@grafema/core 0.1.0-alpha.1

package/dist/plugins/validation/EvalBanValidator.d.ts

@@ -0,0 +1,25 @@
+/**
+ * EvalBanValidator - запрещает использование eval и Function
+ *
+ * Security инвариант: код не должен использовать динамическое выполнение.
+ *
+ * Детектирует:
+ * - eval("code") - прямой вызов eval
+ * - new Function("code") - конструктор Function
+ * - Function("code") - вызов Function без new
+ * - window.eval("code") - eval через window
+ * - globalThis.eval("code") - eval через globalThis
+ * - Aliased eval: const e = eval; e("code") - через AliasTracker
+ *
+ * ПРАВИЛА (Datalog):
+ * violation(X) :- node(X, "CALL"), attr(X, "name", "eval").
+ * violation(X) :- node(X, "CALL"), attr(X, "name", "Function").
+ * violation(X) :- node(X, "CALL"), attr(X, "method", "eval").
+ */
+import { Plugin } from '../Plugin.js';
+import type { PluginContext, PluginResult, PluginMetadata } from '../Plugin.js';
+export declare class EvalBanValidator extends Plugin {
+    get metadata(): PluginMetadata;
+    execute(context: PluginContext): Promise<PluginResult>;
+}
+//# sourceMappingURL=EvalBanValidator.d.ts.map

package/dist/plugins/validation/EvalBanValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EvalBanValidator.d.ts","sourceRoot":"","sources":["../../../src/plugins/validation/EvalBanValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,EAAuB,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAoChF,qBAAa,gBAAiB,SAAQ,MAAM;IAC1C,IAAI,QAAQ,IAAI,cAAc,CAU7B;IAEK,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;CAyG7D"}

