@kairoaisec/cli 0.1.1 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/lib/patterns.d.ts.map +1 -1
- package/dist/lib/patterns.js +188 -0
- package/dist/lib/patterns.js.map +1 -1
- package/dist/lib/scanner.d.ts.map +1 -1
- package/dist/lib/scanner.js +59 -0
- package/dist/lib/scanner.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/lib/patterns.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,
|
|
1
|
+
{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/lib/patterns.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EA4YxD,CAAC"}
|
package/dist/lib/patterns.js
CHANGED
|
@@ -183,5 +183,193 @@ exports.VULNERABILITY_PATTERNS = [
|
|
|
183
183
|
cwe: 'CWE-613',
|
|
184
184
|
confidenceBase: 0.7,
|
|
185
185
|
},
|
|
186
|
+
// DeFi-focused patterns for enhanced security coverage
|
|
187
|
+
{
|
|
188
|
+
id: 'erc20-approve-race',
|
|
189
|
+
pattern: /function\s+approve\s*\([^)]*\)\s*(external|public)[^{]*\{(?![^}]*require\([^)]*==\s*0)/gs,
|
|
190
|
+
severity: 'HIGH',
|
|
191
|
+
title: 'ERC20 Approve Race Condition',
|
|
192
|
+
description: 'ERC20 approve function vulnerable to front-running attacks without zero-value reset.',
|
|
193
|
+
recommendation: 'Implement approve with zero-value reset or use increaseAllowance/decreaseAllowance.',
|
|
194
|
+
category: 'Token Security',
|
|
195
|
+
cwe: 'CWE-362',
|
|
196
|
+
confidenceBase: 0.75,
|
|
197
|
+
},
|
|
198
|
+
{
|
|
199
|
+
id: 'missing-event-emission',
|
|
200
|
+
pattern: /function\s+\w+\([^)]*\)\s*(external|public)[^{]*\{(?![^}]*emit\s+\w+)[^}]*(_balances\[|_totalSupply|_owner|owner\s*=|pause|mint|burn)/gs,
|
|
201
|
+
severity: 'MEDIUM',
|
|
202
|
+
title: 'Missing Event Emission',
|
|
203
|
+
description: 'State-changing function does not emit events for important operations.',
|
|
204
|
+
recommendation: 'Emit events for all significant state changes for transparency and monitoring.',
|
|
205
|
+
category: 'Best Practices',
|
|
206
|
+
cwe: 'CWE-778',
|
|
207
|
+
confidenceBase: 0.6,
|
|
208
|
+
},
|
|
209
|
+
{
|
|
210
|
+
id: 'centralization-risk',
|
|
211
|
+
pattern: /function\s+\w*(?:withdraw|drain|pause|mint|burn|emergency)\w*\s*\([^)]*\)\s*(external|public)[^{]*\{[^}]*onlyOwner/gs,
|
|
212
|
+
severity: 'CRITICAL',
|
|
213
|
+
title: 'Centralization Risk',
|
|
214
|
+
description: 'Owner has excessive control over critical functions that could drain funds or halt operations.',
|
|
215
|
+
recommendation: 'Consider multi-signature requirements or timelock for critical administrative functions.',
|
|
216
|
+
category: 'Access Control',
|
|
217
|
+
cwe: 'CWE-269',
|
|
218
|
+
confidenceBase: 0.85,
|
|
219
|
+
},
|
|
220
|
+
{
|
|
221
|
+
id: 'unsafe-erc20-transfer',
|
|
222
|
+
pattern: /\.transfer\s*\((?![^;]*safeTransfer)/g,
|
|
223
|
+
severity: 'HIGH',
|
|
224
|
+
title: 'Unsafe ERC20 Transfer',
|
|
225
|
+
description: 'Using unsafe transfer() instead of safeTransfer() for ERC20 tokens.',
|
|
226
|
+
recommendation: 'Use OpenZeppelin SafeERC20 library with safeTransfer() for token operations.',
|
|
227
|
+
category: 'Token Security',
|
|
228
|
+
cwe: 'CWE-252',
|
|
229
|
+
confidenceBase: 0.9,
|
|
230
|
+
},
|
|
231
|
+
{
|
|
232
|
+
id: 'mev-sandwich',
|
|
233
|
+
pattern: /function\s+\w*(?:swap|exchange|trade)\w*\s*\([^)]*\)\s*(external|public)[^{]*\{(?![^}]*deadline)(?![^}]*slippage)/gs,
|
|
234
|
+
severity: 'CRITICAL',
|
|
235
|
+
