@lingxiao-office/sdk 1.0.0

package/dist/tools/implementations/rules/schema.d.ts

@@ -0,0 +1,236 @@
+/**
+ * rules/schema.ts — bughunt 静态分析规则的类型 + 外部规则包 zod schema（单一事实源）。
+ *
+ * 设计：
+ *   - 类型层（Severity / SupportedLanguage / LanguageConfig / SecurityRule / SecurityPattern）
+ *     供引擎（TreeSitterSecurityEngine / BughuntScanTools）与规则包（seed / RuleLoader）共享，
+ *     杜绝三处各自定义导致的漂移。
+ *   - zod schema（RulePackInputSchema）用于解析「用户提供的 JSON 规则包」；
+ *     内置默认规则在 seed.ts 用 RegExp 字面量定义（零转换、字节级稳定）。
+ *   - RuleLoader 合并 seed + 用户包（按 id 覆盖/追加）。
+ *
+ * P3 预留：structuralRule / taint 字段为 TaintFlowEngine 预留。本阶段（P1）规则不填充，
+ * 引擎按「字段缺省 = 不启用」处理，扫描行为与外部化前完全一致（字节级不变）。
+ */
+import { z } from 'zod';
+export type Severity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
+export declare const SEVERITIES: readonly Severity[];
+export type SupportedLanguage = 'javascript' | 'typescript' | 'python' | 'go' | 'java' | 'rust' | 'c' | 'cpp' | 'ruby';
+export declare const SUPPORTED_LANGUAGES: readonly SupportedLanguage[];
+export interface LanguageConfig {
+    /** ast-grep 内部语言名（注册后可用） */
+    agName: string;
+    extensions: string[];
+    sources: string[];
+    sinks: string[];
+}
+/** P3 预留：结构化 ast-grep 规则（pattern + 元变量约束）。 */
+export interface StructuralRule {
+    /** ast-grep 结构化 pattern，如 'exec($CMD)' */
+    pattern: string;
+    /** 元变量约束（$CMD 必须匹配的子规则） */
+    constraints?: Record<string, unknown>;
+}
+/** P3 预留：污点传播配置。 */
+export interface TaintSpec {
+    /** source 槽位 pattern（如 'req.body'） */
+    source?: string;
+    /** sink 参数槽位 pattern（如 '$CMD'） */
+    sinkArg?: string;
+    /** 净化器名称覆盖（缺省用 taintFacts 默认表） */
+    sanitizers?: string[];
+}
+export interface SecurityRule {
+    id: string;
+    severity: Severity;
+    cwe?: string;
+    owasp?: string;
+    title: string;
+    description: string;
+    languages: SupportedLanguage[];
+    /** ast-grep 节点 kind 列表（白名单） */
+    nodeKinds: string[];
+    /** 节点文本必须匹配（任一） */
+    patterns: RegExp[];
+    /** 节点文本附加上下文模式（可选，全部满足才报告） */
+    contextPatterns?: RegExp[];
+    /** P3 预留：结构化 ast-grep 规则（缺省=不启用，扫描行为不变） */
+    structuralRule?: StructuralRule;
+    /** P3 预留：污点传播配置（缺省=不启用） */
+    taint?: TaintSpec;
+}
+export interface SecurityPattern {
+    id: string;
+    severity: Severity;
+    rule: string;
+    message: string;
+    pattern: RegExp;
+    fileExts: string[];
+    cwe?: string;
+    owasp?: string;
+}
+declare const LanguageConfigInputSchema: z.ZodObject<{
+    agName: z.ZodString;
+    extensions: z.ZodArray<z.ZodString>;
+    sources: z.ZodArray<z.ZodString>;
+    sinks: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+declare const SecurityRuleInputSchema: z.ZodObject<{
+    id: z.ZodString;
+    severity: z.ZodEnum<{
+        CRITICAL: "CRITICAL";
+        HIGH: "HIGH";
+        MEDIUM: "MEDIUM";
+        LOW: "LOW";
+        INFO: "INFO";
+    }>;
+    cwe: z.ZodOptional<z.ZodString>;
+    owasp: z.ZodOptional<z.ZodString>;
+    title: z.ZodString;
+    description: z.ZodString;
+    languages: z.ZodArray<z.ZodEnum<{
+        python: "python";
+        javascript: "javascript";
+        typescript: "typescript";
+        go: "go";
+        rust: "rust";
+        java: "java";
+        c: "c";
+        cpp: "cpp";
+        ruby: "ruby";
+    }>>;
+    nodeKinds: z.ZodArray<z.ZodString>;
+    patterns: z.ZodArray<z.ZodObject<{
+        source: z.ZodString;
+        flags: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
+    contextPatterns: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source: z.ZodString;
+        flags: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>>;
+    structuralRule: z.ZodOptional<z.ZodObject<{
+        pattern: z.ZodString;
+        constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>;
+    taint: z.ZodOptional<z.ZodObject<{
+        source: z.ZodOptional<z.ZodString>;
+        sinkArg: z.ZodOptional<z.ZodString>;
