@opensip-cli/checks-typescript 0.1.0

package/dist/checks/security/input-sanitization.js

@@ -0,0 +1,255 @@
+// @fitness-ignore-file no-generic-error -- Generic errors appropriate in this context
+/**
+ * @fileoverview Detect unsanitized user input usage
+ *
+ * Uses AST analysis to detect unsanitized user input in HTML injection,
+ * command injection, and path traversal contexts. AST context eliminates
+ * false positives from regex definitions, string constants, and comments.
+ *
+ *
+ */
+import { defineCheck } from '@opensip-cli/fitness';
+import { parseSource, walkNodes, getLineNumber } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/** Names of user input sources on request objects */
+const USER_INPUT_PROPERTIES = new Set(['body', 'params', 'query']);
+/** Names of request objects */
+const REQUEST_OBJECT_NAMES = new Set(['request', 'req']);
+/** Dangerous command execution function names */
+const EXEC_FUNCTIONS = new Set([
+    'exec',
+    'execSync',
+    'spawn',
+    'spawnSync',
+    'execFile',
+    'execFileSync',
+]);
+/** Dangerous file system function names */
+const FS_FUNCTIONS = new Set([
+    'readFile',
+    'readFileSync',
+    'writeFile',
+    'writeFileSync',
+    'unlink',
+    'unlinkSync',
+    'rmdir',
+    'rmdirSync',
+    'mkdir',
+    'mkdirSync',
+]);
+/**
+ * Check if an expression tree references user input (req.body, req.params, req.query).
+ * Walks the subtree of the given node looking for property access chains like
+ * `request.body.field` or `req.query.param`.
+ */
+function referencesUserInput(node) {
+    if (ts.isPropertyAccessExpression(node)) {
+        // Check for req.body, req.params, req.query
+        if (USER_INPUT_PROPERTIES.has(node.name.text) &&
+            ts.isIdentifier(node.expression) &&
+            REQUEST_OBJECT_NAMES.has(node.expression.text)) {
+            return true;
+        }
+        // Check for deeper access: req.body.field
+        if (ts.isPropertyAccessExpression(node.expression)) {
+            return referencesUserInput(node.expression);
+        }
+    }
+    // Check children
+    let found = false;
+    ts.forEachChild(node, (child) => {
+        if (!found && referencesUserInput(child)) {
+            found = true;
+        }
+    });
+    return found;
+}
+/**
+ * Check if a node is inside a string literal or regex definition,
+ * which would indicate this is a pattern definition, not actual code.
+ */
+function isInStringOrRegex(node) {
+    let current = node.parent;
+    while (!ts.isSourceFile(current)) {
+        /* v8 ignore next -- defensive AST/type guard */
+        if (ts.isStringLiteral(current) || ts.isRegularExpressionLiteral(current))
+            return true;
+        /* v8 ignore next -- defensive AST/type guard */
+        if (ts.isNoSubstitutionTemplateLiteral(current))
+            return true;
+        current = current.parent;
+    }
+    return false;
+}
+function truncateMatch(node, maxLength = 200) {
+    const text = node.getText();
+    /* v8 ignore next -- defensive AST/type guard */
+    return text.length > maxLength ? text.slice(0, maxLength) + '...' : text;
+}
+function checkInnerHtmlAssignment(node, sourceFile, filePath) {
+    if (ts.isBinaryExpression(node) &&
+        (node.operatorToken.kind === ts.SyntaxKind.EqualsToken ||
+            node.operatorToken.kind === ts.SyntaxKind.PlusEqualsToken) &&
+        ts.isPropertyAccessExpression(node.left) &&
+        node.left.name.text === 'innerHTML' &&
+        referencesUserInput(node.right)) {
+        return {
+            line: getLineNumber(node, sourceFile),
+            column: 0,
+            message: 'innerHTML with potential user input - use textContent or sanitize',
+            severity: 'error',
+            suggestion: 'Use textContent for plain text: element.textContent = userInput. For HTML, use DOMPurify: element.innerHTML = DOMPurify.sanitize(userInput);',
+            match: node.getText(),
+            filePath,
+        };
+    }
+    return null;
+}
+function checkDangerouslySetInnerHTML(node, sourceFile, filePath) {
+    if (ts.isJsxAttribute(node) &&
+        ts.isIdentifier(node.name) &&
