@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/108-sql-injection-detector.js

@@ -0,0 +1,323 @@
+/**
+ * SQL Injection Detector — static scan for raw SQL built by string
+ * interpolation or concatenation. OWASP #1. Parameterized queries are
+ * safe; a query string with `${userInput}` spliced in is not.
+ *
+ * Flagged sinks:
+ *   - Prisma:  $queryRawUnsafe(...) / $executeRawUnsafe(...) with ANY
+ *     interpolation or `+` concat. (The *Unsafe variants take a plain
+ *     string — the safe $queryRaw tagged template is parameterized and is
+ *     never flagged. So "Unsafe + dynamic" is textbook injection.)
+ *   - Generic: .query(...) / .execute(...) / .raw(...) / sequelize.query(...)
+ *     whose argument is a template literal with `${...}` OR a `+` concat,
+ *     AND references request input (req / request / .query / .params /
+ *     .body). The request-input gate keeps false positives down on the
+ *     generic sinks (a `.query()` with an interpolated constant is fine).
+ *
+ * Findings:
+ *   - 108-sql-injection   critical  code-bug-security
+ *   - 108-clean / 108-summary  info
+ *
+ * Persists `evidence/sql-injection-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+// `(?!\s*\()` keeps a request property access (`req.query.id`) a taint source while
+// excluding a same-named method call — notably the ORM `conn.query(...)` that is also the
+// SQL sink — so a constant `conn.query("SELECT 1")` is no longer flagged. Mirrors agents/112.
+const TAINT_RE = /\b(?:req|request)\b|\.(?:query|params|body)\b(?!\s*\(|\s*\?\.\s*\()/;
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+function readParens(content, openIdx) {
+    if (content[openIdx] !== '(')
+        return null;
+    let depth = 0;
+    let inString = null;
+    let escape = false;
+    for (let i = openIdx; i < content.length; i++) {
+        const ch = content[i];
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (inString) {
+            // Inside a template literal, `${` opens an expression that can contain
+            // its own parens/strings; for our depth purposes we still track the
+            // backtick boundary, and the interpolation parens net out.
+            if (ch === '\\')
+                escape = true;
+            else if (ch === inString)
+                inString = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            inString = ch;
+            continue;
+        }
+        if (ch === '(')
+            depth++;
+        else if (ch === ')') {
+            depth--;
+            if (depth === 0)
+                return { text: content.slice(openIdx, i + 1), end: i };
+        }
+    }
+    return null;
+}
+function lineOf(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+function snippetOf(content, index) {
+    const start = content.lastIndexOf('\n', index) + 1;
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    return content.slice(start, end).trim().slice(0, 160);
+}
+/** Does the call-arg text dynamically build a string (template interp or `+` concat)? */
+function isDynamicString(argText) {
+    const hasTemplateInterp = /`[^`]*\$\{/.test(argText);
+    const hasConcat = /['"`]\s*\+|\+\s*['"`]/.test(argText);
+    return hasTemplateInterp || hasConcat;
+}
+/** Index of the backtick that closes the template opened at `open`, accounting
+ *  for `${ ... }` interpolation (which may nest further templates). Runs on
+ *  masked text, so string-literal bodies are already blanked — only real
+ *  braces/backticks survive. Returns `s.length` if unterminated. */
+function templateClose(s, open) {
+    let i = open + 1;
+    while (i < s.length) {
+        const c = s[i];
+        if (c === '\\') {
+            i += 2;
+            continue;
+        }
+        if (c === '`')
+            return i;
+        if (c === '$' && s[i + 1] === '{') {
+            i += 2;
+            let depth = 1;
+            while (i < s.length && depth > 0) {
+                const d = s[i];
+                if (d === '\\')
+                    i += 2;
+                else if (d === '`')
+                    i = templateClose(s, i) + 1;
+                else if (d === '{') {
+                    depth++;
+                    i++;
+                }
+                else if (d === '}') {
+                    depth--;
+                    i++;
+                }
+                else
+                    i++;
+            }
+            continue;
+        }
+        i++;
+    }
+    return s.length;
+}
+/** Blank out `sql`-tagged template literals (`` sql`… ${x} …` ``). The `sql`
+ *  tag (Drizzle, postgres.js, @vercel/postgres, slonik, …) is the *parameterized*
+ *  query-builder API: its `${…}` interpolations become bind params / SQL
+ *  fragments, never spliced-in string text. So a `sql` template is not
+ *  injectable and must not read as a dynamic SQL string. `sql.raw(…)`, untagged
+ *  templates, and `+` concatenation are unaffected (still flagged). The `sql`
+ *  match requires a standalone identifier (so `mysql`…`` / `obj.sql`…`` are left
+ *  alone). */
+function stripSafeSqlTemplates(arg) {
+    const chars = arg.split('');
+    const tagRe = /(?:^|[^A-Za-z0-9_$.])sql\s*`/g;
+    let m;
+    while ((m = tagRe.exec(arg)) !== null) {
+        const sqlStart = m.index + m[0].indexOf('sql');
+        const backtick = m.index + m[0].length - 1;
+        const close = templateClose(arg, backtick);
+        for (let k = sqlStart; k <= close && k < chars.length; k++)
+            chars[k] = ' ';
+        tagRe.lastIndex = close + 1;
+    }
+    return chars.join('');
+}
+/** Scan a file for injectable raw-SQL sinks. */
+export function scanSqlInjection(content) {
+    const hits = [];
+    const seen = new Set();
+    // Match against code only — never against sink patterns living in comments
+    // or string/template literals. Line numbers/snippets come from the original.
