@datahogo/core 0.1.0

package/dist/scanning/agents/csharp-agent.js

@@ -0,0 +1,592 @@
+// C# / .NET ecosystem security scanner agent.
+// Detects .NET projects (.csproj, .fsproj, .sln) and scans for 13 security
+// vulnerabilities spanning hardcoded secrets, injection flaws, insecure
+// deserialization, missing authorization, weak cryptography, and more.
+export class CSharpScanAgent {
+    async detect(files) {
+        for (const filePath of files.keys()) {
+            if (filePath.endsWith(".csproj") ||
+                filePath.endsWith(".fsproj") ||
+                filePath.endsWith(".sln")) {
+                return true;
+            }
+        }
+        return false;
+    }
+    async scan(files) {
+        const results = [];
+        // Collect all file contents for project-level detection.
+        const allContent = Array.from(files.values()).join("\n");
+        // Detect project-level auth middleware (UseAuthorization / AddAuthorization).
+        // When present, missing-[Authorize] findings become low confidence because
+        // global or policy-based auth may be in effect.
+        const hasGlobalAuth = /(?:AddAuthorization|UseAuthorization)\s*\(/.test(allContent) ||
+            /AddAuthentication\s*\(/.test(allContent) ||
+            /UseAuthentication\s*\(/.test(allContent);
+        // Detect project-level rate limiting middleware.
+        const hasRateLimiter = /(?:AddRateLimiter|UseRateLimiter)\s*\(/.test(allContent);
+        for (const [filePath, content] of files) {
+            if (isCSharpFile(filePath)) {
+                results.push(...checkMissingAuthorize(filePath, content, hasGlobalAuth));
+                results.push(...checkSqlInjection(filePath, content));
+                results.push(...checkCorsWildcard(filePath, content));
+                results.push(...checkUnsafeDeserialization(filePath, content));
+                results.push(...checkXxeVulnerability(filePath, content));
+                results.push(...checkPathTraversal(filePath, content));
+                results.push(...checkHardcodedConnectionStrings(filePath, content));
+                results.push(...checkDeveloperExceptionPage(filePath, content));
+                results.push(...checkCommandInjection(filePath, content));
+                results.push(...checkWeakHashAlgorithm(filePath, content));
+                results.push(...checkMissingAntiForgeryToken(filePath, content));
+                results.push(...checkAllowAnonymousOnSensitiveController(filePath, content));
+            }
+            if (isConfigFile(filePath)) {
+                results.push(...checkSecretsInAppSettings(filePath, content));
+            }
+        }
+        // Suppress or downgrade rate-limit-related findings if global rate limiting is
+        // detected at the project level (placeholder for future rate-limit check).
+        void hasRateLimiter;
+        return results;
+    }
+    getMetadata() {
+        return {
+            name: "csharp-agent",
+            version: "1.0.0",
+            technologies: ["dotnet"],
+        };
+    }
+    getChecks() {
+        return [
+            {
+                id: "csharp:secrets-in-appsettings",
+                name: "Secret hardcoded in appsettings.json",
+                severity: "CRITICAL",
+            },
+            {
+                id: "csharp:missing-authorize",
+                name: "Mutating HTTP endpoint missing [Authorize] attribute",
+                severity: "MEDIUM",
+            },
+            {
+                id: "csharp:sql-injection",
+                name: "SQL injection via string concatenation or interpolation",
+                severity: "CRITICAL",
+            },
+            {
+                id: "csharp:cors-wildcard",
+                name: "CORS configured to allow any origin",
+                severity: "MEDIUM",
+            },
+            {
+                id: "csharp:unsafe-deserialization",
+                name: "Unsafe deserialization via BinaryFormatter",
+                severity: "CRITICAL",
+            },
+            {
+                id: "csharp:xxe-vulnerability",
+                name: "XXE vulnerability: XML parsed without DTD restrictions",
+                severity: "HIGH",
+            },
+            {
+                id: "csharp:path-traversal",
+                name: "Potential path traversal via user-controlled path",
+                severity: "HIGH",
+            },
+            {
+                id: "csharp:hardcoded-connection-string",
+                name: "Hardcoded connection string in source code",
+                severity: "HIGH",
+            },
+            {
+                id: "csharp:developer-exception-page",
+                name: "Developer exception page enabled without environment check",
+                severity: "HIGH",
+            },
+            {
+                id: "csharp:command-injection",
+                name: "Command injection via Process.Start with dynamic input",
+                severity: "CRITICAL",
+            },
+            {
+                id: "csharp:weak-hash-algorithm",
+                name: "Weak hash algorithm: MD5 or SHA-1",
+                severity: "HIGH",
+            },
+            {
+                id: "csharp:missing-antiforgery-token",
+                name: "POST action missing [ValidateAntiForgeryToken]",
+                severity: "MEDIUM",
+            },
+            {
+                id: "csharp:allow-anonymous-sensitive",
+                name: "[AllowAnonymous] on sensitive controller or action",
+                severity: "HIGH",
+            },
+        ];
+    }
+}
+// --- Helper predicates ---
+/** Returns true if the file is a C# source file. */
+export function isCSharpFile(path) {
+    return path.endsWith(".cs");
+}
+/** Returns true if the file matches the appsettings*.json pattern. */
+export function isConfigFile(path) {
+    const filename = path.split("/").pop() ?? path;
+    return /^appsettings.*\.json$/.test(filename);
+}
+// --- Check 1: Secrets in appsettings*.json (CWE-798) ---
+// Values that look like placeholders and should not be flagged.
