@korayda4/vibe-security 0.3.0

package/dist/engine/output.js

@@ -0,0 +1,155 @@
+export function toSarif(result) {
+    const rules = new Map();
+    for (const f of result.findings) {
+        if (rules.has(f.ruleId))
+            continue;
+        rules.set(f.ruleId, {
+            id: f.ruleId,
+            name: f.title,
+            helpText: f.remediation,
+            helpUri: f.references[0],
+            defaultSeverity: f.severity,
+        });
+    }
+    const sarifRules = Array.from(rules.values()).map((r) => ({
+        id: r.id,
+        name: r.name,
+        shortDescription: { text: r.name },
+        fullDescription: { text: r.helpText },
+        help: { text: r.helpText },
+        helpUri: r.helpUri,
+        defaultConfiguration: { level: severityToSarifLevel(r.defaultSeverity) },
+    }));
+    const sarifResults = result.findings.map((f) => ({
+        ruleId: f.ruleId,
+        level: severityToSarifLevel(f.severity),
+        message: { text: `${f.title} -- ${f.impact}` },
+        locations: [
+            {
+                physicalLocation: {
+                    artifactLocation: { uri: f.file },
+                    region: {
+                        startLine: f.match.line,
+                        startColumn: f.match.column + 1,
+                        snippet: { text: f.match.snippet.trim() },
+                    },
+                },
+            },
+        ],
+        fixes: f.fix
+            ? [
+                {
+                    description: { text: f.fix.description },
+                    artifactChanges: [
+                        {
+                            artifactLocation: { uri: f.file },
+                            replacements: [
+                                {
+                                    deletedRegion: { snippet: { text: f.fix.find } },
+                                    insertedText: { text: f.fix.replace },
+                                },
+                            ],
+                        },
+                    ],
+                },
+            ]
+            : undefined,
+    }));
+    return {
+        $schema: 'https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'Vibe Security',
+                        version: '0.1.0',
+                        informationUri: 'https://github.com/korayda4/Vibe-Security',
+                        rules: sarifRules,
+                    },
+                },
+                originalUriBaseIds: { SRCROOT: { uri: 'file://' + result.rootDir + '/' } },
+                results: sarifResults,
+                invocations: [
+                    {
+                        startTimeUtc: result.startedAt,
+                        endTimeUtc: result.finishedAt,
+                        executionSuccessful: true,
+                    },
+                ],
+            },
+        ],
+    };
+}
+function severityToSarifLevel(s) {
+    switch (s) {
+        case 'critical':
+        case 'high':
+            return 'error';
+        case 'medium':
+            return 'warning';
+        case 'low':
+        case 'info':
+        default:
+            return 'note';
+    }
+}
+export function toJson(result) {
+    return JSON.stringify(result, null, 2);
+}
+export function toJunit(result) {
+    const cases = result.findings.map((f) => `    <testcase classname="${escapeXml(f.layer)}" name="${escapeXml(f.ruleId)} ${escapeXml(f.title)}" time="0">\n` +
+        `      <failure type="${escapeXml(f.severity)}" message="${escapeXml(f.title)}">\n` +
+        `        ${escapeXml(f.file)}:${f.match.line} -- ${escapeXml(f.impact)}\n` +
+        `      </failure>\n` +
+        `    </testcase>`);
+    const tests = result.findings.length;
+    const failures = result.findings.filter((f) => f.severity === 'critical' || f.severity === 'high').length;
+    return (`<?xml version="1.0" encoding="UTF-8"?>\n` +
+        `<testsuite name="vibe-security" tests="${tests}" failures="${failures}" errors="0" time="${(result.durationMs / 1000).toFixed(3)}">\n` +
+        cases.join('\n') +
+        `\n</testsuite>\n`);
+}
+function escapeXml(s) {
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+}
+export function toCompactMarkdown(result) {
+    const lines = [];
+    lines.push(`# Vibe Security Summary`);
+    lines.push('');
+    lines.push(`- **Total:** ${result.summary.totalFindings}`);
+    lines.push(`- **Critical:** ${result.summary.bySeverity.critical}`);
+    lines.push(`- **High:** ${result.summary.bySeverity.high}`);
+    lines.push(`- **Medium:** ${result.summary.bySeverity.medium}`);
+    lines.push('');
+    lines.push('| Severity | Rule | File |');
+    lines.push('| --- | --- | --- |');
+    for (const f of result.findings.slice(0, 50)) {
+        lines.push(`| ${f.severity} | \`${f.ruleId}\` | \`${f.file}:${f.match.line}\` |`);
+    }
+    if (result.findings.length > 50) {
+        lines.push(`| _...and ${result.findings.length - 50} more_ | | |`);
+    }
+    return lines.join('\n');
+}
+export function formatOutput(format, result) {
+    switch (format) {
+        case 'sarif':
+            return JSON.stringify(toSarif(result), null, 2);
+        case 'json':
+            return toJson(result);
+        case 'junit':
+            return toJunit(result);
+        case 'compact':
+            return toCompactMarkdown(result);
+        case 'markdown':
+        default:
+            return '';
+    }
+}
+//# sourceMappingURL=output.js.map

