@oculum/scanner 1.0.11 → 1.0.13

package/dist/detect/structural/ssrf-detection.js

@@ -0,0 +1,263 @@
+"use strict";
+/**
+ * Layer 2: SSRF (Server-Side Request Forgery) Detector
+ * Detects user input flowing to server-side HTTP request sinks
+ *
+ * OWASP A01:2021 - Broken Access Control / A10:2021 - SSRF
+ * CWE-918: Server-Side Request Forgery
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectSSRFPatterns = detectSSRFPatterns;
+const file_classifier_1 = require("../../parse/file-classifier");
+const BASE_CONFIDENCE = 0.40;
+/** User input source patterns */
+const USER_INPUT_PATTERN = /(?:req|request|ctx\.request)\.(?:body|query|params|headers)(?:\.\w+|\[)/;
+/** Check if file is client-side (SSRF is server-only) */
+function isClientSideFile(content, filePath) {
+    if (/['"]use client['"]/.test(content))
+        return true;
+    // .tsx/.jsx in components dir without server indicators
+    if (/\/components\//.test(filePath) && !content.includes('express()') && !/['"]use server['"]/.test(content)) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Check surrounding context for SSRF mitigations
+ */
+function hasSSRFMitigation(lines, lineIndex, windowSize = 15) {
+    const start = Math.max(0, lineIndex - windowSize);
+    const end = Math.min(lines.length, lineIndex + windowSize + 1);
+    const context = lines.slice(start, end).join('\n');
+    // Allowlist validation
+    if (/(?:allowed|safe|valid|permitted)(?:Hosts|Domains|Urls|Origins)/i.test(context))
+        return true;
+    if (/allowList|allowlist|whitelist|whiteList/.test(context))
+        return true;
+    // URL validation with host/origin check
+    if (/new\s+URL\(/.test(context) && /\.(?:hostname|host|origin)/.test(context))
+        return true;
+    // IP range checking
+    if (/isPrivateIP|isPrivate|isInternal|isLocalhost/i.test(context))
+        return true;
+    if (/(?:127\.0\.0\.1|10\.\d|192\.168\.|169\.254\.)/.test(context) && /(?:block|reject|deny|forbidden)/i.test(context))
+        return true;
+    // Environment variable source
+    if (/process\.env\./i.test(context)) {
+        // Check if the URL comes from env var, not just any env var in context
+        const envLineCount = lines.slice(start, end).filter(l => /process\.env\./.test(l)).length;
+        const userInputCount = lines.slice(start, end).filter(l => USER_INPUT_PATTERN.test(l)).length;
+        if (envLineCount > 0 && userInputCount <= 1)
+            return false; // Don't suppress just because env vars exist
+    }
+    return false;
+}
+/**
+ * Detect SSRF patterns in server-side code
+ */
+function detectSSRFPatterns(content, filePath, options) {
+    const vulnerabilities = [];
+    if ((0, file_classifier_1.isScannerOrFixtureFile)(filePath))
+        return vulnerabilities;
+    if ((0, file_classifier_1.isTestOrMockFile)(filePath))
+        return vulnerabilities;
+    if (isClientSideFile(content, filePath))
+        return vulnerabilities;
+    const lines = options?.parsed?.lines ?? content.split('\n');
+    // ========== Pass 1: Direct taint — user input in HTTP sinks ==========
+    const DIRECT_SSRF_PATTERNS = [
+        // fetch(req.body.url), fetch(req.query.endpoint)
+        /(?:fetch|got|undici\.request)\s*\(\s*(?:req|request|ctx\.request)\.(?:body|query|params|headers)(?:\.\w+|\[)/,
+        // axios.get(req.body.url)
+        /axios\.(?:get|post|put|delete|patch|head|options|request)\s*\(\s*(?:req|request|ctx\.request)\.(?:body|query|params)/,
+        // http.get(req.body.url), https.get(...)
