@oculum/scanner 1.0.0

package/dist/layer1/urls.js

@@ -0,0 +1,296 @@
+"use strict";
+/**
+ * Layer 1: URL Pattern Matching
+ * Detects hardcoded sensitive URLs that may indicate security issues
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aggregateLocalhostFindings = aggregateLocalhostFindings;
+exports.detectSensitiveURLs = detectSensitiveURLs;
+// Check if file is documentation/README/example
+function isDocumentationFile(filePath) {
+    const docPatterns = [
+        /README/i,
+        /CHANGELOG/i,
+        /CONTRIBUTING/i,
+        /LICENSE/i,
+        /\.md$/i,
+        /\.mdx$/i,
+        /\.rst$/i,
+        /\.adoc$/i,
+        /\/docs\//i,
+        /\/documentation\//i,
+        /\/wiki\//i,
+        /\/guides?\//i,
+        /\/tutorials?\//i,
+        /\/examples?\//i,
+    ];
+    return docPatterns.some(p => p.test(filePath));
+}
+// Check if file is a config/constants file where localhost is expected
+function isDevConfigFile(filePath) {
+    const devConfigPatterns = [
+        /\.env\.local$/i,
+        /\.env\.development$/i,
+        /\.env\.dev$/i,
+        /\.env\.example$/i,
+        /\.env\.sample$/i,
+        /config\.dev\./i,
+        /config\.development\./i,
+        /config\.local\./i,
+        /\/config\/development\//i,
+        /\/config\/local\//i,
+        /constants\.dev\./i,
+    ];
+    return devConfigPatterns.some(p => p.test(filePath));
+}
+// URL patterns that may indicate security issues
+const URL_PATTERNS = [
+    // Internal/staging endpoints in production code
+    {
+        pattern: /https?:\/\/localhost[:\d]*/gi,
+        name: 'Localhost URL',
+        severity: 'medium',
+        description: 'Hardcoded localhost URL found - may cause issues in production',
+    },
+    {
+        pattern: /https?:\/\/127\.0\.0\.1[:\d]*/gi,
+        name: 'Loopback URL',
+        severity: 'medium',
+        description: 'Hardcoded loopback IP address found',
+    },
+    {
+        pattern: /https?:\/\/[^\/]*staging[^\/]*\.[a-z]+/gi,
+        name: 'Staging URL',
+        severity: 'medium',
+        description: 'Hardcoded staging environment URL found',
+    },
+    {
+        pattern: /https?:\/\/[^\/]*\bdev\b[^\/]*\.[a-z]+/gi,
+        name: 'Development URL',
+        severity: 'low',
+        description: 'Hardcoded development environment URL found',
+    },
+    {
+        pattern: /https?:\/\/[^\/]*internal[^\/]*\.[a-z]+/gi,
+        name: 'Internal URL',
+        severity: 'high',
+        description: 'Hardcoded internal URL found - may expose internal infrastructure',
+    },
+    {
+        pattern: /https?:\/\/[^\/]*\btest\b[^\/]*\.[a-z]+/gi,
+        name: 'Test Environment URL',
+        severity: 'low',
+        description: 'Hardcoded test environment URL found',
+    },
+    // Admin/sensitive endpoints - downgraded to info (these are often intentional)
+    {
+        pattern: /['"`]\/admin(?:\/|['"`])/gi,
+        name: 'Admin Endpoint',
+        severity: 'info',
+        description: 'Admin endpoint path found - verify access control',
+    },
+    {
+        pattern: /['"`]\/api\/admin/gi,
+        name: 'Admin API Endpoint',
+        severity: 'low', // Downgraded from medium
+        description: 'Admin API endpoint found - verify access control',
+    },
+    // API keys in URLs
+    {
+        pattern: /\?api[_-]?key=[a-zA-Z0-9_-]{10,}/gi,
+        name: 'API Key in URL Query',
+        severity: 'high',
+        description: 'API key exposed in URL query parameter',
+    },
+    {
+        pattern: /&api[_-]?key=[a-zA-Z0-9_-]{10,}/gi,
+        name: 'API Key in URL Query',
+        severity: 'high',
+        description: 'API key exposed in URL query parameter',
+    },
+    {
+        pattern: /\?token=[a-zA-Z0-9_-]{10,}/gi,
+        name: 'Token in URL Query',
+        severity: 'high',
+        description: 'Token exposed in URL query parameter',
+    },
+    {
+        pattern: /\?secret=[a-zA-Z0-9_-]{10,}/gi,
+        name: 'Secret in URL Query',
+        severity: 'critical',
+        description: 'Secret exposed in URL query parameter',
+    },
+    // Webhook URLs (may contain secrets)
+    {
+        pattern: /https:\/\/hooks\.slack\.com\/services\/[a-zA-Z0-9\/]+/gi,
+        name: 'Slack Webhook URL',
+        severity: 'high',
+        description: 'Slack webhook URL found - should be stored as environment variable',
+    },
+    {
+        pattern: /https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[a-zA-Z0-9_-]+/gi,
+        name: 'Discord Webhook URL',
+        severity: 'high',
+        description: 'Discord webhook URL found - should be stored as environment variable',
+    },
+    // Debug/test endpoints - downgraded (often in test files or intentional)
+    {
+        pattern: /['"`]\/debug(?:\/|['"`])/gi,
+        name: 'Debug Endpoint',
+        severity: 'low', // Downgraded from medium
+        description: 'Debug endpoint found - verify not accessible in production',
