@korayda4/vibe-security 0.3.0

package/dist/engine/rules/database/index.d.ts

@@ -0,0 +1,5 @@
+export declare const rules: {
+    privileges: import("../../../types.js").Rule;
+    encryption: import("../../../types.js").Rule;
+};
+export default rules;

package/dist/engine/rules/database/index.js

@@ -0,0 +1,8 @@
+import privileges from './privileges.js';
+import encryption from './encryption.js';
+export const rules = {
+    privileges,
+    encryption,
+};
+export default rules;
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/database/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/engine/rules/database/index.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,iBAAiB,CAAC;AACzC,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAEzC,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,UAAU;IACV,UAAU;CACX,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/engine/rules/database/privileges.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/database/privileges.js

@@ -0,0 +1,40 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'DB-001',
+    title: 'Overly privileged database user (DROP, ALTER, GRANT granted to app user)',
+    layer: 'database',
+    severity: 'high',
+    description: 'Uygulama DB baglanti kullanicisi DROP, ALTER, GRANT veya superuser yetkilerine sahipse, SQL injection durumunda saldırıgın tum veritabanini silmesi veya sema degistirmesi mumkun.',
+    threat: 'Mass data destruction, ransomware-grade attack, full DB compromise',
+    remediation: '1) App DB user\'ina SADECE gereken yetkileri verin (SELECT, INSERT, UPDATE, DELETE). ' +
+        '2) DROP, ALTER, GRANT, CREATE yetkilerini vermeyin. ' +
+        '3) Migration\'lar icin ayri bir migration user (CI/CD\'de kullanilan, app\'te OLMAYAN). ' +
+        '4) Postgres: `ALTER USER app_user NOSUPERUSER NOINHERIT NOCREATEDB NOCREATEROLE NOREPLICATION`. ' +
+        '5) Read-only endpointler icin ayri read-only user kullanin. ' +
+        '6) Baglanti string\'inde `superuser=yes` veya `root` KULLANMAYIN.',
+    references: [
+        'https://en.wikipedia.org/wiki/Principle_of_least_privilege',
+        'https://www.postgresql.org/docs/current/sql-grant.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html',
+    ],
+    cwe: 'CWE-269',
+    owasp: 'A01:2021 Broken Access Control',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go', 'yaml'],
+    check: (ctx) => {
+        const patterns = [
+            /GRANT\s+(ALL|ALL\s+PRIVILEGES|SUPERUSER|CREATE|DROP|ALTER)\b/gi,
+            /SUPERUSER\b/gi,
+            /NOSUPERUSER\s*=\s*false/gi,
+            /(?:postgres|mysql|mariadb):\/\/[^:]+:([^@]+)@[^\/]+\/(?:[^?]+\?)?[^"\s]*superuser/gi,
+            /(?:postgres|mysql|mariadb):\/\/[^:]+:([^@]+)@[^\/]+\/(?:[^?]+\?)?[^"\s]*root/gi,
+            /GRANT\s+OPTION/gi,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=privileges.js.map

package/dist/engine/rules/database/privileges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privileges.js","sourceRoot":"","sources":["../../../../src/engine/rules/database/privileges.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,0EAA0E;IACjF,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,oLAAoL;IACtL,MAAM,EAAE,oEAAoE;IAC5E,WAAW,EACT,uFAAuF;QACvF,sDAAsD;QACtD,0FAA0F;QAC1F,kGAAkG;QAClG,8DAA8D;QAC9D,mEAAmE;IACrE,UAAU,EAAE;QACV,4DAA4D;QAC5D,wDAAwD;QACxD,mFAAmF;KACpF;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,gCAAgC;IACvC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;IACvE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YAC/B,gEAAgE;YAC1D,eAAe;YACf,2BAA2B;YACjC,qFAAqF;YAC/E,gFAAgF;YAChF,kBAAkB;SACnB,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/frontend/clickjacking.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/frontend/clickjacking.js