title: 'MEV Sandwich Attack Vulnerability',
|
|
236
|
+
description: 'Token swap function lacks slippage protection and deadline, vulnerable to MEV sandwich attacks.',
|
|
237
|
+
recommendation: 'Add deadline parameter and slippage protection to prevent MEV exploitation.',
|
|
238
|
+
category: 'Security',
|
|
239
|
+
cwe: 'CWE-367',
|
|
240
|
+
confidenceBase: 0.8,
|
|
241
|
+
},
|
|
242
|
+
{
|
|
243
|
+
id: 'unchecked-math-legacy',
|
|
244
|
+
pattern: /(?<!using\s+SafeMath\s+for)[^\/\*]*[^+\-]\s*(\+\+|--|\+=|\-=|\*=|\/=)\s*(?!.*SafeMath)/g,
|
|
245
|
+
severity: 'HIGH',
|
|
246
|
+
title: 'Unchecked Math Operations (Legacy)',
|
|
247
|
+
description: 'Arithmetic operations without SafeMath in legacy Solidity versions.',
|
|
248
|
+
recommendation: 'Use SafeMath library for arithmetic operations or upgrade to Solidity >=0.8.0.',
|
|
249
|
+
category: 'Security',
|
|
250
|
+
cwe: 'CWE-190',
|
|
251
|
+
confidenceBase: 0.7,
|
|
252
|
+
},
|
|
253
|
+
{
|
|
254
|
+
id: 'unused-return-value',
|
|
255
|
+
pattern: /\w+\.\w+\([^)]*\)\s*;(?!\s*\/\/)/g,
|
|
256
|
+
severity: 'MEDIUM',
|
|
257
|
+
title: 'Unused Return Value',
|
|
258
|
+
description: 'Function call return value is not used or checked.',
|
|
259
|
+
recommendation: 'Check return values of external calls or explicitly ignore with a comment.',
|
|
260
|
+
category: 'Best Practices',
|
|
261
|
+
cwe: 'CWE-252',
|
|
262
|
+
confidenceBase: 0.5,
|
|
263
|
+
},
|
|
264
|
+
{
|
|
265
|
+
id: 'shadowed-variable',
|
|
266
|
+
pattern: /function\s+\w+\([^)]*\)\s*[^{]*\{[^}]*(?:uint|address|bool|string|bytes)\s+(\w+)[^}]*\}/gs,
|
|
267
|
+
severity: 'MEDIUM',
|
|
268
|
+
title: 'Shadowed State Variable',
|
|
269
|
+
description: 'Local variable may shadow state variable, causing confusion.',
|
|
270
|
+
recommendation: 'Use different names for local variables to avoid shadowing state variables.',
|
|
271
|
+
category: 'Best Practices',
|
|
272
|
+
cwe: 'CWE-710',
|
|
273
|
+
confidenceBase: 0.4,
|
|
274
|
+
},
|
|
275
|
+
{
|
|
276
|
+
id: 'locked-ether',
|
|
277
|
+
pattern: /(?:receive\(\)|fallback\(\)|payable)[^}]*\{(?![^}]*(?:transfer|send|call\{value|withdraw))/gs,
|
|
278
|
+
severity: 'MEDIUM',
|
|
279
|
+
title: 'Locked Ether',
|
|
280
|
+
description: 'Contract can receive Ether but has no mechanism to withdraw it.',
|
|
281
|
+
recommendation: 'Add withdrawal function for received Ether or remove payable modifiers.',
|
|
282
|
+
category: 'Security',
|
|
283
|
+
cwe: 'CWE-667',
|
|
284
|
+
confidenceBase: 0.7,
|
|
285
|
+
},
|
|
286
|
+
{
|
|
287
|
+
id: 'strict-equality-balance',
|
|
288
|
+
pattern: /(?:this\.balance|address\([^)]*\)\.balance)\s*==\s*\d+/g,
|
|
289
|
+
severity: 'MEDIUM',
|
|
290
|
+
title: 'Strict Balance Equality',
|
|
291
|
+
description: 'Using strict equality for Ether balance checks can be manipulated via selfdestruct.',
|
|
292
|
+
recommendation: 'Use >= instead of == for balance checks to prevent manipulation.',
|
|
293
|
+
category: 'Security',
|
|
294
|
+
cwe: 'CWE-1024',
|
|
295
|
+
confidenceBase: 0.8,
|
|
296
|
+
},
|
|
297
|
+
{
|
|
298
|
+
id: 'storage-collision',
|
|
299
|
+
pattern: /contract\s+\w+(?:\s+is\s+[^{]+)?\s*\{[^}]*(?:mapping|uint|address|bool)\s+(?:private|internal)\s+\w+(?:\[\])?[^}]*\}/gs,
|
|
300
|
+
severity: 'HIGH',
|
|
301
|
+
title: 'Potential Storage Collision',
|
|
302
|
+
description: 'Proxy contract implementation may have storage layout collision with proxy.',
