@korayda4/vibe-security 0.3.0

package/dist/engine/rules/kotlin/sqlInjection.js

@@ -0,0 +1,57 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'KT-001',
+    title: 'Kotlin: SQL injection via string template in JPA/JDBC',
+    layer: 'backend',
+    severity: 'critical',
+    description: 'Kotlin string templates (`"SELECT * FROM users WHERE id = $id"`) and string concatenation passed to JPA native queries or JDBC allow SQL injection. Spring Data JPA with `@Query` parameterizes via `?1` / `:name`; raw concatenation bypasses that.',
+    threat: 'Database exfiltration, authentication bypass, data destruction',
+    remediation: '1) Use Spring Data JPA: `@Query("SELECT u FROM User u WHERE u.email = :email") fun findByEmail(@Param("email") email: String)`. ' +
+        '2) For native queries: `@Query(value = "SELECT * FROM users WHERE id = ?1", nativeQuery = true)`. ' +
+        '3) For raw JDBC: `PreparedStatement` with `?` placeholders, never `String.format` or `+`. ' +
+        '4) Use `org.springframework.jdbc.core.namedparam.MapSqlParameterSource` for named parameters. ' +
+        '5) NEVER use `"SELECT * FROM users WHERE id = $id"` with string templates.',
+    references: [
+        'https://docs.spring.io/spring-data/jpa/docs/current/reference/html/#jpa.query-methods.at-query',
+        'https://kotlinlang.org/docs/reference/java-interop.html#string-templates',
+    ],
+    cwe: 'CWE-89',
+    owasp: 'A03:2021 Injection',
+    languages: ['kotlin'],
+    check: (ctx) => {
+        const findings = [];
+        const patterns = [
+            /["']SELECT[^"']*\$[a-zA-Z]/gi,
+            /["']INSERT[^"']*\$[a-zA-Z]/gi,
+            /["']UPDATE[^"']*\$[a-zA-Z]/gi,
+            /["']DELETE[^"']*\$[a-zA-Z]/gi,
+            /createNativeQuery\s*\(\s*["'][^"']*\$/g,
+            /@Query\s*\(\s*["'][^"']*\$/g,
+        ];
+        for (const re of patterns) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=sqlInjection.js.map

package/dist/engine/rules/kotlin/sqlInjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlInjection.js","sourceRoot":"","sources":["../../../../src/engine/rules/kotlin/sqlInjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,uDAAuD;IAC9D,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,sPAAsP;IACxP,MAAM,EAAE,gEAAgE;IACxE,WAAW,EACT,kIAAkI;QAClI,oGAAoG;QACpG,4FAA4F;QAC5F,gGAAgG;QAChG,4EAA4E;IAC9E,UAAU,EAAE;QACV,gGAAgG;QAChG,0EAA0E;KAC3E;IACD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG;YACf,8BAA8B;YAC9B,8BAA8B;YAC9B,8BAA8B;YAC9B,8BAA8B;YAC9B,wCAAwC;YACxC,6BAA6B;SAC9B,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE;oBAC5C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/network/cors.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/network/cors.js