package/dist/plugins/validation/EvalBanValidator.js

@@ -0,0 +1,123 @@
+/**
+ * EvalBanValidator - запрещает использование eval и Function
+ *
+ * Security инвариант: код не должен использовать динамическое выполнение.
+ *
+ * Детектирует:
+ * - eval("code") - прямой вызов eval
+ * - new Function("code") - конструктор Function
+ * - Function("code") - вызов Function без new
+ * - window.eval("code") - eval через window
+ * - globalThis.eval("code") - eval через globalThis
+ * - Aliased eval: const e = eval; e("code") - через AliasTracker
+ *
+ * ПРАВИЛА (Datalog):
+ * violation(X) :- node(X, "CALL"), attr(X, "name", "eval").
+ * violation(X) :- node(X, "CALL"), attr(X, "name", "Function").
+ * violation(X) :- node(X, "CALL"), attr(X, "method", "eval").
+ */
+import { Plugin, createSuccessResult } from '../Plugin.js';
+export class EvalBanValidator extends Plugin {
+    get metadata() {
+        return {
+            name: 'EvalBanValidator',
+            phase: 'VALIDATION',
+            priority: 95, // Высокий приоритет - security check
+            creates: {
+                nodes: [],
+                edges: []
+            }
+        };
+    }
+    async execute(context) {
+        const { graph } = context;
+        console.log('[EvalBanValidator] Checking for eval/Function usage...');
+        const startTime = Date.now();
+        const issues = [];
+        // ОПТИМИЗАЦИЯ: вместо Datalog (медленный full scan), используем прямые graph queries
+        // Datalog зависает на больших графах из-за отсутствия индексов
+        // 1. Прямой вызов eval("code") - ищем все CALL ноды с name="eval"
+        console.log('[EvalBanValidator] Searching for eval() calls...');
+        const evalStart = Date.now();
+        let evalCount = 0;
+        for await (const node of graph.queryNodes({ nodeType: 'CALL' })) {
+            if (node.name === 'eval') {
+                evalCount++;
+                issues.push({
+                    type: 'EVAL_USAGE',
+                    severity: 'ERROR',
+                    message: `Direct eval() call at ${node.file}:${node.line || '?'} - dynamic code execution is forbidden`,
+                    nodeId: node.id,
+                    file: node.file,
+                    line: node.line
+                });
+            }
+        }
+        console.log(`[EvalBanValidator] eval() search took ${Date.now() - evalStart}ms, found ${evalCount} violations`);
+        // 2. Вызов Function("code") или new Function("code")
+        console.log('[EvalBanValidator] Searching for Function() calls...');
+        const funcStart = Date.now();
+        let funcCount = 0;
+        for await (const node of graph.queryNodes({ nodeType: 'CALL' })) {
+            if (node.name === 'Function') {
+                funcCount++;
+                issues.push({
+                    type: 'FUNCTION_CONSTRUCTOR',
+                    severity: 'ERROR',
+                    message: `Function() constructor at ${node.file}:${node.line || '?'} - dynamic code execution is forbidden`,
+                    nodeId: node.id,
+                    file: node.file,
+                    line: node.line
+                });
+            }
+        }
+        console.log(`[EvalBanValidator] Function() search took ${Date.now() - funcStart}ms, found ${funcCount} violations`);
+        // 3. Method call: window.eval, globalThis.eval, this.eval
+        // Note: METHOD_CALL was merged into CALL - method calls have 'method' attribute
+        console.log('[EvalBanValidator] Searching for method eval() calls...');
+        const methodStart = Date.now();
+        let methodCount = 0;
+        for await (const node of graph.queryNodes({ nodeType: 'CALL' })) {
+            const callNode = node;
+            // Method calls have 'method' attribute (e.g., window.eval())
+            if (callNode.method === 'eval' && callNode.object) {
+                methodCount++;
+                const objectName = callNode.object;
+                issues.push({
+                    type: 'EVAL_METHOD',
+                    severity: 'ERROR',
+                    message: `${objectName}.eval() call at ${node.file}:${node.line || '?'} - dynamic code execution is forbidden`,
+                    nodeId: node.id,
+                    file: node.file,
+                    line: node.line,
+                    object: objectName
+                });
+            }
+        }
+        console.log(`[EvalBanValidator] method eval() search took ${Date.now() - methodStart}ms, found ${methodCount} violations`);
+        // 4. Aliased eval - SKIP for now (complex Datalog query causes OOM)
+        console.log('[EvalBanValidator] Skipping aliased eval detection (requires optimized implementation)');
+        const totalTime = ((Date.now() - startTime) / 1000).toFixed(1);
+        const summary = {
+            evalCalls: evalCount,
+            functionCalls: funcCount,
+            methodEvalCalls: methodCount,
+            aliasedEvalCalls: 0, // Skipped for now
+            totalViolations: issues.length,
+            timeSeconds: totalTime
+        };
+        console.log('[EvalBanValidator] Summary:', summary);
+        if (issues.length > 0) {
+            console.log('[EvalBanValidator] ❌ Security violations found:');
+            for (const issue of issues) {
+                console.log(`  🚫 ${issue.message}`);
+            }
+        }
+        else {
+            console.log('[EvalBanValidator] ✅ No eval/Function usage detected');
+        }
+        return createSuccessResult({ nodes: 0, edges: 0 }, // created - validator doesn't create nodes/edges
+        { summary, issues } // metadata
+        );
+    }
+}

package/dist/plugins/validation/GraphConnectivityValidator.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GraphConnectivityValidator - проверяет что все узлы связаны с корневыми узлами
+ * Находит "островки" - узлы которые не имеют путей до SERVICE/MODULE
+ */
+import { Plugin } from '../Plugin.js';
+import type { PluginContext, PluginMetadata, PluginResult } from '../Plugin.js';
+export declare class GraphConnectivityValidator extends Plugin {
+    get metadata(): PluginMetadata;
+    execute(context: PluginContext): Promise<PluginResult>;
+}
+//# sourceMappingURL=GraphConnectivityValidator.d.ts.map

package/dist/plugins/validation/GraphConnectivityValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphConnectivityValidator.d.ts","sourceRoot":"","sources":["../../../src/plugins/validation/GraphConnectivityValidator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAuB,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAyChF,qBAAa,0BAA2B,SAAQ,MAAM;IACpD,IAAI,QAAQ,IAAI,cAAc,CAU7B;IAEK,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;CA4I7D"}

