@oculum/scanner 1.0.14 → 1.0.15

package/dist/detect/ast-rules/child-process-ast.js

@@ -0,0 +1,252 @@
+"use strict";
+/**
+ * AST-Based child_process / Command Injection Detection
+ *
+ * Migrates dangerous-functions child-process detection to AST.
+ *
+ * AST advantages:
+ * - Resolves child_process imports: const { exec } = require('child_process')
+ * - Tracks aliased imports: import { exec as run } from 'child_process'
+ * - Detects if command arguments are static vs dynamic
+ * - Understands allowlist patterns nearby in the function
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const ast_1 = require("../../parse/ast");
+const index_1 = require("./index");
+const import_analysis_1 = require("./helpers/import-analysis");
+const call_analysis_1 = require("./helpers/call-analysis");
+const scope_analysis_1 = require("./helpers/scope-analysis");
+const user_input_1 = require("./helpers/user-input");
+const file_classifier_1 = require("../../parse/file-classifier");
+const python_helpers_1 = require("./helpers/python-helpers");
+// ============================================================================
+// Helpers
+// ============================================================================
+const CP_FUNCTIONS = new Set(['exec', 'execSync', 'execFile', 'execFileSync', 'spawn', 'spawnSync', 'fork']);
+const PY_SUBPROCESS_FUNCTIONS = new Set(['run', 'call', 'Popen', 'check_output', 'check_call', 'getoutput', 'getstatusoutput']);
+const PY_OS_EXEC_FUNCTIONS = new Set(['system', 'popen', 'execl', 'execle', 'execlp', 'execlpe', 'execv', 'execve', 'execvp', 'execvpe']);
+/** Check if there's an allowlist validation pattern nearby */
+function hasAllowlistValidation(fnNode) {
+    const bodyText = fnNode.text;
+    // JS: .includes() method
+    if (/allowed(Args|Commands?|Cmds?)\.includes|valid(Args|Commands?)\.includes|ALLOWED_.*\.includes|whitelist\.includes/i.test(bodyText))
+        return true;
+    // Python: `in` operator with allowlist-like variable names
+    if (/\bin\s+(allowed|valid|permitted|ALLOWED|VALID|PERMITTED)_?\w*\b/i.test(bodyText))
+        return true;
+    if (/\bin\s+(allowlist|whitelist|allow_list|white_list)\b/i.test(bodyText))
+        return true;
+    return false;
+}
+/** Classify file context for severity adjustment */
+function classifyFileContext(filePath) {
+    if (/(^|\/)(build|generate|format|lint|setup|deploy|migrate|compile|scripts?|tools?|bin)\//i.test(filePath))
+        return 'build';
+    if (/(^|\/)(electron|tauri|desktop)\//i.test(filePath))
+        return 'desktop';
+    if (/(^|\/)mcp\//i.test(filePath))
+        return 'mcp';
+    if (/(^|\/)cli\//i.test(filePath))
+        return 'cli';
+    return 'normal';
+}
+// ============================================================================
+// AST Rule: child_process command execution
+// ============================================================================
+(0, index_1.registerASTRule)({
+    id: 'ast-child-process',
+    title: 'Shell command execution detected',
+    description: 'child_process exec/spawn can lead to command injection if arguments include user input',
+    severity: 'high',
+    category: 'command_injection',
+    suggestedFix: 'Use execFile() with argument arrays instead of exec(). Validate and sanitize all command arguments against an allowlist.',
+    languages: ['javascript', 'typescript', 'tsx', 'python'],
+    confidence: 'high',
+    baseConfidence: 0.40,
+    layer: 2,
+    source: 'structural',
+    requiresAIValidation: false,
+    detect(ast, content, nodeIndex) {
+        if ((0, file_classifier_1.isScannerOrFixtureFile)(ast.filePath))
+            return [];
+        // Skip vendor/minified/cached files — third-party code, not user's own
+        if (/node_modules[\/\\]\.cache|\.min\.(js|css)|vendor[\/\\]bundle|dist[\/\\].*\.bundle/i.test(ast.filePath))
+            return [];
+        // Quick content pre-check — skip files without command execution mentions
+        if (!/child_process|subprocess|os\.system|os\.popen|os\.exec/.test(content))
+            return [];
+        const root = ast.tree.rootNode;
+        const isTest = (0, file_classifier_1.isTestOrMockFile)(ast.filePath);
+        const fileCtx = classifyFileContext(ast.filePath);
+        // --- Python: subprocess, os.system, os.popen ---
+        if (ast.language === 'python') {
+            const hasSubprocess = (0, python_helpers_1.hasPythonImport)(root, 'subprocess');
+            const hasOs = (0, python_helpers_1.hasPythonImport)(root, 'os');
+            if (!hasSubprocess && !hasOs)
+                return [];
+            if (isTest)
+                return [];
+            const matches = [];
+            // Build set of local names from direct imports: from subprocess import run → 'run'
+            const pyBindings = (0, python_helpers_1.collectPythonImportBindings)(root);
+            const pyCommandNames = new Set();
+            for (const [local, binding] of pyBindings) {
+                if (binding.module === 'subprocess' && PY_SUBPROCESS_FUNCTIONS.has(binding.originalName)) {
+                    pyCommandNames.add(local);
+                }
+                if (binding.module === 'os' && PY_OS_EXEC_FUNCTIONS.has(binding.originalName)) {
+                    pyCommandNames.add(local);
+                }
+            }
+            for (const node of (0, index_1.getNodes)(nodeIndex, 'call')) {
+                const target = (0, python_helpers_1.resolvePythonCallTarget)(node);
+                if (!target)
+                    continue;
+                let isCommandCall = false;
+                // subprocess.run(...), subprocess.Popen(...), etc.
