@oculum/scanner 1.0.14 → 1.0.15

package/dist/detect/ast-rules/secret-patterns-ast.js

@@ -0,0 +1,199 @@
+"use strict";
+/**
+ * AST-Based Hardcoded Secret Pattern Detection
+ *
+ * Migrates secrets/patterns.ts from regex to AST for source code files.
+ * Scans string literals in the AST for known secret patterns (API keys, tokens).
+ *
+ * AST advantages over regex:
+ * - Only scans actual string values (not comments, type annotations, JSDoc)
+ * - Understands assignment context (can check if value is env ref or placeholder)
+ * - Handles template literals with interpolation
+ * - Can detect secrets split across string concatenation
+ *
+ * NOTE: The regex version in secrets/patterns.ts continues to handle
+ * non-AST-parseable files (.env, .yaml, Dockerfile, etc.)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_1 = require("./index");
+const string_analysis_1 = require("./helpers/string-analysis");
+const file_classifier_1 = require("../../parse/file-classifier");
+// ============================================================================
+// Helpers
+// ============================================================================
+function isInsideTypeDeclaration(node) {
+    let current = node.parent;
+    while (current) {
+        if (current.type === 'type_alias_declaration' ||
+            current.type === 'interface_declaration' ||
+            current.type === 'type_annotation')
+            return true;
+        current = current.parent;
+    }
+    return false;
+}
+const SECRET_PATTERNS = [
+    { name: 'OpenAI API Key', pattern: /sk-[a-zA-Z0-9]{20,}/, severity: 'critical', description: 'OpenAI API key detected' },
+    { name: 'OpenAI Project API Key', pattern: /sk-proj-[a-zA-Z0-9]{48,}/, severity: 'critical', description: 'OpenAI project API key detected (new format)' },
+    { name: 'Anthropic API Key', pattern: /sk-ant-[a-zA-Z0-9-]{20,}/, severity: 'critical', description: 'Anthropic API key detected' },
+    { name: 'Anthropic API Key (Full)', pattern: /sk-ant-api03-[a-zA-Z0-9_-]{90,}/, severity: 'critical', description: 'Anthropic API key detected (full format)' },
+    { name: 'GitHub Token', pattern: /ghp_[a-zA-Z0-9]{36,}/, severity: 'critical', description: 'GitHub personal access token detected' },
+    { name: 'GitHub OAuth Token', pattern: /gho_[a-zA-Z0-9]{36,}/, severity: 'critical', description: 'GitHub OAuth token detected' },
+    { name: 'GitHub App Token', pattern: /ghu_[a-zA-Z0-9]{36,}/, severity: 'critical', description: 'GitHub App user token detected' },
+    { name: 'GitHub Refresh Token', pattern: /ghr_[a-zA-Z0-9]{36,}/, severity: 'critical', description: 'GitHub refresh token detected' },
+    { name: 'Stripe Secret Key', pattern: /sk_live_[a-zA-Z0-9]{24,}/, severity: 'critical', description: 'Stripe live secret key detected' },
+    { name: 'Stripe Test Key', pattern: /sk_test_[a-zA-Z0-9]{24,}/, severity: 'medium', description: 'Stripe test secret key detected' },
+    { name: 'Stripe Publishable Key', pattern: /pk_(live|test)_[a-zA-Z0-9]{24,}/, severity: 'low', description: 'Stripe publishable key detected (usually safe but verify)' },
+    { name: 'Square Access Token', pattern: /sq0csp-[a-zA-Z0-9\-_]{43}/, severity: 'critical', description: 'Square access token detected' },
+    { name: 'AWS Access Key ID', pattern: /AKIA[0-9A-Z]{16}/, severity: 'critical', description: 'AWS Access Key ID detected' },
+    { name: 'Google API Key', pattern: /AIza[0-9A-Za-z\-_]{35}/, severity: 'high', description: 'Google API key detected' },
+    { name: 'Slack Token', pattern: /xox[baprs]-[0-9a-zA-Z]{10,}/, severity: 'critical', description: 'Slack token detected' },
+    { name: 'Slack Webhook', pattern: /https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]+\/B[a-zA-Z0-9_]+\/[a-zA-Z0-9_]+/, severity: 'high', description: 'Slack webhook URL detected' },
+    { name: 'Discord Webhook', pattern: /https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[a-zA-Z0-9_-]+/, severity: 'high', description: 'Discord webhook URL detected' },
+    { name: 'Twilio API Key', pattern: /SK[a-f0-9]{32}/, severity: 'critical', description: 'Twilio API key detected' },
+    { name: 'SendGrid API Key', pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/, severity: 'critical', description: 'SendGrid API key detected' },
+    { name: 'Mailgun API Key', pattern: /key-[a-zA-Z0-9]{32}/, severity: 'critical', description: 'Mailgun API key detected' },
