@nahisaho/musubix-security 2.0.0 → 2.1.0

package/dist/rules/config/profiles.js

@@ -0,0 +1,226 @@
+/**
+ * @fileoverview Rule Profiles
+ * @module @nahisaho/musubix-security/rules/config/profiles
+ * @trace TSK-RULE-002
+ */
+/**
+ * Minimal profile - Essential security checks only
+ * Best for: Quick scans, CI pipelines with time constraints
+ */
+export const PROFILE_MINIMAL = {
+    name: 'minimal',
+    description: 'Essential security checks - critical and high severity only',
+    severityThreshold: 'high',
+    enableTaintAnalysis: false,
+    enableDFG: false,
+    rules: [
+        // OWASP Top 10 - Critical
+        { id: 'owasp-a01-broken-access-control' },
+        { id: 'owasp-a03-injection' },
+        { id: 'owasp-a07-auth-failures' },
+        // CWE Top 25 - Critical
+        { id: 'cwe-79-xss' },
+        { id: 'cwe-89-sql-injection' },
+        { id: 'cwe-78-os-command-injection' },
+        { id: 'cwe-22-path-traversal' },
+        { id: 'cwe-798-hardcoded-credentials' },
+        { id: 'cwe-287-improper-authentication' },
+    ],
+};
+/**
+ * Standard profile - Balanced security coverage
+ * Best for: Regular development, PR checks
+ */
+export const PROFILE_STANDARD = {
+    name: 'standard',
+    description: 'Balanced security coverage - OWASP Top 10 + CWE Top 25',
+    severityThreshold: 'medium',
+    enableTaintAnalysis: true,
+    enableDFG: false,
+    rules: [
+        // All OWASP Top 10
+        { id: 'owasp-a01-broken-access-control' },
+        { id: 'owasp-a02-cryptographic-failures' },
+        { id: 'owasp-a03-injection' },
+        { id: 'owasp-a04-insecure-design' },
+        { id: 'owasp-a05-security-misconfiguration' },
+        { id: 'owasp-a06-vulnerable-components' },
+        { id: 'owasp-a07-auth-failures' },
+        { id: 'owasp-a08-integrity-failures' },
+        { id: 'owasp-a09-logging-failures' },
+        { id: 'owasp-a10-ssrf' },
+        // CWE Top 25
+        { id: 'cwe-787-out-of-bounds-write' },
+        { id: 'cwe-79-xss' },
+        { id: 'cwe-89-sql-injection' },
+        { id: 'cwe-416-use-after-free' },
+        { id: 'cwe-78-os-command-injection' },
+        { id: 'cwe-20-improper-input-validation' },
+        { id: 'cwe-125-out-of-bounds-read' },
+        { id: 'cwe-22-path-traversal' },
+        { id: 'cwe-352-csrf' },
+        { id: 'cwe-434-file-upload' },
+        { id: 'cwe-862-missing-authorization' },
+        { id: 'cwe-476-null-pointer' },
+        { id: 'cwe-287-improper-authentication' },
+        { id: 'cwe-190-integer-overflow' },
+        { id: 'cwe-502-deserialization' },
+        { id: 'cwe-77-command-injection' },
+        { id: 'cwe-119-buffer-overflow' },
+        { id: 'cwe-798-hardcoded-credentials' },
+        { id: 'cwe-918-ssrf' },
+        { id: 'cwe-306-missing-auth-critical' },
+        { id: 'cwe-362-race-condition' },
+        { id: 'cwe-269-improper-privilege' },
+        { id: 'cwe-94-code-injection' },
+        { id: 'cwe-863-incorrect-authorization' },
+        { id: 'cwe-276-incorrect-permissions' },
+    ],
+};
+/**
+ * Strict profile - Comprehensive security analysis
+ * Best for: Security audits, pre-release checks
+ */
+export const PROFILE_STRICT = {
+    name: 'strict',
+    description: 'Comprehensive security analysis - all rules enabled',
+    severityThreshold: 'info',
+    enableTaintAnalysis: true,
+    enableDFG: true,
+    rules: [
+        // All rules from standard profile
+        ...PROFILE_STANDARD.rules,
+        // Additional low-priority rules
+        { id: 'cwe-200-information-exposure' },
+        { id: 'cwe-611-xxe' },
+        { id: 'cwe-1321-prototype-pollution' },
+        { id: 'cwe-400-uncontrolled-resource' },
+        { id: 'cwe-601-open-redirect' },
+        { id: 'cwe-522-weak-credentials' },
+        { id: 'cwe-732-incorrect-permission' },