+                if (hasSubprocess && target.type === 'member' &&
+                    /^subprocess$/.test(target.object ?? '') &&
+                    PY_SUBPROCESS_FUNCTIONS.has(target.name)) {
+                    isCommandCall = true;
+                }
+                // os.system(...), os.popen(...), os.execl(...), etc.
+                if (hasOs && target.type === 'member' &&
+                    /^os$/.test(target.object ?? '') &&
+                    PY_OS_EXEC_FUNCTIONS.has(target.name)) {
+                    isCommandCall = true;
+                }
+                // Direct call via imported name: from subprocess import run; run(cmd)
+                if (target.type === 'direct' && pyCommandNames.has(target.name)) {
+                    isCommandCall = true;
+                }
+                if (!isCommandCall)
+                    continue;
+                const args = (0, python_helpers_1.getPythonCallArguments)(node);
+                // Check for shell=True keyword arg
+                const shellArg = (0, python_helpers_1.getPythonKeywordArgument)(node, 'shell');
+                const hasShellTrue = shellArg?.type === 'true';
+                // subprocess with list args + no shell=True is safe (no shell interpretation)
+                if (args.length > 0 && args[0].type === 'list' && !hasShellTrue)
+                    continue;
+                // Check if all positional args are static strings
+                const allStatic = args.length > 0 && args.every(a => a.type === 'string' || a.type === 'list' && a.namedChildren.every(c => c.type === 'string'));
+                // Static commands can never have injection — fully suppress
+                if (allStatic)
+                    continue;
+                // Check for allowlist validation
+                const fn = (0, ast_1.findEnclosingFunction)(node);
+                if (fn && hasAllowlistValidation(fn))
+                    continue;
+                // Determine severity
+                let severity = 'high';
+                let note = 'Shell command execution with dynamic arguments';
+                // os.system() is always high — no arg separation possible
+                if (target.name === 'system') {
+                    severity = 'high';
+                    note = 'os.system() executes commands via shell — use subprocess with argument list instead';
+                }
+                // shell=True with dynamic args is critical
+                if (hasShellTrue && !allStatic) {
+                    severity = 'critical';
+                    note = 'subprocess with shell=True and dynamic arguments — command injection risk';
+                }
+                // Context adjustments (don't override shell=True escalation with dynamic args)
+                if (!hasShellTrue || allStatic) {
+                    if (fileCtx === 'build') {
+                        severity = 'info';
+                        note = 'Shell command in build script context';
+                    }
+                    else if (fileCtx === 'desktop') {
+                        severity = 'medium';
+                        note = 'Shell command in desktop application context';
+                    }
+                    else if (fileCtx === 'mcp') {
+                        severity = 'medium';
+                        note = 'Shell command in MCP server context';
+                    }
+                    else if (fileCtx === 'cli') {
+                        severity = 'info';
+                        note = 'Shell command in CLI tool context';
+                    }
+                }
+                // Escalate if user input detected
+                if (args.some(a => (0, python_helpers_1.isPythonUserInputExpression)(a))) {
+                    severity = 'critical';
+                    note = 'Shell command with user input — command injection risk';
+                }
+                matches.push({ node, severity, note });
+            }
+            return matches;
+        }
+        // --- JavaScript/TypeScript ---
+        // Check if file imports child_process
+        const hasCP = (0, import_analysis_1.hasImport)(root, 'child_process') ||
+            (0, import_analysis_1.hasImport)(root, 'node:child_process');
+        if (!hasCP)
+            return [];
+        const matches = [];
+        const aliases = (0, scope_analysis_1.collectVariableAliases)(root);
+        const bindings = (0, import_analysis_1.collectImportBindings)(root);
+        // Build set of local names that refer to child_process functions
+        const cpNames = new Set();
+        for (const [local, binding] of bindings) {
+            if ((binding.module === 'child_process' || binding.module === 'node:child_process') &&
+                CP_FUNCTIONS.has(binding.originalName)) {
+                cpNames.add(local);