package/dist/engine/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/engine/output.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,OAAO,CAAC,MAAkB;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAGlB,CAAC;IAEJ,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QAClC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE;YAClB,EAAE,EAAE,CAAC,CAAC,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,KAAK;YACb,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YACxB,eAAe,EAAE,CAAC,CAAC,QAAQ;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;QACrC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,oBAAoB,EAAE,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE;KACzE,CAAC,CAAC,CAAC;IAEJ,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAC9C,SAAS,EAAE;YACT;gBACE,gBAAgB,EAAE;oBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE;oBACjC,MAAM,EAAE;wBACN,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;wBACvB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;wBAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;qBAC1C;iBACF;aACF;SACF;QACD,KAAK,EAAE,CAAC,CAAC,GAAG;YACV,CAAC,CAAC;gBACE;oBACE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE;oBACxC,eAAe,EAAE;wBACf;4BACE,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE;4BACjC,YAAY,EAAE;gCACZ;oCACE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE;oCAChD,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;iCACtC;6BACF;yBACF;qBACF;iBACF;aACF;YACH,CAAC,CAAC,SAAS;KACd,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,OAAO,EAAE,qEAAqE;QAC9E,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,eAAe;wBACrB,OAAO,EAAE,OAAO;wBAChB,cAAc,EAAE,2CAA2C;wBAC3D,KAAK,EAAE,UAAU;qBAClB;iBACF;gBACD,kBAAkB,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,EAAE;gBAC1E,OAAO,EAAE,YAAY;gBACrB,WAAW,EAAE;oBACX;wBACE,YAAY,EAAE,MAAM,CAAC,SAAS;wBAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,mBAAmB,EAAE,IAAI;qBAC1B;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAW;IACvC,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAkB;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAC/B,CAAC,CAAC,EAAE,EAAE,CACJ,4BAA4B,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe;QACjH,wBAAwB,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM;QACnF,WAAW,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;QAC1E,oBAAoB;QACpB,iBAAiB,CACpB,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAE1G,OAAO,CACL,0CAA0C;QAC1C,0CAA0C,KAAK,eAAe,QAAQ,sBAAsB,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACvI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAChB,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,cAAc,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,MAAkB;IAC7D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,KAAK,MAAM;YACT,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,UAAU,CAAC;QAChB;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/engine/reporter.d.ts