package/dist/plugins/validation/GraphConnectivityValidator.js

@@ -0,0 +1,135 @@
+/**
+ * GraphConnectivityValidator - проверяет что все узлы связаны с корневыми узлами
+ * Находит "островки" - узлы которые не имеют путей до SERVICE/MODULE
+ */
+import { Plugin, createSuccessResult } from '../Plugin.js';
+export class GraphConnectivityValidator extends Plugin {
+    get metadata() {
+        return {
+            name: 'GraphConnectivityValidator',
+            phase: 'VALIDATION',
+            priority: 100,
+            creates: {
+                nodes: [],
+                edges: []
+            }
+        };
+    }
+    async execute(context) {
+        const { graph, manifest } = context;
+        const manifestWithValidation = manifest;
+        console.log('[GraphConnectivityValidator] Starting connectivity validation...');
+        // Получаем все узлы
+        const allNodes = await graph.getAllNodes();
+        console.log(`[GraphConnectivityValidator] Total nodes: ${allNodes.length}`);
+        // Находим корневые узлы (SERVICE, MODULE)
+        const rootTypes = ['SERVICE', 'MODULE', 'PROJECT'];
+        const rootNodes = allNodes.filter(n => rootTypes.includes(n.type));
+        console.log(`[GraphConnectivityValidator] Root nodes: ${rootNodes.length}`);
+        if (rootNodes.length === 0) {
+            console.warn('[GraphConnectivityValidator] No root nodes found!');
+            return createSuccessResult({ nodes: 0, edges: 0 }, { skipped: true, reason: 'No root nodes' });
+        }
+        // Check if graph supports getAllEdges
+        if (!graph.getAllEdges) {
+            console.log('[GraphConnectivityValidator] Graph does not support getAllEdges, skipping validation');
+            return createSuccessResult({ nodes: 0, edges: 0 }, { skipped: true, reason: 'No getAllEdges support' });
+        }
+        // Собираем все ребра
+        const allEdges = await graph.getAllEdges();
+        console.log(`[GraphConnectivityValidator] Total edges: ${allEdges.length}`);
+        // Строим карты смежности (обе направления)
+        const adjacencyOut = new Map(); // nodeId -> [targetIds]
+        const adjacencyIn = new Map(); // nodeId -> [sourceIds]
+        for (const edge of allEdges) {
+            // Outgoing edges
+            if (!adjacencyOut.has(edge.src)) {
+                adjacencyOut.set(edge.src, []);
+            }
+            adjacencyOut.get(edge.src).push(edge.dst);
+            // Incoming edges
+            if (!adjacencyIn.has(edge.dst)) {
+                adjacencyIn.set(edge.dst, []);
+            }
+            adjacencyIn.get(edge.dst).push(edge.src);
+        }
+        // BFS от корневых узлов для поиска достижимых узлов
+        const reachable = new Set();
+        const queue = [...rootNodes.map(n => n.id)];
+        while (queue.length > 0) {
+            const nodeId = queue.shift();
+            if (reachable.has(nodeId))
+                continue;
+            reachable.add(nodeId);
+            // Добавляем все связанные узлы (в обоих направлениях)
+            const outgoing = adjacencyOut.get(nodeId) || [];
+            const incoming = adjacencyIn.get(nodeId) || [];
+            for (const targetId of [...outgoing, ...incoming]) {
+                if (!reachable.has(targetId)) {
+                    queue.push(targetId);
+                }
+            }
+        }
+        // Находим недостижимые узлы
+        const unreachable = allNodes.filter(n => !reachable.has(n.id));
+        if (unreachable.length > 0) {
+            // ЯРКОЕ ПРЕДУПРЕЖДЕНИЕ В КОНСОЛИ
+            console.error('\n' + '='.repeat(80));
+            console.error('⚠️  GRAPH VALIDATION ERROR: DISCONNECTED NODES FOUND');
+            console.error('='.repeat(80));
+            console.error(`Found ${unreachable.length} unreachable nodes (${((unreachable.length / allNodes.length) * 100).toFixed(1)}% of total)`);
+            console.error(`These nodes are not connected to the main graph (SERVICE/MODULE/PROJECT level)`);
+            console.error('');
+            // Группируем по типам для читаемости
+            const byType = {};
+            for (const node of unreachable) {
+                if (!byType[node.type])
+                    byType[node.type] = [];
+                byType[node.type].push(node);
+            }
+            for (const [type, nodes] of Object.entries(byType)) {
+                console.error(`  ${type}: ${nodes.length} nodes`);
+                // Показываем первые 5 для каждого типа
+                for (const node of nodes.slice(0, 5)) {
+                    console.error(`    - ${node.name || node.id}`);
+                    // Показываем связи этого узла
+                    const out = adjacencyOut.get(node.id) || [];
+                    const incoming = adjacencyIn.get(node.id) || [];
+                    if (out.length > 0 || incoming.length > 0) {
+                        console.error(`      Edges: ${incoming.length} incoming, ${out.length} outgoing`);
+                    }
+                }
+                if (nodes.length > 5) {
+                    console.error(`    ... and ${nodes.length - 5} more`);
+                }
+            }
+            console.error('');
+            console.error('💡 ACTION REQUIRED: Fix analysis plugins to ensure all nodes are connected');
+            console.error('   Anonymous functions, callbacks, and method calls should be linked to parent nodes');
+            console.error('='.repeat(80) + '\n');
+            // Сохраняем информацию в manifest для дальнейшего использования
+            if (!manifestWithValidation.validation)
+                manifestWithValidation.validation = {};
+            manifestWithValidation.validation.unreachableNodes = unreachable.map(n => ({
+                id: n.id,
+                type: n.type,
+                name: n.name
+            }));
+            manifestWithValidation.validation.hasErrors = true;
+            manifestWithValidation.validation.totalNodes = allNodes.length;
+            manifestWithValidation.validation.reachableNodes = reachable.size;
+            manifestWithValidation.validation.unreachableCount = unreachable.length;
+            manifestWithValidation.validation.unreachableByType = Object.fromEntries(Object.entries(byType).map(([type, nodes]) => [type, nodes.length]));
+        }
+        else {
+            console.log('[GraphConnectivityValidator] ✅ All nodes are reachable from root nodes');
+            if (!manifestWithValidation.validation)
+                manifestWithValidation.validation = {};
+            manifestWithValidation.validation.hasErrors = false;
+            manifestWithValidation.validation.totalNodes = allNodes.length;
+            manifestWithValidation.validation.reachableNodes = reachable.size;
+        }
+        console.log(`[GraphConnectivityValidator] Validation complete: ${reachable.size}/${allNodes.length} nodes reachable`);
+        return createSuccessResult({ nodes: 0, edges: 0 }, { totalNodes: allNodes.length, reachableNodes: reachable.size });
+    }
+}

