@appland/scanner 1.46.1 → 1.47.0

package/built/cli/ci/command.js

@@ -110,7 +110,7 @@ exports.default = {
                         }
                         _c.label = 1;
                     case 1:
-                        _c.trys.push([1, 12, , 13]);
+                        _c.trys.push([1, 13, , 14]);
                         if (!appmapDir) {
                             throw new errors_1.ValidationError('--appmap-dir is required');
                         }
@@ -127,38 +127,40 @@ exports.default = {
                         return [4 /*yield*/, (0, configurationProvider_1.parseConfigFile)(config)];
                     case 5:
                         configData = _c.sent();
-                        scanner = (0, scanner_1.default)(false, configData, files);
-                        return [4 /*yield*/, Promise.all([scanner.scan(), scanner.fetchFindingStatus(appIdArg, appmapDir)])];
+                        return [4 /*yield*/, (0, scanner_1.default)(false, configData, files)];
                     case 6:
+                        scanner = _c.sent();
+                        return [4 /*yield*/, Promise.all([scanner.scan(), scanner.fetchFindingStatus(appIdArg, appmapDir)])];
+                    case 7:
                         _b = __read.apply(void 0, [_c.sent(), 2]), rawScanResults = _b[0], findingStatuses = _b[1];
                         // Always report the raw data
                         return [4 /*yield*/, (0, promises_1.writeFile)(reportFile, JSON.stringify(rawScanResults, null, 2))];
-                    case 7:
+                    case 8:
                         // Always report the raw data
                         _c.sent();
                         scanResults = rawScanResults.withFindings((0, findings_1.newFindings)(rawScanResults.findings, findingStatuses));
                         (0, findingsReport_1.default)(scanResults.findings, scanResults.appMapMetadata);
                         (0, summaryReport_1.default)(scanResults, true);
-                        if (!doUpload) return [3 /*break*/, 9];
+                        if (!doUpload) return [3 /*break*/, 10];
                         return [4 /*yield*/, (0, upload_1.default)(rawScanResults, appId, mergeKey, {
                                 maxRetries: 3,
                             })];
-                    case 8:
+                    case 9:
                         uploadResponse = _c.sent();
                         (0, reportUploadURL_1.default)(uploadResponse.summary.numFindings, uploadResponse.url);
-                        _c.label = 9;
-                    case 9:
-                        if (!updateCommitStatusOption) return [3 /*break*/, 11];
-                        return [4 /*yield*/, (0, updateCommitStatus_1.default)(scanResults.findings.length, scanResults.summary.numChecks)];
+                        _c.label = 10;
                     case 10:
-                        _c.sent();
-                        _c.label = 11;
+                        if (!updateCommitStatusOption) return [3 /*break*/, 12];
+                        return [4 /*yield*/, (0, updateCommitStatus_1.default)(scanResults.findings.length, scanResults.summary.numChecks)];
                     case 11:
+                        _c.sent();
+                        _c.label = 12;
+                    case 12:
                         if (failOption) {
                             (0, fail_1.default)(scanResults.findings.length);
                         }
-                        return [3 /*break*/, 13];
-                    case 12:
+                        return [3 /*break*/, 14];
+                    case 13:
                         err_1 = _c.sent();
                         if (err_1 instanceof errors_1.ValidationError) {
                             console.warn(err_1.message);
@@ -172,7 +174,7 @@ exports.default = {
                             return [2 /*return*/, process.exit(exitCode_1.ExitCode.RuntimeError)];
                         }
                         throw err_1;
-                    case 13: return [2 /*return*/];
+                    case 14: return [2 /*return*/];
                 }
             });
         });

package/built/cli/ci/command.js.map

@@ -1 +1 @@
-{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../src/cli/ci/command.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6BAA4C;AAC5C,wCAAwC;AACxC,6BAAiC;AAKjC,mFAA4E;AAC5E,uCAA2D;AAE3D,6CAA+C;AAC/C,2CAA6C;AAC7C,+EAAyD;AACzD,6EAAuD;AAEvD,wCAAuC;AACvC,iEAA2C;AAC3C,iEAA2C;AAC3C,qDAA+B;AAC/B,4DAA0D;AAG1D,yDAAmC;AACnC,6EAAuD;AACvD,uEAAiD;AACjD,iDAA2B;AAE3B,kBAAe;IACb,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,uEAAuE;IACjF,OAAO,EAAP,UAAQ,IAAU;QAChB,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAClB,QAAQ,EAAE,yDAAyD;YACnE,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;YAClC,QAAQ,EAAE,oCAAoC;YAC9C,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACpB,QAAQ,EAAE,kCAAkC;YAC5C,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YACvB,QAAQ,EAAE,8EAA8E;SACzF,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IACK,OAAO,EAAb,UAAc,OAAkB;;;;;;wBACxB,KAUF,OAAoC,EATtC,SAAS,eAAA,EACT,MAAM,YAAA,EACG,SAAS,aAAA,EACZ,UAAU,UAAA,EACX,QAAQ,SAAA,EACb,UAAU,gBAAA,EACF,QAAQ,YAAA,EACI,wBAAwB,wBAAA,EAC5C,QAAQ,cAAA,CAC+B;wBAEzC,IAAI,SAAS,EAAE;4BACb,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;yBACf;;;;wBAGC,IAAI,CAAC,SAAS,EAAE;4BACd,MAAM,IAAI,wBAAe,CAAC,0BAA0B,CAAC,CAAC;yBACvD;wBAED,qBAAM,IAAA,sBAAY,EAAC,WAAW,EAAE,SAAU,CAAC,EAAA;;wBAA3C,SAA2C,CAAC;wBACtC,IAAI,GAAG,IAAA,gBAAS,EAAC,WAAY,CAAC,CAAC;wBACvB,qBAAM,IAAI,CAAI,SAAS,sBAAmB,CAAC,EAAA;;wBAAnD,KAAK,GAAG,SAA2C;wBAE3C,qBAAM,IAAA,sBAAY,EAAC,QAAQ,EAAE,SAAS,CAAC,EAAA;;wBAA/C,KAAK,GAAG,SAAuC;wBAElC,qBAAM,IAAA,uCAAe,EAAC,MAAM,CAAC,EAAA;;wBAA1C,UAAU,GAAG,SAA6B;wBAE1C,OAAO,GAAG,IAAA,iBAAY,EAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;wBAGrD,qBAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAA;;wBADhF,KAAA,sBACJ,SAAoF,KAAA,EAD/E,cAAc,QAAA,EAAE,eAAe,QAAA;wBAGtC,6BAA6B;wBAC7B,qBAAM,IAAA,oBAAS,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAA;;wBADpE,6BAA6B;wBAC7B,SAAoE,CAAC;wBAE/D,WAAW,GAAG,cAAc,CAAC,YAAY,CAC7C,IAAA,sBAAW,EAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CACtD,CAAC;wBAEF,IAAA,wBAAc,EAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;wBACjE,IAAA,uBAAa,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;6BAE7B,QAAQ,EAAR,wBAAQ;wBACa,qBAAM,IAAA,gBAAM,EAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE;gCACnE,UAAU,EAAE,CAAC;6BACd,CAAC,EAAA;;wBAFI,cAAc,GAAG,SAErB;wBACF,IAAA,yBAAe,EAAC,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;;;6BAGtE,wBAAwB,EAAxB,yBAAwB;wBAC1B,qBAAM,IAAA,4BAAkB,EAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAA;;wBAApF,SAAoF,CAAC;;;wBAGvF,IAAI,UAAU,EAAE;4BACd,IAAA,cAAI,EAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;yBACnC;;;;wBAED,IAAI,KAAG,YAAY,wBAAe,EAAE;4BAClC,OAAO,CAAC,IAAI,CAAC,KAAG,CAAC,OAAO,CAAC,CAAC;4BAC1B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,eAAe,CAAC,EAAC;yBAC/C;wBACD,IAAI,KAAG,YAAY,mBAAU,EAAE;4BAC7B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,UAAU,CAAC,EAAC;yBAC1C;wBACD,IAAI,CAAC,cAAO,IAAI,KAAG,YAAY,KAAK,EAAE;4BACpC,OAAO,CAAC,KAAK,CAAC,KAAG,CAAC,OAAO,CAAC,CAAC;4BAC3B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,YAAY,CAAC,EAAC;yBAC5C;wBAED,MAAM,KAAG,CAAC;;;;;KAEb;CACF,CAAC"}
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../src/cli/ci/command.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6BAA4C;AAC5C,wCAAwC;AACxC,6BAAiC;AAKjC,mFAA4E;AAC5E,uCAA2D;AAE3D,6CAA+C;AAC/C,2CAA6C;AAC7C,+EAAyD;AACzD,6EAAuD;AAEvD,wCAAuC;AACvC,iEAA2C;AAC3C,iEAA2C;AAC3C,qDAA+B;AAC/B,4DAA0D;AAG1D,yDAAmC;AACnC,6EAAuD;AACvD,uEAAiD;AACjD,iDAA2B;AAE3B,kBAAe;IACb,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,uEAAuE;IACjF,OAAO,EAAP,UAAQ,IAAU;QAChB,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAClB,QAAQ,EAAE,yDAAyD;YACnE,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;YAClC,QAAQ,EAAE,oCAAoC;YAC9C,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACpB,QAAQ,EAAE,kCAAkC;YAC5C,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YACvB,QAAQ,EAAE,8EAA8E;SACzF,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IACK,OAAO,EAAb,UAAc,OAAkB;;;;;;wBACxB,KAUF,OAAoC,EATtC,SAAS,eAAA,EACT,MAAM,YAAA,EACG,SAAS,aAAA,EACZ,UAAU,UAAA,EACX,QAAQ,SAAA,EACb,UAAU,gBAAA,EACF,QAAQ,YAAA,EACI,wBAAwB,wBAAA,EAC5C,QAAQ,cAAA,CAC+B;wBAEzC,IAAI,SAAS,EAAE;4BACb,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;yBACf;;;;wBAGC,IAAI,CAAC,SAAS,EAAE;4BACd,MAAM,IAAI,wBAAe,CAAC,0BAA0B,CAAC,CAAC;yBACvD;wBAED,qBAAM,IAAA,sBAAY,EAAC,WAAW,EAAE,SAAU,CAAC,EAAA;;wBAA3C,SAA2C,CAAC;wBACtC,IAAI,GAAG,IAAA,gBAAS,EAAC,WAAY,CAAC,CAAC;wBACvB,qBAAM,IAAI,CAAI,SAAS,sBAAmB,CAAC,EAAA;;wBAAnD,KAAK,GAAG,SAA2C;wBAE3C,qBAAM,IAAA,sBAAY,EAAC,QAAQ,EAAE,SAAS,CAAC,EAAA;;wBAA/C,KAAK,GAAG,SAAuC;wBAElC,qBAAM,IAAA,uCAAe,EAAC,MAAM,CAAC,EAAA;;wBAA1C,UAAU,GAAG,SAA6B;wBAEhC,qBAAM,IAAA,iBAAY,EAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,EAAA;;wBAAtD,OAAO,GAAG,SAA4C;wBAG1D,qBAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAA;;wBADhF,KAAA,sBACJ,SAAoF,KAAA,EAD/E,cAAc,QAAA,EAAE,eAAe,QAAA;wBAGtC,6BAA6B;wBAC7B,qBAAM,IAAA,oBAAS,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAA;;wBADpE,6BAA6B;wBAC7B,SAAoE,CAAC;wBAE/D,WAAW,GAAG,cAAc,CAAC,YAAY,CAC7C,IAAA,sBAAW,EAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CACtD,CAAC;wBAEF,IAAA,wBAAc,EAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;wBACjE,IAAA,uBAAa,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;6BAE7B,QAAQ,EAAR,yBAAQ;wBACa,qBAAM,IAAA,gBAAM,EAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE;gCACnE,UAAU,EAAE,CAAC;6BACd,CAAC,EAAA;;wBAFI,cAAc,GAAG,SAErB;wBACF,IAAA,yBAAe,EAAC,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;;;6BAGtE,wBAAwB,EAAxB,yBAAwB;wBAC1B,qBAAM,IAAA,4BAAkB,EAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAA;;wBAApF,SAAoF,CAAC;;;wBAGvF,IAAI,UAAU,EAAE;4BACd,IAAA,cAAI,EAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;yBACnC;;;;wBAED,IAAI,KAAG,YAAY,wBAAe,EAAE;4BAClC,OAAO,CAAC,IAAI,CAAC,KAAG,CAAC,OAAO,CAAC,CAAC;4BAC1B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,eAAe,CAAC,EAAC;yBAC/C;wBACD,IAAI,KAAG,YAAY,mBAAU,EAAE;4BAC7B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,UAAU,CAAC,EAAC;yBAC1C;wBACD,IAAI,CAAC,cAAO,IAAI,KAAG,YAAY,KAAK,EAAE;4BACpC,OAAO,CAAC,KAAK,CAAC,KAAG,CAAC,OAAO,CAAC,CAAC;4BAC3B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,YAAY,CAAC,EAAC;yBAC5C;wBAED,MAAM,KAAG,CAAC;;;;;KAEb;CACF,CAAC"}

