@quantakrypto/core 0.4.3 → 0.5.0

package/dist/detectors/pem.js.map

@@ -1 +1 @@
-{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AASjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,wEAAwE;YACjF,WAAW,EAAE,+EAA+E;SAC7F;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,iFAAiF;YAC1F,WAAW,EACT,iFAAiF;SACpF;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,sFAAsF;YACxF,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EACT,gIAAgI;SACnI;KACF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,+FAA+F;YACjG,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oGAAoG;YACtG,WAAW,EAAE,qEAAqE;SACnF;KACF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,0BAA0B;YACvC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,yEAAyE;YAClF,WAAW,EAAE,mEAAmE;SACjF;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,+EAA+E;YACxF,WAAW,EAAE,8EAA8E;SAC5F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,oDAAoD;YACjE,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gIAAgI;YAClI,WAAW,EAAE,wEAAwE;SACtF;KACF;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,wCAAwC;YACrD,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,kHAAkH;YACpH,WAAW,EAAE,6DAA6D;SAC3E;KACF;IACD;QACE,EAAE,EAAE,+CAA+C;QACnD,IAAI,EAAE;YACJ,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,mCAAmC;YAChD,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gGAAgG;YAClG,WAAW,EAAE,sDAAsD;SACpE;KACF;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE;oBACzB,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config / certificate detector: finds PEM-encoded cryptographic material in\n * any text file (source, config, .pem, .key, .crt, .env, …). This catches\n * embedded private keys and X.509 certificates regardless of language.\n *\n * Every rule's metadata lives in the {@link RuleMeta} declaration below (the\n * catalog entry); `detect()` builds findings straight from it via\n * `findingFromRule`. All PEM findings are high-confidence exact-marker matches.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from \"../cwe.js\";\n\n/** A PEM rule: its catalog metadata plus the begin-marker regex that triggers it. */\ninterface PemRule {\n  /** Regex matching the PEM begin marker. */\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst PEM_RULES: PemRule[] = [\n  {\n    re: /-----BEGIN RSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-rsa-private-key\",\n      title: \"RSA private key (PEM)\",\n      description: \"PKCS#1 RSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.\",\n      remediation: \"Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN EC PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-ec-private-key\",\n      title: \"EC private key (PEM)\",\n      description: \"SEC1 EC private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"ECDSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.\",\n      remediation:\n        \"Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN DSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-dsa-private-key\",\n      title: \"DSA private key (PEM)\",\n      description: \"DSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"DSA\",\n      hndl: false,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.\",\n      remediation: \"Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).\",\n    },\n  },\n  {\n    re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-openssh-private-key\",\n      title: \"OpenSSH private key\",\n      description: \"OpenSSH private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.\",\n      remediation:\n        \"Rotate the key; plan migration to PQC-capable SSH (prefer the mlkem768x25519-sha256 KEX, OpenSSH 10's default since Apr 2025).\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,\n    meta: {\n      id: \"pem-pgp-private-key\",\n      title: \"PGP/GPG private key block\",\n      description: \"OpenPGP private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.\",\n      remediation: \"Rotate the key; track OpenPGP PQC drafts for migration.\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP MESSAGE-----/g,\n    meta: {\n      id: \"pem-pgp-message\",\n      title: \"PGP/GPG encrypted message\",\n      description: \"OpenPGP encrypted message block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).\",\n      remediation: \"Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-pkcs8-private-key\",\n      title: \"Private key (PKCS#8 PEM)\",\n      description: \"PKCS#8 private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.\",\n      remediation: \"Migrate to PQC keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN CERTIFICATE-----/g,\n    meta: {\n      id: \"pem-certificate\",\n      title: \"X.509 certificate (PEM)\",\n      description: \"X.509 certificate block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: \"Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.\",\n      remediation: \"Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:RSA )?PUBLIC KEY-----/g,\n    meta: {\n      id: \"pem-public-key\",\n      title: \"Classical public key (PEM)\",\n      description: \"SubjectPublicKeyInfo / PKCS#1 RSA public key block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded classical public key (RSA/EC/DSA); its key pair is not quantum-safe — forgeable signatures or classical key exchange.\",\n      remediation: \"Re-issue with PQC keys (ML-DSA / ML-KEM) as the ecosystem adopts them.\",\n    },\n  },\n  {\n    re: /-----BEGIN DH PARAMETERS-----/g,\n    meta: {\n      id: \"pem-dh-parameters\",\n      title: \"Diffie-Hellman parameters (PEM)\",\n      description: \"Finite-field DH group parameters block\",\n      category: \"key-exchange\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"DH\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded finite-field Diffie-Hellman parameters; classical DH key exchange is harvest-now-decrypt-later exposed.\",\n      remediation: \"Migrate key exchange to hybrid X25519MLKEM768 (ML-KEM-768).\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:NEW )?CERTIFICATE REQUEST-----/g,\n    meta: {\n      id: \"pem-cert-request\",\n      title: \"Certificate signing request (PEM)\",\n      description: \"PKCS#10 certificate request block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PKCS#10 CSR; carries a classical public key and will be signed with classical crypto.\",\n      remediation: \"Re-generate with PQC keys as PQC-capable CAs mature.\",\n    },\n  },\n];\n\n/** Detects PEM key/certificate material in arbitrary files. */\nexport const pemDetector: Detector = {\n  id: \"pem-material\",\n  description: \"PEM-encoded private keys and X.509 certificates in any file\",\n  scope: \"config\",\n  language: \"any\",\n  rules: PEM_RULES.map((r) => r.meta),\n  // Applies to every text file; the walker already filters out binaries.\n  appliesTo: () => true,\n  detect({ file, content }): Finding[] {\n    // Fast reject: only proceed if a PEM header is present at all.\n    if (!content.includes(\"-----BEGIN \")) return [];\n\n    const findings: Finding[] = [];\n    for (const rule of PEM_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}
+{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AASjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,wEAAwE;YACjF,WAAW,EAAE,+EAA+E;SAC7F;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,iFAAiF;YAC1F,WAAW,EACT,mIAAmI;SACtI;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,sFAAsF;YACxF,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EACT,gIAAgI;SACnI;KACF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,+FAA+F;YACjG,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oGAAoG;YACtG,WAAW,EAAE,qEAAqE;SACnF;KACF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,0BAA0B;YACvC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,yEAAyE;YAClF,WAAW,EAAE,mEAAmE;SACjF;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,+EAA+E;YACxF,WAAW,EAAE,8EAA8E;SAC5F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,oDAAoD;YACjE,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gIAAgI;YAClI,WAAW,EAAE,wEAAwE;SACtF;KACF;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,wCAAwC;YACrD,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,kHAAkH;YACpH,WAAW,EAAE,6DAA6D;SAC3E;KACF;IACD;QACE,EAAE,EAAE,+CAA+C;QACnD,IAAI,EAAE;YACJ,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,mCAAmC;YAChD,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gGAAgG;YAClG,WAAW,EAAE,sDAAsD;SACpE;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,IAAY;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,CAAC,CAAC;IAC/C,IAAI,yCAAyC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACtD,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,4DAA4D;gBAC5D,4EAA4E;gBAC5E,8EAA8E;gBAC9E,qDAAqD;gBACrD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAC3D,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE;oBACzB,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config / certificate detector: finds PEM-encoded cryptographic material in\n * any text file (source, config, .pem, .key, .crt, .env, …). This catches\n * embedded private keys and X.509 certificates regardless of language.