@dotsetlabs/tollgate 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (215) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +885 -0
  3. package/dist/analyzers/filesystem.d.ts +26 -0
  4. package/dist/analyzers/filesystem.d.ts.map +1 -0
  5. package/dist/analyzers/filesystem.js +284 -0
  6. package/dist/analyzers/filesystem.js.map +1 -0
  7. package/dist/analyzers/http.d.ts +90 -0
  8. package/dist/analyzers/http.d.ts.map +1 -0
  9. package/dist/analyzers/http.js +433 -0
  10. package/dist/analyzers/http.js.map +1 -0
  11. package/dist/analyzers/index.d.ts +101 -0
  12. package/dist/analyzers/index.d.ts.map +1 -0
  13. package/dist/analyzers/index.js +342 -0
  14. package/dist/analyzers/index.js.map +1 -0
  15. package/dist/analyzers/loader.d.ts +114 -0
  16. package/dist/analyzers/loader.d.ts.map +1 -0
  17. package/dist/analyzers/loader.js +184 -0
  18. package/dist/analyzers/loader.js.map +1 -0
  19. package/dist/analyzers/prompt-injection.d.ts +95 -0
  20. package/dist/analyzers/prompt-injection.d.ts.map +1 -0
  21. package/dist/analyzers/prompt-injection.js +725 -0
  22. package/dist/analyzers/prompt-injection.js.map +1 -0
  23. package/dist/analyzers/sdk.d.ts +230 -0
  24. package/dist/analyzers/sdk.d.ts.map +1 -0
  25. package/dist/analyzers/sdk.js +283 -0
  26. package/dist/analyzers/sdk.js.map +1 -0
  27. package/dist/analyzers/shell.d.ts +20 -0
  28. package/dist/analyzers/shell.d.ts.map +1 -0
  29. package/dist/analyzers/shell.js +297 -0
  30. package/dist/analyzers/shell.js.map +1 -0
  31. package/dist/analyzers/sql.d.ts +37 -0
  32. package/dist/analyzers/sql.d.ts.map +1 -0
  33. package/dist/analyzers/sql.js +455 -0
  34. package/dist/analyzers/sql.js.map +1 -0
  35. package/dist/analyzers/types.d.ts +117 -0
  36. package/dist/analyzers/types.d.ts.map +1 -0
  37. package/dist/analyzers/types.js +46 -0
  38. package/dist/analyzers/types.js.map +1 -0
  39. package/dist/approval/interactive.d.ts +72 -0
  40. package/dist/approval/interactive.d.ts.map +1 -0
  41. package/dist/approval/interactive.js +550 -0
  42. package/dist/approval/interactive.js.map +1 -0
  43. package/dist/approval/terminal.d.ts +59 -0
  44. package/dist/approval/terminal.d.ts.map +1 -0
  45. package/dist/approval/terminal.js +238 -0
  46. package/dist/approval/terminal.js.map +1 -0
  47. package/dist/approval/types.d.ts +66 -0
  48. package/dist/approval/types.d.ts.map +1 -0
  49. package/dist/approval/types.js +2 -0
  50. package/dist/approval/types.js.map +1 -0
  51. package/dist/audit/exporter.d.ts +138 -0
  52. package/dist/audit/exporter.d.ts.map +1 -0
  53. package/dist/audit/exporter.js +366 -0
  54. package/dist/audit/exporter.js.map +1 -0
  55. package/dist/audit/logger.d.ts +156 -0
  56. package/dist/audit/logger.d.ts.map +1 -0
  57. package/dist/audit/logger.js +406 -0
  58. package/dist/audit/logger.js.map +1 -0
  59. package/dist/audit/redaction.d.ts +110 -0
  60. package/dist/audit/redaction.d.ts.map +1 -0
  61. package/dist/audit/redaction.js +307 -0
  62. package/dist/audit/redaction.js.map +1 -0
  63. package/dist/audit/schema.d.ts +76 -0
  64. package/dist/audit/schema.d.ts.map +1 -0
  65. package/dist/audit/schema.js +122 -0
  66. package/dist/audit/schema.js.map +1 -0
  67. package/dist/cli/commands/doctor.d.ts +34 -0
