@sphior/scan 0.1.6 → 0.1.7

package/README.md

@@ -31,20 +31,44 @@ sphior-scan run <dir> [options]
 
 Options:
   --sarif <file>         write SARIF 2.1.0 (GitHub code scanning, most CI tools)
-  --json <file>          write raw findings as JSON
-  --fix-context <file>   write finding context for an AI assistant to act on
-  --fail-on <severity>   exit non-zero at or above this severity
-                         (critical | high | medium | low)
+  --json <file>          write the findings as JSON
+  --fix-context <file>   write one entry per place to fix, for an AI assistant to act on
+  --suppressed <file>    write the findings accepted via .sphiorignore or inline comments
+  --fail-on <severity>   exit 1 at or above this severity
+                         (critical | high | medium | low | info)
+  --no-ignore-file       do not read .sphiorignore
 ```
 
-SARIF is written to stdout as well, so it pipes cleanly:
+With none of `--sarif`, `--json` or `--fix-context`, results go to stdout: a table in a
+terminal, SARIF when piped. A one-line summary (with engine and ruleset versions) always goes
+to stderr.
 
 ```bash
 sphior-scan run ./src --fail-on high
 ```
 
-Exit code is `0` when nothing at or above `--fail-on` was found, non-zero otherwise —
-which is what you want in CI.
+Exit codes: `0` when nothing reached `--fail-on` (or no threshold was given), `1` when something
+did, `2` when the arguments are wrong or the directory does not exist — so a typo in CI never
+passes as a clean scan.
+
+### Excluding paths and accepting findings
+
+`.sphiorignore` at the scanned root, one entry per line — `<glob> [rule_id] [# reason]`:
+
+```gitignore
+generated/**                                # no rule id: the files are not read
+test/fixtures/**   secret.*                 # rule id: scanned, then accepted with a reason
+```
+
+Inline, with any line-comment syntax:
+
+```js
+eval(template); // sphior-ignore: constant input from build time
+// sphior-ignore-next-line secret.private_key: documentation string
+```
+
+Accepted findings are left out of SARIF (GitHub code scanning ignores SARIF suppressions) and
+written to `--suppressed` with their reason.
 
 ### GitHub Actions
 
@@ -89,7 +113,8 @@ upload, no telemetry, no language model, no account. It runs correctly with netw
 ## Links
 
 - Product: <https://sphior.com/code>
-- Issues: <https://github.com/Toraastrta/Sphior/issues>
+- Source and full documentation: <https://github.com/Toraastrta/sphior-code>
+- Issues: <https://github.com/Toraastrta/sphior-code/issues>
 
 ## License
 

package/dist/cli.js

@@ -15274,6 +15274,24 @@ var PATTERN_RULES = [
     exts: JS,
     pattern: /createHash\s*\(\s*['"`](?:md5|sha1)['"`]\s*\)/gi
   },
+  {
+    // 2026-10-23: 自己完結コーパス（measure-gate/sast-corpus.ts）が検出欠落として
+    // 検出した。pattern.go.weak_cipher と pattern.java.weak_cipher は存在するのに
+    // **JS/TS 版が無く**、同じ弱点が Go/Java では検出され Node では無検出だった。
+    //
+    // 0-FP の作り: アルゴリズム名を**引用符の直後に固定**する。これが無いと
+    // "description" のような語が `des` に当たる。安全な算法（aes-256-gcm /
+    // aes-256-cbc 等）に当たらないことはテストで固定している。
+    id: "pattern.js.weak_cipher",
+    cwe: "CWE-327",
+    owasp: "A02:2021",
+    severity: "medium",
+    title: "Weak cipher algorithm",
+    message: "DES/3DES, RC2/RC4, Blowfish and IDEA are broken; ECB mode leaks plaintext structure.",
+    remediation: "Use aes-256-gcm (AEAD) with a random IV via crypto.createCipheriv().",
