@bryan-thompson/inspector-assessment-client 1.25.4 → 1.25.5

package/lib/services/assessment/modules/securityTests/SecurityPayloadTester.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Security Payload Tester
+ * Executes security tests with payloads against MCP tools
+ *
+ * Extracted from SecurityAssessor.ts for maintainability.
+ * Handles test execution, batching, and progress tracking.
+ */
+import { SecurityTestResult } from "../../../../lib/assessmentTypes.js";
+import { ProgressCallback } from "../../../../lib/assessment/progressTypes.js";
+import { CompatibilityCallToolResult, Tool } from "@modelcontextprotocol/sdk/types.js";
+import { SecurityPayload } from "../../../../lib/securityPatterns.js";
+/**
+ * Re-export ProgressCallback for external use
+ */
+export type TestProgressCallback = ProgressCallback;
+/**
+ * Configuration for payload testing
+ */
+export interface PayloadTestConfig {
+    enableDomainTesting?: boolean;
+    maxParallelTests?: number;
+    securityTestTimeout?: number;
+    selectedToolsForTesting?: string[];
+}
+/**
+ * Logger interface for test execution
+ */
+export interface TestLogger {
+    log: (message: string) => void;
+    logError: (message: string, error: unknown) => void;
+}
+/**
+ * Executes security tests with payloads against MCP tools
+ */
+export declare class SecurityPayloadTester {
+    private config;
+    private logger;
+    private executeWithTimeout;
+    private responseAnalyzer;
+    private payloadGenerator;
+    private sanitizationDetector;
+    private testCount;
+    constructor(config: PayloadTestConfig, logger: TestLogger, executeWithTimeout: <T>(promise: Promise<T>, timeout: number) => Promise<T>);
+    /**
+     * Run comprehensive security tests (advanced mode)
+     * Tests selected tools with ALL 23 security patterns using diverse payloads
+     */
+    runUniversalSecurityTests(tools: Tool[], callTool: (name: string, params: Record<string, unknown>) => Promise<CompatibilityCallToolResult>, onProgress?: TestProgressCallback): Promise<SecurityTestResult[]>;
+    /**
+     * Run basic security tests (fast mode)
+     * Tests only 5 critical injection patterns with 1 generic payload each
+     */
+    runBasicSecurityTests(tools: Tool[], callTool: (name: string, params: Record<string, unknown>) => Promise<CompatibilityCallToolResult>, onProgress?: TestProgressCallback): Promise<SecurityTestResult[]>;
+    /**
+     * Test tool with a specific payload
+     */
+    testPayload(tool: Tool, attackName: string, payload: SecurityPayload, callTool: (name: string, params: Record<string, unknown>) => Promise<CompatibilityCallToolResult>): Promise<SecurityTestResult>;
+    /**
+     * Extract error message from caught exception
+     */
+    private extractErrorMessage;
+    /**
+     * Sleep for specified milliseconds
+     */
+    private sleep;
+}
+//# sourceMappingURL=SecurityPayloadTester.d.ts.map

package/lib/services/assessment/modules/securityTests/SecurityPayloadTester.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityPayloadTester.d.ts","sourceRoot":"","sources":["../../../../../src/services/assessment/modules/securityTests/SecurityPayloadTester.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAGjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,2BAA2B,EAC3B,IAAI,EACL,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAGL,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAOhC;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,kBAAkB;IAR5B,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,SAAS,CAAK;gBAGZ,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,UAAU,EAClB,kBAAkB,EAAE,CAAC,CAAC,EAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,CAAC,CAAC;IAOjB;;;OAGG;IACG,yBAAyB,CAC7B,KAAK,EAAE,IAAI,EAAE,EACb,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,2BAA2B,CAAC,EACzC,UAAU,CAAC,EAAE,oBAAoB,GAChC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA2JhC;;;OAGG;IACG,qBAAqB,CACzB,KAAK,EAAE,IAAI,EAAE,EACb,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,2BAA2B,CAAC,EACzC,UAAU,CAAC,EAAE,oBAAoB,GAChC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA8IhC;;OAEG;IACG,WAAW,CACf,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,2BAA2B,CAAC,GACxC,OAAO,CAAC,kBAAkB,CAAC;IAuI9B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;OAEG;IACH,OAAO,CAAC,KAAK;CAGd"}

package/lib/services/assessment/modules/securityTests/SecurityPayloadTester.js

@@ -0,0 +1,372 @@
+/**
+ * Security Payload Tester
+ * Executes security tests with payloads against MCP tools
+ *
+ * Extracted from SecurityAssessor.ts for maintainability.
