@securecode-ai/mcp 0.1.0 → 0.2.0

package/dist/project-map/guardPatterns.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Phase E — guard pattern library.
+ *
+ * Maps guard types to the attacks they do and don't stop. The guard
+ * evaluator uses this to answer "does this guard actually defend against
+ * this attack?" — a question the Juror would otherwise have to guess at.
+ *
+ * The patterns are conservative: when we can't determine effectiveness, we
+ * return `unknown` rather than `effective` (a false "effective" is far more
+ * dangerous than a false "unknown" — it would let the Juror mark a real
+ * vulnerability as SAFE).
+ */
+/** Attack types that guards are evaluated against (matches canonical vuln types). */
+export type AttackType = 'sql_injection' | 'nosql_injection' | 'command_injection' | 'xss' | 'ssrf' | 'path_traversal' | 'open_redirect' | 'prototype_pollution' | 'insecure_deserialization' | 'broken_access_control';
+/** Guard types we can identify and evaluate. */
+export type GuardType = 'sanitizer-numeric' | 'sanitizer-html' | 'sanitizer-url' | 'parameterized-query' | 'allowlist-literal' | 'allowlist-dynamic' | 'auth-jwt-verify' | 'auth-jwt-verify-noalg' | 'auth-session' | 'auth-api-key' | 'auth-none' | 'rate-limit' | 'helmet' | 'cors-strict' | 'cors-permissive' | 'validator' | 'unknown';
+export interface GuardEvaluation {
+    /** The guard's display name. */
+    guardName: string;
+    /** Type of guard identified. */
+    guardType: GuardType;
+    /** The attack type being evaluated against. */
+    attackType: AttackType;
+    /** Does this guard stop this attack? */
+    effective: boolean;
+    /** Why it is or isn't effective. */
+    reason: string;
+    /** Example bypass when not effective. */
+    bypassExample?: string;
+}
+/**
+ * Pattern: which GuardType stops which AttackType.
+ *
+ * `true` = effective, `false` = NOT effective, `undefined` = unknown.
+ * When unknown, the evaluator returns `effective: false` with a reason
+ * explaining the guard was detected but its effectiveness against this
+ * attack is not determinable.
+ */
+export declare const GUARD_EFFECTIVENESS: Record<GuardType, Partial<Record<AttackType, boolean>>>;
+/** Bypass examples for known ineffective guard×attack pairs. */
+export declare const GUARD_BYPASS_EXAMPLES: Partial<Record<GuardType, Partial<Record<AttackType, string>>>>;
+/** Reasons explaining why a guard is effective. */
+export declare const GUARD_EFFECTIVE_REASONS: Partial<Record<GuardType, Partial<Record<AttackType, string>>>>;

package/dist/project-map/guardPatterns.js

@@ -0,0 +1,173 @@
+"use strict";
+/**
+ * Phase E — guard pattern library.
+ *
+ * Maps guard types to the attacks they do and don't stop. The guard
+ * evaluator uses this to answer "does this guard actually defend against
+ * this attack?" — a question the Juror would otherwise have to guess at.
+ *
+ * The patterns are conservative: when we can't determine effectiveness, we
+ * return `unknown` rather than `effective` (a false "effective" is far more
+ * dangerous than a false "unknown" — it would let the Juror mark a real
+ * vulnerability as SAFE).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GUARD_EFFECTIVE_REASONS = exports.GUARD_BYPASS_EXAMPLES = exports.GUARD_EFFECTIVENESS = void 0;
+/**
+ * Pattern: which GuardType stops which AttackType.
+ *
+ * `true` = effective, `false` = NOT effective, `undefined` = unknown.
+ * When unknown, the evaluator returns `effective: false` with a reason
+ * explaining the guard was detected but its effectiveness against this
+ * attack is not determinable.
