@oculum/scanner 1.0.11 → 1.0.13

package/dist/detect/structural/index.js

@@ -0,0 +1,510 @@
+"use strict";
+/**
+ * Layer 2: Structural Scan
+ * Contextual analysis using variable heuristics, logic gate detection,
+ * dangerous functions, risky imports, auth anti-patterns, framework checks,
+ * and AI code fingerprinting
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectXXEPatterns = exports.detectLogInjection = exports.detectSSRFPatterns = exports.detectSecurityHeaders = exports.detectModelSupplyChain = exports.detectMCPSecurity = exports.detectAIPackageHallucination = exports.detectAISchemaValidation = exports.detectAIEndpointProtection = exports.detectRAGSafetyIssues = exports.detectAIAgentTools = exports.detectAIExecutionSinks = exports.detectAIPromptHygiene = exports.detectBYOKPatterns = exports.detectDataExposure = exports.detectAIFingerprints = exports.detectFrameworkIssues = exports.detectAuthAntipatterns = exports.detectRiskyImports = exports.detectDangerousFunctions = exports.detectLogicGates = exports.detectSensitiveVariables = void 0;
+exports.runLayer2Scan = runLayer2Scan;
+const auth_helper_detector_1 = require("../../model/auth-helper-detector");
+const path_exclusions_1 = require("../../parse/path-exclusions");
+const file_classifier_1 = require("../../parse/file-classifier");
+const variables_1 = require("./variables");
+const logic_gates_1 = require("./logic-gates");
+const dangerous_functions_1 = require("./dangerous-functions");
+const risky_imports_1 = require("./risky-imports");
+const auth_patterns_1 = require("./auth-patterns");
+const framework_checks_1 = require("./framework-checks");
+const fingerprinting_1 = require("../ai-code/fingerprinting");
+const data_exposure_1 = require("./data-exposure");
+const byok_patterns_1 = require("../ai-code/byok-patterns");
+// Story B: AI-specific detection modules
+const prompt_hygiene_1 = require("../ai-code/prompt-hygiene");
+const execution_sinks_1 = require("../ai-code/execution-sinks");
+const agent_tools_1 = require("../ai-code/agent-tools");
+// M5: New AI-era detectors
+const rag_safety_1 = require("../ai-code/rag-safety");
+const endpoint_protection_1 = require("../ai-code/endpoint-protection");
+const schema_validation_1 = require("../ai-code/schema-validation");
+// AI Detection Roadmap Phase 1
+const package_hallucination_1 = require("../ai-code/package-hallucination");
+const mcp_security_1 = require("../ai-code/mcp-security");
+// AI Detection Roadmap Phase 2
+const model_supply_chain_1 = require("../ai-code/model-supply-chain");
+// OWASP Workstream 1
+const security_headers_1 = require("./security-headers");
+const ssrf_detection_1 = require("./ssrf-detection");
+const log_injection_1 = require("./log-injection");
+const xxe_detection_1 = require("./xxe-detection");
+// Tier system removed in Phase 2B — confidence scoring handles routing
+const parsed_file_1 = require("../../shared/parsed-file");
+const parsed_file_2 = require("../../shared/parsed-file");
+const context_adjustments_1 = require("../../postprocess/filtering/context-adjustments");
+// Process a single file through all Layer 2 detectors
+function processFileLayer2(file, options, authHelperContext) {
+    const stats = {
+        variables: 0,
+        logicGates: 0,
+        dangerousFunctions: 0,
+        riskyImports: 0,
+        authAntipatterns: 0,
+        frameworkIssues: 0,
+        aiFingerprints: 0,
+        dataExposure: 0,
+        byokPatterns: 0,
+        promptHygiene: 0,
+        executionSinks: 0,
+        agentTools: 0,
+        ragSafety: 0,
+        endpointProtection: 0,
+        schemaValidation: 0,
+        // AI Detection Roadmap Phase 1
+        packageHallucination: 0,
+        mcpSecurity: 0,
+        // AI Detection Roadmap Phase 2
+        modelSupplyChain: 0,
+        // OWASP Workstream 1
+        securityHeaders: 0,
+        ssrfDetection: 0,
+        logInjection: 0,
+        xxeDetection: 0,
+    };
+    // Build file-specific context for context-aware detection (Phase 2b)
+    const fileContext = (0, file_classifier_1.buildFileContext)(file.path);
+    // Create ParsedFile once for all detectors to share (avoids redundant content.split('\n'))
+    const parsed = parsed_file_2.ParsedFile.from(file);
+    // Check if this is a manifest file (package.json, requirements.txt, etc.)