+        node.name.text === 'dangerouslySetInnerHTML') {
+        return {
+            line: getLineNumber(node, sourceFile),
+            column: 0,
+            message: 'dangerouslySetInnerHTML usage - ensure input is sanitized',
+            severity: 'warning',
+            suggestion: 'Sanitize content before using dangerouslySetInnerHTML: dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(content) }}. Consider using markdown renderers with XSS protection.',
+            match: node.getText(),
+            filePath,
+        };
+    }
+    return null;
+}
+function getCallFunctionName(node) {
+    const callee = node.expression;
+    if (ts.isIdentifier(callee))
+        return callee.text;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (ts.isPropertyAccessExpression(callee))
+        return callee.name.text;
+    return '';
+}
+function checkUnsanitizedCallArgs(node, sourceFile, filePath, rule) {
+    const { functionNames, message, suggestion } = rule;
+    const functionName = getCallFunctionName(node);
+    if (!functionNames.has(functionName))
+        return null;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (isInStringOrRegex(node))
+        return null;
+    for (const arg of node.arguments) {
+        if (referencesUserInput(arg)) {
+            return {
+                line: getLineNumber(node, sourceFile),
+                column: 0,
+                message,
+                severity: 'error',
+                suggestion,
+                match: truncateMatch(node),
+                filePath,
+            };
+        }
+    }
+    return null;
+}
+function checkHtmlTemplateInterpolation(node, sourceFile, filePath) {
+    if (!ts.isTemplateExpression(node))
+        return null;
+    if (!/^\s*<[a-zA-Z]/.test(node.head.text))
+        return null;
+    for (const span of node.templateSpans) {
+        if (referencesUserInput(span.expression)) {
+            return {
+                line: getLineNumber(node, sourceFile),
+                column: 0,
+                message: 'Unsanitized user input in HTML template - use html-escaper',
+                severity: 'error',
+                suggestion: 'Use html-escaper or DOMPurify to sanitize user input before inserting into HTML: import { escape } from "html-escaper"; const safeHtml = escape(userInput);',
+                match: truncateMatch(node),
+                filePath,
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Check: security/input-sanitization
+ *
+ * Detects user input used without proper sanitization using AST analysis.
+ * Walks the AST to find actual innerHTML assignments, exec/spawn calls,
+ * and file operations with user input references.
+ *
+ *
+ */
+export const inputSanitization = defineCheck({
+    id: '31ef5173-a102-4a37-bc14-3f5bb08f9688',
+    slug: 'input-sanitization',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    // 'raw', not 'strip-strings': checkHtmlTemplateInterpolation classifies a
+    // template as "HTML" by testing the head.text prefix (/^\s*<[a-zA-Z]/). Under
+    // strip-strings the head content is blanked, so all such templates would be
+    // silently ignored. The main sinks use AST expression walks (unaffected).
+    contentFilter: 'raw',
+    description: 'Detect unsanitized user input usage',
+    longDescription: `**Purpose:** Detects user input from request objects (req.body, req.params, req.query) flowing unsanitized into dangerous sinks, using AST analysis to avoid false positives.
+
+**Detects:**
+- innerHTML assignments with user input: \`element.innerHTML = req.body.content\`
+- \`dangerouslySetInnerHTML\` JSX attribute usage
+- User input passed to shell commands: \`exec()\`, \`execSync()\`, \`spawn()\`, \`spawnSync()\`, \`execFile()\`, \`execFileSync()\`
+- User input in file system operations: \`readFile()\`, \`writeFile()\`, \`unlink()\`, etc. (path traversal)
+- User input interpolated into HTML template literals: \`\`<div>\${req.body.name}</div>\`\`
+
+**Why it matters:** Unsanitized user input leads to XSS, command injection, and path traversal vulnerabilities. AST-level detection catches real data flow issues while ignoring string constants and comments.
