@oculum/scanner 1.0.14 → 1.0.15

package/src/__tests__/snapshots/__snapshots__/scan-depth.test.ts.snap

@@ -5,13 +5,22 @@ exports[`Scan Depth Snapshots AI-Era Patterns - Modern Security Issues cheap sca
 exports[`Scan Depth Snapshots AI-Era Patterns - Modern Security Issues full scan should detect AI-era security patterns 1`] = `
 Array [
   Object {
-    "category": "ai_pattern",
+    "category": "dangerous_function",
+    "confidence": "low",
+    "layer": 2,
+    "lineContent": "export async function handleChat(req: Request) {",
+    "lineNumber": 5,
+    "severity": "info",
+    "title": "API route without request body validation",
+  },
+  Object {
+    "category": "missing_auth",
     "confidence": "medium",
     "layer": 2,
-    "lineContent": "const openai = new OpenAI({ apiKey: req.body.userApiKey })",
-    "lineNumber": 6,
-    "severity": "low",
-    "title": "BYOK: User-provided OpenAI API key",
+    "lineContent": "export async function handleChat(req: Request) {",
+    "lineNumber": 5,
+    "severity": "medium",
+    "title": "API route may lack authentication",
   },
 ]
 `;
@@ -22,30 +31,30 @@ exports[`Scan Depth Snapshots Auth Patterns - Missing Authentication full scan s
 Array [
   Object {
     "category": "missing_auth",
-    "confidence": "high",
+    "confidence": "medium",
     "layer": 2,
     "lineContent": "export async function GET(request: Request) {",
     "lineNumber": 6,
     "severity": "medium",
-    "title": "Unprotected API route",
+    "title": "API route may lack authentication",
   },
   Object {
-    "category": "missing_auth",
-    "confidence": "high",
+    "category": "dangerous_function",
+    "confidence": "low",
     "layer": 2,
     "lineContent": "export async function DELETE(request: Request) {",
     "lineNumber": 11,
-    "severity": "medium",
-    "title": "Unprotected API route",
+    "severity": "info",
+    "title": "API route without request body validation",
   },
   Object {
-    "category": "dangerous_function",
-    "confidence": "low",
+    "category": "missing_auth",
+    "confidence": "medium",
     "layer": 2,
-    "lineContent": "const { id } = await request.json()",
-    "lineNumber": 12,
-    "severity": "info",
-    "title": "Request body without schema validation",
+    "lineContent": "export async function DELETE(request: Request) {",
+    "lineNumber": 11,
+    "severity": "medium",
+    "title": "API route may lack authentication",
   },
 ]
 `;
@@ -54,30 +63,27 @@ exports[`Scan Depth Snapshots Clean File - No Findings Expected cheap scan shoul
 
 exports[`Scan Depth Snapshots Clean File - No Findings Expected full scan should produce no findings 1`] = `Array []`;
 
