@oculum/scanner 1.0.11 → 1.0.13

package/dist/model/sink-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-matcher.js","sourceRoot":"","sources":["../../src/model/sink-matcher.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAoGH,gCAuEC;AAvKD,+DAAuD;AACvD,mDAA4D;AAE5D,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;GAEG;AACH,SAAS,uBAAuB,CAC9B,IAAY,EACZ,WAA8B;IAE9B,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAA,2BAAW,EAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,MAAuB,EACvB,OAA0B;IAE1B,MAAM,KAAK,GAAsB,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,OAAO,GAAG,MAAM,CAAA;IACpB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzB,0CAA0C;IAC1C,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACjC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ;YAClC,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS;YAC/B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CACrB,CAAA;QACD,IAAI,CAAC,SAAS;YAAE,MAAK;QACrB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC3B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACxB,OAAO,GAAG,SAAS,CAAA;IACrB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,KAAwB,EACxB,gBAA2C;IAE3C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAA;IAE7B,IAAI,gBAAgB,KAAK,MAAM,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,MAAM,CAAA;IAC/D,IAAI,gBAAgB,KAAK,KAAK,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,yBAAyB,CAAC,IAAY,EAAE,OAAe;IAC9D,oEAAoE;IACpE,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,yCAAyC,IAAA,2BAAW,EAAC,OAAO,CAAC,eAAe,CAC7E,CAAA;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAE7C,0DAA0D;IAC1D,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,gDAAgD,IAAA,2BAAW,EAAC,OAAO,CAAC,KAAK,CAC1E,CAAA;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAE5C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,UAAU,CACxB,OAAe,EACf,SAAiB,EACjB,gBAAmC,EACnC,UAA2B;IAE3B,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAE5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,UAAU,GAAgB,EAAE,CAAA;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAE9B,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IAEtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAE3B,gBAAgB;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpF,SAAQ;QACV,CAAC;QAED,0BAA0B;QAC1B,KAAK,MAAM,EAAE,IAAI,6BAAa,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAEpC,qDAAqD;YACrD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;YACnE,IAAI,CAAC,UAAU;gBAAE,SAAQ;YAEzB,yDAAyD;YACzD,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAA;YACxE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEb,iBAAiB;YACjB,MAAM,IAAI,GAAc;gBACtB,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ;aACtB,CAAA;YAED,+CAA+C;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;YAEtD,6CAA6C;YAC7C,MAAM,eAAe,GAAG,IAAA,qCAAe,EAAC,IAAI,EAAE,UAAU,CAAC,CAAA;YACzD,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAA;YAErE,0CAA0C;YAC1C,MAAM,YAAY,GAAG,EAAE,CAAC,QAAQ,KAAK,WAAW,IAAI,yBAAyB,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;YAEpG,MAAM,SAAS,GAAG,WAAW,IAAI,YAAY,CAAA;YAE7C,qBAAqB;YACrB,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YAE7E,UAAU,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,KAAK;gBACL,IAAI;gBACJ,SAAS;gBACT,UAAU;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/model/sink-patterns.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Shared Sink Patterns — Canonical list of dangerous sink patterns.
+ *
+ * Single source of truth for sink detection patterns used by:
+ * - sink-matcher.ts (intra-file taint path matching)
+ * - function-classifier.ts (exported function profiling)
+ * - cross-file-taint.ts (cross-file taint analysis)
+ */
+import type { SinkType } from './taint-types';
+export interface SinkPattern {
+    pattern: RegExp;
+    sinkType: SinkType;
+}
+export declare const SINK_PATTERNS: SinkPattern[];
+/**
+ * Escape special regex characters in a string for use in RegExp constructors.
+ */
+export declare function escapeRegex(str: string): string;
+//# sourceMappingURL=sink-patterns.d.ts.map

package/dist/model/sink-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-patterns.d.ts","sourceRoot":"","sources":["../../src/model/sink-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAM7C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAMD,eAAO,MAAM,aAAa,EAAE,WAAW,EAyEtC,CAAA;AAMD;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C"}

package/dist/model/sink-patterns.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * Shared Sink Patterns — Canonical list of dangerous sink patterns.
