@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/report/site.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"site.js","sourceRoot":"","sources":["../../../src/report/site.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CACvC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAEvE,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmEvB,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;CAUtB,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG;CACzB,CAAC;AAGF,gGAAgG;AAChG,MAAM,UAAU,OAAO,CAAC,IAAwB;IAC9C,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IACjD,MAAM,QAAQ,GAA4B;QACxC,CAAC,UAAU,EAAE,WAAW,CAAC;QACzB,CAAC,SAAS,EAAE,YAAY,CAAC;QACzB,CAAC,UAAU,EAAE,cAAc,CAAC;QAC5B,CAAC,OAAO,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,oBAAoB,IAAI,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC;IAC/F,KAAK,CAAC,IAAI,CAAC,iCAAiC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACvI,OAAO;;;;;;EAMP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;;;WAGP,CAAC;AACZ,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,UAAU;IACxB,OAAO;;;;;;YAMG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAA0B,EAAE,KAAuB;IAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE9E,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC;IACnC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,CAChB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QAC/D,GAAG,CACJ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,CACV,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAC/E,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEb;6EACyE;IACzE,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,iBAAiB;gBAAE,cAAc,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED;uCACmC;IACnC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnE,OAAO;;;;;;;;;;;;;EAaP,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2FR,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqGP,UAAU;;;;;;;;;;;;EAYV,OAAO,CAAC,MAAM,CAAC;;;;;;;;;;;8EAW6D,GAAG,CAAC,eAAe,CAAC;;+BAEnE,GAAG,CAAC,eAAe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qEA+GkB,SAAS,CAAC,MAAM;eACtE,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;iEAeJ,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;6BAC3D,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;;4BAExB,QAAQ,CAAC,EAAE,4BAA4B,QAAQ,CAAC,EAAE;;;;;;iEAMb,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;uDAClC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;;4BAEnD,SAAS,CAAC,EAAE,4BAA4B,SAAS,CAAC,EAAE;;;;;;iEAMf,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;uDAClC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;;4BAEnD,SAAS,CAAC,EAAE,4BAA4B,SAAS,CAAC,EAAE;;;;;iGAKiB,GAAG;;;;;;;;UAQ1F;IACA;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,CAAC,CAAC;0EAC4D,QAAQ,CAAC,EAAE;;wDAE7B,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC;;iGAEC;QACrF,CAAC,CAAC,QAAQ,CAAC,mBAAmB,KAAK,CAAC;YAClC,CAAC,CAAC,wEAAwE,QAAQ,CAAC,EAAE;;6CAEtD,QAAQ,CAAC,sBAAsB;8FACkB,SAAS;iCACtE;YACnB,CAAC,CAAC,4DAA4D,QAAQ,CAAC,mBAAmB;YAC5F,QAAQ,CAAC,EAAE,oDAAoD,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;;oEAE/B,QAAQ,CAAC,sBAAsB;;yBAE1E,SAAS;;kDAG1B;;;;;;;;;;;8BAWsB,cAAc;;;;;;;mCAOT,SAAS,CAAC,MAAM;mCAChB,SAAS;mCACT,SAAS,CAAC,WAAW;;;yBAG/B,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;EAqBlF,UAAU,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Db,CAAC;AACF,CAAC"}

package/dist/src/rules/code-injection.d.ts

@@ -0,0 +1,47 @@
+/**
+ * CODE INJECTION  (CWE-94 / CWE-95, OWASP A05:2025 - Injection)
+ *
+ * WHAT THE BUG IS, in plain language:
+ * The other injection rules are about a string being read as instructions by
+ * something ELSE - a database, a shell, a browser. This one is about a string
+ * being read as instructions by YOUR OWN PROGRAM, in your own language, with
+ * every privilege your process has.
+ *
+ *     const total = eval(req.body.preTax);
+ *
+ * The author wanted arithmetic. What they built is a remote code execution
+ * endpoint: whatever the request body says, the server runs. No escaping helps,
+ * because there is nothing to escape - the whole string IS the program.
+ *
+ * It is the shortest path from "user input" to "attacker owns the machine" in
+ * any language that has it, and it is startlingly common in code that meant to
+ * be clever about configuration, formulas, filters or plugins.