\n *\n * Every rule's metadata lives in the {@link RuleMeta} declaration below (the\n * catalog entry); `detect()` builds findings straight from it via\n * `findingFromRule`. All PEM findings are high-confidence exact-marker matches.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from \"../cwe.js\";\n\n/** A PEM rule: its catalog metadata plus the begin-marker regex that triggers it. */\ninterface PemRule {\n  /** Regex matching the PEM begin marker. */\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst PEM_RULES: PemRule[] = [\n  {\n    re: /-----BEGIN RSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-rsa-private-key\",\n      title: \"RSA private key (PEM)\",\n      description: \"PKCS#1 RSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.\",\n      remediation: \"Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN EC PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-ec-private-key\",\n      title: \"EC private key (PEM)\",\n      description: \"SEC1 EC private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"ECDSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.\",\n      remediation:\n        \"Migrate to ML-DSA (FIPS 204) for signatures or hybrid X25519MLKEM768 for key agreement; remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN DSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-dsa-private-key\",\n      title: \"DSA private key (PEM)\",\n      description: \"DSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"DSA\",\n      hndl: false,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.\",\n      remediation: \"Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).\",\n    },\n  },\n  {\n    re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-openssh-private-key\",\n      title: \"OpenSSH private key\",\n      description: \"OpenSSH private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.\",\n      remediation:\n        \"Rotate the key; plan migration to PQC-capable SSH (prefer the mlkem768x25519-sha256 KEX, OpenSSH 10's default since Apr 2025).\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,\n    meta: {\n      id: \"pem-pgp-private-key\",\n      title: \"PGP/GPG private key block\",\n      description: \"OpenPGP private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.\",\n      remediation: \"Rotate the key; track OpenPGP PQC drafts for migration.\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP MESSAGE-----/g,\n    meta: {\n      id: \"pem-pgp-message\",\n      title: \"PGP/GPG encrypted message\",\n      description: \"OpenPGP encrypted message block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).\",\n      remediation: \"Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-pkcs8-private-key\",\n      title: \"Private key (PKCS#8 PEM)\",\n      description: \"PKCS#8 private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.\",\n      remediation: \"Migrate to PQC keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN CERTIFICATE-----/g,\n    meta: {\n      id: \"pem-certificate\",\n      title: \"X.509 certificate (PEM)\",\n      description: \"X.509 certificate block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: \"Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.\",\n      remediation: \"Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:RSA )?PUBLIC KEY-----/g,\n    meta: {\n      id: \"pem-public-key\",\n      title: \"Classical public key (PEM)\",\n      description: \"SubjectPublicKeyInfo / PKCS#1 RSA public key block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded classical public key (RSA/EC/DSA); its key pair is not quantum-safe — forgeable signatures or classical key exchange.\",\n      remediation: \"Re-issue with PQC keys (ML-DSA / ML-KEM) as the ecosystem adopts them.\",\n    },\n  },\n  {\n    re: /-----BEGIN DH PARAMETERS-----/g,\n    meta: {\n      id: \"pem-dh-parameters\",\n      title: \"Diffie-Hellman parameters (PEM)\",\n      description: \"Finite-field DH group parameters block\",\n      category: \"key-exchange\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"DH\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded finite-field Diffie-Hellman parameters; classical DH key exchange is harvest-now-decrypt-later exposed.\",\n      remediation: \"Migrate key exchange to hybrid X25519MLKEM768 (ML-KEM-768).\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:NEW )?CERTIFICATE REQUEST-----/g,\n    meta: {\n      id: \"pem-cert-request\",\n      title: \"Certificate signing request (PEM)\",\n      description: \"PKCS#10 certificate request block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PKCS#10 CSR; carries a classical public key and will be signed with classical crypto.\",\n      remediation: \"Re-generate with PQC keys as PQC-capable CAs mature.\",\n    },\n  },\n];\n\n/**\n * True when what follows the begin marker looks like a REAL PEM block rather than a\n * `-----BEGIN …-----` header STRING LITERAL (as appears in PEM parsers, tests, and\n * i18n messages). `from` points just past the begin marker. Three accepting signals:\n *\n *  (a) a full LINE of base64 (≥24 chars, optional `=` padding) — real multi-line PEM\n *      bodies are line-wrapped base64; requiring the whole line to be base64 stops a\n *      long camelCase identifier on a code line from validating a bare header constant.\n *  (b) an ESCAPED-newline base64 run (`\\n<base64>`, a LITERAL backslash-n) — a key\n *      embedded in a single-line JSON/.env string (GCP service accounts, `PRIVATE_KEY=\n *      \"…\\n…\"`), whose body can run past the window before its `-----END`. The literal\n *      `\\n` escape distinguishes it from a source constant, which has a REAL newline.\n *  (c) a matching `-----END …-----` marker with NO double-quote between it and the\n *      begin marker. This admits short/placeholder bodies (`x`, `abc`, `MIIB` in tests)\n *      while rejecting a parser's PAIRED header/footer constants, whose intervening\n *      `\";` … `= \"` always contains a `\"` — a char a real PEM body never holds.\n */\nfunction hasBase64Body(content: string, from: number): boolean {\n  const window = content.slice(from, from + 800);\n  if (/^[ \\t]*[A-Za-z0-9+/]{24,}={0,2}[ \\t]*$/m.test(window)) return true;\n  if (/\\\\n[A-Za-z0-9+/]{24,}/.test(window)) return true;\n  const end = window.search(/-----END [A-Z0-9 ]+-----/);\n  return end >= 0 && !window.slice(0, end).includes('\"');\n}\n\n/** Detects PEM key/certificate material in arbitrary files. */\nexport const pemDetector: Detector = {\n  id: \"pem-material\",\n  description: \"PEM-encoded private keys and X.509 certificates in any file\",\n  scope: \"config\",\n  language: \"any\",\n  rules: PEM_RULES.map((r) => r.meta),\n  // Applies to every text file; the walker already filters out binaries.\n  appliesTo: () => true,\n  detect({ file, content }): Finding[] {\n    // Fast reject: only proceed if a PEM header is present at all.\n    if (!content.includes(\"-----BEGIN \")) return [];\n\n    const findings: Finding[] = [];\n    for (const rule of PEM_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        // Require an actual base64 body after the marker, so a bare\n        // `-----BEGIN RSA PRIVATE KEY-----` string literal in a PEM parser / test /\n        // i18n message does NOT get reported as an embedded key. A real PEM block has\n        // a run of base64 within the next few hundred chars.\n        if (!hasBase64Body(content, m.index + m[0].length)) return;\n        findings.push(\n          findingFromRule(rule.meta, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/php.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in PHP — one of the
+ * most-deployed backend languages, previously uncovered. Handles the three
+ * dominant crypto surfaces:
+ *
+ *  - **ext/openssl** — `openssl_pkey_new()` (classified by its
+ *    `OPENSSL_KEYTYPE_*` config, defaulting to RSA), `openssl_public_encrypt` /
+ *    `openssl_private_decrypt` / `openssl_seal` / `openssl_open` (RSA), and
+ *    `openssl_sign` / `openssl_verify`.