+    },
+    {
+        pattern: /['"`]\/test(?:\/|['"`])/gi,
+        name: 'Test Endpoint',
+        severity: 'info', // Downgraded from low
+        description: 'Test endpoint found - typically safe in test context',
+    },
+];
+// Check if line is a comment
+function isComment(lineContent) {
+    const trimmed = lineContent.trim();
+    return (trimmed.startsWith('//') ||
+        trimmed.startsWith('#') ||
+        trimmed.startsWith('*') ||
+        trimmed.startsWith('/*'));
+}
+// Check if it's in a test file
+function isTestFile(filePath) {
+    return /\.(test|spec)\.(ts|tsx|js|jsx)$/i.test(filePath) ||
+        /\/__tests__\//i.test(filePath) ||
+        /\/test\//i.test(filePath);
+}
+// Check if URL is in an environment variable reference
+function isEnvVarReference(lineContent) {
+    return lineContent.includes('process.env') ||
+        lineContent.includes('${') ||
+        lineContent.includes('import.meta.env');
+}
+// Get URL context for smarter detection
+function getURLContext(lineContent, filePath) {
+    return {
+        isDevOnly: /['"]?BASE_URL['"]?|['"]?API_URL['"]?|['"]?NEXT_PUBLIC_/.test(lineContent),
+        isConfigFile: /config|settings|constants/.test(filePath.toLowerCase()),
+        isTestFile: isTestFile(filePath),
+        isEnvRef: isEnvVarReference(lineContent)
+    };
+}
+// Aggregate repeated localhost findings per file
+function aggregateLocalhostFindings(vulnerabilities) {
+    const localhostByFile = new Map();
+    const result = [];
+    for (const vuln of vulnerabilities) {
+        // Check if this is a localhost/127.0.0.1 URL
+        if (vuln.category === 'sensitive_url' &&
+            /localhost|127\.0\.0\.1/i.test(vuln.lineContent)) {
+            const key = vuln.filePath;
+            if (!localhostByFile.has(key)) {
+                localhostByFile.set(key, { lines: [], urls: [], original: vuln });
+            }
+            const entry = localhostByFile.get(key);
+            entry.lines.push(vuln.lineNumber);
+            entry.urls.push(vuln.lineContent);
+        }
+        else {
+            result.push(vuln);
+        }
+    }
+    // Create aggregated findings for localhost URLs
+    for (const [filePath, data] of localhostByFile) {
+        const aggregated = {
+            ...data.original,
+            title: `Localhost URLs in development code (${data.lines.length} instances)`,
+            description: `Found ${data.lines.length} localhost references on lines ${data.lines.join(', ')}. ` +
+                `This is typically safe in development but should use environment variables.`,
+            lineNumber: data.lines[0],
+            severity: 'info', // Downgraded to info
+        };
+        result.push(aggregated);
+    }
+    return result;
+}
+function detectSensitiveURLs(content, filePath) {
+    const vulnerabilities = [];
+    // Skip documentation files entirely - they often contain example URLs
+    if (isDocumentationFile(filePath)) {
+        return vulnerabilities;
+    }
+    const lines = content.split('\n');
+    const inTestFile = isTestFile(filePath);
+    const inDevConfig = isDevConfigFile(filePath);
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Skip comments
+        if (isComment(line))
+            continue;
+        // Get context for this line
+        const context = getURLContext(line, filePath);
+        // Skip environment variable references entirely
+        if (context.isEnvRef)
+            continue;
+        for (const { pattern, name, severity, description } of URL_PATTERNS) {
+            // Reset regex state
+            const regex = new RegExp(pattern.source, pattern.flags);
+            const match = regex.exec(line);
+            if (match) {
+                const url = match[0];
+                // Special handling for localhost URLs
+                if (/localhost|127\.0\.0\.1/i.test(url)) {
+                    // Skip localhost in test files, dev-only contexts, or dev config files
+                    if (context.isTestFile || context.isDevOnly || inDevConfig) {
+                        continue;
+                    }
+                    // Only flag localhost in production env files as high, otherwise info
+                    const isProduction = filePath.includes('.env.production');
+                    const adjustedSeverity = isProduction ? 'high' : 'info';
+                    vulnerabilities.push({
+                        id: `url-${filePath}-${i + 1}-${name}`,
+                        filePath,
+                        lineNumber: i + 1,
+                        lineContent: line.trim(),
+                        severity: adjustedSeverity,
+                        category: 'sensitive_url',
+                        title: name,
+                        description: description + (isProduction ? ' (in production config!)' : ' (in dev/config file)'),
+                        suggestedFix: 'Move URLs to environment variables or configuration files. Use process.env.API_URL pattern.',