+ *
+ * THE FIX is always the same shape: stop evaluating, start parsing. A maths
+ * expression wants an expression parser. A filter wants a fixed vocabulary of
+ * allowed operations. A plugin wants a registry of known functions looked up by
+ * name. All three are more code than `eval` and none of them can be talked into
+ * running `rm -rf`.
+ *
+ * WHY IT NEEDED A NEW SINK KIND:
+ * `command` is a shell; `code` is the interpreter you are already inside. A
+ * shell-quoting sanitiser (`escapeshellarg`, `shlex.quote`) does nothing here,
+ * and the engine has to know that, which is exactly what kind-scoping is for.
+ *
+ * WHY IT EXISTS AT ALL:
+ * Three independent test files pointed at the same hole on the same day -
+ * OWASP NodeGoat's `eval(req.body.preTax)`, a Python file's
+ * `eval(expression, safe_globals)`, and a TypeScript app's
+ * `new RegExp(req.query.filter)`. In every one the tracer had already found the
+ * source and followed it; there was simply nothing at the far end to hand it
+ * to. The engine could see these all along.
+ *
+ * WHAT THIS RULE DELIBERATELY DOES NOT COVER:
+ * ReDoS - `new RegExp(userInput)` - is a real bug and was one of the three that
+ * prompted this rule, but it is CWE-1333 and an AVAILABILITY problem: a
+ * catastrophically backtracking pattern hangs the process, it does not run the
+ * attacker's code. Filing it under CWE-94 would put the wrong number on a real
+ * finding, so it is left out and named here rather than quietly folded in.
+ */
+import { type Rule } from './contract.js';
+export declare const codeInjectionRule: Rule;

package/dist/src/rules/code-injection.js

@@ -0,0 +1,326 @@
+/**
+ * CODE INJECTION  (CWE-94 / CWE-95, OWASP A05:2025 - Injection)
+ *
+ * WHAT THE BUG IS, in plain language:
+ * The other injection rules are about a string being read as instructions by
+ * something ELSE - a database, a shell, a browser. This one is about a string
+ * being read as instructions by YOUR OWN PROGRAM, in your own language, with
+ * every privilege your process has.
+ *
+ *     const total = eval(req.body.preTax);
+ *
+ * The author wanted arithmetic. What they built is a remote code execution
+ * endpoint: whatever the request body says, the server runs. No escaping helps,
+ * because there is nothing to escape - the whole string IS the program.
+ *
+ * It is the shortest path from "user input" to "attacker owns the machine" in
+ * any language that has it, and it is startlingly common in code that meant to
+ * be clever about configuration, formulas, filters or plugins.
+ *
+ * THE FIX is always the same shape: stop evaluating, start parsing. A maths
+ * expression wants an expression parser. A filter wants a fixed vocabulary of
+ * allowed operations. A plugin wants a registry of known functions looked up by
+ * name. All three are more code than `eval` and none of them can be talked into
+ * running `rm -rf`.
+ *
+ * WHY IT NEEDED A NEW SINK KIND:
+ * `command` is a shell; `code` is the interpreter you are already inside. A
+ * shell-quoting sanitiser (`escapeshellarg`, `shlex.quote`) does nothing here,
+ * and the engine has to know that, which is exactly what kind-scoping is for.
+ *
+ * WHY IT EXISTS AT ALL:
+ * Three independent test files pointed at the same hole on the same day -
+ * OWASP NodeGoat's `eval(req.body.preTax)`, a Python file's
+ * `eval(expression, safe_globals)`, and a TypeScript app's
+ * `new RegExp(req.query.filter)`. In every one the tracer had already found the
+ * source and followed it; there was simply nothing at the far end to hand it
+ * to. The engine could see these all along.
+ *
+ * WHAT THIS RULE DELIBERATELY DOES NOT COVER:
+ * ReDoS - `new RegExp(userInput)` - is a real bug and was one of the three that
+ * prompted this rule, but it is CWE-1333 and an AVAILABILITY problem: a
+ * catastrophically backtracking pattern hangs the process, it does not run the
+ * attacker's code. Filing it under CWE-94 would put the wrong number on a real
+ * finding, so it is left out and named here rather than quietly folded in.
