@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/107-open-redirect-detector.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Open-Redirect Detector — static scan for redirects whose target is
+ * derived from request input without validation. An attacker crafts
+ * `?next=https://evil.example` and your `res.redirect(req.query.next)`
+ * bounces the victim (or their OAuth token) to a site they control.
+ * OWASP "Unvalidated Redirects and Forwards".
+ *
+ * Detected sinks:
+ *   - res.redirect(<tainted>)              (Express / NestJS)
+ *   - redirect(<tainted>)                  (Next.js server actions / RR)
+ *   - res.setHeader('Location', <tainted>) / writeHead(302, { Location })
+ *   - ctx.redirect(<tainted>)              (Koa)
+ *
+ * "Tainted" = the redirect argument references request-controlled input:
+ * `req.` / `request.` / a `.query` / `.params` / `.body` member access.
+ *
+ * To cut false positives, a redirect whose argument is checked against an
+ * allowlist on the SAME line/expression (startsWith('/'), an includes()
+ * guard, a leading-slash-only literal) is not flagged.
+ *
+ * Findings:
+ *   - 107-open-redirect   high  code-bug-security
+ *   - 107-clean / 107-summary  info
+ *
+ * Persists `evidence/open-redirect-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export interface OpenRedirectHit {
+    file: string;
+    line: number;
+    sink: string;
+    snippet: string;
+}
+export interface OpenRedirectAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    filesScanned: number;
+    hits: OpenRedirectHit[];
+}
+/** Scan a file for redirect sinks fed by request-controlled input. */
+export declare function scanOpenRedirect(content: string): Array<Omit<OpenRedirectHit, 'file'>>;
+export declare class OpenRedirectDetectorAgent extends BaseAgent {
+    readonly agentId = 107;
+    readonly agentName = "Open-Redirect Detector";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private persistAudit;
+}
+//# sourceMappingURL=107-open-redirect-detector.d.ts.map

package/dist/agents/107-open-redirect-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"107-open-redirect-detector.d.ts","sourceRoot":"","sources":["../../agents/107-open-redirect-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAwBzC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,eAAe,EAAE,CAAC;CACzB;AA4DD,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAuCtF;AAED,qBAAa,yBAA0B,SAAQ,SAAS;IACtD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,4BAA4B;cAE9B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAwE7C,OAAO,CAAC,YAAY;CAyBrB"}

