@oculum/scanner 1.0.10 → 1.0.12

package/dist/layer2/dangerous-functions/child-process.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Child Process Detection
+ *
+ * Detection logic for child_process functions (exec, spawn, execFile, etc.)
+ * that can lead to command injection vulnerabilities.
+ */
+/**
+ * Check if exec() call is from child_process (dangerous) vs RegExp.exec (safe)
+ * Returns true if this is a child_process exec call that should be flagged
+ */
+export declare function isChildProcessExec(content: string, lineContent: string): boolean;
+/**
+ * Check if spawn/execFile/execSync is from child_process
+ */
+export declare function isChildProcessSpawn(content: string, lineContent: string): boolean;
+//# sourceMappingURL=child-process.d.ts.map

package/dist/layer2/dangerous-functions/child-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process.d.ts","sourceRoot":"","sources":["../../../src/layer2/dangerous-functions/child-process.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAiEhF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAgBjF"}

package/dist/layer2/dangerous-functions/child-process.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * Child Process Detection
+ *
+ * Detection logic for child_process functions (exec, spawn, execFile, etc.)
+ * that can lead to command injection vulnerabilities.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isChildProcessExec = isChildProcessExec;
+exports.isChildProcessSpawn = isChildProcessSpawn;
+/**
+ * Check if exec() call is from child_process (dangerous) vs RegExp.exec (safe)
+ * Returns true if this is a child_process exec call that should be flagged
+ */
+function isChildProcessExec(content, lineContent) {
+    // Check for child_process import
+    const hasChildProcessImport = /require\s*\(\s*['"]child_process['"]\s*\)/.test(content) ||
+        /from\s+['"]child_process['"]/.test(content) ||
+        /import\s+.*child_process/.test(content) ||
+        /require\s*\(\s*['"]node:child_process['"]\s*\)/.test(content) ||
+        /from\s+['"]node:child_process['"]/.test(content);
+    // If no child_process import, this is likely RegExp.exec or similar
+    if (!hasChildProcessImport) {
+        return false;
+    }
+    // Check if this specific line is RegExp.exec pattern
+    // RegExp.exec is called as: regex.exec(string) or /pattern/.exec(string)
+    const isRegExpExec = /\.\s*exec\s*\(/.test(lineContent) && // Method call on an object
+        !/\bexec\s*\(/.test(lineContent.replace(/\.\s*exec\s*\(/, '')); // Not a standalone exec()
+    // Also check for common RegExp patterns
+    const isRegExpPattern = /\/[^/]+\/[gimsuy]*\.exec\s*\(/.test(lineContent) || // /pattern/.exec()
+        /new\s+RegExp\s*\([^)]+\)\.exec\s*\(/.test(lineContent) || // new RegExp().exec()
+        /regex\.exec\s*\(/i.test(lineContent) || // regex.exec()
+        /pattern\.exec\s*\(/i.test(lineContent) || // pattern.exec()
+        /match\.exec\s*\(/i.test(lineContent) || // match.exec()
+        /re\.exec\s*\(/i.test(lineContent); // re.exec()
+    if (isRegExpExec || isRegExpPattern) {
+        return false;
+    }
+    // Check if exec is imported/destructured from child_process
+    const execImported = /\{\s*[^}]*\bexec\b[^}]*\}\s*=\s*require\s*\(\s*['"]child_process['"]/.test(content) ||
+        /\{\s*[^}]*\bexec\b[^}]*\}\s*=\s*require\s*\(\s*['"]node:child_process['"]/.test(content) ||
+        /import\s+\{\s*[^}]*\bexec\b[^}]*\}\s+from\s+['"]child_process['"]/.test(content) ||
+        /import\s+\{\s*[^}]*\bexec\b[^}]*\}\s+from\s+['"]node:child_process['"]/.test(content);
+    // If exec is directly imported from child_process, standalone exec() is dangerous
+    if (execImported && /\bexec\s*\(/.test(lineContent)) {
+        return true;
+    }
+    // Check for child_process.exec() pattern
