@indicated/vibeguard 1.0.0

package/dist/scanner/index.js

@@ -0,0 +1,207 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Scanner = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const glob_1 = require("glob");
+const loader_1 = require("./rules/loader");
+const javascript_1 = require("./parsers/javascript");
+const python_1 = require("./parsers/python");
+const SUPPORTED_EXTENSIONS = {
+    '.js': 'javascript',
+    '.jsx': 'javascript',
+    '.ts': 'typescript',
+    '.tsx': 'typescript',
+    '.mjs': 'javascript',
+    '.cjs': 'javascript',
+    '.py': 'python',
+};
+const DEFAULT_EXCLUDE = [
+    '**/node_modules/**',
+    '**/dist/**',
+    '**/build/**',
+    '**/.git/**',
+    '**/coverage/**',
+    '**/__pycache__/**',
+    '**/venv/**',
+    '**/.venv/**',
+    '**/env/**',
+    '**/*.min.js',
+    '**/*.bundle.js',
+];
+class Scanner {
+    constructor(config = {}) {
+        this.rules = [];
+        this.config = config;
+    }
+    async initialize(licenseKey) {
+        const allRules = await (0, loader_1.loadRules)(licenseKey);
+        this.rules = (0, loader_1.filterRules)(allRules, {
+            enabled: this.config.rules?.enabled,
+            disabled: this.config.rules?.disabled,
+        });
+    }
+    async scan(targets) {
+        const startTime = Date.now();
+        const findings = [];
+        const files = [];
+        for (const target of targets) {
+            const targetPath = path.resolve(target);
+            const stat = fs.statSync(targetPath);
+            if (stat.isDirectory()) {
+                const globPattern = path.join(targetPath, '**/*');
+                const exclude = [...DEFAULT_EXCLUDE, ...(this.config.exclude || [])];
+                const matchedFiles = await (0, glob_1.glob)(globPattern, {
+                    ignore: exclude,
+                    nodir: true,
+                });
+                files.push(...matchedFiles.filter(f => this.isSupportedFile(f)));
+            }
+            else if (stat.isFile() && this.isSupportedFile(targetPath)) {
+                files.push(targetPath);
+            }
+        }
+        for (const file of files) {
+            const fileFindings = await this.scanFile(file);
+            findings.push(...fileFindings);
+        }
+        return {
+            files: files.length,
+            findings: this.sortFindings(findings),
+            duration: Date.now() - startTime,
+        };
+    }
+    async scanStaged() {
+        const startTime = Date.now();
+        const findings = [];
+        // Get staged files from git
+        const { execSync } = await Promise.resolve().then(() => __importStar(require('child_process')));
+        let stagedFiles = [];
+        try {
+            const output = execSync('git diff --cached --name-only --diff-filter=ACM', {
+                encoding: 'utf-8',
+            });
+            stagedFiles = output
+                .split('\n')
+                .filter(f => f.trim() && this.isSupportedFile(f))
+                .map(f => path.resolve(f));
+        }
+        catch {
+            // Not in a git repo or git not available
+            return {
+                files: 0,
+                findings: [],
+                duration: Date.now() - startTime,
+            };
+        }
+        for (const file of stagedFiles) {
+            if (fs.existsSync(file)) {
+                const fileFindings = await this.scanFile(file);
+                findings.push(...fileFindings);
+            }
+        }
+        return {
+            files: stagedFiles.length,
+            findings: this.sortFindings(findings),
+            duration: Date.now() - startTime,
+        };
+    }
+    async scanFile(filePath) {
+        const findings = [];
+        const ext = path.extname(filePath);
+        const language = SUPPORTED_EXTENSIONS[ext];
+        if (!language)
+            return findings;
+        let code;
+        try {
+            code = fs.readFileSync(filePath, 'utf-8');
+        }
+        catch {
+            return findings;
+        }
+        // Filter rules by language
+        const languageRules = this.rules.filter(rule => rule.languages.includes(language));
+        if (language === 'javascript' || language === 'typescript') {
+            // Try AST-based scanning
+            const ast = (0, javascript_1.parseJavaScript)(code, filePath);
+            if (ast) {
+                const astFindings = (0, javascript_1.scanWithAST)(ast, languageRules, {
+                    code,
+                    lines: code.split('\n'),
+                    filePath,
+                });
+                findings.push(...astFindings);
+            }
+            // Also run pattern-based scanning
+            const patternFindings = (0, javascript_1.scanWithPatterns)(code, languageRules, filePath);
+            findings.push(...patternFindings);
+        }
+        else if (language === 'python') {
+            const patternFindings = (0, python_1.scanPythonWithPatterns)(code, languageRules, filePath);
+            findings.push(...patternFindings);
+        }
+        // Deduplicate findings
+        return this.deduplicateFindings(findings);
+    }
+    isSupportedFile(filePath) {
+        const ext = path.extname(filePath);
+        return ext in SUPPORTED_EXTENSIONS;
+    }
+    sortFindings(findings) {
+        const severityOrder = { critical: 0, high: 1, medium: 2, low: 3 };
+        return findings.sort((a, b) => {
+            const severityDiff = severityOrder[a.rule.severity] - severityOrder[b.rule.severity];
+            if (severityDiff !== 0)
+                return severityDiff;
+            return a.file.localeCompare(b.file) || a.line - b.line;
+        });
+    }
+    deduplicateFindings(findings) {
+        const seen = new Set();
+        return findings.filter(f => {
+            const key = `${f.rule.id}:${f.file}:${f.line}`;
+            if (seen.has(key))
+                return false;
+            seen.add(key);
+            return true;
+        });
+    }
+    getRules() {
+        return this.rules;
+    }
+}
+exports.Scanner = Scanner;
+//# sourceMappingURL=index.js.map

