@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/rules/format-string.js

@@ -0,0 +1,146 @@
+/**
+ * FORMAT STRING INJECTION  (CWE-134)
+ *
+ * WHAT THE BUG IS.
+ *
+ *     printf(name);            // `name` came from the user
+ *
+ * looks like printing a string and is not. printf reads its first argument as a
+ * FORMAT, so whoever controls that string controls the conversions too:
+ *
+ *     %x %x %x %x     walks up the stack and prints whatever is sitting there
+ *     %s              treats a stack value as a pointer - crash, or a leak
+ *     %n              WRITES the number of bytes printed so far to a pointer
+ *                     argument, which turns a logging call into an arbitrary
+ *                     memory write
+ *
+ * That last conversion is why this is not a cosmetic bug. It is the standard
+ * route from "the program logs a username" to "the attacker runs code".
+ *
+ * WHY THIS RULE IS THE BEST ARGUMENT FOR POINTING A TAINT ENGINE AT C.
+ *
+ * Most famous C bugs are SIZE bugs - is this buffer big enough, is this integer
+ * about to wrap - and answering those needs an analysis of sizes, allocations
+ * and aliasing that this engine does not have. The unbounded-copy rule next
+ * door is careful to claim much less than its name suggests for exactly that
+ * reason.
+ *
+ * A format string bug needs none of it. The entire question is "is this ONE
+ * argument attacker-controlled?", which is the only question this engine
+ * answers, and it answers it with a printed path. So a flow-verified finding
+ * here means precisely what it says, with no hedge underneath it.
+ *
+ * THE TRAP THIS RULE MUST NOT FALL INTO.
+ *
+ *     printf(name)             dangerous
+ *     printf("%s", name)       correct
+ *
+ * Same function, one extra argument - the identical shape as a parameterised
+ * SQL query versus a concatenated one. A rule that fired on "printf with a
+ * tainted argument" would report the FIX as the bug, which this project treats
+ * as worse than a miss: it teaches people that hardening does not help. Only
+ * the format argument counts, and its index differs per function, so the table
+ * below is the whole rule.
+ */
+import { asCall } from './contract.js';
+import { isStringLiteral } from './lib/strings.js';
+/**
+ * Function name -> which argument is the FORMAT.
+ *
+ * Getting an index wrong here does not just miss a bug, it reports correct
+ * code, so each one is written out rather than inferred from the name.
+ */
+const FORMAT_ARGUMENT = new Map([
+    ['printf', 0],
+    ['vprintf', 0],
+    ['fprintf', 1],
+    ['sprintf', 1],
+    ['vfprintf', 1],
+    ['vsprintf', 1],
+    ['dprintf', 1],
+    ['asprintf', 1],
+    ['syslog', 1],
+    ['snprintf', 2],
+    ['vsnprintf', 2],
+]);
+const C_FAMILY = new Set(['c', 'cpp']);
+const NOT_C = {
+    status: 'not-implemented',
+    note: 'Format string injection is a C-family bug. Other languages either take the format ' +
+        'as a constant by construction or have no %n equivalent, so there is nothing here to ' +
+        'match and this rule never fires. Stated rather than left as a blank column.',
+};
+export const formatStringRule = {
+    id: 'format-string',
+    name: 'Attacker-controlled format string',
+    cwe: 'CWE-134',
+    owasp: 'A05:2025 Injection',
+    severity: 'high',
+    summary: 'The format string is not fixed; if it comes from outside, it can read or even write memory.',
+    fix: 'Make the format a fixed string and pass the value separately: printf("%s", name), not printf(name).',
+    explanation: 'A format string is a small program: %x reads, %s dereferences, and %n WRITES. When ' +
+        'the format itself comes from the user, they are writing that program. The fix is ' +
+        'always the same shape and always cheap - make the format a constant and pass the ' +
+        'value as data: printf("%s", name) instead of printf(name).',
+    limitations: 'A signature-based finding here means only that the format argument is not a literal ' +
+        'in this call - it may be a constant defined elsewhere, which we cannot see because ' +
+        'the preprocessor is not run and constants are not folded. A flow-verified finding ' +
+        'means the value was traced from an attacker-controlled source into the format ' +
+        'position, and that claim carries its path.',
+    shapes: ['call'],
+    support: {
+        c: {
+            status: 'implemented',
+            note: 'Covers the printf family (printf, fprintf, sprintf, snprintf, dprintf, asprintf, ' +
+                'syslog and their v- variants), with the format argument index recorded per ' +
+                'function so that the correct form - a constant format with the value passed as ' +
+                'data - is never reported. A format built by a macro is missed: the preprocessor ' +
+                'is not run.',
+        },
+        cpp: {
+            status: 'implemented',
+            note: 'Identical to C. std::format and iostreams are type-safe and cannot carry this ' +
+                'bug, so they are deliberately not matched; C++ code that calls printf still can, ' +
+                'and still does.',
+        },
+        javascript: NOT_C,
+        typescript: NOT_C,
+        python: NOT_C,
+        java: NOT_C,
+        go: NOT_C,
+        php: NOT_C,
+    },
+    check(shape, ctx) {
+        if (!C_FAMILY.has(ctx.language))
+            return null;
+        const call = asCall(shape);
+        if (!call)
+            return null;
+        const index = FORMAT_ARGUMENT.get(call.calleeName);
+        if (index === undefined)
+            return null;
+        const formatArgument = call.args[index];
+        // No argument in the format position at all - nothing to say about it.
