@oculum/scanner 1.0.14 → 1.0.15

package/dist/detect/ast-rules/index.js

@@ -0,0 +1,232 @@
+"use strict";
+/**
+ * AST Rule Engine
+ *
+ * Defines and runs AST-based detection rules against tree-sitter parse trees.
+ * Rules declare patterns (node types, matchers, context checks) and produce
+ * Vulnerability objects compatible with the existing pipeline.
+ *
+ * This is the v2 foundation — new detectors should be written as AST rules
+ * rather than regex patterns.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getNodes = void 0;
+exports.registerASTRule = registerASTRule;
+exports.getASTRules = getASTRules;
+exports.runASTRules = runASTRules;
+exports.runASTRulesOnFiles = runASTRulesOnFiles;
+exports.collectImportBindings = collectImportBindings;
+exports.isCallTo = isCallTo;
+exports.getFirstStringArg = getFirstStringArg;
+const ast_1 = require("../../parse/ast");
+const node_index_1 = require("../../parse/node-index");
+var node_index_2 = require("../../parse/node-index");
+Object.defineProperty(exports, "getNodes", { enumerable: true, get: function () { return node_index_2.getNodes; } });
+// ============================================================================
+// Rule Registry
+// ============================================================================
+const rules = [];
+/**
+ * Register an AST rule. Called by individual rule modules during import.
+ */
+function registerASTRule(rule) {
+    rules.push(rule);
+}
+/**
+ * Get all registered AST rules.
+ */
+function getASTRules() {
+    return rules;
+}
+// ============================================================================
+// Rule Runner
+// ============================================================================
+/**
+ * Run all applicable AST rules against a single parsed file.
+ * Returns Vulnerability objects ready for the pipeline.
+ */
+function runASTRules(ast, content) {
+    const vulnerabilities = [];
+    const lines = content.split('\n');
+    const nodeIndex = (0, node_index_1.buildNodeIndexCached)(ast.tree.rootNode, ast.language, ast.hash);
+    for (const rule of rules) {
+        // Skip rules that don't apply to this language
+        if (!rule.languages.includes(ast.language))
+            continue;
+        try {
+            const matches = rule.detect(ast, content, nodeIndex);
+            for (const match of matches) {
+                const lineNumber = match.node.startPosition.row + 1; // tree-sitter is 0-indexed
+                const lineContent = lines[match.node.startPosition.row]?.trim() || '';
+                vulnerabilities.push({
+                    id: `${rule.id}-${ast.filePath}-${lineNumber}`,
+                    filePath: ast.filePath,
+                    lineNumber,
+                    lineContent,
+                    severity: match.severity ?? rule.severity,
+                    category: match.category ?? rule.category,
+                    title: rule.title,
+                    description: match.note
+                        ? `${rule.description}. ${match.note}`
+                        : rule.description,
+                    suggestedFix: rule.suggestedFix,
+                    confidence: rule.confidence,
+                    baseConfidence: rule.baseConfidence,
+                    layer: rule.layer ?? 2,
+                    source: rule.source ?? 'structural',
+                    requiresAIValidation: rule.requiresAIValidation ?? false,
+                    taintPath: match.taintPath,
+                    evidenceLevel: match.evidenceLevel,
+                    fixSteps: match.fixSteps,
+                });
+            }
+        }
+        catch (err) {
+            // Individual rule failure should not break the scan
+            if (process.env.NODE_ENV !== 'production') {
+                console.warn(`[AST] Rule ${rule.id} failed on ${ast.filePath}: ${err}`);
+            }
+        }
+    }
+    return vulnerabilities;
+}
+/**
+ * Run all applicable AST rules across multiple parsed files.
+ */
+function runASTRulesOnFiles(asts, files) {
+    const allVulnerabilities = [];
+    const contentMap = new Map(files.map(f => [f.path, f.content]));
+    for (const [filePath, ast] of asts) {
+        const content = contentMap.get(filePath);
+        if (!content)
+            continue;
+        const vulns = runASTRules(ast, content);
+        allVulnerabilities.push(...vulns);
+    }
+    return allVulnerabilities;
+}
+// ============================================================================
+// AST Query Helpers (used by rule implementations)
+// ============================================================================
+/**
+ * Collect all import bindings from the top level of a file.
