@oculum/scanner 1.0.11 → 1.0.13

package/dist/detect/structural/framework-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-checks.d.ts","sourceRoot":"","sources":["../../../src/detect/structural/framework-checks.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAA;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AA6Q1D,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,GAChC,aAAa,EAAE,CA+JjB"}

package/dist/detect/structural/framework-checks.js

@@ -0,0 +1,389 @@
+"use strict";
+/**
+ * Layer 2: Framework-Specific Security Checks
+ * Detects security issues specific to popular frameworks (Next.js, Express, React, etc.)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectFrameworkIssues = detectFrameworkIssues;
+const file_classifier_1 = require("../../parse/file-classifier");
+const BASE_CONFIDENCE = 0.20;
+const FRAMEWORK_PATTERNS = [
+    // ==================== Next.js ====================
+    {
+        name: 'Next.js API route without auth',
+        pattern: /export\s+(default\s+)?(async\s+)?function\s+handler\s*\(/gi,
+        severity: 'medium',
+        description: 'Next.js API route handler - ensure authentication is implemented',
+        suggestedFix: 'Add authentication check at the start of the handler',
+        framework: 'nextjs',
+    },
+    {
+        name: 'Next.js getServerSideProps without auth',
+        pattern: /export\s+(async\s+)?function\s+getServerSideProps/gi,
+        severity: 'low',
+        description: 'Server-side props function - verify auth for protected pages',
+        suggestedFix: 'Check authentication and redirect if needed',
+        framework: 'nextjs',
+    },
+    {
+        name: 'Next.js exposed server action',
+        pattern: /['"]use server['"]\s*;?\s*\n\s*export\s+(async\s+)?function/gi,
+        severity: 'medium',
+        description: 'Server action is publicly accessible - ensure proper validation',
+        suggestedFix: 'Add authentication and input validation to server actions',
+        framework: 'nextjs',
+    },
+    {
+        name: 'Next.js revalidate with user input',
+        pattern: /revalidatePath\s*\(\s*(req|request|params|searchParams)/gi,
+        severity: 'high',
+        description: 'revalidatePath with user input could allow cache poisoning',
+        suggestedFix: 'Validate and sanitize paths before revalidation',
+        framework: 'nextjs',
+    },
+    {
+        name: 'Next.js redirect with user input',
+        pattern: /redirect\s*\(\s*(req|request|params|searchParams|url)/gi,
+        severity: 'high',
+        description: 'Redirect with user input can lead to open redirect vulnerability',
+        suggestedFix: 'Validate redirect URLs against an allowlist',
+        framework: 'nextjs',
+    },
+    {
+        name: 'Next.js unstable_cache without tags',
+        pattern: /unstable_cache\s*\([^)]*\)(?!.*tags)/gi,
+        severity: 'low',
+        description: 'unstable_cache without tags makes invalidation difficult',
+        suggestedFix: 'Add cache tags for proper cache invalidation',
+        framework: 'nextjs',
+    },
+    // ==================== Express ====================
+    // NOTE: "Express without helmet" moved to security-headers.ts (OWASP Workstream 1)
+    {
+        name: 'Express CORS allow all',
+        pattern: /cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/gi,
+        severity: 'high',
+        description: 'CORS configured to allow all origins',
+        suggestedFix: 'Restrict CORS to specific trusted origins',
+        framework: 'express',
+    },
+    {
+        name: 'Express body parser limit',
+        pattern: /bodyParser\.(json|urlencoded)\s*\(\s*\)(?!.*limit)/gi,
+        severity: 'low',
+        description: 'Body parser without size limit can lead to DoS',
+        suggestedFix: 'Add limit option: bodyParser.json({ limit: "100kb" })',
+        framework: 'express',
+    },
+    {
+        name: 'Express trust proxy',
+        pattern: /app\.set\s*\(\s*['"]trust proxy['"]\s*,\s*true\s*\)/gi,
+        severity: 'medium',
+        description: 'Trust proxy enabled - ensure this is intentional',