+ *
+ * Single source of truth for sink detection patterns used by:
+ * - sink-matcher.ts (intra-file taint path matching)
+ * - function-classifier.ts (exported function profiling)
+ * - cross-file-taint.ts (cross-file taint analysis)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SINK_PATTERNS = void 0;
+exports.escapeRegex = escapeRegex;
+// ============================================================================
+// Canonical Sink Patterns
+// ============================================================================
+exports.SINK_PATTERNS = [
+    // SQL injection
+    { pattern: /\.query\s*\(/, sinkType: 'sql_query' },
+    { pattern: /\.raw\s*\(/, sinkType: 'sql_query' },
+    { pattern: /\.execute\s*\(/, sinkType: 'sql_query' },
+    { pattern: /\bsequelize\.query\s*\(/, sinkType: 'sql_query' },
+    { pattern: /\bknex\.raw\s*\(/, sinkType: 'sql_query' },
+    { pattern: /\bcursor\.execute\s*\(/, sinkType: 'sql_query' },
+    // Code execution
+    { pattern: /\beval\s*\(/, sinkType: 'eval' },
+    { pattern: /new\s+Function\s*\(/, sinkType: 'eval' },
+    // Command execution (Node.js)
+    { pattern: /\bexec\s*\(/, sinkType: 'exec' },
+    { pattern: /\bexecSync\s*\(/, sinkType: 'exec' },
+    { pattern: /\bspawn\s*\(/, sinkType: 'exec' },
+    { pattern: /\bchild_process\./, sinkType: 'exec' },
+    // Command execution (Python)
+    { pattern: /\bsubprocess\.run\s*\(/, sinkType: 'command_exec' },
+    { pattern: /\bsubprocess\.call\s*\(/, sinkType: 'command_exec' },
+    { pattern: /\bsubprocess\.Popen\s*\(/, sinkType: 'command_exec' },
+    { pattern: /\bos\.system\s*\(/, sinkType: 'command_exec' },
+    { pattern: /\bos\.popen\s*\(/, sinkType: 'command_exec' },
+    // XSS / DOM injection
+    { pattern: /\.innerHTML\s*=/, sinkType: 'inner_html' },
+    { pattern: /\bdangerouslySetInnerHTML\b/, sinkType: 'inner_html' },
+    { pattern: /\bdocument\.write\s*\(/, sinkType: 'inner_html' },
+    // HTTP requests (SSRF)
+    { pattern: /\bfetch\s*\(/, sinkType: 'http_request' },
+    { pattern: /\baxios\.\w+\s*\(/, sinkType: 'http_request' },
+    { pattern: /\bgot\s*\(/, sinkType: 'http_request' },
+    { pattern: /\bhttp\.request\s*\(/, sinkType: 'http_request' },
+    { pattern: /\bhttps\.request\s*\(/, sinkType: 'http_request' },
+    { pattern: /\brequests\.\w+\s*\(/, sinkType: 'http_request' },
+    // Redirects
+    { pattern: /\bres\.redirect\s*\(/, sinkType: 'redirect' },
+    { pattern: /\bResponse\.redirect\s*\(/, sinkType: 'redirect' },
+    { pattern: /\blocation\.href\s*=/, sinkType: 'redirect' },
+    { pattern: /\bwindow\.location\s*=/, sinkType: 'redirect' },
+    // File system
+    { pattern: /\bfs\.writeFile\b/, sinkType: 'file_write' },
+    { pattern: /\bfs\.writeFileSync\b/, sinkType: 'file_write' },
+    { pattern: /\bcreateWriteStream\s*\(/, sinkType: 'file_write' },
+    { pattern: /\bfs\.readFile\b/, sinkType: 'path_access' },
+    { pattern: /\bfs\.readFileSync\b/, sinkType: 'path_access' },
+    { pattern: /\bpath\.join\s*\(/, sinkType: 'path_access' },
+    { pattern: /\bpath\.resolve\s*\(/, sinkType: 'path_access' },
+    // Template rendering
+    { pattern: /\bpug\.compile\s*\(/, sinkType: 'template_render' },
+    { pattern: /\bejs\.render\s*\(/, sinkType: 'template_render' },
+    { pattern: /\bhandlebars\.compile\s*\(/, sinkType: 'template_render' },
+    // Regex construction (ReDoS)
+    { pattern: /new\s+RegExp\s*\(/, sinkType: 'regex_constructor' },
+    { pattern: /\bre\.compile\s*\(/, sinkType: 'regex_constructor' },
+    // Dynamic imports
+    { pattern: /\bimport\s*\(/, sinkType: 'dynamic_import' },
+    { pattern: /\brequire\s*\(/, sinkType: 'dynamic_import' },
+    // Deserialization
+    { pattern: /\bJSON\.parse\s*\(/, sinkType: 'deserialization' },
+    { pattern: /\bpickle\.load\s*\(/, sinkType: 'deserialization' },
+    { pattern: /\bpickle\.loads\s*\(/, sinkType: 'deserialization' },
+    { pattern: /\byaml\.load\s*\(/, sinkType: 'deserialization' },
+    { pattern: /\byaml\.unsafe_load\s*\(/, sinkType: 'deserialization' },
+];
+// ============================================================================
+// Shared Utilities
+// ============================================================================
+/**
+ * Escape special regex characters in a string for use in RegExp constructors.