+const PLACEHOLDER_PATTERN = /^(?:your[-_]|change[-_]|todo|example|placeholder|\$\{)/i;
+function checkSecretsInAppSettings(filePath, content) {
+    const results = [];
+    // Match sensitive JSON key names with non-placeholder string values.
+    // The character class excludes the literal dollar sign so that ${VAR} substitution
+    // references (which start with $) are excluded at the regex level.
+    const pattern = /"(?:ConnectionString|Password|Secret|ApiKey|Token|PrivateKey)"\s*:\s*"([^"$]{4,})"/gi;
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Reset lastIndex since we reuse the regex across iterations.
+        pattern.lastIndex = 0;
+        const match = pattern.exec(line);
+        if (!match)
+            continue;
+        const value = match[1];
+        // Skip empty strings and placeholder patterns.
+        if (!value || value.trim().length < 4)
+            continue;
+        if (PLACEHOLDER_PATTERN.test(value))
+            continue;
+        results.push({
+            checkId: "csharp:secrets-in-appsettings",
+            title: "Secret hardcoded in appsettings.json",
+            severity: "CRITICAL",
+            confidence: "high",
+            file: filePath,
+            line: i + 1,
+            description: "A sensitive value (connection string, password, API key, or token) is hardcoded " +
+                "directly in appsettings.json. Anyone with read access to the repository or the " +
+                "deployed artifact can extract this secret.",
+            fix: "Use User Secrets, environment variables, or Azure Key Vault.",
+            cwe: "CWE-798",
+        });
+    }
+    return results;
+}
+// --- Check 2: Missing [Authorize] on mutating HTTP endpoints (CWE-306) ---
+function checkMissingAuthorize(filePath, content, hasGlobalAuth) {
+    const results = [];
+    const lines = content.split("\n");
+    // Skip controllers that are intentionally public.
+    const skipControllerNames = /Auth|Login|Public|Health/i;
+    if (skipControllerNames.test(filePath))
+        return results;
+    // Check if the class itself carries [Authorize] or if global auth middleware
+    // is registered at the project level.
+    const classHasAuthorize = /\[Authorize\]/.test(content);
+    if (classHasAuthorize)
+        return results;
+    // Confidence is low when project-level auth middleware is present because
+    // global policy-based auth may protect all routes.
+    const confidence = hasGlobalAuth ? "low" : "medium";
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!/\[Http(?:Post|Put|Delete)(?:\([^)]*\))?\]/.test(line))
+            continue;
+        // Look at the 5 lines immediately above for [Authorize].
+        const windowStart = Math.max(0, i - 5);
+        const window = lines.slice(windowStart, i).join("\n");
+        if (!/\[Authorize\]/.test(window)) {
+            results.push({
+                checkId: "csharp:missing-authorize",
+                title: "Mutating HTTP endpoint missing [Authorize] attribute",
+                severity: "MEDIUM",
+                confidence,
+                file: filePath,
+                line: i + 1,
+                description: "This controller action uses [HttpPost], [HttpPut], or [HttpDelete] but has no " +
+                    "[Authorize] attribute and the controller class is also not annotated. The endpoint " +
+                    "may be accessible to unauthenticated users.",
+                fix: "Add [Authorize] attribute to controllers or actions handling sensitive operations.",
+                cwe: "CWE-306",
+            });
+        }
+    }
+    return results;
+}
+// --- Check 3: SQL injection via string building (CWE-89) ---
+function checkSqlInjection(filePath, content) {
+    const results = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // new SqlCommand(... + or $" interpolation
+        const hasSqlCommand = /(?:new\s+)?SqlCommand\s*\(/.test(line);
+        const hasRawSql = /(?:ExecuteSqlRaw|FromSqlRaw)\s*\(/.test(line);
+        if (!hasSqlCommand && !hasRawSql)
+            continue;
+        // Skip parameterized queries: @paramName, SqlParameter, or AddWithValue
+        // in the same line indicates safe, parameterized usage.
+        if (/@\w+|SqlParameter|AddWithValue/.test(line))
+            continue;
+        // Flag if the same line uses string concatenation or interpolation.
