@quantakrypto/core 0.4.2 → 0.4.4

package/dist/detectors/messaging.js

@@ -0,0 +1,72 @@
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_RISKY_PRIMITIVE, CWE_BROKEN_CRYPTO } from "../cwe.js";
+const MQ_EXTENSIONS = [".properties", ".conf", ".cfg", ".ini"];
+const MQ_RULES = [
+    {
+        // Match TLSv1 (=1.0) and TLSv1.1 but never TLSv1.2 / TLSv1.3: the negative
+        // lookahead stops "TLSv1" from matching the "TLSv1" inside "TLSv1.3".
+        re: /\bssl\.(?:enabled\.)?protocols?\s*=\s*[^\n]*\bTLSv1(?:\.1)?(?![.\d])/gi,
+        meta: {
+            id: "mq-kafka-legacy-tls",
+            title: "Kafka legacy TLS protocol",
+            description: "Kafka ssl.protocol / ssl.enabled.protocols permits TLS 1.0 / 1.1",
+            category: "tls",
+            severity: "medium",
+            confidence: "high",
+            hndl: false,
+            cwe: CWE_RISKY_PRIMITIVE,
+            message: "Kafka broker permits legacy TLS 1.0/1.1; its classical key exchange is weak and harvestable.",
+            remediation: "Require TLS 1.3 and track PQC-hybrid KEX (X25519MLKEM768).",
+        },
+    },
+    {
+        re: /\btls_version\s+tlsv1(?:\.1)?(?![.\d])/gi,
+        meta: {
+            id: "mq-mqtt-legacy-tls",
+            title: "MQTT legacy TLS version",
+            description: "Mosquitto/MQTT tls_version permits TLS 1.0 / 1.1",
+            category: "tls",
+            severity: "medium",
+            confidence: "high",
+            hndl: false,
+            cwe: CWE_RISKY_PRIMITIVE,
+            message: "MQTT broker permits legacy TLS 1.0/1.1; its classical key exchange is weak and harvestable.",
+            remediation: "Require TLS 1.3 and track PQC-hybrid KEX for device fleets.",
+        },
+    },
+    {
+        re: /\bssl\.cipher\.suites\s*=\s*[^\n]*(?:ECDHE_RSA|ECDHE_ECDSA|TLS_RSA|_DHE_RSA)/g,
+        meta: {
+            id: "mq-classical-cipher",
+            title: "Broker classical (EC)DHE cipher suite",
+            description: "Kafka ssl.cipher.suites names a classical ECDHE/DHE/RSA suite",
+            category: "tls",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "ECDH",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Broker TLS is pinned to a classical (EC)DHE/RSA cipher suite; the key exchange is harvest-now-decrypt-later exposed.",
+            remediation: "Move to TLS 1.3 with a PQC-hybrid group (X25519MLKEM768) once the broker/runtime supports it.",
+        },
+    },
+];
+/** Detects classical transport crypto in message-broker / event-stream config. */
+export const messagingDetector = {
+    id: "messaging-transport",
+    description: "Classical transport crypto in message brokers (Kafka, MQTT, RabbitMQ, NATS)",
+    scope: "config",
+    language: "any",
+    rules: MQ_RULES.map((r) => r.meta),
+    appliesTo: (f) => hasExtension(f, MQ_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        for (const rule of MQ_RULES) {
+            eachMatch(rule.re, content, (m) => {
+                findings.push(findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }));
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=messaging.js.map

package/dist/detectors/messaging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/detectors/messaging.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,aAAa,GAAsB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAOlF,MAAM,QAAQ,GAAa;IACzB;QACE,2EAA2E;QAC3E,sEAAsE;QACtE,EAAE,EAAE,wEAAwE;QAC5E,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,kEAAkE;YAC/E,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,mBAAmB;YACxB,OAAO,EACL,8FAA8F;YAChG,WAAW,EAAE,4DAA4D;SAC1E;KACF;IACD;QACE,EAAE,EAAE,0CAA0C;QAC9C,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,kDAAkD;YAC/D,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,mBAAmB;YACxB,OAAO,EACL,6FAA6F;YAC/F,WAAW,EAAE,6DAA6D;SAC3E;KACF;IACD;QACE,EAAE,EAAE,+EAA+E;QACnF,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uCAAuC;YAC9C,WAAW,EAAE,+DAA+D;YAC5E,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,MAAM;YACjB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,sHAAsH;YACxH,WAAW,EACT,+FAA+F;SAClG;KACF;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAa;IACzC,EAAE,EAAE,qBAAqB;IACzB,WAAW,EAAE,6EAA6E;IAC1F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical transport crypto in message brokers / event streams\n * (Kafka, RabbitMQ, MQTT/Mosquitto, NATS). Broker traffic is \"communication\n * between things\"; a legacy TLS floor or a classical (EC)DHE cipher suite makes\n * every message in flight harvest-now-decrypt-later exposed.\n *\n * Covered in broker config files (`.properties`, `.conf`, `.cfg`, `.ini`):\n *  - Kafka `ssl.protocol` / `ssl.enabled.protocols = TLSv1 | TLSv1.1` (legacy).\n *  - MQTT/Mosquitto `tls_version tlsv1 | tlsv1.1` (legacy).\n *  - Kafka `ssl.cipher.suites` naming a classical `ECDHE_RSA` / `ECDHE_ECDSA` /\n *    `TLS_RSA` suite — the harvestable key-exchange path.