@defai.digital/ax-cli 3.4.6 → 3.5.4

package/dist/analyzers/security/detectors/hardcoded-secrets-detector.js

@@ -0,0 +1,140 @@
+/**
+ * Hardcoded Secrets Detector
+ *
+ * Detects hardcoded passwords, API keys, tokens, and other secrets
+ * OWASP A02:2021 - Cryptographic Failures
+ */
+import { BaseSecurityDetector } from '../base-detector.js';
+export class HardcodedSecretsDetector extends BaseSecurityDetector {
+    constructor() {
+        super({
+            id: 'hardcoded-secrets',
+            name: 'Hardcoded Secrets',
+            description: 'Detects hardcoded passwords, API keys, and tokens',
+            severity: 'critical',
+            owaspCategory: 'A02:2021 - Cryptographic Failures',
+            cweId: 'CWE-798',
+        });
+    }
+    async scan(content, filePath) {
+        if (!this.appliesTo(filePath)) {
+            return [];
+        }
+        const vulnerabilities = [];
+        // Pattern 1: Common secret variable names with hardcoded values
+        const secretVarPatterns = [
+            {
+                pattern: /(?:password|passwd|pwd|secret|token|apikey|api_key|private_key|privatekey)\s*[:=]\s*['"`]([^'"`]{8,})['"`]/gi,
+                type: 'password/token',
+            },
+            {
+                pattern: /(?:auth|authorization|bearer)\s*[:=]\s*['"`]([^'"`]{20,})['"`]/gi,
+                type: 'auth token',
+            },
+            {
+                pattern: /(?:access_token|accesstoken|refresh_token|refreshtoken)\s*[:=]\s*['"`]([^'"`]{20,})['"`]/gi,
+                type: 'access token',
+            },
+        ];
+        for (const { pattern, type } of secretVarPatterns) {
+            let match;
+            const regex = new RegExp(pattern);
+            while ((match = regex.exec(content)) !== null) {
+                if (this.shouldIgnore(content, match.index)) {
+                    continue;
+                }
+                // Skip if it looks like a placeholder
+                const value = match[1];
+                if (this.isPlaceholder(value)) {
+                    continue;
+                }
+                const line = this.findLineNumber(content, match.index);
+                const code = this.extractCodeSnippet(content, match.index, 0);
+                vulnerabilities.push(this.createVulnerability(filePath, line, code, `Hardcoded ${type} detected in source code`, 'Use environment variables or secure secret management systems (e.g., AWS Secrets Manager, HashiCorp Vault)', [
+                    'https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password',
+                    'https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html',
+                ]));
+            }
+        }
+        // Pattern 2: AWS Access Keys
+        const awsKeyPattern = /(?:AKIA|A3T|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}/g;
+        let match;
+        while ((match = awsKeyPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            const line = this.findLineNumber(content, match.index);
+            const code = this.extractCodeSnippet(content, match.index, 0);
+            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'AWS Access Key ID detected in source code', 'Remove hardcoded AWS credentials. Use IAM roles or environment variables', [
+                'https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html',
+            ]));
+        }
+        // Pattern 3: Generic API key patterns
+        const apiKeyPattern = /['"`]([a-zA-Z0-9_-]{32,})['"`]/g;
+        while ((match = apiKeyPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            // Check if preceded by key-related variable names
+            const beforeMatch = content.substring(Math.max(0, match.index - 50), match.index);
+            if (/(?:key|token|secret|api)/i.test(beforeMatch)) {
+                const value = match[1];
+                if (this.isPlaceholder(value)) {
+                    continue;
+                }
+                const line = this.findLineNumber(content, match.index);
+                const code = this.extractCodeSnippet(content, match.index, 0);
+                vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Potential API key or token detected in source code', 'Use environment variables to store sensitive credentials', [
+                    'https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html',
+                ]));
+            }
+        }
+        // Pattern 4: JWT tokens
+        const jwtPattern = /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g;
+        while ((match = jwtPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            const line = this.findLineNumber(content, match.index);
+            const code = this.extractCodeSnippet(content, match.index, 0);
+            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'JWT token detected in source code', 'Never hardcode JWT tokens. Generate them at runtime', [
+                'https://jwt.io/introduction',
+            ]));
+        }
+        // Pattern 5: Database connection strings
+        const dbConnectionPattern = /(?:mongodb|mysql|postgresql|postgres|redis):\/\/[^\s;'"]+:[^\s;'"]+@/gi;
+        while ((match = dbConnectionPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            const line = this.findLineNumber(content, match.index);
+            const code = this.extractCodeSnippet(content, match.index, 0);
+            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Database connection string with credentials detected in source code', 'Use environment variables for database credentials', [
+                'https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html',
+            ]));
+        }
+        return vulnerabilities;
+    }
+    /**
+     * Check if value looks like a placeholder
+     */
+    isPlaceholder(value) {
+        const placeholders = [
+            /^[xX]+$/,
+            /^[*]+$/,
+            /^your[_-]?/i,
+            /^test[_-]?/i,
+            /^example/i,
+            /^placeholder/i,
+            /^dummy/i,
+            /^fake/i,
+            /^sample/i,
+            /^xxx/i,
+            /^todo/i,
+            /^changeme/i,
+            /^replace/i,
+        ];
+        return placeholders.some(pattern => pattern.test(value));
+    }
+}
+//# sourceMappingURL=hardcoded-secrets-detector.js.map