package/dist/scanner/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/scanner/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAC7B,+BAA4B;AAE5B,2CAAwD;AACxD,qDAAsF;AACtF,6CAA0D;AAE1D,MAAM,oBAAoB,GAA2B;IACnD,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;IACX,aAAa;IACb,gBAAgB;CACjB,CAAC;AAEF,MAAa,OAAO;IAIlB,YAAY,SAAiB,EAAE;QAHvB,UAAK,GAAmB,EAAE,CAAC;QAIjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAmB;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAA,kBAAS,EAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,IAAA,oBAAW,EAAC,QAAQ,EAAE;YACjC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO;YACnC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAiB;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAErC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAClD,MAAM,OAAO,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;gBAErE,MAAM,YAAY,GAAG,MAAM,IAAA,WAAI,EAAC,WAAW,EAAE;oBAC3C,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAC;gBAEH,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QACjC,CAAC;QAED,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;YACrC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,4BAA4B;QAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,wDAAa,eAAe,GAAC,CAAC;QACnD,IAAI,WAAW,GAAa,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,iDAAiD,EAAE;gBACzE,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;YACH,WAAW,GAAG,MAAM;iBACjB,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;iBAChD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;YACzC,OAAO;gBACL,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACjC,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;YACrC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,QAAgB;QACrC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE/B,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,2BAA2B;QAC3B,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC7C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAkD,CAAC,CAC5E,CAAC;QAEF,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,yBAAyB;YACzB,MAAM,GAAG,GAAG,IAAA,4BAAe,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,WAAW,GAAG,IAAA,wBAAW,EAAC,GAAG,EAAE,aAAa,EAAE;oBAClD,IAAI;oBACJ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;oBACvB,QAAQ;iBACT,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;YAChC,CAAC;YAED,kCAAkC;YAClC,MAAM,eAAe,GAAG,IAAA,6BAAgB,EAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;YACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,eAAe,GAAG,IAAA,+BAAsB,EAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;YAC9E,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QACpC,CAAC;QAED,uBAAuB;QACvB,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEO,eAAe,CAAC,QAAgB;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,GAAG,IAAI,oBAAoB,CAAC;IACrC,CAAC;IAEO,YAAY,CAAC,QAAmB;QACtC,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC5B,MAAM,YAAY,GAChB,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,YAAY,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,mBAAmB,CAAC,QAAmB;QAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAlKD,0BAkKC"}

package/dist/scanner/parsers/javascript.d.ts

@@ -0,0 +1,12 @@
+import * as t from '@babel/types';
+import { Finding, SecurityRule } from '../../types';
+interface ASTContext {
+    code: string;
+    lines: string[];
+    filePath: string;
+}
+export declare function parseJavaScript(code: string, filePath: string): t.File | null;
+export declare function scanWithAST(ast: t.File, rules: SecurityRule[], context: ASTContext): Finding[];
+export declare function scanWithPatterns(code: string, rules: SecurityRule[], filePath: string): Finding[];
+export {};
+//# sourceMappingURL=javascript.d.ts.map

