@js-recon/js-recon 1.3.1-beta.2

package/build/analyze/engine/astEngine.js

@@ -0,0 +1,224 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import chalk from "chalk";
+import parser from "@babel/parser";
+import _traverse from "@babel/traverse";
+import _generator from "@babel/generator";
+const _traverseDefault = _traverse.default;
+const generator = _generator.default;
+import esquery from "esquery";
+import { highlight } from "cli-highlight";
+import { resolveFunctionIdentifier } from "../helpers/engineHelpers/resolveFunctionIdentifier.js";
+import { findMemberExpressionAssignment } from "../helpers/engineHelpers/findMemberExpressionAssignment.js";
+import { findDirectAssignment } from "../helpers/engineHelpers/findDirectAssignment.js";
+import { computeTaint, sinkConsumesTaint } from "../helpers/engineHelpers/taintFlow.js";
+/**
+ * ESQuery-based AST analysis engine for detecting code patterns using custom rules.
+ *
+ * This engine parses JavaScript/TypeScript code into ASTs and uses ESQuery selectors
+ * to find specific patterns defined in rules. It supports complex multi-step analysis
+ * including function resolution and assignment checking.
+ *
+ * @param rule - The analysis rule containing steps and patterns to match
+ * @param mappedJsonData - Collection of code chunks to analyze
+ * @returns Promise that resolves to an array of analysis findings
+ */
+const esqueryEngine = (rule, mappedJsonData) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    let findings = [];
+    for (const chunk of Object.values(mappedJsonData)) {
+        // first of all, load the code in ast
+        let ast;
+        try {
+            ast = parser.parse(chunk.code, {
+                sourceType: "unambiguous",
+                plugins: ["jsx", "typescript"],
+                errorRecovery: true,
+            });
+        }
+        catch (_c) {
+            continue;
+        }
+        let matchList = {};
+        const completedSteps = new Set();
+        // Cache taint info per "source step name" so we don't recompute when several
+        // sink steps share the same source step.
+        const taintCache = {};
+        // iterate through the steps in the rule
+        for (const step of rule.steps) {
+            // honor `requires`: skip the step if any of its required steps did not complete
+            if (step.requires && step.requires.length > 0) {
+                const allRequiresMet = step.requires.every((r) => completedSteps.has(r));
+                if (!allRequiresMet) {
+                    continue;
+                }
+            }
+            // if it is an esquery step, then only proceed
+            if (step.esquery) {
+                const selector = step.esquery.query;
+                // determine the AST subtree to search. by default we search the whole chunk AST,
+                // but `inScopeOf` lets a step look only inside a previous match's subtree —
+                // useful for catching source/sink pairs in the same function rather than the same chunk.
+                let searchRoot = ast;
+                if (step.esquery.inScopeOf) {
+                    const scopeMatch = matchList[step.esquery.inScopeOf];
+                    if (!scopeMatch) {
+                        // dependency didn't match — this step cannot apply
+                        continue;
+                    }
+                    searchRoot = scopeMatch.node;
+                }
+                // match the query against what is there in the user defined config file
+                let matches = esquery(searchRoot, selector);
+                // Optional data-flow filter: only keep matches whose value-side actually
+                // consumes a value tainted by the named source step's matches. This is
+                // what distinguishes a real source→sink finding from accidental
+                // source-and-sink-in-the-same-bundle co-occurrence.
+                if (matches.length > 0 && step.esquery.taintFrom) {
+                    const sourceStepName = step.esquery.taintFrom;
+                    const sourceMatch = matchList[sourceStepName];
+                    if (!sourceMatch) {
+                        // No source matched — nothing can be tainted from it.
+                        continue;
+                    }
+                    if (!taintCache[sourceStepName]) {
+                        const sourceNodes = sourceMatch.allNodes || [sourceMatch.node];
+                        taintCache[sourceStepName] = computeTaint(ast, sourceNodes);
+                    }
+                    const taint = taintCache[sourceStepName];
+                    matches = matches.filter((m) => sinkConsumesTaint(ast, m, taint));
+                }
+                if (matches.length > 0) {
+                    // store the first match as the "primary" node so later steps can reference it,
+                    // and keep the full match list available for tooling that wants it.
+                    matchList[step.name] = { node: matches[0], scope: ast, allNodes: matches };
+                    completedSteps.add(step.name);
+                }
+            }
+            else if (step.postMessageFuncResolve) {
+                // since this is asking to resolve to a function declaration, we'll first get the node for it
+                const selectedNode = (_a = matchList[step.postMessageFuncResolve.name]) === null || _a === void 0 ? void 0 : _a.node;
+                if (selectedNode) {
+                    // check if it a function declaration or a call expression
+                    if (selectedNode.type === "CallExpression") {
+                        if (selectedNode.callee.type === "MemberExpression" &&
+                            selectedNode.callee.property.type === "Identifier" &&
