@empline/preflight 1.0.20

package/dist/checks/security/open-redirect-prevention.js

@@ -0,0 +1,238 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Open Redirect Prevention Preflight (BLOCKING)
+ *
+ * Goal: prevent redirect/router navigation using user-controlled URLs
+ * (callbackUrl/returnTo/next/redirect) without validation.
+ *
+ * Heuristic (fast + low false positives):
+ * - Taint variables assigned from searchParams.get("callbackUrl"|"returnTo"|"next"|"redirect"...)
+ * - Flag redirect()/router.push()/router.replace() using tainted variables or direct searchParams.get(...) usage
+ *   unless wrapped in a known safe helper (e.g. getAuthRedirectUrl/validateRedirectUrl) or obviously internal.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const console_chars_1 = require("../../utils/console-chars");
+const file_cache_1 = require("../../shared/file-cache");
+const glob_patterns_1 = require("../../shared/glob-patterns");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+const findings_writer_1 = require("../../utils/findings-writer");
+// Check metadata
+exports.id = "security/open-redirect-prevention";
+exports.name = "Open Redirect Prevention";
+exports.category = "security";
+exports.blocking = true;
+exports.description = "Open Redirect Prevention Preflight (BLOCKING)";
+exports.tags = ["security"];
+const EXCLUDED = (0, glob_patterns_1.extendExcludes)(glob_patterns_1.STANDARD_EXCLUDES_WITH_TESTS, [
+    "**/scripts/**",
+    "**/test-results/**",
+]);
+const REDIRECT_PARAM_KEYS = [
+    "callbackUrl",
+    "callbackURL",
+    "returnTo",
+    "return_to",
+    "next",
+    "redirect",
+    "redirectTo",
+    "redirect_to",
+    "url",
+];
+const SAFE_WRAPPER_PATTERNS = [
+    /getAuthRedirectUrl\s*\(/,
+    /sanitizeCallbackUrl\s*\(/,
+    /validateRedirectUrl\s*\(/,
+    /safeRedirect\s*\(/,
+    /sanitizeRedirect\s*\(/,
+    /assertInternalRedirect\s*\(/,
+    /assertInternalUrl\s*\(/,
+    /toInternalRedirect\s*\(/,
+    /isSafeRedirect\s*\(/,
+];
+function normalizeRel(p) {
+    return p.replace(/\\/g, "/");
+}
+function isObviouslyInternalRedirectExpression(expr) {
+    const trimmed = expr.trim();
+    if (!trimmed)
+        return false;
+    // Literal internal paths
+    if (/^['"`][/]*/.test(trimmed))
+        return true;
+    // Template string that clearly starts with a slash: `/${...}`
+    if (/^`\s*\//.test(trimmed))
+        return true;
+    // Common internal patterns
+    if (/\bto\s*===\s*['"]\//.test(trimmed))
+        return true;
+    if (/\bpathname\b/.test(trimmed) && /\//.test(trimmed))
+        return true;
+    // Explicit guard
+    if (/\.startsWith\(\s*['"]\/["']\s*\)/.test(trimmed))
+        return true;
+    return false;
+}
+function containsRedirectParamGet(expr) {
+    for (const key of REDIRECT_PARAM_KEYS) {
+        const re = new RegExp(`(?:searchParams|nextUrl\\.searchParams)\\.get\\(\\s*['\"]${key}['\"]\\s*\\)`);
+        if (re.test(expr))
+            return true;
+    }
+    return false;
+}
+function isWrappedSafely(expr) {
+    return SAFE_WRAPPER_PATTERNS.some((p) => p.test(expr));
+}
+function snippetFrom(text, idx) {
+    const start = Math.max(0, idx - 60);
+    const end = Math.min(text.length, idx + 120);
+    return text.slice(start, end).replace(/\s+/g, " ").trim();
+}
+function taintAssignments(content) {
+    const tainted = new Map();
+    // Simple single-line-ish assignment capture. We keep it conservative.
+    // Matches: const callbackUrl = searchParams.get("callbackUrl");
+    const assignRe = /(const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+);/g;
+    let m;
+    while ((m = assignRe.exec(content)) !== null) {
+        const varName = m[2] || "";
+        const rhs = m[3] || "";
+        if (!varName)
+            continue;
+        // If the value is already wrapped by a known-safe helper, do not taint.
