cognium-dev 4.9.29 → 4.11.0

package/dist/cli.js

@@ -3667,7 +3667,7 @@ function detectLanguage(tree) {
     return "python";
   return jsScore > javaScore ? "javascript" : "java";
 }
-function extractTypes(tree, cache, language) {
+function extractTypes(tree, cache, language, options) {
   const effectiveLanguage = language ?? detectLanguage(tree);
   const isJavaScript = effectiveLanguage === "javascript" || effectiveLanguage === "typescript" || effectiveLanguage === "tsx";
   const isPython = effectiveLanguage === "python";
@@ -3687,7 +3687,7 @@ function extractTypes(tree, cache, language) {
   if (effectiveLanguage === "csharp") {
     return extractCSharpTypes(tree, cache);
   }
-  return extractJavaTypes(tree, cache);
+  return extractJavaTypes(tree, cache, options);
 }
 function csharpMemberNodes(body2) {
   if (!body2)
@@ -3843,7 +3843,7 @@ function extractCSharpModifiers(node) {
   }
   return mods;
 }
-function extractJavaTypes(tree, cache) {
+function extractJavaTypes(tree, cache, options) {
   const types = [];
   const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
   for (const cls of classes) {
@@ -3857,8 +3857,81 @@ function extractJavaTypes(tree, cache) {
   for (const enumDecl of enums) {
     types.push(extractEnumInfo(enumDecl));
   }
+  if (!options?.navigationTypes)
+    return types;
+  for (const rec of getNodesFromCache(tree.rootNode, "record_declaration", cache)) {
+    const info2 = extractClassInfo(rec);
+    info2.is_record = true;
+    for (const comp of recordComponents(rec)) {
+      if (!info2.fields.some((f) => f.name === comp.name)) {
+        info2.fields.push({
+          name: comp.name,
+          type: comp.type,
+          modifiers: ["private", "final"],
+          annotations: []
+        });
+      }
+      if (!info2.methods.some((m) => m.name === comp.name)) {
+        info2.methods.push({
+          name: comp.name,
+          return_type: comp.type,
+          parameters: [],
+          annotations: [],
+          modifiers: ["public"],
+          start_line: rec.startPosition.row + 1,
+          end_line: rec.startPosition.row + 1
+        });
+      }
+    }
+    types.push(info2);
+  }
+  const declNodes = [
+    ...classes,
+    ...interfaces,
+    ...enums,
+    ...getNodesFromCache(tree.rootNode, "record_declaration", cache)
+  ];
+  for (const t of types) {
+    const node = declNodes.find((n) => n.startPosition.row + 1 === t.start_line && getIdentifier(n, "name") === t.name);
+    const path = node ? enclosingTypePath(node) : [];
+    if (path.length > 0)
+      t.enclosing_type = path.join(".");
+  }
   return types;
 }
+function recordComponents(node) {
+  const out2 = [];
+  const params = node.childForFieldName("parameters");
+  if (!params)
+    return out2;
+  for (let i2 = 0;i2 < params.childCount; i2++) {
+    const c = params.child(i2);
+    if (!c || c.type !== "formal_parameter")
+      continue;
+    const name2 = c.childForFieldName("name");
+    const type = c.childForFieldName("type");
+    if (name2)
+      out2.push({ name: getNodeText(name2), type: type ? getNodeText(type) : null });
+  }
+  return out2;
+}
+function enclosingTypePath(node) {
+  const DECLS = new Set([
+    "class_declaration",
+    "interface_declaration",
+    "enum_declaration",
+    "record_declaration"
+  ]);
+  const path = [];
+  for (let p = node.parent;p; p = p.parent) {
+    if (!DECLS.has(p.type))
+      continue;
+    const n = getIdentifier(p, "name");
+    if (n)
+      path.unshift(n);
+  }
+  return path;
+}
 function extractJavaScriptTypes(tree, cache) {
   const types = [];
   const classes = getNodesFromCache(tree.rootNode, "class_declaration", cache);
@@ -12591,6 +12664,22 @@ var DEFAULT_SINKS = [
   { method: "deserialize", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "from_str", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
   { method: "from_str", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "rmp_serde", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_read", class: "rmp_serde", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_read_ref", class: "rmp_serde", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "serde_yaml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "toml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "ron", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_bytes", class: "postcard", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "serde_cbor", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "serde_cbor", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "ciborium", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_str", class: "serde_xml_rs", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "serde_xml_rs", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_str", class: "quick_xml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_reader", class: "quick_xml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0] },
+  { method: "from_slice", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