+                            selectedNode.callee.property.name === "addEventListener" &&
+                            selectedNode.arguments[0].type === "StringLiteral" &&
+                            selectedNode.arguments[0].value === "message") {
+                            if (selectedNode.arguments.length === 2) {
+                                // console.log(selectedNode.arguments[1].type);
+                                // if the type is identifier
+                                if (selectedNode.arguments[1].type === "Identifier") {
+                                    // resolve where it is being assigned
+                                    const functionIdentifier = selectedNode.arguments[1];
+                                    const resolvedFunction = resolveFunctionIdentifier(functionIdentifier, ast);
+                                    if (resolvedFunction) {
+                                        matchList[step.name] = { node: resolvedFunction, scope: ast };
+                                        completedSteps.add(step.name);
+                                    }
+                                }
+                                else if (selectedNode.arguments[1].type === "FunctionExpression" ||
+                                    selectedNode.arguments[1].type === "ArrowFunctionExpression") {
+                                    const functionExpression = selectedNode.arguments[1];
+                                    matchList[step.name] = { node: functionExpression, scope: ast };
+                                    completedSteps.add(step.name);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            else if (step.regexMatch) {
+                // Scan all StringLiteral/TemplateLiteral nodes in the chunk for values matching the regex
+                const pattern = new RegExp(step.regexMatch.pattern);
+                const foundNodes = [];
+                _traverseDefault(ast, {
+                    StringLiteral(nodePath) {
+                        if (pattern.test(nodePath.node.value)) {
+                            foundNodes.push(nodePath.node);
+                        }
+                    },
+                    TemplateLiteral(nodePath) {
+                        for (const quasi of nodePath.node.quasis) {
+                            if (pattern.test(quasi.value.raw)) {
+                                foundNodes.push(nodePath.node);
+                                break;
+                            }
+                        }
+                    },
+                });
+                if (foundNodes.length > 0) {
+                    matchList[step.name] = { node: foundNodes[0], scope: ast, allNodes: foundNodes };
+                    completedSteps.add(step.name);
+                }
+            }
+            else if (step.checkAssignmentExist) {
+                const selectedNode = (_b = matchList[step.checkAssignmentExist.name]) === null || _b === void 0 ? void 0 : _b.node;
+                const toMatch = step.checkAssignmentExist.type;
+                const memberExpression = step.checkAssignmentExist.memberExpression;
+                if (selectedNode && memberExpression) {
+                    const assignmentNode = findMemberExpressionAssignment(selectedNode, toMatch, matchList[step.checkAssignmentExist.name].scope);
+                    if (assignmentNode) {
+                        matchList[step.name] = { node: assignmentNode, scope: ast };
+                        completedSteps.add(step.name);
+                    }
+                }
+                else if (selectedNode) {
+                    const assignmentNode = findDirectAssignment(selectedNode, matchList[step.checkAssignmentExist.name].scope);
+                    if (assignmentNode) {
+                        matchList[step.name] = { node: assignmentNode, scope: ast };
+                        completedSteps.add(step.name);
+                    }
+                }
+            }
+        }
+        // fire if every declared step has completed (matched) for this chunk
+        if (completedSteps.size === rule.steps.length) {
+            const message = `[+] "${rule.name}" found in chunk ${chunk.id}`;
+            const lastMatch = Object.values(matchList)[Object.keys(matchList).length - 1];
+            const nodesToReport = lastMatch.allNodes && lastMatch.allNodes.length > 1 ? lastMatch.allNodes : [lastMatch.node];
+            for (const reportNode of nodesToReport) {
+                const code = generator(reportNode).code;
+                if (rule.severity === "info") {
+                    console.log(chalk.cyan(message));
+                }
+                else if (rule.severity === "low") {
+                    console.log(chalk.yellow(message));
+                }
+                else if (rule.severity === "medium") {
+                    console.log(chalk.magenta(message));
+                }
+                else if (rule.severity === "high") {
+                    console.error(chalk.red(message));
+                }
+                console.log(highlight(code, {
+                    language: "javascript",
+                    ignoreIllegals: true,
+                    theme: undefined,
+                }));
+                findings.push({
+                    ruleId: rule.id,
+                    ruleName: rule.name,
+                    ruleType: rule.type,
+                    ruleDescription: rule.description,
+                    ruleAuthor: rule.author,
+                    ruleTech: rule.tech,
+                    severity: rule.severity,
+                    message: message,
+                    findingLocation: `// ${chunk.id}\n\n${code}`,
+                });
+            }
+        }
+    }
+    return findings;
+});
+export default esqueryEngine;
+//# sourceMappingURL=astEngine.js.map