+ *  - **phpseclib3** — `RSA::createKey()` / `EC::createKey()` / `DSA::createKey()`.
+ *  - **libsodium** — `sodium_crypto_box`/`kx` keypairs (X25519) and
+ *    `sodium_crypto_sign` keypairs (Ed25519).
+ *
+ * Lexical, like the other packs; the `openssl_*` / `sodium_crypto_*` prefixes and
+ * `OPENSSL_KEYTYPE_*` constants are distinctive, so the false-positive rate is low.
+ *
+ * HNDL: RSA encryption and (EC/X)DH key agreement are harvest-now-decrypt-later
+ * exposed (hndl:true); ECDSA / DSA / Ed25519 signatures are hndl:false but
+ * forgeable. `openssl_pkey_new` EC and `EC::createKey` are ambiguous (feed BOTH
+ * ECDSA and ECDH), classified conservatively as key-exchange-capable (hndl:true).
+ */
+import type { Detector } from "../types.js";
+/** Detects classical asymmetric crypto in PHP (openssl, phpseclib, libsodium). */
+export declare const phpDetector: Detector;
+//# sourceMappingURL=php.d.ts.map

package/dist/detectors/php.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"php.d.ts","sourceRoot":"","sources":["../../src/detectors/php.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAyI/D,kFAAkF;AAClF,eAAO,MAAM,WAAW,EAAE,QAsEzB,CAAC"}

package/dist/detectors/php.js

@@ -0,0 +1,171 @@
+import { PHP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+const RE_PHP_PKEY_NEW = /\bopenssl_pkey_new\s*\(/g;
+// public_encrypt/private_decrypt (direct RSA) plus seal/open (RSA-envelope: seal
+// encrypts a random symmetric key under each recipient's RSA public key, open
+// decrypts it with the private key) — all RSA key transport, harvest-now exposed.
+const RE_PHP_RSA_CRYPT = /\bopenssl_(?:public_encrypt|private_decrypt|seal|open)\s*\(/g;
+const RE_PHP_SIGN = /\bopenssl_(?:sign|verify)\s*\(/g;
+// phpseclib3 factory methods. The class names are generic, so require `::createKey`.
+const RE_PHP_SECLIB = /\b(RSA|EC|DSA|DH)::createKey\s*\(/g;
+// libsodium X25519 (box / kx / scalarmult) and Ed25519 (sign) key pairs.
+const RE_PHP_SODIUM_X25519 = /\bsodium_crypto_(?:box|kx)_(?:seed_)?keypair\s*\(|\bsodium_crypto_scalarmult(?:_base)?\s*\(/g;
+// Also the explicit-algorithm variant sodium_crypto_sign_ed25519_keypair().
+const RE_PHP_SODIUM_ED25519 = /\bsodium_crypto_sign_(?:ed25519_|seed_)?keypair\s*\(/g;
+const HYBRID = "hybrid X25519MLKEM768 (ML-KEM-768) for key agreement; ML-DSA-65 (FIPS 204) to sign";
+const RULE_PHP_KEYGEN = {
+    id: "php-openssl-keygen",
+    title: "PHP openssl key generation",
+    description: "openssl_pkey_new (RSA/EC/DSA/DH, by OPENSSL_KEYTYPE_*)",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical key pair via PHP openssl_pkey_new — not quantum-safe.",
+};
+const RULE_PHP_RSA_CRYPT = {
+    id: "php-openssl-rsa-crypt",
+    title: "PHP openssl RSA public-key encryption",
+    description: "openssl_public_encrypt / openssl_private_decrypt / openssl_seal / openssl_open",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "RSA public-key encryption/decryption (PHP openssl) is harvest-now-decrypt-later exposed.",
+};
+const RULE_PHP_SIGN = {
+    id: "php-openssl-sign",
+    title: "PHP openssl signature",
+    description: "openssl_sign / openssl_verify",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "unknown",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical signature via PHP openssl (RSA/ECDSA/DSA) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_PHP_SECLIB = {
+    id: "php-phpseclib-keygen",
+    title: "PHP phpseclib key generation",
+    description: "phpseclib3 RSA/EC/DSA/DH ::createKey",
+    category: "kem",
+    severity: "high",
+    confidence: "medium",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical key pair via phpseclib3 (createKey) — not quantum-safe.",
+};
+const RULE_PHP_SODIUM_X25519 = {
+    id: "php-sodium-x25519",
+    title: "PHP libsodium X25519 key agreement",
+    description: "sodium_crypto_box/kx keypair + scalarmult",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "libsodium crypto_box/kx (PHP) uses X25519 key agreement — modern but classical, harvest-now-decrypt-later exposed.",
+};
+const RULE_PHP_SODIUM_ED25519 = {
+    id: "php-sodium-ed25519",
+    title: "PHP libsodium Ed25519 signature",
+    description: "sodium_crypto_sign keypair",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "libsodium crypto_sign (PHP) uses Ed25519 — classical and forgeable by a quantum attacker.",
+};
+/** phpseclib class name → its classification. */
+const SECLIB_INFO = {
+    RSA: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+    EC: {
+        algo: "ECDH",
+        cat: "key-exchange",
+        sev: "high",
+        hndl: true,
+        label: "EC (ECDSA/ECDH)",
+        remediation: HYBRID,
+    },
+    DSA: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+    DH: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+};
+/** Classify `openssl_pkey_new` by the `OPENSSL_KEYTYPE_*` constant in its config.
