@nahisaho/musubix-security 1.8.0

package/dist/analysis/secret-detector.js

@@ -0,0 +1,465 @@
+/**
+ * @fileoverview Secret detection engine
+ * @module @nahisaho/musubix-security/analysis/secret-detector
+ * @trace REQ-SEC-SECRET-001, REQ-SEC-SECRET-002
+ */
+import { createHash } from 'node:crypto';
+import { createFileScanner } from '../infrastructure/file-scanner.js';
+/**
+ * Generate secret ID
+ */
+let secretCounter = 0;
+function generateSecretId() {
+    const date = new Date();
+    const dateStr = date.toISOString().slice(0, 10).replace(/-/g, '');
+    return `SEC-${dateStr}-${String(++secretCounter).padStart(3, '0')}`;
+}
+/**
+ * Reset secret counter (for testing)
+ */
+export function resetSecretCounter() {
+    secretCounter = 0;
+}
+/**
+ * Built-in secret patterns with regex
+ */
+const SECRET_PATTERNS = [
+    // AWS
+    {
+        id: 'aws-access-key',
+        name: 'AWS Access Key ID',
+        type: 'aws-access-key',
+        regex: /\b(AKIA[0-9A-Z]{16})\b/g,
+        severity: 'critical',
+        description: 'AWS Access Key ID',
+        enabled: true,
+        testValuePatterns: [/AKIAIOSFODNN7EXAMPLE/],
+    },
+    {
+        id: 'aws-secret-key',
+        name: 'AWS Secret Access Key',
+        type: 'aws-secret-key',
+        regex: /\b([A-Za-z0-9/+=]{40})\b/g,
+        keyPatterns: [/aws.?secret/i, /secret.?key/i],
+        severity: 'critical',
+        description: 'AWS Secret Access Key',
+        enabled: true,
+        testValuePatterns: [/wJalrXUtnFEMI\/K7MDENG\/bPxRfiCYEXAMPLEKEY/],
+    },
+    // GitHub
+    {
+        id: 'github-pat',
+        name: 'GitHub Personal Access Token',
+        type: 'github-token',
+        regex: /\b(ghp_[a-zA-Z0-9]{36}|gho_[a-zA-Z0-9]{36}|ghu_[a-zA-Z0-9]{36}|ghs_[a-zA-Z0-9]{36}|ghr_[a-zA-Z0-9]{36})\b/g,
+        severity: 'critical',
+        description: 'GitHub Personal Access Token',
+        enabled: true,
+    },
+    {
+        id: 'github-oauth',
+        name: 'GitHub OAuth Access Token',
+        type: 'github-token',
+        regex: /\b(gho_[a-zA-Z0-9]{36})\b/g,
+        severity: 'critical',
+        description: 'GitHub OAuth Access Token',
+        enabled: true,
+    },
+    // Private keys
+    {
+        id: 'private-key-rsa',
+        name: 'RSA Private Key',
+        type: 'private-key',
+        regex: /-----BEGIN RSA PRIVATE KEY-----[\s\S]*?-----END RSA PRIVATE KEY-----/g,
+        severity: 'critical',
+        description: 'RSA Private Key',
+        enabled: true,
+    },
+    {
+        id: 'private-key-ec',
+        name: 'EC Private Key',
+        type: 'private-key',
+        regex: /-----BEGIN EC PRIVATE KEY-----[\s\S]*?-----END EC PRIVATE KEY-----/g,
+        severity: 'critical',
+        description: 'EC Private Key',
+        enabled: true,
+    },
+    {
+        id: 'private-key-openssh',
+        name: 'OpenSSH Private Key',
+        type: 'ssh-key',
+        regex: /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g,
+        severity: 'critical',
+        description: 'OpenSSH Private Key',
+        enabled: true,
+    },
+    // Azure
+    {
+        id: 'azure-storage-key',
+        name: 'Azure Storage Account Key',
+        type: 'azure-connection-string',
+        regex: /AccountKey=[a-zA-Z0-9+/=]{86,88}/g,
+        severity: 'critical',
+        description: 'Azure Storage Account Key',
+        enabled: true,
+    },
+    {
+        id: 'azure-connection-string',
+        name: 'Azure Connection String',
+        type: 'azure-connection-string',
+        regex: /DefaultEndpointsProtocol=https?;AccountName=[^;]+;AccountKey=[a-zA-Z0-9+/=]+/g,
+        severity: 'critical',
+        description: 'Azure Storage Connection String',
+        enabled: true,
+    },
+    // Stripe
+    {
+        id: 'stripe-live-key',
+        name: 'Stripe Live API Key',
+        type: 'stripe-key',
+        regex: /\b(sk_live_[a-zA-Z0-9]{24,})\b/g,
+        severity: 'critical',
+        description: 'Stripe Live Secret Key',
+        enabled: true,
+    },
+    {
+        id: 'stripe-test-key',
+        name: 'Stripe Test API Key',
+        type: 'stripe-key',
+        regex: /\b(sk_test_[a-zA-Z0-9]{24,})\b/g,
+        severity: 'low',
+        description: 'Stripe Test Secret Key',
+        enabled: true,
+    },
+    // Slack
+    {
+        id: 'slack-webhook',
+        name: 'Slack Webhook URL',
+        type: 'slack-webhook',
+        regex: /https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]+\/[A-Z0-9]+\/[a-zA-Z0-9]+/g,
+        severity: 'medium',
+        description: 'Slack Incoming Webhook URL',
+        enabled: true,
+    },
+    {
+        id: 'slack-token',
+        name: 'Slack Token',
+        type: 'api-key',
+        regex: /\b(xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,})\b/g,
+        severity: 'high',
+        description: 'Slack Bot/User Token',
+        enabled: true,
+    },
+    // Database URLs
+    {
+        id: 'database-url-postgres',
