@next-secure-check/rules 0.2.0 → 0.4.0

package/LICENSE

@@ -1,21 +1,22 @@
-MIT License
-
-Copyright (c) 2026 SetraTheXX
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 SetraTheXX
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/README.md

@@ -5,7 +5,7 @@ Built-in deterministic security rules for `next-secure-check`.
 This is an internal workspace package published for the `next-secure-check` CLI. Rules cover common Next.js security checks across secrets, injection, XSS, auth, config, headers, upload, and validation categories. Most users should install the CLI package instead:
 
 ```bash
-npx next-secure-check scan .
+npx --yes next-secure-check@latest scan .
 ```
 
 See the main repository for rule documentation:

package/dist/analysis-cache.d.ts

@@ -0,0 +1,14 @@
+import type { SourceFile } from "@next-secure-check/core";
+export type AnalysisCacheStats = {
+    cacheHits: number;
+    cacheMisses: number;
+};
+export declare class SourceAnalysisCache<TValue> {
+    private cache;
+    private cacheHits;
+    private cacheMisses;
+    get(sourceFile: SourceFile, create: () => TValue): TValue;
+    stats(): AnalysisCacheStats;
+    clear(): void;
+}
+//# sourceMappingURL=analysis-cache.d.ts.map

package/dist/analysis-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-cache.d.ts","sourceRoot":"","sources":["../src/analysis-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,qBAAa,mBAAmB,CAAC,MAAM;IACrC,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,WAAW,CAAK;IAExB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM;IAazD,KAAK,IAAI,kBAAkB;IAO3B,KAAK,IAAI,IAAI;CAKd"}

package/dist/analysis-cache.js

@@ -0,0 +1,28 @@
+export class SourceAnalysisCache {
+    cache = new WeakMap();
+    cacheHits = 0;
+    cacheMisses = 0;
+    get(sourceFile, create) {
+        const cached = this.cache.get(sourceFile);
+        if (cached) {
+            this.cacheHits += 1;
+            return cached;
+        }
+        const value = create();
+        this.cache.set(sourceFile, value);
+        this.cacheMisses += 1;
+        return value;
+    }
+    stats() {
+        return {
+            cacheHits: this.cacheHits,
+            cacheMisses: this.cacheMisses
+        };
+    }
+    clear() {
+        this.cache = new WeakMap();
+        this.cacheHits = 0;
+        this.cacheMisses = 0;
+    }
+}
+//# sourceMappingURL=analysis-cache.js.map

package/dist/analysis-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-cache.js","sourceRoot":"","sources":["../src/analysis-cache.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,mBAAmB;IACtB,KAAK,GAAG,IAAI,OAAO,EAAsB,CAAC;IAC1C,SAAS,GAAG,CAAC,CAAC;IACd,WAAW,GAAG,CAAC,CAAC;IAExB,GAAG,CAAC,UAAsB,EAAE,MAAoB;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YACpB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK;QACH,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,EAAsB,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;IACvB,CAAC;CACF"}

package/dist/ast-utils.d.ts

@@ -1,17 +1,41 @@
 import type { Severity, SourceFile } from "@next-secure-check/core";
+import ts from "typescript";
+import { type AnalysisCacheStats } from "./analysis-cache.js";
 export type AstMatch = {
     line: number;
     column: number;
     evidence: string;
     sourceLine: string;
+    evidencePath?: string;
 };
 export type DangerouslySetInnerHtmlMatch = AstMatch & {
     severity: Extract<Severity, "LOW" | "MEDIUM">;
 };
+export type AnalysisFacts = {
+    sourceFile: ts.SourceFile;
+    commandIdentifiers: ReadonlySet<string>;
+    childProcessNamespaces: ReadonlySet<string>;
+    commandDeclarationNodes: readonly ts.Node[];
+    commandSourcePaths: ReadonlyMap<ts.CallExpression, string>;
+    safeCommandCalls: ReadonlySet<ts.CallExpression>;
+    routeHandlerNodes: readonly ts.Node[];
+    sanitizerIdentifiers: ReadonlySet<string>;
+    safeHtmlIdentifiers: ReadonlySet<string>;
+    hasPasswordHashing: boolean;
+    hasAuthIntent: boolean;
+    hasValidationIntent: boolean;
+    hasUploadHandling: boolean;
+};
+export type AnalysisFactsCacheStats = AnalysisCacheStats;
+export declare function getAnalysisFacts(file: SourceFile): AnalysisFacts;
+export declare function getAnalysisFactsCacheStats(): AnalysisFactsCacheStats;
+export declare function resetAnalysisFactsCacheForTests(): void;
 export declare function findCommandExecutionMatches(file: SourceFile): AstMatch[];
 export declare function findRawSqlConcatMatches(file: SourceFile): AstMatch[];
 export declare function findDangerouslySetInnerHtmlMatches(file: SourceFile): DangerouslySetInnerHtmlMatch[];
 export declare function findPasswordHandlingMatches(file: SourceFile): AstMatch[];
 export declare function findRouteHandlerExports(file: SourceFile): AstMatch[];
+export declare function hasAuthIntentSignal(file: SourceFile): boolean;
+export declare function hasValidationIntentSignal(file: SourceFile): boolean;
 export declare function findUploadRouteHandlerMatches(file: SourceFile): AstMatch[];
 //# sourceMappingURL=ast-utils.d.ts.map