+ */
+import { asCall } from './contract.js';
+import { analyzeStringExpression, constantProof } from './lib/strings.js';
+/**
+ * Calls that hand a string to the language's own interpreter.
+ *
+ * `setTimeout` and `setInterval` are NOT here, and the omission is deliberate.
+ * They only execute a string argument - `setTimeout("alert(1)", 100)` - and the
+ * overwhelmingly common form passes a FUNCTION. Reporting them on shape would
+ * light up every debounce and every retry in every codebase. They are listed as
+ * taint sinks instead, where the engine knows the value came from a request and
+ * a request cannot deliver a function.
+ */
+const EVALUATORS = {
+    javascript: ['eval', 'Function', 'execScript', 'runInNewContext', 'runInThisContext'],
+    typescript: ['eval', 'Function', 'execScript', 'runInNewContext', 'runInThisContext'],
+    // `compile` produces a code object that only `exec` can run, but it is the
+    // same decision one step earlier, and reporting it points at the real line.
+    python: ['eval', 'exec', 'compile'],
+    // `assert($x)` evaluates its argument as PHP when handed a string. It is a
+    // debugging aid that became an RCE primitive, removed in PHP 8 - which means
+    // the codebases that still use it are the old ones nobody is watching.
+    php: ['eval', 'assert', 'create_function'],
+    // ScriptEngine.eval("...") runs JavaScript inside the JVM.
+    java: ['eval'],
+    // Go has no eval. There is no interpreter at runtime to hand a string to, so
+    // the shape this rule detects cannot occur, and an empty list is the honest
+    // answer rather than a rule that never fires but implies coverage.
+    go: [],
+    // C has no interpreter to hand a string to. `dlopen`/`dlsym` load code, but
+    // from a PATH rather than from a string, which is a different bug (untrusted
+    // search path) and not one this rule models. Empty on purpose, and the
+    // coverage matrix says so rather than leaving a blank.
+    c: [],
+    cpp: [],
+};
+/**
+ * Evaluators that are BUILT-IN FUNCTIONS, and are therefore only themselves
+ * when called with nothing in front of them.
+ *
+ * Scanning Django found 163 code-injection findings and 153 were this mistake:
+ *
+ *     compiler.compile(value)     Django's own SQL compiler        x82
+ *     re.compile(pattern)         a regular expression             x21
+ *     self.compile(node)          somebody's method                x20
+ *     x.eval(...)                 somebody else's method           x25
+ *
+ * `compile`, `eval` and `exec` are builtins. `re.compile` shares three letters
+ * with the dangerous one and nothing else. Matching the bare method name meant
+ * every object in Python with a `.compile()` or `.eval()` method - and there are
+ * a lot of them, because those are natural names for "turn this into a runnable
+ * thing" in any DSL, ORM or template engine.
+ *
+ * Not on this list: vm.runInNewContext, which is a method and is supposed to
+ * have `vm` in front of it, and Java's ScriptEngine.eval, which is handled by
+ * JAVA_ENGINE below.
+ */
+const BARE_BUILTINS = new Set([
+    'eval',
+    'exec',
+    'compile',
+    'execScript',
+    'assert',
+    'create_function',
+    'Function',
+]);
+/**
+ * Receivers that ARE evaluators, and so keep the finding despite BARE_BUILTINS.
+ *
+ * The bare-only rule was too blunt on its own: OWASP's dvna has
+ *
+ *     mathjs.eval(req.body.eqn)
+ *
+ * which is a genuine remote-code-execution sink - mathjs's `eval` has its own
+ * CVEs - and it has a receiver, so the first version of this guard silently
+ * dropped it. That is the exact trade this rule has to get right: `re.compile`
+ * and `compiler.compile` are somebody's method, `mathjs.eval` and `window.eval`
+ * are the interpreter. The difference is WHICH object, not whether there is one.