+
+**Scope:** General best practice. Analyzes each file individually using TypeScript AST.`,
+    tags: ['security', 'injection', 'sanitization'],
+    fileTypes: ['ts'],
+    confidence: 'high',
+    analyze(content, filePath) {
+        const sourceFile = parseSource(content, filePath);
+        /* v8 ignore next -- defensive guard */
+        if (!sourceFile)
+            return [];
+        const violations = [];
+        walkNodes(sourceFile, (node) => {
+            const innerHtml = checkInnerHtmlAssignment(node, sourceFile, filePath);
+            if (innerHtml) {
+                violations.push(innerHtml);
+                return;
+            }
+            const dangerousHtml = checkDangerouslySetInnerHTML(node, sourceFile, filePath);
+            if (dangerousHtml) {
+                violations.push(dangerousHtml);
+                return;
+            }
+            if (ts.isCallExpression(node)) {
+                const cmdInjection = checkUnsanitizedCallArgs(node, sourceFile, filePath, {
+                    functionNames: EXEC_FUNCTIONS,
+                    message: 'User input passed to shell command - potential command injection',
+                    suggestion: 'Never pass user input directly to shell commands. Use execFile with separate arguments array, or validate input against a strict allowlist. Consider using child_process.spawn with shell: false.',
+                });
+                if (cmdInjection) {
+                    violations.push(cmdInjection);
+                    return;
+                }
+                const pathTraversal = checkUnsanitizedCallArgs(node, sourceFile, filePath, {
+                    functionNames: FS_FUNCTIONS,
+                    message: 'User input in file path - potential path traversal vulnerability',
+                    suggestion: 'Validate file paths with path.resolve and ensure they stay within allowed directories: const safePath = path.resolve(baseDir, userInput); if (!safePath.startsWith(baseDir)) throw new Error("Invalid path");',
+                });
+                if (pathTraversal) {
+                    violations.push(pathTraversal);
+                    return;
+                }
+            }
+            const htmlTemplate = checkHtmlTemplateInterpolation(node, sourceFile, filePath);
+            if (htmlTemplate) {
+                violations.push(htmlTemplate);
+            }
+        });
+        return violations;
+    },
+});
+//# sourceMappingURL=input-sanitization.js.map

package/dist/checks/security/input-sanitization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-sanitization.js","sourceRoot":"","sources":["../../../src/checks/security/input-sanitization.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,qDAAqD;AACrD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnE,+BAA+B;AAC/B,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAEzD,iDAAiD;AACjD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,MAAM;IACN,UAAU;IACV,OAAO;IACP,WAAW;IACX,UAAU;IACV,cAAc;CACf,CAAC,CAAC;AAEH,2CAA2C;AAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,UAAU;IACV,cAAc;IACd,WAAW;IACX,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,WAAW;IACX,OAAO;IACP,WAAW;CACZ,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,4CAA4C;QAC5C,IACE,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;YAChC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAC9C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,0CAA0C;QAC1C,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,OAAO,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC9B,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,gDAAgD;QAChD,IAAI,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,gDAAgD;QAChD,IAAI,EAAE,CAAC,+BAA+B,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAa,EAAE,SAAS,GAAG,GAAG;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC5B,gDAAgD;IAChD,OAAO,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAa,EACb,UAAyB,EACzB,QAAgB;IAEhB,IACE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC3B,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW;YACpD,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;QAC5D,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QACnC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;YACrC,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,mEAAmE;YAC5E,QAAQ,EAAE,OAAO;YACjB,UAAU,EACR,8IAA8I;YAChJ,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;YACrB,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CACnC,IAAa,EACb,UAAyB,EACzB,QAAgB;IAEhB,IACE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC;QACvB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,yBAAyB,EAC5C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;YACrC,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,2DAA2D;YACpE,QAAQ,EAAE,SAAS;YACnB,UAAU,EACR,kLAAkL;YACpL,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;YACrB,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAuB;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/B,