package/build/analyze/engine/astEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"astEngine.js","sourceRoot":"","sources":["../../../src/analyze/engine/astEngine.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC;AAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC;AACrC,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,EAAE,8BAA8B,EAAE,MAAM,4DAA4D,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAa,MAAM,uCAAuC,CAAC;AAGnG;;;;;;;;;;GAUG;AACH,MAAM,aAAa,GAAG,CAAO,IAAU,EAAE,cAAsB,EAA2B,EAAE;;IACxF,IAAI,QAAQ,GAAmB,EAAE,CAAC;IAElC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAChD,qCAAqC;QACrC,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;gBAC3B,UAAU,EAAE,aAAa;gBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC9B,aAAa,EAAE,IAAI;aACtB,CAAC,CAAC;QACP,CAAC;QAAC,WAAM,CAAC;YACL,SAAS;QACb,CAAC;QAED,IAAI,SAAS,GAAsE,EAAE,CAAC;QACtF,MAAM,cAAc,GAAgB,IAAI,GAAG,EAAE,CAAC;QAC9C,6EAA6E;QAC7E,yCAAyC;QACzC,MAAM,UAAU,GAAwC,EAAE,CAAC;QAE3D,wCAAwC;QACxC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,gFAAgF;YAChF,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzE,IAAI,CAAC,cAAc,EAAE,CAAC;oBAClB,SAAS;gBACb,CAAC;YACL,CAAC;YAED,8CAA8C;YAC9C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAEpC,iFAAiF;gBACjF,4EAA4E;gBAC5E,yFAAyF;gBACzF,IAAI,UAAU,GAAS,GAAG,CAAC;gBAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACzB,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBACrD,IAAI,CAAC,UAAU,EAAE,CAAC;wBACd,mDAAmD;wBACnD,SAAS;oBACb,CAAC;oBACD,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;gBACjC,CAAC;gBAED,wEAAwE;gBACxE,IAAI,OAAO,GAAW,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBAEpD,yEAAyE;gBACzE,uEAAuE;gBACvE,gEAAgE;gBAChE,oDAAoD;gBACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;oBAC9C,MAAM,WAAW,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;oBAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;wBACf,sDAAsD;wBACtD,SAAS;oBACb,CAAC;oBACD,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;wBAC9B,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;wBAC/D,UAAU,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;oBAChE,CAAC;oBACD,MAAM,KAAK,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;oBACzC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBACtE,CAAC;gBAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,+EAA+E;oBAC/E,oEAAoE;oBACpE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;oBAC3E,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClC,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACrC,6FAA6F;gBAE7F,MAAM,YAAY,GAAS,MAAA,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,0CAAE,IAAI,CAAC;gBAE7E,IAAI,YAAY,EAAE,CAAC;oBACf,0DAA0D;oBAC1D,IAAI,YAAY,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBACzC,IACI,YAAY,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;4BAC/C,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;4BAClD,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,kBAAkB;4BACxD,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe;4BAClD,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,EAC/C,CAAC;4BACC,IAAI,YAAY,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gCACtC,+CAA+C;gCAC/C,4BAA4B;gCAC5B,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oCAClD,qCAAqC;oCACrC,MAAM,kBAAkB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oCACrD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;oCAE5E,IAAI,gBAAgB,EAAE,CAAC;wCACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;wCAC9D,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oCAClC,CAAC;gCACL,CAAC;qCAAM,IACH,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB;oCACvD,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,EAC9D,CAAC;oCACC,MAAM,kBAAkB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oCACrD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;oCAChE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gCAClC,CAAC;4BACL,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzB,0FAA0F;gBAC1F,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpD,MAAM,UAAU,GAAW,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,GAAG,EAAE;oBAClB,aAAa,CAAC,QAAa;wBACvB,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;4BACpC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBACnC,CAAC;oBACL,CAAC;oBACD,eAAe,CAAC,QAAa;wBACzB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;4BACvC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gCAChC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gCAC/B,MAAM;4BACV,CAAC;wBACL,CAAC;oBACL,CAAC;iBACJ,CAAC,CAAC;gBACH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;oBACjF,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClC,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACnC,MAAM,YAAY,GAAS,MAAA,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,0CAAE,IAAI,CAAC;gBAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;gBAEpE,IAAI,YAAY,IAAI,gBAAgB,EAAE,CAAC;oBACnC,MAAM,cAAc,GAAG,8BAA8B,CACjD,YAAY,EACZ,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,CAClD,CAAC;oBAEF,IAAI,cAAc,EAAE,CAAC;wBACjB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;wBAC5D,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClC,CAAC;gBACL,CAAC;qBAAM,IAAI,YAAY,EAAE,CAAC;oBACtB,MAAM,cAAc,GAAG,oBAAoB,CACvC,YAAY,EACZ,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,CAClD,CAAC;oBAEF,IAAI,cAAc,EAAE,CAAC;wBACjB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;wBAC5D,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClC,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,IAAI,cAAc,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,IAAI,oBAAoB,KAAK,CAAC,EAAE,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC9E,MAAM,aAAa,GACf,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEhG,KAAK,MAAM,UAAU,IAAI,aAAa,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBAExC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACrC,CAAC;qBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvC,CAAC;qBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxC,CAAC;qBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBAClC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtC,CAAC;gBAED,OAAO,CAAC,GAAG,CACP,SAAS,CAAC,IAAI,EAAE;oBACZ,QAAQ,EAAE,YAAY;oBACtB,cAAc,EAAE,IAAI;oBACpB,KAAK,EAAE,SAAS;iBACnB,CAAC,CACL,CAAC;gBAEF,QAAQ,CAAC,IAAI,CAAC;oBACV,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,eAAe,EAAE,IAAI,CAAC,WAAW;oBACjC,UAAU,EAAE,IAAI,CAAC,MAAM;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,OAAO;oBAChB,eAAe,EAAE,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI,EAAE;iBAC/C,CAAC,CAAC;YACP,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/build/analyze/engine/index.js