@@ -0,0 +1,3 @@
+import type { ScanResult } from '../types.js';
+export declare function writeSecurityReport(result: ScanResult, reportPath: string): Promise<string>;
+export declare function renderSecurityMarkdown(result: ScanResult): string;

package/dist/engine/reporter.js

@@ -0,0 +1,145 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+const LAYER_LABELS = {
+    frontend: 'Frontend',
+    backend: 'Backend & API',
+    network: 'Network & Infrastructure',
+    database: 'Database',
+    cicd: 'CI/CD & DevOps',
+    observability: 'Observability',
+};
+const LAYER_DESCRIPTIONS = {
+    frontend: 'Client-side rendering, DOM manipulation, cookies, asset exposure',
+    backend: 'API endpoints, authentication, input validation, file uploads',
+    network: 'HTTP security headers, CORS, transport security',
+    database: 'Privilege separation, encryption at rest and in transit',
+    cicd: 'Dependency hygiene, secret management, build pipeline',
+    observability: 'Error handling, log safety, anomaly detection',
+};
+const SEVERITY_EMOJI = {
+    critical: '🟣',
+    high: '🔴',
+    medium: '🟠',
+    low: '🟡',
+    info: '🔵',
+};
+const SEVERITY_ORDER = {
+    critical: 0,
+    high: 1,
+    medium: 2,
+    low: 3,
+    info: 4,
+};
+export async function writeSecurityReport(result, reportPath) {
+    const md = renderSecurityMarkdown(result);
+    const absolute = path.resolve(reportPath);
+    await fs.mkdir(path.dirname(absolute), { recursive: true });
+    await fs.writeFile(absolute, md, 'utf8');
+    return absolute;
+}
+export function renderSecurityMarkdown(result) {
+    const lines = [];
+    const projectName = path.basename(result.rootDir);
+    lines.push(`# Security Audit -- ${projectName}`);
+    lines.push('');
+    lines.push(`> Generated by **Vibe Security** on ${result.startedAt}. ` +
+        `${result.summary.totalFindings} finding(s) across ${result.filesScanned} file(s) ` +
+        `using ${result.rulesEvaluated} rule(s) in ${result.durationMs}ms.`);
+    lines.push('');
+    lines.push('## Executive Summary');
+    lines.push('');
+    lines.push('| Severity | Count |');
+    lines.push('| --- | --- |');
+    for (const sev of ['critical', 'high', 'medium', 'low', 'info']) {
+        lines.push(`| ${SEVERITY_EMOJI[sev]} ${capitalize(sev)} | ${result.summary.bySeverity[sev]} |`);
+    }
+    lines.push('');
+    if (result.summary.totalFindings === 0) {
+        lines.push('**No security issues detected.** Maintain a healthy baseline by re-running this scan on every major change.');
+        lines.push('');
+        return lines.join('\n');
+    }
+    lines.push('## Findings by Layer');
+    lines.push('');
+    lines.push('| Layer | Description | Findings |');
+    lines.push('| --- | --- | --- |');
+    for (const layer of Object.keys(LAYER_LABELS)) {
+        if (result.summary.byLayer[layer] === 0)
+            continue;
+        lines.push(`| **${LAYER_LABELS[layer]}** | ${LAYER_DESCRIPTIONS[layer]} | ${result.summary.byLayer[layer]} |`);
+    }
+    lines.push('');
+    const byLayer = new Map();
+    for (const f of result.findings) {
+        if (!byLayer.has(f.layer))
+            byLayer.set(f.layer, []);
+        byLayer.get(f.layer).push(f);
+    }
+    for (const layer of Object.keys(LAYER_LABELS)) {
+        const items = byLayer.get(layer);
+        if (!items || items.length === 0)
+            continue;
+        lines.push(`## ${LAYER_LABELS[layer]}`);
+        lines.push('');
+        items.sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]);
+        for (const f of items) {
+            lines.push(renderFinding(f));
+            lines.push('');
+        }
+    }
+    lines.push('## How to fix');
+    lines.push('');
+    lines.push('1. Address **Critical** and **High** findings first.');
+    lines.push('2. Apply remediations in the order suggested by each rule.');
+    lines.push('3. Re-run `vibe-security scan_project` after each fix batch.');
+    lines.push('4. Wire this scan into CI so regressions surface automatically.');
+    lines.push('');
+    lines.push('---');
+    lines.push('');
+    lines.push('Generated by [Vibe Security](https://github.com/korayda4/Vibe-Security) -- MCP server for AI Vibe Coders.');
+    lines.push('');
+    return lines.join('\n');
+}
+function renderFinding(f) {
+    const out = [];
+    out.push(`### ${SEVERITY_EMOJI[f.severity]} ${f.title}`);
+    out.push('');
+    out.push(`- **Rule ID:** \`${f.ruleId}\``);
+    out.push(`- **Severity:** ${capitalize(f.severity)}`);
+    if (f.cwe)
+        out.push(`- **CWE:** ${f.cwe}`);
+    if (f.owasp)
+        out.push(`- **OWASP:** ${f.owasp}`);
+    out.push(`- **File:** \`${f.file}\` (line ${f.match.line})`);
+    out.push('');
+    out.push('**Description**');
+    out.push('');
+    out.push(f.description);
+    out.push('');
+    out.push('**Impact**');
+    out.push('');
+    out.push(f.impact);
+    out.push('');
+    out.push('**Snippet**');
+    out.push('');
+    out.push('```');
+    out.push(f.match.snippet.trim() || '(empty)');
+    out.push('```');
+    out.push('');
+    out.push('**Remediation**');
+    out.push('');
+    out.push(f.remediation);
+    if (f.references.length > 0) {
+        out.push('');
+        out.push('**References**');
+        out.push('');
+        for (const ref of f.references) {
+            out.push(`- ${ref}`);
+        }
+    }
+    return out.join('\n');
+}
+function capitalize(s) {
+    return s.charAt(0).toUpperCase() + s.slice(1);
+}
+//# sourceMappingURL=reporter.js.map

