@securecode-ai/mcp 0.1.0 → 0.2.1

package/dist/project-map/sinkFinder.js

@@ -0,0 +1,340 @@
+"use strict";
+/**
+ * Phase B — AST-based sink finder.
+ *
+ * Walks a parsed file once and matches every call/assignment/jsx-attribute
+ * against the sink registry. Returns findings with argument shapes and
+ * enclosing-function context so the Taint Tracker (Phase C) and the Juror
+ * can reason about exploitability without re-parsing.
+ *
+ * Replaces the regex `sinkFloorService` with zero false positives on
+ * variable names that happen to match sink names (`const exec = ...`),
+ * sinks inside comments (AST skips them), and sinks inside string literals.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findSinks = findSinks;
+const parserLoader_1 = require("./parserLoader");
+const astHelpers_1 = require("./astHelpers");
+const sinkRegistry_1 = require("./sinkRegistry");
+// ── Argument shape classification ──────────────────────────────────────────
+function classifyArg(node, source) {
+    // JS/TS string literal
+    if ((0, astHelpers_1.isStringLiteral)(node)) {
+        return { kind: 'literal', value: source.slice(node.startIndex, node.endIndex) };
+    }
+    // Python string node is also 'string'
+    if (node.type === 'string') {
+        return { kind: 'literal', value: source.slice(node.startIndex, node.endIndex) };
+    }
+    // Numeric, boolean, regex, null, undefined → literal
+    if (['number', 'true', 'false', 'null', 'undefined', 'none', 'float', 'integer', 'boolean'].includes(node.type)) {
+        return { kind: 'literal', value: source.slice(node.startIndex, node.endIndex) };
+    }
+    // Function/arrow expressions are code, not user input — treat as literal
+    // for requireNonLiteralArg purposes (taint tracker handles closure taint).
+    if (['arrow_function', 'function_expression', 'function'].includes(node.type)) {
+        return { kind: 'literal', value: '<function>' };
+    }
+    // Template literal / template string
+    if (node.type === 'template_string' || node.type === 'template_literal') {
+        const interpolated = node.namedChildren.some(c => c.type === 'template_substitution' || c.type === 'template_expr');
+        return { kind: 'template', interpolated };
+    }
+    // Identifier — a variable reference
+    if ((0, astHelpers_1.isIdentifier)(node)) {
+        return { kind: 'identifier', value: source.slice(node.startIndex, node.endIndex) };
+    }
+    // Python identifier is 'identifier'
+    if (node.type === 'identifier') {
+        return { kind: 'identifier', value: source.slice(node.startIndex, node.endIndex) };
+    }
+    // Binary expression (concatenation, arithmetic)
+    if (node.type === 'binary_expression' || node.type === 'binary_operator_expression') {
+        return { kind: 'binary' };
+    }
+    // Python f-string / formatted string
+    if (node.type === 'concatenated_string' || node.type === 'string_interpolation') {
+        return { kind: 'template', interpolated: true };
+    }
+    // Call expression
+    if (node.type === 'call_expression' || node.type === 'call') {
+        const p = (0, astHelpers_1.callParts)(node, source);
+        return { kind: 'call', value: p ? (p.receiver ? `${p.receiver}.${p.method}` : p.method) : undefined };
+    }
+    // Member expression (e.g. req.body.q) — treat as identifier-like
+    if (node.type === 'member_expression' || node.type === 'attribute') {
+        return { kind: 'identifier', value: source.slice(node.startIndex, node.endIndex) };
+    }
+    return { kind: 'other' };
+}
+/** True if an argument is non-literal (potentially attacker-controlled). */
+function isNonLiteral(arg) {
+    if (arg.kind === 'literal')
+        return false;
+    if (arg.kind === 'template' && !arg.interpolated)
+        return false;
+    return true;
+}
+// ── Enclosing function + try/catch ──────────────────────────────────────────
+const FUNCTION_NODE_TYPES = new Set([
+    'function_declaration', 'function_definition', 'method_definition',
+    'async_function_declaration', 'async_function_definition',
+    'arrow_function', 'function_expression',
+    'generator_function_declaration', 'generator_declaration',
+]);
+const TRY_TYPES = new Set(['try_statement', 'try']);
+function enclosingFunctionName(node, source) {
+    const fn = (0, astHelpers_1.firstAncestor)(node, n => FUNCTION_NODE_TYPES.has(n.type));
+    if (!fn)
+        return null;
+    // Named function: function foo() {} — the name is the first identifier child
+    const id = fn.namedChildren.find(c => (0, astHelpers_1.isIdentifier)(c));
