@defai.digital/ax-cli 3.15.21 → 3.15.24

package/dist/analyzers/security/detectors/insecure-random-detector.js

@@ -1,61 +0,0 @@
-/**
- * Insecure Random Detector
- *
- * Detects use of cryptographically weak random number generators
- * OWASP A02:2021 - Cryptographic Failures
- */
-import { BaseSecurityDetector } from '../base-detector.js';
-export class InsecureRandomDetector extends BaseSecurityDetector {
-    constructor() {
-        super({
-            id: 'insecure-random',
-            name: 'Insecure Random Number Generation',
-            description: 'Detects use of Math.random() for security-sensitive operations',
-            severity: 'medium',
-            owaspCategory: 'A02:2021 - Cryptographic Failures',
-            cweId: 'CWE-338',
-        });
-    }
-    async scan(content, filePath) {
-        if (!this.appliesTo(filePath)) {
-            return [];
-        }
-        const vulnerabilities = [];
-        // Pattern: Math.random() used in security contexts
-        const securityContextKeywords = [
-            'token',
-            'secret',
-            'password',
-            'salt',
-            'key',
-            'nonce',
-            'session',
-            'csrf',
-            'auth',
-            'crypto',
-        ];
-        const mathRandomPattern = /Math\.random\(\)/gi;
-        let match;
-        while ((match = mathRandomPattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            // Check surrounding context (100 characters before and after)
-            const contextStart = Math.max(0, match.index - 100);
-            const contextEnd = Math.min(content.length, match.index + 100);
-            const context = content.substring(contextStart, contextEnd).toLowerCase();
-            // Check if in security-sensitive context
-            const isSecurityContext = securityContextKeywords.some(keyword => context.includes(keyword));
-            if (isSecurityContext) {
-                const line = this.findLineNumber(content, match.index);
-                const code = this.extractCodeSnippet(content, match.index, 1);
-                vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Math.random() is not cryptographically secure and should not be used for security-sensitive operations', 'Use crypto.randomBytes() (Node.js) or crypto.getRandomValues() (browser) for cryptographic randomness', [
-                    'https://owasp.org/www-community/vulnerabilities/Insecure_Randomness',
-                    'https://nodejs.org/api/crypto.html#cryptorandombytessize-callback',
-                ]));
-            }
-        }
-        return vulnerabilities;
-    }
-}
-//# sourceMappingURL=insecure-random-detector.js.map

package/dist/analyzers/security/detectors/insecure-random-detector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"insecure-random-detector.js","sourceRoot":"","sources":["../../../../src/analyzers/security/detectors/insecure-random-detector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,sBAAuB,SAAQ,oBAAoB;IAC9D;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,mCAAmC;YACzC,WAAW,EAAE,gEAAgE;YAC7E,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,mCAAmC;YAClD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAA4B,EAAE,CAAC;QAEpD,mDAAmD;QACnD,MAAM,uBAAuB,GAAG;YAC9B,OAAO;YACP,QAAQ;YACR,UAAU;YACV,MAAM;YACN,KAAK;YACL,OAAO;YACP,SAAS;YACT,MAAM;YACN,MAAM;YACN,QAAQ;SACT,CAAC;QAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;QAC/C,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,8DAA8D;YAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;YAE1E,yCAAyC;YACzC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC1B,CAAC;YAEF,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,wGAAwG,EACxG,uGAAuG,EACvG;oBACE,qEAAqE;oBACrE,mEAAmE;iBACpE,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;CACF"}

package/dist/analyzers/security/detectors/path-traversal-detector.d.ts

@@ -1,12 +0,0 @@
-/**
- * Path Traversal Detector
- *
- * Detects potential path traversal vulnerabilities
- * OWASP A01:2021 - Broken Access Control
- */
-import { BaseSecurityDetector } from '../base-detector.js';
-import type { SecurityVulnerability } from '../types.js';
-export declare class PathTraversalDetector extends BaseSecurityDetector {
-    constructor();
-    scan(content: string, filePath: string): Promise<SecurityVulnerability[]>;
-}