+ */
+exports.GUARD_EFFECTIVENESS = {
+    'sanitizer-numeric': {
+        sql_injection: true, // numbers can't carry SQL syntax
+        nosql_injection: true, // numbers can't carry NoSQL operators
+        command_injection: true, // numbers can't carry shell metachars
+        xss: true, // numbers can't carry script tags
+        open_redirect: true, // numbers can't be URLs
+        path_traversal: true, // numbers can't carry ../
+        ssrf: true, // numbers can't be URLs
+        prototype_pollution: true, // numbers can't carry __proto__
+    },
+    'sanitizer-html': {
+        xss: true, // HTML escaping stops XSS
+        sql_injection: false, // HTML escaping does NOT stop SQLi
+        command_injection: false,
+        open_redirect: false,
+        path_traversal: false,
+        ssrf: false,
+        prototype_pollution: false,
+    },
+    'sanitizer-url': {
+        open_redirect: true, // URL encoding stops redirect injection
+        xss: false, // URL encoding does NOT stop XSS
+        sql_injection: false,
+        command_injection: false,
+        ssrf: true, // URL encoding limits SSRF target manipulation
+        path_traversal: false,
+    },
+    'parameterized-query': {
+        sql_injection: true, // parameterized queries stop SQLi
+        nosql_injection: false,
+        command_injection: false,
+        xss: false,
+    },
+    'allowlist-literal': {
+        sql_injection: true,
+        nosql_injection: true,
+        command_injection: true,
+        xss: true,
+        open_redirect: true,
+        path_traversal: true,
+        ssrf: true,
+        prototype_pollution: true,
+    },
+    'allowlist-dynamic': {
+        // An allowlist with a user-controlled key is NOT effective against anything
+        sql_injection: false,
+        nosql_injection: false,
+        command_injection: false,
+        xss: false,
+        open_redirect: false,
+        path_traversal: false,
+        ssrf: false,
+    },
+    'auth-jwt-verify': {
+        broken_access_control: true, // verified JWT = authenticated
+    },
+    'auth-jwt-verify-noalg': {
+        broken_access_control: false, // algorithm confusion bypass
+    },
+    'auth-session': {
+        broken_access_control: true,
+    },
+    'auth-api-key': {
+        broken_access_control: true,
+    },
+    'auth-none': {
+        broken_access_control: false,
+    },
+    'rate-limit': {
+        // Rate limiting stops brute force but not the vuln types in our taxonomy
+        broken_access_control: false,
+    },
+    'helmet': {
+        xss: false, // helmet sets headers, doesn't sanitize output
+        ssrf: false,
+    },
+    'cors-strict': {
+    // CORS strict doesn't stop any server-side vuln
+    },
+    'cors-permissive': {
+        broken_access_control: false,
+    },
+    'validator': {
+        // Schema validation (zod/joi/pydantic) is effective when the schema
+        // constrains the type (e.g. z.number() stops SQLi). Without seeing
+        // the schema, we can't say — return unknown (false + reason).
+        sql_injection: false,
+        xss: false,
+    },
+    'unknown': {},
+};
+/** Bypass examples for known ineffective guard×attack pairs. */
+exports.GUARD_BYPASS_EXAMPLES = {
+    'sanitizer-html': {
+        sql_injection: "escapeHtml doesn't stop SQLi: q' OR 1=1-- is valid HTML",