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_RISKY_PRIMITIVE, CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\nconst MQ_EXTENSIONS: readonly string[] = [\".properties\", \".conf\", \".cfg\", \".ini\"];\n\ninterface MqRule {\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst MQ_RULES: MqRule[] = [\n  {\n    // Match TLSv1 (=1.0) and TLSv1.1 but never TLSv1.2 / TLSv1.3: the negative\n    // lookahead stops \"TLSv1\" from matching the \"TLSv1\" inside \"TLSv1.3\".\n    re: /\\bssl\\.(?:enabled\\.)?protocols?\\s*=\\s*[^\\n]*\\bTLSv1(?:\\.1)?(?![.\\d])/gi,\n    meta: {\n      id: \"mq-kafka-legacy-tls\",\n      title: \"Kafka legacy TLS protocol\",\n      description: \"Kafka ssl.protocol / ssl.enabled.protocols permits TLS 1.0 / 1.1\",\n      category: \"tls\",\n      severity: \"medium\",\n      confidence: \"high\",\n      hndl: false,\n      cwe: CWE_RISKY_PRIMITIVE,\n      message:\n        \"Kafka broker permits legacy TLS 1.0/1.1; its classical key exchange is weak and harvestable.\",\n      remediation: \"Require TLS 1.3 and track PQC-hybrid KEX (X25519MLKEM768).\",\n    },\n  },\n  {\n    re: /\\btls_version\\s+tlsv1(?:\\.1)?(?![.\\d])/gi,\n    meta: {\n      id: \"mq-mqtt-legacy-tls\",\n      title: \"MQTT legacy TLS version\",\n      description: \"Mosquitto/MQTT tls_version permits TLS 1.0 / 1.1\",\n      category: \"tls\",\n      severity: \"medium\",\n      confidence: \"high\",\n      hndl: false,\n      cwe: CWE_RISKY_PRIMITIVE,\n      message:\n        \"MQTT broker permits legacy TLS 1.0/1.1; its classical key exchange is weak and harvestable.\",\n      remediation: \"Require TLS 1.3 and track PQC-hybrid KEX for device fleets.\",\n    },\n  },\n  {\n    re: /\\bssl\\.cipher\\.suites\\s*=\\s*[^\\n]*(?:ECDHE_RSA|ECDHE_ECDSA|TLS_RSA|_DHE_RSA)/g,\n    meta: {\n      id: \"mq-classical-cipher\",\n      title: \"Broker classical (EC)DHE cipher suite\",\n      description: \"Kafka ssl.cipher.suites names a classical ECDHE/DHE/RSA suite\",\n      category: \"tls\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"ECDH\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Broker TLS is pinned to a classical (EC)DHE/RSA cipher suite; the key exchange is harvest-now-decrypt-later exposed.\",\n      remediation:\n        \"Move to TLS 1.3 with a PQC-hybrid group (X25519MLKEM768) once the broker/runtime supports it.\",\n    },\n  },\n];\n\n/** Detects classical transport crypto in message-broker / event-stream config. */\nexport const messagingDetector: Detector = {\n  id: \"messaging-transport\",\n  description: \"Classical transport crypto in message brokers (Kafka, MQTT, RabbitMQ, NATS)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: MQ_RULES.map((r) => r.meta),\n  appliesTo: (f) => hasExtension(f, MQ_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    for (const rule of MQ_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/pem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAwJ/D,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QA2BzB,CAAC"}
+{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA4M/D,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QA2BzB,CAAC"}

package/dist/detectors/pem.js

@@ -32,7 +32,7 @@ const PEM_RULES = [
             cwe: CWE_HARDCODED_KEY,
             sensitive: true,
             message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
-            remediation: "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
+            remediation: "Migrate to ML-DSA (FIPS 204) for signatures or hybrid X25519MLKEM768 for key agreement; remove embedded private keys from source.",
         },
     },
     {
@@ -66,7 +66,7 @@ const PEM_RULES = [
             cwe: CWE_HARDCODED_KEY,
             sensitive: true,
             message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
-            remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
+            remediation: "Rotate the key; plan migration to PQC-capable SSH (prefer the mlkem768x25519-sha256 KEX, OpenSSH 10's default since Apr 2025).",
         },
     },
     {
@@ -135,6 +135,54 @@ const PEM_RULES = [
             remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
         },
     },
+    {
+        re: /-----BEGIN (?:RSA )?PUBLIC KEY-----/g,
+        meta: {
+            id: "pem-public-key",
+            title: "Classical public key (PEM)",
+            description: "SubjectPublicKeyInfo / PKCS#1 RSA public key block",
+            category: "certificate",
+            severity: "low",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Embedded classical public key (RSA/EC/DSA); its key pair is not quantum-safe — forgeable signatures or classical key exchange.",
+            remediation: "Re-issue with PQC keys (ML-DSA / ML-KEM) as the ecosystem adopts them.",
+        },
+    },
+    {
+        re: /-----BEGIN DH PARAMETERS-----/g,
+        meta: {
+            id: "pem-dh-parameters",
+            title: "Diffie-Hellman parameters (PEM)",
+            description: "Finite-field DH group parameters block",