-exports[`Scan Depth Snapshots Hardcoded Secrets - Critical Findings cheap scan should detect hardcoded secrets 1`] = `
+exports[`Scan Depth Snapshots Hardcoded Secrets - Critical Findings cheap scan should detect hardcoded secrets 1`] = `Array []`;
+
+exports[`Scan Depth Snapshots Hardcoded Secrets - Critical Findings full scan should detect hardcoded secrets 1`] = `
 Array [
   Object {
-    "category": "hardcoded_secret",
-    "confidence": "high",
+    "category": "high_entropy_string",
+    "confidence": "medium",
     "layer": 1,
     "lineContent": "const OPENAI_API_KEY = \\"sk-proj-abc123def456ghi789jkl012mno345pqr678stu901vwx\\"",
     "lineNumber": 3,
-    "severity": "medium",
-    "title": "Generic API Key Assignment",
+    "severity": "high",
+    "title": "Potential hardcoded secret detected",
   },
-]
-`;
-
-exports[`Scan Depth Snapshots Hardcoded Secrets - Critical Findings full scan should detect hardcoded secrets 1`] = `
-Array [
   Object {
-    "category": "hardcoded_secret",
-    "confidence": "high",
+    "category": "high_entropy_string",
+    "confidence": "medium",
     "layer": 1,
-    "lineContent": "const OPENAI_API_KEY = \\"sk-proj-abc123def456ghi789jkl012mno345pqr678stu901vwx\\"",
-    "lineNumber": 3,
+    "lineContent": "const AWS_SECRET_ACCESS_KEY = \\"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\\"",
+    "lineNumber": 5,
     "severity": "medium",
-    "title": "Generic API Key Assignment",
+    "title": "Potential hardcoded secret detected",
   },
 ]
 `;
@@ -85,22 +91,13 @@ Array [
 exports[`Scan Depth Snapshots Mixed Severity - Multiple Issue Types cheap scan should detect Layer 1 issues 1`] = `
 Array [
   Object {
-    "category": "hardcoded_secret",
+    "category": "insecure_config",
     "confidence": "high",
     "layer": 1,
-    "lineContent": "const API_KEY = \\"sk-live-1234567890abcdef\\"",
-    "lineNumber": 7,
+    "lineContent": "app.use(cors({ origin: '*' }))",
+    "lineNumber": 10,
     "severity": "medium",
-    "title": "Generic API Key Assignment",
-  },
-  Object {
-    "category": "weak_crypto",
-    "confidence": "high",
-    "layer": 1,
-    "lineContent": "const hash = crypto.createHash('md5')",
-    "lineNumber": 13,
-    "severity": "high",
-    "title": "MD5 Hash Creation",
+    "title": "Permissive CORS configuration",
   },
 ]
 `;
@@ -123,43 +120,52 @@ Array [
     "lineContent": "const API_KEY = \\"sk-live-1234567890abcdef\\"",
     "lineNumber": 7,
     "severity": "critical",
-    "title": "[AI Pattern] AI hardcoded secret pattern",
+    "title": "[AI Pattern] Hardcoded secret",
   },
   Object {
-    "category": "hardcoded_secret",
-    "confidence": "high",
-    "layer": 1,
+    "category": "sensitive_variable",
+    "confidence": "medium",
+    "layer": 2,
     "lineContent": "const API_KEY = \\"sk-live-1234567890abcdef\\"",
     "lineNumber": 7,
+    "severity": "high",
+    "title": "Sensitive variable with hardcoded value",
+  },
+  Object {
+    "category": "cors_misconfiguration",
+    "confidence": "high",
+    "layer": 2,
+    "lineContent": "app.use(cors({ origin: '*' }))",
+    "lineNumber": 10,
     "severity": "medium",
-    "title": "Generic API Key Assignment",
+    "title": "CORS wildcard origin",
   },
   Object {
     "category": "insecure_config",
-    "confidence": "medium",
-    "layer": 2,
+    "confidence": "high",
+    "layer": 1,
     "lineContent": "app.use(cors({ origin: '*' }))",
     "lineNumber": 10,
-    "severity": "high",
-    "title": "[express] Express CORS allow all",
+    "severity": "medium",
+    "title": "Permissive CORS configuration",
   },
   Object {
     "category": "weak_crypto",
     "confidence": "high",
-    "layer": 1,
+    "layer": 2,
     "lineContent": "const hash = crypto.createHash('md5')",
     "lineNumber": 13,
     "severity": "high",
-    "title": "MD5 Hash Creation",
+    "title": "Weak Hash Algorithm",
   },
   Object {
-    "category": "dangerous_function",
+    "category": "xss",
     "confidence": "high",
     "layer": 2,
     "lineContent": "element.innerHTML = userInput",
     "lineNumber": 16,
-    "severity": "high",
-    "title": "innerHTML assignment",
+    "severity": "medium",
+    "title": "Potential DOM XSS vulnerability",
   },
 ]
 `;

package/src/__tests__/snapshots/scan-depth.test.ts

@@ -9,7 +9,39 @@
  */
 
 import { runLayer1Scan } from '../../detect/secrets'
-import { runLayer2Scan } from '../../detect/structural'
+import { parseFiles } from '../../parse/ast'
+import { runASTRulesOnFiles } from '../../detect/ast-rules'
+// Import AST rule modules so they self-register
+import '../../detect/ast-rules/weak-crypto-ast'
+import '../../detect/ast-rules/variables-ast'
+import '../../detect/ast-rules/risky-imports-ast'
+import '../../detect/ast-rules/secret-patterns-ast'
+import '../../detect/ast-rules/entropy-ast'
+import '../../detect/ast-rules/security-headers-ast'
+import '../../detect/ast-rules/dangerous-eval-ast'
+import '../../detect/ast-rules/dom-xss-ast'
+import '../../detect/ast-rules/json-parse-ast'
+import '../../detect/ast-rules/child-process-ast'
+import '../../detect/ast-rules/sql-injection-ast'
+import '../../detect/ast-rules/request-validation-ast'
+import '../../detect/ast-rules/auth-patterns-ast'
+import '../../detect/ast-rules/framework-checks-ast'
+import '../../detect/ast-rules/data-exposure-ast'
+import '../../detect/ast-rules/logic-gates-ast'
+import '../../detect/ast-rules/ssrf-ast'
+import '../../detect/ast-rules/xxe-ast'
+import '../../detect/ast-rules/log-injection-ast'
+import '../../detect/ast-rules/ai-fingerprinting-ast'
+import '../../detect/ast-rules/agent-tools-ast'
+import '../../detect/ast-rules/byok-ast'
+import '../../detect/ast-rules/endpoint-protection-ast'
+// execution-sinks-ast removed in Phase 4
+import '../../detect/ast-rules/mcp-security-ast'
+import '../../detect/ast-rules/model-supply-chain-ast'
+import '../../detect/ast-rules/package-hallucination-ast'
+import '../../detect/ast-rules/prompt-hygiene-ast'
+import '../../detect/ast-rules/rag-safety-ast'
+import '../../detect/ast-rules/schema-validation-ast'
 import type { ScanFile, Vulnerability } from '../../shared/types'
 