+ * The window is bounded to the current statement (up to the next `;`, capped at
+ * 300 chars) so it can't bleed into a following `openssl_pkey_new` call's key
+ * type. Defaults to RSA — openssl_pkey_new's own default private_key_type is RSA
+ * when none is given. */
+function classifyPkeyNew(content, index) {
+    const semi = content.indexOf(";", index);
+    const end = Math.min(index + 300, semi === -1 ? content.length : semi);
+    const w = content.slice(index, end);
+    if (/\bOPENSSL_KEYTYPE_EC\b/.test(w))
+        return SECLIB_INFO.EC;
+    if (/\bOPENSSL_KEYTYPE_DSA\b/.test(w))
+        return SECLIB_INFO.DSA;
+    if (/\bOPENSSL_KEYTYPE_DH\b/.test(w))
+        return SECLIB_INFO.DH;
+    return SECLIB_INFO.RSA;
+}
+/** Detects classical asymmetric crypto in PHP (openssl, phpseclib, libsodium). */
+export const phpDetector = {
+    id: "php-crypto",
+    description: "Classical asymmetric crypto in PHP (openssl, phpseclib3, libsodium)",
+    scope: "source",
+    language: "php",
+    rules: [
+        RULE_PHP_KEYGEN,
+        RULE_PHP_RSA_CRYPT,
+        RULE_PHP_SIGN,
+        RULE_PHP_SECLIB,
+        RULE_PHP_SODIUM_X25519,
+        RULE_PHP_SODIUM_ED25519,
+    ],
+    appliesTo: (f) => hasExtension(f, PHP_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, content, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        // openssl_pkey_new — one finding per call, classified by its key-type config.
+        eachMatch(RE_PHP_PKEY_NEW, content, (m) => {
+            const info = classifyPkeyNew(content, m.index);
+            findings.push(findingFromRule(RULE_PHP_KEYGEN, { file, content, index: m.index, matchLength: m[0].length }, {
+                title: `PHP openssl ${info.label} key generation`,
+                category: info.cat,
+                severity: info.sev,
+                algorithm: info.algo,
+                hndl: info.hndl,
+                message: `Generates a classical ${info.label} key pair via PHP openssl_pkey_new — not quantum-safe.`,
+                ...(info.remediation ? { remediation: info.remediation } : {}),
+            }));
+        });
+        add(RE_PHP_RSA_CRYPT, RULE_PHP_RSA_CRYPT);
+        add(RE_PHP_SIGN, RULE_PHP_SIGN);
+        // phpseclib3 ::createKey — classify by the class (RSA/EC/DSA/DH).
+        eachMatch(RE_PHP_SECLIB, content, (m) => {
+            const info = SECLIB_INFO[m[1]];
+            findings.push(findingFromRule(RULE_PHP_SECLIB, { file, content, index: m.index, matchLength: m[0].length }, {
+                title: `PHP phpseclib ${info.label} key generation`,
+                category: info.cat,
+                severity: info.sev,
+                algorithm: info.algo,
+                hndl: info.hndl,
+                message: `Generates a classical ${info.label} key pair via phpseclib3 createKey — not quantum-safe.`,
+                ...(info.remediation ? { remediation: info.remediation } : {}),
+            }));
+        });
+        add(RE_PHP_SODIUM_X25519, RULE_PHP_SODIUM_X25519);
+        add(RE_PHP_SODIUM_ED25519, RULE_PHP_SODIUM_ED25519);
+        return findings;
+    },
+};
+//# sourceMappingURL=php.js.map

package/dist/detectors/php.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"php.js","sourceRoot":"","sources":["../../src/detectors/php.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,iFAAiF;AACjF,8EAA8E;AAC9E,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,8DAA8D,CAAC;AACxF,MAAM,WAAW,GAAG,iCAAiC,CAAC;AACtD,qFAAqF;AACrF,MAAM,aAAa,GAAG,oCAAoC,CAAC;AAC3D,yEAAyE;AACzE,MAAM,oBAAoB,GACxB,8FAA8F,CAAC;AACjG,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,uDAAuD,CAAC;AAWtF,MAAM,MAAM,GAAG,oFAAoF,CAAC;AAEpG,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,wDAAwD;IACrE,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,6EAA6E;CACvF,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,uBAAuB;IAC3B,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,gFAAgF;IAC7F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0FAA0F;CAC7F,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,+BAA+B;IAC5C,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yFAAyF;IAC3F,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,sCAAsC;IACnD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,+EAA+E;CACzF,CAAC;AACF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EAAE,2CAA2C;IACxD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,oHAAoH;CACvH,CAAC;AACF,MAAM,uBAAuB,GAAa;IACxC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,iCAAiC;IACxC,WAAW,EAAE,4BAA4B;IACzC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2FAA2F;CAC9F,CAAC;AAEF,iDAAiD;AACjD,MAAM,WAAW,GAA4B;IAC3C,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;IACvE,EAAE,EAAE;QACF,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,MAAM;KACpB;IACD,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;IAC9E,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE;CAC1F,CAAC;AAEF;;;;yBAIyB;AACzB,SAAS,eAAe,CAAC,OAAe,EAAE,KAAa;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC;IAC5D,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC;IAC9D,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC;IAC5D,OAAO,WAAW,CAAC,GAAG,CAAC;AACzB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,YAAY;IAChB,WAAW,EAAE,qEAAqE;IAClF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE;QACL,eAAe;QACf,kBAAkB;QAClB,aAAa