+ * Handles test execution, batching, and progress tracking.
+ */
+import { getAllAttackPatterns, getPayloadsForAttack, } from "../../../../lib/securityPatterns.js";
+import { createConcurrencyLimit } from "../../lib/concurrencyLimit.js";
+import { SecurityResponseAnalyzer } from "./SecurityResponseAnalyzer.js";
+import { SecurityPayloadGenerator } from "./SecurityPayloadGenerator.js";
+import { SanitizationDetector } from "./SanitizationDetector.js";
+import { DEFAULT_PERFORMANCE_CONFIG } from "../../config/performanceConfig.js";
+/**
+ * Executes security tests with payloads against MCP tools
+ */
+export class SecurityPayloadTester {
+    config;
+    logger;
+    executeWithTimeout;
+    responseAnalyzer;
+    payloadGenerator;
+    sanitizationDetector;
+    testCount = 0;
+    constructor(config, logger, executeWithTimeout) {
+        this.config = config;
+        this.logger = logger;
+        this.executeWithTimeout = executeWithTimeout;
+        this.responseAnalyzer = new SecurityResponseAnalyzer();
+        this.payloadGenerator = new SecurityPayloadGenerator();
+        this.sanitizationDetector = new SanitizationDetector();
+    }
+    /**
+     * Run comprehensive security tests (advanced mode)
+     * Tests selected tools with ALL 23 security patterns using diverse payloads
+     */
+    async runUniversalSecurityTests(tools, callTool, onProgress) {
+        // Check if advanced security testing is enabled
+        if (!this.config.enableDomainTesting) {
+            return this.runBasicSecurityTests(tools, callTool, onProgress);
+        }
+        const results = [];
+        const attackPatterns = getAllAttackPatterns();
+        // Parallel tool testing with concurrency limit
+        const concurrency = this.config.maxParallelTests ?? 5;
+        const limit = createConcurrencyLimit(concurrency);
+        // Progress tracking for batched events
+        // Uses centralized PerformanceConfig values (Issue #37)
+        let totalPayloads = 0;
+        for (const pattern of attackPatterns) {
+            totalPayloads += getPayloadsForAttack(pattern.attackName).length;
+        }
+        const totalEstimate = tools.length * totalPayloads;
+        let completedTests = 0;
+        let lastBatchTime = Date.now();
+        const startTime = Date.now();
+        const BATCH_INTERVAL = DEFAULT_PERFORMANCE_CONFIG.batchFlushIntervalMs;
+        const BATCH_SIZE = DEFAULT_PERFORMANCE_CONFIG.securityBatchSize;
+        let batchCount = 0;
+        const emitProgressBatch = () => {
+            if (onProgress) {
+                const event = {
+                    type: "test_batch",
+                    module: "security",
+                    completed: completedTests,
+                    total: totalEstimate,
+                    batchSize: batchCount,
+                    elapsed: Date.now() - startTime,
+                };
+                onProgress(event);
+            }
+            batchCount = 0;
+            lastBatchTime = Date.now();
+        };
+        this.logger.log(`Starting ADVANCED security assessment - testing ${tools.length} tools with ${attackPatterns.length} security patterns (~${totalEstimate} tests) [concurrency: ${concurrency}]`);
+        const allToolResults = await Promise.all(tools.map((tool) => limit(async () => {
+            const toolResults = [];
+            // Tools with no input parameters can't be exploited
+            if (!this.payloadGenerator.hasInputParameters(tool)) {
+                this.logger.log(`${tool.name} has no input parameters - adding passing results`);
+                for (const attackPattern of attackPatterns) {
+                    const payloads = getPayloadsForAttack(attackPattern.attackName);
+                    for (const payload of payloads) {
+                        toolResults.push({
+                            testName: attackPattern.attackName,
+                            description: payload.description,
+                            payload: payload.payload,
+                            riskLevel: payload.riskLevel,
+                            toolName: tool.name,
+                            vulnerable: false,
+                            evidence: "Tool has no input parameters - cannot be exploited via payload injection",
+                        });
+                    }
+                }
+                return toolResults;
+            }
+            this.logger.log(`Testing ${tool.name} with all attack patterns`);
+            for (const attackPattern of attackPatterns) {