+            category: "key-exchange",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "DH",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Embedded finite-field Diffie-Hellman parameters; classical DH key exchange is harvest-now-decrypt-later exposed.",
+            remediation: "Migrate key exchange to hybrid X25519MLKEM768 (ML-KEM-768).",
+        },
+    },
+    {
+        re: /-----BEGIN (?:NEW )?CERTIFICATE REQUEST-----/g,
+        meta: {
+            id: "pem-cert-request",
+            title: "Certificate signing request (PEM)",
+            description: "PKCS#10 certificate request block",
+            category: "certificate",
+            severity: "low",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Embedded PKCS#10 CSR; carries a classical public key and will be signed with classical crypto.",
+            remediation: "Re-generate with PQC keys as PQC-capable CAs mature.",
+        },
+    },
 ];
 /** Detects PEM key/certificate material in arbitrary files. */
 export const pemDetector = {

package/dist/detectors/pem.js.map

@@ -1 +1 @@
-{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AASjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,wEAAwE;YACjF,WAAW,EAAE,+EAA+E;SAC7F;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,iFAAiF;YAC1F,WAAW,EACT,iFAAiF;SACpF;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,sFAAsF;YACxF,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EAAE,2EAA2E;SACzF;KACF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,+FAA+F;YACjG,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oGAAoG;YACtG,WAAW,EAAE,qEAAqE;SACnF;KACF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,0BAA0B;YACvC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,yEAAyE;YAClF,WAAW,EAAE,mEAAmE;SACjF;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,+EAA+E;YACxF,WAAW,EAAE,8EAA8E;SAC5F;KACF;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE;oBACzB,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AASjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,wEAAwE;YACjF,WAAW,EAAE,+EAA+E;SAC7F;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,iFAAiF;YAC1F,WAAW,EACT,mIAAmI;SACtI;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,sFAAsF;YACxF,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EACT,gIAAgI;SACnI;KACF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,+FAA+F;YACjG,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oGAAoG;YACtG,WAAW,EAAE,qEAAqE;SACnF;KACF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,0BAA0B;YACvC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,yEAAyE;YAClF,WAAW,EAAE,mEAAmE;SACjF;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,+EAA+E;YACxF,WAAW,EAAE,8EAA8E;SAC5F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,oDAAoD;YACjE,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gIAAgI;YAClI,WAAW,EAAE,wEAAwE;SACtF;KACF;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,wCAAwC;YACrD,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,kHAAkH;YACpH,WAAW,EAAE,6DAA6D;SAC3E;KACF;IACD;QACE,EAAE,EAAE,+CAA+C;QACnD,IAAI,EAAE;YACJ,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,mCAAmC;YAChD,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gGAAgG;YAClG,WAAW,EAAE,sDAAsD;SACpE;KACF;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE;oBACzB,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config / certificate detector: finds PEM-encoded cryptographic material in\n * any text file (source, config, .pem, .key, .crt, .env, …). This catches\n * embedded private keys and X.509 certificates regardless of language.\n *\n * Every rule's metadata lives in the {@link RuleMeta} declaration below (the\n * catalog entry); `detect()` builds findings straight from it via\n * `findingFromRule`. All PEM findings are high-confidence exact-marker matches.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from \"../cwe.js\";\n\n/** A PEM rule: its catalog metadata plus the begin-marker regex that triggers it. */\ninterface PemRule {\n  /** Regex matching the PEM begin marker. */\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst PEM_RULES: PemRule[] = [\n  {\n    re: /-----BEGIN RSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-rsa-private-key\",\n      title: \"RSA private key (PEM)\",\n      description: \"PKCS#1 RSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.\",\n      remediation: \"Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN EC PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-ec-private-key\",\n      title: \"EC private key (PEM)\",\n      description: \"SEC1 EC private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"ECDSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.\",\n      remediation:\n        \"Migrate to ML-DSA (FIPS 204) for signatures or hybrid X25519MLKEM768 for key agreement; remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN DSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-dsa-private-key\",\n      title: \"DSA private key (PEM)\",\n      description: \"DSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"DSA\",\n      hndl: false,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.