+ */
+const EVALUATOR_RECEIVERS = new Set([
+    'mathjs',
+    'math',
+    'vm',
+    'safeEval',
+    'eval5',
+    'builtins',
+    '__builtins__',
+]);
+/**
+ * Receivers that are the GLOBAL OBJECT, and therefore only in JavaScript.
+ *
+ * `self` was the expensive one. In a browser - and especially in a web worker,
+ * where it is the only name for the global scope - `self.eval(src)` IS the
+ * interpreter, so it belonged on the allowlist. In Python `self` is the
+ * instance, and `self.eval(expr)` is a method somebody wrote.
+ *
+ * Scanning pandas reported 42 code injections and seventeen were `self.eval` -
+ * pandas' own `DataFrame.eval`, a public API that parses a restricted
+ * expression grammar and cannot reach the interpreter. The allowlist was
+ * correct; applying a JavaScript fact to Python was not. `window`, `global`
+ * and `globalThis` move here for the same reason, even though no other language
+ * happened to collide with them yet.
+ */
+const JS_GLOBAL_RECEIVERS = new Set([
+    'window',
+    'global',
+    'globalThis',
+    'self',
+]);
+/**
+ * Is this dangerous-looking name actually bound to something else in this file?
+ *
+ * pandas/core/computation/ops.py, with the import one line above the call:
+ *
+ *     from pandas.core.computation.eval import eval
+ *     res = eval(self, local_dict=env, engine=engine, parser=parser)
+ *
+ * `eval`, `exec` and `compile` are only dangerous because of what the
+ * interpreter binds those names to. An explicit import rebinds them, and this
+ * scanner is holding the very file that says so. Reporting it anyway was
+ * matching a name rather than a function.
+ *
+ * Deliberately narrow: only an explicit import of the same name counts. A
+ * reassignment (`eval = my_evaluator`) or a `import *` that happens to shadow
+ * it is NOT detected, and is a documented gap rather than a guess.
+ */
+function isImportedName(source, name) {
+    const n = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // from x.y import (a, eval, b)  /  from x import eval as e  /  import eval
+    return (new RegExp(`^[ \\t]*from[ \\t]+[\\w.]+[ \\t]+import[ \\t]*\\(?[^\\n]*\\b${n}\\b`, 'm').test(source) || new RegExp(`^[ \\t]*import[ \\t]+${n}\\b`, 'm').test(source));
+}
+/**
+ * Receivers that make `eval` unambiguous in Java, where the bare name is far
+ * too common. `engine.eval(script)` is the JSR-223 scripting API.
+ */
+const JAVA_ENGINE = /engine|script|nashorn|graal|interpreter/i;
+export const codeInjectionRule = {
+    id: 'code-injection',
+    name: 'User input evaluated as program code',
+    cwe: 'CWE-94',
+    owasp: 'A05:2025 Injection',
+    severity: 'critical',
+    summary: 'A string is run as program code; if any of it comes from outside, the sender decides what your server does.',
+    fix: 'Never eval input: parse it instead (a maths parser, a fixed list of allowed commands, or a lookup table).',
+    explanation: 'Passing a string to eval (or exec, Function, assert) tells your own language ' +
+        'to run it as a program, with every privilege the process has. If any part of ' +
+        'that string came from a request, the request decides what your server does. ' +
+        'There is nothing to escape here - the string IS the program - so the fix is ' +
+        'always to stop evaluating and start parsing: an expression parser for maths, ' +
+        'a fixed vocabulary for filters, a lookup table for plugins.',
+    limitations: 'UNVERIFIED (signature-based): we confirmed a value reaches an evaluator and ' +
+        'that it is not a fixed literal. We did NOT confirm it is attacker-controlled - ' +
+        'the data-flow pass is what upgrades this to flow-verified, and evaluating your ' +
+        'own constant is harmless. DELIBERATE GAP: setTimeout and setInterval accept a ' +
+        'string and run it, but almost always receive a function, so they are taint ' +
+        'sinks only and are never reported on shape alone. ALSO NOT COVERED: ReDoS - ' +
+        'new RegExp(userInput) - is a real bug but it is CWE-1333 and an availability ' +
+        'problem rather than code execution, so filing it here would put the wrong ' +
+        'identifier on a real finding. Go is not covered because it has no runtime ' +
+        'evaluator for the shape to occur in.',
+    shapes: ['call'],
+    support: {
+        javascript: {
