@qa-ai-stlc/runner-security 0.0.0-stage → 1.7.0

package/dist/checks/csrf-check.js

@@ -0,0 +1,108 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { buildFinding } from '../finding.js';
+import { isSignInLocation, sessionHeaders } from './session-pages.js';
+// What a forged request looks like to the server: from a site it has no reason to trust.
+const FOREIGN_ORIGIN = 'https://qa-audit-untrusted.example.test';
+function judge(response) {
+    const { status } = response;
+    if (status >= 200 && status < 300) {
+        return 'accepted';
+    }
+    if (status >= 300 && status < 400) {
+        return isSignInLocation(response.headers.location) ? 'unclear' : 'accepted';
+    }
+    return status >= 400 && status < 500 ? 'rejected' : 'unclear';
+}
+/**
+ * Replays each mutation the authorization names with a valid session, a foreign `Origin`, and no
+ * anti-forgery token. A server that checks for forgery refuses it. Only the mutations the
+ * operator named can be sent (the probe enforces it), and a complete request body the operator
+ * vouched for is what makes a refusal mean something: an empty body is refused for reasons that
+ * have nothing to do with CSRF, so without a body a refusal is `uncertain`, not `passed`.
+ */
+export const csrfCheck = {
+    checkClass: 'csrf',
+    run: async ({ probe, authorization, identities }) => {
+        // Signing out is the session check's job. Replaying it here would end the identity's session
+        // and make every later check read a dead session as a refusal.
+        const mutations = authorization.allowedMutations.filter((mutation) => mutation.path !== authorization.logoutPath);
+        if (mutations.length === 0) {
+            return {
+                status: 'skipped',
+                note: 'The authorization names no mutation to replay without a token (the sign-out path is left to the session check).',
+                findings: [],
+            };
+        }
+        const session = identities.byRole('low') ?? identities.all()[0];
+        if (session === undefined) {
+            const failures = identities.describeFailures();
+            return failures === undefined
+                ? { status: 'skipped', note: 'The check needs a signed-in identity.', findings: [] }
+                : { status: 'blocked', note: `The check needs a signed-in identity (${failures})`, findings: [] };
+        }
+        const findings = [];
+        let unclear = 0;
+        let unverifiedRefusals = 0;
+        for (const mutation of mutations) {
+            const response = await probe.request({
+                method: mutation.method,
+                path: mutation.path,
+                headers: {
+                    ...sessionHeaders(session),
+                    origin: FOREIGN_ORIGIN,
+                    referer: `${FOREIGN_ORIGIN}/`,
+                    ...(mutation.contentType !== undefined ? { 'content-type': mutation.contentType } : {}),
+                },
+                ...(mutation.body !== undefined ? { body: mutation.body } : {}),
+            });
+            const verdict = judge(response);
+            if (verdict === 'accepted') {
+                findings.push(acceptedFinding(mutation, response));
+            }
+            else if (verdict === 'unclear') {
+                unclear += 1;
+            }
+            else if (mutation.body === undefined) {
+                unverifiedRefusals += 1;
+            }
+        }
+        if (findings.length > 0 || (unclear === 0 && unverifiedRefusals === 0)) {
+            return {
+                status: 'passed',
+                note: `Replayed ${String(mutations.length)} mutation(s) without a token.`,
+                findings,
+            };
+        }
+        return {
+            status: 'uncertain',
+            note: unclear > 0
+                ? 'A replayed request got no clear answer (a server error, or a redirect to sign in), so it was not judged.'
+                : 'The authorization gave no request body, so a refusal may have another cause than the missing token.',
+            findings,
+        };
+    },
+};
+function acceptedFinding(mutation, response) {
+    const isRedirect = response.status >= 300;
+    return buildFinding({
+        idParts: ['csrf', mutation.method, mutation.path],
+        checkClass: 'csrf',
+        riskArea: 'Request forgery',
+        // A redirect away from a sign-in page after a full request is a clear acceptance; a 200 can be
+        // a form re-displayed with an error, and a request without a body proves less still.
+        confidence: mutation.body === undefined ? 'low' : isRedirect ? 'high' : 'medium',
+        severityProposal: 'critical',
+        title: `${mutation.method} ${mutation.path} is accepted without an anti-forgery token`,
+        steps: [
+            'Sign in as an identity',
+            `Send ${mutation.method} ${mutation.path} with the session cookie, a foreign Origin and no token`,
+        ],
+        expectedResult: 'The server refuses a state-changing request that carries no valid anti-forgery token',
+        actualResult: `The server answered ${String(response.status)}${isRedirect ? ' with a redirect to the next page' : ''} and accepted it`,
+        remediation: 'Verify a per-session anti-forgery token (or an Origin check, or SameSite cookies as a second layer) on every state-changing route.',
+        regressionCheck: `Assert that ${mutation.method} ${mutation.path} without a token answers 403 or 400`,
+        requestIndexes: [response.requestIndex],
+    });
+}
+//# sourceMappingURL=csrf-check.js.map