package/dist/analyzers/security/detectors/hardcoded-secrets-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-secrets-detector.js","sourceRoot":"","sources":["../../../../src/analyzers/security/detectors/hardcoded-secrets-detector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,wBAAyB,SAAQ,oBAAoB;IAChE;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,mDAAmD;YAChE,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,mCAAmC;YAClD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAA4B,EAAE,CAAC;QAEpD,gEAAgE;QAChE,MAAM,iBAAiB,GAAG;YACxB;gBACE,OAAO,EAAE,8GAA8G;gBACvH,IAAI,EAAE,gBAAgB;aACvB;YACD;gBACE,OAAO,EAAE,kEAAkE;gBAC3E,IAAI,EAAE,YAAY;aACnB;YACD;gBACE,OAAO,EAAE,4FAA4F;gBACrG,IAAI,EAAE,cAAc;aACrB;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,iBAAiB,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,sCAAsC;gBACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,aAAa,IAAI,0BAA0B,EAC3C,4GAA4G,EAC5G;oBACE,4EAA4E;oBAC5E,oFAAoF;iBACrF,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,aAAa,GAAG,8DAA8D,CAAC;QACrF,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,2CAA2C,EAC3C,0EAA0E,EAC1E;gBACE,kFAAkF;aACnF,CACF,CACF,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,MAAM,aAAa,GAAG,iCAAiC,CAAC;QACxD,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,kDAAkD;YAClD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAClF,IAAI,2BAA2B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,oDAAoD,EACpD,0DAA0D,EAC1D;oBACE,oFAAoF;iBACrF,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,MAAM,UAAU,GAAG,uDAAuD,CAAC;QAC3E,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,mCAAmC,EACnC,qDAAqD,EACrD;gBACE,6BAA6B;aAC9B,CACF,CACF,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,MAAM,mBAAmB,GAAG,wEAAwE,CAAC;QACrG,OAAO,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,qEAAqE,EACrE,oDAAoD,EACpD;gBACE,mFAAmF;aACpF,CACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,KAAa;QACjC,MAAM,YAAY,GAAG;YACnB,SAAS;YACT,QAAQ;YACR,aAAa;YACb,aAAa;YACb,WAAW;YACX,eAAe;YACf,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,QAAQ;YACR,YAAY;YACZ,WAAW;SACZ,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/analyzers/security/detectors/insecure-deserialization-detector.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Insecure Deserialization Detector
+ *
+ * Detects insecure deserialization vulnerabilities
+ * OWASP A08:2021 - Software and Data Integrity Failures
+ */
+import { BaseSecurityDetector } from '../base-detector.js';
+import type { SecurityVulnerability } from '../types.js';
+export declare class InsecureDeserializationDetector extends BaseSecurityDetector {
+    constructor();
+    scan(content: string, filePath: string): Promise<SecurityVulnerability[]>;
+}