+        /https?\.(?:get|request)\s*\(\s*(?:req|request|ctx\.request)\.(?:body|query|params)/,
+        // got(req.body.url)
+        /got\s*\(\s*(?:req|request|ctx\.request)\.(?:body|query|params)/,
+        // Python: requests.get(request.args.get('url'))
+        /requests\.(?:get|post|put|delete|patch|head|options)\s*\(\s*(?:request\.(?:args|form|json|data)\.get|request\.(?:args|form|json|data)\[)/,
+        // Python: urllib.request.urlopen(request.args.get('url'))
+        /urllib\.request\.urlopen\s*\(\s*(?:request\.(?:args|form|json))/,
+    ];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if ((0, file_classifier_1.isComment)(line))
+            continue;
+        for (const pattern of DIRECT_SSRF_PATTERNS) {
+            if (pattern.test(line)) {
+                if (hasSSRFMitigation(lines, i))
+                    continue;
+                vulnerabilities.push({
+                    id: `ssrf-${filePath}-${i + 1}-direct`,
+                    filePath,
+                    lineNumber: i + 1,
+                    lineContent: line.trim(),
+                    severity: 'high',
+                    category: 'ssrf',
+                    title: 'SSRF: User input in HTTP request',
+                    description: 'User-controlled input flows directly to a server-side HTTP request. An attacker could force the server to make requests to internal services, cloud metadata endpoints (169.254.169.254), or other sensitive resources.',
+                    suggestedFix: 'Validate the URL against an allowlist of permitted domains. Block requests to private IP ranges and cloud metadata endpoints.',
+                    confidence: 'high',
+                    baseConfidence: BASE_CONFIDENCE,
+                    layer: 2,
+                    source: 'structural',
+                });
+                break;
+            }
+        }
+    }
+    // ========== Pass 2: Open redirect ==========
+    const OPEN_REDIRECT_PATTERNS = [
+        // res.redirect(req.query.next)
+        /res\.redirect\s*\(\s*(?:req|request)\.(?:body|query|params)(?:\.\w+|\[)/,
+        // redirect(req.query.returnTo)
+        /(?<!\w)redirect\s*\(\s*(?:req|request)\.(?:body|query|params)(?:\.\w+|\[)/,
+    ];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if ((0, file_classifier_1.isComment)(line))
+            continue;
+        for (const pattern of OPEN_REDIRECT_PATTERNS) {
+            if (pattern.test(line)) {
+                if (hasSSRFMitigation(lines, i))
+                    continue;
+                vulnerabilities.push({
+                    id: `ssrf-${filePath}-${i + 1}-redirect`,
+                    filePath,
+                    lineNumber: i + 1,
+                    lineContent: line.trim(),
+                    severity: 'high',
+                    category: 'ssrf',
+                    title: 'Open redirect: User input in redirect',
+                    description: 'User-controlled input is used in a server redirect. An attacker could craft a URL that redirects users to a malicious site for phishing.',
+                    suggestedFix: 'Validate redirect URLs against an allowlist of permitted paths or domains. Use relative paths instead of absolute URLs.',
+                    confidence: 'high',
+                    baseConfidence: BASE_CONFIDENCE,
+                    layer: 2,
+                    source: 'structural',
+                });
+                break;
+            }
+        }
+    }
+    // ========== Pass 3: Variable-mediated taint ==========
+    // Track: const url = req.body.url; ... fetch(url)
+    const taintedVars = new Map(); // varName -> lineIndex
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if ((0, file_classifier_1.isComment)(line))
+            continue;
+        // Detect taint sources: const/let/var url = req.body.url
+        const taintMatch = line.match(/(?:const|let|var)\s+(\w+)\s*=\s*(?:req|request|ctx\.request)\.(?:body|query|params|headers)(?:\.\w+|\[)/);
+        if (taintMatch) {
+            taintedVars.set(taintMatch[1], i);
+            continue;
+        }
+        // Also detect destructuring: const { url } = req.body