+    const isManifestFile = (filePath) => {
+        const manifestFiles = ['package.json', 'requirements.txt', 'Pipfile', 'pyproject.toml', 'setup.py'];
+        return manifestFiles.some(f => filePath.endsWith(f));
+    };
+    // For non-code files, only run package hallucination detector on manifest files
+    if (!isCodeFile(file.path)) {
+        if (isManifestFile(file.path)) {
+            // Run package hallucination detector on manifest files
+            const packageHallucinationFindings = (0, package_hallucination_1.detectAIPackageHallucination)(file.content, file.path);
+            stats.packageHallucination = packageHallucinationFindings.length;
+            return { findings: packageHallucinationFindings, stats };
+        }
+        return { findings: [], stats };
+    }
+    // Run all detectors — parsed is passed via options for detectors that support it
+    const variableFindings = (0, variables_1.detectSensitiveVariables)(file.content, file.path, { parsed });
+    const logicFindings = (0, logic_gates_1.detectLogicGates)(file.content, file.path, { parsed });
+    const dangerousFuncFindings = (0, dangerous_functions_1.detectDangerousFunctions)(file.content, file.path, { parsed });
+    const riskyImportFindings = (0, risky_imports_1.detectRiskyImports)(file.content, file.path, { parsed });
+    const authFindings = (0, auth_patterns_1.detectAuthAntipatterns)(file.content, file.path, {
+        middlewareConfig: options.middlewareConfig,
+        authHelpers: authHelperContext,
+        fileAuthImports: options.fileAuthImports,
+        parsed,
+    });
+    const frameworkFindings = (0, framework_checks_1.detectFrameworkIssues)(file.content, file.path, { parsed });
+    const aiFindings = (0, fingerprinting_1.detectAIFingerprints)(file.content, file.path, { parsed });
+    const dataExposureFindings = (0, data_exposure_1.detectDataExposure)(file.content, file.path, { parsed });
+    const byokFindings = (0, byok_patterns_1.detectBYOKPatterns)(file.content, file.path, options.middlewareConfig, { parsed });
+    const promptHygieneFindings = (0, prompt_hygiene_1.detectAIPromptHygiene)(file.content, file.path, { parsed });
+    const executionSinkFindings = (0, execution_sinks_1.detectAIExecutionSinks)(file.content, file.path, { parsed });
+    const agentToolFindings = (0, agent_tools_1.detectAIAgentTools)(file.content, file.path, { parsed });
+    const ragSafetyFindings = (0, rag_safety_1.detectRAGSafetyIssues)(file.content, file.path, { parsed });
+    const endpointProtectionFindings = (0, endpoint_protection_1.detectAIEndpointProtection)(file.content, file.path, {
+        middlewareConfig: options.middlewareConfig,
+        parsed,
+    });
+    const schemaValidationFindings = (0, schema_validation_1.detectAISchemaValidation)(file.content, file.path, { parsed });
+    // AI Detection Roadmap Phase 1
+    const packageHallucinationFindings = (0, package_hallucination_1.detectAIPackageHallucination)(file.content, file.path, { parsed });
+    const mcpSecurityFindings = (0, mcp_security_1.detectMCPSecurity)(file.content, file.path, { parsed });
+    // AI Detection Roadmap Phase 2
+    const modelSupplyChainFindings = (0, model_supply_chain_1.detectModelSupplyChain)(file.content, file.path, { parsed });
+    // OWASP Workstream 1
+    const securityHeaderFindings = (0, security_headers_1.detectSecurityHeaders)(file.content, file.path, { parsed });
+    const ssrfFindings = (0, ssrf_detection_1.detectSSRFPatterns)(file.content, file.path, { parsed });
+    const logInjectionFindings = (0, log_injection_1.detectLogInjection)(file.content, file.path, { parsed });
+    const xxeFindings = (0, xxe_detection_1.detectXXEPatterns)(file.content, file.path, { parsed });
+    // Update stats
+    stats.variables = variableFindings.length;
+    stats.logicGates = logicFindings.length;
+    stats.dangerousFunctions = dangerousFuncFindings.length;
+    stats.riskyImports = riskyImportFindings.length;
+    stats.authAntipatterns = authFindings.length;
+    stats.frameworkIssues = frameworkFindings.length;
+    stats.aiFingerprints = aiFindings.length;
+    stats.dataExposure = dataExposureFindings.length;
+    stats.byokPatterns = byokFindings.length;
+    stats.promptHygiene = promptHygieneFindings.length;
+    stats.executionSinks = executionSinkFindings.length;
+    stats.agentTools = agentToolFindings.length;
+    stats.ragSafety = ragSafetyFindings.length;
+    stats.endpointProtection = endpointProtectionFindings.length;
+    stats.schemaValidation = schemaValidationFindings.length;
+    // AI Detection Roadmap Phase 1
+    stats.packageHallucination = packageHallucinationFindings.length;
+    stats.mcpSecurity = mcpSecurityFindings.length;
+    // AI Detection Roadmap Phase 2
+    stats.modelSupplyChain = modelSupplyChainFindings.length;
+    // OWASP Workstream 1
+    stats.securityHeaders = securityHeaderFindings.length;
+    stats.ssrfDetection = ssrfFindings.length;
+    stats.logInjection = logInjectionFindings.length;
+    stats.xxeDetection = xxeFindings.length;
+    // Combine all findings
+    const allFindings = [
+        ...variableFindings,
+        ...logicFindings,
+        ...dangerousFuncFindings,
+        ...riskyImportFindings,
+        ...authFindings,
+        ...frameworkFindings,
+        ...aiFindings,