+                        confidence: isProduction ? 'high' : 'low',
+                        layer: 1,
+                    });
+                }
+                else {
+                    // Normal URL handling (non-localhost)
+                    // Lower severity for test files - downgrade more aggressively
+                    let adjustedSeverity = severity;
+                    if (inTestFile) {
+                        if (severity === 'critical')
+                            adjustedSeverity = 'high';
+                        else if (severity === 'high')
+                            adjustedSeverity = 'low';
+                        else
+                            adjustedSeverity = 'info';
+                    }
+                    // Non-critical URL findings require AI validation
+                    const requiresAIValidation = severity !== 'critical';
+                    vulnerabilities.push({
+                        id: `url-${filePath}-${i + 1}-${name}`,
+                        filePath,
+                        lineNumber: i + 1,
+                        lineContent: line.trim(),
+                        severity: adjustedSeverity,
+                        category: 'sensitive_url',
+                        title: name,
+                        description: description + (inTestFile ? ' (in test file)' : ''),
+                        suggestedFix: 'Move URLs to environment variables or configuration files. Use process.env.API_URL pattern.',
+                        confidence: inTestFile ? 'low' : 'medium',
+                        layer: 1,
+                        requiresAIValidation,
+                    });
+                }
+                break; // Only report one URL issue per line
+            }
+        }
+    }
+    return vulnerabilities;
+}
+//# sourceMappingURL=urls.js.map

package/dist/layer1/urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.js","sourceRoot":"","sources":["../../src/layer1/urls.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAiMH,gEA0CC;AAED,kDA6FC;AAtUD,gDAAgD;AAChD,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,WAAW,GAAG;QAClB,SAAS;QACT,YAAY;QACZ,eAAe;QACf,UAAU;QACV,QAAQ;QACR,SAAS;QACT,SAAS;QACT,UAAU;QACV,WAAW;QACX,oBAAoB;QACpB,WAAW;QACX,cAAc;QACd,iBAAiB;QACjB,gBAAgB;KACjB,CAAA;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,iBAAiB,GAAG;QACxB,gBAAgB;QAChB,sBAAsB;QACtB,cAAc;QACd,kBAAkB;QAClB,iBAAiB;QACjB,gBAAgB;QAChB,wBAAwB;QACxB,kBAAkB;QAClB,0BAA0B;QAC1B,oBAAoB;QACpB,mBAAmB;KACpB,CAAA;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,iDAAiD;AACjD,MAAM,YAAY,GAAG;IACnB,gDAAgD;IAChD;QACE,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,QAAiB;QAC3B,WAAW,EAAE,gEAAgE;KAC9E;IACD;QACE,OAAO,EAAE,iCAAiC;QAC1C,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,QAAiB;QAC3B,WAAW,EAAE,qCAAqC;KACnD;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,QAAiB;QAC3B,WAAW,EAAE,yCAAyC;KACvD;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,KAAc;QACxB,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,mEAAmE;KACjF;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,KAAc;QACxB,WAAW,EAAE,sCAAsC;KACpD;IAED,+EAA+E;IAC/E;QACE,OAAO,EAAE,4BAA4B;QACrC,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,mDAAmD;KACjE;IACD;QACE,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,KAAc,EAAG,yBAAyB;QACpD,WAAW,EAAE,kDAAkD;KAChE;IAED,mBAAmB;IACnB;QACE,OAAO,EAAE,oCAAoC;QAC7C,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,wCAAwC;KACtD;IACD;QACE,OAAO,EAAE,mCAAmC;QAC5C,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,wCAAwC;KACtD;IACD;QACE,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,sCAAsC;KACpD;IACD;QACE,OAAO,EAAE,+BAA+B;QACxC,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,UAAmB;QAC7B,WAAW,EAAE,uCAAuC;KACrD;IAED,qCAAqC;IACrC;QACE,OAAO,EAAE,yDAAyD;QAClE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,oEAAoE;KAClF;IACD;QACE,OAAO,EAAE,yEAAyE;QAClF,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,sEAAsE;KACpF;IAED,yEAAyE;IACzE;QACE,OAAO,EAAE,4BAA4B;QACrC,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,KAAc,EAAG,yBAAyB;QACpD,WAAW,EAAE,4DAA4D;KAC1E;IACD;QACE,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAe,EAAG,sBAAsB;QAClD,WAAW,EAAE,sDAAsD;KACpE;CACF,CAAA;AAED,6BAA6B;AAC7B,SAAS,SAAS,CAAC,WAAmB;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAA;IAClC,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CACzB,CAAA;AACH,CAAC;AAED,+BAA+B;AAC/B,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjD,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/B,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACnC,CAAC;AAED,uDAAuD;AACvD,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,OAAO,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC;QACnC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1B,WAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;AAChD,CAAC;AAED,wCAAwC;AACxC,SAAS,aAAa,CAAC,WAAmB,EAAE,QAAgB;IAM1D,OAAO;QACL,SAAS,EAAE,wDAAwD,CAAC,IAAI,CAAC,WAAW,CAAC;QACrF,YAAY,EAAE,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;QAChC,QAAQ,EAAE,iBAAiB,CAAC,WAAW,CAAC;KACzC,CAAA;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,0BAA0B,CACxC,eAAgC;IAEhC,MAAM,eAAe,GAAG,IAAI,GAAG,EAI3B,CAAA;IAEJ,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,6CAA6C;QAC7C,IAAI,IAAI,CAAC,QAAQ,KAAK,eAAe;YACjC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAErD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAA;YACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;YACnE,CAAC;YACD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;YACvC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACjC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAkB;YAChC,GAAG,IAAI,CAAC,QAAQ;YAChB,KAAK,EAAE,uCAAuC,IAAI,CAAC,KAAK,CAAC,MAAM,aAAa;YAC5E,WAAW,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,kCAAkC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAChG,6EAA6E;YAC/E,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACzB,QAAQ,EAAE,MAAM,EAAG,qBAAqB;SACzC,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACzB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAgB,mBAAmB,CACjC,OAAe,EACf,QAAgB;IAEhB,MAAM,eAAe,GAAoB,EAAE,CAAA;IAE3C,sEAAsE;IACtE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACvC,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IAE7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAErB,gBAAgB;QAChB,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,SAAQ;QAE7B,4BAA4B;QAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAE7C,gDAAgD;QAChD,IAAI,OAAO,CAAC,QAAQ;YAAE,SAAQ;QAE9B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC;YACpE,oBAAoB;YACpB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAEvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;gBAEpB,sCAAsC;gBACtC,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxC,uEAAuE;oBACvE,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;wBAC3D,SAAQ;oBACV,CAAC;oBAED,sEAAsE;oBACtE,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;oBACzD,MAAM,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,MAAe,CAAA;oBAEzE,eAAe,CAAC,IAAI,CAAC;wBACnB,EAAE,EAAE,OAAO,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE;wBACtC,QAAQ;wBACR,UAAU,EAAE,CAAC,GAAG,CAAC;wBACjB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;wBACxB,QAAQ,EAAE,gBAAgB;wBAC1B,QAAQ,EAAE,eAAe;wBACzB,KAAK,EAAE,IAAI;wBACX,WAAW,EAAE,WAAW,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,CAAC;wBAChG,YAAY,EAAE,6FAA6F;wBAC3G,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;wBACzC,KAAK,EAAE,CAAC;qBACT,CAAC,CAAA;gBACJ,CAAC;qBAAM,CAAC;oBACN,sCAAsC;oBACtC,8DAA8D;oBAC9D,IAAI,gBAAgB,GAAG,QAAQ,CAAA;oBAC/B,IAAI,UAAU,EAAE,CAAC;wBACf,IAAI,QAAQ,KAAK,UAAU;4BAAE,gBAAgB,GAAG,MAAM,CAAA;6BACjD,IAAI,QAAQ,KAAK,MAAM;4BAAE,gBAAgB,GAAG,KAAK,CAAA;;4BACjD,gBAAgB,GAAG,MAAM,CAAA;oBAChC,CAAC;oBAED,kDAAkD;oBAClD,MAAM,oBAAoB,GAAG,QAAQ,KAAK,UAAU,CAAA;oBAEpD,eAAe,CAAC,IAAI,CAAC;wBACnB,EAAE,EAAE,OAAO,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE;wBACtC,QAAQ;wBACR,UAAU,EAAE,CAAC,GAAG,CAAC;wBACjB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;wBACxB,QAAQ,EAAE,gBAAgB;wBAC1B,QAAQ,EAAE,eAAe;wBACzB,KAAK,EAAE,IAAI;wBACX,WAAW,EAAE,WAAW,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;wBAChE,YAAY,EAAE,6FAA6F;wBAC3G,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;wBACzC,KAAK,EAAE,CAAC;wBACR,oBAAoB;qBACrB,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAK,CAAC,qCAAqC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/layer1/weak-crypto.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Layer 1: Weak Cryptography Detection
+ * Detects usage of deprecated or weak cryptographic algorithms
+ */
+import type { Vulnerability } from '../types';
+export declare function detectWeakCrypto(content: string, filePath: string): Vulnerability[];
+//# sourceMappingURL=weak-crypto.d.ts.map

package/dist/layer1/weak-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-crypto.d.ts","sourceRoot":"","sources":["../../src/layer1/weak-crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAsQ7C,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,aAAa,EAAE,CAyDjB"}

package/dist/layer1/weak-crypto.js

@@ -0,0 +1,291 @@
+"use strict";
+/**
+ * Layer 1: Weak Cryptography Detection
+ * Detects usage of deprecated or weak cryptographic algorithms
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectWeakCrypto = detectWeakCrypto;
+// Weak/deprecated cryptographic patterns
+const WEAK_CRYPTO_PATTERNS = [
+    // Weak hash algorithms
+    {
+        pattern: /\bMD5\s*\(/gi,
+        name: 'MD5 Hash Usage',
+        severity: 'high',
+        description: 'MD5 is cryptographically broken and should not be used for security purposes',
+        fix: 'Use SHA-256 or SHA-3 for hashing. For passwords, use bcrypt, scrypt, or Argon2.',
+        contextCheck: (line) => {
+            // Only flag as high if used in security context (passwords, tokens, etc.)