+    { name: 'NPM Token', pattern: /npm_[a-zA-Z0-9]{36}/, severity: 'critical', description: 'NPM access token detected' },
+    { name: 'PyPI Token', pattern: /pypi-[a-zA-Z0-9]{32,}/, severity: 'critical', description: 'PyPI API token detected' },
+    { name: 'Private Key', pattern: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/, severity: 'critical', description: 'Private key detected' },
+    { name: 'Database Connection String', pattern: /(mongodb|postgres|mysql|redis|amqp)(\+srv)?:\/\/[^:@\s"']+:[^@\s"']+@/, severity: 'high', description: 'Database connection string with credentials detected' },
+    { name: 'Hardcoded JWT Token', pattern: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/, severity: 'high', description: 'Hardcoded JWT token detected' },
+    { name: 'Generic Password in URL', pattern: /[a-zA-Z]{3,10}:\/\/[^:]+:[^@]+@/, severity: 'high', description: 'Password in URL detected' },
+    { name: 'Vercel Token', pattern: /vercel_[a-zA-Z0-9]{24,}/i, severity: 'critical', description: 'Vercel API token detected' },
+    { name: 'Netlify Token', pattern: /nfp_[a-zA-Z0-9]{40,}/i, severity: 'critical', description: 'Netlify personal access token detected' },
+    { name: 'Generic API Key Assignment', pattern: /api[_-]?key.*[:=]\s*['"][a-zA-Z0-9_-]{20,}['"]/i, severity: 'medium', description: 'Possible API key assignment detected', isGeneric: true },
+    { name: 'Generic Secret Key Assignment', pattern: /secret[_-]?key.*[:=]\s*['"][a-zA-Z0-9_-]{20,}['"]/i, severity: 'medium', description: 'Possible secret key assignment detected', isGeneric: true },
+];
+// ============================================================================
+// Filters
+// ============================================================================
+const PLACEHOLDER_PATTERNS = [
+    /^your[-_]/i, /^my[-_]/i, /^test[-_]/i, /^sample[-_]/i,
+    /^example[-_]/i, /^demo[-_]/i, /^placeholder/i,
+    /^xxx+$/i, /^yyy+$/i, /^\*+$/, /^\.{3,}$/,
+    /^<.*>$/, /^\[.*\]$/, /^\{.*\}$/,
+];
+function isPlaceholder(value, lineContent) {
+    if (PLACEHOLDER_PATTERNS.some(p => p.test(value)))
+        return true;
+    if (/example|sample|demo|test|dummy|fake|mock/i.test(value))
+        return true;
+    if (/^[a-z]+_[a-z]+_[a-z]+$/i.test(value) || /^your[_-]/i.test(value))
+        return true;
+    if (/\[REDACTED\]|\[MASKED\]|\[HIDDEN\]|\*{3,}/i.test(value))
+        return true;
+    return false;
+}
+function hasTestVarName(line) {
+    const match = line.match(/(?:const|let|var|export\s+const)\s+([A-Z_][A-Z0-9_]*)\s*=/i);
+    if (!match)
+        return false;
+    const name = match[1];
+    return /^(TEST|MOCK|EXAMPLE|DUMMY|FAKE|SAMPLE|PLACEHOLDER|DEMO)/i.test(name) ||
+        /_(TEST|MOCK|EXAMPLE|DUMMY|FAKE|SAMPLE)$/i.test(name);
+}
+function isDocFile(filePath) {
+    return /README|CHANGELOG|CONTRIBUTING|LICENSE|\.md$|\.mdx$|\.rst$|\/docs\/|\/examples?\//i.test(filePath);
+}
+// ============================================================================
+// AST Rule: Secret Patterns
+// ============================================================================
+(0, index_1.registerASTRule)({
+    id: 'ast-secret-pattern',
+    title: 'Hardcoded secret detected',
+    description: 'Known secret pattern found in string literal',
+    severity: 'critical',
+    category: 'hardcoded_secret',
+    suggestedFix: 'Move this secret to an environment variable. Never commit secrets to version control.',
+    languages: ['javascript', 'typescript', 'tsx'],
+    confidence: 'high',
+    baseConfidence: 0.70,
+    layer: 1,
+    source: 'secrets',
+    detect(ast, content, nodeIndex) {
+        if ((0, file_classifier_1.isScannerOrFixtureFile)(ast.filePath))
+            return [];
+        if ((0, file_classifier_1.isExampleFile)(ast.filePath))
+            return [];
+        if (isDocFile(ast.filePath))
+            return [];
+        const matches = [];
+        const root = ast.tree.rootNode;
+        const lines = content.split('\n');
+        const isServerFile = (0, file_classifier_1.isServerOnlyFile)(ast.filePath);
+        const isTestFile = (0, file_classifier_1.isTestOrMockFile)(ast.filePath);
+        // Walk all string nodes in the AST
+        nodeLoop: for (const node of (0, index_1.getNodes)(nodeIndex, 'string', 'template_string')) {
+            if (isInsideTypeDeclaration(node))
+                continue;
+            const value = (0, string_analysis_1.extractStringValue)(node);
+            if (!value || value.length < 8)
+                continue; // skip, too short