@@ -0,0 +1,106 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'NET-002',
+    title: 'Overly permissive CORS (wildcard or origin reflection)',
+    layer: 'network',
+    severity: 'high',
+    description: '`Access-Control-Allow-Origin: *` veya gelen `Origin` header\'inin dogrudan yansitilmasi, baska origin\'lerin API\'nize erismesine izin verir. Kimlik bilgisi (credentials) ile birlikteyse cross-origin veri hirsizligina yol acar.',
+    threat: 'Cross-origin data theft, CSRF, credential exfiltration',
+    remediation: '1) Wildcard (`*`) KULLANMAYIN. ' +
+        '2) Explicit bir whitelist tanimlayin: `const allowed = [\'https://app.example.com\', \'https://admin.example.com\']`. ' +
+        '3) Origin kontrolu yapip eslesiyorsa `Access-Control-Allow-Origin: <specific-origin>` donun. ' +
+        '4) Credentials ile birlikte `*` ASLA calismaz; gerekirse `Access-Control-Allow-Credentials: true` + explicit origin kullanin. ' +
+        '5) Preflight icin `Access-Control-Allow-Methods` ve `Access-Control-Allow-Headers`\'i da kisitlayin. ' +
+        '6) Express: `cors({ origin: allowed, credentials: true })`.',
+    references: [
+        'https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS',
+        'https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html#cross-origin-resource-sharing',
+    ],
+    cwe: 'CWE-942',
+    owasp: 'A05:2021 Security Misconfiguration',
+    languages: ['javascript', 'typescript'],
+    check: (ctx) => {
+        const isServerFile = /(?:server|app|main|index)\.(?:ts|js|tsx|jsx|mjs|cjs)$/i.test(ctx.relativePath) ||
+            /\/api\//i.test(ctx.relativePath) ||
+            /routes?\//i.test(ctx.relativePath);
+        if (!isServerFile)
+            return [];
+        const findings = [];
+        const wildcard = /Access-Control-Allow-Origin['"`\s]*,?\s*['"`]\*['"`]/gi;
+        for (const m of ctx.source.matchAll(wildcard)) {
+            if (m.index === undefined)
+                continue;
+            const { line } = lineColumnFromIndex(ctx.source, m.index);
+            findings.push({
+                id: `${rule.id}-${ctx.relativePath}-${line}-w`,
+                ruleId: rule.id,
+                title: rule.title,
+                layer: rule.layer,
+                severity: rule.severity,
+                file: ctx.relativePath,
+                match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                description: rule.description,
+                impact: rule.threat,
+                remediation: rule.remediation,
+                references: rule.references,
+                cwe: rule.cwe,
+                owasp: rule.owasp,
+                fix: {
+                    find: m[0],
+                    replace: m[0].replace(/['"`]\*['"`]/, "'https://yourdomain.com'"),
+                    description: 'Wildcard yerine explicit origin whitelist kullan (kendi domain\'ini yaz)',
+                },
+            });
+        }
+        const reflect = /origin\s*:\s*req\.headers\.origin/g;
+        for (const m of ctx.source.matchAll(reflect)) {
+            if (m.index === undefined)
+                continue;
+            const { line } = lineColumnFromIndex(ctx.source, m.index);
+            findings.push({
+                id: `${rule.id}-${ctx.relativePath}-${line}-r`,
+                ruleId: rule.id,
+                title: rule.title,
+                layer: rule.layer,
+                severity: rule.severity,
+                file: ctx.relativePath,
+                match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                description: rule.description,
+                impact: rule.threat,
+                remediation: rule.remediation,
+                references: rule.references,
+                cwe: rule.cwe,
+                owasp: rule.owasp,
+            });
+        }
+        const corsOrigin = /origin\s*:\s*['"`]\*['"`]/g;
+        for (const m of ctx.source.matchAll(corsOrigin)) {
+            if (m.index === undefined)
+                continue;
+            const { line } = lineColumnFromIndex(ctx.source, m.index);
+            findings.push({
+                id: `${rule.id}-${ctx.relativePath}-${line}-c`,
+                ruleId: rule.id,
+                title: rule.title,
+                layer: rule.layer,
+                severity: rule.severity,
+                file: ctx.relativePath,
+                match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                description: rule.description,
+                impact: rule.threat,
+                remediation: rule.remediation,
+                references: rule.references,
+                cwe: rule.cwe,
+                owasp: rule.owasp,
+                fix: {
+                    find: "origin: '*'",
+                    replace: "origin: ['https://yourdomain.com']",
+                    description: 'cors()\'a whitelist array\'i ver',
+                },
+            });
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=cors.js.map