|
|
303
|
+
recommendation: 'Use storage gaps or OpenZeppelin upgradeable patterns for proxy-safe storage.',
|
|
304
|
+
category: 'Security',
|
|
305
|
+
cwe: 'CWE-1025',
|
|
306
|
+
confidenceBase: 0.6,
|
|
307
|
+
},
|
|
308
|
+
{
|
|
309
|
+
id: 'missing-reentrancy-guard',
|
|
310
|
+
pattern: /function\s+\w+\([^)]*\)\s*(external|public)[^{]*\{[^}]*\.call\{[^}]*\}[^}]*(?!nonReentrant)/gs,
|
|
311
|
+
severity: 'CRITICAL',
|
|
312
|
+
title: 'Missing Reentrancy Protection',
|
|
313
|
+
description: 'Function with external calls lacks reentrancy protection.',
|
|
314
|
+
recommendation: 'Add ReentrancyGuard modifier or use Checks-Effects-Interactions pattern.',
|
|
315
|
+
category: 'Security',
|
|
316
|
+
cwe: 'CWE-841',
|
|
317
|
+
confidenceBase: 0.75,
|
|
318
|
+
},
|
|
319
|
+
{
|
|
320
|
+
id: 'price-oracle-stale',
|
|
321
|
+
pattern: /\.latestRoundData\(\)(?![^}]*updatedAt)(?![^}]*timestamp)/gs,
|
|
322
|
+
severity: 'HIGH',
|
|
323
|
+
title: 'Stale Oracle Price',
|
|
324
|
+
description: 'Oracle price data used without checking freshness or validity.',
|
|
325
|
+
recommendation: 'Check updatedAt timestamp and validate oracle response before using price data.',
|
|
326
|
+
category: 'Security',
|
|
327
|
+
cwe: 'CWE-346',
|
|
328
|
+
confidenceBase: 0.85,
|
|
329
|
+
},
|
|
330
|
+
{
|
|
331
|
+
id: 'insufficient-gas-stipend',
|
|
332
|
+
pattern: /\.(?:send|transfer)\s*\(/g,
|
|
333
|
+
severity: 'MEDIUM',
|
|
334
|
+
title: 'Insufficient Gas Stipend',
|
|
335
|
+
description: 'Using send() or transfer() with 2300 gas stipend may fail with smart contract recipients.',
|
|
336
|
+
recommendation: 'Use call() with explicit gas limit instead of send() or transfer().',
|
|
337
|
+
category: 'Security',
|
|
338
|
+
cwe: 'CWE-400',
|
|
339
|
+
confidenceBase: 0.7,
|
|
340
|
+
},
|
|
341
|
+
{
|
|
342
|
+
id: 'front-running-protection',
|
|
343
|
+
pattern: /function\s+\w*(?:buy|sell|trade|bid)\w*\s*\([^)]*\)\s*(external|public)[^{]*\{(?![^}]*nonce)(?![^}]*commitment)/gs,
|
|
344
|
+
severity: 'HIGH',
|
|
345
|
+
title: 'Front-Running Vulnerability',
|
|
346
|
+
description: 'Price-sensitive function vulnerable to front-running attacks.',
|
|
347
|
+
recommendation: 'Implement commit-reveal scheme or use transaction ordering protection.',
|
|
348
|
+
category: 'Security',
|
|
349
|
+
cwe: 'CWE-362',
|
|
350
|
+
confidenceBase: 0.6,
|
|
351
|
+
},
|
|
352
|
+
{
|
|
353
|
+
id: 'unvalidated-caller',
|
|
354
|
+
pattern: /function\s+\w+\([^)]*\)\s*external[^{]*\{(?![^}]*require\(msg\.sender)(?![^}]*onlyOwner)(?![^}]*modifier)/gs,
|
|
355
|
+
severity: 'MEDIUM',
|
|
356
|
+
title: 'Unvalidated External Caller',
|
|
357
|
+
description: 'External function lacks caller validation or access control.',
|
|
358
|
+
recommendation: 'Add appropriate access control modifiers or caller validation.',
|
|
359
|
+
category: 'Access Control',
|
|
360
|
+
cwe: 'CWE-284',
|
|
361
|
+
confidenceBase: 0.5,
|
|
362
|
+
},
|
|
363
|
+
{
|
|
364
|
+
id: 'state-modification-view',
|
|
365
|
+
pattern: /function\s+\w+\([^)]*\)\s*(?:view|pure)[^{]*\{[^}]*(?:_balances\[|_totalSupply|storage\s+\w+)/gs,
|
|
366
|
+
severity: 'HIGH',
|
|
367
|
+
title: 'State Modification in View Function',
|
|
368
|
+
description: 'View or pure function attempts to modify state variables.',
|
|
369
|
+
recommendation: 'Remove state modifications from view/pure functions or change visibility.',
