@nahisaho/musubix-security 2.0.1 → 2.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (363) hide show
  1. package/dist/analysis/enhanced-taint-analyzer.d.ts +120 -0
  2. package/dist/analysis/enhanced-taint-analyzer.d.ts.map +1 -0
  3. package/dist/analysis/enhanced-taint-analyzer.js +450 -0
  4. package/dist/analysis/enhanced-taint-analyzer.js.map +1 -0
  5. package/dist/analysis/index.d.ts +1 -0
  6. package/dist/analysis/index.d.ts.map +1 -1
  7. package/dist/analysis/index.js +1 -0
  8. package/dist/analysis/index.js.map +1 -1
  9. package/dist/analysis/interprocedural/call-graph-builder.d.ts +192 -0
  10. package/dist/analysis/interprocedural/call-graph-builder.d.ts.map +1 -0
  11. package/dist/analysis/interprocedural/call-graph-builder.js +510 -0
  12. package/dist/analysis/interprocedural/call-graph-builder.js.map +1 -0
  13. package/dist/analysis/interprocedural/dfg-adapter.d.ts +166 -0
  14. package/dist/analysis/interprocedural/dfg-adapter.d.ts.map +1 -0
  15. package/dist/analysis/interprocedural/dfg-adapter.js +455 -0
  16. package/dist/analysis/interprocedural/dfg-adapter.js.map +1 -0
  17. package/dist/analysis/interprocedural/index.d.ts +9 -0
  18. package/dist/analysis/interprocedural/index.d.ts.map +1 -0
  19. package/dist/analysis/interprocedural/index.js +9 -0
  20. package/dist/analysis/interprocedural/index.js.map +1 -0
  21. package/dist/analysis/interprocedural/taint-propagator.d.ts +250 -0
  22. package/dist/analysis/interprocedural/taint-propagator.d.ts.map +1 -0
  23. package/dist/analysis/interprocedural/taint-propagator.js +435 -0
  24. package/dist/analysis/interprocedural/taint-propagator.js.map +1 -0
  25. package/dist/analysis/sanitizers/command-sanitizers.d.ts +12 -0
  26. package/dist/analysis/sanitizers/command-sanitizers.d.ts.map +1 -0
  27. package/dist/analysis/sanitizers/command-sanitizers.js +123 -0
  28. package/dist/analysis/sanitizers/command-sanitizers.js.map +1 -0
  29. package/dist/analysis/sanitizers/html-sanitizers.d.ts +12 -0
  30. package/dist/analysis/sanitizers/html-sanitizers.d.ts.map +1 -0
  31. package/dist/analysis/sanitizers/html-sanitizers.js +213 -0
  32. package/dist/analysis/sanitizers/html-sanitizers.js.map +1 -0
  33. package/dist/analysis/sanitizers/index.d.ts +35 -0
  34. package/dist/analysis/sanitizers/index.d.ts.map +1 -0
  35. package/dist/analysis/sanitizers/index.js +59 -0
  36. package/dist/analysis/sanitizers/index.js.map +1 -0
  37. package/dist/analysis/sanitizers/path-sanitizers.d.ts +12 -0
  38. package/dist/analysis/sanitizers/path-sanitizers.d.ts.map +1 -0
  39. package/dist/analysis/sanitizers/path-sanitizers.js +163 -0
  40. package/dist/analysis/sanitizers/path-sanitizers.js.map +1 -0
  41. package/dist/analysis/sanitizers/sql-sanitizers.d.ts +12 -0
  42. package/dist/analysis/sanitizers/sql-sanitizers.d.ts.map +1 -0
  43. package/dist/analysis/sanitizers/sql-sanitizers.js +216 -0
  44. package/dist/analysis/sanitizers/sql-sanitizers.js.map +1 -0
  45. package/dist/analysis/sanitizers/types.d.ts +78 -0
  46. package/dist/analysis/sanitizers/types.d.ts.map +1 -0
  47. package/dist/analysis/sanitizers/types.js +7 -0
  48. package/dist/analysis/sanitizers/types.js.map +1 -0
  49. package/dist/analysis/sanitizers/validation-sanitizers.d.ts +12 -0
  50. package/dist/analysis/sanitizers/validation-sanitizers.d.ts.map +1 -0
  51. package/dist/analysis/sanitizers/validation-sanitizers.js +268 -0
  52. package/dist/analysis/sanitizers/validation-sanitizers.js.map +1 -0
  53. package/dist/analysis/sinks/code-eval.d.ts +12 -0
  54. package/dist/analysis/sinks/code-eval.d.ts.map +1 -0
  55. package/dist/analysis/sinks/code-eval.js +231 -0
  56. package/dist/analysis/sinks/code-eval.js.map +1 -0
  57. package/dist/analysis/sinks/command-exec.d.ts +12 -0
  58. package/dist/analysis/sinks/command-exec.d.ts.map +1 -0
  59. package/dist/analysis/sinks/command-exec.js +187 -0
  60. package/dist/analysis/sinks/command-exec.js.map +1 -0
  61. package/dist/analysis/sinks/file-operations.d.ts +12 -0
  62. package/dist/analysis/sinks/file-operations.d.ts.map +1 -0
  63. package/dist/analysis/sinks/file-operations.js +239 -0
  64. package/dist/analysis/sinks/file-operations.js.map +1 -0
  65. package/dist/analysis/sinks/html-output.d.ts +12 -0
  66. package/dist/analysis/sinks/html-output.d.ts.map +1 -0
  67. package/dist/analysis/sinks/html-output.js +256 -0