+ */
+function escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=sink-patterns.js.map

package/dist/model/sink-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-patterns.js","sourceRoot":"","sources":["../../src/model/sink-patterns.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAmGH,kCAEC;AAxFD,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAElE,QAAA,aAAa,GAAkB;IAC1C,gBAAgB;IAChB,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE;IAClD,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE;IAChD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE;IACpD,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,WAAW,EAAE;IAC7D,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE;IACtD,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,WAAW,EAAE;IAE5D,iBAAiB;IACjB,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC5C,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAEpD,8BAA8B;IAC9B,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC5C,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAChD,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAElD,6BAA6B;IAC7B,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,cAAc,EAAE;IAC/D,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,cAAc,EAAE;IAChE,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,cAAc,EAAE;IACjE,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE;IAC1D,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAE;IAEzD,sBAAsB;IACtB,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE;IACtD,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,YAAY,EAAE;IAClE,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAE7D,uBAAuB;IACvB,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE;IACrD,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE;IAC1D,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE;IACnD,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,cAAc,EAAE;IAC7D,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,cAAc,EAAE;IAC9D,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,cAAc,EAAE;IAE7D,YAAY;IACZ,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,EAAE;IACzD,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,UAAU,EAAE;IAC9D,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,EAAE;IACzD,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,UAAU,EAAE;IAE3D,cAAc;IACd,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE;IACxD,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC5D,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC/D,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,aAAa,EAAE;IACxD,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,aAAa,EAAE;IAC5D,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,aAAa,EAAE;IACzD,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,aAAa,EAAE;IAE5D,qBAAqB;IACrB,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,iBAAiB,EAAE;IAC/D,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,iBAAiB,EAAE;IAC9D,EAAE,OAAO,EAAE,4BAA4B,EAAE,QAAQ,EAAE,iBAAiB,EAAE;IAEtE,6BAA6B;IAC7B,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,EAAE;IAC/D,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,mBAAmB,EAAE;IAEhE,kBAAkB;IAClB,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACxD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IAEzD,kBAAkB;IAClB,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,iBAAiB,EAAE;IAC9D,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,iBAAiB,EAAE;IAC/D,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,iBAAiB,EAAE;IAChE,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,iBAAiB,EAAE;IAC7D,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,iBAAiB,EAAE;CACrE,CAAA;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC"}

package/dist/model/source-discovery.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Source Discovery — Identifies user-input sources in code files.
+ *
+ * Scans for framework-specific patterns (Express, Next.js, Flask, Django, etc.)
+ * that represent user-controllable input entering the application.
+ */
+import type { UserInputSource } from './taint-types';
+/**
+ * Discover user-input sources in a file.
+ *
+ * Scans each line for framework-specific input patterns and extracts
+ * the variable names that receive user-controlled data.
+ */
+export declare function discoverSources(content: string, filePath: string): UserInputSource[];
+//# sourceMappingURL=source-discovery.d.ts.map

package/dist/model/source-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-discovery.d.ts","sourceRoot":"","sources":["../../src/model/source-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAuB,MAAM,eAAe,CAAA;AAwIzE;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,EAAE,CA2DpF"}

package/dist/model/source-discovery.js

@@ -0,0 +1,170 @@
+"use strict";
+/**
+ * Source Discovery — Identifies user-input sources in code files.
+ *
+ * Scans for framework-specific patterns (Express, Next.js, Flask, Django, etc.)