+        if (!formatArgument)
+            return null;
+        /*
+         * A literal format is the SAFE form and the whole point of the fix. It is
+         * checked first and returns null, so `printf("%s", name)` can never be
+         * reported however dirty `name` is.
+         */
+        if (isStringLiteral(formatArgument, ctx.language))
+            return null;
+        const argumentText = ctx.text(formatArgument);
+        return {
+            node: call.node,
+            message: `${call.calleeName}() is called with a non-constant format string (\`${argumentText}\`)`,
+            reasoning: `The format argument of \`${call.calleeName}()\` is \`${argumentText}\`, which is not a ` +
+                `string literal. A format string is executable: \`%x\` reads values off the stack, ` +
+                `\`%s\` dereferences one as a pointer, and \`%n\` writes to memory. If that value ` +
+                `can be influenced by a user, this is a memory-write primitive rather than a print ` +
+                `statement. The fix is to make the format constant and pass the value as data: ` +
+                `\`${call.calleeName}(${index === 0 ? '' : '..., '}"%s", ${argumentText})\`.`,
+        };
+    },
+};
+//# sourceMappingURL=format-string.js.map

package/dist/src/rules/format-string.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-string.js","sourceRoot":"","sources":["../../../src/rules/format-string.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAC3D,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,WAAW,EAAE,CAAC,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,QAAQ,GAA4B,IAAI,GAAG,CAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAE5E,MAAM,KAAK,GAAG;IACZ,MAAM,EAAE,iBAA0B;IAClC,IAAI,EACF,oFAAoF;QACpF,sFAAsF;QACtF,6EAA6E;CAChF,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,mCAAmC;IACzC,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,6FAA6F;IACtG,GAAG,EACD,qGAAqG;IACvG,WAAW,EACT,qFAAqF;QACrF,mFAAmF;QACnF,mFAAmF;QACnF,4DAA4D;IAC9D,WAAW,EACT,sFAAsF;QACtF,qFAAqF;QACrF,oFAAoF;QACpF,gFAAgF;QAChF,4CAA4C;IAC9C,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,OAAO,EAAE;QACP,CAAC,EAAE;YACD,MAAM,EAAE,aAAa;YACrB,IAAI,EACF,mFAAmF;gBACnF,6EAA6E;gBAC7E,iFAAiF;gBACjF,kFAAkF;gBAClF,aAAa;SAChB;QACD,GAAG,EAAE;YACH,MAAM,EAAE,aAAa;YACrB,IAAI,EACF,gFAAgF;gBAChF,mFAAmF;gBACnF,iBAAiB;SACpB;QACD,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,KAAK;KACX;IAED,KAAK,CAAC,KAAK,EAAE,GAAG;QACd,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAErC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,uEAAuE;QACvE,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAEjC;;;;WAIG;QACH,IAAI,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/D,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,qDAAqD,YAAY,KAAK;YACjG,SAAS,EACP,4BAA4B,IAAI,CAAC,UAAU,aAAa,YAAY,qBAAqB;gBACzF,oFAAoF;gBACpF,mFAAmF;gBACnF,oFAAoF;gBACpF,gFAAgF;gBAChF,KAAK,IAAI,CAAC,UAAU,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,SAAS,YAAY,MAAM;SAChF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/rules/hardcoded-secret.d.ts

@@ -0,0 +1,38 @@
+/**
+ * HARDCODED CREDENTIALS  (CWE-798, OWASP A07:2025 - Authentication
+ * Authentication Failures; also A05 Security Misconfiguration)
+ *
+ * WHAT THE BUG IS, in plain language:
+ * A password, API key or private key written directly into source code is a
+ * secret that has already partly escaped. It is in your git history forever
+ * (deleting the line does not remove it - `git log -p` still has it), it is on
+ * every laptop that ever cloned the repo, it is in your CI logs and your
+ * backups, and every contractor who read the code knows it. You also cannot
+ * rotate it without a code change and a deploy.
+ *
+ * This is the least glamorous vulnerability class and, empirically, one of the
+ * most exploited: attackers scan public repositories for key formats
+ * continuously, and a leaked cloud key can become a bill or a breach in minutes.
+ *
+ * THE FIX:
+ * Keep secrets outside the code - environment variables, a secrets manager
+ * (Vault, AWS Secrets Manager, Doppler), or a config file that is gitignored.
+ * The code should read a NAME, never a VALUE. And if a secret was ever
+ * committed, rotate it; scrubbing history is not enough, because you cannot
+ * un-copy something.
+ *
+ * HOW THIS RULE DECIDES - three signals, deliberately separate:
+ *   1. KNOWN FORMAT     - the text matches a real vendor's key shape
+ *                         (AKIA..., ghp_..., sk_live_...). Very strong.
+ *   2. SUSPICIOUS NAME  - the variable is called `password`, `apiKey`,
+ *                         `secret`... and holds a literal string. Strong.
+ *   3. HIGH ENTROPY     - a long, random-looking literal with no meaningful
+ *                         name. Weak - this is the one that produces false
+ *                         positives, so it gets lower severity and the finding
+ *                         says explicitly that it is an entropy guess.