package/dist/engine/reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../src/engine/reporter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,YAAY,GAA0B;IAC1C,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,eAAe;IACxB,OAAO,EAAE,0BAA0B;IACnC,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,gBAAgB;IACtB,aAAa,EAAE,eAAe;CAC/B,CAAC;AAEF,MAAM,kBAAkB,GAA0B;IAChD,QAAQ,EAAE,kEAAkE;IAC5E,OAAO,EAAE,+DAA+D;IACxE,OAAO,EAAE,iDAAiD;IAC1D,QAAQ,EAAE,yDAAyD;IACnE,IAAI,EAAE,uDAAuD;IAC7D,aAAa,EAAE,+CAA+C;CAC/D,CAAC;AAEF,MAAM,cAAc,GAA6B;IAC/C,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,MAAM,cAAc,GAA6B;IAC/C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkB,EAClB,UAAkB;IAElB,MAAM,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElD,KAAK,CAAC,IAAI,CAAC,uBAAuB,WAAW,EAAE,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,uCAAuC,MAAM,CAAC,SAAS,IAAI;QACzD,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,sBAAsB,MAAM,CAAC,YAAY,WAAW;QACnF,SAAS,MAAM,CAAC,cAAc,eAAe,MAAM,CAAC,UAAU,KAAK,CACtE,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAe,EAAE,CAAC;QAC9E,KAAK,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,6GAA6G,CAAC,CAAC;QAC1H,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAY,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,SAAS;QAClD,KAAK,CAAC,IAAI,CACR,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ,kBAAkB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACnG,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAY,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE3C,KAAK,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IACzE,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,2GAA2G,CAAC,CAAC;IACxH,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACzD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IAC3C,GAAG,CAAC,IAAI,CAAC,mBAAmB,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC;IAC9C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/engine/rules/_helpers.d.ts