+        ...dataExposureFindings,
+        ...byokFindings,
+        ...promptHygieneFindings,
+        ...executionSinkFindings,
+        ...agentToolFindings,
+        ...ragSafetyFindings,
+        ...endpointProtectionFindings,
+        ...schemaValidationFindings,
+        // AI Detection Roadmap Phase 1
+        ...packageHallucinationFindings,
+        ...mcpSecurityFindings,
+        // AI Detection Roadmap Phase 2
+        ...modelSupplyChainFindings,
+        // OWASP Workstream 1
+        ...securityHeaderFindings,
+        ...ssrfFindings,
+        ...logInjectionFindings,
+        ...xxeFindings,
+    ];
+    // Apply context-based severity adjustments (Phase 2b)
+    const adjustedFindings = (0, context_adjustments_1.applyContextAdjustments)(allFindings, fileContext);
+    return {
+        findings: adjustedFindings,
+        stats,
+    };
+}
+// applyFileContextAdjustments consolidated into filtering/context-adjustments.ts
+// Parallel batch size for Layer 2 processing (larger batches for performance)
+const LAYER2_PARALLEL_BATCH_SIZE = 50;
+// Progress update interval (report every N files for better UX)
+const PROGRESS_UPDATE_INTERVAL = 10;
+async function runLayer2Scan(files, options = {}, onProgress, cancellationToken) {
+    const startTime = Date.now();
+    const vulnerabilities = [];
+    const stats = {
+        variables: 0,
+        logicGates: 0,
+        dangerousFunctions: 0,
+        riskyImports: 0,
+        authAntipatterns: 0,
+        frameworkIssues: 0,
+        aiFingerprints: 0,
+        dataExposure: 0,
+        byokPatterns: 0,
+        promptHygiene: 0,
+        executionSinks: 0,
+        agentTools: 0,
+        ragSafety: 0,
+        endpointProtection: 0,
+        schemaValidation: 0,
+        // AI Detection Roadmap Phase 1
+        packageHallucination: 0,
+        mcpSecurity: 0,
+        // AI Detection Roadmap Phase 2
+        modelSupplyChain: 0,
+        // OWASP Workstream 1
+        securityHeaders: 0,
+        ssrfDetection: 0,
+        logInjection: 0,
+        xxeDetection: 0,
+    };
+    // Detect auth helpers once for all files (if not already provided)
+    const authHelperContext = options.authHelperContext || (0, auth_helper_detector_1.detectAuthHelpers)(files);
+    // Track progress for frequent updates
+    let filesProcessed = 0;
+    let lastProgressUpdate = 0;
+    // Process files in parallel batches for better performance on large codebases
+    for (let i = 0; i < files.length; i += LAYER2_PARALLEL_BATCH_SIZE) {
+        // Check for cancellation before processing batch
+        if (cancellationToken?.cancelled)
+            break;
+        const batch = files.slice(i, i + LAYER2_PARALLEL_BATCH_SIZE);
+        const results = await Promise.all(batch.map(file => Promise.resolve(processFileLayer2(file, options, authHelperContext))));
+        for (const result of results) {
+            vulnerabilities.push(...result.findings);
+            // Accumulate stats
+            for (const [key, value] of Object.entries(result.stats)) {
+                stats[key] += value;
+            }
+        }
+        filesProcessed = Math.min(i + LAYER2_PARALLEL_BATCH_SIZE, files.length);
+        // Report progress every PROGRESS_UPDATE_INTERVAL files for better UX
+        if (onProgress && (filesProcessed - lastProgressUpdate >= PROGRESS_UPDATE_INTERVAL || filesProcessed === files.length)) {
+            onProgress({
+                status: 'layer2',
+                message: 'Running structural scan (variables, logic gates)...',
+                filesProcessed,
+                totalFiles: files.length,
+                vulnerabilitiesFound: vulnerabilities.length,
+            });
+            lastProgressUpdate = filesProcessed;
+        }
+    }
+    // Deduplicate findings
+    const dedupedVulnerabilities = deduplicateFindings(vulnerabilities);
+    // Apply path exclusions (test files, seed files, etc.)
+    // By default, exclude test and seed files unless explicitly disabled
+    const excludeTestFiles = options.excludeTestFiles !== false;
+    const excludeSeedFiles = options.excludeSeedFiles !== false;
+    // Build exclusion config based on options
+    const exclusionConfig = {};
+    if (!excludeTestFiles) {
+        exclusionConfig.testPatterns = [];
+    }
+    if (!excludeSeedFiles) {
+        exclusionConfig.seedPatterns = [];
+    }
+    if (options.customExclusions) {
+        // Add custom exclusions to all pattern types
+        exclusionConfig.testPatterns = [
+            ...(exclusionConfig.testPatterns || []),
+            ...options.customExclusions,
+        ];
+    }
+    const { kept: uniqueVulnerabilities, suppressed } = (0, path_exclusions_1.filterFindingsByPath)(dedupedVulnerabilities, Object.keys(exclusionConfig).length > 0 ? exclusionConfig : undefined);
+    // Track suppressed findings (debug info available in stats)
+    // Build raw stats map for logging
+    const rawStats = {
+        sensitive_variables: stats.variables,
+        logic_gates: stats.logicGates,
+        dangerous_functions: stats.dangerousFunctions,
+        risky_imports: stats.riskyImports,
+        auth_antipatterns: stats.authAntipatterns,
+        framework_issues: stats.frameworkIssues,
+        ai_fingerprints: stats.aiFingerprints,
+        data_exposure: stats.dataExposure,