+    exts: JS,
+    pattern: /create(?:De)?Cipher(?:iv)?\s*\(\s*['"`](?:des(?:-[a-z0-9-]*)?|rc[24](?:-[a-z0-9-]*)?|bf(?:-[a-z0-9-]*)?|blowfish|idea(?:-[a-z0-9-]*)?|[a-z0-9-]*-ecb)['"`]/gi
+  },
   // ── Python ──
   {
     id: "pattern.py.requests_verify_false",
@@ -16614,7 +16632,39 @@ function collectTainted(scope, seed) {
   }
   return tainted;
 }
-function scanSinks(scope, tainted) {
+function isFsModule(spec) {
+  if (typeof spec !== "string") return false;
+  const m = spec.replace(/^node:/, "");
+  return m === "fs" || m === "fs/promises";
+}
+function collectFsImportedNames(ast) {
+  const names = /* @__PURE__ */ new Set();
+  walk(ast, (n) => {
+    if (n.type === "ImportDeclaration" && isFsModule(n.source?.value)) {
+      for (const spec of n.specifiers ?? []) {
+        if (spec.type !== "ImportSpecifier") continue;
+        const imported = spec.imported?.name;
+        const local = spec.local?.name;
+        if (typeof imported === "string" && FS_METHODS.has(imported) && typeof local === "string") names.add(local);
+      }
+      return;
+    }
+    if (n.type === "VariableDeclarator") {
+      const init3 = n.init;
+      const id = n.id;
+      if (!init3 || !id || id.type !== "ObjectPattern") return;
+      if (calleeName(init3) !== "require") return;
+      if (!isFsModule(init3.arguments?.[0]?.value)) return;
+      for (const prop of id.properties ?? []) {
+        const key = prop.key?.name;
+        const val = prop.value?.name;
+        if (typeof key === "string" && FS_METHODS.has(key) && typeof val === "string") names.add(val);
+      }
+    }
+  });
+  return names;
+}
+function scanSinks(scope, tainted, fsNames = /* @__PURE__ */ new Set()) {
   const hits = [];
   const hit = (ruleId, node) => {
     hits.push({ ruleId, node });
@@ -16633,6 +16683,7 @@ function scanSinks(scope, tainted) {
       else if (memberPath(callee) === "document.write" && exprIsTainted(arg0, tainted)) hit("taint.js.xss", n);
       else if ((idName === "fetch" || idName === "axios" || idName === "got") && exprIsTainted(arg0, tainted) || !!method && HTTP_METHODS.has(method) && !!objPath && HTTP_CLIENT_OBJECTS.has(objPath) && exprIsTainted(arg0, tainted)) hit("taint.js.ssrf", n);
       else if (!!method && FS_METHODS.has(method) && !!objPath && (objPath === "fs" || objPath === "fs.promises" || objPath === "fsp") && exprIsTainted(arg0, tainted)) hit("taint.js.path_traversal", n);
+      else if (!!idName && fsNames.has(idName) && exprIsTainted(arg0, tainted)) hit("taint.js.path_traversal", n);
       else if (REDIRECT_CALLS.has(memberPath(callee) ?? "") && exprIsTainted(arg0, tainted)) hit("taint.js.open_redirect", n);
       else if (!!method && ["send", "write", "end"].includes(method) && !!objPath && (objPath === "res" || objPath === "response") && exprIsTainted(arg0, tainted)) hit("taint.js.xss", n);
       else if (!!method && MONGO_QUERY_METHODS.has(method) && exprIsTainted(arg0, tainted)) hit("taint.js.nosql_injection", n);
@@ -16712,6 +16763,7 @@ function detectTaintFromAst(ast, path, text) {
       fingerprint
     });
   };
+  const fsNames = collectFsImportedNames(ast);
   const functions = collectLocalFunctions(ast);
   const paramSinks = /* @__PURE__ */ new Map();
   const hitKey2 = (h) => `${h.ruleId}@${h.node.start ?? -1}`;