\",\n      remediation: \"Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).\",\n    },\n  },\n  {\n    re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-openssh-private-key\",\n      title: \"OpenSSH private key\",\n      description: \"OpenSSH private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.\",\n      remediation:\n        \"Rotate the key; plan migration to PQC-capable SSH (prefer the mlkem768x25519-sha256 KEX, OpenSSH 10's default since Apr 2025).\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,\n    meta: {\n      id: \"pem-pgp-private-key\",\n      title: \"PGP/GPG private key block\",\n      description: \"OpenPGP private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.\",\n      remediation: \"Rotate the key; track OpenPGP PQC drafts for migration.\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP MESSAGE-----/g,\n    meta: {\n      id: \"pem-pgp-message\",\n      title: \"PGP/GPG encrypted message\",\n      description: \"OpenPGP encrypted message block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).\",\n      remediation: \"Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-pkcs8-private-key\",\n      title: \"Private key (PKCS#8 PEM)\",\n      description: \"PKCS#8 private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.\",\n      remediation: \"Migrate to PQC keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN CERTIFICATE-----/g,\n    meta: {\n      id: \"pem-certificate\",\n      title: \"X.509 certificate (PEM)\",\n      description: \"X.509 certificate block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: \"Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.\",\n      remediation: \"Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:RSA )?PUBLIC KEY-----/g,\n    meta: {\n      id: \"pem-public-key\",\n      title: \"Classical public key (PEM)\",\n      description: \"SubjectPublicKeyInfo / PKCS#1 RSA public key block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded classical public key (RSA/EC/DSA); its key pair is not quantum-safe — forgeable signatures or classical key exchange.\",\n      remediation: \"Re-issue with PQC keys (ML-DSA / ML-KEM) as the ecosystem adopts them.\",\n    },\n  },\n  {\n    re: /-----BEGIN DH PARAMETERS-----/g,\n    meta: {\n      id: \"pem-dh-parameters\",\n      title: \"Diffie-Hellman parameters (PEM)\",\n      description: \"Finite-field DH group parameters block\",\n      category: \"key-exchange\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"DH\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded finite-field Diffie-Hellman parameters; classical DH key exchange is harvest-now-decrypt-later exposed.\",\n      remediation: \"Migrate key exchange to hybrid X25519MLKEM768 (ML-KEM-768).\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:NEW )?CERTIFICATE REQUEST-----/g,\n    meta: {\n      id: \"pem-cert-request\",\n      title: \"Certificate signing request (PEM)\",\n      description: \"PKCS#10 certificate request block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PKCS#10 CSR; carries a classical public key and will be signed with classical crypto.\",\n      remediation: \"Re-generate with PQC keys as PQC-capable CAs mature.\",\n    },\n  },\n];\n\n/** Detects PEM key/certificate material in arbitrary files. */\nexport const pemDetector: Detector = {\n  id: \"pem-material\",\n  description: \"PEM-encoded private keys and X.509 certificates in any file\",\n  scope: \"config\",\n  language: \"any\",\n  rules: PEM_RULES.map((r) => r.meta),\n  // Applies to every text file; the walker already filters out binaries.\n  appliesTo: () => true,\n  detect({ file, content }): Finding[] {\n    // Fast reject: only proceed if a PEM header is present at all.\n    if (!content.includes(\"-----BEGIN \")) return [];\n\n    const findings: Finding[] = [];\n    for (const rule of PEM_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/php.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in PHP — one of the
+ * most-deployed backend languages, previously uncovered. Handles the three
+ * dominant crypto surfaces:
+ *
+ *  - **ext/openssl** — `openssl_pkey_new()` (classified by its
+ *    `OPENSSL_KEYTYPE_*` config, defaulting to RSA), `openssl_public_encrypt` /
+ *    `openssl_private_decrypt` (RSA), and `openssl_sign` / `openssl_verify`.
+ *  - **phpseclib3** — `RSA::createKey()` / `EC::createKey()` / `DSA::createKey()`.
+ *  - **libsodium** — `sodium_crypto_box`/`kx` keypairs (X25519) and
+ *    `sodium_crypto_sign` keypairs (Ed25519).
+ *
+ * Lexical, like the other packs; the `openssl_*` / `sodium_crypto_*` prefixes and
+ * `OPENSSL_KEYTYPE_*` constants are distinctive, so the false-positive rate is low.
+ *
+ * HNDL: RSA encryption and (EC/X)DH key agreement are harvest-now-decrypt-later
+ * exposed (hndl:true); ECDSA / DSA / Ed25519 signatures are hndl:false but
+ * forgeable. `openssl_pkey_new` EC and `EC::createKey` are ambiguous (feed BOTH
+ * ECDSA and ECDH), classified conservatively as key-exchange-capable (hndl:true).