+        { id: 'cwe-295-improper-cert-validation' },
+        { id: 'cwe-327-broken-crypto' },
+        { id: 'cwe-330-insufficient-randomness' },
+    ],
+};
+/**
+ * OWASP-only profile - OWASP Top 10 focus
+ */
+export const PROFILE_OWASP = {
+    name: 'owasp',
+    description: 'OWASP Top 10 2021 focused analysis',
+    severityThreshold: 'medium',
+    enableTaintAnalysis: true,
+    enableDFG: false,
+    rules: [
+        { id: 'owasp-a01-broken-access-control' },
+        { id: 'owasp-a02-cryptographic-failures' },
+        { id: 'owasp-a03-injection' },
+        { id: 'owasp-a04-insecure-design' },
+        { id: 'owasp-a05-security-misconfiguration' },
+        { id: 'owasp-a06-vulnerable-components' },
+        { id: 'owasp-a07-auth-failures' },
+        { id: 'owasp-a08-integrity-failures' },
+        { id: 'owasp-a09-logging-failures' },
+        { id: 'owasp-a10-ssrf' },
+    ],
+};
+/**
+ * CWE-only profile - CWE Top 25 focus
+ */
+export const PROFILE_CWE = {
+    name: 'cwe',
+    description: 'CWE Top 25 2023 focused analysis',
+    severityThreshold: 'medium',
+    enableTaintAnalysis: true,
+    enableDFG: false,
+    rules: [
+        { id: 'cwe-787-out-of-bounds-write' },
+        { id: 'cwe-79-xss' },
+        { id: 'cwe-89-sql-injection' },
+        { id: 'cwe-416-use-after-free' },
+        { id: 'cwe-78-os-command-injection' },
+        { id: 'cwe-20-improper-input-validation' },
+        { id: 'cwe-125-out-of-bounds-read' },
+        { id: 'cwe-22-path-traversal' },
+        { id: 'cwe-352-csrf' },
+        { id: 'cwe-434-file-upload' },
+        { id: 'cwe-862-missing-authorization' },
+        { id: 'cwe-476-null-pointer' },
+        { id: 'cwe-287-improper-authentication' },
+        { id: 'cwe-190-integer-overflow' },
+        { id: 'cwe-502-deserialization' },
+        { id: 'cwe-77-command-injection' },
+        { id: 'cwe-119-buffer-overflow' },
+        { id: 'cwe-798-hardcoded-credentials' },
+        { id: 'cwe-918-ssrf' },
+        { id: 'cwe-306-missing-auth-critical' },
+        { id: 'cwe-362-race-condition' },
+        { id: 'cwe-269-improper-privilege' },
+        { id: 'cwe-94-code-injection' },
+        { id: 'cwe-863-incorrect-authorization' },
+        { id: 'cwe-276-incorrect-permissions' },
+    ],
+};
+/**
+ * All available profiles
+ */
+export const PROFILES = {
+    minimal: PROFILE_MINIMAL,
+    standard: PROFILE_STANDARD,
+    strict: PROFILE_STRICT,
+    owasp: PROFILE_OWASP,
+    cwe: PROFILE_CWE,
+};
+/**
+ * Get profile by name
+ */
+export function getProfile(name) {
+    return PROFILES[name.toLowerCase()];
+}
+/**
+ * Get all profile names
+ */
+export function getProfileNames() {
+    return Object.keys(PROFILES);
+}
+/**
+ * Check if profile exists
+ */
+export function hasProfile(name) {
+    return name.toLowerCase() in PROFILES;
+}
+/**
+ * Get rule IDs from profile
+ */
+export function getProfileRuleIds(profileName) {
+    const profile = getProfile(profileName);
+    if (!profile)
+        return [];
+    return profile.rules.map(r => r.id);
+}
+/**
+ * Merge profile with custom config
+ */
+export function mergeProfileConfig(profileName, customRules = {}) {
+    const profile = getProfile(profileName);
+    if (!profile)
+        return [];
+    const merged = new Map();
+    // Add profile rules
+    for (const rule of profile.rules) {
+        merged.set(rule.id, { ...rule });
+    }
+    // Apply custom overrides
+    for (const [ruleId, config] of Object.entries(customRules)) {
+        const existing = merged.get(ruleId);
+        if (existing) {
+            merged.set(ruleId, { ...existing, ...config });
+        }
+        else if (config.enabled !== false) {
+            merged.set(ruleId, { id: ruleId, ...config });
+        }
+    }
+    return Array.from(merged.values());
+}
+//# sourceMappingURL=profiles.js.map

