@profullstack/threatcrush 0.10.0 → 0.11.1

package/dist/daemon.js

@@ -4310,6 +4310,347 @@ function workerId() {
   return `${import_node_os4.default.hostname()}/${process.pid}`;
 }
 
+// ../../packages/scan/src/node-rules.ts
+var PATH_CONTAINMENT_GUARD = /\bstartsWith\s*\(|\brelative\s*\(|\bnormalize\s*\(|\brealpath\b|\bisInside\b|\bwithin\s*\(|\bsanitiz\w*\b/i;
+var ARCHIVE_LIBRARY = /\b(?:adm-zip|unzipper|yauzl|node-stream-zip|extract-zip|decompress|tar-stream|tar-fs)\b|require\s*\(\s*['"]tar['"]|from\s+['"]tar['"]/;
+var HEADLESS_BROWSER = /\b(?:puppeteer|playwright|phantom|phantomjs|wkhtmltopdf|wkhtmltoimage|chrome-aws-lambda|html-pdf)\b/;
+var ORIGIN_ALLOWLIST_GUARD = /\b(?:includes|indexOf|has|test|find|some)\s*\(/;
+var FUNCTION_DESERIALIZER = /\b(?:node-serialize|serialize-to-js|funcster|cryo)\b/;
+var CONCATENATED_STRING = String.raw`(?:"[^"\n]*"|'[^'\n]*')\s*\+`;
+var INTERPOLATED_TEMPLATE = "`[^`\\n]*\\$\\{";
+var NODE_RULES = [
+  // ── Code execution ───────────────────────────────────────────────────────
+  {
+    id: "js-vm-untrusted-execution",
+    title: "script compiled and run by the `vm` module",
+    consequence: "Node\u2019s `vm` is not a security boundary \u2014 it isolates globals, not the process. Code reaching it can walk back out through any object it is handed and runs with the server\u2019s full privileges.",
+    cwe: "CWE-94",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\bvm\s*\.\s*(?:runInNewContext|runInThisContext|runInContext|compileFunction)\s*\(|\bnew\s+vm\s*\.\s*Script\s*\(/,
+    // A `vm` call whose source is a build-time constant is a plugin loader, not
+    // a vulnerability. The class only becomes real once the script text can be
+    // influenced, so require that evidence before reporting at full severity.
+    needsContext: true
+  },
+  {
+    id: "js-vm2-sandbox",
+    title: "`vm2` used as a sandbox",
+    consequence: "vm2 was discontinued after a series of escapes that its maintainer judged unfixable by design. Any code it runs should be assumed to run on the host.",
+    cwe: "CWE-1104",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bnew\s+(?:NodeVM|VMScript)\s*\(|\bfrom\s+['"]vm2['"]|require\s*\(\s*['"]vm2['"]\s*\)/,
+    // Nothing on the surrounding lines changes the answer: the package itself
+    // is the finding, the same way a broken cipher is.
+    inherent: true
+  },
+  {
+    id: "js-function-deserialization",
+    title: "deserialiser that reconstructs functions",
+    consequence: "These formats encode functions alongside data and invoke them on load, so parsing an attacker\u2019s payload is executing it. No amount of validation after the parse call helps \u2014 the code has already run.",
+    cwe: "CWE-502",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:unserialize|deepDeserialize|deserialize)\s*\(/,
+    // Without this the rule fires on every project that happens to own a
+    // function called `deserialize`, which is most of them. The import is what
+    // makes the call the dangerous one.
+    fileRequires: FUNCTION_DESERIALIZER,
+    // The parse *is* the execution, so nearby input cannot make it worse and
+    // its absence cannot make it safe. Nobody round-trips a constant through
+    // these libraries.
+    inherent: true
+  },
+  {
+    id: "js-template-injection",
+    title: "template compiled from a non-constant source",
+    consequence: "Template languages are programming languages. A user-supplied template body is remote code execution, not cross-site scripting \u2014 the expression runs on the server before any output is escaped.",
+    cwe: "CWE-1336",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:handlebars|Handlebars|hbs|ejs|pug|jade|nunjucks|eta|twig|dot|doT|liquid|mustache)\s*\.\s*(?:compile|compileFile|render|renderString)\s*\(\s*(?:`[^`\n]*\$\{|[a-zA-Z_$][\w$.]*\s*[,)]|[a-zA-Z_$][\w$.]*\s*\+)/,
+    // Rendering a template held in a variable is the normal case — it was read
+    // from a file at boot. Only the version where request data reaches the
+    // template *body* is this class.
+    needsContext: true
+  },
+  {
+    id: "js-shelljs-command-execution",
+    title: "shelljs command assembled from a string",
+    consequence: "`shell.exec` runs its argument through a shell, so a `;` or backtick in an interpolated value runs as the server user.",
+    cwe: "CWE-78",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: new RegExp(
+      `\\b(?:shell|shelljs|sh)\\s*\\.\\s*exec\\s*\\(\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING}|[a-zA-Z_$][\\w$]*\\s*\\+)`
+    ),
+    fileRequires: /\bshelljs\b/
+  },
+  // ── Injection ────────────────────────────────────────────────────────────
+  {
+    id: "js-nosql-where-expression",
+    title: "MongoDB `$where` built by string assembly",
+    consequence: "`$where` is evaluated as JavaScript by the database server, once per document. An interpolated value can rewrite the predicate to `true` or run a denial-of-service loop inside the database.",
+    cwe: "CWE-943",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: new RegExp(
+      `\\$where\\s*['"]?\\s*:\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING})|\\.\\s*\\$where\\s*=\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING})`
+    )
+  },
+  {
+    id: "js-xpath-injection",
+    title: "XPath expression built by concatenation",
+    consequence: "A quote in the interpolated value closes the predicate early, so the query selects nodes the caller was never meant to read \u2014 the XML equivalent of `OR 1=1`.",
+    cwe: "CWE-643",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    // An XPath expression is recognisable by its own syntax — a descendant
+    // axis or an attribute predicate. Matching on the *call* name alone would
+    // flag every `select(` in the ecosystem. The quoted forms are split per
+    // quote character for the reason given at CONCATENATED_STRING: the
+    // predicate that makes it XPath usually contains the other quote.