+    if (id)
+        return source.slice(id.startIndex, id.endIndex);
+    // const foo = () => {} — the name is on the declarator's parent
+    const parent = fn.parent;
+    if (parent) {
+        if (parent.type === 'lexical_declaration' || parent.type === 'variable_declaration') {
+            for (const decl of parent.namedChildren) {
+                if (decl.type !== 'variable_declarator')
+                    continue;
+                const name = decl.child(0);
+                if (name && (0, astHelpers_1.isIdentifier)(name)) {
+                    return source.slice(name.startIndex, name.endIndex);
+                }
+            }
+        }
+        // Python: `name = def x():` → assignment
+        if (parent.type === 'assignment') {
+            const target = parent.child(0);
+            if (target && (0, astHelpers_1.isIdentifier)(target)) {
+                return source.slice(target.startIndex, target.endIndex);
+            }
+        }
+    }
+    return '<anonymous>';
+}
+function isInsideTryCatch(node) {
+    return (0, astHelpers_1.firstAncestor)(node, n => TRY_TYPES.has(n.type)) !== null;
+}
+function extractCallInfo(node, source) {
+    if (node.type === 'call_expression' || node.type === 'call') {
+        const p = (0, astHelpers_1.callParts)(node, source);
+        if (!p)
+            return null;
+        let args = p.args;
+        // Tagged template literal: `tag\`...\`` — tree-sitter parses the
+        // template_literal as the last child directly (not inside an
+        // `arguments` node). callParts then extracts the template's named
+        // children (substitutions) instead of the template itself. Detect
+        // this and use the template node as the sole argument.
+        const lastChild = node.child(node.childCount - 1);
+        if (lastChild
+            && (lastChild.type === 'template_literal' || lastChild.type === 'template_string')) {
+            args = [lastChild];
+        }
+        return { receiver: p.receiver, method: p.method, args, line: p.line };
+    }
+    if (node.type === 'new_expression') {
+        // new_expression: `new Constructor(args)` — constructor is the first named child.
+        const constructor = node.namedChildren.find(c => c.type === 'identifier' || c.type === 'member_expression');
+        if (!constructor)
+            return null;
+        let receiver = null;
+        let method = '';
+        if (constructor.type === 'member_expression') {
+            const obj = constructor.child(0);
+            const prop = constructor.child(constructor.childCount - 1);
+            if (obj && prop) {
+                receiver = (0, astHelpers_1.baseIdentifier)(obj, source) ?? (0, parserLoader_1.nodeText)(obj, source);
+                method = source.slice(prop.startIndex, prop.endIndex);
+            }
+        }
+        else {
+            method = source.slice(constructor.startIndex, constructor.endIndex);
+        }
+        // Args: last named child that's an arguments/argument_list node.
+        const argsNode = node.namedChildren.find(c => c.type === 'arguments' || c.type === 'argument_list');
+        const args = [];
+        if (argsNode) {
+            for (const c of argsNode.namedChildren)
+                args.push(c);
+        }
+        return { receiver, method, args, line: node.startPosition.row };
+    }
+    return null;
+}
+/** Match a call's (receiver, method) against a single `call` matcher. */
+function matchCall(matcher, receiver, method) {
+    if (method !== matcher.method)
+        return false;
+    if (matcher.receiver === undefined)
+        return receiver === null;
+    if (matcher.receiver === '*')
+        return true;
+    return receiver === matcher.receiver;
+}
+/** Check if a definition applies to the given language. */
+function defForLanguage(def, lang) {
+    return def.languages.includes(lang);
+}
+// ── Finder ──────────────────────────────────────────────────────────────────
+/**
+ * Find all security sinks in source code via AST analysis.
+ *
+ * @param source  the file's source text
+ * @param language  the grammar to parse with
+ * @returns sink findings, ordered by line. Empty when the grammar is missing
+ *          or the file fails to parse (best-effort: never throws).
+ */
+async function findSinks(source, language) {
+    const parsed = await (0, parserLoader_1.parseSource)(source, language);
+    if (!parsed)
+        return [];
+    const { root } = parsed;
+    const findings = [];
+    // Dedup key: `${line}:${canonicalType}` — same as the regex sink floor.