+                const payloads = getPayloadsForAttack(attackPattern.attackName);
+                for (const payload of payloads) {
+                    this.testCount++;
+                    completedTests++;
+                    batchCount++;
+                    try {
+                        const result = await this.testPayload(tool, attackPattern.attackName, payload, callTool);
+                        toolResults.push(result);
+                        if (result.vulnerable && onProgress) {
+                            this.logger.log(`🚨 VULNERABILITY: ${tool.name} - ${attackPattern.attackName} (${payload.payloadType}: ${payload.description})`);
+                            const vulnEvent = {
+                                type: "vulnerability_found",
+                                tool: tool.name,
+                                pattern: attackPattern.attackName,
+                                confidence: result.confidence || "medium",
+                                evidence: result.evidence || "Vulnerability detected",
+                                riskLevel: payload.riskLevel,
+                                requiresReview: result.requiresManualReview || false,
+                                payload: payload.payload,
+                            };
+                            onProgress(vulnEvent);
+                        }
+                    }
+                    catch (error) {
+                        this.logger.logError(`Error testing ${tool.name} with ${attackPattern.attackName}`, error);
+                    }
+                    const timeSinceLastBatch = Date.now() - lastBatchTime;
+                    if (batchCount >= BATCH_SIZE ||
+                        timeSinceLastBatch >= BATCH_INTERVAL) {
+                        emitProgressBatch();
+                    }
+                    if (this.testCount % 5 === 0) {
+                        await this.sleep(100);
+                    }
+                }
+            }
+            return toolResults;
+        })));
+        for (const toolResults of allToolResults) {
+            results.push(...toolResults);
+        }
+        if (batchCount > 0) {
+            emitProgressBatch();
+        }
+        this.logger.log(`ADVANCED security assessment complete: ${results.length} tests executed, ${results.filter((r) => r.vulnerable).length} vulnerabilities found`);
+        return results;
+    }
+    /**
+     * Run basic security tests (fast mode)
+     * Tests only 5 critical injection patterns with 1 generic payload each
+     */
+    async runBasicSecurityTests(tools, callTool, onProgress) {
+        const results = [];
+        const criticalPatterns = [
+            "Command Injection",
+            "Calculator Injection",
+            "SQL Injection",
+            "Path Traversal",
+            "Unicode Bypass",
+        ];
+        const allPatterns = getAllAttackPatterns();
+        const basicPatterns = allPatterns.filter((p) => criticalPatterns.includes(p.attackName));
+        // Progress tracking for batched events
+        // Uses centralized PerformanceConfig values (Issue #37)
+        const totalEstimate = tools.length * basicPatterns.length;
+        let completedTests = 0;
+        let lastBatchTime = Date.now();
+        const startTime = Date.now();
+        const BATCH_INTERVAL = DEFAULT_PERFORMANCE_CONFIG.batchFlushIntervalMs;
+        const BATCH_SIZE = DEFAULT_PERFORMANCE_CONFIG.securityBatchSize;
+        let batchCount = 0;
+        const emitProgressBatch = () => {
+            if (onProgress) {
+                const event = {
+                    type: "test_batch",
+                    module: "security",
+                    completed: completedTests,
+                    total: totalEstimate,
+                    batchSize: batchCount,
+                    elapsed: Date.now() - startTime,
+                };
+                onProgress(event);
+            }
+            batchCount = 0;
+            lastBatchTime = Date.now();
+        };
+        this.logger.log(`Starting BASIC security assessment - testing ${tools.length} tools with ${basicPatterns.length} critical injection patterns (~${totalEstimate} tests)`);
+        for (const tool of tools) {
+            if (!this.payloadGenerator.hasInputParameters(tool)) {
+                this.logger.log(`${tool.name} has no input parameters - adding passing results`);
+                for (const attackPattern of basicPatterns) {