+        sanitizers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+declare const SecurityPatternInputSchema: z.ZodObject<{
+    id: z.ZodString;
+    severity: z.ZodEnum<{
+        CRITICAL: "CRITICAL";
+        HIGH: "HIGH";
+        MEDIUM: "MEDIUM";
+        LOW: "LOW";
+        INFO: "INFO";
+    }>;
+    rule: z.ZodString;
+    message: z.ZodString;
+    pattern: z.ZodObject<{
+        source: z.ZodString;
+        flags: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>;
+    fileExts: z.ZodArray<z.ZodString>;
+    cwe: z.ZodOptional<z.ZodString>;
+    owasp: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const RulePackInputSchema: z.ZodObject<{
+    rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        severity: z.ZodEnum<{
+            CRITICAL: "CRITICAL";
+            HIGH: "HIGH";
+            MEDIUM: "MEDIUM";
+            LOW: "LOW";
+            INFO: "INFO";
+        }>;
+        cwe: z.ZodOptional<z.ZodString>;
+        owasp: z.ZodOptional<z.ZodString>;
+        title: z.ZodString;
+        description: z.ZodString;
+        languages: z.ZodArray<z.ZodEnum<{
+            python: "python";
+            javascript: "javascript";
+            typescript: "typescript";
+            go: "go";
+            rust: "rust";
+            java: "java";
+            c: "c";
+            cpp: "cpp";
+            ruby: "ruby";
+        }>>;
+        nodeKinds: z.ZodArray<z.ZodString>;
+        patterns: z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            flags: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>>;
+        contextPatterns: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            flags: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>>>;
+        structuralRule: z.ZodOptional<z.ZodObject<{
+            pattern: z.ZodString;
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>;
+        taint: z.ZodOptional<z.ZodObject<{
+            source: z.ZodOptional<z.ZodString>;
+            sinkArg: z.ZodOptional<z.ZodString>;
+            sanitizers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
+    patterns: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        severity: z.ZodEnum<{
+            CRITICAL: "CRITICAL";
+            HIGH: "HIGH";
+            MEDIUM: "MEDIUM";
+            LOW: "LOW";
+            INFO: "INFO";
+        }>;
+        rule: z.ZodString;
+        message: z.ZodString;
+        pattern: z.ZodObject<{
+            source: z.ZodString;
+            flags: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>;
+        fileExts: z.ZodArray<z.ZodString>;
+        cwe: z.ZodOptional<z.ZodString>;
+        owasp: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    languages: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        python: "python";
+        javascript: "javascript";
+        typescript: "typescript";
+        go: "go";
+        rust: "rust";
+        java: "java";
+        c: "c";
+        cpp: "cpp";
+        ruby: "ruby";
+    }>, z.ZodObject<{
+        agName: z.ZodString;
+        extensions: z.ZodArray<z.ZodString>;
+        sources: z.ZodArray<z.ZodString>;
+        sinks: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type RulePackInput = z.infer<typeof RulePackInputSchema>;
+export type SecurityRuleInput = z.infer<typeof SecurityRuleInputSchema>;
+export type SecurityPatternInput = z.infer<typeof SecurityPatternInputSchema>;
+export type LanguageConfigInput = z.infer<typeof LanguageConfigInputSchema>;
+/** 把 {source, flags} 编译回 RegExp（确定性，失败抛错而非静默降级）。 */
+export declare function compileRegexp(spec: {
+    source: string;
+    flags: string;
+}): RegExp;
+/** 把用户包输入规则编译成引擎可用的 SecurityRule（含 RegExp）。 */
+export declare function compileRule(input: SecurityRuleInput): SecurityRule;
+/** 把用户包输入 pattern 编译成引擎可用的 SecurityPattern（含 RegExp）。 */
+export declare function compilePattern(input: SecurityPatternInput): SecurityPattern;