+ * that represent user-controllable input entering the application.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.discoverSources = discoverSources;
+const SOURCE_PATTERNS = [
+    // --- Express/Node.js ---
+    { pattern: /\breq\.body\b/, sourceType: 'http_body', framework: 'express', confidence: 'high' },
+    { pattern: /\breq\.query\b/, sourceType: 'http_query', framework: 'express', confidence: 'high' },
+    { pattern: /\breq\.params\b/, sourceType: 'http_params', framework: 'express', confidence: 'high' },
+    { pattern: /\breq\.headers\b/, sourceType: 'http_headers', framework: 'express', confidence: 'high' },
+    { pattern: /\breq\.cookies\b/, sourceType: 'http_headers', framework: 'express', confidence: 'high' },
+    // --- Koa ---
+    { pattern: /\bctx\.request\.body\b/, sourceType: 'http_body', framework: 'koa', confidence: 'high' },
+    { pattern: /\bctx\.query\b/, sourceType: 'http_query', framework: 'koa', confidence: 'high' },
+    // --- Next.js App Router ---
+    { pattern: /\bsearchParams\b/, sourceType: 'http_query', framework: 'nextjs', confidence: 'medium' },
+    { pattern: /\bformData\b/, sourceType: 'form_data', framework: 'nextjs', confidence: 'medium' },
+    // --- Browser APIs ---
+    { pattern: /\bdocument\.location\b/, sourceType: 'url_search_params', framework: 'browser', confidence: 'medium' },
+    { pattern: /\bwindow\.location\b/, sourceType: 'url_search_params', framework: 'browser', confidence: 'medium' },
+    { pattern: /\blocation\.search\b/, sourceType: 'url_search_params', framework: 'browser', confidence: 'medium' },
+    { pattern: /\blocation\.hash\b/, sourceType: 'url_search_params', framework: 'browser', confidence: 'medium' },
+    { pattern: /new\s+URLSearchParams\b/, sourceType: 'url_search_params', framework: 'browser', confidence: 'medium' },
+    { pattern: /\bdocument\.cookie\b/, sourceType: 'http_headers', framework: 'browser', confidence: 'medium' },
+    { pattern: /\bevent\.target\.value\b/, sourceType: 'form_data', framework: 'browser', confidence: 'medium' },
+    // --- WebSocket ---
+    { pattern: /\bws\.on\s*\(\s*['"]message['"]/, sourceType: 'websocket_message', framework: 'websocket', confidence: 'medium' },
+    { pattern: /\bsocket\.on\s*\(\s*['"]message['"]/, sourceType: 'websocket_message', framework: 'websocket', confidence: 'medium' },
+    // --- AWS Lambda ---
+    { pattern: /\bevent\.body\b/, sourceType: 'http_body', framework: 'aws-lambda', confidence: 'high' },
+    { pattern: /\bevent\.queryStringParameters\b/, sourceType: 'http_query', framework: 'aws-lambda', confidence: 'high' },
+    // --- Python Flask ---
+    { pattern: /\brequest\.args\b/, sourceType: 'http_query', framework: 'flask', confidence: 'high' },
+    { pattern: /\brequest\.form\b/, sourceType: 'form_data', framework: 'flask', confidence: 'high' },
+    { pattern: /\brequest\.json\b/, sourceType: 'http_body', framework: 'flask', confidence: 'high' },
+    { pattern: /\brequest\.data\b/, sourceType: 'http_body', framework: 'flask', confidence: 'high' },
+    // --- Python Django ---
+    { pattern: /\brequest\.GET\b/, sourceType: 'http_query', framework: 'django', confidence: 'high' },
+    { pattern: /\brequest\.POST\b/, sourceType: 'form_data', framework: 'django', confidence: 'high' },
+    { pattern: /\brequest\.body\b/, sourceType: 'http_body', framework: 'django', confidence: 'high' },
+    // --- CLI ---
+    { pattern: /\bprocess\.argv\b/, sourceType: 'cli_args', framework: 'node', confidence: 'low' },
+    { pattern: /\bsys\.argv\b/, sourceType: 'cli_args', framework: 'python', confidence: 'low' },
+    { pattern: /\binput\s*\(/, sourceType: 'cli_args', framework: 'python', confidence: 'low' },
+];
+// ============================================================================
+// Variable Extraction
+// ============================================================================
+/** Pattern for direct assignment: const/let/var NAME = ... */
+const DIRECT_ASSIGNMENT = /\b(?:const|let|var)\s+(\w+)\s*=\s*(.+)/;
+/** Pattern for destructuring: const/let/var { A, B } = ... */
+const DESTRUCTURE_ASSIGNMENT = /\b(?:const|let|var)\s+\{\s*([^}]+)\}\s*=\s*(.+)/;
+/** Pattern for array destructuring: const/let/var [ A, B ] = ... */
+const ARRAY_DESTRUCTURE = /\b(?:const|let|var)\s+\[\s*([^\]]+)\]\s*=\s*(.+)/;
+/**
+ * Extract variable name(s) from an assignment line that contains a source expression.
+ */
+function extractVariables(line, sourceExpression) {
+    const variables = [];
+    // Try destructuring first: const { a, b } = req.body
+    const destructureMatch = line.match(DESTRUCTURE_ASSIGNMENT);
+    if (destructureMatch) {
+        const rhs = destructureMatch[2].trim();
+        if (rhs.includes(sourceExpression) || sourceMatchesRhs(rhs, sourceExpression)) {
+            const names = destructureMatch[1].split(',').map(n => {
+                // Handle renaming: `originalName: newName`
+                const parts = n.trim().split(':');
+                return (parts.length > 1 ? parts[1] : parts[0]).trim();
+            }).filter(n => n.length > 0 && n !== '...');
+            variables.push(...names);
+        }
+        return variables;
+    }
+    // Try array destructuring: const [ a, b ] = ...
