@quantakrypto/core 0.4.1 → 0.4.3

package/dist/detectors/c.js.map

@@ -1 +1 @@
-{"version":3,"file":"c.js","sourceRoot":"","sources":["../../src/detectors/c.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,QAAQ,GAAG,qDAAqD,CAAC;AACvE,MAAM,OAAO,GAAG,6DAA6D,CAAC;AAC9E,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAC7D,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAC7C,MAAM,QAAQ,GAAG,iEAAiE,CAAC;AACnF,MAAM,OAAO,GAAG,+DAA+D,CAAC;AAEhF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,4EAA4E;CACtF,CAAC;AACF,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,wDAAwD;IACrE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+JAA+J;IACjK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;IAClF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,0BAA0B;IACvC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,sGAAsG;CACzG,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;IACvF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,oGAAoG;CACvG,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAa;IACjC,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,gDAAgD;IAC7D,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC;IAC/C,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxB,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"c.js","sourceRoot":"","sources":["../../src/detectors/c.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtF,MAAM,QAAQ,GAAG,qDAAqD,CAAC;AACvE,MAAM,OAAO,GAAG,6DAA6D,CAAC;AAC9E,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAC7D,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAC7C,MAAM,QAAQ,GAAG,iEAAiE,CAAC;AACnF,MAAM,OAAO,GAAG,+DAA+D,CAAC;AAChF,wEAAwE;AACxE,6EAA6E;AAC7E,MAAM,eAAe,GAAG,yDAAyD,CAAC;AAClF,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAClD,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,aAAa,GAAG,kEAAkE,CAAC;AACzF,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,MAAM,eAAe,GACnB,4IAA4I,CAAC;AAC/I,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACjD,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAC7C,MAAM,cAAc,GAAG,uDAAuD,CAAC;AAC/E,gFAAgF;AAChF,qEAAqE;AACrE,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAC9D,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,4EAA4E;CACtF,CAAC;AACF,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,wDAAwD;IACrE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+JAA+J;IACjK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;IAClF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,0BAA0B;IACvC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,sGAAsG;CACzG,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;IACvF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,oGAAoG;CACvG,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,4DAA4D;IACzE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4LAA4L;IAC9L,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mHAAmH;CACtH,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,oGAAoG;CACvG,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mGAAmG;IACrG,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,qFAAqF;IACvF,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+GAA+G;CAClH,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,qEAAqE;IAClF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gGAAgG;CACnG,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,wCAAwC;IAC/C,WAAW,EAAE,sBAAsB;IACnC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6FAA6F;IAC/F,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,oBAAoB;IACjC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,qGAAqG;IACvG,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+FAA+F;CAClG,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,2CAA2C;IAClD,WAAW,EAAE,qCAAqC;IAClD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,+DAA+D;IACxE,WAAW,EAAE,gFAAgF;CAC9F,CAAC;AACF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,mDAAmD;IAC1D,WAAW,EAAE,yBAAyB;IACtC,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EAAE,oEAAoE;IAC7E,WAAW,EAAE,uDAAuD;CACrE,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAa;IACjC,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,gDAAgD;IAC7D,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE;QACL,UAAU;QACV,SAAS;QACT,YAAY;QACZ,WAAW;QACX,UAAU;QACV,SAAS;QACT,iBAAiB;QACjB,iBAAiB;QACjB,gBAAgB;QAChB,eAAe;QACf,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,iBAAiB;QACjB,gBAAgB;QAChB,kBAAkB;QAClB,sBAAsB;KACvB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC;IAC/C,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxB,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxB,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source-code detector for classical asymmetric cryptography in C / C++ using\n * OpenSSL (the dominant crypto library for the ecosystem). Lexical, same\n * strategy as the other packs; the OpenSSL function names are distinctive.\n *\n * NOTE: scanning OpenSSL's OWN source/headers will naturally light up (the\n * library declares these symbols) — that is inherent to lexical scanning of a\n * crypto library, not a false positive in application code. Matches the classic\n * `*_generate_key` / `ECDSA_sign` / `ECDH_compute_key` call forms plus the\n * `EVP_RSA_gen` helper.\n *\n * HNDL: RSA encryption and (EC)DH key agreement are harvest-now-decrypt-later\n * exposed (hndl:true); ECDSA / DSA signatures are hndl:false but forgeable.\n * `EC_KEY_generate_key` is ambiguous (feeds ECDSA + ECDH), classified\n * conservatively as key-exchange-capable (hndl:true).\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { C_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from \"../cwe.js\";\n\nconst RE_C_RSA = /\\bRSA_generate_key(?:_ex)?\\s*\\(|\\bEVP_RSA_gen\\s*\\(/g;\nconst RE_C_EC = /\\bEC_KEY_generate_key\\s*\\(|\\bEC_KEY_new_by_curve_name\\s*\\(/g;\nconst RE_C_ECDSA = /\\bECDSA_do_sign\\s*\\(|\\bECDSA_sign\\s*\\(/g;\nconst RE_C_ECDH = /\\bECDH_compute_key\\s*\\(/g;\nconst RE_C_DSA = /\\bDSA_generate_key\\s*\\(|\\bDSA_generate_parameters(?:_ex)?\\s*\\(/g;\nconst RE_C_DH = /\\bDH_generate_key\\s*\\(|\\bDH_generate_parameters(?:_ex)?\\s*\\(/g;\n// Modern OpenSSL 3.x EVP API (the legacy *_generate_key forms above are\n// deprecated) + libsodium — the biggest C false-negative surface (audit F1).\nconst RE_C_EVP_KEYGEN = /\\bEVP_PKEY_(?:Q_)?keygen\\s*\\(|\\bEVP_PKEY_paramgen\\s*\\(/g;\nconst RE_C_EVP_DERIVE = /\\bEVP_PKEY_derive\\s*\\(/g;\nconst RE_C_EVP_CRYPT = /\\bEVP_PKEY_(?:encrypt|decrypt)\\s*\\(/g;\nconst RE_C_EVP_SIGN = /\\bEVP_DigestSign(?:Init)?\\s*\\(|\\bEVP_DigestVerify(?:Init)?\\s*\\(/g;\n// X25519: crypto_box / crypto_kx key pairs (incl. the fully-qualified\n// curve25519xsalsa20poly1305 form) plus the low-level crypto_scalarmult\n// primitive — all classical Curve25519 key agreement (audit recall gap).\nconst RE_C_SODIUM_BOX =\n  /\\bcrypto_box_(?:curve25519xsalsa20poly1305_)?(?:seed_)?keypair\\s*\\(|\\bcrypto_kx_keypair\\s*\\(|\\bcrypto_scalarmult_(?:curve25519|base)\\s*\\(/g;\n// EdDSA: crypto_sign key pairs, including the explicit _ed25519 forms and the\n// deterministic seed_keypair variants (audit recall gap: _ed25519_keypair).\nconst RE_C_SODIUM_SIGN = /\\bcrypto_sign_(?:ed25519_)?(?:seed_)?keypair\\s*\\(/g;\n// Legacy verify / decrypt counterparts to the *_sign / *_encrypt rules above\n// (audit F4-c): the classic OpenSSL RSA/ECDSA verification and RSA raw\n// decryption call forms that the modern EVP + legacy keygen rules don't cover.\nconst RE_C_ECDSA_VERIFY = /\\bECDSA_verify\\s*\\(/g;\nconst RE_C_RSA_VERIFY = /\\bRSA_verify\\s*\\(/g;\nconst RE_C_RSA_CRYPT = /\\bRSA_public_encrypt\\s*\\(|\\bRSA_private_decrypt\\s*\\(/g;\n// C/OpenSSL legacy TLS configuration (mirrors source.ts tlsDetector): forcing a\n// deprecated protocol version or disabling certificate verification.\nconst RE_C_TLS_VERSION = /\\bTLSv1_method\\b|\\bSSLv3_method\\b/g;\nconst RE_C_TLS_VERIFY_NONE = /\\bSSL_VERIFY_NONE\\b/g;\n\nconst RULE_C_RSA: RuleMeta = {\n  id: \"c-rsa-keygen\",\n  title: \"C/OpenSSL RSA key generation\",\n  description: \"OpenSSL RSA_generate_key(_ex) / EVP_RSA_gen\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Generates a classical RSA key pair (C/OpenSSL), which is not quantum-safe.\",\n};\nconst RULE_C_EC: RuleMeta = {\n  id: \"c-ec-keygen\",\n  title: \"C/OpenSSL EC key generation\",\n  description: \"OpenSSL EC_KEY_generate_key / EC_KEY_new_by_curve_name\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Generates a classical EC key pair (C/OpenSSL). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_C_ECDSA: RuleMeta = {\n  id: \"c-ecdsa\",\n  title: \"C/OpenSSL ECDSA signature\",\n  description: \"OpenSSL ECDSA_sign / ECDSA_do_sign\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA signing (C/OpenSSL) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_C_ECDH: RuleMeta = {\n  id: \"c-ecdh\",\n  title: \"C/OpenSSL ECDH key agreement\",\n  description: \"OpenSSL ECDH_compute_key\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman (C/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_C_DSA: RuleMeta = {\n  id: \"c-dsa\",\n  title: \"C/OpenSSL DSA key/usage\",\n  description: \"OpenSSL DSA_generate_key / DSA_generate_parameters\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical DSA (C/OpenSSL) is deprecated and forgeable by a quantum attacker.\",\n  remediation: \"Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_C_DH: RuleMeta = {\n  id: \"c-dh\",\n  title: \"C/OpenSSL Diffie-Hellman key exchange\",\n  description: \"OpenSSL DH_generate_key / DH_generate_parameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman (C/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_C_EVP_KEYGEN: RuleMeta = {\n  id: \"c-evp-keygen\",\n  title: \"C/OpenSSL EVP key generation\",\n  description: \"OpenSSL 3.x EVP_PKEY_keygen / EVP_PKEY_Q_keygen / paramgen\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Generates an asymmetric key via the OpenSSL 3.x EVP API (the key type — RSA/EC/DH/X25519 — is set on the CTX). Treated conservatively as key-exchange-capable (harvest-now-decrypt-later).\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_C_EVP_DERIVE: RuleMeta = {\n  id: \"c-evp-derive\",\n  title: \"C/OpenSSL EVP key agreement\",\n  description: \"OpenSSL 3.x EVP_PKEY_derive (ECDH / DH shared secret)\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Derives an (EC)DH shared secret via the OpenSSL EVP API — broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_C_EVP_CRYPT: RuleMeta = {\n  id: \"c-evp-pkey-crypt\",\n  title: \"C/OpenSSL EVP public-key encryption\",\n  description: \"OpenSSL 3.x EVP_PKEY_encrypt / EVP_PKEY_decrypt (RSA)\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"RSA public-key encryption/decryption via the OpenSSL EVP API is harvest-now-decrypt-later exposed.\",\n};\nconst RULE_C_EVP_SIGN: RuleMeta = {\n  id: \"c-evp-sign\",\n  title: \"C/OpenSSL EVP signing\",\n  description: \"OpenSSL 3.x EVP_DigestSign* / EVP_DigestVerify*\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical signature via the OpenSSL EVP API (RSA/ECDSA/EdDSA) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_C_SODIUM_BOX: RuleMeta = {\n  id: \"c-libsodium-box\",\n  title: \"libsodium X25519 key pair\",\n  description:\n    \"libsodium crypto_box / crypto_kx keypair + crypto_scalarmult (X25519 key agreement)\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"libsodium crypto_box uses X25519 key agreement — modern but classical, and harvest-now-decrypt-later exposed.\",\n};\nconst RULE_C_SODIUM_SIGN: RuleMeta = {\n  id: \"c-libsodium-sign\",\n  title: \"libsodium Ed25519 key pair\",\n  description: \"libsodium crypto_sign(_ed25519)(_seed)_keypair (Ed25519 signatures)\",\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"libsodium crypto_sign uses Ed25519 signatures — classical and forgeable by a quantum attacker.\",\n};\nconst RULE_C_ECDSA_VERIFY: RuleMeta = {\n  id: \"c-ecdsa-verify\",\n  title: \"C/OpenSSL ECDSA signature verification\",\n  description: \"OpenSSL ECDSA_verify\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical ECDSA verification (C/OpenSSL) trusts signatures forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_C_RSA_VERIFY: RuleMeta = {\n  id: \"c-rsa-verify\",\n  title: \"C/OpenSSL RSA signature verification\",\n  description: \"OpenSSL RSA_verify\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical RSA signature verification (C/OpenSSL) trusts signatures forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_C_RSA_CRYPT: RuleMeta = {\n  id: \"c-rsa-crypt\",\n  title: \"C/OpenSSL RSA public-key encryption\",\n  description: \"OpenSSL RSA_public_encrypt / RSA_private_decrypt\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Legacy RSA public-key encryption/decryption (C/OpenSSL) is harvest-now-decrypt-later exposed.\",\n};\nconst RULE_C_TLS_VERSION: RuleMeta = {\n  id: \"c-tls-legacy-version\",\n  title: \"Legacy TLS/SSL version pinned (C/OpenSSL)\",\n  description: \"OpenSSL TLSv1_method / SSLv3_method\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message: \"TLS 1.0 / SSLv3 are deprecated and insecure; require TLS 1.3.\",\n  remediation: \"Use TLS_method() with a minimum of TLS 1.3 and prefer PQC-hybrid key exchange.\",\n};\nconst RULE_C_TLS_VERIFY_NONE: RuleMeta = {\n  id: \"c-tls-verify-none\",\n  title: \"TLS certificate verification disabled (C/OpenSSL)\",\n  description: \"OpenSSL SSL_VERIFY_NONE\",\n  category: \"tls\",\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message: \"SSL_VERIFY_NONE disables TLS certificate verification (MITM risk).\",\n  remediation: \"Use SSL_VERIFY_PEER and verify certificates properly.\",\n};\n\n/** Detects classical asymmetric crypto in C/C++ (OpenSSL). */\nexport const cDetector: Detector = {\n  id: \"c-crypto\",\n  description: \"Classical asymmetric crypto in C/C++ (OpenSSL)\",\n  scope: \"source\",\n  language: \"c\",\n  rules: [\n    RULE_C_RSA,\n    RULE_C_EC,\n    RULE_C_ECDSA,\n    RULE_C_ECDH,\n    RULE_C_DSA,\n    RULE_C_DH,\n    RULE_C_EVP_KEYGEN,\n    RULE_C_EVP_DERIVE,\n    RULE_C_EVP_CRYPT,\n    RULE_C_EVP_SIGN,\n    RULE_C_SODIUM_BOX,\n    RULE_C_SODIUM_SIGN,\n    RULE_C_ECDSA_VERIFY,\n    RULE_C_RSA_VERIFY,\n    RULE_C_RSA_CRYPT,\n    RULE_C_TLS_VERSION,\n    RULE_C_TLS_VERIFY_NONE,\n  ],\n  appliesTo: (f) => hasExtension(f, C_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    add(RE_C_RSA, RULE_C_RSA);\n    add(RE_C_EC, RULE_C_EC);\n    add(RE_C_ECDSA, RULE_C_ECDSA);\n    add(RE_C_ECDH, RULE_C_ECDH);\n    add(RE_C_DSA, RULE_C_DSA);\n    add(RE_C_DH, RULE_C_DH);\n    add(RE_C_EVP_KEYGEN, RULE_C_EVP_KEYGEN);\n    add(RE_C_EVP_DERIVE, RULE_C_EVP_DERIVE);\n    add(RE_C_EVP_CRYPT, RULE_C_EVP_CRYPT);\n    add(RE_C_EVP_SIGN, RULE_C_EVP_SIGN);\n    add(RE_C_SODIUM_BOX, RULE_C_SODIUM_BOX);\n    add(RE_C_SODIUM_SIGN, RULE_C_SODIUM_SIGN);\n    add(RE_C_ECDSA_VERIFY, RULE_C_ECDSA_VERIFY);\n    add(RE_C_RSA_VERIFY, RULE_C_RSA_VERIFY);\n    add(RE_C_RSA_CRYPT, RULE_C_RSA_CRYPT);\n    add(RE_C_TLS_VERSION, RULE_C_TLS_VERSION);\n    add(RE_C_TLS_VERIFY_NONE, RULE_C_TLS_VERIFY_NONE);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/csharp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csharp.d.ts","sourceRoot":"","sources":["../../src/detectors/csharp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA+D/D,gFAAgF;AAChF,eAAO,MAAM,cAAc,EAAE,QAsB5B,CAAC"}
+{"version":3,"file":"csharp.d.ts","sourceRoot":"","sources":["../../src/detectors/csharp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA8L/D,gFAAgF;AAChF,eAAO,MAAM,cAAc,EAAE,QA8C5B,CAAC"}

package/dist/detectors/csharp.js

@@ -1,9 +1,38 @@
 import { CSHARP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 const RE_CS_RSA = /\bRSA\.Create\s*\(|\bnew\s+RSACryptoServiceProvider\s*\(|\bnew\s+RSACng\s*\(|\bnew\s+RSAOpenSsl\s*\(/g;
 const RE_CS_ECDSA = /\bECDsa\.Create\s*\(|\bnew\s+ECDsaCng\s*\(|\bnew\s+ECDsaOpenSsl\s*\(/g;
 const RE_CS_ECDH = /\bECDiffieHellman\.Create\s*\(|\bnew\s+ECDiffieHellmanCng\s*\(|\bnew\s+ECDiffieHellmanOpenSsl\s*\(/g;
 const RE_CS_DSA = /\bDSA\.Create\s*\(|\bnew\s+DSACryptoServiceProvider\s*\(|\bnew\s+DSACng\s*\(/g;
+// Insecure TLS configuration (.NET). Mirrors source.ts's tlsDetector split of a
+// cert-verification-disabled rule (tls-reject-unauthorized) and a legacy-version
+// rule (tls-legacy-version) for the equivalent C# idioms:
+//   - DangerousAcceptAnyServerCertificateValidator / a custom
+//     ServerCertificateCustomValidationCallback → accepts any cert (MITM).
+//   - SslProtocols.Ssl3 / .Tls / .Tls11 → deprecated SSL 3.0 / TLS 1.0 / 1.1.
+// `SslProtocols.Tls` (no suffix) is the legacy TLS 1.0 constant; `Tls12`/`Tls13`
+// are excluded by the trailing \b (the following digit is a word char).
+const RE_CS_TLS_CERT_VALIDATION = /\bDangerousAcceptAnyServerCertificateValidator\b|ServerCertificateCustomValidationCallback\s*=/g;
+const RE_CS_TLS_LEGACY_VERSION = /\bSslProtocols\.(?:Tls|Tls11|Ssl3)\b/g;
+// Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string
+// alg token ("RS256") is caught by the language-agnostic jwt-jose detector, but
+// Microsoft.IdentityModel passes the alg as an IDENTIFIER, not a string literal:
+// SecurityAlgorithms.RsaSha256 / SecurityAlgorithms.EcdsaSha256.