  68. package/dist/analysis/sinks/html-output.js.map +1 -0
  69. package/dist/analysis/sinks/index.d.ts +30 -0
  70. package/dist/analysis/sinks/index.d.ts.map +1 -0
  71. package/dist/analysis/sinks/index.js +46 -0
  72. package/dist/analysis/sinks/index.js.map +1 -0
  73. package/dist/analysis/sinks/sql-query.d.ts +12 -0
  74. package/dist/analysis/sinks/sql-query.d.ts.map +1 -0
  75. package/dist/analysis/sinks/sql-query.js +209 -0
  76. package/dist/analysis/sinks/sql-query.js.map +1 -0
  77. package/dist/analysis/sinks/types.d.ts +97 -0
  78. package/dist/analysis/sinks/types.d.ts.map +1 -0
  79. package/dist/analysis/sinks/types.js +7 -0
  80. package/dist/analysis/sinks/types.js.map +1 -0
  81. package/dist/analysis/sources/database.d.ts +12 -0
  82. package/dist/analysis/sources/database.d.ts.map +1 -0
  83. package/dist/analysis/sources/database.js +211 -0
  84. package/dist/analysis/sources/database.js.map +1 -0
  85. package/dist/analysis/sources/environment.d.ts +12 -0
  86. package/dist/analysis/sources/environment.d.ts.map +1 -0
  87. package/dist/analysis/sources/environment.js +158 -0
  88. package/dist/analysis/sources/environment.js.map +1 -0
  89. package/dist/analysis/sources/file-system.d.ts +12 -0
  90. package/dist/analysis/sources/file-system.d.ts.map +1 -0
  91. package/dist/analysis/sources/file-system.js +180 -0
  92. package/dist/analysis/sources/file-system.js.map +1 -0
  93. package/dist/analysis/sources/http-request.d.ts +12 -0
  94. package/dist/analysis/sources/http-request.d.ts.map +1 -0
  95. package/dist/analysis/sources/http-request.js +179 -0
  96. package/dist/analysis/sources/http-request.js.map +1 -0
  97. package/dist/analysis/sources/index.d.ts +26 -0
  98. package/dist/analysis/sources/index.d.ts.map +1 -0
  99. package/dist/analysis/sources/index.js +40 -0
  100. package/dist/analysis/sources/index.js.map +1 -0
  101. package/dist/analysis/sources/types.d.ts +93 -0
  102. package/dist/analysis/sources/types.d.ts.map +1 -0
  103. package/dist/analysis/sources/types.js +7 -0
  104. package/dist/analysis/sources/types.js.map +1 -0
  105. package/dist/analysis/sources/user-input.d.ts +12 -0
  106. package/dist/analysis/sources/user-input.d.ts.map +1 -0
  107. package/dist/analysis/sources/user-input.js +261 -0
  108. package/dist/analysis/sources/user-input.js.map +1 -0
  109. package/dist/cve/cpe-matcher.d.ts +183 -0
  110. package/dist/cve/cpe-matcher.d.ts.map +1 -0
  111. package/dist/cve/cpe-matcher.js +396 -0
  112. package/dist/cve/cpe-matcher.js.map +1 -0
  113. package/dist/cve/cve-cache.d.ts +225 -0
  114. package/dist/cve/cve-cache.d.ts.map +1 -0
  115. package/dist/cve/cve-cache.js +452 -0
  116. package/dist/cve/cve-cache.js.map +1 -0
  117. package/dist/cve/cve-cache.test.d.ts +6 -0
  118. package/dist/cve/cve-cache.test.d.ts.map +1 -0
  119. package/dist/cve/cve-cache.test.js +363 -0
  120. package/dist/cve/cve-cache.test.js.map +1 -0
  121. package/dist/cve/dependency-parser.d.ts +204 -0
  122. package/dist/cve/dependency-parser.d.ts.map +1 -0
  123. package/dist/cve/dependency-parser.js +338 -0
  124. package/dist/cve/dependency-parser.js.map +1 -0
  125. package/dist/cve/index.d.ts +20 -0
  126. package/dist/cve/index.d.ts.map +1 -0
  127. package/dist/cve/index.js +13 -0
  128. package/dist/cve/index.js.map +1 -0
  129. package/dist/cve/nvd-client.d.ts +137 -0
  130. package/dist/cve/nvd-client.d.ts.map +1 -0
  131. package/dist/cve/nvd-client.js +333 -0
  132. package/dist/cve/nvd-client.js.map +1 -0
  133. package/dist/cve/rate-limiter.d.ts +194 -0
  134. package/dist/cve/rate-limiter.d.ts.map +1 -0
  135. package/dist/cve/rate-limiter.js +276 -0
  136. package/dist/cve/rate-limiter.js.map +1 -0
  137. package/dist/cve/report-generator.d.ts +145 -0
  138. package/dist/cve/report-generator.d.ts.map +1 -0
  139. package/dist/cve/report-generator.js +377 -0
  140. package/dist/cve/report-generator.js.map +1 -0
  141. package/dist/cve/report-generator.test.d.ts +6 -0
  142. package/dist/cve/report-generator.test.d.ts.map +1 -0
  143. package/dist/cve/report-generator.test.js +275 -0
  144. package/dist/cve/report-generator.test.js.map +1 -0
  145. package/dist/cve/vulnerability-scanner.d.ts +198 -0
  146. package/dist/cve/vulnerability-scanner.d.ts.map +1 -0
  147. package/dist/cve/vulnerability-scanner.js +311 -0
  148. package/dist/cve/vulnerability-scanner.js.map +1 -0
  149. package/dist/cve/vulnerability-scanner.test.d.ts +6 -0