  68. package/dist/cli/commands/doctor.d.ts.map +1 -0
  69. package/dist/cli/commands/doctor.js +431 -0
  70. package/dist/cli/commands/doctor.js.map +1 -0
  71. package/dist/cli/commands/export.d.ts +18 -0
  72. package/dist/cli/commands/export.d.ts.map +1 -0
  73. package/dist/cli/commands/export.js +63 -0
  74. package/dist/cli/commands/export.js.map +1 -0
  75. package/dist/cli/commands/init.d.ts +12 -0
  76. package/dist/cli/commands/init.d.ts.map +1 -0
  77. package/dist/cli/commands/init.js +102 -0
  78. package/dist/cli/commands/init.js.map +1 -0
  79. package/dist/cli/commands/logs.d.ts +11 -0
  80. package/dist/cli/commands/logs.d.ts.map +1 -0
  81. package/dist/cli/commands/logs.js +60 -0
  82. package/dist/cli/commands/logs.js.map +1 -0
  83. package/dist/cli/commands/scan.d.ts +29 -0
  84. package/dist/cli/commands/scan.d.ts.map +1 -0
  85. package/dist/cli/commands/scan.js +251 -0
  86. package/dist/cli/commands/scan.js.map +1 -0
  87. package/dist/cli/commands/serve.d.ts +26 -0
  88. package/dist/cli/commands/serve.d.ts.map +1 -0
  89. package/dist/cli/commands/serve.js +424 -0
  90. package/dist/cli/commands/serve.js.map +1 -0
  91. package/dist/cli/commands/start.d.ts +20 -0
  92. package/dist/cli/commands/start.d.ts.map +1 -0
  93. package/dist/cli/commands/start.js +82 -0
  94. package/dist/cli/commands/start.js.map +1 -0
  95. package/dist/cli/commands/stats.d.ts +10 -0
  96. package/dist/cli/commands/stats.d.ts.map +1 -0
  97. package/dist/cli/commands/stats.js +42 -0
  98. package/dist/cli/commands/stats.js.map +1 -0
  99. package/dist/cli/commands/templates.d.ts +26 -0
  100. package/dist/cli/commands/templates.d.ts.map +1 -0
  101. package/dist/cli/commands/templates.js +221 -0
  102. package/dist/cli/commands/templates.js.map +1 -0
  103. package/dist/cli/commands/validate.d.ts +12 -0
  104. package/dist/cli/commands/validate.d.ts.map +1 -0
  105. package/dist/cli/commands/validate.js +107 -0
  106. package/dist/cli/commands/validate.js.map +1 -0
  107. package/dist/cli/commands/wrap.d.ts +19 -0
  108. package/dist/cli/commands/wrap.d.ts.map +1 -0
  109. package/dist/cli/commands/wrap.js +59 -0
  110. package/dist/cli/commands/wrap.js.map +1 -0
  111. package/dist/cli/index.d.ts +17 -0
  112. package/dist/cli/index.d.ts.map +1 -0
  113. package/dist/cli/index.js +202 -0
  114. package/dist/cli/index.js.map +1 -0
  115. package/dist/cli/ui.d.ts +139 -0
  116. package/dist/cli/ui.d.ts.map +1 -0
  117. package/dist/cli/ui.js +271 -0
  118. package/dist/cli/ui.js.map +1 -0
  119. package/dist/constants.d.ts +33 -0
  120. package/dist/constants.d.ts.map +1 -0
  121. package/dist/constants.js +54 -0
  122. package/dist/constants.js.map +1 -0
  123. package/dist/errors.d.ts +28 -0
  124. package/dist/errors.d.ts.map +1 -0
  125. package/dist/errors.js +37 -0
  126. package/dist/errors.js.map +1 -0
  127. package/dist/index.d.ts +49 -0
  128. package/dist/index.d.ts.map +1 -0
  129. package/dist/index.js +82 -0
  130. package/dist/index.js.map +1 -0
  131. package/dist/orchestrator/index.d.ts +11 -0
  132. package/dist/orchestrator/index.d.ts.map +1 -0
  133. package/dist/orchestrator/index.js +10 -0
  134. package/dist/orchestrator/index.js.map +1 -0
  135. package/dist/orchestrator/manager.d.ts +127 -0