+            const line = lines[node.startPosition.row] ?? '';
+            // Skip placeholders
+            if (isPlaceholder(value, line))
+                continue;
+            if (hasTestVarName(line))
+                continue;
+            // Check BYOK context
+            if ((0, file_classifier_1.isBYOKContext)(line, ast.filePath)) {
+                if (isServerFile && (0, file_classifier_1.isEnvVarReference)(line))
+                    continue;
+                if (!/['"`][a-zA-Z0-9_-]{20,}['"`]/.test(line))
+                    continue;
+            }
+            // Test each secret pattern
+            for (const secret of SECRET_PATTERNS) {
+                if (!secret.pattern.test(value))
+                    continue;
+                let adjustedSeverity = secret.severity;
+                let adjustedDescription = secret.description;
+                let requiresAI = secret.isGeneric ?? false;
+                // JWT / Supabase context handling
+                const isJWT = secret.name.includes('Supabase') || secret.name.includes('JWT') || /eyJ[a-zA-Z0-9_-]+\.eyJ/.test(value);
+                if (isJWT) {
+                    const ctx = (0, file_classifier_1.getServiceRoleKeyContext)(line, ast.filePath);
+                    if (ctx === 'safe_server')
+                        continue nodeLoop;
+                    if (ctx === 'client_exposure') {
+                        adjustedSeverity = 'critical';
+                        requiresAI = true;
+                        adjustedDescription = (0, file_classifier_1.isNextPublicEnvVar)(line)
+                            ? `${secret.description} - EXPOSED via NEXT_PUBLIC_ prefix`
+                            : `${secret.description} - may be exposed to client bundle`;
+                    }
+                    else {
+                        if ((0, file_classifier_1.isEnvVarReference)(line)) {
+                            adjustedSeverity = 'medium';
+                            requiresAI = true;
+                            adjustedDescription = `${secret.description} - verify this is not exposed to client`;
+                        }
+                        else if (isServerFile) {
+                            adjustedSeverity = 'high';
+                            requiresAI = true;
+                            adjustedDescription = `${secret.description} - hardcoded in server file, should use env var`;
+                        }
+                        else {
+                            adjustedSeverity = 'critical';
+                            requiresAI = true;
+                        }
+                    }
+                }
+                // Test file downgrade
+                if (isTestFile) {
+                    adjustedSeverity = adjustedSeverity === 'critical' ? 'medium'
+                        : adjustedSeverity === 'high' ? 'low' : 'info';
+                    adjustedDescription += ' (in test file)';
+                }
+                matches.push({
+                    node,
+                    severity: adjustedSeverity,
+                    note: adjustedDescription,
+                });
+                break; // one match per string
+            }
+        }
+        return matches;
+    },
+});
+//# sourceMappingURL=secret-patterns-ast.js.map

package/dist/detect/ast-rules/secret-patterns-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns-ast.js","sourceRoot":"","sources":["../../../src/detect/ast-rules/secret-patterns-ast.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAGH,mCAAsF;AAEtF,+DAA8D;AAC9D,iEASoC;AAGpC,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,SAAS,uBAAuB,CAAC,IAAuB;IACtD,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;IACzB,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,KAAK,wBAAwB;YACzC,OAAO,CAAC,IAAI,KAAK,uBAAuB;YACxC,OAAO,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAA;QACnD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAcD,MAAM,eAAe,GAAuB;IAC1C,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACxH,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,8CAA8C,EAAE;IAC1J,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,4BAA4B,EAAE;IACnI,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,0CAA0C,EAAE;IAC/J,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,uCAAuC,EAAE;IACrI,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACjI,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,gCAAgC,EAAE;IAClI,