@@ -0,0 +1,41 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'FE-005',
+    title: 'Missing clickjacking protection (X-Frame-Options / CSP frame-ancestors)',
+    layer: 'frontend',
+    severity: 'medium',
+    description: 'HTTP response\'unda `X-Frame-Options` veya `Content-Security-Policy: frame-ancestors` direktifi yoksa sayfa saldirgan kontrolundeki bir iframe icinde acilabilir. UI Redressing (clickjacking) ile kullanici istemedigi islemleri yaptirilabilir.',
+    threat: 'UI redressing, clickjacking → unauthorized clicks (payment, settings change)',
+    remediation: 'Tum HTML response\'larina sunlardan birini ekleyin: ' +
+        '`Content-Security-Policy: frame-ancestors \'none\'` (en guclu, modern), veya ' +
+        '`X-Frame-Options: DENY` (eski browser destegi). ' +
+        'Sadece kendi origin\'inizden iframe kabul edecekseniz: `frame-ancestors \'self\'`. ' +
+        'Next.js: middleware veya `next.config.js` headers\'tan ayarlayin. Nginx: `add_header X-Frame-Options "DENY" always;`.',
+    references: [
+        'https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options',
+        'https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors',
+        'https://owasp.org/www-community/attacks/Clickjacking',
+    ],
+    cwe: 'CWE-1021',
+    owasp: 'A05:2021 Security Misconfiguration',
+    languages: ['javascript', 'typescript'],
+    check: (ctx) => {
+        const isConfig = /next\.config\.(js|mjs|ts)$/i.test(ctx.relativePath) ||
+            /vercel\.json$/i.test(ctx.relativePath) ||
+            /_headers$/i.test(ctx.relativePath) ||
+            /nginx\.conf$/i.test(ctx.relativePath) ||
+            /server\.ts$/i.test(ctx.relativePath) ||
+            /server\.js$/i.test(ctx.relativePath);
+        if (!isConfig)
+            return [];
+        const hasFrameAncestors = /frame-ancestors\s+/i.test(ctx.source);
+        const hasXFrameOptions = /X-Frame-Options\s*:/i.test(ctx.source);
+        if (hasFrameAncestors || hasXFrameOptions)
+            return [];
+        const findings = [];
+        findings.push(...grepRule(rule, ctx, /\basync\s+headers\s*\(/g));
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=clickjacking.js.map

package/dist/engine/rules/frontend/clickjacking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clickjacking.js","sourceRoot":"","sources":["../../../../src/engine/rules/frontend/clickjacking.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,yEAAyE;IAChF,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EACT,mPAAmP;IACrP,MAAM,EAAE,8EAA8E;IACtF,WAAW,EACT,sDAAsD;QACtD,+EAA+E;QAC/E,kDAAkD;QAClD,qFAAqF;QACrF,uHAAuH;IACzH,UAAU,EAAE;QACV,2EAA2E;QAC3E,mGAAmG;QACnG,sDAAsD;KACvD;IACD,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,oCAAoC;IAC3C,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GACZ,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACpD,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACvC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACnC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACtC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACrC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAExC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzB,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEjE,IAAI,iBAAiB,IAAI,gBAAgB;YAAE,OAAO,EAAE,CAAC;QAErD,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/frontend/cookies.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/frontend/cookies.js

@@ -0,0 +1,35 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'FE-002',
+    title: 'Insecure cookie attributes (HttpOnly / Secure / SameSite)',
+    layer: 'frontend',
+    severity: 'high',
+    description: 'JWT, session, or sensitive tokens set via document.cookie or via Set-Cookie without HttpOnly / Secure / SameSite flags can be stolen via XSS or MITM.',
+    threat: 'Session hijacking, token theft, account takeover',
+    remediation: 'Set sensitive cookies server-side with HttpOnly (blocks JS), Secure (HTTPS-only), SameSite=Lax or Strict (CSRF mitigation). ' +
+        'Store tokens in server-side cookies, not localStorage or sessionStorage. ' +
+        "Avoid document.cookie for reading or writing tokens in the frontend.",
+    references: [
+        'https://owasp.org/www-community/HttpOnly',
+        'https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html',
+    ],
+    cwe: 'CWE-1004',
+    owasp: 'A07:2021 Identification and Authentication Failures',
+    languages: ['javascript', 'typescript'],
+    check: (ctx) => {
+        const findings = [];
+        const patterns = [
+            /document\.cookie\s*=/g,
+            /Set-Cookie\s*:\s*[^;\n]+(?![;\n]*HttpOnly)/gi,
+            /localStorage\.setItem\s*\(\s*['"][^'"]*(token|jwt|session|auth|api[_-]?key)/gi,
+            /sessionStorage\.setItem\s*\(\s*['"][^'"]*(token|jwt|session|auth|api[_-]?key)/gi,
+        ];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=cookies.js.map