package/dist/checks/csrf-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-check.js","sourceRoot":"","sources":["../../src/checks/csrf-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAGtC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEtE,yFAAyF;AACzF,MAAM,cAAc,GAAG,yCAAyC,CAAC;AAIjE,SAAS,KAAK,CAAC,QAAuB;IACpC,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAkB;IACtC,UAAU,EAAE,MAAM;IAClB,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,EAAiC,EAAE;QACjF,6FAA6F;QAC7F,+DAA+D;QAC/D,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,CAAC,MAAM,CACrD,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,UAAU,CACzD,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,iHAAiH;gBACvH,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAC/C,OAAO,QAAQ,KAAK,SAAS;gBAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,uCAAuC,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACpF,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,yCAAyC,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACtG,CAAC;QAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,kBAAkB,GAAG,CAAC,CAAC;QAC3B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;gBACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE;oBACP,GAAG,cAAc,CAAC,OAAO,CAAC;oBAC1B,MAAM,EAAE,cAAc;oBACtB,OAAO,EAAE,GAAG,cAAc,GAAG;oBAC7B,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxF;gBACD,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChC,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;iBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvC,kBAAkB,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,kBAAkB,KAAK,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,YAAY,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,+BAA+B;gBACzE,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,IAAI,EACF,OAAO,GAAG,CAAC;gBACT,CAAC,CAAC,0GAA0G;gBAC5G,CAAC,CAAC,qGAAqG;YAC3G,QAAQ;SACT,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,QAAiC,EAAE,QAAuB;IACjF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;IAC1C,OAAO,YAAY,CAAC;QAClB,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QACjD,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,iBAAiB;QAC3B,+FAA+F;QAC/F,qFAAqF;QACrF,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAChF,gBAAgB,EAAE,UAAU;QAC5B,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,4CAA4C;QACtF,KAAK,EAAE;YACL,wBAAwB;YACxB,QAAQ,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,yDAAyD;SAClG;QACD,cAAc,EAAE,sFAAsF;QACtG,YAAY,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,kBAAkB;QACtI,WAAW,EACT,oIAAoI;QACtI,eAAe,EAAE,eAAe,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,qCAAqC;QACrG,cAAc,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/checks/dependencies-check.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Asks npm which installed dependencies have known vulnerabilities (`npm audit`, read-only: it
+ * never installs or changes a file). It sends package names and versions from the lockfile to the
+ * configured package registry, which is why the class has to be named in the authorization. Only
+ * npm projects with a lockfile are covered; any other layout is `skipped`, and an audit that could
+ * not run or answered with an error is `blocked`, never `passed`.
+ */
+export declare const dependenciesCheck: SecurityCheck;
+//# sourceMappingURL=dependencies-check.d.ts.map

package/dist/checks/dependencies-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies-check.d.ts","sourceRoot":"","sources":["../../src/checks/dependencies-check.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AAsChF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAkE/B,CAAC"}