+        suggestedFix: 'Only enable trust proxy behind a known reverse proxy',
+        framework: 'express',
+    },
+    {
+        name: 'Express error handler exposes stack',
+        pattern: /res\.(json|send)\s*\(\s*\{[^}]*stack|err\.stack/gi,
+        severity: 'high',
+        description: 'Error stack trace may be exposed to clients',
+        suggestedFix: 'Only expose stack traces in development mode',
+        framework: 'express',
+    },
+    // ==================== React ====================
+    {
+        name: 'React useEffect with async',
+        pattern: /useEffect\s*\(\s*async\s*\(/gi,
+        severity: 'low',
+        description: 'useEffect with async function can cause memory leaks',
+        suggestedFix: 'Define async function inside useEffect and call it',
+        framework: 'react',
+    },
+    {
+        name: 'React state with sensitive data',
+        pattern: /useState\s*\(\s*['"]?(password|secret|token|apiKey|api_key)/gi,
+        severity: 'medium',
+        description: 'Sensitive data in React state may be exposed in dev tools',
+        suggestedFix: 'Avoid storing sensitive data in client-side state',
+        framework: 'react',
+    },
+    {
+        name: 'React href javascript:',
+        pattern: /href\s*=\s*[{'"]*javascript:/gi,
+        severity: 'high',
+        description: 'javascript: URLs can lead to XSS vulnerabilities',
+        suggestedFix: 'Use onClick handlers instead of javascript: URLs',
+        framework: 'react',
+    },
+    {
+        name: 'React uncontrolled input with defaultValue',
+        pattern: /defaultValue\s*=\s*\{[^}]*(password|secret|token)/gi,
+        severity: 'medium',
+        description: 'Sensitive data in defaultValue may persist in DOM',
+        suggestedFix: 'Use controlled inputs for sensitive data',
+        framework: 'react',
+    },
+    // ==================== Vue ====================
+    {
+        name: 'Vue v-html directive',
+        pattern: /v-html\s*=\s*['"]/gi,
+        severity: 'high',
+        description: 'v-html can lead to XSS if content is not sanitized',
+        suggestedFix: 'Sanitize HTML content or use v-text for plain text',
+        framework: 'vue',
+    },
+    {
+        name: 'Vue computed with side effects',
+        pattern: /computed\s*:\s*\{[^}]*\b(fetch|axios|http|api)\b/gi,
+        severity: 'low',
+        description: 'Computed properties with side effects can cause issues',
+        suggestedFix: 'Move API calls to methods or lifecycle hooks',
+        framework: 'vue',
+    },
+    // ==================== Django ====================
+    {
+        name: 'Django DEBUG in production',
+        pattern: /DEBUG\s*=\s*True/gi,
+        severity: 'critical',
+        description: 'Django DEBUG mode should be disabled in production',
+        suggestedFix: 'Set DEBUG = False in production settings',
+        framework: 'django',
+    },
+    {
+        name: 'Django ALLOWED_HOSTS wildcard',
+        pattern: /ALLOWED_HOSTS\s*=\s*\[\s*['"]\*['"]/gi,
+        severity: 'high',
+        description: 'ALLOWED_HOSTS with wildcard allows any host',
+        suggestedFix: 'Specify exact allowed hostnames',
+        framework: 'django',
+    },
+    {
+        name: 'Django SECRET_KEY hardcoded',
+        pattern: /SECRET_KEY\s*=\s*['"][^'"]+['"]/gi,
+        severity: 'critical',
+        description: 'Django SECRET_KEY should not be hardcoded',
+        suggestedFix: 'Load SECRET_KEY from environment variable',
+        framework: 'django',
+    },
+    // ==================== Flask ====================
+    {
+        name: 'Flask debug mode',
+        pattern: /app\.run\s*\([^)]*debug\s*=\s*True/gi,
+        severity: 'critical',
+        description: 'Flask debug mode should be disabled in production',
+        suggestedFix: 'Set debug=False in production',
+        framework: 'flask',
+    },
+    {
+        name: 'Flask secret key hardcoded',
+        pattern: /app\.secret_key\s*=\s*['"][^'"]+['"]/gi,
+        severity: 'critical',
+        description: 'Flask secret_key should not be hardcoded',
