@next-secure-check/rules 0.3.0 → 0.4.0

package/LICENSE

@@ -1,21 +1,22 @@
-MIT License
-
-Copyright (c) 2026 SetraTheXX
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 SetraTheXX
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/README.md

@@ -5,7 +5,7 @@ Built-in deterministic security rules for `next-secure-check`.
 This is an internal workspace package published for the `next-secure-check` CLI. Rules cover common Next.js security checks across secrets, injection, XSS, auth, config, headers, upload, and validation categories. Most users should install the CLI package instead:
 
 ```bash
-npx next-secure-check scan .
+npx --yes next-secure-check@latest scan .
 ```
 
 See the main repository for rule documentation:

package/dist/analysis-cache.d.ts

@@ -0,0 +1,14 @@
+import type { SourceFile } from "@next-secure-check/core";
+export type AnalysisCacheStats = {
+    cacheHits: number;
+    cacheMisses: number;
+};
+export declare class SourceAnalysisCache<TValue> {
+    private cache;
+    private cacheHits;
+    private cacheMisses;
+    get(sourceFile: SourceFile, create: () => TValue): TValue;
+    stats(): AnalysisCacheStats;
+    clear(): void;
+}
+//# sourceMappingURL=analysis-cache.d.ts.map

package/dist/analysis-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-cache.d.ts","sourceRoot":"","sources":["../src/analysis-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,qBAAa,mBAAmB,CAAC,MAAM;IACrC,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,WAAW,CAAK;IAExB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM;IAazD,KAAK,IAAI,kBAAkB;IAO3B,KAAK,IAAI,IAAI;CAKd"}

package/dist/analysis-cache.js

@@ -0,0 +1,28 @@
+export class SourceAnalysisCache {
+    cache = new WeakMap();
+    cacheHits = 0;
+    cacheMisses = 0;
+    get(sourceFile, create) {
+        const cached = this.cache.get(sourceFile);
+        if (cached) {
+            this.cacheHits += 1;
+            return cached;
+        }
+        const value = create();
+        this.cache.set(sourceFile, value);
+        this.cacheMisses += 1;
+        return value;
+    }
+    stats() {
+        return {
+            cacheHits: this.cacheHits,
+            cacheMisses: this.cacheMisses
+        };
+    }
+    clear() {
+        this.cache = new WeakMap();
+        this.cacheHits = 0;
+        this.cacheMisses = 0;
+    }
+}
+//# sourceMappingURL=analysis-cache.js.map

package/dist/analysis-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-cache.js","sourceRoot":"","sources":["../src/analysis-cache.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,mBAAmB;IACtB,KAAK,GAAG,IAAI,OAAO,EAAsB,CAAC;IAC1C,SAAS,GAAG,CAAC,CAAC;IACd,WAAW,GAAG,CAAC,CAAC;IAExB,GAAG,CAAC,UAAsB,EAAE,MAAoB;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YACpB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK;QACH,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,EAAsB,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;IACvB,CAAC;CACF"}

package/dist/ast-utils.d.ts

@@ -1,17 +1,41 @@
 import type { Severity, SourceFile } from "@next-secure-check/core";
+import ts from "typescript";
+import { type AnalysisCacheStats } from "./analysis-cache.js";
 export type AstMatch = {
     line: number;
     column: number;
     evidence: string;
     sourceLine: string;
+    evidencePath?: string;
 };
 export type DangerouslySetInnerHtmlMatch = AstMatch & {
     severity: Extract<Severity, "LOW" | "MEDIUM">;
 };
+export type AnalysisFacts = {
+    sourceFile: ts.SourceFile;
+    commandIdentifiers: ReadonlySet<string>;
+    childProcessNamespaces: ReadonlySet<string>;
+    commandDeclarationNodes: readonly ts.Node[];
+    commandSourcePaths: ReadonlyMap<ts.CallExpression, string>;
+    safeCommandCalls: ReadonlySet<ts.CallExpression>;
+    routeHandlerNodes: readonly ts.Node[];
+    sanitizerIdentifiers: ReadonlySet<string>;
+    safeHtmlIdentifiers: ReadonlySet<string>;
+    hasPasswordHashing: boolean;
+    hasAuthIntent: boolean;
+    hasValidationIntent: boolean;
+    hasUploadHandling: boolean;
+};
+export type AnalysisFactsCacheStats = AnalysisCacheStats;
+export declare function getAnalysisFacts(file: SourceFile): AnalysisFacts;
+export declare function getAnalysisFactsCacheStats(): AnalysisFactsCacheStats;
+export declare function resetAnalysisFactsCacheForTests(): void;
 export declare function findCommandExecutionMatches(file: SourceFile): AstMatch[];
 export declare function findRawSqlConcatMatches(file: SourceFile): AstMatch[];
 export declare function findDangerouslySetInnerHtmlMatches(file: SourceFile): DangerouslySetInnerHtmlMatch[];
 export declare function findPasswordHandlingMatches(file: SourceFile): AstMatch[];
 export declare function findRouteHandlerExports(file: SourceFile): AstMatch[];
+export declare function hasAuthIntentSignal(file: SourceFile): boolean;
+export declare function hasValidationIntentSignal(file: SourceFile): boolean;
 export declare function findUploadRouteHandlerMatches(file: SourceFile): AstMatch[];
 //# sourceMappingURL=ast-utils.d.ts.map

package/dist/ast-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ast-utils.d.ts","sourceRoot":"","sources":["../src/ast-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGpE,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,GAAG;IACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC;CAC/C,CAAC;AASF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAsBxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAmBpE;AAED,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,UAAU,GAAG,4BAA4B,EAAE,CAuBnG;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAexE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAYpE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAqB1E"}
+{"version":3,"file":"ast-utils.d.ts","sourceRoot":"","sources":["../src/ast-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAenF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,GAAG;IACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IAC1B,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5C,uBAAuB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5C,kBAAkB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC3D,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;IACjD,iBAAiB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAIzD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAWhE;AAED,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAmBxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAGpE;AAED,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,UAAU,GAAG,4BAA4B,EAAE,CAQnG;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAOxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAGpE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAE7D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEnE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAc1E"}