+    const masked = maskNonCode(content);
+    const record = (callIdx, sink, tainted) => {
+        const line = lineOf(content, callIdx);
+        if (seen.has(line))
+            return;
+        seen.add(line);
+        hits.push({ line, sink, snippet: snippetOf(content, callIdx), tainted });
+    };
+    // Prisma $queryRawUnsafe / $executeRawUnsafe — Unsafe + any dynamic string.
+    // Request-tainted → real injection (critical); dynamic-but-untainted (e.g. a
+    // constant table name in a dev seed) → a "prefer parameterized" smell, not critical.
+    const unsafeRe = /\$(?:queryRawUnsafe|executeRawUnsafe)\s*\(/g;
+    let m;
+    while ((m = unsafeRe.exec(masked)) !== null) {
+        const paren = m.index + m[0].length - 1;
+        const args = readParens(masked, paren);
+        if (!args)
+            continue;
+        if (isDynamicString(args.text))
+            record(m.index, m[0].replace(/\s*\($/, '()'), TAINT_RE.test(args.text));
+    }
+    // Generic raw sinks — dynamic string AND request-tainted. A `sql`-tagged
+    // template arg is the parameterized API (bind params, not string-built SQL),
+    // so strip those spans before judging dynamic-ness / taint to avoid flagging
+    // safe builder calls like `db.execute(sql`create view ${v} as ${q}`)`.
+    const genericRe = /(?:\b\w+\.)?\b(?:query|execute|raw)\s*\(/g;
+    while ((m = genericRe.exec(masked)) !== null) {
+        const paren = m.index + m[0].length - 1;
+        const args = readParens(masked, paren);
+        if (!args)
+            continue;
+        const sanitized = stripSafeSqlTemplates(args.text);
+        if (isDynamicString(sanitized) && TAINT_RE.test(sanitized)) {
+            record(m.index, m[0].replace(/\s*\($/, '()').trim(), true);
+        }
+    }
+    return hits;
+}
+export class SqlInjectionDetectorAgent extends BaseAgent {
+    agentId = 108;
+    agentName = 'SQL Injection Detector';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    sourceFiles.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const allHits = [];
+        let filesScanned = 0;
+        for (const file of sourceFiles) {
+            if (isTestPath(file, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            filesScanned++;
+            const rel = relativise(file, projectRoot);
+            for (const hit of scanSqlInjection(content)) {
+                allHits.push({ ...hit, file: rel });
+            }
+        }
+        if (allHits.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'sql-injection-detector',
+                description: `Scanned ${filesScanned} non-test file(s) — no raw SQL built from interpolated/concatenated input.`,
+            });
+            this.persistAudit(projectRoot, filesScanned, allHits);
+            return findings;
+        }
+        for (const hit of allHits.slice(0, 100)) {
+            findings.push({
+                id: `${this.agentId}-sql-injection-${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`,
+                type: 'code-bug-security',
+                severity: hit.tainted ? 'critical' : 'medium',
+                agentId: this.agentId,
+                module: 'sql-injection-detector',
+                description: hit.tainted
+                    ? `Raw SQL built by string interpolation/concatenation from request input at ${hit.file}:${hit.line} (${hit.sink}) — SQL injection. Use parameterized queries (Prisma \`$queryRaw\` tagged template, or bind params / placeholders) instead of splicing values into the query string. \`${hit.snippet}\``
+                    : `Raw SQL built by string interpolation at ${hit.file}:${hit.line} (${hit.sink}) using a non-request value (e.g. a constant). Not directly injectable, but prefer the safe \`$queryRaw\` tagged template / bind params over the Unsafe API. \`${hit.snippet}\``,
+                file: hit.file,
+                line: hit.line,
+            });
+        }
+        this.persistAudit(projectRoot, filesScanned, allHits);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'sql-injection-detector',
+            description: `SQL-injection audit: ${allHits.length} injectable raw-SQL sink(s) across ${filesScanned} file(s).`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, filesScanned, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'sql-injection-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/sql-injection-audit.json',