+        suggestedFix: 'Load secret_key from environment variable',
+        framework: 'flask',
+    },
+    // ==================== Supabase ====================
+    {
+        name: 'Supabase service role key exposed',
+        pattern: /supabaseServiceRole|service_role|SUPABASE_SERVICE_ROLE/gi,
+        severity: 'critical',
+        description: 'Supabase service role key should never be exposed to client',
+        suggestedFix: 'Only use service role key in server-side code',
+        framework: 'supabase',
+    },
+    {
+        name: 'Supabase RLS bypass',
+        pattern: /\.rpc\s*\(\s*['"][^'"]+['"]\s*,\s*\{[^}]*\}\s*,\s*\{[^}]*count/gi,
+        severity: 'medium',
+        description: 'RPC call may bypass Row Level Security',
+        suggestedFix: 'Ensure RPC functions have proper security checks',
+        framework: 'supabase',
+    },
+];
+// Detect framework from file content and path
+function detectFramework(content, filePath) {
+    const frameworks = [];
+    // Next.js
+    if (content.includes('next/') || content.includes('from "next"') ||
+        filePath.includes('/app/') || filePath.includes('/pages/')) {
+        frameworks.push('nextjs');
+    }
+    // Express
+    if (content.includes('express()') || content.includes('from "express"') ||
+        content.includes("require('express')")) {
+        frameworks.push('express');
+    }
+    // React
+    if (content.includes('from "react"') || content.includes("from 'react'") ||
+        content.includes('useState') || content.includes('useEffect')) {
+        frameworks.push('react');
+    }
+    // Vue
+    if (content.includes('from "vue"') || content.includes('Vue.component') ||
+        filePath.endsWith('.vue')) {
+        frameworks.push('vue');
+    }
+    // Django
+    if (content.includes('from django') || content.includes('import django') ||
+        filePath.includes('settings.py')) {
+        frameworks.push('django');
+    }
+    // Flask
+    if (content.includes('from flask') || content.includes('Flask(__name__)')) {
+        frameworks.push('flask');
+    }
+    // Supabase
+    if (content.includes('supabase') || content.includes('@supabase/')) {
+        frameworks.push('supabase');
+    }
+    return frameworks;
+}
+function detectFrameworkIssues(content, filePath, options) {
+    const vulnerabilities = [];
+    // Skip scanner/fixture files to avoid self-detection
+    if ((0, file_classifier_1.isScannerOrFixtureFile)(filePath))
+        return vulnerabilities;
+    const lines = options?.parsed?.lines ?? content.split('\n');
+    const detectedFrameworks = detectFramework(content, filePath);
+    const isTestFile = (0, file_classifier_1.isTestOrMockFile)(filePath);
+    lines.forEach((line, index) => {
+        // Skip comment lines
+        if ((0, file_classifier_1.isComment)(line))
+            return;
+        for (const pattern of FRAMEWORK_PATTERNS) {
+            // Only check patterns for detected frameworks (or check all if none detected)
+            if (detectedFrameworks.length > 0 && !detectedFrameworks.includes(pattern.framework)) {
+                continue;
+            }
+            const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
+            if (regex.test(line)) {
+                // Special handling for Supabase service role key
+                if (pattern.name === 'Supabase service role key exposed') {
+                    // Check if this is a proper Supabase client setup pattern
+                    // Expected safe pattern:
+                    // - Variable named supabaseServiceRoleKey (or similar)
+                    // - Loaded from process.env.SUPABASE_SERVICE_ROLE_KEY
+                    // - Used in server-only file (lib/supabase/server.ts, /api/, etc.)
+                    const isServerFile = (0, file_classifier_1.isServerOnlyFile)(filePath);
+                    const usesEnvVar = (0, file_classifier_1.isEnvVarReference)(line);
+                    // Check if this line is just a variable declaration from env var
+                    // e.g., const supabaseServiceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY!