+    const seen = new Set();
+    for (const node of (0, astHelpers_1.walk)(root)) {
+        // ── 1. Call sinks (call_expression / call / new_expression) ──────
+        if (node.type === 'call_expression' || node.type === 'call' || node.type === 'new_expression') {
+            const info = extractCallInfo(node, source);
+            if (!info)
+                continue;
+            for (const def of sinkRegistry_1.SINK_REGISTRY) {
+                if (!defForLanguage(def, language))
+                    continue;
+                let matched = false;
+                for (const matcher of def.matchers) {
+                    if (matcher.kind !== 'call')
+                        continue;
+                    if (matchCall(matcher, info.receiver, info.method)) {
+                        matched = true;
+                        break;
+                    }
+                }
+                if (!matched)
+                    continue;
+                const args = info.args.map(a => classifyArg(a, source));
+                // For call sinks, only the FIRST argument is the injection
+                // vector (the query string, the path, the redirect URL).
+                // Subsequent arguments are parameters/options (e.g.
+                // db.query("SELECT...?", [params]) — the array is NOT an
+                // injection vector). Checking all args would false-positive
+                // on parameterized queries.
+                if (def.requireNonLiteralArg && !(args.length > 0 && isNonLiteral(args[0])))
+                    continue;
+                const key = `${info.line + 1}:${def.canonicalType}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                findings.push({
+                    line: info.line + 1,
+                    endLine: (node.endPosition?.row ?? info.line) + 1,
+                    sink: def.id,
+                    canonicalType: def.canonicalType,
+                    severity: def.severity,
+                    callExpression: source.slice(node.startIndex, node.endIndex),
+                    arguments: args,
+                    enclosingFunction: enclosingFunctionName(node, source),
+                    isInsideTryCatch: isInsideTryCatch(node),
+                });
+                break; // first matching definition wins (registry is severity-ordered)
+            }
+            continue;
+        }
+        // ── 2. Member-assignment sinks (.innerHTML = ...) ────────────────
+        if (node.type === 'assignment_expression' || node.type === 'assignment') {
+            const lhs = node.child(0);
+            if (!lhs)
+                continue;
+            // LHS must be a member_expression / attribute
+            if (lhs.type !== 'member_expression' && lhs.type !== 'attribute')
+                continue;
+            const propNode = lhs.child(lhs.childCount - 1);
+            if (!propNode)
+                continue;
+            const propName = source.slice(propNode.startIndex, propNode.endIndex);
+            for (const def of sinkRegistry_1.SINK_REGISTRY) {
+                if (!defForLanguage(def, language))
+                    continue;
+                let matched = false;
+                for (const matcher of def.matchers) {
+                    if (matcher.kind !== 'member-assignment')
+                        continue;
+                    if (matcher.property === propName) {
+                        matched = true;
+                        break;
+                    }
+                }
+                if (!matched)
+                    continue;
+                const rhs = node.child(node.childCount - 1);
+                const args = rhs ? [classifyArg(rhs, source)] : [];
+                if (def.requireNonLiteralArg && !args.some(isNonLiteral))
+                    continue;
+                const key = `${node.startPosition.row + 1}:${def.canonicalType}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                findings.push({
+                    line: node.startPosition.row + 1,
+                    endLine: (node.endPosition?.row ?? node.startPosition.row) + 1,
+                    sink: def.id,
+                    canonicalType: def.canonicalType,
+                    severity: def.severity,
+                    callExpression: source.slice(node.startIndex, node.endIndex),
+                    arguments: args,
+                    enclosingFunction: enclosingFunctionName(node, source),
+                    isInsideTryCatch: isInsideTryCatch(node),
+                });
+                break;
+            }
+            continue;
+        }
+        // ── 3. JSX attribute sinks (dangerouslySetInnerHTML) ─────────────
+        if (node.type === 'jsx_attribute') {
+            const nameNode = node.child(0);
+            if (!nameNode)
+                continue;
+            const attrName = source.slice(nameNode.startIndex, nameNode.endIndex);
+            for (const def of sinkRegistry_1.SINK_REGISTRY) {
+                if (!defForLanguage(def, language))
+                    continue;
+                let matched = false;
+                for (const matcher of def.matchers) {
+                    if (matcher.kind !== 'jsx-attribute')
+                        continue;
+                    if (matcher.name === attrName) {
+                        matched = true;
+                        break;
+                    }
+                }
+                if (!matched)
+                    continue;
