@securecode-ai/mcp 0.1.0 → 0.2.1

package/dist/project-map/sinkRegistry.js

@@ -0,0 +1,246 @@
+"use strict";
+/**
+ * Phase B — declarative sink registry for the AST sink finder.
+ *
+ * Each entry describes a dangerous operation (a "sink") that the finder
+ * matches against the parsed AST. The registry is deliberately conservative
+ * on false negatives (high recall): a missed sink is a missed vulnerability,
+ * while a false sink is dismissed by the Juror at no structural cost.
+ *
+ * The canonical types mirror `api/src/services/taxonomy.ts` CANONICAL_TYPES
+ * so the API can consume findings without translation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SINK_REGISTRY = void 0;
+/**
+ * The sink registry. Superset of the 11 regex rules in
+ * `api/src/services/sinkFloorService.ts` plus Python sinks.
+ *
+ * Ordering is by severity (Critical first) so the finder, which stops at the
+ * first match per call site, prefers the most severe reading.
+ */
+exports.SINK_REGISTRY = [
+    // ── Command injection (JS/TS/TSX) ──────────────────────────────────────
+    {
+        id: 'exec',
+        canonicalType: 'command_injection',
+        severity: 'Critical',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [
+            { kind: 'call', method: 'exec' }, // bare: const { exec } = require('child_process'); exec(cmd)
+            { kind: 'call', method: 'exec', receiver: 'child_process' },
+        ],
+        description: 'child_process.exec / destructured exec — shell command execution',
+    },
+    {
+        id: 'spawn',
+        canonicalType: 'command_injection',
+        severity: 'Critical',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [
+            { kind: 'call', method: 'spawn' }, // bare: const { spawn } = require('child_process'); spawn(cmd)
+            { kind: 'call', method: 'spawn', receiver: 'child_process' },
+        ],
+        description: 'child_process.spawn — process spawning',
+    },
+    {
+        id: 'execFile',
+        canonicalType: 'command_injection',
+        severity: 'Critical',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [
+            { kind: 'call', method: 'execFile' },
+            { kind: 'call', method: 'execFile', receiver: 'child_process' },
+        ],
+        description: 'child_process.execFile — file execution',
+    },
+    {
+        id: 'fork',
+        canonicalType: 'command_injection',
+        severity: 'Critical',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [
+            { kind: 'call', method: 'fork' },
+            { kind: 'call', method: 'fork', receiver: 'child_process' },
+        ],
+        description: 'child_process.fork — process forking',
+    },
+    {
+        id: 'eval',
+        canonicalType: 'command_injection',
+        severity: 'Critical',
+        languages: ['javascript', 'typescript', 'tsx', 'python'],
+        matchers: [{ kind: 'call', method: 'eval' }],
+        description: 'eval() — arbitrary code execution',
+    },
+    {
+        id: 'Function',
+        canonicalType: 'command_injection',
+        severity: 'Critical',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [{ kind: 'call', method: 'Function' }],
+        description: 'Function() constructor — code execution from string',
+    },
+    // ── Command injection (Python) ─────────────────────────────────────────
+    {
+        id: 'os.system',
+        canonicalType: 'command_injection',
+        severity: 'Critical',
+        languages: ['python'],
+        matchers: [{ kind: 'call', method: 'system', receiver: 'os' }],
+        description: 'os.system() — shell command execution',
+    },
+    {
+        id: 'subprocess',
+        canonicalType: 'command_injection',
+        severity: 'Critical',
+        languages: ['python'],
+        matchers: [
+            { kind: 'call', method: 'call', receiver: 'subprocess' },
+            { kind: 'call', method: 'Popen', receiver: 'subprocess' },
+            { kind: 'call', method: 'run', receiver: 'subprocess' },
+            { kind: 'call', method: 'check_output', receiver: 'subprocess' },
+        ],
+        description: 'subprocess.* — process execution',
+    },
+    {
+        id: 'py-exec',
+        canonicalType: 'command_injection',
+        severity: 'Critical',
+        languages: ['python'],
+        matchers: [{ kind: 'call', method: 'exec' }],
+        description: 'Python exec() — arbitrary code execution',
+    },
+    // ── SQL injection (JS/TS/TSX) ──────────────────────────────────────────
+    {
+        id: 'queryRaw',
+        canonicalType: 'sql_injection',
+        severity: 'Critical',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [{ kind: 'call', method: '$queryRaw', receiver: '*' }],
+        requireNonLiteralArg: true,
+        description: 'Prisma $queryRaw with interpolation — SQL injection',
+    },
+    {
+        id: 'sql-concat',
+        canonicalType: 'sql_injection',