package/dist/engine/rules/network/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../../src/engine/rules/network/cors.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,wDAAwD;IAC/D,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,qOAAqO;IACvO,MAAM,EAAE,wDAAwD;IAChE,WAAW,EACT,iCAAiC;QACjC,wHAAwH;QACxH,+FAA+F;QAC/F,gIAAgI;QAChI,uGAAuG;QACvG,6DAA6D;IAC/D,UAAU,EAAE;QACV,wDAAwD;QACxD,8GAA8G;KAC/G;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,oCAAoC;IAC3C,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,YAAY,GAChB,wDAAwD,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YAC/E,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEtC,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,CAAC;QAE7B,MAAM,QAAQ,GAAG,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,wDAAwD,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI;gBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;gBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;gBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBACV,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC;oBACjE,WAAW,EAAE,0EAA0E;iBACxF;aACF,CAAC,CAAC;QACL,CAAC;QACL,MAAM,OAAO,GAAG,oCAAoC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI;gBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;gBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;gBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;QACL,MAAM,UAAU,GAAG,4BAA4B,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI;gBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;gBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;gBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,EAAE;oBACH,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,oCAAoC;oBAC7C,WAAW,EAAE,kCAAkC;iBAChD;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/network/headers.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/network/headers.js

@@ -0,0 +1,51 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'NET-001',
+    title: 'Missing HTTP security headers (CSP, HSTS, nosniff, referrer-policy, permissions-policy)',
+    layer: 'network',
+    severity: 'medium',
+    description: 'HTTP response\'larinda `Content-Security-Policy`, `Strict-Transport-Security`, `X-Content-Type-Options: nosniff`, `Referrer-Policy` veya `Permissions-Policy` basliklari yoksa tarayici tabanli saldiri yuzeyi acilir: XSS, MIME sniffing, bilgi sizintisi, yetenek istismari.',
+    threat: 'XSS escalation, MIME sniffing, MITM downgrade, information leakage, feature abuse',
+    remediation: 'Asagidaki header\'lari TUM response\'lara ekleyin: ' +
+        '`Content-Security-Policy: default-src \'self\'; script-src \'self\'; object-src \'none\'; base-uri \'self\'` ' +
+        '`Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` ' +
+        '`X-Content-Type-Options: nosniff` ' +
+        '`Referrer-Policy: strict-origin-when-cross-origin` ' +
+        '`Permissions-Policy: camera=(), microphone=(), geolocation=()` ' +
+        'Next.js: `next.config.js` headers; Nginx: `add_header ... always`; Express: `helmet()` middleware\'i.',
+    references: [
+        'https://owasp.org/www-project-secure-headers/',
+        'https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers',
+        'https://securityheaders.com/',
+        'https://helmetjs.github.io/',
+    ],
+    cwe: 'CWE-693',
+    owasp: 'A05:2021 Security Misconfiguration',
+    languages: ['javascript', 'typescript'],
+    check: (ctx) => {
+        const isConfig = /next\.config\.(js|mjs|ts)$/i.test(ctx.relativePath) ||
+            /vercel\.json$/i.test(ctx.relativePath) ||
+            /_headers$/i.test(ctx.relativePath) ||
+            /server\.(ts|js)$/i.test(ctx.relativePath) ||
+            /nginx\.conf$/i.test(ctx.relativePath) ||
+            /middleware\.(ts|js)$/i.test(ctx.relativePath);
+        if (!isConfig)
+            return [];
+        const requiredHeaders = [
+            'content-security-policy',
+            'strict-transport-security',
+            'x-content-type-options',
+            'referrer-policy',
+            'permissions-policy',
+        ];
+        const missing = requiredHeaders.filter((h) => !new RegExp(h, 'i').test(ctx.source));
+        if (missing.length === 0)
+            return [];
+        const findings = [];
+        const re = /headers\s*\(\s*\)\s*[:=]/g;
+        findings.push(...grepRule(rule, ctx, re));
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=headers.js.map

package/dist/engine/rules/network/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../../../src/engine/rules/network/headers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,yFAAyF;IAChG,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EACT,gRAAgR;IAClR,MAAM,EAAE,mFAAmF;IAC3F,WAAW,EACT,qDAAqD;QACrD,+GAA+G;QAC/G,4EAA4E;QAC5E,oCAAoC;QACpC,qDAAqD;QACrD,iEAAiE;QACjE,uGAAuG;IACzG,UAAU,EAAE;QACV,+CAA+C;QAC/C,2DAA2D;QAC3D,8BAA8B;QAC9B,6BAA6B;KAC9B;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,oCAAoC;IAC3C,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GACZ,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACpD,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACvC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACnC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YAC1C,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACtC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEjD,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzB,MAAM,eAAe,GAAG;YACtB,yBAAyB;YACzB,2BAA2B;YAC3B,wBAAwB;YACxB,iBAAiB;YACjB,oBAAoB;SACrB,CAAC;QAEF,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAC5C,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,2BAA2B,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/network/index.d.ts