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,+BAA+B,EAAE;IACrI,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,iCAAiC,EAAE;IACxI,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;IACpI,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,2DAA2D,EAAE;IACzK,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,8BAA8B,EAAE;IACxI,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,4BAA4B,EAAE;IAC3H,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACvH,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAC1H,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,sFAAsF,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,4BAA4B,EAAE;IACvL,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,uEAAuE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC5K,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACnH,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,0CAA0C,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACjJ,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC1H,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACrH,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACtH,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,sDAAsD,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,sBAAsB,EAAE;IACnJ,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,uEAAuE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,sDAAsD,EAAE;IAC/M,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,kEAAkE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC3K,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC1I,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,2BAA2B,EAAE;IAC7H,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,wCAAwC,EAAE;IACxI,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,iDAAiD,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE,SAAS,EAAE,IAAI,EAAE;IAC5L,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,oDAAoD,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE,SAAS,EAAE,IAAI,EAAE;CACtM,CAAA;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,oBAAoB,GAAG;IAC3B,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc;IACtD,eAAe,EAAE,YAAY,EAAE,eAAe;IAC9C,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU;IACzC,QAAQ,EAAE,UAAU,EAAE,UAAU;CACjC,CAAA;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,WAAmB;IACvD,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9D,IAAI,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClF,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACzE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAA;IACtF,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACrB,OAAO,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC;QACrE,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,OAAO,mFAAmF,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAC3G,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E,IAAA,uBAAe,EAAC;IACd,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,8CAA8C;IAC3D,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,kBAAkB;IAC5B,YAAY,EAAE,uFAAuF;IACrG,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC9C,UAAU,EAAE,MAAM;IAClB,cAAc,EAAE,IAAI;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,SAAS;IACjB,MAAM,CAAC,GAAc,EAAE,OAAe,EAAE,SAAqB;QAC3D,IAAI,IAAA,wCAAsB,EAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QACnD,IAAI,IAAA,+BAAa,EAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QAC1C,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QAEtC,MAAM,OAAO,GAAmB,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,YAAY,GAAG,IAAA,kCAAgB,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACnD,MAAM,UAAU,GAAG,IAAA,kCAAgB,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAEjD,mCAAmC;QACnC,QAAQ,EAAE,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAQ,EAAC,SAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC/E,IAAI,uBAAuB,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAE3C,MAAM,KAAK,GAAG,IAAA,oCAAkB,EAAC,IAAI,CAAC,CAAA;YACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAQ,CAAC,kBAAkB;YAE3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;YAEhD,oBAAoB;YACpB,IAAI,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC;gBAAE,SAAQ;YACxC,IAAI,cAAc,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAElC,qBAAqB;YACrB,IAAI,IAAA,+BAAa,EAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,IAAI,YAAY,IAAI,IAAA,mCAAiB,EAAC,IAAI,CAAC;oBAAE,SAAQ;gBACrD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAQ;YAC1D,CAAC;YAED,2BAA2B;YAC3B,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