package/dist/checks/dependencies-check.js

@@ -0,0 +1,160 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { posix } from 'node:path';
+import { QaError } from '@qa-ai-stlc/core';
+import { z } from 'zod';
+import { buildFinding } from '../finding.js';
+const NPM_AUDIT_TIMEOUT_MS = 120_000;
+const LOCKFILE_NAMES = ['package-lock.json', 'npm-shrinkwrap.json'];
+const MAX_ADVISORIES_PER_FINDING = 3;
+const MAX_ADVISORY_TITLE_LENGTH = 120;
+const NpmSeveritySchema = z.enum(['info', 'low', 'moderate', 'high', 'critical']);
+const NpmAuditReportSchema = z.union([
+    z.object({ error: z.object({ code: z.string().optional(), summary: z.string().optional() }) }),
+    z.object({
+        vulnerabilities: z.record(z.string(), z.object({
+            name: z.string(),
+            severity: NpmSeveritySchema,
+            isDirect: z.boolean().optional(),
+            // An entry is an advisory object, or the name of another vulnerable package it passes through.
+            via: z.array(z.union([z.string(), z.object({ title: z.string().optional() })])).default([]),
+            fixAvailable: z.union([z.boolean(), z.object({ name: z.string(), version: z.string() })]).optional(),
+        })),
+    }),
+]);
+const SEVERITY_BY_NPM_SEVERITY = {
+    critical: 'critical',
+    high: 'major',
+    moderate: 'minor',
+    low: 'trivial',
+    info: 'trivial',
+};
+/**
+ * Asks npm which installed dependencies have known vulnerabilities (`npm audit`, read-only: it
+ * never installs or changes a file). It sends package names and versions from the lockfile to the
+ * configured package registry, which is why the class has to be named in the authorization. Only
+ * npm projects with a lockfile are covered; any other layout is `skipped`, and an audit that could
+ * not run or answered with an error is `blocked`, never `passed`.
+ */
+export const dependenciesCheck = {
+    checkClass: 'dependencies',
+    run: async ({ source }) => {
+        if (source === undefined) {
+            return { status: 'skipped', note: 'No source.path is configured.', findings: [] };
+        }
+        const located = await locateLockfile(source);
+        if (located === undefined) {
+            return {
+                status: 'skipped',
+                note: 'No package-lock.json was found at or above source.path. Only npm projects with a lockfile are audited in this version.',
+                findings: [],
+            };
+        }
+        const report = await runNpmAudit(source, located.directory);
+        if ('error' in report) {
+            throw new QaError('SECURITY_DEPENDENCY_AUDIT_FAILED', `npm audit could not complete: ${report.error.summary ?? report.error.code ?? 'no reason given'}`, {
+                remediation: 'Check the registry is reachable and the lockfile is current, then run the audit again.',
+            });
+        }
+        const manifestPath = posix.join(source.relativeRoot, 'package.json');
+        const manifestText = await source.readText(manifestPath);
+        const findings = Object.values(report.vulnerabilities).map((vulnerability) => {
+            const advisoryTitles = vulnerability.via
+                .flatMap((entry) => (typeof entry === 'string' || entry.title === undefined ? [] : [entry.title]))
+                .slice(0, MAX_ADVISORIES_PER_FINDING)
+                .map((title) => title.replace(/\s+/gu, ' ').slice(0, MAX_ADVISORY_TITLE_LENGTH));
+            const manifestLine = vulnerability.isDirect === true ? lineOfDependency(manifestText, vulnerability.name) : undefined;
+            const directness = vulnerability.isDirect === true ? 'a direct dependency' : 'pulled in by another dependency';
+            const advisories = advisoryTitles.length > 0 ? `: ${advisoryTitles.join('; ')}` : '';
+            return buildFinding({
+                idParts: ['dependencies', vulnerability.name],
+                checkClass: 'dependencies',
+                riskArea: 'Known vulnerabilities in third-party dependencies',
+                confidence: 'high',
+                severityProposal: SEVERITY_BY_NPM_SEVERITY[vulnerability.severity],
+                title: `Dependency ${vulnerability.name} has a known ${vulnerability.severity} vulnerability`,
+                steps: [
+                    `Run npm audit for ${source.relativeRoot === '' ? 'the project' : source.relativeRoot}`,
+                    `Read the entry for ${vulnerability.name}`,
+                ],
+                expectedResult: 'No dependency has a published vulnerability',
+                actualResult: `${vulnerability.name} is reported as ${vulnerability.severity} (${directness})${advisories}`,
+                remediation: remediationFor(vulnerability.name, vulnerability.fixAvailable),
+                regressionCheck: `Run npm audit and assert it no longer reports ${vulnerability.name}`,
+                requestIndexes: [],
+                codeReferences: [
+                    manifestLine !== undefined
+                        ? { path: manifestPath, line: manifestLine }
+                        : { path: posix.join(located.directory, located.lockfile) },
+                ],
+            });
+        });
+        return {
+            status: 'passed',
+            note: 'Audited the lockfile against the package registry advisories.',
+            findings,
+        };
+    },
+};
+async function locateLockfile(source) {
+    for (const lockfile of LOCKFILE_NAMES) {
+        const directory = await source.findDirectoryWith(lockfile);
+        if (directory !== undefined) {
+            return { directory, lockfile };
+        }
+    }
+    return undefined;
+}
+// A checkout inside a workspace shares the lockfile of the project above it, so the audit runs
+// from the lockfile's directory and is narrowed to the checkout's own workspace.
+async function runNpmAudit(source, lockDirectory) {
+    // The runner has no working directory of its own, so the project is named by absolute path.
+    const args = ['audit', '--json', '--prefix', source.absoluteDirectory(lockDirectory)];
+    if (lockDirectory !== source.relativeRoot) {
+        args.push('--workspace', posix.relative(lockDirectory, source.relativeRoot));
+    }
+    let stdout;
+    try {
+        // npm exits non-zero when it finds vulnerabilities, so the exit code carries no meaning here;
+        // the JSON report on stdout is the answer.
+        ({ stdout } = await source.processRunner.run('npm', args, {
+            signal: AbortSignal.timeout(NPM_AUDIT_TIMEOUT_MS),
+        }));
+    }
+    catch (error) {
+        throw new QaError('SECURITY_DEPENDENCY_AUDIT_FAILED', 'npm audit could not be started or timed out', {
+            remediation: 'Check npm is installed and on the path.',
+            cause: error,
+        });
+    }
+    let json;
+    try {
+        json = JSON.parse(stdout);
+    }
+    catch (error) {
+        throw new QaError('SECURITY_DEPENDENCY_AUDIT_FAILED', 'npm audit did not answer with JSON', {
+            remediation: 'Run "npm audit --json" in the project to see what npm printed.',
+            cause: error,
+        });
+    }
+    const parsed = NpmAuditReportSchema.safeParse(json);
+    if (!parsed.success) {
+        throw new QaError('SECURITY_DEPENDENCY_AUDIT_FAILED', 'npm audit answered with a report in an unknown shape', {
+            remediation: 'Update npm, or run "npm audit --json" in the project to see what it printed.',
+        });
+    }
+    return parsed.data;
+}
+function lineOfDependency(manifestText, name) {
+    const index = manifestText?.split(/\r?\n/u).findIndex((line) => line.trimStart().startsWith(`"${name}":`));
+    return index === undefined || index < 0 ? undefined : index + 1;
+}
+function remediationFor(name, fixAvailable) {
+    if (typeof fixAvailable === 'object') {
+        return `Update ${fixAvailable.name} to ${fixAvailable.version} or later.`;
+    }
+    return fixAvailable === true
+        ? `Update ${name} to a patched version (npm audit reports a fix is available).`
+        : `No fix is published for ${name}: replace it, or limit how the application uses it.`;
+}
+//# sourceMappingURL=dependencies-check.js.map