@@ -0,0 +1,9 @@
+import type { Finding, FixPatch, Rule, RuleContext } from '../../types.js';
+export declare function matchAll(re: RegExp, source: string): Generator<RegExpExecArray>;
+export declare function lineColumnFromIndex(source: string, index: number): {
+    line: number;
+    column: number;
+};
+export declare function snippetAt(source: string, line: number, contextLines?: number): string;
+export declare function makeFinding(rule: Rule, ctx: RuleContext, matchIndex: number, matchLength: number, fix?: FixPatch): Finding;
+export declare function grepRule(rule: Rule, ctx: RuleContext, re: RegExp): Finding[];

package/dist/engine/rules/_helpers.js

@@ -0,0 +1,64 @@
+export function* matchAll(re, source) {
+    if (re.global || re.sticky) {
+        const matches = source.matchAll(re);
+        for (const m of matches)
+            yield m;
+        return;
+    }
+    const m = re.exec(source);
+    if (m)
+        yield m;
+}
+export function lineColumnFromIndex(source, index) {
+    let line = 1;
+    let col = 0;
+    for (let i = 0; i < index && i < source.length; i++) {
+        if (source[i] === '\n') {
+            line++;
+            col = 0;
+        }
+        else {
+            col++;
+        }
+    }
+    return { line, column: col };
+}
+export function snippetAt(source, line, contextLines = 1) {
+    const lines = source.split(/\r?\n/);
+    const start = Math.max(0, line - 1 - contextLines);
+    const end = Math.min(lines.length, line + contextLines);
+    return lines.slice(start, end).join('\n');
+}
+export function makeFinding(rule, ctx, matchIndex, matchLength, fix) {
+    const { line, column } = lineColumnFromIndex(ctx.source, matchIndex);
+    return {
+        id: `${rule.id}-${ctx.relativePath}-${line}-${column}`,
+        ruleId: rule.id,
+        title: rule.title,
+        layer: rule.layer,
+        severity: rule.severity,
+        file: ctx.relativePath,
+        match: {
+            snippet: snippetAt(ctx.source, line),
+            line,
+            column,
+        },
+        description: rule.description,
+        impact: rule.threat,
+        remediation: rule.remediation,
+        references: rule.references,
+        cwe: rule.cwe,
+        owasp: rule.owasp,
+        fix,
+    };
+}
+export function grepRule(rule, ctx, re) {
+    const out = [];
+    for (const m of matchAll(re, ctx.source)) {
+        if (m.index === undefined)
+            continue;
+        out.push(makeFinding(rule, ctx, m.index, m[0].length));
+    }
+    return out;
+}
+//# sourceMappingURL=_helpers.js.map

package/dist/engine/rules/_helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.js","sourceRoot":"","sources":["../../../src/engine/rules/_helpers.ts"],"names":[],"mappings":"AAEA,MAAM,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAU,EAAE,MAAc;IAClD,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,MAAM,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC;QAAE,MAAM,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,KAAa;IAC/D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,GAAG,GAAG,CAAC,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,YAAY,GAAG,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,YAAY,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAU,EACV,GAAgB,EAChB,UAAkB,EAClB,WAAmB,EACnB,GAAc;IAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrE,OAAO;QACL,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,MAAM,EAAE;QACtD,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,GAAG,CAAC,YAAY;QACtB,KAAK,EAAE;YACL,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;YACpC,IAAI;YACJ,MAAM;SACP;QACD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAU,EAAE,GAAgB,EAAE,EAAU;IAC/D,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,SAAS;QACpC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/engine/rules/backend/fileUpload.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/backend/fileUpload.js

