@oculum/scanner 1.0.14 → 1.0.15

package/src/__tests__/taint/taint-summary.test.ts

@@ -0,0 +1,472 @@
+/**
+ * Tests for Phase 8 Part 2: Function Taint Summaries
+ *
+ * Verifies buildFunctionSummary(), composeSummary(), and getOrBuildSummary()
+ * produce correct results for pass-through, sanitized, multi-param, and
+ * recursive scenarios.
+ */
+
+import { parseFile, clearASTCache } from '../../parse/ast'
+import { buildFileCFGs } from '../../taint/cfg-builder'
+import { buildFileAnalysisCache, buildProjectAnalysisCache } from '../../taint/file-analysis-cache'
+import { buildFunctionSummary, composeSummary, getOrBuildSummary } from '../../taint/taint-summary'
+import type { FunctionDefinition } from '../../taint/cross-file-index'
+import type { CallResolutionContext, FunctionTaintSummary, SummaryCache } from '../../taint/propagation-types'
+import { BUILDING_SENTINEL } from '../../taint/propagation-types'
+import type { TaintKind } from '../../taint/types'
+import type Parser from 'tree-sitter'
+import { walkAST } from '../../parse/ast'
+
+afterEach(() => clearASTCache())
+
+let counter = 0
+function uniquePath(base: string) {
+  counter++
+  return `taint-summary-test-${counter}-${base}`
+}
+
+/** Helper: create a FunctionDefinition from parsed code */
+function makeFuncDef(ast: ReturnType<typeof parseFile>, funcName: string, filePath: string): FunctionDefinition | null {
+  if (!ast) return null
+  let funcNode: Parser.SyntaxNode | null = null
+  let params: string[] = []
+
+  walkAST(ast.tree.rootNode, (node) => {
+    if (
+      (node.type === 'function_declaration' || node.type === 'export_statement') &&
+      !funcNode
+    ) {
+      const actual = node.type === 'export_statement'
+        ? node.namedChildren.find(c => c.type === 'function_declaration')
+        : node
+      if (actual) {
+        const nameNode = actual.childForFieldName('name')
+        if (nameNode?.text === funcName) {
+          funcNode = actual
+          const paramsNode = actual.childForFieldName('parameters')
+          if (paramsNode) {
+            for (const p of paramsNode.namedChildren) {
+              if (p.type === 'identifier') params.push(p.text)
+              else if (p.type === 'required_parameter' || p.type === 'optional_parameter') {
+                const pattern = p.childForFieldName('pattern')
+                if (pattern?.type === 'identifier') params.push(pattern.text)
+              }
+            }
+          }
+          return true
+        }
+      }
+    }
+    return false
+  })
+
+  if (!funcNode) return null
+  return {
+    filePath,
+    functionName: funcName,
+    astNode: funcNode,
+    params,
+    isAsync: false,
+    isExported: true,
+  }
+}
+
+// ============================================================================
+// buildFunctionSummary
+// ============================================================================
+
+describe('buildFunctionSummary', () => {
+  it('records pass-through return taint for identity function', () => {
+    const code = `
+      export function identity(input: string) {
+        return input
+      }
+    `
+    const fp = uniquePath('identity.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+    const funcDef = makeFuncDef(ast, 'identity', fp)!
+    const cfg = cache.cfgs.get('identity')!
+
+    const summary = buildFunctionSummary(cfg, cache, fp, funcDef)
+
+    expect(summary).not.toBeNull()
+    // Param 0 should have all taint kinds surviving to return
+    const returnKinds = summary!.paramReturnKinds.get(0)
+    expect(returnKinds).toBeDefined()
+    expect(returnKinds!.size).toBeGreaterThan(0)
+  })
+
+  it('records no return taint when function ignores parameter', () => {
+    const code = `
+      export function constant(input: string) {
+        return "hello"
+      }
+    `
+    const fp = uniquePath('constant.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+    const funcDef = makeFuncDef(ast, 'constant', fp)!
+    const cfg = cache.cfgs.get('constant')!
