@nahisaho/musubix-security 1.8.0 → 1.8.1

package/dist/analyzers/sast/interprocedural-analyzer.d.ts

@@ -0,0 +1,276 @@
+/**
+ * @fileoverview Interprocedural Analyzer for Cross-Function Data Flow Analysis
+ * @module @nahisaho/musubix-security/analyzers/sast/interprocedural-analyzer
+ * @trace DES-SEC2-SAST-004, REQ-SEC2-SAST-004
+ */
+import type { Vulnerability, Severity, SourceLocation } from '../../types/vulnerability.js';
+/**
+ * Interprocedural analysis result
+ */
+export interface InterproceduralResult {
+    vulnerabilities: InterproceduralVulnerability[];
+    callGraph: CallGraph;
+    dataFlowPaths: DataFlowPath[];
+    analysisMetrics: AnalysisMetrics;
+}
+/**
+ * Interprocedural vulnerability
+ */
+export interface InterproceduralVulnerability {
+    id: string;
+    type: 'taint-propagation' | 'privilege-escalation' | 'data-leakage' | 'injection';
+    severity: Severity;
+    entryPoint: SourceLocation;
+    sinkPoint: SourceLocation;
+    dataFlowPath: DataFlowPath;
+    description: string;
+    recommendation: string;
+    confidence: number;
+}
+/**
+ * Call graph
+ */
+export interface CallGraph {
+    nodes: CallGraphNode[];
+    edges: CallGraphEdge[];
+    entryPoints: string[];
+    sinks: string[];
+}
+/**
+ * Call graph node
+ */
+export interface CallGraphNode {
+    id: string;
+    name: string;
+    file: string;
+    line: number;
+    type: 'function' | 'method' | 'constructor' | 'callback' | 'anonymous';
+    isAsync: boolean;
+    parameters: ParameterInfo[];
+    returnType?: string;
+    modifiers: string[];
+}
+/**
+ * Call graph edge
+ */
+export interface CallGraphEdge {
+    source: string;
+    target: string;
+    callSite: SourceLocation;
+    callType: 'direct' | 'indirect' | 'virtual' | 'callback';
+    arguments: ArgumentBinding[];
+}
+/**
+ * Parameter information
+ */
+export interface ParameterInfo {
+    name: string;
+    index: number;
+    type?: string;
+    isTainted: boolean;
+    taintSource?: string;
+}
+/**
+ * Argument binding
+ */
+export interface ArgumentBinding {
+    parameterIndex: number;
+    expression: string;
+    isTainted: boolean;
+    taintSource?: string;
+}
+/**
+ * Data flow path
+ */
+export interface DataFlowPath {
+    id: string;
+    source: DataFlowNode;
+    sink: DataFlowNode;
+    intermediateNodes: DataFlowNode[];
+    taintType: string;
+    confidence: number;
+    isSanitized: boolean;
+    sanitizationPoint?: DataFlowNode;
+}
+/**
+ * Data flow node
+ */
+export interface DataFlowNode {
+    id: string;
+    expression: string;
+    location: SourceLocation;
+    nodeType: 'source' | 'sink' | 'transform' | 'sanitizer' | 'propagator';
+    taintState: 'tainted' | 'sanitized' | 'unknown';
+}
+/**
+ * Analysis metrics
+ */
+export interface AnalysisMetrics {
+    totalFunctions: number;
+    totalCallSites: number;
+    analysisDepth: number;
+    executionTime: number;
+    nodesVisited: number;
+    pathsAnalyzed: number;
+}
+/**
+ * Analysis options
+ */
+export interface InterproceduralOptions {
+    /** Maximum call depth to analyze */
+    maxDepth?: number;
+    /** Analysis timeout in milliseconds */
+    timeout?: number;
+    /** Maximum nodes to visit */
+    maxNodes?: number;
+    /** Enable context-sensitive analysis */
+    contextSensitive?: boolean;
+    /** Track implicit data flows */
+    trackImplicitFlows?: boolean;
+    /** Custom source definitions */
+    customSources?: TaintSourceDef[];
+    /** Custom sink definitions */
+    customSinks?: TaintSinkDef[];
+    /** Custom sanitizer definitions */
+    customSanitizers?: SanitizerDef[];
+}
+/**
+ * Taint source definition
+ */
+export interface TaintSourceDef {
+    pattern: RegExp;
+    type: string;
+    description: string;
+}
+/**
+ * Taint sink definition
+ */
+export interface TaintSinkDef {
+    pattern: RegExp;
+    type: string;
+    vulnerabilityType: string;
+    severity: Severity;
+}
+/**
+ * Sanitizer definition
+ */
+export interface SanitizerDef {
+    pattern: RegExp;
+    sanitizes: string[];
+}
+/**
+ * Interprocedural Analyzer
+ * @trace DES-SEC2-SAST-004
+ */
+export declare class InterproceduralAnalyzer {
+    private options;
+    private sources;
+    private sinks;
+    private sanitizers;
+    private callGraph;
+    private visitedNodes;
+    private analysisStartTime;
+    constructor(options?: InterproceduralOptions);
+    /**
+     * Analyze code for interprocedural vulnerabilities
+     * @trace REQ-SEC2-SAST-004
+     */
+    analyze(code: string, filePath: string): Promise<InterproceduralResult>;
+    /**
+     * Build call graph from code
+     */
+    buildCallGraph(code: string, filePath: string): CallGraph;
+    /**
+     * Track data flow across functions
+     */
+    trackDataFlow(code: string, filePath: string): DataFlowPath[];
+    /**
+     * Detect vulnerabilities from data flow paths
+     */
+    private detectVulnerabilities;
+    /**
+     * Find taint sources in code
+     */
+    private findTaintSources;
+    /**
+     * Find taint sinks in code
+     */
+    private findTaintSinks;
+    /**
+     * Trace flow from source to sinks
+     */
+    private traceFlowToSinks;
+    /**
+     * Find intermediate nodes between source and sink
+     */
+    private findIntermediateNodes;
+    /**
+     * Find sanitization point in intermediate nodes
+     */
+    private findSanitizationPoint;
+    /**
+     * Calculate path confidence
+     */
+    private calculatePathConfidence;
+    /**
+     * Check if analysis should stop
+     */
+    private shouldStopAnalysis;
+    /**
+     * Determine node type
+     */
+    private determineNodeType;
+    /**
+     * Parse function parameters
+     */
+    private parseParameters;
+    /**
+     * Extract function modifiers
+     */
+    private extractModifiers;
+    /**
+     * Check if function is an entry point
+     */
+    private isEntryPoint;
+    /**
+     * Check if function is a sink
+     */
+    private isSinkFunction;
+    /**
+     * Extract function body
+     */
+    private extractFunctionBody;
+    /**
+     * Determine call type
+     */
+    private determineCallType;
+    /**
+     * Parse arguments at call site
+     */
+    private parseArguments;
+    /**
+     * Generate vulnerability description
+     */
+    private generateDescription;
+    /**
+     * Generate recommendation
+     */
+    private generateRecommendation;
+    /**
+     * Convert results to standard vulnerability format
+     */
+    toVulnerabilities(result: InterproceduralResult): Vulnerability[];
+    /**
+     * Get CWE IDs for vulnerability type
+     */
+    private getCWEsForType;
+    /**
+     * Get OWASP IDs for vulnerability type
+     */
+    private getOWASPForType;
+}
+/**
+ * Create interprocedural analyzer instance
+ */
+export declare function createInterproceduralAnalyzer(options?: InterproceduralOptions): InterproceduralAnalyzer;
+//# sourceMappingURL=interprocedural-analyzer.d.ts.map

