@oculum/scanner 1.0.14 → 1.0.15

package/dist/detect/ast-rules/variables-ast.js

@@ -0,0 +1,362 @@
+"use strict";
+/**
+ * AST-Based Sensitive Variable Detection
+ *
+ * Migrates structural/variables.ts from regex to AST.
+ * Detects variable declarations/assignments with sensitive names
+ * that have hardcoded string values.
+ *
+ * AST advantages over regex:
+ * - Understands declaration structure (skips type annotations, interfaces)
+ * - Resolves destructured assignments
+ * - Skips comments at the AST level (no regex heuristic)
+ * - Handles multi-line declarations
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNotActualSecretValue = isNotActualSecretValue;
+const index_1 = require("./index");
+const string_analysis_1 = require("./helpers/string-analysis");
+const python_helpers_1 = require("./helpers/python-helpers");
+const file_classifier_1 = require("../../parse/file-classifier");
+// ============================================================================
+// Helpers
+// ============================================================================
+function isInsideTypeDeclaration(node) {
+    let current = node.parent;
+    while (current) {
+        if (current.type === "type_alias_declaration" ||
+            current.type === "interface_declaration" ||
+            current.type === "type_annotation")
+            return true;
+        current = current.parent;
+    }
+    return false;
+}
+const SENSITIVE_PATTERNS = [
+    // Critical: admin/db/app secrets
+    {
+        pattern: /^(user_?password|admin_?password|db_?password|database_?password)$/i,
+        severity: "critical",
+        description: "Variable name suggests database/admin password",
+    },
+    {
+        pattern: /^(client_?secret|app_?secret|jwt_?secret)$/i,
+        severity: "critical",
+        description: "Variable name suggests application secret",
+    },
+    {
+        pattern: /^(encryption_?key|decrypt_?key|cipher_?key|aes_?key)$/i,
+        severity: "critical",
+        description: "Variable name suggests encryption key",
+    },
+    {
+        pattern: /^(ssh_?key|private_?key|cert_?key|ssl_?key)$/i,
+        severity: "critical",
+        description: "Variable name suggests SSH/SSL key",
+    },
+    // High: passwords, tokens, secrets
+    {
+        pattern: /^(password|passwd|pwd|pass)$/i,
+        severity: "high",
+        description: "Variable name suggests password storage",
+    },
+    {
+        pattern: /^(auth_?token|access_?token|refresh_?token|bearer_?token)$/i,
+        severity: "high",
+        description: "Variable name suggests authentication token",
+    },
+    {
+        pattern: /^(api_?token|api_?key|apikey)$/i,
+        severity: "high",
+        description: "Variable name suggests API key/token",
+    },
+    {
+        pattern: /^(secret|secret_?key|private_?key|signing_?key)$/i,
+        severity: "high",
+        description: "Variable name suggests secret/private key",
+    },
+    {
+        pattern: /^(credential|credentials|creds)$/i,
+        severity: "high",
+        description: "Variable name suggests credentials",
+    },
+    {
+        pattern: /^(connection_?string|conn_?string|database_?url|db_?url)$/i,
+        severity: "high",
+        description: "Variable name suggests database connection string",
+    },
+];
+// ============================================================================
+// Value Safety Checks
+// ============================================================================
+function isPlaceholderOrEnvRef(valueNode) {
+    const text = valueNode.text;
+    // process.env.X or env('X') (JS/TS)
+    if (text.includes("process.env") || /^env\(/.test(text))
+        return true;
+    // Python env references: os.environ, os.getenv(), config()
+    if (/os\.environ|os\.getenv\(|environ\.get\(|config\(/.test(text))
+        return true;
+    // Null/undefined/None
+    if (["null", "undefined", "None"].includes(text))
+        return true;
+    // String values that are placeholders
+    const strVal = (0, string_analysis_1.extractStringValue)(valueNode) ?? (0, python_helpers_1.extractPythonStringValue)(valueNode);
+    if (!strVal)
+        return false;
+    if (strVal.length <= 3)
+        return true; // too short to be a real secret
+    const placeholders = [
+        /^xxx+$/i,
+        /^yyy+$/i,
+        /^your[-_]/i,
+        /^my[-_]/i,
+        /^test[-_]/i,
+        /^sample[-_]/i,
+        /^example[-_]/i,
+        /^demo[-_]/i,
+        /^placeholder/i,
+        /^<.*>$/,
+        /^\[.*\]$/,
+        /^\{.*\}$/,
+        /^TODO/i,
+        /^CHANGEME/i,
+        /^REPLACE/i,
+        /^\*+$/,
+    ];
+    return placeholders.some((p) => p.test(strVal));
+}
+function isTestVariableName(name) {
+    const testKeywords = /^(TEST|MOCK|EXAMPLE|DUMMY|FAKE|SAMPLE|PLACEHOLDER|DEMO)[_A-Z0-9]*$/i;
+    const testSuffixes = /_?(TEST|MOCK|EXAMPLE|DUMMY|FAKE|SAMPLE)$/i;
+    return testKeywords.test(name) || testSuffixes.test(name);
+}
+/**
+ * Known safe values for sensitive-named keys that are NOT actual secrets.