+        command_injection: "escapeHtml doesn't stop cmd injection: ; cat /etc/passwd",
+    },
+    'sanitizer-url': {
+        xss: "encodeURIComponent doesn't stop XSS: <script> stays as %3Cscript%3E (decodes in HTML)",
+    },
+    'sanitizer-numeric': {
+        insecure_deserialization: "parseInt doesn't validate serialized objects",
+    },
+    'auth-jwt-verify-noalg': {
+        broken_access_control: "Algorithm confusion: sign with HS256 using the public RSA key as the secret",
+    },
+    'allowlist-dynamic': {
+        sql_injection: "User-controlled allowlist key: attacker sets key to their payload",
+        xss: "User-controlled allowlist key: attacker sets key to <script>",
+    },
+    'rate-limit': {
+        broken_access_control: "Rate limiting slows brute force but doesn't stop auth bypass",
+    },
+    'helmet': {
+        xss: "helmet sets CSP/X-Frame-Options but doesn't sanitize response body content",
+    },
+    'cors-permissive': {
+        broken_access_control: "CORS origin:'*' allows any origin to read responses",
+    },
+    'validator': {
+        sql_injection: "Schema validation only stops SQLi if the schema enforces numeric/enum type",
+        xss: "Schema validation only stops XSS if the schema enforces no HTML or sanitizes",
+    },
+};
+/** Reasons explaining why a guard is effective. */
+exports.GUARD_EFFECTIVE_REASONS = {
+    'sanitizer-numeric': {
+        sql_injection: 'parseInt/Number produces a numeric value — no SQL syntax can survive',
+        xss: 'parseInt/Number produces a numeric value — no script tags can survive',
+        command_injection: 'parseInt/Number produces a numeric value — no shell metacharacters',
+    },
+    'sanitizer-html': {
+        xss: 'HTML escaping escapes <, >, ", \', & — prevents script injection',
+    },
+    'parameterized-query': {
+        sql_injection: 'Parameterized queries separate code from data — injection impossible',
+    },
+    'allowlist-literal': {
+        sql_injection: 'Literal allowlist rejects any value not in the set',
+        xss: 'Literal allowlist rejects any value not in the set',
+    },
+    'auth-jwt-verify': {
+        broken_access_control: 'jwt.verify with algorithm pinning rejects forged tokens',
+    },
+    'auth-session': {
+        broken_access_control: 'Session check rejects unauthenticated requests',
+    },
+};
+//# sourceMappingURL=guardPatterns.js.map

package/dist/project-map/guardPatterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardPatterns.js","sourceRoot":"","sources":["../../src/project-map/guardPatterns.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAkDH;;;;;;;GAOG;AACU,QAAA,mBAAmB,GAA4D;IACxF,mBAAmB,EAAE;QACjB,aAAa,EAAE,IAAI,EAAQ,iCAAiC;QAC5D,eAAe,EAAE,IAAI,EAAM,sCAAsC;QACjE,iBAAiB,EAAE,IAAI,EAAI,sCAAsC;QACjE,GAAG,EAAE,IAAI,EAAkB,kCAAkC;QAC7D,aAAa,EAAE,IAAI,EAAQ,wBAAwB;QACnD,cAAc,EAAE,IAAI,EAAO,0BAA0B;QACrD,IAAI,EAAE,IAAI,EAAiB,wBAAwB;QACnD,mBAAmB,EAAE,IAAI,EAAE,gCAAgC;KAC9D;IACD,gBAAgB,EAAE;QACd,GAAG,EAAE,IAAI,EAAkB,0BAA0B;QACrD,aAAa,EAAE,KAAK,EAAO,mCAAmC;QAC9D,iBAAiB,EAAE,KAAK;QACxB,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,KAAK;QACrB,IAAI,EAAE,KAAK;QACX,mBAAmB,EAAE,KAAK;KAC7B;IACD,eAAe,EAAE;QACb,aAAa,EAAE,IAAI,EAAQ,wCAAwC;QACnE,GAAG,EAAE,KAAK,EAAkB,iCAAiC;QAC7D,aAAa,