package/dist/plugins/validation/SQLInjectionValidator.d.ts

@@ -0,0 +1,43 @@
+/**
+ * SQLInjectionValidator - детектирует SQL injection уязвимости
+ *
+ * Security инвариант: SQL запросы не должны содержать недетерминированные
+ * значения (user input) без параметризации.
+ *
+ * Детектирует:
+ * - Template literal с переменными от параметров: `SELECT * FROM users WHERE id = ${userId}`
+ * - String concatenation с user input: "SELECT * FROM users WHERE id = " + userId
+ *
+ * Безопасные паттерны (НЕ flagged):
+ * - Параметризованные запросы: db.query('SELECT * FROM users WHERE id = ?', [userId])
+ * - Только литералы: const query = 'SELECT * FROM users'
+ * - Литералы в template: const role = 'admin'; `SELECT * FROM users WHERE role = '${role}'`
+ *
+ * ПРАВИЛА:
+ * 1. Найти CALL с method = query/execute/run/all/get
+ * 2. Проверить первый аргумент - если содержит nondeterministic value → violation
+ * 3. Использовать ValueDomainAnalyzer для трассировки значений
+ */
+import { Plugin } from '../Plugin.js';
+import type { PluginContext, PluginResult, PluginMetadata } from '../Plugin.js';
+export declare class SQLInjectionValidator extends Plugin {
+    private valueAnalyzer;
+    constructor();
+    get metadata(): PluginMetadata;
+    execute(context: PluginContext): Promise<PluginResult>;
+    /**
+     * Analyze a SQL query call for injection vulnerabilities
+     */
+    private analyzeQueryCall;
+    /**
+     * Check if an expression contains nondeterministic values
+     */
+    private checkExpressionForNondeterminism;
+    /**
+     * Check via Datalog graph pattern for SQL injection
+     * Pattern: CALL -[PASSES_ARGUMENT]-> VARIABLE -[ASSIGNED_FROM*]-> PARAMETER
+     */
+    private checkViaGraphPattern;
+}
+export default SQLInjectionValidator;
+//# sourceMappingURL=SQLInjectionValidator.d.ts.map