+ * Reporting all three at the same confidence would be exactly the dishonesty
+ * this project rejects, so they carry different severities and different
+ * reasoning text.
+ */
+import { type Rule } from './contract.js';
+export declare const hardcodedSecretRule: Rule;

package/dist/src/rules/hardcoded-secret.js

@@ -0,0 +1,440 @@
+/**
+ * HARDCODED CREDENTIALS  (CWE-798, OWASP A07:2025 - Authentication
+ * Authentication Failures; also A05 Security Misconfiguration)
+ *
+ * WHAT THE BUG IS, in plain language:
+ * A password, API key or private key written directly into source code is a
+ * secret that has already partly escaped. It is in your git history forever
+ * (deleting the line does not remove it - `git log -p` still has it), it is on
+ * every laptop that ever cloned the repo, it is in your CI logs and your
+ * backups, and every contractor who read the code knows it. You also cannot
+ * rotate it without a code change and a deploy.
+ *
+ * This is the least glamorous vulnerability class and, empirically, one of the
+ * most exploited: attackers scan public repositories for key formats
+ * continuously, and a leaked cloud key can become a bill or a breach in minutes.
+ *
+ * THE FIX:
+ * Keep secrets outside the code - environment variables, a secrets manager
+ * (Vault, AWS Secrets Manager, Doppler), or a config file that is gitignored.
+ * The code should read a NAME, never a VALUE. And if a secret was ever
+ * committed, rotate it; scrubbing history is not enough, because you cannot
+ * un-copy something.
+ *
+ * HOW THIS RULE DECIDES - three signals, deliberately separate:
+ *   1. KNOWN FORMAT     - the text matches a real vendor's key shape
+ *                         (AKIA..., ghp_..., sk_live_...). Very strong.
+ *   2. SUSPICIOUS NAME  - the variable is called `password`, `apiKey`,
+ *                         `secret`... and holds a literal string. Strong.
+ *   3. HIGH ENTROPY     - a long, random-looking literal with no meaningful
+ *                         name. Weak - this is the one that produces false
+ *                         positives, so it gets lower severity and the finding
+ *                         says explicitly that it is an entropy guess.
+ * Reporting all three at the same confidence would be exactly the dishonesty
+ * this project rejects, so they carry different severities and different
+ * reasoning text.
+ */
+import { asAssignment, asCall } from './contract.js';
+import { isLikelyPlaceholder, looksLikeSql, looksLikeProse, echoesItsOwnName, isStructuralIdentifier, isStringLiteral, isTestPath, looksLikeToken, matchKnownSecret, shannonEntropy, unquote, } from './lib/strings.js';
+/** Variable/field names that suggest the value is a credential. */
+const SECRET_NAME = new RegExp([
+    'pass(word|wd|phrase)?',
+    'secret',
+    'token',
+    'api[_-]?key',
+    'apikey',
+    'access[_-]?key',
+    'secret[_-]?key',
+    'private[_-]?key',
+    'client[_-]?secret',
+    'encryption[_-]?key',
+    'signing[_-]?key',
+    // The lookahead matters: without it, "auth" matches inside "author",
+    // "authorize" and Gin's "AuthUserKey". Found by scanning real repositories.
+    'auth[_-]?(token|key|header|secret)?(?![A-Za-z])',
+    'credential',
+    'bearer',
+    'jwt[_-]?secret',
+    'session[_-]?secret',
+    'connection[_-]?string',
+    'conn[_-]?str',
+    'dsn',
+].join('|'), 'i');
+/**
+ * Names that MATCH the pattern above but are not secrets: they hold the name of
+ * a secret, its location, or a boolean about it. Checked first.
+ *
+ * `prefix`, `suffix` and `source` came from Django, where all three were HIGH
+ * findings: SECRET_KEY_INSECURE_PREFIX = "django-insecure-" is the prefix the
+ * code checks keys FOR, and token_source = "POST" is where a token is read
+ * from (tests/fixtures/safe/secret-shaped-names.py).
+ */
+const NOT_A_SECRET = /(_?(name|field|label|header|type|env|var|path|file|url|uri|prompt|placeholder|examples?|samples?|hash|algo|algorithm|regex|pattern|length|expiry|ttl|enabled|required|prefix|suffix|source)$)|^(has|is|use|should|allow|require)/i;
+/**
+ * A VALUE THAT NAMES A KEY SLOT, not one that fills it:
+ *
+ *     INTERNAL_RESET_SESSION_TOKEN = "_password_reset_token"
+ *
+ * is the session key Django stores the reset token UNDER. Lowercase
+ * snake_case, letters only, at least two words, one of which is a slot noun.
+ * Anything with a digit or a capital still reports - generated values carry
+ * one or the other - and so does snake_case without a slot word
+ * (`DB_PASSWORD = "admin_pass"`, tests/fixtures/vulnerable/secret-near-misses.py).
+ * The cost: a human-chosen secret spelled like a key name, `my_secret_token`,
+ * is not reported, and the rule's limitations say so.