+                    const allPayloads = getPayloadsForAttack(attackPattern.attackName);
+                    const payload = allPayloads[0];
+                    if (payload) {
+                        results.push({
+                            testName: attackPattern.attackName,
+                            description: payload.description,
+                            payload: payload.payload,
+                            riskLevel: payload.riskLevel,
+                            toolName: tool.name,
+                            vulnerable: false,
+                            evidence: "Tool has no input parameters - cannot be exploited via payload injection",
+                        });
+                    }
+                }
+                continue;
+            }
+            this.logger.log(`Testing ${tool.name} with ${basicPatterns.length} critical patterns`);
+            for (const attackPattern of basicPatterns) {
+                const allPayloads = getPayloadsForAttack(attackPattern.attackName);
+                const payload = allPayloads[0];
+                if (!payload)
+                    continue;
+                this.testCount++;
+                completedTests++;
+                batchCount++;
+                try {
+                    const result = await this.testPayload(tool, attackPattern.attackName, payload, callTool);
+                    results.push(result);
+                    if (result.vulnerable && onProgress) {
+                        this.logger.log(`🚨 VULNERABILITY: ${tool.name} - ${attackPattern.attackName}`);
+                        const vulnEvent = {
+                            type: "vulnerability_found",
+                            tool: tool.name,
+                            pattern: attackPattern.attackName,
+                            confidence: result.confidence || "medium",
+                            evidence: result.evidence || "Vulnerability detected",
+                            riskLevel: payload.riskLevel,
+                            requiresReview: result.requiresManualReview || false,
+                            payload: payload.payload,
+                        };
+                        onProgress(vulnEvent);
+                    }
+                }
+                catch (error) {
+                    this.logger.logError(`Error testing ${tool.name} with ${attackPattern.attackName}`, error);
+                }
+                const timeSinceLastBatch = Date.now() - lastBatchTime;
+                if (batchCount >= BATCH_SIZE || timeSinceLastBatch >= BATCH_INTERVAL) {
+                    emitProgressBatch();
+                }
+                if (this.testCount % 5 === 0) {
+                    await this.sleep(100);
+                }
+            }
+        }
+        if (batchCount > 0) {
+            emitProgressBatch();
+        }
+        this.logger.log(`BASIC security assessment complete: ${results.length} tests executed, ${results.filter((r) => r.vulnerable).length} vulnerabilities found`);
+        return results;
+    }
+    /**
+     * Test tool with a specific payload
+     */
+    async testPayload(tool, attackName, payload, callTool) {
+        // Skip execution-based tests for API wrappers
+        if (this.payloadGenerator.isApiWrapper(tool) &&
+            this.payloadGenerator.isExecutionTest(attackName)) {
+            return {
+                testName: attackName,
+                description: payload.description,
+                payload: payload.payload,
+                riskLevel: payload.riskLevel,
+                toolName: tool.name,
+                vulnerable: false,
+                evidence: "API wrapper tool - skips execution tests (returns external data as text, does not execute it as code)",
+            };
+        }
+        try {
+            const params = this.payloadGenerator.createTestParameters(payload, tool);
+            if (Object.keys(params).length === 0) {
+                return {
+                    testName: attackName,
+                    description: payload.description,
+                    payload: payload.payload,
+                    riskLevel: payload.riskLevel,
+                    toolName: tool.name,
+                    vulnerable: false,
+                    evidence: "No compatible parameters for testing",
+                };
+            }
+            // Use config timeout or fall back to centralized PerformanceConfig (Issue #37)
+            const securityTimeout = this.config.securityTestTimeout ??