  150. package/dist/cve/vulnerability-scanner.test.d.ts.map +1 -0
  151. package/dist/cve/vulnerability-scanner.test.js +329 -0
  152. package/dist/cve/vulnerability-scanner.test.js.map +1 -0
  153. package/dist/index.d.ts +1 -0
  154. package/dist/index.d.ts.map +1 -1
  155. package/dist/index.js +4 -0
  156. package/dist/index.js.map +1 -1
  157. package/dist/rules/config/config-parser.d.ts +119 -0
  158. package/dist/rules/config/config-parser.d.ts.map +1 -0
  159. package/dist/rules/config/config-parser.js +376 -0
  160. package/dist/rules/config/config-parser.js.map +1 -0
  161. package/dist/rules/config/index.d.ts +8 -0
  162. package/dist/rules/config/index.d.ts.map +1 -0
  163. package/dist/rules/config/index.js +8 -0
  164. package/dist/rules/config/index.js.map +1 -0
  165. package/dist/rules/config/profiles.d.ts +85 -0
  166. package/dist/rules/config/profiles.d.ts.map +1 -0
  167. package/dist/rules/config/profiles.js +226 -0
  168. package/dist/rules/config/profiles.js.map +1 -0
  169. package/dist/rules/cwe/cwe-119-buffer-overflow.d.ts +9 -0
  170. package/dist/rules/cwe/cwe-119-buffer-overflow.d.ts.map +1 -0
  171. package/dist/rules/cwe/cwe-119-buffer-overflow.js +54 -0
  172. package/dist/rules/cwe/cwe-119-buffer-overflow.js.map +1 -0
  173. package/dist/rules/cwe/cwe-125-oob-read.d.ts +20 -0
  174. package/dist/rules/cwe/cwe-125-oob-read.d.ts.map +1 -0
  175. package/dist/rules/cwe/cwe-125-oob-read.js +247 -0
  176. package/dist/rules/cwe/cwe-125-oob-read.js.map +1 -0
  177. package/dist/rules/cwe/cwe-190-integer-overflow.d.ts +9 -0
  178. package/dist/rules/cwe/cwe-190-integer-overflow.d.ts.map +1 -0
  179. package/dist/rules/cwe/cwe-190-integer-overflow.js +55 -0
  180. package/dist/rules/cwe/cwe-190-integer-overflow.js.map +1 -0
  181. package/dist/rules/cwe/cwe-20-input-validation.d.ts +21 -0
  182. package/dist/rules/cwe/cwe-20-input-validation.d.ts.map +1 -0
  183. package/dist/rules/cwe/cwe-20-input-validation.js +342 -0
  184. package/dist/rules/cwe/cwe-20-input-validation.js.map +1 -0
  185. package/dist/rules/cwe/cwe-22-path-traversal.d.ts +20 -0
  186. package/dist/rules/cwe/cwe-22-path-traversal.d.ts.map +1 -0
  187. package/dist/rules/cwe/cwe-22-path-traversal.js +306 -0
  188. package/dist/rules/cwe/cwe-22-path-traversal.js.map +1 -0
  189. package/dist/rules/cwe/cwe-269-improper-privilege.d.ts +9 -0
  190. package/dist/rules/cwe/cwe-269-improper-privilege.d.ts.map +1 -0
  191. package/dist/rules/cwe/cwe-269-improper-privilege.js +58 -0
  192. package/dist/rules/cwe/cwe-269-improper-privilege.js.map +1 -0
  193. package/dist/rules/cwe/cwe-276-default-permissions.d.ts +9 -0
  194. package/dist/rules/cwe/cwe-276-default-permissions.d.ts.map +1 -0
  195. package/dist/rules/cwe/cwe-276-default-permissions.js +54 -0
  196. package/dist/rules/cwe/cwe-276-default-permissions.js.map +1 -0
  197. package/dist/rules/cwe/cwe-287-improper-auth.d.ts +9 -0
  198. package/dist/rules/cwe/cwe-287-improper-auth.d.ts.map +1 -0
  199. package/dist/rules/cwe/cwe-287-improper-auth.js +57 -0
  200. package/dist/rules/cwe/cwe-287-improper-auth.js.map +1 -0
  201. package/dist/rules/cwe/cwe-306-missing-auth-critical.d.ts +9 -0
  202. package/dist/rules/cwe/cwe-306-missing-auth-critical.d.ts.map +1 -0
  203. package/dist/rules/cwe/cwe-306-missing-auth-critical.js +53 -0
  204. package/dist/rules/cwe/cwe-306-missing-auth-critical.js.map +1 -0
  205. package/dist/rules/cwe/cwe-352-csrf.d.ts +9 -0
  206. package/dist/rules/cwe/cwe-352-csrf.d.ts.map +1 -0
  207. package/dist/rules/cwe/cwe-352-csrf.js +51 -0
  208. package/dist/rules/cwe/cwe-352-csrf.js.map +1 -0
  209. package/dist/rules/cwe/cwe-362-race-condition.d.ts +9 -0
  210. package/dist/rules/cwe/cwe-362-race-condition.d.ts.map +1 -0
  211. package/dist/rules/cwe/cwe-362-race-condition.js +55 -0
  212. package/dist/rules/cwe/cwe-362-race-condition.js.map +1 -0
  213. package/dist/rules/cwe/cwe-416-use-after-free.d.ts +23 -0
  214. package/dist/rules/cwe/cwe-416-use-after-free.d.ts.map +1 -0
  215. package/dist/rules/cwe/cwe-416-use-after-free.js +402 -0
  216. package/dist/rules/cwe/cwe-416-use-after-free.js.map +1 -0
  217. package/dist/rules/cwe/cwe-434-file-upload.d.ts +9 -0
  218. package/dist/rules/cwe/cwe-434-file-upload.d.ts.map +1 -0
  219. package/dist/rules/cwe/cwe-434-file-upload.js +55 -0
  220. package/dist/rules/cwe/cwe-434-file-upload.js.map +1 -0