+    if (/child_process\.exec\s*\(/.test(lineContent) ||
+        /cp\.exec\s*\(/.test(lineContent) ||
+        /childProcess\.exec\s*\(/.test(lineContent)) {
+        return true;
+    }
+    // If we have child_process import but can't determine usage, be conservative
+    // Only flag if it looks like a standalone exec() call
+    return /\bexec\s*\(/.test(lineContent) && !/\.\s*exec\s*\(/.test(lineContent);
+}
+/**
+ * Check if spawn/execFile/execSync is from child_process
+ */
+function isChildProcessSpawn(content, lineContent) {
+    // Check for child_process import
+    const hasChildProcessImport = /require\s*\(\s*['"]child_process['"]\s*\)/.test(content) ||
+        /from\s+['"]child_process['"]/.test(content) ||
+        /require\s*\(\s*['"]node:child_process['"]\s*\)/.test(content) ||
+        /from\s+['"]node:child_process['"]/.test(content);
+    if (!hasChildProcessImport) {
+        return false;
+    }
+    // These functions are always from child_process when that module is imported
+    return /\b(spawn|spawnSync|execSync|execFile|execFileSync)\s*\(/.test(lineContent);
+}
+//# sourceMappingURL=child-process.js.map

package/dist/layer2/dangerous-functions/child-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process.js","sourceRoot":"","sources":["../../../src/layer2/dangerous-functions/child-process.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAMH,gDAiEC;AAKD,kDAgBC;AA1FD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,OAAe,EAAE,WAAmB;IACrE,iCAAiC;IACjC,MAAM,qBAAqB,GACzB,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC;QACzD,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5C,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,gDAAgD,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9D,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAEnD,oEAAoE;IACpE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,qDAAqD;IACrD,yEAAyE;IACzE,MAAM,YAAY,GAChB,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,2BAA2B;QACjE,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAA,CAAC,0BAA0B;IAE3F,wCAAwC;IACxC,MAAM,eAAe,GACnB,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,mBAAmB;QACxE,qCAAqC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,sBAAsB;QACjF,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,eAAe;QACxD,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,iBAAiB;QAC5D,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,eAAe;QACxD,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA,CAAC,YAAY;IAEjD,IAAI,YAAY,IAAI,eAAe,EAAE,CAAC;QACpC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,4DAA4D;IAC5D,MAAM,YAAY,GAChB,sEAAsE,CAAC,IAAI,CACzE,OAAO,CACR;QACD,2EAA2E,CAAC,IAAI,CAC9E,OAAO,CACR;QACD,mEAAmE,CAAC,IAAI,CACtE,OAAO,CACR;QACD,wEAAwE,CAAC,IAAI,CAC3E,OAAO,CACR,CAAA;IAEH,kFAAkF;IAClF,IAAI,YAAY,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yCAAyC;IACzC,IACE,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC;QAC5C,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,EAC3C,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,6EAA6E;IAC7E,sDAAsD;IACtD,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AAC/E,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,OAAe,EAAE,WAAmB;IACtE,iCAAiC;IACjC,MAAM,qBAAqB,GACzB,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC;QACzD,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5C,gDAAgD,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9D,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAEnD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,6EAA6E;IAC7E,OAAO,yDAAyD,CAAC,IAAI,CACnE,WAAW,CACZ,CAAA;AACH,CAAC"}

package/dist/layer2/dangerous-functions/dom-xss.d.ts

@@ -0,0 +1,34 @@
+/**
+ * DOM/XSS Detection
+ *
+ * Detection logic for XSS-related patterns like innerHTML, dangerouslySetInnerHTML,
+ * and document.write.
