@oculum/scanner 1.0.9 → 1.0.11

package/src/layer2/dangerous-functions/utils/schema-validation.ts

@@ -0,0 +1,91 @@
+/**
+ * Schema Validation Detection Utilities
+ *
+ * Functions for detecting schema validation patterns (zod, yup, joi, etc.)
+ * and manual validation patterns.
+ */
+
+/**
+ * Check if schema validation is applied near a JSON.parse call
+ * Looks for zod, yup, joi, or similar validation patterns
+ */
+export function hasSchemaValidationNearby(content: string, lineNumber: number): boolean {
+  const lines = content.split('\n')
+  const start = Math.max(0, lineNumber - 5)
+  const end = Math.min(lines.length, lineNumber + 10)
+  const context = lines.slice(start, end).join('\n')
+
+  const schemaValidationPatterns = [
+    // Zod patterns
+    /z\.(object|string|number|array|boolean)\s*\(/i,
+    /\.parse\s*\(/i,
+    /\.safeParse\s*\(/i,
+    /schema\.parse/i,
+    /Schema\.parse/i,
+    // Yup patterns
+    /yup\.(object|string|number|array|boolean)\s*\(/i,
+    /\.validate\s*\(/i,
+    /\.validateSync\s*\(/i,
+    // Joi patterns
+    /Joi\.(object|string|number|array|boolean)\s*\(/i,
+    /\.validateAsync\s*\(/i,
+    // Valibot patterns
+    /v\.(object|string|number|array|boolean)\s*\(/i,
+    // AJV patterns
+    /ajv\.compile/i,
+    /validate\s*\(\s*schema/i,
+    // TypeBox patterns
+    /Type\.(Object|String|Number|Array|Boolean)\s*\(/i,
+    // Generic validation patterns
+    /validateSchema/i,
+    /schemaValidator/i,
+    /parseAndValidate/i,
+  ]
+
+  return schemaValidationPatterns.some(p => p.test(context))
+}
+
+/**
+ * Check if this file appears to have form/input validation elsewhere
+ * (manual checks on body fields, type guards, etc.)
+ */
+export function hasManualValidation(content: string): boolean {
+  const manualValidationPatterns = [
+    // Type checking / type guards
+    /typeof\s+\w+\s*[!=]==?\s*['"](?:string|number|boolean|object)['"]|Array\.isArray\s*\(/i,
+    // Field existence checks followed by throws/returns
+    /if\s*\(\s*!(?:body|data|input)\.\w+\s*\)\s*\{?\s*(throw|return)/i,
+    // Property access with type assertion comments or inline validation
+    /\b(body|data|input)\s*as\s+\w+/i, // Type assertion
+    // Manual validation with error handling
+    /if\s*\(\s*![\w.]+\s*\|\|\s*typeof\s+[\w.]+/i,
+    // Using type predicates
+    /is\w+\s*\([\w.]+\)/i, // isFoo(bar) pattern
+  ]
+
+  return manualValidationPatterns.some(p => p.test(content))
+}
+
+/**
+ * Check if SQL query uses whitelist validation pattern
+ * e.g., columns validated against allowedColumns array before use
+ */
+export function hasSQLWhitelistValidation(content: string, lineNumber: number): boolean {
+  const lines = content.split('\n')
+  const contextStart = Math.max(0, lineNumber - 15)
+  const contextEnd = Math.min(lines.length, lineNumber + 5)
+  const context = lines.slice(contextStart, contextEnd).join('\n')
+
+  // Whitelist/allowlist validation patterns
+  const whitelistPatterns = [
+    /allowed\w*\s*=\s*\[/i, // allowedColumns = [...]
+    /whitelist\w*\s*=\s*\[/i, // whitelistFields = [...]
+    /valid\w*\s*=\s*\[/i, // validColumns = [...]
+    /\.filter\s*\([^)]*\.includes\s*\(/i, // .filter(c => allowed.includes(c))
+    /\.includes\s*\([^)]*\)/i, // allowedColumns.includes(col)
+    /\.every\s*\([^)]*\.includes/i, // columns.every(c => allowed.includes(c))
+    /if\s*\(\s*!.*\.includes/i, // if (!allowed.includes(...))
+  ]
+
+  return whitelistPatterns.some(p => p.test(context))
+}