package/dist/scanner/parsers/javascript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript.d.ts","sourceRoot":"","sources":["../../../src/scanner/parsers/javascript.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEpD,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,CAiB7E;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,CAAC,CAAC,IAAI,EACX,KAAK,EAAE,YAAY,EAAE,EACrB,OAAO,EAAE,UAAU,GAClB,OAAO,EAAE,CA2MX;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,EAAE,CAyCX"}

package/dist/scanner/parsers/javascript.js

@@ -0,0 +1,266 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseJavaScript = parseJavaScript;
+exports.scanWithAST = scanWithAST;
+exports.scanWithPatterns = scanWithPatterns;
+const parser = __importStar(require("@babel/parser"));
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const t = __importStar(require("@babel/types"));
+function parseJavaScript(code, filePath) {
+    try {
+        return parser.parse(code, {
+            sourceType: 'module',
+            plugins: [
+                'jsx',
+                'typescript',
+                'decorators-legacy',
+                'classProperties',
+                'optionalChaining',
+                'nullishCoalescingOperator',
+            ],
+        });
+    }
+    catch {
+        // If parsing fails, return null and rely on regex patterns only
+        return null;
+    }
+}
+function scanWithAST(ast, rules, context) {
+    const findings = [];
+    const astMatchers = {
+        'eval-usage': (path) => {
+            if (path.isCallExpression() &&
+                t.isIdentifier(path.node.callee) &&
+                path.node.callee.name === 'eval') {
+                const rule = rules.find(r => r.id === 'eval-usage');
+                if (rule) {
+                    const loc = path.node.loc;
+                    return {
+                        rule,
+                        file: context.filePath,
+                        line: loc?.start.line || 0,
+                        column: loc?.start.column || 0,
+                        code: context.lines[(loc?.start.line || 1) - 1] || '',
+                        message: rule.description,
+                    };
+                }
+            }
+            return null;
+        },
+        'sql-injection': (path) => {
+            if (path.isTemplateLiteral() || path.isBinaryExpression()) {
+                const parent = path.parentPath;
+                if (parent?.isCallExpression() &&
+                    t.isMemberExpression(parent.node.callee)) {
+                    const callee = parent.node.callee;
+                    const methodName = t.isIdentifier(callee.property) ? callee.property.name : '';
+                    if (['query', 'exec', 'execute', 'raw'].includes(methodName)) {
+                        // Check if there's string concatenation or template literal with expressions
+                        if (path.isTemplateLiteral() &&
+                            path.node.expressions.length > 0) {
+                            const codeSnippet = context.code.substring(path.node.start || 0, path.node.end || 0).toLowerCase();
+                            if (codeSnippet.includes('select') ||
+                                codeSnippet.includes('insert') ||
+                                codeSnippet.includes('update') ||
+                                codeSnippet.includes('delete') ||
+                                codeSnippet.includes('where')) {
+                                const rule = rules.find(r => r.id === 'sql-injection');
+                                if (rule) {
+                                    const loc = path.node.loc;
+                                    return {
+                                        rule,
+                                        file: context.filePath,
+                                        line: loc?.start.line || 0,
+                                        column: loc?.start.column || 0,
+                                        code: context.lines[(loc?.start.line || 1) - 1] || '',
+                                        message: rule.description,
+                                    };
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            return null;
+        },
+        'xss-innerhtml': (path) => {
+            if (path.isAssignmentExpression()) {
+                const left = path.node.left;
+                if (t.isMemberExpression(left) &&
+                    t.isIdentifier(left.property) &&
+                    left.property.name === 'innerHTML') {
+                    const rule = rules.find(r => r.id === 'xss-innerhtml');
+                    if (rule) {
+                        const loc = path.node.loc;
+                        return {
+                            rule,
+                            file: context.filePath,
+                            line: loc?.start.line || 0,
+                            column: loc?.start.column || 0,
+                            code: context.lines[(loc?.start.line || 1) - 1] || '',
+                            message: rule.description,
+                        };
+                    }
+                }
+            }
+            // Check for dangerouslySetInnerHTML in JSX
+            if (path.isJSXAttribute()) {
+                const name = path.node.name;
+                if (t.isJSXIdentifier(name) && name.name === 'dangerouslySetInnerHTML') {
+                    const rule = rules.find(r => r.id === 'xss-innerhtml');
+                    if (rule) {