+ */
+import type { Detector } from "../types.js";
+/** Detects classical asymmetric crypto in PHP (openssl, phpseclib, libsodium). */
+export declare const phpDetector: Detector;
+//# sourceMappingURL=php.d.ts.map

package/dist/detectors/php.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"php.d.ts","sourceRoot":"","sources":["../../src/detectors/php.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAqI/D,kFAAkF;AAClF,eAAO,MAAM,WAAW,EAAE,QAsEzB,CAAC"}

package/dist/detectors/php.js

@@ -0,0 +1,167 @@
+import { PHP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+const RE_PHP_PKEY_NEW = /\bopenssl_pkey_new\s*\(/g;
+const RE_PHP_RSA_CRYPT = /\bopenssl_(?:public_encrypt|private_decrypt)\s*\(/g;
+const RE_PHP_SIGN = /\bopenssl_(?:sign|verify)\s*\(/g;
+// phpseclib3 factory methods. The class names are generic, so require `::createKey`.
+const RE_PHP_SECLIB = /\b(RSA|EC|DSA|DH)::createKey\s*\(/g;
+// libsodium X25519 (box / kx / scalarmult) and Ed25519 (sign) key pairs.
+const RE_PHP_SODIUM_X25519 = /\bsodium_crypto_(?:box|kx)_(?:seed_)?keypair\s*\(|\bsodium_crypto_scalarmult(?:_base)?\s*\(/g;
+const RE_PHP_SODIUM_ED25519 = /\bsodium_crypto_sign_(?:seed_)?keypair\s*\(/g;
+const HYBRID = "hybrid X25519MLKEM768 (ML-KEM-768) for key agreement; ML-DSA-65 (FIPS 204) to sign";
+const RULE_PHP_KEYGEN = {
+    id: "php-openssl-keygen",
+    title: "PHP openssl key generation",
+    description: "openssl_pkey_new (RSA/EC/DSA/DH, by OPENSSL_KEYTYPE_*)",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical key pair via PHP openssl_pkey_new — not quantum-safe.",
+};
+const RULE_PHP_RSA_CRYPT = {
+    id: "php-openssl-rsa-crypt",
+    title: "PHP openssl RSA public-key encryption",
+    description: "openssl_public_encrypt / openssl_private_decrypt",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "RSA public-key encryption/decryption (PHP openssl) is harvest-now-decrypt-later exposed.",
+};
+const RULE_PHP_SIGN = {
+    id: "php-openssl-sign",
+    title: "PHP openssl signature",
+    description: "openssl_sign / openssl_verify",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "unknown",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical signature via PHP openssl (RSA/ECDSA/DSA) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_PHP_SECLIB = {
+    id: "php-phpseclib-keygen",
+    title: "PHP phpseclib key generation",
+    description: "phpseclib3 RSA/EC/DSA/DH ::createKey",
+    category: "kem",
+    severity: "high",
+    confidence: "medium",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical key pair via phpseclib3 (createKey) — not quantum-safe.",
+};
+const RULE_PHP_SODIUM_X25519 = {
+    id: "php-sodium-x25519",
+    title: "PHP libsodium X25519 key agreement",
+    description: "sodium_crypto_box/kx keypair + scalarmult",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "libsodium crypto_box/kx (PHP) uses X25519 key agreement — modern but classical, harvest-now-decrypt-later exposed.",
+};
+const RULE_PHP_SODIUM_ED25519 = {
+    id: "php-sodium-ed25519",
+    title: "PHP libsodium Ed25519 signature",
+    description: "sodium_crypto_sign keypair",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "libsodium crypto_sign (PHP) uses Ed25519 — classical and forgeable by a quantum attacker.",
+};
+/** phpseclib class name → its classification. */
+const SECLIB_INFO = {
+    RSA: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+    EC: {
+        algo: "ECDH",
+        cat: "key-exchange",
+        sev: "high",
+        hndl: true,
+        label: "EC (ECDSA/ECDH)",
+        remediation: HYBRID,
+    },
+    DSA: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+    DH: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+};
+/** Classify `openssl_pkey_new` by the `OPENSSL_KEYTYPE_*` constant in its config.
+ * The window is bounded to the current statement (up to the next `;`, capped at
+ * 300 chars) so it can't bleed into a following `openssl_pkey_new` call's key
+ * type. Defaults to RSA — openssl_pkey_new's own default private_key_type is RSA
+ * when none is given. */
+function classifyPkeyNew(content, index) {
+    const semi = content.indexOf(";", index);
+    const end = Math.min(index + 300, semi === -1 ? content.length : semi);
+    const w = content.slice(index, end);
+    if (/\bOPENSSL_KEYTYPE_EC\b/.test(w))
+        return SECLIB_INFO.EC;
+    if (/\bOPENSSL_KEYTYPE_DSA\b/.test(w))
+        return SECLIB_INFO.DSA;
+    if (/\bOPENSSL_KEYTYPE_DH\b/.test(w))
+        return SECLIB_INFO.DH;
+    return SECLIB_INFO.RSA;
+}
+/** Detects classical asymmetric crypto in PHP (openssl, phpseclib, libsodium). */
+export const phpDetector = {
+    id: "php-crypto",
+    description: "Classical asymmetric crypto in PHP (openssl, phpseclib3, libsodium)",
+    scope: "source",
+    language: "php",
+    rules: [
+        RULE_PHP_KEYGEN,
+        RULE_PHP_RSA_CRYPT,
+        RULE_PHP_SIGN,
+        RULE_PHP_SECLIB,
+        RULE_PHP_SODIUM_X25519,
+        RULE_PHP_SODIUM_ED25519,
+    ],
+    appliesTo: (f) => hasExtension(f, PHP_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, content, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        // openssl_pkey_new — one finding per call, classified by its key-type config.