+ */
+const KEY_SLOT_NAME = /^_?[a-z]+(?:_[a-z]+)+$/;
+const SLOT_NOUNS = new Set(['password', 'passwd', 'token', 'secret', 'key', 'session', 'csrf', 'cookie', 'nonce']);
+function namesAKeySlot(value) {
+    if (!KEY_SLOT_NAME.test(value))
+        return false;
+    return value.split('_').some((word) => SLOT_NOUNS.has(word));
+}
+/**
+ * A STATEMENT OR TEMPLATE THE SECRET IS SUBSTITUTED INTO:
+ *
+ *     set_password = 'ALTER USER %(user)s IDENTIFIED BY "%(password)s"'
+ *
+ * from Django's Oracle backend. The password is the placeholder, filled in
+ * later; the string is SQL. A Spring `{noop}hunter22` is not a template - the
+ * brace form is not read here at all.
+ */
+/**
+ * A LEXER'S TOKEN, NOT AN AUTH TOKEN.
+ *
+ * Django's template engine builds operator tokens for `{% if %}` -
+ * `token = "is not"`, `token = "not in"` in django/template/smartif.py - and
+ * both were reported as hardcoded credentials because of the variable name.
+ *
+ * The test is narrow on purpose. The name's only credential word must be
+ * `token` (`sessionToken` is a credential slot whatever it holds), and EVERY
+ * word of the value must be a programming-language keyword or an operator.
+ * One ordinary word - "manny is cool" - and it is a passphrase again.
+ */
+const LANGUAGE_WORDS = new Set([
+    'is', 'not', 'in', 'and', 'or', 'if', 'else', 'elif', 'for', 'while', 'def', 'class',
+    'return', 'true', 'false', 'none', 'null', 'nil', 'undefined', 'new', 'of', 'as', 'with',
+    'from', 'import', 'lambda', 'yield', 'await', 'async', 'try', 'except', 'finally', 'raise',
+    'throw', 'catch', 'case', 'switch', 'default', 'break', 'continue', 'pass', 'do', 'then',
+    'end', 'endif', 'endfor', 'block', 'endblock', 'let', 'var', 'const', 'typeof', 'instanceof',
+]);
+const OTHER_CREDENTIAL_WORD = /pass|secret|key|auth|credential|bearer|jwt|session|access|refresh|csrf|api/i;
+function isLanguageToken(name, value) {
+    if (!/token/i.test(name) || OTHER_CREDENTIAL_WORD.test(name))
+        return false;
+    const words = value.trim().split(/\s+/).filter(Boolean);
+    return words.length > 0 && words.every((w) => LANGUAGE_WORDS.has(w.toLowerCase()) || /^[^\w\s]+$/.test(w));
+}
+function isStatementOrTemplate(value) {
+    return looksLikeSql(value) || /%\([A-Za-z_]\w*\)[sdr]/.test(value);
+}
+/** Entropy threshold above which a long literal starts looking machine-generated. */
+const ENTROPY_THRESHOLD = 4.0;
+const MIN_ENTROPY_LENGTH = 24;
+function literalOf(node, language) {
+    if (!isStringLiteral(node, language))
+        return null;
+    const text = unquote((node.text ?? '').trim());
+    return { node, text };
+}
+/**
+ * PUBLIC BY DESIGN: a blockchain address, or a file name.
+ *
+ * Juice Shop's Web3 pages produced twenty "credentials": contract and wallet
+ * ADDRESSES - `BeeTokenAddress = '0x3643...'`, Bitcoin `address: '1AbK...'` -
+ * which are published on a public ledger and are the opposite of secret, and a
+ * map of Solidity compiler file names. An address is only let off when the
+ * name says address or does not say credential at all: `secretKey = '0x' + 40
+ * hex digits` still reports. A wallet's PRIVATE key is 64 hex digits, not 40,
+ * so it never matches here (tests/fixtures/vulnerable/secret-arguments.js).
+ */
+const ETH_ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+const BASE58_ADDRESS = /^(?:[13][1-9A-HJ-NP-Za-km-z]{25,34}|X[1-9A-HJ-NP-Za-km-z]{33}|(?:bc|tb)1[02-9ac-hj-np-z]{11,71})$/;
+const ADDRESS_NAME = /address|addr|wallet|contract|recipient|payee/i;
+const FILE_NAME = /^[\w.+@-]+\.(?:js|mjs|cjs|json|wasm|css|map|html?|png|jpe?g|gif|svg|ico|txt|md|xml|ya?ml|zip|gz|tgz|tar|pdf|woff2?|ttf)$/i;
+function isPublicIdentifier(name, value) {
+    if (FILE_NAME.test(value))
+        return true;
+    const addressShaped = ETH_ADDRESS.test(value) || BASE58_ADDRESS.test(value);
+    return addressShaped && (ADDRESS_NAME.test(name) || !SECRET_NAME.test(name));
+}
+const JS_KEY_ARGUMENTS = [
+    { callee: 'createHmac', index: 1 },
+    { callee: 'createCipheriv', index: 1 },
+    { callee: 'createDecipheriv', index: 1 },
+    { callee: 'createSecretKey', index: 0 },
+    { callee: 'sign', receiver: /^(jwt|jsonwebtoken)$/i, index: 1 },
+    { callee: 'verify', receiver: /^(jwt|jsonwebtoken)$/i, index: 1 },
+];
+const KEY_ARGUMENTS = {
+    javascript: JS_KEY_ARGUMENTS,
+    typescript: JS_KEY_ARGUMENTS,
+    python: [
+        { callee: 'new', receiver: /^hmac$/, index: 0 },
+        { callee: 'encode', receiver: /^jwt$/, index: 1 },
+        { callee: 'decode', receiver: /^jwt$/, index: 1 },
+    ],
+    php: [
+        { callee: 'hash_hmac', index: 2 },
+        { callee: 'openssl_encrypt', index: 2 },
+        { callee: 'openssl_decrypt', index: 2 },
+        { callee: 'encode', receiver: /(^|\\)JWT$/, index: 1 },
+    ],
+};
+const TEMPLATE_REFERENCE = /^\$\{?\w+\}?$|^%\(\w+\)s$|^<[^>]+>$|^\{\{.*\}\}$/;
+export const hardcodedSecretRule = {
+    id: 'hardcoded-secret',
+    name: 'Credential written directly into source code',
+    cwe: 'CWE-798',
+    owasp: 'A07:2025 Authentication Failures',
+    severity: 'high',
+    summary: 'A password or key is written in the code, so anyone with the code or its git history has it.',