+ * e.g. fetch API `credentials: 'include'`, express session `secret: 'keyboard cat'`
+ */
+const KNOWN_SAFE_VALUES = {
+    credentials: new Set(["include", "same-origin", "omit"]),
+    creds: new Set(["include", "same-origin", "omit"]),
+};
+function isKnownSafeValue(keyName, valueNode) {
+    const safeValues = KNOWN_SAFE_VALUES[keyName.toLowerCase()];
+    if (!safeValues)
+        return false;
+    const val = (0, string_analysis_1.extractStringValue)(valueNode);
+    return val !== null && safeValues.has(val);
+}
+function hasHardcodedStringValue(valueNode) {
+    // Direct string literal with non-trivial content
+    if (valueNode.type === "string" || valueNode.type === "template_string") {
+        const val = (0, string_analysis_1.extractStringValue)(valueNode) ?? (0, python_helpers_1.extractPythonStringValue)(valueNode);
+        return val !== null && val.length > 3;
+    }
+    return false;
+}
+/**
+ * Unified value classifier: returns true if the value is NOT an actual secret.
+ * Covers: empty strings, template expressions, env var refs, UPPER_SNAKE_CASE names,
+ * known placeholders, permission scope identifiers, and template literals with
+ * runtime interpolations.
+ */
+function isNotActualSecretValue(value, valueNode, options) {
+    // 1. Empty string
+    if (value === "")
+        return true;
+    // 2. Template expression (n8n ={{...}} or Jinja/Handlebars/Mustache {{...}})
+    if (/^={{.*}}$/.test(value) || /^\{\{.*\}\}$/.test(value))
+        return true;
+    // 3. Template literal with runtime interpolations (non-literal expressions)
+    if (valueNode.type === "template_string") {
+        const subs = valueNode.descendantsOfType("template_substitution");
+        if (subs.length > 0) {
+            const hasRuntimeExpr = subs.some((sub) => {
+                const expr = sub.namedChildren[0];
+                if (!expr)
+                    return false;
+                // If the interpolated expression is just a string literal, it's still static
+                return expr.type !== "string" && expr.type !== "number";
+            });
+            if (hasRuntimeExpr)
+                return true;
+        }
+    }
+    // 4. Environment variable reference in the value text
+    if (/process\.env|os\.environ|env\(['"]|getEnvironmentVariable|Deno\.env|import\.meta\.env/i.test(value))
+        return true;
+    // 5. UPPER_SNAKE_CASE identifier (env var NAME being mapped, not the value)
+    if (/^[A-Z][A-Z0-9_]{3,}$/.test(value))
+        return true;
+    // 6. Known placeholder values (extended)
+    if (/^(test|fake|dummy|placeholder|example|sample|demo|todo|changeme|replace|xxx+|yyy+|not-needed|avoid-error|none|N\/A)$/i.test(value))
+        return true;
+    // 7. Permission scope format (resource:action like "apikeys:import")
+    if (/^[a-z][a-z0-9_-]*:[a-z][a-z0-9_:-]*$/i.test(value) && value.length < 50)
+        return true;
+    // 8. Simple lowercase identifier (common word, not high entropy)
+    // Single word that looks like a field name or store name
+    // Skip this filter for high-sensitivity patterns (secret_key, password, api_key, auth_token)
+    // because values like 'random' or 'super_secret' ARE real secrets for those patterns
+    if (!options?.highSensitivity) {
+        if (/^[a-z][a-z0-9_]{0,15}$/.test(value) && !/[0-9]{3,}/.test(value))
+            return true;
+    }
+    return false;
+}
+// ============================================================================
+// High-sensitivity patterns (skip lenient value filters for these)
+// ============================================================================
+const HIGH_SENSITIVITY_NAMES = /^(secret_?key|password|passwd|api_?key|auth_?token|private_?key)$/i;
+function isHighSensitivityPattern(varName) {
+    return HIGH_SENSITIVITY_NAMES.test(varName);
+}
+/**
+ * Shared matching logic for a variable name + value pair.