package/dist/checks/dependencies-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies-check.js","sourceRoot":"","sources":["../../src/checks/dependencies-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAI7C,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,cAAc,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAU,CAAC;AAC7E,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAGlF,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC;IACnC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IAC9F,CAAC,CAAC,MAAM,CAAC;QACP,eAAe,EAAE,CAAC,CAAC,MAAM,CACvB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,QAAQ,EAAE,iBAAiB;YAC3B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAChC,+FAA+F;YAC/F,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3F,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;SACrG,CAAC,CACH;KACF,CAAC;CACH,CAAC,CAAC;AAIH,MAAM,wBAAwB,GAAuE;IACnG,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE,OAAO;IACjB,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC9C,UAAU,EAAE,cAAc;IAC1B,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAiC,EAAE;QACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,wHAAwH;gBAC9H,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,OAAO,CACf,kCAAkC,EAClC,iCAAiC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,iBAAiB,EAAE,EACjG;gBACE,WAAW,EACT,wFAAwF;aAC3F,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE;YAC3E,MAAM,cAAc,GAAG,aAAa,CAAC,GAAG;iBACrC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;iBACjG,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;iBACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnF,MAAM,YAAY,GAChB,aAAa,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnG,MAAM,UAAU,GACd,aAAa,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iCAAiC,CAAC;YAC9F,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO,YAAY,CAAC;gBAClB,OAAO,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC;gBAC7C,UAAU,EAAE,cAAc;gBAC1B,QAAQ,EAAE,mDAAmD;gBAC7D,UAAU,EAAE,MAAM;gBAClB,gBAAgB,EAAE,wBAAwB,CAAC,aAAa,CAAC,QAAQ,CAAC;gBAClE,KAAK,EAAE,cAAc,aAAa,CAAC,IAAI,gBAAgB,aAAa,CAAC,QAAQ,gBAAgB;gBAC7F,KAAK,EAAE;oBACL,qBAAqB,MAAM,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE;oBACvF,sBAAsB,aAAa,CAAC,IAAI,EAAE;iBAC3C;gBACD,cAAc,EAAE,6CAA6C;gBAC7D,YAAY,EAAE,GAAG,aAAa,CAAC,IAAI,mBAAmB,aAAa,CAAC,QAAQ,KAAK,UAAU,IAAI,UAAU,EAAE;gBAC3G,WAAW,EAAE,cAAc,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC;gBAC3E,eAAe,EAAE,iDAAiD,aAAa,CAAC,IAAI,EAAE;gBACtF,cAAc,EAAE,EAAE;gBAClB,cAAc,EAAE;oBACd,YAAY,KAAK,SAAS;wBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE;wBAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;iBAC9D;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,+DAA+D;YACrE,QAAQ;SACT,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,cAAc,CAC3B,MAAsB;IAEtB,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+FAA+F;AAC/F,iFAAiF;AACjF,KAAK,UAAU,WAAW,CAAC,MAAsB,EAAE,aAAqB;IACtE,4FAA4F;IAC5F,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;IACtF,IAAI,aAAa,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,8FAA8F;QAC9F,2CAA2C;QAC3C,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE;YACxD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;SAClD,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,OAAO,CAAC,kCAAkC,EAAE,6CAA6C,EAAE;YACnG,WAAW,EAAE,yCAAyC;YACtD,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,OAAO,CAAC,kCAAkC,EAAE,oCAAoC,EAAE;YAC1F,WAAW,EAAE,gEAAgE;YAC7E,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,OAAO,CACf,kCAAkC,EAClC,sDAAsD,EACtD;YACE,WAAW,EAAE,8EAA8E;SAC5F,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAgC,EAAE,IAAY;IACtE,MAAM,KAAK,GAAG,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;IAC3G,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,YAA0B;IAC9D,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,UAAU,YAAY,CAAC,IAAI,OAAO,YAAY,CAAC,OAAO,YAAY,CAAC;IAC5E,CAAC;IACD,OAAO,YAAY,KAAK,IAAI;QAC1B,CAAC,CAAC,UAAU,IAAI,+DAA+D;QAC/E,CAAC,CAAC,2BAA2B,IAAI,qDAAqD,CAAC;AAC3F,CAAC"}

package/dist/checks/encoding-check.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Sends a harmless marker in the usual query parameters and reads the page back. A marker that
+ * comes back with its angle brackets and quotes unencoded means input is written into the page
+ * without encoding, the precondition of cross-site scripting. Only GET requests are sent. Finding
+ * nothing proves little (the real parameters stay unknown), so a clean result is `uncertain`, not
+ * `passed`: the audit does not claim more than it tried.
+ */
+export declare const encodingCheck: SecurityCheck;
+//# sourceMappingURL=encoding-check.d.ts.map