+
+    const summary = buildFunctionSummary(cfg, cache, fp, funcDef)
+
+    // No taint reaches return, so summary may be null or have empty return kinds
+    if (summary) {
+      const returnKinds = summary.paramReturnKinds.get(0)
+      expect(!returnKinds || returnKinds.size === 0).toBe(true)
+    }
+  })
+
+  it('records sink entries for functions with sinks', () => {
+    const code = `
+      import { Pool } from 'pg'
+      const pool = new Pool()
+      export function runQuery(input: string) {
+        return pool.query(input)
+      }
+    `
+    const fp = uniquePath('sink-func.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+    const funcDef = makeFuncDef(ast, 'runQuery', fp)!
+    const cfg = cache.cfgs.get('runQuery')
+
+    if (cfg) {
+      const summary = buildFunctionSummary(cfg, cache, fp, funcDef)
+
+      if (summary) {
+        // Should have sink entries for param 0 (sql sink)
+        const sinkEntries = summary.paramSinkEntries.get(0)
+        if (sinkEntries && sinkEntries.length > 0) {
+          expect(sinkEntries[0].reachableKinds.size).toBeGreaterThan(0)
+        }
+      }
+    }
+  })
+
+  it('handles multi-param functions', () => {
+    const code = `
+      export function combine(a: string, b: string) {
+        return a + b
+      }
+    `
+    const fp = uniquePath('multi-param.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+    const funcDef = makeFuncDef(ast, 'combine', fp)!
+    const cfg = cache.cfgs.get('combine')!
+
+    const summary = buildFunctionSummary(cfg, cache, fp, funcDef)
+
+    if (summary) {
+      // Both params should contribute to return taint
+      const p0 = summary.paramReturnKinds.get(0)
+      const p1 = summary.paramReturnKinds.get(1)
+      if (p0) expect(p0.size).toBeGreaterThan(0)
+      if (p1) expect(p1.size).toBeGreaterThan(0)
+    }
+  })
+
+  it('returns null for function with no taint behavior', () => {
+    const code = `
+      export function add(a: number, b: number) {
+        return a + b
+      }
+    `
+    const fp = uniquePath('no-taint.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+    const funcDef = makeFuncDef(ast, 'add', fp)!
+    const cfg = cache.cfgs.get('add')
+
+    if (cfg) {
+      const summary = buildFunctionSummary(cfg, cache, fp, funcDef)
+      // May or may not be null — depends on whether numeric params get tainted
+      // Just verify it doesn't crash
+      expect(true).toBe(true)
+    }
+  })
+})
+
+// ============================================================================
+// composeSummary
+// ============================================================================
+
+describe('composeSummary', () => {
+  it('returns intersection of caller arg taint and surviving return kinds', () => {
+    const summary: FunctionTaintSummary = {
+      functionName: 'identity',
+      filePath: 'test.ts',
+      params: ['input'],
+      paramReturnKinds: new Map([[0, new Set<TaintKind>(['sql', 'xss', 'command'])]]),
+      paramSinkEntries: new Map(),
+    }
+
+    const code = `identity(x)`
+    const fp = uniquePath('compose.ts')
+    const ast = parseFile(code, fp)!
+    const callNode = ast.tree.rootNode.descendantsOfType('call_expression')[0]
+
+    // Caller only has 'sql' taint on the arg
+    const result = composeSummary(
+      summary,
+      [new Set<TaintKind>(['sql'])],
+      'caller.ts',
+      callNode,
+    )
+
+    // Return should only have 'sql' (intersection)
+    expect(result.returnTaint.has('sql')).toBe(true)
+    expect(result.returnTaint.has('xss')).toBe(false)
+  })
+
+  it('returns empty when no intersection', () => {
+    const summary: FunctionTaintSummary = {
+      functionName: 'identity',
+      filePath: 'test.ts',
+      params: ['input'],
+      paramReturnKinds: new Map([[0, new Set<TaintKind>(['sql'])]]),
+      paramSinkEntries: new Map(),
+    }
+
+    const code = `identity(x)`
+    const fp = uniquePath('no-intersect.ts')
+    const ast = parseFile(code, fp)!