;QACb,eAAe;QACf,sBAAsB;QACtB,uBAAuB;KACxB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IACjD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAQ,EAAE,CAC/C,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,8EAA8E;QAC9E,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,eAAe,EACf,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,eAAe,IAAI,CAAC,KAAK,iBAAiB;gBACjD,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,yBAAyB,IAAI,CAAC,KAAK,wDAAwD;gBACpG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEhC,kEAAkE;QAClE,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,eAAe,EACf,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,iBAAiB,IAAI,CAAC,KAAK,iBAAiB;gBACnD,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,yBAAyB,IAAI,CAAC,KAAK,wDAAwD;gBACpG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;QAClD,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source-code detector for classical asymmetric cryptography in PHP — one of the\n * most-deployed backend languages, previously uncovered. Handles the three\n * dominant crypto surfaces:\n *\n *  - **ext/openssl** — `openssl_pkey_new()` (classified by its\n *    `OPENSSL_KEYTYPE_*` config, defaulting to RSA), `openssl_public_encrypt` /\n *    `openssl_private_decrypt` / `openssl_seal` / `openssl_open` (RSA), and\n *    `openssl_sign` / `openssl_verify`.\n *  - **phpseclib3** — `RSA::createKey()` / `EC::createKey()` / `DSA::createKey()`.\n *  - **libsodium** — `sodium_crypto_box`/`kx` keypairs (X25519) and\n *    `sodium_crypto_sign` keypairs (Ed25519).\n *\n * Lexical, like the other packs; the `openssl_*` / `sodium_crypto_*` prefixes and\n * `OPENSSL_KEYTYPE_*` constants are distinctive, so the false-positive rate is low.\n *\n * HNDL: RSA encryption and (EC/X)DH key agreement are harvest-now-decrypt-later\n * exposed (hndl:true); ECDSA / DSA / Ed25519 signatures are hndl:false but\n * forgeable. `openssl_pkey_new` EC and `EC::createKey` are ambiguous (feed BOTH\n * ECDSA and ECDH), classified conservatively as key-exchange-capable (hndl:true).\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { PHP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\nconst RE_PHP_PKEY_NEW = /\\bopenssl_pkey_new\\s*\\(/g;\n// public_encrypt/private_decrypt (direct RSA) plus seal/open (RSA-envelope: seal\n// encrypts a random symmetric key under each recipient's RSA public key, open\n// decrypts it with the private key) — all RSA key transport, harvest-now exposed.\nconst RE_PHP_RSA_CRYPT = /\\bopenssl_(?:public_encrypt|private_decrypt|seal|open)\\s*\\(/g;\nconst RE_PHP_SIGN = /\\bopenssl_(?:sign|verify)\\s*\\(/g;\n// phpseclib3 factory methods. The class names are generic, so require `::createKey`.\nconst RE_PHP_SECLIB = /\\b(RSA|EC|DSA|DH)::createKey\\s*\\(/g;\n// libsodium X25519 (box / kx / scalarmult) and Ed25519 (sign) key pairs.\nconst RE_PHP_SODIUM_X25519 =\n  /\\bsodium_crypto_(?:box|kx)_(?:seed_)?keypair\\s*\\(|\\bsodium_crypto_scalarmult(?:_base)?\\s*\\(/g;\n// Also the explicit-algorithm variant sodium_crypto_sign_ed25519_keypair().\nconst RE_PHP_SODIUM_ED25519 = /\\bsodium_crypto_sign_(?:ed25519_|seed_)?keypair\\s*\\(/g;\n\n/** Key-type classification for `openssl_pkey_new`, keyed by its config constant. */\ninterface KeyInfo {\n  algo: Finding[\"algorithm\"];\n  cat: Finding[\"category\"];\n  sev: Finding[\"severity\"];\n  hndl: boolean;\n  label: string;\n  remediation?: string;\n}\nconst HYBRID = \"hybrid X25519MLKEM768 (ML-KEM-768) for key agreement; ML-DSA-65 (FIPS 204) to sign\";\n\nconst RULE_PHP_KEYGEN: RuleMeta = {\n  id: \"php-openssl-keygen\",\n  title: \"PHP openssl key generation\",\n  description: \"openssl_pkey_new (RSA/EC/DSA/DH, by OPENSSL_KEYTYPE_*)\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Generates a classical key pair via PHP openssl_pkey_new — not quantum-safe.\",\n};\nconst RULE_PHP_RSA_CRYPT: RuleMeta = {\n  id: \"php-openssl-rsa-crypt\",\n  title: \"PHP openssl RSA public-key encryption\",\n  description: \"openssl_public_encrypt / openssl_private_decrypt / openssl_seal / openssl_open\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"RSA public-key encryption/decryption (PHP openssl) is harvest-now-decrypt-later exposed.\",\n};\nconst RULE_PHP_SIGN: RuleMeta = {\n  id: \"php-openssl-sign\",\n  title: \"PHP openssl signature\",\n  description: \"openssl_sign / openssl_verify\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical signature via PHP openssl (RSA/ECDSA/DSA) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_PHP_SECLIB: RuleMeta = {\n  id: \"php-phpseclib-keygen\",\n  title: \"PHP phpseclib key generation\",\n  description: \"phpseclib3 RSA/EC/DSA/DH ::createKey\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Generates a classical key pair via phpseclib3 (createKey) — not quantum-safe.\",\n};\nconst RULE_PHP_SODIUM_X25519: RuleMeta = {\n  id: \"php-sodium-x25519\",\n  title: \"PHP libsodium X25519 key agreement\",\n  description: \"sodium_crypto_box/kx keypair + scalarmult\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"libsodium crypto_box/kx (PHP) uses X25519 key agreement — modern but classical, harvest-now-decrypt-later exposed.\",\n};\nconst RULE_PHP_SODIUM_ED25519: RuleMeta = {\n  id: \"php-sodium-ed25519\",\n  title: \"PHP libsodium Ed25519 signature\",\n  description: \"sodium_crypto_sign keypair\",\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"libsodium crypto_sign (PHP) uses Ed25519 — classical and forgeable by a quantum attacker.