+        if (/\+/.test(line) || /\$"/.test(line)) {
+            results.push({
+                checkId: "csharp:sql-injection",
+                title: "SQL injection via string concatenation or interpolation",
+                severity: "CRITICAL",
+                confidence: "high",
+                file: filePath,
+                line: i + 1,
+                description: "A SQL command is constructed using string concatenation (+) or interpolation ($\"\"). " +
+                    "If any part of the string comes from user input, an attacker can inject arbitrary SQL " +
+                    "to read, modify, or delete data.",
+                fix: 'Use parameterized queries: new SqlCommand("SELECT * FROM Users WHERE Id = @id", conn)',
+                cwe: "CWE-89",
+            });
+        }
+    }
+    return results;
+}
+// --- Check 4: CORS wildcard (CWE-942) ---
+function checkCorsWildcard(filePath, content) {
+    const results = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (/AllowAnyOrigin\s*\(\s*\)/.test(line) ||
+            /WithOrigins\s*\(\s*["']\*["']\s*\)/.test(line) ||
+            /SetIsOriginAllowed\s*\(\s*_\s*=>/.test(line)) {
+            results.push({
+                checkId: "csharp:cors-wildcard",
+                title: "CORS configured to allow any origin",
+                severity: "MEDIUM",
+                confidence: "high",
+                file: filePath,
+                line: i + 1,
+                description: "The CORS policy allows requests from any origin. This lets malicious websites make " +
+                    "authenticated cross-origin requests to your API on behalf of logged-in users.",
+                fix: 'Restrict CORS: builder.WithOrigins("https://yourdomain.com")',
+                cwe: "CWE-942",
+            });
+        }
+    }
+    return results;
+}
+// --- Check 5: Unsafe deserialization via BinaryFormatter (CWE-502) ---
+function checkUnsafeDeserialization(filePath, content) {
+    const results = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        if (/BinaryFormatter/.test(lines[i])) {
+            results.push({
+                checkId: "csharp:unsafe-deserialization",
+                title: "Unsafe deserialization via BinaryFormatter",
+                severity: "CRITICAL",
+                confidence: "high",
+                file: filePath,
+                line: i + 1,
+                description: "BinaryFormatter is obsolete and unsafe. Deserializing attacker-controlled data with " +
+                    "BinaryFormatter can lead to remote code execution because it instantiates arbitrary " +
+                    "types during deserialization.",
+                fix: "Use System.Text.Json or JsonSerializer instead of BinaryFormatter.",
+                cwe: "CWE-502",
+            });
+        }
+    }
+    return results;
+}
+// --- Check 6: XXE vulnerability via XmlDocument without DTD prohibition (CWE-611) ---
+function checkXxeVulnerability(filePath, content) {
+    const results = [];
+    // If the file already globally disables DTD processing, skip it.
+    if (/DtdProcessing\.Prohibit|ProhibitDtd\s*=\s*true/i.test(content)) {
+        return results;
+    }
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (/new\s+XmlDocument\s*\(\s*\)|XmlReader\.Create\s*\(/.test(line)) {
+            results.push({
+                checkId: "csharp:xxe-vulnerability",
+                title: "XXE vulnerability: XML parsed without DTD restrictions",
+                severity: "HIGH",
+                // Medium confidence: some XmlDocument/XmlReader.Create usages process only
+                // trusted internal XML and are not actually exploitable. Context matters.
+                confidence: "medium",
+                file: filePath,
+                line: i + 1,
+                description: "XmlDocument or XmlReader.Create() is used without setting DtdProcessing.Prohibit. " +
+                    "Attackers can exploit external entity references in crafted XML to read local files, " +
+                    "perform server-side request forgery, or cause denial-of-service.",
+                fix: "Set XmlReaderSettings.DtdProcessing = DtdProcessing.Prohibit",
+                cwe: "CWE-611",
+            });
+        }
+    }
+    return results;
+}
+// --- Check 7: Path traversal (CWE-22) ---
+// User-input terms that when passed as arguments to Path.Combine indicate
+// potentially attacker-controlled path components. The regex is case-insensitive
+// and does NOT require word boundaries on both sides so it catches compound
+// identifiers like `userParam`, `queryString`, `requestBody`, etc.
+const PATH_USER_INPUT_TERMS = /(?:request|query|param|body|header|routedata)/i;
+function checkPathTraversal(filePath, content) {
+    const results = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!/Path\.Combine\s*\(/.test(line))
+            continue;
+        // Extract the argument list from Path.Combine(...).
+        // We want user-input terms to appear INSIDE the call's argument list,
+        // not just anywhere on the line.
+        const combineArgMatch = /Path\.Combine\s*\(([^)]+)\)/.exec(line);
+        if (!combineArgMatch)
+            continue;
+        const args = combineArgMatch[1];
+        if (!PATH_USER_INPUT_TERMS.test(args))
+            continue;
+        // Check if Path.GetFullPath or similar normalization appears within
+        // the next 3 lines — if so, the developer likely validates the result.