package/dist/engine/rules/frontend/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../../../src/engine/rules/frontend/cookies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,2DAA2D;IAClE,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,uJAAuJ;IACzJ,MAAM,EAAE,kDAAkD;IAC1D,WAAW,EACT,8HAA8H;QAC9H,2EAA2E;QAC3E,sEAAsE;IACxE,UAAU,EAAE;QACV,0CAA0C;QAC1C,2DAA2D;QAC3D,oFAAoF;KACrF;IACD,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,qDAAqD;IAC5D,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAa;YACzB,uBAAuB;YACvB,8CAA8C;YAC9C,+EAA+E;YAC/E,iFAAiF;SAClF,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/frontend/envVars.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/frontend/envVars.js

@@ -0,0 +1,34 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'FE-003',
+    title: 'Sensitive value exposed via public env prefix',
+    layer: 'frontend',
+    severity: 'critical',
+    description: 'Public env prefixes (NEXT_PUBLIC_, REACT_APP_, VITE_, GATSBY_, EXPO_PUBLIC_) are bundled into the client at build time. Any secret read via these prefixes (API key, DB connection string) is exposed to every visitor.',
+    threat: 'Secret / API key disclosure, full backend compromise',
+    remediation: '1) Do NOT define sensitive keys with public prefixes — use API_KEY instead of NEXT_PUBLIC_API_KEY. ' +
+        '2) Public env should only carry public data (API URL, feature flags). ' +
+        "3) Read secrets server-side via process.env.SECRET_NAME in route / API handlers. " +
+        '4) Wire gitleaks or trufflehog as a pre-commit hook in CI.',
+    references: [
+        'https://nextjs.org/docs/basic-features/environment-variables#exposing-environment-variables-to-the-browser',
+        'https://create-react-app.dev/docs/adding-custom-environment-variables/',
+        'https://vitejs.dev/guide/env-and-mode.html',
+    ],
+    cwe: 'CWE-200',
+    owasp: 'A05:2021 Security Misconfiguration',
+    languages: ['javascript', 'typescript'],
+    check: (ctx) => {
+        const findings = [];
+        const patterns = [
+            /^(NEXT_PUBLIC|REACT_APP|VITE_|GATSBY_|EXPO_PUBLIC_)[A-Z0-9_]*(SECRET|KEY|TOKEN|PASSWORD|API[_-]?KEY|PRIVATE|CREDENTIAL|AUTH)/gim,
+            /process\.env\.(NEXT_PUBLIC|REACT_APP|VITE_|GATSBY_|EXPO_PUBLIC_)[A-Z0-9_]*(SECRET|KEY|TOKEN|PASSWORD|API[_-]?KEY|PRIVATE|CREDENTIAL|AUTH)/g,
+        ];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=envVars.js.map

package/dist/engine/rules/frontend/envVars.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envVars.js","sourceRoot":"","sources":["../../../../src/engine/rules/frontend/envVars.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,+CAA+C;IACtD,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,yNAAyN;IAC3N,MAAM,EAAE,sDAAsD;IAC9D,WAAW,EACT,qGAAqG;QACrG,wEAAwE;QACxE,mFAAmF;QACnF,4DAA4D;IAC9D,UAAU,EAAE;QACV,4GAA4G;QAC5G,wEAAwE;QACxE,4CAA4C;KAC7C;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,oCAAoC;IAC3C,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAa;YACzB,iIAAiI;YACjI,4IAA4I;SAC7I,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/frontend/eval.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/frontend/eval.js