+        if (isWrappedSafely(rhs) || isObviouslyInternalRedirectExpression(rhs)) {
+            continue;
+        }
+        for (const key of REDIRECT_PARAM_KEYS) {
+            const re = new RegExp(`(?:searchParams|nextUrl\\.searchParams)\\.get\\(\\s*['\"]${key}['\"]\\s*\\)`);
+            if (re.test(rhs)) {
+                tainted.set(varName, { key, index: m.index });
+                break;
+            }
+        }
+    }
+    return tainted;
+}
+function findRedirectCalls(content) {
+    const results = [];
+    const callRe = /(redirect|router\.(?:push|replace))\s*\(\s*([\s\S]{1,300}?)\s*\)/g;
+    let m;
+    while ((m = callRe.exec(content)) !== null) {
+        results.push({ callee: m[1], args: m[2], index: m.index });
+    }
+    return results;
+}
+async function main() {
+    console.log(`\n${console_chars_1.emoji.lock} OPEN REDIRECT PREVENTION (BLOCKING)`);
+    console.log((0, console_chars_1.createDivider)(80, "heavy"));
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)("Open Redirect Prevention");
+    const files = await file_cache_1.fileCache.getFiles("{app,components,lib}/**/*.{ts,tsx}", {
+        ignore: EXCLUDED,
+    });
+    const issues = [];
+    await reporter.processFiles(files, async (file) => {
+        const rel = normalizeRel(path.relative(process.cwd(), file));
+        const content = fs.readFileSync(file, "utf8");
+        if (!content.includes("redirect(") &&
+            !content.includes("router.push") &&
+            !content.includes("router.replace")) {
+            return;
+        }
+        const tainted = taintAssignments(content);
+        const calls = findRedirectCalls(content);
+        for (const c of calls) {
+            const args = c.args.trim();
+            if (!args)
+                continue;
+            if (isWrappedSafely(args))
+                continue;
+            if (isObviouslyInternalRedirectExpression(args))
+                continue;
+            const directGet = containsRedirectParamGet(args);
+            const argIsTaintedVar = tainted.has(args.replace(/[)\s]/g, ""));
+            // Also catch simple patterns like redirect(callbackUrl) with whitespace
+            const simpleArg = args.split(/[,\n]/)[0]?.trim() ?? "";
+            const simpleArgName = simpleArg.replace(/\s+/g, "");
+            const simpleTainted = tainted.has(simpleArgName);
+            if (!directGet && !argIsTaintedVar && !simpleTainted) {
+                continue;
+            }
+            const lc = (0, findings_writer_1.indexToLineCol)(content, c.index);
+            issues.push({
+                file: rel,
+                line: lc.line,
+                col: lc.col,
+                message: "Potential open redirect: redirect/navigation uses user-controlled URL without validation",
+                suggestion: "Validate redirect targets (internal-only) and/or wrap with getAuthRedirectUrl()/validateRedirectUrl() before redirect()/router.push().",
+                snippet: snippetFrom(content, c.index),
+            });
+        }
+    });
+    const findings = issues.map((i) => ({
+        severity: "error",
+        code: "open_redirect",
+        message: `${i.message}. ${i.suggestion}`,
+        file: i.file,
+        range: { startLine: i.line, startColumn: i.col },
+    }));
+    (0, findings_writer_1.writeFindings)(findings);
+    if (issues.length > 0) {
+        console.log(`\n${console_chars_1.emoji.error} BLOCKING: ${issues.length} potential open-redirect issue(s) found`);
+        console.log((0, console_chars_1.createDivider)(80, "heavy"));
+        for (const i of issues.slice(0, 25)) {
+            console.log(`${console_chars_1.emoji.error} ${i.file}:${i.line}:${i.col}`);
+            console.log(`  ${i.message}`);
+            console.log(`  Suggestion: ${i.suggestion}`);
+            console.log(`  Snippet: ${i.snippet}`);
+            console.log();
+        }
+        if (issues.length > 25) {
+            console.log(`... and ${issues.length - 25} more`);
+        }
+        process.exit(1);
+    }
+    console.log(`\n${console_chars_1.emoji.success} No obvious open-redirect patterns found`);
+    process.exit(0);
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=open-redirect-prevention.js.map