@@ -0,0 +1,6 @@
+export declare const rules: {
+    headers: import("../../../types.js").Rule;
+    cors: import("../../../types.js").Rule;
+    tls: import("../../../types.js").Rule;
+};
+export default rules;

package/dist/engine/rules/network/index.js

@@ -0,0 +1,10 @@
+import headers from './headers.js';
+import cors from './cors.js';
+import tls from './tls.js';
+export const rules = {
+    headers,
+    cors,
+    tls,
+};
+export default rules;
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/network/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/engine/rules/network/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,OAAO;IACP,IAAI;IACJ,GAAG;CACJ,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/engine/rules/network/tls.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/network/tls.js

@@ -0,0 +1,40 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'NET-003',
+    title: 'Insecure transport — TLS downgrade or missing HTTPS enforcement',
+    layer: 'network',
+    severity: 'high',
+    description: 'TLS 1.0/1.1 destegi aciksa veya HTTP→HTTPS yonlendirmesi yoksa, ag seviyesi MITM saldirilari ile hassas veri sizdirilabilir.',
+    threat: 'Man-in-the-middle, credential interception, session theft',
+    remediation: '1) TLS 1.2+ zorunlu tutun; TLS 1.0/1.1\'i devre disi birakin. ' +
+        '2) `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`. ' +
+        '3) Nginx: `ssl_protocols TLSv1.2 TLSv1.3;`. ' +
+        '4) Tum HTTP isteklerini 301 ile HTTPS\'e yonlendirin. ' +
+        '5) Sertifika otomasyonu icin Let\'s Encrypt + certbot veya cloud provider ACM kullanin. ' +
+        '6) HSTS preload listesi icin basvuru yapin.',
+    references: [
+        'https://wiki.mozilla.org/Security/Server_Side_TLS',
+        'https://datatracker.ietf.org/doc/html/rfc6797',
+    ],
+    cwe: 'CWE-319',
+    owasp: 'A02:2021 Cryptographic Failures',
+    languages: ['javascript', 'typescript'],
+    check: (ctx) => {
+        const isConfig = /nginx\.conf$/i.test(ctx.relativePath) ||
+            /next\.config\.(js|mjs|ts)$/i.test(ctx.relativePath) ||
+            /server\.(ts|js)$/i.test(ctx.relativePath);
+        if (!isConfig)
+            return [];
+        const findings = [];
+        const tlsPattern = /ssl_protocols\s+([^;\n]+)/g;
+        for (const m of ctx.source.matchAll(tlsPattern)) {
+            if (m[1] && /TLSv1\.0|TLSv1\.1|SSLv[23]/.test(m[1])) {
+                findings.push(...grepRule(rule, ctx, tlsPattern));
+                break;
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=tls.js.map

package/dist/engine/rules/network/tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../../../src/engine/rules/network/tls.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,iEAAiE;IACxE,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,8HAA8H;IAChI,MAAM,EAAE,2DAA2D;IACnE,WAAW,EACT,gEAAgE;QAChE,gFAAgF;QAChF,8CAA8C;QAC9C,wDAAwD;QACxD,0FAA0F;QAC1F,6CAA6C;IAC/C,UAAU,EAAE;QACV,mDAAmD;QACnD,+CAA+C;KAChD;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,iCAAiC;IACxC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GACZ,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACtC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACpD,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE7C,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzB,MAAM,QAAQ,GAAG,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,4BAA4B,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;gBAClD,MAAM;YACR,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/observability/errorHandler.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/observability/errorHandler.js