+const RE_CS_JWT_ALG = /\bSecurityAlgorithms\.(?:Rsa|Ecdsa)Sha(?:256|384|512)\b/g;
+// BouncyCastle (Org.BouncyCastle) modern-curve and finite-field DH primitives,
+// which System.Security.Cryptography does not expose directly. Each regex is
+// anchored to the distinctive BouncyCastle class names for one family so it
+// can't misfire on unrelated identifiers:
+//   - Ed25519KeyPairGenerator / Ed25519Signer / Ed25519PrivateKeyParameters → EdDSA
+//   - X25519KeyPairGenerator / X25519Agreement / X25519PrivateKeyParameters → X25519
+//   - X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters → X448
+//   - DHParametersGenerator / DHBasicAgreement / DH(Basic)KeyPairGenerator / DHParameters → DH
+// The trailing \b keeps each token whole (e.g. Ed25519KeyGenerationParameters,
+// X25519PublicKeyParameters and DHKeyGenerationParameters are NOT matched).
+const RE_CS_BC_EDDSA = /\bEd25519(?:KeyPairGenerator|Signer|PrivateKeyParameters)\b/g;
+const RE_CS_BC_X25519 = /\bX25519(?:KeyPairGenerator|Agreement|PrivateKeyParameters)\b/g;
+const RE_CS_BC_X448 = /\bX448(?:KeyPairGenerator|Agreement|PrivateKeyParameters)\b/g;
+const RE_CS_BC_DH = /\bDH(?:ParametersGenerator|BasicAgreement|BasicKeyPairGenerator|KeyPairGenerator|Parameters)\b/g;
 const RULE_CS_RSA = {
     id: "csharp-rsa",
     title: "C# RSA key/usage",
@@ -54,13 +83,111 @@ const RULE_CS_DSA = {
     message: "Classical DSA (.NET) is deprecated and forgeable by a quantum attacker.",
     remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
 };
+const RULE_CS_TLS_CERT = {
+    id: "csharp-tls-cert-validation",
+    title: "C# TLS certificate verification disabled",
+    description: "DangerousAcceptAnyServerCertificateValidator / ServerCertificateCustomValidationCallback override",
+    category: "tls",
+    severity: "high",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_CERT_VALIDATION,
+    message: "Accepting any server certificate disables TLS certificate verification (MITM risk).",
+    remediation: "Remove the custom validator and verify certificates properly; prefer PQC-hybrid key exchange.",
+};
+const RULE_CS_TLS_LEGACY = {
+    id: "csharp-tls-legacy-version",
+    title: "C# legacy TLS/SSL version pinned",
+    description: "SslProtocols pinned to Ssl3 / TLS 1.0 / TLS 1.1",
+    category: "tls",
+    severity: "medium",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_WEAK_STRENGTH,
+    message: "SSL 3.0 / TLS 1.0 / TLS 1.1 are deprecated and insecure; require TLS 1.2+ (prefer 1.3).",
+    remediation: "Use SslProtocols.Tls13 (or Tls12) and prefer PQC-hybrid key exchange.",
+};
+const RULE_CS_JWT_ALG = {
+    id: "csharp-jwt-alg",
+    title: "C# identifier-form JWT/JOSE algorithm",
+    description: "Microsoft.IdentityModel SecurityAlgorithms.RsaSha* / EcdsaSha*",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "unknown",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "A classical JWT/JOSE signature algorithm (.NET, identifier form) is used, forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms",
+};
+const RULE_CS_BC_EDDSA = {
+    id: "csharp-bouncycastle-eddsa",
+    title: "C# Ed25519 signature (BouncyCastle)",
+    description: "Org.BouncyCastle Ed25519KeyPairGenerator / Ed25519Signer / Ed25519PrivateKeyParameters",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical Ed25519 signing (BouncyCastle) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_CS_BC_X25519 = {
+    id: "csharp-bouncycastle-x25519",
+    title: "C# X25519 key agreement (BouncyCastle)",
+    description: "Org.BouncyCastle X25519KeyPairGenerator / X25519Agreement / X25519PrivateKeyParameters",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "X25519 Diffie-Hellman key agreement (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_CS_BC_X448 = {
+    id: "csharp-bouncycastle-x448",
+    title: "C# X448 key agreement (BouncyCastle)",
+    description: "Org.BouncyCastle X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "X448",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "X448 Diffie-Hellman key agreement (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_CS_BC_DH = {
+    id: "csharp-bouncycastle-dh",
+    title: "C# finite-field Diffie-Hellman (BouncyCastle)",
+    description: "Org.BouncyCastle DHParametersGenerator / DHBasicAgreement / DHKeyPairGenerator / DHParameters",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Finite-field Diffie-Hellman (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
 /** Detects classical asymmetric crypto in C# (System.Security.Cryptography). */
 export const csharpDetector = {
     id: "csharp-crypto",
-    description: "Classical asymmetric crypto in C#/.NET (System.Security.Cryptography)",
+    description: "Classical asymmetric crypto (System.Security.Cryptography) and insecure TLS config in C#/.NET",
     scope: "source",
     language: "csharp",
-    rules: [RULE_CS_RSA, RULE_CS_ECDSA, RULE_CS_ECDH, RULE_CS_DSA],
+    rules: [
+        RULE_CS_RSA,
+        RULE_CS_ECDSA,
+        RULE_CS_ECDH,
+        RULE_CS_DSA,
+        RULE_CS_TLS_CERT,
+        RULE_CS_TLS_LEGACY,
+        RULE_CS_JWT_ALG,
+        RULE_CS_BC_EDDSA,
+        RULE_CS_BC_X25519,
+        RULE_CS_BC_X448,
+        RULE_CS_BC_DH,
+    ],
     appliesTo: (f) => hasExtension(f, CSHARP_EXTENSIONS),
     detect({ file, content }) {
         const findings = [];
@@ -70,6 +197,17 @@ export const csharpDetector = {
         add(RE_CS_ECDH, RULE_CS_ECDH);
         add(RE_CS_RSA, RULE_CS_RSA);
         add(RE_CS_DSA, RULE_CS_DSA);
+        // Insecure TLS configuration (disjoint from the crypto factories above).
+        add(RE_CS_TLS_CERT_VALIDATION, RULE_CS_TLS_CERT);
+        add(RE_CS_TLS_LEGACY_VERSION, RULE_CS_TLS_LEGACY);
+        // Identifier-form JWT/JOSE signature algorithms (Microsoft.IdentityModel).
+        add(RE_CS_JWT_ALG, RULE_CS_JWT_ALG);
+        // BouncyCastle (Org.BouncyCastle) curve / finite-field DH primitives that
+        // System.Security.Cryptography does not expose directly.
+        add(RE_CS_BC_EDDSA, RULE_CS_BC_EDDSA);
+        add(RE_CS_BC_X25519, RULE_CS_BC_X25519);
+        add(RE_CS_BC_X448, RULE_CS_BC_X448);
+        add(RE_CS_BC_DH, RULE_CS_BC_DH);
         return findings;
     },
 };

package/dist/detectors/csharp.js.map

@@ -1 +1 @@
-{"version":3,"file":"csharp.js","sourceRoot":"","sources":["../../src/detectors/csharp.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,SAAS,GACb,uGAAuG,CAAC;AAC1G,MAAM,WAAW,GAAG,uEAAuE,CAAC;AAC5F,MAAM,UAAU,GACd,qGAAqG,CAAC;AACxG,MAAM,SAAS,GAAG,+EAA+E,CAAC;AAElG,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;CACxF,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,sDAAsD;IACnE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oEAAoE;IAC7E,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,0EAA0E;IACvF,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iGAAiG;CACpG,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,oEAAoE;IACjF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;IAClF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,uEAAuE;IACpF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,gEAAgE;QAChE,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"csharp.js","sourceRoot":"","sources":["../../src/detectors/csharp.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtF,MAAM,SAAS,GACb,uGAAuG,CAAC;AAC1G,MAAM,WAAW,GAAG,uEAAuE,CAAC;AAC5F,MAAM,UAAU,GACd,qGAAqG,CAAC;AACxG,MAAM,SAAS,GAAG,+EAA+E,CAAC;AAClG,gFAAgF;AAChF,iFAAiF;AACjF,0DAA0D;AAC1D,8DAA8D;AAC9D,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,wEAAwE;AACxE,MAAM,yBAAyB,GAC7B,iGAAiG,CAAC;AACpG,MAAM,wBAAwB,GAAG,uCAAuC,CAAC;AACzE,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,iEAAiE;AACjE,MAAM,aAAa,GAAG,0DAA0D,CAAC;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,0CAA0C;AAC1C,oFAAoF;AACpF,qFAAqF;AACrF,6EAA6E;AAC7E,+FAA+F;AAC/F,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,cAAc,GAAG,8DAA8D,CAAC;AACtF,MAAM,eAAe,GAAG,gEAAgE,CAAC;AACzF,MAAM,aAAa,GAAG,8DAA8D,CAAC;AACrF,MAAM,WAAW,GACf,iGAAiG,CAAC;AAEpG,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;CACxF,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,sDAAsD;IACnE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oEAAoE;IAC7E,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,0EAA0E;IACvF,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iGAAiG;CACpG,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,oEAAoE;IACjF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;IAClF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,4BAA4B;IAChC,KAAK,EAAE,0CAA0C;IACjD,WAAW,EACT,mGAAmG;IACrG,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EAAE,qFAAqF;IAC9F,WAAW,EACT,+FAA+F;CAClG,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yFAAyF;IAC3F,WAAW,EAAE,uEAAuE;CACrF,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,gEAAgE;IAC7E,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4GAA4G;IAC9G,WAAW,EAAE,2DAA2D;CACzE,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EACT,wFAAwF;IAC1F,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;IACvF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,4BAA4B;IAChC,KAAK,EAAE,wCAAwC;IAC/C,WAAW,EACT,wFAAwF;IAC1F,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+GAA+G;CAClH,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,0BAA0B;IAC9B,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,kFAAkF;IAC/F,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6GAA6G;CAChH,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,wBAAwB;IAC5B,KAAK,EAAE,+CAA+C;IACtD,WAAW,EACT,+FAA+F;IACjG,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,uGAAuG;CAC1G,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,EAAE,EAAE,eAAe;IACnB,WAAW,EACT,+FAA+F;IACjG,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE;QACL,WAAW;QACX,aAAa;QACb,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,kBAAkB;QAClB,eAAe;QACf,gBAAgB;QAChB,iBAAiB;QACjB,eAAe;QACf,aAAa;KACd;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,gEAAgE;QAChE,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,yEAAyE;QACzE,GAAG,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;QACjD,GAAG,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC;QAClD,2EAA2E;QAC3E,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,0EAA0E;QAC1E,yDAAyD;QACzD,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source-code detector for classical asymmetric cryptography in C# / .NET\n * (`System.Security.Cryptography`). Same lexical strategy as the other packs.