package/dist/agents/107-open-redirect-detector.js

@@ -0,0 +1,263 @@
+/**
+ * Open-Redirect Detector — static scan for redirects whose target is
+ * derived from request input without validation. An attacker crafts
+ * `?next=https://evil.example` and your `res.redirect(req.query.next)`
+ * bounces the victim (or their OAuth token) to a site they control.
+ * OWASP "Unvalidated Redirects and Forwards".
+ *
+ * Detected sinks:
+ *   - res.redirect(<tainted>)              (Express / NestJS)
+ *   - redirect(<tainted>)                  (Next.js server actions / RR)
+ *   - res.setHeader('Location', <tainted>) / writeHead(302, { Location })
+ *   - ctx.redirect(<tainted>)              (Koa)
+ *
+ * "Tainted" = the redirect argument references request-controlled input:
+ * `req.` / `request.` / a `.query` / `.params` / `.body` member access.
+ *
+ * To cut false positives, a redirect whose argument is checked against an
+ * allowlist on the SAME line/expression (startsWith('/'), an includes()
+ * guard, a leading-slash-only literal) is not flagged.
+ *
+ * Findings:
+ *   - 107-open-redirect   high  code-bug-security
+ *   - 107-clean / 107-summary  info
+ *
+ * Persists `evidence/open-redirect-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+/** Request-controlled input references inside a redirect target. */
+// `(?!\s*\()` on the `.query|params|body` accessor excludes same-named method calls
+// (TypeORM `queryRunner.query(...)`) from being treated as request input. Mirrors agents/112.
+const TAINT_RE = /\b(?:req|request)\b|\.(?:query|params|body)\b(?!\s*\(|\s*\?\.\s*\()|\bquery\.[A-Za-z_$]|\bparams\.[A-Za-z_$]|\bbody\.[A-Za-z_$]|\b(?:nextUrl|searchParams)\b/;
+/** Same-line guards that suggest the target is validated → suppress. */
+const GUARD_RE = /startsWith\s*\(\s*['"`]\//;
+/**
+ * The redirect target is a literal relative path → same-origin, can't be
+ * navigated off-site, so interpolated request input can't make it an open
+ * redirect. Covers both the direct form `redirect(`/${x}/bar`)` and the Next.js
+ * `redirect(new URL(`/login`, req.url))` idiom (where req.url is only the base).
+ * Protocol-relative "//host" is excluded — the browser treats it as absolute.
+ */
+const RELATIVE_PATH_RE = /^[\s(]*(?:new\s+URL\s*\(\s*)?['"`]\/(?!\/)/;
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+function readParens(content, openIdx) {
+    if (content[openIdx] !== '(')
+        return null;
+    let depth = 0;
+    let inString = null;
+    let escape = false;
+    for (let i = openIdx; i < content.length; i++) {
+        const ch = content[i];
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (inString) {
+            if (ch === '\\')
+                escape = true;
+            else if (ch === inString)
+                inString = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            inString = ch;
+            continue;
+        }
+        if (ch === '(')
+            depth++;
+        else if (ch === ')') {
+            depth--;
+            if (depth === 0)
+                return { text: content.slice(openIdx, i + 1), end: i };
+        }
+    }
+    return null;
+}
+function lineOf(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+function snippetOf(content, index) {
+    const start = content.lastIndexOf('\n', index) + 1;
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    return content.slice(start, end).trim().slice(0, 160);
+}
+/** Scan a file for redirect sinks fed by request-controlled input. */
+export function scanOpenRedirect(content) {
+    const hits = [];
+    const seen = new Set();
+    // Strip comments so sink patterns in doc examples don't fire. Strings are
+    // kept intact because the `setHeader('Location', …)` sink keys off the
+    // literal header name. Line numbers/snippets come from the original source.
+    const masked = maskNonCode(content, { maskStrings: false });
+    const pushIfTainted = (argText, callIdx, sink) => {
+        if (!TAINT_RE.test(argText))
+            return;
+        if (GUARD_RE.test(argText))
+            return; // validated against a leading-slash allowlist
+        if (RELATIVE_PATH_RE.test(argText))
+            return; // literal relative path → same-origin, safe
+        const line = lineOf(content, callIdx);
+        if (seen.has(line))
+            return;
+        seen.add(line);
+        hits.push({ line, sink, snippet: snippetOf(content, callIdx) });
+    };
+    // .redirect( ... )  — res.redirect / ctx.redirect / bare redirect(
+    const redirectRe = /(?:\b\w+\.)?\bredirect\s*\(/g;
+    let m;
+    while ((m = redirectRe.exec(masked)) !== null) {
+        const paren = m.index + m[0].length - 1;
+        const args = readParens(masked, paren);
+        if (!args)
+            continue;
+        pushIfTainted(args.text, m.index, 'redirect()');
+    }
+    // setHeader('Location', <tainted>)
+    const locationRe = /setHeader\s*\(\s*['"`]location['"`]\s*,/gi;
+    while ((m = locationRe.exec(masked)) !== null) {
+        // grab the rest of the call args
+        const paren = masked.lastIndexOf('(', m.index + m[0].length - 1);
+        const args = readParens(masked, paren);
+        if (!args)
+            continue;
+        pushIfTainted(args.text, m.index, "setHeader('Location')");
+    }
+    return hits;
+}
+export class OpenRedirectDetectorAgent extends BaseAgent {
+    agentId = 107;
+    agentName = 'Open-Redirect Detector';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    sourceFiles.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const allHits = [];
+        let filesScanned = 0;
+        for (const file of sourceFiles) {
+            if (isTestPath(file, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            filesScanned++;
+            const rel = relativise(file, projectRoot);
+            for (const hit of scanOpenRedirect(content)) {
+                allHits.push({ ...hit, file: rel });
+            }
+        }
+        if (allHits.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'open-redirect-detector',
+                description: `Scanned ${filesScanned} non-test file(s) — no redirects fed by unvalidated request input.`,
+            });
+            this.persistAudit(projectRoot, filesScanned, allHits);
+            return findings;
+        }
+        for (const hit of allHits.slice(0, 100)) {
+            findings.push({
+                id: `${this.agentId}-open-redirect-${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`,
+                type: 'code-bug-security',
+                severity: 'high',
+                agentId: this.agentId,
+                module: 'open-redirect-detector',
+                description: `Redirect target at ${hit.file}:${hit.line} (${hit.sink}) is derived from request input with no visible allowlist — open redirect. An attacker can craft a link that bounces the victim (and any token on the redirect) to a site they control. Validate against an allowlist or only permit same-origin / leading-slash paths. \`${hit.snippet}\``,
+                file: hit.file,
+                line: hit.line,
+            });
+        }
+        this.persistAudit(projectRoot, filesScanned, allHits);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'open-redirect-detector',
+            description: `Open-redirect audit: ${allHits.length} unvalidated redirect sink(s) across ${filesScanned} file(s).`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, filesScanned, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'open-redirect-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/open-redirect-audit.json',
+                description: `Open-redirect audit: ${hits.length} sink(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=107-open-redirect-detector.js.map