\",\n};\n\n/** phpseclib class name → its classification. */\nconst SECLIB_INFO: Record<string, KeyInfo> = {\n  RSA: { algo: \"RSA\", cat: \"kem\", sev: \"high\", hndl: true, label: \"RSA\" },\n  EC: {\n    algo: \"ECDH\",\n    cat: \"key-exchange\",\n    sev: \"high\",\n    hndl: true,\n    label: \"EC (ECDSA/ECDH)\",\n    remediation: HYBRID,\n  },\n  DSA: { algo: \"DSA\", cat: \"signature\", sev: \"high\", hndl: false, label: \"DSA\" },\n  DH: { algo: \"DH\", cat: \"key-exchange\", sev: \"high\", hndl: true, label: \"Diffie-Hellman\" },\n};\n\n/** Classify `openssl_pkey_new` by the `OPENSSL_KEYTYPE_*` constant in its config.\n * The window is bounded to the current statement (up to the next `;`, capped at\n * 300 chars) so it can't bleed into a following `openssl_pkey_new` call's key\n * type. Defaults to RSA — openssl_pkey_new's own default private_key_type is RSA\n * when none is given. */\nfunction classifyPkeyNew(content: string, index: number): KeyInfo {\n  const semi = content.indexOf(\";\", index);\n  const end = Math.min(index + 300, semi === -1 ? content.length : semi);\n  const w = content.slice(index, end);\n  if (/\\bOPENSSL_KEYTYPE_EC\\b/.test(w)) return SECLIB_INFO.EC;\n  if (/\\bOPENSSL_KEYTYPE_DSA\\b/.test(w)) return SECLIB_INFO.DSA;\n  if (/\\bOPENSSL_KEYTYPE_DH\\b/.test(w)) return SECLIB_INFO.DH;\n  return SECLIB_INFO.RSA;\n}\n\n/** Detects classical asymmetric crypto in PHP (openssl, phpseclib, libsodium). */\nexport const phpDetector: Detector = {\n  id: \"php-crypto\",\n  description: \"Classical asymmetric crypto in PHP (openssl, phpseclib3, libsodium)\",\n  scope: \"source\",\n  language: \"php\",\n  rules: [\n    RULE_PHP_KEYGEN,\n    RULE_PHP_RSA_CRYPT,\n    RULE_PHP_SIGN,\n    RULE_PHP_SECLIB,\n    RULE_PHP_SODIUM_X25519,\n    RULE_PHP_SODIUM_ED25519,\n  ],\n  appliesTo: (f) => hasExtension(f, PHP_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta): void =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n\n    // openssl_pkey_new — one finding per call, classified by its key-type config.\n    eachMatch(RE_PHP_PKEY_NEW, content, (m) => {\n      const info = classifyPkeyNew(content, m.index);\n      findings.push(\n        findingFromRule(\n          RULE_PHP_KEYGEN,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `PHP openssl ${info.label} key generation`,\n            category: info.cat,\n            severity: info.sev,\n            algorithm: info.algo,\n            hndl: info.hndl,\n            message: `Generates a classical ${info.label} key pair via PHP openssl_pkey_new — not quantum-safe.`,\n            ...(info.remediation ? { remediation: info.remediation } : {}),\n          },\n        ),\n      );\n    });\n\n    add(RE_PHP_RSA_CRYPT, RULE_PHP_RSA_CRYPT);\n    add(RE_PHP_SIGN, RULE_PHP_SIGN);\n\n    // phpseclib3 ::createKey — classify by the class (RSA/EC/DSA/DH).\n    eachMatch(RE_PHP_SECLIB, content, (m) => {\n      const info = SECLIB_INFO[m[1]];\n      findings.push(\n        findingFromRule(\n          RULE_PHP_SECLIB,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `PHP phpseclib ${info.label} key generation`,\n            category: info.cat,\n            severity: info.sev,\n            algorithm: info.algo,\n            hndl: info.hndl,\n            message: `Generates a classical ${info.label} key pair via phpseclib3 createKey — not quantum-safe.`,\n            ...(info.remediation ? { remediation: info.remediation } : {}),\n          },\n        ),\n      );\n    });\n\n    add(RE_PHP_SODIUM_X25519, RULE_PHP_SODIUM_X25519);\n    add(RE_PHP_SODIUM_ED25519, RULE_PHP_SODIUM_ED25519);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/pkcs11.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Config detector: classical asymmetric keys held in / generated by a PKCS#11 HSM
+ * or token. HSMs hold an organization's longest-lived roots (CA keys, code-signing
+ * keys), so they are exactly the keys a PQC migration must find first — yet they
+ * live behind a PKCS#11 layer the source packs never see.
+ *
+ * Covered, distinctive lexical surfaces:
+ *  - `pkcs11-tool --keypairgen --key-type rsa:2048 | EC:secp256r1` — the standard
+ *    OpenSC keygen invocation recorded in ops scripts / runbooks.
+ *  - `CKM_RSA_PKCS(_KEY_PAIR_GEN|_OAEP|_PSS)` / `CKM_EC(DSA|DH)` / `CKM_DSA` — the
+ *    PKCS#11 mechanism constants (SoftHSM, SunPKCS11, pkcs11js, python-pkcs11), which
+ *    name the exact algorithm.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical asymmetric keys behind a PKCS#11 HSM / token. */
+export declare const pkcs11Detector: Detector;
+//# sourceMappingURL=pkcs11.d.ts.map

package/dist/detectors/pkcs11.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkcs11.d.ts","sourceRoot":"","sources":["../../src/detectors/pkcs11.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAuE/D,sEAAsE;AACtE,eAAO,MAAM,cAAc,EAAE,QA2B5B,CAAC"}

package/dist/detectors/pkcs11.js

@@ -0,0 +1,87 @@
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+// `pkcs11-tool --keypairgen --key-type rsa:2048` / `EC:secp256r1` (OpenSC).
+const RE_PKCS11_TOOL_RSA = /--key-type\s+rsa:\d+/gi;
+const RE_PKCS11_TOOL_EC = /--key-type\s+EC:[A-Za-z0-9]+/gi;
+// PKCS#11 mechanism constants (CKM_*), which name the algorithm exactly.