+                    const isEnvVarDeclaration = /(?:const|let|var)\s+\w*(?:service.*role|supabase.*key)\w*\s*=\s*process\.env\./i.test(line);
+                    // Check if this is a createClient call with variable reference (not hardcoded)
+                    // e.g., createClient(supabaseUrl, supabaseServiceRoleKey, {...})
+                    const isCreateClientWithVar = /createClient\s*\(\s*\w+\s*,\s*\w*(?:service.*role|key)\w*\s*[,)]/i.test(line);
+                    // If server file + env var pattern OR server file + createClient with variable reference, it's safe
+                    if (isServerFile) {
+                        if (isEnvVarDeclaration || usesEnvVar) {
+                            // Safe: declaring/loading from env var in server file
+                            continue;
+                        }
+                        if (isCreateClientWithVar && !/"[a-zA-Z0-9._-]{20,}"/.test(line)) {
+                            // Safe: using variable (not hardcoded string) in createClient
+                            // Check surrounding content for env var loading
+                            const fileHasEnvVarLoading = content.includes('process.env.SUPABASE_SERVICE_ROLE_KEY');
+                            if (fileHasEnvVarLoading) {
+                                continue;
+                            }
+                        }
+                    }
+                    const serviceRoleContext = (0, file_classifier_1.getServiceRoleKeyContext)(line, filePath);
+                    // Double-check: Server-only file using env var = safe, skip entirely
+                    if (serviceRoleContext === 'safe_server') {
+                        continue;
+                    }
+                    // Determine severity and whether AI validation is needed
+                    let adjustedSeverity = pattern.severity;
+                    let adjustedDescription = pattern.description;
+                    let requiresAIValidation = false;
+                    let adjustedConfidence = 'medium';
+                    if (serviceRoleContext === 'client_exposure') {
+                        // Client exposure = critical
+                        adjustedSeverity = 'critical';
+                        adjustedDescription = 'Supabase service role key may be exposed to client - this bypasses RLS';
+                        requiresAIValidation = true;
+                        adjustedConfidence = 'high';
+                    }
+                    else {
+                        // needs_review
+                        if ((0, file_classifier_1.isEnvVarReference)(line)) {
+                            // Using env var in non-server file - needs review
+                            adjustedSeverity = 'medium';
+                            adjustedDescription = 'Supabase service role key usage - verify this is server-only code';
+                            requiresAIValidation = true;
+                        }
+                        else if ((0, file_classifier_1.isServerOnlyFile)(filePath)) {
+                            // Hardcoded in server file - bad practice but not critical
+                            adjustedSeverity = 'high';
+                            adjustedDescription = 'Supabase service role key should use environment variable';
+                            requiresAIValidation = true;
+                        }
+                        else {
+                            // Unknown context - flag for review
+                            adjustedSeverity = 'high';
+                            requiresAIValidation = true;
+                        }
+                    }
+                    // Downgrade test file severity
+                    if (isTestFile) {
+                        adjustedSeverity = 'low';
+                        adjustedConfidence = 'low';
+                        adjustedDescription = `${adjustedDescription} (in test file)`;
