cognium-dev 4.9.7 → 4.9.9

package/dist/cli.js

@@ -13764,17 +13764,27 @@ function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
 function stripCsLiterals(line) {
   return line.replace(/\/\/.*$/, "").replace(/@?"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)'/g, "''");
 }
+var _csDepthLines;
+var _csDepthPrefix;
 function csBraceDepthBefore(lines, idx) {
-  let depth = 0;
-  for (let i2 = 0;i2 < idx && i2 < lines.length; i2++) {
-    for (const ch of stripCsLiterals(lines[i2])) {
-      if (ch === "{")
-        depth++;
-      else if (ch === "}")
-        depth--;
+  if (lines !== _csDepthLines) {
+    const pref = new Int32Array(lines.length + 1);
+    let depth = 0;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      pref[i2] = depth;
+      for (const ch of stripCsLiterals(lines[i2])) {
+        if (ch === "{")
+          depth++;
+        else if (ch === "}")
+          depth--;
+      }
     }
+    pref[lines.length] = depth;
+    _csDepthLines = lines;
+    _csDepthPrefix = pref;
   }
-  return depth;
+  const clamped = idx < 0 ? 0 : idx > lines.length ? lines.length : idx;
+  return _csDepthPrefix[clamped];
 }
 function netBraces(fragment) {
   let n = 0;
@@ -13885,6 +13895,33 @@ function csThenBlock(lines, ifIdx, rest) {
   }
   return { start: ifIdx, end: firstIdx, earlyExit: isExit(firstText.trim()) };
 }
+var _csGuardLines;
+var _csGuardMap;
+function csEqualityGuardIndex(lines) {
+  if (lines === _csGuardLines && _csGuardMap)
+    return _csGuardMap;
+  const map = new Map;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const parts2 = splitCsIf(lines[i2]);
+    if (!parts2)
+      continue;
+    const guard = csEqualityGuard(parts2.cond);
+    if (!guard)
+      continue;
+    const entry = { i: i2, rest: parts2.rest, ifCol: parts2.ifCol, op: guard.op };
+    for (const id of csIdentifiers(guard.exprSide)) {
+      let arr = map.get(id);
+      if (!arr) {
+        arr = [];
+        map.set(id, arr);
+      }
+      arr.push(entry);
+    }
+  }
+  _csGuardLines = lines;
+  _csGuardMap = map;
+  return map;
+}
 function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines) {
   if (language !== "csharp")
     return false;
@@ -13903,24 +13940,25 @@ function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)
     return false;
   const sinkIdx = call.location.line - 1;
   const sinkDepth = csBraceDepthBefore(sourceLines, sinkIdx);
-  for (let i2 = 0;i2 < sinkIdx; i2++) {
-    const parts2 = splitCsIf(sourceLines[i2]);
-    if (!parts2)
-      continue;
-    const guard = csEqualityGuard(parts2.cond);
-    if (!guard)
-      continue;
-    const guardIds = csIdentifiers(guard.exprSide);
-    if (![...guardIds].some((id) => candidates.has(id)))
-      continue;
-    const block = csThenBlock(sourceLines, i2, parts2.rest);
-    if (guard.op === "==") {
-      if (sinkIdx >= block.start && sinkIdx <= block.end)
-        return true;
-    } else {
-      const guardDepth = csBraceDepthBefore(sourceLines, i2) + netBraces(stripCsLiterals(sourceLines[i2]).slice(0, parts2.ifCol));
-      if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
-        return true;
+  const guardMap = csEqualityGuardIndex(sourceLines);
+  const checked = new Set;
+  for (const cand of candidates) {
+    const guards = guardMap.get(cand);
+    if (!guards)
+      continue;
+    for (const g of guards) {
+      if (g.i >= sinkIdx || checked.has(g))
+        continue;
+      checked.add(g);
+      const block = csThenBlock(sourceLines, g.i, g.rest);
+      if (g.op === "==") {
+        if (sinkIdx >= block.start && sinkIdx <= block.end)
+          return true;
+      } else {
+        const guardDepth = csBraceDepthBefore(sourceLines, g.i) + netBraces(stripCsLiterals(sourceLines[g.i]).slice(0, g.ifCol));
+        if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
