegExp(httpRequestDeclRe.source, "g");
+    while ((d = reqRe.exec(line)) !== null)
+      httpRequestReceivers.add(d[1]);
   }
   const formFileReadRe = formFileParams.size > 0 ? new RegExp(`\\b(?:${[...formFileParams].join("|")})\\s*\\.\\s*(?:FileName|ContentType)\\b`) : null;
+  const requestReadRe = new RegExp(`\\b(?:${[...httpRequestReceivers].join("|")})\\s*\\.\\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\\b`);
   const classify = (text) => requestReadRe.test(text) ? "http_param" : formFileReadRe?.test(text) ? "http_param" : consoleReadRe.test(text) ? "io_input" : envReadRe.test(text) ? "env_input" : null;
   const inlineReads = [
     [requestReadRe, "http_param"],
@@ -26819,10 +26901,37 @@ function findCSharpRequestSources(sourceCode, language) {
   };
   const exprStmtCallRe = /^\s*(?:await\s+)?[A-Za-z_][\w.]*(?:<[^>]*>)?\s*\(.*\)\s*;\s*$/;
   const nonCallKeywordRe = /^\s*(?:await\s+)?(?:if|while|for|foreach|switch|using|lock|return|throw|catch|when|nameof|typeof|sizeof|default)\b/;
+  const embeddedAssignRe = /(?:^|[{;])\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*([^;{}]+)/;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m) {
       const stmt = lines[i2];
+      if (stmt.includes("{") && !/^\s*(?:\/\/|\/\*|\*)/.test(stmt)) {
+        const emb = new RegExp(embeddedAssignRe.source, "g");
+        let em;
+        let seeded = false;
+        while ((em = emb.exec(stmt)) !== null) {
+          const varName2 = em[1];
+          const rhs2 = em[2];
+          const type3 = classify(rhs2);
+          if (!type3)
+            continue;
+          const lineNumber3 = i2 + 1;
+          if (sources.some((s) => s.line === lineNumber3 && s.variable === varName2))
+            continue;
+          sources.push({
+            type: type3,
+            location: `${varName2} = ${rhs2.trim().substring(0, 50)}${rhs2.length > 50 ? "..." : ""}`,
+            severity: "high",
+            line: lineNumber3,
+            confidence: 1,
+            variable: varName2
+          });
+          seeded = true;
+        }
+        if (seeded)
+          continue;
+      }
       if (!exprStmtCallRe.test(stmt) || nonCallKeywordRe.test(stmt))
         continue;
       const hit = inlineRead(stmt);
@@ -29540,6 +29649,76 @@ function guardRejects(lines, i2, terminatorRe, window2) {
   }
   return false;
 }
+function findCSharpEarlyReturnGuardSanitizers(code, language) {
+  if (language !== "csharp")
+    return [];
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const terminatorRe = /\b(throw|return)\b/;
+  const allowlistRes = [
+    /\bif\s*\(\s*Array\s*\.\s*IndexOf\s*\([^,]+,\s*([A-Za-z_][\w.]*)\s*\)\s*<\s*0\s*\)/,
+    /\bif\s*\(\s*!\s*[A-Za-z_][\w.]*\s*\.\s*Contains\s*\(\s*([A-Za-z_][\w.]*)\s*\)\s*\)/
+  ];
+  const charClassRe = /\bif\s*\(\s*!\s*([A-Za-z_][\w.]*)\s*\.\s*All\s*\(\s*char\s*\.\s*Is[A-Za-z]+\s*\)\s*\)/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    let guardedExpr = null;
+    for (const re of allowlistRes) {
+      const m = re.exec(lines[i2]);
+      if (m) {
+        guardedExpr = m[1];
+        break;
+      }
+    }
+    if (!guardedExpr) {
+      const m = charClassRe.exec(lines[i2]);
+      if (m)
+        guardedExpr = m[1];
+    }
+    if (!guardedExpr)
+      continue;
+    if (!guardRejects(lines, i2, terminatorRe, 6))
+      continue;
+    const root = guardedExpr.split(".")[0];
+    const guarded = new Set([guardedExpr, root]);
+    const assignRe = /^\s*(?:(?:var|string)\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+    for (let b = i2 - 1;b >= 0; b--) {
+      const a = assignRe.exec(lines[b]);
+      if (!a || !guarded.has(a[1]))
+        continue;
+      for (const id of a[2].match(/[A-Za-z_]\w*/g) ?? [])
+        guarded.add(id);
+    }
+    const mentions = (t) => {
+      for (const n of guarded)