+ */
+/**
+ * Check if innerHTML is being used on a style element (CSS injection is not XSS)
+ */
+export declare function isStyleElementInnerHTML(lineContent: string, content: string, lineNumber: number, lines?: string[]): boolean;
+/**
+ * Check if innerHTML/dangerouslySetInnerHTML uses static content only
+ */
+export declare function isStaticHTMLContent(lineContent: string, content: string, lineNumber: number, lines?: string[]): boolean;
+/**
+ * Check if dangerouslySetInnerHTML is used with DOMPurify sanitization
+ */
+export declare function hasDOMPurifySanitization(lineContent: string, content: string, lineNumber: number, lines?: string[]): boolean;
+/**
+ * Check if data flows to an LLM prompt rather than a DOM sink
+ * LLM prompts are NOT XSS - they're prompt injection (different risk profile)
+ */
+export declare function isLLMPromptContext(lineContent: string, content: string, filePath: string): boolean;
+/**
+ * Check if innerHTML uses output from trusted HTML rendering libraries
+ * Libraries like Shiki, highlight.js, marked, etc. produce sanitized HTML
+ */
+export declare function isTrustedLibraryHTMLOutput(lineContent: string, content: string, lineNumber: number, lines?: string[]): boolean;
+/**
+ * Check if this is a static bootstrap script (e.g., localStorage theme reader)
+ * These are very low risk even with dangerouslySetInnerHTML
+ */
+export declare function isStaticBootstrapScript(_lineContent: string, content: string, lineNumber: number, lines?: string[]): boolean;
+//# sourceMappingURL=dom-xss.d.ts.map

package/dist/layer2/dangerous-functions/dom-xss.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dom-xss.d.ts","sourceRoot":"","sources":["../../../src/layer2/dangerous-functions/dom-xss.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,OAAO,CAgCT;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,OAAO,CAoDT;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,OAAO,CAoBT;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAiCT;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,OAAO,CAuDT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,OAAO,CA8BT"}

package/dist/layer2/dangerous-functions/dom-xss.js

@@ -0,0 +1,230 @@
+"use strict";
+/**
+ * DOM/XSS Detection
+ *
+ * Detection logic for XSS-related patterns like innerHTML, dangerouslySetInnerHTML,
+ * and document.write.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isStyleElementInnerHTML = isStyleElementInnerHTML;
+exports.isStaticHTMLContent = isStaticHTMLContent;
+exports.hasDOMPurifySanitization = hasDOMPurifySanitization;
+exports.isLLMPromptContext = isLLMPromptContext;
+exports.isTrustedLibraryHTMLOutput = isTrustedLibraryHTMLOutput;
+exports.isStaticBootstrapScript = isStaticBootstrapScript;
+/**
+ * Check if innerHTML is being used on a style element (CSS injection is not XSS)
+ */
+function isStyleElementInnerHTML(lineContent, content, lineNumber, lines) {
+    const _lines = lines ?? content.split('\n');
+    // Direct style element patterns on the line
+    const stylePatterns = [
+        /stylesheet\.innerHTML/i, // stylesheet.innerHTML = ...
+        /styleElement\.innerHTML/i, // styleElement.innerHTML = ...
+        /styleEl\.innerHTML/i, // styleEl.innerHTML = ...
+        /style\.innerHTML/i, // style.innerHTML = ...
+        /\.style\b.*\.innerHTML/i, // element.style.innerHTML
+        /createElement\s*\(\s*['"`]style['"`]\s*\)/i, // createElement('style')
+    ];
+    if (stylePatterns.some(p => p.test(lineContent))) {
+        return true;
+    }
+    // Check surrounding context for style element creation
+    const contextStart = Math.max(0, lineNumber - 10);
+    const contextEnd = lineNumber;