+ * Returns a map of local name → { source module, original name }.
+ *
+ * Handles:
+ *  - import { foo } from 'mod'
+ *  - import { foo as bar } from 'mod'
+ *  - import foo from 'mod'
+ *  - const { foo } = require('mod')
+ */
+function collectImportBindings(root) {
+    const bindings = new Map();
+    (0, ast_1.walkAST)(root, (node) => {
+        // ES import
+        if (node.type === 'import_statement') {
+            const source = node.childForFieldName('source');
+            const moduleName = source?.text.replace(/^['"]|['"]$/g, '') ?? '';
+            // Find the import clause (might be a field or a direct child depending on grammar)
+            const clause = node.childForFieldName('import')
+                ?? node.children.find(c => c.type === 'import_clause');
+            if (clause) {
+                // import { a, b as c } from 'mod'
+                const namedImports = clause.descendantsOfType('import_specifier');
+                for (const spec of namedImports) {
+                    const nameNode = spec.childForFieldName('name');
+                    const aliasNode = spec.childForFieldName('alias');
+                    const original = nameNode?.text ?? '';
+                    const local = aliasNode?.text ?? original;
+                    bindings.set(local, { module: moduleName, originalName: original });
+                }
+                // import foo from 'mod' (default)
+                const defaultImport = clause.descendantsOfType('identifier');
+                if (defaultImport.length === 1 && namedImports.length === 0) {
+                    bindings.set(defaultImport[0].text, { module: moduleName, originalName: 'default' });
+                }
+            }
+            return true; // skip subtree
+        }
+        // CJS require: const { foo } = require('mod')
+        if (node.type === 'lexical_declaration' || node.type === 'variable_declaration') {
+            for (const declarator of node.descendantsOfType('variable_declarator')) {
+                const init = declarator.childForFieldName('value');
+                if (init?.type === 'call_expression' &&
+                    init.childForFieldName('function')?.text === 'require') {
+                    const args = init.childForFieldName('arguments');
+                    const firstArg = args?.namedChildren[0];
+                    const moduleName = firstArg?.text.replace(/^['"]|['"]$/g, '') ?? '';
+                    const nameNode = declarator.childForFieldName('name');
+                    if (nameNode?.type === 'object_pattern') {
+                        // const { foo, bar: baz } = require('mod')
+                        for (const prop of nameNode.namedChildren) {
+                            if (prop.type === 'shorthand_property_identifier_pattern') {
+                                bindings.set(prop.text, { module: moduleName, originalName: prop.text });
+                            }
+                            else if (prop.type === 'pair_pattern') {
+                                const key = prop.childForFieldName('key')?.text ?? '';
+                                const value = prop.childForFieldName('value')?.text ?? '';
+                                bindings.set(value, { module: moduleName, originalName: key });
+                            }
+                        }
+                    }
+                    else if (nameNode?.type === 'identifier') {
+                        // const foo = require('mod')
+                        bindings.set(nameNode.text, { module: moduleName, originalName: 'default' });
+                    }
+                }
+            }
+        }
+        return false;
+    });
+    return bindings;
+}
+/**
+ * Check if a call_expression node calls a specific function name
+ * (handles both direct calls and member expressions like crypto.createHash).
+ */
+function isCallTo(node, name) {
+    if (node.type !== 'call_expression')
+        return false;
+    const fn = node.childForFieldName('function');
+    if (!fn)
+        return false;
+    // Direct: functionName(...)
+    if (fn.type === 'identifier' && fn.text === name)
+        return true;
+    // Member: obj.method(...)
+    if (fn.type === 'member_expression') {
+        const prop = fn.childForFieldName('property');
+        if (prop?.text === name)
+            return true;
+    }
+    return false;
+}
+/**
+ * Get the string value of the first argument to a call expression.
+ * Returns null if the first arg isn't a string literal.