+        name: 'PostgreSQL Connection String',
+        type: 'database-url',
+        regex: /postgres(?:ql)?:\/\/[^:]+:[^@]+@[^/]+\/[^\s'"]+/gi,
+        severity: 'high',
+        description: 'PostgreSQL connection string with credentials',
+        enabled: true,
+    },
+    {
+        id: 'database-url-mysql',
+        name: 'MySQL Connection String',
+        type: 'database-url',
+        regex: /mysql:\/\/[^:]+:[^@]+@[^/]+\/[^\s'"]+/gi,
+        severity: 'high',
+        description: 'MySQL connection string with credentials',
+        enabled: true,
+    },
+    {
+        id: 'database-url-mongodb',
+        name: 'MongoDB Connection String',
+        type: 'database-url',
+        regex: /mongodb(\+srv)?:\/\/[^:]+:[^@]+@[^/]+\/[^\s'"]+/gi,
+        severity: 'high',
+        description: 'MongoDB connection string with credentials',
+        enabled: true,
+    },
+    // JWT
+    {
+        id: 'jwt-token',
+        name: 'JWT Token',
+        type: 'jwt-secret',
+        regex: /\beyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+\b/g,
+        severity: 'medium',
+        description: 'JSON Web Token (may contain sensitive claims)',
+        enabled: true,
+    },
+    // Generic API keys
+    {
+        id: 'generic-api-key',
+        name: 'Generic API Key',
+        type: 'api-key',
+        regex: /\b[a-f0-9]{32}\b/gi,
+        keyPatterns: [/api.?key/i, /apikey/i, /secret/i, /token/i, /password/i],
+        severity: 'medium',
+        description: 'Generic API key pattern',
+        enabled: true,
+        falsePositiveRate: 0.4,
+    },
+    // Password patterns
+    {
+        id: 'hardcoded-password',
+        name: 'Hardcoded Password',
+        type: 'password',
+        regex: /(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/gi,
+        severity: 'high',
+        description: 'Hardcoded password in code',
+        enabled: true,
+    },
+];
+/**
+ * Common test/example value patterns
+ */
+const TEST_VALUE_PATTERNS = [
+    /example/i,
+    /test/i,
+    /dummy/i,
+    /sample/i,
+    /placeholder/i,
+    /your.?key/i,
+    /xxx+/i,
+    /000+/,
+    /123456/,
+    /abcdef/,
+];
+/**
+ * Detect context from surrounding code
+ */
+function detectContext(content, matchIndex) {
+    const before = content.slice(Math.max(0, matchIndex - 50), matchIndex);
+    const after = content.slice(matchIndex, matchIndex + 50);
+    if (/\/\/|\/\*|\*/.test(before))
+        return 'comment';
+    if (/['"]/.test(before) && /['"]/.test(after))
+        return 'string-literal';
+    if (/`/.test(before))
+        return 'template-literal';
+    if (/[{,]\s*\w+\s*:\s*$/.test(before))
+        return 'object-property';
+    if (/\[\s*$/.test(before))
+        return 'array-element';
+    if (/\.(env|config|json|ya?ml)$/.test(content.slice(0, 100)))
+        return 'config-file';
+    return 'source-code';
+}
+/**
+ * Mask a secret value
+ */
+function maskValue(value) {
+    if (value.length <= 8) {
+        return '*'.repeat(value.length);
+    }
+    return `${value.slice(0, 4)}${'*'.repeat(value.length - 8)}${value.slice(-4)}`;
+}
+/**
+ * Hash a value for deduplication
+ */
+function hashValue(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+/**
+ * Check if a value looks like a test/example
+ */
+function isTestValue(value, pattern) {
+    // Check pattern-specific test values
+    if (pattern.testValuePatterns) {
+        for (const testPattern of pattern.testValuePatterns) {
+            if (testPattern.test(value)) {
+                return true;
+            }
+        }
+    }
+    // Check generic test patterns
+    for (const testPattern of TEST_VALUE_PATTERNS) {
+        if (testPattern.test(value)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Get line number from index in content
+ */
+function getLineNumber(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+/**
+ * Get column from index in content
+ */
+function getColumn(content, index) {
+    const lastNewline = content.lastIndexOf('\n', index - 1);
+    return index - lastNewline - 1;
+}
+/**
+ * Secret detector engine
+ */
+export class SecretDetector {
+    patterns;
+    fileScanner;
+    options;
+    constructor(options = {}) {
+        this.options = options;
+        this.fileScanner = createFileScanner({
+            extensions: ['.ts', '.tsx', '.js', '.jsx', '.json', '.yml', '.yaml', '.env', '.config', '.md'],
+            excludePatterns: options.excludePatterns,
+            maxFileSize: options.maxFileSize,
+        });
+        // Initialize patterns
+        this.patterns = SECRET_PATTERNS.filter((p) => {
+            if (!p.enabled)
+                return false;
+            if (options.disablePatterns?.includes(p.id))
+                return false;
+            return true;
+        });
+        // Add custom patterns
+        if (options.customPatterns) {
+            this.patterns.push(...options.customPatterns);
+        }
+    }