+            }
+        }
+        for (const node of (0, index_1.getNodes)(nodeIndex, 'call_expression')) {
+            const target = (0, call_analysis_1.resolveCallTarget)(node, aliases);
+            if (!target)
+                continue;
+            // Check if this is a child_process function call
+            const isCPCall = cpNames.has(target.name) ||
+                (target.type === 'member' && CP_FUNCTIONS.has(target.name) &&
+                    /child_process|cp/.test(target.object ?? ''));
+            if (!isCPCall)
+                continue;
+            const args = (0, call_analysis_1.getCallArguments)(node);
+            // Static command string can never have injection — fully suppress
+            // Only check the first arg (command string); callbacks/options are irrelevant
+            if (args.length > 0 && (0, scope_analysis_1.isConstant)(args[0]))
+                continue;
+            // spawn/spawnSync with array second arg never goes through shell — safe
+            if ((target.name === 'spawn' || target.name === 'spawnSync') && args.length >= 2 && args[1].type === 'array')
+                continue;
+            // Check for allowlist validation
+            const fn = (0, ast_1.findEnclosingFunction)(node);
+            if (fn && hasAllowlistValidation(fn))
+                continue;
+            // Skip tests
+            if (isTest)
+                continue;
+            // Context-adjusted severity
+            let severity = 'high';
+            let note = 'Shell command execution with dynamic arguments';
+            if (fileCtx === 'build') {
+                severity = 'info';
+                note = 'Shell command in build script context';
+            }
+            else if (fileCtx === 'desktop') {
+                severity = 'medium';
+                note = 'Shell command in desktop application context';
+            }
+            else if (fileCtx === 'mcp') {
+                severity = 'medium';
+                note = 'Shell command in MCP server context';
+            }
+            else if (fileCtx === 'cli') {
+                severity = 'info';
+                note = 'Shell command in CLI tool context';
+            }
+            // Escalate if user input detected
+            if (args.some(a => (0, user_input_1.isUserInputExpression)(a))) {
+                severity = 'critical';
+                note = 'Shell command with user input - command injection risk';
+            }
+            matches.push({ node, severity, note });
+        }
+        return matches;
+    },
+});
+//# sourceMappingURL=child-process-ast.js.map

package/dist/detect/ast-rules/child-process-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process-ast.js","sourceRoot":"","sources":["../../../src/detect/ast-rules/child-process-ast.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAGH,yCAAuD;AACvD,mCAAsF;AAEtF,+DAA4F;AAC5F,2DAA6E;AAC7E,6DAA6E;AAC7E,qDAA4D;AAC5D,iEAAsF;AACtF,6DAA+L;AAE/L,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;AAE5G,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAA;AAC/H,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;AAEzI,8DAA8D;AAC9D,SAAS,sBAAsB,CAAC,MAAyB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAA;IAC5B,yBAAyB;IACzB,IAAI,mHAAmH,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACnJ,2DAA2D;IAC3D,IAAI,kEAAkE,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAClG,IAAI,uDAAuD,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACvF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oDAAoD;AACpD,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,wFAAwF,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAA;IAC3H,IAAI,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IACxE,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,4CAA4C;AAC5C,+EAA+E;AAE/E,IAAA,uBAAe,EAAC;IACd,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,wFAAwF;IACrG,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,mBAAmB;IAC7B,YAAY,EAAE,0HAA0H;IACxI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC;IACxD,UAAU,EAAE,MAAM;IAClB,cAAc,EAAE,IAAI;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,YAAY;IACpB,oBAAoB,EAAE,KAAK;IAC3B,MAAM,CAAC,GAAc,EAAE,OAAe,EAAE,SAAqB;QAC3D,IAAI,IAAA,wCAAsB,EAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QAEnD,uEAAuE;QACvE,IAAI,oFAAoF,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QAEtH,0EAA0E;QAC1E,IAAI,CAAC,wDAAwD,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAA;QAEtF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;QAC9B,MAAM,MAAM,GAAG,IAAA,kCAAgB,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAEjD,kDAAkD;QAClD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,aAAa,GAAG,IAAA,gCAAe,EAAC,IAAI,EAAE,YAAY,CAAC,CAAA;YACzD,MAAM,KAAK,GAAG,IAAA,gCAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACzC,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,CAAA;YACvC,IAAI,MAAM;gBAAE,OAAO,EAAE,CAAA;YAErB,MAAM,OAAO,GAAmB,EAAE,CAAA;YAElC,mFAAmF;YACnF,MAAM,UAAU,GAAG,IAAA,4CAA2B,EAAC,IAAI,CAAC,CAAA;YACpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;YACxC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;oBACzF,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC3B,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC9E,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC3B,CAAC;YACH,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAQ,EAAC,SAAU,EAAE,MAAM,CAAC,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,IAAA,wCAAuB,EAAC,IAAI,CAAC,CAAA;gBAC5C,IAAI,CAAC,MAAM;oBAAE,SAAQ;gBAErB,IAAI,aAAa,GAAG,KAAK,CAAA;gBAEzB,mDAAmD;gBACnD,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;oBACzC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;oBACxC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,aAAa,GAAG,IAAI,CAAA;gBACtB,CAAC;gBAED,qDAAqD;gBACrD,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;oBACjC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;oBAChC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,aAAa,GAAG,IAAI,CAAA;gBACtB,CAAC;gBAED,sEAAsE;gBACtE,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChE,aAAa,GAAG,IAAI,CAAA;gBACtB,CAAC;gBAED,IAAI,CAAC,aAAa;oBAAE,SAAQ;gBAE5B,MAAM,IAAI,GAAG,IAAA,uCAAsB,EAAC,IAAI,CAAC,CAAA;gBAEzC,mCAAmC;gBACnC,MAAM,QAAQ,GAAG,IAAA,yCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAA;gBACxD,MAAM,YAAY,GAAG,QAAQ,EAAE,IAAI,KAAK,MAAM,CAAA;gBAE9C,8EAA8E;gBAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,YAAY;oBAAE,SAAQ;gBAEzE,kDAAkD;gBAClD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAClD,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAC5F,CAAA;gBAED,4DAA4D;gBAC5D,IAAI,SAAS;oBAAE,SAAQ;gBAEvB,iCAAiC;gBACjC,MAAM,EAAE,GAAG,IAAA,2BAAqB,EAAC,IAAI,CAAC,CAAA;gBACtC,IAAI,EAAE,IAAI,sBAAsB,CAAC,EAAE,CAAC;oBAAE,SAAQ;gBAE9C,qBAAqB;gBACrB,IAAI,QAAQ,GAAoD,MAAM,CAAA;gBACtE,IAAI,IAAI,GAAG,gDAAgD,CAAA;gBAE3D,0DAA0D;gBAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,QAAQ,GAAG,MAAM,CAAA;oBACjB,IAAI,GAAG,qFAAqF,CAAA;gBAC9F,CAAC;gBAED,2CAA2C;gBAC3C,IAAI,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC/B,QAAQ,GAAG,UAAU,CAAA;oBACrB,IAAI,GAAG,2EAA2E,CAAA;gBACpF,CAAC;gBAED,+EAA+E;gBAC/E,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC;oBAC/B,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;wBACxB,QAAQ,GAAG,MAAM,CAAA;wBACjB,IAAI,GAAG,uCAAuC,CAAA;oBAChD,CAAC;yBAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBACjC,QAAQ,GAAG,QAAQ,CAAA;wBACnB,IAAI,GAAG,8CAA8C,CAAA;oBACvD,CAAC;yBAAM,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;wBAC7B,QAAQ,GAAG,QAAQ,CAAA;wBACnB,IAAI,GAAG,qCAAqC,CAAA;oBAC9C,CAAC;yBAAM,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;wBAC7B,QAAQ,GAAG,MAAM,CAAA;wBACjB,IAAI,GAAG,mCAAmC,CAAA;oBAC5C,CAAC;gBACH,CAAC;gBAED,kCAAkC;gBAClC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,4CAA2B,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,QAAQ,GAAG,UAAU,CAAA;oBACrB,IAAI,GAAG,wDAAwD,CAAA;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;YACxC,CAAC;YAED,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,gCAAgC;QAChC,sCAAsC;QACtC,MAAM,KAAK,GACT,IAAA,2BAAS,EAAC,IAAI,EAAE,eAAe,CAAC;YAChC,IAAA,2BAAS,EAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;QAEvC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAA;QAErB,MAAM,OAAO,GAAmB,EAAE,CAAA;QAClC,MAAM,OAAO,GAAG,IAAA,uCAAsB,EAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,IAAA,uCAAqB,EAAC,IAAI,CAAC,CAAA;QAE5C,iEAAiE;QACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;QACjC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;YACxC,IACE,CAAC,OAAO,CAAC,MAAM,KAAK,eAAe,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC;gBAC/E,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EACtC,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAQ,EAAC,SAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAA,iCAAiB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YAC/C,IAAI,CAAC,MAAM;gBAAE,SAAQ;YAErB,iDAAiD;YACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBACvC,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACxD,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAA;YAEjD,IAAI,CAAC,QAAQ;gBAAE,SAAQ;YAEvB,MAAM,IAAI,GAAG,IAAA,gCAAgB,EAAC,IAAI,CAAC,CAAA;YAEnC,kEAAkE;YAClE,8EAA8E;YAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAA,2BAAU,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAQ;YAEpD,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO;gBAAE,SAAQ;YAEtH,iCAAiC;YACjC,MAAM,EAAE,GAAG,IAAA,2BAAqB,EAAC,IAAI,CAAC,CAAA;YACtC,IAAI,EAAE,IAAI,sBAAsB,CAAC,EAAE,CAAC;gBAAE,SAAQ;YAE9C,aAAa;YACb,IAAI,MAAM;gBAAE,SAAQ;YAEpB,4BAA4B;YAC5B,IAAI,QAAQ,GAAoD,MAAM,CAAA;YACtE,IAAI,IAAI,GAAG,gDAAgD,CAAA;YAE3D,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,QAAQ,GAAG,MAAM,CAAA;gBACjB,IAAI,GAAG,uCAAuC,CAAA;YAChD,CAAC;iBAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,QAAQ,GAAG,QAAQ,CAAA;gBACnB,IAAI,GAAG,8CAA8C,CAAA;YACvD,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC7B,QAAQ,GAAG,QAAQ,CAAA;gBACnB,IAAI,GAAG,qCAAqC,CAAA;YAC9C,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC7B,QAAQ,GAAG,MAAM,CAAA;gBACjB,IAAI,GAAG,mCAAmC,CAAA;YAC5C,CAAC;YAED,kCAAkC;YAClC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,kCAAqB,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,QAAQ,GAAG,UAAU,CAAA;gBACrB,IAAI,GAAG,wDAAwD,CAAA;YACjE,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACxC,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAC,CAAA"}