  136. package/dist/orchestrator/manager.d.ts.map +1 -0
  137. package/dist/orchestrator/manager.js +498 -0
  138. package/dist/orchestrator/manager.js.map +1 -0
  139. package/dist/orchestrator/types.d.ts +141 -0
  140. package/dist/orchestrator/types.d.ts.map +1 -0
  141. package/dist/orchestrator/types.js +9 -0
  142. package/dist/orchestrator/types.js.map +1 -0
  143. package/dist/policy/engine.d.ts +55 -0
  144. package/dist/policy/engine.d.ts.map +1 -0
  145. package/dist/policy/engine.js +288 -0
  146. package/dist/policy/engine.js.map +1 -0
  147. package/dist/policy/natural-language.d.ts +141 -0
  148. package/dist/policy/natural-language.d.ts.map +1 -0
  149. package/dist/policy/natural-language.js +552 -0
  150. package/dist/policy/natural-language.js.map +1 -0
  151. package/dist/policy/parser.d.ts +141 -0
  152. package/dist/policy/parser.d.ts.map +1 -0
  153. package/dist/policy/parser.js +314 -0
  154. package/dist/policy/parser.js.map +1 -0
  155. package/dist/policy/types.d.ts +428 -0
  156. package/dist/policy/types.d.ts.map +1 -0
  157. package/dist/policy/types.js +32 -0
  158. package/dist/policy/types.js.map +1 -0
  159. package/dist/policy/validator.d.ts +72 -0
  160. package/dist/policy/validator.d.ts.map +1 -0
  161. package/dist/policy/validator.js +453 -0
  162. package/dist/policy/validator.js.map +1 -0
  163. package/dist/proxy/bridge.d.ts +84 -0
  164. package/dist/proxy/bridge.d.ts.map +1 -0
  165. package/dist/proxy/bridge.js +217 -0
  166. package/dist/proxy/bridge.js.map +1 -0
  167. package/dist/proxy/client.d.ts +130 -0
  168. package/dist/proxy/client.d.ts.map +1 -0
  169. package/dist/proxy/client.js +290 -0
  170. package/dist/proxy/client.js.map +1 -0
  171. package/dist/proxy/server.d.ts +111 -0
  172. package/dist/proxy/server.d.ts.map +1 -0
  173. package/dist/proxy/server.js +444 -0
  174. package/dist/proxy/server.js.map +1 -0
  175. package/dist/scanner.d.ts +91 -0
  176. package/dist/scanner.d.ts.map +1 -0
  177. package/dist/scanner.js +373 -0
  178. package/dist/scanner.js.map +1 -0
  179. package/dist/session/index.d.ts +32 -0
  180. package/dist/session/index.d.ts.map +1 -0
  181. package/dist/session/index.js +31 -0
  182. package/dist/session/index.js.map +1 -0
  183. package/dist/session/manager.d.ts +166 -0
  184. package/dist/session/manager.d.ts.map +1 -0
  185. package/dist/session/manager.js +454 -0
  186. package/dist/session/manager.js.map +1 -0
  187. package/dist/session/sqlite-store.d.ts +54 -0
  188. package/dist/session/sqlite-store.d.ts.map +1 -0
  189. package/dist/session/sqlite-store.js +209 -0
  190. package/dist/session/sqlite-store.js.map +1 -0
  191. package/dist/session/types.d.ts +179 -0
  192. package/dist/session/types.d.ts.map +1 -0
  193. package/dist/session/types.js +38 -0
  194. package/dist/session/types.js.map +1 -0
  195. package/dist/templates.d.ts +64 -0
  196. package/dist/templates.d.ts.map +1 -0
  197. package/dist/templates.js +451 -0
  198. package/dist/templates.js.map +1 -0
  199. package/dist/utils/config.d.ts +57 -0
  200. package/dist/utils/config.d.ts.map +1 -0
  201. package/dist/utils/config.js +104 -0
  202. package/dist/utils/config.js.map +1 -0
  203. package/dist/utils/errors.d.ts +18 -0