package/dist/analyzers/security/detectors/insecure-deserialization-detector.js

@@ -0,0 +1,109 @@
+/**
+ * Insecure Deserialization Detector
+ *
+ * Detects insecure deserialization vulnerabilities
+ * OWASP A08:2021 - Software and Data Integrity Failures
+ */
+import { BaseSecurityDetector } from '../base-detector.js';
+export class InsecureDeserializationDetector extends BaseSecurityDetector {
+    constructor() {
+        super({
+            id: 'insecure-deserialization',
+            name: 'Insecure Deserialization',
+            description: 'Detects insecure deserialization vulnerabilities',
+            severity: 'high',
+            owaspCategory: 'A08:2021 - Software and Data Integrity Failures',
+            cweId: 'CWE-502',
+        });
+    }
+    async scan(content, filePath) {
+        if (!this.appliesTo(filePath)) {
+            return [];
+        }
+        const vulnerabilities = [];
+        // Pattern 1: JSON.parse with user input without validation
+        const jsonParsePattern = /JSON\.parse\((?:req\.|params\.|query\.|input|user)[^)]+\)/gi;
+        let match;
+        while ((match = jsonParsePattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            const line = this.findLineNumber(content, match.index);
+            const code = this.extractCodeSnippet(content, match.index, 1);
+            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'JSON.parse with user input without validation may lead to prototype pollution', 'Validate JSON structure after parsing and use Object.create(null) to avoid prototype pollution', [
+                'https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data',
+                'https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html',
+            ]));
+        }
+        // Pattern 2: eval() with JSON (extremely dangerous)
+        const evalJsonPattern = /eval\([^)]*(?:JSON|json|parse)/gi;
+        while ((match = evalJsonPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            const line = this.findLineNumber(content, match.index);
+            const code = this.extractCodeSnippet(content, match.index, 1);
+            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Using eval() for JSON parsing is extremely dangerous', 'Use JSON.parse() instead of eval()', [
+                'https://owasp.org/www-community/attacks/Code_Injection',
+            ]));
+        }
+        // Pattern 3: Node.js serialize packages with user input
+        const serializePackages = ['node-serialize', 'serialize-javascript', 'funcster'];
+        for (const pkg of serializePackages) {
+            const pattern = new RegExp(`require\\(['"\`]${pkg}['"\`]\\)`, 'gi');
+            let pkgMatch;
+            while ((pkgMatch = pattern.exec(content)) !== null) {
+                // Check if there's deserialization with user input nearby
+                const contextStart = pkgMatch.index;
+                const contextEnd = Math.min(content.length, pkgMatch.index + 500);
+                const context = content.substring(contextStart, contextEnd);
+                if (/(?:unserialize|deserialize|parse)\([^)]*(?:req\.|params\.|query\.|input|user)/i.test(context)) {
+                    const line = this.findLineNumber(content, pkgMatch.index);
+                    const code = this.extractCodeSnippet(content, pkgMatch.index, 2);
+                    vulnerabilities.push(this.createVulnerability(filePath, line, code, `Package ${pkg} used for deserialization of user input is dangerous`, 'Avoid deserializing untrusted data. Use JSON.parse() with validation', [
+                        'https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data',
+                    ]));
+                }
+            }
+        }
+        // Pattern 4: Object.assign with user input (prototype pollution)
+        const objectAssignPattern = /Object\.assign\([^,)]*,\s*(?:req\.|params\.|query\.|input|user)/gi;
+        while ((match = objectAssignPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            const line = this.findLineNumber(content, match.index);
+            const code = this.extractCodeSnippet(content, match.index, 1);
+            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Object.assign with user input may lead to prototype pollution', 'Validate and sanitize user input before using Object.assign. Consider using Object.create(null)', [
+                'https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data',
+                'https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html',
+            ]));
+        }
+        // Pattern 5: Spread operator with user input
+        const spreadPattern = /\{\.\.\.(?:req\.|params\.|query\.|input|user)[^}]*\}/gi;
+        while ((match = spreadPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            const line = this.findLineNumber(content, match.index);
+            const code = this.extractCodeSnippet(content, match.index, 1);
+            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Spread operator with user input may lead to prototype pollution', 'Validate user input before spreading. Use allowlist of permitted fields', [
+                'https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html',
+            ]));
+        }
+        // Pattern 6: vm module with user input
+        const vmPattern = /(?:runInContext|runInNewContext|runInThisContext)\([^)]*(?:req\.|params\.|query\.|input|user)/gi;
+        while ((match = vmPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            const line = this.findLineNumber(content, match.index);
+            const code = this.extractCodeSnippet(content, match.index, 1);
+            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'vm module with user input is extremely dangerous', 'Never execute user-provided code. Find alternative solutions', [
+                'https://nodejs.org/api/vm.html#vm_vm_executing_javascript',
+            ]));
+        }
+        return vulnerabilities;
+    }
+}
+//# sourceMappingURL=insecure-deserialization-detector.js.map