@@ -0,0 +1,59 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import requestEngine from "./requestEngine.js";
+import astEngine from "./astEngine.js";
+/**
+ * Main analysis engine that routes rules to appropriate sub-engines based on rule type.
+ *
+ * This function serves as the central dispatcher for analysis rules, determining whether
+ * to use the AST engine for code analysis or the request engine for API analysis.
+ * It validates technology compatibility before executing the appropriate engine.
+ *
+ * @param rule - The analysis rule containing patterns and conditions to match
+ * @param mappedJsonData - Code chunks data for AST-based analysis (optional)
+ * @param openapiData - OpenAPI specification data for request-based analysis (optional)
+ * @param tech - Technology stack identifier or "all" for universal rules
+ * @returns Promise that resolves to an array of analysis findings, or undefined if no data available
+ */
+export const engine = (rule, mappedJsonData, openapiData, tech) => __awaiter(void 0, void 0, void 0, function* () {
+    // first of all check what is rule type, and then check if the data for that is available or is undefined
+    let findings = [];
+    if (rule.type === "request") {
+        if (!openapiData) {
+            return;
+        }
+        let techValid = true;
+        for (const t of rule.tech) {
+            if (!rule.tech.includes(tech)) {
+                techValid = false;
+            }
+        }
+        if (techValid || tech === "all" || rule.tech.includes("all")) {
+            findings.push(...(yield requestEngine(rule, openapiData)));
+        }
+    }
+    else if (rule.type === "ast") {
+        if (!mappedJsonData) {
+            return;
+        }
+        let techValid = true;
+        for (const t of rule.tech) {
+            if (!rule.tech.includes(tech)) {
+                techValid = false;
+            }
+        }
+        if (techValid || tech === "all" || rule.tech.includes("all")) {
+            findings.push(...(yield astEngine(rule, mappedJsonData)));
+        }
+    }
+    return findings;
+});
+export default engine;
+//# sourceMappingURL=index.js.map