+        byok_patterns: stats.byokPatterns,
+        ai_prompt_hygiene: stats.promptHygiene,
+        ai_execution_sinks: stats.executionSinks,
+        ai_agent_tools: stats.agentTools,
+        // M5: New AI-era detectors
+        ai_rag_safety: stats.ragSafety,
+        ai_endpoint_protection: stats.endpointProtection,
+        ai_schema_validation: stats.schemaValidation,
+        // AI Detection Roadmap Phase 1
+        ai_package_hallucination: stats.packageHallucination,
+        ai_mcp_security: stats.mcpSecurity,
+        // AI Detection Roadmap Phase 2
+        model_supply_chain: stats.modelSupplyChain,
+        // OWASP Workstream 1
+        security_headers: stats.securityHeaders,
+        ssrf_detection: stats.ssrfDetection,
+        log_injection: stats.logInjection,
+        xxe_detection: stats.xxeDetection,
+    };
+    // Compute deduped counts per category
+    const dedupedStats = {};
+    for (const vuln of uniqueVulnerabilities) {
+        const cat = vuln.category;
+        dedupedStats[cat] = (dedupedStats[cat] || 0) + 1;
+    }
+    // Compute severity distribution
+    const severityStats = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const vuln of uniqueVulnerabilities) {
+        severityStats[vuln.severity] = (severityStats[vuln.severity] || 0) + 1;
+    }
+    return {
+        vulnerabilities: uniqueVulnerabilities,
+        filesScanned: files.filter(f => isCodeFile(f.path)).length,
+        duration: Date.now() - startTime,
+        stats: {
+            raw: rawStats,
+            deduped: dedupedStats,
+            bySeverity: severityStats,
+            suppressedByPath: suppressed.length,
+        },
+    };
+}
+// Check if file is a code file (not config/data)
+function isCodeFile(filePath) {
+    const codeExtensions = [
+        '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',
+        '.py', '.rb', '.php', '.go', '.java', '.cs',
+        '.rs', '.swift', '.kt', '.scala',
+    ];
+    return codeExtensions.some(ext => filePath.endsWith(ext));
+}
+// Remove duplicate findings on the same line and merge related findings
+function deduplicateFindings(vulnerabilities) {
+    // First pass: exact deduplication by file:line:category
+    const seen = new Map();
+    for (const vuln of vulnerabilities) {
+        const key = `${vuln.filePath}:${vuln.lineNumber}:${vuln.category}`;
+        const existing = seen.get(key);
+        // Keep the higher severity finding
+        if (!existing || (0, parsed_file_1.severityRank)(vuln.severity) > (0, parsed_file_1.severityRank)(existing.severity)) {
+            seen.set(key, vuln);
+        }
+    }
+    // Second pass: merge findings on adjacent lines (within 3 lines) with same category
+    const dedupedList = Array.from(seen.values());
+    const merged = mergeAdjacentFindings(dedupedList);
+    // Third pass: subsume related categories (e.g., specific finding subsumes generic)
+    return subsumeRelatedFindings(merged);
+}
+// Merge findings on adjacent lines with the same category
+function mergeAdjacentFindings(vulnerabilities) {
+    if (vulnerabilities.length <= 1)
+        return vulnerabilities;
+    // Group by file and category
+    const groups = new Map();
+    for (const vuln of vulnerabilities) {
+        const key = `${vuln.filePath}:${vuln.category}`;
+        const group = groups.get(key) || [];
+        group.push(vuln);
+        groups.set(key, group);
+    }
+    const result = [];
+    for (const [, group] of groups) {
+        if (group.length === 1) {
+            result.push(group[0]);
+            continue;
+        }
+        // Sort by line number
+        group.sort((a, b) => a.lineNumber - b.lineNumber);
+        // Merge adjacent findings (within 3 lines)
+        let current = group[0];
+        let mergedCount = 1;
+        for (let i = 1; i < group.length; i++) {
+            const next = group[i];
+            if (next.lineNumber - current.lineNumber <= 3) {
+                // Merge: keep higher severity, note the merge
+                mergedCount++;
+                if ((0, parsed_file_1.severityRank)(next.severity) > (0, parsed_file_1.severityRank)(current.severity)) {
+                    current = {
+                        ...next,
+                        title: current.title,
+                        description: current.description,
+                    };
+                }
+            }
+            else {
+                // Not adjacent - emit current and start new
+                if (mergedCount > 1) {
+                    current = {
+                        ...current,
+                        title: `${current.title} (${mergedCount} occurrences)`,
+                    };
+                }
+                result.push(current);
+                current = next;
+                mergedCount = 1;
+            }
+        }
+        // Emit last
+        if (mergedCount > 1) {
+            current = {
+                ...current,
+                title: `${current.title} (${mergedCount} occurrences)`,
+            };
+        }
+        result.push(current);
+    }
+    return result;
+}
+// Subsume related findings where a more specific finding covers a generic one
+function subsumeRelatedFindings(vulnerabilities) {
+    // Define subsumption rules: specific category subsumes generic