package/dist/ast-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ast-utils.d.ts","sourceRoot":"","sources":["../src/ast-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGpE,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,GAAG;IACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC;CAC/C,CAAC;AAQF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAsBxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAmBpE;AAED,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,UAAU,GAAG,4BAA4B,EAAE,CAqBnG;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAexE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAYpE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAqB1E"}
+{"version":3,"file":"ast-utils.d.ts","sourceRoot":"","sources":["../src/ast-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAenF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,GAAG;IACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IAC1B,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5C,uBAAuB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5C,kBAAkB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC3D,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;IACjD,iBAAiB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAIzD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAWhE;AAED,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAmBxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAGpE;AAED,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,UAAU,GAAG,4BAA4B,EAAE,CAQnG;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAOxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAGpE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAE7D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEnE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAc1E"}

package/dist/ast-utils.js

@@ -1,379 +1,110 @@
 import ts from "typescript";
-const COMMAND_EXECUTION_NAMES = new Set(["exec", "execSync", "spawn", "spawnSync"]);
-const ROUTE_HANDLER_NAMES = new Set(["GET", "POST", "PUT", "DELETE", "PATCH"]);
-const SQL_QUERY_METHOD_NAMES = new Set(["query", "execute"]);
-const SQL_RAW_TAG_NAMES = new Set(["$queryRaw", "$executeRaw"]);
-const SQL_KEYWORD_PATTERN = /\b(SELECT|INSERT|UPDATE|DELETE)\b/i;
-export function findCommandExecutionMatches(file) {
-    const sourceFile = ts.createSourceFile(file.path, file.content, ts.ScriptTarget.Latest, true, scriptKindForPath(file.path));
-    const commandIdentifiers = new Set();
-    const childProcessNamespaces = new Set();
-    const declarationNodes = [];
-    visit(sourceFile, (node) => {
-        collectChildProcessImports(node, commandIdentifiers, childProcessNamespaces, declarationNodes);
-        collectChildProcessRequires(node, commandIdentifiers, childProcessNamespaces, declarationNodes);
+import { SourceAnalysisCache } from "./analysis-cache.js";
+import { collectCommandDiscovery } from "./command-discovery.js";
+import { collectCommandFlowFacts, isAnalyzableCommandExecutionCall } from "./command-flow.js";
+import { findPasswordHandlingNodes, hasPasswordHashingCall } from "./password-ast.js";
+import { findRawSqlConcatNodes } from "./sql-ast.js";
+import { ROUTE_HANDLER_NAMES, exportedRouteHandlerName, hasAuthIntentInSource, hasValidationIntentInSource, isApiRouteFilePath, isUploadHandlingNode } from "./route-ast.js";
+import { createXssAnalysisFacts, findDangerouslySetInnerHtmlNodes } from "./xss-ast.js";
+const analysisFactsCache = new SourceAnalysisCache();
+export function getAnalysisFacts(file) {
+    return analysisFactsCache.get(file, () => {
+        const sourceFile = ts.createSourceFile(file.path, file.content, ts.ScriptTarget.Latest, true, scriptKindForPath(file.path));
+        return createAnalysisFacts(sourceFile);
     });
-    const matches = declarationNodes.map((node) => matchFromNode(file, sourceFile, node));
+}
+export function getAnalysisFactsCacheStats() {