+ */
+function getFirstStringArg(callNode) {
+    const args = callNode.childForFieldName('arguments');
+    if (!args)
+        return null;
+    const firstArg = args.namedChildren[0];
+    if (!firstArg)
+        return null;
+    if (firstArg.type === 'string' || firstArg.type === 'template_string') {
+        // Strip quotes
+        const text = firstArg.text;
+        if ((text.startsWith("'") && text.endsWith("'")) ||
+            (text.startsWith('"') && text.endsWith('"'))) {
+            return text.slice(1, -1);
+        }
+        if (text.startsWith('`') && text.endsWith('`')) {
+            return text.slice(1, -1);
+        }
+        // string node may contain a string_fragment child
+        const fragment = firstArg.descendantsOfType('string_fragment');
+        if (fragment.length > 0)
+            return fragment[0].text;
+    }
+    return null;
+}
+//# sourceMappingURL=index.js.map

package/dist/detect/ast-rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/detect/ast-rules/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AA4EH,0CAEC;AAKD,kCAEC;AAUD,kCAkDC;AAKD,gDAgBC;AAgBD,sDAsEC;AAMD,4BAeC;AAMD,8CAsBC;AAxSD,yCAAyC;AACzC,uDAAuF;AACvF,qDAAiE;AAAxC,sGAAA,QAAQ,OAAA;AA4DjC,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,KAAK,GAAc,EAAE,CAAA;AAE3B;;GAEG;AACH,SAAgB,eAAe,CAAC,IAAa;IAC3C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW;IACzB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,WAAW,CACzB,GAAc,EACd,OAAe;IAEf,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,IAAA,iCAAoB,EAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;IAEjF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,+CAA+C;QAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAQ;QAEpD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;YAEpD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,CAAA,CAAC,2BAA2B;gBAC/E,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;gBAErE,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,UAAU,EAAE;oBAC9C,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,UAAU;oBACV,WAAW;oBACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;oBACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;oBACzC,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,KAAK,CAAC,IAAI;wBACrB,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,EAAE;wBACtC,CAAC,CAAC,IAAI,CAAC,WAAW;oBACpB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;oBACtB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,YAAY;oBACnC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,KAAK;oBACxD,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oDAAoD;YACpD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,EAAE,cAAc,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAChC,IAA4B,EAC5B,KAA+C;IAE/C,MAAM,kBAAkB,GAAoB,EAAE,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAE/D,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,CAAC,OAAO;YAAE,SAAQ;QAEtB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACvC,kBAAkB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,kBAAkB,CAAA;AAC3B,CAAC;AAED,+EAA+E;AAC/E,mDAAmD;AACnD,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CACnC,IAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoD,CAAA;IAE5E,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,YAAY;QACZ,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;YAC/C,MAAM,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;YAEjE,mFAAmF;YACnF,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;mBAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAA;YAExD,IAAI,MAAM,EAAE,CAAC;gBACX,kCAAkC;gBAClC,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;gBACjE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;oBAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;oBACjD,MAAM,QAAQ,GAAG,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAA;oBACrC,MAAM,KAAK,GAAG,SAAS,EAAE,IAAI,IAAI,QAAQ,CAAA;oBACzC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACrE,CAAC;gBACD,kCAAkC;gBAClC,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;gBAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAA;gBACtF,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAA,CAAC,eAAe;QAC7B,CAAC;QAED,8CAA8C;QAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAChF,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,GAAG,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;gBAClD,IACE,IAAI,EAAE,IAAI,KAAK,iBAAiB;oBAChC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,KAAK,SAAS,EACtD,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;oBAChD,MAAM,QAAQ,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;oBACvC,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;oBAEnE,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;oBACrD,IAAI,QAAQ,EAAE,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBACxC,2CAA2C;wBAC3C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;4BAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,uCAAuC,EAAE,CAAC;gCAC1D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;4BAC1E,CAAC;iCAAM,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gCACxC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,EAAE,CAAA;gCACrD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE,CAAA;gCACzD,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAA;4BAChE,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,IAAI,QAAQ,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC3C,6BAA6B;wBAC7B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAA;oBAC9E,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,IAAuB,EAAE,IAAY;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAA;IACjD,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IAErB,4BAA4B;IAC5B,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE7D,0BAA0B;IAC1B,IAAI,EAAE,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;QAC7C,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;IACtC,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,QAA2B;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtE,eAAe;QACf,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC1B,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC1B,CAAC;QACD,kDAAkD;QAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/detect/ast-rules/json-parse-ast.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AST-Based JSON.parse Source-Aware Detection
+ *
+ * Migrates dangerous-functions JSON.parse detection to AST.