package/built/cli/scan/command.js

@@ -134,7 +134,7 @@ exports.default = {
                         }
                         _c.label = 1;
                     case 1:
-                        _c.trys.push([1, 10, , 11]);
+                        _c.trys.push([1, 11, , 12]);
                         if (appmapFile && appmapDir) {
                             throw new errors_1.ValidationError('Use --appmap-dir or --appmap-file, but not both');
                         }
@@ -161,14 +161,18 @@ exports.default = {
                     case 6: return [4 /*yield*/, (0, configurationProvider_1.parseConfigFile)(config)];
                     case 7:
                         configData = _c.sent();
-                        scanner = (0, scanner_1.default)(reportAllFindings, configData, files);
+                        return [4 /*yield*/, (0, scanner_1.default)(reportAllFindings, configData, files).catch(function (error) {
+                                throw new errors_1.ValidationError(error.message + '\nUse --all to perform an offline scan.');
+                            })];
+                    case 8:
+                        scanner = _c.sent();
                         startTime = Date.now();
                         return [4 /*yield*/, Promise.all([scanner.scan(), scanner.fetchFindingStatus(appIdArg, appmapDir)])];
-                    case 8:
+                    case 9:
                         _b = __read.apply(void 0, [_c.sent(), 2]), rawScanResults = _b[0], findingStatuses = _b[1];
                         // Always report the raw data
                         return [4 /*yield*/, (0, promises_1.writeFile)(reportFile, formatReport(rawScanResults))];
-                    case 9:
+                    case 10:
                         // Always report the raw data
                         _c.sent();
                         scanResults = void 0;
@@ -185,8 +189,8 @@ exports.default = {
                         elapsed = Date.now() - startTime;
                         numChecks = scanResults.checks.length * scanResults.summary.numAppMaps;
                         console.log("Performed " + numChecks + " checks in " + elapsed + "ms (" + Math.floor(numChecks / (elapsed / 1000.0)) + " checks/sec)");
-                        return [3 /*break*/, 11];
-                    case 10:
+                        return [3 /*break*/, 12];
+                    case 11:
                         err_1 = _c.sent();
                         if (err_1 instanceof errors_1.ValidationError) {
                             console.warn(err_1.message);
@@ -200,7 +204,7 @@ exports.default = {
                             return [2 /*return*/, process.exit(exitCode_1.ExitCode.RuntimeError)];
                         }
                         throw err_1;
-                    case 11: return [2 /*return*/];
+                    case 12: return [2 /*return*/];
                 }
             });
         });

