@grafema/core 0.1.0-alpha.1

package/src/plugins/validation/SQLInjectionValidator.ts

@@ -0,0 +1,363 @@
+/**
+ * SQLInjectionValidator - детектирует SQL injection уязвимости
+ *
+ * Security инвариант: SQL запросы не должны содержать недетерминированные
+ * значения (user input) без параметризации.
+ *
+ * Детектирует:
+ * - Template literal с переменными от параметров: `SELECT * FROM users WHERE id = ${userId}`
+ * - String concatenation с user input: "SELECT * FROM users WHERE id = " + userId
+ *
+ * Безопасные паттерны (НЕ flagged):
+ * - Параметризованные запросы: db.query('SELECT * FROM users WHERE id = ?', [userId])
+ * - Только литералы: const query = 'SELECT * FROM users'
+ * - Литералы в template: const role = 'admin'; `SELECT * FROM users WHERE role = '${role}'`
+ *
+ * ПРАВИЛА:
+ * 1. Найти CALL с method = query/execute/run/all/get
+ * 2. Проверить первый аргумент - если содержит nondeterministic value → violation
+ * 3. Использовать ValueDomainAnalyzer для трассировки значений
+ */
+
+import { Plugin, createSuccessResult } from '../Plugin.js';
+import type { PluginContext, PluginResult, PluginMetadata } from '../Plugin.js';
+import type { BaseNodeRecord, NodeRecord } from '@grafema/types';
+import type { EdgeRecord as TypesEdgeRecord } from '@grafema/types';
+import { ValueDomainAnalyzer } from '../enrichment/ValueDomainAnalyzer.js';
+
+// Type expected by ValueDomainAnalyzer
+interface ValueAnalyzerGraph {
+  queryNodes(filter: { nodeType: string }): AsyncIterable<NodeRecord>;
+  getNode(id: string): Promise<NodeRecord | null>;
+  getOutgoingEdges(nodeId: string): Promise<TypesEdgeRecord[]>;
+  getIncomingEdges(nodeId: string): Promise<TypesEdgeRecord[]>;
+  addEdge(edge: { src: string; dst: string; type: string; metadata?: Record<string, unknown> }): Promise<void> | void;
+}
+
+// SQL query method names to detect
+const SQL_METHODS = ['query', 'execute', 'exec', 'run', 'all', 'get', 'prepare', 'raw'];
+
+/**
+ * SQL injection issue
+ */
+interface SQLInjectionIssue {
+  type: string;
+  severity: string;
+  message: string;
+  nodeId: string;
+  file?: string;
+  line?: number;
+  reason: string;
+  nondeterministicSources: string[];
+}
+
+/**
+ * Analysis result
+ */
+interface AnalysisResult {
+  isVulnerable: boolean;
+  reason: string | null;
+  sources: string[];
+}
+
+/**
+ * Edge record
+ */
+interface EdgeRecord {
+  edgeType?: string;
+  edge_type?: string;
+  dst?: string;
+  target_id?: string;
+  argIndex?: number;
+  index?: number;
+  [key: string]: unknown;
+}
+
+/**
+ * Extended node with query properties
+ */
+interface CallNode extends BaseNodeRecord {
+  method?: string;
+  queryArgName?: string;
+  nodeType?: string;
+  attrs?: { name?: string };
+}
+
+/**
+ * Datalog violation result
+ */
+interface DatalogViolation {
+  bindings: Array<{ name: string; value: string }>;
+}
+
+export class SQLInjectionValidator extends Plugin {
+  private valueAnalyzer: ValueDomainAnalyzer;
+
+  constructor() {
+    super();
+    this.valueAnalyzer = new ValueDomainAnalyzer();
+  }
+
+  get metadata(): PluginMetadata {
+    return {
+      name: 'SQLInjectionValidator',
+      phase: 'VALIDATION',
+      priority: 90, // After ValueDomainAnalyzer (65)
+      creates: {
+        nodes: [],
+        edges: []
+      }
+    };
+  }
+
+  async execute(context: PluginContext): Promise<PluginResult> {
+    const { graph } = context;
+
+    console.log('[SQLInjectionValidator] Checking for SQL injection vulnerabilities...');
+
+    const issues: SQLInjectionIssue[] = [];
+
+    // 1. Find all CALL nodes that look like SQL queries
+    const sqlCalls: CallNode[] = [];
+    for await (const node of graph.queryNodes({ nodeType: 'CALL' })) {
+      const callNode = node as CallNode;
