@datahogo/core 0.1.0

package/dist/orchestrator.js

@@ -0,0 +1,237 @@
+// Scan orchestrator - runs all engines in parallel and aggregates results
+import { runSecretsEngine } from "./engines/secrets.js";
+import { analyzePatterns } from "./engines/patterns.js";
+import { analyzeDependencies } from "./engines/dependencies.js";
+import { analyzeConfig } from "./engines/config.js";
+import { scanUrl } from "./engines/url-scanner.js";
+import { analyzeDbRules } from "./engines/db-rules.js";
+import { runGitleaks } from "./engines/gitleaks.js";
+import { runSemgrep } from "./engines/semgrep.js";
+import { runNpmAudit } from "./engines/npm-audit.js";
+import { runDast } from "./engines/dast.js";
+import { analyzeGitHubActions } from "./engines/github-actions.js";
+import { runMultiTechScan } from "./scanning/orchestrator.js";
+import { classifyFindings } from "./utils/context-classifier.js";
+import { postProcessFindings } from "./utils/post-processor.js";
+import { detectTechnologies } from "./scanning/tech-detector.js";
+export async function runScan(params) {
+    const startTime = Date.now();
+    const engineResults = [];
+    let scanLog;
+    // Run code analysis engines in parallel
+    const codeEnginePromises = [
+        // Regex-based engines (always run, work on Map<string, string>)
+        runEngine("secrets", () => runSecretsEngine(params.files)),
+        runEngine("patterns", () => analyzePatterns(params.files)),
+        runEngine("dependencies", () => analyzeDependencies(params.files)),
+        runEngine("config", () => analyzeConfig(params.files)),
+        runEngine("github-actions", () => analyzeGitHubActions(params.files)),
+        // Multi-tech agents (Python, Go, Java, PHP, C#, Mobile, Supabase).
+        // The javascript-agent is excluded: it is an adapter around the legacy
+        // engines above and would duplicate every JS finding.
+        runEngine("multi-tech-agents", async () => {
+            const report = await runMultiTechScan(params.files, { exclude: ["javascript-agent"] });
+            scanLog = report.scanLog;
+            return report.results.map(agentResultToFinding);
+        }, 120_000),
+        // External tool engines (only when filesystem is available)
+        ...(params.repoDir ? [
+            runEngine("gitleaks", () => runGitleaks(params.repoDir)),
+            runEngine("semgrep", () => runSemgrep(params.repoDir)),
+            runEngine("npm-audit", () => runNpmAudit(params.repoDir, params.files)),
+        ] : []),
+    ];
+    // Conditionally run URL scanner + DAST
+    if (params.appUrl) {
+        codeEnginePromises.push(runEngine("url-scanner", () => scanUrl(params.appUrl)), runEngine("dast", () => runDast(params.appUrl), 180_000) // DAST needs more time
+        );
+    }
+    // Conditionally run DB rules parser
+    if (params.dbRulesInput) {
+        codeEnginePromises.push(runEngine("db-rules", () => analyzeDbRules(params.dbRulesInput, "auto")));
+    }
+    const results = await Promise.allSettled(codeEnginePromises);
+    for (const result of results) {
+        if (result.status === "fulfilled") {
+            engineResults.push(result.value);
+        }
+    }
+    // Aggregate findings
+    const allFindings = [];
+    const failedEngines = [];
+    for (const engineResult of engineResults) {
+        if (engineResult.error) {
+            failedEngines.push(engineResult.engine);
+        }
+        allFindings.push(...engineResult.findings);
+    }
+    // Deduplicate findings by vulnerability_id + file_path + line_number
+    const deduplicated = deduplicateFindings(allFindings);
+    // Classify findings by context (production, test, example, etc.)
+    const classified = classifyFindings(deduplicated);
+    // Post-process: framework suppressions, cross-engine dedup, contextual notes,
+    // and actionable/informational classification.