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAChD,gDAAgD;IAChD,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IACnE,OAAO,EAAE,CAAC;AACZ,CAAC;AAQD,SAAS,wBAAwB,CAC/B,IAAuB,EACvB,UAAyB,EACzB,QAAgB,EAChB,IAAyB;IAEzB,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IACpD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,gDAAgD;IAChD,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;gBACrC,MAAM,EAAE,CAAC;gBACT,OAAO;gBACP,QAAQ,EAAE,OAAO;gBACjB,UAAU;gBACV,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC;gBAC1B,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,8BAA8B,CACrC,IAAa,EACb,UAAyB,EACzB,QAAgB;IAEhB,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;gBACrC,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,4DAA4D;gBACrE,QAAQ,EAAE,OAAO;gBACjB,UAAU,EACR,6JAA6J;gBAC/J,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC;gBAC1B,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,oBAAoB;IAC1B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,aAAa,EAAE,KAAK;IACpB,WAAW,EAAE,qCAAqC;IAClD,eAAe,EAAE;;;;;;;;;;;wFAWqE;IACtF,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC;IAC/C,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,UAAU,EAAE,MAAM;IAElB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,uCAAuC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7B,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACvE,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,MAAM,aAAa,GAAG,4BAA4B,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC/E,IAAI,aAAa,EAAE,CAAC;gBAClB,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC/B,OAAO;YACT,CAAC;YAED,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE;oBACxE,aAAa,EAAE,cAAc;oBAC7B,OAAO,EAAE,kEAAkE;oBAC3E,UAAU,EACR,mMAAmM;iBACtM,CAAC,CAAC;gBACH,IAAI,YAAY,EAAE,CAAC;oBACjB,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBAED,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE;oBACzE,aAAa,EAAE,YAAY;oBAC3B,OAAO,EAAE,kEAAkE;oBAC3E,UAAU,EACR,+MAA+M;iBAClN,CAAC,CAAC;gBACH,IAAI,aAAa,EAAE,CAAC;oBAClB,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC/B,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,8BAA8B,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAChF,IAAI,YAAY,EAAE,CAAC;gBACjB,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/sql-injection.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @fileoverview Detect potential SQL injection vulnerabilities
+ *
+ * Uses AST analysis to find SQL injection patterns in template literals and
+ * string concatenation. AST context eliminates false positives from suggestion
+ * text, error messages, and comments.
+ */
+import { type CheckViolation } from '@opensip-cli/fitness';
+/**
+ * Check: security/sql-injection
+ *
+ * Detects potential SQL injection vulnerabilities using AST analysis.
+ * Walks template literals and string concatenation to find SQL patterns,
+ * while filtering out suggestion text, messages, and tagged templates.
+ */
+/**
+ * Pure analysis function. Exported so unit tests can exercise the
+ * detection logic without standing up the full Check framework
+ * (defineCheck wraps `analyze` into an `execute` closure that
+ * requires an ExecutionContext to invoke).
+ */
+export declare function analyzeSqlInjection(content: string, filePath: string): CheckViolation[];
+export declare const sqlInjection: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=sql-injection.d.ts.map

package/dist/checks/security/sql-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection.d.ts","sourceRoot":"","sources":["../../../src/checks/security/sql-injection.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAkTxE;;;;;;GAMG;AACH;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAcvF;AAED,eAAO,MAAM,YAAY,sCAuBvB,CAAC"}

package/dist/checks/security/sql-injection.js

@@ -0,0 +1,330 @@
+/**
+ * @fileoverview Detect potential SQL injection vulnerabilities
+ *
+ * Uses AST analysis to find SQL injection patterns in template literals and
+ * string concatenation. AST context eliminates false positives from suggestion
+ * text, error messages, and comments.
+ */
+import { defineCheck } from '@opensip-cli/fitness';
+import { parseSource, walkNodes, getLineNumber } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/**
+ * SQL structural patterns indicating actual SQL statements (not casual English).
+ * Requires SQL keyword + structural follow-up: SELECT...FROM, INSERT INTO, etc.
+ */
+const SQL_STRUCTURE_PATTERN = 
+// eslint-disable-next-line sonarjs/regex-complexity -- enumerates SQL DML/DDL shapes in a single bounded alternation; splitting fragments the rule's intent
+/\b(?:SELECT\s+[\w.*]+\s+FROM|INSERT\s+INTO|UPDATE\s+\w+\s+SET|DELETE\s+FROM|DROP\s+(?:TABLE|INDEX|DATABASE|VIEW)|ALTER\s+TABLE|CREATE\s+(?:TABLE|INDEX|DATABASE|VIEW)|TRUNCATE\s+(?:TABLE)?)\b/i;
+/** Simpler pattern for SQL keywords at start of string concatenation */
+const SQL_KEYWORD_PATTERN = /^\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE)\b/i;
+/**
+ * SQL clause keywords for detecting concatenation in WHERE/SET/VALUES clauses.