package/built/cli/scan/command.js.map

@@ -1 +1 @@
-{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../src/cli/scan/command.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6BAA4C;AAC5C,wCAAwC;AACxC,6BAAiC;AAKjC,mFAA4E;AAC5E,uCAA2D;AAE3D,6CAA+C;AAC/C,2CAA6C;AAC7C,+EAAyD;AACzD,6EAAuD;AAEvD,wCAAuC;AACvC,iEAA2C;AAG3C,sDAAoD;AACpD,yDAAmC;AAInC,kBAAe;IACb,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,yCAAyC;IACnD,OAAO,EAAP,UAAQ,IAAU;QAChB,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;YACzB,QAAQ,EAAE,qBAAqB;YAC/B,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACjB,QAAQ,EAAE,gEAAgE;YAC1E,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACjB,QAAQ,EAAE,6DAA6D;YACvE,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IACK,OAAO,EAAb,UAAc,OAAkB;;;;;;wBACxB,KAUF,OAAoC,EATtC,SAAS,eAAA,EACT,UAAU,gBAAA,EACV,MAAM,YAAA,EACG,SAAS,aAAA,EACb,iBAAiB,SAAA,EACjB,QAAQ,SAAA,EACb,MAAM,YAAA,EACN,GAAG,SAAA,EACH,UAAU,gBAAA,CAC6B;wBAEzC,IAAI,SAAS,EAAE;4BACb,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;yBACf;wBAED,IAAI,MAAM,EAAE;4BACV,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC;yBACtC;;;;wBAGC,IAAI,UAAU,IAAI,SAAS,EAAE;4BAC3B,MAAM,IAAI,wBAAe,CAAC,iDAAiD,CAAC,CAAC;yBAC9E;wBACD,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE;4BAC7B,MAAM,IAAI,wBAAe,CAAC,kDAAkD,CAAC,CAAC;yBAC/E;wBAEG,KAAK,GAAa,EAAE,CAAC;6BACrB,SAAS,EAAT,wBAAS;wBACX,qBAAM,IAAA,sBAAY,EAAC,WAAW,EAAE,SAAU,CAAC,EAAA;;wBAA3C,SAA2C,CAAC;wBACtC,IAAI,GAAG,IAAA,gBAAS,EAAC,WAAY,CAAC,CAAC;wBAC7B,qBAAM,IAAI,CAAI,SAAS,sBAAmB,CAAC,EAAA;;wBAAnD,KAAK,GAAG,SAA2C,CAAC;;;6BAElD,UAAU,EAAV,wBAAU;wBACZ,qBAAM,IAAA,sBAAY,EAAC,MAAM,EAAE,UAAU,CAAC,EAAA;;wBAAtC,SAAsC,CAAC;wBACvC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;;4BAGJ,qBAAM,IAAA,uCAAe,EAAC,MAAM,CAAC,EAAA;;wBAA1C,UAAU,GAAG,SAA6B;wBAE1C,OAAO,GAAG,IAAA,iBAAY,EAAC,iBAAiB,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;wBAE7D,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;wBAEa,qBAAM,OAAO,CAAC,GAAG,CAGzD,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAA;;wBAH9D,KAAA,sBAAoC,SAG0B,KAAA,EAH7D,cAAc,QAAA,EAAE,eAAe,QAAA;wBAKtC,6BAA6B;wBAC7B,qBAAM,IAAA,oBAAS,EAAC,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,EAAA;;wBADzD,6BAA6B;wBAC7B,SAAyD,CAAC;wBAEtD,WAAW,SAAA,CAAC;wBAChB,IAAI,iBAAiB,EAAE;4BACrB,WAAW,GAAG,cAAc,CAAC;yBAC9B;6BAAM;4BACL,WAAW,GAAG,cAAc,CAAC,YAAY,CACvC,IAAA,sBAAW,EAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CACtD,CAAC;yBACH;wBAED,IAAA,wBAAc,EAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;wBACtE,OAAO,CAAC,GAAG,EAAE,CAAC;wBACd,IAAA,uBAAa,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;wBACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBACZ,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;wBAEjC,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;wBAC7E,OAAO,CAAC,GAAG,CACT,eAAa,SAAS,mBAAc,OAAO,YAAO,IAAI,CAAC,KAAK,CAC1D,SAAS,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,CAC/B,iBAAc,CAChB,CAAC;;;;wBAEF,IAAI,KAAG,YAAY,wBAAe,EAAE;4BAClC,OAAO,CAAC,IAAI,CAAC,KAAG,CAAC,OAAO,CAAC,CAAC;4BAC1B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,eAAe,CAAC,EAAC;yBAC/C;wBACD,IAAI,KAAG,YAAY,mBAAU,EAAE;4BAC7B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,UAAU,CAAC,EAAC;yBAC1C;wBACD,IAAI,CAAC,cAAO,IAAI,KAAG,YAAY,KAAK,EAAE;4BACpC,OAAO,CAAC,KAAK,CAAC,KAAG,CAAC,OAAO,CAAC,CAAC;4BAC3B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,YAAY,CAAC,EAAC;yBAC5C;wBAED,MAAM,KAAG,CAAC;;;;;KAEb;CACF,CAAC;AAEF,SAAS,cAAc,CAAC,EAOP;QANC,IAAI,iBAAA,EACD,OAAO,oBAAA,EACJ,UAAU,uBAAA,EACjB,GAAG,gBAAA,EACG,SAAS,sBAAA,EACT,SAAS,sBAAA;IAE9B,IAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,GAAG,EAAE,IAAI,GAAG,CAAC;QACb,MAAM,EAAE,OAAO,GAAG,CAAC;QACnB,GAAG,EAAE,GAAG,GAAG,CAAC;QACZ,QAAQ,EAAE,SAAS,GAAG,CAAC;QACvB,QAAQ,EAAE,SAAS,GAAG,CAAC;KACxB,CAAC;SACC,MAAM,CAAC,UAAC,EAAK;YAAL,KAAA,aAAK,EAAF,CAAC,QAAA;QAAM,OAAA,CAAC;IAAD,CAAC,CAAC;SACpB,GAAG,CAAC,UAAC,EAAG;YAAH,KAAA,aAAG,EAAF,CAAC,QAAA;QAAM,OAAA,CAAC;IAAD,CAAC,CAAC,CAAC;IAEnB,OAAO,UAAU,QAAkB;QACjC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAC,EAAM;gBAAN,KAAA,aAAM,EAAL,CAAC,QAAA,EAAE,CAAC,QAAA;YACpC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvC,IAAI,CAAC,KAAK,YAAY;gBAAE,OAAQ,CAAC,CAAC,IAAI,EAAE,CAAa,CAAC,MAAM,KAAK,UAAU,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAO,OAAoB,EAAE,GAAgB;;IACxD,IAAM,MAAM,GAAG,IAAI,GAAG,EAAQ,CAAC;;QAE/B,KAAoB,IAAA,YAAA,SAAA,OAAO,CAAA,gCAAA,qDAAE;YAAxB,IAAM,KAAK,oBAAA;YACd,IAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SACtB;;;;;;;;;IAED,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,SAAS,YAAY,CAAC,cAA2B;IACzC,IAAA,kBAA6C,cAAc,CAAE,EAA3D,OAAO,aAAA,EAAE,cAAc,oBAAA,EAAE,QAAQ,cAA0B,CAAC;IAEpE,gDAAgD;IAChD,IAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtD,IAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,UAAC,EAAc;YAAd,KAAA,aAAc,EAAb,EAAE,QAAA,EAAE,QAAQ,QAAA;QAAM,OAAA,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAtB,CAAsB,CAAC,CAC/E,CAAC;IAEF,yCAAyC;IACzC,IAAM,cAAc,4BAAO,IAAI,CAAC,QAAQ,EAAE,UAAC,EAAQ;YAAN,IAAI,UAAA;QAAO,OAAA,IAAI;IAAJ,CAAI,CAAC,SAAC,CAAC;IAE/D,OAAO,IAAI,CAAC,SAAS,uBAEd,cAAc,KACjB,OAAO,wBAAO,OAAO,KAAE,WAAW,EAAE,cAAc,CAAC,MAAM,KACzD,cAAc,EAAE,QAAQ,EACxB,QAAQ,EAAE,cAAc,KAE1B,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../src/cli/scan/command.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6BAA4C;AAC5C,wCAAwC;AACxC,6BAAiC;AAKjC,mFAA4E;AAC5E,uCAA2D;AAE3D,6CAA+C;AAC/C,2CAA6C;AAC7C,+EAAyD;AACzD,6EAAuD;AAEvD,wCAAuC;AACvC,iEAA2C;AAG3C,sDAAoD;AACpD,yDAAmC;AAInC,kBAAe;IACb,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,yCAAyC;IACnD,OAAO,EAAP,UAAQ,IAAU;QAChB,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;YACzB,QAAQ,EAAE,qBAAqB;YAC/B,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACjB,QAAQ,EAAE,gEAAgE;YAC1E,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACjB,QAAQ,EAAE,6DAA6D;YACvE,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IACK,OAAO,EAAb,UAAc,OAAkB;;;;;;wBACxB,KAUF,OAAoC,EATtC,SAAS,eAAA,EACT,UAAU,gBAAA,EACV,MAAM,YAAA,EACG,SAAS,aAAA,EACb,iBAAiB,SAAA,EACjB,QAAQ,SAAA,EACb,MAAM,YAAA,EACN,GAAG,SAAA,EACH,UAAU,gBAAA,CAC6B;wBAEzC,IAAI,SAAS,EAAE;4BACb,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;yBACf;wBAED,IAAI,MAAM,EAAE;4BACV,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC;yBACtC;;;;wBAGC,IAAI,UAAU,IAAI,SAAS,EAAE;4BAC3B,MAAM,IAAI,wBAAe,CAAC,iDAAiD,CAAC,CAAC;yBAC9E;wBACD,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE;4BAC7B,MAAM,IAAI,wBAAe,CAAC,kDAAkD,CAAC,CAAC;yBAC/E;wBAEG,KAAK,GAAa,EAAE,CAAC;6BACrB,SAAS,EAAT,wBAAS;wBACX,qBAAM,IAAA,sBAAY,EAAC,WAAW,EAAE,SAAU,CAAC,EAAA;;wBAA3C,SAA2C,CAAC;wBACtC,IAAI,GAAG,IAAA,gBAAS,EAAC,WAAY,CAAC,CAAC;wBAC7B,qBAAM,IAAI,CAAI,SAAS,sBAAmB,CAAC,EAAA;;wBAAnD,KAAK,GAAG,SAA2C,CAAC;;;6BAElD,UAAU,EAAV,wBAAU;wBACZ,qBAAM,IAAA,sBAAY,EAAC,MAAM,EAAE,UAAU,CAAC,EAAA;;wBAAtC,SAAsC,CAAC;wBACvC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;;4BAGJ,qBAAM,IAAA,uCAAe,EAAC,MAAM,CAAC,EAAA;;wBAA1C,UAAU,GAAG,SAA6B;wBAEhC,qBAAM,IAAA,iBAAY,EAAC,iBAAiB,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAC5E,UAAC,KAAY;gCACX,MAAM,IAAI,wBAAe,CAAC,KAAK,CAAC,OAAO,GAAG,yCAAyC,CAAC,CAAC;4BACvF,CAAC,CACF,EAAA;;wBAJK,OAAO,GAAG,SAIf;wBAEK,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;wBAEa,qBAAM,OAAO,CAAC,GAAG,CAGzD,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAA;;wBAH9D,KAAA,sBAAoC,SAG0B,KAAA,EAH7D,cAAc,QAAA,EAAE,eAAe,QAAA;wBAKtC,6BAA6B;wBAC7B,qBAAM,IAAA,oBAAS,EAAC,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,EAAA;;wBADzD,6BAA6B;wBAC7B,SAAyD,CAAC;wBAEtD,WAAW,SAAA,CAAC;wBAChB,IAAI,iBAAiB,EAAE;4BACrB,WAAW,GAAG,cAAc,CAAC;yBAC9B;6BAAM;4BACL,WAAW,GAAG,cAAc,CAAC,YAAY,CACvC,IAAA,sBAAW,EAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CACtD,CAAC;yBACH;wBAED,IAAA,wBAAc,EAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;wBACtE,OAAO,CAAC,GAAG,EAAE,CAAC;wBACd,IAAA,uBAAa,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;wBACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBACZ,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;wBAEjC,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;wBAC7E,OAAO,CAAC,GAAG,CACT,eAAa,SAAS,mBAAc,OAAO,YAAO,IAAI,CAAC,KAAK,CAC1D,SAAS,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,CAC/B,iBAAc,CAChB,CAAC;;;;wBAEF,IAAI,KAAG,YAAY,wBAAe,EAAE;4BAClC,OAAO,CAAC,IAAI,CAAC,KAAG,CAAC,OAAO,CAAC,CAAC;4BAC1B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,eAAe,CAAC,EAAC;yBAC/C;wBACD,IAAI,KAAG,YAAY,mBAAU,EAAE;4BAC7B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,UAAU,CAAC,EAAC;yBAC1C;wBACD,IAAI,CAAC,cAAO,IAAI,KAAG,YAAY,KAAK,EAAE;4BACpC,OAAO,CAAC,KAAK,CAAC,KAAG,CAAC,OAAO,CAAC,CAAC;4BAC3B,sBAAO,OAAO,CAAC,IAAI,CAAC,mBAAQ,CAAC,YAAY,CAAC,EAAC;yBAC5C;wBAED,MAAM,KAAG,CAAC;;;;;KAEb;CACF,CAAC;AAEF,SAAS,cAAc,CAAC,EAOP;QANC,IAAI,iBAAA,EACD,OAAO,oBAAA,EACJ,UAAU,uBAAA,EACjB,GAAG,gBAAA,EACG,SAAS,sBAAA,EACT,SAAS,sBAAA;IAE9B,IAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,GAAG,EAAE,IAAI,GAAG,CAAC;QACb,MAAM,EAAE,OAAO,GAAG,CAAC;QACnB,GAAG,EAAE,GAAG,GAAG,CAAC;QACZ,QAAQ,EAAE,SAAS,GAAG,CAAC;QACvB,QAAQ,EAAE,SAAS,GAAG,CAAC;KACxB,CAAC;SACC,MAAM,CAAC,UAAC,EAAK;YAAL,KAAA,aAAK,EAAF,CAAC,QAAA;QAAM,OAAA,CAAC;IAAD,CAAC,CAAC;SACpB,GAAG,CAAC,UAAC,EAAG;YAAH,KAAA,aAAG,EAAF,CAAC,QAAA;QAAM,OAAA,CAAC;IAAD,CAAC,CAAC,CAAC;IAEnB,OAAO,UAAU,QAAkB;QACjC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAC,EAAM;gBAAN,KAAA,aAAM,EAAL,CAAC,QAAA,EAAE,CAAC,QAAA;YACpC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvC,IAAI,CAAC,KAAK,YAAY;gBAAE,OAAQ,CAAC,CAAC,IAAI,EAAE,CAAa,CAAC,MAAM,KAAK,UAAU,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAO,OAAoB,EAAE,GAAgB;;IACxD,IAAM,MAAM,GAAG,IAAI,GAAG,EAAQ,CAAC;;QAE/B,KAAoB,IAAA,YAAA,SAAA,OAAO,CAAA,gCAAA,qDAAE;YAAxB,IAAM,KAAK,oBAAA;YACd,IAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SACtB;;;;;;;;;IAED,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,SAAS,YAAY,CAAC,cAA2B;IACzC,IAAA,kBAA6C,cAAc,CAAE,EAA3D,OAAO,aAAA,EAAE,cAAc,oBAAA,EAAE,QAAQ,cAA0B,CAAC;IAEpE,gDAAgD;IAChD,IAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtD,IAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,UAAC,EAAc;YAAd,KAAA,aAAc,EAAb,EAAE,QAAA,EAAE,QAAQ,QAAA;QAAM,OAAA,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAtB,CAAsB,CAAC,CAC/E,CAAC;IAEF,yCAAyC;IACzC,IAAM,cAAc,4BAAO,IAAI,CAAC,QAAQ,EAAE,UAAC,EAAQ;YAAN,IAAI,UAAA;QAAO,OAAA,IAAI;IAAJ,CAAI,CAAC,SAAC,CAAC;IAE/D,OAAO,IAAI,CAAC,SAAS,uBAEd,cAAc,KACjB,OAAO,wBAAO,OAAO,KAAE,WAAW,EAAE,cAAc,CAAC,MAAM,KACzD,cAAc,EAAE,QAAQ,EACxB,QAAQ,EAAE,cAAc,KAE1B,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/built/cli/scan/scanner.js

@@ -61,9 +61,19 @@ var resolveAppId_1 = __importDefault(require("../resolveAppId"));
 var scan_1 = __importDefault(require("../scan"));
 var scanResults_1 = require("../../report/scanResults");
 function scanner(reportAllFindings, configuration, files) {
-    return reportAllFindings
-        ? new StandaloneScanner(configuration, files)
-        : new ServerIntegratedScanner(configuration, files);
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    if (!reportAllFindings) return [3 /*break*/, 1];
+                    return [2 /*return*/, new StandaloneScanner(configuration, files)];
+                case 1: return [4 /*yield*/, (0, src_1.loadConfiguration)()];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/, new ServerIntegratedScanner(configuration, files)];
+            }
+        });
+    });
 }
 exports.default = scanner;
 var ScannerBase = /** @class */ (function () {
@@ -76,14 +86,11 @@ var ScannerBase = /** @class */ (function () {
             var checks, _a, appMapMetadata, findings;
             return __generator(this, function (_b) {
                 switch (_b.label) {
-                    case 0: return [4 /*yield*/, this.verifyServerConfiguration()];
+                    case 0: return [4 /*yield*/, (0, configurationProvider_1.loadConfig)(this.configuration)];
                     case 1:
-                        _b.sent();
-                        return [4 /*yield*/, (0, configurationProvider_1.loadConfig)(this.configuration)];
-                    case 2:
                         checks = _b.sent();
                         return [4 /*yield*/, (0, scan_1.default)(this.files, checks)];
-                    case 3:
+                    case 2:
                         _a = _b.sent(), appMapMetadata = _a.appMapMetadata, findings = _a.findings;
                         return [2 /*return*/, new scanResults_1.ScanResults(this.configuration, appMapMetadata, findings, checks)];
                 }
@@ -97,23 +104,6 @@ var ServerIntegratedScanner = /** @class */ (function (_super) {
     function ServerIntegratedScanner() {
         return _super !== null && _super.apply(this, arguments) || this;
     }
-    ServerIntegratedScanner.prototype.verifyServerConfiguration = function () {
-        return __awaiter(this, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                return [2 /*return*/, new Promise(function (resolve) {
-                        (0, src_1.loadConfiguration)()
-                            .then(function () { return resolve(true); })
-                            .catch(function (err) {
-                            console.warn("\u26A0\uFE0F Notice \u26A0\uFE0F");
-                            console.warn("\u26A0\uFE0F AppMap Server configuration is not available.");
-                            console.warn("\u26A0\uFE0F Detailed message: " + err.toString());
-                            console.warn("\u26A0\uFE0F Scanning will continue without fetching existing findings from the server.");
-                            resolve(false);
-                        });
-                    })];
-            });
-        });
-    };
     ServerIntegratedScanner.prototype.fetchFindingStatus = function (appIdArg, appMapDir) {
         return __awaiter(this, void 0, void 0, function () {
             var appId;