package/dist/rules/config/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/rules/config/profiles.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkCH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgB;IAC1C,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,6DAA6D;IAC1E,iBAAiB,EAAE,MAAM;IACzB,mBAAmB,EAAE,KAAK;IAC1B,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE;QACL,0BAA0B;QAC1B,EAAE,EAAE,EAAE,iCAAiC,EAAE;QACzC,EAAE,EAAE,EAAE,qBAAqB,EAAE;QAC7B,EAAE,EAAE,EAAE,yBAAyB,EAAE;QACjC,wBAAwB;QACxB,EAAE,EAAE,EAAE,YAAY,EAAE;QACpB,EAAE,EAAE,EAAE,sBAAsB,EAAE;QAC9B,EAAE,EAAE,EAAE,6BAA6B,EAAE;QACrC,EAAE,EAAE,EAAE,uBAAuB,EAAE;QAC/B,EAAE,EAAE,EAAE,+BAA+B,EAAE;QACvC,EAAE,EAAE,EAAE,iCAAiC,EAAE;KAC1C;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAgB;IAC3C,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,wDAAwD;IACrE,iBAAiB,EAAE,QAAQ;IAC3B,mBAAmB,EAAE,IAAI;IACzB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE;QACL,mBAAmB;QACnB,EAAE,EAAE,EAAE,iCAAiC,EAAE;QACzC,EAAE,EAAE,EAAE,kCAAkC,EAAE;QAC1C,EAAE,EAAE,EAAE,qBAAqB,EAAE;QAC7B,EAAE,EAAE,EAAE,2BAA2B,EAAE;QACnC,EAAE,EAAE,EAAE,qCAAqC,EAAE;QAC7C,EAAE,EAAE,EAAE,iCAAiC,EAAE;QACzC,EAAE,EAAE,EAAE,yBAAyB,EAAE;QACjC,EAAE,EAAE,EAAE,8BAA8B,EAAE;QACtC,EAAE,EAAE,EAAE,4BAA4B,EAAE;QACpC,EAAE,EAAE,EAAE,gBAAgB,EAAE;QACxB,aAAa;QACb,EAAE,EAAE,EAAE,6BAA6B,EAAE;QACrC,EAAE,EAAE,EAAE,YAAY,EAAE;QACpB,EAAE,EAAE,EAAE,sBAAsB,EAAE;QAC9B,EAAE,EAAE,EAAE,wBAAwB,EAAE;QAChC,EAAE,EAAE,EAAE,6BAA6B,EAAE;QACrC,EAAE,EAAE,EAAE,kCAAkC,EAAE;QAC1C,EAAE,EAAE,EAAE,4BAA4B,EAAE;QACpC,EAAE,EAAE,EAAE,uBAAuB,EAAE;QAC/B,EAAE,EAAE,EAAE,cAAc,EAAE;QACtB,EAAE,EAAE,EAAE,qBAAqB,EAAE;QAC7B,EAAE,EAAE,EAAE,+BAA+B,EAAE;QACvC,EAAE,EAAE,EAAE,sBAAsB,EAAE;QAC9B,EAAE,EAAE,EAAE,iCAAiC,EAAE;QACzC,EAAE,EAAE,EAAE,0BAA0B,EAAE;QAClC,EAAE,EAAE,EAAE,yBAAyB,EAAE;QACjC,EAAE,EAAE,EAAE,0BAA0B,EAAE;QAClC,EAAE,EAAE,EAAE,yBAAyB,EAAE;QACjC,EAAE,EAAE,EAAE,+BAA+B,EAAE;QACvC,EAAE,EAAE,EAAE,cAAc,EAAE;QACtB,EAAE,EAAE,EAAE,+BAA+B,EAAE;QACvC,EAAE,EAAE,EAAE,wBAAwB,EAAE;QAChC,EAAE,EAAE,EAAE,4BAA4B,EAAE;QACpC,EAAE,EAAE,EAAE,uBAAuB,EAAE;QAC/B,EAAE,EAAE,EAAE,iCAAiC,EAAE;QACzC,EAAE,EAAE,EAAE,+BAA+B,EAAE;KACxC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,qDAAqD;IAClE,iBAAiB,EAAE,MAAM;IACzB,mBAAmB,EAAE,IAAI;IACzB,SAAS,EAAE,IAAI;IACf,KAAK,EAAE;QACL,kCAAkC;QAClC,GAAG,gBAAgB,CAAC,KAAK;QACzB,gCAAgC;QAChC,EAAE,EAAE,EAAE,8BAA8B,EAAE;QACtC,EAAE,EAAE,EAAE,aAAa,EAAE;QACrB,EAAE,EAAE,EAAE,8BAA8B,EAAE;QACtC,EAAE,EAAE,EAAE,+BAA+B,EAAE;QACvC,EAAE,EAAE,EAAE,uBAAuB,EAAE;QAC/B,EAAE,EAAE,EAAE,0BAA0B,EAAE;QAClC,EAAE,EAAE,EAAE,8BAA8B,EAAE;QACtC,EAAE,EAAE,EAAE,kCAAkC,EAAE;QAC1C,EAAE,EAAE,EAAE,uBAAuB,EAAE;QAC/B,EAAE,EAAE,EAAE,iCAAiC,EAAE;KAC1C;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAgB;IACxC,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,oCAAoC;IACjD,iBAAiB,EAAE,QAAQ;IAC3B,mBAAmB,EAAE,IAAI;IACzB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE;QACL,EAAE,EAAE,EAAE,iCAAiC,EAAE;QACzC,EAAE,EAAE,EAAE,kCAAkC,EAAE;QAC1C,EAAE,EAAE,EAAE,qBAAqB,EAAE;QAC7B,EAAE,EAAE,EAAE,2BAA2B,EAAE;QACnC,EAAE,EAAE,EAAE,qCAAqC,EAAE;QAC7C,EAAE,EAAE,EAAE,iCAAiC,EAAE;QACzC,EAAE,EAAE,EAAE,yBAAyB,EAAE;QACjC,EAAE,EAAE,EAAE,8BAA8B,EAAE;QACtC,EAAE,EAAE,EAAE,4BAA4B,EAAE;QACpC,EAAE,EAAE,EAAE,gBAAgB,EAAE;KACzB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,kCAAkC;IAC/C,iBAAiB,EAAE,QAAQ;IAC3B,mBAAmB,EAAE,IAAI;IACzB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE;QACL,EAAE,EAAE,EAAE,6BAA6B,EAAE;QACrC,EAAE,EAAE,EAAE,YAAY,EAAE;QACpB,EAAE,EAAE,EAAE,sBAAsB,EAAE;QAC9B,EAAE,EAAE,EAAE,wBAAwB,EAAE;QAChC,EAAE,EAAE,EAAE,6BAA6B,EAAE;QACrC,EAAE,EAAE,EAAE,kCAAkC,EAAE;QAC1C,EAAE,EAAE,EAAE,4BAA4B,EAAE;QACpC,EAAE,EAAE,EAAE,uBAAuB,EAAE;QAC/B,EAAE,EAAE,EAAE,cAAc,EAAE;QACtB,EAAE,EAAE,EAAE,qBAAqB,EAAE;QAC7B,EAAE,EAAE,EAAE,+BAA+B,EAAE;QACvC,EAAE,EAAE,EAAE,sBAAsB,EAAE;QAC9B,EAAE,EAAE,EAAE,iCAAiC,EAAE;QACzC,EAAE,EAAE,EAAE,0BAA0B,EAAE;QAClC,EAAE,EAAE,EAAE,yBAAyB,EAAE;QACjC,EAAE,EAAE,EAAE,0BAA0B,EAAE;QAClC,EAAE,EAAE,EAAE,yBAAyB,EAAE;QACjC,EAAE,EAAE,EAAE,+BAA+B,EAAE;QACvC,EAAE,EAAE,EAAE,cAAc,EAAE;QACtB,EAAE,EAAE,EAAE,+BAA+B,EAAE;QACvC,EAAE,EAAE,EAAE,wBAAwB,EAAE;QAChC,EAAE,EAAE,EAAE,4BAA4B,EAAE;QACpC,EAAE,EAAE,EAAE,uBAAuB,EAAE;QAC/B,EAAE,EAAE,EAAE,iCAAiC,EAAE;QACzC,EAAE,EAAE,EAAE,+BAA+B,EAAE;KACxC;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAgC;IACnD,OAAO,EAAE,eAAe;IACxB,QAAQ,EAAE,gBAAgB;IAC1B,MAAM,EAAE,cAAc;IACtB,KAAK,EAAE,aAAa;IACpB,GAAG,EAAE,WAAW;CACjB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,cAA8E,EAAE;IAEhF,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEpD,oBAAoB;IACpB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,yBAAyB;IACzB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC"}