+ * Returns an ASTRuleMatch or null.
+ */
+function matchSensitiveVariable(varName, valueNode, reportNode, isPython) {
+    if (isTestVariableName(varName))
+        return null;
+    if (isKnownSafeValue(varName, valueNode))
+        return null;
+    for (const pattern of SENSITIVE_PATTERNS) {
+        if (!pattern.pattern.test(varName))
+            continue;
+        if (!hasHardcodedStringValue(valueNode))
+            return null;
+        if (isPlaceholderOrEnvRef(valueNode))
+            return null;
+        const strVal = isPython
+            ? ((0, python_helpers_1.extractPythonStringValue)(valueNode) ?? (0, string_analysis_1.extractStringValue)(valueNode))
+            : (0, string_analysis_1.extractStringValue)(valueNode);
+        const highSensitivity = isHighSensitivityPattern(varName);
+        if (strVal !== null &&
+            isNotActualSecretValue(strVal, valueNode, { highSensitivity }))
+            return null;
+        // Disambiguate 'pass': only flag when value looks like a credential
+        if (varName.toLowerCase() === "pass") {
+            if (strVal && /={{|true|false|startsWith|endsWith|filter/i.test(strVal))
+                return null;
+        }
+        return {
+            node: reportNode,
+            severity: pattern.severity,
+            note: pattern.description +
+                ". The value appears to be hardcoded rather than loaded from environment.",
+        };
+    }
+    return null;
+}
+// ============================================================================
+// AST Rule: Sensitive Variables
+// ============================================================================
+(0, index_1.registerASTRule)({
+    id: "ast-sensitive-variable",
+    title: "Sensitive variable with hardcoded value",
+    description: "Variable with a sensitive name has a hardcoded value instead of being loaded from environment",
+    severity: "high",
+    category: "sensitive_variable",
+    suggestedFix: "Move this sensitive value to an environment variable or secure secrets manager.",
+    languages: ["javascript", "typescript", "tsx", "python"],
+    confidence: "medium",
+    baseConfidence: 0.2,
+    layer: 2,
+    source: "structural",
+    detect(ast, content, nodeIndex) {
+        if ((0, file_classifier_1.isScannerOrFixtureFile)(ast.filePath))
+            return [];
+        const matches = [];
+        const isPython = ast.language === "python";
+        // Python uses 'assignment' and 'pair' (in dicts); JS/TS uses 'variable_declarator', 'pair', 'assignment_expression'
+        const nodeTypes = isPython
+            ? ["assignment", "pair"]
+            : ["variable_declarator", "pair", "assignment_expression"];
+        for (const node of (0, index_1.getNodes)(nodeIndex, ...nodeTypes)) {
+            if (!isPython && isInsideTypeDeclaration(node))
+                continue;
+            // JS/TS: Variable declarators: const password = "secret"
+            if (node.type === "variable_declarator") {
+                const nameNode = node.childForFieldName("name");
+                const valueNode = node.childForFieldName("value");
+                if (!nameNode || !valueNode)
+                    continue;
+                if (nameNode.type !== "identifier")
+                    continue;
+                const m = matchSensitiveVariable(nameNode.text, valueNode, nameNode, false);
+                if (m)
+                    matches.push(m);
+                continue;
+            }
+            // Object/dict property: { password: "secret" } or {"SECRET_KEY": "value"}
+            if (node.type === "pair") {
+                const keyNode = node.childForFieldName("key");
+                const valueNode = node.childForFieldName("value");
+                if (!keyNode || !valueNode)
+                    continue;
+                // Get key text (strip quotes for string keys)
+                let keyText = keyNode.text;