  204. package/dist/utils/errors.d.ts.map +1 -0
  205. package/dist/utils/errors.js +35 -0
  206. package/dist/utils/errors.js.map +1 -0
  207. package/dist/utils/logger.d.ts +144 -0
  208. package/dist/utils/logger.d.ts.map +1 -0
  209. package/dist/utils/logger.js +300 -0
  210. package/dist/utils/logger.js.map +1 -0
  211. package/dist/wizard.d.ts +68 -0
  212. package/dist/wizard.d.ts.map +1 -0
  213. package/dist/wizard.js +395 -0
  214. package/dist/wizard.js.map +1 -0
  215. package/package.json +99 -0
@@ -0,0 +1,297 @@
1
+ /**
2
+ * Shell Command Analyzer
3
+ *
4
+ * Detects dangerous shell commands and patterns:
5
+ * - Destructive commands (rm -rf, mkfs, dd)
6
+ * - Privilege escalation (sudo, su)
7
+ * - Remote code execution (curl | bash)
8
+ * - System modification (chmod 777, chown)
9
+ */
10
+ export class ShellAnalyzer {
11
+ name = 'shell';
12
+ // Commands that should never be run
13
+ FORBIDDEN_COMMANDS = [
14
+ // Fork bomb - use bounded whitespace to prevent ReDoS
15
+ {
16
+ pattern: /:\(\)\s{0,5}\{\s{0,5}:\|:&\s{0,5}\}\s{0,5};?\s{0,5}:/,
17
+ risk: 'dangerous',
18
+ reason: 'Fork bomb detected - will crash system',
19
+ category: 'fork_bomb',
20
+ },
21
+ // Disk destruction
22
+ {
23
+ pattern: /\bdd\s+.*\bif=.*\bof=\/dev\/[hs]d/i,
24
+ risk: 'dangerous',
25
+ reason: 'Direct disk write detected - can destroy filesystem',
26
+ category: 'disk_destruction',
27
+ },
28
+ // Format filesystem
29
+ {
30
+ pattern: /\b(mkfs|mke2fs|mkfs\.\w+)\b/i,
31
+ risk: 'dangerous',
32
+ reason: 'Filesystem format command detected',
33
+ category: 'disk_destruction',
34
+ },
35
+ // Wipe commands
36
+ {
37
+ pattern: /\b(shred|wipe)\s+/i,
38
+ risk: 'dangerous',
39
+ reason: 'Secure deletion command detected',
40
+ category: 'disk_destruction',
41
+ },
42
+ ];
43
+ // Commands that are dangerous in certain contexts
44
+ DANGEROUS_PATTERNS = [
45
+ // rm with dangerous flags or paths
46
+ {
47
+ pattern: /\brm\s+(-[rRf]+\s+)*[/~]/,
48
+ risk: 'dangerous',
49
+ reason: 'rm command targeting root or home directory',
50
+ category: 'file_deletion',
51
+ },
52
+ {
53
+ pattern: /\brm\s+-[rRf]*\s+-[rRf]*\s/,
54
+ risk: 'destructive',
55
+ reason: 'rm with recursive/force flags',
56
+ category: 'file_deletion',
57
+ },
58
+ // sudo commands
59
+ {
60
+ pattern: /\bsudo\s+/,
61
+ risk: 'dangerous',
62
+ reason: 'Privilege escalation with sudo',
63
+ category: 'privilege_escalation',
64
+ },
65
+ // su commands
66
+ {
67
+ pattern: /\bsu\s+(-|root|\s*$)/,
68
+ risk: 'dangerous',
69
+ reason: 'Switch to root user',
70
+ category: 'privilege_escalation',
71
+ },
72
+ // chmod with dangerous permissions
73
+ {
74
+ pattern: /\bchmod\s+([0-7]*7[0-7]{2}|[0-7]{2}7|a\+[rwx])/,
75
+ risk: 'destructive',
76
+ reason: 'chmod with overly permissive settings',
77
+ category: 'permission_change',
78
+ },
79
+ // chown to root
80
+ {
81
+ pattern: /\bchown\s+(root|0)/i,
82
+ risk: 'destructive',
83
+ reason: 'Changing ownership to root',
84
+ category: 'permission_change',
85
+ },
86
+ // Remote code execution via curl/wget
87
+ {
88
+ pattern: /\b(curl|wget)\s+.*\|\s*(ba)?sh/i,
89
+ risk: 'dangerous',
90
+ reason: 'Remote code execution: piping download to shell',
91
+ category: 'remote_code_execution',
92
+ },
93
+ // eval with variable