package/build/analyze/engine/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyze/engine/index.ts"],"names":[],"mappings":";;;;;;;;;AAGA,OAAO,aAAa,MAAM,oBAAoB,CAAC;AAC/C,OAAO,SAAS,MAAM,gBAAgB,CAAC;AAGvC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAClB,IAAU,EACV,cAAkC,EAClC,WAAoC,EACpC,IAAiD,EACd,EAAE;IACrC,yGAAyG;IAEzG,IAAI,QAAQ,GAAmB,EAAE,CAAC;IAElC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO;QACX,CAAC;QAED,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,KAAK,CAAC;YACtB,CAAC;QACL,CAAC;QAED,IAAI,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,OAAO;QACX,CAAC;QAED,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,KAAK,CAAC;YACtB,CAAC;QACL,CAAC;QAED,IAAI,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/build/analyze/engine/requestEngine.js

@@ -0,0 +1,100 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import chalk from "chalk";
+/**
+ * Request-based analysis engine for analyzing OpenAPI specifications against rules.
+ *
+ * This engine analyzes API endpoints, methods, headers, and URL patterns defined in
+ * OpenAPI specifications to identify security issues, misconfigurations, or patterns
+ * of interest. It supports multiple condition types including presence, absence, and equality checks.
+ *
+ * @param rule - The analysis rule containing request-based patterns to match
+ * @param openapiData - OpenAPI specification containing API endpoint definitions
+ * @returns Promise that resolves to an array of analysis findings
+ */
+const engine = (rule, openapiData) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    let findings = [];
+    for (const path in openapiData.paths) {
+        const methods = openapiData.paths[path];
+        for (const method in methods) {
+            const operation = methods[method];
+            if (!operation)
+                continue;
+            let successfulSteps = 0;
+            for (const step of rule.steps) {
+                let stepSuccess = false;
+                if (step.request.type === "url") {
+                    const urlContainsName = path.includes(step.request.name);
+                    if (step.request.condition === "contains") {
+                        stepSuccess = urlContainsName;
+                    }
+                    else if (step.request.condition === "absent") {
+                        stepSuccess = !urlContainsName;
+                    }
+                }
+                else if (step.request.type === "headers") {
+                    const headers = (_a = operation.parameters) === null || _a === void 0 ? void 0 : _a.filter((param) => param.in === "header");
+                    if (step.request.condition === "contains") {
+                        if (headers === null || headers === void 0 ? void 0 : headers.some((h) => h.name === step.request.name)) {
+                            stepSuccess = true;
+                        }
+                    }
+                    else if (step.request.condition === "absent") {
+                        if (!(headers === null || headers === void 0 ? void 0 : headers.some((h) => h.name === step.request.name))) {
+                            stepSuccess = true;
+                        }
+                    }
+                }
+                else if (step.request.type === "method") {
+                    if (step.request.condition === "is") {
+                        stepSuccess = method.toLowerCase() === step.request.name.toLowerCase();
+                    }
+                    else if (step.request.condition === "is_not") {
+                        stepSuccess = method.toLowerCase() !== step.request.name.toLowerCase();
+                    }
+                }
+                if (stepSuccess) {
+                    successfulSteps++;
+                }
+            }
+            if (successfulSteps === rule.steps.length) {
+                // get the severity of the rule