+                description: `SQL-injection audit: ${hits.length} sink(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=108-sql-injection-detector.js.map

package/dist/agents/108-sql-injection-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"108-sql-injection-detector.js","sourceRoot":"","sources":["../../agents/108-sql-injection-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAEH,oFAAoF;AACpF,0FAA0F;AAC1F,8FAA8F;AAC9F,MAAM,QAAQ,GAAG,qEAAqE,CAAC;AAoBvF,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,OAAe;IAClD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,uEAAuE;YACvE,oEAAoE;YACpE,2DAA2D;YAC3D,IAAI,EAAE,KAAK,IAAI;gBAAE,MAAM,GAAG,IAAI,CAAC;iBAC1B,IAAI,EAAE,KAAK,QAAQ;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACxE,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO,iBAAiB,IAAI,SAAS,CAAC;AACxC,CAAC;AAED;;;oEAGoE;AACpE,SAAS,aAAa,CAAC,CAAS,EAAE,IAAY;IAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACf,IAAI,CAAC,KAAK,IAAI;oBAAE,CAAC,IAAI,CAAC,CAAC;qBAClB,IAAI,CAAC,KAAK,GAAG;oBAAE,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;qBAC3C,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,KAAK,EAAE,CAAC;oBAAC,CAAC,EAAE,CAAC;gBAAC,CAAC;qBAChC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,KAAK,EAAE,CAAC;oBAAC,CAAC,EAAE,CAAC;gBAAC,CAAC;;oBAChC,CAAC,EAAE,CAAC;YACX,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;cAOc;AACd,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,+BAA+B,CAAC;IAC9C,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QAC3E,KAAK,CAAC,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,IAAI,GAAyC,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,OAAgB,EAAQ,EAAE;QACvE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,qFAAqF;IACrF,MAAM,QAAQ,GAAG,6CAA6C,CAAC;IAC/D,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,SAAS,GAAG,2CAA2C,CAAC;IAC9D,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,eAAe,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IAC7C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,wBAAwB,CAAC;IAEpC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,wBAAwB;gBAChC,WAAW,EAAE,WAAW,YAAY,4EAA4E;aACjH,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,kBAAkB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE;gBAClF,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;gBAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,wBAAwB;gBAChC,WAAW,EAAE,GAAG,CAAC,OAAO;oBACtB,CAAC,CAAC,6EAA6E,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,0KAA0K,GAAG,CAAC,OAAO,IAAI;oBACzS,CAAC,CAAC,4CAA4C,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,kKAAkK,GAAG,CAAC,OAAO,IAAI;gBAClQ,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEtD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,wBAAwB;YAChC,WAAW,EAAE,wBAAwB,OAAO,CAAC,MAAM,sCAAsC,YAAY,WAAW;SACjH,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,YAAoB,EAAE,IAAuB;QACrF,MAAM,KAAK,GAAsB;YAC/B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,0BAA0B,CAAC,EAClD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,mCAAmC;gBACzC,WAAW,EAAE,wBAAwB,IAAI,CAAC,MAAM,mBAAmB,YAAY,UAAU;aAC1F,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/109-path-traversal-detector.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Path Traversal Detector — static scan for filesystem operations whose
+ * path is derived from request input without sanitization. An attacker
+ * sends `?file=../../etc/passwd` and `fs.readFile(req.query.file)` serves
+ * it. OWASP path traversal / local file inclusion.
+ *
+ * Flagged sinks (path argument is request-tainted):
+ *   - fs.readFile / readFileSync / createReadStream / writeFile / unlink /
+ *     rm / readdir / open  (incl. fs.promises and bare readFile imports)
+ *   - res.sendFile / res.download   (Express static file responders)
+ *
+ * "Tainted" = the path argument references req / request / .query /
+ * .params / .body. A `path.join(dir, req.params.x)` still concatenates
+ * untrusted input, so join() doesn't launder it.
+ *
+ * Suppressed when the same expression sanitizes: a `path.basename(` wrap
+ * (strips directory components) or an explicit `..` rejection
+ * (`.includes('..')` / `replace(/\.\./)`).