  221. package/dist/rules/cwe/cwe-476-null-deref.d.ts +9 -0
  222. package/dist/rules/cwe/cwe-476-null-deref.d.ts.map +1 -0
  223. package/dist/rules/cwe/cwe-476-null-deref.js +55 -0
  224. package/dist/rules/cwe/cwe-476-null-deref.js.map +1 -0
  225. package/dist/rules/cwe/cwe-502-deserialization.d.ts +9 -0
  226. package/dist/rules/cwe/cwe-502-deserialization.d.ts.map +1 -0
  227. package/dist/rules/cwe/cwe-502-deserialization.js +57 -0
  228. package/dist/rules/cwe/cwe-502-deserialization.js.map +1 -0
  229. package/dist/rules/cwe/cwe-77-command-injection.d.ts +9 -0
  230. package/dist/rules/cwe/cwe-77-command-injection.d.ts.map +1 -0
  231. package/dist/rules/cwe/cwe-77-command-injection.js +55 -0
  232. package/dist/rules/cwe/cwe-77-command-injection.js.map +1 -0
  233. package/dist/rules/cwe/cwe-78-command-injection.d.ts +20 -0
  234. package/dist/rules/cwe/cwe-78-command-injection.d.ts.map +1 -0
  235. package/dist/rules/cwe/cwe-78-command-injection.js +259 -0
  236. package/dist/rules/cwe/cwe-78-command-injection.js.map +1 -0
  237. package/dist/rules/cwe/cwe-787-oob-write.d.ts +21 -0
  238. package/dist/rules/cwe/cwe-787-oob-write.d.ts.map +1 -0
  239. package/dist/rules/cwe/cwe-787-oob-write.js +321 -0
  240. package/dist/rules/cwe/cwe-787-oob-write.js.map +1 -0
  241. package/dist/rules/cwe/cwe-79-xss.d.ts +22 -0
  242. package/dist/rules/cwe/cwe-79-xss.d.ts.map +1 -0
  243. package/dist/rules/cwe/cwe-79-xss.js +386 -0
  244. package/dist/rules/cwe/cwe-79-xss.js.map +1 -0
  245. package/dist/rules/cwe/cwe-798-hardcoded-credentials.d.ts +9 -0
  246. package/dist/rules/cwe/cwe-798-hardcoded-credentials.d.ts.map +1 -0
  247. package/dist/rules/cwe/cwe-798-hardcoded-credentials.js +58 -0
  248. package/dist/rules/cwe/cwe-798-hardcoded-credentials.js.map +1 -0
  249. package/dist/rules/cwe/cwe-862-missing-auth.d.ts +9 -0
  250. package/dist/rules/cwe/cwe-862-missing-auth.d.ts.map +1 -0
  251. package/dist/rules/cwe/cwe-862-missing-auth.js +55 -0
  252. package/dist/rules/cwe/cwe-862-missing-auth.js.map +1 -0
  253. package/dist/rules/cwe/cwe-863-incorrect-auth.d.ts +9 -0
  254. package/dist/rules/cwe/cwe-863-incorrect-auth.d.ts.map +1 -0
  255. package/dist/rules/cwe/cwe-863-incorrect-auth.js +58 -0
  256. package/dist/rules/cwe/cwe-863-incorrect-auth.js.map +1 -0
  257. package/dist/rules/cwe/cwe-89-sql-injection.d.ts +21 -0
  258. package/dist/rules/cwe/cwe-89-sql-injection.d.ts.map +1 -0
  259. package/dist/rules/cwe/cwe-89-sql-injection.js +456 -0
  260. package/dist/rules/cwe/cwe-89-sql-injection.js.map +1 -0
  261. package/dist/rules/cwe/cwe-918-ssrf.d.ts +9 -0
  262. package/dist/rules/cwe/cwe-918-ssrf.d.ts.map +1 -0
  263. package/dist/rules/cwe/cwe-918-ssrf.js +59 -0
  264. package/dist/rules/cwe/cwe-918-ssrf.js.map +1 -0
  265. package/dist/rules/cwe/cwe-94-code-injection.d.ts +9 -0
  266. package/dist/rules/cwe/cwe-94-code-injection.d.ts.map +1 -0
  267. package/dist/rules/cwe/cwe-94-code-injection.js +59 -0
  268. package/dist/rules/cwe/cwe-94-code-injection.js.map +1 -0
  269. package/dist/rules/cwe/index.d.ts +43 -0
  270. package/dist/rules/cwe/index.d.ts.map +1 -0
  271. package/dist/rules/cwe/index.js +99 -0
  272. package/dist/rules/cwe/index.js.map +1 -0
  273. package/dist/rules/engine/index.d.ts +10 -0
  274. package/dist/rules/engine/index.d.ts.map +1 -0
  275. package/dist/rules/engine/index.js +9 -0
  276. package/dist/rules/engine/index.js.map +1 -0
  277. package/dist/rules/engine/rule-context.d.ts +99 -0
  278. package/dist/rules/engine/rule-context.d.ts.map +1 -0
  279. package/dist/rules/engine/rule-context.js +175 -0
  280. package/dist/rules/engine/rule-context.js.map +1 -0
  281. package/dist/rules/engine/rule-engine.d.ts +132 -0
  282. package/dist/rules/engine/rule-engine.d.ts.map +1 -0
  283. package/dist/rules/engine/rule-engine.js +379 -0
  284. package/dist/rules/engine/rule-engine.js.map +1 -0
  285. package/dist/rules/engine/rule-registry.d.ts +133 -0
  286. package/dist/rules/engine/rule-registry.d.ts.map +1 -0
  287. package/dist/rules/engine/rule-registry.js +281 -0
  288. package/dist/rules/engine/rule-registry.js.map +1 -0
  289. package/dist/rules/index.d.ts +14 -0
  290. package/dist/rules/index.d.ts.map +1 -0
  291. package/dist/rules/index.js +16 -0
  292. package/dist/rules/index.js.map +1 -0
  293. package/dist/rules/owasp/a01-broken-access-control.d.ts +19 -0
  294. package/dist/rules/owasp/a01-broken-access-control.d.ts.map +1 -0