\n * .NET exposes each algorithm through a factory (`RSA.Create()`,\n * `ECDsa.Create()`, `ECDiffieHellman.Create()`) or a concrete CSP/CNG class\n * (`RSACryptoServiceProvider`, `ECDsaCng`, …), all of which are precise signals.\n *\n * HNDL: RSA (keygen/encryption) and (EC)DH key agreement are harvest-now-\n * decrypt-later exposed (hndl:true); ECDSA/DSA signatures are hndl:false but\n * forgeable by a quantum attacker.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { CSHARP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from \"../cwe.js\";\n\nconst RE_CS_RSA =\n  /\\bRSA\\.Create\\s*\\(|\\bnew\\s+RSACryptoServiceProvider\\s*\\(|\\bnew\\s+RSACng\\s*\\(|\\bnew\\s+RSAOpenSsl\\s*\\(/g;\nconst RE_CS_ECDSA = /\\bECDsa\\.Create\\s*\\(|\\bnew\\s+ECDsaCng\\s*\\(|\\bnew\\s+ECDsaOpenSsl\\s*\\(/g;\nconst RE_CS_ECDH =\n  /\\bECDiffieHellman\\.Create\\s*\\(|\\bnew\\s+ECDiffieHellmanCng\\s*\\(|\\bnew\\s+ECDiffieHellmanOpenSsl\\s*\\(/g;\nconst RE_CS_DSA = /\\bDSA\\.Create\\s*\\(|\\bnew\\s+DSACryptoServiceProvider\\s*\\(|\\bnew\\s+DSACng\\s*\\(/g;\n// Insecure TLS configuration (.NET). Mirrors source.ts's tlsDetector split of a\n// cert-verification-disabled rule (tls-reject-unauthorized) and a legacy-version\n// rule (tls-legacy-version) for the equivalent C# idioms:\n//   - DangerousAcceptAnyServerCertificateValidator / a custom\n//     ServerCertificateCustomValidationCallback → accepts any cert (MITM).\n//   - SslProtocols.Ssl3 / .Tls / .Tls11 → deprecated SSL 3.0 / TLS 1.0 / 1.1.\n// `SslProtocols.Tls` (no suffix) is the legacy TLS 1.0 constant; `Tls12`/`Tls13`\n// are excluded by the trailing \\b (the following digit is a word char).\nconst RE_CS_TLS_CERT_VALIDATION =\n  /\\bDangerousAcceptAnyServerCertificateValidator\\b|ServerCertificateCustomValidationCallback\\s*=/g;\nconst RE_CS_TLS_LEGACY_VERSION = /\\bSslProtocols\\.(?:Tls|Tls11|Ssl3)\\b/g;\n// Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string\n// alg token (\"RS256\") is caught by the language-agnostic jwt-jose detector, but\n// Microsoft.IdentityModel passes the alg as an IDENTIFIER, not a string literal:\n// SecurityAlgorithms.RsaSha256 / SecurityAlgorithms.EcdsaSha256.\nconst RE_CS_JWT_ALG = /\\bSecurityAlgorithms\\.(?:Rsa|Ecdsa)Sha(?:256|384|512)\\b/g;\n// BouncyCastle (Org.BouncyCastle) modern-curve and finite-field DH primitives,\n// which System.Security.Cryptography does not expose directly. Each regex is\n// anchored to the distinctive BouncyCastle class names for one family so it\n// can't misfire on unrelated identifiers:\n//   - Ed25519KeyPairGenerator / Ed25519Signer / Ed25519PrivateKeyParameters → EdDSA\n//   - X25519KeyPairGenerator / X25519Agreement / X25519PrivateKeyParameters → X25519\n//   - X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters → X448\n//   - DHParametersGenerator / DHBasicAgreement / DH(Basic)KeyPairGenerator / DHParameters → DH\n// The trailing \\b keeps each token whole (e.g. Ed25519KeyGenerationParameters,\n// X25519PublicKeyParameters and DHKeyGenerationParameters are NOT matched).\nconst RE_CS_BC_EDDSA = /\\bEd25519(?:KeyPairGenerator|Signer|PrivateKeyParameters)\\b/g;\nconst RE_CS_BC_X25519 = /\\bX25519(?:KeyPairGenerator|Agreement|PrivateKeyParameters)\\b/g;\nconst RE_CS_BC_X448 = /\\bX448(?:KeyPairGenerator|Agreement|PrivateKeyParameters)\\b/g;\nconst RE_CS_BC_DH =\n  /\\bDH(?:ParametersGenerator|BasicAgreement|BasicKeyPairGenerator|KeyPairGenerator|Parameters)\\b/g;\n\nconst RULE_CS_RSA: RuleMeta = {\n  id: \"csharp-rsa\",\n  title: \"C# RSA key/usage\",\n  description: \"System.Security.Cryptography RSA.Create / RSACryptoServiceProvider / RSACng\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical RSA (.NET) is not quantum-safe and RSA encryption is HNDL-exposed.\",\n};\nconst RULE_CS_ECDSA: RuleMeta = {\n  id: \"csharp-ecdsa\",\n  title: \"C# ECDSA signature\",\n  description: \"System.Security.Cryptography ECDsa.Create / ECDsaCng\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA signing (.NET) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_CS_ECDH: RuleMeta = {\n  id: \"csharp-ecdh\",\n  title: \"C# ECDH key agreement\",\n  description: \"System.Security.Cryptography ECDiffieHellman.Create / ECDiffieHellmanCng\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman (.NET) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_CS_DSA: RuleMeta = {\n  id: \"csharp-dsa\",\n  title: \"C# DSA key/signature\",\n  description: \"System.Security.Cryptography DSA.Create / DSACryptoServiceProvider\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical DSA (.NET) is deprecated and forgeable by a quantum attacker.\",\n  remediation: \"Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_CS_TLS_CERT: RuleMeta = {\n  id: \"csharp-tls-cert-validation\",\n  title: \"C# TLS certificate verification disabled\",\n  description:\n    \"DangerousAcceptAnyServerCertificateValidator / ServerCertificateCustomValidationCallback override\",\n  category: \"tls\",\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message: \"Accepting any server certificate disables TLS certificate verification (MITM risk).\",\n  remediation:\n    \"Remove the custom validator and verify certificates properly; prefer PQC-hybrid key exchange.\",\n};\nconst RULE_CS_TLS_LEGACY: RuleMeta = {\n  id: \"csharp-tls-legacy-version\",\n  title: \"C# legacy TLS/SSL version pinned\",\n  description: \"SslProtocols pinned to Ssl3 / TLS 1.0 / TLS 1.1\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message:\n    \"SSL 3.0 / TLS 1.0 / TLS 1.1 are deprecated and insecure; require TLS 1.2+ (prefer 1.3).\",\n  remediation: \"Use SslProtocols.Tls13 (or Tls12) and prefer PQC-hybrid key exchange.\",\n};\nconst RULE_CS_JWT_ALG: RuleMeta = {\n  id: \"csharp-jwt-alg\",\n  title: \"C# identifier-form JWT/JOSE algorithm\",\n  description: \"Microsoft.IdentityModel SecurityAlgorithms.RsaSha* / EcdsaSha*\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"A classical JWT/JOSE signature algorithm (.NET, identifier form) is used, forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms\",\n};\nconst RULE_CS_BC_EDDSA: RuleMeta = {\n  id: \"csharp-bouncycastle-eddsa\",\n  title: \"C# Ed25519 signature (BouncyCastle)\",\n  description:\n    \"Org.BouncyCastle Ed25519KeyPairGenerator / Ed25519Signer / Ed25519PrivateKeyParameters\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical Ed25519 signing (BouncyCastle) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_CS_BC_X25519: RuleMeta = {\n  id: \"csharp-bouncycastle-x25519\",\n  title: \"C# X25519 key agreement (BouncyCastle)\",\n  description:\n    \"Org.BouncyCastle X25519KeyPairGenerator / X25519Agreement / X25519PrivateKeyParameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X25519 Diffie-Hellman key agreement (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_CS_BC_X448: RuleMeta = {\n  id: \"csharp-bouncycastle-x448\",\n  title: \"C# X448 key agreement (BouncyCastle)\",\n  description: \"Org.BouncyCastle X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"X448\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X448 Diffie-Hellman key agreement (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_CS_BC_DH: RuleMeta = {\n  id: \"csharp-bouncycastle-dh\",\n  title: \"C# finite-field Diffie-Hellman (BouncyCastle)\",\n  description:\n    \"Org.BouncyCastle DHParametersGenerator / DHBasicAgreement / DHKeyPairGenerator / DHParameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\n\n/** Detects classical asymmetric crypto in C# (System.Security.Cryptography). */\nexport const csharpDetector: Detector = {\n  id: \"csharp-crypto\",\n  description:\n    \"Classical asymmetric crypto (System.Security.Cryptography) and insecure TLS config in C#/.NET\",\n  scope: \"source\",\n  language: \"csharp\",\n  rules: [\n    RULE_CS_RSA,\n    RULE_CS_ECDSA,\n    RULE_CS_ECDH,\n    RULE_CS_DSA,\n    RULE_CS_TLS_CERT,\n    RULE_CS_TLS_LEGACY,\n    RULE_CS_JWT_ALG,\n    RULE_CS_BC_EDDSA,\n    RULE_CS_BC_X25519,\n    RULE_CS_BC_X448,\n    RULE_CS_BC_DH,\n  ],\n  appliesTo: (f) => hasExtension(f, CSHARP_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    // ECDSA / ECDH before RSA/DSA so the specific EC factories win.\n    add(RE_CS_ECDSA, RULE_CS_ECDSA);\n    add(RE_CS_ECDH, RULE_CS_ECDH);\n    add(RE_CS_RSA, RULE_CS_RSA);\n    add(RE_CS_DSA, RULE_CS_DSA);\n    // Insecure TLS configuration (disjoint from the crypto factories above).\n    add(RE_CS_TLS_CERT_VALIDATION, RULE_CS_TLS_CERT);\n    add(RE_CS_TLS_LEGACY_VERSION, RULE_CS_TLS_LEGACY);\n    // Identifier-form JWT/JOSE signature algorithms (Microsoft.IdentityModel).\n    add(RE_CS_JWT_ALG, RULE_CS_JWT_ALG);\n    // BouncyCastle (Org.BouncyCastle) curve / finite-field DH primitives that\n    // System.Security.Cryptography does not expose directly.\n    add(RE_CS_BC_EDDSA, RULE_CS_BC_EDDSA);\n    add(RE_CS_BC_X25519, RULE_CS_BC_X25519);\n    add(RE_CS_BC_X448, RULE_CS_BC_X448);\n    add(RE_CS_BC_DH, RULE_CS_BC_DH);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/go.d.ts

@@ -6,11 +6,13 @@
  * `ecdsa.SignASN1`, `ecdh.X25519`, …) are precise, low-false-positive signals.