package/dist/checks/security/open-redirect-prevention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-redirect-prevention.js","sourceRoot":"","sources":["../../../src/checks/security/open-redirect-prevention.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,4CAA8B;AAC9B,gDAAkC;AAClC,6DAAiE;AACjE,wDAAoD;AACpD,8DAA0F;AAC1F,uFAAwF;AACxF,iEAAmG;AAGnG,iBAAiB;AACJ,QAAA,EAAE,GAAG,mCAAmC,CAAC;AACzC,QAAA,IAAI,GAAG,0BAA0B,CAAC;AAClC,QAAA,QAAQ,GAAG,UAAU,CAAC;AACtB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,+CAA+C,CAAC;AAC9D,QAAA,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAWjC,MAAM,QAAQ,GAAG,IAAA,8BAAc,EAAC,4CAA4B,EAAE;IAC5D,eAAe;IACf,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG;IAC1B,aAAa;IACb,aAAa;IACb,UAAU;IACV,WAAW;IACX,MAAM;IACN,UAAU;IACV,YAAY;IACZ,aAAa;IACb,KAAK;CACN,CAAC;AAEF,MAAM,qBAAqB,GAAa;IACtC,yBAAyB;IACzB,0BAA0B;IAC1B,0BAA0B;IAC1B,mBAAmB;IACnB,uBAAuB;IACvB,6BAA6B;IAC7B,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;CACtB,CAAC;AAEF,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,qCAAqC,CAAC,IAAY;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,yBAAyB;IACzB,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,8DAA8D;IAC9D,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,2BAA2B;IAC3B,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,iBAAiB;IACjB,IAAI,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAElE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,4DAA4D,GAAG,cAAc,CAC9E,CAAC;QACF,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;IAElE,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEvB,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,wEAAwE;QACxE,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,qCAAqC,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,SAAS;QACX,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACtC,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,4DAA4D,GAAG,cAAc,CAC9E,CAAC;YACF,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC9C,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAe;IAEf,MAAM,OAAO,GAA2D,EAAE,CAAC;IAE3E,MAAM,MAAM,GAAG,mEAAmE,CAAC;IACnF,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,IAAI,sCAAsC,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,0BAA0B,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,MAAM,sBAAS,CAAC,QAAQ,CAAC,oCAAoC,EAAE;QAC3E,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE9C,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC9B,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAChC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EACnC,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEzC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAE3B,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,eAAe,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpC,IAAI,qCAAqC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAE1D,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;YAEhE,wEAAwE;YACxE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvD,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACpD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAEjD,IAAI,CAAC,SAAS,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrD,SAAS;YACX,CAAC;YAED,MAAM,EAAE,GAAG,IAAA,gCAAc,EAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,GAAG,EAAE,EAAE,CAAC,GAAG;gBACX,OAAO,EACL,0FAA0F;gBAC5F,UAAU,EACR,wIAAwI;gBAC1I,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAuB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,UAAU,EAAE;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;KACjD,CAAC,CAAC,CAAC;IACJ,IAAA,+BAAa,EAAC,QAAQ,CAAC,CAAC;IAExB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CACT,KAAK,qBAAK,CAAC,KAAK,cAAc,MAAM,CAAC,MAAM,yCAAyC,CACrF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;IAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/checks/security/path-traversal-prevention.d.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env tsx
+/**
+ * Path Traversal Prevention Preflight (BLOCKING)
+ *
+ * Detects potential path traversal vulnerabilities in file operations.
+ * Path traversal attacks use sequences like "../" to access files outside
+ * the intended directory.
+ *
+ * Checks for:
+ * - User input directly used in file paths without sanitization
+ * - Missing path.basename() or path.resolve() validation
+ * - Dynamic file paths from request params/query/body
+ * - Unsafe path concatenation patterns
+ *
+ * Usage:
+ *   pnpm preflight:path-traversal
+ *   pnpm preflight:path-traversal --verbose
+ */
+export declare const id = "security/path-traversal-prevention";
+export declare const name = "Path Traversal Prevention";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "Path Traversal Prevention Preflight (BLOCKING)";
+export declare const tags: string[];
+//# sourceMappingURL=path-traversal-prevention.d.ts.map

package/dist/checks/security/path-traversal-prevention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-traversal-prevention.d.ts","sourceRoot":"","sources":["../../../src/checks/security/path-traversal-prevention.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAUH,eAAO,MAAM,EAAE,uCAAuC,CAAC;AACvD,eAAO,MAAM,IAAI,8BAA8B,CAAC;AAChD,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,mDAAmD,CAAC;AAC5E,eAAO,MAAM,IAAI,UAAe,CAAC"}

package/dist/checks/security/path-traversal-prevention.js

@@ -0,0 +1,246 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Path Traversal Prevention Preflight (BLOCKING)
+ *
+ * Detects potential path traversal vulnerabilities in file operations.
+ * Path traversal attacks use sequences like "../" to access files outside
+ * the intended directory.