package/dist/rules/cwe/cwe-119-buffer-overflow.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview CWE-119: Improper Restriction of Operations within Bounds of Memory Buffer
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-119-buffer-overflow
+ * @trace TSK-RULE-006
+ */
+import type { SecurityRule } from '../types.js';
+export declare const cwe119BufferOverflow: SecurityRule;
+export default cwe119BufferOverflow;
+//# sourceMappingURL=cwe-119-buffer-overflow.d.ts.map

package/dist/rules/cwe/cwe-119-buffer-overflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-119-buffer-overflow.d.ts","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-119-buffer-overflow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,aAAa,CAAC;AAE1E,eAAO,MAAM,oBAAoB,EAAE,YAiDlC,CAAC;AAEF,eAAe,oBAAoB,CAAC"}

package/dist/rules/cwe/cwe-119-buffer-overflow.js

@@ -0,0 +1,54 @@
+/**
+ * @fileoverview CWE-119: Improper Restriction of Operations within Bounds of Memory Buffer
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-119-buffer-overflow
+ * @trace TSK-RULE-006
+ */
+export const cwe119BufferOverflow = {
+    id: 'cwe-119-buffer-overflow',
+    name: 'CWE-119: Buffer Overflow',
+    description: 'Detects improper buffer boundary operations',
+    defaultSeverity: 'high',
+    category: 'memory-safety',
+    tags: ['cwe', 'buffer', 'memory', 'security'],
+    cwe: ['119'],
+    references: [
+        { title: 'CWE-119', url: 'https://cwe.mitre.org/data/definitions/119.html' },
+    ],
+    async analyze(context) {
+        const findings = [];
+        const lines = context.sourceCode.split('\n');
+        const patterns = [
+            { pattern: /Buffer\.from\s*\([^)]+\)\.copy\s*\(/gi, type: 'Buffer copy without bounds', severity: 'high' },
+            { pattern: /\.slice\s*\(\s*\w+\s*,\s*\w+\s*\)/gi, type: 'Dynamic slice bounds', severity: 'medium' },
+            { pattern: /new\s+ArrayBuffer\s*\(\s*\w+\s*\)/gi, type: 'Dynamic ArrayBuffer size', severity: 'medium' },
+            { pattern: /\.set\s*\([^)]+,\s*\w+\s*\)/gi, type: 'TypedArray set with offset', severity: 'medium' },
+            { pattern: /memcpy|memmove|strcpy|strcat/gi, type: 'C-style memory function', severity: 'critical' },
+            { pattern: /\.subarray\s*\(\s*-/gi, type: 'Negative subarray index', severity: 'high' },
+        ];
+        for (let i = 0; i < lines.length; i++) {
+            for (const { pattern, type, severity } of patterns) {
+                pattern.lastIndex = 0;
+                if (pattern.test(lines[i])) {
+                    findings.push({
+                        id: `cwe-119-${findings.length + 1}`,
+                        ruleId: 'cwe-119-buffer-overflow',
+                        severity,
+                        message: `Buffer Overflow - ${type}: Validate buffer boundaries`,
+                        location: { file: context.filePath, startLine: i + 1, endLine: i + 1 },
+                        cwe: ['119'],
+                        suggestion: {
+                            description: 'Always validate buffer bounds before operations',
+                            example: `// Validate bounds before copy
+if (offset + length <= buffer.length) {
+  source.copy(buffer, offset, 0, length);
+}`,
+                        },
+                    });
+                }
+            }
+        }
+        return findings;
+    },
+};
+export default cwe119BufferOverflow;
+//# sourceMappingURL=cwe-119-buffer-overflow.js.map