+    const arrayMatch = line.match(ARRAY_DESTRUCTURE);
+    if (arrayMatch) {
+        const rhs = arrayMatch[2].trim();
+        if (rhs.includes(sourceExpression) || sourceMatchesRhs(rhs, sourceExpression)) {
+            const names = arrayMatch[1].split(',').map(n => n.trim()).filter(n => n.length > 0 && n !== '...');
+            variables.push(...names);
+        }
+        return variables;
+    }
+    // Try direct assignment: const name = req.body
+    const directMatch = line.match(DIRECT_ASSIGNMENT);
+    if (directMatch) {
+        const rhs = directMatch[2].trim();
+        if (rhs.includes(sourceExpression) || sourceMatchesRhs(rhs, sourceExpression)) {
+            variables.push(directMatch[1]);
+        }
+    }
+    return variables;
+}
+/**
+ * Check if a source pattern's expression is part of the RHS of an assignment.
+ */
+function sourceMatchesRhs(rhs, sourceExpression) {
+    // Handle cases like `req.body.email` matching the `req.body` source
+    return rhs.includes(sourceExpression);
+}
+// ============================================================================
+// Main Discovery Function
+// ============================================================================
+/**
+ * Discover user-input sources in a file.
+ *
+ * Scans each line for framework-specific input patterns and extracts
+ * the variable names that receive user-controlled data.
+ */
+function discoverSources(content, filePath) {
+    const lines = content.split('\n');
+    const sources = [];
+    const seen = new Set();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lineNumber = i + 1;
+        // Skip comments
+        const trimmed = line.trim();
+        if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*')) {
+            continue;
+        }
+        for (const sp of SOURCE_PATTERNS) {
+            const match = sp.pattern.exec(line);
+            if (!match)
+                continue;
+            const expression = match[0];
+            // Extract variables assigned from this source
+            const variables = extractVariables(line, expression);
+            if (variables.length > 0) {
+                for (const variable of variables) {
+                    const key = `${lineNumber}:${variable}:${sp.sourceType}`;
+                    if (seen.has(key))
+                        continue;
+                    seen.add(key);
+                    sources.push({
+                        line: lineNumber,
+                        expression,
+                        variable,
+                        sourceType: sp.sourceType,
+                        frameworkSource: sp.framework,
+                        confidence: sp.confidence,
+                    });
+                }
+            }
+            else {
+                // Source found but no variable assignment (e.g., inline usage like `db.query(req.query.id)`)
+                // Still record it — the taint tracker and sink matcher can use the expression directly
+                const key = `${lineNumber}:${expression}:${sp.sourceType}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                sources.push({
+                    line: lineNumber,
+                    expression,
+                    variable: expression,
+                    sourceType: sp.sourceType,
+                    frameworkSource: sp.framework,
+                    confidence: sp.confidence,
+                });
+            }
+        }
+    }
+    return sources;
+}
+//# sourceMappingURL=source-discovery.js.map

package/dist/model/source-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-discovery.js","sourceRoot":"","sources":["../../src/model/source-discovery.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAgJH,0CA2DC;AAxLD,MAAM,eAAe,GAAoB;IACvC,0BAA0B;IAC1B,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE;IAC/F,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE;IACjG,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE;IACnG,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE;IACrG,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE;IAErG,cAAc;IACd,EAAE,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE;IACpG,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE;IAE7F,6BAA6B;IAC7B,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE;IACpG,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE;IAE/F,uBAAuB;IACvB,EAAE,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;IAClH,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;IAChH,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;IAChH,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC9G,EAAE,OAAO,EAAE,yBAAyB,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;IACnH,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC3G,EAAE,OAAO,EAAE,0BAA0B,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;IAE5G,oBAAoB;IACpB,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC7H,EAAE,OAAO,EAAE,qCAAqC,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE;IAEjI,qBAAqB;IACrB,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE;IACpG,EAAE,OAAO,EAAE,kCAAkC,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE;IAEtH,uBAAuB;IACvB,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE;IAClG,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE;IACjG,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE;IACjG,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE;IAEjG,wBAAwB;IACxB,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE;IAClG,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE;IAClG,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE;IAElG,cAAc;IACd,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;IAC9F,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE;IAC5F,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE;CAC5F,CAAA;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,8DAA8D;AAC9D,MAAM,iBAAiB,GAAG,wCAAwC,CAAA;AAElE,8DAA8D;AAC9D,MAAM,sBAAsB,GAAG,iDAAiD,CAAA;AAEhF,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,kDAAkD,CAAA;AAE5E;;GAEG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,gBAAwB;IAC9D,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,qDAAqD;IACrD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;IAC3D,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBACnD,2CAA2C;gBAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBACjC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACxD,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;YAC3C,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QAC1B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,gDAAgD;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAChD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;YAClG,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QAC1B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,+CAA+C;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC9E,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,gBAAwB;IAC7D,oEAAoE;IACpE,OAAO,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;AACvC,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,OAAe,EAAE,QAAgB;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAE9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAA;QAExB,gBAAgB;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpF,SAAQ;QACV,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnC,IAAI,CAAC,KAAK;gBAAE,SAAQ;YAEpB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YAE3B,8CAA8C;YAC9C,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;YAEpD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;oBACjC,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,QAAQ,IAAI,EAAE,CAAC,UAAU,EAAE,CAAA;oBACxD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,SAAQ;oBAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBAEb,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,UAAU;wBAChB,UAAU;wBACV,QAAQ;wBACR,UAAU,EAAE,EAAE,CAAC,UAAU;wBACzB,eAAe,EAAE,EAAE,CAAC,SAAS;wBAC7B,UAAU,EAAE,EAAE,CAAC,UAAU;qBAC1B,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,6FAA6F;gBAC7F,uFAAuF;gBACvF,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,UAAU,IAAI,EAAE,CAAC,UAAU,EAAE,CAAA;gBAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAQ;gBAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAEb,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,UAAU;oBAChB,UAAU;oBACV,QAAQ,EAAE,UAAU;oBACpB,UAAU,EAAE,EAAE,CAAC,UAAU;oBACzB,eAAe,EAAE,EAAE,CAAC,SAAS;oBAC7B,UAAU,EAAE,EAAE,CAAC,UAAU;iBAC1B,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/model/taint-tracker.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Taint Propagation Tracker — Propagates taint through variable assignments.
+ *
+ * Walks lines forward from discovered sources, tracking how tainted data
+ * flows through assignments, destructuring, template literals, etc.
+ * Marks variables as sanitised when they pass through known sanitisers.
+ */
+import type { UserInputSource, TaintedVariable } from './taint-types';
+import type { SanitiserInfo } from './taint-types';
+/**
+ * Propagate taint through variable assignments in a file.
+ *
+ * Algorithm:
+ * 1. Initialize tainted vars from sources
+ * 2. Walk lines forward, tracking brace depth for scope
+ * 3. For each line, check if any tainted var appears on the right side
+ * 4. If sanitiser wraps the expression, mark sanitised
+ * 5. When exiting a scope, remove block-scoped (const/let) vars at that depth
+ */
+export declare function propagateTaint(content: string, _filePath: string, sources: UserInputSource[], sanitisers: SanitiserInfo[]): TaintedVariable[];
+//# sourceMappingURL=taint-tracker.d.ts.map

package/dist/model/taint-tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-tracker.d.ts","sourceRoot":"","sources":["../../src/model/taint-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAwB,MAAM,eAAe,CAAA;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAwMlD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EAAE,EAC1B,UAAU,EAAE,aAAa,EAAE,GAC1B,eAAe,EAAE,CA4GnB"}

package/dist/model/taint-tracker.js

@@ -0,0 +1,281 @@
+"use strict";
+/**
+ * Taint Propagation Tracker — Propagates taint through variable assignments.
+ *
+ * Walks lines forward from discovered sources, tracking how tainted data
+ * flows through assignments, destructuring, template literals, etc.
+ * Marks variables as sanitised when they pass through known sanitisers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.propagateTaint = propagateTaint;
+const sanitiser_detection_1 = require("./sanitiser-detection");
+// ============================================================================
+// Scope Tracking
+// ============================================================================
+/**
+ * Track brace depth for approximate scope analysis.
+ * Counts { and } while ignoring those inside string literals and comments.