+            status: 'implemented',
+            note: 'Covers eval, new Function, and the vm module\'s runInNewContext/runInThisContext. setTimeout/setInterval with a string are taint sinks only, because the common form passes a function and reporting on shape would flag every debounce in the codebase.',
+        },
+        typescript: {
+            status: 'implemented',
+            note: 'Identical to JavaScript.',
+        },
+        python: {
+            status: 'implemented',
+            note: 'Covers eval, exec and compile. NOT covered: __import__ with a built name, and the ast.literal_eval / eval confusion - literal_eval is safe and is deliberately absent.',
+        },
+        java: {
+            status: 'partial',
+            note: 'PARTIAL: ScriptEngine.eval only, and only on a receiver whose name looks like a script engine (engine, script, nashorn, graal). `eval` is a common method name in Java, so an engine stored under an unrelated name is missed rather than guessed at.',
+        },
+        php: {
+            status: 'implemented',
+            note: 'Covers eval, assert with a string argument, and create_function. assert() evaluating strings was removed in PHP 8, so a hit here also tells you the file predates that.',
+        },
+        go: {
+            status: 'not-implemented',
+            note: 'NOT IMPLEMENTED: Go has no runtime evaluator - no eval, no exec of source, no scripting engine in the standard library. The shape this rule detects cannot occur, so a Go entry would imply coverage of a risk that does not exist.',
+        },
+        c: {
+            status: 'not-implemented',
+            note: 'C has no interpreter to hand a string to. dlopen/dlsym load code, but from a PATH rather than from a string - that is an untrusted-search-path weakness, which this rule does not model. Empty on purpose rather than half-filled.',
+        },
+        cpp: {
+            status: 'not-implemented',
+            note: 'C++ has no interpreter to hand a string to either. Embedded scripting engines (Lua, V8, Python-C-API) genuinely do evaluate strings and are NOT modelled - a tainted string reaching luaL_dostring or v8::Script::Compile is missed entirely.',
+        },
+    },
+    check(shape, ctx) {
+        const language = ctx.language;
+        const call = asCall(shape);
+        if (!call)
+            return null;
+        if (!EVALUATORS[language].includes(call.calleeName))
+            return null;
+        // Java's `eval` needs a receiver that looks like a scripting engine.
+        if (language === 'java' && !JAVA_ENGINE.test(call.receiverText))
+            return null;
+        // Everywhere else, a builtin with something in front of it is somebody
+        // else's method that happens to share the name.
+        const isJs = language === 'javascript' || language === 'typescript';
+        if (language !== 'java' && BARE_BUILTINS.has(call.calleeName) && call.receiverText !== '') {
+            const owner = call.receiverText.split(/[.\s([]/).filter(Boolean).pop() ?? call.receiverText;
+            const known = EVALUATOR_RECEIVERS.has(owner) || (isJs && JS_GLOBAL_RECEIVERS.has(owner));
+            if (!known)
+                return null;
+        }
+        // A builtin the file has explicitly imported over is not the builtin.
+        if (BARE_BUILTINS.has(call.calleeName) && isImportedName(ctx.file.source, call.calleeName)) {
+            return null;
+        }
+        // PHP's assert() is only dangerous with a STRING argument; assert($a > $b)
+        // is an ordinary boolean check and is not evaluated as source.
+        const argument = call.args[0];
+        if (!argument)
+            return null;
+        if (language === 'php' && call.calleeName === 'assert') {
+            if (argument.type !== 'string' && argument.type !== 'encapsed_string') {
+                // A variable could still hold a string, so we do not drop it outright -
+                // but a visible comparison is provably not source text.
+                if (argument.type === 'binary_expression')
+                    return null;
+            }
+        }
+        /*
+         * `exec(compile(source, name, "exec"))` is ONE decision, and this rule saw
+         * two: once for the `exec` and once for the `compile` inside it. Flask's
+         * own config loader produced a duplicate pair on the same line.