+                        const loc = path.node.loc;
+                        return {
+                            rule,
+                            file: context.filePath,
+                            line: loc?.start.line || 0,
+                            column: loc?.start.column || 0,
+                            code: context.lines[(loc?.start.line || 1) - 1] || '',
+                            message: rule.description,
+                        };
+                    }
+                }
+            }
+            return null;
+        },
+        'missing-auth': (path) => {
+            // Detect Express/Next.js API routes without auth checks
+            if (path.isCallExpression()) {
+                const callee = path.node.callee;
+                if (t.isMemberExpression(callee) &&
+                    t.isIdentifier(callee.property) &&
+                    ['get', 'post', 'put', 'delete', 'patch'].includes(callee.property.name)) {
+                    const args = path.node.arguments;
+                    if (args.length >= 2) {
+                        // Get the full call expression code to check for middleware
+                        const callCode = context.code.substring(path.node.start || 0, path.node.end || 0).toLowerCase();
+                        // Check if any argument mentions auth-related terms (middleware)
+                        const hasAuthMiddleware = callCode.includes('auth') ||
+                            callCode.includes('session') ||
+                            callCode.includes('token') ||
+                            callCode.includes('jwt') ||
+                            callCode.includes('middleware') ||
+                            callCode.includes('isauthenticated') ||
+                            callCode.includes('requireauth') ||
+                            callCode.includes('protect') ||
+                            callCode.includes('verify');
+                        if (!hasAuthMiddleware) {
+                            // Check route path for sensitive endpoints
+                            const routePath = args[0];
+                            if (t.isStringLiteral(routePath)) {
+                                const pathValue = routePath.value.toLowerCase();
+                                if (pathValue.includes('/api/') ||
+                                    pathValue.includes('/user') ||
+                                    pathValue.includes('/admin') ||
+                                    pathValue.includes('/account') ||
+                                    pathValue.includes('/profile')) {
+                                    const rule = rules.find(r => r.id === 'missing-auth-route');
+                                    if (rule) {
+                                        const loc = path.node.loc;
+                                        return {
+                                            rule,
+                                            file: context.filePath,
+                                            line: loc?.start.line || 0,
+                                            column: loc?.start.column || 0,
+                                            code: context.lines[(loc?.start.line || 1) - 1] || '',
+                                            message: `API route ${routePath.value} may be missing authentication`,
+                                        };
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            return null;
+        },
+    };
+    (0, traverse_1.default)(ast, {
+        enter(path) {
+            for (const matcherKey of Object.keys(astMatchers)) {
+                const finding = astMatchers[matcherKey](path);
+                if (finding) {
+                    // Avoid duplicates
+                    const isDuplicate = findings.some(f => f.rule.id === finding.rule.id &&
+                        f.line === finding.line &&
+                        f.file === finding.file);
+                    if (!isDuplicate) {
+                        findings.push(finding);
+                    }
+                }
+            }
+        },
+    });
+    return findings;
+}
+function scanWithPatterns(code, rules, filePath) {
+    const findings = [];
+    const lines = code.split('\n');
+    for (const rule of rules) {
+        if (!rule.patterns)
+            continue;
+        for (const pattern of rule.patterns) {
+            let match;
+            const regex = new RegExp(pattern.source, pattern.flags + (pattern.flags.includes('g') ? '' : 'g'));
+            while ((match = regex.exec(code)) !== null) {
+                // Calculate line number from match index
+                const beforeMatch = code.substring(0, match.index);
+                const lineNumber = (beforeMatch.match(/\n/g) || []).length + 1;
+                const lineStart = beforeMatch.lastIndexOf('\n') + 1;
+                const column = match.index - lineStart;
+                // Avoid duplicates
+                const isDuplicate = findings.some(f => f.rule.id === rule.id &&
+                    f.line === lineNumber &&
+                    f.file === filePath);
+                if (!isDuplicate) {
+                    findings.push({
+                        rule,
+                        file: filePath,
+                        line: lineNumber,
+                        column,
+                        code: lines[lineNumber - 1] || '',
+                        message: rule.description,
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=javascript.js.map