package/dist/analyzers/security/detectors/path-traversal-detector.js

@@ -1,82 +0,0 @@
-/**
- * Path Traversal Detector
- *
- * Detects potential path traversal vulnerabilities
- * OWASP A01:2021 - Broken Access Control
- */
-import { BaseSecurityDetector } from '../base-detector.js';
-export class PathTraversalDetector extends BaseSecurityDetector {
-    constructor() {
-        super({
-            id: 'path-traversal',
-            name: 'Path Traversal',
-            description: 'Detects potential path traversal vulnerabilities',
-            severity: 'high',
-            owaspCategory: 'A01:2021 - Broken Access Control',
-            cweId: 'CWE-22',
-        });
-    }
-    async scan(content, filePath) {
-        if (!this.appliesTo(filePath)) {
-            return [];
-        }
-        const vulnerabilities = [];
-        // Pattern 1: File operations with user input
-        const fileOpPatterns = [
-            {
-                pattern: /(?:readFile|writeFile|unlink|stat|access|open)\([^)]*(?:req\.|params\.|query\.|input|user)/gi,
-                operation: 'file operation',
-            },
-            {
-                pattern: /(?:fs\.|promises\.)(?:readFile|writeFile|unlink|stat|access|open)\([^)]*(?:req\.|params\.|query\.|input|user)/gi,
-                operation: 'file system operation',
-            },
-            {
-                pattern: /path\.join\([^)]*(?:req\.|params\.|query\.|input|user)/gi,
-                operation: 'path concatenation',
-            },
-        ];
-        for (const { pattern, operation } of fileOpPatterns) {
-            let match;
-            const regex = new RegExp(pattern);
-            while ((match = regex.exec(content)) !== null) {
-                if (this.shouldIgnore(content, match.index)) {
-                    continue;
-                }
-                const line = this.findLineNumber(content, match.index);
-                const code = this.extractCodeSnippet(content, match.index, 1);
-                vulnerabilities.push(this.createVulnerability(filePath, line, code, `${operation} uses user input which may lead to path traversal attacks`, 'Validate and sanitize file paths. Use path.resolve() and check if resolved path is within allowed directory', [
-                    'https://owasp.org/www-community/attacks/Path_Traversal',
-                    'https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html',
-                ]));
-            }
-        }
-        // Pattern 2: Direct string concatenation for file paths
-        const pathConcatPattern = /['"`][./\\]*['"`]\s*\+\s*(?:req\.|params\.|query\.|input|user)/gi;
-        let match;
-        while ((match = pathConcatPattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            const line = this.findLineNumber(content, match.index);
-            const code = this.extractCodeSnippet(content, match.index, 1);
-            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'File path constructed using string concatenation with user input', 'Never concatenate user input directly into file paths. Use path.join() with validation', [
-                'https://owasp.org/www-community/attacks/Path_Traversal',
-            ]));
-        }
-        // Pattern 3: Template literals with user input in file paths
-        const templatePathPattern = /(?:readFile|writeFile|unlink|stat|access|open)\([`'][^`']*\$\{(?:req\.|params\.|query\.|input|user)/gi;
-        while ((match = templatePathPattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            const line = this.findLineNumber(content, match.index);
-            const code = this.extractCodeSnippet(content, match.index, 1);
-            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'File path uses template literal with user input', 'Validate and sanitize file paths. Ensure path stays within allowed directory', [
-                'https://owasp.org/www-community/attacks/Path_Traversal',
-            ]));
-        }
-        return vulnerabilities;
-    }
-}
-//# sourceMappingURL=path-traversal-detector.js.map