+        if (new RegExp(`\\b${n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`).test(t))
+          return true;
+      return false;
+    };
+    for (let l = i2 + 1;l < lines.length; l++) {
+      const a = assignRe.exec(lines[l]);
+      if (a && mentions(a[2]))
+        guarded.add(a[1]);
+      if (mentions(lines[l])) {
+        sanitizers.push({
+          type: "csharp_early_return_guard",
+          method: "guard",
+          line: l + 1,
+          sanitizes: [
+            "ssrf",
+            "xpath_injection",
+            "ldap_injection",
+            "path_traversal",
+            "command_injection",
+            "sql_injection",
+            "external_taint_escape"
+          ]
+        });
+      }
+    }
+  }
+  return sanitizers;
+}
 function findCSharpFullPathStartsWithGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -36613,6 +36792,65 @@ class LibraryProfileXssGatePass {
 }
 
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
+var CONTAINER_READ_SOURCES = new Set(["plugin_param", "config_param"]);
+function makeConstPropVeto(constProp, graph, sources, code) {
+  const lines = typeof code === "string" ? code.split(`
+`) : [];
+  const selfReassign = new Map;
+  const escape = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  for (const [line, defs] of graph.defsByLine) {
+    const text = lines[line - 1];
+    if (!text)
+      continue;
+    for (const d of defs) {
+      if (d.kind !== "local" && d.kind !== "param")
+        continue;
+      const v = escape(d.variable);
+      const m = new RegExp(`(?:^|[^\\w.$])${v}\\s*(?:([-+*/%&|^]|<<|>>)=|=(?!=))(.*)$`).exec(text);
+      if (!m)
+        continue;
+      if (m[1] || new RegExp(`(?:^|[^\\w.$])${v}\\b`).test(m[2])) {
+        const arr = selfReassign.get(d.variable) ?? [];
+        arr.push(line);
+        selfReassign.set(d.variable, arr);
+      }
+    }
+  }
+  const reassignedAt = (v, line) => (selfReassign.get(v) ?? []).includes(line);
+  const defAt = (v, line) => {
+    const own = (graph.defsByLine.get(line) ?? []).find((d) => d.variable === v);
+    if (own)
+      return own;
+    const use = (graph.usesByLine.get(line) ?? []).find((u) => u.variable === v && u.def_id != null);
+    return use ? graph.defById.get(use.def_id) : undefined;
+  };
+  return (step, sourceLine, sinkLine) => {
+    const r = isFalsePositive(constProp, step.line, step.variable);
+    if (!r.isFalsePositive)
+      return false;
+    if (r.reason !== "variable_not_tainted")
+      return true;
+    const lo = Math.min(sourceLine, sinkLine);
+    let d = defAt(step.variable, step.line);
+    let selfHops = 0;
+    for (let guard = 0;d && d.line > lo && reassignedAt(d.variable, d.line) && guard < 32; guard++) {
+      const here = d.id;
+      const prior = (graph.usesByLine.get(d.line) ?? []).find((u) => u.variable === d.variable && u.def_id != null && u.def_id !== here);
+      if (!prior)
+        break;
+      selfHops++;
+      d = graph.defById.get(prior.def_id);
+    }
+    if (!d)
+      return true;
+    if (d.line === sourceLine && sources.some((s) => s.line === sourceLine && !CONTAINER_READ_SOURCES.has(s.type)))
+      return false;
+    if (selfHops > 0 && d.line >= lo)
+      return false;
+    return true;
+  };
+}
+
 class TaintPropagationPass {
   name = "taint-propagation";
   category = "security";
@@ -36630,12 +36868,12 @@ class TaintPropagationPass {
       return { flows: [] };
     }
     const propagationResult = propagateTaint(graph, sources, sinks, sanitizers);
+    const isVetoed = makeConstPropVeto(constProp, graph, sources, ctx.code);
     const verifiedFlows = propagationResult.flows.filter((flow) => {
       if (constProp.unreachableLines.has(flow.sink.line))
         return false;
       for (const step of flow.path) {
-        const fpCheck = isFalsePositive(constProp, step.line, step.variable);