+          return true;
+        }
       }
     }
   }
@@ -26939,6 +26977,13 @@ function buildJavaTaintedVars(sourceCode, seedVars) {
     "interface",
     "enum"
   ]);
+  const complexTaintedRes = [];
+  for (const v of knownTainted) {
+    if (!/^[\p{L}\p{N}_]+$/u.test(v)) {
+      const esc = v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      complexTaintedRes.push(new RegExp(`(?<![\\p{L}\\p{N}_])${esc}(?![\\p{L}\\p{N}_])`, "u"));
+    }
+  }
   let changed = true;
   let guard = 0;
   while (changed && guard < lines.length + 2) {
@@ -26960,9 +27005,9 @@ function buildJavaTaintedVars(sourceCode, seedVars) {
         continue;
       if (knownTainted.has(lhs))
         continue;
-      const escaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
       const rhsCode = rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
-      const ref = [...knownTainted].some((v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhsCode));
+      const rhsIdents = rhsCode.match(/[\p{L}\p{N}_]+/gu);
+      const ref = rhsIdents !== null && rhsIdents.some((t) => knownTainted.has(t)) || complexTaintedRes.length > 0 && complexTaintedRes.some((re) => re.test(rhsCode));
       if (ref) {
         derived.set(lhs, i2 + 1);
         knownTainted.add(lhs);
@@ -36283,13 +36328,22 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
   }
   return flows;
 }
+var _reassignSplitCode;
+var _reassignSplitLines;
+function splitLinesCached(code) {
+  if (code === _reassignSplitCode && _reassignSplitLines)
+    return _reassignSplitLines;
+  _reassignSplitCode = code;
+  _reassignSplitLines = code.split(`
+`);
+  return _reassignSplitLines;
+}
 function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
   if (!variable || sinkLine - srcLine < 2)
     return false;
   if (!/^[A-Za-z_][\w]*$/.test(variable))
     return false;
-  const lines = code.split(`
-`);
+  const lines = splitLinesCached(code);
   const lo = Math.max(0, srcLine);
   const hi = Math.min(lines.length, sinkLine - 1);
   const strLit = `(?:"[^"\\\\]*(?:\\\\.[^"\\\\]*)*"|'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'|\`[^\`\\\\]*(?:\\\\.[^\`\\\\]*)*\`)`;
@@ -36627,9 +36681,10 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  const SIMPLE_IDENT = /^[\p{L}\p{N}_]+$/u;
   const reCache = new Map;
   for (const s of sourcesWithVar) {
-    if (reCache.has(s.variable))
+    if (SIMPLE_IDENT.test(s.variable) || reCache.has(s.variable))
       continue;
     const escaped = s.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     reCache.set(s.variable, new RegExp(`(?<![\\p{L}\\p{N}_])${escaped}(?![\\p{L}\\p{N}_])`, "u"));
@@ -36640,6 +36695,23 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     existing.push(call);
     callsByLine.set(call.location.line, existing);
   }
+  const sourcesByVar = new Map;
+  const complexSources = [];
+  sourcesWithVar.forEach((source, ord) => {
+    const complex = !SIMPLE_IDENT.test(source.variable);
+    const entry = { source, ord, complex };
+    if (!complex) {
+      let list = sourcesByVar.get(source.variable);
+      if (!list) {
+        list = [];
+        sourcesByVar.set(source.variable, list);
+      }
+      list.push(entry);
+    } else {
+      complexSources.push(entry);
+    }
+  });
+  const flowKeys = new Set;
   for (const sink of sinks) {
     if (unreachableLines.has(sink.line))
       continue;
@@ -36652,18 +36724,35 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         const expr = arg.expression;
         if (!expr)
           continue;
-        for (const source of sourcesWithVar) {
+        const exprIdentMatches = expr.match(/[\p{L}\p{N}_]+/gu);
+        let candidates = complexSources.length > 0 ? complexSources.slice() : null;
+        if (exprIdentMatches) {
+          for (const id of new Set(exprIdentMatches)) {
+            const list = sourcesByVar.get(id);