+                    }
+                    vulnerabilities.push({
+                        id: `framework-${filePath}-${index + 1}-${pattern.name}`,
+                        filePath,
+                        lineNumber: index + 1,
+                        lineContent: line.trim(),
+                        severity: adjustedSeverity,
+                        category: 'insecure_config',
+                        title: `[${pattern.framework}] ${pattern.name}`,
+                        description: adjustedDescription,
+                        suggestedFix: pattern.suggestedFix,
+                        confidence: adjustedConfidence,
+                        baseConfidence: BASE_CONFIDENCE,
+                        layer: 2,
+                        source: 'structural',
+                        requiresAIValidation,
+                    });
+                    break;
+                }
+                // Standard handling for other patterns
+                let severity = pattern.severity;
+                let confidence = 'medium';
+                // Downgrade test file severity
+                if (isTestFile) {
+                    if (severity === 'critical') {
+                        severity = 'medium';
+                    }
+                    else if (severity === 'high') {
+                        severity = 'low';
+                    }
+                    else {
+                        severity = 'info';
+                    }
+                    confidence = 'low';
+                }
+                vulnerabilities.push({
+                    id: `framework-${filePath}-${index + 1}-${pattern.name}`,
+                    filePath,
+                    lineNumber: index + 1,
+                    lineContent: line.trim(),
+                    severity,
+                    category: 'insecure_config',
+                    title: `[${pattern.framework}] ${pattern.name}`,
+                    description: isTestFile ? `${pattern.description} (in test file)` : pattern.description,
+                    suggestedFix: pattern.suggestedFix,
+                    confidence,
+                    baseConfidence: BASE_CONFIDENCE,
+                    layer: 2,
+                    source: 'structural',
+                });
+                break; // Only report once per line
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=framework-checks.js.map

package/dist/detect/structural/framework-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-checks.js","sourceRoot":"","sources":["../../../src/detect/structural/framework-checks.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAgRH,sDAmKC;AA/aD,iEAOoC;AAEpC,MAAM,eAAe,GAAG,IAAI,CAAA;AAW5B,MAAM,kBAAkB,GAAuB;IAC7C,oDAAoD;IACpD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,kEAAkE;QAC/E,YAAY,EAAE,sDAAsD;QACpE,SAAS,EAAE,QAAQ;KACpB;IACD;QACE,IAAI,EAAE,yCAAyC;QAC/C,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8DAA8D;QAC3E,YAAY,EAAE,6CAA6C;QAC3D,SAAS,EAAE,QAAQ;KACpB;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,+DAA+D;QACxE,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,iEAAiE;QAC9E,YAAY,EAAE,2DAA2D;QACzE,SAAS,EAAE,QAAQ;KACpB;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,2DAA2D;QACpE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4DAA4D;QACzE,YAAY,EAAE,iDAAiD;QAC/D,SAAS,EAAE,QAAQ;KACpB;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,yDAAyD;QAClE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,kEAAkE;QAC/E,YAAY,EAAE,6CAA6C;QAC3D,SAAS,EAAE,QAAQ;KACpB;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,wCAAwC;QACjD,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0DAA0D;QACvE,YAAY,EAAE,8CAA8C;QAC5D,SAAS,EAAE,QAAQ;KACpB;IAED,oDAAoD;IACpD,mFAAmF;IACnF;QACE,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,sCAAsC;QACnD,YAAY,EAAE,2CAA2C;QACzD,SAAS,EAAE,SAAS;KACrB;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,gDAAgD;QAC7D,YAAY,