  *
  * Covered:
- *   - crypto/rsa   — GenerateKey, EncryptOAEP/PKCS1v15, SignPKCS1v15/PSS
- *   - crypto/ecdsa — GenerateKey, Sign/SignASN1
+ *   - crypto/rsa   — GenerateKey, EncryptOAEP/PKCS1v15, SignPKCS1v15/PSS, DecryptOAEP, VerifyPKCS1v15/PSS
+ *   - crypto/ecdsa — GenerateKey, Sign/SignASN1, Verify/VerifyASN1
  *   - crypto/ecdh  — P256/P384/P521/X25519 curve construction (key agreement)
- *   - crypto/ed25519 — GenerateKey, Sign
+ *   - crypto/elliptic — GenerateKey / ScalarMult (classic pre-1.20 ECDH)
+ *   - crypto/ed25519 — GenerateKey, Sign, Verify
  *   - crypto/dsa   — GenerateKey, GenerateParameters (deprecated)
+ *   - crypto/tls   — InsecureSkipVerify, legacy MinVersion (transport config hygiene)
  *
  * HNDL policy mirrors the other detectors: KEM / key agreement (RSA encryption,
  * ECDH) is harvest-now-decrypt-later exposed (hndl:true); signatures (RSA-sign,

package/dist/detectors/go.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../src/detectors/go.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA8G/D,oFAAoF;AACpF,eAAO,MAAM,UAAU,EAAE,QAkCxB,CAAC"}
+{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../src/detectors/go.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAqR/D,oFAAoF;AACpF,eAAO,MAAM,UAAU,EAAE,QAoExB,CAAC"}

package/dist/detectors/go.js

@@ -1,5 +1,5 @@
 import { GO_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 /* -------------------------------------------------------------------------- */
 /* Precompiled regexes (module scope)                                         */
 /* -------------------------------------------------------------------------- */
@@ -7,9 +7,36 @@ const RE_GO_RSA_KEYGEN = /\brsa\.GenerateKey\s*\(|\brsa\.GenerateMultiPrimeKey\s
 const RE_GO_RSA_ENCRYPT = /\brsa\.EncryptOAEP\s*\(|\brsa\.EncryptPKCS1v15\s*\(/g;
 const RE_GO_RSA_SIGN = /\brsa\.SignPKCS1v15\s*\(|\brsa\.SignPSS\s*\(/g;
 const RE_GO_ECDSA = /\becdsa\.GenerateKey\s*\(|\becdsa\.SignASN1\s*\(|\becdsa\.Sign\s*\(/g;
-const RE_GO_ECDH = /\becdh\.(?:P256|P384|P521|X25519)\s*\(/g;
+const RE_GO_ECDH = /\becdh\.(?:P256|P384|P521)\s*\(/g;
+// X25519 gets its own family (algorithm "X25519", lower severity) to match how
+// every other pack classifies it — Go was the lone site reporting it as ECDH/high
+// (audit F9). Still key-exchange + hndl:true.
+const RE_GO_X25519 = /\becdh\.X25519\s*\(/g;
 const RE_GO_ED25519 = /\bed25519\.GenerateKey\s*\(|\bed25519\.Sign\s*\(/g;
 const RE_GO_DSA = /\bdsa\.GenerateKey\s*\(|\bdsa\.GenerateParameters\s*\(/g;
+// Verify / decrypt call sites — the inverse operations the Sign/Encrypt/
+// GenerateKey rules above miss today (audit F4/F6). Deliberately disjoint from
+// those rules to avoid double-counting: DecryptOAEP≠EncryptOAEP, Verify*≠Sign*.
+const RE_GO_RSA_DECRYPT = /\brsa\.DecryptOAEP\s*\(/g;
+const RE_GO_RSA_VERIFY = /\brsa\.VerifyPKCS1v15\s*\(|\brsa\.VerifyPSS\s*\(/g;
+const RE_GO_ECDSA_VERIFY = /\becdsa\.Verify(?:ASN1)?\s*\(/g;
+const RE_GO_ED25519_VERIFY = /\bed25519\.Verify\s*\(/g;
+// Classic pre-1.20 elliptic-curve key agreement (crypto/elliptic), superseded by
+// crypto/ecdh but still widespread. GenerateKey + ScalarMult are the low-level
+// ECDH building blocks the crypto/ecdh rule does not see. `.ScalarMult(` is an
+// unqualified method call, so this rule carries medium confidence.
+const RE_GO_ECDH_CLASSIC = /\belliptic\.GenerateKey\s*\(|\.ScalarMult\s*\(/g;
+// Go TLS misconfiguration (crypto/tls). Mirrors the JS tlsDetector: disabled
+// certificate verification and a legacy TLS/SSL version floor.
+const RE_GO_TLS_SKIP_VERIFY = /InsecureSkipVerify:\s*true/g;
+const RE_GO_TLS_LEGACY_VERSION = /MinVersion:\s*tls\.Version(?:TLS1[01]|SSL30)/g;
+// Identifier-form golang-jwt signing methods (audit gap: the quoted "RS256" alg
+// token is caught by the language-agnostic jwt-jose detector, but golang-jwt
+// passes the alg as an EXPORTED IDENTIFIER — `jwt.SigningMethodRS256`,
+// `jwt.SigningMethodES256`, `jwt.SigningMethodEdDSA` — which the string rule
+// misses. RS*/PS* → RSA, ES* → ECDSA, EdDSA → EdDSA. The `\b`s keep it precise:
+// HS* HMAC methods and longer look-alikes (`SigningMethodRS2560`) do not match.