+                const message = `[+] "${rule.name}" found in ${path} [${method.toUpperCase()}]`;
+                if (rule.severity === "info") {
+                    console.log(chalk.cyan(message));
+                }
+                else if (rule.severity === "low") {
+                    console.log(chalk.yellow(message));
+                }
+                else if (rule.severity === "medium") {
+                    console.log(chalk.magenta(message));
+                }
+                else if (rule.severity === "high") {
+                    console.error(chalk.red(message));
+                }
+                findings.push({
+                    ruleId: rule.id,
+                    ruleName: rule.name,
+                    ruleType: rule.type,
+                    ruleDescription: rule.description,
+                    ruleAuthor: rule.author,
+                    ruleTech: rule.tech,
+                    severity: rule.severity,
+                    message: message,
+                    findingLocation: `${path} [${method.toUpperCase()}]`,
+                });
+            }
+        }
+    }
+    return findings;
+});
+export default engine;
+//# sourceMappingURL=requestEngine.js.map

package/build/analyze/engine/requestEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestEngine.js","sourceRoot":"","sources":["../../../src/analyze/engine/requestEngine.ts"],"names":[],"mappings":";;;;;;;;;AAEA,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,GAAG,CAAO,IAAU,EAAE,WAAwB,EAA2B,EAAE;;IACnF,IAAI,QAAQ,GAAmB,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,IAAI,eAAe,GAAG,CAAC,CAAC;YAExB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC5B,IAAI,WAAW,GAAG,KAAK,CAAC;gBAExB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC9B,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACzD,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;wBACxC,WAAW,GAAG,eAAe,CAAC;oBAClC,CAAC;yBAAM,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;wBAC7C,WAAW,GAAG,CAAC,eAAe,CAAC;oBACnC,CAAC;gBACL,CAAC;qBAAM,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACzC,MAAM,OAAO,GAAG,MAAA,SAAS,CAAC,UAAU,0CAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;oBAE/E,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;wBACxC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;4BACrD,WAAW,GAAG,IAAI,CAAC;wBACvB,CAAC;oBACL,CAAC;yBAAM,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;wBAC7C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA,EAAE,CAAC;4BACtD,WAAW,GAAG,IAAI,CAAC;wBACvB,CAAC;oBACL,CAAC;gBACL,CAAC;qBAAM,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACxC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;wBAClC,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC3E,CAAC;yBAAM,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;wBAC7C,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC3E,CAAC;gBACL,CAAC;gBAED,IAAI,WAAW,EAAE,CAAC;oBACd,eAAe,EAAE,CAAC;gBACtB,CAAC;YACL,CAAC;YAED,IAAI,eAAe,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,+BAA+B;gBAC/B,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,IAAI,cAAc,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC;gBAChF,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACrC,CAAC;qBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvC,CAAC;qBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxC,CAAC;qBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBAClC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtC,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACV,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,eAAe,EAAE,IAAI,CAAC,WAAW;oBACjC,UAAU,EAAE,IAAI,CAAC,MAAM;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,OAAO;oBAChB,eAAe,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG;iBACvD,CAAC,CAAC;YACP,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/build/analyze/helpers/engineHelpers/findDirectAssignment.js