@@ -0,0 +1,40 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'BE-007',
+    title: 'Unsafe file upload (extension not validated, original filename used)',
+    layer: 'backend',
+    severity: 'high',
+    description: 'Dosya yuklemesinde sadece `Content-Type` veya extension kontrol edilip sunucuda orijinal isimle saklanirsa, saldirgan `.php`, `.jsp`, `.aspx` veya web-accessible dizine script yukleyebilir (RCE).',
+    threat: 'Remote code execution, XSS via SVG, web-shell upload',
+    remediation: '1) **Magic bytes** ile gercek MIME tespit edin (`file-type` paketi, `python-magic`, vb.). ' +
+        '2) Sadece izinli extension + MIME whitelist kabul edin (jpg, png, pdf, vb.). ' +
+        '3) Dosyayi **UUID** ile yeniden adlandirin (orijinal ismi KULLANMAYIN). ' +
+        '4) Sunucudan BAGIMSIZ depolama kullanin (S3, GCS, R2). Web root\'a yazmayin. ' +
+        '5) Boyut limiti koyun (multipart maxFileSize). ' +
+        '6) Antivirus / ClamAV ile tarayin. ' +
+        '7) Content-Disposition: attachment ile zorla indirme sunun. ' +
+        '8) SVG ve HTML\'i reddedin (XSS vektoru).',
+    references: [
+        'https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload',
+        'https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html',
+    ],
+    cwe: 'CWE-434',
+    owasp: 'A04:2021 Insecure Design',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        const patterns = [
+            /diskStorage\s*\([^)]*destination\s*:/g,
+            /filename\s*:\s*\(?\s*req\.file\.originalname/g,
+            /file\.save\s*\(\s*[^)]*originalname/gi,
+            /transferTo\s*\(\s*new\s+File\s*\(/g,
+            /filepath\.Join\s*\([^,]*Header\.Filename/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=fileUpload.js.map

package/dist/engine/rules/backend/fileUpload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileUpload.js","sourceRoot":"","sources":["../../../../src/engine/rules/backend/fileUpload.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,sEAAsE;IAC7E,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,qMAAqM;IACvM,MAAM,EAAE,sDAAsD;IAC9D,WAAW,EACT,4FAA4F;QAC5F,+EAA+E;QAC/E,0EAA0E;QAC1E,+EAA+E;QAC/E,iDAAiD;QACjD,qCAAqC;QACrC,8DAA8D;QAC9D,2CAA2C;IAC7C,UAAU,EAAE;QACV,0EAA0E;QAC1E,6EAA6E;KAC9E;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,0BAA0B;IACjC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YAC/B,uCAAuC;YACjC,+CAA+C;YACrD,uCAAuC;YACvC,oCAAoC;YACpC,2CAA2C;SACtC,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/backend/hashing.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/backend/hashing.js

@@ -0,0 +1,40 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'BE-002',
+    title: 'Weak password hashing (MD5 / SHA-1 / SHA-256 / plain text)',
+    layer: 'backend',
+    severity: 'critical',
+    description: 'Parolalar MD5, SHA1, SHA256 veya duz metin olarak saklandiginda, veritabani sizintisinda aninda kirilabilir. Modern GPU\'lar MD5\'i saniyede milyarlarca kez deneyebilir.',
+    threat: 'Mass credential disclosure, credential stuffing on other services',
+    remediation: 'Parolalari **Argon2id** veya **bcrypt (work factor >= 12)** ile hashleyin. ' +
+        'Her kullanici icin unique salt (Argon2/bcrypt otomatik ekler). ' +
+        'Login sirasinda constant-time comparison kullanin. ' +
+        'Yeni uyelikte minimum 12 karakter sifre zorunlulugu + zayif sifre listesi (HIBP). ' +
+        'MFA\'yi yayginlastirin. Mevcut legacy hashleri acil olarak yeniden hashleyin.',
+    references: [
+        'https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html',
+        'https://github.com/P-H-C/phc-string-format/blob/master/phc-sf-spec.md',
+        'https://auth0.com/blog/hashing-in-action-understanding-bcrypt-and-argon2/',
+    ],
+    cwe: 'CWE-916',
+    owasp: 'A02:2021 Cryptographic Failures',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        const patterns = [
+            /(?:createHash|hashlib\.\w+|MessageDigest\.getInstance)\s*\(\s*['"`](md5|sha1|sha-1|sha256|sha-256)['"`]/gi,
+            /['"`](md5|sha1|sha-1|sha256|sha-256)['"`]\s*\)/g,
+            /\bmd5\s*\(/gi,
+            /\bsha1\s*\(/gi,
+            /\bsha256\s*\(/gi,
+            /password\s*[:=]\s*req\.body\.(password|passwd|pwd)/gi,
+            /\bpassword\s*=\s*['"`][^'"`]+['"`]\s*[;\n]/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=hashing.js.map