+        const destructMatch = line.match(/(?:const|let|var)\s*\{([^}]+)\}\s*=\s*(?:req|request|ctx\.request)\.(?:body|query|params)/);
+        if (destructMatch) {
+            const vars = destructMatch[1].split(',').map(v => v.trim().split(':')[0].trim());
+            for (const v of vars) {
+                if (v)
+                    taintedVars.set(v, i);
+            }
+            continue;
+        }
+        // Check if tainted variable flows to HTTP sink (within 20 lines)
+        if (taintedVars.size > 0) {
+            const httpSinkPattern = /(?:fetch|axios\.(?:get|post|put|delete|patch|request)|got|https?\.(?:get|request)|undici\.request)\s*\(/;
+            if (httpSinkPattern.test(line)) {
+                for (const [varName, sourceLineIdx] of taintedVars) {
+                    if (i - sourceLineIdx <= 20 && i - sourceLineIdx > 0) {
+                        // Check if the variable is used in this sink call
+                        const varPattern = new RegExp(`\\b${varName}\\b`);
+                        if (varPattern.test(line)) {
+                            if (hasSSRFMitigation(lines, i))
+                                continue;
+                            vulnerabilities.push({
+                                id: `ssrf-${filePath}-${i + 1}-mediated`,
+                                filePath,
+                                lineNumber: i + 1,
+                                lineContent: line.trim(),
+                                severity: 'medium',
+                                category: 'ssrf',
+                                title: 'SSRF: Variable-mediated user input in HTTP request',
+                                description: `User input assigned to variable '${varName}' (line ${sourceLineIdx + 1}) flows to an HTTP request sink. An attacker could control the request destination.`,
+                                suggestedFix: 'Validate the URL against an allowlist before making the request. Block private IP ranges.',
+                                confidence: 'medium',
+                                baseConfidence: BASE_CONFIDENCE,
+                                layer: 2,
+                                source: 'structural',
+                                requiresAIValidation: true,
+                            });
+                            break;
+                        }
+                    }
+                }
+            }
+            // Check for redirect sinks too
+            const redirectSinkPattern = /(?:res\.redirect|redirect)\s*\(/;
+            if (redirectSinkPattern.test(line)) {
+                for (const [varName, sourceLineIdx] of taintedVars) {
+                    if (i - sourceLineIdx <= 20 && i - sourceLineIdx > 0) {
+                        const varPattern = new RegExp(`\\b${varName}\\b`);
+                        if (varPattern.test(line)) {
+                            if (hasSSRFMitigation(lines, i))
+                                continue;
+                            vulnerabilities.push({
+                                id: `ssrf-${filePath}-${i + 1}-redirect-mediated`,
+                                filePath,
+                                lineNumber: i + 1,
+                                lineContent: line.trim(),
+                                severity: 'medium',
+                                category: 'ssrf',
+                                title: 'Open redirect: Variable-mediated user input',
+                                description: `User input assigned to variable '${varName}' (line ${sourceLineIdx + 1}) flows to a redirect call.`,
+                                suggestedFix: 'Validate redirect URL against an allowlist of permitted paths.',
+                                confidence: 'medium',
+                                baseConfidence: BASE_CONFIDENCE,
+                                layer: 2,
+                                source: 'structural',
+                                requiresAIValidation: true,
+                            });
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    // ========== Pass 4: Template literal with user input in URL ==========