@@ -0,0 +1,34 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'OBS-002',
+    title: 'Unhandled promise rejection / missing global error handler',
+    layer: 'observability',
+    severity: 'medium',
+    description: 'Node.js servislerinde `process.on(\'unhandledRejection\')` ve `process.on(\'uncaughtException\')` handler\'lari yoksa process crash\'ler sessizce olur, security event\'leri kaybolur, monitoring bos kalir.',
+    threat: 'Silent crashes, missed security signals, denial of service via uncaught errors',
+    remediation: 'Production\'da mutlaka global handler kurun: ' +
+        '`process.on(\'unhandledRejection\', (err) => { logger.error(err); metrics.increment(\'unhandled_rejection\'); })` ve ' +
+        '`process.on(\'uncaughtException\', (err) => { logger.fatal(err); process.exit(1); })`. ' +
+        'Express icin en sonda `app.use((err, req, res, next) => { ... })` error middleware. ' +
+        'Worker queue\'larda failed job\'lari retry queue\'ya yonlendirin.',
+    references: [
+        'https://nodejs.org/api/process.html#warning-using-uncaughtexception-correctly',
+        'https://expressjs.com/en/guide/error-handling.html',
+    ],
+    cwe: 'CWE-754',
+    owasp: 'A09:2021 Security Logging and Monitoring Failures',
+    languages: ['javascript', 'typescript'],
+    check: (ctx) => {
+        const isServerEntry = /(?:server|app|main|index)\.(?:ts|js)$/i.test(ctx.relativePath);
+        if (!isServerEntry)
+            return [];
+        const hasUnhandled = /unhandledRejection|uncaughtException/.test(ctx.source);
+        if (hasUnhandled)
+            return [];
+        const findings = [];
+        findings.push(...grepRule(rule, ctx, /listen\s*\(\s*\d+/g));
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=errorHandler.js.map

package/dist/engine/rules/observability/errorHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.js","sourceRoot":"","sources":["../../../../src/engine/rules/observability/errorHandler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,4DAA4D;IACnE,KAAK,EAAE,eAAe;IACtB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EACT,8MAA8M;IAChN,MAAM,EAAE,gFAAgF;IACxF,WAAW,EACT,+CAA+C;QAC/C,uHAAuH;QACvH,yFAAyF;QACzF,sFAAsF;QACtF,mEAAmE;IACrE,UAAU,EAAE;QACV,+EAA+E;QAC/E,oDAAoD;KACrD;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,mDAAmD;IAC1D,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,aAAa,GAAG,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtF,IAAI,CAAC,aAAa;YAAE,OAAO,EAAE,CAAC;QAE9B,MAAM,YAAY,GAAG,sCAAsC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7E,IAAI,YAAY;YAAE,OAAO,EAAE,CAAC;QAE5B,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC5D,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/observability/index.d.ts

@@ -0,0 +1,5 @@
+export declare const rules: {
+    logging: import("../../../types.js").Rule;
+    errorHandler: import("../../../types.js").Rule;
+};
+export default rules;

package/dist/engine/rules/observability/index.js

@@ -0,0 +1,8 @@
+import logging from './logging.js';
+import errorHandler from './errorHandler.js';
+export const rules = {
+    logging,
+    errorHandler,
+};
+export default rules;
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/observability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/engine/rules/observability/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAE7C,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,OAAO;IACP,YAAY;CACb,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/engine/rules/observability/logging.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/observability/logging.js