 // Helper to normalize vulnerability output for snapshot comparison
@@ -39,13 +71,13 @@ async function runCheapScan(file: ScanFile): Promise<object[]> {
   return normalizeVulnerabilities(layer1Result.vulnerabilities)
 }
 
-// Helper to run a full scan (Layer 1 + Layer 2, no AI validation)
+// Helper to run a full scan (Layer 1 + AST rules, no AI validation)
 async function runFullScan(file: ScanFile): Promise<object[]> {
-  const [layer1Result, layer2Result] = await Promise.all([
-    runLayer1Scan([file]),
-    runLayer2Scan([file]),
-  ])
-  return normalizeVulnerabilities([...layer1Result.vulnerabilities, ...layer2Result.vulnerabilities])
+  const layer1Result = await runLayer1Scan([file])
+  const fileInputs = [{ path: file.path, content: file.content }]
+  const asts = parseFiles(fileInputs)
+  const astFindings = runASTRulesOnFiles(asts, fileInputs)
+  return normalizeVulnerabilities([...layer1Result.vulnerabilities, ...astFindings])
 }
 
 describe('Scan Depth Snapshots', () => {

package/src/__tests__/taint/async-flow.test.ts

@@ -0,0 +1,247 @@
+/**
+ * Tests for Async Flow Taint Injection (Phase 3, Part 3)
+ *
+ * Verifies that:
+ * 1. Promise chain callback parameters (.then/.catch) inherit taint
+ * 2. Callback-style APIs (fs.readFile, event handlers) inject taint
+ * 3. Integration with the taint propagation engine
+ */
+
+import type { ScanFile } from '../../shared/types'
+import { parseFiles, clearASTCache } from '../../parse/ast'
+import { buildModuleGraph } from '../../model/module-graph'
+import { analyzeTaintsForProject } from '../../taint/cross-file-analyzer'
+import { analyzeTaintsForFile } from '../../taint/taint-analyzer'
+import { buildCrossFileIndex } from '../../taint/cross-file-index'
+import type { TaintFinding, CallResolutionContext } from '../../taint/propagation-types'
+
+function makeFile(path: string, content: string): ScanFile {
+  return {
+    path,
+    content,
+    language: path.endsWith('.js') ? 'javascript' : 'typescript',
+    size: content.length,
+  }
+}
+
+function analyzeSingleFile(content: string, path = 'src/app.ts'): TaintFinding[] {
+  const files = [makeFile(path, content)]
+  const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+  const ast = asts.get(path)
+  if (!ast) return []
+  return analyzeTaintsForFile(ast, path)
+}
+
+function analyzeProject(files: ScanFile[]): TaintFinding[] {
+  const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+  const moduleGraph = buildModuleGraph(files)
+  return analyzeTaintsForProject(files, asts, moduleGraph)
+}
+
+beforeEach(() => clearASTCache())
+
+// ============================================================================
+// Promise Chain: .then() / .catch()
+// ============================================================================
+
+describe('Async Flow: Promise .then() chains', () => {
+  it('seeds callback parameter with taint from .then() object', () => {
+    const findings = analyzeSingleFile(`
+      function handler(req, res) {
+        const input = req.body
+        const promise = Promise.resolve(input)
+        promise.then(data => {
+          eval(data)
+        })
+      }
+    `)
+
+    const commandFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('command')
+    )
+    expect(commandFindings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('propagates taint through chained .then() calls', () => {
+    const findings = analyzeSingleFile(`
+      function handler(req, res) {
+        const url = req.body.url
+        fetchData(url).then(response => {
+          return response
+        }).then(data => {
+          eval(data)
+        })
+      }
+    `)
+
+    const commandFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('command')
+    )
+    expect(commandFindings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('seeds .catch() callback parameter with taint', () => {
+    const findings = analyzeSingleFile(`
+      function handler(req, res) {
+        const input = req.body
+        doSomething(input).catch(err => {
+          eval(err)
+        })
+      }
+    `)
+
+    const commandFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('command')
+    )
+    expect(commandFindings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('no injection when promise object is not tainted', () => {
+    const findings = analyzeSingleFile(`
+      function handler(req, res) {
+        const safe = 'static'
+        Promise.resolve(safe).then(data => {