+            // Checksum/etag usage is acceptable for non-security purposes
+            const securityContexts = [/password/i, /token/i, /secret/i, /credential/i, /auth/i, /session/i, /key/i];
+            const checksumContexts = [/checksum/i, /hash.*file/i, /file.*hash/i, /etag/i, /content.*hash/i, /integrity/i, /digest/i, /fingerprint/i];
+            const isSecurityContext = securityContexts.some(p => p.test(line));
+            const isChecksumContext = checksumContexts.some(p => p.test(line));
+            // If it's clearly a checksum context, don't flag
+            if (isChecksumContext && !isSecurityContext) {
+                return false;
+            }
+            return true;
+        },
+    },
+    {
+        pattern: /createHash\s*\(\s*['"]md5['"]\s*\)/gi,
+        name: 'MD5 Hash Creation',
+        severity: 'high',
+        description: 'MD5 is cryptographically broken and should not be used for security purposes',
+        fix: 'Use createHash(\'sha256\') or createHash(\'sha3-256\') instead.',
+        contextCheck: (line, _match, funcName) => {
+            // Check function name and line context for checksum indicators
+            const checksumIndicators = [/checksum/i, /etag/i, /content.*hash/i, /file.*hash/i, /integrity/i, /digest/i, /fingerprint/i, /verify.*file/i];
+            const securityIndicators = [/password/i, /token/i, /secret/i, /credential/i, /auth/i, /session/i];
+            const lineAndFunc = funcName ? `${funcName} ${line}` : line;
+            const isChecksum = checksumIndicators.some(p => p.test(lineAndFunc));
+            const isSecurity = securityIndicators.some(p => p.test(lineAndFunc));
+            // Checksum use without security context = acceptable, don't flag
+            if (isChecksum && !isSecurity) {
+                return false;
+            }
+            return true;
+        },
+    },
+    {
+        pattern: /\bSHA1\s*\(/gi,
+        name: 'SHA1 Hash Usage',
+        severity: 'medium',
+        description: 'SHA1 is deprecated and vulnerable to collision attacks',
+        fix: 'Use SHA-256 or SHA-3 for hashing.',
+    },
+    {
+        pattern: /createHash\s*\(\s*['"]sha1['"]\s*\)/gi,
+        name: 'SHA1 Hash Creation',
+        severity: 'medium',
+        description: 'SHA1 is deprecated and vulnerable to collision attacks',
+        fix: 'Use createHash(\'sha256\') or createHash(\'sha3-256\') instead.',
+    },
+    // Weak encryption algorithms
+    {
+        pattern: /\bDES\b(?!ede3|3)/gi,
+        name: 'DES Encryption',
+        severity: 'high',
+        description: 'DES is obsolete and easily broken. Use AES instead.',
+        fix: 'Use AES-256-GCM for symmetric encryption.',
+    },
+    {
+        pattern: /createCipher(?:iv)?\s*\(\s*['"]des['"]/gi,
+        name: 'DES Cipher Creation',
+        severity: 'high',
+        description: 'DES is obsolete and easily broken',
+        fix: 'Use createCipheriv(\'aes-256-gcm\', ...) instead.',
+    },
+    {
+        pattern: /\bRC4\b/gi,
+        name: 'RC4 Encryption',
+        severity: 'high',
+        description: 'RC4 is broken and should never be used',
+        fix: 'Use AES-256-GCM for symmetric encryption.',
+    },
+    {
+        pattern: /createCipher(?:iv)?\s*\(\s*['"]rc4['"]/gi,
+        name: 'RC4 Cipher Creation',
+        severity: 'high',
+        description: 'RC4 is broken and should never be used',
+        fix: 'Use createCipheriv(\'aes-256-gcm\', ...) instead.',
+    },
+    {
+        pattern: /\bBlowfish\b/gi,
+        name: 'Blowfish Encryption',
+        severity: 'medium',
+        description: 'Blowfish has a small block size and is not recommended for new applications',
+        fix: 'Use AES-256-GCM for symmetric encryption.',
+    },
+    // Insecure random number generation
+    {
+        pattern: /Math\.random\s*\(\s*\)/g,
+        name: 'Math.random() for Security',
+        severity: 'high',
+        description: 'Math.random() is not cryptographically secure and should not be used for security purposes',
+        fix: 'Use crypto.randomBytes() or crypto.getRandomValues() for cryptographic operations.',
+        contextCheck: (line) => {
+            // Only flag if it looks like it's being used for security
+            const securityContexts = [
+                /token/i, /secret/i, /key/i, /password/i, /salt/i,
+                /nonce/i, /iv/i, /random.*id/i, /uuid/i, /session/i,
+            ];
+            return securityContexts.some(ctx => ctx.test(line));
+        },
+    },
+    // Weak key derivation
+    {
+        pattern: /pbkdf2.*iterations?\s*[=:]\s*(\d+)/gi,
+        name: 'Weak PBKDF2 Iterations',
+        severity: 'medium',
+        description: 'PBKDF2 with low iteration count is vulnerable to brute force attacks',
+        fix: 'Use at least 100,000 iterations for PBKDF2, or switch to Argon2.',
+        contextCheck: (line, match) => {