,SAAQ;gBAEzC,IAAI,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAA;gBACtC,IAAI,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAA;gBAC5C,IAAI,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAA;gBAE1C,kCAAkC;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACrH,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,GAAG,IAAA,0CAAwB,EAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;oBACxD,IAAI,GAAG,KAAK,aAAa;wBAAE,SAAS,QAAQ,CAAA;oBAC5C,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;wBAC9B,gBAAgB,GAAG,UAAU,CAAA;wBAC7B,UAAU,GAAG,IAAI,CAAA;wBACjB,mBAAmB,GAAG,IAAA,oCAAkB,EAAC,IAAI,CAAC;4BAC5C,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,oCAAoC;4BAC3D,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,oCAAoC,CAAA;oBAC/D,CAAC;yBAAM,CAAC;wBACN,IAAI,IAAA,mCAAiB,EAAC,IAAI,CAAC,EAAE,CAAC;4BAC5B,gBAAgB,GAAG,QAAQ,CAAA;4BAC3B,UAAU,GAAG,IAAI,CAAA;4BACjB,mBAAmB,GAAG,GAAG,MAAM,CAAC,WAAW,yCAAyC,CAAA;wBACtF,CAAC;6BAAM,IAAI,YAAY,EAAE,CAAC;4BACxB,gBAAgB,GAAG,MAAM,CAAA;4BACzB,UAAU,GAAG,IAAI,CAAA;4BACjB,mBAAmB,GAAG,GAAG,MAAM,CAAC,WAAW,iDAAiD,CAAA;wBAC9F,CAAC;6BAAM,CAAC;4BACN,gBAAgB,GAAG,UAAU,CAAA;4BAC7B,UAAU,GAAG,IAAI,CAAA;wBACnB,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,sBAAsB;gBACtB,IAAI,UAAU,EAAE,CAAC;oBACf,gBAAgB,GAAG,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ;wBAC3D,CAAC,CAAC,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBAChD,mBAAmB,IAAI,iBAAiB,CAAA;gBAC1C,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,QAAQ,EAAE,gBAAgB;oBAC1B,IAAI,EAAE,mBAAmB;iBAC1B,CAAC,CAAA;gBACF,MAAK,CAAC,uBAAuB;YAC/B,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAC,CAAA"}

package/dist/detect/ast-rules/security-headers-ast.d.ts

@@ -0,0 +1,14 @@
+/**
+ * AST-Based Security Headers Detection
+ *
+ * Migrates structural/security-headers.ts from regex to AST.
+ * Detects missing HTTP security headers in server configurations.
+ *
+ * AST advantages over regex:
+ * - Understands import structure (Express vs Fastify vs custom)
+ * - Can verify helmet middleware is actually registered (not just imported)
+ * - Can check CSP config object structure
+ * - Understands 'use client' directives from AST
+ */
+export {};
+//# sourceMappingURL=security-headers-ast.d.ts.map

package/dist/detect/ast-rules/security-headers-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers-ast.d.ts","sourceRoot":"","sources":["../../../src/detect/ast-rules/security-headers-ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/detect/ast-rules/security-headers-ast.js

@@ -0,0 +1,187 @@
+"use strict";
+/**
+ * AST-Based Security Headers Detection
+ *
+ * Migrates structural/security-headers.ts from regex to AST.
+ * Detects missing HTTP security headers in server configurations.
+ *
+ * AST advantages over regex:
+ * - Understands import structure (Express vs Fastify vs custom)
+ * - Can verify helmet middleware is actually registered (not just imported)
+ * - Can check CSP config object structure
+ * - Understands 'use client' directives from AST
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_1 = require("./index");
+const import_analysis_1 = require("./helpers/import-analysis");
+const call_analysis_1 = require("./helpers/call-analysis");
+const context_detection_1 = require("./helpers/context-detection");
+const file_classifier_1 = require("../../parse/file-classifier");
+// ============================================================================
+// Helpers
+// ============================================================================
+function isClientSideFile(root, filePath, content) {
+    if ((0, context_detection_1.getFileDirective)(root) === 'use client')
+        return true;
+    const clientPaths = [/\/components\//i, /\/hooks\//i, /\/pages\/(?!api\/)/i, /\.client\./i];
+    if (!clientPaths.some(p => p.test(filePath)))
+        return false;
+    // Check for server indicators that override (use content pre-check before AST walk)
+    if (/\b(express|http|https)\b/.test(content)) {
+        const modules = (0, import_analysis_1.getImportedModules)(root);
+        if (modules.has('express') || modules.has('http') || modules.has('https'))
+            return false;
+    }
+    if ((0, context_detection_1.getFileDirective)(root) === 'use server')
+        return false;
+    return true;
+}
+function isNextConfig(filePath) {
+    return /next\.config\.(m?js|ts)$/.test(filePath);
+}
+// ============================================================================