+    const technologies = detectTechnologies(params.files).technologies;
+    const postProcessed = postProcessFindings(classified, technologies);
+    // Calculate score (only production findings penalize; framework requirements skipped)
+    const score = calculateScore(postProcessed);
+    // Build summary with context breakdown
+    const summary = buildSummary(postProcessed);
+    return {
+        findings: postProcessed,
+        engineResults,
+        score,
+        summary,
+        failedEngines,
+        durationMs: Date.now() - startTime,
+        scanLog,
+    };
+}
+// Agent findings carry their own title/description/fix inline, so they don't
+// map to the numeric vulnerability catalog. We derive a stable synthetic id
+// (>= 100000, outside the catalog range) from the checkId so deduplication
+// by vulnerability_id + file + line keeps working.
+function syntheticVulnId(key) {
+    let hash = 0;
+    for (let i = 0; i < key.length; i++) {
+        hash = (hash * 31 + key.charCodeAt(i)) | 0;
+    }
+    return 100000 + (Math.abs(hash) % 100000);
+}
+function agentResultToFinding(result) {
+    const category = result.checkId?.split(":")[0] ?? "multi-tech";
+    return {
+        vulnerability_id: syntheticVulnId(result.checkId ?? result.title),
+        severity: result.severity.toLowerCase(),
+        category,
+        title: result.title,
+        description_simple: result.description,
+        file_path: result.file,
+        line_number: result.line,
+        fix_description: result.fix,
+        owasp_ref: result.cwe,
+        status: "open",
+        confidence: result.confidence,
+    };
+}
+const ENGINE_TIMEOUT_MS = 90_000; // 90s default per-engine safety timeout
+async function runEngine(name, fn, timeoutMs = ENGINE_TIMEOUT_MS) {
+    const startTime = Date.now();
+    try {
+        const findings = await Promise.race([
+            fn(),
+            new Promise((_, reject) => setTimeout(() => reject(new Error(`Engine ${name} timed out after ${timeoutMs}ms`)), timeoutMs)),
+        ]);
+        return {
+            engine: name,
+            findings,
+            durationMs: Date.now() - startTime,
+        };
+    }
+    catch (error) {
+        return {
+            engine: name,
+            findings: [],
+            error: error instanceof Error ? error.message : "Unknown error",
+            durationMs: Date.now() - startTime,
+        };
+    }
+}
+function deduplicateFindings(findings) {
+    // Fuzzy dedup: same vulnerability_id + file_path within ±2 lines = duplicate.
+    // This handles Semgrep (AST node start) vs regex (first match line) differences.
+    const result = [];
+    const seen = new Map(); // baseKey → array of seen line numbers
+    for (const finding of findings) {
+        const baseKey = `${finding.vulnerability_id}:${finding.file_path ?? ""}`;
+        const lineNum = finding.line_number ?? 0;
+        const seenLines = seen.get(baseKey);
+        if (seenLines) {
+            const isDuplicate = seenLines.some((l) => Math.abs(l - lineNum) <= 2);
+            if (isDuplicate)
+                continue;
+            seenLines.push(lineNum);
+        }
+        else {
+            seen.set(baseKey, [lineNum]);
+        }
+        result.push(finding);
+    }
+    return result;
+}
+const CONTEXT_PENALTY = {
+    production: 1.0,
+    config: 0, // Config/scripts/migrations are infrastructure, not production code
+    test: 0,
+    example: 0,
+    rule: 0,
+    vendored: 0,
+};
+const CONFIDENCE_MULTIPLIER = {
+    high: 1.0, // Semgrep AST-based, high confidence
+    medium: 0.7, // Regex pattern with good specificity
+    low: 0.3, // Absence checks, broad regex matches
+};
+function calculateScore(findings) {
+    const penalties = {
+        critical: 15,
+        high: 10,
+        medium: 5,
+        low: 2,
+        info: 0,
+    };
+    let score = 100;
+    for (const finding of findings) {
+        if (finding.status === "open") {
+            // Framework requirements are expected behaviour — do not penalize the score.