+    pattern: new RegExp(
+      `\\b(?:xpath|xpathSelect|select|selectNodes|selectSingleNode|evaluate|find)\\s*\\(\\s*(?:\`[^\`\\n]*(?:\\/\\/|\\[@)[^\`\\n]*\\$\\{|"[^"\\n]*(?:\\/\\/|\\[@)[^"\\n]*"\\s*\\+|'[^'\\n]*(?:\\/\\/|\\[@)[^'\\n]*'\\s*\\+)`
+    ),
+    fileRequires: /\bxpath\b|\bxmldom\b|\blibxmljs\b|\bxpath\.js\b/
+  },
+  {
+    id: "js-regex-from-input",
+    title: "regular expression compiled from a variable",
+    consequence: "A caller who controls the pattern controls the matcher: they can supply catastrophic backtracking to hang the event loop, or a permissive pattern that defeats whatever the regex was validating.",
+    cwe: "CWE-1333",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    pattern: new RegExp(
+      `\\bnew\\s+RegExp\\s*\\(\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING}|(?!['"\`/])[a-zA-Z_$][\\w$.]*\\s*[,)])`
+    ),
+    needsContext: true
+  },
+  // ── XML ──────────────────────────────────────────────────────────────────
+  {
+    id: "js-xml-external-entities",
+    title: "XML parser configured to resolve entities",
+    consequence: "An entity declaration in the document body makes the parser fetch a local file or an internal URL and paste the result into the parsed output \u2014 file disclosure and server-side request forgery from a document upload.",
+    cwe: "CWE-611",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    // The option name is the finding. Every parser in the ecosystem defaults
+    // these off, so an explicit `true` is a deliberate re-enable.
+    pattern: /\b(?:noent|resolveEntities|expandEntities|externalEntities|resolveExternals)\s*:\s*(?:true|1)\b/,
+    inherent: true
+  },
+  // ── Authentication and tokens ────────────────────────────────────────────
+  {
+    id: "js-jwt-none-algorithm",
+    title: "JWT algorithm set to `none`",
+    consequence: "The `none` algorithm means the signature is not checked. Anyone can mint a token with any claims \u2014 including another user\u2019s id or an admin role \u2014 by base64-encoding a header and a body.",
+    cwe: "CWE-347",
+    severity: "critical",
+    languages: ["javascript", "typescript"],
+    pattern: /\balgorithms?\s*:\s*\[?\s*['"]none['"]/i,
+    inherent: true
+  },
+  // ── Cryptography ─────────────────────────────────────────────────────────
+  {
+    id: "js-broken-cipher-algorithm",
+    title: "broken cipher selected",
+    consequence: "DES, 3DES, RC2, RC4, Blowfish and IDEA are all breakable with commodity hardware or have practical plaintext-recovery attacks. Data encrypted with them should be treated as encoded, not encrypted.",
+    cwe: "CWE-327",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bcreate(?:Cipher|Decipher)(?:iv)?\s*\(\s*['"](?:des|des3|des-ede\w*|3des|rc2|rc4|bf|blowfish|cast5?|idea|seed)\b/i,
+    inherent: true
+  },
+  {
+    id: "js-ecb-mode-cipher",
+    title: "block cipher in ECB mode",
+    consequence: "ECB encrypts every block independently, so identical plaintext blocks produce identical ciphertext. Structure in the data survives encryption and blocks can be reordered or replayed without detection.",
+    cwe: "CWE-327",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bcreate(?:Cipher|Decipher)(?:iv)?\s*\(\s*['"][^'"\n]*-ecb\b/i,
+    inherent: true
+  },
+  {
+    id: "js-legacy-cipher-api",
+    title: "deprecated `createCipher` used",
+    consequence: "`createCipher` derives the key from a passphrase with a single unsalted MD5 pass and uses a fixed all-zero IV, so the same passphrase always produces the same keystream. It was removed in Node 22.",
+    cwe: "CWE-327",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    // `createCipheriv` is the correct API and shares the prefix, so the
+    // negative look-ahead is what separates the finding from the fix.