+    const callNode = ast.tree.rootNode.descendantsOfType('call_expression')[0]
+
+    const result = composeSummary(
+      summary,
+      [new Set<TaintKind>(['xss'])],
+      'caller.ts',
+      callNode,
+    )
+
+    expect(result.returnTaint.size).toBe(0)
+  })
+
+  it('emits callee findings for reachable sinks', () => {
+    const summary: FunctionTaintSummary = {
+      functionName: 'runQuery',
+      filePath: 'db.ts',
+      params: ['input'],
+      paramReturnKinds: new Map(),
+      paramSinkEntries: new Map([
+        [0, [{
+          sinkLine: 5,
+          sinkExpression: 'pool.query(input)',
+          sinkType: 'sql_query',
+          reachableKinds: new Set<TaintKind>(['sql']),
+        }]],
+      ]),
+    }
+
+    const code = `runQuery(userInput)`
+    const fp = uniquePath('callee-findings.ts')
+    const ast = parseFile(code, fp)!
+    const callNode = ast.tree.rootNode.descendantsOfType('call_expression')[0]
+
+    const result = composeSummary(
+      summary,
+      [new Set<TaintKind>(['sql', 'xss'])],
+      'caller.ts',
+      callNode,
+    )
+
+    expect(result.calleeFindings.length).toBe(1)
+    expect(result.calleeFindings[0].matchingKinds.has('sql')).toBe(true)
+    expect(result.calleeFindings[0].matchingKinds.has('xss')).toBe(false) // not reachable at sink
+  })
+
+  it('handles empty arg taint', () => {
+    const summary: FunctionTaintSummary = {
+      functionName: 'identity',
+      filePath: 'test.ts',
+      params: ['input'],
+      paramReturnKinds: new Map([[0, new Set<TaintKind>(['sql'])]]),
+      paramSinkEntries: new Map(),
+    }
+
+    const code = `identity(x)`
+    const fp = uniquePath('empty-arg.ts')
+    const ast = parseFile(code, fp)!
+    const callNode = ast.tree.rootNode.descendantsOfType('call_expression')[0]
+
+    const result = composeSummary(
+      summary,
+      [new Set<TaintKind>()],
+      'caller.ts',
+      callNode,
+    )
+
+    expect(result.returnTaint.size).toBe(0)
+    expect(result.calleeFindings.length).toBe(0)
+  })
+
+  it('composes multi-param summaries correctly', () => {
+    const summary: FunctionTaintSummary = {
+      functionName: 'combine',
+      filePath: 'test.ts',
+      params: ['a', 'b'],
+      paramReturnKinds: new Map([
+        [0, new Set<TaintKind>(['sql', 'xss'])],
+        [1, new Set<TaintKind>(['command'])],
+      ]),
+      paramSinkEntries: new Map(),
+    }
+
+    const code = `combine(x, y)`
+    const fp = uniquePath('multi-compose.ts')
+    const ast = parseFile(code, fp)!
+    const callNode = ast.tree.rootNode.descendantsOfType('call_expression')[0]
+
+    const result = composeSummary(
+      summary,
+      [new Set<TaintKind>(['sql']), new Set<TaintKind>(['command', 'path'])],
+      'caller.ts',
+      callNode,
+    )
+
+    // Param 0: sql (from intersection of [sql] ∩ [sql,xss])
+    // Param 1: command (from intersection of [command,path] ∩ [command])
+    expect(result.returnTaint.has('sql')).toBe(true)
+    expect(result.returnTaint.has('command')).toBe(true)
+    expect(result.returnTaint.has('xss')).toBe(false)
+    expect(result.returnTaint.has('path')).toBe(false)
+  })
+})
+
+// ============================================================================
+// getOrBuildSummary
+// ============================================================================
+
+describe('getOrBuildSummary', () => {
+  it('returns null when summaryCache is not set', () => {
+    const fp = uniquePath('no-cache.ts')
+    const ctx: CallResolutionContext = {
+      crossFileIndex: { resolveImport: new Map(), functionDefs: new Map(), callSites: new Map() },
+      allASTs: new Map(),
+      callStack: new Set(),
+      maxDepth: 5,
+      resultCache: new Map(),
+    }
+
+    const funcDef: FunctionDefinition = {
+      filePath: fp,
+      functionName: 'test',
+      astNode: null as any,
+      params: [],
+      isAsync: false,
+      isExported: false,
+    }
+
+    expect(getOrBuildSummary(funcDef, ctx)).toBeNull()
+  })
+
+  it('returns null when analysisCache is not set', () => {