+    /**
+     * Scan file content for secrets
+     */
+    scanContent(content, filePath) {
+        const secrets = [];
+        const seenHashes = new Set();
+        for (const pattern of this.patterns) {
+            // Reset regex state
+            pattern.regex.lastIndex = 0;
+            // Check key patterns first if defined (for context-sensitive detection)
+            if (pattern.keyPatterns) {
+                let hasKeyContext = false;
+                for (const keyPattern of pattern.keyPatterns) {
+                    if (keyPattern.test(content)) {
+                        hasKeyContext = true;
+                        break;
+                    }
+                }
+                if (!hasKeyContext)
+                    continue;
+            }
+            let match;
+            while ((match = pattern.regex.exec(content)) !== null) {
+                const value = match[1] || match[0];
+                const hash = hashValue(value);
+                // Skip duplicates
+                if (seenHashes.has(hash))
+                    continue;
+                seenHashes.add(hash);
+                // Check if test value
+                const testValue = isTestValue(value, pattern);
+                if (this.options.ignoreTestValues && testValue)
+                    continue;
+                const lineNumber = getLineNumber(content, match.index);
+                const column = getColumn(content, match.index);
+                // Extract key name if possible
+                const beforeMatch = content.slice(Math.max(0, match.index - 50), match.index);
+                const keyNameMatch = beforeMatch.match(/(\w+)\s*[=:]\s*['"]?\s*$/);
+                const keyName = keyNameMatch ? keyNameMatch[1] : undefined;
+                const location = {
+                    file: filePath,
+                    startLine: lineNumber,
+                    endLine: lineNumber,
+                    startColumn: column,
+                    endColumn: column + value.length,
+                };
+                secrets.push({
+                    id: generateSecretId(),
+                    type: pattern.type,
+                    location,
+                    maskedValue: maskValue(value),
+                    valueHash: hash,
+                    keyName,
+                    context: detectContext(content, match.index),
+                    confidence: pattern.falsePositiveRate ? 1 - pattern.falsePositiveRate : 0.9,
+                    isTestValue: testValue,
+                    patternId: pattern.id,
+                    detectedAt: new Date(),
+                    severity: pattern.severity,
+                });
+            }
+        }
+        return secrets;
+    }
+    /**
+     * Scan a single file
+     */
+    async scanFile(filePath) {
+        const content = await this.fileScanner.readFile(filePath);
+        return this.scanContent(content, filePath);
+    }
+    /**
+     * Scan a directory for secrets
+     */
+    async scan(rootPath) {
+        const startTime = Date.now();
+        const files = await this.fileScanner.scan(rootPath);
+        const allSecrets = [];
+        let scannedFiles = 0;
+        let skippedFiles = 0;
+        for (const file of files) {
+            try {
+                const content = await this.fileScanner.readFileSafe(file.path);
+                if (!content) {
+                    skippedFiles++;
+                    continue;
+                }
+                const secrets = this.scanContent(content, file.path);
+                allSecrets.push(...secrets);
+                scannedFiles++;
+            }
+            catch (error) {
+                console.warn(`Warning: Failed to scan ${file.path}: ${error}`);
+                skippedFiles++;
+            }
+        }
+        const duration = Date.now() - startTime;
+        // Build summary
+        const byType = {};
+        let testValuesCount = 0;
+        const bySeverity = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+        for (const secret of allSecrets) {
+            byType[secret.type] = (byType[secret.type] || 0) + 1;
+            bySeverity[secret.severity]++;
+            if (secret.isTestValue)
+                testValuesCount++;
+        }
+        return {
+            secrets: allSecrets,
+            scannedFiles,
+            skippedFiles,
+            duration,
+            timestamp: new Date(),
+            options: this.options,
+            summary: {
+                byType,
+                bySeverity,
+                total: allSecrets.length,
+                testValues: testValuesCount,
+            },
+        };
+    }
+    /**
+     * Add a custom pattern
+     */
+    addPattern(pattern) {
+        this.patterns.push(pattern);
+    }
+    /**
+     * Get all patterns
+     */
+    getPatterns() {
+        return [...this.patterns];
+    }
+}
+/**
+ * Create a secret detector
+ */
+export function createSecretDetector(options) {