+            if (finding.is_framework_requirement)
+                continue;
+            const ctx = finding.context ?? "production";
+            const contextMul = CONTEXT_PENALTY[ctx] ?? 1;
+            const confidenceMul = CONFIDENCE_MULTIPLIER[finding.confidence ?? "medium"];
+            score -= (penalties[finding.severity] ?? 0) * contextMul * confidenceMul;
+        }
+    }
+    return Math.max(0, Math.round(score));
+}
+function buildSummary(findings) {
+    const summary = {
+        total: 0, critical: 0, high: 0, medium: 0, low: 0, info: 0,
+        allFindings: 0,
+        production: 0, nonProduction: 0,
+        byContext: {},
+        actionable: 0,
+        informational: 0,
+    };
+    for (const finding of findings) {
+        summary.allFindings++;
+        const ctx = finding.context ?? "production";
+        if (ctx === "production") {
+            summary.production++;
+            if (finding.classification === "informational") {
+                summary.informational++;
+            }
+            else {
+                // Only actionable findings count toward headline totals and severity breakdown
+                summary.actionable++;
+                summary.total++;
+                if (finding.severity === "critical")
+                    summary.critical++;
+                else if (finding.severity === "high")
+                    summary.high++;
+                else if (finding.severity === "medium")
+                    summary.medium++;
+                else if (finding.severity === "low")
+                    summary.low++;
+                else if (finding.severity === "info")
+                    summary.info++;
+            }
+        }
+        else {
+            summary.nonProduction++;
+        }
+        summary.byContext[ctx] = (summary.byContext[ctx] ?? 0) + 1;
+    }
+    return summary;
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAmCjE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAkB;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,IAAI,OAA4B,CAAC;IAEjC,wCAAwC;IACxC,MAAM,kBAAkB,GAAG;QACzB,gEAAgE;QAChE,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,SAAS,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,sDAAsD;QACtD,SAAS,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACvF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClD,CAAC,EAAE,OAAO,CAAC;QACX,4DAA4D;QAC5D,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACnB,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,OAAQ,CAAC,CAAC;YACzD,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,OAAQ,CAAC,CAAC;YACvD,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,OAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;SACzE,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,uCAAuC;IACvC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,kBAAkB,CAAC,IAAI,CACrB,SAAS,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAO,CAAC,CAAC,EACvD,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAO,CAAC,EAAE,OAAO,CAAC,CAAC,uBAAuB;SAClF,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,kBAAkB,CAAC,IAAI,CACrB,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CACzB,cAAc,CAAC,MAAM,CAAC,YAAa,EAAE,MAAM,CAAC,CAC7C,CACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAE7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,WAAW,GAAkB,EAAE,CAAC;IACtC,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,qEAAqE;IACrE,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAEtD,iEAAiE;IACjE,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAElD,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC;IACnE,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAEpE,sFAAsF;IACtF,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAE5C,uCAAuC;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAE5C,OAAO;QACL,QAAQ,EAAE,aAAa;QACvB,aAAa;QACb,KAAK;QACL,OAAO;QACP,aAAa;QACb,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,mDAAmD;AACnD,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAuB;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;IAC/D,OAAO;QACL,gBAAgB,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAc;QACnD,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,kBAAkB,EAAE,MAAM,CAAC,WAAW;QACtC,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,WAAW,EAAE,MAAM,CAAC,IAAI;QACxB,eAAe,EAAE,MAAM,CAAC,GAAG;QAC3B,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,MAAM,EAAE,MAAM;QACd,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,CAAC,wCAAwC;AAE1E,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,EAAgD,EAChD,YAAoB,iBAAiB;IAErC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAClC,EAAE,EAAE;YACJ,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CACR,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,oBAAoB,SAAS,IAAI,CAAC,CAAC,EACxE,SAAS,CACV,CACF;SACF,