package/dist/engine/rules/backend/hashing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashing.js","sourceRoot":"","sources":["../../../../src/engine/rules/backend/hashing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,4DAA4D;IACnE,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,2KAA2K;IAC7K,MAAM,EAAE,mEAAmE;IAC3E,WAAW,EACT,6EAA6E;QAC7E,iEAAiE;QACjE,qDAAqD;QACrD,oFAAoF;QACpF,+EAA+E;IACjF,UAAU,EAAE;QACV,kFAAkF;QAClF,uEAAuE;QACvE,2EAA2E;KAC5E;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,iCAAiC;IACxC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YAC/B,2GAA2G;YACrG,iDAAiD;YACjD,cAAc;YACd,eAAe;YACf,iBAAiB;YACvB,sDAAsD;YAChD,6CAA6C;SAC9C,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/backend/idor.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/backend/idor.js

@@ -0,0 +1,40 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'BE-001',
+    title: 'Potential IDOR / BOLA — ownership not verified',
+    layer: 'backend',
+    severity: 'high',
+    description: '`GET /api/resource/:id`, `app.get(\'/users/:id\')` gibi endpoint\'lerde, ID\'nin varligi kontrol edilse bile o kaynagin gercek sahibinin istegi yapan kullanici olup olmadigi sorgulanmiyor. Saldirgan baska kullanicilarin verilerine erisebilir (BOLA — Broken Object Level Authorization, OWASP API #1).',
+    threat: 'Unauthorized data access → account takeover, data breach, privacy violation',
+    remediation: 'Her resource erisiminden once sunucu tarafinda suni sorgu ekleyin: ' +
+        '`await db.resource.findFirst({ where: { id, ownerId: session.userId } })`. ' +
+        'Ya da policy tabanli bir authz katmani kullanin (CASL, Oso, cerbos). ' +
+        'Sadece `findUnique({ where: { id } })` ile cekmek YETERSIZ. ' +
+        'Listeleme endpoint\'lerinde `where` filtresine her zaman `ownerId` ekleyin. ' +
+        'Audit log ile anomalileri izleyin.',
+    references: [
+        'https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/',
+        'https://owasp.org/www-project-api-security/',
+    ],
+    cwe: 'CWE-639',
+    owasp: 'A01:2021 Broken Access Control',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        // This is a coarse heuristic — false positives are accepted in static analysis.
+        const suspiciousPatterns = [
+            /findUnique\s*\(\s*\{\s*where\s*:\s*\{\s*id\s*[:=]/g,
+            /findFirst\s*\(\s*\{\s*where\s*:\s*\{\s*id\s*[:=]/g,
+            /findOne\s*\(\s*\{\s*where\s*:\s*\{\s*id\s*[:=]/gi,
+            /findByPk\s*\(/g,
+            /getById\s*\(/g,
+            /\.find\s*\(\s*\{\s*id\s*[:=]/g,
+        ];
+        const findings = [];
+        for (const re of suspiciousPatterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=idor.js.map

package/dist/engine/rules/backend/idor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idor.js","sourceRoot":"","sources":["../../../../src/engine/rules/backend/idor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,gDAAgD;IACvD,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,6SAA6S;IAC/S,MAAM,EAAE,6EAA6E;IACrF,WAAW,EACT,qEAAqE;QACrE,6EAA6E;QAC7E,uEAAuE;QACvE,8DAA8D;QAC9D,8EAA8E;QAC9E,oCAAoC;IACtC,UAAU,EAAE;QACV,yFAAyF;QACzF,6CAA6C;KAC9C;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,gCAAgC;IACvC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,gFAAgF;QAC5E,MAAM,kBAAkB,GAAa;YACnC,oDAAoD;YACpD,mDAAmD;YACnD,kDAAkD;YAClD,gBAAgB;YAChB,eAAe;YACf,+BAA+B;SAChC,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/backend/index.d.ts