+        eachMatch(RE_PHP_PKEY_NEW, content, (m) => {
+            const info = classifyPkeyNew(content, m.index);
+            findings.push(findingFromRule(RULE_PHP_KEYGEN, { file, content, index: m.index, matchLength: m[0].length }, {
+                title: `PHP openssl ${info.label} key generation`,
+                category: info.cat,
+                severity: info.sev,
+                algorithm: info.algo,
+                hndl: info.hndl,
+                message: `Generates a classical ${info.label} key pair via PHP openssl_pkey_new — not quantum-safe.`,
+                ...(info.remediation ? { remediation: info.remediation } : {}),
+            }));
+        });
+        add(RE_PHP_RSA_CRYPT, RULE_PHP_RSA_CRYPT);
+        add(RE_PHP_SIGN, RULE_PHP_SIGN);
+        // phpseclib3 ::createKey — classify by the class (RSA/EC/DSA/DH).
+        eachMatch(RE_PHP_SECLIB, content, (m) => {
+            const info = SECLIB_INFO[m[1]];
+            findings.push(findingFromRule(RULE_PHP_SECLIB, { file, content, index: m.index, matchLength: m[0].length }, {
+                title: `PHP phpseclib ${info.label} key generation`,
+                category: info.cat,
+                severity: info.sev,
+                algorithm: info.algo,
+                hndl: info.hndl,
+                message: `Generates a classical ${info.label} key pair via phpseclib3 createKey — not quantum-safe.`,
+                ...(info.remediation ? { remediation: info.remediation } : {}),
+            }));
+        });
+        add(RE_PHP_SODIUM_X25519, RULE_PHP_SODIUM_X25519);
+        add(RE_PHP_SODIUM_ED25519, RULE_PHP_SODIUM_ED25519);
+        return findings;
+    },
+};
+//# sourceMappingURL=php.js.map

package/dist/detectors/php.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"php.js","sourceRoot":"","sources":["../../src/detectors/php.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,WAAW,GAAG,iCAAiC,CAAC;AACtD,qFAAqF;AACrF,MAAM,aAAa,GAAG,oCAAoC,CAAC;AAC3D,yEAAyE;AACzE,MAAM,oBAAoB,GACxB,8FAA8F,CAAC;AACjG,MAAM,qBAAqB,GAAG,8CAA8C,CAAC;AAW7E,MAAM,MAAM,GAAG,oFAAoF,CAAC;AAEpG,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,wDAAwD;IACrE,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,6EAA6E;CACvF,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,uBAAuB;IAC3B,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0FAA0F;CAC7F,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,+BAA+B;IAC5C,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yFAAyF;IAC3F,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,sCAAsC;IACnD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,+EAA+E;CACzF,CAAC;AACF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EAAE,2CAA2C;IACxD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,oHAAoH;CACvH,CAAC;AACF,MAAM,uBAAuB,GAAa;IACxC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,iCAAiC;IACxC,WAAW,EAAE,4BAA4B;IACzC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2FAA2F;CAC9F,CAAC;AAEF,iDAAiD;AACjD,MAAM,WAAW,GAA4B;IAC3C,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;IACvE,EAAE,EAAE;QACF,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,MAAM;KACpB;IACD,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;IAC9E,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE;CAC1F,CAAC;AAEF;;;;yBAIyB;AACzB,SAAS,eAAe,CAAC,OAAe,EAAE,KAAa;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC;IAC5D,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC;IAC9D,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC;IAC5D,OAAO,WAAW,CAAC,GAAG,CAAC;AACzB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,YAAY;IAChB,WAAW,EAAE,qEAAqE;IAClF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE;QACL,eAAe;QACf,kBAAkB;QAClB,aAAa;QACb,eAAe;QACf,sBAAsB;QACtB,uBAAuB;KACxB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IACjD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAQ,EAAE,CAC/C,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,8EAA8E;QAC9E,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,eAAe,EACf,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,eAAe,IAAI,CAAC,KAAK,iBAAiB;gBACjD,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,yBAAyB,IAAI,CAAC,KAAK,wDAAwD;gBACpG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEhC,kEAAkE;QAClE,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,eAAe,EACf,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,iBAAiB,IAAI,CAAC,KAAK,iBAAiB;gBACnD,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,yBAAyB,IAAI,CAAC,KAAK,wDAAwD;gBACpG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;QAClD,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source-code