EAAE,uDAAuD;QACrE,SAAS,EAAE,SAAS;KACrB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,uDAAuD;QAChE,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,kDAAkD;QAC/D,YAAY,EAAE,sDAAsD;QACpE,SAAS,EAAE,SAAS;KACrB;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,6CAA6C;QAC1D,YAAY,EAAE,8CAA8C;QAC5D,SAAS,EAAE,SAAS;KACrB;IAED,kDAAkD;IAClD;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,sDAAsD;QACnE,YAAY,EAAE,oDAAoD;QAClE,SAAS,EAAE,OAAO;KACnB;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,+DAA+D;QACxE,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,2DAA2D;QACxE,YAAY,EAAE,mDAAmD;QACjE,SAAS,EAAE,OAAO;KACnB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,kDAAkD;QAC/D,YAAY,EAAE,kDAAkD;QAChE,SAAS,EAAE,OAAO;KACnB;IACD;QACE,IAAI,EAAE,4CAA4C;QAClD,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,mDAAmD;QAChE,YAAY,EAAE,0CAA0C;QACxD,SAAS,EAAE,OAAO;KACnB;IAED,gDAAgD;IAChD;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oDAAoD;QACjE,YAAY,EAAE,oDAAoD;QAClE,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,wDAAwD;QACrE,YAAY,EAAE,8CAA8C;QAC5D,SAAS,EAAE,KAAK;KACjB;IAED,mDAAmD;IACnD;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,oDAAoD;QACjE,YAAY,EAAE,0CAA0C;QACxD,SAAS,EAAE,QAAQ;KACpB;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,6CAA6C;QAC1D,YAAY,EAAE,iCAAiC;QAC/C,SAAS,EAAE,QAAQ;KACpB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,mCAAmC;QAC5C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2CAA2C;QACxD,YAAY,EAAE,2CAA2C;QACzD,SAAS,EAAE,QAAQ;KACpB;IAED,kDAAkD;IAClD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mDAAmD;QAChE,YAAY,EAAE,+BAA+B;QAC7C,SAAS,EAAE,OAAO;KACnB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,wCAAwC;QACjD,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,0CAA0C;QACvD,YAAY,EAAE,2CAA2C;QACzD,SAAS,EAAE,OAAO;KACnB;IAED,qDAAqD;IACrD;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,6DAA6D;QAC1E,YAAY,EAAE,+CAA+C;QAC7D,SAAS,EAAE,UAAU;KACtB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,kEAAkE;QAC3E,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,wCAAwC;QACrD,YAAY,EAAE,kDAAkD;QAChE,SAAS,EAAE,UAAU;KACtB;CACF,CAAA;AAED,8CAA8C;AAC9C,SAAS,eAAe,CAAC,OAAe,EAAE,QAAgB;IACxD,MAAM,UAAU,GAAa,EAAE,CAAA;IAE/B,UAAU;IACV,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5D,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC;IAED,UAAU;IACV,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC5B,CAAC;IAED,QAAQ;IACR,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QACpE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM;IACN,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACnE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;IAED,SAAS;IACT,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACpE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC;IAED,QAAQ;IACR,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;IAED,WAAW;IACX,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC7B,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAgB,qBAAqB,CACnC,OAAe,EACf,QAAgB,EAChB,OAAiC;IAEjC,MAAM,eAAe,GAAoB,EAAE,CAAA;IAE3C,qDAAqD;IACrD,IAAI,IAAA,wCAAsB,EAAC,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAA;IAE5D,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC7D,MAAM,UAAU,GAAG,IAAA,kCAAgB,EAAC,QAAQ,CAAC,CAAA;IAE7C,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,qBAAqB;QACrB,IAAI,IAAA,2BAAS,EAAC,IAAI,CAAC;YAAE,OAAM;QAE3B,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,8EAA8E;YAC9E,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrF,SAAQ;YACV,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAEvE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,iDAAiD;gBACjD,IAAI,OAAO,CAAC,IAAI,KAAK,mCAAmC,EAAE,CAAC;oBACzD,0DAA0D;oBAC1D,yBAAyB;oBACzB,uDAAuD;oBACvD,sDAAsD;oBACtD,mEAAmE;oBAEnE,MAAM,YAAY,GAAG,IAAA,kCAAgB,EAAC,QAAQ,CAAC,CAAA;oBAC/C,MAAM,UAAU,GAAG,IAAA,mCAAiB,EAAC,IAAI,CAAC,CAAA;oBAE1C,iEAAiE;oBACjE,8EAA8E;oBAC9E,MAAM,mBAAmB,GAAG,iFAAiF