+ *
+ * AST advantages:
+ * - Source classification from AST (req.body vs localStorage vs config)
+ * - Try-catch detection via AST ancestors (not regex line search)
+ * - Schema validation detection from nearby call expressions
+ * - Handles aliased JSON.parse: const parse = JSON.parse; parse(input)
+ */
+export {};
+//# sourceMappingURL=json-parse-ast.d.ts.map

package/dist/detect/ast-rules/json-parse-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-parse-ast.d.ts","sourceRoot":"","sources":["../../../src/detect/ast-rules/json-parse-ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/detect/ast-rules/json-parse-ast.js

@@ -0,0 +1,143 @@
+"use strict";
+/**
+ * AST-Based JSON.parse Source-Aware Detection
+ *
+ * Migrates dangerous-functions JSON.parse detection to AST.
+ *
+ * AST advantages:
+ * - Source classification from AST (req.body vs localStorage vs config)
+ * - Try-catch detection via AST ancestors (not regex line search)
+ * - Schema validation detection from nearby call expressions
+ * - Handles aliased JSON.parse: const parse = JSON.parse; parse(input)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const ast_1 = require("../../parse/ast");
+const index_1 = require("./index");
+const call_analysis_1 = require("./helpers/call-analysis");
+const scope_analysis_1 = require("./helpers/scope-analysis");
+const control_flow_1 = require("./helpers/control-flow");
+const user_input_1 = require("./helpers/user-input");
+const import_analysis_1 = require("./helpers/import-analysis");
+const file_classifier_1 = require("../../parse/file-classifier");
+function classifySource(argNode, filePath, root) {
+    if ((0, file_classifier_1.isTestOrMockFile)(filePath))
+        return 'test';
+    const text = argNode.text;
+    // User input sources
+    if ((0, user_input_1.isUserInputExpression)(argNode))
+        return 'user_input';
+    if (/req(uest)?\.body|event\.body|ctx\.request\.body/i.test(text))
+        return 'user_input';
+    // Local storage
+    if (/localStorage\.getItem|sessionStorage\.getItem/i.test(text))
+        return 'local_storage';
+    // Database
+    if (/row\.\w+|document\.\w+|item\.\w+|record\.\w+/i.test(text))
+        return 'database';
+    // Config
+    if (/config\.|settings\.|constants\./i.test(text))
+        return 'config';
+    // File system reads (standard config-loading pattern)
+    if (/readFileSync|readFile\b|\.readFile\(|fs\.promises\.readFile/i.test(text))
+        return 'config';
+    // Trusted SDK responses
+    if (/\.json\(\)|response\.text\(\)|\.data\b/i.test(text))
+        return 'trusted_sdk';
+    // Internal/migration files
+    if (/scripts?\/|tools?\//i.test(filePath))
+        return 'internal';
+    // Check file context for hints
+    if ((0, import_analysis_1.hasImport)(root, 'openai') || (0, import_analysis_1.hasImport)(root, '@anthropic-ai/sdk'))
+        return 'trusted_sdk';
+    return 'unknown';
+}
+/** Check if there's schema validation nearby */
+function hasSchemaValidation(fnNode, root) {
+    if (!fnNode)
+        return false;
+    const bodyText = fnNode.text;
+    // Exclude JSON.parse itself from matching — look for schema-library parse calls
+    return /z\.(parse|safeParse|parseAsync)\s*\(|schema\.(parse|safeParse)\s*\(|\.safeParse\s*\(|\.validate\s*\(|\.check\s*\(|joi\.|yup\.|zod\./i.test(bodyText);
+}
+// ============================================================================
+// AST Rule: JSON.parse
+// ============================================================================
+(0, index_1.registerASTRule)({
+    id: 'ast-json-parse',
+    title: 'JSON.parse with unvalidated input',
+    description: 'JSON.parse() called on potentially untrusted data without schema validation',
+    severity: 'medium',
+    category: 'dangerous_function',
+    suggestedFix: 'Add schema validation (zod, yup, joi) after JSON.parse() to validate the structure and types of parsed data.',
+    languages: ['javascript', 'typescript', 'tsx'],
+    confidence: 'medium',
+    baseConfidence: 0.35,