package/dist/rules/cwe/cwe-119-buffer-overflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-119-buffer-overflow.js","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-119-buffer-overflow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAiB;IAChD,EAAE,EAAE,yBAAyB;IAC7B,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,6CAA6C;IAC1D,eAAe,EAAE,MAAM;IACvB,QAAQ,EAAE,eAAe;IACzB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC;IAC7C,GAAG,EAAE,CAAC,KAAK,CAAC;IACZ,UAAU,EAAE;QACV,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,iDAAiD,EAAE;KAC7E;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAG;YACf,EAAE,OAAO,EAAE,uCAAuC,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAe,EAAE;YACnH,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,QAAiB,EAAE;YAC7G,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,QAAiB,EAAE;YACjH,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,QAAiB,EAAE;YAC7G,EAAE,OAAO,EAAE,gCAAgC,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,UAAmB,EAAE;YAC7G,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAe,EAAE;SACjG,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACnD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;wBACpC,MAAM,EAAE,yBAAyB;wBACjC,QAAQ;wBACR,OAAO,EAAE,qBAAqB,IAAI,8BAA8B;wBAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE;wBACtE,GAAG,EAAE,CAAC,KAAK,CAAC;wBACZ,UAAU,EAAE;4BACV,WAAW,EAAE,iDAAiD;4BAC9D,OAAO,EAAE;;;EAGrB;yBACW;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,oBAAoB,CAAC"}

package/dist/rules/cwe/cwe-125-oob-read.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @fileoverview CWE-125: Out-of-bounds Read
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-125-oob-read
+ * @trace TSK-RULE-005
+ *
+ * Detects:
+ * - Buffer read beyond bounds
+ * - Array access with unchecked index
+ * - String operations with invalid offsets
+ * - TypedArray read violations
+ *
+ * CWE-125 is #7 in CWE Top 25 2023.
+ */
+import type { SecurityRule } from '../types.js';
+/**
+ * CWE-125 - Out-of-bounds Read
+ */
+export declare const cwe125OutOfBoundsRead: SecurityRule;
+export default cwe125OutOfBoundsRead;
+//# sourceMappingURL=cwe-125-oob-read.d.ts.map

package/dist/rules/cwe/cwe-125-oob-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-125-oob-read.d.ts","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-125-oob-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,aAAa,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,YA0BnC,CAAC;AAwOF,eAAe,qBAAqB,CAAC"}