package/dist/scanner/parsers/javascript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript.js","sourceRoot":"","sources":["../../../src/scanner/parsers/javascript.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,0CAiBC;AAED,kCA+MC;AAED,4CA6CC;AA5RD,sDAAwC;AACxC,+DAAqD;AACrD,gDAAkC;AASlC,SAAgB,eAAe,CAAC,IAAY,EAAE,QAAgB;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YACxB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE;gBACP,KAAK;gBACL,YAAY;gBACZ,mBAAmB;gBACnB,iBAAiB;gBACjB,kBAAkB;gBAClB,2BAA2B;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,WAAW,CACzB,GAAW,EACX,KAAqB,EACrB,OAAmB;IAEnB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,WAAW,GAAuD;QACtE,YAAY,EAAE,CAAC,IAAc,EAAE,EAAE;YAC/B,IACE,IAAI,CAAC,gBAAgB,EAAE;gBACvB,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,EAChC,CAAC;gBACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;gBACpD,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;oBAC1B,OAAO;wBACL,IAAI;wBACJ,IAAI,EAAE,OAAO,CAAC,QAAQ;wBACtB,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;wBAC1B,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;wBAC9B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;wBACrD,OAAO,EAAE,IAAI,CAAC,WAAW;qBAC1B,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,eAAe,EAAE,CAAC,IAAc,EAAE,EAAE;YAClC,IAAI,IAAI,CAAC,iBAAiB,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;gBAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;gBAC/B,IACE,MAAM,EAAE,gBAAgB,EAAE;oBAC1B,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACxC,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;oBAClC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAE/E,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC7D,6EAA6E;wBAC7E,IACE,IAAI,CAAC,iBAAiB,EAAE;4BACxB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAChC,CAAC;4BACD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CACxC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,EACpB,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CACnB,CAAC,WAAW,EAAE,CAAC;4BAEhB,IACE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;gCAC9B,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;gCAC9B,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;gCAC9B,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;gCAC9B,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC7B,CAAC;gCACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC;gCACvD,IAAI,IAAI,EAAE,CAAC;oCACT,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;oCAC1B,OAAO;wCACL,IAAI;wCACJ,IAAI,EAAE,OAAO,CAAC,QAAQ;wCACtB,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;wCAC1B,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;wCAC9B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;wCACrD,OAAO,EAAE,IAAI,CAAC,WAAW;qCAC1B,CAAC;gCACJ,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,eAAe,EAAE,CAAC,IAAc,EAAE,EAAE;YAClC,IAAI,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5B,IACE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC;oBAC1B,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,EAClC,CAAC;oBACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC;oBACvD,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;wBAC1B,OAAO;4BACL,IAAI;4BACJ,IAAI,EAAE,OAAO,CAAC,QAAQ;4BACtB,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;4BAC1B,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;4BAC9B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;4BACrD,OAAO,EAAE,IAAI,CAAC,WAAW;yBAC1B,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,2CAA2C;YAC3C,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5B,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;oBACvE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC;oBACvD,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;wBAC1B,OAAO;4BACL,IAAI;4BACJ,IAAI,EAAE,OAAO,CAAC,QAAQ;4BACtB,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;4BAC1B,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;4BAC9B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;4BACrD,OAAO,EAAE,IAAI,CAAC,WAAW;yBAC1B,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc,EAAE,CAAC,IAAc,EAAE,EAAE;YACjC,wDAAwD;YACxD,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,IACE,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;oBAC5B,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAC/B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EACxE,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;oBACjC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;wBACrB,4DAA4D;wBAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CACrC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,EACpB,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CACnB,CAAC,WAAW,EAAE,CAAC;wBAEhB,iEAAiE;wBACjE,MAAM,iBAAiB,GACrB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;4BACzB,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC5B,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;4BAC1B,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;4BACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;4BAC/B,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;4BACpC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;4BAChC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC5B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;wBAE9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;4BACvB,2CAA2C;4BAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;4BAC1B,IAAI,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gCACjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gCAChD,IACE,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;oCAC3B,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;oCAC3B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;oCAC5B,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;oCAC9B,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC9B,CAAC;oCACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAC;oCAC5D,IAAI,IAAI,EAAE,CAAC;wCACT,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;wCAC1B,OAAO;4CACL,IAAI;4CACJ,IAAI,EAAE,OAAO,CAAC,QAAQ;4CACtB,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;4CAC1B,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;4CAC9B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;4CACrD,OAAO,EAAE,aAAa,SAAS,CAAC,KAAK,gCAAgC;yCACtE,CAAC;oCACJ,CAAC;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,IAAA,kBAAQ,EAAC,GAAG,EAAE;QACZ,KAAK,CAAC,IAAI;YACR,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClD,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC9C,IAAI,OAAO,EAAE,CAAC;oBACZ,mBAAmB;oBACnB,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE;wBAC7B,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;wBACvB,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAC1B,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,gBAAgB,CAC9B,IAAY,EACZ,KAAqB,EACrB,QAAgB;IAEhB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAE7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAEnG,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,yCAAyC;gBACzC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,UAAU,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;gBAEvC,mBAAmB;gBACnB,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;oBACrB,CAAC,CAAC,IAAI,KAAK,UAAU;oBACrB,CAAC,CAAC,IAAI,KAAK,QAAQ,CACtB,CAAC;gBAEF,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI;wBACJ,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,UAAU;wBAChB,MAAM;wBACN,IAAI,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE;wBACjC,OAAO,EAAE,IAAI,CAAC,WAAW;qBAC1B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/scanner/parsers/python.d.ts