+         *
+         * `compile` earns its place in the list because it is sometimes reached
+         * alone, but when its result is being handed straight to an evaluator the
+         * outer call is the honest place to report - it is where the code actually
+         * runs, and one line of source should not become two findings.
+         */
+        if (call.calleeName === 'compile') {
+            let ancestor = call.node.parent;
+            for (let depth = 0; ancestor && depth < 4; depth++) {
+                const text = ancestor.text ?? '';
+                if (/\b(eval|exec)\s*\(/.test(text) && ancestor.type !== 'call' && ancestor.type !== 'call_expression') {
+                    ancestor = ancestor.parent;
+                    continue;
+                }
+                if ((ancestor.type === 'call' || ancestor.type === 'call_expression') &&
+                    /^\s*(eval|exec)\s*\(/.test(text)) {
+                    return null;
+                }
+                ancestor = ancestor.parent;
+            }
+        }
+        const built = analyzeStringExpression(argument, language);
+        // `eval("1 + 1")` is a constant. Nobody can put anything inside it.
+        if (!built.isDynamic)
+            return null;
+        // `bar` written in a branch that cannot run, every live write a literal:
+        // the same proof the SQL rule withdraws on, with the same receipt.
+        const proof = constantProof(argument, built.dynamicParts, language, { staticMethod: ctx.staticMethod, javaTypeInScan: ctx.javaTypeInScan });
+        if (proof) {
+            if (proof.reasoned)
+                ctx.noteClean?.('code-injection', argument, proof.reason);
+            return null;
+        }
+        return {
+            node: call.node,
+            message: `Value passed to ${call.calleeName}() is executed as ${language === 'php' ? 'PHP' : language} code`,
+            reasoning: `\`${call.calleeName}()\` hands its argument to the interpreter this program is ` +
+                `already running inside, so whatever the string says, the process does - with ` +
+                `every permission it has. The value here is ${built.mechanism === 'opaque' ? 'a runtime value' : `built at runtime via ${built.mechanism}`}, ` +
+                `so its text is not fixed at the time you are reading this line. Escaping cannot ` +
+                `help, because the whole string is the program. Replace the evaluation with a ` +
+                `parser for the thing you actually wanted: an expression evaluator for arithmetic, ` +
+                `a fixed set of allowed operations for filters, a lookup table for plugin names.`,
+        };
+    },
+};
+//# sourceMappingURL=code-injection.js.map

package/dist/src/rules/code-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-injection.js","sourceRoot":"","sources":["../../../src/rules/code-injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE1E;;;;;;;;;GASG;AACH,MAAM,UAAU,GAA0C;IACxD,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;IACrF,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;IACrF,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;IACnC,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC;IAC1C,2DAA2D;IAC3D,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,EAAE,EAAE,EAAE;IACN,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,uDAAuD;IACvD,CAAC,EAAE,EAAE;IACL,GAAG,EAAE,EAAE;CACR,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACjD,MAAM;IACN,MAAM;IACN,SAAS;IACT,YAAY;IACZ,QAAQ;IACR,iBAAiB;IACjB,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,UAAU;IACV,OAAO;IACP,UAAU;IACV,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,cAAc,CAAC,MAAc,EAAE,IAAY;IAClD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACtD,2EAA2E;IAC3E,OAAO,CACL,IAAI,MAAM,CAAC,+DAA+D,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CACzF,MAAM,CACP,IAAI,IAAI,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAClE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,WAAW,GAAG,0CAA0C,CAAC;AAE/D,MAAM,CAAC,MAAM,iBAAiB,GAAS;IACrC,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,sCAAsC;IAC5C,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,6GAA6G;IACtH,GAAG,EACD,2GAA2G;IAC7G,WAAW,