94
+ {
95
+ pattern: /\beval\s+["']?\$/,
96
+ risk: 'dangerous',
97
+ reason: 'eval with variable input - potential injection',
98
+ category: 'code_injection',
99
+ },
100
+ // Writing to /dev
101
+ {
102
+ pattern: />\s*\/dev\/[hs]d/,
103
+ risk: 'dangerous',
104
+ reason: 'Writing directly to disk device',
105
+ category: 'disk_destruction',
106
+ },
107
+ // System reboot/shutdown
108
+ {
109
+ pattern: /\b(reboot|shutdown|poweroff|halt|init\s+[06])\b/,
110
+ risk: 'dangerous',
111
+ reason: 'System shutdown/reboot command',
112
+ category: 'system_control',
113
+ },
114
+ // Kill all processes
115
+ {
116
+ pattern: /\bkillall\s+(-9\s+)?-/,
117
+ risk: 'dangerous',
118
+ reason: 'Killing multiple processes',
119
+ category: 'process_control',
120
+ },
121
+ {
122
+ pattern: /\bpkill\s+-9/,
123
+ risk: 'destructive',
124
+ reason: 'Force killing processes',
125
+ category: 'process_control',
126
+ },
127
+ // iptables flush
128
+ {
129
+ pattern: /\biptables\s+(-F|--flush)/,
130
+ risk: 'dangerous',
131
+ reason: 'Flushing firewall rules',
132
+ category: 'network',
133
+ },
134
+ // System service control
135
+ {
136
+ pattern: /\b(systemctl|service)\s+(stop|disable|mask)\s+/,
137
+ risk: 'destructive',
138
+ reason: 'Stopping system service',
139
+ category: 'system_control',
140
+ },
141
+ // Package removal
142
+ {
143
+ pattern: /\b(apt|apt-get|yum|dnf|pacman)\s+(remove|purge|autoremove)\s+/,
144
+ risk: 'destructive',
145
+ reason: 'Removing system packages',
146
+ category: 'package_management',
147
+ },
148
+ // npm/pip with sudo
149
+ {
150
+ pattern: /\bsudo\s+(npm|pip|pip3)\s+/,
151
+ risk: 'destructive',
152
+ reason: 'Installing packages with root privileges',
153
+ category: 'package_management',
154
+ },
155
+ // Environment variable manipulation that could affect PATH
156
+ {
157
+ pattern: /\bexport\s+PATH=/,
158
+ risk: 'destructive',
159
+ reason: 'Modifying PATH environment variable',
160
+ category: 'environment',
161
+ },
162
+ // Git force push
163
+ {
164
+ pattern: /\bgit\s+push\s+.*(-f|--force)/,
165
+ risk: 'destructive',
166
+ reason: 'Git force push - can overwrite history',
167
+ category: 'version_control',
168
+ },
169
+ // Git reset hard
170
+ {
171
+ pattern: /\bgit\s+reset\s+--hard/,
172
+ risk: 'destructive',
173
+ reason: 'Git hard reset - discards uncommitted changes',
174
+ category: 'version_control',
175
+ },
176
+ // Docker system prune
177
+ {
178
+ pattern: /\bdocker\s+(system\s+prune|rm\s+-f)/,
179
+ risk: 'destructive',
180
+ reason: 'Docker cleanup - may remove important containers/images',
181
+ category: 'container',
182
+ },
183
+ ];
184
+ // Patterns that warrant attention but aren't necessarily dangerous
185
+ CAUTION_PATTERNS = [
186
+ {
187
+ pattern: /\brm\s+/,
188
+ risk: 'destructive',
189
+ reason: 'File deletion command',
190
+ category: 'file_deletion',
191
+ },
192
+ {
193
+ pattern: /\bmv\s+.*\s+\/dev\/null/,
194
+ risk: 'destructive',
195
+ reason: 'Moving file to /dev/null (deletion)',
196
+ category: 'file_deletion',
197
+ },
198
+ {
199
+ pattern: />\s*[^|&]/,
200
+ risk: 'destructive',
201
+ reason: 'File overwrite with redirect',
202
+ category: 'file_modification',
203
+ },
204
+ {
205
+ pattern: /\bchmod\s+/,
206
+ risk: 'destructive',
207