detector for classical asymmetric cryptography in PHP — one of the\n * most-deployed backend languages, previously uncovered. Handles the three\n * dominant crypto surfaces:\n *\n *  - **ext/openssl** — `openssl_pkey_new()` (classified by its\n *    `OPENSSL_KEYTYPE_*` config, defaulting to RSA), `openssl_public_encrypt` /\n *    `openssl_private_decrypt` (RSA), and `openssl_sign` / `openssl_verify`.\n *  - **phpseclib3** — `RSA::createKey()` / `EC::createKey()` / `DSA::createKey()`.\n *  - **libsodium** — `sodium_crypto_box`/`kx` keypairs (X25519) and\n *    `sodium_crypto_sign` keypairs (Ed25519).\n *\n * Lexical, like the other packs; the `openssl_*` / `sodium_crypto_*` prefixes and\n * `OPENSSL_KEYTYPE_*` constants are distinctive, so the false-positive rate is low.\n *\n * HNDL: RSA encryption and (EC/X)DH key agreement are harvest-now-decrypt-later\n * exposed (hndl:true); ECDSA / DSA / Ed25519 signatures are hndl:false but\n * forgeable. `openssl_pkey_new` EC and `EC::createKey` are ambiguous (feed BOTH\n * ECDSA and ECDH), classified conservatively as key-exchange-capable (hndl:true).\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { PHP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\nconst RE_PHP_PKEY_NEW = /\\bopenssl_pkey_new\\s*\\(/g;\nconst RE_PHP_RSA_CRYPT = /\\bopenssl_(?:public_encrypt|private_decrypt)\\s*\\(/g;\nconst RE_PHP_SIGN = /\\bopenssl_(?:sign|verify)\\s*\\(/g;\n// phpseclib3 factory methods. The class names are generic, so require `::createKey`.\nconst RE_PHP_SECLIB = /\\b(RSA|EC|DSA|DH)::createKey\\s*\\(/g;\n// libsodium X25519 (box / kx / scalarmult) and Ed25519 (sign) key pairs.\nconst RE_PHP_SODIUM_X25519 =\n  /\\bsodium_crypto_(?:box|kx)_(?:seed_)?keypair\\s*\\(|\\bsodium_crypto_scalarmult(?:_base)?\\s*\\(/g;\nconst RE_PHP_SODIUM_ED25519 = /\\bsodium_crypto_sign_(?:seed_)?keypair\\s*\\(/g;\n\n/** Key-type classification for `openssl_pkey_new`, keyed by its config constant. */\ninterface KeyInfo {\n  algo: Finding[\"algorithm\"];\n  cat: Finding[\"category\"];\n  sev: Finding[\"severity\"];\n  hndl: boolean;\n  label: string;\n  remediation?: string;\n}\nconst HYBRID = \"hybrid X25519MLKEM768 (ML-KEM-768) for key agreement; ML-DSA-65 (FIPS 204) to sign\";\n\nconst RULE_PHP_KEYGEN: RuleMeta = {\n  id: \"php-openssl-keygen\",\n  title: \"PHP openssl key generation\",\n  description: \"openssl_pkey_new (RSA/EC/DSA/DH, by OPENSSL_KEYTYPE_*)\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Generates a classical key pair via PHP openssl_pkey_new — not quantum-safe.\",\n};\nconst RULE_PHP_RSA_CRYPT: RuleMeta = {\n  id: \"php-openssl-rsa-crypt\",\n  title: \"PHP openssl RSA public-key encryption\",\n  description: \"openssl_public_encrypt / openssl_private_decrypt\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"RSA public-key encryption/decryption (PHP openssl) is harvest-now-decrypt-later exposed.\",\n};\nconst RULE_PHP_SIGN: RuleMeta = {\n  id: \"php-openssl-sign\",\n  title: \"PHP openssl signature\",\n  description: \"openssl_sign / openssl_verify\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical signature via PHP openssl (RSA/ECDSA/DSA) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_PHP_SECLIB: RuleMeta = {\n  id: \"php-phpseclib-keygen\",\n  title: \"PHP phpseclib key generation\",\n  description: \"phpseclib3 RSA/EC/DSA/DH ::createKey\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Generates a classical key pair via phpseclib3 (createKey) — not quantum-safe.\",\n};\nconst RULE_PHP_SODIUM_X25519: RuleMeta = {\n  id: \"php-sodium-x25519\",\n  title: \"PHP libsodium X25519 key agreement\",\n  description: \"sodium_crypto_box/kx keypair + scalarmult\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"libsodium crypto_box/kx (PHP) uses X25519 key agreement — modern but classical, harvest-now-decrypt-later exposed.