package/dist/plugins/validation/SQLInjectionValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SQLInjectionValidator.d.ts","sourceRoot":"","sources":["../../../src/plugins/validation/SQLInjectionValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,EAAuB,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAsEhF,qBAAa,qBAAsB,SAAQ,MAAM;IAC/C,OAAO,CAAC,aAAa,CAAsB;;IAO3C,IAAI,QAAQ,IAAI,cAAc,CAU7B;IAEK,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAmE5D;;OAEG;YACW,gBAAgB;IAgF9B;;OAEG;YACW,gCAAgC;IAsC9C;;;OAGG;YACW,oBAAoB;CAqDnC;AAED,eAAe,qBAAqB,CAAC"}

package/dist/plugins/validation/SQLInjectionValidator.js

@@ -0,0 +1,251 @@
+/**
+ * SQLInjectionValidator - детектирует SQL injection уязвимости
+ *
+ * Security инвариант: SQL запросы не должны содержать недетерминированные
+ * значения (user input) без параметризации.
+ *
+ * Детектирует:
+ * - Template literal с переменными от параметров: `SELECT * FROM users WHERE id = ${userId}`
+ * - String concatenation с user input: "SELECT * FROM users WHERE id = " + userId
+ *
+ * Безопасные паттерны (НЕ flagged):
+ * - Параметризованные запросы: db.query('SELECT * FROM users WHERE id = ?', [userId])
+ * - Только литералы: const query = 'SELECT * FROM users'
+ * - Литералы в template: const role = 'admin'; `SELECT * FROM users WHERE role = '${role}'`
+ *
+ * ПРАВИЛА:
+ * 1. Найти CALL с method = query/execute/run/all/get
+ * 2. Проверить первый аргумент - если содержит nondeterministic value → violation
+ * 3. Использовать ValueDomainAnalyzer для трассировки значений
+ */
+import { Plugin, createSuccessResult } from '../Plugin.js';
+import { ValueDomainAnalyzer } from '../enrichment/ValueDomainAnalyzer.js';
+// SQL query method names to detect
+const SQL_METHODS = ['query', 'execute', 'exec', 'run', 'all', 'get', 'prepare', 'raw'];
+export class SQLInjectionValidator extends Plugin {
+    valueAnalyzer;
+    constructor() {
+        super();
+        this.valueAnalyzer = new ValueDomainAnalyzer();
+    }
+    get metadata() {
+        return {
+            name: 'SQLInjectionValidator',
+            phase: 'VALIDATION',
+            priority: 90, // After ValueDomainAnalyzer (65)
+            creates: {
+                nodes: [],
+                edges: []
+            }
+        };
+    }
+    async execute(context) {
+        const { graph } = context;
+        console.log('[SQLInjectionValidator] Checking for SQL injection vulnerabilities...');
+        const issues = [];
+        // 1. Find all CALL nodes that look like SQL queries
+        const sqlCalls = [];
+        for await (const node of graph.queryNodes({ nodeType: 'CALL' })) {
+            const callNode = node;
+            const method = callNode.method || callNode.name;
+            if (method && SQL_METHODS.includes(method)) {
+                sqlCalls.push(callNode);
+            }
+        }
+        console.log(`[SQLInjectionValidator] Found ${sqlCalls.length} potential SQL calls`);
+        // 2. For each SQL call, analyze the query argument
+        for (const call of sqlCalls) {
+            const result = await this.analyzeQueryCall(call, graph);
+            if (result.isVulnerable) {
+                issues.push({
+                    type: 'SQL_INJECTION',
+                    severity: 'ERROR',
+                    message: `Potential SQL injection at ${call.file}:${call.line || '?'} - ${result.reason}`,
+                    nodeId: call.id,
+                    file: call.file,
+                    line: call.line,
+                    reason: result.reason,
+                    nondeterministicSources: result.sources
+                });
+            }
+        }
+        // 3. Also check via graph pattern - CALL nodes that have ARGUMENT -> PARAMETER paths
+        const patternViolations = await this.checkViaGraphPattern(graph, sqlCalls);
+        for (const violation of patternViolations) {
+            // Avoid duplicates
+            if (!issues.find(i => i.nodeId === violation.nodeId)) {
+                issues.push(violation);
+            }
+        }
+        const summary = {
+            sqlCallsChecked: sqlCalls.length,
+            vulnerabilitiesFound: issues.length
+        };
+        console.log('[SQLInjectionValidator] Summary:', summary);
+        if (issues.length > 0) {
+            console.log('[SQLInjectionValidator] ❌ SQL injection vulnerabilities found:');
+            for (const issue of issues) {
+                console.log(`  🚫 ${issue.message}`);
+            }
+        }
+        else {
+            console.log('[SQLInjectionValidator] ✅ No SQL injection vulnerabilities detected');
+        }
+        return createSuccessResult({ nodes: 0, edges: 0 }, { summary, issues });
+    }
+    /**
+     * Analyze a SQL query call for injection vulnerabilities
+     */
+    async analyzeQueryCall(call, graph) {
+        const result = {
+            isVulnerable: false,
+            reason: null,
+            sources: []
+        };
+        // Get the query argument - usually first argument
+        // We need to check if it has nondeterministic content
+        // Check if this call has PASSES_ARGUMENT edges
+        const outgoing = await graph.getOutgoingEdges(call.id);
+        const argEdges = outgoing.filter(e => (e.edgeType || e.edge_type) === 'PASSES_ARGUMENT');
+        if (argEdges.length === 0) {
+            // No tracked arguments - check via queryArgName attribute if available
+            if (call.queryArgName) {
+                const valueSet = await this.valueAnalyzer.getValueSet(call.queryArgName, call.file, graph);
+                if (valueSet.hasUnknown) {
+                    result.isVulnerable = true;
+                    result.reason = `Query argument "${call.queryArgName}" contains user input`;
+                    result.sources = ['unknown'];
+                }
+            }
+            return result;
+        }