+/** 把用户包输入语言配置编译成 LanguageConfig。 */
+export declare function compileLanguageConfig(input: LanguageConfigInput): LanguageConfig;
+export {};
+//# sourceMappingURL=schema.d.ts.map

package/dist/tools/implementations/rules/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/tools/implementations/rules/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAAkD,CAAC;AAE7F,MAAM,MAAM,iBAAiB,GACzB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,MAAM,GACN,GAAG,GACH,KAAK,GACL,MAAM,CAAC;AAEX,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAE3D,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,oBAAoB;AACpB,MAAM,WAAW,SAAS;IACxB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,mBAAmB;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8BAA8B;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,2CAA2C;IAC3C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA6BD,QAAA,MAAM,yBAAyB;;;;;iBAK7B,CAAC;AAEH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa3B,CAAC;AAEH,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;iBAS9B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE7E;AAED,+CAA+C;AAC/C,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,CAelE;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,CAW3E;AAED,oCAAoC;AACpC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAOhF"}

package/dist/tools/implementations/rules/schema.js

@@ -0,0 +1,119 @@
+/**
+ * rules/schema.ts — bughunt 静态分析规则的类型 + 外部规则包 zod schema（单一事实源）。
+ *
+ * 设计：
+ *   - 类型层（Severity / SupportedLanguage / LanguageConfig / SecurityRule / SecurityPattern）
+ *     供引擎（TreeSitterSecurityEngine / BughuntScanTools）与规则包（seed / RuleLoader）共享，
+ *     杜绝三处各自定义导致的漂移。
+ *   - zod schema（RulePackInputSchema）用于解析「用户提供的 JSON 规则包」；
+ *     内置默认规则在 seed.ts 用 RegExp 字面量定义（零转换、字节级稳定）。
+ *   - RuleLoader 合并 seed + 用户包（按 id 覆盖/追加）。
+ *
+ * P3 预留：structuralRule / taint 字段为 TaintFlowEngine 预留。本阶段（P1）规则不填充，
+ * 引擎按「字段缺省 = 不启用」处理，扫描行为与外部化前完全一致（字节级不变）。
+ */
+import { z } from 'zod';
+export const SEVERITIES = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO'];
+export const SUPPORTED_LANGUAGES = [
+    'javascript', 'typescript', 'python', 'go', 'java', 'rust', 'c', 'cpp', 'ruby',
+];
+// ═══════════════════════════════════════════════════════════════════════════════
+// 用户 JSON 规则包 zod schema（patterns 字符串化以 JSON 友好）
+// ═══════════════════════════════════════════════════════════════════════════════
+const LANGUAGE_ENUM = z.enum([
+    'javascript', 'typescript', 'python', 'go', 'java', 'rust', 'c', 'cpp', 'ruby',
+]);
+const SEVERITY_ENUM = z.enum(['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO']);
+/** 正则的可序列化表示：source + flags。加载时 new RegExp(source, flags) 精确还原。 */
+const RegexpSpecSchema = z.object({
+    source: z.string(),
+    flags: z.string().default(''),
+});
+const StructuralRuleInputSchema = z.object({
+    pattern: z.string(),
+    constraints: z.record(z.string(), z.unknown()).optional(),
+});
+const TaintSpecInputSchema = z.object({
+    source: z.string().optional(),
+    sinkArg: z.string().optional(),
+    sanitizers: z.array(z.string()).optional(),
+});
+const LanguageConfigInputSchema = z.object({
+    agName: z.string(),
+    extensions: z.array(z.string()),
+    sources: z.array(z.string()),
+    sinks: z.array(z.string()),
+});
+const SecurityRuleInputSchema = z.object({
+    id: z.string(),
+    severity: SEVERITY_ENUM,
+    cwe: z.string().optional(),
+    owasp: z.string().optional(),
+    title: z.string(),
+    description: z.string(),
+    languages: z.array(LANGUAGE_ENUM),
+    nodeKinds: z.array(z.string()),
+    patterns: z.array(RegexpSpecSchema),
+    contextPatterns: z.array(RegexpSpecSchema).optional(),
+    structuralRule: StructuralRuleInputSchema.optional(),
+    taint: TaintSpecInputSchema.optional(),
+});
+const SecurityPatternInputSchema = z.object({
+    id: z.string(),
+    severity: SEVERITY_ENUM,
+    rule: z.string(),