@@ -0,0 +1,37 @@
+import _traverse from "@babel/traverse";
+const traverse = _traverse.default;
+/**
+ * Finds direct assignment expressions or variable declarations for a given identifier node.
+ *
+ * Searches through the AST scope to locate where a specific identifier is assigned a value,
+ * either through assignment expressions (e.g., `x = value`) or variable declarations (e.g., `var x = value`).
+ *
+ * @param nodeToFind - The identifier node to search for assignments
+ * @param scope - The AST scope to search within
+ * @returns The assignment or declaration node if found, null otherwise
+ */
+export function findDirectAssignment(nodeToFind, scope) {
+    let assignmentNode = null;
+    traverse(scope, {
+        AssignmentExpression(path) {
+            // Check if the left-hand side of the assignment matches the nodeToFind
+            if (path.node.left.type === "Identifier" &&
+                nodeToFind.type === "Identifier" &&
+                path.node.left.name === nodeToFind.name) {
+                assignmentNode = path.node;
+                path.stop(); // Stop traversal once found
+            }
+        },
+        VariableDeclarator(path) {
+            // Check if the variable being declared matches the nodeToFind
+            if (path.node.id.type === "Identifier" &&
+                nodeToFind.type === "Identifier" &&
+                path.node.id.name === nodeToFind.name) {
+                assignmentNode = path.node;
+                path.stop(); // Stop traversal once found
+            }
+        },
+    });
+    return assignmentNode;
+}
+//# sourceMappingURL=findDirectAssignment.js.map

package/build/analyze/helpers/engineHelpers/findDirectAssignment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findDirectAssignment.js","sourceRoot":"","sources":["../../../../src/analyze/helpers/engineHelpers/findDirectAssignment.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AAGxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;AAEnC;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAgB,EAAE,KAAW;IAC9D,IAAI,cAAc,GAAgB,IAAI,CAAC;IAEvC,QAAQ,CAAC,KAAK,EAAE;QACZ,oBAAoB,CAAC,IAAI;YACrB,uEAAuE;YACvE,IACI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY;gBACpC,UAAU,CAAC,IAAI,KAAK,YAAY;gBAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EACzC,CAAC;gBACC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC3B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B;YAC7C,CAAC;QACL,CAAC;QACD,kBAAkB,CAAC,IAAI;YACnB,8DAA8D;YAC9D,IACI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY;gBAClC,UAAU,CAAC,IAAI,KAAK,YAAY;gBAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EACvC,CAAC;gBACC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC3B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B;YAC7C,CAAC;QACL,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;AAC1B,CAAC"}

package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js

@@ -0,0 +1,29 @@
+import _traverse from "@babel/traverse";
+const traverse = _traverse.default;
+/**
+ * Finds an assignment expression where the left side is a member expression with a property that matches the given name.
+ * Traverses the given node and its children to find a match.
+ * @param node The AST node to traverse.
+ * @param toMatch The name of the property to match on the left side of the assignment.
+ * @param scope The scope of the traverse.
+ * @returns The assignment expression node if found, otherwise undefined.
+ */
+export const findMemberExpressionAssignment = (node, toMatch, scope) => {
+    let foundNode;
+    traverse(node, {
+        AssignmentExpression(path) {
+            var _a, _b, _c, _d;
+            const assignmentNode = path.node;
+            if (((_a = assignmentNode.left) === null || _a === void 0 ? void 0 : _a.type) === "MemberExpression" &&
+                ((_b = assignmentNode.right) === null || _b === void 0 ? void 0 : _b.type) === "MemberExpression" &&
+                ((_c = assignmentNode.left.property) === null || _c === void 0 ? void 0 : _c.type) === "Identifier" &&
+                ((_d = assignmentNode.left.property) === null || _d === void 0 ? void 0 : _d.name) === toMatch) {
+                foundNode = assignmentNode;
+                // Stop further traversal once a match is found
+                path.stop();
+            }
+        },
+    }, scope);
+    return foundNode;
+};
+//# sourceMappingURL=findMemberExpressionAssignment.js.map