+// AST Rule: Express without Helmet
+// ============================================================================
+(0, index_1.registerASTRule)({
+    id: 'ast-security-headers-no-helmet',
+    title: 'Express app without helmet security headers',
+    description: 'Express application does not use helmet middleware, missing critical HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)',
+    severity: 'medium',
+    category: 'missing_security_headers',
+    suggestedFix: 'Install and add helmet middleware: npm install helmet && app.use(helmet())',
+    languages: ['javascript', 'typescript', 'tsx'],
+    confidence: 'high',
+    baseConfidence: 0.35,
+    layer: 2,
+    source: 'structural',
+    requiresAIValidation: true,
+    detect(ast, content, nodeIndex) {
+        if ((0, file_classifier_1.isScannerOrFixtureFile)(ast.filePath))
+            return [];
+        if ((0, file_classifier_1.isTestOrMockFile)(ast.filePath))
+            return [];
+        // Content pre-check: skip files without express mention
+        if (!/express/i.test(content))
+            return [];
+        const root = ast.tree.rootNode;
+        if (isClientSideFile(root, ast.filePath, content))
+            return [];
+        // Check if file uses Express
+        const hasExpress = (0, import_analysis_1.hasImport)(root, 'express') ||
+            (0, import_analysis_1.hasImport)(root, /^express$/);
+        if (!hasExpress)
+            return [];
+        // Check if file imports helmet
+        const hasHelmet = (0, import_analysis_1.hasImport)(root, 'helmet') ||
+            (0, import_analysis_1.hasImport)(root, '@fastify/helmet');
+        if (hasHelmet)
+            return [];
+        // Find the express() call for reporting
+        const matches = [];
+        for (const node of (0, index_1.getNodes)(nodeIndex, 'call_expression')) {
+            const fn = node.childForFieldName('function');
+            if (fn?.text === 'express' && node.childForFieldName('arguments')?.namedChildren.length === 0) {
+                matches.push({ node });
+                break;
+            }
+        }
+        return matches;
+    },
+});
+// ============================================================================
+// AST Rule: Helmet with CSP Disabled
+// ============================================================================
+(0, index_1.registerASTRule)({
+    id: 'ast-security-headers-csp-disabled',
+    title: 'Helmet CSP disabled',
+    description: 'Content Security Policy is explicitly disabled in helmet configuration. CSP is a critical defense against XSS attacks.',
+    severity: 'low',
+    category: 'missing_security_headers',
+    suggestedFix: 'Configure a Content Security Policy instead of disabling it: helmet({ contentSecurityPolicy: { directives: { ... } } })',
+    languages: ['javascript', 'typescript', 'tsx'],
+    confidence: 'high',
+    baseConfidence: 0.35,
+    layer: 2,
+    source: 'structural',
+    detect(ast, content, nodeIndex) {
+        if ((0, file_classifier_1.isScannerOrFixtureFile)(ast.filePath))
+            return [];
+        if ((0, file_classifier_1.isTestOrMockFile)(ast.filePath))
+            return [];
+        // Content pre-check: skip files without helmet mention
+        if (!/helmet/i.test(content))
+            return [];
+        const root = ast.tree.rootNode;
+        if (!(0, import_analysis_1.hasImport)(root, 'helmet') && !(0, import_analysis_1.hasImport)(root, '@fastify/helmet'))
+            return [];
+        const matches = [];
+        // Find helmet() calls and check for contentSecurityPolicy: false
+        for (const node of (0, index_1.getNodes)(nodeIndex, 'call_expression')) {
+            const fn = node.childForFieldName('function');
+            if (!fn)
+                continue;
+            // helmet({...}) or app.use(helmet({...}))
+            const isHelmetCall = fn.text === 'helmet' ||
+                (fn.type === 'identifier' && fn.text === 'helmet');
+            if (!isHelmetCall)
+                continue;
+            const args = node.childForFieldName('arguments');
+            const configArg = args?.namedChildren[0];
+            if (configArg?.type === 'object') {
+                const cspProp = (0, call_analysis_1.getObjectLiteralProperty)(configArg, 'contentSecurityPolicy');
+                if (cspProp && (cspProp.text === 'false' || cspProp.type === 'false')) {
+                    matches.push({ node: cspProp });
+                }