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAExH,+EAA+E;oBAC/E,iEAAiE;oBACjE,MAAM,qBAAqB,GAAG,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAE5G,oGAAoG;oBACpG,IAAI,YAAY,EAAE,CAAC;wBACjB,IAAI,mBAAmB,IAAI,UAAU,EAAE,CAAC;4BACtC,sDAAsD;4BACtD,SAAQ;wBACV,CAAC;wBACD,IAAI,qBAAqB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACjE,8DAA8D;4BAC9D,gDAAgD;4BAChD,MAAM,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAA;4BACtF,IAAI,oBAAoB,EAAE,CAAC;gCACzB,SAAQ;4BACV,CAAC;wBACH,CAAC;oBACH,CAAC;oBAED,MAAM,kBAAkB,GAAG,IAAA,0CAAwB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;oBAEnE,qEAAqE;oBACrE,IAAI,kBAAkB,KAAK,aAAa,EAAE,CAAC;wBACzC,SAAQ;oBACV,CAAC;oBAED,yDAAyD;oBACzD,IAAI,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAA;oBACvC,IAAI,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAA;oBAC7C,IAAI,oBAAoB,GAAG,KAAK,CAAA;oBAChC,IAAI,kBAAkB,GAA8B,QAAQ,CAAA;oBAE5D,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;wBAC7C,6BAA6B;wBAC7B,gBAAgB,GAAG,UAAU,CAAA;wBAC7B,mBAAmB,GAAG,wEAAwE,CAAA;wBAC9F,oBAAoB,GAAG,IAAI,CAAA;wBAC3B,kBAAkB,GAAG,MAAM,CAAA;oBAC7B,CAAC;yBAAM,CAAC;wBACN,eAAe;wBACf,IAAI,IAAA,mCAAiB,EAAC,IAAI,CAAC,EAAE,CAAC;4BAC5B,kDAAkD;4BAClD,gBAAgB,GAAG,QAAQ,CAAA;4BAC3B,mBAAmB,GAAG,mEAAmE,CAAA;4BACzF,oBAAoB,GAAG,IAAI,CAAA;wBAC7B,CAAC;6BAAM,IAAI,IAAA,kCAAgB,EAAC,QAAQ,CAAC,EAAE,CAAC;4BACtC,2DAA2D;4BAC3D,gBAAgB,GAAG,MAAM,CAAA;4BACzB,mBAAmB,GAAG,2DAA2D,CAAA;4BACjF,oBAAoB,GAAG,IAAI,CAAA;wBAC7B,CAAC;6BAAM,CAAC;4BACN,oCAAoC;4BACpC,gBAAgB,GAAG,MAAM,CAAA;4BACzB,oBAAoB,GAAG,IAAI,CAAA;wBAC7B,CAAC;oBACH,CAAC;oBAED,+BAA+B;oBAC/B,IAAI,UAAU,EAAE,CAAC;wBACf,gBAAgB,GAAG,KAAK,CAAA;wBACxB,kBAAkB,GAAG,KAAK,CAAA;wBAC1B,mBAAmB,GAAG,GAAG,mBAAmB,iBAAiB,CAAA;oBAC/D,CAAC;oBAED,eAAe,CAAC,IAAI,CAAC;wBACnB,EAAE,EAAE,aAAa,QAAQ,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;wBACxD,QAAQ;wBACR,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;wBACxB,QAAQ,EAAE,gBAAgB;wBAC1B,QAAQ,EAAE,iBAAiB;wBAC3B,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,IAAI,EAAE;wBAC/C,WAAW,EAAE,mBAAmB;wBAChC,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,UAAU,EAAE,kBAAkB;wBAC9B,cAAc,EAAE,eAAe;wBAC/B,KAAK,EAAE,CAAC;wBACZ,MAAM,EAAE,YAAqB;wBACzB,oBAAoB;qBACrB,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;gBAED,uCAAuC;gBACvC,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;gBAC/B,IAAI,UAAU,GAA8B,QAAQ,CAAA;gBAEpD,+BAA+B;gBAC/B,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;wBAC5B,QAAQ,GAAG,QAAQ,CAAA;oBACrB,CAAC;yBAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;wBAC/B,QAAQ,GAAG,KAAK,CAAA;oBAClB,CAAC;yBAAM,CAAC;wBACN,QAAQ,GAAG,MAAM,CAAA;oBACnB,CAAC;oBACD,UAAU,GAAG,KAAK,CAAA;gBACpB,CAAC;gBAED,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE,EAAE,aAAa,QAAQ,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;oBACxD,QAAQ;oBACR,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;oBACxB,QAAQ;oBACR,QAAQ,EAAE,iBAAiB;oBAC3B,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,IAAI,EAAE;oBAC/C,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW;oBACvF,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,UAAU;oBACV,cAAc,EAAE,eAAe;oBAC/B,KAAK,EAAE,CAAC;oBACV,MAAM,EAAE,YAAqB;iBAC5B,CAAC,CAAA;gBACF,MAAK,CAAC,4BAA4B;YACpC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/detect/structural/index.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Layer 2: Structural Scan
+ * Contextual analysis using variable heuristics, logic gate detection,
+ * dangerous functions, risky imports, auth anti-patterns, framework checks,
+ * and AI code fingerprinting
+ */
+import type { Vulnerability, ScanFile, CancellationToken, DetectorContext } from '../../shared/types';
+import type { ProgressCallback } from '../../shared/types';
+import type { MiddlewareAuthConfig } from '../../model/middleware-detector';
+import { type AuthHelperContext } from '../../model/auth-helper-detector';
+import type { FileAuthImports } from '../../model/imported-auth-detector';