+    fix: 'Move it to an environment variable or secrets manager, read it by name, and rotate the exposed one.',
+    explanation: 'A password or API key written into source code lives in git history forever, on ' +
+        'every machine that cloned the repo, and in every CI log. It cannot be rotated ' +
+        'without a deploy, and public repositories are scanned for key formats ' +
+        'continuously. Secrets belong in environment variables or a secrets manager; the ' +
+        'code should reference a name, never a value.',
+    limitations: 'UNVERIFIED (signature-based): we matched a name pattern, a known vendor key format, ' +
+        'or a randomness score. We cannot tell a real production key from a test fixture, ' +
+        'a rotated-and-dead key, or a deliberately fake example. Entropy-only hits in ' +
+        'particular are a guess about how random text looks, nothing more. ' +
+        'DELIBERATE GAP: values matching a vendor format but ending in EXAMPLE, or with ' +
+        'the random portion filled by 0000/1234567890, are treated as published ' +
+        'documentation placeholders (AWS prints AKIAIOSFODNN7EXAMPLE in its own docs) and ' +
+        'are NOT reported. A real key that happens to end in EXAMPLE would be missed. ' +
+        'Also not reported: a value under a name ending in prefix, suffix or source; a value ' +
+        'that is an SQL statement or a %(name)s template; and a lowercase snake_case value ' +
+        'that names a key slot (`_password_reset_token`) - so a human-chosen secret spelled ' +
+        'like one, `my_secret_token`, would be missed. Nor a value under a name whose only ' +
+        'credential word is `token` when every word of it is a programming keyword or operator ' +
+        '(`token = "is not"` in a template lexer) - a secret made only of such words would be missed. ' +
+        'Nor a blockchain address (`0x` and 40 hex digits, or a Bitcoin-style address) under a name that ' +
+        'says address or does not say credential, nor a value that is a file name (`soljson-v0.8.21.js`): ' +
+        'both are public by design. A key passed straight to a call is reported only for the calls listed ' +
+        'in KEY_ARGUMENTS (createHmac, createCipheriv, jwt.sign / verify, hmac.new, jwt.encode / decode, ' +
+        'hash_hmac, openssl_encrypt / decrypt, JWT::encode); any other function that takes a key is not read.',
+    shapes: ['assignment', 'call'],
+    support: {
+        javascript: {
+            status: 'implemented',
+            note: 'Covers variable declarations, assignments and object-literal entries ({ apiKey: "..." }).',
+        },
+        typescript: {
+            status: 'implemented',
+            note: 'Additionally covers class property definitions (`private token = "..."`).',
+        },
+        python: {
+            status: 'implemented',
+            note: 'Covers assignments, dict literals and keyword arguments (connect(password="...")).',
+        },
+        java: {
+            status: 'implemented',
+            note: 'Covers field and local variable initialisers, including `static final String`. Values read from .properties files are not analysed - this tool parses code, not config.',
+        },
+        go: {
+            status: 'implemented',
+            note: 'Covers :=, var, const and struct literal fields (Config{ApiKey: "..."}).',
+        },
+        php: {
+            status: 'implemented',
+            note: 'Covers $var = "..." and class property declarations. NOT covered: define(\'API_KEY\', \'...\') and const declarations, which are a different shape - a documented gap, not a silent one.',
+        },
+        c: {
+            status: 'implemented',
+            note: 'String literals and initialisers are analysed exactly as in every other language - C has no interpolation, so a credential is either a literal or it is not. NOT COVERED: a secret assembled by the preprocessor (#define KEY "...") is invisible, because the preprocessor is not run.',
+        },
+        cpp: {
+            status: 'implemented',
+            note: 'Every C entry applies unchanged, since C++ inherits the whole libc surface and real code still uses it. Namespace-qualified calls (std::system) and method calls on objects are recognised in addition.',
+        },
+    },
+    check(shape, ctx) {
+        const language = ctx.language;
+        /**
+         * Test and example files get a severity downgrade, not a free pass.
+         * Measured on five real repositories, 167 of 179 raw findings were in test
+         * trees. Dropping them silently would be dishonest (a committed key is
+         * committed wherever it lives) and reporting them as HIGH buries the real
+         * ones. So: keep the finding, lower the severity, say why in the reasoning.
+         *
+         * THE SEVERITY PART OF THIS NOW HAPPENS IN core/analyze.ts, for every rule
+         * rather than only this one - see the note there. What stays here is the
+         * sentence only a credential rule can write: that the VALUE is likely a
+         * stand-in. `eval()` in a test is still a real eval; `password = 'x'` in a
+         * test is usually not a real password, and that difference is worth saying.