+                DEFAULT_PERFORMANCE_CONFIG.securityTestTimeoutMs;
+            const response = await this.executeWithTimeout(callTool(tool.name, params), securityTimeout);
+            // Check for connection errors FIRST
+            if (this.responseAnalyzer.isConnectionError(response)) {
+                return {
+                    testName: attackName,
+                    description: payload.description,
+                    payload: payload.payload,
+                    riskLevel: payload.riskLevel,
+                    toolName: tool.name,
+                    vulnerable: true,
+                    evidence: `CONNECTION ERROR: Test could not complete due to server/network failure`,
+                    response: this.responseAnalyzer.extractResponseContent(response),
+                    connectionError: true,
+                    errorType: this.responseAnalyzer.classifyError(response),
+                    testReliability: "failed",
+                    confidence: "high",
+                    requiresManualReview: true,
+                };
+            }
+            // Analyze with evidence-based detection
+            const { isVulnerable, evidence } = this.responseAnalyzer.analyzeResponse(response, payload, tool);
+            // Issue #56: Detect sanitization for false positive reduction
+            const responseText = this.responseAnalyzer.extractResponseContent(response);
+            const toolSanitization = this.sanitizationDetector.detect(tool);
+            const responseSanitization = this.sanitizationDetector.detectInResponse(responseText);
+            const combinedSanitization = this.sanitizationDetector.mergeResults(toolSanitization, responseSanitization);
+            // Calculate confidence with sanitization awareness
+            const confidenceResult = this.responseAnalyzer.calculateConfidence(tool, isVulnerable, evidence || "", responseText, payload, combinedSanitization);
+            return {
+                testName: attackName,
+                description: payload.description,
+                payload: payload.payload,
+                riskLevel: payload.riskLevel,
+                toolName: tool.name,
+                vulnerable: isVulnerable,
+                evidence,
+                response: responseText,
+                // Issue #56: Include sanitization info for transparency
+                sanitizationDetected: combinedSanitization.detected,
+                sanitizationLibraries: combinedSanitization.libraries,
+                ...confidenceResult,
+            };
+        }
+        catch (error) {
+            // Check if error is a connection/server failure
+            if (this.responseAnalyzer.isConnectionErrorFromException(error)) {
+                return {
+                    testName: attackName,
+                    description: payload.description,
+                    payload: payload.payload,
+                    riskLevel: payload.riskLevel,
+                    toolName: tool.name,
+                    vulnerable: false,
+                    evidence: `CONNECTION ERROR: Test could not complete due to server/network failure`,
+                    response: this.extractErrorMessage(error),
+                    connectionError: true,
+                    errorType: this.responseAnalyzer.classifyErrorFromException(error),
+                    testReliability: "failed",
+                    confidence: "high",
+                    requiresManualReview: true,
+                };
+            }
+            return {
+                testName: attackName,
+                description: payload.description,
+                payload: payload.payload,
+                riskLevel: payload.riskLevel,
+                toolName: tool.name,
+                vulnerable: false,
+                evidence: `Tool rejected input: ${this.extractErrorMessage(error)}`,
+            };
+        }
+    }
+    /**
+     * Extract error message from caught exception
+     */
+    extractErrorMessage(error) {
+        if (error instanceof Error) {
+            return error.message;
+        }
+        return String(error);
+    }
+    /**
+     * Sleep for specified milliseconds
+     */
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+}

package/lib/services/assessment/modules/securityTests/SecurityResponseAnalyzer.d.ts

@@ -0,0 +1,178 @@
+/**
+ * Security Response Analyzer
+ * Analyzes tool responses for evidence-based vulnerability detection
+ *
+ * Extracted from SecurityAssessor.ts for maintainability.
+ * Handles response analysis, reflection detection, and confidence calculation.