@@ -0,0 +1,3 @@
+import { Finding, SecurityRule } from '../../types';
+export declare function scanPythonWithPatterns(code: string, rules: SecurityRule[], filePath: string): Finding[];
+//# sourceMappingURL=python.d.ts.map

package/dist/scanner/parsers/python.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../../src/scanner/parsers/python.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA+CpD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,EAAE,CA0EX"}

package/dist/scanner/parsers/python.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanPythonWithPatterns = scanPythonWithPatterns;
+// Python-specific patterns in addition to shared patterns
+const pythonPatterns = [
+    // SQL injection patterns
+    {
+        ruleId: 'sql-injection',
+        pattern: /cursor\.execute\s*\(\s*f?['"`](?:SELECT|INSERT|UPDATE|DELETE)[^'"`]*\{[^}]+\}/i,
+    },
+    {
+        ruleId: 'sql-injection',
+        pattern: /\.execute\s*\(\s*['"`](?:SELECT|INSERT|UPDATE|DELETE)[^'"`]*['"]\s*%\s*/i,
+    },
+    {
+        ruleId: 'sql-injection',
+        pattern: /\.execute\s*\(\s*['"`](?:SELECT|INSERT|UPDATE|DELETE)[^'"`]*['"`]\s*\+/i,
+    },
+    // Eval usage
+    {
+        ruleId: 'eval-usage',
+        pattern: /\beval\s*\([^)]*(?:input|request|data|params|args)/i,
+    },
+    {
+        ruleId: 'eval-usage',
+        pattern: /\bexec\s*\([^)]*(?:input|request|data|params|args)/i,
+    },
+    // Hardcoded secrets
+    {
+        ruleId: 'hardcoded-secret',
+        pattern: /(?:api[_-]?key|secret[_-]?key|password|token)\s*=\s*['"][^'"]{8,}['"]/i,
+    },
+    // Flask/Django without CSRF
+    {
+        ruleId: 'permissive-cors',
+        pattern: /CORS\s*\(\s*app\s*(?:,\s*resources\s*=\s*\{[^}]*\*[^}]*\})?/,
+    },
+    // Debug mode in production
+    {
+        ruleId: 'verbose-errors',
+        pattern: /app\.run\s*\([^)]*debug\s*=\s*True/i,
+    },
+    {
+        ruleId: 'verbose-errors',
+        pattern: /DEBUG\s*=\s*True/,
+    },
+];
+function scanPythonWithPatterns(code, rules, filePath) {
+    const findings = [];
+    const lines = code.split('\n');
+    // First, scan with rule-defined patterns
+    for (const rule of rules) {
+        if (!rule.patterns || !rule.languages.includes('python'))
+            continue;
+        for (const pattern of rule.patterns) {
+            let match;
+            const regex = new RegExp(pattern.source, pattern.flags + (pattern.flags.includes('g') ? '' : 'g'));
+            while ((match = regex.exec(code)) !== null) {
+                const beforeMatch = code.substring(0, match.index);
+                const lineNumber = (beforeMatch.match(/\n/g) || []).length + 1;
+                const lineStart = beforeMatch.lastIndexOf('\n') + 1;
+                const column = match.index - lineStart;
+                const isDuplicate = findings.some(f => f.rule.id === rule.id &&
+                    f.line === lineNumber &&
+                    f.file === filePath);
+                if (!isDuplicate) {
+                    findings.push({
+                        rule,
+                        file: filePath,
+                        line: lineNumber,
+                        column,
+                        code: lines[lineNumber - 1] || '',
+                        message: rule.description,
+                    });
+                }
+            }
+        }
+    }
+    // Then scan with Python-specific patterns
+    for (const { ruleId, pattern } of pythonPatterns) {
+        const rule = rules.find(r => r.id === ruleId);
+        if (!rule)
+            continue;
+        let match;
+        const regex = new RegExp(pattern.source, pattern.flags + (pattern.flags.includes('g') ? '' : 'g'));
+        while ((match = regex.exec(code)) !== null) {
+            const beforeMatch = code.substring(0, match.index);
+            const lineNumber = (beforeMatch.match(/\n/g) || []).length + 1;
+            const lineStart = beforeMatch.lastIndexOf('\n') + 1;
+            const column = match.index - lineStart;
+            const isDuplicate = findings.some(f => f.rule.id === ruleId &&
+                f.line === lineNumber &&
+                f.file === filePath);
+            if (!isDuplicate) {
+                findings.push({
+                    rule,
+                    file: filePath,
+                    line: lineNumber,
+                    column,
+                    code: lines[lineNumber - 1] || '',
+                    message: rule.description,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=python.js.map