+ *
+ * Case-SENSITIVE intentionally — lowercase `and`, `or`, `set`, `values`,
+ * `where` are extremely common English words and produce massive false-
+ * positive rates against CLI help-text strings (`'Usage: ...\n' +
+ * 'AND swapped into tenant.keys'`). Real SQL keyword usage in code is
+ * conventionally uppercase; the few projects that lowercase them can
+ * either uppercase or pragma per-site. (See checkConcatenationInjection
+ * for the additional "walk the concat chain for a real SQL keyword"
+ * filter that prevents arm-3 from firing on incidental WHERE/AND inside
+ * non-SQL text.)
+ */
+const SQL_CLAUSE_PATTERN = /\b(?:WHERE|AND|OR|SET|VALUES)\b/;
+/** Safe tagged template tags that use parameterized queries */
+const SAFE_TEMPLATE_TAGS = new Set(['sql', 'query', 'raw']);
+/** Safe object property names where SQL-like words are just messages */
+const SUGGESTION_PROPERTY_NAMES = new Set([
+    'message',
+    'msg',
+    'suggestion',
+    'description',
+    'help',
+    'hint',
+    'detail',
+    'title',
+    'label',
+    'text',
+    'placeholder',
+    'tooltip',
+    'caption',
+    'summary',
+]);
+/**
+ * Check if a template expression is inside a tagged template literal.
+ * Tagged templates like sql`...` or db.query`...` use parameterized queries.
+ */
+function isInTaggedTemplate(node) {
+    let current = node.parent;
+    while (!ts.isSourceFile(current)) {
+        /* v8 ignore next -- defensive AST/type guard */
+        if (ts.isTaggedTemplateExpression(current)) {
+            const tag = current.tag;
+            if (ts.isIdentifier(tag) && SAFE_TEMPLATE_TAGS.has(tag.text))
+                return true;
+            if (ts.isPropertyAccessExpression(tag) && SAFE_TEMPLATE_TAGS.has(tag.name.text))
+                return true;
+            // Any tagged template is likely using parameterized queries
+            return true;
+        }
+        current = current.parent;
+    }
+    return false;
+}
+/**
+ * Check if a node is inside an object literal property used for messages/suggestions.
+ * Template literals in properties like { message: `...`, suggestion: `...` } are not SQL.
+ */
+function isInSuggestionProperty(node) {
+    let current = node.parent;
+    while (!ts.isSourceFile(current)) {
+        if (ts.isPropertyAssignment(current) &&
+            ts.isIdentifier(current.name) &&
+            SUGGESTION_PROPERTY_NAMES.has(current.name.text.toLowerCase())) {
+            return true;
+        }
+        current = current.parent;
+    }
+    return false;
+}
+/**
+ * Check if a node is a direct argument to a .query() call.
+ */
+function isInQueryCall(node) {
+    const parent = node.parent;
+    return (ts.isCallExpression(parent) &&
+        ts.isPropertyAccessExpression(parent.expression) &&
+        parent.expression.name.text === 'query');
+}
+/**
+ * Walk the binary-`+` concat chain rooted at `node` and collect every
+ * string-literal segment's text. Used by `checkConcatenationInjection`
+ * to gate arm-3 — a right-side string containing a clause keyword
+ * (WHERE/AND/OR/SET/VALUES) is only treated as SQL when the SAME
+ * concatenation also has at least one segment that starts with a real
+ * SQL statement keyword (SELECT/INSERT/...).
+ *
+ * Why this matters: without the gate, the loose right-side check
+ * fires on `cli.info('Usage: ...\n' + 'AND continues here\n')` because
+ * "AND" appears in English help text. The gate requires the same
+ * concat chain to also contain a "SELECT * FROM" or similar real-SQL
+ * fragment, which CLI help text never has.
+ *
+ * Walks both up (ancestor +) and down (descendant +) from `node` so a
+ * mid-chain finding still sees the whole expression.
+ */
+function collectConcatChainStrings(node) {
+    const strings = [];
+    // Walk up to the root of the contiguous + chain.
+    let root = node;
+    while (ts.isBinaryExpression(root.parent) &&
+        root.parent.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+        root = root.parent;
+    }
+    // Walk down collecting every string-literal leaf.