  295. package/dist/rules/owasp/a01-broken-access-control.js +295 -0
  296. package/dist/rules/owasp/a01-broken-access-control.js.map +1 -0
  297. package/dist/rules/owasp/a02-cryptographic-failures.d.ts +19 -0
  298. package/dist/rules/owasp/a02-cryptographic-failures.d.ts.map +1 -0
  299. package/dist/rules/owasp/a02-cryptographic-failures.js +327 -0
  300. package/dist/rules/owasp/a02-cryptographic-failures.js.map +1 -0
  301. package/dist/rules/owasp/a03-injection.d.ts +21 -0
  302. package/dist/rules/owasp/a03-injection.d.ts.map +1 -0
  303. package/dist/rules/owasp/a03-injection.js +342 -0
  304. package/dist/rules/owasp/a03-injection.js.map +1 -0
  305. package/dist/rules/owasp/a04-insecure-design.d.ts +19 -0
  306. package/dist/rules/owasp/a04-insecure-design.d.ts.map +1 -0
  307. package/dist/rules/owasp/a04-insecure-design.js +403 -0
  308. package/dist/rules/owasp/a04-insecure-design.js.map +1 -0
  309. package/dist/rules/owasp/a05-security-misconfiguration.d.ts +19 -0
  310. package/dist/rules/owasp/a05-security-misconfiguration.d.ts.map +1 -0
  311. package/dist/rules/owasp/a05-security-misconfiguration.js +371 -0
  312. package/dist/rules/owasp/a05-security-misconfiguration.js.map +1 -0
  313. package/dist/rules/owasp/a06-vulnerable-components.d.ts +18 -0
  314. package/dist/rules/owasp/a06-vulnerable-components.d.ts.map +1 -0
  315. package/dist/rules/owasp/a06-vulnerable-components.js +243 -0
  316. package/dist/rules/owasp/a06-vulnerable-components.js.map +1 -0
  317. package/dist/rules/owasp/a07-auth-failures.d.ts +19 -0
  318. package/dist/rules/owasp/a07-auth-failures.d.ts.map +1 -0
  319. package/dist/rules/owasp/a07-auth-failures.js +300 -0
  320. package/dist/rules/owasp/a07-auth-failures.js.map +1 -0
  321. package/dist/rules/owasp/a08-integrity-failures.d.ts +18 -0
  322. package/dist/rules/owasp/a08-integrity-failures.d.ts.map +1 -0
  323. package/dist/rules/owasp/a08-integrity-failures.js +306 -0
  324. package/dist/rules/owasp/a08-integrity-failures.js.map +1 -0
  325. package/dist/rules/owasp/a09-logging-failures.d.ts +18 -0
  326. package/dist/rules/owasp/a09-logging-failures.d.ts.map +1 -0
  327. package/dist/rules/owasp/a09-logging-failures.js +339 -0
  328. package/dist/rules/owasp/a09-logging-failures.js.map +1 -0
  329. package/dist/rules/owasp/a10-ssrf.d.ts +18 -0
  330. package/dist/rules/owasp/a10-ssrf.d.ts.map +1 -0
  331. package/dist/rules/owasp/a10-ssrf.js +349 -0
  332. package/dist/rules/owasp/a10-ssrf.js.map +1 -0
  333. package/dist/rules/owasp/index.d.ts +20 -0
  334. package/dist/rules/owasp/index.d.ts.map +1 -0
  335. package/dist/rules/owasp/index.js +53 -0
  336. package/dist/rules/owasp/index.js.map +1 -0
  337. package/dist/rules/types.d.ts +277 -0
  338. package/dist/rules/types.d.ts.map +1 -0
  339. package/dist/rules/types.js +34 -0
  340. package/dist/rules/types.js.map +1 -0
  341. package/dist/tests/integration/epic-integration.test.d.ts +7 -0
  342. package/dist/tests/integration/epic-integration.test.d.ts.map +1 -0
  343. package/dist/tests/integration/epic-integration.test.js +390 -0
  344. package/dist/tests/integration/epic-integration.test.js.map +1 -0
  345. package/dist/tests/rules/cwe/cwe-top25-1-13.test.d.ts +2 -0
  346. package/dist/tests/rules/cwe/cwe-top25-1-13.test.d.ts.map +1 -0
  347. package/dist/tests/rules/cwe/cwe-top25-1-13.test.js +154 -0
  348. package/dist/tests/rules/cwe/cwe-top25-1-13.test.js.map +1 -0
  349. package/dist/tests/rules/cwe/cwe-top25-14-25.test.d.ts +2 -0
  350. package/dist/tests/rules/cwe/cwe-top25-14-25.test.d.ts.map +1 -0
  351. package/dist/tests/rules/cwe/cwe-top25-14-25.test.js +121 -0
  352. package/dist/tests/rules/cwe/cwe-top25-14-25.test.js.map +1 -0
  353. package/dist/types/cve.d.ts +278 -0
  354. package/dist/types/cve.d.ts.map +1 -0
  355. package/dist/types/cve.js +7 -0
  356. package/dist/types/cve.js.map +1 -0
  357. package/dist/types/index.d.ts +2 -0
  358. package/dist/types/index.d.ts.map +1 -1
  359. package/dist/types/rule.d.ts +245 -0
  360. package/dist/types/rule.d.ts.map +1 -0
  361. package/dist/types/rule.js +7 -0
  362. package/dist/types/rule.js.map +1 -0
  363. package/package.json +1 -1
@@ -0,0 +1,276 @@
1
+ /**
2
+ * @fileoverview Token Bucket Rate Limiter for NVD API
3
+ * @module @nahisaho/musubix-security/cve/rate-limiter
4
+ *
5
+ * Implements Token Bucket algorithm for rate limiting.