package/dist/analyzers/security/detectors/path-traversal-detector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-traversal-detector.js","sourceRoot":"","sources":["../../../../src/analyzers/security/detectors/path-traversal-detector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,qBAAsB,SAAQ,oBAAoB;IAC7D;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,kDAAkD;YAC/D,QAAQ,EAAE,MAAM;YAChB,aAAa,EAAE,kCAAkC;YACjD,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAA4B,EAAE,CAAC;QAEpD,6CAA6C;QAC7C,MAAM,cAAc,GAAG;YACrB;gBACE,OAAO,EAAE,8FAA8F;gBACvG,SAAS,EAAE,gBAAgB;aAC5B;YACD;gBACE,OAAO,EAAE,iHAAiH;gBAC1H,SAAS,EAAE,uBAAuB;aACnC;YACD;gBACE,OAAO,EAAE,0DAA0D;gBACnE,SAAS,EAAE,oBAAoB;aAChC;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,cAAc,EAAE,CAAC;YACpD,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,GAAG,SAAS,2DAA2D,EACvE,6GAA6G,EAC7G;oBACE,wDAAwD;oBACxD,kFAAkF;iBACnF,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,MAAM,iBAAiB,GAAG,kEAAkE,CAAC;QAC7F,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,kEAAkE,EAClE,wFAAwF,EACxF;gBACE,wDAAwD;aACzD,CACF,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,mBAAmB,GAAG,uGAAuG,CAAC;QACpI,OAAO,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,iDAAiD,EACjD,8EAA8E,EAC9E;gBACE,wDAAwD;aACzD,CACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;CACF"}

package/dist/analyzers/security/detectors/sql-injection-detector.d.ts

@@ -1,12 +0,0 @@
-/**
- * SQL Injection Detector
- *
- * Detects potential SQL injection vulnerabilities
- * OWASP A03:2021 - Injection
- */
-import { BaseSecurityDetector } from '../base-detector.js';
-import type { SecurityVulnerability } from '../types.js';
-export declare class SQLInjectionDetector extends BaseSecurityDetector {
-    constructor();
-    scan(content: string, filePath: string): Promise<SecurityVulnerability[]>;
-}

package/dist/analyzers/security/detectors/sql-injection-detector.js

@@ -1,88 +0,0 @@
-/**
- * SQL Injection Detector
- *
- * Detects potential SQL injection vulnerabilities
- * OWASP A03:2021 - Injection
- */
-import { BaseSecurityDetector } from '../base-detector.js';
-export class SQLInjectionDetector extends BaseSecurityDetector {
-    constructor() {
-        super({
-            id: 'sql-injection',
-            name: 'SQL Injection',
-            description: 'Detects potential SQL injection vulnerabilities',
-            severity: 'critical',
-            owaspCategory: 'A03:2021 - Injection',
-            cweId: 'CWE-89',
-        });
-    }
-    async scan(content, filePath) {
-        if (!this.appliesTo(filePath)) {
-            return [];
-        }
-        const vulnerabilities = [];
-        // Pattern 1: String concatenation in SQL queries
-        const concatPatterns = [
-            /(?:query|sql|execute|exec)\s*(?:=|:)\s*['"`][\s\S]*?\$\{[^}]+\}/gi,
-            /(?:query|sql|execute|exec)\s*(?:=|:)\s*['"`][\s\S]*?\+\s*\w+/gi,
-            /(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE)[\s\S]*?\+\s*\w+/gi,
-        ];
-        for (const pattern of concatPatterns) {
-            let match;
-            const regex = new RegExp(pattern);
-            while ((match = regex.exec(content)) !== null) {
-                if (this.shouldIgnore(content, match.index)) {
-                    continue;
-                }
-                const line = this.findLineNumber(content, match.index);
-                const code = this.extractCodeSnippet(content, match.index, 1);
-                vulnerabilities.push(this.createVulnerability(filePath, line, code, 'SQL query uses string concatenation which may lead to SQL injection', 'Use parameterized queries or prepared statements instead of string concatenation', [
-                    'https://owasp.org/www-community/attacks/SQL_Injection',
-                    'https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html',
-                ]));
-            }
-        }
-        // Pattern 2: Direct use of user input in queries
-        const userInputPatterns = [
-            /(?:query|sql|execute|exec)\s*(?:=|:)\s*['"`][\s\S]*?(?:req\.body|req\.query|req\.params|params|input|userInput)/gi,
-            /(?:SELECT|INSERT|UPDATE|DELETE)[\s\S]{0,100}(?:req\.body|req\.query|req\.params|params|input)/gi,
-        ];
-        for (const pattern of userInputPatterns) {
-            let match;
-            const regex = new RegExp(pattern);
-            while ((match = regex.exec(content)) !== null) {
-                if (this.shouldIgnore(content, match.index)) {
-                    continue;
-                }
-                const line = this.findLineNumber(content, match.index);
-                const code = this.extractCodeSnippet(content, match.index, 1);
-                vulnerabilities.push(this.createVulnerability(filePath, line, code, 'SQL query directly uses user input without sanitization', 'Always sanitize and validate user input. Use parameterized queries or ORM methods', [
-                    'https://owasp.org/www-community/attacks/SQL_Injection',
-                    'https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html',
-                ]));
-            }
-        }
-        // Pattern 3: Unsafe query execution methods
-        const unsafeMethodPatterns = [
-            /\.query\(['"`][^'"`]*\$\{/gi,
-            /\.exec\(['"`][^'"`]*\$\{/gi,
-            /\.raw\(['"`][^'"`]*\$\{/gi,
-        ];
-        for (const pattern of unsafeMethodPatterns) {
-            let match;
-            const regex = new RegExp(pattern);
-            while ((match = regex.exec(content)) !== null) {
-                if (this.shouldIgnore(content, match.index)) {
-                    continue;
-                }
-                const line = this.findLineNumber(content, match.index);
-                const code = this.extractCodeSnippet(content, match.index, 1);
-                vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Database method uses template literals which may be vulnerable to SQL injection', 'Use parameterized queries with placeholders (?, $1, etc.) instead of template literals', [
-                    'https://owasp.org/www-community/attacks/SQL_Injection',
-                ]));
-            }
-        }
-        return vulnerabilities;
-    }
-}
-//# sourceMappingURL=sql-injection-detector.js.map