+    const contextBefore = _lines.slice(contextStart, contextEnd).join('\n');
+    // Look for style element creation that flows into innerHTML
+    const styleCreationPatterns = [
+        /document\.createElement\s*\(\s*['"`]style['"`]\s*\)/i,
+        /\.appendChild\s*\([^)]*style/i,
+        /const\s+\w*(style|stylesheet)\w*\s*=/i,
+        /let\s+\w*(style|stylesheet)\w*\s*=/i,
+        /var\s+\w*(style|stylesheet)\w*\s*=/i,
+    ];
+    return styleCreationPatterns.some(p => p.test(contextBefore));
+}
+/**
+ * Check if innerHTML/dangerouslySetInnerHTML uses static content only
+ */
+function isStaticHTMLContent(lineContent, content, lineNumber, lines) {
+    const _lines = lines ?? content.split('\n');
+    // Get surrounding context (5 lines before and after)
+    const contextStart = Math.max(0, lineNumber - 6);
+    const contextEnd = Math.min(_lines.length, lineNumber + 5);
+    const context = _lines.slice(contextStart, contextEnd).join('\n');
+    // Static HTML indicators - string literals only
+    const staticIndicators = [
+        /innerHTML\s*=\s*['"][^'"]*['"]/, // innerHTML = "static string" (single line)
+        /innerHTML\s*=\s*`[^`]*`/, // innerHTML = `static template` (single line, no ${})
+        /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html:\s*['"`]/, // React static string
+    ];
+    // Check for multi-line template literals assigned to innerHTML
+    // Look for: innerHTML = ` at the start
+    const multilineTemplateStart = /innerHTML\s*=\s*`/;
+    if (multilineTemplateStart.test(lineContent)) {
+        // Find the closing backtick in subsequent lines
+        let templateContent = '';
+        let foundClosing = false;
+        for (let i = lineNumber - 1; i < _lines.length && i < lineNumber + 50; i++) {
+            templateContent += _lines[i] + '\n';
+            if (_lines[i].includes('`') && i > lineNumber - 1) {
+                foundClosing = true;
+                break;
+            }
+        }
+        // If template has no ${...} interpolations, it's static
+        if (foundClosing && !/\$\{[^}]*\}/.test(templateContent)) {
+            return true;
+        }
+    }
+    // Dynamic content indicators (red flags)
+    const dynamicIndicators = [
+        /\$\{[^}]*\}/, // Template interpolation ${...}
+        /innerHTML\s*=.*\+/, // String concatenation with +
+        /innerHTML\s*\+=\s*/, // Append operation
+        /\breq\.|\.params|\.query|\.body/, // User input (req.params, req.query, req.body)
+        /\bprops\./, // Component props
+        /\bstate\./, // Component state
+        /\.value\b/, // Input value
+        /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html:\s*[^'"`]/, // React dynamic
+    ];
+    const isStatic = staticIndicators.some(p => p.test(lineContent));
+    const isDynamic = dynamicIndicators.some(p => p.test(context));
+    return isStatic && !isDynamic;
+}
+/**
+ * Check if dangerouslySetInnerHTML is used with DOMPurify sanitization
+ */
+function hasDOMPurifySanitization(lineContent, content, lineNumber, lines) {
+    const _lines = lines ?? content.split('\n');
+    const contextStart = Math.max(0, lineNumber - 10);
+    const contextEnd = Math.min(_lines.length, lineNumber + 5);
+    const context = _lines.slice(contextStart, contextEnd).join('\n');
+    // DOMPurify sanitization patterns
+    const sanitizationPatterns = [
+        /DOMPurify\.sanitize/i,
+        /sanitize\s*\(/i,
+        /purify\s*\(/i,
+        /xss\s*\(/i,
+        /clean\s*\(/i,
+        /sanitizeHtml/i,
+        /escapeHtml/i,
+        /sanitized/i,
+        /purified/i,
+    ];
+    return sanitizationPatterns.some(p => p.test(context));