-        if (fpCheck.isFalsePositive)
+        if (isVetoed(step, flow.source.line, flow.sink.line))
           return false;
       }
       if (isCorrelatedPredicateFP(constProp, flow))
@@ -36741,7 +36979,7 @@ class TaintPropagationPass {
         continue;
       let isFP = false;
       for (const step of f.path) {
-        if (isFalsePositive(constProp, step.line, step.variable).isFalsePositive) {
+        if (isVetoed(step, f.source_line, f.sink_line)) {
           isFP = true;
           break;
         }
@@ -36767,7 +37005,7 @@ class TaintPropagationPass {
         continue;
       let isFP = false;
       for (const step of f.path) {
-        if (isFalsePositive(constProp, step.line, step.variable).isFalsePositive) {
+        if (isVetoed(step, f.source_line, f.sink_line)) {
           isFP = true;
           break;
         }
@@ -38171,6 +38409,109 @@ var GO_PURE_PACKAGES = new Set([
   "hex",
   "base64"
 ]);
+var CSHARP_PURE_STATIC_RECEIVERS = new Set([
+  "string",
+  "String",
+  "Convert",
+  "Encoding",
+  "BitConverter",
+  "Math",
+  "Int16",
+  "Int32",
+  "Int64",
+  "UInt16",
+  "UInt32",
+  "UInt64",
+  "Double",
+  "Single",
+  "Decimal",
+  "Boolean",
+  "Byte",
+  "SByte",
+  "Char",
+  "Guid",
+  "DateTime",
+  "DateTimeOffset",
+  "TimeSpan",
+  "Enum",
+  "Array",
+  "Buffer",
+  "Nullable",
+  "CultureInfo",
+  "StringComparer",
+  "Comparer",
+  "EqualityComparer",
+  "Console",
+  "Debug",
+  "Trace",
+  "Logger",
+  "logger",
+  "_logger",
+  "Log"
+]);
+var CSHARP_NON_ESCAPE_METHODS = new Set([
+  "ToString",
+  "ToArray",
+  "ToList",
+  "ToCharArray",
+  "GetHashCode",
+  "Equals",
+  "CompareTo",
+  "Trim",
+  "TrimStart",
+  "TrimEnd",
+  "Substring",
+  "Split",
+  "Join",
+  "Concat",
+  "PadLeft",
+  "PadRight",
+  "ToLower",
+  "ToUpper",
+  "ToLowerInvariant",
+  "ToUpperInvariant",
+  "StartsWith",
+  "EndsWith",
+  "Contains",
+  "IndexOf",
+  "LastIndexOf",
+  "Insert",
+  "Remove",
+  "Normalize",
+  "Append",
+  "AppendLine",
+  "AppendFormat",
+  "TryParse",
+  "Parse",
+  "LogInformation",
+  "LogWarning",
+  "LogError",
+  "LogDebug",
+  "LogTrace",
+  "LogCritical",
+  "Information",
+  "Warning",
+  "Verbose",
+  "Fatal",
+  "BeginScope",
+  "Add",
+  "AddLast",
+  "AddFirst",
+  "AddRange",
+  "TryAdd",
+  "Insert",
+  "Push",
+  "Enqueue"
+]);
+function isCSharpNonEscapeCall(call) {
+  const name2 = call.method_name;
+  const recv = (call.receiver ?? "").split(".").pop() ?? "";
+  if (CSHARP_PURE_STATIC_RECEIVERS.has(recv))
+    return true;
+  if (CSHARP_NON_ESCAPE_METHODS.has(name2))
+    return true;
+  return false;
+}
 function isGoNonEscapeCall(call) {
   const name2 = call.method_name;
   const recv = (call.receiver ?? "").split(".").pop() ?? "";
@@ -38418,6 +38759,9 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
         if (graph.ir.meta.language === "go" && isGoNonEscapeCall(call)) {
           continue;
         }
+        if (graph.ir.meta.language === "csharp" && isCSharpNonEscapeCall(call)) {
+          continue;
+        }
         const bashSafeBuiltins = new Set([
           "echo",
           "printf",
@@ -40052,6 +40396,8 @@ class VariableShadowingPass {
             const outerEntry = declLocals[0];
             for (let i2 = 1;i2 < numDeclLocals; i2++) {
               const inner = declLocals[i2];
+              if (inner.def.line <= outerEntry.def.line)
+                continue;
               if (!isInNestedScope(codeLines, outerEntry.def.line, inner.def.line))
                 continue;
               const key = `${variable}-${inner.def.line}`;
@@ -49135,7 +49481,30 @@ async function analyzeProject(files, options = {}) {
   const perFileBudgetMs = options.perFileBudgetMs ?? 0;
   const perFileStart = Date.now();
   let perFileBudgetExceeded = false;
+  const maxProjectSourceChars = options.maxProjectSourceChars ?? 0;