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if ((0, file_classifier_1.isComment)(line))
+            continue;
+        // fetch(`${req.query.baseUrl}/api`) or fetch(`http://${req.body.host}/path`)
+        const templateSinkPattern = /(?:fetch|axios\.(?:get|post|put|delete|patch|request)|got|https?\.(?:get|request))\s*\(\s*`[^`]*\$\{[^}]*(?:req|request|ctx\.request)\.(?:body|query|params)[^}]*\}/;
+        if (templateSinkPattern.test(line)) {
+            // Avoid duplicate with direct taint
+            const alreadyFound = vulnerabilities.some(v => v.lineNumber === i + 1 && v.filePath === filePath);
+            if (alreadyFound)
+                continue;
+            if (hasSSRFMitigation(lines, i))
+                continue;
+            vulnerabilities.push({
+                id: `ssrf-${filePath}-${i + 1}-template`,
+                filePath,
+                lineNumber: i + 1,
+                lineContent: line.trim(),
+                severity: 'high',
+                category: 'ssrf',
+                title: 'SSRF: User input interpolated in HTTP request URL',
+                description: 'User-controlled request data is interpolated into an HTTP request URL via template literal. An attacker could manipulate the request destination.',
+                suggestedFix: 'Extract and validate the user input before constructing the URL. Use an allowlist of permitted domains.',
+                confidence: 'high',
+                baseConfidence: BASE_CONFIDENCE,
+                layer: 2,
+                source: 'structural',
+            });
+        }
+    }
+    return vulnerabilities;
+}
+//# sourceMappingURL=ssrf-detection.js.map

package/dist/detect/structural/ssrf-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-detection.js","sourceRoot":"","sources":["../../../src/detect/structural/ssrf-detection.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AA8DH,gDAuOC;AAjSD,iEAIoC;AAEpC,MAAM,eAAe,GAAG,IAAI,CAAA;AAM5B,iCAAiC;AACjC,MAAM,kBAAkB,GAAG,yEAAyE,CAAA;AAEpG,yDAAyD;AACzD,SAAS,gBAAgB,CAAC,OAAe,EAAE,QAAgB;IACzD,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,wDAAwD;IACxD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7G,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,KAAe,EAAE,SAAiB,EAAE,aAAqB,EAAE;IACpF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,CAAC,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAElD,uBAAuB;IACvB,IAAI,iEAAiE,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAChG,IAAI,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAExE,wCAAwC;IACxC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1F,oBAAoB;IACpB,IAAI,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9E,IAAI,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAElI,8BAA8B;IAC9B,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,uEAAuE;QACvE,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACzF,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC7F,IAAI,YAAY,GAAG,CAAC,IAAI,cAAc,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA,CAAC,6CAA6C;IACzG,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAChC,OAAe,EACf,QAAgB,EAChB,OAAqB;IAErB,MAAM,eAAe,GAAoB,EAAE,CAAA;IAE3C,IAAI,IAAA,wCAAsB,EAAC,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAA;IAC5D,IAAI,IAAA,kCAAgB,EAAC,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAA;IACtD,IAAI,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAA;IAE/D,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAE3D,wEAAwE;IACxE,MAAM,oBAAoB,GAAG;QAC3B,iDAAiD;QACjD,8GAA8G;QAC9G,0BAA0B;QAC1B,sHAAsH;QACtH,yCAAyC;QACzC,oFAAoF;QACpF,oBAAoB;QACpB,gEAAgE;QAChE,gDAAgD;QAChD,0IAA0I;QAC1I,0DAA0D;QAC1D,iEAAiE;KAClE,CAAA;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,IAAA,2BAAS,EAAC,IAAI,CAAC;YAAE,SAAQ;QAE7B,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC;oBAAE,SAAQ;gBAEzC,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE,EAAE,QAAQ,QAAQ,IAAI,CAAC,GAAG,CAAC,SAAS;oBACtC,QAAQ;oBACR,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;oBACxB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,kCAAkC;oBACzC,WAAW,EACT,yNAAyN;oBAC3N,YAAY,EACV,+HAA+H;oBACjI,UAAU,EAAE,MAAM;oBAClB,cAAc,EAAE,eAAe;oBAC/B,KAAK,EAAE,CAAC;oBACV,MAAM,EAAE,YAAqB;iBAC5B,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,sBAAsB,GAAG;QAC7B,+BAA+B;QAC/B,yEAAyE;QACzE,+BAA+B;QAC/B,2EAA2E;KAC5E,CAAA;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,IAAA,2BAAS,EAAC,IAAI,CAAC;YAAE,SAAQ;QAE7B,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC;oBAAE,SAAQ;gBAEzC,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE,EAAE,QAAQ,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW;oBACxC,QAAQ;oBACR,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;oBACxB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,uCAAuC;oBAC9C,WAAW,EACT,0IAA0I;oBAC5I,YAAY,EACV,yHAAyH;oBAC3H,UAAU,EAAE,MAAM;oBAClB,cAAc,EAAE,eAAe;oBAC/B,KAAK,EAAE,CAAC;oBACV,MAAM,EAAE,YAAqB;iBAC5B,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,kDAAkD;IAClD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA,CAAC,uBAAuB;IAErE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,IAAA,2BAAS,EAAC,IAAI,CAAC;YAAE,SAAQ;QAE7B,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAC3B,yGAAyG,CAC1G,CAAA;QACD,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACjC,SAAQ;QACV,CAAC;QAED,sDAAsD;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAC9B,2FAA2F,CAC5F,CAAA;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAChF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC;oBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9B,CAAC;YACD,SAAQ;QACV,CAAC;QAED,iEAAiE;QACjE,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,eAAe,GAAG,yGAAyG,CAAA;YACjI,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,KAAK,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC;oBACnD,IAAI,CAAC,GAAG,aAAa,IAAI,EAAE,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;wBACrD,kDAAkD;wBAClD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,MAAM,OAAO,KAAK,CAAC,CAAA;wBACjD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC1B,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC;gCAAE,SAAQ;4BAEzC,eAAe,CAAC,IAAI,CAAC;gCACnB,EAAE,EAAE,QAAQ,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW;gCACxC,QAAQ;gCACR,UAAU,EAAE,CAAC,GAAG,CAAC;gCACjB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;gCACxB,QAAQ,EAAE,QAAQ;gCAClB,QAAQ,EAAE,MAAM;gCAChB,KAAK,EAAE,oDAAoD;gCAC3D,WAAW,EACT,oCAAoC,OAAO,WAAW,aAAa,GAAG,CAAC,qFAAqF;gCAC9J,YAAY,EACV,2FAA2F;gCAC7F,UAAU,EAAE,QAAQ;gCACpB,cAAc,EAAE,eAAe;gCAC/B,KAAK,EAAE,CAAC;gCAChB,MAAM,EAAE,YAAqB;gCACrB,oBAAoB,EAAE,IAAI;6BAC3B,CAAC,CAAA;4BACF,MAAK;wBACP,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+BAA+B;YAC/B,MAAM,mBAAmB,GAAG,iCAAiC,CAAA;YAC7D,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,KAAK,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC;oBACnD,IAAI,CAAC,GAAG,aAAa,IAAI,EAAE,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;wBACrD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,MAAM,OAAO,KAAK,CAAC,CAAA;wBACjD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC1B,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC;gCAAE,SAAQ;4BAEzC,eAAe,CAAC,IAAI,CAAC;gCACnB,EAAE,EAAE,QAAQ,QAAQ,IAAI,CAAC,GAAG,CAAC,oBAAoB;gCACjD,QAAQ;gCACR,UAAU,EAAE,CAAC,GAAG,CAAC;gCACjB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;gCACxB,QAAQ,EAAE,QAAQ;gCAClB,QAAQ,EAAE,MAAM;gCAChB,KAAK,EAAE,6CAA6C;gCACpD,WAAW,EACT,oCAAoC,OAAO,WAAW,aAAa,GAAG,CAAC,6BAA6B;gCACtG,YAAY,EAAE,gEAAgE;gCAC9E,UAAU,EAAE,QAAQ;gCACpB,cAAc,EAAE,eAAe;gCAC/B,KAAK,EAAE,CAAC;gCAChB,MAAM,EAAE,YAAqB;gCACrB,oBAAoB,EAAE,IAAI;6BAC3B,CAAC,CAAA;4BACF,MAAK;wBACP,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,IAAA,2BAAS,EAAC,IAAI,CAAC;YAAE,SAAQ;QAE7B,6EAA6E;QAC7E,MAAM,mBAAmB,GAAG,qKAAqK,CAAA;QACjM,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,oCAAoC;YACpC,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CACvD,CAAA;YACD,IAAI,YAAY;gBAAE,SAAQ;YAC1B,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC;gBAAE,SAAQ;YAEzC,eAAe,CAAC,IAAI,CAAC;gBACnB,EAAE,EAAE,QAAQ,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW;gBACxC,QAAQ;gBACR,UAAU,EAAE,CAAC,GAAG,CAAC;gBACjB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;gBACxB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,mDAAmD;gBAC1D,WAAW,EACT,mJAAmJ;gBACrJ,YAAY,EACV,yGAAyG;gBAC3G,UAAU,EAAE,MAAM;gBAClB,cAAc,EAAE,eAAe;gBAC/B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,YAAqB;aAC9B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/detect/structural/variables.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Layer 2: Variable Heuristics