package/dist/rules/cwe/cwe-125-oob-read.js

@@ -0,0 +1,247 @@
+/**
+ * @fileoverview CWE-125: Out-of-bounds Read
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-125-oob-read
+ * @trace TSK-RULE-005
+ *
+ * Detects:
+ * - Buffer read beyond bounds
+ * - Array access with unchecked index
+ * - String operations with invalid offsets
+ * - TypedArray read violations
+ *
+ * CWE-125 is #7 in CWE Top 25 2023.
+ */
+/**
+ * CWE-125 - Out-of-bounds Read
+ */
+export const cwe125OutOfBoundsRead = {
+    id: 'cwe-125-oob-read',
+    name: 'CWE-125: Out-of-bounds Read',
+    description: 'Detects potential out-of-bounds read vulnerabilities',
+    defaultSeverity: 'medium',
+    category: 'memory-safety',
+    tags: ['cwe', 'memory', 'buffer', 'array', 'security'],
+    cwe: ['125'],
+    references: [
+        {
+            title: 'CWE-125: Out-of-bounds Read',
+            url: 'https://cwe.mitre.org/data/definitions/125.html',
+        },
+    ],
+    async analyze(context) {
+        const findings = [];
+        const sourceCode = context.sourceCode;
+        checkBufferReadPatterns(context, sourceCode, findings);
+        checkArrayReadPatterns(context, sourceCode, findings);
+        checkStringReadPatterns(context, sourceCode, findings);
+        return findings;
+    },
+};
+/**
+ * Check for buffer read patterns
+ */
+function checkBufferReadPatterns(context, sourceCode, findings) {
+    const lines = sourceCode.split('\n');
+    const bufferPatterns = [
+        {
+            pattern: /\.read(?:UInt|Int)(?:8|16|32)(?:BE|LE)?\s*\(\s*(?:\w+|[^)]+)\s*\)/gi,
+            type: 'Buffer typed read with dynamic offset',
+            message: 'Buffer read with dynamic offset needs bounds checking',
+            severity: 'medium',
+        },
+        {
+            pattern: /\.readBigInt64(?:BE|LE)?\s*\(\s*\w+\s*\)/gi,
+            type: 'Buffer BigInt read',
+            message: 'BigInt buffer read with variable offset needs validation',
+            severity: 'medium',
+        },
+        {
+            pattern: /\.slice\s*\(\s*(?:\w+|\d+)\s*,\s*(?:\w+|\d+)\s*\)/gi,
+            type: 'Buffer/Array slice with dynamic bounds',
+            message: 'Slice with dynamic bounds may read beyond buffer',
+            severity: 'low',
+        },
+        {
+            pattern: /\.subarray\s*\(\s*(?:\w+)\s*(?:,\s*\w+)?\s*\)/gi,
+            type: 'Subarray with dynamic offset',
+            message: 'Subarray with dynamic offset may exceed bounds',
+            severity: 'low',
+        },
+        {
+            pattern: /\.toString\s*\(\s*['"`]\w+['"`]\s*,\s*\w+\s*,\s*\w+\s*\)/gi,
+            type: 'Buffer toString with dynamic range',
+            message: 'Buffer toString with dynamic range needs validation',
+            severity: 'low',
+        },
+    ];
+    for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+        const line = lines[lineNum];
+        for (const { pattern, type, message, severity } of bufferPatterns) {
+            pattern.lastIndex = 0;
+            if (pattern.test(line)) {
+                findings.push({
+                    id: `cwe-125-buffer-${findings.length + 1}`,
+                    ruleId: 'cwe-125-oob-read',
+                    severity,
+                    message: `Out-of-bounds Read - ${type}: ${message}`,
+                    location: {
+                        file: context.filePath,
+                        startLine: lineNum + 1,
+                        endLine: lineNum + 1,
+                        startColumn: 0,
+                        endColumn: line.length,
+                    },
+                    cwe: ['125'],
+                    suggestion: {
+                        description: 'Validate offset and length before buffer read',
+                        example: `// Check bounds before reading
+if (offset >= 0 && offset + 4 <= buffer.length) {
+  const value = buffer.readInt32LE(offset);
+}
+
+// Safe slice
+const safeEnd = Math.min(end, buffer.length);
+const slice = buffer.slice(start, safeEnd);`,
+                    },
+                });
+            }
+        }
+    }
+}
+/**
+ * Check for array read patterns
+ */
+function checkArrayReadPatterns(context, sourceCode, findings) {
+    const lines = sourceCode.split('\n');
+    const arrayPatterns = [
+        {
+            pattern: /\[\s*(?:req\.|params\.|query\.|body\.)\w+\s*\]/gi,
+            type: 'Array access with user-controlled index',
+            message: 'User-controlled array index may cause out-of-bounds read',
+            severity: 'medium',
+        },
+        {
+            pattern: /\[\s*\w+\s*-\s*\d+\s*\]/gi,
+            type: 'Array access with subtraction',
+            message: 'Array index subtraction may result in negative index',
+            severity: 'low',
+        },
+        {
+            pattern: /\.at\s*\(\s*-?\d+\s*\)/gi,
+            type: 'Array.at usage',
+            message: 'Array.at returns undefined for out-of-bounds, verify handling',
+            severity: 'info',
+        },
+        {
+            pattern: /for\s*\([^)]*<\s*\w+\.length\s*\+\s*\d+/gi,
+            type: 'Loop beyond array length',
+            message: 'Loop condition exceeds array length',
+            severity: 'medium',
+        },
+    ];
+    for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+        const line = lines[lineNum];
+        for (const { pattern, type, message, severity } of arrayPatterns) {
+            pattern.lastIndex = 0;
+            if (pattern.test(line)) {
+                findings.push({
+                    id: `cwe-125-array-${findings.length + 1}`,
+                    ruleId: 'cwe-125-oob-read',
+                    severity,
+                    message: `Out-of-bounds Read - ${type}: ${message}`,
+                    location: {
+                        file: context.filePath,
+                        startLine: lineNum + 1,
+                        endLine: lineNum + 1,
+                        startColumn: 0,
+                        endColumn: line.length,
+                    },
+                    cwe: ['125'],
+                    suggestion: {
+                        description: 'Validate array index before access',
+                        example: `// Check bounds before access
+if (index >= 0 && index < array.length) {
+  const value = array[index];
+}
+
+// Use optional chaining for safety
+const value = array[index] ?? defaultValue;
+
+// Use Array.at with null check
+const item = array.at(index);
+if (item !== undefined) { }`,
+                    },
+                });
+            }
+        }
+    }
+}
+/**
+ * Check for string read patterns
+ */
+function checkStringReadPatterns(context, sourceCode, findings) {
+    const lines = sourceCode.split('\n');
+    const stringPatterns = [
+        {
+            pattern: /\.charAt\s*\(\s*(?:\w+|[^)]+)\s*\)/gi,
+            type: 'charAt with dynamic index',
+            message: 'charAt returns empty string for invalid index',
+            severity: 'info',
+        },
+        {
+            pattern: /\.charCodeAt\s*\(\s*(?:\w+|[^)]+)\s*\)/gi,
+            type: 'charCodeAt with dynamic index',
+            message: 'charCodeAt returns NaN for invalid index',
+            severity: 'low',
+        },
+        {
+            pattern: /\.substring\s*\(\s*\w+\s*,\s*\w+\s*\)/gi,
+            type: 'substring with dynamic bounds',
+            message: 'Ensure substring bounds are validated',
+            severity: 'info',
+        },
+        {
+            pattern: /\.codePointAt\s*\(\s*\w+\s*\)/gi,
+            type: 'codePointAt with dynamic index',
+            message: 'codePointAt returns undefined for invalid index',
+            severity: 'info',
+        },
+    ];
+    for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+        const line = lines[lineNum];
+        for (const { pattern, type, message, severity } of stringPatterns) {
+            pattern.lastIndex = 0;
+            if (pattern.test(line)) {
+                findings.push({
+                    id: `cwe-125-string-${findings.length + 1}`,
+                    ruleId: 'cwe-125-oob-read',
+                    severity,
+                    message: `Out-of-bounds Read - ${type}: ${message}`,
+                    location: {
+                        file: context.filePath,
+                        startLine: lineNum + 1,
+                        endLine: lineNum + 1,
+                        startColumn: 0,
+                        endColumn: line.length,
+                    },
+                    cwe: ['125'],
+                    suggestion: {
+                        description: 'Check string length before character access',
+                        example: `// Check length before access
+if (index < str.length) {
+  const char = str.charAt(index);
+}
+
+// Handle edge cases
+const code = str.charCodeAt(index);
+if (!Number.isNaN(code)) {
+  // valid code point
+}`,
+                    },
+                });
+            }
+        }
+    }
+}
+export default cwe125OutOfBoundsRead;
+//# sourceMappingURL=cwe-125-oob-read.js.map