6
+ * - With API Key: 50 requests per 30 seconds
7
+ * - Without API Key: 5 requests per 30 seconds
8
+ *
9
+ * @requirement REQ-CVE-001 - NVD API rate limiting compliance
10
+ * @design DES-EPIC2-002 - Rate Limiter component
11
+ */
12
+ /**
13
+ * Token Bucket Rate Limiter
14
+ *
15
+ * @example
16
+ * ```typescript
17
+ * // With API key (50 req/30s)
18
+ * const limiter = new RateLimiter({ maxTokens: 50, windowMs: 30000 });
19
+ *
20
+ * // Check if request can proceed
21
+ * if (limiter.canProceed()) {
22
+ * limiter.consume();
23
+ * // make request
24
+ * }
25
+ *
26
+ * // Or wait for token
27
+ * await limiter.waitForToken();
28
+ * // make request
29
+ * ```
30
+ */
31
+ export class RateLimiter {
32
+ tokens;
33
+ maxTokens;
34
+ windowMs;
35
+ refillTokens;
36
+ lastRefillTime;
37
+ refillInterval = null;
38
+ constructor(options) {
39
+ this.maxTokens = options.maxTokens;
40
+ this.windowMs = options.windowMs;
41
+ this.refillTokens = options.refillTokens ?? options.maxTokens;
42
+ this.tokens = this.maxTokens;
43
+ this.lastRefillTime = Date.now();
44
+ }
45
+ /**
46
+ * Create a rate limiter configured for NVD API with API key
47
+ * @returns Rate limiter with 50 req/30s limit
48
+ */
49
+ static withApiKey() {
50
+ return new RateLimiter({ maxTokens: 50, windowMs: 30000 });
51
+ }
52
+ /**
53
+ * Create a rate limiter configured for NVD API without API key
54
+ * @returns Rate limiter with 5 req/30s limit
55
+ */
56
+ static withoutApiKey() {
57
+ return new RateLimiter({ maxTokens: 5, windowMs: 30000 });
58
+ }
59
+ /**
60
+ * Create appropriate rate limiter based on whether API key is provided
61
+ * @param hasApiKey - Whether an API key is available
62
+ * @returns Configured rate limiter
63
+ */
64
+ static forNVD(hasApiKey) {
65
+ return hasApiKey ? RateLimiter.withApiKey() : RateLimiter.withoutApiKey();
66
+ }
67
+ /**
68
+ * Refill tokens based on elapsed time
69
+ */
70
+ refill() {
71
+ const now = Date.now();
72
+ const elapsed = now - this.lastRefillTime;
73
+ if (elapsed >= this.windowMs) {
74
+ // Calculate how many full windows have passed
75
+ const windowsPassed = Math.floor(elapsed / this.windowMs);
76
+ const tokensToAdd = windowsPassed * this.refillTokens;
77
+ this.tokens = Math.min(this.maxTokens, this.tokens + tokensToAdd);
78
+ this.lastRefillTime = now - (elapsed % this.windowMs);
79
+ }
80
+ }
81
+ /**
82
+ * Check if a request can proceed without waiting
83
+ * @returns True if tokens are available
84
+ */
85
+ canProceed() {
86
+ this.refill();
87
+ return this.tokens > 0;
88
+ }
89
+ /**
90
+ * Consume a token for a request
91
+ * @returns True if token was consumed, false if no tokens available
92
+ */
93
+ consume() {
94
+ this.refill();
95
+ if (this.tokens > 0) {
96
+ this.tokens--;
97
+ return true;
98
+ }
99
+ return false;
100
+ }
101
+ /**
102
+ * Try to acquire a token, consuming it if available
103
+ * Alias for consume() for clearer semantics
104
+ * @returns True if token was acquired
105
+ */
106
+ tryAcquire() {
107
+ return this.consume();
108
+ }
109
+ /**
110
+ * Wait for a token to become available, then consume it
111
+ * @param timeoutMs - Maximum time to wait (default: 2 * windowMs)
112
+ * @returns Promise that resolves when token is acquired
113
+ * @throws Error if timeout is exceeded
114
+ */
115
+ async waitForToken(timeoutMs) {
116
+ const timeout = timeoutMs ?? this.windowMs * 2;
117
+ const startTime = Date.now();
118
+ while (!this.consume()) {
119
+ const elapsed = Date.now() - startTime;
120
+ if (elapsed >= timeout) {
121
+ throw new Error(`Rate limit timeout: waited ${elapsed}ms for token (max: ${timeout}ms)`);
122
+ }
123
+ // Calculate optimal wait time
124
+ const status = this.getStatus();
125
+ const waitTime = Math.min(status.waitTimeMs, timeout - elapsed, 100);
126
+ await this.sleep(waitTime);
127
+ }
128
+ }
129
+ /**
130
+ * Get current rate limit status
131
+ * @returns Current status including available tokens and wait time
132
+ */
133
+ getStatus() {
134
+ this.refill();
135
+ const now = Date.now();
136
+ const elapsed = now - this.lastRefillTime;
137
+ const msUntilRefill = Math.max(0, this.windowMs - elapsed);
138
+ // Calculate wait time if no tokens available
139
+ let waitTimeMs = 0;
140
+ if (this.tokens === 0) {
141
+ // Time until next refill
142
+ waitTimeMs = msUntilRefill;
143
+ }
144
+ return {
145
+ availableTokens: this.tokens,
146
+ maxTokens: this.maxTokens,
147
+ msUntilRefill,
148
+ canProceed: this.tokens > 0,
149
+ waitTimeMs,
150
+ };
151
+ }
152
+ /**
153
+ * Reset the rate limiter to initial state
154
+ */
155
+ reset() {
156
+ this.tokens = this.maxTokens;
157
+ this.lastRefillTime = Date.now();
158
+ }
159
+ /**
160
+ * Start automatic token refill (for long-running processes)
161
+ * @param callback - Optional callback when tokens are refilled
162
+ */
163
+ startAutoRefill(callback) {
164
+ if (this.refillInterval) {
165
+ return; // Already running
166
+ }
167
+ this.refillInterval = setInterval(() => {
168
+ const oldTokens = this.tokens;
169
+ this.refill();
170
+ if (callback && this.tokens > oldTokens) {
171
+ callback(this.tokens);
172
+ }
173
+ }, this.windowMs);
174
+ }
175
+ /**
176
+ * Stop automatic token refill
177
+ */
178
+ stopAutoRefill() {
179
+ if (this.refillInterval) {
180
+ clearInterval(this.refillInterval);
181
+ this.refillInterval = null;
182