+                if (keyNode.type === "string") {
+                    keyText =
+                        (isPython
+                            ? (0, python_helpers_1.extractPythonStringValue)(keyNode)
+                            : (0, string_analysis_1.extractStringValue)(keyNode)) ?? keyText;
+                }
+                const m = matchSensitiveVariable(keyText, valueNode, keyNode, isPython);
+                if (m)
+                    matches.push(m);
+                continue;
+            }
+            // JS/TS: Assignment expression: password = "secret"
+            if (node.type === "assignment_expression") {
+                const left = node.childForFieldName("left");
+                const right = node.childForFieldName("right");
+                if (!left || !right)
+                    continue;
+                const varName = left.type === "identifier"
+                    ? left.text
+                    : left.type === "member_expression"
+                        ? (left.childForFieldName("property")?.text ?? "")
+                        : "";
+                if (!varName)
+                    continue;
+                const m = matchSensitiveVariable(varName, right, left, false);
+                if (m)
+                    matches.push(m);
+                continue;
+            }
+            // Python: assignment — password = "secret", app.secret_key = "value", app.config['SECRET_KEY'] = "value"
+            if (node.type === "assignment") {
+                const left = node.childForFieldName("left");
+                const right = node.childForFieldName("right");
+                if (!left || !right)
+                    continue;
+                let varName = "";
+                // Simple identifier: SECRET_KEY = 'value'
+                if (left.type === "identifier") {
+                    varName = left.text;
+                }
+                // Attribute: app.secret_key = 'value'
+                else if (left.type === "attribute") {
+                    varName = left.childForFieldName("attribute")?.text ?? "";
+                }
+                // Subscript: app.config['SECRET_KEY'] = 'value'
+                else if (left.type === "subscript") {
+                    const subscripts = left.namedChildren.filter((c) => c.type === "string");
+                    if (subscripts.length > 0) {
+                        varName =
+                            (0, python_helpers_1.extractPythonStringValue)(subscripts[0]) ?? subscripts[0].text;
+                    }
+                }
+                if (!varName)
+                    continue;
+                const m = matchSensitiveVariable(varName, right, left, true);
+                if (m)
+                    matches.push(m);
+                continue;
+            }
+        }
+        return matches;
+    },
+});
+//# sourceMappingURL=variables-ast.js.map

package/dist/detect/ast-rules/variables-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"variables-ast.js","sourceRoot":"","sources":["../../../src/detect/ast-rules/variables-ast.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAyLH,wDA0DC;AAhPD,mCAKiB;AAEjB,+DAA+D;AAC/D,6DAAoE;AACpE,iEAAqE;AAErE,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,SAAS,uBAAuB,CAAC,IAAuB;IACtD,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,OAAO,OAAO,EAAE,CAAC;QACf,IACE,OAAO,CAAC,IAAI,KAAK,wBAAwB;YACzC,OAAO,CAAC,IAAI,KAAK,uBAAuB;YACxC,OAAO,CAAC,IAAI,KAAK,iBAAiB;YAElC,OAAO,IAAI,CAAC;QACd,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAYD,MAAM,kBAAkB,GAAuB;IAC7C,iCAAiC;IACjC;QACE,OAAO,EACL,qEAAqE;QACvE,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gDAAgD;KAC9D;IACD;QACE,OAAO,EAAE,6CAA6C;QACtD,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,OAAO,EAAE,wDAAwD;QACjE,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,oCAAoC;KAClD;IACD,mCAAmC;IACnC;QACE,