@@ -16723,7 +16775,7 @@ function detectTaintFromAst(ast, path, text) {
       fn.params.forEach((p, i2) => {
         if (!p) return;
         const tainted = collectTainted(fn.scope, [p]);
-        const hits = scanSinks(fn.scope, tainted);
+        const hits = scanSinks(fn.scope, tainted, fsNames);
         walkScope(fn.scope, (n) => {
           if (n.type !== "CallExpression") return;
           const callee = calleeName(n);
@@ -16760,7 +16812,7 @@ function detectTaintFromAst(ast, path, text) {
   });
   for (const scope of scopes) {
     const tainted = collectTainted(scope, []);
-    for (const h of scanSinks(scope, tainted)) addFinding(h.ruleId, h.node);
+    for (const h of scanSinks(scope, tainted, fsNames)) addFinding(h.ruleId, h.node);
     walkScope(scope, (n) => {
       if (n.type !== "CallExpression") return;
       const name2 = calleeName(n);
@@ -16962,7 +17014,7 @@ function scaToCanonical(input) {
 
 // src/engine/version.ts
 var ENGINE_VERSION = "0.1.0";
-var RULESET_VERSION = "2026.10.20-23";
+var RULESET_VERSION = "2026.10.23-24";
 
 // src/engine/suppress.ts
 var EMPTY_CONFIG = { excludes: [], scoped: [], problems: [] };

package/dist/server.cjs

@@ -24351,6 +24351,24 @@ var PATTERN_RULES = [
     exts: JS,
     pattern: /createHash\s*\(\s*['"`](?:md5|sha1)['"`]\s*\)/gi
   },
+  {
+    // 2026-10-23: 自己完結コーパス（measure-gate/sast-corpus.ts）が検出欠落として
+    // 検出した。pattern.go.weak_cipher と pattern.java.weak_cipher は存在するのに
+    // **JS/TS 版が無く**、同じ弱点が Go/Java では検出され Node では無検出だった。
+    //
+    // 0-FP の作り: アルゴリズム名を**引用符の直後に固定**する。これが無いと
+    // "description" のような語が `des` に当たる。安全な算法（aes-256-gcm /
+    // aes-256-cbc 等）に当たらないことはテストで固定している。
+    id: "pattern.js.weak_cipher",
+    cwe: "CWE-327",
+    owasp: "A02:2021",
+    severity: "medium",
+    title: "Weak cipher algorithm",
+    message: "DES/3DES, RC2/RC4, Blowfish and IDEA are broken; ECB mode leaks plaintext structure.",
+    remediation: "Use aes-256-gcm (AEAD) with a random IV via crypto.createCipheriv().",
+    exts: JS,
+    pattern: /create(?:De)?Cipher(?:iv)?\s*\(\s*['"`](?:des(?:-[a-z0-9-]*)?|rc[24](?:-[a-z0-9-]*)?|bf(?:-[a-z0-9-]*)?|blowfish|idea(?:-[a-z0-9-]*)?|[a-z0-9-]*-ecb)['"`]/gi
+  },
   // ── Python ──
   {
     id: "pattern.py.requests_verify_false",
@@ -25691,7 +25709,39 @@ function collectTainted(scope, seed) {
   }
   return tainted;
 }
-function scanSinks(scope, tainted) {
+function isFsModule(spec) {
+  if (typeof spec !== "string") return false;
+  const m = spec.replace(/^node:/, "");
+  return m === "fs" || m === "fs/promises";
+}
+function collectFsImportedNames(ast) {
+  const names = /* @__PURE__ */ new Set();
+  walk(ast, (n) => {
+    if (n.type === "ImportDeclaration" && isFsModule(n.source?.value)) {
+      for (const spec of n.specifiers ?? []) {
+        if (spec.type !== "ImportSpecifier") continue;
+        const imported = spec.imported?.name;
+        const local = spec.local?.name;
+        if (typeof imported === "string" && FS_METHODS.has(imported) && typeof local === "string") names.add(local);
+      }
+      return;
+    }
+    if (n.type === "VariableDeclarator") {
+      const init3 = n.init;
+      const id = n.id;
+      if (!init3 || !id || id.type !== "ObjectPattern") return;
+      if (calleeName(init3) !== "require") return;
+      if (!isFsModule(init3.arguments?.[0]?.value)) return;
+      for (const prop of id.properties ?? []) {