package/dist/detect/ast-rules/dangerous-eval-ast.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AST-Based eval() / Function() / setTimeout-string Detection
+ *
+ * Migrates dangerous-functions eval detection to AST.
+ *
+ * AST advantages:
+ * - Distinguishes eval() from model.eval() (member expression vs direct call)
+ * - Tracks aliased eval: const e = eval; e(userInput)
+ * - Detects Function constructor with variable aliasing
+ * - Understands if argument is a string literal (safe) vs dynamic (dangerous)
+ */
+export {};
+//# sourceMappingURL=dangerous-eval-ast.d.ts.map

package/dist/detect/ast-rules/dangerous-eval-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dangerous-eval-ast.d.ts","sourceRoot":"","sources":["../../../src/detect/ast-rules/dangerous-eval-ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/detect/ast-rules/dangerous-eval-ast.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * AST-Based eval() / Function() / setTimeout-string Detection
+ *
+ * Migrates dangerous-functions eval detection to AST.
+ *
+ * AST advantages:
+ * - Distinguishes eval() from model.eval() (member expression vs direct call)
+ * - Tracks aliased eval: const e = eval; e(userInput)
+ * - Detects Function constructor with variable aliasing
+ * - Understands if argument is a string literal (safe) vs dynamic (dangerous)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_1 = require("./index");
+const scope_analysis_1 = require("./helpers/scope-analysis");
+const call_analysis_1 = require("./helpers/call-analysis");
+const user_input_1 = require("./helpers/user-input");
+const file_classifier_1 = require("../../parse/file-classifier");
+const python_helpers_1 = require("./helpers/python-helpers");
+// ============================================================================
+// Helpers
+// ============================================================================
+/** Check if all arguments to a call are static string literals */
+function allArgsStatic(args) {
+    return args.length > 0 && args.every(arg => (0, scope_analysis_1.isConstant)(arg));
+}
+/** Check if eval is used as a method call (model.eval(), torch.eval()) */
+function isMethodEval(node) {
+    const fn = node.childForFieldName('function');
+    return fn?.type === 'member_expression';
+}
+/** Check if a Python argument is a static literal */
+function isPythonStaticArg(node) {
+    if (node.type === 'string' && !(0, python_helpers_1.isPythonFString)(node))
+        return true;
+    if (node.type === 'integer' || node.type === 'float')
+        return true;
+    if (node.type === 'true' || node.type === 'false' || node.type === 'none')
+        return true;
+    return false;
+}
+// ============================================================================
+// AST Rule: eval() / Function constructor
+// ============================================================================
+(0, index_1.registerASTRule)({
+    id: 'ast-dangerous-eval',
+    title: 'Dynamic code execution detected',
+    description: 'eval(), Function constructor, or string-based setTimeout/setInterval can execute arbitrary code',
+    severity: 'critical',
+    category: 'dangerous_function',
+    suggestedFix: 'Avoid eval() and Function constructor. Use safer alternatives like JSON.parse() for data, or structured approaches for dynamic behavior.',
+    languages: ['javascript', 'typescript', 'tsx', 'python'],
+    confidence: 'high',
+    baseConfidence: 0.40,
+    layer: 2,
+    source: 'structural',
+    requiresAIValidation: false,
+    detect(ast, content, nodeIndex) {
+        if ((0, file_classifier_1.isScannerOrFixtureFile)(ast.filePath))
+            return [];
+        // Content pre-check: skip files without relevant dynamic execution patterns
+        if (!/\beval\b|\bFunction\b|\bsetTimeout\b|\bsetInterval\b|\bexec\b|\bcompile\b|\b__import__\b/i.test(content))
+            return [];
+        const matches = [];
+        const root = ast.tree.rootNode;
+        const isTest = (0, file_classifier_1.isTestOrMockFile)(ast.filePath);
+        // --- Python: eval(), exec(), compile(), __import__() ---
+        if (ast.language === 'python') {
+            if (isTest)