+    return new SecretDetector(options);
+}
+//# sourceMappingURL=secret-detector.js.map

package/dist/analysis/secret-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detector.js","sourceRoot":"","sources":["../../src/analysis/secret-detector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,OAAO,EAAe,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEnF;;GAEG;AACH,IAAI,aAAa,GAAG,CAAC,CAAC;AACtB,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,OAAO,OAAO,IAAI,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,aAAa,GAAG,CAAC,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,eAAe,GAAoB;IACvC,MAAM;IACN;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mBAAmB;QAChC,OAAO,EAAE,IAAI;QACb,iBAAiB,EAAE,CAAC,sBAAsB,CAAC;KAC5C;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;QAC7C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,IAAI;QACb,iBAAiB,EAAE,CAAC,4CAA4C,CAAC;KAClE;IACD,SAAS;IACT;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,4GAA4G;QACnH,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,2BAA2B;QACjC,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,IAAI;KACd;IACD,eAAe;IACf;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,uEAAuE;QAC9E,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,iBAAiB;QAC9B,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,qEAAqE;QAC5E,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gBAAgB;QAC7B,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,+EAA+E;QACtF,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,IAAI;KACd;IACD,QAAQ;IACR;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,2BAA2B;QACjC,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,mCAAmC;QAC1C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,+EAA+E;QACtF,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,IAAI;KACd;IACD,SAAS;IACT;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,iCAAiC;QACxC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,wBAAwB;QACrC,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,iCAAiC;QACxC,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,wBAAwB;QACrC,OAAO,EAAE,IAAI;KACd;IACD,QAAQ;IACR;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,4EAA4E;QACnF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,8DAA8D;QACrE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,sBAAsB;QACnC,OAAO,EAAE,IAAI;KACd;IACD,gBAAgB;IAChB;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,mDAAmD;QAC1D,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,yCAAyC;QAChD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,2BAA2B;QACjC,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,mDAAmD;QAC1D,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE,IAAI;KACd;IACD,MAAM;IACN;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,2DAA2D;QAClE,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,IAAI;KACd;IACD,mBAAmB;IACnB;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC;QACvE,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,IAAI;QACb,iBAAiB,EAAE,GAAG;KACvB;IACD,oBAAoB;IACpB;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,sDAAsD;QAC7D,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,UAAU;IACV,OAAO;IACP,QAAQ;IACR,SAAS;IACT,cAAc;IACd,YAAY;IACZ,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF;;GAEG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,UAAkB;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;IAEzD,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACvE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAChD,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAChE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IAClD,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IAEnF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa,EAAE,OAAsB;IACxD,qCAAqC;IACrC,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACpD,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,WAAW,IAAI,mBAAmB,EAAE,CAAC;QAC9C,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa;IACnD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,KAAK,GAAG,WAAW,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAkB;IAC1B,WAAW,CAAc;IACzB,OAAO,CAAoB;IAEnC,YAAY,UAA6B,EAAE;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC;YACnC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC;YAC9F,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QAEH,sBAAsB;QACtB,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3C,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC7B,IAAI,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,sBAAsB;QACtB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAAe,EAAE,QAAgB;QAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,oBAAoB;YACpB,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YAE5B,wEAAwE;YACxE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxB,IAAI,aAAa,GAAG,KAAK,CAAC;gBAC1B,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBAC7C,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC7B,aAAa,