+    function collect(n) {
+        if (ts.isBinaryExpression(n) && n.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+            collect(n.left);
+            collect(n.right);
+            return;
+        }
+        if (ts.isStringLiteral(n) || ts.isNoSubstitutionTemplateLiteral(n)) {
+            strings.push(n.text);
+        }
+    }
+    collect(root);
+    return strings;
+}
+/**
+ * True iff the concat chain rooted at the parent of `node` contains
+ * at least one string segment that starts with a real SQL keyword
+ * (SELECT/INSERT/...). This is the "this is actually SQL" sanity check
+ * for arm-3 of checkConcatenationInjection.
+ */
+function concatChainHasSqlKeyword(node) {
+    for (const s of collectConcatChainStrings(node)) {
+        if (SQL_KEYWORD_PATTERN.test(s))
+            return true;
+    }
+    return false;
+}
+/**
+ * Known CLI-output property-access call patterns: `cli.info(...)`,
+ * `cli.error(...)`, `console.log(...)`, `logger.warn(...)`, etc.
+ * Binary-string-concat arguments to these calls are never SQL.
+ */
+const OUTPUT_METHOD_NAMES = new Set([
+    'log',
+    'info',
+    'warn',
+    'error',
+    'debug',
+    'trace',
+    'fatal',
+    'print',
+    'println',
+    'raw',
+    'write',
+    'writeln',
+]);
+/**
+ * True iff `node` is an argument (direct or wrapped) to an output-style
+ * call expression (`cli.info(...)`, `console.log(...)`, `logger.warn(...)`).
+ * These call sites carry user-facing text, not SQL — concatenation
+ * inside them is help/status text composition.
+ */
+function isInOutputCall(node) {
+    let current = node.parent;
+    while (!ts.isSourceFile(current)) {
+        if (ts.isCallExpression(current)) {
+            const callee = current.expression;
+            return (ts.isPropertyAccessExpression(callee) &&
+                ts.isIdentifier(callee.name) &&
+                OUTPUT_METHOD_NAMES.has(callee.name.text));
+        }
+        current = current.parent;
+    }
+    return false;
+}
+/**
+ * Get the full text content of a template expression (head + spans).
+ */
+function getTemplateText(node) {
+    const parts = [node.head.text];
+    for (const span of node.templateSpans) {
+        // @fitness-ignore-next-line performance-anti-patterns -- string literal placeholder for template span, not a spread operator
+        parts.push('${...}', span.literal.text);
+    }
+    return parts.join('');
+}
+/**
+ * Check a template expression node for SQL injection via interpolation.
+ */
+function checkTemplateInjection(node, sourceFile, filePath, violations) {
+    if (!ts.isTemplateExpression(node))
+        return;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (isInTaggedTemplate(node))
+        return;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (isInSuggestionProperty(node))
+        return;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (isInOutputCall(node))
+        return;
+    const templateText = getTemplateText(node);
+    if (!SQL_STRUCTURE_PATTERN.test(templateText))
+        return;
+    const line = getLineNumber(node, sourceFile);
+    const matchText = node.getText();
+    const isQueryArg = isInQueryCall(node);
+    violations.push({
+        line,
+        column: 0,
+        message: isQueryArg
+            ? 'Potential SQL injection: raw query with template interpolation'
+            : 'Potential SQL injection: template literal with SQL and interpolation detected',
+        severity: 'error',
+        suggestion: 'Use parameterized queries: db.query("SELECT * FROM users WHERE id = $1", [userId]). Never interpolate user input directly into SQL strings.',
+        match: matchText.length > 200 ? matchText.slice(0, 200) + '...' : matchText,
+        filePath,
+    });
+}
+/**
+ * Check a binary expression node for SQL injection via string concatenation.