+                return [];
+            const pyAliases = (0, python_helpers_1.collectPythonVariableAliases)(root);
+            for (const node of (0, index_1.getNodes)(nodeIndex, 'call')) {
+                const target = (0, python_helpers_1.resolvePythonCallTarget)(node, pyAliases);
+                if (!target)
+                    continue;
+                // Skip method calls: model.eval(), torch.compile()
+                if (target.type === 'member')
+                    continue;
+                const name = target.name;
+                if (name !== 'eval' && name !== 'exec' && name !== 'compile' && name !== '__import__')
+                    continue;
+                const args = (0, python_helpers_1.getPythonCallArguments)(node);
+                if (args.length > 0 && args.every(a => isPythonStaticArg(a)))
+                    continue;
+                const hasUserInput = args.some(a => (0, python_helpers_1.isPythonUserInputExpression)(a));
+                if (name === 'eval') {
+                    matches.push({
+                        node,
+                        severity: hasUserInput ? 'critical' : 'high',
+                        note: hasUserInput
+                            ? 'eval() called with user input — critical code execution risk'
+                            : 'eval() with dynamic argument — can execute arbitrary Python expressions',
+                    });
+                }
+                else if (name === 'exec') {
+                    matches.push({
+                        node,
+                        severity: hasUserInput ? 'critical' : 'high',
+                        note: hasUserInput
+                            ? 'exec() called with user input — critical code execution risk'
+                            : 'exec() with dynamic argument — can execute arbitrary Python code',
+                    });
+                }
+                else if (name === 'compile') {
+                    matches.push({
+                        node,
+                        severity: 'medium',
+                        note: 'compile() with dynamic argument — code object can be passed to exec()',
+                    });
+                }
+                else if (name === '__import__') {
+                    matches.push({
+                        node,
+                        severity: hasUserInput ? 'critical' : 'high',
+                        note: hasUserInput
+                            ? '__import__() with user input — can load arbitrary Python modules'
+                            : '__import__() with dynamic argument — can load arbitrary modules',
+                    });
+                }
+            }
+            return matches;
+        }
+        // --- JavaScript/TypeScript ---
+        const aliases = (0, scope_analysis_1.collectVariableAliases)(root);
+        for (const node of (0, index_1.getNodes)(nodeIndex, 'call_expression', 'new_expression')) {
+            const target = (0, call_analysis_1.resolveCallTarget)(node, aliases);
+            if (!target)
+                continue;
+            const args = (0, call_analysis_1.getCallArguments)(node);
+            // --- eval() ---
+            if (target.name === 'eval' && target.type === 'direct') {
+                // Skip method calls: model.eval()
+                if (!target.aliased && isMethodEval(node))
+                    continue;
+                // Skip static literal arguments
+                if (allArgsStatic(args))
+                    continue;
+                // Skip test files
+                if (isTest)
+                    continue;
+                const hasUserInput = args.some(a => (0, user_input_1.isUserInputExpression)(a));
+                matches.push({
+                    node,
+                    severity: hasUserInput ? 'critical' : 'medium',
+                    note: hasUserInput
+                        ? 'eval() called with user input — critical code injection risk'
+                        : 'eval() with dynamic argument — verify input is trusted and consider alternatives',
+                });
+                continue;
+            }
+            // --- new Function() ---
+            if (target.name === 'Function' && (target.type === 'new' || target.type === 'direct')) {
+                if (allArgsStatic(args))
+                    continue;
+                if (isTest)
+                    continue;
+                matches.push({
+                    node,
+                    severity: 'critical',
+                    note: 'Function constructor can execute arbitrary code like eval()',
+                });
+                continue;
+            }
+            // --- setTimeout/setInterval with string first argument ---
+            if ((target.name === 'setTimeout' || target.name === 'setInterval') &&