|
|
370
|
+
category: 'Security',
|
|
371
|
+
cwe: 'CWE-664',
|
|
372
|
+
confidenceBase: 0.9,
|
|
373
|
+
},
|
|
186
374
|
];
|
|
187
375
|
//# sourceMappingURL=patterns.js.map
|
package/dist/lib/patterns.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../src/lib/patterns.ts"],"names":[],"mappings":";;;AAYA;;;;GAIG;AACU,QAAA,sBAAsB,GAA2B;IAC5D;QACE,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,gGAAgG;QAClG,cAAc,EAAE,8EAA8E;QAC9F,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,mEAAmE;QAC5E,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,6EAA6E;QAC1F,cAAc,EACZ,0FAA0F;QAC5F,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,WAAW;QACf,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,uEAAuE;QACpF,cAAc,EAAE,gEAAgE;QAChF,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,iFAAiF;QAC9F,cAAc,EACZ,yFAAyF;QAC3F,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,oEAAoE;QACjF,cAAc,EACZ,iFAAiF;QACnF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EAAE,mEAAmE;QAChF,cAAc,EAAE,mEAAmE;QACnF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,OAAO,EAAE,wDAAwD;QACjE,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EAAE,+DAA+D;QAC5E,cAAc,EAAE,kEAAkE;QAClF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,4DAA4D;QACzE,cAAc,EAAE,iEAAiE;QACjF,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,UAAU;QACf,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,OAAO,EAAE,kDAAkD;QAC3D,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,oFAAoF;QACtF,cAAc,EAAE,yDAAyD;QACzE,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,gEAAgE;QAC7E,cAAc,EAAE,+DAA+D;QAC/E,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EACT,qGAAqG;QACvG,cAAc,EACZ,iFAAiF;QACnF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,iGAAiG;QACnG,cAAc,EAAE,sDAAsD;QACtE,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,OAAO,EAAE,yDAAyD;QAClE,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,4EAA4E;QACzF,cAAc,EAAE,uEAAuE;QACvF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EAAE,kEAAkE;QAC/E,cAAc,EACZ,oFAAoF;QACtF,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,gEAAgE;QAC7E,cAAc,EAAE,0EAA0E;QAC1F,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,8BAA8B;QACrC,WAAW,EAAE,oEAAoE;QACjF,cAAc,EAAE,8EAA8E;QAC9F,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;CACF,CAAC"}
|
|
1
|
+
{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../src/lib/patterns.ts"],"names":[],"mappings":";;;AAYA;;;;GAIG;AACU,QAAA,sBAAsB,GAA2B;IAC5D;QACE,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,gGAAgG;QAClG,cAAc,EAAE,8EAA8E;QAC9F,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,mEAAmE;QAC5E,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,6EAA6E;QAC1F,cAAc,EACZ,0FAA0F;QAC5F,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,WAAW;QACf,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,uEAAuE;QACpF,cAAc,EAAE,gEAAgE;QAChF,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,iFAAiF;QAC9F,cAAc,EACZ,yFAAyF;QAC3F,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,oEAAoE;QACjF,cAAc,EACZ,iFAAiF;QACnF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EAAE,mEAAmE;QAChF,cAAc,EAAE,mEAAmE;QACnF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,OAAO,EAAE,wDAAwD;QACjE,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EAAE,+DAA+D;QAC5E,cAAc,EAAE,kEAAkE;QAClF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,4DAA4D;QACzE,cAAc,EAAE,iEAAiE;QACjF,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,UAAU;QACf,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,OAAO,EAAE,kDAAkD;QAC3D,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,oFAAoF;QACtF,cAAc,EAAE,yDAAyD;QACzE,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,gEAAgE;QAC7E,cAAc,EAAE,+DAA+D;QAC/E,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EACT,qGAAqG;QACvG,cAAc,EACZ,iFAAiF;QACnF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,iGAAiG;QACnG,cAAc,EAAE,sDAAsD;QACtE,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,OAAO,EAAE,yDAAyD;QAClE,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,4EAA4E;QACzF,cAAc,EAAE,uEAAuE;QACvF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EAAE,kEAAkE;QAC/E,cAAc,EACZ,oFAAoF;QACtF,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,gEAAgE;QAC7E,cAAc,EAAE,0EAA0E;QAC1F,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,8BAA8B;QACrC,WAAW,EAAE,oEAAoE;QACjF,cAAc,EAAE,8EAA8E;QAC9F,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD,uDAAuD;IACvD;QACE,EAAE,EAAE,oBAAoB;QACxB,OAAO,EACL,0FAA0F;QAC5F,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,sFAAsF;QACxF,cAAc,EACZ,qFAAqF;QACvF,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,OAAO,EACL,yIAAyI;QAC3I,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,wEAAwE;QACrF,cAAc,EACZ,gFAAgF;QAClF,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,OAAO,EACL,sHAAsH;QACxH,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,gGAAgG;QAClG,cAAc,EACZ,0FAA0F;QAC5F,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,qEAAqE;QAClF,cAAc,EAAE,8EAA8E;QAC9F,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EACL,qHAAqH;QACvH,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EACT,iGAAiG;QACnG,cAAc,EAAE,6EAA6E;QAC7F,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,OAAO,EACL,yFAAyF;QAC3F,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EAAE,qEAAqE;QAClF,cAAc,EACZ,gFAAgF;QAClF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,OAAO,EAAE,mCAAmC;QAC5C,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,oDAAoD;QACjE,cAAc,EAAE,4EAA4E;QAC5F,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,OAAO,EACL,2FAA2F;QAC7F,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,8DAA8D;QAC3E,cAAc,EAAE,6EAA6E;QAC7F,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EACL,8FAA8F;QAChG,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,iEAAiE;QAC9E,cAAc,EAAE,yEAAyE;QACzF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,OAAO,EAAE,yDAAyD;QAClE,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,qFAAqF;QACvF,cAAc,EAAE,kEAAkE;QAClF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,UAAU;QACf,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,OAAO,EACL,wHAAwH;QAC1H,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE,6EAA6E;QAC1F,cAAc,EAAE,+EAA+E;QAC/F,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,UAAU;QACf,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,OAAO,EACL,+FAA+F;QACjG,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,+BAA+B;QACtC,WAAW,EAAE,2DAA2D;QACxE,cAAc,EAAE,0EAA0E;QAC1F,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,OAAO,EAAE,6DAA6D;QACtE,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,gEAAgE;QAC7E,cAAc,EACZ,iFAAiF;QACnF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,IAAI;KACrB;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,2FAA2F;QAC7F,cAAc,EAAE