+    const fp = uniquePath('no-analysis.ts')
+    const summaryCache: SummaryCache = new Map()
+    const ctx: CallResolutionContext = {
+      crossFileIndex: { resolveImport: new Map(), functionDefs: new Map(), callSites: new Map() },
+      allASTs: new Map(),
+      callStack: new Set(),
+      maxDepth: 5,
+      resultCache: new Map(),
+      summaryCache,
+    }
+
+    const funcDef: FunctionDefinition = {
+      filePath: fp,
+      functionName: 'test',
+      astNode: null as any,
+      params: [],
+      isAsync: false,
+      isExported: false,
+    }
+
+    expect(getOrBuildSummary(funcDef, ctx)).toBeNull()
+  })
+
+  it('returns null for recursive functions (BUILDING_SENTINEL)', () => {
+    const fp = uniquePath('recursive.ts')
+    const summaryCache: SummaryCache = new Map()
+    summaryCache.set(`${fp}:recurse`, BUILDING_SENTINEL)
+
+    const ctx: CallResolutionContext = {
+      crossFileIndex: { resolveImport: new Map(), functionDefs: new Map(), callSites: new Map() },
+      allASTs: new Map(),
+      callStack: new Set(),
+      maxDepth: 5,
+      resultCache: new Map(),
+      summaryCache,
+      analysisCache: new Map(),
+    }
+
+    const funcDef: FunctionDefinition = {
+      filePath: fp,
+      functionName: 'recurse',
+      astNode: null as any,
+      params: [],
+      isAsync: false,
+      isExported: false,
+    }
+
+    expect(getOrBuildSummary(funcDef, ctx)).toBeNull()
+  })
+
+  it('returns cached summary on second call', () => {
+    const code = `
+      export function identity(input: string) {
+        return input
+      }
+    `
+    const fp = uniquePath('cached.ts')
+    const ast = parseFile(code, fp)!
+    const analysisCache = buildProjectAnalysisCache(new Map([[fp, ast]]))
+    const summaryCache: SummaryCache = new Map()
+
+    const ctx: CallResolutionContext = {
+      crossFileIndex: { resolveImport: new Map(), functionDefs: new Map(), callSites: new Map() },
+      allASTs: new Map([[fp, ast]]),
+      callStack: new Set(),
+      maxDepth: 5,
+      resultCache: new Map(),
+      summaryCache,
+      analysisCache,
+    }
+
+    const funcDef = makeFuncDef(ast, 'identity', fp)!
+
+    const first = getOrBuildSummary(funcDef, ctx)
+    const second = getOrBuildSummary(funcDef, ctx)
+
+    // Should be the same reference (cached)
+    expect(second).toBe(first)
+  })
+
+  it('returns null when file is not in analysisCache', () => {
+    const fp = uniquePath('missing-file.ts')
+    const summaryCache: SummaryCache = new Map()
+
+    const ctx: CallResolutionContext = {
+      crossFileIndex: { resolveImport: new Map(), functionDefs: new Map(), callSites: new Map() },
+      allASTs: new Map(),
+      callStack: new Set(),
+      maxDepth: 5,
+      resultCache: new Map(),
+      summaryCache,
+      analysisCache: new Map(), // empty — file not cached
+    }
+
+    const funcDef: FunctionDefinition = {
+      filePath: fp,
+      functionName: 'test',
+      astNode: null as any,
+      params: [],
+      isAsync: false,
+      isExported: false,
+    }
+
+    expect(getOrBuildSummary(funcDef, ctx)).toBeNull()
+  })
+})

package/src/detect/ai-code/index.ts

@@ -1,11 +1,6 @@
-export { detectAIAgentTools } from './agent-tools'
-export { detectBYOKPatterns } from './byok-patterns'
-export { detectAIEndpointProtection } from './endpoint-protection'
-export { detectAIExecutionSinks } from './execution-sinks'
-export { detectAIFingerprints } from './fingerprinting'
-export { detectMCPSecurity } from './mcp-security'
-export { detectModelSupplyChain } from './model-supply-chain'
-export { detectAIPackageHallucination } from './package-hallucination'
-export { detectAIPromptHygiene } from './prompt-hygiene'
-export { detectRAGSafetyIssues } from './rag-safety'
-export { detectAISchemaValidation } from './schema-validation'
+/**
+ * AI Code Detection (Legacy)
+ *
+ * All regex-based AI code detectors have been retired in favour of AST rules
+ * (see detect/ast-rules/). This barrel file is kept empty for backward compatibility.
+ */