+    message: z.string(),
+    pattern: RegexpSpecSchema,
+    fileExts: z.array(z.string()),
+    cwe: z.string().optional(),
+    owasp: z.string().optional(),
+});
+export const RulePackInputSchema = z.object({
+    rules: z.array(SecurityRuleInputSchema).optional(),
+    patterns: z.array(SecurityPatternInputSchema).optional(),
+    languages: z.record(LANGUAGE_ENUM, LanguageConfigInputSchema).optional(),
+});
+/** 把 {source, flags} 编译回 RegExp（确定性，失败抛错而非静默降级）。 */
+export function compileRegexp(spec) {
+    return new RegExp(spec.source, spec.flags || '');
+}
+/** 把用户包输入规则编译成引擎可用的 SecurityRule（含 RegExp）。 */
+export function compileRule(input) {
+    return {
+        id: input.id,
+        severity: input.severity,
+        cwe: input.cwe,
+        owasp: input.owasp,
+        title: input.title,
+        description: input.description,
+        languages: input.languages,
+        nodeKinds: input.nodeKinds,
+        patterns: input.patterns.map(compileRegexp),
+        contextPatterns: input.contextPatterns?.map(compileRegexp),
+        structuralRule: input.structuralRule,
+        taint: input.taint,
+    };
+}
+/** 把用户包输入 pattern 编译成引擎可用的 SecurityPattern（含 RegExp）。 */
+export function compilePattern(input) {
+    return {
+        id: input.id,
+        severity: input.severity,
+        rule: input.rule,
+        message: input.message,
+        pattern: compileRegexp(input.pattern),
+        fileExts: input.fileExts,
+        cwe: input.cwe,
+        owasp: input.owasp,
+    };
+}
+/** 把用户包输入语言配置编译成 LanguageConfig。 */
+export function compileLanguageConfig(input) {
+    return {
+        agName: input.agName,
+        extensions: input.extensions,
+        sources: input.sources,
+        sinks: input.sinks,
+    };
+}
+//# sourceMappingURL=schema.js.map

package/dist/tools/implementations/rules/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/tools/implementations/rules/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAa7F,MAAM,CAAC,MAAM,mBAAmB,GAAiC;IAC/D,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM;CAC/E,CAAC;AA2DF,kFAAkF;AAClF,iDAAiD;AACjD,kFAAkF;AAElF,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM;CAC/E,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5E,mEAAmE;AACnE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,aAAa;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,gBAAgB;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;IACxD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAOH,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,IAAuC;IACnE,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,WAAW,CAAC,KAAwB;IAClD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;QAC3C,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC;QAC1D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,cAAc,CAAC,KAA2B;IACxD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;QACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,qBAAqB,CAAC,KAA0B;IAC9D,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC"}

package/dist/tools/implementations/rules/seed.d.ts

@@ -0,0 +1,18 @@
+/**
+ * rules/seed.ts — 内置默认规则包（单一事实源：把原本散落在引擎里的硬编码规则
+ * 收口到这里）。
+ *
+ * 规则用 RegExp 字面量定义（零转换），保证外部化前后扫描输出字节级一致。
+ * 用户可通过 RuleLoader 的 rulePackPath 提供额外 JSON 规则包，按 id 覆盖/追加。
+ *
+ * 内容迁移自：
+ *   - TreeSitterSecurityEngine.ts 的 SECURITY_RULES（14 条）+ LANGUAGE_CONFIGS（9 语言）
+ *   - BughuntScanTools.ts 的 SECURITY_PATTERNS（19 条）
+ *
+ * P3 将在此之上为部分规则补充 structuralRule / taint 字段（结构化污点）。
+ */
+import type { LanguageConfig, SecurityPattern, SecurityRule, SupportedLanguage } from './schema.js';
+export declare const SEED_LANGUAGE_CONFIGS: Record<SupportedLanguage, LanguageConfig>;
+export declare const SEED_RULES: SecurityRule[];
+export declare const SEED_PATTERNS: SecurityPattern[];
+//# sourceMappingURL=seed.d.ts.map