+        // Check each argument
+        for (const edge of argEdges) {
+            const argId = edge.dst || edge.target_id;
+            const argNode = await graph.getNode(argId);
+            if (!argNode)
+                continue;
+            const argIndex = edge.argIndex || edge.index;
+            if (argIndex !== 0 && argIndex !== undefined)
+                continue; // Only check first argument
+            // Check argument type
+            const argType = argNode.nodeType || argNode.type;
+            if (argType === 'LITERAL') {
+                // Pure literal - safe
+                continue;
+            }
+            if (argType === 'VARIABLE' || argType === 'CONSTANT') {
+                // Trace value domain
+                const varName = argNode.name || argNode.attrs?.name;
+                if (varName) {
+                    const valueSet = await this.valueAnalyzer.getValueSet(varName, call.file, graph);
+                    if (valueSet.hasUnknown) {
+                        result.isVulnerable = true;
+                        result.reason = `Query variable "${varName}" may contain user input`;
+                        result.sources.push(varName);
+                    }
+                }
+            }
+            if (argType === 'PARAMETER') {
+                // Direct parameter in query - definitely vulnerable
+                result.isVulnerable = true;
+                result.reason = 'Query contains direct function parameter';
+                result.sources.push(argNode.name || 'parameter');
+            }
+            if (argType === 'EXPRESSION') {
+                // Template literal or concatenation - check for nondeterministic values
+                const { hasUnknown, sources } = await this.checkExpressionForNondeterminism(argNode, graph);
+                if (hasUnknown) {
+                    result.isVulnerable = true;
+                    result.reason = 'Query expression contains nondeterministic values';
+                    result.sources.push(...sources);
+                }
+            }
+        }
+        return result;
+    }
+    /**
+     * Check if an expression contains nondeterministic values
+     */
+    async checkExpressionForNondeterminism(exprNode, graph) {
+        const result = { hasUnknown: false, sources: [] };
+        // Check DERIVES_FROM edges
+        const outgoing = await graph.getOutgoingEdges(exprNode.id);
+        const derivesFromEdges = outgoing.filter(e => (e.edgeType || e.edge_type) === 'DERIVES_FROM' ||
+            (e.edgeType || e.edge_type) === 'ASSIGNED_FROM');
+        for (const edge of derivesFromEdges) {
+            const sourceId = edge.dst || edge.target_id;
+            const sourceNode = await graph.getNode(sourceId);
+            if (!sourceNode)
+                continue;
+            const sourceType = sourceNode.nodeType || sourceNode.type;
+            if (sourceType === 'PARAMETER') {
+                result.hasUnknown = true;
+                result.sources.push(sourceNode.name || 'parameter');
+            }
+            else if (sourceType === 'VARIABLE' || sourceType === 'CONSTANT') {
+                const varName = sourceNode.name || sourceNode.attrs?.name;
+                if (varName) {
+                    const valueSet = await this.valueAnalyzer.getValueSet(varName, exprNode.file, graph);
+                    if (valueSet.hasUnknown) {
+                        result.hasUnknown = true;
+                        result.sources.push(varName);
+                    }
+                }
+            }
+        }
+        return result;
+    }
+    /**
+     * Check via Datalog graph pattern for SQL injection
+     * Pattern: CALL -[PASSES_ARGUMENT]-> VARIABLE -[ASSIGNED_FROM*]-> PARAMETER
+     */
+    async checkViaGraphPattern(graph, excludeCalls = []) {
+        const issues = [];
+        const excludeIds = new Set(excludeCalls.map(c => c.id));
+        // Find CALL nodes that have argument tracing to PARAMETER
+        try {
+            // Check if graph supports checkGuarantee
+            if (!graph.checkGuarantee) {
+                console.log('[SQLInjectionValidator] Graph does not support checkGuarantee, skipping pattern-based check');
+                return issues;
+            }
+            // Check guarantee for SQL method calls with parameter-derived arguments
+            const violations = await graph.checkGuarantee(`
+        violation(X) :-
+          node(X, "CALL"),
+          attr(X, "method", M),
+          edge(X, Arg, "PASSES_ARGUMENT"),
+          edge(Arg, P, "ASSIGNED_FROM"),
+          node(P, "PARAMETER").
+      `);
+            for (const v of violations) {
+                const nodeId = v.bindings.find(b => b.name === 'X')?.value;
+                if (nodeId && !excludeIds.has(nodeId)) {
+                    const node = await graph.getNode(nodeId);
+                    if (node) {
+                        const method = node.method || node.name;
+                        if (SQL_METHODS.includes(method)) {
+                            issues.push({
+                                type: 'SQL_INJECTION',
+                                severity: 'ERROR',
+                                message: `SQL injection via parameter flow at ${node.file}:${node.line || '?'}`,
+                                nodeId,
+                                file: node.file,
+                                line: node.line,
+                                reason: 'Parameter value flows into SQL query',
+                                nondeterministicSources: ['parameter']
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        catch (err) {
+            // Datalog query might fail if backend doesn't support it
+            console.log('[SQLInjectionValidator] Datalog check skipped:', err.message);
+        }
+        return issues;
+    }
+}
+export default SQLInjectionValidator;