package/dist/checks/encoding-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding-check.d.ts","sourceRoot":"","sources":["../../src/checks/encoding-check.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AAwBhF;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,EAAE,aAsC3B,CAAC"}

package/dist/checks/encoding-check.js

@@ -0,0 +1,67 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { fetchPage } from '../fetch-page.js';
+import { buildFinding } from '../finding.js';
+const PAGE_PATHS = ['/', '/login'];
+// Query parameter names that applications commonly echo into a page. A black-box check cannot know
+// which parameters an application reads, so it can only try the usual ones.
+const PARAMETER_NAMES = [
+    'q',
+    'search',
+    'query',
+    's',
+    'name',
+    'id',
+    'message',
+    'error',
+    'redirect',
+    'next',
+];
+// A marker, not a payload: it contains the characters that matter in HTML (angle brackets and
+// quotes) around a fixed token, and does nothing if it is reflected.
+const TOKEN = 'qaaudit7q3';
+const MARKER = `${TOKEN}<"'>`;
+/**
+ * Sends a harmless marker in the usual query parameters and reads the page back. A marker that
+ * comes back with its angle brackets and quotes unencoded means input is written into the page
+ * without encoding, the precondition of cross-site scripting. Only GET requests are sent. Finding
+ * nothing proves little (the real parameters stay unknown), so a clean result is `uncertain`, not
+ * `passed`: the audit does not claim more than it tried.
+ */
+export const encodingCheck = {
+    checkClass: 'encoding',
+    run: async ({ probe, authorization }) => {
+        const { baseUrl } = authorization.environment;
+        const query = PARAMETER_NAMES.map((name) => `${name}=${encodeURIComponent(MARKER)}`).join('&');
+        const findings = [];
+        for (const path of PAGE_PATHS) {
+            const page = await fetchPage(probe, baseUrl, `${path}?${query}`);
+            if (!page.response.bodyText.includes(MARKER)) {
+                continue;
+            }
+            findings.push(buildFinding({
+                idParts: ['encoding', 'reflected', path],
+                checkClass: 'encoding',
+                riskArea: 'Injection: output encoding',
+                confidence: 'medium',
+                severityProposal: 'major',
+                title: `Input from the query string is written into ${path} without encoding`,
+                steps: [
+                    `Request ${path} with a marker containing angle brackets and quotes in the usual parameters`,
+                    'Search the page for the marker, unencoded',
+                ],
+                expectedResult: 'Characters that are special in HTML come back encoded',
+                actualResult: `The marker was returned unencoded by GET ${page.path.replace(/\?.*$/u, '')}`,
+                remediation: 'Encode all input for the context it is written into (HTML, attribute, script, URL).',
+                regressionCheck: `Assert that a marker with angle brackets sent to ${path} is returned encoded`,
+                requestIndexes: [page.response.requestIndex],
+            }));
+        }
+        return {
+            status: 'uncertain',
+            note: `Tried ${String(PARAMETER_NAMES.length)} common parameter names on ${String(PAGE_PATHS.length)} pages; parameters the application actually reads were not discovered.`,
+            findings,
+        };
+    },
+};
+//# sourceMappingURL=encoding-check.js.map

package/dist/checks/encoding-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding-check.js","sourceRoot":"","sources":["../../src/checks/encoding-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAGtC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,MAAM,UAAU,GAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAEtD,mGAAmG;AACnG,4EAA4E;AAC5E,MAAM,eAAe,GAAsB;IACzC,GAAG;IACH,QAAQ;IACR,OAAO;IACP,GAAG;IACH,MAAM;IACN,IAAI;IACJ,SAAS;IACT,OAAO;IACP,UAAU;IACV,MAAM;CACP,CAAC;AAEF,8FAA8F;AAC9F,qEAAqE;AACrE,MAAM,KAAK,GAAG,YAAY,CAAC;AAC3B,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,UAAU,EAAE,UAAU;IACtB,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAiC,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC;QAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAsB,EAAE,CAAC;QAEvC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,YAAY,CAAC;gBACX,OAAO,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC;gBACxC,UAAU,EAAE,UAAU;gBACtB,QAAQ,EAAE,4BAA4B;gBACtC,UAAU,EAAE,QAAQ;gBACpB,gBAAgB,EAAE,OAAO;gBACzB,KAAK,EAAE,+CAA+C,IAAI,mBAAmB;gBAC7E,KAAK,EAAE;oBACL,WAAW,IAAI,6EAA6E;oBAC5F,2CAA2C;iBAC5C;gBACD,cAAc,EAAE,uDAAuD;gBACvE,YAAY,EAAE,4CAA4C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE;gBAC3F,WAAW,EAAE,qFAAqF;gBAClG,eAAe,EAAE,oDAAoD,IAAI,sBAAsB;gBAC/F,cAAc,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;aAC7C,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,SAAS,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,8BAA8B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,wEAAwE;YAC5K,QAAQ;SACT,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/checks/errors-check.d.ts