+          eval(data)
+        })
+      }
+    `)
+
+    // 'safe' is not tainted, so eval(data) should not produce a finding
+    // (data inherits taint from safe which has none)
+    const commandFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('command')
+    )
+    expect(commandFindings.length).toBe(0)
+  })
+
+  it('works with fetch().then() pattern', () => {
+    const findings = analyzeSingleFile(`
+      function handler(req, res) {
+        const url = req.query.target
+        fetch(url).then(response => {
+          response.json().then(data => {
+            db.execute(data)
+          })
+        })
+      }
+    `)
+
+    // fetch(url) already has taint from url
+    // response inherits via .then()
+    // data inherits via .then()
+    const findings_any = findings.filter(f =>
+      [...f.matchingKinds].some(k => k === 'sql' || k === 'ssrf')
+    )
+    expect(findings_any.length).toBeGreaterThanOrEqual(1)
+  })
+})
+
+// ============================================================================
+// Callback-Style APIs
+// ============================================================================
+
+describe('Async Flow: Callback APIs', () => {
+  it('seeds fs.readFile callback data param with path taint', () => {
+    const findings = analyzeSingleFile(`
+      function handler(req, res) {
+        const path = req.body.path
+        fs.readFile(path, (err, data) => {
+          eval(data)
+        })
+      }
+    `)
+
+    const commandFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('command')
+    )
+    expect(commandFindings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('seeds event handler callback with emitter taint', () => {
+    const findings = analyzeSingleFile(`
+      function handler(req, res) {
+        const tainted = req.body
+        emitter.on('data', (chunk) => {
+          eval(chunk)
+        })
+      }
+    `)
+
+    // emitter.on() with 'all' taintedArgs collects taint from all args.
+    // The string 'data' has no taint. `chunk` only gets tainted if one of the
+    // arguments to emitter.on() is tainted. In this case they're not (just a
+    // string and an arrow function), so this should produce no finding.
+    // This tests that we don't over-taint.
+    const commandFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('command')
+    )
+    expect(commandFindings.length).toBe(0)
+  })
+
+  it('no injection when fs.readFile path is static', () => {
+    const findings = analyzeSingleFile(`
+      function handler(req, res) {
+        fs.readFile('/etc/config.json', (err, data) => {
+          eval(data)
+        })
+      }
+    `)
+
+    // Static path = no taint on data
+    const commandFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('command')
+    )
+    expect(commandFindings.length).toBe(0)
+  })
+
+  it('seeds http.get callback with URL taint', () => {
+    const findings = analyzeSingleFile(`
+      function handler(req, res) {
+        const url = req.body.target
+        http.get(url, (response) => {
+          response.on('data', (chunk) => {
+            eval(chunk)
+          })
+        })
+      }
+    `)
+
+    // http.get(url, callback): url is tainted → response inherits taint
+    // Inner response.on('data', callback): response is tainted → chunk inherits
+    const commandFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('command')
+    )
+    expect(commandFindings.length).toBeGreaterThanOrEqual(1)
+  })
+})
+
+// ============================================================================
+// Cross-File + Async Integration
+// ============================================================================
+
+describe('Async Flow: Cross-file integration', () => {
+  it('taint flows through .then() in cross-file callee', () => {
+    const files = [
+      makeFile('src/handler.ts', `
+        import { processAsync } from './processor'
+        function handler(req, res) {
+          const input = req.body
+          processAsync(input)
+        }
+      `),
+      makeFile('src/processor.ts', `
+        export function processAsync(data) {
+          Promise.resolve(data).then(value => {
+            eval(value)
+          })
+        }
+      `),
+    ]
+
+    const findings = analyzeProject(files)
+    const commandFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('command')
+    )
+    expect(commandFindings.length).toBeGreaterThanOrEqual(1)
+  })
+})