package/src/layer2/data-exposure.ts

@@ -5,7 +5,7 @@
  */
 
 import type { Vulnerability, VulnerabilitySeverity } from '../types'
-import { isComment, isTestOrMockFile } from '../utils/context-helpers'
+import { isComment, isTestOrMockFile, isScannerOrFixtureFile } from '../utils/context-helpers'
 
 interface DataExposurePattern {
   name: string
@@ -174,6 +174,10 @@ export function detectDataExposure(
   filePath: string
 ): Vulnerability[] {
   const vulnerabilities: Vulnerability[] = []
+
+  // Skip scanner/fixture files to avoid self-detection
+  if (isScannerOrFixtureFile(filePath)) return vulnerabilities
+
   const lines = content.split('\n')
   const isTestFile = isTestOrMockFile(filePath)
   const isLowRiskFile = isLowRiskLoggingFile(filePath)

package/src/layer2/framework-checks.ts

@@ -10,6 +10,7 @@ import {
   isEnvVarReference,
   getServiceRoleKeyContext,
   isTestOrMockFile,
+  isScannerOrFixtureFile,
 } from '../utils/context-helpers'
 
 interface FrameworkPattern {
@@ -281,6 +282,10 @@ export function detectFrameworkIssues(
   filePath: string
 ): Vulnerability[] {
   const vulnerabilities: Vulnerability[] = []
+
+  // Skip scanner/fixture files to avoid self-detection
+  if (isScannerOrFixtureFile(filePath)) return vulnerabilities
+
   const lines = content.split('\n')
   const detectedFrameworks = detectFramework(content, filePath)
   const isTestFile = isTestOrMockFile(filePath)

package/src/layer2/index.ts

@@ -31,6 +31,11 @@ import { detectAIAgentTools } from './ai-agent-tools'
 import { detectRAGSafetyIssues } from './ai-rag-safety'
 import { detectAIEndpointProtection } from './ai-endpoint-protection'
 import { detectAISchemaValidation } from './ai-schema-validation'
+// AI Detection Roadmap Phase 1
+import { detectAIPackageHallucination } from './ai-package-hallucination'
+import { detectMCPSecurity } from './ai-mcp-security'
+// AI Detection Roadmap Phase 2
+import { detectModelSupplyChain } from './model-supply-chain'
 // Tier system imports
 import {
   type TierStats,
@@ -90,6 +95,11 @@ type Layer2DetectorStats = {
   ragSafety: number
   endpointProtection: number
   schemaValidation: number
+  // AI Detection Roadmap Phase 1
+  packageHallucination: number
+  mcpSecurity: number
+  // AI Detection Roadmap Phase 2
+  modelSupplyChain: number
 }
 
 // Process a single file through all Layer 2 detectors
@@ -114,10 +124,27 @@ function processFileLayer2(
     ragSafety: 0,
     endpointProtection: 0,
     schemaValidation: 0,
+    // AI Detection Roadmap Phase 1
+    packageHallucination: 0,
+    mcpSecurity: 0,
+    // AI Detection Roadmap Phase 2
+    modelSupplyChain: 0,
   }
 
-  // Skip non-code files
+  // Check if this is a manifest file (package.json, requirements.txt, etc.)
+  const isManifestFile = (filePath: string) => {
+    const manifestFiles = ['package.json', 'requirements.txt', 'Pipfile', 'pyproject.toml', 'setup.py']
+    return manifestFiles.some(f => filePath.endsWith(f))
+  }
+
+  // For non-code files, only run package hallucination detector on manifest files
   if (!isCodeFile(file.path)) {
+    if (isManifestFile(file.path)) {
+      // Run package hallucination detector on manifest files
+      const packageHallucinationFindings = detectAIPackageHallucination(file.content, file.path)
+      stats.packageHallucination = packageHallucinationFindings.length
+      return { findings: packageHallucinationFindings, stats }
+    }
     return { findings: [], stats }
   }
 