package/built/cli/scan/scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../src/cli/scan/scanner.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gDAAoF;AAEpF,mFAAuE;AAEvE,sGAA0E;AAE1E,iEAA2C;AAC3C,iDAA2B;AAC3B,wDAAuD;AAQvD,SAAwB,OAAO,CAC7B,iBAA0B,EAC1B,aAA4B,EAC5B,KAAe;IAEf,OAAO,iBAAiB;QACtB,CAAC,CAAC,IAAI,iBAAiB,CAAC,aAAa,EAAE,KAAK,CAAC;QAC7C,CAAC,CAAC,IAAI,uBAAuB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AARD,0BAQC;AAED;IACE,qBAAmB,aAA4B,EAAS,KAAe;QAApD,kBAAa,GAAb,aAAa,CAAe;QAAS,UAAK,GAAL,KAAK,CAAU;IAAG,CAAC;IAErE,0BAAI,GAAV;;;;;4BACE,qBAAM,IAAI,CAAC,yBAAyB,EAAE,EAAA;;wBAAtC,SAAsC,CAAC;wBAExB,qBAAM,IAAA,kCAAU,EAAC,IAAI,CAAC,aAAa,CAAC,EAAA;;wBAA7C,MAAM,GAAG,SAAoC;wBACd,qBAAM,IAAA,cAAI,EAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAA;;wBAA7D,KAA+B,SAA8B,EAA3D,cAAc,oBAAA,EAAE,QAAQ,cAAA;wBAChC,sBAAO,IAAI,yBAAW,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAC;;;;KAC9E;IAGH,kBAAC;AAAD,CAAC,AAZD,IAYC;AAED;IAAsC,2CAAW;IAAjD;;IAwBA,CAAC;IAvBO,2DAAyB,GAA/B;;;gBACE,sBAAO,IAAI,OAAO,CAAC,UAAC,OAAO;wBACzB,IAAA,uBAAiB,GAAE;6BAChB,IAAI,CAAC,cAAM,OAAA,OAAO,CAAC,IAAI,CAAC,EAAb,CAAa,CAAC;6BACzB,KAAK,CAAC,UAAC,GAAG;4BACT,OAAO,CAAC,IAAI,CAAC,kCAAc,CAAC,CAAC;4BAC7B,OAAO,CAAC,IAAI,CAAC,4DAAkD,CAAC,CAAC;4BACjE,OAAO,CAAC,IAAI,CAAC,oCAAwB,GAAG,CAAC,QAAQ,EAAI,CAAC,CAAC;4BACvD,OAAO,CAAC,IAAI,CACV,yFAA+E,CAChF,CAAC;4BACF,OAAO,CAAC,KAAK,CAAC,CAAC;wBACjB,CAAC,CAAC,CAAC;oBACP,CAAC,CAAC,EAAC;;;KACJ;IAEK,oDAAkB,GAAxB,UACE,QAAiB,EACjB,SAAkB;;;;;4BAEJ,qBAAM,IAAA,sBAAY,EAAC,QAAQ,EAAE,SAAS,CAAC,EAAA;;wBAA/C,KAAK,GAAG,SAAuC;wBAC9C,qBAAM,IAAA,2BAAW,EAAC,KAAK,CAAC,EAAA;4BAA/B,sBAAO,SAAwB,EAAC;;;;KACjC;IACH,8BAAC;AAAD,CAAC,AAxBD,CAAsC,WAAW,GAwBhD;AAED;IAAgC,qCAAW;IAA3C;;IAQA,CAAC;IAPO,qDAAyB,GAA/B;;;gBACE,sBAAO,IAAI,EAAC;;;KACb;IAEK,8CAAkB,GAAxB;;;gBACE,sBAAO,EAAE,EAAC;;;KACX;IACH,wBAAC;AAAD,CAAC,AARD,CAAgC,WAAW,GAQ1C"}
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../src/cli/scan/scanner.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gDAAoF;AAEpF,mFAAuE;AAEvE,sGAA0E;AAE1E,iEAA2C;AAC3C,iDAA2B;AAC3B,wDAAuD;AAQvD,SAA8B,OAAO,CACnC,iBAA0B,EAC1B,aAA4B,EAC5B,KAAe;;;;;yBAEX,iBAAiB,EAAjB,wBAAiB;oBACnB,sBAAO,IAAI,iBAAiB,CAAC,aAAa,EAAE,KAAK,CAAC,EAAC;wBAEnD,qBAAM,IAAA,uBAAiB,GAAE,EAAA;;oBAAzB,SAAyB,CAAC;oBAC1B,sBAAO,IAAI,uBAAuB,CAAC,aAAa,EAAE,KAAK,CAAC,EAAC;;;;CAE5D;AAXD,0BAWC;AAED;IACE,qBAAmB,aAA4B,EAAS,KAAe;QAApD,kBAAa,GAAb,aAAa,CAAe;QAAS,UAAK,GAAL,KAAK,CAAU;IAAG,CAAC;IAErE,0BAAI,GAAV;;;;;4BACiB,qBAAM,IAAA,kCAAU,EAAC,IAAI,CAAC,aAAa,CAAC,EAAA;;wBAA7C,MAAM,GAAG,SAAoC;wBACd,qBAAM,IAAA,cAAI,EAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAA;;wBAA7D,KAA+B,SAA8B,EAA3D,cAAc,oBAAA,EAAE,QAAQ,cAAA;wBAChC,sBAAO,IAAI,yBAAW,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAC;;;;KAC9E;IACH,kBAAC;AAAD,CAAC,AARD,IAQC;AAED;IAAsC,2CAAW;IAAjD;;IAQA,CAAC;IAPO,oDAAkB,GAAxB,UACE,QAAiB,EACjB,SAAkB;;;;;4BAEJ,qBAAM,IAAA,sBAAY,EAAC,QAAQ,EAAE,SAAS,CAAC,EAAA;;wBAA/C,KAAK,GAAG,SAAuC;wBAC9C,qBAAM,IAAA,2BAAW,EAAC,KAAK,CAAC,EAAA;4BAA/B,sBAAO,SAAwB,EAAC;;;;KACjC;IACH,8BAAC;AAAD,CAAC,AARD,CAAsC,WAAW,GAQhD;AAED;IAAgC,qCAAW;IAA3C;;IAQA,CAAC;IAPO,qDAAyB,GAA/B;;;gBACE,sBAAO,IAAI,EAAC;;;KACb;IAEK,8CAAkB,GAAxB;;;gBACE,sBAAO,EAAE,EAAC;;;KACX;IACH,wBAAC;AAAD,CAAC,AARD,CAAgC,WAAW,GAQ1C"}

package/built/rules/deserializationOfUntrustedData.js

@@ -1,31 +1,4 @@
 "use strict";
-var __generator = (this && this.__generator) || function (thisArg, body) {
-    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
-    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
-    function verb(n) { return function (v) { return step([n, v]); }; }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while (_) try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [op[0] & 2, t.value];
-            switch (op[0]) {
-                case 0: case 1: t = op; break;
-                case 4: _.label++; return { value: op[1], done: false };
-                case 5: _.label++; y = op[1]; op = [0]; continue;
-                case 7: op = _.ops.pop(); _.trys.pop(); continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
-                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
-                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
-                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop(); continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
-        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
-    }
-};
 var __values = (this && this.__values) || function(o) {
     var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
     if (m) return m.call(o);
@@ -44,75 +17,34 @@ Object.defineProperty(exports, "__esModule", { value: true });
 var models_1 = require("@appland/models");
 var url_1 = require("url");
 var parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
-function sanitizesData(event, objectId, label) {
-    return (event.labels.has(label) &&
-        !!event.returnValue &&
-        !!event.returnValue.object_id &&
-        event.returnValue.object_id === objectId);
-}
-function precedingEvents(rootEvent, target) {
-    var _a, _b, event, e_1_1;
-    var e_1, _c;
-    return __generator(this, function (_d) {
-        switch (_d.label) {
-            case 0:
-                _d.trys.push([0, 5, 6, 7]);
-                _a = __values(new models_1.EventNavigator(rootEvent).descendants()), _b = _a.next();
-                _d.label = 1;
-            case 1:
-                if (!!_b.done) return [3 /*break*/, 4];
-                event = _b.value;
-                if (event.event === target) {
-                    return [3 /*break*/, 4];
-                }
-                return [4 /*yield*/, event];
-            case 2:
-                _d.sent();
-                _d.label = 3;
-            case 3:
-                _b = _a.next();
-                return [3 /*break*/, 1];
-            case 4: return [3 /*break*/, 7];
-            case 5:
-                e_1_1 = _d.sent();
-                e_1 = { error: e_1_1 };
-                return [3 /*break*/, 7];
-            case 6:
-                try {
-                    if (_b && !_b.done && (_c = _a.return)) _c.call(_a);
-                }
-                finally { if (e_1) throw e_1.error; }
-                return [7 /*endfinally*/];
-            case 7: return [2 /*return*/];
-        }
-    });
-}
+var precedingEvents_1 = __importDefault(require("./lib/precedingEvents"));
+var sanitizesData_1 = __importDefault(require("./lib/sanitizesData"));
 function allArgumentsSanitized(rootEvent, event) {
     return (event.parameters || [])
         .filter(function (parameter) { return parameter.object_id; })
         .every(function (parameter) {
-        var e_2, _a;
+        var e_1, _a;
         try {
-            for (var _b = __values(precedingEvents(rootEvent, event)), _c = _b.next(); !_c.done; _c = _b.next()) {
+            for (var _b = __values((0, precedingEvents_1.default)(rootEvent, event)), _c = _b.next(); !_c.done; _c = _b.next()) {
                 var candidate = _c.value;
-                if (sanitizesData(candidate.event, parameter.object_id, Sanitize)) {
+                if ((0, sanitizesData_1.default)(candidate.event, parameter.object_id, DeserializeSanitize)) {
                     return true;
                 }
             }
         }
-        catch (e_2_1) { e_2 = { error: e_2_1 }; }
+        catch (e_1_1) { e_1 = { error: e_1_1 }; }
         finally {
             try {
                 if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
             }
-            finally { if (e_2) throw e_2.error; }
+            finally { if (e_1) throw e_1.error; }
         }
         return false;
     });
 }
 function build() {
     function matcher(rootEvent) {
-        var e_3, _a;
+        var e_2, _a;
         try {
             for (var _b = __values(new models_1.EventNavigator(rootEvent).descendants()), _c = _b.next(); !_c.done; _c = _b.next()) {
                 var event = _c.value;
@@ -134,12 +66,12 @@ function build() {
                 }
             }
         }
-        catch (e_3_1) { e_3 = { error: e_3_1 }; }
+        catch (e_2_1) { e_2 = { error: e_2_1 }; }
         finally {
             try {
                 if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
             }
-            finally { if (e_3) throw e_3.error; }
+            finally { if (e_2) throw e_2.error; }
         }
     }
     return {
@@ -148,11 +80,11 @@ function build() {
 }
 var DeserializeUnsafe = 'deserialize.unsafe';
 var DeserializeSafe = 'deserialize.safe';
-var Sanitize = 'sanitize';
+var DeserializeSanitize = 'deserialize.sanitize';
 exports.default = {
     id: 'deserialization-of-untrusted-data',
     title: 'Deserialization of untrusted data',
-    labels: [DeserializeUnsafe, DeserializeSafe, Sanitize],
+    labels: [DeserializeUnsafe, DeserializeSafe, DeserializeSanitize],
     impactDomain: 'Security',
     enumerateScope: false,
     // scope: //*[@command]