@@ -0,0 +1,8 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Provokes two ordinary error responses and reads them for stack traces, database errors and
+ * framework banners. A match is something the page printed, so confidence is high; it is only a
+ * response body, so nothing here changes anything on the server.
+ */
+export declare const errorsCheck: SecurityCheck;
+//# sourceMappingURL=errors-check.d.ts.map

package/dist/checks/errors-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-check.d.ts","sourceRoot":"","sources":["../../src/checks/errors-check.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AAsChF;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,aA4BzB,CAAC"}

package/dist/checks/errors-check.js

@@ -0,0 +1,60 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { buildFinding } from '../finding.js';
+// A path nothing serves, and a path with an invalid percent escape: the two ordinary ways to
+// provoke an error page without sending anything harmful.
+const ERROR_PATHS = [
+    { path: '/qa-audit-no-such-page', label: 'a page that does not exist' },
+    { path: '/qa-audit-%ZZ', label: 'a malformed percent escape' },
+];
+// What an error page should never print: where the code lives, which query failed, which product
+// and version is answering. Each pattern matches wording specific enough to be rare in ordinary prose.
+const LEAK_PATTERNS = [
+    {
+        name: 'stack-trace',
+        pattern: /\n\s+at [\w$.<>[\] ]+\(?[^\n)]*:\d+:\d+\)?|Traceback \(most recent call last\)|Stack trace:|Exception in thread/u,
+        severity: 'major',
+    },
+    {
+        name: 'database-error',
+        pattern: /SQLSTATE\[|ORA-\d{5}|You have an error in your SQL syntax|PG::\w+Error|SQLite3?::|MongoServerError/iu,
+        severity: 'major',
+    },
+    {
+        name: 'framework-banner',
+        pattern: /Whitelabel Error Page|Server Error in '\/' Application|Werkzeug Debugger|Django.*DEBUG = True|Laravel.*Whoops|<pre>Cannot (GET|POST|PUT|DELETE) \//iu,
+        severity: 'trivial',
+    },
+];
+/**
+ * Provokes two ordinary error responses and reads them for stack traces, database errors and
+ * framework banners. A match is something the page printed, so confidence is high; it is only a
+ * response body, so nothing here changes anything on the server.
+ */
+export const errorsCheck = {
+    checkClass: 'errors',
+    run: async ({ probe }) => {
+        const findings = [];
+        for (const { path, label } of ERROR_PATHS) {
+            const response = await probe.request({ method: 'GET', path });
+            for (const leak of LEAK_PATTERNS.filter((candidate) => candidate.pattern.test(response.bodyText))) {
+                findings.push(buildFinding({
+                    idParts: ['errors', leak.name, path],
+                    checkClass: 'errors',
+                    riskArea: 'Information disclosure: error pages',
+                    confidence: 'high',
+                    severityProposal: leak.severity,
+                    title: `An error page discloses a ${leak.name.replace('-', ' ')}`,
+                    steps: [`Request ${path} (${label})`, 'Read the response body'],
+                    expectedResult: 'The error page says what went wrong for a visitor and nothing about the implementation',
+                    actualResult: `GET ${path} answered ${String(response.status)} with a ${leak.name.replace('-', ' ')}`,
+                    remediation: 'Show a generic error page in production and log the detail on the server.',
+                    regressionCheck: `Assert that GET ${path} returns no ${leak.name.replace('-', ' ')}`,
+                    requestIndexes: [response.requestIndex],
+                }));
+            }
+        }
+        return { status: 'passed', note: 'Provoked a missing-page and a malformed-escape error.', findings };
+    },
+};
+//# sourceMappingURL=errors-check.js.map

package/dist/checks/errors-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-check.js","sourceRoot":"","sources":["../../src/checks/errors-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAGtC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,6FAA6F;AAC7F,0DAA0D;AAC1D,MAAM,WAAW,GAAiE;IAChF,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,4BAA4B,EAAE;IACvE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,4BAA4B,EAAE;CAC/D,CAAC;AAQF,iGAAiG;AACjG,uGAAuG;AACvG,MAAM,aAAa,GAA2B;IAC5C;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EACL,kHAAkH;QACpH,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EACL,sGAAsG;QACxG,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EACL,sJAAsJ;QACxJ,QAAQ,EAAE,SAAS;KACpB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAkB;IACxC,UAAU,EAAE,QAAQ;IACpB,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAiC,EAAE;QACtD,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAClG,QAAQ,CAAC,IAAI,CACX,YAAY,CAAC;oBACX,OAAO,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;oBACpC,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,qCAAqC;oBAC/C,UAAU,EAAE,MAAM;oBAClB,gBAAgB,EAAE,IAAI,CAAC,QAAQ;oBAC/B,KAAK,EAAE,6BAA6B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;oBACjE,KAAK,EAAE,CAAC,WAAW,IAAI,KAAK,KAAK,GAAG,EAAE,wBAAwB,CAAC;oBAC/D,cAAc,EACZ,wFAAwF;oBAC1F,YAAY,EAAE,OAAO,IAAI,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;oBACrG,WAAW,EAAE,2EAA2E;oBACxF,eAAe,EAAE,mBAAmB,IAAI,eAAe,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;oBACpF,cAAc,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;iBACxC,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uDAAuD,EAAE,QAAQ,EAAE,CAAC;IACvG,CAAC;CACF,CAAC"}