GAAG,IAAI,CAAC;wBACrB,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,aAAa;oBAAE,SAAS;YAC/B,CAAC;YAED,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACtD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBAE9B,kBAAkB;gBAClB,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACnC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAErB,sBAAsB;gBACtB,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,SAAS;oBAAE,SAAS;gBAEzD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAE/C,+BAA+B;gBAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC9E,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBACnE,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAE3D,MAAM,QAAQ,GAAmB;oBAC/B,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,UAAU;oBACrB,OAAO,EAAE,UAAU;oBACnB,WAAW,EAAE,MAAM;oBACnB,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM;iBACjC,CAAC;gBAEF,OAAO,CAAC,IAAI,CAAC;oBACX,EAAE,EAAE,gBAAgB,EAAE;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,QAAQ;oBACR,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC;oBAC7B,SAAS,EAAE,IAAI;oBACf,OAAO;oBACP,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;oBAC5C,UAAU,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG;oBAC3E,WAAW,EAAE,SAAS;oBACtB,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,UAAU,EAAE,IAAI,IAAI,EAAE;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrD,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;gBAC5B,YAAY,EAAE,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;gBAC/D,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,gBAAgB;QAChB,MAAM,MAAM,GAAwC,EAAE,CAAC;QACvD,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,MAAM,UAAU,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAElG,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,WAAW;gBAAE,eAAe,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,YAAY;YACZ,YAAY;YACZ,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE;gBACP,MAAM;gBACN,UAAU;gBACV,KAAK,EAAE,UAAU,CAAC,MAAM;gBACxB,UAAU,EAAE,eAAe;aAC5B;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAsB;QAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA2B;IAC9D,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/analysis/taint-analyzer.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @fileoverview Taint analysis engine
+ * @module @nahisaho/musubix-security/analysis/taint-analyzer
+ * @trace REQ-SEC-TAINT-001, REQ-SEC-TAINT-002, REQ-SEC-TAINT-003, REQ-SEC-TAINT-004
+ */
+import type { TaintSource, TaintSink, TaintResult, TaintAnalysisOptions } from '../types/index.js';
+/**
+ * Reset counters (for testing)
+ */
+export declare function resetTaintCounters(): void;
+/**
+ * Taint analyzer engine
+ */
+export declare class TaintAnalyzer {
+    private parser;
+    private fileScanner;
+    private options;
+    private sourcePatterns;
+    private sinkPatterns;
+    constructor(options?: TaintAnalysisOptions);
+    /**
+     * Analyze a single file for taint issues
+     */
+    analyzeFile(filePath: string): {
+        sources: TaintSource[];
+        sinks: TaintSink[];
+    };
+    /**
+     * Find taint sources in a source file
+     */
+    private findSources;
+    /**
+     * Find taint sinks in a source file
+     */
+    private findSinks;
+    /**
+     * Trace taint flow from sources to sinks (simplified)
+     * Note: Full interprocedural analysis would require more sophisticated data flow analysis
+     */
+    private tracePaths;
+    /**
+     * Check if source and sink could be connected
+     */
+    private checkConnection;
+    /**
+     * Check if there's sanitization between source and sink
+     */
+    private checkSanitization;
+    /**
+     * Build flow steps between source and sink
+     */
+    private buildFlowSteps;
+    /**
+     * Analyze a directory for taint issues
+     */
+    analyze(rootPath: string): Promise<TaintResult>;
+}
+/**
+ * Create a taint analyzer
+ */
+export declare function createTaintAnalyzer(options?: TaintAnalysisOptions): TaintAnalyzer;
+//# sourceMappingURL=taint-analyzer.d.ts.map

package/dist/analysis/taint-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-analyzer.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-analyzer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EAGT,WAAW,EACX,oBAAoB,EAIrB,MAAM,mBAAmB,CAAC;AA6B3B;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAIzC;AAyLD;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,YAAY,CAAgB;gBAExB,OAAO,GAAE,oBAAyB;IAgC9C;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QAAC,KAAK,EAAE,SAAS,EAAE,CAAA;KAAE;IAQ7E;;OAEG;IACH,OAAO,CAAC,WAAW;IA6DnB;;OAEG;IACH,OAAO,CAAC,SAAS;IA+BjB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAgDlB;;OAEG;IACH,OAAO,CAAC,eAAe;IAYvB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAgDzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAyBtB;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;CAsFtD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,aAAa,CAEjF"}