,qEAAqE;QACrF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,OAAO,EACL,mHAAmH;QACrH,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE,+DAA+D;QAC5E,cAAc,EAAE,wEAAwE;QACxF,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,OAAO,EACL,6GAA6G;QAC/G,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE,8DAA8D;QAC3E,cAAc,EAAE,gEAAgE;QAChF,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,OAAO,EACL,iGAAiG;QACnG,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EAAE,2DAA2D;QACxE,cAAc,EAAE,2EAA2E;QAC3F,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,GAAG;KACpB;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/lib/scanner.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAQnE;AAcD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/lib/scanner.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAQnE;AAcD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CA0M5E;AAsBD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf,CAcA;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAU3D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAClD,OAAO,EAAE,CAKX"}
|
package/dist/lib/scanner.js
CHANGED
|
@@ -48,6 +48,10 @@ function scanFileContent(content, filePath) {
|
|
|
48
48
|
if (pattern.id === 'integer-overflow' && skipOverflow) {
|
|
49
49
|
continue;
|
|
50
50
|
}
|
|
51
|
+
// Skip unchecked-math-legacy for Solidity >=0.8.0 (built-in overflow checks)
|
|
52
|
+
if (pattern.id === 'unchecked-math-legacy' && skipOverflow) {
|
|
53
|
+
continue;
|
|
54
|
+
}
|
|
51
55
|
const beforeMatch = content.substring(0, match.index);
|
|
52
56
|
const lineNumber = beforeMatch.split('\n').length;
|
|
53
57
|
// Check if match is in a comment
|
|
@@ -140,6 +144,61 @@ function scanFileContent(content, filePath) {
|
|
|
140
144
|
finding.confidence *= 0.3;
|
|
141
145
|
}
|
|
142
146
|
}
|
|
147
|
+
// Context-aware: Missing reentrancy guard — suppress if ReentrancyGuard is present
|
|
148
|
+
const missingReentrancyFindings = findings.filter((f) => f.pattern_id === 'missing-reentrancy-guard');
|
|
149
|
+
for (const finding of missingReentrancyFindings) {
|
|
150
|
+
if (hasReentrancyGuard) {
|
|
151
|
+
const funcStart = Math.max(0, finding.line_start - 10);
|
|
152
|
+
const funcEnd = Math.min(lines.length, finding.line_start + 10);
|
|
153
|
+
const funcContext = lines.slice(funcStart, funcEnd).join('\n');
|
|
154
|
+
if (/nonReentrant/.test(funcContext)) {
|
|
155
|
+
finding.confidence = 0;
|
|
156
|
+
}
|
|
157
|
+
else {
|
|
158
|
+
finding.confidence *= 0.3;
|
|
159
|
+
}
|
|
160
|
+
}
|
|
161
|
+
}
|
|
162
|
+
// Context-aware: Unsafe ERC20 transfer — reduce confidence if SafeERC20 is imported
|
|
163
|
+
const unsafeTransferFindings = findings.filter((f) => f.pattern_id === 'unsafe-erc20-transfer');
|
|
164
|
+
const hasSafeERC20 = /import.*SafeERC20|using\s+SafeERC20\s+for/.test(content);
|
|
165
|
+
for (const finding of unsafeTransferFindings) {
|
|
166
|
+
if (hasSafeERC20) {
|
|
167
|
+
finding.confidence *= 0.2; // Likely false positive if SafeERC20 is used
|
|
168
|
+
}
|
|
169
|
+
// Check if it's actually an ERC20 contract context
|
|
170
|
+
const contextLines = lines
|
|
171
|
+
.slice(Math.max(0, finding.line_start - 20), Math.min(lines.length, finding.line_start + 5))
|
|
172
|
+
.join('\n');
|
|
173
|
+
if (!/ERC20|_transfer|_balances|allowance/.test(contextLines)) {
|
|
174
|
+
finding.confidence *= 0.3; // Not in ERC20 context