+      const method = callNode.method || callNode.name;
+      if (method && SQL_METHODS.includes(method as string)) {
+        sqlCalls.push(callNode);
+      }
+    }
+
+    console.log(`[SQLInjectionValidator] Found ${sqlCalls.length} potential SQL calls`);
+
+    // 2. For each SQL call, analyze the query argument
+    for (const call of sqlCalls) {
+      const result = await this.analyzeQueryCall(call, graph);
+      if (result.isVulnerable) {
+        issues.push({
+          type: 'SQL_INJECTION',
+          severity: 'ERROR',
+          message: `Potential SQL injection at ${call.file}:${call.line || '?'} - ${result.reason}`,
+          nodeId: call.id,
+          file: call.file,
+          line: call.line as number | undefined,
+          reason: result.reason!,
+          nondeterministicSources: result.sources
+        });
+      }
+    }
+
+    // 3. Also check via graph pattern - CALL nodes that have ARGUMENT -> PARAMETER paths
+    const patternViolations = await this.checkViaGraphPattern(graph, sqlCalls);
+    for (const violation of patternViolations) {
+      // Avoid duplicates
+      if (!issues.find(i => i.nodeId === violation.nodeId)) {
+        issues.push(violation);
+      }
+    }
+
+    const summary = {
+      sqlCallsChecked: sqlCalls.length,
+      vulnerabilitiesFound: issues.length
+    };
+
+    console.log('[SQLInjectionValidator] Summary:', summary);
+
+    if (issues.length > 0) {
+      console.log('[SQLInjectionValidator] ❌ SQL injection vulnerabilities found:');
+      for (const issue of issues) {
+        console.log(`  🚫 ${issue.message}`);
+      }
+    } else {
+      console.log('[SQLInjectionValidator] ✅ No SQL injection vulnerabilities detected');
+    }
+
+    return createSuccessResult(
+      { nodes: 0, edges: 0 },
+      { summary, issues }
+    );
+  }
+
+  /**
+   * Analyze a SQL query call for injection vulnerabilities
+   */
+  private async analyzeQueryCall(call: CallNode, graph: PluginContext['graph']): Promise<AnalysisResult> {
+    const result: AnalysisResult = {
+      isVulnerable: false,
+      reason: null,
+      sources: []
+    };
+
+    // Get the query argument - usually first argument
+    // We need to check if it has nondeterministic content
+
+    // Check if this call has PASSES_ARGUMENT edges
+    const outgoing = await graph.getOutgoingEdges(call.id) as unknown as EdgeRecord[];
+    const argEdges = outgoing.filter(e =>
+      (e.edgeType || e.edge_type) === 'PASSES_ARGUMENT'
+    );
+
+    if (argEdges.length === 0) {
+      // No tracked arguments - check via queryArgName attribute if available
+      if (call.queryArgName) {
+        const valueSet = await this.valueAnalyzer.getValueSet(call.queryArgName, call.file!, graph as unknown as ValueAnalyzerGraph);
+        if (valueSet.hasUnknown) {
+          result.isVulnerable = true;
+          result.reason = `Query argument "${call.queryArgName}" contains user input`;
+          result.sources = ['unknown'];
+        }
+      }
+      return result;
+    }
+
+    // Check each argument
+    for (const edge of argEdges) {
+      const argId = edge.dst || edge.target_id;
+      const argNode = await graph.getNode(argId!) as CallNode | null;
+      if (!argNode) continue;
+
+      const argIndex = edge.argIndex || edge.index;
+      if (argIndex !== 0 && argIndex !== undefined) continue; // Only check first argument
+
+      // Check argument type
+      const argType = argNode.nodeType || argNode.type;
+
+      if (argType === 'LITERAL') {
+        // Pure literal - safe
+        continue;
+      }
+
+      if (argType === 'VARIABLE' || argType === 'CONSTANT') {
+        // Trace value domain
+        const varName = argNode.name || argNode.attrs?.name;