+        severity: 'Critical',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [{ kind: 'call', method: 'query', receiver: '*' }],
+        requireNonLiteralArg: true,
+        description: 'db.query with non-literal argument — potential SQL injection',
+    },
+    // ── SQL injection (Python) ─────────────────────────────────────────────
+    {
+        id: 'cursor-execute',
+        canonicalType: 'sql_injection',
+        severity: 'Critical',
+        languages: ['python'],
+        matchers: [{ kind: 'call', method: 'execute', receiver: '*' }],
+        requireNonLiteralArg: true,
+        description: 'cursor.execute with non-literal argument — potential SQL injection',
+    },
+    // ── XSS (JS/TS/TSX) ────────────────────────────────────────────────────
+    {
+        id: 'dangerouslySetInnerHTML',
+        canonicalType: 'xss',
+        severity: 'High',
+        languages: ['tsx'],
+        matchers: [{ kind: 'jsx-attribute', name: 'dangerouslySetInnerHTML' }],
+        description: 'React dangerouslySetInnerHTML — XSS via DOM injection',
+    },
+    {
+        id: 'innerHTML',
+        canonicalType: 'xss',
+        severity: 'High',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [{ kind: 'member-assignment', property: 'innerHTML' }],
+        requireNonLiteralArg: true,
+        description: '.innerHTML assignment — XSS via DOM injection',
+    },
+    // ── Open redirect (JS/TS/TSX) ──────────────────────────────────────────
+    {
+        id: 'res.redirect',
+        canonicalType: 'open_redirect',
+        severity: 'Medium',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [{ kind: 'call', method: 'redirect', receiver: '*' }],
+        requireNonLiteralArg: true,
+        description: 'res.redirect with non-literal argument — open redirect',
+    },
+    // ── Path traversal (JS/TS/TSX) ──────────────────────────────────────────
+    {
+        id: 'fs-read-write',
+        canonicalType: 'path_traversal',
+        severity: 'High',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [
+            { kind: 'call', method: 'readFile', receiver: 'fs' },
+            { kind: 'call', method: 'readFileSync', receiver: 'fs' },
+            { kind: 'call', method: 'writeFile', receiver: 'fs' },
+            { kind: 'call', method: 'writeFileSync', receiver: 'fs' },
+            { kind: 'call', method: 'createReadStream', receiver: 'fs' },
+            { kind: 'call', method: 'createWriteStream', receiver: 'fs' },
+        ],
+        requireNonLiteralArg: true,
+        description: 'fs.readFile/writeFile with non-literal path — path traversal',
+    },
+    // ── Path traversal (Python) ─────────────────────────────────────────────
+    {
+        id: 'py-open',
+        canonicalType: 'path_traversal',
+        severity: 'High',
+        languages: ['python'],
+        matchers: [{ kind: 'call', method: 'open' }],
+        requireNonLiteralArg: true,
+        description: 'open() with non-literal path — path traversal',
+    },
+    // ── Insecure crypto (JS/TS/TSX) ─────────────────────────────────────────
+    {
+        id: 'createCipher',
+        canonicalType: 'insecure_crypto',
+        severity: 'Medium',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [
+            { kind: 'call', method: 'createCipher', receiver: 'crypto' },
+            { kind: 'call', method: 'createDecipher', receiver: 'crypto' },
+        ],
+        description: 'crypto.createCipher/createDecipher — deprecated, use createCipheriv',
+    },
+    // ── Prototype pollution (JS/TS/TSX) ────────────────────────────────────
+    {
+        id: 'proto-merge',
+        canonicalType: 'prototype_pollution',
+        severity: 'High',
+        languages: ['javascript', 'typescript', 'tsx'],
+        matchers: [
+            { kind: 'call', method: 'merge', receiver: '*' },
+            { kind: 'call', method: 'defaultsDeep', receiver: '*' },
+            { kind: 'call', method: 'deepCopy', receiver: '*' },
+            { kind: 'call', method: 'extend', receiver: '*' },
+        ],
+        requireNonLiteralArg: true,
+        description: 'Object merge/extend with user input — prototype pollution',
+    },
+    // ── Insecure deserialization (Python) ───────────────────────────────────
+    {
+        id: 'pickle-loads',
+        canonicalType: 'insecure_deserialization',
+        severity: 'High',
+        languages: ['python'],
+        matchers: [
+            { kind: 'call', method: 'loads', receiver: 'pickle' },
+            { kind: 'call', method: 'load', receiver: 'pickle' },
+        ],
+        description: 'pickle.loads/load — insecure deserialization',
+    },
+    {
+        id: 'yaml-load',
+        canonicalType: 'insecure_deserialization',
+        severity: 'High',
+        languages: ['python'],
+        matchers: [{ kind: 'call', method: 'load', receiver: 'yaml' }],
+        description: 'yaml.load without SafeLoader — insecure deserialization',
+    },
+];
+//# sourceMappingURL=sinkRegistry.js.map