package/built/rules/deserializationOfUntrustedData.js.map

@@ -1 +1 @@
-{"version":3,"file":"deserializationOfUntrustedData.js","sourceRoot":"","sources":["../../src/rules/deserializationOfUntrustedData.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0CAAwD;AAExD,2BAA0B;AAC1B,oFAA8D;AAE9D,SAAS,aAAa,CAAC,KAAY,EAAE,QAAgB,EAAE,KAAa;IAClE,OAAO,CACL,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,WAAW;QACnB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS;QAC7B,KAAK,CAAC,WAAW,CAAC,SAAS,KAAK,QAAQ,CACzC,CAAC;AACJ,CAAC;AAED,SAAU,eAAe,CAAC,SAAgB,EAAE,MAAa;;;;;;;gBACnC,KAAA,SAAA,IAAI,uBAAc,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;;;;gBAApD,KAAK;gBACd,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE;oBAC1B,wBAAM;iBACP;gBACD,qBAAM,KAAK,EAAA;;gBAAX,SAAW,CAAC;;;;;;;;;;;;;;;;;;;CAEf;AAED,SAAS,qBAAqB,CAAC,SAAgB,EAAE,KAAY;IAC3D,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,UAAC,SAAS,IAAK,OAAA,SAAS,CAAC,SAAS,EAAnB,CAAmB,CAAC;SAC1C,KAAK,CAAC,UAAC,SAAS;;;YACf,KAAwB,IAAA,KAAA,SAAA,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA,gBAAA,4BAAE;gBAAtD,IAAM,SAAS,WAAA;gBAClB,IAAI,aAAa,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAU,EAAE,QAAQ,CAAC,EAAE;oBAClE,OAAO,IAAI,CAAC;iBACb;aACF;;;;;;;;;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,KAAK;IACZ,SAAS,OAAO,CAAC,SAAgB;;;YAC/B,KAAoB,IAAA,KAAA,SAAA,IAAI,uBAAc,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA,gBAAA,4BAAE;gBAA5D,IAAM,KAAK,WAAA;gBACd,mIAAmI;gBACnI,IACE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;oBACzC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAApC,CAAoC,CAAC,EACjF;oBACA,IAAI,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;wBACjD,OAAO;qBACR;yBAAM;wBACL,OAAO;4BACL;gCACE,KAAK,EAAE,OAAO;gCACd,KAAK,EAAE,KAAK,CAAC,KAAK;gCAClB,OAAO,EAAK,KAAK,CAAC,KAAK,iCAA8B;6BACtD;yBACF,CAAC;qBACH;iBACF;aACF;;;;;;;;;IACH,CAAC;IAED,OAAO;QACL,OAAO,SAAA;KACR,CAAC;AACJ,CAAC;AAED,IAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,IAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,IAAM,QAAQ,GAAG,UAAU,CAAC;AAE5B,kBAAe;IACb,EAAE,EAAE,mCAAmC;IACvC,KAAK,EAAE,mCAAmC;IAC1C,MAAM,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,QAAQ,CAAC;IACtD,YAAY,EAAE,UAAU;IACxB,cAAc,EAAE,KAAK;IACrB,uBAAuB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,IAAI,SAAG,CAAC,iDAAiD,CAAC;QACrE,eAAe,EAAE,IAAI,SAAG,CAAC,0DAA0D,CAAC;KACrF;IACD,WAAW,EAAE,IAAA,8BAAoB,EAAC,gCAAgC,CAAC;IACnE,GAAG,EAAE,0FAA0F;IAC/F,KAAK,OAAA;CACE,CAAC"}
+{"version":3,"file":"deserializationOfUntrustedData.js","sourceRoot":"","sources":["../../src/rules/deserializationOfUntrustedData.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwD;AAExD,2BAA0B;AAC1B,oFAA8D;AAC9D,0EAAoD;AACpD,sEAAgD;AAEhD,SAAS,qBAAqB,CAAC,SAAgB,EAAE,KAAY;IAC3D,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,UAAC,SAAS,IAAK,OAAA,SAAS,CAAC,SAAS,EAAnB,CAAmB,CAAC;SAC1C,KAAK,CAAC,UAAC,SAAS;;;YACf,KAAwB,IAAA,KAAA,SAAA,IAAA,yBAAe,EAAC,SAAS,EAAE,KAAK,CAAC,CAAA,gBAAA,4BAAE;gBAAtD,IAAM,SAAS,WAAA;gBAClB,IAAI,IAAA,uBAAa,EAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAU,EAAE,mBAAmB,CAAC,EAAE;oBAC7E,OAAO,IAAI,CAAC;iBACb;aACF;;;;;;;;;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,KAAK;IACZ,SAAS,OAAO,CAAC,SAAgB;;;YAC/B,KAAoB,IAAA,KAAA,SAAA,IAAI,uBAAc,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA,gBAAA,4BAAE;gBAA5D,IAAM,KAAK,WAAA;gBACd,mIAAmI;gBACnI,IACE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;oBACzC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAApC,CAAoC,CAAC,EACjF;oBACA,IAAI,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;wBACjD,OAAO;qBACR;yBAAM;wBACL,OAAO;4BACL;gCACE,KAAK,EAAE,OAAO;gCACd,KAAK,EAAE,KAAK,CAAC,KAAK;gCAClB,OAAO,EAAK,KAAK,CAAC,KAAK,iCAA8B;6BACtD;yBACF,CAAC;qBACH;iBACF;aACF;;;;;;;;;IACH,CAAC;IAED,OAAO;QACL,OAAO,SAAA;KACR,CAAC;AACJ,CAAC;AAED,IAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,IAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,IAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAEnD,kBAAe;IACb,EAAE,EAAE,mCAAmC;IACvC,KAAK,EAAE,mCAAmC;IAC1C,MAAM,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,CAAC;IACjE,YAAY,EAAE,UAAU;IACxB,cAAc,EAAE,KAAK;IACrB,uBAAuB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,IAAI,SAAG,CAAC,iDAAiD,CAAC;QACrE,eAAe,EAAE,IAAI,SAAG,CAAC,0DAA0D,CAAC;KACrF;IACD,WAAW,EAAE,IAAA,8BAAoB,EAAC,gCAAgC,CAAC;IACnE,GAAG,EAAE,0FAA0F;IAC/F,KAAK,OAAA;CACE,CAAC"}

package/built/rules/execOfUntrustedCommand.js

@@ -0,0 +1,97 @@
+"use strict";
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var models_1 = require("@appland/models");
+var url_1 = require("url");
+var parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
+var precedingEvents_1 = __importDefault(require("./lib/precedingEvents"));
+var sanitizesData_1 = __importDefault(require("./lib/sanitizesData"));
+function allArgumentsSanitized(rootEvent, event) {
+    return (event.parameters || [])
+        .filter(function (parameter) { return parameter.object_id; })
+        .every(function (parameter) {
+        var e_1, _a;
+        try {
+            for (var _b = __values((0, precedingEvents_1.default)(rootEvent, event)), _c = _b.next(); !_c.done; _c = _b.next()) {
+                var candidate = _c.value;
+                if ((0, sanitizesData_1.default)(candidate.event, parameter.object_id, ExecSanitize)) {
+                    return true;
+                }
+            }
+        }
+        catch (e_1_1) { e_1 = { error: e_1_1 }; }
+        finally {
+            try {
+                if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
+            }
+            finally { if (e_1) throw e_1.error; }
+        }
+        return false;
+    });
+}
+function build() {
+    function matcher(rootEvent) {
+        var e_2, _a;
+        try {
+            for (var _b = __values(new models_1.EventNavigator(rootEvent).descendants()), _c = _b.next(); !_c.done; _c = _b.next()) {
+                var event = _c.value;
+                if (event.event.labels.has(Exec) &&
+                    !event.event.ancestors().find(function (ancestor) { return ancestor.labels.has(ExecSafe); })) {
+                    if (allArgumentsSanitized(rootEvent, event.event)) {
+                        return;
+                    }
+                    else {
+                        return [
+                            {
+                                level: 'error',
+                                event: event.event,
+                                message: event.event + " executes an untrusted command string",
+                            },
+                        ];
+                    }
+                }
+            }
+        }
+        catch (e_2_1) { e_2 = { error: e_2_1 }; }
+        finally {
+            try {
+                if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
+            }
+            finally { if (e_2) throw e_2.error; }
+        }
+    }
+    return {
+        matcher: matcher,
+    };
+}
+var Exec = 'system.exec';
+var ExecSafe = 'system.exec.safe';
+var ExecSanitize = 'system.exec.sanitize';
+exports.default = {
+    id: 'exec-of-untrusted-command',
+    title: 'Execution of untrusted system command',
+    labels: [Exec, ExecSafe, ExecSanitize],
+    impactDomain: 'Security',
+    enumerateScope: false,
+    // scope: //*[@command]
+    references: {
+        'CWE-78': new url_1.URL('https://cwe.mitre.org/data/definitions/78.html'),
+    },
+    description: (0, parseRuleDescription_1.default)('execOfUntrustedCommand'),
+    url: 'https://appland.com/docs/analysis/rules-reference.html#exec-of-untrusted-command',
+    build: build,
+};
+//# sourceMappingURL=execOfUntrustedCommand.js.map