+        const key = prop.key?.name;
+        const val = prop.value?.name;
+        if (typeof key === "string" && FS_METHODS.has(key) && typeof val === "string") names.add(val);
+      }
+    }
+  });
+  return names;
+}
+function scanSinks(scope, tainted, fsNames = /* @__PURE__ */ new Set()) {
   const hits = [];
   const hit = (ruleId, node) => {
     hits.push({ ruleId, node });
@@ -25710,6 +25760,7 @@ function scanSinks(scope, tainted) {
       else if (memberPath(callee) === "document.write" && exprIsTainted(arg0, tainted)) hit("taint.js.xss", n);
       else if ((idName === "fetch" || idName === "axios" || idName === "got") && exprIsTainted(arg0, tainted) || !!method && HTTP_METHODS.has(method) && !!objPath && HTTP_CLIENT_OBJECTS.has(objPath) && exprIsTainted(arg0, tainted)) hit("taint.js.ssrf", n);
       else if (!!method && FS_METHODS.has(method) && !!objPath && (objPath === "fs" || objPath === "fs.promises" || objPath === "fsp") && exprIsTainted(arg0, tainted)) hit("taint.js.path_traversal", n);
+      else if (!!idName && fsNames.has(idName) && exprIsTainted(arg0, tainted)) hit("taint.js.path_traversal", n);
       else if (REDIRECT_CALLS.has(memberPath(callee) ?? "") && exprIsTainted(arg0, tainted)) hit("taint.js.open_redirect", n);
       else if (!!method && ["send", "write", "end"].includes(method) && !!objPath && (objPath === "res" || objPath === "response") && exprIsTainted(arg0, tainted)) hit("taint.js.xss", n);
       else if (!!method && MONGO_QUERY_METHODS.has(method) && exprIsTainted(arg0, tainted)) hit("taint.js.nosql_injection", n);
@@ -25789,6 +25840,7 @@ function detectTaintFromAst(ast, path, text) {
       fingerprint
     });
   };
+  const fsNames = collectFsImportedNames(ast);
   const functions = collectLocalFunctions(ast);
   const paramSinks = /* @__PURE__ */ new Map();
   const hitKey2 = (h) => `${h.ruleId}@${h.node.start ?? -1}`;
@@ -25800,7 +25852,7 @@ function detectTaintFromAst(ast, path, text) {
       fn.params.forEach((p, i2) => {
         if (!p) return;
         const tainted = collectTainted(fn.scope, [p]);
-        const hits = scanSinks(fn.scope, tainted);
+        const hits = scanSinks(fn.scope, tainted, fsNames);
         walkScope(fn.scope, (n) => {
           if (n.type !== "CallExpression") return;
           const callee = calleeName(n);
@@ -25837,7 +25889,7 @@ function detectTaintFromAst(ast, path, text) {
   });
   for (const scope of scopes) {
     const tainted = collectTainted(scope, []);
-    for (const h of scanSinks(scope, tainted)) addFinding(h.ruleId, h.node);
+    for (const h of scanSinks(scope, tainted, fsNames)) addFinding(h.ruleId, h.node);
     walkScope(scope, (n) => {
       if (n.type !== "CallExpression") return;
       const name2 = calleeName(n);
@@ -26039,7 +26091,7 @@ function scaToCanonical(input) {
 
 // src/engine/version.ts
 var ENGINE_VERSION = "0.1.0";
-var RULESET_VERSION = "2026.10.20-23";
+var RULESET_VERSION = "2026.10.23-24";
 
 // src/engine/suppress.ts
 var SPHIORIGNORE_FILE = ".sphiorignore";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphior/scan",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Deterministic source scanner — hardcoded secrets and insecure patterns (CWE) with AST/taint analysis. No AI, no network, no source upload. CLI + LSP for editors and CI.",
   "type": "module",
   "bin": {