+ */
+import { CompatibilityCallToolResult, Tool } from "@modelcontextprotocol/sdk/types.js";
+import { SecurityPayload } from "../../../../lib/securityPatterns.js";
+import type { SanitizationDetectionResult } from "./SanitizationDetector.js";
+/**
+ * Result of confidence calculation
+ */
+export interface ConfidenceResult {
+    confidence: "high" | "medium" | "low";
+    requiresManualReview: boolean;
+    manualReviewReason?: string;
+    reviewGuidance?: string;
+}
+/**
+ * Result of response analysis
+ */
+export interface AnalysisResult {
+    isVulnerable: boolean;
+    evidence?: string;
+}
+/**
+ * Result of computed math analysis with confidence level (Issue #58)
+ */
+export interface MathResultAnalysis {
+    isComputed: boolean;
+    confidence: "high" | "medium" | "low";
+    reason?: string;
+}
+/**
+ * Error classification types
+ */
+export type ErrorClassification = "connection" | "server" | "protocol";
+/**
+ * Analyzes tool responses for security vulnerabilities
+ * Distinguishes between safe reflection and actual execution
+ */
+export declare class SecurityResponseAnalyzer {
+    /**
+     * Analyze response with evidence-based detection
+     * CRITICAL: Distinguish between safe reflection and actual execution
+     *
+     * Refactored to reduce cyclomatic complexity (Issue #36).
+     * Detection flow: Error checks → Tool behavior → Evidence matching
+     */
+    analyzeResponse(response: CompatibilityCallToolResult, payload: SecurityPayload, tool: Tool): AnalysisResult;
+    /**
+     * Check for safe error responses that indicate proper input rejection
+     * Handles: MCP validation errors (-32602), HTTP 4xx/5xx errors
+     */
+    private checkSafeErrorResponses;
+    /**
+     * Check for safe tool behavior patterns
+     * Handles: Tool categories, reflection, computed math, validation rejection
+     */
+    private checkSafeToolBehavior;
+    /**
+     * Check for vulnerability evidence in response
+     * Handles: Evidence pattern matching, fallback injection analysis
+     */
+    private checkVulnerabilityEvidence;
+    /**
+     * Check if tool explicitly rejected input with validation error (SAFE)
+     */
+    isValidationRejection(response: CompatibilityCallToolResult): boolean;
+    /**
+     * Check if response is an MCP validation error (safe rejection)
+     */
+    isMCPValidationError(errorInfo: {
+        code?: string | number;
+        message?: string;
+    }, responseText: string): boolean;
+    /**
+     * Check if response is an HTTP error (Issue #26)
+     */
+    isHttpErrorResponse(responseText: string): boolean;
+    /**
+     * Check if evidence pattern is ambiguous
+     */
+    isValidationPattern(evidencePattern: RegExp): boolean;
+    /**
+     * Check if response contains evidence of actual execution
+     */
+    hasExecutionEvidence(responseText: string): boolean;
+    /**
+     * Check if a math expression payload was computed (execution evidence)
+     */
+    isComputedMathResult(payload: string, responseText: string): boolean;
+    /**
+     * Check if numeric value appears in structured data context (not as computation result)
+     * Distinguishes {"records": 4} from computed "4" (Issue #58)
+     *
+     * @param result The computed numeric result to check for
+     * @param responseText The response text to analyze
+     * @returns true if the number appears to be coincidental data, not a computed result
+     */
+    isCoincidentalNumericInStructuredData(result: number, responseText: string): boolean;
+    /**
+     * Enhanced computed math result analysis with tool context (Issue #58)
+     *
+     * Returns a confidence level indicating how likely this is a real Calculator Injection:
+     * - high: Strong evidence of computation (should flag as vulnerable)
+     * - medium: Ambiguous (excluded from vulnerability count per user decision)
+     * - low: Likely coincidental data (excluded from vulnerability count)
+     */
+    analyzeComputedMathResult(payload: string, responseText: string, tool?: Tool): MathResultAnalysis;
+    /**
+     * Check if response indicates connection/server failure
+     */
+    isConnectionError(response: CompatibilityCallToolResult): boolean;
+    /**
+     * Check if caught exception indicates connection/server failure
+     */
+    isConnectionErrorFromException(error: unknown): boolean;
+    /**
+     * Classify error type for reporting
+     */
+    classifyError(response: CompatibilityCallToolResult): ErrorClassification;
+    /**
+     * Classify error type from caught exception
+     */
+    classifyErrorFromException(error: unknown): ErrorClassification;