@@ -0,0 +1,35 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'FE-006',
+    title: 'Dangerous dynamic code execution (eval / Function / setTimeout string)',
+    layer: 'frontend',
+    severity: 'high',
+    description: '`eval()`, `new Function()`, `setTimeout(string, ...)` veya `setInterval(string, ...)` ile dinamik kod calistirmak, kullanici girdisi kontrolsuzce yurutulurse RCE veya XSS ile sonuclanabilir.',
+    threat: 'Remote code execution, XSS, injection chain',
+    remediation: 'Dinamik koda ihtiyac varsa JSON.parse veya guvenli bir DSL parser kullanin. ' +
+        '`eval`, `Function` constructor\'dan tamamen kacinin. ' +
+        '`setTimeout` / `setInterval`\'a her zaman fonksiyon referansi verin, string vermeyin. ' +
+        'CSP header\'larinda `unsafe-eval` eklemeyin.',
+    references: [
+        'https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!',
+        'https://owasp.org/www-community/attacks/Code_Injection',
+    ],
+    cwe: 'CWE-95',
+    owasp: 'A03:2021 Injection',
+    languages: ['javascript', 'typescript'],
+    check: (ctx) => {
+        const patterns = [
+            /\beval\s*\(/g,
+            /\bnew\s+Function\s*\(/g,
+            /setTimeout\s*\(\s*['"`]/g,
+            /setInterval\s*\(\s*['"`]/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=eval.js.map

package/dist/engine/rules/frontend/eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval.js","sourceRoot":"","sources":["../../../../src/engine/rules/frontend/eval.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,wEAAwE;IAC/E,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,gMAAgM;IAClM,MAAM,EAAE,6CAA6C;IACrD,WAAW,EACT,8EAA8E;QAC9E,uDAAuD;QACvD,wFAAwF;QACxF,8CAA8C;IAChD,UAAU,EAAE;QACV,uGAAuG;QACvG,wDAAwD;KACzD;IACD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YACzB,cAAc;YACd,wBAAwB;YACxB,0BAA0B;YAC1B,2BAA2B;SAC5B,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/frontend/index.d.ts

@@ -0,0 +1,9 @@
+export declare const rules: {
+    xss: import("../../../types.js").Rule;
+    cookies: import("../../../types.js").Rule;
+    envVars: import("../../../types.js").Rule;
+    sourceMaps: import("../../../types.js").Rule;
+    clickjacking: import("../../../types.js").Rule;
+    eval: import("../../../types.js").Rule;
+};
+export default rules;

package/dist/engine/rules/frontend/index.js

@@ -0,0 +1,16 @@
+import xss from './xss.js';
+import cookies from './cookies.js';
+import envVars from './envVars.js';
+import sourceMaps from './sourceMaps.js';
+import clickjacking from './clickjacking.js';
+import evalRule from './eval.js';
+export const rules = {
+    xss,
+    cookies,
+    envVars,
+    sourceMaps,
+    clickjacking,
+    eval: evalRule,
+};
+export default rules;
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/frontend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/engine/rules/frontend/index.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,UAAU,MAAM,iBAAiB,CAAC;AACzC,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,QAAQ,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,GAAG;IACH,OAAO;IACP,OAAO;IACP,UAAU;IACV,YAAY;IACZ,IAAI,EAAE,QAAQ;CACf,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/engine/rules/frontend/sourceMaps.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/frontend/sourceMaps.js