+ *
+ * Checks for:
+ * - User input directly used in file paths without sanitization
+ * - Missing path.basename() or path.resolve() validation
+ * - Dynamic file paths from request params/query/body
+ * - Unsafe path concatenation patterns
+ *
+ * Usage:
+ *   pnpm preflight:path-traversal
+ *   pnpm preflight:path-traversal --verbose
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const fs = __importStar(require("fs"));
+const glob_1 = require("glob");
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Check metadata
+exports.id = "security/path-traversal-prevention";
+exports.name = "Path Traversal Prevention";
+exports.category = "security";
+exports.blocking = true;
+exports.description = "Path Traversal Prevention Preflight (BLOCKING)";
+exports.tags = ["security"];
+const DANGEROUS_PATTERNS = [
+    // Direct path concatenation with user input
+    {
+        pattern: /path\.join\([^)]*(?:req\.(?:params|query|body)|params\.|searchParams)/gi,
+        message: "User input used directly in path.join() - validate with path.basename() first",
+        severity: "error",
+    },
+    // Template literal paths with user input
+    {
+        pattern: /`[^`]*\$\{[^}]*(?:req\.(?:params|query|body)|params\.|searchParams)[^}]*\}[^`]*`.*(?:readFile|writeFile|unlink|rmdir|mkdir|access|stat|open)/gi,
+        message: "Template literal with user input used in file operation",
+        severity: "error",
+    },
+    // String concatenation for paths
+    {
+        pattern: /(?:readFile|writeFile|createReadStream|createWriteStream)\s*\([^)]*\+[^)]*(?:req\.|params\.|query\.|body\.)/gi,
+        message: "String concatenation with user input in file operation",
+        severity: "error",
+    },
+    // fs operations with dynamic paths from request
+    {
+        pattern: /fs\.(?:readFile|writeFile|unlink|rmdir|mkdir|access|stat|readdir|rename|copyFile)\s*\(\s*(?:req\.(?:params|query|body)|params\.)/gi,
+        message: "File system operation with unsanitized user input",
+        severity: "error",
+    },
+    // Unsafe download/serve file patterns
+    {
+        pattern: /res\.(?:sendFile|download)\s*\([^)]*(?:req\.(?:params|query|body)|params\.)/gi,
+        message: "sendFile/download with user input - ensure path is validated",
+        severity: "error",
+    },
+    // Missing basename validation before file operations
+    {
+        pattern: /const\s+(?:file(?:name|Path)?|path)\s*=\s*(?:req\.(?:params|query|body)|params\.|searchParams)[^;]*;[^]*?(?:readFile|writeFile|unlink)/gi,
+        message: "User input assigned to path variable without basename() validation",
+        severity: "warning",
+    },
+    // Potential directory listing with user input
+    {
+        pattern: /fs\.readdir\s*\([^)]*(?:req\.|params\.|query\.)/gi,
+        message: "Directory listing with user input - potential information disclosure",
+        severity: "error",
+    },
+    // R2/S3 key from user input without validation
+    {
+        pattern: /(?:Key|key)\s*:\s*(?:`[^`]*\$\{|.*\+).*(?:req\.|params\.|query\.)/gi,
+        message: "Storage key constructed from user input - validate to prevent traversal",
+        severity: "warning",
+    },
+];
+// Patterns that indicate proper sanitization
+const SAFE_PATTERNS = [
+    /path\.basename\s*\(/,
+    /path\.normalize\s*\(/,
+    /\.replace\s*\(\s*\/\.\.\//,
+    /\.replace\s*\(\s*\/[\[\]\\\/]/,
+    /sanitize(?:Path|Filename|Input)/i,
+    /validatePath/i,
+    /allowedPaths\.includes/,
+    /whitelist/i,
+];
+async function findFiles() {
+    const patterns = ["app/api/**/*.ts", "lib/**/*.ts", "scripts/**/*.ts", "app/**/route.ts"];
+    const files = [];
+    for (const pattern of patterns) {
+        const matches = await (0, glob_1.glob)(pattern, {
+            ignore: ["**/node_modules/**", "**/*.test.ts", "**/*.spec.ts", "**/dist/**"],
+        });
+        files.push(...matches);
+    }
+    return [...new Set(files)];
+}
+function checkFile(filePath, content) {
+    const issues = [];
+    const lines = content.split("\n");
+    // Skip test files and mocks
+    if (filePath.includes(".test.") ||
+        filePath.includes(".spec.") ||
+        filePath.includes("__mocks__")) {
+        return [];
+    }
+    for (const { pattern, message, severity } of DANGEROUS_PATTERNS) {
+        // Reset regex state
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(content)) !== null) {
+            const matchIndex = match.index;