+ *
+ * Findings:
+ *   - 109-path-traversal   high  code-bug-security
+ *   - 109-clean / 109-summary  info
+ *
+ * Persists `evidence/path-traversal-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export interface PathTraversalHit {
+    file: string;
+    line: number;
+    sink: string;
+    snippet: string;
+}
+export interface PathTraversalAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    filesScanned: number;
+    hits: PathTraversalHit[];
+}
+/** Scan a file for request-tainted filesystem sinks. */
+export declare function scanPathTraversal(content: string): Array<Omit<PathTraversalHit, 'file'>>;
+export declare class PathTraversalDetectorAgent extends BaseAgent {
+    readonly agentId = 109;
+    readonly agentName = "Path Traversal Detector";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private persistAudit;
+}
+//# sourceMappingURL=109-path-traversal-detector.d.ts.map

package/dist/agents/109-path-traversal-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"109-path-traversal-detector.d.ts","sourceRoot":"","sources":["../../agents/109-path-traversal-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAoBzC,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,gBAAgB,EAAE,CAAC;CAC1B;AA4DD,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CA2BxF;AAED,qBAAa,0BAA2B,SAAQ,SAAS;IACvD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,6BAA6B;cAE/B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAwE7C,OAAO,CAAC,YAAY;CAyBrB"}

package/dist/agents/109-path-traversal-detector.js

@@ -0,0 +1,244 @@
+/**
+ * Path Traversal Detector — static scan for filesystem operations whose
+ * path is derived from request input without sanitization. An attacker
+ * sends `?file=../../etc/passwd` and `fs.readFile(req.query.file)` serves
+ * it. OWASP path traversal / local file inclusion.
+ *
+ * Flagged sinks (path argument is request-tainted):
+ *   - fs.readFile / readFileSync / createReadStream / writeFile / unlink /
+ *     rm / readdir / open  (incl. fs.promises and bare readFile imports)
+ *   - res.sendFile / res.download   (Express static file responders)
+ *
+ * "Tainted" = the path argument references req / request / .query /
+ * .params / .body. A `path.join(dir, req.params.x)` still concatenates
+ * untrusted input, so join() doesn't launder it.
+ *
+ * Suppressed when the same expression sanitizes: a `path.basename(` wrap
+ * (strips directory components) or an explicit `..` rejection
+ * (`.includes('..')` / `replace(/\.\./)`).
+ *
+ * Findings:
+ *   - 109-path-traversal   high  code-bug-security
+ *   - 109-clean / 109-summary  info
+ *
+ * Persists `evidence/path-traversal-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+// `(?!\s*\()` keeps a request property access (`req.query.file`) a taint source while
+// excluding a same-named method call (TypeORM `queryRunner.query(...)`), which is not
+// request input. Mirrors agents/112 REQUEST_RE.
+const TAINT_RE = /\b(?:req|request)\b|\.(?:query|params|body)\b(?!\s*\(|\s*\?\.\s*\()/;
+/** Same-expression sanitizers that defang traversal. */
+const SANITIZED_RE = /\bpath\.basename\s*\(|\.includes\s*\(\s*['"`]\.\.['"`]|\.replace\s*\(\s*\/\\?\.\\?\./;
+/** Filesystem sink calls whose first/path argument we inspect. */
+const FS_SINK_RE = /\bfs\.(?:promises\.)?(?:readFile|readFileSync|createReadStream|createWriteStream|writeFile|writeFileSync|appendFile|appendFileSync|copyFile|copyFileSync|cp|cpSync|rename|renameSync|truncate|truncateSync|unlink|unlinkSync|rm|rmSync|rmdir|rmdirSync|mkdir|mkdirSync|readdir|readdirSync|open|openSync)\s*\(|\b(?:readFile|readFileSync|createReadStream|writeFile|appendFile|copyFile|rename|unlink)\s*\(|\bres\.(?:sendFile|download)\s*\(/g;
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+function readParens(content, openIdx) {
+    if (content[openIdx] !== '(')
+        return null;
+    let depth = 0;
+    let inString = null;
+    let escape = false;
+    for (let i = openIdx; i < content.length; i++) {
+        const ch = content[i];
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (inString) {
+            if (ch === '\\')
+                escape = true;
+            else if (ch === inString)
+                inString = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            inString = ch;
+            continue;
+        }
+        if (ch === '(')
+            depth++;
+        else if (ch === ')') {
+            depth--;
+            if (depth === 0)
+                return { text: content.slice(openIdx, i + 1), end: i };
+        }
+    }
+    return null;
+}
+function lineOf(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+function snippetOf(content, index) {
+    const start = content.lastIndexOf('\n', index) + 1;
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    return content.slice(start, end).trim().slice(0, 160);
+}
+/** Scan a file for request-tainted filesystem sinks. */
+export function scanPathTraversal(content) {
+    const hits = [];
+    const seen = new Set();
+    // Match against code only — fs sinks in comments / string literals are not
+    // real. Line numbers/snippets come from the original source.