+    return analysisFactsCache.stats();
+}
+export function resetAnalysisFactsCacheForTests() {
+    analysisFactsCache.clear();
+}
+export function findCommandExecutionMatches(file) {
+    const { sourceFile, commandIdentifiers, childProcessNamespaces, commandDeclarationNodes, commandSourcePaths, safeCommandCalls } = getAnalysisFacts(file);
+    const matches = commandDeclarationNodes.map((node) => matchFromNode(file, sourceFile, node));
     visit(sourceFile, (node) => {
-        if (!ts.isCallExpression(node) || !isCommandExecutionCall(node.expression, commandIdentifiers, childProcessNamespaces)) {
+        if (!ts.isCallExpression(node) ||
+            safeCommandCalls.has(node) ||
+            !isAnalyzableCommandExecutionCall(node, commandIdentifiers, childProcessNamespaces)) {
             return;
         }
-        matches.push(matchFromNode(file, sourceFile, node));
+        const match = matchFromNode(file, sourceFile, node);
+        const evidencePath = commandSourcePaths.get(node);
+        matches.push(evidencePath ? { ...match, evidencePath } : match);
     });
     return dedupeMatches(matches);
 }
 export function findRawSqlConcatMatches(file) {
-    const sourceFile = ts.createSourceFile(file.path, file.content, ts.ScriptTarget.Latest, true, scriptKindForPath(file.path));
-    const matches = [];
-    visit(sourceFile, (node) => {
-        if (ts.isCallExpression(node) && isSqlQuerySinkCall(node)) {
-            const [firstArgument] = node.arguments;
-            if (isInterpolatedSqlTemplate(firstArgument)) {
-                matches.push(matchFromNode(file, sourceFile, node));
-            }
-            return;
-        }
-        if (ts.isTaggedTemplateExpression(node) && isRawSqlTaggedTemplate(node) && isInterpolatedSqlTemplate(node.template)) {
-            matches.push(matchFromNode(file, sourceFile, node));
-        }
-    });
-    return dedupeMatches(matches);
+    const { sourceFile } = getAnalysisFacts(file);
+    return dedupeMatches(findRawSqlConcatNodes(sourceFile).map((node) => matchFromNode(file, sourceFile, node)));
 }
 export function findDangerouslySetInnerHtmlMatches(file) {
-    const sourceFile = ts.createSourceFile(file.path, file.content, ts.ScriptTarget.Latest, true, scriptKindForPath(file.path));
-    const matches = [];
-    visit(sourceFile, (node) => {
-        if (!ts.isJsxAttribute(node) || !ts.isIdentifier(node.name) || node.name.text !== "dangerouslySetInnerHTML") {
-            return;
-        }
-        const severity = dangerouslySetInnerHtmlSeverity(node.initializer);
-        if (!severity) {
-            return;
-        }
-        matches.push({
-            ...matchFromNode(file, sourceFile, node),
-            severity
-        });
-    });
-    return dedupeMatches(matches);
+    const { sourceFile, sanitizerIdentifiers, safeHtmlIdentifiers } = getAnalysisFacts(file);
+    return dedupeMatches(findDangerouslySetInnerHtmlNodes(sourceFile, sanitizerIdentifiers, safeHtmlIdentifiers).map(({ node, severity }) => ({
+        ...matchFromNode(file, sourceFile, node),
+        severity
+    })));
 }
 export function findPasswordHandlingMatches(file) {
-    const sourceFile = ts.createSourceFile(file.path, file.content, ts.ScriptTarget.Latest, true, scriptKindForPath(file.path));
-    const matches = [];
-    if (hasPasswordHashingCall(sourceFile)) {
-        return matches;
+    const { sourceFile, hasPasswordHashing } = getAnalysisFacts(file);
+    if (hasPasswordHashing) {
+        return [];
     }
-    visit(sourceFile, (node) => {
-        if (isPasswordHandlingNode(node)) {
-            matches.push(matchFromNode(file, sourceFile, node));
-        }
-    });
-    return dedupeMatches(matches);
+    return dedupeMatches(findPasswordHandlingNodes(sourceFile).map((node) => matchFromNode(file, sourceFile, node)));
 }
 export function findRouteHandlerExports(file) {