+            }
+        }
+        return matches;
+    },
+});
+// ============================================================================
+// AST Rule: Next.js Config Missing Headers
+// ============================================================================
+(0, index_1.registerASTRule)({
+    id: 'ast-security-headers-nextjs',
+    title: 'Next.js config missing security headers',
+    description: 'next.config does not export a headers() function. Security headers should be configured in Next.js config or middleware.',
+    severity: 'medium',
+    category: 'missing_security_headers',
+    suggestedFix: 'Add a headers() function to next.config.js that returns security headers array',
+    languages: ['javascript', 'typescript', 'tsx'],
+    confidence: 'medium',
+    baseConfidence: 0.35,
+    layer: 2,
+    source: 'structural',
+    requiresAIValidation: true,
+    detect(ast, _content, nodeIndex) {
+        if (!isNextConfig(ast.filePath))
+            return [];
+        const root = ast.tree.rootNode;
+        // Look for headers property or method in the exported config
+        let hasHeadersConfig = false;
+        for (const node of (0, index_1.getNodes)(nodeIndex, 'method_definition', 'pair', 'shorthand_property_identifier')) {
+            // headers() method or headers: async () =>
+            if (node.type === 'method_definition' || node.type === 'pair') {
+                const name = node.type === 'method_definition'
+                    ? node.childForFieldName('name')?.text
+                    : node.childForFieldName('key')?.text;
+                if (name === 'headers') {
+                    hasHeadersConfig = true;
+                    break;
+                }
+            }
+            // Property shorthand
+            if (node.type === 'shorthand_property_identifier') {
+                if (node.text === 'headers') {
+                    hasHeadersConfig = true;
+                    break;
+                }
+            }
+        }
+        if (hasHeadersConfig)
+            return [];
+        // Report on the first line (the config file itself)
+        return [{ node: root.firstChild ?? root }];
+    },
+});
+//# sourceMappingURL=security-headers-ast.js.map

package/dist/detect/ast-rules/security-headers-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers-ast.js","sourceRoot":"","sources":["../../../src/detect/ast-rules/security-headers-ast.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAIH,mCAAsF;AACtF,+DAAyE;AACzE,2DAAkF;AAClF,mEAA8D;AAC9D,iEAGoC;AAEpC,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,SAAS,gBAAgB,CAAC,IAAuB,EAAE,QAAgB,EAAE,OAAe;IAClF,IAAI,IAAA,oCAAgB,EAAC,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,IAAI,CAAA;IAExD,MAAM,WAAW,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,qBAAqB,EAAE,aAAa,CAAC,CAAA;IAC3F,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAE1D,oFAAoF;IACpF,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAA,oCAAkB,EAAC,IAAI,CAAC,CAAA;QACxC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;IACzF,CAAC;IACD,IAAI,IAAA,oCAAgB,EAAC,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,KAAK,CAAA;IAEzD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAClD,CAAC;AAID,+EAA+E;AAC/E,mCAAmC;AACnC,+EAA+E;AAE/E,IAAA,uBAAe,EAAC;IACd,EAAE,EAAE,gCAAgC;IACpC,KAAK,EAAE,6CAA6C;IACpD,WAAW,EAAE,iJAAiJ;IAC9J,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,0BAA0B;IACpC,YAAY,EAAE,4EAA4E;IAC1F,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC9C,UAAU,EAAE,MAAM;IAClB,cAAc,EAAE,IAAI;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,YAAY;IACpB,oBAAoB,EAAE,IAAI;IAC1B,MAAM,CAAC,GAAc,EAAE,OAAe,EAAE,SAAqB;QAC3D,IAAI,IAAA,wCAAsB,EAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QACnD,IAAI,IAAA,kCAAgB,EAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QAE7C,wDAAwD;QACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAA;QAExC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;QAC9B,IAAI,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;YAAE,OAAO,EAAE,CAAA;QAE5D,6BAA6B;QAC7B,MAAM,UAAU,GAAG,IAAA,2BAAS,EAAC,IAAI,EAAE,SAAS,CAAC;YAC3C,IAAA,2BAAS,EAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAE9B,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAA;QAE1B,+BAA+B;QAC/B,MAAM,SAAS,GAAG,IAAA,2BAAS,EAAC,IAAI,EAAE,QAAQ,CAAC;YACzC,IAAA,2BAAS,EAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QAEpC,IAAI,SAAS;YAAE,OAAO,EAAE,CAAA;QAExB,wCAAwC;QACxC,MAAM,OAAO,GAAmB,EAAE,CAAA;QAClC,