+ */
+function checkConcatenationInjection(node, sourceFile, filePath, violations) {
+    if (!ts.isBinaryExpression(node))
+        return;
+    if (node.operatorToken.kind !== ts.SyntaxKind.PlusToken)
+        return;
+    if (isInSuggestionProperty(node))
+        return;
+    if (isInOutputCall(node))
+        return;
+    const leftIsString = ts.isStringLiteral(node.left);
+    const rightIsString = ts.isStringLiteral(node.right);
+    if (!leftIsString && !rightIsString)
+        return;
+    const leftText = leftIsString ? node.left.text : '';
+    const rightText = rightIsString ? node.right.text : '';
+    if (leftIsString && SQL_KEYWORD_PATTERN.test(leftText) && !rightIsString) {
+        violations.push({
+            line: getLineNumber(node, sourceFile),
+            column: 0,
+            message: 'Potential SQL injection: SQL string concatenation detected',
+            severity: 'error',
+            suggestion: 'Use parameterized queries instead of string concatenation. With TypeORM: createQueryBuilder().where("id = :id", { id }). With raw queries: query("SELECT * FROM t WHERE x = $1", [x]).',
+            match: node.getText(),
+            filePath,
+        });
+    }
+    if (rightIsString &&
+        SQL_CLAUSE_PATTERN.test(rightText) &&
+        !leftIsString &&
+        // Gate: the concat chain must also contain a real SQL keyword
+        // somewhere (SELECT/INSERT/...). Without this, the loose clause
+        // pattern fires on incidental WHERE/AND inside non-SQL text
+        // (CLI help strings, error message composition, etc.).
+        concatChainHasSqlKeyword(node)) {
+        violations.push({
+            line: getLineNumber(node, sourceFile),
+            column: 0,
+            message: 'Potential SQL injection: string concatenation in SQL clause detected',
+            severity: 'error',
+            suggestion: 'Use parameterized queries for all user-supplied values. Never concatenate strings to build WHERE, AND, OR, SET, or VALUES clauses.',
+            match: node.getText(),
+            filePath,
+        });
+    }
+}
+/**
+ * Check: security/sql-injection
+ *
+ * Detects potential SQL injection vulnerabilities using AST analysis.
+ * Walks template literals and string concatenation to find SQL patterns,
+ * while filtering out suggestion text, messages, and tagged templates.
+ */
+/**
+ * Pure analysis function. Exported so unit tests can exercise the
+ * detection logic without standing up the full Check framework
+ * (defineCheck wraps `analyze` into an `execute` closure that
+ * requires an ExecutionContext to invoke).
+ */
+export function analyzeSqlInjection(content, filePath) {
+    const sourceFile = parseSource(content, filePath);
+    /* v8 ignore next -- defensive guard */
+    if (!sourceFile)
+        return [];
+    const violations = [];
+    walkNodes(sourceFile, (node) => {
+        // @lazy-ok -- synchronous callback; no awaits in analyze(); "resolved async result" in suggestion text triggers false positive
+        checkTemplateInjection(node, sourceFile, filePath, violations);
+        checkConcatenationInjection(node, sourceFile, filePath, violations);
+    });
+    return violations;
+}
+export const sqlInjection = defineCheck({
+    id: '73c198ff-3d68-4e9b-a2aa-9e5d511cd89c',
+    slug: 'sql-injection',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'raw',
+    description: 'Detect potential SQL injection vulnerabilities',
+    longDescription: `**Purpose:** Detects potential SQL injection vulnerabilities by using AST analysis to find user-supplied values interpolated or concatenated into SQL strings.
+
+**Detects:**
+- Template literals containing SQL structure patterns (SELECT...FROM, INSERT INTO, UPDATE...SET, DELETE FROM, DROP, ALTER, CREATE, TRUNCATE) with \`\${...}\` interpolation — excluding safe tagged templates (\`sql\`, \`query\`, \`raw\`) and message/suggestion properties
+- String concatenation starting with SQL keywords (\`"SELECT " + variable\`)
+- String concatenation appending SQL clause keywords (\`variable + " WHERE ..."\`)
+
+**Why it matters:** SQL injection remains a top web vulnerability (OWASP Top 10). A single unparameterized query can expose or destroy an entire database.