+    const masked = maskNonCode(content);
+    const re = new RegExp(FS_SINK_RE.source, 'g');
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+        const paren = m.index + m[0].length - 1;
+        const args = readParens(masked, paren);
+        if (!args)
+            continue;
+        if (!TAINT_RE.test(args.text))
+            continue;
+        const snippet = snippetOf(content, m.index);
+        // Suppress if a sanitizer appears anywhere on the statement line — the
+        // guard (`!x.includes('..')`) often sits before the sink call, outside
+        // the call args; path.basename() usually sits inside.
+        if (SANITIZED_RE.test(snippet))
+            continue;
+        const line = lineOf(content, m.index);
+        if (seen.has(line))
+            continue;
+        seen.add(line);
+        const sink = m[0].replace(/\s*\($/, '()').trim();
+        hits.push({ line, sink, snippet });
+    }
+    return hits;
+}
+export class PathTraversalDetectorAgent extends BaseAgent {
+    agentId = 109;
+    agentName = 'Path Traversal Detector';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    sourceFiles.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const allHits = [];
+        let filesScanned = 0;
+        for (const file of sourceFiles) {
+            if (isTestPath(file, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            filesScanned++;
+            const rel = relativise(file, projectRoot);
+            for (const hit of scanPathTraversal(content)) {
+                allHits.push({ ...hit, file: rel });
+            }
+        }
+        if (allHits.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'path-traversal-detector',
+                description: `Scanned ${filesScanned} non-test file(s) — no filesystem sinks fed by unsanitized request input.`,
+            });
+            this.persistAudit(projectRoot, filesScanned, allHits);
+            return findings;
+        }
+        for (const hit of allHits.slice(0, 100)) {
+            findings.push({
+                id: `${this.agentId}-path-traversal-${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`,
+                type: 'code-bug-security',
+                severity: 'high',
+                agentId: this.agentId,
+                module: 'path-traversal-detector',
+                description: `Filesystem path at ${hit.file}:${hit.line} (${hit.sink}) is derived from request input with no visible sanitization — path traversal / LFI. A \`../../\` payload can escape the intended directory. Use \`path.basename()\` on the user portion, resolve and verify the result stays within an allowed root, or map IDs to known paths. \`${hit.snippet}\``,
+                file: hit.file,
+                line: hit.line,
+            });
+        }
+        this.persistAudit(projectRoot, filesScanned, allHits);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'path-traversal-detector',
+            description: `Path-traversal audit: ${allHits.length} unsanitized filesystem sink(s) across ${filesScanned} file(s).`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, filesScanned, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'path-traversal-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/path-traversal-audit.json',
+                description: `Path-traversal audit: ${hits.length} sink(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=109-path-traversal-detector.js.map

package/dist/agents/109-path-traversal-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"109-path-traversal-detector.js","sourceRoot":"","sources":["../../agents/109-path-traversal-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAEH,sFAAsF;AACtF,sFAAsF;AACtF,gDAAgD;AAChD,MAAM,QAAQ,GAAG,qEAAqE,CAAC;AACvF,wDAAwD;AACxD,MAAM,YAAY,GAAG,sFAAsF,CAAC;AAE5G,kEAAkE;AAClE,MAAM,UAAU,GACd,ibAAib,CAAC;AAiBpb,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,OAAe;IAClD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,IAAI;gBAAE,MAAM,GAAG,IAAI,CAAC;iBAC1B,IAAI,EAAE,KAAK,QAAQ;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACxE,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAA0C,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,uEAAuE;QACvE,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,0BAA2B,SAAQ,SAAS;IAC9C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,yBAAyB,CAAC;IAErC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,yBAAyB;gBACjC,WAAW,EAAE,WAAW,YAAY,2EAA2E;aAChH,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,mBAAmB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE;gBACnF,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,yBAAyB;gBACjC,WAAW,EAAE,sBAAsB,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,sRAAsR,GAAG,CAAC,OAAO,IAAI;gBACzW,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEtD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,yBAAyB;YACjC,WAAW,EAAE,yBAAyB,OAAO,CAAC,MAAM,0CAA0C,YAAY,WAAW;SACtH,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,YAAoB,EAAE,IAAwB;QACtF,MAAM,KAAK,GAAuB;YAChC,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,2BAA2B,CAAC,EACnD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,oCAAoC;gBAC1C,WAAW,EAAE,yBAAyB,IAAI,CAAC,MAAM,mBAAmB,YAAY,UAAU;aAC3F,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}