+  const maxProjectFiles = options.maxProjectFiles ?? 0;
+  let projectSourceChars = 0;
+  let projectSizeBudgetExceeded = false;
   for (const { code, filePath, language } of files) {
+    if (maxProjectFiles > 0 && fileAnalyses.length >= maxProjectFiles) {
+      projectSizeBudgetExceeded = true;
+      logger.warn("analyzeProject: file-count ceiling reached, skipping remaining files", {
+        analysed: fileAnalyses.length,
+        total: files.length,
+        maxProjectFiles
+      });
+      break;
+    }
+    if (maxProjectSourceChars > 0 && projectSourceChars + code.length > maxProjectSourceChars) {
+      projectSizeBudgetExceeded = true;
+      logger.warn("analyzeProject: source-size ceiling reached, skipping remaining files", {
+        analysed: fileAnalyses.length,
+        total: files.length,
+        sourceChars: projectSourceChars,
+        maxProjectSourceChars
+      });
+      break;
+    }
     if (perFileBudgetMs > 0 && Date.now() - perFileStart > perFileBudgetMs) {
       perFileBudgetExceeded = true;
       logger.warn("analyzeProject: per-file budget exceeded, skipping remaining files", {
@@ -49150,6 +49519,7 @@ async function analyzeProject(files, options = {}) {
     projectGraph.addFile(filePath, new CodeGraph(ir));
     sourceLinesByFile.set(filePath, code.split(`
 `));
+    projectSourceChars += code.length;
   }
   const crossFileBudgetMs = options.crossFileBudgetMs ?? 300000;
   const crossFileResult = new CrossFilePass().run(projectGraph, sourceLinesByFile, { budgetMs: crossFileBudgetMs });
@@ -49203,6 +49573,9 @@ async function analyzeProject(files, options = {}) {
   if (perFileBudgetExceeded) {
     projectAnalysis.per_file_budget_exceeded = true;
   }
+  if (projectSizeBudgetExceeded) {
+    projectAnalysis.project_size_budget_exceeded = true;
+  }
   return projectAnalysis;
 }
 function deriveProjectName(paths) {
@@ -50296,7 +50669,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.26";
+var version = "4.9.28";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -50694,6 +51067,12 @@ function formatResults(results, verbose, crossFileData, profileSummary) {
     lines.push("");
     lines.push(formatCrossFilePaths(crossFileData.taintPaths));
   }
+  if (crossFileData?.projectSizeBudgetExceeded) {
+    lines.push("");
+    lines.push(colors.yellow(`⚠ Project size ceiling reached — analysed ${crossFileData.filesAnalysed ?? "?"} of ${crossFileData.filesTotal ?? "?"} files.`));
+    lines.push(colors.yellow("  Results cover the analysed files only; this is NOT a clean scan of the project."));
+    lines.push(colors.yellow("  Raise or disable the cap with --max-project-source-chars <n> (0 = unlimited)."));
+  }
   if (crossFileData?.budgetExceeded) {
     lines.push("");
     lines.push(colors.yellow("⚠ Cross-file budget exceeded — some cross-file taint paths may be missing."));
@@ -50714,6 +51093,7 @@ function formatJSON(results, crossFileData, profileSummary) {
     cross_file_taint_paths: crossFileData?.taintPaths ?? [],
     cross_file_calls: crossFileData?.crossFileCalls ?? [],
     cross_file_budget_exceeded: crossFileData?.budgetExceeded ?? false,
+    project_size_budget_exceeded: crossFileData?.projectSizeBudgetExceeded ?? false,
     ...profileSummary ? { project_profile: profileSummary } : {},
     summary: {
       filesScanned: results.length,
@@ -50841,8 +51221,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "178c681",
-  builtAt: "2026-09-24T18:11:45.249Z"
+  gitSha: "7bfe5de",
+  builtAt: "2026-10-01T00:24:15.337Z"
 };
 
 // src/utils/args.ts
@@ -50932,6 +51312,17 @@ SCAN OPTIONS:
                                On exceed: partial taint paths kept, remaining
                                cross-file phases skipped, cross_file_budget_exceeded
                                surfaced in output (text warning / JSON / SARIF field).