+            if (!list)
+              continue;
+            (candidates ??= []).push(...list);
+          }
+        }
+        if (!candidates)
+          continue;
+        if (candidates.length > 1)
+          candidates.sort((a, b) => a.ord - b.ord);
+        for (const { source, complex } of candidates) {
           if (source.line >= sink.line)
             continue;
           if (source.in_method && call.in_method && source.in_method !== call.in_method) {
             continue;
           }
-          const re = reCache.get(source.variable);
-          if (!re || !re.test(expr))
-            continue;
+          if (complex) {
+            const re = reCache.get(source.variable);
+            if (!re || !re.test(expr))
+              continue;
+          }
           if (!sourceSemanticsAllowed(source, sink.type))
             continue;
-          if (flows.some((f) => f.source_line === source.line && f.sink_line === sink.line && f.sink_type === sink.type))
+          const dedupKey = `${source.line}:${sink.line}:${sink.type}`;
+          if (flowKeys.has(dedupKey))
             continue;
           if (aliasSanitizedFor.get(source.variable)?.has(sink.type)) {
             break;
@@ -36683,6 +36772,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             confidence: source.confidence * sink.confidence * 0.7,
             sanitized: false
           });
+          flowKeys.add(dedupKey);
           break;
         }
       }
@@ -48731,7 +48821,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.7";
+var version = "4.9.9";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -49282,6 +49372,12 @@ function generateSarifResults(results, crossFileData) {
   return sarifResults;
 }
 
+// src/build-info.ts
+var buildInfo = {
+  gitSha: "5c476ca",
+  builtAt: "2026-08-26T20:08:56.375Z"
+};
+
 // src/utils/args.ts
 function parseArgs(argv) {
   const args2 = [];
@@ -49422,8 +49518,11 @@ EXAMPLES:
 For more information, visit: https://cognium.dev
 `);
 }
-function showVersion(version2) {
+function showVersion(version2, buildInfo2) {
   console.log(`cognium-dev v${version2}`);
+  if (buildInfo2?.builtAt) {
+    console.log(`build ${buildInfo2.gitSha} · ${buildInfo2.builtAt}`);
+  }
   console.log(`Powered by Cognium Labs`);
 }
 
@@ -50557,7 +50656,7 @@ async function main() {
     return;
   }
   if (command === "version" || options.version || options.V) {
-    showVersion(version);
+    showVersion(version, buildInfo);
     return;
   }
   if (command === "init") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.7",
+  "version": "4.9.9",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,13 +8,13 @@
     "cognium-dev": "dist/cli.js"
   },
   "scripts": {
-    "build": "bun build src/cli.ts --outdir dist --target node --format esm --external pino-pretty",
-    "build:standalone": "mkdir -p wasm && cp ../circle-ir/wasm/*.wasm wasm/ && bun build src/cli.ts --compile --outfile cognium-dev --external pino-pretty",
+    "build": "node scripts/build.mjs",
+    "build:standalone": "mkdir -p wasm && cp ../circle-ir/wasm/*.wasm wasm/ && node scripts/build.mjs --standalone",
     "dev": "bun run src/cli.ts",
     "test": "bun test",
     "clean": "rm -rf dist cognium-dev cognium-dev-* *.bun-build wasm",
     "typecheck": "tsc --noEmit",
-    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually — use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
+    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually \u2014 use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
     "dogfood": "bun run src/cli.ts scan src/ -q",
     "prepublishOnly": "bun run build"
   },
@@ -65,8 +65,8 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^4.9.7"
+    "@cognium/project-profile-detect": "1.1.0",
+    "circle-ir": "4.9.9"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",