package/dist/analyzers/security/detectors/insecure-deserialization-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-deserialization-detector.js","sourceRoot":"","sources":["../../../../src/analyzers/security/detectors/insecure-deserialization-detector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,+BAAgC,SAAQ,oBAAoB;IACvE;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,0BAA0B;YAC9B,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,kDAAkD;YAC/D,QAAQ,EAAE,MAAM;YAChB,aAAa,EAAE,iDAAiD;YAChE,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAA4B,EAAE,CAAC;QAEpD,2DAA2D;QAC3D,MAAM,gBAAgB,GAAG,6DAA6D,CAAC;QACvF,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,+EAA+E,EAC/E,gGAAgG,EAChG;gBACE,mFAAmF;gBACnF,iFAAiF;aAClF,CACF,CACF,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,MAAM,eAAe,GAAG,kCAAkC,CAAC;QAC3D,OAAO,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,sDAAsD,EACtD,oCAAoC,EACpC;gBACE,wDAAwD;aACzD,CACF,CACF,CAAC;QACJ,CAAC;QAED,wDAAwD;QACxD,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,UAAU,CAAC,CAAC;QACjF,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,mBAAmB,GAAG,WAAW,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,QAAQ,CAAC;YAEb,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnD,0DAA0D;gBAC1D,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC;gBACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;gBAClE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;gBAE5D,IAAI,gFAAgF,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnG,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;oBAEjE,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,WAAW,GAAG,sDAAsD,EACpE,sEAAsE,EACtE;wBACE,mFAAmF;qBACpF,CACF,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,MAAM,mBAAmB,GAAG,mEAAmE,CAAC;QAChG,OAAO,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,+DAA+D,EAC/D,iGAAiG,EACjG;gBACE,mFAAmF;gBACnF,gGAAgG;aACjG,CACF,CACF,CAAC;QACJ,CAAC;QAED,6CAA6C;QAC7C,MAAM,aAAa,GAAG,wDAAwD,CAAC;QAC/E,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,iEAAiE,EACjE,yEAAyE,EACzE;gBACE,gGAAgG;aACjG,CACF,CACF,CAAC;QACJ,CAAC;QAED,uCAAuC;QACvC,MAAM,SAAS,GAAG,iGAAiG,CAAC;QACpH,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,kDAAkD,EAClD,8DAA8D,EAC9D;gBACE,2DAA2D;aAC5D,CACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;CACF"}

package/dist/analyzers/security/detectors/insecure-random-detector.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Insecure Random Detector
+ *
+ * Detects use of cryptographically weak random number generators
+ * OWASP A02:2021 - Cryptographic Failures
+ */
+import { BaseSecurityDetector } from '../base-detector.js';
+import type { SecurityVulnerability } from '../types.js';
+export declare class InsecureRandomDetector extends BaseSecurityDetector {
+    constructor();
+    scan(content: string, filePath: string): Promise<SecurityVulnerability[]>;
+}