+  --max-project-source-chars <n>
+                             Cap the per-file phase by total source characters
+                               [default: scaled to this process's V8 heap limit
+                               (~7000 chars per MB, so ~29M at Node's default
+                               4 GB heap) — 0 = unlimited. Raise it together
+                               with --max-old-space-size, not on its own.]
+                               A project large enough to exhaust the V8 heap would
+                               otherwise abort the process with no results at all.
+                               On exceed: remaining files skipped, results kept for
+                               the analysed subset, project_size_budget_exceeded
+                               surfaced in output (text warning / JSON field).
 
 METRICS OPTIONS:
   -l, --language <lang>      Analyze only files for language (bash|csharp|go|html|java|javascript|typescript|python|rust)
@@ -51350,12 +51741,35 @@ async function scanFile(filePath, language, analyzeOpts) {
     };
   }
 }
-async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
-  const filesWithCode = files.map((f) => ({
-    code: readFileSync(f, "utf-8"),
-    filePath: f,
-    language: language || detectLanguage7(f)
-  }));
+var CHARS_PER_MB_OF_HEAP = 7000;
+function defaultMaxProjectSourceChars() {
+  try {
+    const heapMb = getHeapStatistics().heap_size_limit / (1024 * 1024);
+    if (!Number.isFinite(heapMb) || heapMb <= 0)
+      return 32000000;
+    return Math.floor(heapMb * CHARS_PER_MB_OF_HEAP);
+  } catch {
+    return 32000000;
+  }
+}
+async function scanProject(files, language, analyzeOpts, crossFileBudgetMs, maxProjectSourceChars) {
+  const sourceCap = maxProjectSourceChars ?? defaultMaxProjectSourceChars();
+  const filesWithCode = [];
+  let sourceChars = 0;
+  let readTruncated = false;
+  for (const f of files) {
+    const code = readFileSync(f, "utf-8");
+    if (sourceCap > 0 && sourceChars + code.length > sourceCap && filesWithCode.length > 0) {
+      readTruncated = true;
+      break;
+    }
+    sourceChars += code.length;
+    filesWithCode.push({
+      code,
+      filePath: f,
+      language: language || detectLanguage7(f)
+    });
+  }
   const projectResult = await analyzeProject(filesWithCode, {
     passOptions: analyzeOpts?.passOptions,
     disabledPasses: analyzeOpts?.disabledPasses,
@@ -51391,7 +51805,10 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
     crossFileData: {
       taintPaths: projectResult.taint_paths,
       crossFileCalls: projectResult.cross_file_calls,
-      budgetExceeded: projectResult.cross_file_budget_exceeded === true
+      budgetExceeded: projectResult.cross_file_budget_exceeded === true,
+      projectSizeBudgetExceeded: readTruncated || projectResult.project_size_budget_exceeded === true,
+      filesAnalysed: projectResult.files.length,
+      filesTotal: files.length
     }
   };
 }
@@ -51622,7 +52039,7 @@ async function runScan(targetPath, options) {
     if ((await stat2(absPath)).isDirectory()) {
       if (spin)
         spin.text = `Running project analysis on ${files.length} file(s)...`;
-      const projectScan = await scanProject(files, options.language, analyzeOpts, options.crossFileBudgetMs);
+      const projectScan = await scanProject(files, options.language, analyzeOpts, options.crossFileBudgetMs, options.maxProjectSourceChars);
       results = projectScan.results;
       crossFileData = projectScan.crossFileData;
     } else {
@@ -51654,8 +52071,10 @@ async function runScan(targetPath, options) {
           spin.text = `Scanning... (${processed}/${files.length})`;
       }
     }
-    if (spin)
-      spin.succeed(`Scanned ${files.length} file(s)`);
+    if (spin) {
+      const analysed = crossFileData?.projectSizeBudgetExceeded ? crossFileData.filesAnalysed ?? files.length : files.length;
+      spin.succeed(analysed === files.length ? `Scanned ${files.length} file(s)` : `Scanned ${analysed} of ${files.length} file(s) — stopped at the project size ceiling`);