-    const sourceFile = ts.createSourceFile(file.path, file.content, ts.ScriptTarget.Latest, true, scriptKindForPath(file.path));
-    const matches = [];
-    visit(sourceFile, (node) => {
-        const name = exportedRouteHandlerName(node);
-        if (name && (name === "DEFAULT" || ROUTE_HANDLER_NAMES.has(name))) {
-            matches.push(matchFromNode(file, sourceFile, node));
-        }
-    });
-    return dedupeMatches(matches);
+    const { sourceFile, routeHandlerNodes } = getAnalysisFacts(file);
+    return dedupeMatches(routeHandlerNodes.map((node) => matchFromNode(file, sourceFile, node)));
+}
+export function hasAuthIntentSignal(file) {
+    return getAnalysisFacts(file).hasAuthIntent;
+}
+export function hasValidationIntentSignal(file) {
+    return getAnalysisFacts(file).hasValidationIntent;
 }
 export function findUploadRouteHandlerMatches(file) {
     if (!isApiRouteFilePath(file.path)) {
         return [];
     }
-    const sourceFile = ts.createSourceFile(file.path, file.content, ts.ScriptTarget.Latest, true, scriptKindForPath(file.path));
-    const routeHandlerMatches = [];
+    const { sourceFile, routeHandlerNodes, hasUploadHandling } = getAnalysisFacts(file);
+    const routeHandlerMatches = routeHandlerNodes
+        .filter((node) => {
+        const name = exportedRouteHandlerName(node);
+        return name === "DEFAULT" || name === "POST" || name === "PUT" || name === "PATCH";
+    })
+        .map((node) => matchFromNode(file, sourceFile, node));
+    return hasUploadHandling ? dedupeMatches(routeHandlerMatches) : [];
+}
+function createAnalysisFacts(sourceFile) {
+    const commandDiscovery = collectCommandDiscovery(sourceFile);
+    const commandFlow = collectCommandFlowFacts(sourceFile, commandDiscovery.commandIdentifiers, commandDiscovery.childProcessNamespaces);
+    const routeHandlerNodes = [];
     let hasUploadHandling = false;
     visit(sourceFile, (node) => {
-        const name = exportedRouteHandlerName(node);
-        if (name && (name === "DEFAULT" || name === "POST" || name === "PUT" || name === "PATCH")) {
-            routeHandlerMatches.push(matchFromNode(file, sourceFile, node));
+        const routeName = exportedRouteHandlerName(node);
+        if (routeName && (routeName === "DEFAULT" || ROUTE_HANDLER_NAMES.has(routeName))) {
+            routeHandlerNodes.push(node);
         }
         if (!hasUploadHandling && isUploadHandlingNode(node)) {
             hasUploadHandling = true;
         }
     });
-    return hasUploadHandling ? dedupeMatches(routeHandlerMatches) : [];
-}
-function collectChildProcessImports(node, commandIdentifiers, childProcessNamespaces, declarationNodes) {
-    if (!ts.isImportDeclaration(node) || !isChildProcessSpecifier(node.moduleSpecifier)) {
-        return;
-    }
-    const importClause = node.importClause;
-    if (!importClause) {
-        return;
-    }
-    if (importClause.name) {
-        childProcessNamespaces.add(importClause.name.text);
-    }
-    const namedBindings = importClause.namedBindings;
-    if (namedBindings && ts.isNamespaceImport(namedBindings)) {
-        childProcessNamespaces.add(namedBindings.name.text);
-        return;
-    }
-    if (!namedBindings || !ts.isNamedImports(namedBindings)) {
-        return;
-    }
-    for (const importSpecifier of namedBindings.elements) {
-        const importedName = importSpecifier.propertyName?.text ?? importSpecifier.name.text;
-        if (!COMMAND_EXECUTION_NAMES.has(importedName)) {
-            continue;
-        }
-        commandIdentifiers.add(importSpecifier.name.text);
-        declarationNodes.push(importSpecifier);
-    }
-}
-function collectChildProcessRequires(node, commandIdentifiers, childProcessNamespaces, declarationNodes) {
-    if (!ts.isVariableDeclaration(node) || !node.initializer) {
-        return;
-    }
-    if (isRequireChildProcessCall(node.initializer)) {