package/dist/rules/cwe/cwe-125-oob-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-125-oob-read.js","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-125-oob-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,sDAAsD;IACxD,eAAe,EAAE,QAAQ;IACzB,QAAQ,EAAE,eAAe;IACzB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC;IACtD,GAAG,EAAE,CAAC,KAAK,CAAC;IACZ,UAAU,EAAE;QACV;YACE,KAAK,EAAE,6BAA6B;YACpC,GAAG,EAAE,iDAAiD;SACvD;KACF;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QAEtC,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvD,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACtD,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEvD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF;;GAEG;AACH,SAAS,uBAAuB,CAC9B,OAAoB,EACpB,UAAkB,EAClB,QAAuB;IAEvB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,cAAc,GAAG;QACrB;YACE,OAAO,EAAE,qEAAqE;YAC9E,IAAI,EAAE,uCAAuC;YAC7C,OAAO,EAAE,uDAAuD;YAChE,QAAQ,EAAE,QAAiB;SAC5B;QACD;YACE,OAAO,EAAE,4CAA4C;YACrD,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,0DAA0D;YACnE,QAAQ,EAAE,QAAiB;SAC5B;QACD;YACE,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,wCAAwC;YAC9C,OAAO,EAAE,kDAAkD;YAC3D,QAAQ,EAAE,KAAc;SACzB;QACD;YACE,OAAO,EAAE,iDAAiD;YAC1D,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,gDAAgD;YACzD,QAAQ,EAAE,KAAc;SACzB;QACD;YACE,OAAO,EAAE,4DAA4D;YACrE,IAAI,EAAE,oCAAoC;YAC1C,OAAO,EAAE,qDAAqD;YAC9D,QAAQ,EAAE,KAAc;SACzB;KACF,CAAC;IAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,cAAc,EAAE,CAAC;YAClE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,kBAAkB,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC3C,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,wBAAwB,IAAI,KAAK,OAAO,EAAE;oBACnD,QAAQ,EAAE;wBACR,IAAI,EAAE,OAAO,CAAC,QAAQ;wBACtB,SAAS,EAAE,OAAO,GAAG,CAAC;wBACtB,OAAO,EAAE,OAAO,GAAG,CAAC;wBACpB,WAAW,EAAE,CAAC;wBACd,SAAS,EAAE,IAAI,CAAC,MAAM;qBACvB;oBACD,GAAG,EAAE,CAAC,KAAK,CAAC;oBACZ,UAAU,EAAE;wBACV,WAAW,EAAE,+CAA+C;wBAC5D,OAAO,EAAE;;;;;;;4CAOuB;qBACjC;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAC7B,OAAoB,EACpB,UAAkB,EAClB,QAAuB;IAEvB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,aAAa,GAAG;QACpB;YACE,OAAO,EAAE,kDAAkD;YAC3D,IAAI,EAAE,yCAAyC;YAC/C,OAAO,EAAE,0DAA0D;YACnE,QAAQ,EAAE,QAAiB;SAC5B;QACD;YACE,OAAO,EAAE,2BAA2B;YACpC,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,sDAAsD;YAC/D,QAAQ,EAAE,KAAc;SACzB;QACD;YACE,OAAO,EAAE,0BAA0B;YACnC,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,+DAA+D;YACxE,QAAQ,EAAE,MAAe;SAC1B;QACD;YACE,OAAO,EAAE,2CAA2C;YACpD,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,qCAAqC;YAC9C,QAAQ,EAAE,QAAiB;SAC5B;KACF,CAAC;IAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,aAAa,EAAE,CAAC;YACjE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,iBAAiB,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC1C,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,wBAAwB,IAAI,KAAK,OAAO,EAAE;oBACnD,QAAQ,EAAE;wBACR,IAAI,EAAE,OAAO,CAAC,QAAQ;wBACtB,SAAS,EAAE,OAAO,GAAG,CAAC;wBACtB,OAAO,EAAE,OAAO,GAAG,CAAC;wBACpB,WAAW,EAAE,CAAC;wBACd,SAAS,EAAE,IAAI,CAAC,MAAM;qBACvB;oBACD,GAAG,EAAE,CAAC,KAAK,CAAC;oBACZ,UAAU,EAAE;wBACV,WAAW,EAAE,oCAAoC;wBACjD,OAAO,EAAE;;;;;;;;;;4BAUO;qBACjB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAC9B,OAAoB,EACpB,UAAkB,EAClB,QAAuB;IAEvB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,cAAc,GAAG;QACrB;YACE,OAAO,EAAE,sCAAsC;YAC/C,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,+CAA+C;YACxD,QAAQ,EAAE,MAAe;SAC1B;QACD;YACE,OAAO,EAAE,0CAA0C;YACnD,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,0CAA0C;YACnD,QAAQ,EAAE,KAAc;SACzB;QACD;YACE,OAAO,EAAE,yCAAyC;YAClD,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,uCAAuC;YAChD,QAAQ,EAAE,MAAe;SAC1B;QACD;YACE,OAAO,EAAE,iCAAiC;YAC1C,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,MAAe;SAC1B;KACF,CAAC;IAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,cAAc,EAAE,CAAC;YAClE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,kBAAkB,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC3C,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,wBAAwB,IAAI,KAAK,OAAO,EAAE;oBACnD,QAAQ,EAAE;wBACR,IAAI,EAAE,OAAO,CAAC,QAAQ;wBACtB,SAAS,EAAE,OAAO,GAAG,CAAC;wBACtB,OAAO,EAAE,OAAO,GAAG,CAAC;wBACpB,WAAW,EAAE,CAAC;wBACd,SAAS,EAAE,IAAI,CAAC,MAAM;qBACvB;oBACD,GAAG,EAAE,CAAC,KAAK,CAAC;oBACZ,UAAU,EAAE;wBACV,WAAW,EAAE,6CAA6C;wBAC1D,OAAO,EAAE;;;;;;;;;EASnB;qBACS;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,eAAe,qBAAqB,CAAC"}