+    }
     if (suppressions.length > 0) {
       const beforeCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0) + (crossFileData?.taintPaths.length ?? 0);
       results = applySuppressionsToResults(results, suppressions, process.cwd());
@@ -51731,7 +52150,8 @@ async function runScan(targetPath, options) {
     const qualityCount = allVulns.filter((v) => v.category !== "security").length;
     const errors = results.filter((r) => r.error).length;
     const crossFilePaths = crossFileData?.taintPaths.length ?? 0;
-    const shouldOutput = totalVulns > 0 || crossFilePaths > 0 || errors > 0 || options.verbose || options.output || options.format !== "text";
+    const truncated = crossFileData?.projectSizeBudgetExceeded === true;
+    const shouldOutput = totalVulns > 0 || crossFilePaths > 0 || errors > 0 || options.verbose || options.output || options.format !== "text" || truncated;
     const profileSummary = buildProfileSummary(absPath, detectedModules, resolvedProfiles);
     if (resolvedProfiles) {
       for (const r of results) {
@@ -51763,15 +52183,17 @@ async function runScan(targetPath, options) {
       }
       if (!options.quiet && options.format === "text") {
         console.log();
+        const scanned = crossFileData?.projectSizeBudgetExceeded ? crossFileData.filesAnalysed ?? files.length : files.length;
+        const scannedLabel = crossFileData?.projectSizeBudgetExceeded ? `${scanned} of ${crossFileData.filesTotal ?? files.length} file(s) analysed` : `${scanned} file(s)`;
         if (securityCount > 0) {
-          console.log(colors.red(`Found ${securityCount} security finding(s) in ${files.length} file(s)`));
+          console.log(colors.red(`Found ${securityCount} security finding(s) in ${scannedLabel}`));
         }
         if (qualityCount > 0) {
           const label = securityCount > 0 ? "Also found" : "Found";
-          console.log(colors.yellow(`${label} ${qualityCount} code quality finding(s) in ${files.length} file(s)`));
+          console.log(colors.yellow(`${label} ${qualityCount} code quality finding(s) in ${scannedLabel}`));
         }
         if (securityCount === 0 && qualityCount === 0 && options.verbose) {
-          console.log(colors.green(`No findings in ${files.length} file(s)`));
+          console.log(colors.green(`No findings in ${scannedLabel}`));
         }
         if (errors > 0) {
           console.log(colors.yellow(`${errors} file(s) had errors during analysis`));
@@ -52065,6 +52487,17 @@ function parseCrossFileBudgetMs(raw) {
   }
   return n;
 }
+function parseMaxProjectSourceChars(raw) {
+  if (raw === undefined || raw === true || raw === "")
+    return;
+  const s = String(raw);
+  const n = Number.parseInt(s, 10);
+  if (!Number.isFinite(n) || n < 0 || String(n) !== s) {
+    console.error(colors.yellow(`Warning: invalid --max-project-source-chars "${s}" (expected non-negative integer, 0 = unlimited); ignoring`));
+    return;
+  }
+  return n;
+}
 var SBOM_MANIFESTS = {
   "package.json": parseNpmDependencies,
   "package-lock.json": parseNpmLockDependencies,
@@ -52262,6 +52695,7 @@ Usage: cognium-dev scan <path> [options]`);
       profile: options.profile || options.p,
       disablePass: options["disable-pass"],
       crossFileBudgetMs: parseCrossFileBudgetMs(options["cross-file-budget-ms"]),
+      maxProjectSourceChars: parseMaxProjectSourceChars(options["max-project-source-chars"]),
       projectProfile: parseProjectProfileArg(options["project-profile"]),
       noProjectProfile: options["no-project-profile"] === true,
       projectProfileExplain: options["project-profile-explain"] === true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.26",
+  "version": "4.9.28",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -65,10 +65,10 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.9.26"
+    "circle-ir": "4.9.28"
   },
   "devDependencies": {
-    "@types/node": "^26.6.1",
+    "@types/node": "^26.6.2",
     "ajv": "^8.17.1",
     "ajv-draft-04": "^1.0.0",
     "bun-types": "^1.4.2",