+ reason: 'Changing file permissions',
208
+ category: 'permission_change',
209
+ },
210
+ {
211
+ pattern: /\bchown\s+/,
212
+ risk: 'destructive',
213
+ reason: 'Changing file ownership',
214
+ category: 'permission_change',
215
+ },
216
+ ];
217
+ analyze(command, _context) {
218
+ // Normalize the command
219
+ const normalizedCommand = this.normalizeCommand(command);
220
+ // Check forbidden commands first
221
+ for (const { pattern, risk, reason, category } of this.FORBIDDEN_COMMANDS) {
222
+ if (pattern.test(normalizedCommand)) {
223
+ return {
224
+ risk,
225
+ reason,
226
+ triggers: [category],
227
+ metadata: { category, pattern: pattern.source },
228
+ };
229
+ }
230
+ }
231
+ // Check dangerous patterns
232
+ for (const { pattern, risk, reason, category } of this.DANGEROUS_PATTERNS) {
233
+ if (pattern.test(normalizedCommand)) {
234
+ return {
235
+ risk,
236
+ reason,
237
+ triggers: [category],
238
+ metadata: { category, pattern: pattern.source },
239
+ };
240
+ }
241
+ }
242
+ // Check caution patterns
243
+ for (const { pattern, risk, reason, category } of this.CAUTION_PATTERNS) {
244
+ if (pattern.test(normalizedCommand)) {
245
+ return {
246
+ risk,
247
+ reason,
248
+ triggers: [category],
249
+ metadata: { category, pattern: pattern.source },
250
+ };
251
+ }
252
+ }
253
+ // Check for command chaining that might hide malicious commands
254
+ if (this.hasSuspiciousChaining(normalizedCommand)) {
255
+ return {
256
+ risk: 'destructive',
257
+ reason: 'Complex command chaining detected - review carefully',
258
+ triggers: ['command_chaining'],
259
+ };
260
+ }
261
+ // Default: command appears safe
262
+ return {
263
+ risk: 'safe',
264
+ reason: 'No dangerous patterns detected',
265
+ };
266
+ }
267
+ normalizeCommand(command) {
268
+ // Remove extra whitespace
269
+ let normalized = command.trim().replace(/\s+/g, ' ');
270
+ // Expand common aliases (conservative list)
271
+ normalized = normalized.replace(/\bll\b/g, 'ls -l');
272
+ return normalized;
273
+ }
274
+ hasSuspiciousChaining(command) {
275
+ // Count chain operators
276
+ const chainOperators = (command.match(/[;&|]{1,2}/g) ?? []).length;
277
+ // More than 3 chained commands is suspicious
278
+ if (chainOperators > 3) {
279
+ return true;
280
+ }
281
+ // Check for hiding patterns like: innocent && dangerous
282
+ const parts = command.split(/[;&|]+/);
283
+ if (parts.length >= 2) {
284
+ // If first command is innocuous but later ones are dangerous
285
+ const firstSafe = /^(echo|ls|pwd|cd|cat|head|tail)\b/.test(parts[0]?.trim() ?? '');
286
+ const laterDangerous = parts.slice(1).some(part => {
287
+ const trimmed = part.trim();
288
+ return /^(rm|sudo|curl.*\|.*sh|dd|mkfs)/.test(trimmed);
289
+ });
290
+ if (firstSafe && laterDangerous) {
291
+ return true;
292
+ }
293
+ }
294
+ return false;
295
+ }
296
+ }
297