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,QAAQ;YACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;YAC/D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAuB;IAClD,8EAA8E;IAC9E,iFAAiF;IACjF,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC,CAAC,uCAAuC;IAEjF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;QAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACtE,IAAI,WAAW;gBAAE,SAAS;YAC1B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,eAAe,GAAmC;IACtD,UAAU,EAAE,GAAG;IACf,MAAM,EAAE,CAAC,EAAK,oEAAoE;IAClF,IAAI,EAAE,CAAC;IACP,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,qBAAqB,GAAsC;IAC/D,IAAI,EAAE,GAAG,EAAK,qCAAqC;IACnD,MAAM,EAAE,GAAG,EAAG,sCAAsC;IACpD,GAAG,EAAE,GAAG,EAAM,sCAAsC;CACrD,CAAC;AAEF,SAAS,cAAc,CAAC,QAAuB;IAC7C,MAAM,SAAS,GAA2B;QACxC,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,EAAE;QACR,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IAEF,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,6EAA6E;YAC7E,IAAI,OAAO,CAAC,wBAAwB;gBAAE,SAAS;YAE/C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC;YAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC;YAC5E,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,UAAU,GAAG,aAAa,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,QAAuB;IAC3C,MAAM,OAAO,GAA0B;QACrC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,WAAW,EAAE,CAAC;QACd,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;QAC/B,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,CAAC;QACb,aAAa,EAAE,CAAC;KACjB,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC;QAE5C,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,OAAO,CAAC,UAAU,EAAE,CAAC;YAErB,IAAI,OAAO,CAAC,cAAc,KAAK,eAAe,EAAE,CAAC;gBAC/C,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,+EAA+E;gBAC/E,OAAO,CAAC,UAAU,EAAE,CAAC;gBACrB,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU;oBAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;qBACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;oBAAE,OAAO,CAAC,IAAI,EAAE,CAAC;qBAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO,CAAC,MAAM,EAAE,CAAC;qBACpD,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;oBAAE,OAAO,CAAC,GAAG,EAAE,CAAC;qBAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;oBAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/rules/ai-llm-security.yaml

@@ -0,0 +1,199 @@
+rules:
+  # =============================================
+  # AI / LLM Security (IDs 200-208)
+  # =============================================
+
+  - id: datahogo-ai-prompt-injection
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $MESSAGES = `...${$USER_INPUT}...`
+          - pattern: |
+              $MESSAGES.push({..., content: `...${$INPUT}...`})
+          - pattern: |
+              $CLIENT.messages.create({..., messages: [{..., content: `...${$INPUT}...`}]})
+    message: >
+      User input is interpolated directly into an LLM prompt. This enables prompt injection attacks
+      where an attacker can manipulate the AI's behavior. Sanitize or use structured prompts with
+      system/user role separation.
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 200
+      owasp: "A03:2021"
+      category: ai-llm
+
+  - id: datahogo-ai-api-key-frontend
+    patterns:
+      - pattern-either:
+          - pattern: process.env.NEXT_PUBLIC_ANTHROPIC_API_KEY
+          - pattern: process.env.NEXT_PUBLIC_OPENAI_API_KEY
+          - pattern: process.env.NEXT_PUBLIC_AI_API_KEY
+          - pattern: process.env.NEXT_PUBLIC_CLAUDE_API_KEY
+    message: >
+      AI API key is exposed via NEXT_PUBLIC_ environment variable, making it accessible in the browser.
+      AI API keys must only be used server-side.
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 203
+      owasp: "A07:2021"
+      category: ai-llm
+
+  - id: datahogo-ai-output-eval
+    patterns:
+      - pattern-either:
+          - pattern: eval($AI_RESPONSE)
+          - pattern: new Function($AI_RESPONSE)
+          - pattern: eval($COMPLETION.content)
+          - pattern: eval($RESPONSE.choices[0].message.content)
+    message: >
+      AI-generated output is passed to eval() or Function constructor. Never execute AI output as code —
+      it can be manipulated via prompt injection to run arbitrary code.
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 208
+      owasp: "A03:2021"
+      category: ai-llm
+
+  - id: datahogo-ai-no-output-sanitization
+    patterns:
+      - pattern: |
+          dangerouslySetInnerHTML={{__html: $AI_OUTPUT}}
+      - metavariable-regex:
+          metavariable: $AI_OUTPUT
+          regex: ".*(completion|response|aiOutput|generated|llm|chat|gpt|claude).*"
+    message: >
+      AI-generated content is rendered as HTML without sanitization. AI outputs can contain XSS payloads
+      via prompt injection. Always sanitize with DOMPurify before rendering.