package/dist/rules/cwe/cwe-190-integer-overflow.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview CWE-190: Integer Overflow or Wraparound
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-190-integer-overflow
+ * @trace TSK-RULE-006
+ */
+import type { SecurityRule } from '../types.js';
+export declare const cwe190IntegerOverflow: SecurityRule;
+export default cwe190IntegerOverflow;
+//# sourceMappingURL=cwe-190-integer-overflow.d.ts.map

package/dist/rules/cwe/cwe-190-integer-overflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-190-integer-overflow.d.ts","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-190-integer-overflow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,aAAa,CAAC;AAE1E,eAAO,MAAM,qBAAqB,EAAE,YAkDnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/rules/cwe/cwe-190-integer-overflow.js

@@ -0,0 +1,55 @@
+/**
+ * @fileoverview CWE-190: Integer Overflow or Wraparound
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-190-integer-overflow
+ * @trace TSK-RULE-006
+ */
+export const cwe190IntegerOverflow = {
+    id: 'cwe-190-integer-overflow',
+    name: 'CWE-190: Integer Overflow or Wraparound',
+    description: 'Detects potential integer overflow vulnerabilities',
+    defaultSeverity: 'high',
+    category: 'numeric',
+    tags: ['cwe', 'integer', 'overflow', 'security'],
+    cwe: ['190'],
+    references: [
+        { title: 'CWE-190', url: 'https://cwe.mitre.org/data/definitions/190.html' },
+    ],
+    async analyze(context) {
+        const findings = [];
+        const lines = context.sourceCode.split('\n');
+        const patterns = [
+            { pattern: /\w+\s*\+\s*\w+\s*>\s*Number\.MAX_SAFE_INTEGER/gi, type: 'Unchecked addition overflow', severity: 'high' },
+            { pattern: /parseInt\s*\([^)]+\)\s*\*\s*\d+/gi, type: 'Parsed int multiplication', severity: 'medium' },
+            { pattern: /\w+\s*\*\s*\w+\s*(?!.*(?:BigInt|overflow|check))/gi, type: 'Unchecked multiplication', severity: 'low' },
+            { pattern: /Math\.pow\s*\([^)]+\)/gi, type: 'Power operation without bounds', severity: 'medium' },
+            { pattern: /<<\s*\d{2,}/gi, type: 'Large bit shift', severity: 'high' },
+            { pattern: /new\s+(?:Int8|Int16|Int32|Uint8|Uint16|Uint32)Array/gi, type: 'TypedArray boundary', severity: 'low' },
+        ];
+        for (let i = 0; i < lines.length; i++) {
+            for (const { pattern, type, severity } of patterns) {
+                pattern.lastIndex = 0;
+                if (pattern.test(lines[i])) {
+                    findings.push({
+                        id: `cwe-190-${findings.length + 1}`,
+                        ruleId: 'cwe-190-integer-overflow',
+                        severity,
+                        message: `Integer Overflow - ${type}: Validate numeric bounds`,
+                        location: { file: context.filePath, startLine: i + 1, endLine: i + 1 },
+                        cwe: ['190'],
+                        suggestion: {
+                            description: 'Use BigInt or bounds checking',
+                            example: `// Use BigInt for large numbers
+const result = BigInt(a) * BigInt(b);
+
+// Or check bounds
+if (a > Number.MAX_SAFE_INTEGER - b) throw new Error('Overflow');`,
+                        },
+                    });
+                }
+            }
+        }
+        return findings;
+    },
+};
+export default cwe190IntegerOverflow;
+//# sourceMappingURL=cwe-190-integer-overflow.js.map