+    layer: 2,
+    source: 'structural',
+    detect(ast, content, nodeIndex) {
+        if ((0, file_classifier_1.isScannerOrFixtureFile)(ast.filePath))
+            return [];
+        // Content pre-check: skip files without JSON.parse
+        if (!/JSON\.parse/.test(content))
+            return [];
+        const matches = [];
+        const root = ast.tree.rootNode;
+        const aliases = (0, scope_analysis_1.collectVariableAliases)(root);
+        for (const node of (0, index_1.getNodes)(nodeIndex, 'call_expression')) {
+            const target = (0, call_analysis_1.resolveCallTarget)(node, aliases);
+            if (!target)
+                continue;
+            // JSON.parse() or aliased
+            const isJSONParse = (target.name === 'parse' && target.object === 'JSON') ||
+                (target.aliased && target.fullChain === 'JSON.parse');
+            if (!isJSONParse)
+                continue;
+            const args = (0, call_analysis_1.getCallArguments)(node);
+            if (args.length === 0)
+                continue;
+            const source = classifySource(args[0], ast.filePath, root);
+            const inTryCatch = (0, control_flow_1.isInsideTryCatch)(node);
+            const fn = (0, ast_1.findEnclosingFunction)(node);
+            const hasSchema = hasSchemaValidation(fn, root);
+            // Safe sources: skip entirely
+            if (source === 'test' || source === 'trusted_sdk' || source === 'internal')
+                continue;
+            // Config/database with try-catch: skip
+            if ((source === 'config' || source === 'database') && inTryCatch)
+                continue;
+            // Local storage with try-catch: skip
+            if (source === 'local_storage' && inTryCatch)
+                continue;
+            // User input: severity depends on try-catch and schema validation
+            if (source === 'user_input') {
+                if (hasSchema)
+                    continue; // schema validation present
+                if (inTryCatch) {
+                    matches.push({
+                        node,
+                        severity: 'low',
+                        note: 'JSON.parse on user input wrapped in try-catch, but consider adding schema validation (zod/yup) for type safety',
+                    });
+                }
+                else {
+                    matches.push({
+                        node,
+                        severity: 'medium',
+                        note: 'JSON.parse on user input without try-catch or schema validation',
+                    });
+                }
+                continue;
+            }
+            // Unknown source without try-catch
+            if (source === 'unknown' && !inTryCatch && !hasSchema) {
+                matches.push({
+                    node,
+                    severity: 'info',
+                    note: 'JSON.parse without try-catch - consider adding error handling',
+                });
+            }
+        }
+        return matches;
+    },
+});
+//# sourceMappingURL=json-parse-ast.js.map

package/dist/detect/ast-rules/json-parse-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-parse-ast.js","sourceRoot":"","sources":["../../../src/detect/ast-rules/json-parse-ast.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAGH,yCAAuD;AACvD,mCAAsF;AAEtF,2DAA6E;AAC7E,6DAAiE;AACjE,yDAAyD;AACzD,qDAA4D;AAC5D,+DAAqD;AACrD,iEAAsF;AAUtF,SAAS,cAAc,CACrB,OAA0B,EAC1B,QAAgB,EAChB,IAAuB;IAEvB,IAAI,IAAA,kCAAgB,EAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAA;IAE7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAEzB,qBAAqB;IACrB,IAAI,IAAA,kCAAqB,EAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAA;IACvD,IAAI,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAA;IAEtF,gBAAgB;IAChB,IAAI,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAA;IAEvF,WAAW;IACX,IAAI,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAA;IAEjF,SAAS;IACT,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAA;IAElE,sDAAsD;IACtD,IAAI,