+ //# sourceMappingURL=shell.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/analyzers/shell.ts"],"names":[],"mappings":"AASA;;;;;;;;GAQG;AACH,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,OAAO,CAAC;IAExB,oCAAoC;IACnB,kBAAkB,GAAuB;QACxD,sDAAsD;QACtD;YACE,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,wCAAwC;YAChD,QAAQ,EAAE,WAAW;SACtB;QACD,mBAAmB;QACnB;YACE,OAAO,EAAE,oCAAoC;YAC7C,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,qDAAqD;YAC7D,QAAQ,EAAE,kBAAkB;SAC7B;QACD,oBAAoB;QACpB;YACE,OAAO,EAAE,8BAA8B;YACvC,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,oCAAoC;YAC5C,QAAQ,EAAE,kBAAkB;SAC7B;QACD,gBAAgB;QAChB;YACE,OAAO,EAAE,oBAAoB;YAC7B,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,kCAAkC;YAC1C,QAAQ,EAAE,kBAAkB;SAC7B;KACF,CAAC;IAEF,kDAAkD;IACjC,kBAAkB,GAAuB;QACxD,mCAAmC;QACnC;YACE,OAAO,EAAE,0BAA0B;YACnC,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,6CAA6C;YACrD,QAAQ,EAAE,eAAe;SAC1B;QACD;YACE,OAAO,EAAE,4BAA4B;YACrC,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,+BAA+B;YACvC,QAAQ,EAAE,eAAe;SAC1B;QACD,gBAAgB;QAChB;YACE,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,gCAAgC;YACxC,QAAQ,EAAE,sBAAsB;SACjC;QACD,cAAc;QACd;YACE,OAAO,EAAE,sBAAsB;YAC/B,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,qBAAqB;YAC7B,QAAQ,EAAE,sBAAsB;SACjC;QACD,mCAAmC;QACnC;YACE,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,uCAAuC;YAC/C,QAAQ,EAAE,mBAAmB;SAC9B;QACD,gBAAgB;QAChB;YACE,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,4BAA4B;YACpC,QAAQ,EAAE,mBAAmB;SAC9B;QACD,sCAAsC;QACtC;YACE,OAAO,EAAE,iCAAiC;YAC1C,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,iDAAiD;YACzD,QAAQ,EAAE,uBAAuB;SAClC;QACD,qBAAqB;QACrB;YACE,OAAO,EAAE,kBAAkB;YAC3B,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,gDAAgD;YACxD,QAAQ,EAAE,gBAAgB;SAC3B;QACD,kBAAkB;QAClB;YACE,OAAO,EAAE,kBAAkB;YAC3B,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,iCAAiC;YACzC,QAAQ,EAAE,kBAAkB;SAC7B;QACD,yBAAyB;QACzB;YACE,OAAO,EAAE,iDAAiD;YAC1D,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,gCAAgC;YACxC,QAAQ,EAAE,gBAAgB;SAC3B;QACD,qBAAqB;QACrB;YACE,OAAO,EAAE,uBAAuB;YAChC,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,4BAA4B;YACpC,QAAQ,EAAE,iBAAiB;SAC5B;QACD;YACE,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,iBAAiB;SAC5B;QACD,iBAAiB;QACjB;YACE,OAAO,EAAE,2BAA2B;YACpC,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,SAAS;SACpB;QACD,yBAAyB;QACzB;YACE,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,gBAAgB;SAC3B;QACD,kBAAkB;QAClB;YACE,OAAO,EAAE,+DAA+D;YACxE,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,0BAA0B;YAClC,QAAQ,EAAE,oBAAoB;SAC/B;QACD,oBAAoB;QACpB;YACE,OAAO,EAAE,4BAA4B;YACrC,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,0CAA0C;YAClD,QAAQ,EAAE,oBAAoB;SAC/B;QACD,2DAA2D;QAC3D;YACE,OAAO,EAAE,kBAAkB;YAC3B,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qCAAqC;YAC7C,QAAQ,EAAE,aAAa;SACxB;QACD,iBAAiB;QACjB;YACE,OAAO,EAAE,+BAA+B;YACxC,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,wCAAwC;YAChD,QAAQ,EAAE,iBAAiB;SAC5B;QACD,iBAAiB;QACjB;YACE,OAAO,EAAE,wBAAwB;YACjC,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,+CAA+C;YACvD,QAAQ,EAAE,iBAAiB;SAC5B;QACD,sBAAsB;QACtB;YACE,OAAO,EAAE,qCAAqC;YAC9C,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,yDAAyD;YACjE,QAAQ,EAAE,WAAW;SACtB;KACF,CAAC;IAEF,mEAAmE;IAClD,gBAAgB,GAAuB;QACtD;YACE,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,uBAAuB;YAC/B,QAAQ,EAAE,eAAe;SAC1B;QACD;YACE,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qCAAqC;YAC7C,QAAQ,EAAE,eAAe;SAC1B;QACD;YACE,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,8BAA8B;YACtC,QAAQ,EAAE,mBAAmB;SAC9B;QACD;YACE,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,2