+    pattern: /\bcrypto\s*\.\s*create(?:Cipher|Decipher)\s*\(/,
+    lineGuard: /create(?:Cipher|Decipher)iv\s*\(/,
+    inherent: true
+  },
+  // ── Cross-site scripting ─────────────────────────────────────────────────
+  {
+    id: "js-template-autoescape-disabled",
+    title: "template auto-escaping turned off",
+    consequence: "Auto-escaping is the control that makes a template engine safe by default. Disabling it globally means every interpolation in every template becomes an injection point, including ones written later by someone who assumed the default.",
+    cwe: "CWE-79",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bautoescape\s*:\s*false\b|\bescape\s*:\s*false\b|\bnoEscape\s*:\s*true\b/,
+    inherent: true
+  },
+  {
+    id: "js-serialize-javascript-unsafe",
+    title: "`serialize-javascript` in unsafe mode",
+    consequence: "The `unsafe` flag turns off escaping of HTML-significant characters in the output. Embedding the result in a `<script>` block lets a string value close the tag and start a new one.",
+    cwe: "CWE-79",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bunsafe\s*:\s*true\b/,
+    fileRequires: /\bserialize-javascript\b/,
+    inherent: true
+  },
+  {
+    id: "js-cors-origin-reflected",
+    title: "CORS origin reflected from the request",
+    consequence: "Echoing the caller\u2019s `Origin` header back as `Access-Control-Allow-Origin` allows every site, while looking like an allow-list. Combined with credentials, any page the victim visits can read their authenticated responses.",
+    cwe: "CWE-942",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    // Both spellings of the same mistake: writing the header directly, and
+    // handing the request's origin to a CORS middleware's `origin` option.
+    //
+    // An earlier draft also matched a bare variable — `setHeader('…', origin)`
+    // — which is wrong. A variable holding a *validated* origin is exactly
+    // what the correct implementation looks like, and the rule cannot tell the
+    // two apart. Only the visible read from the request qualifies.
+    pattern: /\bAccess-Control-Allow-Origin['"]\s*,\s*(?:req|request|ctx)\s*\.|\borigin\s*:\s*(?:req|request|ctx)\s*\./,
+    // Reflecting the header is the defect whatever surrounds it; there is no
+    // arrangement of nearby lines that makes an echoed origin safe — except a
+    // membership test on the value, which is what the guard looks for.
+    inherent: true,
+    guard: ORIGIN_ALLOWLIST_GUARD
+  },
+  // ── Server-side request forgery ──────────────────────────────────────────
+  {
+    id: "js-headless-browser-navigation",
+    title: "headless browser sent to a non-constant URL",
+    consequence: "The browser runs on the server, inside the private network. A controlled URL reaches the cloud metadata endpoint, localhost admin panels and internal services \u2014 and `file://` reads the disk.",
+    cwe: "CWE-918",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\.\s*(?:goto|setContent|navigate)\s*\(\s*(?:`[^`\n]*\$\{|(?!['"`])[a-zA-Z_$][\w$.]*\s*[,)])/,
+    fileRequires: HEADLESS_BROWSER,
+    needsContext: true
+  },
+  // ── Path handling ────────────────────────────────────────────────────────
+  {
+    id: "js-archive-entry-path",
+    title: "archive entry written to a path built from its own name",
+    consequence: "An entry named `../../etc/cron.d/x` escapes the extraction directory when its name is joined to the destination. Overwriting a file outside the target \u2014 a systemd unit, an SSH key, a deployed script \u2014 is code execution on the next run.",
+    cwe: "CWE-22",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:join|resolve)\s*\(\s*[^,\n)]+,\s*[a-zA-Z_$][\w$]*\s*\.\s*(?:entryName|fileName|filename|name|path)\b/,
+    fileRequires: ARCHIVE_LIBRARY,
+    guard: PATH_CONTAINMENT_GUARD,
+    // The containment check comes *after* the join — you build the path, then
+    // verify it stayed inside. A backwards-only window would miss every
+    // correct implementation and report the safe code alongside the unsafe.
+    guardForward: 3
+  },
+  // ── Electron ─────────────────────────────────────────────────────────────
+  {
+    id: "js-electron-node-integration",
+    title: "Electron renderer given Node access",
+    consequence: "With node integration on \u2014 or context isolation off \u2014 any script that reaches the page reaches `require`. A single XSS in rendered content becomes `child_process.exec` on the user\u2019s machine.",
+    cwe: "CWE-1188",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bnodeIntegration(?:InWorker|InSubFrames)?\s*:\s*true\b|\bcontextIsolation\s*:\s*false\b|\benableRemoteModule\s*:\s*true\b|\bsandbox\s*:\s*false\b/,
+    inherent: true
+  },
+  {
+    id: "js-electron-web-security-disabled",
+    title: "Electron web security disabled",
+    consequence: "Turning off `webSecurity` drops the same-origin policy for the window, so remote content can read local files and every other origin the app has loaded.",
+    cwe: "CWE-1173",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bwebSecurity\s*:\s*false\b|\ballowRunningInsecureContent\s*:\s*true\b|\bwebviewTag\s*:\s*true\b/,
+    inherent: true
+  },
+  {
+    id: "js-electron-open-external",
+    title: "Electron `openExternal` with a non-constant URL",
+    consequence: "`shell.openExternal` hands the string to the operating system\u2019s handler. A `file://` path executes a local binary and, on Windows, an SMB path executes a remote one.",
+    cwe: "CWE-749",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bshell\s*\.\s*openExternal\s*\(\s*(?:`[^`\n]*\$\{|(?!['"`])[a-zA-Z_$][\w$.]*\s*[,)])/,
+    needsContext: true
+  },
+  // ── Hardening and resource limits ────────────────────────────────────────
+  {
+    id: "js-helmet-protection-disabled",
+    title: "security header explicitly disabled",
+    consequence: "Each of these switches off a browser-side protection that was already on. The header stops being sent, so the defence it enables \u2014 framing, sniffing, referrer leakage, transport downgrade \u2014 is available to an attacker again.",
+    cwe: "CWE-693",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:contentSecurityPolicy|frameguard|hsts|noSniff|xssFilter|hidePoweredBy|referrerPolicy|dnsPrefetchControl|ieNoOpen|permittedCrossDomainPolicies|crossOriginEmbedderPolicy|crossOriginOpenerPolicy|crossOriginResourcePolicy|originAgentCluster)\s*:\s*false\b/,
+    inherent: true
+  },
+  {
+    id: "js-buffer-bounds-check-disabled",
+    title: "buffer bounds checking turned off",
+    consequence: "With `noAssert` the read or write is not range-checked, so an offset past the end of the buffer returns adjacent heap memory or corrupts it instead of throwing.",
+    cwe: "CWE-125",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    // The trailing `true` on a Buffer numeric accessor *is* `noAssert` — it is
+    // the last positional parameter of every one of these methods. Anchoring
+    // on the accessor name is what keeps this from matching `, true)` on any
+    // call in the codebase.