@@ -0,0 +1,38 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'OBS-001',
+    title: 'Sensitive data exposed via logs (PII / stack trace / console.log in prod)',
+    layer: 'observability',
+    severity: 'medium',
+    description: 'Log\'a parola, kart numarasi, token, session cookie veya kullanici kimlik bilgisi basilmasi, log toplayici sizintisinda GDPR/KVKK ihlali olusturur. Stack trace\'in production response\'una donmesi bilgi ifshasidir.',
+    threat: 'PII leakage via logs, information disclosure via error responses, compliance violation',
+    remediation: '1) Production response\'larinda ASLA stack trace / `error.stack` / ic detay donmeyin. Generic 500 + correlation id. ' +
+        '2) Log\'a PII gondermeden once redact edin (`***-mask`). ' +
+        '3) Parola, token, CVV, PAN gibi alanlari logger\'a gecmeyin. ' +
+        '4) Merkezi log (ELK, Datadog, Sentry) ile PII redaction rules kurun. ' +
+        '5) Anomali tespiti icin SIEM (Splunk, Sentinel) ile alerting. ' +
+        '6) `console.log` production\'da birakilabilir ama debug amacli PII tasimamali.',
+    references: [
+        'https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html',
+        'https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure',
+    ],
+    cwe: 'CWE-532',
+    owasp: 'A09:2021 Security Logging and Monitoring Failures',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        const patterns = [
+            /console\.log\s*\([^)]*(?:password|passwd|pwd|token|secret|api[_-]?key|cvv|cardNumber|ssn|tcKimlik)/gi,
+            /logger?\.(?:info|debug|warn)\s*\([^)]*(?:password|passwd|pwd|token|secret|api[_-]?key|cvv|cardNumber|ssn|tcKimlik)/gi,
+            /res\.(?:send|json)\s*\(\s*\{\s*[^}]*error\s*:\s*err\.stack/gi,
+            /res\.(?:send|json)\s*\(\s*err\.stack/gi,
+            /print\s*\(\s*[^)]*(?:password|secret|token|api[_-]?key)/gi,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=logging.js.map

package/dist/engine/rules/observability/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../../../src/engine/rules/observability/logging.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,2EAA2E;IAClF,KAAK,EAAE,eAAe;IACtB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EACT,wNAAwN;IAC1N,MAAM,EAAE,wFAAwF;IAChG,WAAW,EACT,sHAAsH;QACtH,2DAA2D;QAC3D,+DAA+D;QAC/D,uEAAuE;QACvE,gEAAgE;QAChE,gFAAgF;IAClF,UAAU,EAAE;QACV,yEAAyE;QACzE,4EAA4E;KAC7E;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,mDAAmD;IAC1D,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YAC/B,sGAAsG;YAChG,sHAAsH;YAC5H,8DAA8D;YACxD,wCAAwC;YAC9C,2DAA2D;SACtD,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/php/index.d.ts

@@ -0,0 +1,6 @@
+export declare const rules: {
+    sqlInjection: import("../../../types.js").Rule;
+    xss: import("../../../types.js").Rule;
+    weakHashing: import("../../../types.js").Rule;
+};
+export default rules;

package/dist/engine/rules/php/index.js

@@ -0,0 +1,10 @@
+import sqlInjection from './sqlInjection.js';
+import xss from './xss.js';
+import weakHashing from './weakHashing.js';
+export const rules = {
+    sqlInjection,
+    xss,
+    weakHashing,
+};
+export default rules;
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/php/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/engine/rules/php/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,WAAW,MAAM,kBAAkB,CAAC;AAE3C,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,YAAY;IACZ,GAAG;IACH,WAAW;CACZ,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/engine/rules/php/sqlInjection.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/php/sqlInjection.js

@@ -0,0 +1,58 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'PHP-001',
+    title: 'PHP: SQL injection via string concatenation',
+    layer: 'backend',
+    severity: 'critical',
+    description: 'PHP mysqli / PDO queries built via string concatenation or interpolation allow attackers to inject SQL through any user-controlled parameter.',
+    threat: 'Database exfiltration, authentication bypass, data destruction, full server compromise',
+    remediation: '1) Use PDO prepared statements: `$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?"); $stmt->execute([$id])`. ' +
+        '2) Use mysqli prepared: `$stmt = $mysqli->prepare("SELECT * FROM users WHERE id = ?"); $stmt->bind_param("i", $id)`. ' +
+        '3) For Eloquent / Laravel query builder: `User::where("id", $id)->first()`. ' +
+        '4) NEVER use `"SELECT * FROM users WHERE id = $id"` or `.="..."`. ' +
+        '5) For variable table/column names: validate against an allowlist.',
+    references: [
+        'https://www.php.net/manual/en/pdo.prepared-statements.php',
+        'https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php',
+        'https://owasp.org/www-community/attacks/SQL_Injection',
+    ],
+    cwe: 'CWE-89',
+    owasp: 'A03:2021 Injection',
+    languages: ['php'],
+    check: (ctx) => {
+        const findings = [];
+        const patterns = [
+            /\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\s*\[/g,
+            /\$this->input->get\(/g,
+            /\bquery\s*\(\s*["'][^"']*["']\s*\.\s*\$_/gi,
+            /->query\s*\(\s*["'][^"']*["']\s*\.\s*\$_/gi,
+            /->prepare\s*\(\s*["'][^"']*["']\s*\.\s*\$_/gi,
+            /mysqli_query\s*\(\s*[^,]+,\s*["'][^"']*["']\s*\.\s*\$_/gi,
+        ];
+        for (const re of patterns) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=sqlInjection.js.map