@@ -0,0 +1,79 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'FE-004',
+    title: 'Source maps published in production',
+    layer: 'frontend',
+    severity: 'medium',
+    description: 'Publishing .js.map files in production output exposes source code (component names, comments, internal architecture) to anyone. Attackers can reverse engineer and discover sensitive internals (URLs, developer notes).',
+    threat: 'Source code disclosure, architecture reconnaissance, intellectual property leak',
+    remediation: '1) Next.js: set productionBrowserSourceMaps: false. ' +
+        '2) Vite: set build.sourcemap = false or upload to Sentry / Datadog. ' +
+        '3) Webpack: use devtool: false or hidden-source-map, then upload to Sentry. ' +
+        '4) Block *.map access at CDN/Nginx: location ~* \\.map$ { deny all; }',
+    references: [
+        'https://nextjs.org/docs/advanced-features/source-maps',
+        'https://webpack.js.org/configuration/devtool/',
+        'https://docs.sentry.io/platforms/javascript/sourcemaps/',
+    ],
+    cwe: 'CWE-540',
+    owasp: 'A05:2021 Security Misconfiguration',
+    languages: ['javascript', 'typescript'],
+    check: (ctx) => {
+        const findings = [];
+        const nextPattern = /productionBrowserSourceMaps\s*:\s*true/g;
+        for (const m of ctx.source.matchAll(nextPattern)) {
+            if (m.index === undefined)
+                continue;
+            const { line } = lineColumnFromIndex(ctx.source, m.index);
+            findings.push({
+                id: `${rule.id}-${ctx.relativePath}-${line}`,
+                ruleId: rule.id,
+                title: rule.title,
+                layer: rule.layer,
+                severity: rule.severity,
+                file: ctx.relativePath,
+                match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                description: rule.description,
+                impact: rule.threat,
+                remediation: rule.remediation,
+                references: rule.references,
+                cwe: rule.cwe,
+                owasp: rule.owasp,
+                fix: {
+                    find: 'productionBrowserSourceMaps: true',
+                    replace: 'productionBrowserSourceMaps: false',
+                    description: 'Disable production source maps',
+                },
+            });
+        }
+        const vitePattern = /build\.sourcemap\s*=\s*['"]?true/g;
+        for (const m of ctx.source.matchAll(vitePattern)) {
+            if (m.index === undefined)
+                continue;
+            const { line } = lineColumnFromIndex(ctx.source, m.index);
+            findings.push({
+                id: `${rule.id}-${ctx.relativePath}-${line}-vite`,
+                ruleId: rule.id,
+                title: rule.title,
+                layer: rule.layer,
+                severity: rule.severity,
+                file: ctx.relativePath,
+                match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                description: rule.description,
+                impact: rule.threat,
+                remediation: rule.remediation,
+                references: rule.references,
+                cwe: rule.cwe,
+                owasp: rule.owasp,
+                fix: {
+                    find: 'build.sourcemap = true',
+                    replace: 'build.sourcemap = false',
+                    description: 'Disable Vite sourcemap generation',
+                },
+            });
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=sourceMaps.js.map

package/dist/engine/rules/frontend/sourceMaps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceMaps.js","sourceRoot":"","sources":["../../../../src/engine/rules/frontend/sourceMaps.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,qCAAqC;IAC5C,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EACT,0NAA0N;IAC5N,MAAM,EAAE,iFAAiF;IACzF,WAAW,EACT,sDAAsD;QACtD,sEAAsE;QACtE,8EAA8E;QAC9E,uEAAuE;IACzE,UAAU,EAAE;QACV,uDAAuD;QACvD,+CAA+C;QAC/C,yDAAyD;KAC1D;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,oCAAoC;IAC3C,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QAEpB,MAAM,WAAW,GAAG,yCAAyC,CAAC;QAC9D,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE;gBAC5C,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;gBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;gBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,EAAE;oBACH,IAAI,EAAE,mCAAmC;oBACzC,OAAO,EAAE,oCAAoC;oBAC7C,WAAW,EAAE,gCAAgC;iBAC9C;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,mCAAmC,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,OAAO;gBACjD,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;gBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;gBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,EAAE;oBACH,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,yBAAyB;oBAClC,WAAW,EAAE,mCAAmC;iBACjD;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/frontend/xss.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/frontend/xss.js