package/dist/project-map/sinkRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sinkRegistry.js","sourceRoot":"","sources":["../../src/project-map/sinkRegistry.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAiDH;;;;;;GAMG;AACU,QAAA,aAAa,GAAqB;IAC3C,0EAA0E;IAC1E;QACI,EAAE,EAAE,MAAM;QACV,aAAa,EAAE,mBAAmB;QAClC,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAiB,6DAA6D;YAC9G,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE;SAC9D;QACD,WAAW,EAAE,kEAAkE;KAClF;IACD;QACI,EAAE,EAAE,OAAO;QACX,aAAa,EAAE,mBAAmB;QAClC,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAqB,+DAA+D;YACrH,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE;SAC/D;QACD,WAAW,EAAE,wCAAwC;KACxD;IACD;QACI,EAAE,EAAE,UAAU;QACd,aAAa,EAAE,mBAAmB;QAClC,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACpC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE;SAClE;QACD,WAAW,EAAE,yCAAyC;KACzD;IACD;QACI,EAAE,EAAE,MAAM;QACV,aAAa,EAAE,mBAAmB;QAClC,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAChC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE;SAC9D;QACD,WAAW,EAAE,sCAAsC;KACtD;IACD;QACI,EAAE,EAAE,MAAM;QACV,aAAa,EAAE,mBAAmB;QAClC,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC;QACxD,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5C,WAAW,EAAE,mCAAmC;KACnD;IACD;QACI,EAAE,EAAE,UAAU;QACd,aAAa,EAAE,mBAAmB;QAClC,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChD,WAAW,EAAE,qDAAqD;KACrE;IAED,0EAA0E;IAC1E;QACI,EAAE,EAAE,WAAW;QACf,aAAa,EAAE,mBAAmB;QAClC,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9D,WAAW,EAAE,uCAAuC;KACvD;IACD;QACI,EAAE,EAAE,YAAY;QAChB,aAAa,EAAE,mBAAmB;QAClC,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,QAAQ,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;YACxD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE;YACzD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE;YACvD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE;SACnE;QACD,WAAW,EAAE,kCAAkC;KAClD;IACD;QACI,EAAE,EAAE,SAAS;QACb,aAAa,EAAE,mBAAmB;QAClC,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5C,WAAW,EAAE,0CAA0C;KAC1D;IAED,0EAA0E;IAC1E;QACI,EAAE,EAAE,UAAU;QACd,aAAa,EAAE,eAAe;QAC9B,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAChE,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,qDAAqD;KACrE;IACD;QACI,EAAE,EAAE,YAAY;QAChB,aAAa,EAAE,eAAe;QAC9B,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAC5D,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,8DAA8D;KAC9E;IAED,0EAA0E;IAC1E;QACI,EAAE,EAAE,gBAAgB;QACpB,aAAa,EAAE,eAAe;QAC9B,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAC9D,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,oEAAoE;KACpF;IAED,0EAA0E;IAC1E;QACI,EAAE,EAAE,yBAAyB;QAC7B,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,KAAK,CAAC;QAClB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;QACtE,WAAW,EAAE,uDAAuD;KACvE;IACD;QACI,EAAE,EAAE,WAAW;QACf,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAChE,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,+CAA+C;KAC/D;IAED,0EAA0E;IAC1E;QACI,EAAE,EAAE,cAAc;QAClB,aAAa,EAAE,eAAe;QAC9B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAC/D,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,wDAAwD;KACxE;IAED,2EAA2E;IAC3E;QACI,EAAE,EAAE,eAAe;QACnB,aAAa,EAAE,gBAAgB;QAC/B,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;YACpD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE;YACxD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;YACrD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC5D,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChE;QACD,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,8DAA8D;KAC9E;IAED,2EAA2E;IAC3E;QACI,EAAE,EAAE,SAAS;QACb,aAAa,EAAE,gBAAgB;QAC/B,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5C,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,+CAA+C;KAC/D;IAED,2EAA2E;IAC3E;QACI,EAAE,EAAE,cAAc;QAClB,aAAa,EAAE,iBAAiB;QAChC,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC5D,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACjE;QACD,WAAW,EAAE,qEAAqE;KACrF;IAED,0EAA0E;IAC1E;QACI,EAAE,EAAE,aAAa;QACjB,aAAa,EAAE,qBAAqB;QACpC,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;QAC9C,QAAQ,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE;YAChD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE;YACvD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE;YACnD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE;SACpD;QACD,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,2DAA2D;KAC3E;IAED,2EAA2E;IAC3E;QACI,EAAE,EAAE,cAAc;QAClB,aAAa,EAAE,0BAA0B;QACzC,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,QAAQ,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE;YACrD,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACvD;QACD,WAAW,EAAE,8CAA8C;KAC9D;IACD;QACI,EAAE,EAAE,WAAW;QACf,aAAa,EAAE,0BAA0B;QACzC,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC9D,WAAW,EAAE,yDAAyD;KACzE;CACJ,CAAC"}

package/dist/project-map/taintSources.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Phase C — taint source patterns.