+                target.type === 'direct') {
+                const firstArg = args[0];
+                if (!firstArg)
+                    continue;
+                // Only dangerous when first arg is a string (not a function reference)
+                if (firstArg.type === 'string' || firstArg.type === 'template_string') {
+                    if ((0, scope_analysis_1.isConstant)(firstArg))
+                        continue; // static string, low risk
+                    matches.push({
+                        node,
+                        severity: 'high',
+                        note: `${target.name}() with string argument acts like eval()`,
+                    });
+                    continue;
+                }
+                // Variable/expression argument (not a function literal) — potential implicit eval
+                if (firstArg.type !== 'arrow_function' &&
+                    firstArg.type !== 'function_expression') {
+                    if ((0, scope_analysis_1.isConstant)(firstArg))
+                        continue;
+                    // Member expressions are typically function refs: this.tick, obj.handler
+                    if (firstArg.type === 'member_expression')
+                        continue;
+                    // Identifiers: resolve value to determine if function or potential string
+                    if (firstArg.type === 'identifier') {
+                        const resolved = (0, scope_analysis_1.resolveVariableValue)(firstArg, firstArg.text);
+                        // Skip if resolved to a function
+                        if (resolved && (resolved.type === 'arrow_function' || resolved.type === 'function_expression'))
+                            continue;
+                        // Skip if not resolvable — likely a parameter/imported function reference
+                        if (!resolved)
+                            continue;
+                        // Resolved to a call expression or other non-function: could be a string
+                        matches.push({
+                            node,
+                            severity: 'medium',
+                            note: `${target.name}() with non-function argument — acts like eval() if value is a string`,
+                        });
+                        continue;
+                    }
+                    matches.push({
+                        node,
+                        severity: 'medium',
+                        note: `${target.name}() with non-function argument — acts like eval() if value is a string`,
+                    });
+                }
+                continue;
+            }
+        }
+        return matches;
+    },
+});
+//# sourceMappingURL=dangerous-eval-ast.js.map

package/dist/detect/ast-rules/dangerous-eval-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dangerous-eval-ast.js","sourceRoot":"","sources":["../../../src/detect/ast-rules/dangerous-eval-ast.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAIH,mCAAsF;AAEtF,6DAAmG;AACnG,2DAA6E;AAE7E,qDAA4D;AAC5D,iEAAsF;AACtF,6DAAsK;AAEtK,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,kEAAkE;AAClE,SAAS,aAAa,CAAC,IAAyB;IAC9C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAA,2BAAU,EAAC,GAAG,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAuB;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC7C,OAAO,EAAE,EAAE,IAAI,KAAK,mBAAmB,CAAA;AACzC,CAAC;AAED,qDAAqD;AACrD,SAAS,iBAAiB,CAAC,IAAuB;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAA,gCAAe,EAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACjE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACjE,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACtF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E,IAAA,uBAAe,EAAC;IACd,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,iCAAiC;IACxC,WAAW,EAAE,iGAAiG;IAC9G,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,oBAAoB;IAC9B,YAAY,EAAE,0IAA0I;IACxJ,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC;IACxD,UAAU,EAAE,MAAM;IAClB,cAAc,EAAE,IAAI;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,YAAY;IACpB,oBAAoB,EAAE,KAAK;IAC3B,MAAM,CAAC,GAAc,EAAE,OAAe,EAAE,SAAqB;QAC3D,IAAI,IAAA,wCAAsB,EAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAA;QAEnD,4EAA4E;QAC5E,IAAI,CAAC,2FAA2F,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAA;QAEzH,MAAM,OAAO,GAAmB,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;QAC9B,MAAM,MAAM,GAAG,IAAA,kCAAgB,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAE7C,0DAA0D;QAC1D,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM;gBAAE,OAAO,EAAE,CAAA;YAErB,MAAM,SAAS,GAAG,IAAA,6CAA4B,EAAC,IAAI,CAAC,CAAA;YAEpD,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAQ,EAAC,SAAU,EAAE,MAAM,CAAC,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,IAAA,wCAAuB,EAAC,IAAI,EAAE,SAAS,CAAC,CAAA;gBACvD,IAAI,CAAC,MAAM;oBAAE,SAAQ;gBAErB,mDAAmD;gBACnD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;oBAAE,SAAQ;gBAEtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;gBACxB,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY;oBAAE,SAAQ;gBAE/F,MAAM,IAAI,GAAG,IAAA,uCAAsB,EAAC,IAAI,CAAC,CAAA;gBACzC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAQ;gBAEtE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,4CAA2B,EAAC,CAAC,CAAC,CAAC,CAAA;gBAEnE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpB,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI;wBACJ,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;wBAC5C,IAAI,EAAE,YAAY;4BAChB,CAAC,CAAC,8DAA8D;4BAChE,CAAC,CAAC,yEAAyE;qBAC9E,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI;wBACJ,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;wBAC5C,IAAI,EAAE,YAAY;4BAChB,CAAC,CAAC,8DAA8D;4BAChE,CAAC,CAAC,kEAAkE;qBACvE,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC9B,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI;wBACJ,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,uEAAuE;qBAC9E,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;oBACjC,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI;wBACJ,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;wBAC5C,IAAI,EAAE,YAAY;4BAChB,CAAC,CAAC,kEAAkE;4BACpE,CAAC,CAAC,iEAAiE;qBACtE,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,gCAAgC;QAChC,MAAM,OAAO,GAAG,IAAA,uCAAsB,EAAC,IAAI,CAAC,CAAA;QAE5C,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAQ,EAAC,SAAU,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC7E,MAAM,MAAM,GAAG,IAAA,iCAAiB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YAC/C,IAAI,CAAC,MAAM;gBAAE,SAAQ;YAErB,MAAM,IAAI,GAAG,IAAA,gCAAgB,EAAC,IAAI,CAAC,CAAA;YAEnC,iBAAiB;YACjB,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,kCAAkC;gBAClC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBAEnD,gCAAgC;gBAChC,IAAI,aAAa,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBAEjC,kBAAkB;gBAClB,IAAI,MAAM;oBAAE,SAAQ;gBAEpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,kCAAqB,EAAC,CAAC,CAAC,CAAC,CAAA;gBAC7D,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;oBAC9C,IAAI,EAAE,YAAY;wBAChB,CAAC,CAAC,8DAA8D;wBAChE,CAAC,CAAC,kFAAkF;iBACvF,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YAED,yBAAyB;YACzB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACtF,IAAI,aAAa,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBACjC,IAAI,MAAM;oBAAE,SAAQ;gBAEpB,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,6DAA6D;iBACpE,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YAED,4DAA4D;YAC5D,IACE,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC;gBAC/D,MAAM,CAAC,IAAI,KAAK,QAAQ,EACxB,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;gBACxB,IAAI,CAAC,QAAQ;oBAAE,SAAQ;gBAEvB,uEAAuE;gBACvE,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACtE,IAAI,IAAA,2BAAU,EAAC,QAAQ,CAAC;wBAAE,SAAQ,CAAC,0BAA0B;oBAC7D,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI;wBACJ,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,0CAA0C;qBAC/D,CAAC,CAAA;oBACF,SAAQ;gBACV,CAAC;gBAED,kFAAkF;gBAClF,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB;oBAClC,QAAQ,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC5C,IAAI,IAAA,2BAAU,EAAC,QAAQ,CAAC;wBAAE,SAAQ;oBAClC,yEAAyE;oBACzE,IAAI,QAAQ,CAAC,IAAI,KAAK,mBAAmB;wBAAE,SAAQ;oBACnD,0EAA0E;oBAC1E,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBACnC,MAAM,QAAQ,GAAG,IAAA,qCAAoB,EAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;wBAC9D,iCAAiC;wBACjC,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,QAAQ,CAAC,IAAI,KAAK,qBAAqB,CAAC;4BAAE,SAAQ;wBACzG,0EAA0E;wBAC1E,IAAI,CAAC,QAAQ;4BAAE,SAAQ;wBACvB,yEAAyE;wBACzE,OAAO,CAAC,IAAI,CAAC;4BACX,IAAI;4BACJ,QAAQ,EAAE,QAAQ;4BAClB,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,uEAAuE;yBAC5F,CAAC,CAAA;wBACF,SAAQ;oBACV,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI;wBACJ,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,uEAAuE;qBAC5F,CAAC,CAAA;gBACJ,CAAC;gBACD,SAAQ;YACV,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAC,CAAA"}

package/dist/detect/ast-rules/data-exposure-ast.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AST-Based Data Exposure Detection
+ *
+ * Migrates structural/data-exposure.ts from regex to AST.
+ * Detects sensitive data in API responses (stack traces, error objects).
+ *
+ * AST advantages:
+ * - Understands res.json(err) vs res.json({ error: err.message })
+ * - Detects error spread: res.json({ ...error })
+ * - Distinguishes response sinks from log sinks at the AST level
+ */
+export {};
+//# sourceMappingURL=data-exposure-ast.d.ts.map

package/dist/detect/ast-rules/data-exposure-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-exposure-ast.d.ts","sourceRoot":"","sources":["../../../src/detect/ast-rules/data-exposure-ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}