+        if (varName) {
+          const valueSet = await this.valueAnalyzer.getValueSet(varName as string, call.file!, graph as unknown as ValueAnalyzerGraph);
+          if (valueSet.hasUnknown) {
+            result.isVulnerable = true;
+            result.reason = `Query variable "${varName}" may contain user input`;
+            result.sources.push(varName as string);
+          }
+        }
+      }
+
+      if (argType === 'PARAMETER') {
+        // Direct parameter in query - definitely vulnerable
+        result.isVulnerable = true;
+        result.reason = 'Query contains direct function parameter';
+        result.sources.push((argNode.name as string) || 'parameter');
+      }
+
+      if (argType === 'EXPRESSION') {
+        // Template literal or concatenation - check for nondeterministic values
+        const { hasUnknown, sources } = await this.checkExpressionForNondeterminism(argNode, graph);
+        if (hasUnknown) {
+          result.isVulnerable = true;
+          result.reason = 'Query expression contains nondeterministic values';
+          result.sources.push(...sources);
+        }
+      }
+    }
+
+    return result;
+  }
+
+  /**
+   * Check if an expression contains nondeterministic values
+   */
+  private async checkExpressionForNondeterminism(
+    exprNode: CallNode,
+    graph: PluginContext['graph']
+  ): Promise<{ hasUnknown: boolean; sources: string[] }> {
+    const result = { hasUnknown: false, sources: [] as string[] };
+
+    // Check DERIVES_FROM edges
+    const outgoing = await graph.getOutgoingEdges(exprNode.id) as unknown as EdgeRecord[];
+    const derivesFromEdges = outgoing.filter(e =>
+      (e.edgeType || e.edge_type) === 'DERIVES_FROM' ||
+      (e.edgeType || e.edge_type) === 'ASSIGNED_FROM'
+    );
+
+    for (const edge of derivesFromEdges) {
+      const sourceId = edge.dst || edge.target_id;
+      const sourceNode = await graph.getNode(sourceId!) as CallNode | null;
+      if (!sourceNode) continue;
+
+      const sourceType = sourceNode.nodeType || sourceNode.type;
+
+      if (sourceType === 'PARAMETER') {
+        result.hasUnknown = true;
+        result.sources.push((sourceNode.name as string) || 'parameter');
+      } else if (sourceType === 'VARIABLE' || sourceType === 'CONSTANT') {
+        const varName = sourceNode.name || sourceNode.attrs?.name;
+        if (varName) {
+          const valueSet = await this.valueAnalyzer.getValueSet(varName as string, exprNode.file!, graph);
+          if (valueSet.hasUnknown) {
+            result.hasUnknown = true;
+            result.sources.push(varName as string);
+          }
+        }
+      }
+    }
+
+    return result;
+  }
+
+  /**
+   * Check via Datalog graph pattern for SQL injection
+   * Pattern: CALL -[PASSES_ARGUMENT]-> VARIABLE -[ASSIGNED_FROM*]-> PARAMETER
+   */
+  private async checkViaGraphPattern(
+    graph: PluginContext['graph'],
+    excludeCalls: CallNode[] = []
+  ): Promise<SQLInjectionIssue[]> {
+    const issues: SQLInjectionIssue[] = [];
+    const excludeIds = new Set(excludeCalls.map(c => c.id));
+
+    // Find CALL nodes that have argument tracing to PARAMETER
+    try {
+      // Check if graph supports checkGuarantee
+      if (!graph.checkGuarantee) {
+        console.log('[SQLInjectionValidator] Graph does not support checkGuarantee, skipping pattern-based check');
+        return issues;
+      }
+
+      // Check guarantee for SQL method calls with parameter-derived arguments
+      const violations = await graph.checkGuarantee(`
+        violation(X) :-
+          node(X, "CALL"),
+          attr(X, "method", M),
+          edge(X, Arg, "PASSES_ARGUMENT"),
+          edge(Arg, P, "ASSIGNED_FROM"),
+          node(P, "PARAMETER").