package/dist/analyzers/security/detectors/sql-injection-detector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sql-injection-detector.js","sourceRoot":"","sources":["../../../../src/analyzers/security/detectors/sql-injection-detector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,oBAAqB,SAAQ,oBAAoB;IAC5D;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,iDAAiD;YAC9D,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,sBAAsB;YACrC,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAA4B,EAAE,CAAC;QAEpD,iDAAiD;QACjD,MAAM,cAAc,GAAG;YACrB,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;SAChE,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,qEAAqE,EACrE,kFAAkF,EAClF;oBACE,uDAAuD;oBACvD,0FAA0F;iBAC3F,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,iBAAiB,GAAG;YACxB,mHAAmH;YACnH,iGAAiG;SAClG,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,yDAAyD,EACzD,mFAAmF,EACnF;oBACE,uDAAuD;oBACvD,kFAAkF;iBACnF,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,MAAM,oBAAoB,GAAG;YAC3B,6BAA6B;YAC7B,4BAA4B;YAC5B,2BAA2B;SAC5B,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,iFAAiF,EACjF,wFAAwF,EACxF;oBACE,uDAAuD;iBACxD,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;CACF"}

package/dist/analyzers/security/detectors/weak-crypto-detector.d.ts

@@ -1,12 +0,0 @@
-/**
- * Weak Cryptography Detector
- *
- * Detects use of weak or deprecated cryptographic algorithms
- * OWASP A02:2021 - Cryptographic Failures
- */
-import { BaseSecurityDetector } from '../base-detector.js';
-import type { SecurityVulnerability } from '../types.js';
-export declare class WeakCryptoDetector extends BaseSecurityDetector {
-    constructor();
-    scan(content: string, filePath: string): Promise<SecurityVulnerability[]>;
-}