package/dist/tools/implementations/rules/seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../../../src/tools/implementations/rules/seed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,YAAY,EACZ,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAMrB,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAuD3E,CAAC;AAMF,eAAO,MAAM,UAAU,EAAE,YAAY,EAoIpC,CAAC;AAMF,eAAO,MAAM,aAAa,EAAE,eAAe,EAoD1C,CAAC"}

package/dist/tools/implementations/rules/seed.js

@@ -0,0 +1,252 @@
+// ═══════════════════════════════════════════════════════════════════════════════
+// 语言配置（9 语言：ast-grep 名 + 扩展名 + 污点 sources/sinks 声明）
+// ═══════════════════════════════════════════════════════════════════════════════
+export const SEED_LANGUAGE_CONFIGS = {
+    javascript: {
+        agName: 'JavaScript',
+        extensions: ['.js', '.mjs', '.cjs'],
+        sources: ['req.body', 'req.query', 'req.params', 'req.headers', 'process.env', 'event.body', 'ctx.request.body'],
+        sinks: ['eval', 'exec', 'execSync', 'spawn', 'query', 'innerHTML', 'document.write', 'Function', 'setTimeout', 'setInterval'],
+    },
+    typescript: {
+        agName: 'TypeScript',
+        extensions: ['.ts', '.mts', '.cts'],
+        sources: ['req.body', 'req.query', 'req.params', 'request.body', 'ctx.request', 'event.body'],
+        sinks: ['eval', 'exec', 'execSync', 'spawn', 'query', 'innerHTML', 'dangerouslySetInnerHTML', 'Function'],
+    },
+    python: {
+        agName: 'python',
+        extensions: ['.py'],
+        sources: ['request.form', 'request.args', 'request.json', 'request.data', 'sys.argv', 'input()', 'os.environ'],
+        sinks: ['eval', 'exec', 'os.system', 'subprocess.call', 'subprocess.run', 'cursor.execute', 'pickle.loads', 'yaml.load'],
+    },
+    go: {
+        agName: 'go',
+        extensions: ['.go'],
+        sources: ['r.FormValue', 'r.URL.Query', 'r.Body', 'os.Getenv', 'c.Param', 'c.Query'],
+        sinks: ['exec.Command', 'db.Query', 'db.Exec', 'template.HTML', 'fmt.Fprintf', 'os.Remove'],
+    },
+    java: {
+        agName: 'java',
+        extensions: ['.java'],
+        sources: ['request.getParameter', 'request.getHeader', 'request.getInputStream', 'System.getenv'],
+        sinks: ['Runtime.exec', 'ProcessBuilder', 'Statement.execute', 'PreparedStatement', 'Class.forName', 'ObjectInputStream'],
+    },
+    rust: {
+        agName: 'rust',
+        extensions: ['.rs'],
+        sources: ['std::env::args', 'std::io::stdin', 'Request::body'],
+        sinks: ['Command::new', 'std::process::Command', 'unsafe'],
+    },
+    c: {
+        agName: 'c',
+        extensions: ['.c', '.h'],
+        sources: ['argv', 'getenv', 'fgets', 'scanf', 'gets', 'recv'],
+        sinks: ['system', 'exec', 'popen', 'strcpy', 'strcat', 'sprintf', 'gets', 'scanf', 'free'],
+    },
+    cpp: {
+        agName: 'cpp',
+        extensions: ['.cpp', '.cc', '.cxx', '.hpp', '.hxx'],
+        sources: ['argv', 'getenv', 'std::cin', 'recv'],
+        sinks: ['system', 'exec', 'popen', 'strcpy', 'strcat', 'sprintf', 'delete', 'free'],
+    },
+    ruby: {
+        agName: 'ruby',
+        extensions: ['.rb'],
+        sources: ['params', 'request.body', 'ENV', 'ARGV', 'gets'],
+        sinks: ['eval', 'exec', 'system', 'send', 'public_send', 'instance_eval', 'class_eval', 'Marshal.load'],
+    },
+};
+// ═══════════════════════════════════════════════════════════════════════════════
+// ast-grep 多语言 AST 规则（节点 kind 白名单 + 文本正则；OWASP Top 10 + CWE）
+// ═══════════════════════════════════════════════════════════════════════════════
+export const SEED_RULES = [
+    // ── CWE-78: OS Command Injection ──
+    {
+        id: 'CWE-78', severity: 'CRITICAL', cwe: 'CWE-78', owasp: 'A03:2021',
+        title: 'OS Command Injection',
+        description: '用户输入直接传入系统命令执行函数',
+        languages: ['javascript', 'typescript', 'python', 'go', 'java', 'ruby', 'c', 'cpp'],
+        nodeKinds: ['call_expression', 'function_call', 'method_invocation', 'call'],