package/dist/engine/rules/php/sqlInjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlInjection.js","sourceRoot":"","sources":["../../../../src/engine/rules/php/sqlInjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,6CAA6C;IACpD,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,+IAA+I;IACjJ,MAAM,EAAE,wFAAwF;IAChG,WAAW,EACT,sHAAsH;QACtH,uHAAuH;QACvH,8EAA8E;QAC9E,oEAAoE;QACpE,oEAAoE;IACtE,UAAU,EAAE;QACV,2DAA2D;QAC3D,yEAAyE;QACzE,uDAAuD;KACxD;IACD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,KAAK,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG;YACf,6CAA6C;YAC7C,uBAAuB;YACvB,4CAA4C;YAC5C,4CAA4C;YAC5C,8CAA8C;YAC9C,0DAA0D;SAC3D,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE;oBAC5C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/php/weakHashing.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/php/weakHashing.js

@@ -0,0 +1,36 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'PHP-003',
+    title: 'PHP: weak password hashing (md5 / sha1 / sha256)',
+    layer: 'backend',
+    severity: 'critical',
+    description: 'Using `md5()`, `sha1()`, or `sha256()` for password hashing is broken — modern hardware cracks these in seconds. Use `password_hash($password, PASSWORD_BCRYPT)` or `PASSWORD_ARGON2ID`.',
+    threat: 'Mass credential disclosure if database leaks',
+    remediation: '1) Use `password_hash($pw, PASSWORD_BCRYPT, ["cost" => 12])` for bcrypt (PHP 5.5+). ' +
+        '2) Or `password_hash($pw, PASSWORD_ARGON2ID)` for Argon2id (PHP 7.2+). ' +
+        '3) Verify with `password_verify($pw, $hash)`. ' +
+        '4) NEVER use `md5`, `sha1`, `sha256`, `hash("md5", ...)` for passwords. ' +
+        '5) For legacy hashes, rehash on next successful login: if (password_verify(...)) { $new = password_hash(...) }.',
+    references: [
+        'https://www.php.net/manual/en/function.password-hash.php',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html',
+    ],
+    cwe: 'CWE-916',
+    owasp: 'A02:2021 Cryptographic Failures',
+    languages: ['php'],
+    check: (ctx) => {
+        const findings = [];
+        const patterns = [
+            /\bmd5\s*\(\s*\$_/gi,
+            /\bsha1\s*\(\s*\$_/gi,
+            /\bsha256\s*\(\s*\$_/gi,
+            /\bhash\s*\(\s*['"`](?:md5|sha1|sha256)['"`]/gi,
+        ];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=weakHashing.js.map

package/dist/engine/rules/php/weakHashing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"weakHashing.js","sourceRoot":"","sources":["../../../../src/engine/rules/php/weakHashing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,kDAAkD;IACzD,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,0LAA0L;IAC5L,MAAM,EAAE,8CAA8C;IACtD,WAAW,EACT,sFAAsF;QACtF,yEAAyE;QACzE,gDAAgD;QAChD,0EAA0E;QAC1E,iHAAiH;IACnH,UAAU,EAAE;QACV,0DAA0D;QAC1D,kFAAkF;KACnF;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,iCAAiC;IACxC,SAAS,EAAE,CAAC,KAAK,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG;YACf,oBAAoB;YACpB,qBAAqB;YACrB,uBAAuB;YACvB,+CAA+C;SAChD,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/php/xss.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;