+    const subsumptionRules = {
+        // SQL injection subsumes generic dangerous function
+        sql_injection: ['dangerous_function'],
+        // Command injection subsumes generic dangerous function
+        command_injection: ['dangerous_function'],
+        // XSS subsumes generic dangerous function
+        xss: ['dangerous_function'],
+        // Specific auth issues subsume generic missing auth
+        missing_auth: ['auth_antipattern'],
+    };
+    // Group by file and line
+    const byLocation = new Map();
+    for (const vuln of vulnerabilities) {
+        const key = `${vuln.filePath}:${vuln.lineNumber}`;
+        const group = byLocation.get(key) || [];
+        group.push(vuln);
+        byLocation.set(key, group);
+    }
+    const result = [];
+    for (const [, group] of byLocation) {
+        if (group.length === 1) {
+            result.push(group[0]);
+            continue;
+        }
+        // Check for subsumption
+        const toKeep = new Set(group);
+        for (const vuln of group) {
+            const subsumes = subsumptionRules[vuln.category];
+            if (subsumes) {
+                for (const other of group) {
+                    if (subsumes.includes(other.category) && other !== vuln) {
+                        toKeep.delete(other);
+                    }
+                }
+            }
+        }
+        result.push(...toKeep);
+    }
+    return result;
+}
+// severityRank imported from utils/parsed-file
+var variables_2 = require("./variables");
+Object.defineProperty(exports, "detectSensitiveVariables", { enumerable: true, get: function () { return variables_2.detectSensitiveVariables; } });
+var logic_gates_2 = require("./logic-gates");
+Object.defineProperty(exports, "detectLogicGates", { enumerable: true, get: function () { return logic_gates_2.detectLogicGates; } });
+var dangerous_functions_2 = require("./dangerous-functions");
+Object.defineProperty(exports, "detectDangerousFunctions", { enumerable: true, get: function () { return dangerous_functions_2.detectDangerousFunctions; } });
+var risky_imports_2 = require("./risky-imports");
+Object.defineProperty(exports, "detectRiskyImports", { enumerable: true, get: function () { return risky_imports_2.detectRiskyImports; } });
+var auth_patterns_2 = require("./auth-patterns");
+Object.defineProperty(exports, "detectAuthAntipatterns", { enumerable: true, get: function () { return auth_patterns_2.detectAuthAntipatterns; } });
+var framework_checks_2 = require("./framework-checks");
+Object.defineProperty(exports, "detectFrameworkIssues", { enumerable: true, get: function () { return framework_checks_2.detectFrameworkIssues; } });
+var fingerprinting_2 = require("../ai-code/fingerprinting");
+Object.defineProperty(exports, "detectAIFingerprints", { enumerable: true, get: function () { return fingerprinting_2.detectAIFingerprints; } });
+var data_exposure_2 = require("./data-exposure");
+Object.defineProperty(exports, "detectDataExposure", { enumerable: true, get: function () { return data_exposure_2.detectDataExposure; } });
+var byok_patterns_2 = require("../ai-code/byok-patterns");
+Object.defineProperty(exports, "detectBYOKPatterns", { enumerable: true, get: function () { return byok_patterns_2.detectBYOKPatterns; } });
+// Story B: AI-specific detectors
+var prompt_hygiene_2 = require("../ai-code/prompt-hygiene");
+Object.defineProperty(exports, "detectAIPromptHygiene", { enumerable: true, get: function () { return prompt_hygiene_2.detectAIPromptHygiene; } });
+var execution_sinks_2 = require("../ai-code/execution-sinks");
+Object.defineProperty(exports, "detectAIExecutionSinks", { enumerable: true, get: function () { return execution_sinks_2.detectAIExecutionSinks; } });
+var agent_tools_2 = require("../ai-code/agent-tools");
+Object.defineProperty(exports, "detectAIAgentTools", { enumerable: true, get: function () { return agent_tools_2.detectAIAgentTools; } });
+// M5: New AI-era detectors
+var rag_safety_2 = require("../ai-code/rag-safety");
+Object.defineProperty(exports, "detectRAGSafetyIssues", { enumerable: true, get: function () { return rag_safety_2.detectRAGSafetyIssues; } });
+var endpoint_protection_2 = require("../ai-code/endpoint-protection");
+Object.defineProperty(exports, "detectAIEndpointProtection", { enumerable: true, get: function () { return endpoint_protection_2.detectAIEndpointProtection; } });
+var schema_validation_2 = require("../ai-code/schema-validation");
+Object.defineProperty(exports, "detectAISchemaValidation", { enumerable: true, get: function () { return schema_validation_2.detectAISchemaValidation; } });
+// AI Detection Roadmap Phase 1
+var package_hallucination_2 = require("../ai-code/package-hallucination");
+Object.defineProperty(exports, "detectAIPackageHallucination", { enumerable: true, get: function () { return package_hallucination_2.detectAIPackageHallucination; } });
+var mcp_security_2 = require("../ai-code/mcp-security");
+Object.defineProperty(exports, "detectMCPSecurity", { enumerable: true, get: function () { return mcp_security_2.detectMCPSecurity; } });
+// AI Detection Roadmap Phase 2
+var model_supply_chain_2 = require("../ai-code/model-supply-chain");
+Object.defineProperty(exports, "detectModelSupplyChain", { enumerable: true, get: function () { return model_supply_chain_2.detectModelSupplyChain; } });