+    pattern: /\b(?:read|write)(?:U?Int(?:8|16|32)(?:[BL]E)?|U?Int[BL]E|Float[BL]E|Double[BL]E)\s*\([^)\n]*,\s*true\s*\)|\bnoAssert\s*:\s*true\b/,
+    inherent: true
+  },
+  {
+    id: "js-uninitialized-buffer",
+    title: "buffer allocated without zeroing",
+    consequence: "`allocUnsafe` and the old `new Buffer(size)` hand back whatever was previously in that heap memory \u2014 keys, session tokens, other users\u2019 request bodies. Anything not overwritten before the buffer is sent leaks it.",
+    cwe: "CWE-908",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    pattern: /\bBuffer\s*\.\s*allocUnsafe(?:Slow)?\s*\(|\bnew\s+Buffer\s*\(\s*(?![`'"])[a-zA-Z_$0-9]/,
+    inherent: true
+  },
+  {
+    id: "js-oversized-request-body-limit",
+    title: "request body limit raised to a very large value",
+    consequence: "A body limit in the tens of megabytes lets a handful of concurrent requests exhaust memory, and the parse happens before any authentication check the route performs.",
+    cwe: "CWE-400",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    // Two or more digits before `mb` — 50mb and up. A limit is a *good* thing;
+    // only an ineffective one is the finding.
+    pattern: /\blimit\s*:\s*['"]\s*(?:[5-9]\d|\d{3,})\s*mb\s*['"]|\blimit\s*:\s*['"]\s*\d+\s*gb\s*['"]/i,
+    inherent: true
+  },
+  // ── Information disclosure ───────────────────────────────────────────────
+  {
+    id: "js-error-detail-returned",
+    title: "error object or stack trace sent to the client",
+    consequence: "A stack trace names absolute paths, package versions and internal function names, and framework errors often carry the failing query or connection string with them. It is a map of the server, handed out on request.",
+    cwe: "CWE-209",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    // `res.status(500).send(…)` is the overwhelmingly common spelling, so the
+    // optional `.status(…)` hop is not a nicety — without it the rule misses
+    // nearly every real occurrence.
+    pattern: /\bres\s*\.\s*(?:status\s*\([^)\n]*\)\s*\.\s*)?(?:send|json|end|write)\s*\(\s*(?:[a-zA-Z_$][\w$]*\s*\.\s*stack\b|(?:error|err|e)\s*[,)])|\.\s*(?:send|json)\s*\(\s*\{[^}\n]*\b(?:stack|err|error)\s*:\s*(?:error|err|e)\s*[,}]/,
+    inherent: true
+  }
+];
+
 // ../../packages/scan/src/types.ts
 var SEVERITY_ORDER = ["info", "low", "medium", "high", "critical"];
 function severityRank(severity) {
@@ -4356,7 +4697,20 @@ var GENERIC_GUARD = (
   // The identifier must END at the escaper (with at most a known output-context
   // suffix). An earlier, looser form also matched `describe(`, which would have
   // silenced findings across every test file in every repository.
-  /\ballow(?:ed|list|_list|ed_hosts)?\b|\bwhitelist\b|\b\w{0,6}[Ee]sc(?:ape)?(?:[Hh]tml|HTML|[Xx]ml|XML|[Ss]ql|[Aa]ttr|[Jj]s|[Uu]ri|[Uu]rl)?\s*\(|\bhtml_escape\b|\bhtmlspecialchars\s*\(|\bsanitiz\w*\b|\bencoded\b|\brealpath\b|\bcommonpath\b|\bresolve\(\)\.startsWith\b|\bprocess\.env\b|\bos\.environ\b|\bgetenv\b|\bENV\s*\[|setObjectInputFilter|ObjectInputFilter/i
+  // The `Access-Control-` lookbehind is not a nicety. This regex is
+  // case-insensitive, and `Access-Control-Allow-Origin` contains the word
+  // "Allow" followed by a non-word character — so the CORS header name matched
+  // the allow-list heuristic. Because the guard is tested against an 8-line
+  // *window*, one header line silently disabled every guardable rule near it:
+  // in a four-line Express error handler, the header on one line suppressed
+  // both the `none`-algorithm JWT finding and the returned stack trace below
+  // it. The failure mode is the dangerous kind — not fewer findings, none, and
+  // indistinguishable from clean code.
+  //
+  // Scoped to the header prefix rather than to a bare `allow(?!-)`, because
+  // this guard also runs over `.yml` and `.conf` files, where `allow-list:`
+  // and `allowed-hosts:` are ordinary keys that should still guard.