package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findMemberExpressionAssignment.js","sourceRoot":"","sources":["../../../../src/analyze/helpers/engineHelpers/findMemberExpressionAssignment.ts"],"names":[],"mappings":"AACA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,IAAU,EAAE,OAAe,EAAE,KAAU,EAAoB,EAAE;IACxG,IAAI,SAA2B,CAAC;IAEhC,QAAQ,CACJ,IAAI,EACJ;QACI,oBAAoB,CAAC,IAAI;;YACrB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC;YAEjC,IACI,CAAA,MAAA,cAAc,CAAC,IAAI,0CAAE,IAAI,MAAK,kBAAkB;gBAChD,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,IAAI,MAAK,kBAAkB;gBACjD,CAAA,MAAC,cAAc,CAAC,IAAY,CAAC,QAAQ,0CAAE,IAAI,MAAK,YAAY;gBAC5D,CAAA,MAAC,cAAc,CAAC,IAAY,CAAC,QAAQ,0CAAE,IAAI,MAAK,OAAO,EACzD,CAAC;gBACC,SAAS,GAAG,cAAc,CAAC;gBAC3B,+CAA+C;gBAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,CAAC;QACL,CAAC;KACJ,EACD,KAAK,CACR,CAAC;IAEF,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC"}

package/build/analyze/helpers/engineHelpers/resolveFunctionIdentifier.js

@@ -0,0 +1,38 @@
+import _traverse from "@babel/traverse";
+const traverse = _traverse.default;
+/**
+ * Resolves a function identifier to its declaration node in the given AST.
+ *
+ * Given an identifier node, this function traverses the given AST and returns the
+ * function declaration node associated with the identifier. The traversal is stopped
+ * once a match is found.
+ *
+ * @param identifier - The identifier node to resolve
+ * @param ast - The AST to traverse
+ * @returns The function declaration node associated with the identifier, or undefined if not found
+ */
+export function resolveFunctionIdentifier(identifier, ast) {
+    let declarationNode;
+    if (identifier.type !== "Identifier") {
+        return undefined;
+    }
+    traverse(ast, {
+        FunctionDeclaration(path) {
+            if (path.node.id && path.node.id.name === identifier.name) {
+                declarationNode = path.node;
+                path.stop();
+            }
+        },
+        VariableDeclarator(path) {
+            if (path.node.id.type === "Identifier" && path.node.id.name === identifier.name) {
+                if (path.node.init &&
+                    (path.node.init.type === "ArrowFunctionExpression" || path.node.init.type === "FunctionExpression")) {
+                    declarationNode = path.node.init;
+                    path.stop();
+                }
+            }
+        },
+    });
+    return declarationNode;
+}
+//# sourceMappingURL=resolveFunctionIdentifier.js.map

package/build/analyze/helpers/engineHelpers/resolveFunctionIdentifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveFunctionIdentifier.js","sourceRoot":"","sources":["../../../../src/analyze/helpers/engineHelpers/resolveFunctionIdentifier.ts"],"names":[],"mappings":"AACA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAgB,EAAE,GAAS;IACjE,IAAI,eAAiC,CAAC;IAEtC,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE;QACV,mBAAmB,CAAC,IAAI;YACpB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBACxD,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,CAAC;QACL,CAAC;QACD,kBAAkB,CAAC,IAAI;YACnB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC9E,IACI,IAAI,CAAC,IAAI,CAAC,IAAI;oBACd,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,yBAAyB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC,EACrG,CAAC;oBACC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBACjC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAChB,CAAC;YACL,CAAC;QACL,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AAC3B,CAAC"}