@@ -0,0 +1,70 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'FE-001',
+    title: 'Unsafe DOM injection (innerHTML / dangerouslySetInnerHTML)',
+    layer: 'frontend',
+    severity: 'high',
+    description: 'User-controlled or external data rendered via element.innerHTML or React dangerouslySetInnerHTML enables XSS (Cross-Site Scripting). Attackers inject HTML/JS to steal sessions, exfiltrate data, or take over the page.',
+    threat: 'Stored / Reflected XSS → account takeover, session hijack, data exfiltration, malware distribution',
+    remediation: "1) Use textContent or the framework's safe binding (React JSX, Vue {{ }}, Angular interpolation). " +
+        '2) If rich text is required, sanitize with DOMPurify.sanitize(). ' +
+        "3) If user HTML must render, enforce server-side CSP to block inline scripts. " +
+        '4) Avoid eval(), document.write(), Function() constructor.',
+    references: [
+        'https://owasp.org/www-community/attacks/xss/',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html',
+        'https://github.com/cure53/DOMPurify',
+    ],
+    cwe: 'CWE-79',
+    owasp: 'A03:2021 Injection',
+    languages: ['javascript', 'typescript'],
+    check: (ctx) => {
+        const findings = [];
+        const patterns = [
+            /\.innerHTML\s*=/g,
+            /dangerouslySetInnerHTML\s*=\s*\{/g,
+            /document\.write\s*\(/g,
+            /\.outerHTML\s*=/g,
+            /insertAdjacentHTML\s*\(/g,
+        ];
+        for (const re of patterns) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                let fix;
+                if (re.source.includes('dangerouslySetInnerHTML')) {
+                    const snippet = snippetAt(ctx.source, line, 3);
+                    const dsihMatch = snippet.match(/dangerouslySetInnerHTML\s*=\s*\{\{\s*__html:\s*([^}]+)\s*\}\s*\}/);
+                    if (dsihMatch) {
+                        const expr = dsihMatch[1].trim();
+                        fix = {
+                            find: `dangerouslySetInnerHTML={{ __html: ${expr} }}`,
+                            replace: `dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(${expr}) }}`,
+                            description: 'Sanitize with DOMPurify (npm i dompurify @types/dompurify)',
+                        };
+                    }
+                }
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}-${m[0].length}`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                    fix,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=xss.js.map

package/dist/engine/rules/frontend/xss.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xss.js","sourceRoot":"","sources":["../../../../src/engine/rules/frontend/xss.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,4DAA4D;IACnE,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,0NAA0N;IAC5N,MAAM,EAAE,oGAAoG;IAC5G,WAAW,EACT,oGAAoG;QACpG,mEAAmE;QACnE,gFAAgF;QAChF,4DAA4D;IAC9D,UAAU,EAAE;QACV,8CAA8C;QAC9C,iGAAiG;QACjG,qCAAqC;KACtC;IACD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAa;YACzB,kBAAkB;YAClB,mCAAmC;YACnC,uBAAuB;YACvB,kBAAkB;YAClB,0BAA0B;SAC3B,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAE1D,IAAI,GAAG,CAAC;gBACR,IAAI,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;oBAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAC7B,kEAAkE,CACnE,CAAC;oBACF,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBACjC,GAAG,GAAG;4BACJ,IAAI,EAAE,sCAAsC,IAAI,KAAK;4BACrD,OAAO,EAAE,yDAAyD,IAAI,MAAM;4BAC5E,WAAW,EAAE,4DAA4D;yBAC1E,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;oBAC3D,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,GAAG;iBACJ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/index.d.ts

@@ -0,0 +1,8 @@
+import type { Language, Rule } from '../../types.js';
+export interface RegisteredRule extends Rule {
+}
+export declare function getAllRules(): readonly RegisteredRule[];
+export declare function getRuleById(id: string): RegisteredRule | undefined;
+export declare function getRulesForLanguage(language: Language): readonly RegisteredRule[];
+export declare function getRulesByLayer(layer: RegisteredRule['layer']): readonly RegisteredRule[];
+export declare function getRulesByLanguages(languages: readonly Language[]): readonly RegisteredRule[];