+  /(?<!Access-Control-)\ballow(?:ed|list|_list|ed_hosts)?\b|\bwhitelist\b|\b\w{0,6}[Ee]sc(?:ape)?(?:[Hh]tml|HTML|[Xx]ml|XML|[Ss]ql|[Aa]ttr|[Jj]s|[Uu]ri|[Uu]rl)?\s*\(|\bhtml_escape\b|\bhtmlspecialchars\s*\(|\bsanitiz\w*\b|\bencoded\b|\brealpath\b|\bcommonpath\b|\bresolve\(\)\.startsWith\b|\bprocess\.env\b|\bos\.environ\b|\bgetenv\b|\bENV\s*\[|setObjectInputFilter|ObjectInputFilter/i
 );
 var XXE_GUARD = /FEATURE_SECURE_PROCESSING|setExpandEntityReferences|disallow-doctype-decl|external-general-entities|external-parameter-entities|setXIncludeAware\s*\(\s*false/;
 var XML_PARSING_FILE = /\b(?:javax\.xml|org\.xml\.sax|org\.w3c\.dom|org\.jdom2?|org\.dom4j|XmlPullParser|DocumentBuilderFactory|DocumentBuilder|SAXParserFactory|SAXParser|XMLInputFactory|XMLReaderFactory|XMLReader|SAXBuilder|SAXReader)\b/;
@@ -4784,6 +5138,20 @@ var CODE_RULES = [
     consequence: "Catastrophic backtracking: a crafted input of a few dozen characters pins a CPU core for minutes.",
     cwe: "CWE-1333",
     severity: "medium",
+    // Scoped, because unscoped this rule reads C as if it were a regex.
+    //
+    // `(void *)*memptr64` — a cast to a pointer type, then a dereference — is
+    // the single most ordinary line in a C file, and it matches the first
+    // alternative exactly: `(`, some text, `*`, `)`, `*`. Every `*(char *)*p`
+    // in a codebase became a ReDoS finding. Caught on inspektor-gadget, where
+    // the rule's one and only hit across 1186 files was a `bpf_probe_read_user`
+    // call in an eBPF C program.
+    //
+    // Scoping is the fix rather than a cleverer pattern: C has no regex
+    // literals, so there is nothing here for the rule to find no matter how
+    // the pattern is written. `other` also covers C++, Rust and Zig, which
+    // share the cast-then-deref spelling.
+    languages: ["javascript", "typescript", "python", "ruby", "go", "java", "php"],
     pattern: /\([^)\n]*[+*]\s*\)\s*[+*]|\([^)\n]*\{\d+,\}\s*\)\s*[+*{]/
   },
   // ── Temporary files ──────────────────────────────────────────────────────
@@ -5203,9 +5571,13 @@ var CODE_RULES = [
     severity: "high",
     languages: ["python"],
     // An f-string whose content is an LDAP filter (`(&…` / `(|…`) with an
-    // interpolation. The safe form escapes, so the window carries an escaper.
-    pattern: /\bf['"][^'"\n]*\([&|][^'"\n]*\{[^}\n]+\}/,
-    guard: /escap/i
+    // interpolation. One variant per quote so an inner `'` inside a `"`-string
+    // does not end the class early.
+    pattern: /\bf"[^"\n]*\([&|][^"\n]*\{[^}\n]+\}|\bf'[^'\n]*\([&|][^'\n]*\{[^}\n]+\}/,
+    // The guard is an escaper *call*, not the mere presence of `escape` — the
+    // module-level `from ldap.filter import escape_filter_chars` sits in every
+    // window and would otherwise exonerate the unescaped filter too.
+    guard: /\bescape\w*\s*\(/i
   },
   {
     id: "py-xpath-injection",
@@ -5214,7 +5586,9 @@ var CODE_RULES = [
     cwe: "CWE-643",
     severity: "high",
     languages: ["python"],
-    pattern: /\bf['"][^'"\n]*(?:\/\/|\/\w+\[)[^'"\n]*\{[^}\n]+\}/
+    // Per-quote, so an inner `'` in a `"`-delimited f-string (`text()='{x}'`)
+    // does not truncate the match before the interpolation.
+    pattern: /\bf"[^"\n]*(?:\/\/|\/\w+\[)[^"\n]*\{[^}\n]+\}|\bf'[^'\n]*(?:\/\/|\/\w+\[)[^'\n]*\{[^}\n]+\}/
   },
   {
     id: "py-fast-password-hash",
@@ -5284,7 +5658,39 @@ var CODE_RULES = [
     severity: "high",
     languages: ["javascript", "typescript"],
     pattern: /\.\s*(?:setHeader|header|set)\s*\(\s*['"`][^'"`\n]+['"`]\s*,\s*(?:req|request|ctx)\s*\.\s*(?:query|body|params|headers)\b/
-  }
+  },
+  {
+    id: "js-nosql-injection",
+    title: "NoSQL query built from request data",
+    consequence: 'A request object passed straight to `find`/`update` lets the caller supply MongoDB operators \u2014 `{"$ne": null}`, `{"$gt": ""}`, `{"$where": "\u2026"}` \u2014 turning a lookup into an authentication bypass or arbitrary query.',
+    cwe: "CWE-943",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\.\s*(?:find|findOne|findOneAndUpdate|updateOne|updateMany|update|deleteOne|deleteMany|remove|count|countDocuments|aggregate)\s*\(\s*(?:req|request|ctx)\s*\.\s*(?:body|query|params)\b/
+  },
+  {
+    id: "js-host-header-trust",
+    title: "URL built from the Host header",
+    consequence: "The Host header is attacker-controlled. Building a link from it \u2014 a password-reset URL above all \u2014 lets an attacker point the victim\u2019s reset token at a domain they control.",
+    cwe: "CWE-346",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/
+  },
+  // A recursive-merge prototype-pollution rule (`target[key] = source[key]`
+  // with no `__proto__` guard) was built and dropped. The bare copy-by-key is
+  // the safe allow-listed shape (`updates[field] = body[field]` over an
+  // `allowedFields` list) as often as the vulnerable one; whether it is a sink
+  // depends on where the key comes from and which of endless guard idioms
+  // filters it — a whole-function question this line-oriented engine does not
+  // answer. It flagged legitimate merges in Capacitor and in this repo's own
+  // web app. `js-prototype-pollution` still catches the explicit `__proto__`
+  // literal; the recursive-merge case is left to KNOWN_GAPS.