+         */
+        const inTests = isTestPath(ctx.file.path);
+        const testNote = inTests
+            ? ' NOTE: in a test or fixture file the value is usually a stand-in rather than a ' +
+                'live credential. It is still committed to git history, and fixtures do get ' +
+                'copy-pasted into production.'
+            : '';
+        const downgrade = (severity) => severity;
+        /* ---- Any string literal argument that matches a known vendor format ----
+         * e.g. client.init("AKIAIOSFODNN7EXAMPLE"). No variable name to go on, but
+         * the shape of the value alone is conclusive enough to report.          */
+        const call = asCall(shape);
+        if (call) {
+            for (const arg of call.args) {
+                const literal = literalOf(arg, language);
+                if (!literal)
+                    continue;
+                const known = matchKnownSecret(literal.text);
+                if (!known)
+                    continue;
+                return {
+                    node: arg,
+                    severity: downgrade('critical'),
+                    message: `${known.label} passed literally to ${call.calleeText}()`,
+                    reasoning: `The string passed to \`${call.calleeText}()\` matches the published format of ` +
+                        `a ${known.label}. Vendor key formats are distinctive enough that automated ` +
+                        `scrapers search public code for exactly this pattern. Treat this key as ` +
+                        `already compromised and rotate it, then move it to an environment variable.` +
+                        testNote,
+                };
+            }
+            for (const slot of KEY_ARGUMENTS[language] ?? []) {
+                if (call.calleeName !== slot.callee)
+                    continue;
+                if (slot.receiver && !slot.receiver.test(call.receiverText))
+                    continue;
+                const arg = call.args[slot.index];
+                if (!arg || !isStringLiteral(arg, language))
+                    continue;
+                const value = unquote((arg.text ?? '').trim());
+                if (value.length < 4 || TEMPLATE_REFERENCE.test(value))
+                    continue;
+                return {
+                    node: arg,
+                    severity: downgrade('high'),
+                    message: `Key written into the code, passed straight to ${call.calleeText}()`,
+                    reasoning: `Argument ${slot.index + 1} of \`${call.calleeText}()\` is the key it signs, encrypts or ` +
+                        `verifies with, and here it is a fixed string literal (${value.length} characters) rather ` +
+                        `than a value read from the environment or a secrets manager. Anyone who can read the ` +
+                        `code - or its git history - can forge what this key protects.` +
+                        testNote,
+                };
+            }
+            return null;
+        }
+        const assignment = asAssignment(shape);
+        if (!assignment)
+            return null;
+        const literal = literalOf(assignment.value, language);
+        if (!literal)
+            return null; // `password = getSecret()` is the correct pattern.
+        const value = literal.text;
+        const name = assignment.targetName;
+        /* ---- Signal 1: a known vendor key format. Strongest. ---- */
+        const known = matchKnownSecret(value);
+        if (known) {
+            return {
+                node: assignment.node,
+                severity: downgrade('critical'),
+                message: `${known.label} hardcoded in \`${name}\``,
+                reasoning: `The literal assigned to \`${name}\` matches the published format of a ` +
+                    `${known.label}. This is not a name-based guess - the value itself is ` +
+                    `structurally identifiable as a credential. Rotate it (assume it is already ` +
+                    `public if this repo has ever been shared) and load it from the environment.` +
+                    testNote,
+            };
+        }
+        if (isLikelyPlaceholder(value))
+            return null;
+        /*
+         * A SECRET IS NOT A SENTENCE. cal.com stores its user-facing error strings
+         * under credential-shaped names - `encryption_key_missing`, `api_key_invalid`
+         * - so the name pattern matched and the value was an error message. See
+         * looksLikeProse(), which is deliberately word-shaped rather than
+         * space-shaped so that a diceware passphrase still reports.
+         */
+        if (looksLikeProse(name, value))
+            return null;
+        // A value that only restates its own variable name is a lookup key, not a
+        // credential. See echoesItsOwnName() - this was 152 findings on Keycloak.
+        if (echoesItsOwnName(name, value))
+            return null;
+        if (isStatementOrTemplate(value))
+            return null;
+        if (isLanguageToken(name, value))
+            return null;
+        if (isPublicIdentifier(name, value))
+            return null;
+        /* ---- Signal 2: the variable name says "credential". ---- */
+        if (SECRET_NAME.test(name) && !NOT_A_SECRET.test(name)) {
+            if (value.length < 4)
+                return null; // "", "x" - not a real secret
+            // A suspicious NAME cannot outvote a value that is structurally not a
+            // key. `token: 'delimiter.curly'` is a theme scope, not a credential.
+            if (isStructuralIdentifier(value))
+                return null;
+            if (namesAKeySlot(value))
+                return null;
+            return {
+                node: assignment.node,
+                severity: downgrade('high'),
+                message: `Credential-looking value hardcoded in \`${name}\``,
+                reasoning: `\`${name}\` matches the naming pattern for a credential and is assigned a ` +
+                    `fixed string literal (${value.length} characters) rather than being read from ` +
+                    `the environment or a secrets manager. Anything committed here is in git ` +
+                    `history permanently, even if the line is deleted later.` + testNote,
+            };
+        }
+        /* ---- Signal 3: entropy only. Weakest - and labelled as such. ---- */
+        // The structural gate comes FIRST: entropy alone cannot tell a key from a
+        // MIME type. See looksLikeToken() for the measurements that motivated this.