+ */
+function countBraceChanges(line, inMultiLineComment) {
+    let delta = 0;
+    let inComment = inMultiLineComment;
+    let inString = null;
+    let escaped = false;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        const next = i < line.length - 1 ? line[i + 1] : '';
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === '\\') {
+            escaped = true;
+            continue;
+        }
+        // Handle multi-line comments
+        if (inComment) {
+            if (ch === '*' && next === '/') {
+                inComment = false;
+                i++; // skip /
+            }
+            continue;
+        }
+        // Handle single-line comments
+        if (!inString && ch === '/' && next === '/') {
+            break; // rest of line is comment
+        }
+        // Handle multi-line comment start
+        if (!inString && ch === '/' && next === '*') {
+            inComment = true;
+            i++; // skip *
+            continue;
+        }
+        // Handle string literals
+        if (!inString && (ch === '"' || ch === "'" || ch === '`')) {
+            inString = ch;
+            continue;
+        }
+        if (inString && ch === inString) {
+            inString = null;
+            continue;
+        }
+        // Count braces outside strings and comments
+        if (!inString) {
+            if (ch === '{')
+                delta++;
+            if (ch === '}')
+                delta--;
+        }
+    }
+    return { delta, inComment };
+}
+// ============================================================================
+// Propagation Detection
+// ============================================================================
+/** Check if a tainted variable appears on the right side of an expression */
+function findTaintedVarInExpression(line, taintedVars) {
+    for (const [name, tv] of taintedVars) {
+        // Use word boundary to avoid partial matches (e.g., "url" matching "urlParser")
+        const regex = new RegExp(`\\b${escapeRegex(name)}\\b`);
+        if (regex.test(line)) {
+            return { varName: name, variable: tv };
+        }
+    }
+    return null;
+}
+function escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Detect what type of propagation is happening on a line.
+ */
+function detectPropagationType(line) {
+    const trimmed = line.trim();
+    // Destructuring: const { a, b } = taintedVar
+    if (/(?:const|let|var)\s+\{[^}]+\}\s*=/.test(trimmed)) {
+        return 'destructure';
+    }
+    // Spread: { ...taintedVar }
+    if (/\.\.\.\w+/.test(trimmed)) {
+        return 'spread';
+    }
+    // Template literal: `${taintedVar}`
+    if (/`[^`]*\$\{[^}]+\}[^`]*`/.test(trimmed)) {
+        return 'template_literal';
+    }
+    // String concatenation: "..." + taintedVar
+    if (/['"][^'"]*['"]\s*\+/.test(trimmed) || /\+\s*['"][^'"]*['"]/.test(trimmed)) {
+        return 'string_concat';
+    }
+    // Ternary/nullish: taintedVar ?? default, taintedVar || default
+    if (/\?\?|\|\|/.test(trimmed) && /(?:const|let|var)\s+\w+\s*=/.test(trimmed)) {
+        return 'ternary';
+    }
+    // Array push: arr.push(taintedVar)
+    if (/\.push\s*\(/.test(trimmed)) {
+        return 'array_push';
+    }
+    // Object spread: { ...taintedVar, key: value }
+    if (/\{[^}]*\.\.\.\w+/.test(trimmed)) {
+        return 'object_spread';
+    }
+    // Method chain: taintedVar.trim().toLowerCase() — result still tainted
+    if (/\.\w+\s*\(/.test(trimmed)) {
+        return 'method_chain';
+    }
+    // Direct assignment: const x = taintedVar
+    if (/(?:const|let|var)\s+\w+\s*=/.test(trimmed) || /\w+\s*=(?!=)/.test(trimmed)) {
+        return 'direct_assignment';
+    }
+    return null;
+}
+/**
+ * Extract the newly assigned variable name from a line.
+ */
+function extractAssignedVariable(line) {
+    const trimmed = line.trim();
+    // Destructuring: const { a, b } = ...
+    const destructMatch = trimmed.match(/(?:const|let|var)\s+\{\s*([^}]+)\}\s*=/);
+    if (destructMatch) {
+        return destructMatch[1].split(',').map(n => {
+            const parts = n.trim().split(':');
+            return (parts.length > 1 ? parts[1] : parts[0]).trim();
+        }).filter(n => n.length > 0 && n !== '...');
+    }
+    // Array destructuring: const [a, b] = ...
+    const arrayMatch = trimmed.match(/(?:const|let|var)\s+\[\s*([^\]]+)\]\s*=/);
+    if (arrayMatch) {
+        return arrayMatch[1].split(',').map(n => n.trim()).filter(n => n.length > 0 && n !== '...');
+    }
+    // Direct assignment: const x = ... or let x = ...
+    const directMatch = trimmed.match(/(?:const|let|var)\s+(\w+)\s*=/);
+    if (directMatch) {
+        return [directMatch[1]];
+    }
+    // Re-assignment: x = ... (no const/let/var)
+    const reassignMatch = trimmed.match(/^(\w+)\s*=(?!=)/);
+    if (reassignMatch) {
+        return [reassignMatch[1]];
+    }
+    return [];
+}
+/**
+ * Determine variable scope type from declaration keyword.