+}
+/**
+ * Check if data flows to an LLM prompt rather than a DOM sink
+ * LLM prompts are NOT XSS - they're prompt injection (different risk profile)
+ */
+function isLLMPromptContext(lineContent, content, filePath) {
+    // File path indicators of AI/LLM code
+    const aiFilePatterns = [
+        /\/(ai|llm|chat|openai|anthropic|gpt|claude)\//i,
+        /\/(assistants?|agents?|prompts?)\//i,
+        /(chat|ai|llm|prompt|assistant).*\.(ts|js|tsx|jsx)$/i,
+    ];
+    if (aiFilePatterns.some(p => p.test(filePath))) {
+        return true;
+    }
+    // Content patterns suggesting LLM API usage
+    const llmApiPatterns = [
+        /\.create\s*\(\s*\{[^}]*messages\s*:/i, // OpenAI/Anthropic SDK
+        /openai|anthropic|claude|gpt-4|gpt-3/i, // AI service mentions
+        /\bprompt\s*[=:+]/i, // prompt assignment
+        /\bsystemPrompt|userPrompt|assistantPrompt/i, // Prompt variables
+        /completion|chat\.create|messages\.create/i, // API calls
+        /\bmessages\s*:\s*\[/i, // Messages array
+        /role:\s*['"`](user|assistant|system)['"`]/i, // Message roles
+    ];
+    // Check the line and surrounding context
+    const _lines = content.split('\n');
+    const lineIndex = _lines.findIndex(l => l === lineContent || l.includes(lineContent.trim()));
+    const startLine = Math.max(0, lineIndex - 10);
+    const endLine = Math.min(_lines.length, lineIndex + 10);
+    const context = _lines.slice(startLine, endLine).join('\n');
+    return llmApiPatterns.some(p => p.test(lineContent) || p.test(context));
+}
+/**
+ * Check if innerHTML uses output from trusted HTML rendering libraries
+ * Libraries like Shiki, highlight.js, marked, etc. produce sanitized HTML
+ */
+function isTrustedLibraryHTMLOutput(lineContent, content, lineNumber, lines) {
+    const _lines = lines ?? content.split('\n');
+    const contextStart = Math.max(0, lineNumber - 15);
+    const contextEnd = Math.min(_lines.length, lineNumber + 5);
+    const context = _lines.slice(contextStart, contextEnd).join('\n');
+    // Trusted HTML rendering library patterns
+    const trustedLibraryPatterns = [
+        // Syntax highlighting
+        /\bshiki\b/i,
+        /\bcodeToHtml\s*\(/i, // Shiki's codeToHtml()
+        /\bhighlight(?:er)?\.highlight/i, // highlight.js
+        /\bhljs\.highlight/i,
+        /\bPrism\.highlight/i, // Prism.js
+        /\bPrismJS/i,
+        // Markdown rendering
+        /\bmarked\s*\(/i, // marked library
+        /\bmarkdownIt/i, // markdown-it
+        /\bremark/i, // remark
+        /\brehype/i, // rehype
+        /\bMDX/i,
+        /\bserialize\s*\(.*mdx/i, // next-mdx-remote
+        /\bcompileMDX/i,
+        // Rich text editors (output is sanitized)
+        /\bTiptap/i,
+        /\bProseMirror/i,
+        /\bQuill/i,
+        /\bSlate/i,
+        /\bLexical/i,
+        /\bDraft(?:JS)?/i,
+        /\.getHTML\s*\(\)/i, // Editor getHTML() output
+        // React components that handle sanitization
+        /\brenderToString\s*\(/i, // Server-rendered React
+        /\brenderToStaticMarkup\s*\(/i,
+        // Code formatting/display libraries
+        /\bprettier/i,
+        /\bbeautify/i,
+        // SVG rendering
+        /\bcanvg/i,
+        /\.toSVG\s*\(/i,
+    ];
+    // Also check imports at top of file
+    const fullContent = content.substring(0, 2000); // First 2000 chars for imports
+    return (trustedLibraryPatterns.some(p => p.test(lineContent)) ||
+        trustedLibraryPatterns.some(p => p.test(context)) ||
+        trustedLibraryPatterns.some(p => p.test(fullContent)));
+}
+/**
+ * Check if this is a static bootstrap script (e.g., localStorage theme reader)