+ }
183
+ }
184
+ /**
185
+ * Dispose of the rate limiter
186
+ */
187
+ dispose() {
188
+ this.stopAutoRefill();
189
+ }
190
+ /**
191
+ * Sleep for specified milliseconds
192
+ */
193
+ sleep(ms) {
194
+ return new Promise((resolve) => setTimeout(resolve, ms));
195
+ }
196
+ }
197
+ /**
198
+ * Decorator for rate-limited async functions
199
+ *
200
+ * @example
201
+ * ```typescript
202
+ * const limiter = RateLimiter.forNVD(true);
203
+ *
204
+ * const rateLimitedFetch = withRateLimit(limiter, async (url: string) => {
205
+ * return fetch(url);
206
+ * });
207
+ * ```
208
+ */
209
+ export function withRateLimit(limiter, fn) {
210
+ return (async (...args) => {
211
+ await limiter.waitForToken();
212
+ return fn(...args);
213
+ });
214
+ }
215
+ /**
216
+ * Rate limiter pool for managing multiple limiters
217
+ *
218
+ * @example
219
+ * ```typescript
220
+ * const pool = new RateLimiterPool();
221
+ *
222
+ * // Get or create a limiter for NVD API
223
+ * const nvdLimiter = pool.get('nvd', () => RateLimiter.forNVD(true));
224
+ * ```
225
+ */
226
+ export class RateLimiterPool {
227
+ limiters = new Map();
228
+ /**
229
+ * Get or create a rate limiter by key
230
+ * @param key - Unique identifier for the limiter
231
+ * @param factory - Factory function to create limiter if not exists
232
+ * @returns The rate limiter
233
+ */
234
+ get(key, factory) {
235
+ let limiter = this.limiters.get(key);
236
+ if (!limiter) {
237
+ limiter = factory();
238
+ this.limiters.set(key, limiter);
239
+ }
240
+ return limiter;
241
+ }
242
+ /**
243
+ * Check if a limiter exists for the given key
244
+ */
245
+ has(key) {
246
+ return this.limiters.has(key);
247
+ }
248
+ /**
249
+ * Remove a limiter by key
250
+ */
251
+ remove(key) {
252
+ const limiter = this.limiters.get(key);
253
+ if (limiter) {
254
+ limiter.dispose();
255
+ this.limiters.delete(key);
256
+ return true;
257
+ }
258
+ return false;
259
+ }
260
+ /**
261
+ * Get all limiter keys
262
+ */
263
+ keys() {
264
+ return Array.from(this.limiters.keys());
265
+ }
266
+ /**
267
+ * Dispose all limiters
268
+ */
269
+ dispose() {
270
+ for (const limiter of this.limiters.values()) {
271
+ limiter.dispose();
272
+ }
273
+ this.limiters.clear();
274
+ }
275
+ }
276
+ //# sourceMappingURL=rate-limiter.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/cve/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAyCH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,WAAW;IACd,MAAM,CAAS;IACN,SAAS,CAAS;IAClB,QAAQ,CAAS;IACjB,YAAY,CAAS;IAC9B,cAAc,CAAS;IACvB,cAAc,GAA0C,IAAI,CAAC;IAErE,YAAY,OAA2B;QACrC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;QAC9D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,UAAU;QACf,OAAO,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,aAAa;QAClB,OAAO,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAM,CAAC,SAAkB;QAC9B,OAAO,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;IAC5E,CAAC;IAED;;OAEG;IACK,MAAM;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QAE1C,IAAI,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,8CAA8C;YAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;YAEtD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;YAClE,IAAI,CAAC,cAAc,GAAG,GAAG,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,CAAC;QAEd,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,SAAkB;QACnC,MAAM,OAAO,GAAG,SAAS,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACvC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,sBAAsB,OAAO,KAAK,CACxE,CAAC;YACJ,CAAC;YAED,8BAA8B;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC;YAErE,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,IAAI,CAAC,MAAM,EAAE,CAAC;QAEd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC;QAE3D,6CAA6C;QAC7C,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,yBAAyB;YACzB,UAAU,GAAG,aAAa,CAAC;QAC7B,CAAC;QAED,OAAO;YACL,eAAe,EAAE,IAAI,CAAC,MAAM;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa;YACb,UAAU,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC;YAC3B,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,QAAmC;QACjD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,CAAC,kBAAkB;QAC5B,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;YAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YAEd,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAoB,EACpB,EAAK;IAEL,OAAO,CAAC,KAAK,EAAE,GAAG,IAAmB,EAA0B,EAAE;QAC/D,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,GAAG,IAAI,CAAkB,CAAC;IACtC,CAAC,CAAM,CAAC;AACV,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,eAAe;IAClB,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAElD;;;;;OAKG;IACH,GAAG,CAAC,GAAW,EAAE,OAA0B;QACzC,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAW;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}
@@ -0,0 +1,145 @@
1
+ /**
2
+ * @fileoverview CVE Report Generator
3
+ * @module @nahisaho/musubix-security/cve/report-generator
4
+ * @description Generates vulnerability reports in Markdown, JSON, and SARIF formats
5
+ * @requirements REQ-SEC-CVE-003 - CVE report generation with multiple formats
6
+ * @design DES-SEC-CVE-003 - Report generator with SARIF 2.1.0 support
7
+ * @task TSK-CVE-008 - レポート生成
8
+ */
9
+ import type { ScanResult } from './vulnerability-scanner.js';
10
+ /**
11
+ * Report output format
12
+ */
13
+ export type ReportFormat = 'markdown' | 'json' | 'sarif';
14
+ /**
15
+ * Report generator options