EACT,+EAA+E;QAC/E,+EAA+E;QAC/E,8EAA8E;QAC9E,8EAA8E;QAC9E,+EAA+E;QAC/E,6DAA6D;IAC/D,WAAW,EACT,8EAA8E;QAC9E,iFAAiF;QACjF,iFAAiF;QACjF,gFAAgF;QAChF,6EAA6E;QAC7E,8EAA8E;QAC9E,+EAA+E;QAC/E,4EAA4E;QAC5E,4EAA4E;QAC5E,sCAAsC;IACxC,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,OAAO,EAAE;QACP,UAAU,EAAE;YACV,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,0PAA0P;SACjQ;QACD,UAAU,EAAE;YACV,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,0BAA0B;SACjC;QACD,MAAM,EAAE;YACN,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,wKAAwK;SAC/K;QACD,IAAI,EAAE;YACJ,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,uPAAuP;SAC9P;QACD,GAAG,EAAE;YACH,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,yKAAyK;SAChL;QACD,EAAE,EAAE;YACF,MAAM,EAAE,iBAAiB;YACzB,IAAI,EAAE,qOAAqO;SAC5O;QACD,CAAC,EAAE;YACD,MAAM,EAAE,iBAAiB;YACzB,IAAI,EACF,oOAAoO;SACvO;QACD,GAAG,EAAE;YACH,MAAM,EAAE,iBAAiB;YACzB,IAAI,EACF,+OAA+O;SAClP;KACF;IACD,KAAK,CAAC,KAAK,EAAE,GAAG;QACd,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjE,qEAAqE;QACrE,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QAE7E,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,IAAI,GAAG,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,CAAC;QACpE,IAAI,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;YAC5F,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;QAC1B,CAAC;QAED,sEAAsE;QACtE,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACvD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACtE,wEAAwE;gBACxE,wDAAwD;gBACxD,IAAI,QAAQ,CAAC,IAAI,KAAK,mBAAmB;oBAAE,OAAO,IAAI,CAAC;YACzD,CAAC;QACH,CAAC;QAED;;;;;;;;;WASG;QACH,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,QAAQ,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;gBACjC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACvG,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC;oBAC3B,SAAS;gBACX,CAAC;gBACD,IACE,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,CAAC;oBACjE,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EACjC,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1D,oEAAoE;QACpE,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAClC,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5I,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,QAAQ;gBAAE,GAAG,CAAC,SAAS,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,mBAAmB,IAAI,CAAC,UAAU,qBAAqB,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,OAAO;YAC5G,SAAS,EACP,KAAK,IAAI,CAAC,UAAU,6DAA6D;gBACjF,+EAA+E;gBAC/E,8CAA8C,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,wBAAwB,KAAK,CAAC,SAAS,EAAE,IAAI;gBAC9I,kFAAkF;gBAClF,+EAA+E;gBAC/E,oFAAoF;gBACpF,iFAAiF;SACpF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/rules/command-injection.d.ts

@@ -0,0 +1,30 @@
+/**
+ * OS COMMAND INJECTION  (CWE-78, OWASP A05:2025 - Injection)
+ *
+ * WHAT THE BUG IS, in plain language:
+ * Some functions hand a string to the operating system's SHELL - the same
+ * program that runs your terminal. The shell has its own punctuation with
+ * special meaning: `;` ends a command and starts another, `|` pipes output,
+ * `&&` chains, and backticks or `$( )` run a command and paste its output.
+ *
+ *     exec("ping -c 1 " + host)
+ *
+ * If `host` is `example.com; rm -rf /`, the shell sees TWO commands and runs
+ * both. Same disease as SQL injection: data got mixed into instructions.
+ *
+ * THE FIX:
+ * Don't use a shell. Every language has a way to launch a program with its
+ * arguments as a LIST rather than a sentence - `execFile`/`spawn` without
+ * `shell: true` in Node, `subprocess.run([...])` without `shell=True` in
+ * Python, `exec.Command("ping", "-c", "1", host)` in Go. When arguments are a
+ * list, `;` is just a character in a string. Nothing parses it.
+ *
+ * WHY THIS RULE IS FUSSIER THAN THE SQL ONE:
+ * `spawn("ls", [dir])` is safe, `spawn("ls " + dir, {shell:true})` is not, and
+ * they are the same function. Where the safety depends on an options object we
+ * check for it textually and say so; where we cannot tell, we stay quiet rather
+ * than guess. A scanner that cries wolf on every subprocess call gets muted,
+ * and a muted scanner finds nothing.
+ */
+import { type Rule } from './contract.js';
+export declare const commandInjectionRule: Rule;