+        patterns: [/\b(?:exec|execSync|spawn|spawnSync|system|popen|os\.system|subprocess\.(?:call|run|Popen)|Runtime\.exec|Command::new)\s*\(/],
+        contextPatterns: [/\$\{.*(?:req|args|params|input|user|query|body|argv)|\+\s*(?:req|args|params|input|user|query|body|argv)/],
+    },
+    // ── CWE-89: SQL Injection ──
+    {
+        id: 'CWE-89', severity: 'HIGH', cwe: 'CWE-89', owasp: 'A03:2021',
+        title: 'SQL Injection',
+        description: '字符串拼接构建 SQL 查询',
+        languages: ['javascript', 'typescript', 'python', 'go', 'java', 'ruby'],
+        nodeKinds: ['call_expression', 'function_call', 'method_invocation', 'template_string', 'call'],
+        patterns: [/\b(?:query|execute|raw|exec|cursor\.execute|db\.Query|db\.Exec|Statement\.execute)\b/],
+        contextPatterns: [/(?:SELECT|INSERT|UPDATE|DELETE|DROP)\b/i, /\$\{|\+ ?[a-z]|%s|format\(|f['"]/],
+    },
+    // ── CWE-79: XSS ──
+    {
+        id: 'CWE-79', severity: 'HIGH', cwe: 'CWE-79', owasp: 'A03:2021',
+        title: 'Cross-Site Scripting (XSS)',
+        description: '未转义的用户输入插入 HTML',
+        languages: ['javascript', 'typescript'],
+        nodeKinds: ['assignment_expression', 'call_expression', 'jsx_attribute'],
+        patterns: [/\b(?:innerHTML|outerHTML|document\.write|dangerouslySetInnerHTML)\b/],
+    },
+    // ── CWE-95: Eval Injection ──
+    {
+        id: 'CWE-95', severity: 'HIGH', cwe: 'CWE-95', owasp: 'A03:2021',
+        title: 'Code Injection via eval()',
+        description: '动态代码执行（eval/exec/Function）',
+        languages: ['javascript', 'typescript', 'python', 'ruby'],
+        nodeKinds: ['call_expression', 'function_call', 'call'],
+        patterns: [/\b(?:eval|exec|Function|instance_eval|class_eval|module_eval)\s*\(/],
+    },
+    // ── CWE-22: Path Traversal ──
+    {
+        id: 'CWE-22', severity: 'HIGH', cwe: 'CWE-22', owasp: 'A01:2021',
+        title: 'Path Traversal',
+        description: '用户输入用于文件路径操作',
+        languages: ['javascript', 'typescript', 'python', 'go', 'java', 'ruby', 'c'],
+        nodeKinds: ['call_expression', 'function_call', 'method_invocation', 'call'],
+        patterns: [/\b(?:readFile|writeFile|open|os\.path\.join|filepath\.Join|File\.new|fopen|readFileSync|createReadStream)\b/],
+        contextPatterns: [/(?:req\.|params|args|input|user|query|body)/],
+    },
+    // ── CWE-798: Hardcoded Credentials ──
+    {
+        id: 'CWE-798', severity: 'HIGH', cwe: 'CWE-798', owasp: 'A07:2021',
+        title: 'Hardcoded Credentials',
+        description: '代码中硬编码密码/密钥/token',
+        languages: ['javascript', 'typescript', 'python', 'go', 'java', 'rust', 'ruby', 'c', 'cpp'],
+        nodeKinds: ['variable_declarator', 'assignment_expression', 'assignment', 'short_var_declaration', 'const_declaration', 'init_declarator'],
+        patterns: [/(?:password|secret|api_?key|token|auth_?token|private_?key|access_?key)\s*[:=]\s*['"][^'"]{8,}/i],
+    },
+    // ── CWE-330: Insecure Randomness ──
+    {
+        id: 'CWE-330', severity: 'MEDIUM', cwe: 'CWE-330', owasp: 'A02:2021',
+        title: 'Insecure Randomness',
+        description: '使用不安全的随机数生成器用于安全场景',
+        languages: ['javascript', 'typescript', 'python', 'java'],
+        nodeKinds: ['call_expression', 'function_call', 'method_invocation', 'call'],
+        patterns: [/\b(?:Math\.random|random\.random|Random\(\))\b/],
+        contextPatterns: [/(?:token|secret|password|key|salt|nonce|iv|session)/i],
+    },
+    // ── CWE-611: XXE ──
+    {
+        id: 'CWE-611', severity: 'HIGH', cwe: 'CWE-611', owasp: 'A05:2021',
+        title: 'XML External Entity (XXE)',
+        description: 'XML 解析未禁用外部实体',
+        languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+        nodeKinds: ['call_expression', 'function_call', 'method_invocation', 'call'],
+        patterns: [/\b(?:parseString|XMLParser|DOMParser|DocumentBuilder|xml\.parse|etree\.parse|saxParser|xml2js)\s*\(/],