\",\n};\nconst RULE_PHP_SODIUM_ED25519: RuleMeta = {\n  id: \"php-sodium-ed25519\",\n  title: \"PHP libsodium Ed25519 signature\",\n  description: \"sodium_crypto_sign keypair\",\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"libsodium crypto_sign (PHP) uses Ed25519 — classical and forgeable by a quantum attacker.\",\n};\n\n/** phpseclib class name → its classification. */\nconst SECLIB_INFO: Record<string, KeyInfo> = {\n  RSA: { algo: \"RSA\", cat: \"kem\", sev: \"high\", hndl: true, label: \"RSA\" },\n  EC: {\n    algo: \"ECDH\",\n    cat: \"key-exchange\",\n    sev: \"high\",\n    hndl: true,\n    label: \"EC (ECDSA/ECDH)\",\n    remediation: HYBRID,\n  },\n  DSA: { algo: \"DSA\", cat: \"signature\", sev: \"high\", hndl: false, label: \"DSA\" },\n  DH: { algo: \"DH\", cat: \"key-exchange\", sev: \"high\", hndl: true, label: \"Diffie-Hellman\" },\n};\n\n/** Classify `openssl_pkey_new` by the `OPENSSL_KEYTYPE_*` constant in its config.\n * The window is bounded to the current statement (up to the next `;`, capped at\n * 300 chars) so it can't bleed into a following `openssl_pkey_new` call's key\n * type. Defaults to RSA — openssl_pkey_new's own default private_key_type is RSA\n * when none is given. */\nfunction classifyPkeyNew(content: string, index: number): KeyInfo {\n  const semi = content.indexOf(\";\", index);\n  const end = Math.min(index + 300, semi === -1 ? content.length : semi);\n  const w = content.slice(index, end);\n  if (/\\bOPENSSL_KEYTYPE_EC\\b/.test(w)) return SECLIB_INFO.EC;\n  if (/\\bOPENSSL_KEYTYPE_DSA\\b/.test(w)) return SECLIB_INFO.DSA;\n  if (/\\bOPENSSL_KEYTYPE_DH\\b/.test(w)) return SECLIB_INFO.DH;\n  return SECLIB_INFO.RSA;\n}\n\n/** Detects classical asymmetric crypto in PHP (openssl, phpseclib, libsodium). */\nexport const phpDetector: Detector = {\n  id: \"php-crypto\",\n  description: \"Classical asymmetric crypto in PHP (openssl, phpseclib3, libsodium)\",\n  scope: \"source\",\n  language: \"php\",\n  rules: [\n    RULE_PHP_KEYGEN,\n    RULE_PHP_RSA_CRYPT,\n    RULE_PHP_SIGN,\n    RULE_PHP_SECLIB,\n    RULE_PHP_SODIUM_X25519,\n    RULE_PHP_SODIUM_ED25519,\n  ],\n  appliesTo: (f) => hasExtension(f, PHP_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta): void =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n\n    // openssl_pkey_new — one finding per call, classified by its key-type config.\n    eachMatch(RE_PHP_PKEY_NEW, content, (m) => {\n      const info = classifyPkeyNew(content, m.index);\n      findings.push(\n        findingFromRule(\n          RULE_PHP_KEYGEN,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `PHP openssl ${info.label} key generation`,\n            category: info.cat,\n            severity: info.sev,\n            algorithm: info.algo,\n            hndl: info.hndl,\n            message: `Generates a classical ${info.label} key pair via PHP openssl_pkey_new — not quantum-safe.`,\n            ...(info.remediation ? { remediation: info.remediation } : {}),\n          },\n        ),\n      );\n    });\n\n    add(RE_PHP_RSA_CRYPT, RULE_PHP_RSA_CRYPT);\n    add(RE_PHP_SIGN, RULE_PHP_SIGN);\n\n    // phpseclib3 ::createKey — classify by the class (RSA/EC/DSA/DH).\n    eachMatch(RE_PHP_SECLIB, content, (m) => {\n      const info = SECLIB_INFO[m[1]];\n      findings.push(\n        findingFromRule(\n          RULE_PHP_SECLIB,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `PHP phpseclib ${info.label} key generation`,\n            category: info.cat,\n            severity: info.sev,\n            algorithm: info.algo,\n            hndl: info.hndl,\n            message: `Generates a classical ${info.label} key pair via phpseclib3 createKey — not quantum-safe.`,\n            ...(info.remediation ? { remediation: info.remediation } : {}),\n          },\n        ),\n      );\n    });\n\n    add(RE_PHP_SODIUM_X25519, RULE_PHP_SODIUM_X25519);\n    add(RE_PHP_SODIUM_ED25519, RULE_PHP_SODIUM_ED25519);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/python.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../src/detectors/python.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAsJ/D,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAE,QAsC5B,CAAC"}
+{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../src/detectors/python.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAsR/D,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAE,QA4D5B,CAAC"}