package/dist/analyzers/security/detectors/weak-crypto-detector.js

@@ -1,104 +0,0 @@
-/**
- * Weak Cryptography Detector
- *
- * Detects use of weak or deprecated cryptographic algorithms
- * OWASP A02:2021 - Cryptographic Failures
- */
-import { BaseSecurityDetector } from '../base-detector.js';
-export class WeakCryptoDetector extends BaseSecurityDetector {
-    constructor() {
-        super({
-            id: 'weak-cryptography',
-            name: 'Weak Cryptography',
-            description: 'Detects use of weak or deprecated cryptographic algorithms',
-            severity: 'high',
-            owaspCategory: 'A02:2021 - Cryptographic Failures',
-            cweId: 'CWE-327',
-        });
-    }
-    async scan(content, filePath) {
-        if (!this.appliesTo(filePath)) {
-            return [];
-        }
-        const vulnerabilities = [];
-        // Pattern 1: Weak hashing algorithms
-        const weakHashAlgorithms = ['md5', 'sha1', 'md4', 'md2'];
-        for (const algorithm of weakHashAlgorithms) {
-            const pattern = new RegExp(`createHash\\(['"\`]${algorithm}['"\`]\\)`, 'gi');
-            let match;
-            while ((match = pattern.exec(content)) !== null) {
-                if (this.shouldIgnore(content, match.index)) {
-                    continue;
-                }
-                const line = this.findLineNumber(content, match.index);
-                const code = this.extractCodeSnippet(content, match.index, 1);
-                vulnerabilities.push(this.createVulnerability(filePath, line, code, `Weak hashing algorithm ${algorithm.toUpperCase()} detected`, `Use SHA-256, SHA-384, or SHA-512 instead of ${algorithm.toUpperCase()}`, [
-                    'https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/',
-                    'https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html',
-                ]));
-            }
-        }
-        // Pattern 2: Weak cipher algorithms
-        const weakCipherAlgorithms = ['des', 'des-ede', 'des-ede-cbc', 'des3', 'rc4', 'rc2', 'blowfish'];
-        for (const algorithm of weakCipherAlgorithms) {
-            const pattern = new RegExp(`createCipher(?:iv)?\\(['"\`]${algorithm}['"\`]`, 'gi');
-            let match;
-            while ((match = pattern.exec(content)) !== null) {
-                if (this.shouldIgnore(content, match.index)) {
-                    continue;
-                }
-                const line = this.findLineNumber(content, match.index);
-                const code = this.extractCodeSnippet(content, match.index, 1);
-                vulnerabilities.push(this.createVulnerability(filePath, line, code, `Weak cipher algorithm ${algorithm.toUpperCase()} detected`, 'Use AES-256-GCM or ChaCha20-Poly1305 for encryption', [
-                    'https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/',
-                ]));
-            }
-        }
-        // Pattern 3: ECB mode (insecure block cipher mode)
-        const ecbPattern = /createCipher(?:iv)?\(['"`][^'"`]*-ecb['"`]/gi;
-        let match;
-        while ((match = ecbPattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            const line = this.findLineNumber(content, match.index);
-            const code = this.extractCodeSnippet(content, match.index, 1);
-            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'ECB mode is insecure and should not be used', 'Use GCM or CBC mode with proper IV instead of ECB', [
-                'https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/',
-            ]));
-        }
-        // Pattern 4: Deprecated createCipher (should use createCipheriv)
-        const createCipherPattern = /createCipher\(/g;
-        while ((match = createCipherPattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            // Check if it's not createCipheriv
-            const afterMatch = content.substring(match.index, match.index + 20);
-            if (!afterMatch.includes('createCipheriv')) {
-                const line = this.findLineNumber(content, match.index);
-                const code = this.extractCodeSnippet(content, match.index, 1);
-                vulnerabilities.push(this.createVulnerability(filePath, line, code, 'createCipher is deprecated and insecure', 'Use createCipheriv with a random IV instead', [
-                    'https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options',
-                ]));
-            }
-        }
-        // Pattern 5: Small RSA key sizes
-        const rsaKeyPattern = /(?:modulusLength|keySize)['"\s:]*(\d+)/gi;
-        while ((match = rsaKeyPattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            const keySize = parseInt(match[1], 10);
-            if (keySize < 2048) {
-                const line = this.findLineNumber(content, match.index);
-                const code = this.extractCodeSnippet(content, match.index, 1);
-                vulnerabilities.push(this.createVulnerability(filePath, line, code, `RSA key size of ${keySize} bits is too small`, 'Use at least 2048 bits for RSA keys, preferably 4096 bits', [
-                    'https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html',
-                ]));
-            }
-        }
-        return vulnerabilities;
-    }
-}
-//# sourceMappingURL=weak-crypto-detector.js.map