+
+**Scope:** General best practice. Analyzes each file individually using TypeScript AST. Excludes migrations and seed files.`,
+    tags: ['security', 'injection', 'sql', 'database'],
+    fileTypes: ['ts'],
+    confidence: 'high',
+    analyze(content, filePath) {
+        return analyzeSqlInjection(content, filePath);
+    },
+});
+//# sourceMappingURL=sql-injection.js.map

package/dist/checks/security/sql-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection.js","sourceRoot":"","sources":["../../../src/checks/security/sql-injection.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;;GAGG;AACH,MAAM,qBAAqB;AACzB,4JAA4J;AAC5J,iMAAiM,CAAC;AAEpM,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,mEAAmE,CAAC;AAEhG;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAkB,GAAG,iCAAiC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE5D,wEAAwE;AACxE,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,SAAS;IACT,KAAK;IACL,YAAY;IACZ,aAAa;IACb,MAAM;IACN,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;IACP,MAAM;IACN,aAAa;IACb,SAAS;IACT,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,gDAAgD;QAChD,IAAI,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,IAAI,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,IAAI,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7F,4DAA4D;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAa;IAC3C,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,IACE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC;YAChC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;YAC7B,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAC9D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,OAAO,CACL,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC3B,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC;QAChD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,yBAAyB,CAAC,IAAyB;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,iDAAiD;IACjD,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,OACE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,SAAS,EAC1D,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,kDAAkD;IAClD,SAAS,OAAO,CAAC,CAAU;QACzB,IAAI,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YACjF,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,IAAyB;IACzD,KAAK,MAAM,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,SAAS;IACT,KAAK;IACL,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,IAAI,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;YAClC,OAAO,CACL,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;gBACrC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC5B,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,IAA2B;IAClD,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,6HAA6H;QAC7H,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAC7B,IAAa,EACb,UAAyB,EACzB,QAAgB,EAChB,UAA4B;IAE5B,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO;IAC3C,gDAAgD;IAChD,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO;IACrC,gDAAgD;IAChD,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO;IACzC,gDAAgD;IAChD,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO;IAEjC,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO;IAEtD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEvC,UAAU,CAAC,IAAI,CAAC;QACd,IAAI;QACJ,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,UAAU;YACjB,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,+EAA+E;QACnF,QAAQ,EAAE,OAAO;QACjB,UAAU,EACR,6IAA6I;QAC/I,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;QAC3E,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAClC,IAAa,EACb,UAAyB,EACzB,QAAgB,EAChB,UAA4B;IAE5B,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO;IACzC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,SAAS;QAAE,OAAO;IAChE,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO;IACzC,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO;IAEjC,MAAM,YAAY,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa;QAAE,OAAO;IAE5C,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvD,IAAI,YAAY,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACzE,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;YACrC,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,4DAA4D;YACrE,QAAQ,EAAE,OAAO;YACjB,UAAU,EACR,wLAAwL;YAC1L,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;YACrB,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,IACE,aAAa;QACb,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;QAClC,CAAC,YAAY;QACb,8DAA8D;QAC9D,gEAAgE;QAChE,4DAA4D;QAC5D,uDAAuD;QACvD,wBAAwB,CAAC,IAAI,CAAC,EAC9B,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;YACrC,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,sEAAsE;YAC/E,QAAQ,EAAE,OAAO;YACjB,UAAU,EACR,oIAAoI;YACtI,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;YACrB,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,QAAgB;IACnE,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClD,uCAAuC;IACvC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QAC7B,+HAA+H;QAC/H,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/D,2BAA2B,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;IACtC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,KAAK;IACpB,WAAW,EAAE,gDAAgD;IAC7D,eAAe,EAAE;;;;;;;;;4HASyG;IAC1H,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC;IAClD,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,UAAU,EAAE,MAAM;IAElB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,OAAO,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/unsafe-secret-comparison.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @fileoverview Detect unsafe equality comparisons on secret/token values
+ *
+ * Finds binary equality operators (=== / !==) applied to variables whose names
+ * suggest they hold cryptographic secrets (token, secret, signature, password,
+ * key). Such comparisons are vulnerable to timing attacks and must use a
+ * constant-time comparison function like safeCompare().
+ */
+/**
+ * Check: security/unsafe-secret-comparison
+ *
+ * Detects usage of === or !== to compare variables whose names suggest they
+ * hold cryptographic secrets. Such comparisons are vulnerable to timing
+ * side-channel attacks.
+ */
+export declare const unsafeSecretComparison: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=unsafe-secret-comparison.d.ts.map

package/dist/checks/security/unsafe-secret-comparison.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafe-secret-comparison.d.ts","sourceRoot":"","sources":["../../../src/checks/security/unsafe-secret-comparison.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA+KH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,sCA2DjC,CAAC"}