+const RE_GO_JWT_SIGNINGMETHOD = /\bSigningMethod(RS|PS|ES)(?:256|384|512)\b|\bSigningMethodEdDSA\b/g;
 /* -------------------------------------------------------------------------- */
 /* Rule catalog                                                               */
 /* -------------------------------------------------------------------------- */
@@ -66,7 +93,7 @@ const RULE_GO_ECDSA = {
 const RULE_GO_ECDH = {
     id: "go-ecdh",
     title: "Go ECDH key exchange",
-    description: "crypto/ecdh P256/P384/P521/X25519 key agreement",
+    description: "crypto/ecdh P256/P384/P521 key agreement",
     category: "key-exchange",
     severity: "high",
     confidence: "high",
@@ -75,6 +102,18 @@ const RULE_GO_ECDH = {
     cwe: CWE_BROKEN_CRYPTO,
     message: "Elliptic-curve Diffie-Hellman (Go crypto/ecdh) is broken by Shor's algorithm (harvest-now-decrypt-later).",
 };
+const RULE_GO_X25519 = {
+    id: "go-x25519",
+    title: "Go X25519 key exchange",
+    description: "crypto/ecdh X25519 key agreement",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "X25519 (Go crypto/ecdh) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
 const RULE_GO_ED25519 = {
     id: "go-ed25519",
     title: "Go Ed25519 signature",
@@ -100,6 +139,124 @@ const RULE_GO_DSA = {
     message: "Classical DSA (Go) is deprecated and forgeable by a quantum attacker.",
     remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
 };
+const RULE_GO_RSA_DECRYPT = {
+    id: "go-rsa-decrypt",
+    title: "Go RSA public-key decryption",
+    description: "crypto/rsa DecryptOAEP",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "RSA public-key decryption (Go) recovers data protected by a classical KEM — harvest-now-decrypt-later exposed.",
+};
+const RULE_GO_RSA_VERIFY = {
+    id: "go-rsa-verify",
+    title: "Go RSA signature verification",
+    description: "crypto/rsa VerifyPKCS1v15 / VerifyPSS",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Verifies classical RSA signatures (Go), which are forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_GO_ECDSA_VERIFY = {
+    id: "go-ecdsa-verify",
+    title: "Go ECDSA signature verification",
+    description: "crypto/ecdsa Verify / VerifyASN1",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Verifies classical ECDSA signatures (Go), which are forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_GO_ED25519_VERIFY = {
+    id: "go-ed25519-verify",
+    title: "Go Ed25519 signature verification",
+    description: "crypto/ed25519 Verify",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Verifies Ed25519 signatures (Go) — modern but still classical and quantum-forgeable.",
+};
+const RULE_GO_ECDH_CLASSIC = {
+    id: "go-ecdh-classic",
+    title: "Go classic EC key agreement (crypto/elliptic)",
+    description: "crypto/elliptic GenerateKey / ScalarMult (pre-1.20 ECDH)",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "medium",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Low-level elliptic-curve key agreement (Go crypto/elliptic) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_GO_TLS_SKIP_VERIFY = {
+    id: "go-tls-insecure-skip-verify",
+    title: "Go TLS certificate verification disabled",
+    description: "crypto/tls Config InsecureSkipVerify: true",
+    category: "tls",
+    severity: "high",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_CERT_VALIDATION,
+    message: "InsecureSkipVerify:true disables TLS certificate verification (Go) — MITM risk.",
+    remediation: "Remove InsecureSkipVerify:true; verify certificates properly.",
+};
+const RULE_GO_TLS_LEGACY_VERSION = {
+    id: "go-tls-legacy-version",
+    title: "Go legacy TLS version pinned",
+    description: "crypto/tls MinVersion pinned to TLS 1.0/1.1 or SSL 3.0",
+    category: "tls",
+    severity: "medium",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_WEAK_STRENGTH,
+    message: "MinVersion pins a deprecated TLS/SSL floor (TLS 1.0/1.1 or SSL 3.0) in Go; require TLS 1.3.",
+    remediation: "Set MinVersion: tls.VersionTLS13 and prefer PQC-hybrid key exchange.",
+};
+const RULE_GO_JWT_SIGNINGMETHOD = {
+    id: "go-jwt-signingmethod",
+    title: "Go identifier-form JWT signing method",
+    description: "golang-jwt SigningMethodRS/PS/ES* / SigningMethodEdDSA identifier",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "unknown", // representative umbrella; refined per-match (RSA/ECDSA/EdDSA)
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "A classical JWT signature algorithm (Go golang-jwt, identifier form) is used, forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms",
+};
+// The x509 PEM/DER key + certificate layer: parsing/marshalling classical RSA,
+// EC and PKIX key material and X.509 certificates. This is the "handles classical
+// keys" surface the Sign/Verify/GenerateKey rules miss — a key-loading utility
+// (`x509.ParsePKCS8PrivateKey`) touches quantum-vulnerable material without ever
+// naming rsa/ecdsa. Family is ambiguous at the parse site, so `unknown`.
+const RE_GO_X509_PARSE = /\bx509\.(?:ParsePKCS1PrivateKey|ParsePKCS8PrivateKey|ParsePKIXPublicKey|ParseECPrivateKey|ParsePKCS1PublicKey|MarshalPKCS1PrivateKey|MarshalPKCS8PrivateKey|MarshalPKIXPublicKey|MarshalECPrivateKey|ParseCertificates?|ParseCertificateRequest|CreateCertificate|CreateCertificateRequest)\b/g;
+const RULE_GO_X509_PARSE = {
+    id: "go-x509-parse",
+    title: "Go x509 classical key/certificate handling",
+    description: "x509.Parse*/Marshal*/Create* for RSA/EC/PKIX keys and X.509 certificates",
+    category: "certificate",
+    severity: "medium",
+    confidence: "medium",
+    algorithm: "unknown",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "This code parses/marshals classical asymmetric key or X.509 certificate material (x509.*), a quantum forgery/harvest surface.",
+    remediation: "Inventory the key/cert types handled here; plan PQC (ML-DSA) certificate + key migration.",
+};
 /** Detects classical asymmetric crypto in Go source (crypto/* standard library). */
 export const goDetector = {
     id: "go-crypto",
@@ -112,8 +269,18 @@ export const goDetector = {
         RULE_GO_RSA_SIGN,
         RULE_GO_ECDSA,
         RULE_GO_ECDH,
+        RULE_GO_X25519,
         RULE_GO_ED25519,
         RULE_GO_DSA,
+        RULE_GO_RSA_DECRYPT,
+        RULE_GO_RSA_VERIFY,
+        RULE_GO_ECDSA_VERIFY,
+        RULE_GO_ED25519_VERIFY,
+        RULE_GO_ECDH_CLASSIC,
+        RULE_GO_TLS_SKIP_VERIFY,
+        RULE_GO_TLS_LEGACY_VERSION,
+        RULE_GO_JWT_SIGNINGMETHOD,
+        RULE_GO_X509_PARSE,
     ],
     appliesTo: (f) => hasExtension(f, GO_EXTENSIONS),
     detect({ file, content }) {
@@ -124,8 +291,25 @@ export const goDetector = {
         add(RE_GO_RSA_SIGN, RULE_GO_RSA_SIGN);
         add(RE_GO_ECDSA, RULE_GO_ECDSA);
         add(RE_GO_ECDH, RULE_GO_ECDH);
+        add(RE_GO_X25519, RULE_GO_X25519);
         add(RE_GO_ED25519, RULE_GO_ED25519);
         add(RE_GO_DSA, RULE_GO_DSA);
+        add(RE_GO_RSA_DECRYPT, RULE_GO_RSA_DECRYPT);
+        add(RE_GO_RSA_VERIFY, RULE_GO_RSA_VERIFY);
+        add(RE_GO_ECDSA_VERIFY, RULE_GO_ECDSA_VERIFY);
+        add(RE_GO_ED25519_VERIFY, RULE_GO_ED25519_VERIFY);
+        add(RE_GO_ECDH_CLASSIC, RULE_GO_ECDH_CLASSIC);
+        add(RE_GO_TLS_SKIP_VERIFY, RULE_GO_TLS_SKIP_VERIFY);
+        add(RE_GO_TLS_LEGACY_VERSION, RULE_GO_TLS_LEGACY_VERSION);
+        add(RE_GO_X509_PARSE, RULE_GO_X509_PARSE);
+        // Identifier-form golang-jwt signing methods (jwt.SigningMethodRS256, …).
+        // Refine the umbrella "unknown" algorithm per match: m[1] is the RS/PS/ES
+        // prefix (RS/PS → RSA, ES → ECDSA); when it is undefined the EdDSA branch
+        // matched, so the family is EdDSA.
+        eachMatch(RE_GO_JWT_SIGNINGMETHOD, content, (m) => {
+            const algorithm = m[1] === "ES" ? "ECDSA" : m[1] ? "RSA" : "EdDSA";
+            findings.push(findingFromRule(RULE_GO_JWT_SIGNINGMETHOD, { file, content, index: m.index, matchLength: m[0].length }, { algorithm }));
+        });
         return findings;
     },
 };

package/dist/detectors/go.js.map

@@ -1 +1 @@