@@ -0,0 +1,12 @@
+export declare const rules: {
+    idor: import("../../../types.js").Rule;
+    hashing: import("../../../types.js").Rule;
+    jwt: import("../../../types.js").Rule;
+    sqlInjection: import("../../../types.js").Rule;
+    inputValidation: import("../../../types.js").Rule;
+    rateLimit: import("../../../types.js").Rule;
+    fileUpload: import("../../../types.js").Rule;
+    tokenInUrl: import("../../../types.js").Rule;
+    tokenExpiry: import("../../../types.js").Rule;
+};
+export default rules;

package/dist/engine/rules/backend/index.js

@@ -0,0 +1,22 @@
+import idor from './idor.js';
+import hashing from './hashing.js';
+import jwt from './jwt.js';
+import sqlInjection from './sqlInjection.js';
+import inputValidation from './inputValidation.js';
+import rateLimit from './rateLimit.js';
+import fileUpload from './fileUpload.js';
+import tokenInUrl from './tokenInUrl.js';
+import tokenExpiry from './tokenExpiry.js';
+export const rules = {
+    idor,
+    hashing,
+    jwt,
+    sqlInjection,
+    inputValidation,
+    rateLimit,
+    fileUpload,
+    tokenInUrl,
+    tokenExpiry,
+};
+export default rules;
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/engine/rules/backend/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,eAAe,MAAM,sBAAsB,CAAC;AACnD,OAAO,SAAS,MAAM,gBAAgB,CAAC;AACvC,OAAO,UAAU,MAAM,iBAAiB,CAAC;AACzC,OAAO,UAAU,MAAM,iBAAiB,CAAC;AACzC,OAAO,WAAW,MAAM,kBAAkB,CAAC;AAE3C,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI;IACJ,OAAO;IACP,GAAG;IACH,YAAY;IACZ,eAAe;IACf,SAAS;IACT,UAAU;IACV,UAAU;IACV,WAAW;CACZ,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/engine/rules/backend/inputValidation.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/backend/inputValidation.js

@@ -0,0 +1,37 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'BE-005',
+    title: 'Mass assignment — input not validated against DTO',
+    layer: 'backend',
+    severity: 'high',
+    description: '`req.body` veya `request.json()`\'i dogrudan ORM\'a vermek (prisma.user.create({ data: req.body })) mass assignment saldirisina aciktir. Saldirgan `role: "admin"`, `isAdmin: true`, `balance: 99999` gibi alanlari enjekte edebilir.',
+    threat: 'Privilege escalation, data tampering, business logic bypass',
+    remediation: '1) **Zod / Joi / class-validator** ile explicit DTO semasi tanimlayin. ' +
+        '2) Schema\'da olmayan alanlari `.strict()` ile reddedin. ' +
+        '3) Sadece schema\'da tanimli alanlari ORM\'a gecirin: `prisma.user.create({ data: parsed.data })`. ' +
+        '4) `Object.assign(user, req.body)` veya spread `{...req.body, ...overrides}` yapilarindan kacinin. ' +
+        '5) Default olarak tum update endpointleri "PUT yerine PATCH" ile alan-bazli olmali.',
+    references: [
+        'https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html',
+        'https://zod.dev/',
+    ],
+    cwe: 'CWE-915',
+    owasp: 'A04:2021 Insecure Design',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        const patterns = [
+            /\.(?:create|update|upsert)\s*\(\s*\{\s*data\s*:\s*(?:req\.body|request\.body|request\.json\(\)|input|body)/gi,
+            /\.(?:create|update|upsert)\s*\(\s*(?:req\.body|request\.body|request\.json\(\)|input|body)\b/gi,
+            /@ModelAttribute\s+\w+\s+\w+/g,
+            /(?:ModelForm|form\.save)\(\)/g,
+            /c\.BindJSON\s*\(\s*[a-zA-Z_][a-zA-Z0-9_]*\s*\)/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=inputValidation.js.map