+  { method: "deserialize_from", class: "bincode", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0] },
   { method: "body", class: "HttpResponseBuilder", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "body", class: "HttpResponse", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -27210,6 +27299,27 @@ function findPythonAssignmentSources(sourceCode, language) {
     const lineNumber = lineNum + 1;
     if (line.trimStart().startsWith("#"))
       continue;
+    const forTargetMatch = line.match(/^\s*for\s+([\p{L}\p{N}_]+)\s+in\s+(.+?)\s*:\s*$/u);
+    if (forTargetMatch) {
+      const [, iterVar, iterExpr] = forTargetMatch;
+      for (const { pattern, type } of PYTHON_TAINTED_PATTERNS2) {
+        if (!pattern.test(iterExpr))
+          continue;
+        const alreadyExists = sources.some((s2) => s2.line === lineNumber && s2.type === type);
+        if (!alreadyExists) {
+          sources.push({
+            type,
+            location: `for ${iterVar} in ${iterExpr.trim().substring(0, 50)}${iterExpr.length > 50 ? "..." : ""}`,
+            severity: "high",
+            line: lineNumber,
+            confidence: 0.95,
+            variable: iterVar
+          });
+        }
+        break;
+      }
+      continue;
+    }
     const assignmentMatch = line.match(/^(\s*\w[\w.]*)\s*(?::\s*\w[\w\[\], .]*)?\s*=\s*(.+)/);
     if (!assignmentMatch)
       continue;
@@ -36483,6 +36593,103 @@ class SpeculativePromptParamSourcePass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/param-source-flow-gate-pass.js
+var EXEMPT_LANGUAGES = new Set(["java", "csharp"]);
+var ROUTE_ANNOTATION = /(?:^|[.\s@])(?:route|api_route|get|post|put|patch|delete|head|options|websocket|api_view|view_config|RequestMapping|GetMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping|All)\s*(?:\(|$)/i;
+var RUST_ROUTE_ATTR = /^\s*#\[\s*(?:[A-Za-z_][\w]*::)*(?:get|post|put|patch|delete|head|options|route|handler)\s*[(\]]/;
+var RUST_HANDLER_RETURN = /\b(?:HttpResponse|Responder|Reply|IntoResponse|Response(?:<[^>]*>)?)\b/;
+function enclosingMethod(methods, line) {
+  let best;
+  for (const m of methods) {
+    if (m.start_line <= line && line <= m.end_line) {
+      if (!best || m.end_line - m.start_line < best.end_line - best.start_line)
+        best = m;
+    }
+  }
+  return best;
+}
+function rustAttributesAbove(lines, startLine) {
+  const out2 = [];
+  for (let i2 = startLine - 2;i2 >= 0; i2--) {
+    const t = (lines[i2] ?? "").trim();
+    if (t.startsWith("#[")) {
+      out2.push(t);
+      continue;
+    }
+    if (t === "" || t.startsWith("//"))
+      continue;
+    break;
+  }
+  return out2;
+}
+function isFrameworkHandler(method, language, lines) {
+  if (method.annotations.some((a) => ROUTE_ANNOTATION.test(a)))
+    return true;
+  if (language === "rust") {
+    if (rustAttributesAbove(lines, method.start_line).some((a) => RUST_ROUTE_ATTR.test(a)))
+      return true;
+    if (method.return_type && RUST_HANDLER_RETURN.test(method.return_type))
+      return true;
+  }
+  return false;
+}
+
+class ParamSourceFlowGatePass {
+  keepParamSourcedFlows;
+  name = "param-source-flow-gate";
+  category = "security";
+  constructor(keepParamSourcedFlows) {
+    this.keepParamSourcedFlows = keepParamSourcedFlows;
+  }
+  run(ctx) {
+    const result = { applied: false, dropped: 0, droppedBySinkType: {} };
+    if (this.keepParamSourcedFlows || EXEMPT_LANGUAGES.has(ctx.language))
+      return result;
+    if (!ctx.hasResult("interprocedural"))
+      return result;
+    const flows = ctx.getResult("interprocedural").additionalFlows;
+    result.applied = true;
+    if (flows.length === 0)
+      return result;
+    const methods = ctx.graph.ir.types.flatMap((t) => t.methods);
+    const lines = ctx.code.split(`
+`);
+    const handlerCache = new Map;
+    const isHandler = (m) => {
+      let v = handlerCache.get(m);
+      if (v === undefined) {
+        v = isFrameworkHandler(m, ctx.language, lines);
+        handlerCache.set(m, v);
+      }
+      return v;
+    };
+    const realSourceLines = new Set;
+    if (ctx.hasResult("sink-filter")) {
+      const sources = ctx.getResult("sink-filter").sources;
+      for (const s of sources) {
+        if (s.type !== "interprocedural_param")
+          realSourceLines.add(s.line);
+      }
+    }
+    let w = 0;
+    for (const f of flows) {
+      let keep = true;
+      if (f.source_type === "interprocedural_param" && !realSourceLines.has(f.source_line)) {
+        const m = enclosingMethod(methods, f.source_line);
+        keep = m !== undefined && isHandler(m);
+      }
+      if (keep)
+        flows[w++] = f;
+      else {
+        result.dropped++;
+        result.droppedBySinkType[f.sink_type] = (result.droppedBySinkType[f.sink_type] ?? 0) + 1;
+      }
+    }
+    flows.length = w;
+    return result;
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
 var REFLECTION_SINK_METHODS = new Set([
   "forName",
@@ -43738,6 +43945,13 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Revoke the GitHub refresh token and store secrets outside source control."