package/dist/analyzers/sast/interprocedural-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interprocedural-analyzer.d.ts","sourceRoot":"","sources":["../../../src/analyzers/sast/interprocedural-analyzer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAE3G;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,4BAA4B,EAAE,CAAC;IAChD,SAAS,EAAE,SAAS,CAAC;IACrB,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,eAAe,EAAE,eAAe,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,mBAAmB,GAAG,sBAAsB,GAAG,cAAc,GAAG,WAAW,CAAC;IAClF,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,cAAc,CAAC;IAC3B,SAAS,EAAE,cAAc,CAAC;IAC1B,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;IACvE,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,CAAC;IACzD,SAAS,EAAE,eAAe,EAAE,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,iBAAiB,EAAE,YAAY,EAAE,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC;IACvE,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gCAAgC;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gCAAgC;IAChC,aAAa,CAAC,EAAE,cAAc,EAAE,CAAC;IACjC,8BAA8B;IAC9B,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;IAC7B,mCAAmC;IACnC,gBAAgB,CAAC,EAAE,YAAY,EAAE,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AA0CD;;;GAGG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,UAAU,CAAiB;IACnC,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,YAAY,CAAc;IAClC,OAAO,CAAC,iBAAiB,CAAS;gBAEtB,OAAO,GAAE,sBAA2B;IAkBhD;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA8B7E;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS;IAwGzD;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE;IAoC7D;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA8B7B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IA6BxB;;OAEG;IACH,OAAO,CAAC,cAAc;IA6BtB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkCxB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAuD7B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA6B/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IASzB;;OAEG;IACH,OAAO,CAAC,eAAe;IAevB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;OAEG;IACH,OAAO,CAAC,YAAY;IAapB;;OAEG;IACH,OAAO,CAAC,cAAc;IAKtB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAoC3B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAkCtB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAQ3B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAe9B;;OAEG;IACH,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,GAAG,aAAa,EAAE;IAiBjE;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;IACH,OAAO,CAAC,eAAe;CASxB;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,CAAC,EAAE,sBAAsB,GAC/B,uBAAuB,CAEzB"}