+ * Identifies variable names associated with sensitive data
+ */
+import type { Vulnerability, SensitiveVariablePattern } from '../../shared/types';
+import type { ParsedFile } from '../../shared/parsed-file';
+export declare const SENSITIVE_VARIABLE_PATTERNS: SensitiveVariablePattern[];
+export declare function detectSensitiveVariables(content: string, filePath: string, options?: {
+    parsed?: ParsedFile;
+}): Vulnerability[];
+//# sourceMappingURL=variables.d.ts.map

package/dist/detect/structural/variables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../../../src/detect/structural/variables.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAM1D,eAAO,MAAM,2BAA2B,EAAE,wBAAwB,EA0DjE,CAAA;AAqDD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,GAChC,aAAa,EAAE,CAiDjB"}

package/dist/detect/structural/variables.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * Layer 2: Variable Heuristics
+ * Identifies variable names associated with sensitive data
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_VARIABLE_PATTERNS = void 0;
+exports.detectSensitiveVariables = detectSensitiveVariables;
+const file_classifier_1 = require("../../parse/file-classifier");
+const BASE_CONFIDENCE = 0.20;
+// Patterns for sensitive variable names
+exports.SENSITIVE_VARIABLE_PATTERNS = [
+    // Password-related
+    {
+        pattern: /\b(password|passwd|pwd|pass)\s*[=:]/gi,
+        severity: 'high',
+        description: 'Variable name suggests password storage',
+    },
+    {
+        pattern: /\b(user_?password|admin_?password|db_?password|database_?password)\s*[=:]/gi,
+        severity: 'critical',
+        description: 'Variable name suggests database/admin password',
+    },
+    // Token-related
+    {
+        pattern: /\b(auth_?token|access_?token|refresh_?token|bearer_?token)\s*[=:]/gi,
+        severity: 'high',
+        description: 'Variable name suggests authentication token',
+    },
+    {
+        pattern: /\b(api_?token|api_?key|apikey)\s*[=:]/gi,
+        severity: 'high',
+        description: 'Variable name suggests API key/token',
+    },
+    // Secret-related
+    {
+        pattern: /\b(secret|secret_?key|private_?key|signing_?key)\s*[=:]/gi,
+        severity: 'high',
+        description: 'Variable name suggests secret/private key',
+    },
+    {
+        pattern: /\b(client_?secret|app_?secret|jwt_?secret)\s*[=:]/gi,
+        severity: 'critical',
+        description: 'Variable name suggests application secret',
+    },
+    // Credential-related
+    {
+        pattern: /\b(credential|credentials|creds)\s*[=:]/gi,
+        severity: 'high',
+        description: 'Variable name suggests credentials',
+    },
+    // Connection strings
+    {
+        pattern: /\b(connection_?string|conn_?string|database_?url|db_?url)\s*[=:]/gi,
+        severity: 'high',
+        description: 'Variable name suggests database connection string',
+    },
+    // Encryption keys
+    {
+        pattern: /\b(encryption_?key|decrypt_?key|cipher_?key|aes_?key)\s*[=:]/gi,
+        severity: 'critical',
+        description: 'Variable name suggests encryption key',
+    },
+    // SSH/Certificate
+    {
+        pattern: /\b(ssh_?key|private_?key|cert_?key|ssl_?key)\s*[=:]/gi,
+        severity: 'critical',
+        description: 'Variable name suggests SSH/SSL key',
+    },
+];
+// Check if the value looks like a placeholder or env var reference
+function isPlaceholderOrEnvRef(line) {
+    const safePatterns = [
+        /[=:]\s*['"]?\s*$/, // Empty value
+        /[=:]\s*['"]?xxx/i, // xxx placeholder
+        /[=:]\s*['"]?your[-_]/i, // your-xxx placeholder
+        /[=:]\s*['"]?<[^>]+>/, // <placeholder>
+        /[=:]\s*['"]?\$\{/, // ${VAR} template
+        /[=:]\s*['"]?process\.env/, // process.env reference
+        /[=:]\s*['"]?env\(/, // env() function
+        /[=:]\s*['"]?getenv/i, // getenv function