+        const lookAheadEnd = Math.min(lines.length, i + 4);
+        const lookAhead = lines.slice(i, lookAheadEnd).join("\n");
+        if (/Path\.GetFullPath\s*\(/.test(lookAhead))
+            continue;
+        results.push({
+            checkId: "csharp:path-traversal",
+            title: "Potential path traversal via user-controlled path",
+            severity: "HIGH",
+            // Medium: user-input term is in arguments, but we can't verify how
+            // it was derived without deeper data-flow analysis.
+            confidence: "medium",
+            file: filePath,
+            line: i + 1,
+            description: "Path.Combine() is called with what appears to be request-derived input. An attacker " +
+                "could supply path segments like '../' to escape the intended directory and access " +
+                "arbitrary files on the server.",
+            fix: "Validate paths against a whitelist. Use Path.GetFullPath() and verify the result stays within the expected directory.",
+            cwe: "CWE-22",
+        });
+    }
+    return results;
+}
+// --- Check 8: Hardcoded connection strings in .cs source (CWE-798) ---
+function checkHardcodedConnectionStrings(filePath, content) {
+    const results = [];
+    // Match inline connection string syntax inside string literals.
+    const pattern = /"(?:Server|Data Source|Initial Catalog)=/i;
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        if (pattern.test(lines[i])) {
+            results.push({
+                checkId: "csharp:hardcoded-connection-string",
+                title: "Hardcoded connection string in source code",
+                severity: "HIGH",
+                confidence: "medium",
+                file: filePath,
+                line: i + 1,
+                description: "A database connection string (Server=, Data Source=, or Initial Catalog=) is " +
+                    "embedded directly in C# source code. This exposes database credentials to anyone " +
+                    "who can read the repository.",
+                fix: "Store connection strings in configuration or environment variables.",
+                cwe: "CWE-798",
+            });
+        }
+    }
+    return results;
+}
+// --- Check 9: Developer exception page without environment guard (CWE-215) ---
+function checkDeveloperExceptionPage(filePath, content) {
+    const results = [];
+    // If the file guards the call with IsDevelopment(), it is safe.
+    if (/IsDevelopment\s*\(\s*\)/.test(content)) {
+        return results;
+    }
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        if (/UseDeveloperExceptionPage\s*\(\s*\)/.test(lines[i])) {
+            results.push({
+                checkId: "csharp:developer-exception-page",
+                title: "Developer exception page enabled without environment check",
+                severity: "HIGH",
+                confidence: "high",
+                file: filePath,
+                line: i + 1,
+                description: "UseDeveloperExceptionPage() is called without a surrounding IsDevelopment() guard. " +
+                    "In production this reveals full stack traces, source code snippets, and request " +
+                    "details to users who trigger an unhandled exception.",
+                fix: "Only use in development: if (app.Environment.IsDevelopment()) app.UseDeveloperExceptionPage();",
+                cwe: "CWE-215",
+            });
+        }
+    }
+    return results;
+}
+// --- Check 10: Command injection via Process.Start with dynamic input (CWE-78) ---
+// Terms that indicate user-controlled data flowing into Process.Start arguments.
+const COMMAND_USER_INPUT_TERMS = /\b(?:[Rr]equest|[Uu]ser[Ii]nput|[Uu]ser[Nn]ame|[Qq]uery)\b/;
+function checkCommandInjection(filePath, content) {
+    const results = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!/Process\.Start\s*\(/.test(line))
+            continue;
+        // Only flag when BOTH conditions are met:
+        // 1. The line contains string concatenation (+) or interpolation ($").
+        // 2. The interpolated/concatenated value involves user-input terms
+        //    OR the string concat is plain (+) which can include any variable.
+        //
+        // Rationale: `var x = Process.Start("notepad.exe")` has `var` on the line
+        // but no concat/interpolation, so it is NOT flagged.
+        // `Process.Start($"cmd /c {userInput}")` has interpolation → flagged.
+        // `Process.Start("bash", "-c " + userInput)` has concat + user term → flagged.
+        const hasConcatOrInterpolation = /\+/.test(line) || /\$"/.test(line);
+        if (!hasConcatOrInterpolation)
+            continue;
+        // For plain concat (+) without an explicit user-input term, require at least
+        // one user-input-derived identifier to avoid flagging benign constants.
+        const hasInterpolation = /\$"/.test(line);
+        const hasUserInputTerm = COMMAND_USER_INPUT_TERMS.test(line);
+        // $"..." interpolation with any variable is suspicious (flag it).
+        // Plain + concat is only flagged when user-input terms are also present.