+// OWASP Workstream 1
+var security_headers_2 = require("./security-headers");
+Object.defineProperty(exports, "detectSecurityHeaders", { enumerable: true, get: function () { return security_headers_2.detectSecurityHeaders; } });
+var ssrf_detection_2 = require("./ssrf-detection");
+Object.defineProperty(exports, "detectSSRFPatterns", { enumerable: true, get: function () { return ssrf_detection_2.detectSSRFPatterns; } });
+var log_injection_2 = require("./log-injection");
+Object.defineProperty(exports, "detectLogInjection", { enumerable: true, get: function () { return log_injection_2.detectLogInjection; } });
+var xxe_detection_2 = require("./xxe-detection");
+Object.defineProperty(exports, "detectXXEPatterns", { enumerable: true, get: function () { return xxe_detection_2.detectXXEPatterns; } });
+//# sourceMappingURL=index.js.map

package/dist/detect/structural/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/detect/structural/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAoRH,sCAiKC;AAhbD,2EAA4F;AAE5F,iEAGoC;AACpC,iEAAgF;AAChF,2CAAsD;AACtD,+CAAgD;AAChD,+DAAgE;AAChE,mDAAoD;AACpD,mDAAwD;AACxD,yDAA0D;AAC1D,8DAAgE;AAChE,mDAAoD;AACpD,4DAA6D;AAC7D,yCAAyC;AACzC,8DAAiE;AACjE,gEAAmE;AACnE,wDAA2D;AAC3D,2BAA2B;AAC3B,sDAA6D;AAC7D,wEAA2E;AAC3E,oEAAuE;AACvE,+BAA+B;AAC/B,4EAA+E;AAC/E,0DAA2D;AAC3D,+BAA+B;AAC/B,sEAAsE;AACtE,qBAAqB;AACrB,yDAA0D;AAC1D,qDAAqD;AACrD,mDAAoD;AACpD,mDAAmD;AACnD,uEAAuE;AACvE,0DAAuD;AACvD,0DAAqD;AACrD,yFAAyF;AAsEzF,sDAAsD;AACtD,SAAS,iBAAiB,CACxB,IAAc,EACd,OAAsB,EACtB,iBAAuD;IAEvD,MAAM,KAAK,GAAwB;QACjC,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,CAAC;QACb,kBAAkB,EAAE,CAAC;QACrB,YAAY,EAAE,CAAC;QACf,gBAAgB,EAAE,CAAC;QACnB,eAAe,EAAE,CAAC;QAClB,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,CAAC;QACf,YAAY,EAAE,CAAC;QACf,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,UAAU,EAAE,CAAC;QACb,SAAS,EAAE,CAAC;QACZ,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE,CAAC;QACnB,+BAA+B;QAC/B,oBAAoB,EAAE,CAAC;QACvB,WAAW,EAAE,CAAC;QACd,+BAA+B;QAC/B,gBAAgB,EAAE,CAAC;QACnB,qBAAqB;QACrB,eAAe,EAAE,CAAC;QAClB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC;QACf,YAAY,EAAE,CAAC;KAChB,CAAA;IAED,qEAAqE;IACrE,MAAM,WAAW,GAAG,IAAA,kCAAgB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE/C,2FAA2F;IAC3F,MAAM,MAAM,GAAG,wBAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEpC,0EAA0E;IAC1E,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,EAAE;QAC1C,MAAM,aAAa,GAAG,CAAC,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAA;QACnG,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC,CAAA;IAED,gFAAgF;IAChF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,uDAAuD;YACvD,MAAM,4BAA4B,GAAG,IAAA,oDAA4B,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAC1F,KAAK,CAAC,oBAAoB,GAAG,4BAA4B,CAAC,MAAM,CAAA;YAChE,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAA;QAC1D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IAChC,CAAC;IAED,iFAAiF;IACjF,MAAM,gBAAgB,GAAG,IAAA,oCAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC3E,MAAM,qBAAqB,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC3F,MAAM,mBAAmB,GAAG,IAAA,kCAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACnF,MAAM,YAAY,GAAG,IAAA,sCAAsB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;QACnE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,WAAW,EAAE,iBAAiB;QAC9B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM;KACP,CAAC,CAAA;IACF,MAAM,iBAAiB,GAAG,IAAA,wCAAqB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACpF,MAAM,UAAU,GAAG,IAAA,qCAAoB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5E,MAAM,oBAAoB,GAAG,IAAA,kCAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACpF,MAAM,YAAY,GAAG,IAAA,kCAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACtG,MAAM,qBAAqB,GAAG,IAAA,sCAAqB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,MAAM,qBAAqB,GAAG,IAAA,wCAAsB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACzF,MAAM,iBAAiB,GAAG,IAAA,gCAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACjF,MAAM,iBAAiB,GAAG,IAAA,kCAAqB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACpF,MAAM,0BAA0B,GAAG,IAAA,gDAA0B,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;QACrF,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,MAAM;KACP,CAAC,CAAA;IACF,MAAM,wBAAwB,GAAG,IAAA,4CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9F,+BAA+B;IAC/B,MAAM,4BAA4B,GAAG,IAAA,oDAA4B,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACtG,MAAM,mBAAmB,GAAG,IAAA,gCAAiB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAClF,+BAA+B;IAC/B,MAAM,wBAAwB,GAAG,IAAA,2CAAsB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5F,qBAAqB;IACrB,MAAM,sBAAsB,GAAG,IAAA,wCAAqB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACzF,MAAM,YAAY,GAAG,IAAA,mCAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5E,MAAM,oBAAoB,GAAG,IAAA,kCAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACpF,MAAM,WAAW,GAAG,IAAA,iCAAiB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAE1E,eAAe;IACf,KAAK,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAA;IACzC,KAAK,CAAC,UAAU,GAAG,aAAa,CAAC,MAAM,CAAA;IACvC,KAAK,CAAC,kBAAkB,GAAG,qBAAqB,CAAC,MAAM,CAAA;IACvD,KAAK,CAAC,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAA;IAC/C,KAAK,CAAC,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAA;IAC5C,KAAK,CAAC,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAA;IAChD,KAAK,CAAC,cAAc,GAAG,UAAU,CAAC,MAAM,CAAA;IACxC,KAAK,CAAC,YAAY,GAAG,oBAAoB,CAAC,MAAM,CAAA;IAChD,KAAK,CAAC,YAAY,GAAG,YAAY,CAAC,MAAM,CAAA;IACxC,KAAK,CAAC,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAA;IAClD,KAAK,CAAC,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAA;IACnD,KAAK,CAAC,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAA;IAC3C,KAAK,CAAC,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAA;IAC1C,KAAK,CAAC,kBAAkB,GAAG,0BAA0B,CAAC,MAAM,CAAA;IAC5D,KAAK,CAAC,gBAAgB,GAAG,wBAAwB,CAAC,MAAM,CAAA;IACxD,+BAA+B;IAC/B,KAAK,CAAC,oBAAoB,GAAG,4BAA4B,CAAC,MAAM,CAAA;IAChE,KAAK,CAAC,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAA;IAC9C,+BAA+B;IAC/B,KAAK,CAAC,gBAAgB,GAAG,wBAAwB,CAAC,MAAM,CAAA;IACxD,qBAAqB;IACrB,KAAK,CAAC,eAAe,GAAG,sBAAsB,CAAC,MAAM,CAAA;IACrD,KAAK,CAAC,aAAa,GAAG,YAAY,CAAC,MAAM,CAAA;IACzC,KAAK,CAAC,YAAY,GAAG,oBAAoB,CAAC,MAAM,CAAA;IAChD,KAAK,CAAC,YAAY,GAAG,WAAW,CAAC,MAAM,CAAA;IAEvC,uBAAuB;IACvB,MAAM,WAAW,GAAG;QAClB,GAAG,gBAAgB;QACnB,GAAG,aAAa;QAChB,GAAG,qBAAqB;QACxB,GAAG,mBAAmB;QACtB,GAAG,YAAY;QACf,GAAG,iBAAiB;QACpB,GAAG,UAAU;QACb,GAAG,oBAAoB;QACvB,GAAG,YAAY;QACf,GAAG,qBAAqB;QACxB,GAAG,qBAAqB;QACxB,GAAG,iBAAiB;QACpB,GAAG,iBAAiB;QACpB,GAAG,0BAA0B;QAC7B,GAAG,wBAAwB;QAC3B,+BAA+B;QAC/B,GAAG,4BAA4B;QAC/B,GAAG,mBAAmB;QACtB,+BAA+B;QAC/B,GAAG,wBAAwB;QAC3B,qBAAqB;QACrB,GAAG,sBAAsB;QACzB,GAAG,YAAY;QACf,GAAG,oBAAoB;QACvB,GAAG,WAAW;KACf,CAAA;IAED,sDAAsD;IACtD,MAAM,gBAAgB,GAAG,IAAA,6CAAuB,EAAC,WAAW,EAAE,WAAW,CAAC,CAAA;IAE1E,OAAO;QACL,QAAQ,EAAE,gBAAgB;QAC1B,KAAK;KACN,CAAA;AACH,CAAC;AAED,iFAAiF;AAEjF,8EAA8E;AAC9E,MAAM,0BAA0B,GAAG,EAAE,CAAA;AACrC,gEAAgE;AAChE,MAAM,wBAAwB,GAAG,EAAE,CAAA;AAE5B,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,UAAyB,EAAE,EAC3B,UAA6B,EAC7B,iBAAqC;IAErC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,KAAK,GAAwB;QACjC,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,CAAC;QACb,kBAAkB,EAAE,CAAC;QACrB,YAAY,EAAE,CAAC;QACf,gBAAgB,EAAE,CAAC;QACnB,eAAe,EAAE,CAAC;QAClB,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,CAAC;QACf,YAAY,EAAE,CAAC;QACf,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,UAAU,EAAE,CAAC;QACb,SAAS,EAAE,CAAC;QACZ,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE,CAAC;QACnB,+BAA+B;QAC/B,oBAAoB,EAAE,CAAC;QACvB,WAAW,EAAE,CAAC;QACd,+BAA+B;QAC/B,gBAAgB,EAAE,CAAC;QACnB,qBAAqB;QACrB,eAAe,EAAE,CAAC;QAClB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC;QACf,YAAY,EAAE,CAAC;KAChB,CAAA;IAED,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAA,wCAAiB,EAAC,KAAK,CAAC,CAAA;IAE/E,sCAAsC;IACtC,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,IAAI,kBAAkB,GAAG,CAAC,CAAA;IAE1B,8EAA8E;IAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,0BAA0B,EAAE,CAAC;QAClE,iDAAiD;QACjD,IAAI,iBAAiB,EAAE,SAAS;YAAE,MAAK;QAEvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,0BAA0B,CAAC,CAAA;QAC5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,CACxF,CAAA;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;YACxC,mBAAmB;YACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,KAAK,CAAC,GAAgC,CAAC,IAAI,KAAK,CAAA;YAClD,CAAC;QACH,CAAC;QAED,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,0BAA0B,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAEvE,qEAAqE;QACrE,IAAI,UAAU,IAAI,CAAC,cAAc,GAAG,kBAAkB,IAAI,wBAAwB,IAAI,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACvH,UAAU,CAAC;gBACT,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,qDAAqD;gBAC9D,cAAc;gBACd,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,oBAAoB,EAAE,eAAe,CAAC,MAAM;aAC7C,CAAC,CAAA;YACF,kBAAkB,GAAG,cAAc,CAAA;QACrC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,sBAAsB,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAA;IAEnE,uDAAuD;IACvD,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAA;IAC3D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAA;IAE3D,0CAA0C;IAC1C,MAAM,eAAe,GAA6B,EAAE,CAAA;IACpD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,eAAe,CAAC,YAAY,GAAG,EAAE,CAAA;IACnC,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,eAAe,CAAC,YAAY,GAAG,EAAE,CAAA;IACnC,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,6CAA6C;QAC7C,eAAe,CAAC,YAAY,GAAG;YAC7B,GAAG,CAAC,eAAe,CAAC,YAAY,IAAI,EAAE,CAAC;YACvC,GAAG,OAAO,CAAC,gBAAgB;SAC5B,CAAA;IACH,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,IAAA,sCAAoB,EACtE,sBAAsB,EACtB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CACtE,CAAA;IAED,4DAA4D;IAE5D,kCAAkC;IAClC,MAAM,QAAQ,GAA2B;QACvC,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,mBAAmB,EAAE,KAAK,CAAC,kBAAkB;QAC7C,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;QACzC,gBAAgB,EAAE,KAAK,CAAC,eAAe;QACvC,eAAe,EAAE,KAAK,CAAC,cAAc;QACrC,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,iBAAiB,EAAE,KAAK,CAAC,aAAa;QACtC,kBAAkB,EAAE,KAAK,CAAC,cAAc;QACxC,cAAc,EAAE,KAAK,CAAC,UAAU;QAChC,2BAA2B;QAC3B,aAAa,EAAE,KAAK,CAAC,SAAS;QAC9B,sBAAsB,EAAE,KAAK,CAAC,kBAAkB;QAChD,oBAAoB,EAAE,KAAK,CAAC,gBAAgB;QAC5C,+BAA+B;QAC/B,wBAAwB,EAAE,KAAK,CAAC,oBAAoB;QACpD,eAAe,EAAE,KAAK,CAAC,WAAW;QAClC,+BAA+B;QAC/B,kBAAkB,EAAE,KAAK,CAAC,gBAAgB;QAC1C,qBAAqB;QACrB,gBAAgB,EAAE,KAAK,CAAC,eAAe;QACvC,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,aAAa,EAAE,KAAK,CAAC,YAAY;KAClC,CAAA;IAED,sCAAsC;IACtC,MAAM,YAAY,GAA2B,EAAE,CAAA;IAC/C,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAA;QACzB,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;IAED,gCAAgC;IAChC,