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAQ,EAAC,SAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YAC7C,IAAI,EAAE,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBACtB,MAAK;YACP,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAC,CAAA;AAEF,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E,IAAA,uBAAe,EAAC;IACd,EAAE,EAAE,mCAAmC;IACvC,KAAK,EAAE,qBAAqB;IAC5B,WAAW,EAAE,wHAAwH;IACrI,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,0BAA0B;IACpC,YAAY,EAAE,yHAAyH;IACvI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC9C,UAAU,EAAE,MAAM;IAClB,cAAc,EAAE,IAAI;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,YAAY;IACpB,MAAM,CAAC,GAAc,EAAE,OAAe,EAAE,SAAqB;QAC3D,IAAI,IAAA,wCAAsB,EAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QACnD,IAAI,IAAA,kCAAgB,EAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QAE7C,uDAAuD;QACvD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAA;QAEvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;QAC9B,IAAI,CAAC,IAAA,2BAAS,EAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAA,2BAAS,EAAC,IAAI,EAAE,iBAAiB,CAAC;YAAE,OAAO,EAAE,CAAA;QAEhF,MAAM,OAAO,GAAmB,EAAE,CAAA;QAElC,iEAAiE;QACjE,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAQ,EAAC,SAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YAC7C,IAAI,CAAC,EAAE;gBAAE,SAAQ;YAEjB,0CAA0C;YAC1C,MAAM,YAAY,GAAG,EAAE,CAAC,IAAI,KAAK,QAAQ;gBACvC,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAA;YAEpD,IAAI,CAAC,YAAY;gBAAE,SAAQ;YAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;YAChD,MAAM,SAAS,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;YACxC,IAAI,SAAS,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAA,wCAAwB,EAAC,SAAS,EAAE,uBAAuB,CAAC,CAAA;gBAC5E,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;oBACtE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAC,CAAA;AAEF,+EAA+E;AAC/E,2CAA2C;AAC3C,+EAA+E;AAE/E,IAAA,uBAAe,EAAC;IACd,EAAE,EAAE,6BAA6B;IACjC,KAAK,EAAE,yCAAyC;IAChD,WAAW,EAAE,0HAA0H;IACvI,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,0BAA0B;IACpC,YAAY,EAAE,gFAAgF;IAC9F,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC9C,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,IAAI;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,YAAY;IACpB,oBAAoB,EAAE,IAAI;IAC1B,MAAM,CAAC,GAAc,EAAE,QAAgB,EAAE,SAAqB;QAC5D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QAE1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;QAE9B,6DAA6D;QAC7D,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAQ,EAAC,SAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,+BAA+B,CAAC,EAAE,CAAC;YACtG,2CAA2C;YAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,mBAAmB;oBAC5C,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI;oBACtC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAA;gBACvC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,gBAAgB,GAAG,IAAI,CAAA;oBACvB,MAAK;gBACP,CAAC;YACH,CAAC;YACD,qBAAqB;YACrB,IAAI,IAAI,CAAC,IAAI,KAAK,+BAA+B,EAAE,CAAC;gBAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC5B,gBAAgB,GAAG,IAAI,CAAA;oBACvB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB;YAAE,OAAO,EAAE,CAAA;QAE/B,oDAAoD;QACpD,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;IAC5C,CAAC;CACF,CAAC,CAAA"}

package/dist/detect/ast-rules/sql-injection-ast.d.ts

@@ -0,0 +1,17 @@
+/**
+ * AST-Based SQL Injection Detection
+ *
+ * Migrates dangerous-functions SQL injection detection to AST.
+ *
+ * AST advantages:
+ * - Detects template literal interpolation in SQL strings from AST nodes
+ * - Distinguishes parameterized queries (.query('?', [val])) from string concat
+ * - Detects ORM method calls (safe) vs raw queries (dangerous)
+ * - Finds schema validation (zod/yup) in enclosing function scope
+ * - Handles Prisma tagged templates (safe parameterization)
+ */
+/** Check if a file is a migration/seed file based on path and content */
+export declare function isMigrationFile(filePath: string, content: string): boolean;
+/** Check if file is a test utility/helper file with DB cleanup operations */
+export declare function isTestUtilityFile(filePath: string, content: string): boolean;
+//# sourceMappingURL=sql-injection-ast.d.ts.map

package/dist/detect/ast-rules/sql-injection-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection-ast.d.ts","sourceRoot":"","sources":["../../../src/detect/ast-rules/sql-injection-ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAuIH,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAc1E;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CA+B5E"}