+  // Node-ecosystem classes — vm2, Electron, JWT, archive extraction, headless
+  // browsers — are kept in their own table because each has to know which
+  // package it is looking at before it can claim anything. Folded in here so
+  // there stays exactly one rule list for every consumer to iterate.
+  ...NODE_RULES
 ];
 var COMMENT_PREFIX = /^\s*(?:\/\/|\/\*|\*|#|--|<!--)/;
 var DEFINITION_PREFIX = /^\s*(?:(?:export|public|private|protected|static|final|async|abstract)\s+)*(?:def|function|func|class|module|interface|struct|impl|fn|sub)\b/;
@@ -5359,6 +5765,188 @@ function evaluateRule(rule, ctx) {
   return { rule, confidence, severity: severityFor(rule.severity, confidence) };
 }
 
+// ../../packages/scan/src/template-rules.ts
+var LAYOUT_SLOT = /\{\{\{\s*(?:body|content|outlet|children)\s*\}\}\}/;
+var XSS_CONSEQUENCE = "The value is written into the page as markup rather than as text, so a `<script>` or an `onerror=` attribute in it executes in the visitor\u2019s session \u2014 with their cookies, and their privileges.";
+var TEMPLATE_RULES = [
+  {
+    id: "tpl-handlebars-unescaped",
+    title: "Handlebars/Mustache interpolation that skips escaping",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".hbs", ".handlebars", ".hdbs", ".mustache", ".ms"],
+    // Two spellings of the same opt-out: the triple-stache and the `&` prefix.
+    pattern: /\{\{\{(?!\{)[^}]*\}\}\}|\{\{\s*&\s*[^}]+\}\}/,
+    lineGuard: LAYOUT_SLOT
+  },
+  {
+    id: "tpl-vue-v-html",
+    title: "`v-html` binding",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".vue", ".html", ".htm"],
+    pattern: /\bv-html\s*=|\s:inner-html\.prop\s*=/
+  },
+  {
+    id: "tpl-pug-unescaped",
+    title: "Pug/Jade unescaped interpolation",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".pug", ".jade"],
+    // `!{…}` is unescaped interpolation anywhere on the line. `!=` is
+    // unescaped buffered code, but only in the tag position — anchored to the
+    // start of the line and preceded by nothing but tag, class and id
+    // characters, so the `!==` inside `- if (a !== b)` cannot reach it.
+    pattern: /!\{[^}\n]*\}|^\s*[\w.#%-]*!=(?!=)\s*\S/
+  },
+  {
+    id: "tpl-ejs-raw-output",
+    title: "EJS/ECT raw output tag",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".ejs", ".ect"],
+    // In EJS `<%= %>` escapes and `<%-` does not, which is the reverse of
+    // Underscore's convention — see KNOWN_GAPS.
+    pattern: /<%-(?!\s*(?:include|-))/,
+    // `<%- include('partial') %>` splices another template, not user data.
+    lineGuard: /<%-\s*(?:include|partial)\s*\(/
+  },
+  {
+    id: "tpl-dust-escape-filter-off",
+    title: "Dust reference with escaping suppressed",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".dust", ".tl"],
+    // The `|s` filter means "suppress the default HTML escape".
+    pattern: /\{[^{}\n]+\|\s*s\s*\}/
+  },
+  {
+    id: "tpl-jinja-safe-filter",
+    title: "Nunjucks/Twig/Jinja `safe` filter or autoescape block off",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".njk", ".nunjucks", ".twig", ".jinja", ".jinja2", ".j2"],
+    pattern: /\|\s*(?:safe|raw)\s*(?:\}\}|\|)|\{%\s*autoescape\s+(?:false|off)\s*%\}/
+  },
+  {
+    id: "tpl-haml-unescaped",
+    title: "Haml unescaped output",
+    consequence: XSS_CONSEQUENCE,
+    cwe: "CWE-79",
+    severity: "high",
+    extensions: [".haml"],
+    pattern: /^\s*[\w.#%-]*!=(?!=)\s*\S/
+  }
+];
+var TEMPLATE_EXTENSIONS = new Set(
+  TEMPLATE_RULES.flatMap((rule) => rule.extensions)
+);
+function evaluateTemplateRules(extension, lines) {
+  const ext = extension.toLowerCase();
+  const applicable = TEMPLATE_RULES.filter((rule) => rule.extensions.includes(ext));
+  if (applicable.length === 0) return [];
+  const matches = [];
+  lines.forEach((line, index) => {
+    for (const rule of applicable) {
+      if (!rule.pattern.test(line)) continue;
+      if (rule.lineGuard?.test(line)) continue;
+      matches.push({
+        rule,
+        // A template cannot show that the value is untrusted, so the claim
+        // never rises above `pattern` and the shared cap holds it at medium.