+      `) as DatalogViolation[];
+
+      for (const v of violations) {
+        const nodeId = v.bindings.find(b => b.name === 'X')?.value;
+        if (nodeId && !excludeIds.has(nodeId)) {
+          const node = await graph.getNode(nodeId) as CallNode | null;
+          if (node) {
+            const method = node.method || node.name;
+            if (SQL_METHODS.includes(method as string)) {
+              issues.push({
+                type: 'SQL_INJECTION',
+                severity: 'ERROR',
+                message: `SQL injection via parameter flow at ${node.file}:${node.line || '?'}`,
+                nodeId,
+                file: node.file,
+                line: node.line as number | undefined,
+                reason: 'Parameter value flows into SQL query',
+                nondeterministicSources: ['parameter']
+              });
+            }
+          }
+        }
+      }
+    } catch (err) {
+      // Datalog query might fail if backend doesn't support it
+      console.log('[SQLInjectionValidator] Datalog check skipped:', (err as Error).message);
+    }
+
+    return issues;
+  }
+}
+
+export default SQLInjectionValidator;

package/src/plugins/validation/ShadowingDetector.ts

@@ -0,0 +1,173 @@
+/**
+ * ShadowingDetector - detects variable shadowing issues
+ *
+ * Detects two types of shadowing:
+ *
+ * 1. Cross-file shadowing:
+ *    - CLASS `User` defined in models.js
+ *    - VARIABLE `User` in handlers.js shadows the class
+ *    - Method calls on the variable go to wrong target
+ *
+ * 2. Scope-aware shadowing:
+ *    - import { User } from './models'
+ *    - function handler() { const User = {...}; User.save(); }
+ *    - Local variable shadows the imported class
+ *
+ * Implementation notes:
+ * - Datalog doesn't support inequality (\=), so we use JS filtering
+ * - queryNodes is an async generator, use getAllNodes for arrays
+ */
+
+import { Plugin, createSuccessResult } from '../Plugin.js';
+import type { PluginContext, PluginResult, PluginMetadata } from '../Plugin.js';
+import type { BaseNodeRecord, NodeRecord } from '@grafema/types';
+
+/**
+ * Shadowing issue
+ */
+interface ShadowingIssue {
+  type: string;
+  severity: string;
+  message: string;
+  shadowingNodeId: string;
+  shadowedName: string;
+  shadowedNodeId: string;
+  shadowedFile?: string;
+  file?: string;
+  line?: number;
+  scope?: string;
+}
+
+/**
+ * Extended node with shadowing properties
+ */
+interface ShadowableNode extends BaseNodeRecord {
+  local?: string;
+  parentScopeId?: string;
+}
+
+/**
+ * Validation summary
+ */
+interface ValidationSummary {
+  crossFileShadows: number;
+  scopeShadows: number;
+  totalIssues: number;
+}
+
+export class ShadowingDetector extends Plugin {
+  get metadata(): PluginMetadata {
+    return {
+      name: 'ShadowingDetector',
+      phase: 'VALIDATION',
+      priority: 80, // After enrichment, before other validators
+      creates: {
+        nodes: [],
+        edges: []
+      }
+    };
+  }
+
+  async execute(context: PluginContext): Promise<PluginResult> {
+    const { graph } = context;
+
+    console.log('[ShadowingDetector] Checking for variable shadowing...');
+
+    const issues: ShadowingIssue[] = [];
+
+    // Get all relevant nodes
+    const allClasses = await graph.getAllNodes({ type: 'CLASS' });
+    const allVariables = await graph.getAllNodes({ type: 'VARIABLE' }) as ShadowableNode[];
+    const allConstants = await graph.getAllNodes({ type: 'CONSTANT' }) as ShadowableNode[];