+        /[=:]\s*['"]?os\.environ/, // Python os.environ
+        /[=:]\s*['"]?ENV\[/, // Ruby ENV
+        /[=:]\s*null\b/i, // null value
+        /[=:]\s*undefined\b/, // undefined value
+        /[=:]\s*None\b/, // Python None
+        /[=:]\s*['"]?TODO/i, // TODO placeholder
+        /[=:]\s*['"]?CHANGEME/i, // CHANGEME placeholder
+        /[=:]\s*['"]?REPLACE/i, // REPLACE placeholder
+        /\?\s*.*\s*:\s*/, // Ternary operator (conditional assignment)
+        /\|\|/, // OR fallback (e.g., ENV_VAR || '')
+        /\?\?/, // Nullish coalescing
+        /[A-Z_]{3,}_(?:KEY|TOKEN|SECRET)/, // References to env var constants
+    ];
+    return safePatterns.some(pattern => pattern.test(line));
+}
+// Check if line is a comment
+function isComment(line) {
+    const trimmed = line.trim();
+    return (trimmed.startsWith('//') ||
+        trimmed.startsWith('#') ||
+        trimmed.startsWith('*') ||
+        trimmed.startsWith('/*') ||
+        trimmed.startsWith('"""') ||
+        trimmed.startsWith("'''") ||
+        trimmed.startsWith('<!--'));
+}
+// Check if it's a type definition or interface
+function isTypeDefinition(line) {
+    return (/^\s*(type|interface|class)\s/.test(line) ||
+        /:\s*(string|number|boolean|any)\s*[;,}]/.test(line) ||
+        /\?\s*:\s*\w+/.test(line));
+}
+function detectSensitiveVariables(content, filePath, options) {
+    const vulnerabilities = [];
+    // Skip scanner/fixture files to avoid self-detection
+    if ((0, file_classifier_1.isScannerOrFixtureFile)(filePath))
+        return vulnerabilities;
+    const lines = options?.parsed?.lines ?? content.split('\n');
+    lines.forEach((line, index) => {
+        // Skip comments
+        if (isComment(line))
+            return;
+        // Skip type definitions
+        if (isTypeDefinition(line))
+            return;
+        // Skip if it's a placeholder/env reference
+        if (isPlaceholderOrEnvRef(line))
+            return;
+        for (const pattern of exports.SENSITIVE_VARIABLE_PATTERNS) {
+            const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
+            if (regex.test(line)) {
+                // Extract the actual value to check if it's hardcoded
+                const valueMatch = line.match(/[=:]\s*['"]([^'"]+)['"]/i);
+                if (valueMatch && valueMatch[1].length > 3) {
+                    // Has a non-trivial hardcoded value
+                    vulnerabilities.push({
+                        id: `var-${filePath}-${index + 1}`,
+                        filePath,
+                        lineNumber: index + 1,
+                        lineContent: line.trim(),
+                        severity: pattern.severity,
+                        category: 'sensitive_variable',
+                        title: 'Sensitive variable with hardcoded value',
+                        description: pattern.description + '. The value appears to be hardcoded rather than loaded from environment.',
+                        suggestedFix: 'Move this sensitive value to an environment variable or secure secrets manager.',
+                        confidence: 'medium',
+                        baseConfidence: BASE_CONFIDENCE,
+                        layer: 2,
+                        source: 'structural',
+                    });
+                }
+                break; // Only report once per line
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=variables.js.map

package/dist/detect/structural/variables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"variables.js","sourceRoot":"","sources":["../../../src/detect/structural/variables.