package/dist/analyzers/security/detectors/insecure-random-detector.js

@@ -0,0 +1,61 @@
+/**
+ * Insecure Random Detector
+ *
+ * Detects use of cryptographically weak random number generators
+ * OWASP A02:2021 - Cryptographic Failures
+ */
+import { BaseSecurityDetector } from '../base-detector.js';
+export class InsecureRandomDetector extends BaseSecurityDetector {
+    constructor() {
+        super({
+            id: 'insecure-random',
+            name: 'Insecure Random Number Generation',
+            description: 'Detects use of Math.random() for security-sensitive operations',
+            severity: 'medium',
+            owaspCategory: 'A02:2021 - Cryptographic Failures',
+            cweId: 'CWE-338',
+        });
+    }
+    async scan(content, filePath) {
+        if (!this.appliesTo(filePath)) {
+            return [];
+        }
+        const vulnerabilities = [];
+        // Pattern: Math.random() used in security contexts
+        const securityContextKeywords = [
+            'token',
+            'secret',
+            'password',
+            'salt',
+            'key',
+            'nonce',
+            'session',
+            'csrf',
+            'auth',
+            'crypto',
+        ];
+        const mathRandomPattern = /Math\.random\(\)/gi;
+        let match;
+        while ((match = mathRandomPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            // Check surrounding context (100 characters before and after)
+            const contextStart = Math.max(0, match.index - 100);
+            const contextEnd = Math.min(content.length, match.index + 100);
+            const context = content.substring(contextStart, contextEnd).toLowerCase();
+            // Check if in security-sensitive context
+            const isSecurityContext = securityContextKeywords.some(keyword => context.includes(keyword));
+            if (isSecurityContext) {
+                const line = this.findLineNumber(content, match.index);
+                const code = this.extractCodeSnippet(content, match.index, 1);
+                vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Math.random() is not cryptographically secure and should not be used for security-sensitive operations', 'Use crypto.randomBytes() (Node.js) or crypto.getRandomValues() (browser) for cryptographic randomness', [
+                    'https://owasp.org/www-community/vulnerabilities/Insecure_Randomness',
+                    'https://nodejs.org/api/crypto.html#cryptorandombytessize-callback',
+                ]));
+            }
+        }
+        return vulnerabilities;
+    }
+}
+//# sourceMappingURL=insecure-random-detector.js.map

package/dist/analyzers/security/detectors/insecure-random-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-random-detector.js","sourceRoot":"","sources":["../../../../src/analyzers/security/detectors/insecure-random-detector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,sBAAuB,SAAQ,oBAAoB;IAC9D;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,mCAAmC;YACzC,WAAW,EAAE,gEAAgE;YAC7E,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,mCAAmC;YAClD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAA4B,EAAE,CAAC;QAEpD,mDAAmD;QACnD,MAAM,uBAAuB,GAAG;YAC9B,OAAO;YACP,QAAQ;YACR,UAAU;YACV,MAAM;YACN,KAAK;YACL,OAAO;YACP,SAAS;YACT,MAAM;YACN,MAAM;YACN,QAAQ;SACT,CAAC;QAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;QAC/C,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,8DAA8D;YAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;YAE1E,yCAAyC;YACzC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC1B,CAAC;YAEF,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,wGAAwG,EACxG,uGAAuG,EACvG;oBACE,qEAAqE;oBACrE,mEAAmE;iBACpE,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;CACF"}

package/dist/analyzers/security/detectors/path-traversal-detector.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Path Traversal Detector
+ *
+ * Detects potential path traversal vulnerabilities
+ * OWASP A01:2021 - Broken Access Control
+ */
+import { BaseSecurityDetector } from '../base-detector.js';
+import type { SecurityVulnerability } from '../types.js';
+export declare class PathTraversalDetector extends BaseSecurityDetector {
+    constructor();
+    scan(content: string, filePath: string): Promise<SecurityVulnerability[]>;
+}