+            // Find line number
+            let lineNumber = 1;
+            let charCount = 0;
+            for (let i = 0; i < lines.length; i++) {
+                charCount += lines[i].length + 1; // +1 for newline
+                if (charCount > matchIndex) {
+                    lineNumber = i + 1;
+                    break;
+                }
+            }
+            // Check surrounding context for safe patterns (50 chars before and after)
+            const contextStart = Math.max(0, matchIndex - 200);
+            const contextEnd = Math.min(content.length, matchIndex + match[0].length + 200);
+            const context = content.slice(contextStart, contextEnd);
+            const isSafe = SAFE_PATTERNS.some((safePattern) => safePattern.test(context));
+            if (!isSafe) {
+                issues.push({
+                    file: filePath,
+                    line: lineNumber,
+                    pattern: pattern.source.slice(0, 50) + "...",
+                    severity,
+                    message,
+                    code: match[0].slice(0, 100),
+                });
+            }
+        }
+    }
+    return issues;
+}
+async function main() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(path.basename(__filename, ".ts"));
+    const verbose = process.argv.includes("--verbose") || process.argv.includes("-v");
+    console.log(`${console_chars_1.emoji.lock} Path Traversal Prevention Preflight`);
+    console.log((0, console_chars_1.createDivider)(60, "heavy"));
+    const files = await findFiles();
+    console.log(`Scanning ${files.length} files for path traversal vulnerabilities...\n`);
+    const allIssues = [];
+    for (const file of files) {
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            const issues = checkFile(file, content);
+            allIssues.push(...issues);
+        }
+        catch (error) {
+            // Skip files that can't be read
+        }
+    }
+    // Group by severity
+    const errors = allIssues.filter((i) => i.severity === "error");
+    const warnings = allIssues.filter((i) => i.severity === "warning");
+    if (errors.length > 0) {
+        console.log(`${console_chars_1.emoji.error} ERRORS (blocking):`);
+        console.log((0, console_chars_1.createDivider)(60, "light"));
+        for (const issue of errors) {
+            console.log(`  ${issue.file}:${issue.line}`);
+            console.log(`    ${issue.message}`);
+            if (verbose) {
+                console.log(`    Code: ${issue.code}`);
+            }
+            console.log("");
+        }
+    }
+    if (warnings.length > 0) {
+        console.log(`${console_chars_1.emoji.warning}  WARNINGS:`);
+        console.log((0, console_chars_1.createDivider)(60, "light"));
+        for (const issue of warnings) {
+            console.log(`  ${issue.file}:${issue.line}`);
+            console.log(`    ${issue.message}`);
+            if (verbose) {
+                console.log(`    Code: ${issue.code}`);
+            }
+            console.log("");
+        }
+    }
+    console.log((0, console_chars_1.createDivider)(60, "heavy"));
+    console.log(`Files scanned: ${files.length}`);
+    console.log(`Errors: ${errors.length}`);
+    console.log(`Warnings: ${warnings.length}`);
+    if (errors.length === 0 && warnings.length === 0) {
+        console.log(`\n${console_chars_1.emoji.success} No path traversal vulnerabilities detected`);
+    }
+    console.log(`\n${console_chars_1.emoji.docs} Safe patterns to use:`);
+    console.log(`   ${console_chars_1.chars.bullet} path.basename(userInput) - strips directory components`);
+    console.log(`   ${console_chars_1.chars.bullet} path.resolve(baseDir, path.basename(userInput))`);
+    console.log(`   ${console_chars_1.chars.bullet} Whitelist allowed filenames/paths`);
+    console.log(`   ${console_chars_1.chars.bullet} Validate against regex: /^[a-zA-Z0-9_-]+$/`);
+    // Exit with error if blocking issues found
+    if (errors.length > 0) {
+        process.exit(1);
+    }
+}
+main().catch(console.error);
+//# sourceMappingURL=path-traversal-prevention.js.map