+ *
+ * Defines what constitutes attacker-controlled input. A member expression
+ * (or call on a member expression) is a source if its text starts with one
+ * of the patterns below. The taint tracker uses this to seed the tainted
+ * variable set during its forward walk.
+ */
+import type { SinkLanguage } from './sinkRegistry';
+export type TaintSourceType = 'body' | 'query' | 'path' | 'header' | 'cookie' | 'stdin' | 'argv' | 'env';
+export interface TaintSourcePattern {
+    /** Text prefix that identifies this source: 'req.body', 'request.GET', etc. */
+    prefix: string;
+    languages: SinkLanguage[];
+    sourceType: TaintSourceType;
+    /** How likely this is attacker-controlled (0-1). Body/query/path = 1.0, env = 0.5. */
+    confidence: number;
+}
+/**
+ * Source patterns for JS/TS/TSX and Python.
+ *
+ * JS/TS: Express, Fastify, Koa, Next.js, Lambda event.
+ * Python: Flask, Django, FastAPI, sys.argv, os.environ.
+ */
+export declare const TAINT_SOURCES: TaintSourcePattern[];
+/**
+ * Check if an expression's text matches a taint source pattern.
+ * Returns the matching pattern, or null if not a source.
+ */
+export declare function matchTaintSource(text: string, language: SinkLanguage): TaintSourcePattern | null;

package/dist/project-map/taintSources.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * Phase C — taint source patterns.
+ *
+ * Defines what constitutes attacker-controlled input. A member expression
+ * (or call on a member expression) is a source if its text starts with one
+ * of the patterns below. The taint tracker uses this to seed the tainted
+ * variable set during its forward walk.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TAINT_SOURCES = void 0;
+exports.matchTaintSource = matchTaintSource;
+/**
+ * Source patterns for JS/TS/TSX and Python.
+ *
+ * JS/TS: Express, Fastify, Koa, Next.js, Lambda event.
+ * Python: Flask, Django, FastAPI, sys.argv, os.environ.