+    },
+    // ── CWE-502: Deserialization ──
+    {
+        id: 'CWE-502', severity: 'CRITICAL', cwe: 'CWE-502', owasp: 'A08:2021',
+        title: 'Insecure Deserialization',
+        description: '不安全的反序列化操作',
+        languages: ['javascript', 'typescript', 'python', 'java', 'ruby'],
+        nodeKinds: ['call_expression', 'function_call', 'method_invocation', 'call'],
+        patterns: [/\b(?:unserialize|deserialize|pickle\.loads?|yaml\.(?:load|unsafe_load)|Marshal\.load|ObjectInputStream|readObject)\b/],
+    },
+    // ── CWE-918: SSRF ──
+    {
+        id: 'CWE-918', severity: 'HIGH', cwe: 'CWE-918', owasp: 'A10:2021',
+        title: 'Server-Side Request Forgery (SSRF)',
+        description: '用户输入控制服务端 HTTP 请求目标',
+        languages: ['javascript', 'typescript', 'python', 'go', 'java', 'ruby'],
+        nodeKinds: ['call_expression', 'function_call', 'method_invocation', 'call'],
+        patterns: [/\b(?:fetch|axios|request|http\.get|urllib\.request|net\/http\.Get|HttpClient|open-uri)\b/],
+        contextPatterns: [/(?:req\.|params|args|input|user|query|body|\$\{)/],
+    },
+    // ── CWE-120: Buffer Overflow (C/C++) ──
+    {
+        id: 'CWE-120', severity: 'CRITICAL', cwe: 'CWE-120', owasp: 'A04:2021',
+        title: 'Buffer Overflow',
+        description: '不安全的缓冲区操作',
+        languages: ['c', 'cpp'],
+        nodeKinds: ['call_expression'],
+        patterns: [/\b(?:strcpy|strcat|sprintf|gets|scanf)\s*\(/],
+    },
+    // ── CWE-676: Dangerous Function (C/C++) ──
+    {
+        id: 'CWE-676', severity: 'MEDIUM', cwe: 'CWE-676', owasp: 'A04:2021',
+        title: 'Dangerous Function',
+        description: '使用已知不安全的函数',
+        languages: ['c', 'cpp'],
+        nodeKinds: ['call_expression'],
+        patterns: [/\b(?:gets|mktemp|tmpnam|tempnam|realpath)\s*\(/],
+    },
+    // ── CWE-259: Hardcoded Password (Go specific) ──
+    {
+        id: 'CWE-259-GO', severity: 'HIGH', cwe: 'CWE-259', owasp: 'A07:2021',
+        title: 'Hardcoded Password (Go)',
+        description: 'Go 代码中硬编码密码',
+        languages: ['go'],
+        nodeKinds: ['short_var_declaration', 'var_declaration', 'const_declaration'],
+        patterns: [/(?:password|secret|apiKey|token)\s*[:=]\s*"[^"]{6,}"/i],
+    },
+    // ── Rust unsafe block ──
+    {
+        id: 'RUST-UNSAFE', severity: 'MEDIUM', cwe: 'CWE-676',
+        title: 'Unsafe Block',
+        description: 'Rust unsafe 代码块需要人工审查',
+        languages: ['rust'],
+        nodeKinds: ['unsafe_block'],
+        patterns: [/unsafe/],
+    },
+];
+// ═══════════════════════════════════════════════════════════════════════════════
+// 内建 OWASP 正则规则（零依赖，始终可用；迁移自 BughuntScanTools）
+// ═══════════════════════════════════════════════════════════════════════════════
+export const SEED_PATTERNS = [
+    // SQL 注入
+    { id: 'SQL-INJ', severity: 'HIGH', rule: 'sql-injection', message: '可能的 SQL 注入：字符串拼接构建 SQL 查询',
+        pattern: /(?:query|execute|raw)\s*\(\s*[`'"](?:SELECT|INSERT|UPDATE|DELETE|DROP|ALTER)\b[^`'"]*\$\{/gi, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-89', owasp: 'A03:2021' },
+    { id: 'SQL-INJ-2', severity: 'HIGH', rule: 'sql-injection-concat', message: '可能的 SQL 注入：+ 拼接构建 SQL',
+        pattern: /(?:query|execute|raw)\s*\(\s*['"](?:SELECT|INSERT|UPDATE|DELETE)\b[^'"]*['"]\s*\+/gi, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-89', owasp: 'A03:2021' },
+    // 命令注入
+    { id: 'CMD-INJ', severity: 'CRITICAL', rule: 'command-injection', message: '可能的命令注入：exec/execSync 使用模板字符串或拼接',
+        pattern: /(?:exec|execSync|spawn|spawnSync)\s*\(\s*`[^`]*\$\{/g, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-78', owasp: 'A03:2021' },
+    { id: 'CMD-INJ-2', severity: 'CRITICAL', rule: 'command-injection-concat', message: '可能的命令注入：exec 使用字符串拼接',
+        pattern: /(?:exec|execSync)\s*\(\s*[^,)]*\+\s*(?:req\.|args|params|input|user)/g, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-78', owasp: 'A03:2021' },