-        if (ts.isIdentifier(node.name)) {
-            childProcessNamespaces.add(node.name.text);
-            return;
-        }
-        if (ts.isObjectBindingPattern(node.name)) {
-            for (const element of node.name.elements) {
-                const importedName = bindingElementName(element);
-                const localName = bindingElementLocalName(element);
-                if (!importedName || !localName || !COMMAND_EXECUTION_NAMES.has(importedName)) {
-                    continue;
-                }
-                commandIdentifiers.add(localName);
-                declarationNodes.push(element);
-            }
-        }
-        return;
-    }
-    if (ts.isPropertyAccessExpression(node.initializer) && isRequireChildProcessCall(node.initializer.expression)) {
-        const importedName = node.initializer.name.text;
-        if (ts.isIdentifier(node.name) && COMMAND_EXECUTION_NAMES.has(importedName)) {
-            commandIdentifiers.add(node.name.text);
-            declarationNodes.push(node);
-        }
-    }
-}
-function isCommandExecutionCall(expression, commandIdentifiers, childProcessNamespaces) {
-    if (ts.isIdentifier(expression)) {
-        return commandIdentifiers.has(expression.text);
-    }
-    if (!ts.isPropertyAccessExpression(expression) || !COMMAND_EXECUTION_NAMES.has(expression.name.text)) {
-        return false;
-    }
-    return ts.isIdentifier(expression.expression) && childProcessNamespaces.has(expression.expression.text);
-}
-function isSqlQuerySinkCall(node) {
-    const expression = node.expression;
-    return ts.isPropertyAccessExpression(expression) && SQL_QUERY_METHOD_NAMES.has(expression.name.text);
-}
-function isRawSqlTaggedTemplate(node) {
-    const tag = node.tag;
-    return ts.isPropertyAccessExpression(tag) && SQL_RAW_TAG_NAMES.has(tag.name.text);
-}
-function isInterpolatedSqlTemplate(node) {
-    return node !== undefined && ts.isTemplateExpression(node) && SQL_KEYWORD_PATTERN.test(node.getText());
-}
-function dangerouslySetInnerHtmlSeverity(initializer) {
-    if (!initializer || ts.isStringLiteral(initializer)) {
-        return undefined;
-    }
-    if (!ts.isJsxExpression(initializer) || !initializer.expression) {
-        return undefined;
-    }
-    const expression = initializer.expression;
-    if (!ts.isObjectLiteralExpression(expression)) {
-        return "LOW";
-    }
-    const htmlExpression = expression.properties
-        .filter(ts.isPropertyAssignment)
-        .find((property) => propertyNameText(property.name) === "__html")?.initializer;
-    if (!htmlExpression || isStaticHtmlExpression(htmlExpression) || isSanitizedHtmlExpression(htmlExpression)) {
-        return undefined;
-    }
-    return "MEDIUM";
-}
-function propertyNameText(name) {
-    if (ts.isIdentifier(name) || ts.isStringLiteralLike(name) || ts.isNumericLiteral(name)) {
-        return name.text;
-    }
-    return undefined;
-}
-function isStaticHtmlExpression(expression) {
-    return ts.isStringLiteralLike(expression) || ts.isNoSubstitutionTemplateLiteral(expression);
-}
-function isSanitizedHtmlExpression(expression) {
-    if (!ts.isCallExpression(expression)) {
-        return false;
-    }
-    const sanitizerName = callExpressionName(expression.expression);
-    return sanitizerName !== undefined && /^(?:sanitize|sanitizeHtml|sanitizeMarkdown)$/i.test(sanitizerName);
-}
-function callExpressionName(expression) {
-    if (ts.isIdentifier(expression)) {
-        return expression.text;
-    }
-    if (ts.isPropertyAccessExpression(expression)) {
-        return expression.name.text;
-    }
-    return undefined;
-}
-function hasPasswordHashingCall(sourceFile) {
-    let hasHashingCall = false;
-    visit(sourceFile, (node) => {
-        if (hasHashingCall || !ts.isCallExpression(node)) {
-            return;
-        }
-        hasHashingCall = isPasswordHashingCall(node);