EAAE,KAAK;QACpB,iBAAiB,EAAE,KAAK;QACxB,IAAI,EAAE,IAAI,EAAkB,+CAA+C;QAC3E,cAAc,EAAE,KAAK;KACxB;IACD,qBAAqB,EAAE;QACnB,aAAa,EAAE,IAAI,EAAS,kCAAkC;QAC9D,eAAe,EAAE,KAAK;QACtB,iBAAiB,EAAE,KAAK;QACxB,GAAG,EAAE,KAAK;KACb;IACD,mBAAmB,EAAE;QACjB,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,IAAI;QACvB,GAAG,EAAE,IAAI;QACT,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI;QACpB,IAAI,EAAE,IAAI;QACV,mBAAmB,EAAE,IAAI;KAC5B;IACD,mBAAmB,EAAE;QACjB,4EAA4E;QAC5E,aAAa,EAAE,KAAK;QACpB,eAAe,EAAE,KAAK;QACtB,iBAAiB,EAAE,KAAK;QACxB,GAAG,EAAE,KAAK;QACV,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,KAAK;QACrB,IAAI,EAAE,KAAK;KACd;IACD,iBAAiB,EAAE;QACf,qBAAqB,EAAE,IAAI,EAAG,+BAA+B;KAChE;IACD,uBAAuB,EAAE;QACrB,qBAAqB,EAAE,KAAK,EAAG,6BAA6B;KAC/D;IACD,cAAc,EAAE;QACZ,qBAAqB,EAAE,IAAI;KAC9B;IACD,cAAc,EAAE;QACZ,qBAAqB,EAAE,IAAI;KAC9B;IACD,WAAW,EAAE;QACT,qBAAqB,EAAE,KAAK;KAC/B;IACD,YAAY,EAAE;QACV,yEAAyE;QACzE,qBAAqB,EAAE,KAAK;KAC/B;IACD,QAAQ,EAAE;QACN,GAAG,EAAE,KAAK,EAAe,+CAA+C;QACxE,IAAI,EAAE,KAAK;KACd;IACD,aAAa,EAAE;IACX,gDAAgD;KACnD;IACD,iBAAiB,EAAE;QACf,qBAAqB,EAAE,KAAK;KAC/B;IACD,WAAW,EAAE;QACT,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,aAAa,EAAE,KAAK;QACpB,GAAG,EAAE,KAAK;KACb;IACD,SAAS,EAAE,EAAE;CAChB,CAAC;AAEF,gEAAgE;AACnD,QAAA,qBAAqB,GAAoE;IAClG,gBAAgB,EAAE;QACd,aAAa,EAAE,yDAAyD;QACxE,iBAAiB,EAAE,0DAA0D;KAChF;IACD,eAAe,EAAE;QACb,GAAG,EAAE,uFAAuF;KAC/F;IACD,mBAAmB,EAAE;QACjB,wBAAwB,EAAE,8CAA8C;KAC3E;IACD,uBAAuB,EAAE;QACrB,qBAAqB,EAAE,6EAA6E;KACvG;IACD,mBAAmB,EAAE;QACjB,aAAa,EAAE,mEAAmE;QAClF,GAAG,EAAE,8DAA8D;KACtE;IACD,YAAY,EAAE;QACV,qBAAqB,EAAE,8DAA8D;KACxF;IACD,QAAQ,EAAE;QACN,GAAG,EAAE,4EAA4E;KACpF;IACD,iBAAiB,EAAE;QACf,qBAAqB,EAAE,qDAAqD;KAC/E;IACD,WAAW,EAAE;QACT,aAAa,EAAE,4EAA4E;QAC3F,GAAG,EAAE,8EAA8E;KACtF;CACJ,CAAC;AAEF,mDAAmD;AACtC,QAAA,uBAAuB,GAAoE;IACpG,mBAAmB,EAAE;QACjB,aAAa,EAAE,sEAAsE;QACrF,GAAG,EAAE,uEAAuE;QAC5E,iBAAiB,EAAE,oEAAoE;KAC1F;IACD,gBAAgB,EAAE;QACd,GAAG,EAAE,kEAAkE;KAC1E;IACD,qBAAqB,EAAE;QACnB,aAAa,EAAE,sEAAsE;KACxF;IACD,mBAAmB,EAAE;QACjB,aAAa,EAAE,oDAAoD;QACnE,GAAG,EAAE,oDAAoD;KAC5D;IACD,iBAAiB,EAAE;QACf,qBAAqB,EAAE,yDAAyD;KACnF;IACD,cAAc,EAAE;QACZ,qBAAqB,EAAE,gDAAgD;KAC1E;CACJ,CAAC"}

package/dist/project-map/sanitizers.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Phase C — sanitizer registry.
+ *
+ * Functions that remove taint from data. When the taint tracker encounters
+ * a call to a sanitizer, the result is NOT tainted (the sanitizer removes
+ * the taint). Note: `String()` alone does NOT remove taint — it's a type
+ * coercion, not a sanitizer.
+ */
+import type { SinkLanguage } from './sinkRegistry';
+export interface SanitizerDef {
+    /** Method name: 'parseInt', 'escape', 'sanitize', etc. */
+    method: string;
+    /** Optional receiver: 'DOMPurify' for DOMPurify.sanitize. */
+    receiver?: string;
+    languages: SinkLanguage[];
+}
+/**
+ * Known sanitizers. A call to any of these with a tainted argument produces
+ * a non-tainted result.
+ *
+ * Type coercions that reject non-numeric input (parseInt, parseFloat, Number)
+ * ARE sanitizers for SQL injection — the result is always a number.
+ * `String()` is NOT a sanitizer — it accepts anything.
+ */
+export declare const SANITIZERS: SanitizerDef[];
+/**
+ * Check if a call expression is a sanitizer call.
+ * Returns the sanitizer name, or null if not a sanitizer.