package/dist/checks/headers-check.d.ts

@@ -0,0 +1,9 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Looks at the security headers of the landing page, following same-origin redirects to the page
+ * a visitor actually sees. Header names are compared case-insensitively because the probe's HTTP
+ * client lower-cases them. A missing header is a fact about the response, so those findings carry
+ * high confidence; their severity stays low because each is defence in depth, not a flaw by itself.
+ */
+export declare const headersCheck: SecurityCheck;
+//# sourceMappingURL=headers-check.d.ts.map

package/dist/checks/headers-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers-check.d.ts","sourceRoot":"","sources":["../../src/checks/headers-check.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AAoEhF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,aA2D1B,CAAC"}

package/dist/checks/headers-check.js

@@ -0,0 +1,110 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { fetchPage } from '../fetch-page.js';
+import { buildFinding } from '../finding.js';
+const PAGE_PATH = '/';
+// A product name followed by a version number tells an attacker which known flaws to try.
+const VERSIONED_BANNER = /\d+\.\d+/u;
+const EXPECTATIONS = [
+    {
+        name: 'content-security-policy',
+        isMissing: (headers) => headers['content-security-policy'] === undefined,
+        title: 'No Content-Security-Policy header',
+        riskArea: 'Browser hardening: script injection',
+        severity: 'minor',
+        expected: 'The response sets a Content-Security-Policy that limits where scripts can load from',
+        remediation: 'Send a Content-Security-Policy header, starting from a restrictive default-src.',
+    },
+    {
+        name: 'x-content-type-options',
+        isMissing: (headers) => headers['x-content-type-options']?.toLowerCase() !== 'nosniff',
+        title: 'Content type sniffing is not disabled',
+        riskArea: 'Browser hardening: content sniffing',
+        severity: 'minor',
+        expected: 'The response sets X-Content-Type-Options: nosniff',
+        remediation: 'Send X-Content-Type-Options: nosniff on every response.',
+    },
+    {
+        name: 'framing',
+        // A frame-ancestors directive in the CSP supersedes X-Frame-Options, so either one counts.
+        isMissing: (headers) => headers['x-frame-options'] === undefined &&
+            !(headers['content-security-policy'] ?? '').toLowerCase().includes('frame-ancestors'),
+        title: 'The page can be framed by any site',
+        riskArea: 'Browser hardening: clickjacking',
+        severity: 'minor',
+        expected: 'The response sets X-Frame-Options or a CSP frame-ancestors directive',
+        remediation: "Send Content-Security-Policy: frame-ancestors 'self', or X-Frame-Options: SAMEORIGIN.",
+    },
+    {
+        name: 'strict-transport-security',
+        isMissing: (headers, isHttps) => isHttps && headers['strict-transport-security'] === undefined,
+        title: 'No Strict-Transport-Security header on an HTTPS site',
+        riskArea: 'Transport security',
+        severity: 'minor',
+        expected: 'The HTTPS response sets Strict-Transport-Security',
+        remediation: 'Send Strict-Transport-Security with a max-age of at least six months.',
+    },
+    {
+        name: 'referrer-policy',
+        isMissing: (headers) => headers['referrer-policy'] === undefined,
+        title: 'No Referrer-Policy header',
+        riskArea: 'Information disclosure: referrer',
+        severity: 'trivial',
+        expected: 'The response sets a Referrer-Policy',
+        remediation: 'Send Referrer-Policy: strict-origin-when-cross-origin or stricter.',
+    },
+];
+/**
+ * Looks at the security headers of the landing page, following same-origin redirects to the page
+ * a visitor actually sees. Header names are compared case-insensitively because the probe's HTTP
+ * client lower-cases them. A missing header is a fact about the response, so those findings carry
+ * high confidence; their severity stays low because each is defence in depth, not a flaw by itself.
+ */
+export const headersCheck = {
+    checkClass: 'headers',
+    run: async ({ probe, authorization }) => {
+        const { baseUrl } = authorization.environment;
+        const isHttps = new URL(baseUrl).protocol === 'https:';
+        const page = await fetchPage(probe, baseUrl, PAGE_PATH);
+        const { headers } = page.response;
+        const requestIndexes = [page.response.requestIndex];
+        const reached = `GET ${page.path}`;
+        const findings = EXPECTATIONS.filter((expectation) => expectation.isMissing(headers, isHttps)).map((expectation) => buildFinding({
+            idParts: ['headers', expectation.name],
+            checkClass: 'headers',
+            riskArea: expectation.riskArea,
+            confidence: 'high',
+            severityProposal: expectation.severity,
+            title: expectation.title,
+            steps: [
+                `Request ${PAGE_PATH}${page.path === PAGE_PATH ? '' : ` and follow it to ${page.path}`}`,
+                'Read the response headers',
+            ],
+            expectedResult: expectation.expected,
+            actualResult: `${reached} answered ${String(page.response.status)} without it`,
+            remediation: expectation.remediation,
+            regressionCheck: `Assert that ${reached} returns the ${expectation.name} protection`,
+            requestIndexes,
+        }));
+        const banners = [headers.server, headers['x-powered-by']].filter((value) => value !== undefined);
+        const disclosesTechnology = headers['x-powered-by'] !== undefined || banners.some((banner) => VERSIONED_BANNER.test(banner));
+        if (disclosesTechnology) {
+            findings.push(buildFinding({
+                idParts: ['headers', 'technology-banner'],
+                checkClass: 'headers',
+                riskArea: 'Information disclosure: technology',
+                confidence: 'medium',
+                severityProposal: 'trivial',
+                title: 'The response names the server technology',
+                steps: [`Request ${PAGE_PATH}`, 'Read the Server and X-Powered-By headers'],
+                expectedResult: 'The response does not name the framework or its version',
+                actualResult: `The response sent ${banners.map((banner) => `"${banner}"`).join(' and ')}`,
+                remediation: 'Remove X-Powered-By and drop version numbers from the Server header.',
+                regressionCheck: 'Assert that the response has no X-Powered-By header and no versioned Server header',
+                requestIndexes,
+            }));
+        }
+        return { status: 'passed', note: `Read the headers of ${page.path}.`, findings };
+    },
+};
+//# sourceMappingURL=headers-check.js.map