+                const key = `${node.startPosition.row + 1}:${def.canonicalType}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                // The value is child(1) or namedChildren[1]
+                const valueNode = node.namedChildren.length > 1 ? node.namedChildren[1] : null;
+                const args = valueNode ? [classifyArg(valueNode, source)] : [];
+                findings.push({
+                    line: node.startPosition.row + 1,
+                    endLine: (node.endPosition?.row ?? node.startPosition.row) + 1,
+                    sink: def.id,
+                    canonicalType: def.canonicalType,
+                    severity: def.severity,
+                    callExpression: source.slice(node.startIndex, node.endIndex),
+                    arguments: args,
+                    enclosingFunction: enclosingFunctionName(node, source),
+                    isInsideTryCatch: isInsideTryCatch(node),
+                });
+                break;
+            }
+        }
+    }
+    findings.sort((a, b) => a.line - b.line);
+    return findings;
+}
+//# sourceMappingURL=sinkFinder.js.map

package/dist/project-map/sinkFinder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sinkFinder.js","sourceRoot":"","sources":["../../src/project-map/sinkFinder.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAqOH,8BAmIC;AAtWD,iDAAuE;AACvE,6CAEsB;AACtB,iDAA0F;AAgC1F,8EAA8E;AAE9E,SAAS,WAAW,CAAC,IAAoB,EAAE,MAAc;IACrD,uBAAuB;IACvB,IAAI,IAAA,4BAAe,EAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,qDAAqD;IACrD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9G,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;IACD,qCAAqC;IACrC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACtE,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,CACxE,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IACD,oCAAoC;IACpC,IAAI,IAAA,yBAAY,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,oCAAoC;IACpC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,gDAAgD;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IACD,qCAAqC;IACrC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAA,sBAAS,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC1G,CAAC;IACD,iEAAiE;IACjE,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CAAC,GAAY;IAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAChC,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB;IAClE,4BAA4B,EAAE,2BAA2B;IACzD,gBAAgB,EAAE,qBAAqB;IACvC,gCAAgC,EAAE,uBAAuB;CAC5D,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAEpD,SAAS,qBAAqB,CAAC,IAAoB,EAAE,MAAc;IAC/D,MAAM,EAAE,GAAG,IAAA,0BAAa,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,6EAA6E;IAC7E,MAAM,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,yBAAY,EAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IACxD,gEAAgE;IAChE,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;IACzB,IAAI,MAAM,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,IAAI,KAAK,qBAAqB,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAClF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACtC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB;oBAAE,SAAS;gBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,IAAI,IAAI,IAAA,yBAAY,EAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACxD,CAAC;YACL,CAAC;QACL,CAAC;QACD,yCAAyC;QACzC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,MAAM,IAAI,IAAA,yBAAY,EAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5D,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,aAAa,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAoB;IAC1C,OAAO,IAAA,0BAAa,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;AACpE,CAAC;AAYD,SAAS,eAAe,CAAC,IAAoB,EAAE,MAAc;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAA,sBAAS,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAClB,iEAAiE;QACjE,6DAA6D;QAC7D,kEAAkE;QAClE,kEAAkE;QAClE,uDAAuD;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,SAAS;eACN,CAAC,SAAS,CAAC,IAAI,KAAK,kBAAkB,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,CAAC,EAAE,CAAC;YACrF,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACjC,kFAAkF;QAClF,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC5C,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAC5D,CAAC;QACF,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,WAAW,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YAC3D,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAA,uBAAQ,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAChE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1D,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxE,CAAC;QACD,iEAAiE;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACzC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,CACvD,CAAC;QACF,MAAM,IAAI,GAAqB,EAAE,CAAC;QAClC,IAAI,QAAQ,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,aAAa;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CACd,OAA+C,EAC/C,QAAuB,EACvB,MAAc;IAEd,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,KAAK,IAAI,CAAC;IAC7D,IAAI,OAAO,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC;AACzC,CAAC;AAED,2DAA2D;AAC3D,SAAS,cAAc,CAAC,GAAmB,EAAE,IAAkB;IAC3D,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACI,KAAK,UAAU,SAAS,CAC3B,MAAc,EACd,QAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAW,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAExB,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,oEAAoE;QACpE,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC5F,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,KAAK,MAAM,GAAG,IAAI,4BAAa,EAAE,CAAC;gBAC9B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;oBAAE,SAAS;gBAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACjC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;wBAAE,SAAS;oBACtC,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjD,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM;oBACV,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBACxD,2DAA2D;gBAC3D,yDAAyD;gBACzD,oDAAoD;gBACpD,yDAAyD;gBACzD,4DAA4D;gBAC5D,4BAA4B;gBAC5B,IAAI,GAAG,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAS;gBACtF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACpD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;oBACnB,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;oBACjD,IAAI,EAAE,GAAG,CAAC,EAAE;oBACZ,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;oBAC5D,SAAS,EAAE,IAAI;oBACf,iBAAiB,EAAE,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC;oBACtD,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,CAAC;iBAC3C,CAAC,CAAC;gBACH,MAAM,CAAC,gEAAgE;YAC3E,CAAC;YACD,SAAS;QACb,CAAC;QAED,oEAAoE;QACpE,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,8CAA8C;YAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtE,KAAK,MAAM,GAAG,IAAI,4BAAa,EAAE,CAAC;gBAC9B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;oBAAE,SAAS;gBAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACjC,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB;wBAAE,SAAS;oBACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAAC,OAAO,GAAG,IAAI,CAAC;wBAAC,MAAM;oBAAC,CAAC;gBACjE,CAAC;gBACD,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,IAAI,GAAG,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;oBAAE,SAAS;gBACnE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACjE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC9D,IAAI,EAAE,GAAG,CAAC,EAAE;oBACZ,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;oBAC5D,SAAS,EAAE,IAAI;oBACf,iBAAiB,EAAE,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC;oBACtD,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,CAAC;iBAC3C,CAAC,CAAC;gBACH,MAAM;YACV,CAAC;YACD,SAAS;QACb,CAAC;QAED,oEAAoE;QACpE,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtE,KAAK,MAAM,GAAG,IAAI,4BAAa,EAAE,CAAC;gBAC9B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;oBAAE,SAAS;gBAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACjC,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;wBAAE,SAAS;oBAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAAC,OAAO,GAAG,IAAI,CAAC;wBAAC,MAAM;oBAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACjE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,4CAA4C;gBAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC/E,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,QAAQ,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC9D,IAAI,EAAE,GAAG,CAAC,EAAE;oBACZ,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;oBAC5D,SAAS,EAAE,IAAI;oBACf,iBAAiB,EAAE,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC;oBACtD,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,CAAC;iBAC3C,CAAC,CAAC;gBACH,MAAM;YACV,CAAC;QACL,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/project-map/sinkRegistry.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Phase B — declarative sink registry for the AST sink finder.
+ *
+ * Each entry describes a dangerous operation (a "sink") that the finder
+ * matches against the parsed AST. The registry is deliberately conservative
+ * on false negatives (high recall): a missed sink is a missed vulnerability,
+ * while a false sink is dismissed by the Juror at no structural cost.
+ *
+ * The canonical types mirror `api/src/services/taxonomy.ts` CANONICAL_TYPES
+ * so the API can consume findings without translation.
+ */
+/** Languages supported by the tree-sitter grammars we ship. */
+export type SinkLanguage = 'javascript' | 'typescript' | 'tsx' | 'python';
+/** How a sink is matched in the AST. */
+export type SinkMatcher = {
+    kind: 'call';
+    /** The method name being called: `exec`, `eval`, `query`, `system`. */
+    method: string;
+    /**
+     * The base identifier the call is rooted at, or:
+     *  - `undefined` → match only bare calls (no receiver): `eval(...)`
+     *  - `'*'`       → match any receiver: `x.query(...)`, `query(...)`
+     *  - a string    → match that exact receiver: `child_process.exec(...)`
+     */
+    receiver?: string | '*';
+} | {
+    kind: 'member-assignment';
+    /** The property being assigned: `innerHTML`, `outerHTML`, `href`. */
+    property: string;
+} | {
+    kind: 'jsx-attribute';
+    /** The JSX attribute name: `dangerouslySetInnerHTML`. */
+    name: string;
+};
+export interface SinkDefinition {
+    /** Stable id for dedup/logging: 'exec', 'eval', 'inner-html'. */
+    id: string;
+    /** Canonical vulnerability type (matches API taxonomy). */
+    canonicalType: string;
+    severity: 'Critical' | 'High' | 'Medium';
+    languages: SinkLanguage[];
+    matchers: SinkMatcher[];
+    /**
+     * Only report when at least one argument is non-literal (identifier,
+     * template with interpolation, binary expression, or call expression).
+     * Use for sinks where a literal argument is definitively safe:
+     * `res.redirect("/home")`, `fs.readFile("config.json")`,
+     * `db.query("SELECT * FROM users")`.
+     */
+    requireNonLiteralArg?: boolean;
+    description: string;
+}
+/**
+ * The sink registry. Superset of the 11 regex rules in
+ * `api/src/services/sinkFloorService.ts` plus Python sinks.
+ *
+ * Ordering is by severity (Critical first) so the finder, which stops at the
+ * first match per call site, prefers the most severe reading.
+ */
+export declare const SINK_REGISTRY: SinkDefinition[];