+        /*
+         * AN IDENTIFIER IS NOT A CREDENTIAL, however random it looks.
+         *
+         * Mattermost's TypeScript produced 266 hardcoded-secret findings and 160
+         * came down this path, nearly all of them shaped like
+         *
+         *     id: 'owsyt8n43jfxjpzh9np93mx1wa'
+         *     group_id: 'cpa9q4w7m2x5c8v1b6n3k0jr5h'
+         *
+         * in `.test.tsx` fixtures. Those are Mattermost's 26-character record ids.
+         * The entropy heuristic is not wrong about them - they ARE random, that is
+         * the point of an id - it is just answering a question nobody asked.
+         *
+         * Unlike the name path, the entropy path had no name check whatsoever: it
+         * fired on any variable at all. A name that says "identifier" is the
+         * cheapest possible signal that randomness is expected here, and this is
+         * the WEAKEST of the three signals to begin with, so a hardcoded session id
+         * lost to it costs a `medium` guess rather than a real detection.
+         */
+        if (/(^|_)(id|ids|uuid|guid|sid|gid|uid)$/i.test(name) || /Id$/.test(name))
+            return null;
+        /*
+         * A PROPERTY NAMED `example` IS DOCUMENTATION, and it is high-entropy on
+         * purpose - a sample ID or JWT has to look real to be useful. cal.com's
+         * OpenAPI output schemas are built from them. The entropy path had no name
+         * check at all until Mattermost's record ids forced one directly above;
+         * this is the same idea, and `example` is the OpenAPI keyword rather than a
+         * guess at intent.
+         */
+        if (/(^|[._-])examples?$|(^|[._-])samples?$/i.test(name))
+            return null;
+        if (value.length >= MIN_ENTROPY_LENGTH && looksLikeToken(value)) {
+            const entropy = shannonEntropy(value);
+            if (entropy >= ENTROPY_THRESHOLD) {
+                return {
+                    node: assignment.node,
+                    severity: downgrade('medium'),
+                    message: `High-entropy literal assigned to \`${name}\` (possible secret)`,
+                    reasoning: `The value assigned to \`${name}\` is ${value.length} characters long with a ` +
+                        `Shannon entropy of ${entropy.toFixed(2)} bits/character. Ordinary English text ` +
+                        `scores around 2.5-3.5; generated keys and tokens usually score above 4. ` +
+                        `THIS IS A RANDOMNESS HEURISTIC, NOT AN IDENTIFICATION - a hash, a UUID, a ` +
+                        `base64 test fixture or a minified blob will score the same. Severity is ` +
+                        `deliberately lower than a name or format match for that reason.` + testNote,
+                    limitations: 'UNVERIFIED (signature-based, entropy heuristic): this finding rests ONLY on how ' +
+                        'random the text looks. There is no name evidence and no format evidence. ' +
+                        'Expect false positives and treat it as "worth a glance", not "a secret".',
+                };
+            }
+        }
+        return null;
+    },
+};
+//# sourceMappingURL=hardcoded-secret.js.map

package/dist/src/rules/hardcoded-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-secret.js","sourceRoot":"","sources":["../../../src/rules/hardcoded-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,OAAO,GACR,MAAM,kBAAkB,CAAC;AAE1B,mEAAmE;AACnE,MAAM,WAAW,GAAG,IAAI,MAAM,CAC5B;IACE,uBAAuB;IACvB,QAAQ;IACR,OAAO;IACP,aAAa;IACb,QAAQ;IACR,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,oBAAoB;IACpB,iBAAiB;IACjB,qEAAqE;IACrE,4EAA4E;IAC5E,iDAAiD;IACjD,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,oBAAoB;IACpB,uBAAuB;IACvB,cAAc;IACd,KAAK;CACN,CAAC,IAAI,CAAC,GAAG,CAAC,EACX,GAAG,CACJ,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,YAAY,GAChB,mOAAmO,CAAC;AAEtO;;;;;;;;;;;;GAYG;AACH,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACnH,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;IACpF,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;IACxF,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO;IAC1F,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IACxF,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY;CAC7F,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,6EAA6E,CAAC;AAE5G,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,qFAAqF;AACrF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAO9B,SAAS,SAAS,CAAC,IAAU,EAAE,QAAoB;IACjD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,MAAM,cAAc,GAAG,mGAAmG,CAAC;AAC3H,MAAM,YAAY,GAAG,+CAA+C,CAAC;AACrE,MAAM,SAAS,GAAG,2HAA2H,CAAC;AAC9I,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,OAAO,aAAa,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/E,CAAC;AAaD,MAAM,gBAAgB,GAAuB;IACzC,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE;IAClC,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE;IACtC,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE;IACxC,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE;IACvC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE;IAC/D,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE;CACpE,CAAC;AACF,MAAM,aAAa,GAAoD;IACrE,UAAU,EAAE,gBAAgB;IAC5B,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE;QACN,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE;QAC/C,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;QACjD,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;KAClD;IACD,GAAG,EAAE;QACH,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;QACjC,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE;QACvC,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE;QACvC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE;KACvD;CACF,CAAC;AACF,MAAM,kBAAkB,GAAG,kDAAkD,CAAC;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAS;IACvC,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,8CAA8C;IACpD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,kCAAkC;IACzC,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,8FAA8F;IACvG,GAAG,EACD,qGAAqG;IACvG,WAAW,EACT,kFAAkF;QAClF,gFAAgF;QAChF,wEAAwE;QACxE,kFAAkF;QAClF,8CAA8C;IAChD,WAAW,EACT,sFAAsF;QACtF,mFAAmF;QACnF,+EAA+E;QAC/E,oEAAoE;QACpE,iFAAiF;QACjF,yEAAyE;QACzE,mFAAmF;QACnF,+EAA+E;QAC/E,sFAAsF;QACtF,oFAAoF;QACpF,qFAAqF;QACrF,oFAAoF;QACpF,wFAAwF;QACxF,+FAA+F;QAC/F,kGAAkG;QAClG,mGAAmG;QACnG,mGAAmG;QACnG,kGAAkG;QAClG,sGAAsG;IACxG,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,2FAA2F;SAClG;QACD,UAAU,EAAE;YACV,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,2EAA2E;SAClF;QACD,MAAM,EAAE;YACN,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,oFAAoF;SAC3F;QACD,IAAI,EAAE;YACJ,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,yKAAyK;SAChL;QACD,EAAE,EAAE;YACF,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,0EAA0E;SACjF;QACD,GAAG,EAAE;YACH,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,0LAA0L;SACjM;QACD,CAAC,EAAE;YACD,MAAM,EAAE,aAAa;YACrB,IAAI,EACF,yRAAyR;SAC5R;QACD,GAAG,EAAE;YACH,MAAM,EAAE,aAAa;YACrB,IAAI,EACF,yMAAyM;SAC5M;KACF;IACD,KAAK,CAAC,KAAK,EAAE,GAAG;QACd,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE9B;;;;;;;;;;;;WAYG;QACH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,OAAO;YACtB,CAAC,CAAC,iFAAiF;gBACjF,6EAA6E;gBAC7E,8BAA8B;YAChC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,SAAS,GAAG,CAAC,QAAwC,EAAkC,EAAE,CAC7F,QAAQ,CAAC;QAEX;;mFAE2E;QAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACzC,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC7C,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,OAAO;oBACL,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC;oBAC/B,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,wBAAwB,IAAI,CAAC,UAAU,IAAI;oBAClE,SAAS,EACP,0BAA0B,IAAI,CAAC,UAAU,uCAAuC;wBAChF,KAAK,KAAK,CAAC,KAAK,6DAA6D;wBAC7E,0EAA0E;wBAC1E,6EAA6E;wBAC7E,QAAQ;iBACX,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM;oBAAE,SAAS;gBAC9C,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;oBAAE,SAAS;gBACtE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;oBAAE,SAAS;gBACtD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACjE,OAAO;oBACL,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC;oBAC3B,OAAO,EAAE,iDAAiD,IAAI,CAAC,UAAU,IAAI;oBAC7E,SAAS,EACP,YAAY,IAAI,CAAC,KAAK,GAAG,CAAC,SAAS,IAAI,CAAC,UAAU,wCAAwC;wBAC1F,yDAAyD,KAAK,CAAC,MAAM,sBAAsB;wBAC3F,uFAAuF;wBACvF,+DAA+D;wBAC/D,QAAQ;iBACX,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAE7B,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;QAE9E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC;QAEnC,+DAA+D;QAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC;gBAC/B,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,mBAAmB,IAAI,IAAI;gBAClD,SAAS,EACP,6BAA6B,IAAI,uCAAuC;oBACxE,GAAG,KAAK,CAAC,KAAK,yDAAyD;oBACvE,6EAA6E;oBAC7E,6EAA6E;oBAC7E,QAAQ;aACX,CAAC;QACJ,CAAC;QAED,IAAI,mBAAmB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C;;;;;;WAMG;QACH,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,qBAAqB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjD,8DAA8D;QAC9D,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;YACjE,sEAAsE;YACtE,sEAAsE;YACtE,IAAI,sBAAsB,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,IAAI,aAAa,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC;gBAC3B,OAAO,EAAE,2CAA2C,IAAI,IAAI;gBAC5D,SAAS,EACP,KAAK,IAAI,mEAAmE;oBAC5E,yBAAyB,KAAK,CAAC,MAAM,2CAA2C;oBAChF,0EAA0E;oBAC1E,yDAAyD,GAAG,QAAQ;aACvE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E;;;;;;;;;;;;;;;;;;WAkBG;QACH,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxF;;;;;;;WAOG;QACH,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtE,IAAI,KAAK,CAAC,MAAM,IAAI,kBAAkB,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACjC,OAAO;oBACL,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC;oBAC7B,OAAO,EAAE,sCAAsC,IAAI,sBAAsB;oBACzE,SAAS,EACP,2BAA2B,IAAI,SAAS,KAAK,CAAC,MAAM,0BAA0B;wBAC9E,sBAAsB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,yCAAyC;wBACjF,0EAA0E;wBAC1E,4EAA4E;wBAC5E,0EAA0E;wBAC1E,iEAAiE,GAAG,QAAQ;oBAC9E,WAAW,EACT,kFAAkF;wBAClF,2EAA2E;wBAC3E,0EAA0E;iBAC7E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC"}