-{"version":3,"file":"go.js","sourceRoot":"","sources":["../../src/detectors/go.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AACtF,MAAM,iBAAiB,GAAG,sDAAsD,CAAC;AACjF,MAAM,cAAc,GAAG,+CAA+C,CAAC;AACvE,MAAM,WAAW,GAAG,sEAAsE,CAAC;AAC3F,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAC7D,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAC1E,MAAM,SAAS,GAAG,yDAAyD,CAAC;AAE5E,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,qEAAqE;CAC/E,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,wGAAwG;CAC3G,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gEAAgE;IACzE,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,4CAA4C;IACzD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,0DAA0D;IACnE,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2GAA2G;CAC9G,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gEAAgE;CAC1E,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,uEAAuE;IAChF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAa;IAClC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,2EAA2E;IACxF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE;QACL,kBAAkB;QAClB,mBAAmB;QACnB,gBAAgB;QAChB,aAAa;QACb,YAAY;QACZ,eAAe;QACf,WAAW;KACZ;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAE5B,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"go.js","sourceRoot":"","sources":["../../src/detectors/go.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AACtF,MAAM,iBAAiB,GAAG,sDAAsD,CAAC;AACjF,MAAM,cAAc,GAAG,+CAA+C,CAAC;AACvE,MAAM,WAAW,GAAG,sEAAsE,CAAC;AAC3F,MAAM,UAAU,GAAG,kCAAkC,CAAC;AACtD,+EAA+E;AAC/E,kFAAkF;AAClF,8CAA8C;AAC9C,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAC1E,MAAM,SAAS,GAAG,yDAAyD,CAAC;AAC5E,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AACrD,MAAM,gBAAgB,GAAG,mDAAmD,CAAC;AAC7E,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAC5D,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AACvD,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,mEAAmE;AACnE,MAAM,kBAAkB,GAAG,iDAAiD,CAAC;AAC7E,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AAC5D,MAAM,wBAAwB,GAAG,+CAA+C,CAAC;AACjF,gFAAgF;AAChF,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,MAAM,uBAAuB,GAC3B,oEAAoE,CAAC;AAEvE,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,qEAAqE;CAC/E,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,wGAAwG;CAC3G,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gEAAgE;IACzE,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,4CAA4C;IACzD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,0DAA0D;IACnE,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2GAA2G;CAC9G,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,kCAAkC;IAC/C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,kGAAkG;CACrG,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gEAAgE;CAC1E,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,uEAAuE;IAChF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,wBAAwB;IACrC,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gHAAgH;CACnH,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,uCAAuC;IACpD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oFAAoF;IAC7F,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,iCAAiC;IACxC,WAAW,EAAE,kCAAkC;IAC/C,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sFAAsF;IAC/F,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,mCAAmC;IAC1C,WAAW,EAAE,uBAAuB;IACpC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sFAAsF;CAChG,CAAC;AACF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,+CAA+C;IACtD,WAAW,EAAE,0DAA0D;IACvE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,wHAAwH;CAC3H,CAAC;AACF,MAAM,uBAAuB,GAAa;IACxC,EAAE,EAAE,6BAA6B;IACjC,KAAK,EAAE,0CAA0C;IACjD,WAAW,EAAE,4CAA4C;IACzD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EAAE,iFAAiF;IAC1F,WAAW,EAAE,+DAA+D;CAC7E,CAAC;AACF,MAAM,0BAA0B,GAAa;IAC3C,EAAE,EAAE,uBAAuB;IAC3B,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,wDAAwD;IACrE,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6FAA6F;IAC/F,WAAW,EAAE,sEAAsE;CACpF,CAAC;AACF,MAAM,yBAAyB,GAAa;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,mEAAmE;IAChF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS,EAAE,+DAA+D;IACrF,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gHAAgH;IAClH,WAAW,EAAE,2DAA2D;CACzE,CAAC;AAEF,+EAA+E;AAC/E,kFAAkF;AAClF,+EAA+E;AAC/E,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,gBAAgB,GACpB,gSAAgS,CAAC;AACnS,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,4CAA4C;IACnD,WAAW,EAAE,0EAA0E;IACvF,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+HAA+H;IACjI,WAAW,EACT,2FAA2F;CAC9F,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAa;IAClC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,2EAA2E;IACxF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE;QACL,kBAAkB;QAClB,mBAAmB;QACnB,gBAAgB;QAChB,aAAa;QACb,YAAY;QACZ,cAAc;QACd,eAAe;QACf,WAAW;QACX,mBAAmB;QACnB,kBAAkB;QAClB,oBAAoB;QACpB,sBAAsB;QACtB,oBAAoB;QACpB,uBAAuB;QACvB,0BAA0B;QAC1B,yBAAyB;QACzB,kBAAkB;KACnB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAClC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC9C,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;QAClD,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC9C,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;QACpD,GAAG,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,CAAC;QAC1D,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAE1C,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,mCAAmC;QACnC,SAAS,CAAC,uBAAuB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAChD,MAAM,SAAS,GAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YACzF,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,yBAAyB,EACzB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D,EAAE,SAAS,EAAE,CACd,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source-code detector for classical, non-quantum-safe asymmetric cryptography\n * in Go. Same lexical (regex-over-source) strategy as the JS/TS and Python\n * detectors. Go's crypto lives almost entirely in the highly-standardized\n * `crypto/*` standard library, so package-qualified calls (`rsa.GenerateKey`,\n * `ecdsa.SignASN1`, `ecdh.X25519`, …) are precise, low-false-positive signals.\n *\n * Covered:\n *   - crypto/rsa   — GenerateKey, EncryptOAEP/PKCS1v15, SignPKCS1v15/PSS, DecryptOAEP, VerifyPKCS1v15/PSS\n *   - crypto/ecdsa — GenerateKey, Sign/SignASN1, Verify/VerifyASN1\n *   - crypto/ecdh  — P256/P384/P521/X25519 curve construction (key agreement)\n *   - crypto/elliptic — GenerateKey / ScalarMult (classic pre-1.20 ECDH)\n *   - crypto/ed25519 — GenerateKey, Sign, Verify\n *   - crypto/dsa   — GenerateKey, GenerateParameters (deprecated)\n *   - crypto/tls   — InsecureSkipVerify, legacy MinVersion (transport config hygiene)\n *\n * HNDL policy mirrors the other detectors: KEM / key agreement (RSA encryption,\n * ECDH) is harvest-now-decrypt-later exposed (hndl:true); signatures (RSA-sign,\n * ECDSA, Ed25519, DSA) are hndl:false but still forgeable by a quantum attacker.\n * Unlike Node's ambiguous `'ec'` keygen, Go's `ecdsa.GenerateKey` is\n * signature-specific and Go's key agreement lives in the separate `crypto/ecdh`\n * package, so the two are classified precisely rather than conservatively merged.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { GO_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from \"../cwe.js\";\n\n/* -------------------------------------------------------------------------- */\n/* Precompiled regexes (module scope)                                         */\n/* -------------------------------------------------------------------------- */\n\nconst RE_GO_RSA_KEYGEN = /\\brsa\\.GenerateKey\\s*\\(|\\brsa\\.GenerateMultiPrimeKey\\s*\\(/g;\nconst RE_GO_RSA_ENCRYPT = /\\brsa\\.EncryptOAEP\\s*\\(|\\brsa\\.EncryptPKCS1v15\\s*\\(/g;\nconst RE_GO_RSA_SIGN = /\\brsa\\.SignPKCS1v15\\s*\\(|\\brsa\\.SignPSS\\s*\\(/g;\nconst RE_GO_ECDSA = /\\becdsa\\.GenerateKey\\s*\\(|\\becdsa\\.SignASN1\\s*\\(|\\becdsa\\.Sign\\s*\\(/g;\nconst RE_GO_ECDH = /\\becdh\\.(?:P256|P384|P521)\\s*\\(/g;\n// X25519 gets its own family (algorithm \"X25519\", lower severity) to match how\n// every other pack classifies it — Go was the lone site reporting it as ECDH/high\n// (audit F9). Still key-exchange + hndl:true.\nconst RE_GO_X25519 = /\\becdh\\.X25519\\s*\\(/g;\nconst RE_GO_ED25519 = /\\bed25519\\.GenerateKey\\s*\\(|\\bed25519\\.Sign\\s*\\(/g;\nconst RE_GO_DSA = /\\bdsa\\.GenerateKey\\s*\\(|\\bdsa\\.GenerateParameters\\s*\\(/g;\n// Verify / decrypt call sites — the inverse operations the Sign/Encrypt/\n// GenerateKey rules above miss today (audit F4/F6). Deliberately disjoint from\n// those rules to avoid double-counting: DecryptOAEP≠EncryptOAEP, Verify*≠Sign*.\nconst RE_GO_RSA_DECRYPT = /\\brsa\\.DecryptOAEP\\s*\\(/g;\nconst RE_GO_RSA_VERIFY = /\\brsa\\.VerifyPKCS1v15\\s*\\(|\\brsa\\.VerifyPSS\\s*\\(/g;\nconst RE_GO_ECDSA_VERIFY = /\\becdsa\\.Verify(?:ASN1)?\\s*\\(/g;\nconst RE_GO_ED25519_VERIFY = /\\bed25519\\.Verify\\s*\\(/g;\n// Classic pre-1.20 elliptic-curve key agreement (crypto/elliptic), superseded by\n// crypto/ecdh but still widespread. GenerateKey + ScalarMult are the low-level\n// ECDH building blocks the crypto/ecdh rule does not see. `.ScalarMult(` is an\n// unqualified method call, so this rule carries medium confidence.\nconst RE_GO_ECDH_CLASSIC = /\\belliptic\\.GenerateKey\\s*\\(|\\.ScalarMult\\s*\\(/g;\n// Go TLS misconfiguration (crypto/tls). Mirrors the JS tlsDetector: disabled\n// certificate verification and a legacy TLS/SSL version floor.\nconst RE_GO_TLS_SKIP_VERIFY = /InsecureSkipVerify:\\s*true/g;\nconst RE_GO_TLS_LEGACY_VERSION = /MinVersion:\\s*tls\\.Version(?:TLS1[01]|SSL30)/g;\n// Identifier-form golang-jwt signing methods (audit gap: the quoted \"RS256\" alg\n// token is caught by the language-agnostic jwt-jose detector, but golang-jwt\n// passes the alg as an EXPORTED IDENTIFIER — `jwt.SigningMethodRS256`,\n// `jwt.SigningMethodES256`, `jwt.SigningMethodEdDSA` — which the string rule\n// misses. RS*/PS* → RSA, ES* → ECDSA, EdDSA → EdDSA. The `\\b`s keep it precise:\n// HS* HMAC methods and longer look-alikes (`SigningMethodRS2560`) do not match.\nconst RE_GO_JWT_SIGNINGMETHOD =\n  /\\bSigningMethod(RS|PS|ES)(?:256|384|512)\\b|\\bSigningMethodEdDSA\\b/g;\n\n/* -------------------------------------------------------------------------- */\n/* Rule catalog                                                               */\n/* -------------------------------------------------------------------------- */\n\nconst RULE_GO_RSA_KEYGEN: RuleMeta = {\n  id: \"go-rsa-keygen\",\n  title: \"Go RSA key generation\",\n  description: \"crypto/rsa GenerateKey / GenerateMultiPrimeKey\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Generates a classical RSA key pair (Go), which is not quantum-safe.