+        severity: severityFor(rule.severity, "pattern"),
+        line: index + 1
+      });
+    }
+  });
+  return matches;
+}
+
+// ../../packages/scan/src/controls.ts
+var SERVER_FRAMEWORK = /\bexpress\s*\(\s*\)|\bnew\s+Koa\s*\(|\bfastify\s*\(|\brequire\s*\(\s*['"](?:express|koa|@hapi\/hapi|restify)['"]\s*\)|\bfrom\s+['"](?:express|koa|@hapi\/hapi|restify)['"]|\bhttp\s*\.\s*createServer\s*\(|\bNestFactory\s*\.\s*create\s*\(/;
+var SECURITY_CONTROLS = [
+  {
+    id: "control-security-headers-absent",
+    title: "no security header middleware",
+    consequence: "Without them the browser applies no framing protection, sniffs content types, sends full referrers cross-origin and never learns to require HTTPS \u2014 a set of defences that cost one line to enable.",
+    cwe: "CWE-693",
+    severity: "medium",
+    evidence: /\bhelmet\b|\bkoa-helmet\b|\b@fastify\/helmet\b|\blusca\b|Strict-Transport-Security|Content-Security-Policy|X-Frame-Options|X-Content-Type-Options/i
+  },
+  {
+    id: "control-anti-csrf-absent",
+    title: "no cross-site request forgery protection",
+    consequence: "A cookie-authenticated endpoint with no token check can be driven by a form on any other site \u2014 the browser attaches the session automatically, so the victim only has to visit a page.",
+    cwe: "CWE-352",
+    severity: "medium",
+    // SameSite counts. A cookie the browser refuses to send cross-site is not
+    // reachable by the attack this control exists to stop, so a project that
+    // chose that route instead of tokens has the control, not a gap.
+    evidence: /\bcsurf\b|\bcsrf\b|\bxsrf\b|\blusca\b|\b@fastify\/csrf\b|\bdouble-csrf\b|\bsameSite\s*:\s*['"](?:strict|lax)['"]/i
+  },
+  {
+    id: "control-rate-limiting-absent",
+    title: "no request rate limiting",
+    consequence: "Login and password-reset endpoints with no limiter can be tried at the speed of the network \u2014 credential stuffing, token brute force and enumeration all become a matter of waiting.",
+    cwe: "CWE-770",
+    severity: "medium",
+    evidence: /\bexpress-rate-limit\b|\brateLimit\b|\brate-limiter\b|\bratelimit\b|\bexpress-slow-down\b|\bslowDown\b|\bbottleneck\b|\bthrottle\b/i
+  },
+  {
+    id: "control-body-size-limit-absent",
+    title: "no request body size limit",
+    consequence: "The body is parsed into memory before any handler \u2014 and before any authentication check \u2014 so unbounded parsing lets a few concurrent requests exhaust the process.",
+    cwe: "CWE-400",
+    severity: "medium",
+    evidence: /\blimit\s*:\s*['"]?\d+\s*(?:kb|mb|b)\b|\bbodyLimit\b|\bmaxRequestBodySize\b|\bclient_max_body_size\b/i
+  }
+];
+var ControlAudit = class {
+  seen = /* @__PURE__ */ new Set();
+  /** Where the server is built. Anchors the findings somewhere meaningful. */
+  serverFile = null;
+  observe(relativePath, text) {
+    if (this.serverFile === null && SERVER_FRAMEWORK.test(text)) {
+      this.serverFile = relativePath;
+    }
+    for (const control of SECURITY_CONTROLS) {
+      if (this.seen.has(control.id)) continue;
+      if (control.evidence.test(text)) this.seen.add(control.id);
+    }
+  }
+  /** Controls with no evidence anywhere. Empty when the tree serves no HTTP. */
+  missing() {
+    if (this.serverFile === null) return [];
+    return SECURITY_CONTROLS.filter((control) => !this.seen.has(control.id));
+  }
+  findings() {
+    const anchor = this.serverFile;
+    if (anchor === null) return [];
+    return this.missing().map((control) => ({
+      ruleId: control.id,
+      title: control.title,
+      file: anchor,
+      line: 1,
+      // `pattern` is doing real work here: it caps the severity, and it says
+      // in the report itself how much the scanner is claiming. An absence is
+      // never `evidence`.
+      severity: severityFor(control.severity, "pattern"),
+      confidence: "pattern",
+      message: `${control.title} \u2014 no evidence of one anywhere in the scanned tree (${control.cwe})`,
+      consequence: control.consequence,
+      cwe: control.cwe,
+      excerpt: "",
+      category: "code"
+    }));
+  }
+};
+
 // ../../packages/scan/src/manifest-rules.ts
 var POPULAR_NPM = [
   "react",
@@ -5790,7 +6378,18 @@ var KNOWN_PLACEHOLDERS = [
   /\bEXAMPLE_?KEY\b/i,
   /\bYOUR_[A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD)\b/,
   /\b(?:xxx+|X{4,}|\*{4,}|<[a-z-]+>)\b/,
-  /\bchangeme\b/i
+  /\bchangeme\b/i,
+  // The metasyntactic pair in a connection string, `postgres://user:pass@host`.