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAA;IAE9F,wBAAwB;IACxB,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAA;IAE9E,2BAA2B;IAC3B,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAA;IAE5D,+BAA+B;IAC/B,IAAI,IAAA,2BAAS,EAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAA,2BAAS,EAAC,IAAI,EAAE,mBAAmB,CAAC;QAAE,OAAO,aAAa,CAAA;IAE3F,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,gDAAgD;AAChD,SAAS,mBAAmB,CAAC,MAAgC,EAAE,IAAuB;IACpF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAA;IAC5B,gFAAgF;IAChF,OAAO,sIAAsI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAC9J,CAAC;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,IAAA,uBAAe,EAAC;IACd,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,mCAAmC;IAC1C,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,oBAAoB;IAC9B,YAAY,EAAE,8GAA8G;IAC5H,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC9C,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,IAAI;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,YAAY;IACpB,MAAM,CAAC,GAAc,EAAE,OAAe,EAAE,SAAqB;QAC3D,IAAI,IAAA,wCAAsB,EAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QAEnD,mDAAmD;QACnD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAA;QAE3C,MAAM,OAAO,GAAmB,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;QAC9B,MAAM,OAAO,GAAG,IAAA,uCAAsB,EAAC,IAAI,CAAC,CAAA;QAE5C,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAQ,EAAC,SAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAA,iCAAiB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YAC/C,IAAI,CAAC,MAAM;gBAAE,SAAQ;YAErB,0BAA0B;YAC1B,MAAM,WAAW,GACf,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;gBACrD,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,YAAY,CAAC,CAAA;YAEvD,IAAI,CAAC,WAAW;gBAAE,SAAQ;YAE1B,MAAM,IAAI,GAAG,IAAA,gCAAgB,EAAC,IAAI,CAAC,CAAA;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YAE/B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC1D,MAAM,UAAU,GAAG,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAA;YACzC,MAAM,EAAE,GAAG,IAAA,2BAAqB,EAAC,IAAI,CAAC,CAAA;YACtC,MAAM,SAAS,GAAG,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;YAE/C,8BAA8B;YAC9B,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,UAAU;gBAAE,SAAQ;YAEpF,uCAAuC;YACvC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,UAAU;gBAAE,SAAQ;YAE1E,qCAAqC;YACrC,IAAI,MAAM,KAAK,eAAe,IAAI,UAAU;gBAAE,SAAQ;YAEtD,kEAAkE;YAClE,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,IAAI,SAAS;oBAAE,SAAQ,CAAC,4BAA4B;gBACpD,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI;wBACJ,QAAQ,EAAE,KAAK;wBACf,IAAI,EAAE,gHAAgH;qBACvH,CAAC,CAAA;gBACJ,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI;wBACJ,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,iEAAiE;qBACxE,CAAC,CAAA;gBACJ,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,mCAAmC;YACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,+DAA+D;iBACtE,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAC,CAAA"}

package/dist/detect/ast-rules/log-injection-ast.d.ts

@@ -0,0 +1,14 @@
+/**
+ * AST-Based Log Injection Detection
+ *
+ * Migrates structural/log-injection.ts from regex to AST.
+ * Detects unsanitized user input flowing into log statements.
+ *
+ * AST advantages:
+ * - Resolves log sink calls structurally (console.log, logger.info, winston.error)
+ * - Checks argument nodes for user input references, not regex on line text
+ * - Detects taint through template literals and concatenation in log args
+ * - Distinguishes error logging (catch block) from user input logging
+ */
+export {};
+//# sourceMappingURL=log-injection-ast.d.ts.map

package/dist/detect/ast-rules/log-injection-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-injection-ast.d.ts","sourceRoot":"","sources":["../../../src/detect/ast-rules/log-injection-ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/detect/ast-rules/log-injection-ast.js

@@ -0,0 +1,235 @@
+"use strict";
+/**
+ * AST-Based Log Injection Detection
+ *
+ * Migrates structural/log-injection.ts from regex to AST.
+ * Detects unsanitized user input flowing into log statements.