+ * These are very low risk even with dangerouslySetInnerHTML
+ */
+function isStaticBootstrapScript(_lineContent, content, lineNumber, lines) {
+    const _lines = lines ?? content.split('\n');
+    const contextStart = Math.max(0, lineNumber - 10);
+    const contextEnd = Math.min(_lines.length, lineNumber + 5);
+    const context = _lines.slice(contextStart, contextEnd).join('\n');
+    // Bootstrap script indicators (reading from localStorage, setting attributes)
+    const bootstrapPatterns = [
+        /localStorage\.getItem/i,
+        /document\.documentElement\.setAttribute/i,
+        /data-(theme|font|mode)/i,
+        /classList\.(add|remove|toggle)/i,
+        /\.dataset\./i,
+    ];
+    // Dangerous patterns that disqualify as safe bootstrap
+    const dangerousPatterns = [
+        /\$\{.*\}/, // Template interpolation
+        /\+\s*[a-zA-Z]/, // String concatenation with variable
+        /innerHTML\s*=\s*[a-zA-Z]/, // innerHTML set to variable directly
+        /fetch\s*\(/, // Network requests
+        /\.(query|params|body)/, // User input
+        /location\.(search|hash)/, // URL parameters
+        /document\.cookie/, // Cookie access
+    ];
+    const hasBootstrapPatterns = bootstrapPatterns.some(p => p.test(context));
+    const hasDangerousPatterns = dangerousPatterns.some(p => p.test(context));
+    return hasBootstrapPatterns && !hasDangerousPatterns;
+}
+//# sourceMappingURL=dom-xss.js.map

package/dist/layer2/dangerous-functions/dom-xss.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dom-xss.js","sourceRoot":"","sources":["../../../src/layer2/dangerous-functions/dom-xss.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAOH,0DAqCC;AAKD,kDAyDC;AAKD,4DAyBC;AAMD,gDAqCC;AAMD,gEA4DC;AAMD,0DAmCC;AA1RD;;GAEG;AACH,SAAgB,uBAAuB,CACrC,WAAmB,EACnB,OAAe,EACf,UAAkB,EAClB,KAAgB;IAEhB,MAAM,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAE3C,4CAA4C;IAC5C,MAAM,aAAa,GAAG;QACpB,wBAAwB,EAAE,6BAA6B;QACvD,0BAA0B,EAAE,+BAA+B;QAC3D,qBAAqB,EAAE,0BAA0B;QACjD,mBAAmB,EAAE,wBAAwB;QAC7C,yBAAyB,EAAE,0BAA0B;QACrD,4CAA4C,EAAE,yBAAyB;KACxE,CAAA;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,uDAAuD;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,UAAU,CAAA;IAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEvE,4DAA4D;IAC5D,MAAM,qBAAqB,GAAG;QAC5B,sDAAsD;QACtD,+BAA+B;QAC/B,uCAAuC;QACvC,qCAAqC;QACrC,qCAAqC;KACtC,CAAA;IAED,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;AAC/D,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CACjC,WAAmB,EACnB,OAAe,EACf,UAAkB,EAClB,KAAgB;IAEhB,MAAM,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAE3C,qDAAqD;IACrD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEjE,gDAAgD;IAChD,MAAM,gBAAgB,GAAG;QACvB,gCAAgC,EAAE,4CAA4C;QAC9E,yBAAyB,EAAE,sDAAsD;QACjF,yDAAyD,EAAE,sBAAsB;KAClF,CAAA;IAED,+DAA+D;IAC/D,uCAAuC;IACvC,MAAM,sBAAsB,GAAG,mBAAmB,CAAA;IAClD,IAAI,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,gDAAgD;QAChD,IAAI,eAAe,GAAG,EAAE,CAAA;QACxB,IAAI,YAAY,GAAG,KAAK,CAAA;QACxB,KAAK,IAAI,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,UAAU,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3E,eAAe,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;YACnC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;gBAClD,YAAY,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,YAAY,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,iBAAiB,GAAG;QACxB,aAAa,EAAE,gCAAgC;QAC/C,mBAAmB,EAAE,8BAA8B;QACnD,oBAAoB,EAAE,mBAAmB;QACzC,iCAAiC,EAAE,+CAA+C;QAClF,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EAAE,cAAc;QAC3B,0DAA0D,EAAE,gBAAgB;KAC7E,CAAA;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IAE9D,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAA;AAC/B,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CACtC,WAAmB,EACnB,OAAe,EACf,UAAkB,EAClB,KAAgB;IAEhB,MAAM,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEjE,kCAAkC;IAClC,MAAM,oBAAoB,GAAG;QAC3B,sBAAsB;QACtB,gBAAgB;QAChB,cAAc;QACd,WAAW;QACX,aAAa;QACb,eAAe;QACf,aAAa;QACb,YAAY;QACZ,WAAW;KACZ,CAAA;IAED,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,WAAmB,EACnB,OAAe,EACf,QAAgB;IAEhB,sCAAsC;IACtC,MAAM,cAAc,GAAG;QACrB,gDAAgD;QAChD,qCAAqC;QACrC,qDAAqD;KACtD,CAAA;IAED,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,4CAA4C;IAC5C,MAAM,cAAc,GAAG;QACrB,sCAAsC,EAAE,uBAAuB;QAC/D,sCAAsC,EAAE,sBAAsB;QAC9D,mBAAmB,EAAE,oBAAoB;QACzC,4CAA4C,EAAE,mBAAmB;QACjE,2CAA2C,EAAE,YAAY;QACzD,sBAAsB,EAAE,iBAAiB;QACzC,4CAA4C,EAAE,gBAAgB;KAC/D,CAAA;IAED,yCAAyC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAChC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CACzD,CAAA;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,EAAE,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE3D,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACzE,CAAC;AAED;;;GAGG;AACH,SAAgB,0BAA0B,CACxC,WAAmB,EACnB,OAAe,EACf,UAAkB,EAClB,KAAgB;IAEhB,MAAM,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEjE,0CAA0C;IAC1C,MAAM,sBAAsB,GAAG;QAC7B,sBAAsB;QACtB,YAAY;QACZ,oBAAoB,EAAW,uBAAuB;QACtD,gCAAgC,EAAG,eAAe;QAClD,oBAAoB;QACpB,qBAAqB,EAAU,WAAW;QAC1C,YAAY;QAEZ,qBAAqB;QACrB,gBAAgB,EAAe,iBAAiB;QAChD,eAAe,EAAgB,cAAc;QAC7C,WAAW,EAAoB,SAAS;QACxC,WAAW,EAAoB,SAAS;QACxC,QAAQ;QACR,wBAAwB,EAAO,kBAAkB;QACjD,eAAe;QAEf,0CAA0C;QAC1C,WAAW;QACX,gBAAgB;QAChB,UAAU;QACV,UAAU;QACV,YAAY;QACZ,iBAAiB;QACjB,mBAAmB,EAAY,0BAA0B;QAEzD,4CAA4C;QAC5C,wBAAwB,EAAQ,wBAAwB;QACxD,8BAA8B;QAE9B,oCAAoC;QACpC,aAAa;QACb,aAAa;QAEb,gBAAgB;QAChB,UAAU;QACV,eAAe;KAChB,CAAA;IAED,oCAAoC;IACpC,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA,CAAC,+BAA+B;IAE9E,OAAO,CACL,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjD,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CACtD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,YAAoB,EACpB,OAAe,EACf,UAAkB,EAClB,KAAgB;IAEhB,MAAM,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEjE,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG;QACxB,wBAAwB;QACxB,0CAA0C;QAC1C,yBAAyB;QACzB,iCAAiC;QACjC,cAAc;KACf,CAAA;IAED,uDAAuD;IACvD,MAAM,iBAAiB,GAAG;QACxB,UAAU,EAAE,yBAAyB;QACrC,eAAe,EAAE,qCAAqC;QACtD,0BAA0B,EAAE,qCAAqC;QACjE,YAAY,EAAE,mBAAmB;QACjC,uBAAuB,EAAE,aAAa;QACtC,yBAAyB,EAAE,iBAAiB;QAC5C,kBAAkB,EAAE,gBAAgB;KACrC,CAAA;IAED,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACzE,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IAEzE,OAAO,oBAAoB,IAAI,CAAC,oBAAoB,CAAA;AACtD,CAAC"}

package/dist/layer2/dangerous-functions/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Layer 2: Dangerous Function Call Analysis
+ *
+ * Detects usage of dangerous functions that can lead to security vulnerabilities.
+ * This module orchestrates detection across multiple specialized modules.
+ */
+import type { Vulnerability } from '../../types';
+import type { ParsedFile } from '../../utils/parsed-file';
+export { DANGEROUS_FUNCTIONS, type DangerousFunctionPattern } from './patterns';
+/**
+ * Main detection function for dangerous function calls
+ */
+export declare function detectDangerousFunctions(content: string, filePath: string, options?: {
+    parsed?: ParsedFile;
+}): Vulnerability[];
+//# sourceMappingURL=index.d.ts.map

package/dist/layer2/dangerous-functions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/layer2/dangerous-functions/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAsDzD,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAE/E;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,GAChC,aAAa,EAAE,CA4MjB"}