+const RE_CKM_RSA = /\bCKM_RSA_(?:PKCS(?:_KEY_PAIR_GEN|_OAEP|_PSS)?|X_509|9796)\b/g;
+const RE_CKM_EC = /\bCKM_EC(?:DSA(?:_SHA\d+)?|DH1?_DERIVE|_KEY_PAIR_GEN)\b/g;
+const RE_CKM_DSA = /\bCKM_DSA(?:_SHA\d+|_KEY_PAIR_GEN)?\b/g;
+const RE_CKM_DH = /\bCKM_DH_PKCS_(?:KEY_PAIR_GEN|DERIVE)\b/g;
+const RULE_PKCS11_RSA = {
+    id: "pkcs11-rsa",
+    title: "PKCS#11 (HSM) RSA key",
+    description: "PKCS#11 RSA key generation / mechanism (pkcs11-tool, CKM_RSA_*)",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "A classical RSA key in a PKCS#11 HSM / token — likely a long-lived root (CA / code-signing), and not quantum-safe.",
+    remediation: "Inventory HSM-held RSA keys first (longest-lived); plan re-keying to PQC (ML-KEM-768 / ML-DSA-65) as HSM firmware adds support.",
+};
+const RULE_PKCS11_EC = {
+    id: "pkcs11-ec",
+    title: "PKCS#11 (HSM) EC key",
+    description: "PKCS#11 EC key generation / mechanism (CKM_EC*, --key-type EC)",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "A classical EC key in a PKCS#11 HSM / token; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204). Prioritise HSM-held keys.",
+};
+const RULE_PKCS11_DSA = {
+    id: "pkcs11-dsa",
+    title: "PKCS#11 (HSM) DSA key",
+    description: "PKCS#11 DSA key generation / mechanism (CKM_DSA*)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "DSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "A classical DSA key in a PKCS#11 HSM / token — deprecated and quantum-forgeable.",
+    remediation: "Rotate off DSA; migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_PKCS11_DH = {
+    id: "pkcs11-dh",
+    title: "PKCS#11 (HSM) Diffie-Hellman",
+    description: "PKCS#11 finite-field DH key generation / derive (CKM_DH_PKCS_*)",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "DH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Finite-field Diffie-Hellman in a PKCS#11 HSM / token; classical key agreement, harvest-now-decrypt-later exposed.",
+    remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).",
+};
+/** Detects classical asymmetric keys behind a PKCS#11 HSM / token. */
+export const pkcs11Detector = {
+    id: "pkcs11-crypto",
+    description: "Classical asymmetric keys in a PKCS#11 HSM / token",
+    scope: "config",
+    language: "any",
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    rules: [RULE_PKCS11_RSA, RULE_PKCS11_EC, RULE_PKCS11_DSA, RULE_PKCS11_DH],
+    detect({ file, content }) {
+        // Fast reject: only proceed on a distinctive PKCS#11 marker.
+        if (!content.includes("CKM_") && !content.includes("--key-type")) {
+            return [];
+        }
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, content, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        add(RE_PKCS11_TOOL_RSA, RULE_PKCS11_RSA);
+        add(RE_PKCS11_TOOL_EC, RULE_PKCS11_EC);
+        add(RE_CKM_RSA, RULE_PKCS11_RSA);
+        add(RE_CKM_EC, RULE_PKCS11_EC);
+        add(RE_CKM_DSA, RULE_PKCS11_DSA);
+        add(RE_CKM_DH, RULE_PKCS11_DH);
+        return findings;
+    },
+};
+//# sourceMappingURL=pkcs11.js.map

package/dist/detectors/pkcs11.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkcs11.js","sourceRoot":"","sources":["../../src/detectors/pkcs11.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AACpD,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAC3D,yEAAyE;AACzE,MAAM,UAAU,GAAG,+DAA+D,CAAC;AACnF,MAAM,SAAS,GAAG,0DAA0D,CAAC;AAC7E,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAC5D,MAAM,SAAS,GAAG,0CAA0C,CAAC;AAE7D,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,iEAAiE;IAC9E,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,oHAAoH;IACtH,WAAW,EACT,iIAAiI;CACpI,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,gEAAgE;IAC7E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yJAAyJ;IAC3J,WAAW,EACT,wHAAwH;CAC3H,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,mDAAmD;IAChE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,kFAAkF;IAC3F,WAAW,EAAE,kDAAkD;CAChE,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,iEAAiE;IAC9E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mHAAmH;IACrH,WAAW,EAAE,8DAA8D;CAC5E,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,oDAAoD;IACjE,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,KAAK,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC;IACzE,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,6DAA6D;QAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAQ,EAAE,CAC/C,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACzC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;QACvC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACjC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAC/B,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACjC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical asymmetric keys held in / generated by a PKCS#11 HSM\n * or token. HSMs hold an organization's longest-lived roots (CA keys, code-signing\n * keys), so they are exactly the keys a PQC migration must find first — yet they\n * live behind a PKCS#11 layer the source packs never see.\n *\n * Covered, distinctive lexical surfaces:\n *  - `pkcs11-tool --keypairgen --key-type rsa:2048 | EC:secp256r1` — the standard\n *    OpenSC keygen invocation recorded in ops scripts / runbooks.\n *  - `CKM_RSA_PKCS(_KEY_PAIR_GEN|_OAEP|_PSS)` / `CKM_EC(DSA|DH)` / `CKM_DSA` — the\n *    PKCS#11 mechanism constants (SoftHSM, SunPKCS11, pkcs11js, python-pkcs11), which\n *    name the exact algorithm.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// `pkcs11-tool --keypairgen --key-type rsa:2048` / `EC:secp256r1` (OpenSC).\nconst RE_PKCS11_TOOL_RSA = /--key-type\\s+rsa:\\d+/gi;\nconst RE_PKCS11_TOOL_EC = /--key-type\\s+EC:[A-Za-z0-9]+/gi;\n// PKCS#11 mechanism constants (CKM_*), which name the algorithm exactly.\nconst RE_CKM_RSA = /\\bCKM_RSA_(?:PKCS(?:_KEY_PAIR_GEN|_OAEP|_PSS)?|X_509|9796)\\b/g;\nconst RE_CKM_EC = /\\bCKM_EC(?:DSA(?:_SHA\\d+)?|DH1?_DERIVE|_KEY_PAIR_GEN)\\b/g;\nconst RE_CKM_DSA = /\\bCKM_DSA(?:_SHA\\d+|_KEY_PAIR_GEN)?