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAwHH,4DAqDC;AAzKD,iEAAoE;AAEpE,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B,wCAAwC;AAC3B,QAAA,2BAA2B,GAA+B;IACrE,mBAAmB;IACnB;QACE,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,yCAAyC;KACvD;IACD;QACE,OAAO,EAAE,6EAA6E;QACtF,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gDAAgD;KAC9D;IACD,gBAAgB;IAChB;QACE,OAAO,EAAE,qEAAqE;QAC9E,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,OAAO,EAAE,yCAAyC;QAClD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,sCAAsC;KACpD;IACD,iBAAiB;IACjB;QACE,OAAO,EAAE,2DAA2D;QACpE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2CAA2C;KACzD;IACD,qBAAqB;IACrB;QACE,OAAO,EAAE,2CAA2C;QACpD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oCAAoC;KAClD;IACD,qBAAqB;IACrB;QACE,OAAO,EAAE,oEAAoE;QAC7E,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mDAAmD;KACjE;IACD,kBAAkB;IAClB;QACE,OAAO,EAAE,gEAAgE;QACzE,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,uCAAuC;KACrD;IACD,kBAAkB;IAClB;QACE,OAAO,EAAE,uDAAuD;QAChE,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,oCAAoC;KAClD;CACF,CAAA;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,YAAY,GAAG;QACnB,kBAAkB,EAAqB,cAAc;QACrD,kBAAkB,EAAqB,kBAAkB;QACzD,uBAAuB,EAAgB,uBAAuB;QAC9D,qBAAqB,EAAkB,gBAAgB;QACvD,kBAAkB,EAAqB,kBAAkB;QACzD,0BAA0B,EAAa,wBAAwB;QAC/D,mBAAmB,EAAoB,iBAAiB;QACxD,qBAAqB,EAAkB,kBAAkB;QACzD,yBAAyB,EAAc,oBAAoB;QAC3D,mBAAmB,EAAoB,WAAW;QAClD,gBAAgB,EAAuB,aAAa;QACpD,oBAAoB,EAAmB,kBAAkB;QACzD,eAAe,EAAwB,cAAc;QACrD,mBAAmB,EAAoB,mBAAmB;QAC1D,uBAAuB,EAAgB,uBAAuB;QAC9D,sBAAsB,EAAiB,sBAAsB;QAC7D,gBAAgB,EAAuB,4CAA4C;QACnF,MAAM,EAAiC,oCAAoC;QAC3E,MAAM,EAAiC,qBAAqB;QAC5D,iCAAiC,EAAM,kCAAkC;KAC1E,CAAA;IAED,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,6BAA6B;AAC7B,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QACzB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QACzB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAC3B,CAAA;AACH,CAAC;AAED,+CAA+C;AAC/C,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,CACL,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;QACzC,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1B,CAAA;AACH,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAe,EACf,QAAgB,EAChB,OAAiC;IAEjC,MAAM,eAAe,GAAoB,EAAE,CAAA;IAE3C,qDAAqD;IACrD,IAAI,IAAA,wCAAsB,EAAC,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAA;IAE5D,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAE3D,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,gBAAgB;QAChB,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAM;QAE3B,wBAAwB;QACxB,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,OAAM;QAElC,2CAA2C;QAC3C,IAAI,qBAAqB,CAAC,IAAI,CAAC;YAAE,OAAM;QAEvC,KAAK,MAAM,OAAO,IAAI,mCAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAEvE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,sDAAsD;gBACtD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBAEzD,IAAI,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3C,oCAAoC;oBACpC,eAAe,CAAC,IAAI,CAAC;wBACnB,EAAE,EAAE,OAAO,QAAQ,IAAI,KAAK,GAAG,CAAC,EAAE;wBAClC,QAAQ;wBACR,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;wBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,QAAQ,EAAE,oBAAoB;wBAC9B,KAAK,EAAE,yCAAyC;wBAChD,WAAW,EAAE,OAAO,CAAC,WAAW,GAAG,0EAA0E;wBAC7G,YAAY,EAAE,iFAAiF;wBAC/F,UAAU,EAAE,QAAQ;wBACpB,cAAc,EAAE,eAAe;wBAC/B,KAAK,EAAE,CAAC;wBACZ,MAAM,EAAE,YAAqB;qBAC1B,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAK,CAAC,4BAA4B;YACpC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/detect/structural/xxe-detection.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Layer 2: XXE (XML External Entity) Detector
+ * Detects XML parsing without entity expansion protection
+ *
+ * OWASP A02:2021 - Cryptographic Failures (was A04 in 2017)
+ * CWE-611: Improper Restriction of XML External Entity Reference
+ */
+import type { Vulnerability } from '../../shared/types';
+import type { ParsedFile } from '../../shared/parsed-file';
+interface XXEOptions {
+    parsed?: ParsedFile;
+}
+/**
+ * Detect XXE patterns in code
+ */
+export declare function detectXXEPatterns(content: string, filePath: string, options?: XXEOptions): Vulnerability[];
+export {};
+//# sourceMappingURL=xxe-detection.d.ts.map

package/dist/detect/structural/xxe-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xxe-detection.d.ts","sourceRoot":"","sources":["../../../src/detect/structural/xxe-detection.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAA;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAS1D,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB;AA8LD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,UAAU,GACnB,aAAa,EAAE,CAwDjB"}