package/dist/analyzers/security/detectors/weak-crypto-detector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"weak-crypto-detector.js","sourceRoot":"","sources":["../../../../src/analyzers/security/detectors/weak-crypto-detector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,kBAAmB,SAAQ,oBAAoB;IAC1D;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,4DAA4D;YACzE,QAAQ,EAAE,MAAM;YAChB,aAAa,EAAE,mCAAmC;YAClD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAA4B,EAAE,CAAC;QAEpD,qCAAqC;QACrC,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,sBAAsB,SAAS,WAAW,EAAE,IAAI,CAAC,CAAC;YAC7E,IAAI,KAAK,CAAC;YAEV,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,0BAA0B,SAAS,CAAC,WAAW,EAAE,WAAW,EAC5D,+CAA+C,SAAS,CAAC,WAAW,EAAE,EAAE,EACxE;oBACE,sIAAsI;oBACtI,uFAAuF;iBACxF,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACjG,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,+BAA+B,SAAS,QAAQ,EAAE,IAAI,CAAC,CAAC;YACnF,IAAI,KAAK,CAAC;YAEV,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,yBAAyB,SAAS,CAAC,WAAW,EAAE,WAAW,EAC3D,qDAAqD,EACrD;oBACE,sIAAsI;iBACvI,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,MAAM,UAAU,GAAG,8CAA8C,CAAC;QAClE,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,6CAA6C,EAC7C,mDAAmD,EACnD;gBACE,sIAAsI;aACvI,CACF,CACF,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;QAC9C,OAAO,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,mCAAmC;YACnC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,yCAAyC,EACzC,6CAA6C,EAC7C;oBACE,iFAAiF;iBAClF,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,aAAa,GAAG,0CAA0C,CAAC;QACjE,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,mBAAmB,OAAO,oBAAoB,EAC9C,2DAA2D,EAC3D;oBACE,uFAAuF;iBACxF,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;CACF"}

package/dist/analyzers/security/detectors/xss-detector.d.ts

@@ -1,12 +0,0 @@
-/**
- * XSS (Cross-Site Scripting) Detector
- *
- * Detects potential XSS vulnerabilities
- * OWASP A03:2021 - Injection
- */
-import { BaseSecurityDetector } from '../base-detector.js';
-import type { SecurityVulnerability } from '../types.js';
-export declare class XSSDetector extends BaseSecurityDetector {
-    constructor();
-    scan(content: string, filePath: string): Promise<SecurityVulnerability[]>;
-}