+            const iterations = parseInt(match[1], 10);
+            return iterations < 10000;
+        },
+    },
+    // Weak bcrypt rounds
+    {
+        pattern: /bcrypt\.hash\s*\([^,]+,\s*(\d+)/gi,
+        name: 'Weak bcrypt Rounds',
+        severity: 'medium',
+        description: 'bcrypt with low cost factor is vulnerable to brute force attacks',
+        fix: 'Use at least 10 rounds for bcrypt (12 recommended).',
+        contextCheck: (line, match) => {
+            const rounds = parseInt(match[1], 10);
+            return rounds < 10;
+        },
+    },
+    // ECB mode (insecure)
+    {
+        pattern: /['"]aes-\d+-ecb['"]/gi,
+        name: 'AES ECB Mode',
+        severity: 'high',
+        description: 'ECB mode is insecure as it does not provide semantic security',
+        fix: 'Use AES-GCM or AES-CBC with proper IV handling.',
+    },
+    // Deprecated createCipher (no IV)
+    {
+        pattern: /createCipher\s*\(/g,
+        name: 'Deprecated createCipher',
+        severity: 'high',
+        description: 'createCipher is deprecated and does not use an IV, making it insecure',
+        fix: 'Use createCipheriv() with a random IV instead.',
+    },
+    // Hardcoded encryption keys
+    {
+        pattern: /(?:encryption|cipher|aes)[_-]?key\s*[=:]\s*['"][a-zA-Z0-9+/=]{16,}['"]/gi,
+        name: 'Hardcoded Encryption Key',
+        severity: 'critical',
+        description: 'Encryption key is hardcoded in source code',
+        fix: 'Store encryption keys in environment variables or a secure key management system.',
+    },
+    // Hardcoded IVs
+    {
+        pattern: /\biv\s*[=:]\s*['"][a-zA-Z0-9+/=]{16,}['"]/gi,
+        name: 'Hardcoded IV',
+        severity: 'high',
+        description: 'Initialization vector (IV) should be random for each encryption operation',
+        fix: 'Generate a random IV using crypto.randomBytes() for each encryption.',
+    },
+];
+// Check if line is a comment
+function isComment(lineContent) {
+    const trimmed = lineContent.trim();
+    return (trimmed.startsWith('//') ||
+        trimmed.startsWith('#') ||
+        trimmed.startsWith('*') ||
+        trimmed.startsWith('/*'));
+}
+// Check if line is a pattern definition (regex or string literal in detector code)
+function isPatternDefinition(lineContent) {
+    const trimmed = lineContent.trim();
+    // Pattern definitions typically look like:
+    // pattern: /regex/
+    // name: 'string'
+    // description: 'string'
+    // fix: 'string'
+    return (trimmed.startsWith('pattern:') ||
+        trimmed.startsWith('name:') ||
+        trimmed.startsWith('description:') ||
+        trimmed.startsWith('fix:') ||
+        // Also check for object property assignments with these names
+        /^\s*(pattern|name|description|fix|severity)\s*:/.test(lineContent));
+}
+// Check if file is part of the scanner's own detection code
+function isScannerDetectorFile(filePath) {
+    return (filePath.includes('scanner/src/layer1/') ||
+        filePath.includes('scanner/src/layer2/') ||
+        filePath.includes('scanner/src/layer3/') ||
+        filePath.includes('/lib/scanner/layer1/') ||
+        filePath.includes('/lib/scanner/layer2/') ||
+        filePath.includes('/lib/scanner/layer3/'));
+}
+// Check if file is a test file or fixture
+function isTestOrFixtureFile(filePath) {
+    const lowerPath = filePath.toLowerCase();
+    return (lowerPath.includes('__tests__') ||
+        lowerPath.includes('__mocks__') ||
+        lowerPath.includes('/test/') ||
+        lowerPath.includes('/tests/') ||
+        lowerPath.includes('/fixtures/') ||
+        lowerPath.includes('/fixture/') ||
+        lowerPath.includes('.test.') ||
+        lowerPath.includes('.spec.') ||
+        lowerPath.includes('-test.') ||
+        lowerPath.includes('-spec.') ||
+        lowerPath.includes('benchmark'));
+}
+/**
+ * Find the enclosing function name for a given line
+ */
+function findEnclosingFunctionName(lines, lineIndex) {
+    // Look backwards for function declaration
+    for (let i = lineIndex; i >= 0 && i >= lineIndex - 20; i--) {
+        const line = lines[i];
+        // Match function declarations: function name(), const name = (), async function name()
+        const funcMatch = line.match(/(?:function\s+|const\s+|let\s+|var\s+)(\w+)\s*(?:=\s*(?:async\s*)?\(|=\s*(?:async\s+)?function|\()/);
+        if (funcMatch) {
+            return funcMatch[1];
+        }
+        // Match method declarations: name() { or name: function()
+        const methodMatch = line.match(/^\s*(?:async\s+)?(\w+)\s*\([^)]*\)\s*\{/);
+        if (methodMatch) {
+            return methodMatch[1];
+        }
+    }
+    return undefined;
+}
+function detectWeakCrypto(content, filePath) {
+    const vulnerabilities = [];
+    const lines = content.split('\n');
+    // Skip scanner's own detector files to avoid self-detection