+ */
+exports.TAINT_SOURCES = [
+    // ── JS/TS — Express / generic ───────────────────────────────────────
+    { prefix: 'req.body', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'body', confidence: 1.0 },
+    { prefix: 'req.query', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'query', confidence: 1.0 },
+    { prefix: 'req.params', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'path', confidence: 1.0 },
+    { prefix: 'req.headers', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'header', confidence: 0.9 },
+    { prefix: 'req.cookies', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'cookie', confidence: 0.9 },
+    { prefix: 'req.files', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'body', confidence: 0.9 },
+    // ── JS/TS — generic `request` object ─────────────────────────────────
+    { prefix: 'request.body', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'body', confidence: 1.0 },
+    { prefix: 'request.query', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'query', confidence: 1.0 },
+    { prefix: 'request.params', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'path', confidence: 1.0 },
+    { prefix: 'request.headers', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'header', confidence: 0.9 },
+    { prefix: 'request.cookies', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'cookie', confidence: 0.9 },
+    // ── JS/TS — Koa ctx ───────────────────────────────────────────────────
+    { prefix: 'ctx.request.body', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'body', confidence: 1.0 },
+    { prefix: 'ctx.request.query', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'query', confidence: 1.0 },
+    { prefix: 'ctx.request.params', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'path', confidence: 1.0 },
+    { prefix: 'ctx.body', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'body', confidence: 1.0 },
+    { prefix: 'ctx.query', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'query', confidence: 1.0 },
+    { prefix: 'ctx.params', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'path', confidence: 1.0 },
+    { prefix: 'ctx.headers', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'header', confidence: 0.9 },
+    // ── JS/TS — Lambda event ──────────────────────────────────────────────
+    { prefix: 'event.body', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'body', confidence: 1.0 },
+    { prefix: 'event.queryStringParameters', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'query', confidence: 1.0 },
+    { prefix: 'event.pathParameters', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'path', confidence: 1.0 },
+    { prefix: 'event.headers', languages: ['javascript', 'typescript', 'tsx'], sourceType: 'header', confidence: 0.9 },
+    // ── Python — Flask / Django / FastAPI ────────────────────────────────
+    { prefix: 'request.GET', languages: ['python'], sourceType: 'query', confidence: 1.0 },
+    { prefix: 'request.POST', languages: ['python'], sourceType: 'body', confidence: 1.0 },
+    { prefix: 'request.args', languages: ['python'], sourceType: 'query', confidence: 1.0 },
+    { prefix: 'request.form', languages: ['python'], sourceType: 'body', confidence: 1.0 },
+    { prefix: 'request.json', languages: ['python'], sourceType: 'body', confidence: 1.0 },
+    { prefix: 'request.body', languages: ['python'], sourceType: 'body', confidence: 1.0 },
+    { prefix: 'request.headers', languages: ['python'], sourceType: 'header', confidence: 0.9 },
+    { prefix: 'request.cookies', languages: ['python'], sourceType: 'cookie', confidence: 0.9 },
+    { prefix: 'request.values', languages: ['python'], sourceType: 'query', confidence: 1.0 },
+    { prefix: 'request.data', languages: ['python'], sourceType: 'body', confidence: 1.0 },
+    // ── Python — system ───────────────────────────────────────────────────
+    { prefix: 'sys.argv', languages: ['python'], sourceType: 'argv', confidence: 0.7 },
+    { prefix: 'os.environ', languages: ['python'], sourceType: 'env', confidence: 0.5 },
+    { prefix: 'os.getenv', languages: ['python'], sourceType: 'env', confidence: 0.5 },
+];
+/**
+ * Check if an expression's text matches a taint source pattern.
+ * Returns the matching pattern, or null if not a source.
+ */
+function matchTaintSource(text, language) {
+    for (const src of exports.TAINT_SOURCES) {
+        if (!src.languages.includes(language))
+            continue;
+        // Exact match or prefix match (req.body.q starts with req.body)
+        if (text === src.prefix || text.startsWith(src.prefix + '.') || text.startsWith(src.prefix + '[')) {
+            return src;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=taintSources.js.map