package/dist/plugins/validation/ShadowingDetector.d.ts

@@ -0,0 +1,26 @@
+/**
+ * ShadowingDetector - detects variable shadowing issues
+ *
+ * Detects two types of shadowing:
+ *
+ * 1. Cross-file shadowing:
+ *    - CLASS `User` defined in models.js
+ *    - VARIABLE `User` in handlers.js shadows the class
+ *    - Method calls on the variable go to wrong target
+ *
+ * 2. Scope-aware shadowing:
+ *    - import { User } from './models'
+ *    - function handler() { const User = {...}; User.save(); }
+ *    - Local variable shadows the imported class
+ *
+ * Implementation notes:
+ * - Datalog doesn't support inequality (\=), so we use JS filtering
+ * - queryNodes is an async generator, use getAllNodes for arrays
+ */
+import { Plugin } from '../Plugin.js';
+import type { PluginContext, PluginResult, PluginMetadata } from '../Plugin.js';
+export declare class ShadowingDetector extends Plugin {
+    get metadata(): PluginMetadata;
+    execute(context: PluginContext): Promise<PluginResult>;
+}
+//# sourceMappingURL=ShadowingDetector.d.ts.map

package/dist/plugins/validation/ShadowingDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ShadowingDetector.d.ts","sourceRoot":"","sources":["../../../src/plugins/validation/ShadowingDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAuB,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAoChF,qBAAa,iBAAkB,SAAQ,MAAM;IAC3C,IAAI,QAAQ,IAAI,cAAc,CAU7B;IAEK,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;CAsG7D"}