@indicated/vibeguard 1.3.2 → 1.5.0

package/src/scanner/parsers/javascript.ts

@@ -109,13 +109,49 @@ export function scanWithAST(
     },
 
     'xss-innerhtml': (path: NodePath) => {
+      // Check if file imports a sanitizer - if so, assume proper usage
+      const codeLC = context.code.toLowerCase();
+      const hasSanitizer = codeLC.includes('dompurify') ||
+        codeLC.includes('sanitize-html') ||
+        codeLC.includes('xss') ||
+        codeLC.includes('escapehtml') ||
+        codeLC.includes('escape-html') ||
+        codeLC.includes('htmlsanitizer') ||
+        /function\s+escapehtml/i.test(context.code) ||
+        /const\s+escapehtml/i.test(context.code) ||
+        /escapehtml\s*[:=]/i.test(context.code);
+
+      if (hasSanitizer) {
+        return null; // File has sanitization, skip innerHTML checks
+      }
+
       if (path.isAssignmentExpression()) {
         const left = path.node.left;
+        const right = path.node.right;
         if (
           t.isMemberExpression(left) &&
           t.isIdentifier(left.property) &&
           left.property.name === 'innerHTML'
         ) {
+          // Skip if RHS is a string literal (static HTML is safe)
+          if (t.isStringLiteral(right)) {
+            return null;
+          }
+          // Skip if RHS is a template literal with no expressions (static)
+          if (t.isTemplateLiteral(right) && right.expressions.length === 0) {
+            return null;
+          }
+          // Skip if wrapped in sanitizer call
+          if (t.isCallExpression(right)) {
+            const callCode = context.code.substring(
+              right.start || 0,
+              right.end || 0
+            ).toLowerCase();
+            if (callCode.includes('sanitize') || callCode.includes('escape') || callCode.includes('purify')) {
+              return null;
+            }
+          }
+
           const rule = rules.find(r => r.id === 'xss-innerhtml');
           if (rule) {
             const loc = path.node.loc;
@@ -132,10 +168,25 @@ export function scanWithAST(
         }
       }
 
-      // Check for dangerouslySetInnerHTML in JSX
+      // Check for dangerouslySetInnerHTML in JSX - only flag if value is not static
       if (path.isJSXAttribute()) {
         const name = path.node.name;
         if (t.isJSXIdentifier(name) && name.name === 'dangerouslySetInnerHTML') {
+          const value = path.node.value;
+          // Check if the value is a static string (safe)
+          if (t.isJSXExpressionContainer(value) && value.expression) {
+            const expr = value.expression;
+            // Check if it's an object with __html property that's a string literal
+            if (t.isObjectExpression(expr)) {
+              const htmlProp = expr.properties.find(
+                p => t.isObjectProperty(p) && t.isIdentifier(p.key) && p.key.name === '__html'
+              );
+              if (htmlProp && t.isObjectProperty(htmlProp) && t.isStringLiteral(htmlProp.value)) {
+                return null; // Static HTML string is safe
+              }
+            }
+          }
+
           const rule = rules.find(r => r.id === 'xss-innerhtml');
           if (rule) {
             const loc = path.node.loc;

package/src/scanner/rules/definitions.ts

@@ -126,8 +126,9 @@ export const securityRules: SecurityRule[] = [
     tier: 'free',
     languages: ['javascript', 'typescript'],
     patterns: [
-      /localStorage\.setItem\s*\(\s*['"`](?:token|jwt|auth|session|api[_-]?key|secret|password|credential)/i,
-      /sessionStorage\.setItem\s*\(\s*['"`](?:token|jwt|auth|session|api[_-]?key|secret|password|credential)/i,
+      // Only match actual sensitive key names, not prefixes like "sessionStartTime"
+      /localStorage\.setItem\s*\(\s*['"`](?:access[_-]?token|refresh[_-]?token|auth[_-]?token|jwt[_-]?token|api[_-]?key|secret[_-]?key|password|private[_-]?key)['"`]/i,
+      /sessionStorage\.setItem\s*\(\s*['"`](?:access[_-]?token|refresh[_-]?token|auth[_-]?token|jwt[_-]?token|api[_-]?key|secret[_-]?key|password|private[_-]?key)['"`]/i,
     ],
     fix: 'Use httpOnly cookies for sensitive tokens, or encrypt before storage',
   },
@@ -139,7 +140,20 @@ export const securityRules: SecurityRule[] = [
     tier: 'pro',
     languages: ['javascript', 'typescript'],
     patterns: [
-      /\.from\s*\(\s*['"`][^'"`]+['"`]\s*\)\.(?:select|insert|update|delete)/,
+      // Only flag client-side code - server-side using service role is correct pattern
+      /createClient\s*\([^)]*\)[\s\S]*\.from\s*\(\s*['"`][^'"`]+['"`]\s*\)\.(?:select|insert|update|delete)/,
+    ],
+    // Exclude server-side API files where service role key usage is correct
+    pathExclusions: [
+      /\/api\//,
+      /\/server\//,
+      /\/backend\//,
+      /\/routes\//,
+      /\/controllers\//,
+      /\/services\//,
+      /\.server\./,
+      /pages\/api\//,
+      /app\/api\//,
     ],
     astMatcher: 'supabase-no-rls',
     fix: 'Enable Row Level Security on Supabase tables and add policies',
@@ -404,17 +418,20 @@ export const securityRules: SecurityRule[] = [
   {
     id: 'prototype-pollution',
     name: 'Potential Prototype Pollution',
-    description: 'Merging user input into objects can allow prototype pollution attacks',
+    description: 'Deep merging user input can allow prototype pollution attacks',
     severity: 'low',
     tier: 'free',
     languages: ['javascript', 'typescript'],
     patterns: [
-      /Object\.assign\s*\(\s*\{\}\s*,[^)]*(?:req\.|body\.|params\.|query\.)/,
-      /\{\s*\.\.\.(?:req|body|params|query)/,
-      /lodash\.merge\s*\([^)]*(?:req\.|body\.)/,
-      /deepmerge\s*\([^)]*(?:req\.|body\.)/,
+      // Only flag actual deep merge operations that can cause prototype pollution
+      // Spread operator {...obj} and Object.assign({}, obj) are SAFE - they don't pollute
+      /(?:lodash|_)\.merge\s*\([^)]*(?:req\.|body\.|params\.|query\.)/,
+      /(?:lodash|_)\.mergeWith\s*\([^)]*(?:req\.|body\.|params\.|query\.)/,
+      /(?:lodash|_)\.defaultsDeep\s*\([^)]*(?:req\.|body\.|params\.|query\.)/,
+      /deepmerge\s*\([^)]*(?:req\.|body\.|params\.|query\.)/,
+      /merge\s*\(\s*\w+\s*,\s*(?:req\.|body\.|params\.|query\.)/,
     ],
-    fix: 'Validate and sanitize user input before merging. Use Object.create(null) for dictionaries',
+    fix: 'Validate and sanitize user input before deep merging. Use Object.create(null) for dictionaries',
   },
 
   // ============================================