package/dist/scanner/parsers/python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../src/scanner/parsers/python.ts"],"names":[],"mappings":";;AA+CA,wDA8EC;AA3HD,0DAA0D;AAC1D,MAAM,cAAc,GAA0C;IAC5D,yBAAyB;IACzB;QACE,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,gFAAgF;KAC1F;IACD;QACE,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,0EAA0E;KACpF;IACD;QACE,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,yEAAyE;KACnF;IACD,aAAa;IACb;QACE,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,qDAAqD;KAC/D;IACD;QACE,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,qDAAqD;KAC/D;IACD,oBAAoB;IACpB;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,wEAAwE;KAClF;IACD,4BAA4B;IAC5B;QACE,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,6DAA6D;KACvE;IACD,2BAA2B;IAC3B;QACE,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,qCAAqC;KAC/C;IACD;QACE,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B;CACF,CAAC;AAEF,SAAgB,sBAAsB,CACpC,IAAY,EACZ,KAAqB,EACrB,QAAgB;IAEhB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/B,yCAAyC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEnE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAEnG,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,UAAU,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;gBAEvC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;oBACrB,CAAC,CAAC,IAAI,KAAK,UAAU;oBACrB,CAAC,CAAC,IAAI,KAAK,QAAQ,CACtB,CAAC;gBAEF,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI;wBACJ,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,UAAU;wBAChB,MAAM;wBACN,IAAI,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE;wBACjC,OAAO,EAAE,IAAI,CAAC,WAAW;qBAC1B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,IAAI,KAAK,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEnG,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;YAEvC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM;gBACpB,CAAC,CAAC,IAAI,KAAK,UAAU;gBACrB,CAAC,CAAC,IAAI,KAAK,QAAQ,CACtB,CAAC;YAEF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI;oBACJ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,MAAM;oBACN,IAAI,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE;oBACjC,OAAO,EAAE,IAAI,CAAC,WAAW;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/scanner/rules/definitions.d.ts

@@ -0,0 +1,5 @@
+import { SecurityRule } from '../../types';
+export declare const securityRules: SecurityRule[];
+export declare function getRuleById(id: string): SecurityRule | undefined;
+export declare function getRulesBySeverity(severity: string): SecurityRule[];
+//# sourceMappingURL=definitions.d.ts.map

package/dist/scanner/rules/definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../../src/scanner/rules/definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,eAAO,MAAM,aAAa,EAAE,YAAY,EAqkBvC,CAAC;AAEF,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEhE;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAEnE"}