package/dist/checks/security/path-traversal-prevention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-traversal-prevention.js","sourceRoot":"","sources":["../../../src/checks/security/path-traversal-prevention.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,+BAA4B;AAC5B,2CAA6B;AAC7B,6DAAwE;AACxE,uFAAwF;AAGxF,iBAAiB;AACJ,QAAA,EAAE,GAAG,oCAAoC,CAAC;AAC1C,QAAA,IAAI,GAAG,2BAA2B,CAAC;AACnC,QAAA,QAAQ,GAAG,UAAU,CAAC;AACtB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,gDAAgD,CAAC;AAC/D,QAAA,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAWjC,MAAM,kBAAkB,GAAG;IACzB,4CAA4C;IAC5C;QACE,OAAO,EAAE,yEAAyE;QAClF,OAAO,EAAE,+EAA+E;QACxF,QAAQ,EAAE,OAAgB;KAC3B;IACD,yCAAyC;IACzC;QACE,OAAO,EACL,gJAAgJ;QAClJ,OAAO,EAAE,yDAAyD;QAClE,QAAQ,EAAE,OAAgB;KAC3B;IACD,iCAAiC;IACjC;QACE,OAAO,EACL,+GAA+G;QACjH,OAAO,EAAE,wDAAwD;QACjE,QAAQ,EAAE,OAAgB;KAC3B;IACD,gDAAgD;IAChD;QACE,OAAO,EACL,oIAAoI;QACtI,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,OAAgB;KAC3B;IACD,sCAAsC;IACtC;QACE,OAAO,EAAE,+EAA+E;QACxF,OAAO,EAAE,8DAA8D;QACvE,QAAQ,EAAE,OAAgB;KAC3B;IACD,qDAAqD;IACrD;QACE,OAAO,EACL,0IAA0I;QAC5I,OAAO,EAAE,oEAAoE;QAC7E,QAAQ,EAAE,SAAkB;KAC7B;IACD,8CAA8C;IAC9C;QACE,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,sEAAsE;QAC/E,QAAQ,EAAE,OAAgB;KAC3B;IACD,+CAA+C;IAC/C;QACE,OAAO,EAAE,qEAAqE;QAC9E,OAAO,EAAE,yEAAyE;QAClF,QAAQ,EAAE,SAAkB;KAC7B;CACF,CAAC;AAEF,6CAA6C;AAC7C,MAAM,aAAa,GAAG;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,2BAA2B;IAC3B,+BAA+B;IAC/B,kCAAkC;IAClC,eAAe;IACf,wBAAwB;IACxB,YAAY;CACb,CAAC;AAEF,KAAK,UAAU,SAAS;IACtB,MAAM,QAAQ,GAAG,CAAC,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAE1F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAA,WAAI,EAAC,OAAO,EAAE;YAClC,MAAM,EAAE,CAAC,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,CAAC;SAC7E,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,OAAe;IAClD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,4BAA4B;IAC5B,IACE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC9B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAChE,oBAAoB;QACpB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAEtB,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;YAE/B,mBAAmB;YACnB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,iBAAiB;gBACnD,IAAI,SAAS,GAAG,UAAU,EAAE,CAAC;oBAC3B,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,0EAA0E;YAC1E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,GAAG,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;YAChF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAExD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAE9E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBAC5C,QAAQ;oBACR,OAAO;oBACP,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElF,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,IAAI,sCAAsC,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,MAAM,gDAAgD,CAAC,CAAC;IAEtF,MAAM,SAAS,GAAY,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxC,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,qBAAqB,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,aAAa,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,IAAI,wBAAwB,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,MAAM,yDAAyD,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,MAAM,kDAAkD,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,MAAM,oCAAoC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,MAAM,6CAA6C,CAAC,CAAC;IAE7E,2CAA2C;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/checks/security/permission-security-validation.d.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env tsx
+/**
+ * Permission Security Validation Preflight
+ *
+ * Ensures permission-gated actions are properly secured:
+ * - API routes check permissions before performing actions
+ * - Team member actions verify role/permissions
+ * - Store owner actions verify ownership
+ * - Permission groups are validated before assignment
+ *
+ * BLOCKING: Missing permission checks enable unauthorized access
+ */
+export declare const id = "security/permission-security-validation";
+export declare const name = "Permission Security Validation";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "Permission Security Validation Preflight";
+export declare const tags: string[];
+//# sourceMappingURL=permission-security-validation.d.ts.map

package/dist/checks/security/permission-security-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-security-validation.d.ts","sourceRoot":"","sources":["../../../src/checks/security/permission-security-validation.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AAQH,eAAO,MAAM,EAAE,4CAA4C,CAAC;AAC5D,eAAO,MAAM,IAAI,mCAAmC,CAAC;AACrD,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,6CAA6C,CAAC;AACtE,eAAO,MAAM,IAAI,UAA4B,CAAC"}