\",\n};\nconst RULE_GO_RSA_ENCRYPT: RuleMeta = {\n  id: \"go-rsa-encrypt\",\n  title: \"Go RSA public-key encryption\",\n  description: \"crypto/rsa EncryptOAEP / EncryptPKCS1v15\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"RSA public-key encryption (Go) is broken by Shor's algorithm and exposed to harvest-now-decrypt-later.\",\n};\nconst RULE_GO_RSA_SIGN: RuleMeta = {\n  id: \"go-rsa-sign\",\n  title: \"Go RSA signature\",\n  description: \"crypto/rsa SignPKCS1v15 / SignPSS\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical RSA signing (Go) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_GO_ECDSA: RuleMeta = {\n  id: \"go-ecdsa\",\n  title: \"Go ECDSA key/signature\",\n  description: \"crypto/ecdsa GenerateKey / Sign / SignASN1\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA (Go) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_GO_ECDH: RuleMeta = {\n  id: \"go-ecdh\",\n  title: \"Go ECDH key exchange\",\n  description: \"crypto/ecdh P256/P384/P521 key agreement\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman (Go crypto/ecdh) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_GO_X25519: RuleMeta = {\n  id: \"go-x25519\",\n  title: \"Go X25519 key exchange\",\n  description: \"crypto/ecdh X25519 key agreement\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X25519 (Go crypto/ecdh) is modern but still classical key agreement — harvest-now-decrypt-later.\",\n};\nconst RULE_GO_ED25519: RuleMeta = {\n  id: \"go-ed25519\",\n  title: \"Go Ed25519 signature\",\n  description: \"crypto/ed25519 GenerateKey / Sign\",\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Ed25519 (Go) is a modern but still classical signature scheme.\",\n};\nconst RULE_GO_DSA: RuleMeta = {\n  id: \"go-dsa\",\n  title: \"Go DSA key/usage\",\n  description: \"crypto/dsa GenerateKey / GenerateParameters\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical DSA (Go) is deprecated and forgeable by a quantum attacker.\",\n  remediation: \"Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_GO_RSA_DECRYPT: RuleMeta = {\n  id: \"go-rsa-decrypt\",\n  title: \"Go RSA public-key decryption\",\n  description: \"crypto/rsa DecryptOAEP\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"RSA public-key decryption (Go) recovers data protected by a classical KEM — harvest-now-decrypt-later exposed.\",\n};\nconst RULE_GO_RSA_VERIFY: RuleMeta = {\n  id: \"go-rsa-verify\",\n  title: \"Go RSA signature verification\",\n  description: \"crypto/rsa VerifyPKCS1v15 / VerifyPSS\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Verifies classical RSA signatures (Go), which are forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_GO_ECDSA_VERIFY: RuleMeta = {\n  id: \"go-ecdsa-verify\",\n  title: \"Go ECDSA signature verification\",\n  description: \"crypto/ecdsa Verify / VerifyASN1\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Verifies classical ECDSA signatures (Go), which are forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_GO_ED25519_VERIFY: RuleMeta = {\n  id: \"go-ed25519-verify\",\n  title: \"Go Ed25519 signature verification\",\n  description: \"crypto/ed25519 Verify\",\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Verifies Ed25519 signatures (Go) — modern but still classical and quantum-forgeable.\",\n};\nconst RULE_GO_ECDH_CLASSIC: RuleMeta = {\n  id: \"go-ecdh-classic\",\n  title: \"Go classic EC key agreement (crypto/elliptic)\",\n  description: \"crypto/elliptic GenerateKey / ScalarMult (pre-1.20 ECDH)\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Low-level elliptic-curve key agreement (Go crypto/elliptic) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_GO_TLS_SKIP_VERIFY: RuleMeta = {\n  id: \"go-tls-insecure-skip-verify\",\n  title: \"Go TLS certificate verification disabled\",\n  description: \"crypto/tls Config InsecureSkipVerify: true\",\n  category: \"tls\",\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message: \"InsecureSkipVerify:true disables TLS certificate verification (Go) — MITM risk.\",\n  remediation: \"Remove InsecureSkipVerify:true; verify certificates properly.\",\n};\nconst RULE_GO_TLS_LEGACY_VERSION: RuleMeta = {\n  id: \"go-tls-legacy-version\",\n  title: \"Go legacy TLS version pinned\",\n  description: \"crypto/tls MinVersion pinned to TLS 1.0/1.1 or SSL 3.0\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message:\n    \"MinVersion pins a deprecated TLS/SSL floor (TLS 1.0/1.1 or SSL 3.0) in Go; require TLS 1.3.\",\n  remediation: \"Set MinVersion: tls.VersionTLS13 and prefer PQC-hybrid key exchange.\",\n};\nconst RULE_GO_JWT_SIGNINGMETHOD: RuleMeta = {\n  id: \"go-jwt-signingmethod\",\n  title: \"Go identifier-form JWT signing method\",\n  description: \"golang-jwt SigningMethodRS/PS/ES* / SigningMethodEdDSA identifier\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\", // representative umbrella; refined per-match (RSA/ECDSA/EdDSA)\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"A classical JWT signature algorithm (Go golang-jwt, identifier form) is used, forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms\",\n};\n\n// The x509 PEM/DER key + certificate layer: parsing/marshalling classical RSA,\n// EC and PKIX key material and X.509 certificates. This is the \"handles classical\n// keys\" surface the Sign/Verify/GenerateKey rules miss — a key-loading utility\n// (`x509.ParsePKCS8PrivateKey`) touches quantum-vulnerable material without ever\n// naming rsa/ecdsa. Family is ambiguous at the parse site, so `unknown`.\nconst RE_GO_X509_PARSE =\n  /\\bx509\\.(?:ParsePKCS1PrivateKey|ParsePKCS8PrivateKey|ParsePKIXPublicKey|ParseECPrivateKey|ParsePKCS1PublicKey|MarshalPKCS1PrivateKey|MarshalPKCS8PrivateKey|MarshalPKIXPublicKey|MarshalECPrivateKey|ParseCertificates?|ParseCertificateRequest|CreateCertificate|CreateCertificateRequest)\\b/g;\nconst RULE_GO_X509_PARSE: RuleMeta = {\n  id: \"go-x509-parse\",\n  title: \"Go x509 classical key/certificate handling\",\n  description: \"x509.Parse*/Marshal*/Create* for RSA/EC/PKIX keys and X.509 certificates\",\n  category: \"certificate\",\n  severity: \"medium\",\n  confidence: \"medium\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"This code parses/marshals classical asymmetric key or X.509 certificate material (x509.*), a quantum forgery/harvest surface.\",\n  remediation:\n    \"Inventory the key/cert types handled here; plan PQC (ML-DSA) certificate + key migration.\",\n};\n\n/** Detects classical asymmetric crypto in Go source (crypto/* standard library). */\nexport const goDetector: Detector = {\n  id: \"go-crypto\",\n  description: \"Classical asymmetric crypto in Go (crypto/rsa, ecdsa, ecdh, ed25519, dsa)\",\n  scope: \"source\",\n  language: \"go\",\n  rules: [\n    RULE_GO_RSA_KEYGEN,\n    RULE_GO_RSA_ENCRYPT,\n    RULE_GO_RSA_SIGN,\n    RULE_GO_ECDSA,\n    RULE_GO_ECDH,\n    RULE_GO_X25519,\n    RULE_GO_ED25519,\n    RULE_GO_DSA,\n    RULE_GO_RSA_DECRYPT,\n    RULE_GO_RSA_VERIFY,\n    RULE_GO_ECDSA_VERIFY,\n    RULE_GO_ED25519_VERIFY,\n    RULE_GO_ECDH_CLASSIC,\n    RULE_GO_TLS_SKIP_VERIFY,\n    RULE_GO_TLS_LEGACY_VERSION,\n    RULE_GO_JWT_SIGNINGMETHOD,\n    RULE_GO_X509_PARSE,\n  ],\n  appliesTo: (f) => hasExtension(f, GO_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n\n    add(RE_GO_RSA_KEYGEN, RULE_GO_RSA_KEYGEN);\n    add(RE_GO_RSA_ENCRYPT, RULE_GO_RSA_ENCRYPT);\n    add(RE_GO_RSA_SIGN, RULE_GO_RSA_SIGN);\n    add(RE_GO_ECDSA, RULE_GO_ECDSA);\n    add(RE_GO_ECDH, RULE_GO_ECDH);\n    add(RE_GO_X25519, RULE_GO_X25519);\n    add(RE_GO_ED25519, RULE_GO_ED25519);\n    add(RE_GO_DSA, RULE_GO_DSA);\n    add(RE_GO_RSA_DECRYPT, RULE_GO_RSA_DECRYPT);\n    add(RE_GO_RSA_VERIFY, RULE_GO_RSA_VERIFY);\n    add(RE_GO_ECDSA_VERIFY, RULE_GO_ECDSA_VERIFY);\n    add(RE_GO_ED25519_VERIFY, RULE_GO_ED25519_VERIFY);\n    add(RE_GO_ECDH_CLASSIC, RULE_GO_ECDH_CLASSIC);\n    add(RE_GO_TLS_SKIP_VERIFY, RULE_GO_TLS_SKIP_VERIFY);\n    add(RE_GO_TLS_LEGACY_VERSION, RULE_GO_TLS_LEGACY_VERSION);\n    add(RE_GO_X509_PARSE, RULE_GO_X509_PARSE);\n\n    // Identifier-form golang-jwt signing methods (jwt.SigningMethodRS256, …).\n    // Refine the umbrella \"unknown\" algorithm per match: m[1] is the RS/PS/ES\n    // prefix (RS/PS → RSA, ES → ECDSA); when it is undefined the EdDSA branch\n    // matched, so the family is EdDSA.\n    eachMatch(RE_GO_JWT_SIGNINGMETHOD, content, (m) => {\n      const algorithm: Finding[\"algorithm\"] = m[1] === \"ES\" ? \"ECDSA\" : m[1] ? \"RSA\" : \"EdDSA\";\n      findings.push(\n        findingFromRule(\n          RULE_GO_JWT_SIGNINGMETHOD,\n          { file, content, index: m.index, matchLength: m[0].length },\n          { algorithm },\n        ),\n      );\n    });\n\n    return findings;\n  },\n};\n"]}

package/dist/detectors/java.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"java.d.ts","sourceRoot":"","sources":["../../src/detectors/java.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA8K/D,iFAAiF;AACjF,eAAO,MAAM,YAAY,EAAE,QAsC1B,CAAC"}
+{"version":3,"file":"java.d.ts","sourceRoot":"","sources":["../../src/detectors/java.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAkT/D,iFAAiF;AACjF,eAAO,MAAM,YAAY,EAAE,QA4F1B,CAAC"}