package/dist/checks/headers-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers-check.js","sourceRoot":"","sources":["../../src/checks/headers-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAGtC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAYrC,MAAM,YAAY,GAAiC;IACjD;QACE,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC,KAAK,SAAS;QACxE,KAAK,EAAE,mCAAmC;QAC1C,QAAQ,EAAE,qCAAqC;QAC/C,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,qFAAqF;QAC/F,WAAW,EAAE,iFAAiF;KAC/F;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS;QACtF,KAAK,EAAE,uCAAuC;QAC9C,QAAQ,EAAE,qCAAqC;QAC/C,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,mDAAmD;QAC7D,WAAW,EAAE,yDAAyD;KACvE;IACD;QACE,IAAI,EAAE,SAAS;QACf,2FAA2F;QAC3F,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,OAAO,CAAC,iBAAiB,CAAC,KAAK,SAAS;YACxC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACvF,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,iCAAiC;QAC3C,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,sEAAsE;QAChF,WAAW,EAAE,uFAAuF;KACrG;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,2BAA2B,CAAC,KAAK,SAAS;QAC9F,KAAK,EAAE,sDAAsD;QAC7D,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,mDAAmD;QAC7D,WAAW,EAAE,uEAAuE;KACrF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,SAAS;QAChE,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,kCAAkC;QAC5C,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,qCAAqC;QAC/C,WAAW,EAAE,oEAAoE;KAClF;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC,UAAU,EAAE,SAAS;IACrB,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAiC,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QAEnC,MAAM,QAAQ,GAAsB,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CACtE,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CACxC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACpB,YAAY,CAAC;YACX,OAAO,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC;YACtC,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,UAAU,EAAE,MAAM;YAClB,gBAAgB,EAAE,WAAW,CAAC,QAAQ;YACtC,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,KAAK,EAAE;gBACL,WAAW,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,IAAI,EAAE,EAAE;gBACxF,2BAA2B;aAC5B;YACD,cAAc,EAAE,WAAW,CAAC,QAAQ;YACpC,YAAY,EAAE,GAAG,OAAO,aAAa,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa;YAC9E,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,eAAe,EAAE,eAAe,OAAO,gBAAgB,WAAW,CAAC,IAAI,aAAa;YACpF,cAAc;SACf,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAC9D,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAChD,CAAC;QACF,MAAM,mBAAmB,GACvB,OAAO,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACnG,IAAI,mBAAmB,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CACX,YAAY,CAAC;gBACX,OAAO,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC;gBACzC,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,oCAAoC;gBAC9C,UAAU,EAAE,QAAQ;gBACpB,gBAAgB,EAAE,SAAS;gBAC3B,KAAK,EAAE,0CAA0C;gBACjD,KAAK,EAAE,CAAC,WAAW,SAAS,EAAE,EAAE,0CAA0C,CAAC;gBAC3E,cAAc,EAAE,yDAAyD;gBACzE,YAAY,EAAE,qBAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACzF,WAAW,EAAE,sEAAsE;gBACnF,eAAe,EACb,oFAAoF;gBACtF,cAAc;aACf,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC;IACnF,CAAC;CACF,CAAC"}

package/dist/checks/secrets-check.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Looks through the source checkout for credentials committed with the code. Only the kind of
+ * secret and where it sits are reported, never the value, so the audit result and the defect draft
+ * carry no credential themselves. A match in test code or sample data is reported with low
+ * confidence. A clean result is `passed` only when every file was read: a truncated or partly
+ * skipped scan cannot show that nothing is there.
+ */
+export declare const secretsCheck: SecurityCheck;
+//# sourceMappingURL=secrets-check.d.ts.map

package/dist/checks/secrets-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-check.d.ts","sourceRoot":"","sources":["../../src/checks/secrets-check.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AA+DhF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,aA+C1B,CAAC"}