|
|
175
|
+
}
|
|
176
|
+
}
|
|
177
|
+
// Context-aware: Centralization risk — reduce confidence for test or mock contracts
|
|
178
|
+
const centralizationFindings = findings.filter((f) => f.pattern_id === 'centralization-risk');
|
|
179
|
+
for (const finding of centralizationFindings) {
|
|
180
|
+
if (/test|mock|demo|example/i.test(filePath) ||
|
|
181
|
+
/contract\s+\w*(?:Test|Mock|Demo)/i.test(content)) {
|
|
182
|
+
finding.confidence *= 0.2; // Test contracts can have centralized control
|
|
183
|
+
}
|
|
184
|
+
}
|
|
185
|
+
// Context-aware: Storage collision — only relevant for upgradeable contracts
|
|
186
|
+
const storageFindings = findings.filter((f) => f.pattern_id === 'storage-collision');
|
|
187
|
+
for (const finding of storageFindings) {
|
|
188
|
+
if (!/upgradeable|proxy|implementation|initialize/i.test(content)) {
|
|
189
|
+
finding.confidence *= 0.2; // Not relevant for non-upgradeable contracts
|
|
190
|
+
}
|
|
191
|
+
}
|
|
192
|
+
// Context-aware: Oracle staleness — check if validation exists
|
|
193
|
+
const oracleFindings = findings.filter((f) => f.pattern_id === 'price-oracle-stale');
|
|
194
|
+
for (const finding of oracleFindings) {
|
|
195
|
+
const startLine = Math.max(0, finding.line_start - 10);
|
|
196
|
+
const endLine = Math.min(lines.length, finding.line_start + 10);
|
|
197
|
+
const context = lines.slice(startLine, endLine).join('\n');
|
|
198
|
+
if (/updatedAt|timestamp.*>|block\.timestamp.*-.*</.test(context)) {
|
|
199
|
+
finding.confidence *= 0.3; // Validation appears to be present
|
|
200
|
+
}
|
|
201
|
+
}
|
|
143
202
|
// Filter out low confidence findings after context analysis
|
|
144
203
|
const filteredFindings = findings.filter((f) => f.confidence >= 0.3);
|
|
145
204
|
// Deduplicate findings by fingerprint
|
package/dist/lib/scanner.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/lib/scanner.ts"],"names":[],"mappings":";;AAwBA,4BAQC;AAiBD,
|
|
1
|
+
{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/lib/scanner.ts"],"names":[],"mappings":";;AAwBA,4BAQC;AAiBD,0CA0MC;AAyBD,8CAoBC;AAKD,oCAUC;AAKD,4CAQC;AApUD,0CAAuC;AACvC,mCAAoC;AACpC,+CAA6E;AAmB7E;;GAEG;AACI,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;QACxD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,OAAe,EAAE,QAAgB;IAC/D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAElG,KAAK,MAAM,OAAO,IAAI,oCAAsB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,wEAAwE;YACxE,IAAI,OAAO,CAAC,EAAE,KAAK,kBAAkB,IAAI,YAAY,EAAE,CAAC;gBACtD,SAAS;YACX,CAAC;YAED,6EAA6E;YAC7E,IAAI,OAAO,CAAC,EAAE,KAAK,uBAAuB,IAAI,YAAY,EAAE,CAAC;gBAC3D,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAElD,iCAAiC;YACjC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAEzD,qCAAqC;YACrC,IAAI,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;YACxC,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,IAAI,GAAG,CAAC,CAAC,uCAAuC;YAC5D,CAAC;YAED,8BAA8B;YAC9B,IAAI,UAAU,GAAG,GAAG;gBAAE,SAAS;YAE/B,0DAA0D;YAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAErE,yCAAyC;YACzC,MAAM,WAAW,GAAG,0BAA0B,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YAE9F,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,IAAA,mBAAU,GAAE;gBAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,QAAQ;gBACnB,UAAU,EAAE,UAAU;gBACtB,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,WAAW;gBACzB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