+        if (!hasInterpolation && !hasUserInputTerm)
+            continue;
+        results.push({
+            checkId: "csharp:command-injection",
+            title: "Command injection via Process.Start with dynamic input",
+            severity: "CRITICAL",
+            confidence: "high",
+            file: filePath,
+            line: i + 1,
+            description: "Process.Start() is called with what appears to be dynamic (potentially user-controlled) " +
+                "arguments. If user input is passed unsanitized to a shell command, an attacker can " +
+                "execute arbitrary commands on the host.",
+            fix: "Validate all input before passing to Process.Start(). Use allowlists.",
+            cwe: "CWE-78",
+        });
+    }
+    return results;
+}
+// --- Check 11: Weak hash algorithm (CWE-328) ---
+function checkWeakHashAlgorithm(filePath, content) {
+    const results = [];
+    const pattern = /MD5\.Create\s*\(\s*\)|SHA1\.Create\s*\(\s*\)|new\s+MD5CryptoServiceProvider\s*\(\s*\)|new\s+SHA1CryptoServiceProvider\s*\(\s*\)/;
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        if (pattern.test(lines[i])) {
+            results.push({
+                checkId: "csharp:weak-hash-algorithm",
+                title: "Weak hash algorithm: MD5 or SHA-1",
+                severity: "HIGH",
+                confidence: "medium",
+                file: filePath,
+                line: i + 1,
+                description: "MD5 and SHA-1 are cryptographically broken. Collisions are computationally feasible " +
+                    "for both algorithms. Using them for integrity checks or password hashing provides " +
+                    "insufficient protection.",
+                fix: "Use SHA256.Create() or SHA512.Create() for hashing.",
+                cwe: "CWE-328",
+            });
+        }
+    }
+    return results;
+}
+// --- Check 12: Missing anti-forgery token on POST actions (CWE-352) ---
+function checkMissingAntiForgeryToken(filePath, content) {
+    const results = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!/\[HttpPost\]/.test(line))
+            continue;
+        // Look at up to 3 lines immediately above for the anti-forgery attribute.
+        const windowStart = Math.max(0, i - 3);
+        const window = lines.slice(windowStart, i).join("\n");
+        if (!/\[ValidateAntiForgeryToken\]/.test(window)) {
+            results.push({
+                checkId: "csharp:missing-antiforgery-token",
+                title: "POST action missing [ValidateAntiForgeryToken]",
+                severity: "MEDIUM",
+                confidence: "medium",
+                file: filePath,
+                line: i + 1,
+                description: "This [HttpPost] action does not have a [ValidateAntiForgeryToken] attribute within " +
+                    "the preceding 3 lines. Without CSRF validation, a malicious page can trick a logged-in " +
+                    "user's browser into submitting unintended requests.",
+                fix: "Add [ValidateAntiForgeryToken] to POST actions, or use [AutoValidateAntiforgeryToken] on the controller.",
+                cwe: "CWE-352",
+            });
+        }
+    }
+    return results;
+}
+// --- Check 13: [AllowAnonymous] on sensitive controller or action (CWE-306) ---
+// Terms that suggest an endpoint handles privileged or personal data.
+const SENSITIVE_TERMS = /admin|user|account|settings|manage/i;
+// Method names that suggest mutating or privileged operations.
+const SENSITIVE_METHOD_NAMES = /Create|Update|Delete|Admin|Settings|Manage|Account/;
+// HTTP verbs that mutate state — AllowAnonymous on these is riskier than on GET.
+const MUTATING_HTTP_VERBS = /\[Http(?:Post|Put|Delete|Patch)(?:\([^)]*\))?\]/;
+function checkAllowAnonymousOnSensitiveController(filePath, content) {
+    const results = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!/\[AllowAnonymous\]/.test(line))
+            continue;
+        // --- Path-based detection ---
+        // If the file path itself signals a sensitive controller (e.g. AdminController.cs),
+        // flag regardless of HTTP verb because the entire class is presumably privileged.
+        if (SENSITIVE_TERMS.test(filePath)) {
+            results.push({
+                checkId: "csharp:allow-anonymous-sensitive",
+                title: "[AllowAnonymous] on sensitive controller or action",
+                severity: "HIGH",
+                confidence: "low",
+                file: filePath,
+                line: i + 1,
+                description: "[AllowAnonymous] is applied in a file whose name suggests it handles admin, user, " +
+                    "account, settings, or management functionality. This overrides any controller-level " +
+                    "[Authorize] attribute and makes the endpoint publicly accessible.",
+                fix: "Remove [AllowAnonymous] from sensitive endpoints. Use [Authorize] instead.",
+                cwe: "CWE-306",
+            });
+            continue;
+        }
+        // --- Code-level detection ---
+        // For files without a sensitive name, flag when the surrounding context contains
+        // a sensitive class or method name (e.g. UserSettingsController, AdminAction,
+        // CreateUser). HTTP verb context is used to confirm this is a controller action
+        // (not a utility class), but we don't restrict to mutating verbs only — a GET
+        // endpoint exposing admin data is also a concern.
+        const windowStart = Math.max(0, i - 4);
+        const windowEnd = Math.min(lines.length, i + 5);
+        const window = lines.slice(windowStart, windowEnd).join("\n");
+        // Require at least one HTTP verb attribute nearby to confirm this is a
+        // controller action (not just a random class with the attribute).