+export interface Layer2Options {
+    middlewareConfig?: MiddlewareAuthConfig;
+    authHelperContext?: AuthHelperContext;
+    fileAuthImports?: Map<string, FileAuthImports>;
+    /** Whether to exclude test files from scanning (default: true) */
+    excludeTestFiles?: boolean;
+    /** Whether to exclude seed files from scanning (default: true) */
+    excludeSeedFiles?: boolean;
+    /** Custom exclusion patterns (glob format) */
+    customExclusions?: string[];
+    /**
+     * Detector context for context-aware detection (Phase 2b)
+     * When provided, detectors can make smarter decisions based on:
+     * - Project-level auth configuration
+     * - Framework detection
+     * - Per-file context (server vs client, test vs production)
+     */
+    detectorContext?: DetectorContext;
+}
+export interface Layer2Stats {
+    /** Raw finding counts per detector (before dedupe) */
+    raw: Record<string, number>;
+    /** Deduped finding counts per category */
+    deduped: Record<string, number>;
+    /** Severity distribution of deduped findings */
+    bySeverity: Record<string, number>;
+    /** Findings suppressed by path exclusions */
+    suppressedByPath: number;
+}
+export interface Layer2Result {
+    vulnerabilities: Vulnerability[];
+    filesScanned: number;
+    duration: number;
+    /** Heuristic breakdown stats for noise analysis */
+    stats: Layer2Stats;
+}
+export declare function runLayer2Scan(files: ScanFile[], options?: Layer2Options, onProgress?: ProgressCallback, cancellationToken?: CancellationToken): Promise<Layer2Result>;
+export { detectSensitiveVariables } from './variables';
+export { detectLogicGates } from './logic-gates';
+export { detectDangerousFunctions } from './dangerous-functions';
+export { detectRiskyImports } from './risky-imports';
+export { detectAuthAntipatterns } from './auth-patterns';
+export { detectFrameworkIssues } from './framework-checks';
+export { detectAIFingerprints } from '../ai-code/fingerprinting';
+export { detectDataExposure } from './data-exposure';
+export { detectBYOKPatterns } from '../ai-code/byok-patterns';
+export { detectAIPromptHygiene } from '../ai-code/prompt-hygiene';
+export { detectAIExecutionSinks } from '../ai-code/execution-sinks';
+export { detectAIAgentTools } from '../ai-code/agent-tools';
+export { detectRAGSafetyIssues } from '../ai-code/rag-safety';
+export { detectAIEndpointProtection } from '../ai-code/endpoint-protection';
+export { detectAISchemaValidation } from '../ai-code/schema-validation';
+export { detectAIPackageHallucination } from '../ai-code/package-hallucination';
+export { detectMCPSecurity } from '../ai-code/mcp-security';
+export { detectModelSupplyChain } from '../ai-code/model-supply-chain';
+export { detectSecurityHeaders } from './security-headers';
+export { detectSSRFPatterns } from './ssrf-detection';
+export { detectLogInjection } from './log-injection';
+export { detectXXEPatterns } from './xxe-detection';
+//# sourceMappingURL=index.d.ts.map

package/dist/detect/structural/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/detect/structural/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACrG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAC3E,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AAsCzE,MAAM,WAAW,aAAa;IAC5B,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC9C,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,aAAa,EAAE,CAAA;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,mDAAmD;IACnD,KAAK,EAAE,WAAW,CAAA;CACnB;AAmMD,wBAAsB,aAAa,CACjC,KAAK,EAAE,QAAQ,EAAE,EACjB,OAAO,GAAE,aAAkB,EAC3B,UAAU,CAAC,EAAE,gBAAgB,EAC7B,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,YAAY,CAAC,CA4JvB;AA2JD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAA;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAA;AAEvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAE3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA"}