package/dist/project-map/taintSources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taintSources.js","sourceRoot":"","sources":["../../src/project-map/taintSources.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAwEH,4CAYC;AAnED;;;;;GAKG;AACU,QAAA,aAAa,GAAyB;IAC/C,uEAAuE;IACvE,EAAE,MAAM,EAAE,UAAU,EAAQ,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IACpH,EAAE,MAAM,EAAE,WAAW,EAAO,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,EAAI,UAAU,EAAE,GAAG,EAAE;IACpH,EAAE,MAAM,EAAE,YAAY,EAAM,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IACpH,EAAE,MAAM,EAAE,aAAa,EAAK,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAG,UAAU,EAAE,GAAG,EAAE;IACpH,EAAE,MAAM,EAAE,aAAa,EAAK,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAG,UAAU,EAAE,GAAG,EAAE;IACpH,EAAE,MAAM,EAAE,WAAW,EAAO,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IACpH,wEAAwE;IACxE,EAAE,MAAM,EAAE,cAAc,EAAI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IACpH,EAAE,MAAM,EAAE,eAAe,EAAG,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,EAAI,UAAU,EAAE,GAAG,EAAE;IACpH,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IACpH,EAAE,MAAM,EAAE,iBAAiB,EAAC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAG,UAAU,EAAE,GAAG,EAAE;IACpH,EAAE,MAAM,EAAE,iBAAiB,EAAC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAG,UAAU,EAAE,GAAG,EAAE;IACpH,yEAAyE;IACzE,EAAE,MAAM,EAAE,kBAAkB,EAAI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IACxH,EAAE,MAAM,EAAE,mBAAmB,EAAG,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,EAAI,UAAU,EAAE,GAAG,EAAE;IACxH,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IACxH,EAAE,MAAM,EAAE,UAAU,EAAI,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IAChH,EAAE,MAAM,EAAE,WAAW,EAAG,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,EAAI,UAAU,EAAE,GAAG,EAAE;IAChH,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IAChH,EAAE,MAAM,EAAE,aAAa,EAAC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAG,UAAU,EAAE,GAAG,EAAE;IAChH,yEAAyE;IACzE,EAAE,MAAM,EAAE,YAAY,EAAU,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IACxH,EAAE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,EAAI,UAAU,EAAE,GAAG,EAAE;IACjI,EAAE,MAAM,EAAE,sBAAsB,EAAC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IACzH,EAAE,MAAM,EAAE,eAAe,EAAO,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAG,UAAU,EAAE,GAAG,EAAE;IAExH,wEAAwE;IACxE,EAAE,MAAM,EAAE,aAAa,EAAM,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,OAAO,EAAI,UAAU,EAAE,GAAG,EAAE;IAC5F,EAAE,MAAM,EAAE,cAAc,EAAK,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IAC5F,EAAE,MAAM,EAAE,cAAc,EAAK,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,OAAO,EAAI,UAAU,EAAE,GAAG,EAAE;IAC5F,EAAE,MAAM,EAAE,cAAc,EAAK,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IAC5F,EAAE,MAAM,EAAE,cAAc,EAAK,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IAC5F,EAAE,MAAM,EAAE,cAAc,EAAK,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IAC5F,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAG,UAAU,EAAE,GAAG,EAAE;IAC5F,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAG,UAAU,EAAE,GAAG,EAAE;IAC5F,EAAE,MAAM,EAAE,gBAAgB,EAAG,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,OAAO,EAAI,UAAU,EAAE,GAAG,EAAE;IAC5F,EAAE,MAAM,EAAE,cAAc,EAAK,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,MAAM,EAAK,UAAU,EAAE,GAAG,EAAE;IAC5F,yEAAyE;IACzE,EAAE,MAAM,EAAE,UAAU,EAAK,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,MAAM,EAAI,UAAU,EAAE,GAAG,EAAE;IACvF,EAAE,MAAM,EAAE,YAAY,EAAG,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,KAAK,EAAK,UAAU,EAAE,GAAG,EAAE;IACvF,EAAE,MAAM,EAAE,WAAW,EAAI,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,KAAK,EAAK,UAAU,EAAE,GAAG,EAAE;CAC1F,CAAC;AAEF;;;GAGG;AACH,SAAgB,gBAAgB,CAC5B,IAAY,EACZ,QAAsB;IAEtB,KAAK,MAAM,GAAG,IAAI,qBAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAChD,gEAAgE;QAChE,IAAI,IAAI,KAAK,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YAChG,OAAO,GAAG,CAAC;QACf,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/project-map/taintTracker.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Phase C — taint propagation tracker.
+ *
+ * Walks a parsed file forward, maintaining a per-scope set of tainted
+ * variables. When a source access is found (req.body, request.GET, etc.),
+ * the variable is marked tainted. Taint propagates through assignments,
+ * concatenations, and template interpolations. Sanitizer calls strip
+ * taint. When a sink (from the sink registry) is encountered, the
+ * arguments are checked for taint — if tainted, a TaintResult is recorded
+ * with the full propagation path from source to sink.
+ *
+ * Intra-function: source and sink in the same function (the common case).
+ * Inter-function: a simple first pass identifies functions that return
+ * tainted data; calls to those functions propagate taint to the result.
+ */
+import { SinkLanguage } from './sinkRegistry';
+export interface PropagationStep {
+    line: number;
+    variable: string;
+    operation: 'source' | 'assign' | 'concat' | 'template' | 'call-pass' | 'sink-arg';
+    description: string;
+}
+export interface TaintResult {
+    source: string;
+    sourceLine: number;
+    sink: string;
+    sinkLine: number;
+    canonicalType: string;
+    propagationPath: PropagationStep[];
+    isTainted: boolean;
+}
+/**
+ * Track taint propagation through source code. Returns a TaintResult for
+ * every sink where tainted data reaches an argument.
+ *
+ * @param source   the file's source text
+ * @param language  the grammar to parse with
+ * @returns taint results, one per tainted sink argument. Empty when the
+ *          grammar is missing, the file fails to parse, or no tainted data
+ *          reaches any sink (best-effort: never throws).
+ */
+export declare function trackTaint(source: string, language: SinkLanguage): Promise<TaintResult[]>;