   },
+  {
+    name: "GitLab personal access token",
+    regex: /\bglpat-[A-Za-z0-9_-]{20,}\b/,
+    severity: "critical",
+    level: "error",
+    fix: "Revoke the GitLab personal access token and store it outside source control."
+  },
   {
     name: "Stripe live secret key",
     regex: /\bsk_live_[A-Za-z0-9]{24,}\b/,
@@ -43745,6 +43959,13 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Rotate the Stripe secret key in the Stripe Dashboard and load it from a secrets manager."
   },
+  {
+    name: "Stripe live restricted key",
+    regex: /\brk_live_[A-Za-z0-9]{24,}\b/,
+    severity: "critical",
+    level: "error",
+    fix: "Rotate the Stripe restricted key in the Stripe Dashboard and load it from a secrets manager."
+  },
   {
     name: "Stripe live publishable key",
     regex: /\bpk_live_[A-Za-z0-9]{24,}\b/,
@@ -44096,6 +44317,9 @@ class ScanSecretsPass {
         const m = pattern.regex.exec(lineText);
         if (!m)
           continue;
+        if ((pattern.name === "Stripe live restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
+          continue;
+        }
         if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
           continue;
         }
@@ -49270,7 +49494,7 @@ async function analyze(code, filePath, language, options = {}) {
       };
     }
     const tTypes = phaseStart();
-    const types = extractTypes(tree, nodeCache, language);
+    const types = extractTypes(tree, nodeCache, language, { navigationTypes: options.navigationTypes });
     phaseEnd("extractTypes", tTypes);
     const tCalls = phaseStart();
     const calls = extractCalls(tree, nodeCache, language);
@@ -49335,6 +49559,8 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
     }));
+    if (!disabledPasses.has("param-source-flow-gate"))
+      pipeline.add(new ParamSourceFlowGatePass(options.speculativeParamSources === true));
     if (!disabledPasses.has("library-profile-cwe22-path-gate"))
       pipeline.add(new LibraryProfileCwe22PathGatePass);
     if (!disabledPasses.has("scan-secrets"))
@@ -50785,7 +51011,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.29";
+var version = "4.11.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -51337,8 +51563,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "9d1d45a",
-  builtAt: "2026-10-01T03:14:59.073Z"
+  gitSha: "165e82d",
+  builtAt: "2026-10-07T23:49:13.604Z"
 };
 
 // src/utils/args.ts
@@ -51589,7 +51815,7 @@ function loadConfig(profilePath) {
     const content = readFileSync(configPath, "utf-8");
     return JSON.parse(content);
   } catch (err2) {
-    throw new Error(`Failed to parse ${configPath}: ${err2 instanceof Error ? err2.message : String(err2)}. ` + "Fix the JSON or remove the file.");
+    throw new Error(`Failed to parse ${configPath}: ${err2 instanceof Error ? err2.message : String(err2)}. ` + "Fix the JSON or remove the file.", { cause: err2 });
   }
 }
 function convertConfigToPassOptions(config) {
@@ -51966,7 +52192,7 @@ async function initWasm(spin) {
           go: join3(wasmDir, "tree-sitter-go.wasm"),
           java: join3(wasmDir, "tree-sitter-java.wasm"),
           javascript: join3(wasmDir, "tree-sitter-javascript.wasm"),
-          typescript: join3(wasmDir, "tree-sitter-javascript.wasm"),
+          typescript: join3(wasmDir, "tree-sitter-typescript.wasm"),
           python: join3(wasmDir, "tree-sitter-python.wasm"),
           rust: join3(wasmDir, "tree-sitter-rust.wasm"),
           html: join3(wasmDir, "tree-sitter-html.wasm"),
@@ -52001,7 +52227,7 @@ Please ensure the wasm/ directory is located next to the binary or in your curre
         go: wasmBasePath + "tree-sitter-go.wasm",
         java: wasmBasePath + "tree-sitter-java.wasm",
         javascript: wasmBasePath + "tree-sitter-javascript.wasm",
-        typescript: wasmBasePath + "tree-sitter-javascript.wasm",
+        typescript: wasmBasePath + "tree-sitter-typescript.wasm",
         python: wasmBasePath + "tree-sitter-python.wasm",
         rust: wasmBasePath + "tree-sitter-rust.wasm",
         html: wasmBasePath + "tree-sitter-html.wasm",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.29",
+  "version": "4.11.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -12,7 +12,7 @@
     "test": "bun test",
     "clean": "rm -rf dist cognium-dev cognium-dev-* *.bun-build wasm",
     "typecheck": "tsc --noEmit",
-    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually \u2014 use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
+    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually — use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
     "dogfood": "bun run src/cli.ts scan src/ -q",
     "prepublishOnly": "bun run build",
     "test:coverage": "bun test --coverage"
@@ -65,10 +65,10 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.9.29"
+    "circle-ir": "4.11.0"
   },
   "devDependencies": {
-    "@types/node": "^26.6.2",
+    "@types/node": "^26.6.4",
     "ajv": "^8.17.1",
     "ajv-draft-04": "^1.0.0",
     "bun-types": "^1.4.2",