+    if (isScannerDetectorFile(filePath)) {
+        return vulnerabilities;
+    }
+    // Skip test files and fixtures (intentional vulnerable code for testing)
+    if (isTestOrFixtureFile(filePath)) {
+        return vulnerabilities;
+    }
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Skip comments
+        if (isComment(line))
+            continue;
+        // Skip pattern definitions (detector rule definitions)
+        if (isPatternDefinition(line))
+            continue;
+        for (const cryptoPattern of WEAK_CRYPTO_PATTERNS) {
+            const { pattern, name, severity, description, fix, contextCheck } = cryptoPattern;
+            // Reset regex state
+            const regex = new RegExp(pattern.source, pattern.flags);
+            const match = regex.exec(line);
+            if (match) {
+                // If there's a context check, apply it
+                // Pass function name for additional context
+                const funcName = findEnclosingFunctionName(lines, i);
+                if (contextCheck && !contextCheck(line, match, funcName)) {
+                    continue;
+                }
+                vulnerabilities.push({
+                    id: `weak-crypto-${filePath}-${i + 1}-${name}`,
+                    filePath,
+                    lineNumber: i + 1,
+                    lineContent: line.trim(),
+                    severity,
+                    category: 'weak_crypto',
+                    title: name,
+                    description,
+                    suggestedFix: fix,
+                    confidence: 'high',
+                    layer: 1,
+                });
+                break; // Only report one crypto issue per line
+            }
+        }
+    }
+    return vulnerabilities;
+}
+//# sourceMappingURL=weak-crypto.js.map

package/dist/layer1/weak-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-crypto.js","sourceRoot":"","sources":["../../src/layer1/weak-crypto.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAwQH,4CA4DC;AAhUD,yCAAyC;AACzC,MAAM,oBAAoB,GAAG;IAC3B,uBAAuB;IACvB;QACE,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,8EAA8E;QAC3F,GAAG,EAAE,iFAAiF;QACtF,YAAY,EAAE,CAAC,IAAY,EAAE,EAAE;YAC7B,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;YACvG,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;YAExI,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAClE,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAElE,iDAAiD;YACjD,IAAI,iBAAiB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAA;YACd,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;KACF;IACD;QACE,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,8EAA8E;QAC3F,GAAG,EAAE,iEAAiE;QACtE,YAAY,EAAE,CAAC,IAAY,EAAE,MAAwB,EAAE,QAAiB,EAAE,EAAE;YAC1E,+DAA+D;YAC/D,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,CAAC,CAAA;YAC5I,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;YAEjG,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;YAE3D,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;YACpE,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;YAEpE,iEAAiE;YACjE,IAAI,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAA;YACd,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;KACF;IACD;QACE,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,QAAiB;QAC3B,WAAW,EAAE,wDAAwD;QACrE,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,OAAO,EAAE,uCAAuC;QAChD,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,QAAiB;QAC3B,WAAW,EAAE,wDAAwD;QACrE,GAAG,EAAE,iEAAiE;KACvE;IAED,6BAA6B;IAC7B;QACE,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,qDAAqD;QAClE,GAAG,EAAE,2CAA2C;KACjD;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,mCAAmC;QAChD,GAAG,EAAE,mDAAmD;KACzD;IACD;QACE,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,wCAAwC;QACrD,GAAG,EAAE,2CAA2C;KACjD;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,wCAAwC;QACrD,GAAG,EAAE,mDAAmD;KACzD;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,QAAiB;QAC3B,WAAW,EAAE,6EAA6E;QAC1F,GAAG,EAAE,2CAA2C;KACjD;IAED,oCAAoC;IACpC;QACE,OAAO,EAAE,yBAAyB;QAClC,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,4FAA4F;QACzG,GAAG,EAAE,oFAAoF;QACzF,YAAY,EAAE,CAAC,IAAY,EAAE,EAAE;YAC7B,0DAA0D;YAC1D,MAAM,gBAAgB,GAAG;gBACvB,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO;gBACjD,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU;aACpD,CAAA;YACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACrD,CAAC;KACF;IAED,sBAAsB;IACtB;QACE,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,QAAiB;QAC3B,WAAW,EAAE,sEAAsE;QACnF,GAAG,EAAE,kEAAkE;QACvE,YAAY,EAAE,CAAC,IAAY,EAAE,KAAuB,EAAE,EAAE;YACtD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACzC,OAAO,UAAU,GAAG,KAAK,CAAA;QAC3B,CAAC;KACF;IAED,qBAAqB;IACrB;QACE,OAAO,EAAE,mCAAmC;QAC5C,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,QAAiB;QAC3B,WAAW,EAAE,kEAAkE;QAC/E,GAAG,EAAE,qDAAqD;QAC1D,YAAY,EAAE,CAAC,IAAY,EAAE,KAAuB,EAAE,EAAE;YACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACrC,OAAO,MAAM,GAAG,EAAE,CAAA;QACpB,CAAC;KACF;IAED,sBAAsB;IACtB;QACE,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,+DAA+D;QAC5E,GAAG,EAAE,iDAAiD;KACvD;IAED,kCAAkC;IAClC;QACE,OAAO,EAAE,oBAAoB;QAC7B,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,uEAAuE;QACpF,GAAG,EAAE,gDAAgD;KACtD;IAED,4BAA4B;IAC5B;QACE,OAAO,EAAE,0EAA0E;QACnF,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,UAAmB;QAC7B,WAAW,EAAE,4CAA4C;QACzD,GAAG,EAAE,mFAAmF;KACzF;IAED,gBAAgB;IAChB;QACE,OAAO,EAAE,6CAA6C;QACtD,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,MAAe;QACzB,WAAW,EAAE,2EAA2E;QACxF,GAAG,EAAE,sEAAsE;KAC5E;CACF,CAAA;AAED,6BAA6B;AAC7B,SAAS,SAAS,CAAC,WAAmB;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAA;IAClC,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CACzB,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAA;IAClC,2CAA2C;IAC3C,mBAAmB;IACnB,iBAAiB;IACjB,wBAAwB;IACxB,gBAAgB;IAChB,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAC9B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;QAC3B,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;QAClC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,8DAA8D;QAC9D,iDAAiD,CAAC,IAAI,CAAC,WAAW,CAAC,CACpE,CAAA;AACH,CAAC;AAED,4DAA4D;AAC5D,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACxC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACxC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACxC,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACzC,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACzC,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAC1C,CAAA;AACH,CAAC;AAED,0CAA0C;AAC1C,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IACxC,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC/B,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC/B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5B,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC7B,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QAChC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC/B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5B,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAChC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,KAAe,EAAE,SAAiB;IACnE,0CAA0C;IAC1C,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,uFAAuF;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,oGAAoG,CAAC,CAAA;QAClI,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,CAAC,CAAC,CAAA;QACrB,CAAC;QACD,0DAA0D;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACzE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAgB,gBAAgB,CAC9B,OAAe,EACf,QAAgB;IAEhB,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,4DAA4D;IAC5D,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,yEAAyE;IACzE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAErB,gBAAgB;QAChB,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,SAAQ;QAE7B,uDAAuD;QACvD,IAAI,mBAAmB,CAAC,IAAI,CAAC;YAAE,SAAQ;QAEvC,KAAK,MAAM,aAAa,IAAI,oBAAoB,EAAE,CAAC;YACjD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,aAAa,CAAA;YAEjF,oBAAoB;YACpB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YACvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAE9B,IAAI,KAAK,EAAE,CAAC;gBACV,uCAAuC;gBACvC,4CAA4C;gBAC5C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;gBACpD,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACzD,SAAQ;gBACV,CAAC;gBAED,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE,EAAE,eAAe,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE;oBAC9C,QAAQ;oBACR,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;oBACxB,QAAQ;oBACR,QAAQ,EAAE,aAAa;oBACvB,KAAK,EAAE,IAAI;oBACX,WAAW;oBACX,YAAY,EAAE,GAAG;oBACjB,UAAU,EAAE,MAAM;oBAClB,KAAK,EAAE,CAAC;iBACT,CAAC,CAAA;gBACF,MAAK,CAAC,wCAAwC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/layer2/ai-agent-tools.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Layer 2: AI Agent Tool Permission Detection
+ * Detects overly permissive agent tools and missing authorization checks
+ *
+ * Covers B4: Agent/tool orchestration logic
+ *
+ * Issues detected:
+ * - Tools with unrestricted file system access
+ * - Tools with unrestricted network access
+ * - Tools with shell/code execution capability
+ * - Tools without user/tenant context verification
+ * - Database tools without proper scoping
+ */
+import type { Vulnerability } from '../types';
+/**
+ * Main detection function for AI agent tool permission issues
+ */
+export declare function detectAIAgentTools(content: string, filePath: string): Vulnerability[];
+//# sourceMappingURL=ai-agent-tools.d.ts.map

package/dist/layer2/ai-agent-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-agent-tools.d.ts","sourceRoot":"","sources":["../../src/layer2/ai-agent-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,UAAU,CAAA;AAmapE;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,aAAa,EAAE,CAiKjB"}