-    });
-    return hasHashingCall;
-}
-function isPasswordHashingCall(node) {
-    const expression = node.expression;
-    if (ts.isIdentifier(expression)) {
-        return /^scrypt(?:Sync)?$/i.test(expression.text);
-    }
-    if (!ts.isPropertyAccessExpression(expression)) {
-        return false;
-    }
-    const methodName = expression.name.text;
-    const targetName = expressionNameText(expression.expression);
-    if (/^scrypt(?:Sync)?$/i.test(methodName) && targetName === "crypto") {
-        return true;
-    }
-    return methodName === "hash" && (targetName === "bcrypt" || targetName === "argon2");
-}
-function isPasswordHandlingNode(node) {
-    if (ts.isVariableDeclaration(node)) {
-        return isPasswordVariableDeclaration(node);
-    }
-    return (ts.isPropertyAccessExpression(node) &&
-        node.name.text === "password" &&
-        isRequestBodyExpression(node.expression) &&
-        !isVariableDeclarationInitializer(node));
-}
-function isPasswordVariableDeclaration(node) {
-    if (!node.initializer) {
-        return false;
-    }
-    if (ts.isIdentifier(node.name) && node.name.text === "password") {
-        return isPasswordSourceExpression(node.initializer);
-    }
-    if (!ts.isObjectBindingPattern(node.name)) {
-        return false;
-    }
-    return node.name.elements.some((element) => bindingElementName(element) === "password") && isCredentialJsonExpression(node.initializer);
-}
-function isPasswordSourceExpression(expression) {
-    return isPasswordPropertyAccess(expression) || isPasswordFormDataGetCall(expression);
-}
-function isPasswordPropertyAccess(expression) {
-    return ts.isPropertyAccessExpression(expression) && expression.name.text === "password" && isCredentialContainerExpression(expression.expression);
-}
-function isPasswordFormDataGetCall(expression) {
-    if (!ts.isCallExpression(expression) || !ts.isPropertyAccessExpression(expression.expression) || expression.expression.name.text !== "get") {
-        return false;
-    }
-    const [fieldName] = expression.arguments;
-    return fieldName !== undefined && ts.isStringLiteralLike(fieldName) && fieldName.text === "password";
-}
-function isVariableDeclarationInitializer(expression) {
-    return ts.isVariableDeclaration(expression.parent) && expression.parent.initializer === expression;
-}
-function isCredentialContainerExpression(expression) {
-    return isRequestBodyExpression(expression) || isCredentialLikeIdentifier(expression);
-}
-function isRequestBodyExpression(expression) {
-    return ((ts.isIdentifier(expression) && /^(body|credentials|credential|data|payload|formData)$/i.test(expression.text)) ||
-        (ts.isPropertyAccessExpression(expression) &&
-            expression.name.text === "body" &&
-            ts.isIdentifier(expression.expression) &&
-            /^(req|request)$/i.test(expression.expression.text)));
-}
-function isCredentialJsonExpression(expression) {
-    const unwrappedExpression = ts.isAwaitExpression(expression) ? expression.expression : expression;
-    return (ts.isCallExpression(unwrappedExpression) &&
-        ts.isPropertyAccessExpression(unwrappedExpression.expression) &&
-        unwrappedExpression.expression.name.text === "json" &&
-        ts.isIdentifier(unwrappedExpression.expression.expression) &&
-        /^(request|req)$/i.test(unwrappedExpression.expression.expression.text));
-}
-function isCredentialLikeIdentifier(expression) {
-    return ts.isIdentifier(expression) && /^(credentials?|user|account)$/i.test(expression.text);
-}
-function expressionNameText(expression) {
-    return ts.isIdentifier(expression) ? expression.text : undefined;
-}
-function exportedRouteHandlerName(node) {
-    if (ts.isFunctionDeclaration(node) && hasDefaultExportModifier(node)) {
-        return "DEFAULT";
-    }
-    if (ts.isFunctionDeclaration(node) && hasExportModifier(node) && node.name) {