package/dist/agents/107-open-redirect-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"107-open-redirect-detector.js","sourceRoot":"","sources":["../../agents/107-open-redirect-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAEH,oEAAoE;AACpE,oFAAoF;AACpF,8FAA8F;AAC9F,MAAM,QAAQ,GAAG,8JAA8J,CAAC;AAChL,wEAAwE;AACxE,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAC7C;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,4CAA4C,CAAC;AAiBtE,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,OAAe;IAClD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,IAAI;gBAAE,MAAM,GAAG,IAAI,CAAC;iBAC1B,IAAI,EAAE,KAAK,QAAQ;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACxE,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,IAAI,GAAyC,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,IAAY,EAAQ,EAAE;QAC7E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QACpC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,8CAA8C;QAClF,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,4CAA4C;QACxF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC;IAEF,mEAAmE;IACnE,MAAM,UAAU,GAAG,8BAA8B,CAAC;IAClD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,mCAAmC;IACnC,MAAM,UAAU,GAAG,2CAA2C,CAAC;IAC/D,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,iCAAiC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IAC7C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,wBAAwB,CAAC;IAEpC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,wBAAwB;gBAChC,WAAW,EAAE,WAAW,YAAY,oEAAoE;aACzG,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,kBAAkB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE;gBAClF,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,wBAAwB;gBAChC,WAAW,EAAE,sBAAsB,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,6QAA6Q,GAAG,CAAC,OAAO,IAAI;gBAChW,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEtD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,wBAAwB;YAChC,WAAW,EAAE,wBAAwB,OAAO,CAAC,MAAM,wCAAwC,YAAY,WAAW;SACnH,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,YAAoB,EAAE,IAAuB;QACrF,MAAM,KAAK,GAAsB;YAC/B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,0BAA0B,CAAC,EAClD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,mCAAmC;gBACzC,WAAW,EAAE,wBAAwB,IAAI,CAAC,MAAM,mBAAmB,YAAY,UAAU;aAC1F,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/108-sql-injection-detector.d.ts

@@ -0,0 +1,51 @@
+/**
+ * SQL Injection Detector — static scan for raw SQL built by string
+ * interpolation or concatenation. OWASP #1. Parameterized queries are
+ * safe; a query string with `${userInput}` spliced in is not.
+ *
+ * Flagged sinks:
+ *   - Prisma:  $queryRawUnsafe(...) / $executeRawUnsafe(...) with ANY
+ *     interpolation or `+` concat. (The *Unsafe variants take a plain
+ *     string — the safe $queryRaw tagged template is parameterized and is
+ *     never flagged. So "Unsafe + dynamic" is textbook injection.)
+ *   - Generic: .query(...) / .execute(...) / .raw(...) / sequelize.query(...)
+ *     whose argument is a template literal with `${...}` OR a `+` concat,
+ *     AND references request input (req / request / .query / .params /
+ *     .body). The request-input gate keeps false positives down on the
+ *     generic sinks (a `.query()` with an interpolated constant is fine).
+ *
+ * Findings:
+ *   - 108-sql-injection   critical  code-bug-security
+ *   - 108-clean / 108-summary  info
+ *
+ * Persists `evidence/sql-injection-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export interface SqlInjectionHit {
+    file: string;
+    line: number;
+    sink: string;
+    snippet: string;
+    /** True when the interpolated value is request-derived (a real injection);
+     *  false for dynamic-but-not-tainted input (e.g. a constant table name). */
+    tainted: boolean;
+}
+export interface SqlInjectionAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    filesScanned: number;
+    hits: SqlInjectionHit[];
+}
+/** Scan a file for injectable raw-SQL sinks. */
+export declare function scanSqlInjection(content: string): Array<Omit<SqlInjectionHit, 'file'>>;
+export declare class SqlInjectionDetectorAgent extends BaseAgent {
+    readonly agentId = 108;
+    readonly agentName = "SQL Injection Detector";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private persistAudit;
+}
+//# sourceMappingURL=108-sql-injection-detector.d.ts.map

package/dist/agents/108-sql-injection-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"108-sql-injection-detector.d.ts","sourceRoot":"","sources":["../../agents/108-sql-injection-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAczC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;gFAC4E;IAC5E,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,eAAe,EAAE,CAAC;CACzB;AAwHD,gDAAgD;AAChD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CA0CtF;AAED,qBAAa,yBAA0B,SAAQ,SAAS;IACtD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,4BAA4B;cAE9B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IA0E7C,OAAO,CAAC,YAAY;CAyBrB"}