package/dist/analyzers/security/detectors/path-traversal-detector.js

@@ -0,0 +1,82 @@
+/**
+ * Path Traversal Detector
+ *
+ * Detects potential path traversal vulnerabilities
+ * OWASP A01:2021 - Broken Access Control
+ */
+import { BaseSecurityDetector } from '../base-detector.js';
+export class PathTraversalDetector extends BaseSecurityDetector {
+    constructor() {
+        super({
+            id: 'path-traversal',
+            name: 'Path Traversal',
+            description: 'Detects potential path traversal vulnerabilities',
+            severity: 'high',
+            owaspCategory: 'A01:2021 - Broken Access Control',
+            cweId: 'CWE-22',
+        });
+    }
+    async scan(content, filePath) {
+        if (!this.appliesTo(filePath)) {
+            return [];
+        }
+        const vulnerabilities = [];
+        // Pattern 1: File operations with user input
+        const fileOpPatterns = [
+            {
+                pattern: /(?:readFile|writeFile|unlink|stat|access|open)\([^)]*(?:req\.|params\.|query\.|input|user)/gi,
+                operation: 'file operation',
+            },
+            {
+                pattern: /(?:fs\.|promises\.)(?:readFile|writeFile|unlink|stat|access|open)\([^)]*(?:req\.|params\.|query\.|input|user)/gi,
+                operation: 'file system operation',
+            },
+            {
+                pattern: /path\.join\([^)]*(?:req\.|params\.|query\.|input|user)/gi,
+                operation: 'path concatenation',
+            },
+        ];
+        for (const { pattern, operation } of fileOpPatterns) {
+            let match;
+            const regex = new RegExp(pattern);
+            while ((match = regex.exec(content)) !== null) {
+                if (this.shouldIgnore(content, match.index)) {
+                    continue;
+                }
+                const line = this.findLineNumber(content, match.index);
+                const code = this.extractCodeSnippet(content, match.index, 1);
+                vulnerabilities.push(this.createVulnerability(filePath, line, code, `${operation} uses user input which may lead to path traversal attacks`, 'Validate and sanitize file paths. Use path.resolve() and check if resolved path is within allowed directory', [
+                    'https://owasp.org/www-community/attacks/Path_Traversal',
+                    'https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html',
+                ]));
+            }
+        }
+        // Pattern 2: Direct string concatenation for file paths
+        const pathConcatPattern = /['"`][./\\]*['"`]\s*\+\s*(?:req\.|params\.|query\.|input|user)/gi;
+        let match;
+        while ((match = pathConcatPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            const line = this.findLineNumber(content, match.index);
+            const code = this.extractCodeSnippet(content, match.index, 1);
+            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'File path constructed using string concatenation with user input', 'Never concatenate user input directly into file paths. Use path.join() with validation', [
+                'https://owasp.org/www-community/attacks/Path_Traversal',
+            ]));
+        }
+        // Pattern 3: Template literals with user input in file paths
+        const templatePathPattern = /(?:readFile|writeFile|unlink|stat|access|open)\([`'][^`']*\$\{(?:req\.|params\.|query\.|input|user)/gi;
+        while ((match = templatePathPattern.exec(content)) !== null) {
+            if (this.shouldIgnore(content, match.index)) {
+                continue;
+            }
+            const line = this.findLineNumber(content, match.index);
+            const code = this.extractCodeSnippet(content, match.index, 1);
+            vulnerabilities.push(this.createVulnerability(filePath, line, code, 'File path uses template literal with user input', 'Validate and sanitize file paths. Ensure path stays within allowed directory', [
+                'https://owasp.org/www-community/attacks/Path_Traversal',
+            ]));
+        }
+        return vulnerabilities;
+    }
+}
+//# sourceMappingURL=path-traversal-detector.js.map