package/dist/engine/rules/index.js

@@ -0,0 +1,38 @@
+import { rules as frontendRules } from './frontend/index.js';
+import { rules as backendRules } from './backend/index.js';
+import { rules as networkRules } from './network/index.js';
+import { rules as databaseRules } from './database/index.js';
+import { rules as cicdRules } from './cicd/index.js';
+import { rules as observabilityRules } from './observability/index.js';
+import { rules as rustRules } from './rust/index.js';
+import { rules as rubyRules } from './ruby/index.js';
+import { rules as phpRules } from './php/index.js';
+import { rules as kotlinRules } from './kotlin/index.js';
+const registry = [
+    ...Object.values(frontendRules),
+    ...Object.values(backendRules),
+    ...Object.values(networkRules),
+    ...Object.values(databaseRules),
+    ...Object.values(cicdRules),
+    ...Object.values(observabilityRules),
+    ...Object.values(rustRules),
+    ...Object.values(rubyRules),
+    ...Object.values(phpRules),
+    ...Object.values(kotlinRules),
+];
+export function getAllRules() {
+    return registry;
+}
+export function getRuleById(id) {
+    return registry.find((r) => r.id === id);
+}
+export function getRulesForLanguage(language) {
+    return registry.filter((r) => r.languages.includes(language));
+}
+export function getRulesByLayer(layer) {
+    return registry.filter((r) => r.layer === layer);
+}
+export function getRulesByLanguages(languages) {
+    return registry.filter((r) => r.languages.some((l) => languages.includes(l)));
+}
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/engine/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,KAAK,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,KAAK,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,KAAK,IAAI,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIzD,MAAM,QAAQ,GAAqB;IACjC,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;IAC/B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;IAC/B,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;IAC3B,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;IACpC,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;IAC3B,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;IAC3B,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC1B,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;CAC9B,CAAC;AAEF,MAAM,UAAU,WAAW;IACzB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAkB;IACpD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAA8B;IAChE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC"}

package/dist/engine/rules/kotlin/index.d.ts

@@ -0,0 +1,5 @@
+export declare const rules: {
+    sqlInjection: import("../../../types.js").Rule;
+    kotlinxHtml: import("../../../types.js").Rule;
+};
+export default rules;

package/dist/engine/rules/kotlin/index.js

@@ -0,0 +1,8 @@
+import sqlInjection from './sqlInjection.js';
+import kotlinxHtml from './kotlinxHtml.js';
+export const rules = {
+    sqlInjection,
+    kotlinxHtml,
+};
+export default rules;
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/kotlin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/engine/rules/kotlin/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,WAAW,MAAM,kBAAkB,CAAC;AAE3C,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,YAAY;IACZ,WAAW;CACZ,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/engine/rules/kotlin/kotlinxHtml.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/kotlin/kotlinxHtml.js

@@ -0,0 +1,54 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'KT-002',
+    title: 'Kotlin: XSS via kotlinx.html raw text or unsafe HTML',
+    layer: 'frontend',
+    severity: 'high',
+    description: '` kotlinx.html` DSL escapes HTML by default, but `unsafe { +userInput }` (the unary plus operator on TextBuilder) or `rawText(userInput)` inserts raw HTML — XSS.',
+    threat: 'Reflected / Stored XSS → session hijack, account takeover',
+    remediation: '1) Use plain DSL: `p { text(userInput) }` — auto-escapes. ' +
+        '2) NEVER use `unsafe { +userInput }` or `rawText(userInput)` with user-controlled input. ' +
+        '3) For rich text, sanitize first via OWASP Java HTML Sanitizer. ' +
+        '4) Set Content-Security-Policy header for defense in depth. ' +
+        '5) Server-side render: always escape on output.',
+    references: [
+        'https://github.com/Kotlin/kotlinx.html',
+        'https://owasp.org/www-community/attacks/xss/',
+    ],
+    cwe: 'CWE-79',
+    owasp: 'A03:2021 Injection',
+    languages: ['kotlin'],
+    check: (ctx) => {
+        const findings = [];
+        const patterns = [
+            /unsafe\s*\{\s*\+/g,
+            /rawText\s*\(\s*[^)]*request/gi,
+            /rawText\s*\(\s*[^)]*input/gi,
+        ];
+        for (const re of patterns) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=kotlinxHtml.js.map

package/dist/engine/rules/kotlin/kotlinxHtml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kotlinxHtml.js","sourceRoot":"","sources":["../../../../src/engine/rules/kotlin/kotlinxHtml.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,sDAAsD;IAC7D,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,mKAAmK;IACrK,MAAM,EAAE,2DAA2D;IACnE,WAAW,EACT,4DAA4D;QAC5D,2FAA2F;QAC3F,kEAAkE;QAClE,8DAA8D;QAC9D,iDAAiD;IACnD,UAAU,EAAE;QACV,wCAAwC;QACxC,8CAA8C;KAC/C;IACD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG;YACf,mBAAmB;YACnB,+BAA+B;YAC/B,6BAA6B;SAC9B,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE;oBAC5C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/kotlin/sqlInjection.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;