16
+ */
17
+ export interface ReportOptions {
18
+ /** Report title */
19
+ title?: string;
20
+ /** Include detailed vulnerability information */
21
+ includeDetails?: boolean;
22
+ /** Include remediation suggestions */
23
+ includeRemediation?: boolean;
24
+ /** Minimum severity to include */
25
+ minSeverity?: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE';
26
+ /** Group vulnerabilities by severity */
27
+ groupBySeverity?: boolean;
28
+ /** Include scan metadata */
29
+ includeMetadata?: boolean;
30
+ /** Project URL for SARIF */
31
+ projectUrl?: string;
32
+ }
33
+ /**
34
+ * SARIF 2.1.0 compatible report structure
35
+ */
36
+ export interface SARIFReport {
37
+ $schema: string;
38
+ version: string;
39
+ runs: SARIFRun[];
40
+ }
41
+ interface SARIFRun {
42
+ tool: {
43
+ driver: {
44
+ name: string;
45
+ version: string;
46
+ informationUri: string;
47
+ rules: SARIFRule[];
48
+ };
49
+ };
50
+ results: SARIFResult[];
51
+ invocations: Array<{
52
+ executionSuccessful: boolean;
53
+ endTimeUtc: string;
54
+ }>;
55
+ }
56
+ interface SARIFRule {
57
+ id: string;
58
+ name: string;
59
+ shortDescription: {
60
+ text: string;
61
+ };
62
+ fullDescription: {
63
+ text: string;
64
+ };
65
+ helpUri?: string;
66
+ defaultConfiguration: {
67
+ level: 'error' | 'warning' | 'note' | 'none';
68
+ };
69
+ properties: {
70
+ precision: string;
71
+ 'security-severity': string;
72
+ tags: string[];
73
+ };
74
+ }
75
+ interface SARIFResult {
76
+ ruleId: string;
77
+ level: 'error' | 'warning' | 'note' | 'none';
78
+ message: {
79
+ text: string;
80
+ };
81
+ locations: Array<{
82
+ physicalLocation: {
83
+ artifactLocation: {
84
+ uri: string;
85
+ uriBaseId: string;
86
+ };
87
+ };
88
+ }>;
89
+ properties: {
90
+ packageName: string;
91
+ packageVersion: string;
92
+ fixedVersion?: string;
93
+ cvssScore?: number;
94
+ cwes?: string[];
95
+ };
96
+ }
97
+ /**
98
+ * CVE Report Generator
99
+ */
100
+ export declare class ReportGenerator {
101
+ private readonly options;
102
+ constructor(options?: ReportOptions);
103
+ /**
104
+ * Generate report in specified format
105
+ */
106
+ generate(result: ScanResult, format: ReportFormat): string;
107
+ /**
108
+ * Filter vulnerabilities by minimum severity
109
+ */
110
+ private filterBySeverity;
111
+ /**
112
+ * Generate Markdown report
113
+ */
114
+ private generateMarkdown;
115
+ /**
116
+ * Format a single vulnerability as Markdown
117
+ */
118
+ private formatVulnerabilityMarkdown;
119
+ /**
120
+ * Group vulnerabilities by severity
121
+ */
122
+ private groupBySeverity;
123
+ /**
124
+ * Generate JSON report
125
+ */
126
+ private generateJSON;
127
+ /**
128
+ * Generate SARIF 2.1.0 report
129
+ */
130
+ private generateSARIF;
131
+ }
132
+ /**
133
+ * Quick report generation function
134
+ */
135
+ export declare function generateReport(result: ScanResult, format: ReportFormat, options?: ReportOptions): string;
136
+ /**
137
+ * Generate and save report to file
138
+ */
139
+ export declare function generateReportToFile(result: ScanResult, filePath: string, format: ReportFormat, options?: ReportOptions): Promise<void>;
140
+ /**
141
+ * Determine format from file extension
142
+ */
143
+ export declare function getFormatFromExtension(filePath: string): ReportFormat;
144
+ export {};
145
+ //# sourceMappingURL=report-generator.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"report-generator.d.ts","sourceRoot":"","sources":["../../src/cve/report-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAyB,MAAM,4BAA4B,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kCAAkC;IAClC,WAAW,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9D,wCAAwC;IACxC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,4BAA4B;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,4BAA4B;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,EAAE,CAAC;CAClB;AAED,UAAU,QAAQ;IAChB,IAAI,EAAE;QACJ,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;YAChB,cAAc,EAAE,MAAM,CAAC;YACvB,KAAK,EAAE,SAAS,EAAE,CAAC;SACpB,CAAC;KACH,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;QACjB,mBAAmB,EAAE,OAAO,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ;AAED,UAAU,SAAS;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,eAAe,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE;QACpB,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;KAC9C,CAAC;IACF,UAAU,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,IAAI,EAAE,MAAM,EAAE,CAAC;KAChB,CAAC;CACH;AAED,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC7C,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,SAAS,EAAE,KAAK,CAAC;QACf,gBAAgB,EAAE;YAChB,gBAAgB,EAAE;gBAChB,GAAG,EAAE,MAAM,CAAC;gBACZ,SAAS,EAAE,MAAM,CAAC;aACnB,CAAC;SACH,CAAC;KACH,CAAC,CAAC;IACH,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAiDD;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;gBAEtC,OAAO,GAAE,aAAkB;IAYvC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM;IAe1D;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAgCxB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAiExB;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAwCnC;;OAEG;IACH,OAAO,CAAC,eAAe;IAsBvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAiCpB;;OAEG;IACH,OAAO,CAAC,aAAa;CAoFtB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,aAAa,GACtB,MAAM,CAGR;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAYrE"}