+        const hasHttpVerb = /\[Http(?:Get|Post|Put|Delete|Patch)(?:\([^)]*\))?\]/.test(window);
+        const hasSensitiveName = SENSITIVE_TERMS.test(window) || SENSITIVE_METHOD_NAMES.test(window);
+        if (hasHttpVerb && hasSensitiveName) {
+            results.push({
+                checkId: "csharp:allow-anonymous-sensitive",
+                title: "[AllowAnonymous] on sensitive controller or action",
+                severity: "HIGH",
+                confidence: "low",
+                file: filePath,
+                line: i + 1,
+                description: "[AllowAnonymous] is applied near code that appears to handle admin, user, account, " +
+                    "settings, or management functionality. This overrides any controller-level [Authorize] " +
+                    "attribute and makes the endpoint publicly accessible.",
+                fix: "Remove [AllowAnonymous] from sensitive endpoints. Use [Authorize] instead.",
+                cwe: "CWE-306",
+            });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=csharp-agent.js.map

package/dist/scanning/agents/csharp-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csharp-agent.js","sourceRoot":"","sources":["../../../src/scanning/agents/csharp-agent.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,2EAA2E;AAC3E,wEAAwE;AACxE,uEAAuE;AAIvE,MAAM,OAAO,eAAe;IAC1B,KAAK,CAAC,MAAM,CAAC,KAA0B;QACrC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,IACE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EACzB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAA0B;QACnC,MAAM,OAAO,GAAiB,EAAE,CAAC;QAEjC,yDAAyD;QACzD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzD,8EAA8E;QAC9E,2EAA2E;QAC3E,gDAAgD;QAChD,MAAM,aAAa,GACjB,4CAA4C,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7D,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC;YACzC,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE5C,iDAAiD;QACjD,MAAM,cAAc,GAAG,wCAAwC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjF,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;YACxC,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBACvD,OAAO,CAAC,IAAI,CAAC,GAAG,+BAA+B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,GAAG,wCAAwC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,2EAA2E;QAC3E,KAAK,cAAc,CAAC;QAEpB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,WAAW;QACT,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,OAAO;YAChB,YAAY,EAAE,CAAC,QAAQ,CAAC;SACzB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO;YACL;gBACE,EAAE,EAAE,+BAA+B;gBACnC,IAAI,EAAE,sCAAsC;gBAC5C,QAAQ,EAAE,UAAU;aACrB;YACD;gBACE,EAAE,EAAE,0BAA0B;gBAC9B,IAAI,EAAE,sDAAsD;gBAC5D,QAAQ,EAAE,QAAQ;aACnB;YACD;gBACE,EAAE,EAAE,sBAAsB;gBAC1B,IAAI,EAAE,yDAAyD;gBAC/D,QAAQ,EAAE,UAAU;aACrB;YACD;gBACE,EAAE,EAAE,sBAAsB;gBAC1B,IAAI,EAAE,qCAAqC;gBAC3C,QAAQ,EAAE,QAAQ;aACnB;YACD;gBACE,EAAE,EAAE,+BAA+B;gBACnC,IAAI,EAAE,4CAA4C;gBAClD,QAAQ,EAAE,UAAU;aACrB;YACD;gBACE,EAAE,EAAE,0BAA0B;gBAC9B,IAAI,EAAE,wDAAwD;gBAC9D,QAAQ,EAAE,MAAM;aACjB;YACD;gBACE,EAAE,EAAE,uBAAuB;gBAC3B,IAAI,EAAE,mDAAmD;gBACzD,QAAQ,EAAE,MAAM;aACjB;YACD;gBACE,EAAE,EAAE,oCAAoC;gBACxC,IAAI,EAAE,4CAA4C;gBAClD,QAAQ,EAAE,MAAM;aACjB;YACD;gBACE,EAAE,EAAE,iCAAiC;gBACrC,IAAI,EAAE,4DAA4D;gBAClE,QAAQ,EAAE,MAAM;aACjB;YACD;gBACE,EAAE,EAAE,0BAA0B;gBAC9B,IAAI,EAAE,wDAAwD;gBAC9D,QAAQ,EAAE,UAAU;aACrB;YACD;gBACE,EAAE,EAAE,4BAA4B;gBAChC,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,MAAM;aACjB;YACD;gBACE,EAAE,EAAE,kCAAkC;gBACtC,IAAI,EAAE,gDAAgD;gBACtD,QAAQ,EAAE,QAAQ;aACnB;YACD;gBACE,EAAE,EAAE,kCAAkC;gBACtC,IAAI,EAAE,oDAAoD;gBAC1D,QAAQ,EAAE,MAAM;aACjB;SACF,CAAC;IACJ,CAAC;CACF;AAED,4BAA4B;AAE5B,oDAAoD;AACpD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAC/C,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,0DAA0D;AAE1D,gEAAgE;AAChE,MAAM,mBAAmB,GAAG,yDAAyD,CAAC;AAEtF,SAAS,yBAAyB,CAAC,QAAgB,EAAE,OAAe;IAClE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,qEAAqE;IACrE,mFAAmF;IACnF,mEAAmE;IACnE,MAAM,OAAO,GACX,sFAAsF,CAAC;IAEzF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,8DAA8D;QAC9D,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,+CAA+C;QAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAChD,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAE9C,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,+BAA+B;YACxC,KAAK,EAAE,sCAAsC;YAC7C,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,WAAW,EACT,kFAAkF;gBAClF,iFAAiF;gBACjF,4CAA4C;YAC9C,GAAG,EAAE,8DAA8D;YACnE,GAAG,EAAE,SAAS;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4EAA4E;AAE5E,SAAS,qBAAqB,CAC5B,QAAgB,EAChB,OAAe,EACf,aAAsB;IAEtB,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,kDAAkD;IAClD,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;IACxD,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAEvD,6EAA6E;IAC7E,sCAAsC;IACtC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,iBAAiB;QAAE,OAAO,OAAO,CAAC;IAEtC,0EAA0E;IAC1E,mDAAmD;IACnD,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAEtE,yDAAyD;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,0BAA0B;gBACnC,KAAK,EAAE,sDAAsD;gBAC7D,QAAQ,EAAE,QAAQ;gBAClB,UAAU;gBACV,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,gFAAgF;oBAChF,qFAAqF;oBACrF,6CAA6C;gBAC/C,GAAG,EAAE,oFAAoF;gBACzF,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8DAA8D;AAE9D,SAAS,iBAAiB,CAAC,QAAgB,EAAE,OAAe;IAC1D,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,2CAA2C;QAC3C,MAAM,aAAa,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjE,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS;YAAE,SAAS;QAE3C,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAE1D,oEAAoE;QACpE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,sBAAsB;gBAC/B,KAAK,EAAE,yDAAyD;gBAChE,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,wFAAwF;oBACxF,wFAAwF;oBACxF,kCAAkC;gBACpC,GAAG,EAAE,uFAAuF;gBAC5F,GAAG,EAAE,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2CAA2C;AAE3C,SAAS,iBAAiB,CAAC,QAAgB,EAAE,OAAe;IAC1D,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IACE,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/C,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAC7C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,sBAAsB;gBAC/B,KAAK,EAAE,qCAAqC;gBAC5C,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,qFAAqF;oBACrF,+EAA+E;gBACjF,GAAG,EAAE,8DAA8D;gBACnE,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wEAAwE;AAExE,SAAS,0BAA0B,CAAC,QAAgB,EAAE,OAAe;IACnE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,+BAA+B;gBACxC,KAAK,EAAE,4CAA4C;gBACnD,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,sFAAsF;oBACtF,sFAAsF;oBACtF,+BAA+B;gBACjC,GAAG,EAAE,oEAAoE;gBACzE,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uFAAuF;AAEvF,SAAS,qBAAqB,CAAC,QAAgB,EAAE,OAAe;IAC9D,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,iEAAiE;IACjE,IAAI,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,0BAA0B;gBACnC,KAAK,EAAE,wDAAwD;gBAC/D,QAAQ,EAAE,MAAM;gBAChB,2EAA2E;gBAC3E,0EAA0E;gBAC1E,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,oFAAoF;oBACpF,uFAAuF;oBACvF,kEAAkE;gBACpE,GAAG,EAAE,8DAA8D;gBACnE,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2CAA2C;AAE3C,0EAA0E;AAC1E,iFAAiF;AACjF,4EAA4E;AAC5E,mEAAmE;AACnE,MAAM,qBAAqB,GAAG,gDAAgD,CAAC;AAE/E,SAAS,kBAAkB,CAAC,QAAgB,EAAE,OAAe;IAC3D,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAE/C,oDAAoD;QACpD,sEAAsE;QACtE,iCAAiC;QACjC,MAAM,eAAe,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,eAAe;YAAE,SAAS;QAE/B,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAEhD,oEAAoE;QACpE,uEAAuE;QACvE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,SAAS;QAEvD,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,mDAAmD;YAC1D,QAAQ,EAAE,MAAM;YAChB,mEAAmE;YACnE,oDAAoD;YACpD,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,WAAW,EACT,sFAAsF;gBACtF,oFAAoF;gBACpF,gCAAgC;YAClC,GAAG,EAAE,uHAAuH;YAC5H,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wEAAwE;AAExE,SAAS,+BAA+B,CAAC,QAAgB,EAAE,OAAe;IACxE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,gEAAgE;IAChE,MAAM,OAAO,GAAG,2CAA2C,CAAC;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,oCAAoC;gBAC7C,KAAK,EAAE,4CAA4C;gBACnD,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,+EAA+E;oBAC/E,mFAAmF;oBACnF,8BAA8B;gBAChC,GAAG,EAAE,qEAAqE;gBAC1E,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAEhF,SAAS,2BAA2B,CAAC,QAAgB,EAAE,OAAe;IACpE,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,gEAAgE;IAChE,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,iCAAiC;gBAC1C,KAAK,EAAE,4DAA4D;gBACnE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,qFAAqF;oBACrF,kFAAkF;oBAClF,sDAAsD;gBACxD,GAAG,EAAE,gGAAgG;gBACrG,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oFAAoF;AAEpF,iFAAiF;AACjF,MAAM,wBAAwB,GAAG,4DAA4D,CAAC;AAE9F,SAAS,qBAAqB,CAAC,QAAgB,EAAE,OAAe;IAC9D,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAEhD,0CAA0C;QAC1C,uEAAuE;QACvE,mEAAmE;QACnE,uEAAuE;QACvE,EAAE;QACF,0EAA0E;QAC1E,qDAAqD;QACrD,sEAAsE;QACtE,+EAA+E;QAC/E,MAAM,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,wBAAwB;YAAE,SAAS;QAExC,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7D,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,CAAC,gBAAgB,IAAI,CAAC,gBAAgB;YAAE,SAAS;QAErD,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,wDAAwD;YAC/D,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,WAAW,EACT,0FAA0F;gBAC1F,qFAAqF;gBACrF,yCAAyC;YAC3C,GAAG,EAAE,uEAAuE;YAC5E,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kDAAkD;AAElD,SAAS,sBAAsB,CAAC,QAAgB,EAAE,OAAe;IAC/D,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,OAAO,GACX,iIAAiI,CAAC;IACpI,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,4BAA4B;gBACrC,KAAK,EAAE,mCAAmC;gBAC1C,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,sFAAsF;oBACtF,oFAAoF;oBACpF,0BAA0B;gBAC5B,GAAG,EAAE,qDAAqD;gBAC1D,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AAEzE,SAAS,4BAA4B,CAAC,QAAgB,EAAE,OAAe;IACrE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAEzC,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,kCAAkC;gBAC3C,KAAK,EAAE,gDAAgD;gBACvD,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,qFAAqF;oBACrF,yFAAyF;oBACzF,qDAAqD;gBACvD,GAAG,EAAE,0GAA0G;gBAC/G,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AAEjF,sEAAsE;AACtE,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D,+DAA+D;AAC/D,MAAM,sBAAsB,GAAG,oDAAoD,CAAC;AAEpF,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,iDAAiD,CAAC;AAE9E,SAAS,wCAAwC,CAC/C,QAAgB,EAChB,OAAe;IAEf,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAE/C,+BAA+B;QAC/B,oFAAoF;QACpF,kFAAkF;QAClF,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,kCAAkC;gBAC3C,KAAK,EAAE,oDAAoD;gBAC3D,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK;gBACjB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,oFAAoF;oBACpF,sFAAsF;oBACtF,mEAAmE;gBACrE,GAAG,EAAE,4EAA4E;gBACjF,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,+BAA+B;QAC/B,iFAAiF;QACjF,8EAA8E;QAC9E,gFAAgF;QAChF,8EAA8E;QAC9E,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9D,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,WAAW,GAAG,qDAAqD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvF,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7F,IAAI,WAAW,IAAI,gBAAgB,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,kCAAkC;gBAC3C,KAAK,EAAE,oDAAoD;gBAC3D,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK;gBACjB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,WAAW,EACT,qFAAqF;oBACrF,yFAAyF;oBACzF,uDAAuD;gBACzD,GAAG,EAAE,4EAA4E;gBACjF,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/scanning/agents/go-agent.d.ts

@@ -0,0 +1,14 @@
+import type { ScanAgent, ScanResult, AgentMetadata, CheckDefinition } from "../types.js";
+export type Confidence = "high" | "medium" | "low";
+export interface GoScanResult extends ScanResult {
+    confidence: Confidence;
+}
+export declare class GoScanAgent implements ScanAgent {
+    detect(files: Map<string, string>): Promise<boolean>;
+    scan(files: Map<string, string>): Promise<ScanResult[]>;
+    getMetadata(): AgentMetadata;
+    getChecks(): CheckDefinition[];
+}
+/** Returns true if the file path ends with .go. */
+export declare function isGoFile(path: string): boolean;
+//# sourceMappingURL=go-agent.d.ts.map

package/dist/scanning/agents/go-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"go-agent.d.ts","sourceRoot":"","sources":["../../../src/scanning/agents/go-agent.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAKzF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,qBAAa,WAAY,YAAW,SAAS;IACrC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAyB7D,WAAW,IAAI,aAAa;IAQ5B,SAAS,IAAI,eAAe,EAAE;CAoB/B;AAID,mDAAmD;AACnD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9C"}