+    const allImports = await graph.getAllNodes({ type: 'IMPORT' }) as ShadowableNode[];
+
+    // Build maps for efficient lookup
+    const classesByName = new Map<string, NodeRecord[]>();
+    for (const cls of allClasses) {
+      const name = cls.name as string;
+      if (!classesByName.has(name)) {
+        classesByName.set(name, []);
+      }
+      classesByName.get(name)!.push(cls);
+    }
+
+    const importsByFileAndLocal = new Map<string, ShadowableNode>();
+    for (const imp of allImports) {
+      const key = `${imp.file}:${imp.local}`;
+      importsByFileAndLocal.set(key, imp);
+    }
+
+    // 1. Cross-file shadowing: VARIABLE shadows CLASS from another file
+    for (const variable of allVariables) {
+      const name = variable.name as string;
+      const classesWithSameName = classesByName.get(name);
+      if (classesWithSameName) {
+        // Find classes in different files
+        const shadowedClasses = classesWithSameName.filter(c => c.file !== variable.file);
+        for (const shadowedClass of shadowedClasses) {
+          issues.push({
+            type: 'CROSS_FILE_SHADOW',
+            severity: 'WARNING',
+            message: `Variable "${name}" at ${variable.file}:${variable.line || '?'} shadows class "${name}" from ${shadowedClass.file}`,
+            shadowingNodeId: variable.id,
+            shadowedName: name,
+            shadowedNodeId: shadowedClass.id,
+            shadowedFile: shadowedClass.file,
+            file: variable.file,
+            line: variable.line as number | undefined
+          });
+        }
+      }
+    }
+
+    // 2. Scope-aware shadowing: local VARIABLE/CONSTANT shadows IMPORT
+    // Variables/constants with parentScopeId (inside functions) that shadow imports
+    const allLocalVars = [...allVariables, ...allConstants].filter(v => v.parentScopeId);
+
+    for (const localVar of allLocalVars) {
+      const name = localVar.name as string;
+      const importKey = `${localVar.file}:${name}`;
+      const shadowedImport = importsByFileAndLocal.get(importKey);
+
+      if (shadowedImport) {
+        const nodeType = localVar.type === 'CONSTANT' ? 'constant' : 'variable';
+        issues.push({
+          type: 'SCOPE_SHADOW',
+          severity: 'WARNING',
+          message: `Local ${nodeType} "${name}" at ${localVar.file}:${localVar.line || '?'} shadows imported "${name}"`,
+          shadowingNodeId: localVar.id,
+          shadowedName: name,
+          shadowedNodeId: shadowedImport.id,
+          file: localVar.file,
+          line: localVar.line as number | undefined,
+          scope: localVar.parentScopeId
+        });
+      }
+    }
+
+    const crossFileCount = issues.filter(i => i.type === 'CROSS_FILE_SHADOW').length;
+    const scopeCount = issues.filter(i => i.type === 'SCOPE_SHADOW').length;
+
+    const summary: ValidationSummary = {
+      crossFileShadows: crossFileCount,
+      scopeShadows: scopeCount,
+      totalIssues: issues.length
+    };
+
+    console.log('[ShadowingDetector] Summary:', summary);
+
+    if (issues.length > 0) {
+      console.log('[ShadowingDetector] Shadowing issues found:');
+      for (const issue of issues) {
+        console.log(`  ${issue.type === 'CROSS_FILE_SHADOW' ? '📁' : '🔒'} ${issue.message}`);
+      }
+    } else {
+      console.log('[ShadowingDetector] No shadowing issues detected');
+    }
+
+    return createSuccessResult(
+      { nodes: 0, edges: 0 },
+      { summary, issues }
+    );
+  }
+}