,GAAG;gBAC9C,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,UAAU,EAAE,OAAO,CAAC,EAAE;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,kBAAkB,GAAG,6CAA6C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvF,IAAI,kBAAkB,EAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;gBACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/D,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBACrC,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC;IAC9E,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACxF,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,0DAA0D;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3D,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5F,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,wBAAwB;QACrD,CAAC;QACD,IACE,OAAO,CAAC,UAAU,KAAK,sBAAsB;YAC7C,wCAAwC,CAAC,IAAI,CAAC,OAAO,CAAC,EACtD,CAAC;YACD,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;QAC5B,CAAC;QACD,IACE,OAAO,CAAC,UAAU,KAAK,uBAAuB;YAC9C,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1C,CAAC;YACD,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,cAAc,CAAC,CAAC;IAC5E,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3D,gDAAgD;QAChD,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,MAAM,yBAAyB,GAAG,QAAQ,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,0BAA0B,CACnD,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;QAChD,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;YAChE,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,uBAAuB,CAAC,CAAC;IAChG,MAAM,YAAY,GAAG,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/E,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,6CAA6C;QAC1E,CAAC;QACD,mDAAmD;QACnD,MAAM,YAAY,GAAG,KAAK;aACvB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;aAC3F,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,uBAAuB;QACpD,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,qBAAqB,CAAC,CAAC;IAC9F,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IACE,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,EACjD,CAAC;YACD,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,8CAA8C;QAC3E,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,mBAAmB,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,6CAA6C;QAC1E,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,oBAAoB,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,mCAAmC;QAChE,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;IAErE,sCAAsC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACnD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CACjC,QAAgB,EAChB,SAAiB,EACjB,UAAkB,EAClB,WAAmB;IAEnB,6CAA6C;IAC7C,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,SAAS,IAAI,UAAU,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/E,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;QACjC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,2BAA2B;IACjD,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,QAAmB;IAOnD,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,KAAK,EAAE,QAAQ,CAAC,MAAM;KACvB,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,QAAmB;IAC9C,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAElE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAE5C,sDAAsD;QACtD,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAC9B,QAAmB,EACnB,WAAmD;IAEnD,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAE5C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC;AACnF,CAAC"}
|