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 204
+      category: ai-llm
+
+  # =============================================
+  # Database Connection Security (IDs 209-220)
+  # =============================================
+
+  - id: datahogo-db-connection-no-ssl
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new Pool({..., ssl: false})
+          - pattern: |
+              new Client({..., ssl: false})
+          - pattern: |
+              createConnection({..., ssl: false})
+    message: >
+      Database connection has SSL explicitly disabled. Always use SSL/TLS for database connections
+      to prevent credential and data interception.
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 209
+      category: database-connection
+
+  - id: datahogo-db-ssl-reject-unauthorized-false
+    pattern: |
+      ssl: { rejectUnauthorized: false }
+    message: >
+      Database SSL certificate validation is disabled. This makes the connection vulnerable to
+      man-in-the-middle attacks. Use a proper CA certificate instead.
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 219
+      category: database-connection
+
+  - id: datahogo-db-default-credentials
+    patterns:
+      - pattern-regex: "(?:postgres|mysql|mongodb)://(?:postgres|root|admin):(?:postgres|root|admin|password|secret|test)@"
+    message: >
+      Database connection string uses default credentials. Use strong, unique passwords
+      managed via environment variables or a secrets manager.
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 211
+      category: database-connection
+
+  - id: datahogo-db-connection-string-logged
+    patterns:
+      - pattern-either:
+          - pattern: console.log(process.env.DATABASE_URL)
+          - pattern: console.log($X.connectionString)
+          - pattern: console.log(..., process.env.DATABASE_URL, ...)
+          - pattern: console.error(process.env.DATABASE_URL)
+    message: >
+      Database connection string (which may contain credentials) is logged. Remove logging of
+      connection strings to prevent credential exposure.
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 218
+      category: database-connection
+
+  - id: datahogo-db-hardcoded-host
+    patterns:
+      - pattern-regex: "host:\\s*['\"]\\w+\\.(?:rds\\.amazonaws\\.com|database\\.azure\\.com|cloudsql\\.google\\.com)['\"]"
+    message: >
+      Database host is hardcoded to a cloud provider endpoint. Use environment variables
+      to allow different configurations per environment.
+    severity: INFO
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 220
+      category: database-connection
+
+  # =============================================
+  # Cloud Provider Security (IDs 221-232)
+  # =============================================
+
+  - id: datahogo-cloud-metadata-ssrf
+    patterns:
+      - pattern-either:
+          - pattern: fetch("http://169.254.169.254/...")
+          - pattern: fetch(`http://169.254.169.254/...`)
+          - pattern: axios.get("http://169.254.169.254/...")
+    message: >
+      Request to cloud metadata endpoint detected. If user input can influence this URL,
+      it enables SSRF attacks to steal cloud credentials. Block metadata IPs in your HTTP client.
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 222
+      owasp: "A10:2021"
+      category: cloud
+
+  - id: datahogo-cloud-iam-star-star
+    patterns:
+      - pattern-regex: '"Action"\\s*:\\s*"\\*"[\\s\\S]{0,100}"Resource"\\s*:\\s*"\\*"'
+    message: >
+      IAM policy grants full access (Action: *, Resource: *). Follow least-privilege principle —
+      specify only the actions and resources needed.
+    severity: WARNING
+    languages: [json]
+    metadata:
+      datahogo_id: 224
+      category: cloud
+
+  - id: datahogo-cloud-s3-public
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new s3.Bucket({..., publicReadAccess: true})
+          - pattern: |
+              ACL: "public-read"
+          - pattern: |
+              ACL: "public-read-write"
+    message: >
+      S3 bucket configured with public access. Unless intentionally serving public static assets,
+      buckets should be private with CloudFront or presigned URLs for access.
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 221
+      owasp: "A05:2021"
+      category: cloud