package/built/rules/execOfUntrustedCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execOfUntrustedCommand.js","sourceRoot":"","sources":["../../src/rules/execOfUntrustedCommand.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwD;AACxD,2BAA0B;AAE1B,oFAA8D;AAC9D,0EAAoD;AACpD,sEAAgD;AAEhD,SAAS,qBAAqB,CAAC,SAAgB,EAAE,KAAY;IAC3D,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,UAAC,SAAS,IAAK,OAAA,SAAS,CAAC,SAAS,EAAnB,CAAmB,CAAC;SAC1C,KAAK,CAAC,UAAC,SAAS;;;YACf,KAAwB,IAAA,KAAA,SAAA,IAAA,yBAAe,EAAC,SAAS,EAAE,KAAK,CAAC,CAAA,gBAAA,4BAAE;gBAAtD,IAAM,SAAS,WAAA;gBAClB,IAAI,IAAA,uBAAa,EAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAU,EAAE,YAAY,CAAC,EAAE;oBACtE,OAAO,IAAI,CAAC;iBACb;aACF;;;;;;;;;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,KAAK;IACZ,SAAS,OAAO,CAAC,SAAgB;;;YAC/B,KAAoB,IAAA,KAAA,SAAA,IAAI,uBAAc,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA,gBAAA,4BAAE;gBAA5D,IAAM,KAAK,WAAA;gBACd,IACE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC5B,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAA7B,CAA6B,CAAC,EAC1E;oBACA,IAAI,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;wBACjD,OAAO;qBACR;yBAAM;wBACL,OAAO;4BACL;gCACE,KAAK,EAAE,OAAO;gCACd,KAAK,EAAE,KAAK,CAAC,KAAK;gCAClB,OAAO,EAAK,KAAK,CAAC,KAAK,0CAAuC;6BAC/D;yBACF,CAAC;qBACH;iBACF;aACF;;;;;;;;;IACH,CAAC;IAED,OAAO;QACL,OAAO,SAAA;KACR,CAAC;AACJ,CAAC;AAED,IAAM,IAAI,GAAG,aAAa,CAAC;AAC3B,IAAM,QAAQ,GAAG,kBAAkB,CAAC;AACpC,IAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C,kBAAe;IACb,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC;IACtC,YAAY,EAAE,UAAU;IACxB,cAAc,EAAE,KAAK;IACrB,uBAAuB;IACvB,UAAU,EAAE;QACV,QAAQ,EAAE,IAAI,SAAG,CAAC,gDAAgD,CAAC;KACpE;IACD,WAAW,EAAE,IAAA,8BAAoB,EAAC,wBAAwB,CAAC;IAC3D,GAAG,EAAE,kFAAkF;IACvF,KAAK,OAAA;CACE,CAAC"}

package/built/rules/lib/parseRuleDescription.js

@@ -4,13 +4,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 var fs_1 = __importDefault(require("fs"));
-var errors_1 = require("../../errors");
 var path_1 = require("path");
 function parseRuleDescription(id) {
     var content = fs_1.default.readFileSync((0, path_1.join)(__dirname, "../../../doc/rules/" + id + ".md"), 'utf-8');
-    var propertiesContent = content.match(/---\n((?:.*\n)+)---\n((?:.*\n)+?)###/);
+    var propertiesContent = content.match(/---\n((?:.*\n)+)---\n((?:.*\n)+?)##?#?/);
     if (!propertiesContent) {
-        throw new errors_1.ValidationError("Unable to read description for rule \"" + id + "\".");
+        // This is probably a new doc that doesn't have front matter yet.
+        // It's all description.
+        return content;
     }
     return propertiesContent[2].replace(/\n/g, ' ').trim();
 }

package/built/rules/lib/parseRuleDescription.js.map

@@ -1 +1 @@
-{"version":3,"file":"parseRuleDescription.js","sourceRoot":"","sources":["../../../src/rules/lib/parseRuleDescription.ts"],"names":[],"mappings":";;;;;AAAA,0CAAoB;AACpB,uCAA+C;AAC/C,6BAA4B;AAE5B,SAAwB,oBAAoB,CAAC,EAAU;IACrD,IAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,wBAAsB,EAAE,QAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IACzF,IAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAEhF,IAAI,CAAC,iBAAiB,EAAE;QACtB,MAAM,IAAI,wBAAe,CAAC,2CAAwC,EAAE,QAAI,CAAC,CAAC;KAC3E;IAED,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AATD,uCASC"}
+{"version":3,"file":"parseRuleDescription.js","sourceRoot":"","sources":["../../../src/rules/lib/parseRuleDescription.ts"],"names":[],"mappings":";;;;;AAAA,0CAAoB;AACpB,6BAA4B;AAE5B,SAAwB,oBAAoB,CAAC,EAAU;IACrD,IAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,wBAAsB,EAAE,QAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IACzF,IAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAElF,IAAI,CAAC,iBAAiB,EAAE;QACtB,iEAAiE;QACjE,wBAAwB;QACxB,OAAO,OAAO,CAAC;KAChB;IAED,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AAXD,uCAWC"}

package/built/rules/lib/precedingEvents.js

@@ -0,0 +1,80 @@
+"use strict";
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var models_1 = require("@appland/models");
+function precedingEvents(rootEvent, target) {
+    var _a, _b, event, e_1_1;
+    var e_1, _c;
+    return __generator(this, function (_d) {
+        switch (_d.label) {
+            case 0:
+                _d.trys.push([0, 5, 6, 7]);
+                _a = __values(new models_1.EventNavigator(rootEvent).descendants()), _b = _a.next();
+                _d.label = 1;
+            case 1:
+                if (!!_b.done) return [3 /*break*/, 4];
+                event = _b.value;
+                if (event.event === target) {
+                    return [3 /*break*/, 4];
+                }
+                return [4 /*yield*/, event];
+            case 2:
+                _d.sent();
+                _d.label = 3;
+            case 3:
+                _b = _a.next();
+                return [3 /*break*/, 1];
+            case 4: return [3 /*break*/, 7];
+            case 5:
+                e_1_1 = _d.sent();
+                e_1 = { error: e_1_1 };
+                return [3 /*break*/, 7];
+            case 6:
+                try {
+                    if (_b && !_b.done && (_c = _a.return)) _c.call(_a);
+                }
+                finally { if (e_1) throw e_1.error; }
+                return [7 /*endfinally*/];
+            case 7: return [2 /*return*/];
+        }
+    });
+}
+exports.default = precedingEvents;
+//# sourceMappingURL=precedingEvents.js.map

package/built/rules/lib/precedingEvents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"precedingEvents.js","sourceRoot":"","sources":["../../../src/rules/lib/precedingEvents.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0CAAwD;AAExD,SAAyB,eAAe,CACtC,SAAgB,EAChB,MAAa;;;;;;;gBAEO,KAAA,SAAA,IAAI,uBAAc,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;;;;gBAApD,KAAK;gBACd,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE;oBAC1B,wBAAM;iBACP;gBACD,qBAAM,KAAK,EAAA;;gBAAX,SAAW,CAAC;;;;;;;;;;;;;;;;;;;CAEf;AAVD,kCAUC"}

package/built/rules/lib/sanitizesData.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+function sanitizesData(event, objectId, label) {
+    return (event.labels.has(label) &&
+        !!event.returnValue &&
+        !!event.returnValue.object_id &&
+        event.returnValue.object_id === objectId);
+}
+exports.default = sanitizesData;
+//# sourceMappingURL=sanitizesData.js.map

package/built/rules/lib/sanitizesData.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizesData.js","sourceRoot":"","sources":["../../../src/rules/lib/sanitizesData.ts"],"names":[],"mappings":";;AAEA,SAAwB,aAAa,CAAC,KAAY,EAAE,QAAgB,EAAE,KAAa;IACjF,OAAO,CACL,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,WAAW;QACnB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS;QAC7B,KAAK,CAAC,WAAW,CAAC,SAAS,KAAK,QAAQ,CACzC,CAAC;AACJ,CAAC;AAPD,gCAOC"}

package/built/rules/missingAuthentication.js

@@ -10,7 +10,7 @@ var matchPattern_1 = require("./lib/matchPattern");
 var url_1 = require("url");
 var parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
 function isPublic(event) {
-    return event.labels.has(Public);
+    return event.labels.has(AccessPublic);
 }
 var authenticatedBy = function (iterator) {
     var i = iterator.next();
@@ -56,13 +56,13 @@ function build(options) {
         matcher: matcher,
     };
 }
-var Public = 'public';
+var AccessPublic = 'access.public';
 var SecurityAuthentication = 'security.authentication';
 exports.default = {
     id: 'missing-authentication',
     title: 'Unauthenticated HTTP server request',
     scope: 'http_server_request',
-    labels: [Public, SecurityAuthentication],
+    labels: [AccessPublic, SecurityAuthentication],
     impactDomain: 'Security',
     enumerateScope: false,
     references: {

package/built/rules/missingAuthentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"missingAuthentication.js","sourceRoot":"","sources":["../../src/rules/missingAuthentication.ts"],"names":[],"mappings":";;;;;AAAA,0CAAwD;AACxD,oDAA2D;AAG3D,mCAAoD;AAEpD,mDAAkD;AAClD,2BAA0B;AAC1B,oFAA8D;AAE9D,SAAS,QAAQ,CAAC,KAAY;IAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,IAAM,eAAe,GAAG,UAAC,QAAkC;IACzD,IAAI,CAAC,GAAmC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;QACd,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAA,6BAAsB,EAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,sBAAsB,CAAC,EAAE;YAC5F,OAAO,IAAI,CAAC;SACb;QACD,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;KACrB;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;IAAA;QACS,wBAAmB,GAAyB,EAAE,CAAC;QAC/C,wBAAmB,GAAyB,EAAE,CAAC;IACxD,CAAC;IAAD,cAAC;AAAD,CAAC,AAHD,IAGC;AAED,SAAS,KAAK,CAAC,OAAgC;IAAhC,wBAAA,EAAA,cAAuB,OAAO,EAAE;IAC7C,IAAM,mBAAmB,GAAG,IAAA,2BAAY,EAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtE,IAAM,mBAAmB,GAAG,IAAA,2BAAY,EAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEtE,SAAS,eAAe,CAAC,WAAmB;QAC1C,SAAS,IAAI,CAAC,MAAoB;YAChC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,CACL,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;IAED,SAAS,OAAO,CAAC,KAAY;QAC3B,OAAO,CAAC,eAAe,CAAC,IAAI,uBAAc,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,SAAS,KAAK,CAAC,CAAQ;QACrB,OAAO,CACL,CAAC,CAAC,KAAK,KAAK,SAAS;YACrB,CAAC,CAAC,kBAAkB,KAAK,SAAS;YAClC,CAAC,CAAC,kBAAkB,CAAC,MAAM,GAAG,GAAG;YACjC,CAAC,CAAC,IAAA,+BAAkB,EAAC,CAAC,CAAC;YACvB,CAAC,CAAC,IAAA,+BAAkB,EAAC,CAAC,CAAE,CAAC,WAAW;YACpC,eAAe,CAAC,IAAA,+BAAkB,EAAC,CAAC,CAAE,CAAC,WAAW,CAAC,CACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,OAAA;QACL,OAAO,SAAA;KACR,CAAC;AACJ,CAAC;AACD,IAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,IAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEzD,kBAAe;IACb,EAAE,EAAE,wBAAwB;IAC5B,KAAK,EAAE,qCAAqC;IAC5C,KAAK,EAAE,qBAAqB;IAC5B,MAAM,EAAE,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,YAAY,EAAE,UAAU;IACxB,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE;QACV,SAAS,EAAE,IAAI,SAAG,CAAC,iDAAiD,CAAC;KACtE;IACD,WAAW,EAAE,IAAA,8BAAoB,EAAC,uBAAuB,CAAC;IAC1D,GAAG,EAAE,+EAA+E;IACpF,OAAO,SAAA;IACP,KAAK,OAAA;CACE,CAAC"}
+{"version":3,"file":"missingAuthentication.js","sourceRoot":"","sources":["../../src/rules/missingAuthentication.ts"],"names":[],"mappings":";;;;;AAAA,0CAAwD;AACxD,oDAA2D;AAG3D,mCAAoD;AAEpD,mDAAkD;AAClD,2BAA0B;AAC1B,oFAA8D;AAE9D,SAAS,QAAQ,CAAC,KAAY;IAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACxC,CAAC;AAED,IAAM,eAAe,GAAG,UAAC,QAAkC;IACzD,IAAI,CAAC,GAAmC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;QACd,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAA,6BAAsB,EAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,sBAAsB,CAAC,EAAE;YAC5F,OAAO,IAAI,CAAC;SACb;QACD,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;KACrB;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;IAAA;QACS,wBAAmB,GAAyB,EAAE,CAAC;QAC/C,wBAAmB,GAAyB,EAAE,CAAC;IACxD,CAAC;IAAD,cAAC;AAAD,CAAC,AAHD,IAGC;AAED,SAAS,KAAK,CAAC,OAAgC;IAAhC,wBAAA,EAAA,cAAuB,OAAO,EAAE;IAC7C,IAAM,mBAAmB,GAAG,IAAA,2BAAY,EAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtE,IAAM,mBAAmB,GAAG,IAAA,2BAAY,EAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEtE,SAAS,eAAe,CAAC,WAAmB;QAC1C,SAAS,IAAI,CAAC,MAAoB;YAChC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,CACL,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;IAED,SAAS,OAAO,CAAC,KAAY;QAC3B,OAAO,CAAC,eAAe,CAAC,IAAI,uBAAc,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,SAAS,KAAK,CAAC,CAAQ;QACrB,OAAO,CACL,CAAC,CAAC,KAAK,KAAK,SAAS;YACrB,CAAC,CAAC,kBAAkB,KAAK,SAAS;YAClC,CAAC,CAAC,kBAAkB,CAAC,MAAM,GAAG,GAAG;YACjC,CAAC,CAAC,IAAA,+BAAkB,EAAC,CAAC,CAAC;YACvB,CAAC,CAAC,IAAA,+BAAkB,EAAC,CAAC,CAAE,CAAC,WAAW;YACpC,eAAe,CAAC,IAAA,+BAAkB,EAAC,CAAC,CAAE,CAAC,WAAW,CAAC,CACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,OAAA;QACL,OAAO,SAAA;KACR,CAAC;AACJ,CAAC;AACD,IAAM,YAAY,GAAG,eAAe,CAAC;AACrC,IAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEzD,kBAAe;IACb,EAAE,EAAE,wBAAwB;IAC5B,KAAK,EAAE,qCAAqC;IAC5C,KAAK,EAAE,qBAAqB;IAC5B,MAAM,EAAE,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,YAAY,EAAE,UAAU;IACxB,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE;QACV,SAAS,EAAE,IAAI,SAAG,CAAC,iDAAiD,CAAC;KACtE;IACD,WAAW,EAAE,IAAA,8BAAoB,EAAC,uBAAuB,CAAC;IAC1D,GAAG,EAAE,+EAA+E;IACpF,OAAO,SAAA;IACP,KAAK,OAAA;CACE,CAAC"}