package/dist/analyzers/security/detectors/xss-detector.js

@@ -1,90 +0,0 @@
-/**
- * XSS (Cross-Site Scripting) Detector
- *
- * Detects potential XSS vulnerabilities
- * OWASP A03:2021 - Injection
- */
-import { BaseSecurityDetector } from '../base-detector.js';
-export class XSSDetector extends BaseSecurityDetector {
-    constructor() {
-        super({
-            id: 'xss-vulnerability',
-            name: 'Cross-Site Scripting (XSS)',
-            description: 'Detects potential XSS vulnerabilities',
-            severity: 'high',
-            owaspCategory: 'A03:2021 - Injection',
-            cweId: 'CWE-79',
-        });
-    }
-    async scan(content, filePath) {
-        if (!this.appliesTo(filePath)) {
-            return [];
-        }
-        const vulnerabilities = [];
-        // Pattern 1: dangerouslySetInnerHTML in React
-        const dangerouslySetInnerHTMLPattern = /dangerouslySetInnerHTML\s*=\s*\{\{?\s*__html:\s*(?!['"`])[^}]+\}\}?/gi;
-        let match;
-        while ((match = dangerouslySetInnerHTMLPattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            const line = this.findLineNumber(content, match.index);
-            const code = this.extractCodeSnippet(content, match.index, 1);
-            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Using dangerouslySetInnerHTML with unsanitized content may lead to XSS', 'Sanitize HTML content using a library like DOMPurify before rendering', [
-                'https://owasp.org/www-community/attacks/xss/',
-                'https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html',
-            ]));
-        }
-        // Pattern 2: innerHTML assignment
-        const innerHTMLPattern = /\.innerHTML\s*=\s*(?!['"`])[^;]+/gi;
-        while ((match = innerHTMLPattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            const line = this.findLineNumber(content, match.index);
-            const code = this.extractCodeSnippet(content, match.index, 1);
-            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Direct innerHTML assignment with dynamic content may lead to XSS', 'Use textContent for text or sanitize HTML before assignment', [
-                'https://owasp.org/www-community/attacks/xss/',
-                'https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html',
-            ]));
-        }
-        // Pattern 3: document.write with user input
-        const documentWritePattern = /document\.write\([^)]*(?:req\.|params\.|input|user|query)/gi;
-        while ((match = documentWritePattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            const line = this.findLineNumber(content, match.index);
-            const code = this.extractCodeSnippet(content, match.index, 1);
-            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'document.write with user input may lead to XSS', 'Avoid document.write. Use DOM manipulation methods and sanitize input', [
-                'https://owasp.org/www-community/attacks/xss/',
-            ]));
-        }
-        // Pattern 4: eval() with user input
-        const evalPattern = /eval\([^)]*(?:req\.|params\.|input|user|query)/gi;
-        while ((match = evalPattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            const line = this.findLineNumber(content, match.index);
-            const code = this.extractCodeSnippet(content, match.index, 1);
-            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'eval() with user input is extremely dangerous and may lead to code injection', 'Never use eval() with user input. Find alternative solutions', [
-                'https://owasp.org/www-community/attacks/Code_Injection',
-            ]));
-        }
-        // Pattern 5: Unescaped template rendering (Express, etc.)
-        const unescapedRenderPattern = /res\.send\([^)]*\$\{(?:req\.|params\.|input|user|query)/gi;
-        while ((match = unescapedRenderPattern.exec(content)) !== null) {
-            if (this.shouldIgnore(content, match.index)) {
-                continue;
-            }
-            const line = this.findLineNumber(content, match.index);
-            const code = this.extractCodeSnippet(content, match.index, 1);
-            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Sending unescaped user input in response may lead to XSS', 'Escape HTML entities or use a templating engine with auto-escaping', [
-                'https://owasp.org/www-community/attacks/xss/',
-            ]));
-        }
-        return vulnerabilities;
-    }
-}
-//# sourceMappingURL=xss-detector.js.map

package/dist/analyzers/security/detectors/xss-detector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"xss-detector.js","sourceRoot":"","sources":["../../../../src/analyzers/security/detectors/xss-detector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,WAAY,SAAQ,oBAAoB;IACnD;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,4BAA4B;YAClC,WAAW,EAAE,uCAAuC;YACpD,QAAQ,EAAE,MAAM;YAChB,aAAa,EAAE,sBAAsB;YACrC,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAA4B,EAAE,CAAC;QAEpD,8CAA8C;QAC9C,MAAM,8BAA8B,GAAG,uEAAuE,CAAC;QAC/G,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACvE,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,wEAAwE,EACxE,uEAAuE,EACvE;gBACE,8CAA8C;gBAC9C,4FAA4F;aAC7F,CACF,CACF,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;QAC9D,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,kEAAkE,EAClE,6DAA6D,EAC7D;gBACE,8CAA8C;gBAC9C,0FAA0F;aAC3F,CACF,CACF,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,MAAM,oBAAoB,GAAG,6DAA6D,CAAC;QAC3F,OAAO,CAAC,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,gDAAgD,EAChD,uEAAuE,EACvE;gBACE,8CAA8C;aAC/C,CACF,CACF,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,WAAW,GAAG,kDAAkD,CAAC;QACvE,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,8EAA8E,EAC9E,8DAA8D,EAC9D;gBACE,wDAAwD;aACzD,CACF,CACF,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,MAAM,sBAAsB,GAAG,2DAA2D,CAAC;QAC3F,OAAO,CAAC,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,0DAA0D,EAC1D,oEAAoE,EACpE;gBACE,8CAA8C;aAC/C,CACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;CACF"}