-        return node.name.text;
-    }
-    if (!ts.isVariableStatement(node) || !hasExportModifier(node)) {
-        return undefined;
-    }
-    const [declaration] = node.declarationList.declarations;
-    return declaration && ts.isIdentifier(declaration.name) ? declaration.name.text : undefined;
-}
-function hasExportModifier(node) {
-    return ts.canHaveModifiers(node) && (ts.getModifiers(node) ?? []).some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword);
-}
-function hasDefaultExportModifier(node) {
-    const modifiers = ts.canHaveModifiers(node) ? (ts.getModifiers(node) ?? []) : [];
-    return (modifiers.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) &&
-        modifiers.some((modifier) => modifier.kind === ts.SyntaxKind.DefaultKeyword));
-}
-function isApiRouteFilePath(filePath) {
-    const normalizedPath = filePath.replace(/\\/g, "/");
-    return (/^app\/api\/.*\/route\.[tj]s$/i.test(normalizedPath) ||
-        /^src\/app\/api\/.*\/route\.[tj]s$/i.test(normalizedPath) ||
-        /^pages\/api\/.*\.([tj]s)$/i.test(normalizedPath) ||
-        /^apps\/[^/]+\/app\/api\/.*\/route\.[tj]s$/i.test(normalizedPath) ||
-        /^apps\/[^/]+\/src\/app\/api\/.*\/route\.[tj]s$/i.test(normalizedPath) ||
-        /^apps\/[^/]+\/pages\/api\/.*\.([tj]s)$/i.test(normalizedPath));
-}
-function isUploadHandlingNode(node) {
-    if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
-        const methodName = node.expression.name.text;
-        if (methodName === "formData") {
-            return true;
-        }
-        if (methodName === "get") {
-            const [fieldName] = node.arguments;
-            return fieldName !== undefined && ts.isStringLiteralLike(fieldName) && /^(file|files|blob|image|avatar|media)$/i.test(fieldName.text);
-        }
-    }
-    if (ts.isIdentifier(node)) {
-        return /^(file|files|blob|formData)$/i.test(node.text);
-    }
-    if (ts.isTypeReferenceNode(node) && ts.isIdentifier(node.typeName)) {
-        return /^(File|Blob|FormData)$/i.test(node.typeName.text);
-    }
-    return false;
-}
-function isRequireChildProcessCall(node) {
-    if (!ts.isCallExpression(node) || !ts.isIdentifier(node.expression) || node.expression.text !== "require") {
-        return false;
-    }
-    const [specifier] = node.arguments;
-    return isChildProcessSpecifier(specifier);
-}
-function isChildProcessSpecifier(node) {
-    return node !== undefined && ts.isStringLiteralLike(node) && /^(?:node:)?child_process$/.test(node.text);
-}
-function bindingElementName(element) {
-    if (element.propertyName) {
-        return ts.isIdentifier(element.propertyName) || ts.isStringLiteralLike(element.propertyName) ? element.propertyName.text : undefined;
-    }
-    return ts.isIdentifier(element.name) ? element.name.text : undefined;
-}
-function bindingElementLocalName(element) {
-    return ts.isIdentifier(element.name) ? element.name.text : undefined;
+    const xssFacts = createXssAnalysisFacts(sourceFile);
+    return {
+        sourceFile,
+        commandIdentifiers: commandDiscovery.commandIdentifiers,
+        childProcessNamespaces: commandDiscovery.childProcessNamespaces,
+        commandDeclarationNodes: commandDiscovery.commandDeclarationNodes,
+        commandSourcePaths: commandFlow.sourcePaths,
+        safeCommandCalls: commandFlow.safeCommandCalls,
+        routeHandlerNodes,
+        sanitizerIdentifiers: xssFacts.sanitizerIdentifiers,
+        safeHtmlIdentifiers: xssFacts.safeHtmlIdentifiers,
+        hasPasswordHashing: hasPasswordHashingCall(sourceFile),
+        hasAuthIntent: hasAuthIntentInSource(sourceFile),
+        hasValidationIntent: hasValidationIntentInSource(sourceFile),
+        hasUploadHandling
+    };
 }
 function matchFromNode(file, sourceFile, node) {
     const position = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));