+ *
+ * @param method   the method name from callParts
+ * @param receiver the base identifier from callParts (or null for bare calls)
+ * @param language the source language
+ */
+export declare function matchSanitizer(method: string, receiver: string | null, language: SinkLanguage): string | null;

package/dist/project-map/sanitizers.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Phase C — sanitizer registry.
+ *
+ * Functions that remove taint from data. When the taint tracker encounters
+ * a call to a sanitizer, the result is NOT tainted (the sanitizer removes
+ * the taint). Note: `String()` alone does NOT remove taint — it's a type
+ * coercion, not a sanitizer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANITIZERS = void 0;
+exports.matchSanitizer = matchSanitizer;
+/**
+ * Known sanitizers. A call to any of these with a tainted argument produces
+ * a non-tainted result.
+ *
+ * Type coercions that reject non-numeric input (parseInt, parseFloat, Number)
+ * ARE sanitizers for SQL injection — the result is always a number.
+ * `String()` is NOT a sanitizer — it accepts anything.
+ */
+exports.SANITIZERS = [
+    // ── JS/TS — type coercions that reject invalid input ─────────────────
+    { method: 'parseInt', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'parseFloat', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'Number', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'Boolean', languages: ['javascript', 'typescript', 'tsx'] },
+    // ── JS/TS — encoding functions ───────────────────────────────────────
+    { method: 'encodeURIComponent', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'encodeURI', languages: ['javascript', 'typescript', 'tsx'] },
+    // ── JS/TS — HTML/XSS sanitizers ──────────────────────────────────────
+    { method: 'escape', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'escapeHtml', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'sanitize', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'sanitizeHtml', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'sanitize', receiver: 'DOMPurify', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'xss', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'clean', receiver: 'xss', languages: ['javascript', 'typescript', 'tsx'] },
+    // ── JS/TS — validator library ────────────────────────────────────────
+    // validator.isInt(x) etc. are validators, not sanitizers — they return
+    // boolean, not cleaned data. The sanitizer is validator.toString(x, true)
+    // etc. But `escape` from validator IS a sanitizer.
+    { method: 'escape', receiver: 'validator', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'ltrim', receiver: 'validator', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'rtrim', receiver: 'validator', languages: ['javascript', 'typescript', 'tsx'] },
+    { method: 'trim', receiver: 'validator', languages: ['javascript', 'typescript', 'tsx'] },
+    // ── Python — type coercions ──────────────────────────────────────────
+    { method: 'int', languages: ['python'] },
+    { method: 'float', languages: ['python'] },
+    { method: 'bool', languages: ['python'] },
+    // ── Python — HTML/XSS sanitizers ─────────────────────────────────────
+    { method: 'escape', languages: ['python'] },
+    { method: 'escape', receiver: 'markupsafe', languages: ['python'] },
+    { method: 'clean', receiver: 'bleach', languages: ['python'] },
+    { method: 'clean', receiver: 'nh3', languages: ['python'] },
+];
+/**
+ * Check if a call expression is a sanitizer call.
+ * Returns the sanitizer name, or null if not a sanitizer.