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;IAClG,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,eAAe,EAAE,qBAAqB;QACtC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAC1D,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAChC,KAAK,EAAE;YACL,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,aAAa;YACzB,gBAAgB,EAAE,UAAU,CAAC,MAAM;SACpC;KACF,CAAA;AACH,CAAC;AAED,iDAAiD;AACjD,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,cAAc,GAAG;QACrB,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;QAC5C,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;QAC3C,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ;KACjC,CAAA;IAED,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB,CAAC,eAAgC;IAC3D,wDAAwD;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAA;IAE7C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAE9B,mCAAmC;QACnC,IAAI,CAAC,QAAQ,IAAI,IAAA,0BAAY,EAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAA,0BAAY,EAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAA;IAEjD,mFAAmF;IACnF,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAA;AACvC,CAAC;AAED,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,eAAgC;IAC7D,IAAI,eAAe,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,eAAe,CAAA;IAEvD,6BAA6B;IAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAA;IACjD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACnC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,sBAAsB;QACtB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAA;QAEjD,2CAA2C;QAC3C,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,WAAW,GAAG,CAAC,CAAA;QAEnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,IAAI,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;gBAC9C,8CAA8C;gBAC9C,WAAW,EAAE,CAAA;gBACb,IAAI,IAAA,0BAAY,EAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAA,0BAAY,EAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjE,OAAO,GAAG;wBACR,GAAG,IAAI;wBACP,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,4CAA4C;gBAC5C,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;oBACpB,OAAO,GAAG;wBACR,GAAG,OAAO;wBACV,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,KAAK,WAAW,eAAe;qBACvD,CAAA;gBACH,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACpB,OAAO,GAAG,IAAI,CAAA;gBACd,WAAW,GAAG,CAAC,CAAA;YACjB,CAAC;QACH,CAAC;QAED,YAAY;QACZ,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,GAAG;gBACR,GAAG,OAAO;gBACV,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,KAAK,WAAW,eAAe;aACvD,CAAA;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACtB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,sBAAsB,CAAC,eAAgC;IAC9D,+DAA+D;IAC/D,MAAM,gBAAgB,GAA6B;QACjD,oDAAoD;QACpD,aAAa,EAAE,CAAC,oBAAoB,CAAC;QACrC,wDAAwD;QACxD,iBAAiB,EAAE,CAAC,oBAAoB,CAAC;QACzC,0CAA0C;QAC1C,GAAG,EAAE,CAAC,oBAAoB,CAAC;QAC3B,oDAAoD;QACpD,YAAY,EAAE,CAAC,kBAAkB,CAAC;KACnC,CAAA;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAA;IACrD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAA;QACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACvC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChB,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAChD,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;oBAC1B,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;IACxB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+CAA+C;AAE/C,yCAAsD;AAA7C,qHAAA,wBAAwB,OAAA;AACjC,6CAAgD;AAAvC,+GAAA,gBAAgB,OAAA;AACzB,6DAAgE;AAAvD,+HAAA,wBAAwB,OAAA;AACjC,iDAAoD;AAA3C,mHAAA,kBAAkB,OAAA;AAC3B,iDAAwD;AAA/C,uHAAA,sBAAsB,OAAA;AAC/B,uDAA0D;AAAjD,yHAAA,qBAAqB,OAAA;AAC9B,4DAAgE;AAAvD,sHAAA,oBAAoB,OAAA;AAC7B,iDAAoD;AAA3C,mHAAA,kBAAkB,OAAA;AAC3B,0DAA6D;AAApD,mHAAA,kBAAkB,OAAA;AAC3B,iCAAiC;AACjC,4DAAiE;AAAxD,uHAAA,qBAAqB,OAAA;AAC9B,8DAAmE;AAA1D,yHAAA,sBAAsB,OAAA;AAC/B,sDAA2D;AAAlD,iHAAA,kBAAkB,OAAA;AAC3B,2BAA2B;AAC3B,oDAA6D;AAApD,mHAAA,qBAAqB,OAAA;AAC9B,sEAA2E;AAAlE,iIAAA,0BAA0B,OAAA;AACnC,kEAAuE;AAA9D,6HAAA,wBAAwB,OAAA;AACjC,+BAA+B;AAC/B,0EAA+E;AAAtE,qIAAA,4BAA4B,OAAA;AACrC,wDAA2D;AAAlD,iHAAA,iBAAiB,OAAA;AAC1B,+BAA+B;AAC/B,oEAAsE;AAA7D,4HAAA,sBAAsB,OAAA;AAC/B,qBAAqB;AACrB,uDAA0D;AAAjD,yHAAA,qBAAqB,OAAA;AAC9B,mDAAqD;AAA5C,oHAAA,kBAAkB,OAAA;AAC3B,iDAAoD;AAA3C,mHAAA,kBAAkB,OAAA;AAC3B,iDAAmD;AAA1C,kHAAA,iBAAiB,OAAA"}

package/dist/detect/structural/log-injection.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Layer 2: Log Injection Detector
+ * Detects unsanitized user input flowing into log statements
+ *
+ * OWASP A09:2021 - Security Logging and Monitoring Failures
+ * CWE-117: Improper Output Neutralization for Logs
+ */
+import type { Vulnerability } from '../../shared/types';
+import type { ParsedFile } from '../../shared/parsed-file';
+interface LogInjectionOptions {
+    parsed?: ParsedFile;
+}
+/**
+ * Detect log injection patterns
+ */
+export declare function detectLogInjection(content: string, filePath: string, options?: LogInjectionOptions): Vulnerability[];
+export {};
+//# sourceMappingURL=log-injection.d.ts.map

package/dist/detect/structural/log-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-injection.d.ts","sourceRoot":"","sources":["../../../src/detect/structural/log-injection.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAA;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAS1D,UAAU,mBAAmB;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB;AA2JD;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,aAAa,EAAE,CAuEjB"}