+ *
+ * AST advantages:
+ * - Resolves log sink calls structurally (console.log, logger.info, winston.error)
+ * - Checks argument nodes for user input references, not regex on line text
+ * - Detects taint through template literals and concatenation in log args
+ * - Distinguishes error logging (catch block) from user input logging
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const ast_1 = require("../../parse/ast");
+const index_1 = require("./index");
+const call_analysis_1 = require("./helpers/call-analysis");
+const user_input_1 = require("./helpers/user-input");
+const control_flow_1 = require("./helpers/control-flow");
+const file_classifier_1 = require("../../parse/file-classifier");
+// ============================================================================
+// Helpers
+// ============================================================================
+/** Log method names */
+const LOG_METHODS = new Set(['log', 'info', 'warn', 'error', 'debug', 'trace', 'fatal', 'silly', 'verbose']);
+/** Log objects */
+const LOG_OBJECTS = /^(console|logger|log|winston|pino|bunyan|log4js|signale)$/;
+function isLogSink(node) {
+    const target = (0, call_analysis_1.resolveCallTarget)(node);
+    if (!target)
+        return false;
+    if (!target.object)
+        return false;
+    if (!LOG_OBJECTS.test(target.object))
+        return false;
+    if (!LOG_METHODS.has(target.name))
+        return false;
+    return true;
+}
+/** Check if argument is an error variable from a catch clause */
+function isErrorVarLogging(arg, callNode) {
+    // Direct error identifier: console.error(err)
+    if (arg.type === 'identifier' && /^(err|error|e|ex|exception)$/i.test(arg.text)) {
+        return true;
+    }
+    // Error property: err.message, error.stack
+    if (arg.type === 'member_expression') {
+        const obj = arg.childForFieldName('object');
+        if (obj && /^(err|error|e|ex|exception)$/i.test(obj.text))
+            return true;
+    }
+    // If inside catch clause, check if any arg references the catch variable
+    if ((0, control_flow_1.isInsideCatchClause)(callNode)) {
+        // Walk up to find catch clause and its parameter
+        let current = callNode.parent;
+        while (current) {
+            if (current.type === 'catch_clause') {
+                const param = current.childForFieldName('parameter');
+                if (param && arg.type === 'identifier' && arg.text === param.text)
+                    return true;
+                break;
+            }
+            current = current.parent;
+        }
+    }
+    return false;
+}
+/** Check if argument contains user input (recursive check for nested expressions) */
+function argContainsUserInput(arg) {
+    // Direct user input
+    if ((0, user_input_1.isUserInputExpression)(arg)) {
+        if (/\.headers/.test(arg.text))
+            return { found: true, type: 'header' };
+        return { found: true, type: 'body' };
+    }
+    // Spread of request body: { ...req.body }
+    if (arg.type === 'spread_element') {
+        const expr = arg.namedChildren[0];
+        if (expr && (0, user_input_1.isUserInputExpression)(expr))
+            return { found: true, type: 'spread' };
+    }
+    // JSON.stringify(req.body)
+    if (arg.type === 'call_expression') {
+        const target = (0, call_analysis_1.resolveCallTarget)(arg);
+        if (target?.object === 'JSON' && target?.name === 'stringify') {
+            const innerArgs = (0, call_analysis_1.getCallArguments)(arg);
+            if (innerArgs.length > 0 && (0, user_input_1.isUserInputExpression)(innerArgs[0])) {
+                return { found: true, type: 'stringify' };
+            }
+        }
+    }
+    // Template literal: `User input: ${req.body.name}`
+    if (arg.type === 'template_string') {
+        let found = false;
+        let type = 'body';
+        (0, ast_1.walkAST)(arg, (n) => {
+            if (n.type === 'template_substitution') {
+                const expr = n.namedChildren[0];
+                if (expr && (0, user_input_1.isUserInputExpression)(expr)) {
+                    found = true;
+                    if (/\.headers/.test(expr.text))
+                        type = 'header';
+                }
+            }
+            return false;
+        });
+        if (found)
+            return { found: true, type };
+    }
+    // Object literal with user input: { data: req.body }
+    if (arg.type === 'object') {
+        for (const child of arg.namedChildren) {
+            if (child.type === 'pair') {
+                const value = child.childForFieldName('value');
+                if (value && (0, user_input_1.isUserInputExpression)(value)) {
+                    if (/\.headers/.test(value.text))
+                        return { found: true, type: 'header' };
+                    return { found: true, type: 'body' };
+                }
+            }