package/built/sampleConfig/default.yml

@@ -1,7 +1,8 @@
 checks:
   - rule: authzBeforeAuthn
   - rule: circularDependency
-  # - rule: deserializationOfUntrustedData
+  - rule: deserializationOfUntrustedData
+  - rule: execOfUntrustedCommand
   - rule: http500
   # - rule: illegalPackageDependency
   # - rule: incompatibleHttpClientRequest

package/built/scope/commandScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandScope.js","sourceRoot":"","sources":["../../src/scope/commandScope.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0CAAwD;AAExD,kEAA4C;AAE5C;IAIE,mBAAY,KAAY;QACtB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,IAAI,uBAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAEA,0BAAM,GAAP;;;;;wBACE,qBAAM,IAAI,CAAC,KAAK,EAAA;;oBAAhB,SAAgB,CAAC;;;;oBAEG,KAAA,SAAA,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAA;;;;oBAAvC,KAAK;oBACd,qBAAM,KAAK,CAAC,KAAK,EAAA;;oBAAjB,SAAiB,CAAC;;;;;;;;;;;;;;;;;;;KAErB;IACH,gBAAC;AAAD,CAAC,AAhBD,IAgBC;AAED,4CAA4C;AAC5C,IAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,IAAM,GAAG,GAAG,KAAK,CAAC;AAElB;IAA0C,gCAAa;IAAvD;;IAeA,CAAC;IAdE,6BAAM,GAAP,UAAQ,MAAwB;;;;;;;oBACV,WAAA,SAAA,MAAM,CAAA;;;;oBAAf,KAAK;yBAEZ,CAAA,KAAK,CAAC,MAAM,EAAE;wBACd,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;4BACnC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;4BAChC,KAAK,CAAC,iBAAiB,CAAC,CAAA,EAH1B,wBAG0B;oBAE1B,qBAAM,IAAI,SAAS,CAAC,KAAK,CAAC,EAAA;;oBAA1B,SAA0B,CAAC;oBAE3B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;;;;;;;;;;;;;;;;;;;KAG9C;IACH,mBAAC;AAAD,CAAC,AAfD,CAA0C,uBAAa,GAetD"}
+{"version":3,"file":"commandScope.js","sourceRoot":"","sources":["../../src/scope/commandScope.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0CAAwD;AAExD,kEAA4C;AAE5C;IAIE,mBAAY,KAAY;QACtB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,IAAI,uBAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAEA,0BAAM,GAAP;;;;;wBACE,qBAAM,IAAI,CAAC,KAAK,EAAA;;oBAAhB,SAAgB,CAAC;;;;oBAEG,KAAA,SAAA,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAA;;;;oBAAvC,KAAK;oBACd,qBAAM,KAAK,CAAC,KAAK,EAAA;;oBAAjB,SAAiB,CAAC;;;;;;;;;;;;;;;;;;;KAErB;IACH,gBAAC;AAAD,CAAC,AAhBD,IAgBC;AAED,4CAA4C;AAC5C,IAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,IAAM,GAAG,GAAG,KAAK,CAAC;AAElB;IAA0C,gCAAa;IAAvD;;IAeA,CAAC;IAdE,6BAAM,GAAP,UAAQ,MAA+B;;;;;;;oBACjB,WAAA,SAAA,MAAM,CAAA;;;;oBAAf,KAAK;yBAEZ,CAAA,KAAK,CAAC,MAAM,EAAE;wBACd,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;4BACnC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;4BAChC,KAAK,CAAC,iBAAiB,CAAC,CAAA,EAH1B,wBAG0B;oBAE1B,qBAAM,IAAI,SAAS,CAAC,KAAK,CAAC,EAAA;;oBAA1B,SAA0B,CAAC;oBAE3B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;;;;;;;;;;;;;;;;;;;KAG9C;IACH,mBAAC;AAAD,CAAC,AAfD,CAA0C,uBAAa,GAetD"}

package/built/scope/rootScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"rootScope.js","sourceRoot":"","sources":["../../src/scope/rootScope.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,0DAAoC;AACpC,kEAA4C;AAE5C;IAAuC,6BAAa;IAApD;;IAUA,CAAC;IATE,0BAAM,GAAP,UAAQ,MAAwB;;;;;;;oBACV,WAAA,SAAA,MAAM,CAAA;;;;oBAAf,KAAK;yBACV,CAAA,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA,EAA/B,wBAA+B;oBACjC,qBAAM,IAAI,mBAAS,CAAC,KAAK,CAAC,EAAA;;oBAA1B,SAA0B,CAAC;oBAE3B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;;;;;;;;;;;;;;;;;;;KAG9C;IACH,gBAAC;AAAD,CAAC,AAVD,CAAuC,uBAAa,GAUnD"}
+{"version":3,"file":"rootScope.js","sourceRoot":"","sources":["../../src/scope/rootScope.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,0DAAoC;AACpC,kEAA4C;AAE5C;IAAuC,6BAAa;IAApD;;IAUA,CAAC;IATE,0BAAM,GAAP,UAAQ,MAA+B;;;;;;;oBACjB,WAAA,SAAA,MAAM,CAAA;;;;oBAAf,KAAK;yBACV,CAAA,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA,EAA/B,wBAA+B;oBACjC,qBAAM,IAAI,mBAAS,CAAC,KAAK,CAAC,EAAA;;oBAA1B,SAA0B,CAAC;oBAE3B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;;;;;;;;;;;;;;;;;;;KAG9C;IACH,gBAAC;AAAD,CAAC,AAVD,CAAuC,uBAAa,GAUnD"}

package/built/scope/scopeIterator.js.map

@@ -1 +1 @@
-{"version":3,"file":"scopeIterator.js","sourceRoot":"","sources":["../../src/scope/scopeIterator.ts"],"names":[],"mappings":";;AAGA;IAAA;IAeA,CAAC;IAZC,yDAAyD;IAC/C,4CAAoB,GAA9B,UAA+B,UAAiB,EAAE,MAAwB;QACxE,uGAAuG;QACvG,IAAI,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE;YACxB,IAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;YAChC,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE;gBACtD,MAAM;aACP;YACD,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;SAC7B;IACH,CAAC;IACH,oBAAC;AAAD,CAAC,AAfD,IAeC"}
+{"version":3,"file":"scopeIterator.js","sourceRoot":"","sources":["../../src/scope/scopeIterator.ts"],"names":[],"mappings":";;AAGA;IAAA;IAeA,CAAC;IAZC,yDAAyD;IAC/C,4CAAoB,GAA9B,UAA+B,UAAiB,EAAE,MAAuB;QACvE,uGAAuG;QACvG,IAAI,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE;YACxB,IAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;YAChC,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE;gBACtD,MAAM;aACP;YACD,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;SAC7B;IACH,CAAC;IACH,oBAAC;AAAD,CAAC,AAfD,IAeC"}

package/built/scope/sqlTransactionScope.js

@@ -102,7 +102,7 @@ exports.hasTransactionDetails = hasTransactionDetails;
 function iterateTransaction(begin, tail) {
     // since we can only go through the tail once,
     // we have to keep the list of events in the transaction
-    var transaction = [];
+    var transaction = [begin];
     for (var next = tail.next(); !next.done; next = tail.next()) {
         var event = next.value;
         if (!event.isCall())
@@ -114,17 +114,27 @@ function iterateTransaction(begin, tail) {
         var sql = (0, models_1.parseSQL)(event.sql.sql);
         if (!sql)
             continue;
+        // This is normally a noop which generates a SQL warning.
+        // It can also happen if there's more than one SQL connection used
+        // and the new transaction is open in a different one than before.
+        // We currently don't track the separate connections, so we have to
+        // assume this is the same one and issue a warning.
         if (isBegin(sql))
-            throw new Error('Transaction started within a transaction.');
+            console.warn("SQL transaction started within a transaction in event " + event.id);
         var end = isEnd(sql);
         if (end) {
             begin.transaction = { status: end.action, events: transaction };
             break;
         }
     }
+    if (!begin.transaction) {
+        // Transaction was still active at the end of appmap;
+        // assume it was aborted.
+        begin.transaction = { status: 'rollback', events: transaction };
+    }
     return {
         scope: begin,
-        events: transaction[Symbol.iterator],
+        events: transaction[Symbol.iterator].bind(transaction),
     };
 }
 var SQLTransactionScope = /** @class */ (function (_super) {