+    // XSS
+    { id: 'XSS-1', severity: 'HIGH', rule: 'xss-innerhtml', message: 'XSS 风险：使用 innerHTML 赋值',
+        pattern: /\.innerHTML\s*=\s*(?!['"`]<)/g, fileExts: ['.ts', '.js', '.tsx', '.jsx'], cwe: 'CWE-79', owasp: 'A03:2021' },
+    { id: 'XSS-2', severity: 'HIGH', rule: 'xss-dangerously', message: 'XSS 风险：dangerouslySetInnerHTML',
+        pattern: /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:/g, fileExts: ['.tsx', '.jsx'], cwe: 'CWE-79', owasp: 'A03:2021' },
+    // 不安全的 eval
+    { id: 'EVAL-1', severity: 'HIGH', rule: 'unsafe-eval', message: '不安全的 eval() 调用',
+        pattern: /\beval\s*\(/g, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-95', owasp: 'A03:2021' },
+    { id: 'EVAL-2', severity: 'MEDIUM', rule: 'unsafe-function-constructor', message: '不安全的 Function() 构造器',
+        pattern: /new\s+Function\s*\(/g, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-95', owasp: 'A03:2021' },
+    // 路径遍历
+    { id: 'PATH-1', severity: 'HIGH', rule: 'path-traversal', message: '可能的路径遍历：用户输入直接拼接路径',
+        pattern: /(?:readFile|writeFile|createReadStream|access|stat|unlink|rmdir)\w*\s*\(\s*(?:req\.|args|params|input)/g, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-22', owasp: 'A01:2021' },
+    { id: 'PATH-2', severity: 'MEDIUM', rule: 'path-traversal-join', message: '路径拼接未验证：join 使用用户输入',
+        pattern: /(?:path\.)?(?:join|resolve)\s*\([^)]*(?:req\.|args\.|params\.|input|user)/g, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-22', owasp: 'A01:2021' },
+    // 硬编码密钥
+    { id: 'SECRET-1', severity: 'HIGH', rule: 'hardcoded-secret', message: '硬编码密钥/密码',
+        pattern: /(?:password|secret|api_?key|token|auth)\s*[:=]\s*['"][^'"]{8,}['"]/gi, fileExts: ['.ts', '.js', '.mjs', '.json', '.env'], cwe: 'CWE-798', owasp: 'A07:2021' },
+    { id: 'SECRET-2', severity: 'MEDIUM', rule: 'hardcoded-jwt', message: '硬编码 JWT/Bearer token',
+        pattern: /['"](?:eyJ[A-Za-z0-9_-]+\.eyJ|Bearer\s+[A-Za-z0-9_-]{20,})['"]/g, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-798', owasp: 'A07:2021' },
+    // 不安全的随机数
+    { id: 'RAND-1', severity: 'MEDIUM', rule: 'insecure-random', message: '不安全的随机数：Math.random() 用于安全场景',
+        pattern: /(?:token|secret|password|key|salt|nonce|iv)\s*=.*Math\.random/gi, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-330', owasp: 'A02:2021' },
+    // 未验证的重定向
+    { id: 'REDIR-1', severity: 'MEDIUM', rule: 'open-redirect', message: '可能的开放重定向',
+        pattern: /(?:redirect|location)\s*[=(]\s*(?:req\.|args|params|query)/g, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-601', owasp: 'A01:2021' },
+    // 不安全的 CORS
+    { id: 'CORS-1', severity: 'MEDIUM', rule: 'cors-wildcard', message: 'CORS 配置使用通配符 *',
+        pattern: /['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/g, fileExts: ['.ts', '.js', '.mjs'] },
+    // 原型污染
+    { id: 'PROTO-1', severity: 'HIGH', rule: 'prototype-pollution', message: '可能的原型污染：动态属性赋值',
+        pattern: /\[(?:key|prop|name|attr|field)\]\s*=/g, fileExts: ['.ts', '.js', '.mjs'], cwe: 'CWE-1321', owasp: 'A08:2021' },
+    // 不安全的反序列化
+    { id: 'DESER-1', severity: 'HIGH', rule: 'unsafe-deserialize', message: '不安全的反序列化',
+        pattern: /(?:unserialize|deserialize|yaml\.load|pickle\.loads)\s*\(/g, fileExts: ['.ts', '.js', '.py'], cwe: 'CWE-502', owasp: 'A08:2021' },
+    // 敏感信息泄露
+    { id: 'LEAK-1', severity: 'MEDIUM', rule: 'sensitive-log', message: '可能泄露敏感信息到日志',
+        pattern: /console\.(?:log|info|warn|error)\s*\([^)]*(?:password|secret|token|key|credential)/gi, fileExts: ['.ts', '.js', '.mjs'] },
+    // 不安全的 HTTP
+    { id: 'HTTP-1', severity: 'LOW', rule: 'insecure-http', message: '使用不安全的 HTTP（非 HTTPS）',
+        pattern: /['"]http:\/\/(?!localhost|127\.0\.0\.1|0\.0\.0\.0)/g, fileExts: ['.ts', '.js', '.mjs'] },
+];
+//# sourceMappingURL=seed.js.map