\\b/g;\nconst RE_CKM_DH = /\\bCKM_DH_PKCS_(?:KEY_PAIR_GEN|DERIVE)\\b/g;\n\nconst RULE_PKCS11_RSA: RuleMeta = {\n  id: \"pkcs11-rsa\",\n  title: \"PKCS#11 (HSM) RSA key\",\n  description: \"PKCS#11 RSA key generation / mechanism (pkcs11-tool, CKM_RSA_*)\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"A classical RSA key in a PKCS#11 HSM / token — likely a long-lived root (CA / code-signing), and not quantum-safe.\",\n  remediation:\n    \"Inventory HSM-held RSA keys first (longest-lived); plan re-keying to PQC (ML-KEM-768 / ML-DSA-65) as HSM firmware adds support.\",\n};\nconst RULE_PKCS11_EC: RuleMeta = {\n  id: \"pkcs11-ec\",\n  title: \"PKCS#11 (HSM) EC key\",\n  description: \"PKCS#11 EC key generation / mechanism (CKM_EC*, --key-type EC)\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"A classical EC key in a PKCS#11 HSM / token; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204). Prioritise HSM-held keys.\",\n};\nconst RULE_PKCS11_DSA: RuleMeta = {\n  id: \"pkcs11-dsa\",\n  title: \"PKCS#11 (HSM) DSA key\",\n  description: \"PKCS#11 DSA key generation / mechanism (CKM_DSA*)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"A classical DSA key in a PKCS#11 HSM / token — deprecated and quantum-forgeable.\",\n  remediation: \"Rotate off DSA; migrate to ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_PKCS11_DH: RuleMeta = {\n  id: \"pkcs11-dh\",\n  title: \"PKCS#11 (HSM) Diffie-Hellman\",\n  description: \"PKCS#11 finite-field DH key generation / derive (CKM_DH_PKCS_*)\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman in a PKCS#11 HSM / token; classical key agreement, harvest-now-decrypt-later exposed.\",\n  remediation: \"Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).\",\n};\n\n/** Detects classical asymmetric keys behind a PKCS#11 HSM / token. */\nexport const pkcs11Detector: Detector = {\n  id: \"pkcs11-crypto\",\n  description: \"Classical asymmetric keys in a PKCS#11 HSM / token\",\n  scope: \"config\",\n  language: \"any\",\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  rules: [RULE_PKCS11_RSA, RULE_PKCS11_EC, RULE_PKCS11_DSA, RULE_PKCS11_DH],\n  detect({ file, content }): Finding[] {\n    // Fast reject: only proceed on a distinctive PKCS#11 marker.\n    if (!content.includes(\"CKM_\") && !content.includes(\"--key-type\")) {\n      return [];\n    }\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta): void =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    add(RE_PKCS11_TOOL_RSA, RULE_PKCS11_RSA);\n    add(RE_PKCS11_TOOL_EC, RULE_PKCS11_EC);\n    add(RE_CKM_RSA, RULE_PKCS11_RSA);\n    add(RE_CKM_EC, RULE_PKCS11_EC);\n    add(RE_CKM_DSA, RULE_PKCS11_DSA);\n    add(RE_CKM_DH, RULE_PKCS11_DH);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/proxy.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Config detector: classical-certificate TLS termination in standalone
+ * reverse-proxy / load-balancer configuration and in-code gRPC channel
+ * credentials.
+ *
+ * A standalone Envoy, Nginx, HAProxy, Traefik, or Caddy config that terminates
+ * TLS with an RSA/ECDSA leaf certificate and negotiates an ECDHE key exchange is
+ * the canonical harvest-now-decrypt-later (HNDL) surface: an attacker who
+ * records today's handshake + ciphertext can decrypt it retroactively once a
+ * cryptographically-relevant quantum computer (CRQC) can break the ephemeral
+ * (EC)DHE secret. The Kubernetes / service-mesh detectors (`k8s.ts`, `mesh.ts`)
+ * cover the CLUSTER-managed cert + mesh-mTLS surfaces; the STANDALONE proxy
+ * config FILES and the in-code gRPC credential constructors below are seen by
+ * neither them nor the language packs, so they are covered here.
+ *
+ * Because the config token itself does not name the cert's key algorithm (the
+ * key lives in a referenced PEM file, out of band), these findings use
+ * `algorithm: "unknown"` — the evidence is "a classical-cert TLS channel is
+ * configured HERE", not a specific family. They are `category: "key-exchange"`
+ * (the ECDHE handshake is the harvestable primitive) and `hndl: true`.
+ * Confidence is `medium`: a config-level indicator of a classical TLS channel,
+ * not a matched algorithm string.
+ *
+ * PRECISION / fast-reject: several of the matched tokens (`ssl_certificate`,
+ * `private_key:`, `certificates:`) are generic enough to appear in unrelated
+ * YAML/config, so `detect()` bails unless the file carries a distinctive
+ * proxy/gRPC marker (see `hasProxyMarker`). This keeps a random YAML that merely
+ * has a `private_key:` key, or a Traefik-shaped `certificates:` list that isn't
+ * a Traefik config, from firing. Comments are masked (YAML/nginx/HCL `#`, plus
+ * `//` and C-style `/* … *\/` blocks) so a commented-out directive can't fire.
+ *
+ * Covered surfaces:
+ *  - Envoy   — `common_tls_context:` / `DownstreamTlsContext` /
+ *              `UpstreamTlsContext` with `tls_certificates:` carrying a
+ *              `certificate_chain:` + `private_key:` (and the
+ *              `envoy.transport_sockets.tls` transport socket).
+ *  - Nginx   — `ssl_certificate` + `ssl_certificate_key` directives.
+ *  - HAProxy — `bind … ssl crt …` lines and `crt-store` sections.
+ *  - Traefik — a `tls:` block's `certificates:` with `certFile:` + `keyFile:`
+ *              (dynamic config) or a `certResolver` (ACME) reference.
+ *  - gRPC    — in-code TLS channel credentials: `grpc.ssl_channel_credentials(`
+ *              (Python), `grpc.credentials.createSsl(` (Node),
+ *              `TlsChannelCredentials` (Java), `credentials.NewTLS(` (Go).
+ */
+import type { Detector } from "../types.js";
+/**
+ * Detects classical-cert TLS termination in standalone reverse-proxy /
+ * load-balancer config files and in-code gRPC channel credentials. See the
+ * module docstring for the covered surfaces and the fast-reject rationale.
+ */
+export declare const proxyDetector: Detector;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/detectors/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/detectors/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA2J/D;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,QA+B3B,CAAC"}