package/dist/analyzers/security/detectors/path-traversal-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-traversal-detector.js","sourceRoot":"","sources":["../../../../src/analyzers/security/detectors/path-traversal-detector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,qBAAsB,SAAQ,oBAAoB;IAC7D;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,kDAAkD;YAC/D,QAAQ,EAAE,MAAM;YAChB,aAAa,EAAE,kCAAkC;YACjD,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAA4B,EAAE,CAAC;QAEpD,6CAA6C;QAC7C,MAAM,cAAc,GAAG;YACrB;gBACE,OAAO,EAAE,8FAA8F;gBACvG,SAAS,EAAE,gBAAgB;aAC5B;YACD;gBACE,OAAO,EAAE,iHAAiH;gBAC1H,SAAS,EAAE,uBAAuB;aACnC;YACD;gBACE,OAAO,EAAE,0DAA0D;gBACnE,SAAS,EAAE,oBAAoB;aAChC;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,cAAc,EAAE,CAAC;YACpD,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,GAAG,SAAS,2DAA2D,EACvE,6GAA6G,EAC7G;oBACE,wDAAwD;oBACxD,kFAAkF;iBACnF,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,MAAM,iBAAiB,GAAG,kEAAkE,CAAC;QAC7F,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,kEAAkE,EAClE,wFAAwF,EACxF;gBACE,wDAAwD;aACzD,CACF,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,mBAAmB,GAAG,uGAAuG,CAAC;QACpI,OAAO,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,iDAAiD,EACjD,8EAA8E,EAC9E;gBACE,wDAAwD;aACzD,CACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;CACF"}

package/dist/analyzers/security/detectors/sql-injection-detector.d.ts

@@ -0,0 +1,12 @@
+/**
+ * SQL Injection Detector
+ *
+ * Detects potential SQL injection vulnerabilities
+ * OWASP A03:2021 - Injection
+ */
+import { BaseSecurityDetector } from '../base-detector.js';
+import type { SecurityVulnerability } from '../types.js';
+export declare class SQLInjectionDetector extends BaseSecurityDetector {
+    constructor();
+    scan(content: string, filePath: string): Promise<SecurityVulnerability[]>;
+}