+    /**
+     * Check if response is just reflection (safe)
+     * Two-layer defense: Match reflection patterns, verify NO execution evidence
+     */
+    isReflectionResponse(responseText: string): boolean;
+    /**
+     * Detect execution artifacts in response
+     */
+    detectExecutionArtifacts(responseText: string): boolean;
+    /**
+     * Check if response contains echoed injection payload patterns
+     */
+    containsEchoedInjectionPayload(responseText: string): boolean;
+    /**
+     * Analyze injection response (fallback logic)
+     */
+    analyzeInjectionResponse(response: CompatibilityCallToolResult, _payload: string): AnalysisResult;
+    /**
+     * Calculate confidence level and manual review requirements
+     *
+     * @param tool - The tool being tested
+     * @param isVulnerable - Whether the tool was flagged as vulnerable
+     * @param evidence - Evidence string from vulnerability detection
+     * @param responseText - The response text from the tool
+     * @param payload - The security payload used for testing
+     * @param sanitizationResult - Optional sanitization detection result (Issue #56)
+     * @returns Confidence result with manual review requirements
+     */
+    calculateConfidence(tool: Tool, isVulnerable: boolean, evidence: string, responseText: string, payload: SecurityPayload, sanitizationResult?: SanitizationDetectionResult): ConfidenceResult;
+    /**
+     * Check if tool is a structured data tool
+     */
+    isStructuredDataTool(toolName: string, toolDescription: string): boolean;
+    /**
+     * Check if response is returning search results
+     */
+    isSearchResultResponse(responseText: string): boolean;
+    /**
+     * Check if response is from a creation/modification operation
+     */
+    isCreationResponse(responseText: string): boolean;
+    /**
+     * Extract response content
+     */
+    extractResponseContent(response: CompatibilityCallToolResult): string;
+    /**
+     * Extract error info from response
+     */
+    private extractErrorInfo;
+}
+//# sourceMappingURL=SecurityResponseAnalyzer.d.ts.map

package/lib/services/assessment/modules/securityTests/SecurityResponseAnalyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityResponseAnalyzer.d.ts","sourceRoot":"","sources":["../../../../../src/services/assessment/modules/securityTests/SecurityResponseAnalyzer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,2BAA2B,EAC3B,IAAI,EACL,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEvE;;;GAGG;AACH,qBAAa,wBAAwB;IACnC;;;;;;OAMG;IACH,eAAe,CACb,QAAQ,EAAE,2BAA2B,EACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,IAAI,GACT,cAAc;IAqBjB;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IA2B/B;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAkF7B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAuClC;;OAEG;IACH,qBAAqB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO;IA2DrE;;OAEG;IACH,oBAAoB,CAClB,SAAS,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EACvD,YAAY,EAAE,MAAM,GACnB,OAAO;IA6BV;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAiBlD;;OAEG;IACH,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAqBrD;;OAEG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IA6BnD;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IAiFpE;;;;;;;OAOG;IACH,qCAAqC,CACnC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO;IAwFV;;;;;;;OAOG;IACH,yBAAyB,CACvB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,IAAI,GACV,kBAAkB;IAoMrB;;OAEG;IACH,iBAAiB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO;IA4CjE;;OAEG;IACH,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IA8CvD;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,2BAA2B,GAAG,mBAAmB;IA0BzE;;OAEG;IACH,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB;IA2B/D;;;OAGG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IA+KnD;;OAEG;IACH,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAuCvD;;OAEG;IACH,8BAA8B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAgB7D;;OAEG;IACH,wBAAwB,CACtB,QAAQ,EAAE,2BAA2B,EACrC,QAAQ,EAAE,MAAM,GACf,cAAc;IAyBjB;;;;;;;;;;OAUG;IACH,mBAAmB,CACjB,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,OAAO,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,EACxB,kBAAkB,CAAC,EAAE,2BAA2B,GAC/C,gBAAgB;IA4JnB;;OAEG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO;IAmBxE;;OAEG;IACH,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAiBrD;;OAEG;IACH,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAoBjD;;OAEG;IACH,sBAAsB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM;IAWrE;;OAEG;IACH,OAAO,CAAC,gBAAgB;CAwBzB"}