+            if (child.type === 'spread_element') {
+                const expr = child.namedChildren[0];
+                if (expr && (0, user_input_1.isUserInputExpression)(expr))
+                    return { found: true, type: 'spread' };
+            }
+        }
+    }
+    // String concatenation with user input
+    if (arg.type === 'binary_expression') {
+        let found = false;
+        let type = 'body';
+        (0, ast_1.walkAST)(arg, (n) => {
+            if ((0, user_input_1.isUserInputExpression)(n)) {
+                found = true;
+                if (/\.headers/.test(n.text))
+                    type = 'header';
+            }
+            return false;
+        });
+        if (found)
+            return { found: true, type };
+    }
+    return { found: false, type: 'body' };
+}
+/** Check for sanitization in enclosing function */
+function hasSanitization(node) {
+    let current = node.parent;
+    let fnBody = null;
+    while (current) {
+        if (current.type === 'function_declaration' || current.type === 'arrow_function' || current.type === 'function_expression') {
+            fnBody = current.childForFieldName('body') ?? current;
+            break;
+        }
+        current = current.parent;
+    }
+    if (!fnBody)
+        return false;
+    const bodyText = fnBody.text;
+    return /sanitize\s*\(|\.replace\s*\(\s*\/[\[\\]rn\]|stripNewlines?\s*\(|escapeLog/i.test(bodyText);
+}
+/** Check for middleware logging imports */
+function hasMiddlewareLogging(content) {
+    return /(?:app|server|router)\.use\s*\(\s*(?:morgan|pino|express-winston|express\.logger)/.test(content);
+}
+// ============================================================================
+// AST Rule: Log Injection
+// ============================================================================
+(0, index_1.registerASTRule)({
+    id: 'ast-log-injection',
+    title: 'Log injection: User input in log statement',
+    description: 'Unsanitized user input flows into log statements, risking log forging or injection',
+    severity: 'low',
+    category: 'log_injection',
+    suggestedFix: 'Sanitize user input before logging (strip newlines and control characters). Use structured logging (JSON format) to prevent log forging.',
+    languages: ['javascript', 'typescript', 'tsx'],
+    confidence: 'medium',
+    baseConfidence: 0.35,
+    layer: 2,
+    source: 'structural',
+    detect(ast, content, nodeIndex) {
+        if ((0, file_classifier_1.isScannerOrFixtureFile)(ast.filePath))
+            return [];
+        if ((0, file_classifier_1.isTestOrMockFile)(ast.filePath))
+            return [];
+        // Skip files that use middleware logging (morgan, pino, etc.)
+        if (hasMiddlewareLogging(content))
+            return [];
+        const matches = [];
+        for (const node of (0, index_1.getNodes)(nodeIndex, 'call_expression')) {
+            if (!isLogSink(node))
+                continue;
+            const args = (0, call_analysis_1.getCallArguments)(node);
+            if (args.length === 0)
+                continue;
+            // Skip pure error logging
+            const allErrorArgs = args.every(a => isErrorVarLogging(a, node) || a.type === 'string' || a.type === 'template_string');
+            if (allErrorArgs && args.some(a => isErrorVarLogging(a, node)))
+                continue;
+            // Check each argument for user input
+            for (const arg of args) {
+                // Skip error variables
+                if (isErrorVarLogging(arg, node))
+                    continue;
+                const userInput = argContainsUserInput(arg);
+                if (!userInput.found)
+                    continue;
+                // JSON.stringify escapes newlines, carriage returns, and control characters,
+                // which prevents log forging (CRLF injection, ANSI escape injection).
+                if (userInput.type === 'stringify')
+                    continue;
+                // Skip if sanitization is nearby
+                if (hasSanitization(node))
+                    continue;
+                let severity = 'low';
+                let note = 'Request data in log statement.';
+                if (userInput.type === 'header') {
+                    severity = 'medium';
+                    note = 'HTTP headers logged without sanitization. Headers can contain CRLF sequences.';
+                }
+                else if (userInput.type === 'spread') {
+                    severity = 'low';
+                    note = 'Entire request body logged, may contain unsanitized user input.';
+                }
+                matches.push({
+                    node,
+                    severity: severity,
+                    note,
+                });
+                break; // One finding per log call
+            }
+        }
+        return matches;
+    },
+});
+//# sourceMappingURL=log-injection-ast.js.map