package/built/scope/sqlTransactionScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"sqlTransactionScope.js","sourceRoot":"","sources":["../../src/scope/sqlTransactionScope.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0CAA2C;AAI3C,kEAA4C;AAG5C,SAAS,OAAO,CAAC,GAA2B;IAC1C,QAAQ,GAAG,CAAC,OAAO,EAAE;QACnB,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,UAAC,CAAC,IAAK,OAAA,OAAO,CAAC,CAAC,CAAC,EAAV,CAAU,CAAC,CAAC;QAC/C,KAAK,aAAa;YAChB,OAAO,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC;QAChC;YACE,OAAO,KAAK,CAAC;KAChB;AACH,CAAC;AAMD,SAAS,KAAK,CAAC,GAA2B;;IACxC,QAAQ,GAAG,CAAC,OAAO,EAAE;QACnB,KAAK,MAAM;;gBACT,KAAwB,IAAA,KAAA,SAAA,GAAG,CAAC,SAAS,CAAA,gBAAA,4BAAE;oBAAlC,IAAM,SAAS,WAAA;oBAClB,IAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;oBAChC,IAAI,MAAM;wBAAE,OAAO,MAAM,CAAC;iBAC3B;;;;;;;;;YACD,OAAO,SAAS,CAAC;QACnB,KAAK,aAAa;YAChB,OAAO,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,GAA+B,CAAC;QAC/E;YACE,OAAO,SAAS,CAAC;KACpB;AACH,CAAC;AASD,SAAgB,qBAAqB,CACnC,KAA0C;IAE1C,OAAO,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;AACzC,CAAC;AAJD,sDAIC;AAED,SAAS,kBAAkB,CACzB,KAA0C,EAC1C,IAAqB;IAErB,8CAA8C;IAC9C,wDAAwD;IACxD,IAAM,WAAW,GAAY,EAAE,CAAC;IAChC,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QAC3D,IAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,SAAS;QACzB,kEAAkE;QAClE,IAAM,GAAG,GAAG,IAAA,iBAAQ,EAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/E,IAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG,EAAE;YACP,KAAK,CAAC,WAAW,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAChE,MAAM;SACP;KACF;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAA2B;KAC/D,CAAC;AACJ,CAAC;AAED;IAAiD,uCAAa;IAA9D;;IAUA,CAAC;IATE,oCAAM,GAAP,UAAQ,MAA+B;;;;;;;oBACjB,WAAA,SAAA,MAAM,CAAA;;;;oBAAf,KAAK;oBACd,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG;wBAAE,wBAAS;oBACtC,GAAG,GAAG,IAAA,iBAAQ,EAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;yBAChC,CAAA,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA,EAAlC,wBAAkC;oBACpC,qBAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAA;;oBAAvC,SAAuC,CAAC;;;;;;;;;;;;;;;;;;;KAG7C;IACH,0BAAC;AAAD,CAAC,AAVD,CAAiD,uBAAa,GAU7D"}
+{"version":3,"file":"sqlTransactionScope.js","sourceRoot":"","sources":["../../src/scope/sqlTransactionScope.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0CAA2C;AAI3C,kEAA4C;AAG5C,SAAS,OAAO,CAAC,GAA2B;IAC1C,QAAQ,GAAG,CAAC,OAAO,EAAE;QACnB,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,UAAC,CAAC,IAAK,OAAA,OAAO,CAAC,CAAC,CAAC,EAAV,CAAU,CAAC,CAAC;QAC/C,KAAK,aAAa;YAChB,OAAO,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC;QAChC;YACE,OAAO,KAAK,CAAC;KAChB;AACH,CAAC;AAMD,SAAS,KAAK,CAAC,GAA2B;;IACxC,QAAQ,GAAG,CAAC,OAAO,EAAE;QACnB,KAAK,MAAM;;gBACT,KAAwB,IAAA,KAAA,SAAA,GAAG,CAAC,SAAS,CAAA,gBAAA,4BAAE;oBAAlC,IAAM,SAAS,WAAA;oBAClB,IAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;oBAChC,IAAI,MAAM;wBAAE,OAAO,MAAM,CAAC;iBAC3B;;;;;;;;;YACD,OAAO,SAAS,CAAC;QACnB,KAAK,aAAa;YAChB,OAAO,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,GAA+B,CAAC;QAC/E;YACE,OAAO,SAAS,CAAC;KACpB;AACH,CAAC;AASD,SAAgB,qBAAqB,CACnC,KAA0C;IAE1C,OAAO,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;AACzC,CAAC;AAJD,sDAIC;AAED,SAAS,kBAAkB,CACzB,KAA0C,EAC1C,IAAqB;IAErB,8CAA8C;IAC9C,wDAAwD;IACxD,IAAM,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QAC3D,IAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,SAAS;QACzB,kEAAkE;QAClE,IAAM,GAAG,GAAG,IAAA,iBAAQ,EAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,yDAAyD;QACzD,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,mDAAmD;QACnD,IAAI,OAAO,CAAC,GAAG,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,2DAAyD,KAAK,CAAC,EAAI,CAAC,CAAC;QAEpF,IAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG,EAAE;YACP,KAAK,CAAC,WAAW,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAChE,MAAM;SACP;KACF;IAED,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;QACtB,qDAAqD;QACrD,yBAAyB;QACzB,KAAK,CAAC,WAAW,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;KACjE;IAED,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAA2B;KACjF,CAAC;AACJ,CAAC;AAED;IAAiD,uCAAa;IAA9D;;IAUA,CAAC;IATE,oCAAM,GAAP,UAAQ,MAA+B;;;;;;;oBACjB,WAAA,SAAA,MAAM,CAAA;;;;oBAAf,KAAK;oBACd,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG;wBAAE,wBAAS;oBACtC,GAAG,GAAG,IAAA,iBAAQ,EAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;yBAChC,CAAA,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA,EAAlC,wBAAkC;oBACpC,qBAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAA;;oBAAvC,SAAuC,CAAC;;;;;;;;;;;;;;;;;;;KAG7C;IACH,0BAAC;AAAD,CAAC,AAVD,CAAiD,uBAAa,GAU7D"}

package/doc/labels/{public.md → access.public.md}

@@ -1,5 +1,5 @@
 ---
-name: public
+name: access.public
 rules:
   - missing-authentication
 ---

package/doc/labels/deserialize.safe.md

@@ -4,6 +4,8 @@ rules:
   - deserialization-of-untrusted-data
 ---
 
+Indicates that a function performs deserialization safely.
+
 ## Examples
 
 - Ruby [JSON.parse](https://ruby-doc.org/stdlib-3.0.2/libdoc/json/rdoc/JSON.html#method-i-parse)

package/doc/labels/deserialize.sanitize.md

@@ -0,0 +1,22 @@
+---
+name: deserialize.sanitize
+rules:
+  - deserialization-of-untrusted-data
+---
+
+Ensures that data is safe and trusted for deserialization, transforming it if necessary, and
+returning `falsey` or raising an exception if it's impossible to make the data safe.
+
+A function with this label can be used to convert untrusted data such as direct user input or HTTP
+request parameters into trusted data.
+
+Note that this is not the same as ensuring that a parameter satisfies business logic constraints -
+such as presence or max length. It's a security check that ensures the data cannot cause harm on
+deserialization.
+
+To be considered successful, a `deserialize.sanitize` function must return a `truthy` value.
+
+## Examples
+
+- Running user-provided YAML through a "safe loader" which discards unsafe syntax such as object
+  class names.

package/doc/labels/deserialize.unsafe.md

@@ -4,6 +4,8 @@ rules:
   - deserialization-of-untrusted-data
 ---
 
+Indicates that a function does not guarantee safe deserialization.
+
 ## Examples
 
 - Ruby [YAML.unsafe_load](https://docs.ruby-lang.org/en/3.0/Psych.html#method-c-unsafe_load)

package/doc/labels/system.exec.md

@@ -0,0 +1,7 @@
+---
+name: system.exec
+rules:
+  - exec-of-untrusted-command
+---
+
+Indicates that a function performs an OS system command.

package/doc/labels/system.exec.safe.md

@@ -0,0 +1,7 @@
+---
+name: system.exec.safe
+rules:
+  - exec-of-untrusted-command
+---
+
+Indicates that a function performs an OS system command in a manner which is known to be safe.

package/doc/labels/system.exec.sanitize.md

@@ -0,0 +1,22 @@
+---
+name: system.exec.sanitize
+rules:
+  - exec-of-untrusted-command
+---
+
+Ensures that data is safe and trusted for use as a system command, transforming it if necessary, and
+returning `falsey` or raising an exception if it's impossible to make the data safe.
+
+A function with this label can be used to convert untrusted data such as direct user input or HTTP
+request parameters into trusted data.
+
+Note that this is not the same as ensuring that a parameter satisfies business logic constraints -
+such as presence or max length. It's a security check that ensures the data cannot cause harm when
+used as a system command.
+
+To be considered successful, a `system.exec.sanitize` function must return a `truthy` value.
+
+## Examples
+
+- Ensuring that a user-provided file path is a subdirectory of a known allowed directory.
+- Ensuring that a system command string does not have any potential injection or side-effects.

package/doc/rules/deserializationOfUntrustedData.md

@@ -9,7 +9,7 @@ impactDomain: Security
 labels:
   - deserialize.unsafe
   - deserialize.safe
-  - sanitize
+  - deserialize.sanitize
 ---
 
 Finds occurrances of deserialization in which the mechanism employed is known to be unsafe, and the

package/doc/rules/execOfUntrustedCommand.md

@@ -0,0 +1,16 @@
+---
+rule: exec-of-untrusted-command
+name: Exec of untrusted command
+title: Execution of untrusted system command
+references:
+  CWE-78: https://cwe.mitre.org/data/definitions/78.html
+impactDomain: Security
+labels:
+  - system.exec
+  - system.exec.safe
+  - system.exec.sanitize
+---
+
+Find occurrances of system command execution in which the command string is not guaranteed to be
+safe.
+

package/doc/rules/missingAuthentication.md

@@ -6,7 +6,7 @@ references:
   CWE-306: https://cwe.mitre.org/data/definitions/306.html
 impactDomain: Security
 labels:
-  - public
+  - access.public
   - security.authentication
 scope: http_server_request
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appland/scanner",
-  "version": "1.46.1",
+  "version": "1.47.0",
   "description": "",
   "bin": "built/cli.js",
   "files": [

package/doc/labels/sanitize.md

@@ -1,29 +0,0 @@
----
-name: sanitize
-rules:
-  - deserialization-of-untrusted-data
----
-
-Ensures that data is safe and trusted, transforming it if necessary, and returning `falsey` or
-raising an exception if it's impossible to make the data safe.
-
-A function with this label can be used to convert untrusted data such as direct user input or HTTP
-request parameters into trusted data.
-
-Note that this is not the same as ensuring that a parameter satisfies business logic constraints -
-such as presence or max length. It's a security check that ensures the data cannot cause downstream
-harm.
-
-To be considered successful, a `sanitize` function must return a `truthy` value.
-
-## Examples
-
-- Sanitizing HTML by removing all potentially harmful elements, such as script tags.
-- Ensuring that SQL queries are properly escaped.
-- Running user-provided YAML through a "safe loader" which discards unsafe syntax such as object
-  class names.
-- Ensuring that a user-provided file path is a subdirectory of a known allowed directory.
-- Ensuring that a system command string does not have any potential injection or side-effects.
-- Ruby -
-  [sanitize_filename](https://github.com/technoweenie/attachment_fu/blob/fa08cb03914b02b66853b4615cd3eca768291ca7/lib/technoweenie/attachment_fu.rb#L410)
-  in `attachment_fu`.