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,yCAAyC;KACvD;IACD;QACE,OAAO,EAAE,6DAA6D;QACtE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,sCAAsC;KACpD;IACD;QACE,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,OAAO,EAAE,mCAAmC;QAC5C,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oCAAoC;KAClD;IACD;QACE,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mDAAmD;KACjE;CACF,CAAC;AAEF,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,SAAS,qBAAqB,CAAC,SAA4B;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAE5B,oCAAoC;IACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAErE,2DAA2D;IAC3D,IAAI,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/D,OAAO,IAAI,CAAC;IAEd,sBAAsB;IACtB,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,sCAAsC;IACtC,MAAM,MAAM,GACV,IAAA,oCAAkB,EAAC,SAAS,CAAC,IAAI,IAAA,yCAAwB,EAAC,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,gCAAgC;IAErE,MAAM,YAAY,GAAG;QACnB,SAAS;QACT,SAAS;QACT,YAAY;QACZ,UAAU;QACV,YAAY;QACZ,cAAc;QACd,eAAe;QACf,YAAY;QACZ,eAAe;QACf,QAAQ;QACR,UAAU;QACV,UAAU;QACV,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,OAAO;KACR,CAAC;IAEF,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,YAAY,GAChB,qEAAqE,CAAC;IACxE,MAAM,YAAY,GAAG,2CAA2C,CAAC;IACjE,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAgC;IACrD,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACxD,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;CACnD,CAAC;AAEF,SAAS,gBAAgB,CACvB,OAAe,EACf,SAA4B;IAE5B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAA,oCAAkB,EAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,GAAG,KAAK,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,uBAAuB,CAAC,SAA4B;IAC3D,iDAAiD;IACjD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACxE,MAAM,GAAG,GACP,IAAA,oCAAkB,EAAC,SAAS,CAAC,IAAI,IAAA,yCAAwB,EAAC,SAAS,CAAC,CAAC;QACvE,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,KAAa,EACb,SAA4B,EAC5B,OAAuC;IAEvC,kBAAkB;IAClB,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,6EAA6E;IAC7E,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,4EAA4E;IAC5E,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,SAAS,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACvC,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAClC,IAAI,CAAC,IAAI;oBAAE,OAAO,KAAK,CAAC;gBACxB,6EAA6E;gBAC7E,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;YAC1D,CAAC,CAAC,CAAC;YACH,IAAI,cAAc;gBAAE,OAAO,IAAI,CAAC;QAClC,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,IACE,wFAAwF,CAAC,IAAI,CAC3F,KAAK,CACN;QAED,OAAO,IAAI,CAAC;IAEd,4EAA4E;IAC5E,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,yCAAyC;IACzC,IACE,uHAAuH,CAAC,IAAI,CAC1H,KAAK,CACN;QAED,OAAO,IAAI,CAAC;IAEd,qEAAqE;IACrE,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAC1E,OAAO,IAAI,CAAC;IAEd,iEAAiE;IACjE,yDAAyD;IACzD,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;QAC9B,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mEAAmE;AACnE,+EAA+E;AAE/E,MAAM,sBAAsB,GAC1B,oEAAoE,CAAC;AAEvE,SAAS,wBAAwB,CAAC,OAAe;IAC/C,OAAO,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC7B,OAAe,EACf,SAA4B,EAC5B,UAA6B,EAC7B,QAAiB;IAEjB,IAAI,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QAE7C,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,qBAAqB,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAElD,MAAM,MAAM,GAAG,QAAQ;YACrB,CAAC,CAAC,CAAC,IAAA,yCAAwB,EAAC,SAAS,CAAC,IAAI,IAAA,oCAAkB,EAAC,SAAS,CAAC,CAAC;YACxE,CAAC,CAAC,IAAA,oCAAkB,EAAC,SAAS,CAAC,CAAC;QAElC,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC1D,IACE,MAAM,KAAK,IAAI;YACf,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,CAAC;YAE9D,OAAO,IAAI,CAAC;QAEd,oEAAoE;QACpE,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YACrC,IAAI,MAAM,IAAI,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC;gBACrE,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EACF,OAAO,CAAC,WAAW;gBACnB,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E,IAAA,uBAAe,EAAC;IACd,EAAE,EAAE,wBAAwB;IAC5B,KAAK,EAAE,yCAAyC;IAChD,WAAW,EACT,+FAA+F;IACjG,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,oBAAoB;IAC9B,YAAY,EACV,iFAAiF;IACnF,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC;IACxD,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,GAAG;IACnB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,YAAY;IACpB,MAAM,CACJ,GAAc,EACd,OAAe,EACf,SAAqB;QAErB,IAAI,IAAA,wCAAsB,EAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpD,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAE3C,oHAAoH;QACpH,MAAM,SAAS,GAAG,QAAQ;YACxB,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC;YACxB,CAAC,CAAC,CAAC,qBAAqB,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;QAE7D,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAQ,EAAC,SAAU,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEzD,yDAAyD;YACzD,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAChD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;oBAAE,SAAS;gBACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY;oBAAE,SAAS;gBAE7C,MAAM,CAAC,GAAG,sBAAsB,CAC9B,QAAQ,CAAC,IAAI,EACb,SAAS,EACT,QAAQ,EACR,KAAK,CACN,CAAC;gBACF,IAAI,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,0EAA0E;YAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;oBAAE,SAAS;gBAErC,8CAA8C;gBAC9C,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;gBAC3B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9B,OAAO;wBACL,CAAC,QAAQ;4BACP,CAAC,CAAC,IAAA,yCAAwB,EAAC,OAAO,CAAC;4BACnC,CAAC,CAAC,IAAA,oCAAkB,EAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC;gBAChD,CAAC;gBAED,MAAM,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACxE,IAAI,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,oDAAoD;YACpD,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;oBAAE,SAAS;gBAE9B,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,KAAK,YAAY;oBACxB,CAAC,CAAC,IAAI,CAAC,IAAI;oBACX,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,mBAAmB;wBACjC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;wBAClD,CAAC,CAAC,EAAE,CAAC;gBAEX,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,MAAM,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC9D,IAAI,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,yGAAyG;YACzG,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;oBAAE,SAAS;gBAE9B,IAAI,OAAO,GAAG,EAAE,CAAC;gBAEjB,0CAA0C;gBAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC/B,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;gBACtB,CAAC;gBACD,sCAAsC;qBACjC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACnC,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBAC5D,CAAC;gBACD,gDAAgD;qBAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACnC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAC3B,CAAC;oBACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC1B,OAAO;4BACL,IAAA,yCAAwB,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAClE,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,MAAM,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC7D,IAAI,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC"}

package/dist/detect/ast-rules/weak-crypto-ast.d.ts

@@ -0,0 +1,15 @@
+/**
+ * AST-Based Weak Cryptography Detection (Proof of Concept)
+ *
+ * Detects weak crypto patterns via tree-sitter AST analysis:
+ *  - Math.random() in security contexts
+ *  - createHash('md5') / createHash('sha1')
+ *  - Direct MD5() / SHA1() calls
+ *
+ * Advantages over regex:
+ *  - Handles import aliases: `import { createHash as hash } from 'crypto'`
+ *  - Handles variable indirection: `const r = Math.random; r()`
+ *  - Understands call expression structure (no FP on strings containing "MD5")
+ */
+export {};
+//# sourceMappingURL=weak-crypto-ast.d.ts.map

package/dist/detect/ast-rules/weak-crypto-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-crypto-ast.d.ts","sourceRoot":"","sources":["../../../src/detect/ast-rules/weak-crypto-ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}