+ *
+ * @param method   the method name from callParts
+ * @param receiver the base identifier from callParts (or null for bare calls)
+ * @param language the source language
+ */
+function matchSanitizer(method, receiver, language) {
+    for (const san of exports.SANITIZERS) {
+        if (!san.languages.includes(language))
+            continue;
+        if (san.method !== method)
+            continue;
+        if (san.receiver && receiver !== san.receiver)
+            continue;
+        return san.receiver ? `${san.receiver}.${san.method}` : san.method;
+    }
+    return null;
+}
+//# sourceMappingURL=sanitizers.js.map

package/dist/project-map/sanitizers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizers.js","sourceRoot":"","sources":["../../src/project-map/sanitizers.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAiEH,wCAYC;AAjED;;;;;;;GAOG;AACU,QAAA,UAAU,GAAmB;IACtC,wEAAwE;IACxE,EAAE,MAAM,EAAE,UAAU,EAAO,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC3E,EAAE,MAAM,EAAE,YAAY,EAAK,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC3E,EAAE,MAAM,EAAE,QAAQ,EAAS,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC3E,EAAE,MAAM,EAAE,SAAS,EAAQ,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC3E,wEAAwE;IACxE,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAChF,EAAE,MAAM,EAAE,WAAW,EAAU,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC/E,wEAAwE;IACxE,EAAE,MAAM,EAAE,QAAQ,EAAS,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC3E,EAAE,MAAM,EAAE,YAAY,EAAM,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC5E,EAAE,MAAM,EAAE,UAAU,EAAO,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC3E,EAAE,MAAM,EAAE,cAAc,EAAG,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC3E,EAAE,MAAM,EAAE,UAAU,EAAG,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC9F,EAAE,MAAM,EAAE,KAAK,EAAa,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC5E,EAAE,MAAM,EAAE,OAAO,EAAG,QAAQ,EAAE,KAAK,EAAW,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC9F,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,mDAAmD;IACnD,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC7F,EAAE,MAAM,EAAE,OAAO,EAAG,QAAQ,EAAE,WAAW,EAAI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC7F,EAAE,MAAM,EAAE,OAAO,EAAG,QAAQ,EAAE,WAAW,EAAI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAC7F,EAAE,MAAM,EAAE,MAAM,EAAI,QAAQ,EAAE,WAAW,EAAI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE;IAE7F,wEAAwE;IACxE,EAAE,MAAM,EAAE,KAAK,EAAW,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE;IACjD,EAAE,MAAM,EAAE,OAAO,EAAS,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE;IACjD,EAAE,MAAM,EAAE,MAAM,EAAU,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE;IACjD,wEAAwE;IACxE,EAAE,MAAM,EAAE,QAAQ,EAAQ,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE;IACjD,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE;IACnE,EAAE,MAAM,EAAE,OAAO,EAAG,QAAQ,EAAE,QAAQ,EAAM,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE;IACnE,EAAE,MAAM,EAAE,OAAO,EAAG,QAAQ,EAAE,KAAK,EAAQ,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE;CACrE,CAAC;AAEF;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC1B,MAAc,EACd,QAAuB,EACvB,QAAsB;IAEtB,KAAK,MAAM,GAAG,IAAI,kBAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAChD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,SAAS;QACpC,IAAI,GAAG,CAAC,QAAQ,IAAI,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAAE,SAAS;QACxD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/project-map/sinkFinder.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Phase B — AST-based sink finder.
+ *
+ * Walks a parsed file once and matches every call/assignment/jsx-attribute
+ * against the sink registry. Returns findings with argument shapes and
+ * enclosing-function context so the Taint Tracker (Phase C) and the Juror
+ * can reason about exploitability without re-parsing.
+ *
+ * Replaces the regex `sinkFloorService` with zero false positives on
+ * variable names that happen to match sink names (`const exec = ...`),
+ * sinks inside comments (AST skips them), and sinks inside string literals.
+ */
+import { SinkLanguage } from './sinkRegistry';
+export interface ArgInfo {
+    kind: 'literal' | 'template' | 'identifier' | 'binary' | 'call' | 'other';
+    /** For literal: the string value. For identifier: the variable name. For call: the call name. */
+    value?: string;
+    /** For template: whether the template has interpolation. */
+    interpolated?: boolean;
+}
+export interface SinkFinding {
+    /** 1-indexed start line. */
+    line: number;
+    /** 1-indexed end line (inclusive). */
+    endLine: number;
+    /** Sink id from the registry: 'exec', 'eval', 'innerHTML'. */
+    sink: string;
+    /** Canonical vulnerability type (matches API taxonomy). */
+    canonicalType: string;
+    severity: 'Critical' | 'High' | 'Medium';
+    /** The full call/assignment expression text (for display). */
+    callExpression: string;
+    /** Each argument's shape — empty for member-assignment / jsx-attribute. */
+    arguments: ArgInfo[];
+    /** Name of the enclosing function, or null at module level. */
+    enclosingFunction: string | null;
+    /** Whether the sink is inside a try/catch block. */
+    isInsideTryCatch: boolean;
+}
+/**
+ * Find all security sinks in source code via AST analysis.
+ *
+ * @param source  the file's source text
+ * @param language  the grammar to parse with
+ * @returns sink findings, ordered by line. Empty when the grammar is missing
+ *          or the file fails to parse (best-effort: never throws).
+ */
+export declare function findSinks(source: string, language: SinkLanguage): Promise<SinkFinding[]>;