@@ -143,6 +170,11 @@ function processFileLayer2(
     middlewareConfig: options.middlewareConfig,
   })
   const schemaValidationFindings = detectAISchemaValidation(file.content, file.path)
+  // AI Detection Roadmap Phase 1
+  const packageHallucinationFindings = detectAIPackageHallucination(file.content, file.path)
+  const mcpSecurityFindings = detectMCPSecurity(file.content, file.path)
+  // AI Detection Roadmap Phase 2
+  const modelSupplyChainFindings = detectModelSupplyChain(file.content, file.path)
 
   // Update stats
   stats.variables = variableFindings.length
@@ -160,6 +192,11 @@ function processFileLayer2(
   stats.ragSafety = ragSafetyFindings.length
   stats.endpointProtection = endpointProtectionFindings.length
   stats.schemaValidation = schemaValidationFindings.length
+  // AI Detection Roadmap Phase 1
+  stats.packageHallucination = packageHallucinationFindings.length
+  stats.mcpSecurity = mcpSecurityFindings.length
+  // AI Detection Roadmap Phase 2
+  stats.modelSupplyChain = modelSupplyChainFindings.length
 
   return {
     findings: [
@@ -178,6 +215,11 @@ function processFileLayer2(
       ...ragSafetyFindings,
       ...endpointProtectionFindings,
       ...schemaValidationFindings,
+      // AI Detection Roadmap Phase 1
+      ...packageHallucinationFindings,
+      ...mcpSecurityFindings,
+      // AI Detection Roadmap Phase 2
+      ...modelSupplyChainFindings,
     ],
     stats,
   }
@@ -212,6 +254,11 @@ export async function runLayer2Scan(
     ragSafety: 0,
     endpointProtection: 0,
     schemaValidation: 0,
+    // AI Detection Roadmap Phase 1
+    packageHallucination: 0,
+    mcpSecurity: 0,
+    // AI Detection Roadmap Phase 2
+    modelSupplyChain: 0,
   }
 
   // Detect auth helpers once for all files (if not already provided)
@@ -303,6 +350,11 @@ export async function runLayer2Scan(
     ai_rag_safety: stats.ragSafety,
     ai_endpoint_protection: stats.endpointProtection,
     ai_schema_validation: stats.schemaValidation,
+    // AI Detection Roadmap Phase 1
+    ai_package_hallucination: stats.packageHallucination,
+    ai_mcp_security: stats.mcpSecurity,
+    // AI Detection Roadmap Phase 2
+    model_supply_chain: stats.modelSupplyChain,
   }
 
   // Compute deduped counts per category
@@ -341,6 +393,11 @@ export async function runLayer2Scan(
     ai_rag_safety: 'ai_rag_safety',
     ai_endpoint_protection: 'ai_endpoint_protection',
     ai_schema_validation: 'ai_schema_validation',
+    // AI Detection Roadmap Phase 1
+    ai_package_hallucination: 'ai_package_hallucination',
+    ai_mcp_security: 'ai_mcp_security',
+    // AI Detection Roadmap Phase 2
+    model_supply_chain: 'model_supply_chain',
   }
 
   // Heuristic breakdown available in stats.raw and stats.tiers for debugging
@@ -538,3 +595,8 @@ export { detectAIAgentTools } from './ai-agent-tools'
 export { detectRAGSafetyIssues } from './ai-rag-safety'
 export { detectAIEndpointProtection } from './ai-endpoint-protection'
 export { detectAISchemaValidation } from './ai-schema-validation'
+// AI Detection Roadmap Phase 1
+export { detectAIPackageHallucination } from './ai-package-hallucination'
+export { detectMCPSecurity } from './ai-mcp-security'
+// AI Detection Roadmap Phase 2
+export { detectModelSupplyChain } from './model-supply-chain'

package/src/layer2/logic-gates.ts

@@ -4,6 +4,7 @@
  */
 
 import type { Vulnerability } from '../types'
+import { isScannerOrFixtureFile } from '../utils/context-helpers'
 
 interface LogicPattern {
   name: string
@@ -134,6 +135,10 @@ export function detectLogicGates(
   filePath: string
 ): Vulnerability[] {
   const vulnerabilities: Vulnerability[] = []
+
+  // Skip scanner/fixture files to avoid self-detection
+  if (isScannerOrFixtureFile(filePath)) return vulnerabilities
+
   const lines = content.split('\n')
 
   // Check each line against patterns