package/dist/analyzers/security/detectors/sql-injection-detector.js

@@ -0,0 +1,88 @@
+/**
+ * SQL Injection Detector
+ *
+ * Detects potential SQL injection vulnerabilities
+ * OWASP A03:2021 - Injection
+ */
+import { BaseSecurityDetector } from '../base-detector.js';
+export class SQLInjectionDetector extends BaseSecurityDetector {
+    constructor() {
+        super({
+            id: 'sql-injection',
+            name: 'SQL Injection',
+            description: 'Detects potential SQL injection vulnerabilities',
+            severity: 'critical',
+            owaspCategory: 'A03:2021 - Injection',
+            cweId: 'CWE-89',
+        });
+    }
+    async scan(content, filePath) {
+        if (!this.appliesTo(filePath)) {
+            return [];
+        }
+        const vulnerabilities = [];
+        // Pattern 1: String concatenation in SQL queries
+        const concatPatterns = [
+            /(?:query|sql|execute|exec)\s*(?:=|:)\s*['"`][\s\S]*?\$\{[^}]+\}/gi,
+            /(?:query|sql|execute|exec)\s*(?:=|:)\s*['"`][\s\S]*?\+\s*\w+/gi,
+            /(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE)[\s\S]*?\+\s*\w+/gi,
+        ];
+        for (const pattern of concatPatterns) {
+            let match;
+            const regex = new RegExp(pattern);
+            while ((match = regex.exec(content)) !== null) {
+                if (this.shouldIgnore(content, match.index)) {
+                    continue;
+                }
+                const line = this.findLineNumber(content, match.index);
+                const code = this.extractCodeSnippet(content, match.index, 1);
+                vulnerabilities.push(this.createVulnerability(filePath, line, code, 'SQL query uses string concatenation which may lead to SQL injection', 'Use parameterized queries or prepared statements instead of string concatenation', [
+                    'https://owasp.org/www-community/attacks/SQL_Injection',
+                    'https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html',
+                ]));
+            }
+        }
+        // Pattern 2: Direct use of user input in queries
+        const userInputPatterns = [
+            /(?:query|sql|execute|exec)\s*(?:=|:)\s*['"`][\s\S]*?(?:req\.body|req\.query|req\.params|params|input|userInput)/gi,
+            /(?:SELECT|INSERT|UPDATE|DELETE)[\s\S]{0,100}(?:req\.body|req\.query|req\.params|params|input)/gi,
+        ];
+        for (const pattern of userInputPatterns) {
+            let match;
+            const regex = new RegExp(pattern);
+            while ((match = regex.exec(content)) !== null) {
+                if (this.shouldIgnore(content, match.index)) {
+                    continue;
+                }
+                const line = this.findLineNumber(content, match.index);
+                const code = this.extractCodeSnippet(content, match.index, 1);
+                vulnerabilities.push(this.createVulnerability(filePath, line, code, 'SQL query directly uses user input without sanitization', 'Always sanitize and validate user input. Use parameterized queries or ORM methods', [
+                    'https://owasp.org/www-community/attacks/SQL_Injection',
+                    'https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html',
+                ]));
+            }
+        }
+        // Pattern 3: Unsafe query execution methods
+        const unsafeMethodPatterns = [
+            /\.query\(['"`][^'"`]*\$\{/gi,
+            /\.exec\(['"`][^'"`]*\$\{/gi,
+            /\.raw\(['"`][^'"`]*\$\{/gi,
+        ];
+        for (const pattern of unsafeMethodPatterns) {
+            let match;
+            const regex = new RegExp(pattern);
+            while ((match = regex.exec(content)) !== null) {
+                if (this.shouldIgnore(content, match.index)) {
+                    continue;
+                }
+                const line = this.findLineNumber(content, match.index);
+                const code = this.extractCodeSnippet(content, match.index, 1);
+                vulnerabilities.push(this.createVulnerability(filePath, line, code, 'Database method uses template literals which may be vulnerable to SQL injection', 'Use parameterized queries with placeholders (?, $1, etc.) instead of template literals', [
+                    'https://owasp.org/www-community/attacks/SQL_Injection',
+                ]));
+            }
+        }
+        return vulnerabilities;
+    }
+}
+//# sourceMappingURL=sql-injection-detector.js.map

package/dist/analyzers/security/detectors/sql-injection-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection-detector.js","sourceRoot":"","sources":["../../../../src/analyzers/security/detectors/sql-injection-detector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,oBAAqB,SAAQ,oBAAoB;IAC5D;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,iDAAiD;YAC9D,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,sBAAsB;YACrC,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAA4B,EAAE,CAAC;QAEpD,iDAAiD;QACjD,MAAM,cAAc,GAAG;YACrB,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;SAChE,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,qEAAqE,EACrE,kFAAkF,EAClF;oBACE,uDAAuD;oBACvD,0FAA0F;iBAC3F,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,iBAAiB,GAAG;YACxB,mHAAmH;YACnH,iGAAiG;SAClG,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,yDAAyD,EACzD,mFAAmF,EACnF;oBACE,uDAAuD;oBACvD,kFAAkF;iBACnF,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,MAAM,oBAAoB,GAAG;YAC3B,6BAA6B;YAC7B,4BAA4B;YAC5B,2BAA2B;SAC5B,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAE9D,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,mBAAmB,CACtB,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,iFAAiF,EACjF,wFAAwF,EACxF;oBACE,uDAAuD;iBACxD,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;CACF"}

package/dist/analyzers/security/detectors/weak-crypto-detector.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Weak Cryptography Detector
+ *
+ * Detects use of weak or deprecated cryptographic algorithms
+ * OWASP A02:2021 - Cryptographic Failures
+ */
+import { BaseSecurityDetector } from '../base-detector.js';
+import type { SecurityVulnerability } from '../types.js';
+export declare class WeakCryptoDetector extends BaseSecurityDetector {
+    constructor();
+    scan(content: string, filePath: string): Promise<SecurityVulnerability[]>;
+}