+ */
+function getDeclarationType(line) {
+    const trimmed = line.trim();
+    if (/^(?:const|let)\b/.test(trimmed))
+        return 'block';
+    if (/^var\b/.test(trimmed))
+        return 'function';
+    return 'reassign';
+}
+// ============================================================================
+// Main Propagation Function
+// ============================================================================
+/**
+ * Propagate taint through variable assignments in a file.
+ *
+ * Algorithm:
+ * 1. Initialize tainted vars from sources
+ * 2. Walk lines forward, tracking brace depth for scope
+ * 3. For each line, check if any tainted var appears on the right side
+ * 4. If sanitiser wraps the expression, mark sanitised
+ * 5. When exiting a scope, remove block-scoped (const/let) vars at that depth
+ */
+function propagateTaint(content, _filePath, sources, sanitisers) {
+    const lines = content.split('\n');
+    const taintedVars = new Map();
+    const allTaintedVars = [];
+    // Track scope for variable lifetime
+    let braceDepth = 0;
+    let inMultiLineComment = false;
+    const scopeVars = new Map(); // variable name -> declared scope depth
+    // Initialize tainted vars from sources
+    for (const source of sources) {
+        const tv = {
+            name: source.variable,
+            taintedAt: source.line,
+            source,
+            propagation: 'direct_assignment',
+            sanitised: false,
+            scopeDepth: 0,
+        };
+        taintedVars.set(source.variable, tv);
+        allTaintedVars.push(tv);
+    }
+    // Walk lines forward
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lineNumber = i + 1;
+        const trimmed = line.trim();
+        // Skip empty lines and comments
+        if (trimmed === '' || trimmed.startsWith('//')) {
+            continue;
+        }
+        // Update brace depth
+        const braceResult = countBraceChanges(line, inMultiLineComment);
+        inMultiLineComment = braceResult.inComment;
+        // Handle scope exit: remove block-scoped vars declared at the exiting depth
+        if (braceResult.delta < 0) {
+            const newDepth = braceDepth + braceResult.delta;
+            for (const [varName, declDepth] of scopeVars) {
+                if (declDepth > newDepth) {
+                    taintedVars.delete(varName);
+                    scopeVars.delete(varName);
+                }
+            }
+        }
+        braceDepth = Math.max(0, braceDepth + braceResult.delta);
+        // Skip lines that are only closing braces
+        if (/^[}\])\s;]*$/.test(trimmed))
+            continue;
+        // Check if any tainted variable appears in this line (on the right side of an assignment)
+        const found = findTaintedVarInExpression(line, taintedVars);
+        if (!found)
+            continue;
+        // Check if this line is an assignment that creates a new tainted variable
+        const assignedVars = extractAssignedVariable(line);
+        if (assignedVars.length === 0)
+            continue;
+        // Don't re-taint the same variable (e.g., `userInput = userInput.trim()`)
+        const newVars = assignedVars.filter(v => v !== found.varName);
+        if (newVars.length === 0) {
+            // Still might be a method chain on the same variable — update it
+            // Check if sanitiser is applied
+            const sanitResult = (0, sanitiser_detection_1.isSanitiserCall)(line, sanitisers);
+            if (sanitResult.sanitised && taintedVars.has(found.varName)) {
+                const existing = taintedVars.get(found.varName);
+                existing.sanitised = true;
+                existing.sanitisedAt = lineNumber;
+                existing.sanitisationMethod = sanitResult.method;
+            }
+            continue;
+        }
+        // Detect propagation type
+        const propagationType = detectPropagationType(line) ?? 'direct_assignment';
+        const declType = getDeclarationType(line);
+        // Check if sanitised at this assignment
+        const sanitResult = (0, sanitiser_detection_1.isSanitiserCall)(line, sanitisers);
+        for (const varName of newVars) {
+            const tv = {
+                name: varName,
+                taintedAt: lineNumber,
+                source: found.variable.source,
+                propagation: propagationType,
+                sanitised: sanitResult.sanitised,
+                sanitisedAt: sanitResult.sanitised ? lineNumber : undefined,
+                sanitisationMethod: sanitResult.method,
+                scopeDepth: braceDepth,
+            };
+            taintedVars.set(varName, tv);
+            allTaintedVars.push(tv);
+            // Track scope for block-scoped vars
+            if (declType === 'block') {
+                scopeVars.set(varName, braceDepth);
+            }
+        }
+    }
+    return allTaintedVars;
+}
+//# sourceMappingURL=taint-tracker.js.map