+  // This is not the AWS case above and the distinction is the whole reason it
+  // is allowed: `AKIAIOSFODNN7EXAMPLE` is a real credential *format* carrying a
+  // fake value, so it arrives by way of a pasted template. `user:pass` is the
+  // English words sitting where a credential goes, which is how every database
+  // driver writes its DSN in its own README, and nobody pastes that out of a
+  // secret manager.
+  //
+  // Both halves have to be metasyntactic. `root:hunter2@` is not exempt, since
+  // a real password beside a common username is the case this must not swallow.
+  /:\/\/(?:user(?:name)?|admin|root|dbuser|myuser):(?:pass(?:word|wd)?|secret|dbpass|mypassword)@/i
 ];
 function isKnownPlaceholder(text) {
   return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));
@@ -5895,7 +6494,12 @@ var SCAN_EXTENSIONS = /* @__PURE__ */ new Set([
   ".erb",
   ".ejs",
   ".vue",
-  ".svelte"
+  ".svelte",
+  // Template files, so the engine in `template-rules.ts` has something to
+  // read. Sourced from the rules themselves rather than repeated here: an
+  // engine added there becomes scannable without a second edit that could be
+  // forgotten, which is how a rule ends up quietly never firing.
+  ...TEMPLATE_EXTENSIONS
 ]);
 var LANGUAGE_BY_EXTENSION = {
   ".js": "javascript",
@@ -5967,6 +6571,10 @@ function languageOfShebang(firstLine) {
 }
 var SUPPRESS_NEXT = /threatcrush-disable-next-line(?:\s+([\w-]+))?/;
 var SUPPRESS_LINE = /threatcrush-disable-line(?:\s+([\w-]+))?/;
+var FOREIGN_CREDENTIAL = /\b(?:nolint:[\w,]*gosec|nosec)\b[^\n]*\bG101\b|\bG101\b[^\n]*\b(?:nolint:[\w,]*gosec|nosec)\b/;
+function foreignCredentialMark(line) {
+  return FOREIGN_CREDENTIAL.test(line);
+}
 function collectSuppressions(lines) {
   const byLine = /* @__PURE__ */ new Map();
   let count = 0;
@@ -6004,16 +6612,18 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       if (!match) continue;
       if (isKnownPlaceholder(match[0])) continue;
       if (isSuppressed(suppressions, index, rule.id)) continue;
+      const marked = foreignCredentialMark(line);
       findings.push({
         ruleId: rule.id,
         title: rule.name,
         file: relativePath,
         line: index + 1,
-        // Reported but not blocking in tests — see isTestPath.
-        severity: inTests ? "low" : rule.severity,
+        // Reported but not blocking in tests — see isTestPath. The same goes
+        // for a line another linter's credential rule was already told about.
+        severity: inTests || marked ? "low" : rule.severity,
         // A matched credential format is the finding, not a proxy for one.
         confidence: "evidence",
-        message: inTests ? `Possible ${rule.name} detected in a test file \u2014 usually a fixture, still worth confirming it is not a live credential` : `Possible ${rule.name} detected`,
+        message: inTests ? `Possible ${rule.name} detected in a test file \u2014 usually a fixture, still worth confirming it is not a live credential` : marked ? `Possible ${rule.name} detected on a line already marked as a false positive for another linter's credential rule` : `Possible ${rule.name} detected`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: redactSecret(line.trim()).slice(0, 200),
@@ -6043,6 +6653,23 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       });
     }
   });
+  for (const match of evaluateTemplateRules(extensionOf(relativePath), lines)) {
+    const index = match.line - 1;
+    if (isSuppressed(suppressions, index, match.rule.id)) continue;
+    findings.push({
+      ruleId: match.rule.id,
+      title: match.rule.title,
+      file: relativePath,
+      line: match.line,
+      severity: match.severity,
+      confidence: "pattern",
+      message: `${match.rule.title} (${match.rule.cwe})`,
+      consequence: match.rule.consequence,
+      cwe: match.rule.cwe,
+      excerpt: (lines[index] ?? "").trim().slice(0, 200),
+      category: "code"
+    });
+  }
   return findings;
 }
 function scanManifest(relativePath, filename, text) {
@@ -6144,6 +6771,7 @@ function scanPath(targetPath, options = {}) {
   const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
   const allowed = options.categories ? new Set(options.categories) : null;
   const findings = [];
+  const controls = new ControlAudit();
   const unreadable = [];
   let filesScanned = 0;
   let suppressed = 0;
@@ -6197,6 +6825,7 @@ function scanPath(targetPath, options = {}) {
     filesScanned += 1;
     options.onFile?.(relativePath);
     suppressed += collectSuppressions(text.split("\n")).count;
+    controls.observe(relativePath, text);
     const fileFindings = [
       ...scanText(relativePath, text, declared ?? languageOf(filename)),
       ...isManifest ? scanManifest(relativePath, filename, text) : []
@@ -6239,6 +6868,7 @@ function scanPath(targetPath, options = {}) {
   } else {
     scanFile(targetPath, (0, import_node_path5.basename)(targetPath));
   }
+  if (options.missingControls) findings.push(...controls.findings());
   const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;
   filtered.sort(
     (a, b) => severityRank(b.severity) - severityRank(a.severity) || a.file.localeCompare(b.file) || a.line - b.line