BAA2B;YACnC,QAAQ,EAAE,mBAAmB;SAC9B;QACD;YACE,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,mBAAmB;SAC9B;KACF,CAAC;IAEF,OAAO,CAAC,OAAe,EAAE,QAA0B;QACjD,wBAAwB;QACxB,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEzD,iCAAiC;QACjC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,IAAI;oBACJ,MAAM;oBACN,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,IAAI;oBACJ,MAAM;oBACN,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxE,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,IAAI;oBACJ,MAAM;oBACN,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,sDAAsD;gBAC9D,QAAQ,EAAE,CAAC,kBAAkB,CAAC;aAC/B,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,gCAAgC;SACzC,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,OAAe;QACtC,0BAA0B;QAC1B,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAErD,4CAA4C;QAC5C,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEpD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,qBAAqB,CAAC,OAAe;QAC3C,wBAAwB;QACxB,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAEnE,6CAA6C;QAC7C,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,wDAAwD;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,6DAA6D;YAC7D,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,OAAO,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YAEH,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
@@ -0,0 +1,37 @@
1
+ import type { AnalysisResult, ContentAnalyzer, AnalyzerContext } from './types.js';
2
+ /**
3
+ * SQL Statement Analyzer
4
+ *
5
+ * Classifies SQL statements by risk level:
6
+ * - read: SELECT statements
7
+ * - write: INSERT statements
8
+ * - write/destructive: UPDATE/DELETE with WHERE clause
9
+ * - dangerous: UPDATE/DELETE without WHERE, DROP, TRUNCATE, ALTER
10
+ */
11
+ export declare class SqlAnalyzer implements ContentAnalyzer {
12
+ readonly name = "sql";
13
+ private parser;
14
+ constructor();
15
+ analyze(sql: string, _context?: AnalyzerContext): AnalysisResult;
16
+ private analyzeStatement;
17
+ private analyzeSelect;
18
+ private analyzeUpdate;
19
+ private analyzeDelete;
20
+ private isAlwaysTrueCondition;
21
+ private checkDangerousPatterns;
22
+ /**
23
+ * Remove SQL comments for pattern matching
24
+ * Handles both -- line comments and /* block comments
25
+ */
26
+ private removeComments;
27
+ /**
28
+ * Count semicolons that are outside of string literals
29
+ */
30
+ private countSemicolonsOutsideStrings;
31
+ /**
32
+ * Check for functions that can cause DoS / resource exhaustion
33
+ */
34
+ private checkDosFunctions;
35
+ private isHigherRisk;
36
+ }
37
+ //# sourceMappingURL=sql.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../../src/analyzers/sql.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEnF;;;;;;;;GAQG;AACH,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,IAAI,SAAS;IACtB,OAAO,CAAC,MAAM,CAA8B;;IAM5C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,cAAc;IAwChE,OAAO,CAAC,gBAAgB;IAsExB,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,aAAa;IA6BrB,OAAO,CAAC,aAAa;IA6BrB,OAAO,CAAC,qBAAqB;IAqB7B,OAAO,CAAC,sBAAsB;IA4E9B;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6DtB;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAoCrC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiGzB,OAAO,CAAC,YAAY;CAIrB"}