package/dist/analyzers/security/index.d.ts

@@ -1,16 +0,0 @@
-/**
- * Security Analyzer Module
- *
- * Provides security vulnerability detection with OWASP-aligned detectors
- */
-export { SecurityAnalyzer } from './security-analyzer.js';
-export { BaseSecurityDetector } from './base-detector.js';
-export * from './types.js';
-export { SQLInjectionDetector } from './detectors/sql-injection-detector.js';
-export { XSSDetector } from './detectors/xss-detector.js';
-export { HardcodedSecretsDetector } from './detectors/hardcoded-secrets-detector.js';
-export { InsecureRandomDetector } from './detectors/insecure-random-detector.js';
-export { PathTraversalDetector } from './detectors/path-traversal-detector.js';
-export { CommandInjectionDetector } from './detectors/command-injection-detector.js';
-export { WeakCryptoDetector } from './detectors/weak-crypto-detector.js';
-export { InsecureDeserializationDetector } from './detectors/insecure-deserialization-detector.js';

package/dist/analyzers/security/index.js

@@ -1,18 +0,0 @@
-/**
- * Security Analyzer Module
- *
- * Provides security vulnerability detection with OWASP-aligned detectors
- */
-export { SecurityAnalyzer } from './security-analyzer.js';
-export { BaseSecurityDetector } from './base-detector.js';
-export * from './types.js';
-// Export all detectors
-export { SQLInjectionDetector } from './detectors/sql-injection-detector.js';
-export { XSSDetector } from './detectors/xss-detector.js';
-export { HardcodedSecretsDetector } from './detectors/hardcoded-secrets-detector.js';
-export { InsecureRandomDetector } from './detectors/insecure-random-detector.js';
-export { PathTraversalDetector } from './detectors/path-traversal-detector.js';
-export { CommandInjectionDetector } from './detectors/command-injection-detector.js';
-export { WeakCryptoDetector } from './detectors/weak-crypto-detector.js';
-export { InsecureDeserializationDetector } from './detectors/insecure-deserialization-detector.js';
-//# sourceMappingURL=index.js.map

package/dist/analyzers/security/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyzers/security/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,cAAc,YAAY,CAAC;AAE3B,uBAAuB;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,kDAAkD,CAAC"}

package/dist/analyzers/security/security-analyzer.d.ts

@@ -1,38 +0,0 @@
-/**
- * Security Analyzer
- *
- * Main orchestrator for security vulnerability detection
- */
-import type { SecurityDetector, FileSecurityResult, BatchSecurityResult, SecurityScanOptions } from './types.js';
-export declare class SecurityAnalyzer {
-    private detectors;
-    constructor();
-    /**
-     * Register all default security detectors
-     */
-    private registerDefaultDetectors;
-    /**
-     * Scan a single file for security vulnerabilities
-     */
-    scanFile(filePath: string, options?: SecurityScanOptions): Promise<FileSecurityResult>;
-    /**
-     * Scan multiple files in batch
-     */
-    scanBatch(files: string[], options?: SecurityScanOptions): Promise<BatchSecurityResult>;
-    /**
-     * Scan directory with pattern
-     */
-    scanDirectory(directory: string, pattern?: string, options?: SecurityScanOptions): Promise<BatchSecurityResult>;
-    /**
-     * Calculate risk score for a file based on vulnerabilities
-     */
-    private calculateRiskScore;
-    /**
-     * Get list of all registered detectors
-     */
-    getDetectors(): SecurityDetector[];
-    /**
-     * Get detector by ID
-     */
-    getDetector(id: string): SecurityDetector | undefined;
-}