@sun-asterisk/sunlint 1.3.32 → 1.3.34

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (456) hide show
  1. package/README.md +47 -0
  2. package/config/released-rules.json +62 -0
  3. package/config/rules/enhanced-rules-registry.json +2315 -1354
  4. package/core/adapters/dart-analyzer.js +658 -0
  5. package/core/adapters/index.js +102 -0
  6. package/core/adapters/sunlint-rule-adapter.js +0 -2
  7. package/core/adapters/typescript-analyzer.js +277 -0
  8. package/core/analysis-orchestrator.js +168 -40
  9. package/core/architecture-integration.js +220 -0
  10. package/core/cli-action-handler.js +72 -24
  11. package/core/cli-program.js +13 -1
  12. package/core/config-merger.js +24 -14
  13. package/core/constants/defaults.js +1 -2
  14. package/core/github-annotate-service.js +141 -89
  15. package/core/github-step-summary-generator.js +8 -8
  16. package/core/interfaces/language-analyzer.interface.js +393 -0
  17. package/core/output-service.js +102 -38
  18. package/core/rule-selection-service.js +77 -27
  19. package/core/scoring-service.js +65 -20
  20. package/core/semantic-engine-manager.js +375 -0
  21. package/core/semantic-engine.js +4 -57
  22. package/core/unified-rule-registry.js +52 -11
  23. package/core/upload-service.js +43 -9
  24. package/docs/DART_RULE_EXECUTION_FLOW.md +745 -0
  25. package/docs/DART_SUPPORT_IMPLEMENTATION.md +245 -0
  26. package/docs/SUNLINT_ARCHITECTURE.md +692 -0
  27. package/docs/skills/CREATE_DART_RULE.md +909 -0
  28. package/engines/eslint-engine.js +2 -8
  29. package/engines/heuristic-engine.js +234 -38
  30. package/package.json +6 -5
  31. package/rules/common/C002_no_duplicate_code/config.json +12 -20
  32. package/rules/common/C002_no_duplicate_code/dart/analyzer.js +53 -0
  33. package/rules/common/C002_no_duplicate_code/index.js +93 -0
  34. package/rules/common/C003_no_vague_abbreviations/config.json +1 -1
  35. package/rules/common/C003_no_vague_abbreviations/dart/analyzer.js +54 -0
  36. package/rules/common/C003_no_vague_abbreviations/index.js +93 -0
  37. package/rules/common/C006_function_naming/dart/analyzer.js +40 -0
  38. package/rules/common/C006_function_naming/index.js +86 -0
  39. package/rules/common/C008_variable_declaration_locality/dart/analyzer.js +32 -0
  40. package/rules/common/C008_variable_declaration_locality/index.js +86 -0
  41. package/rules/common/C010_limit_block_nesting/dart/analyzer.js +32 -0
  42. package/rules/common/C010_limit_block_nesting/index.js +86 -0
  43. package/rules/common/C012_command_query_separation/config.json +61 -0
  44. package/rules/common/C012_command_query_separation/dart/analyzer.js +32 -0
  45. package/rules/common/C012_command_query_separation/index.js +86 -0
  46. package/rules/common/C013_no_dead_code/dart/analyzer.js +32 -0
  47. package/rules/common/C013_no_dead_code/index.js +86 -0
  48. package/rules/common/C014_dependency_injection/dart/analyzer.js +32 -0
  49. package/rules/common/C014_dependency_injection/index.js +86 -0
  50. package/rules/common/C017_constructor_logic/dart/analyzer.js +32 -0
  51. package/rules/common/C017_constructor_logic/index.js +86 -0
  52. package/rules/common/C018_no_throw_generic_error/dart/analyzer.js +32 -0
  53. package/rules/common/C018_no_throw_generic_error/index.js +86 -0
  54. package/rules/common/C019_log_level_usage/dart/analyzer.js +32 -0
  55. package/rules/common/C019_log_level_usage/index.js +86 -0
  56. package/rules/common/C019_log_level_usage/{ts-morph-analyzer.js → typescript/ts-morph-analyzer.js} +0 -1
  57. package/rules/common/C020_unused_imports/dart/analyzer.js +32 -0
  58. package/rules/common/C020_unused_imports/index.js +86 -0
  59. package/rules/common/C020_unused_imports/{ts-morph-analyzer.js → typescript/ts-morph-analyzer.js} +0 -1
  60. package/rules/common/C021_import_organization/config.json +29 -9
  61. package/rules/common/C021_import_organization/dart/analyzer.js +40 -0
  62. package/rules/common/C021_import_organization/index.js +83 -0
  63. package/rules/common/C021_import_organization/{ts-morph-analyzer.js → typescript/ts-morph-analyzer.js} +0 -1
  64. package/rules/common/C023_no_duplicate_variable/config.json +7 -2
  65. package/rules/common/C023_no_duplicate_variable/dart/analyzer.js +40 -0
  66. package/rules/common/C023_no_duplicate_variable/index.js +83 -0
  67. package/rules/common/C024_no_scatter_hardcoded_constants/config.json +7 -2
  68. package/rules/common/C024_no_scatter_hardcoded_constants/dart/analyzer.js +40 -0
  69. package/rules/common/C024_no_scatter_hardcoded_constants/index.js +83 -0
  70. package/rules/common/C024_no_scatter_hardcoded_constants/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +19 -1
  71. package/rules/common/C029_catch_block_logging/config.json +15 -5
  72. package/rules/common/C029_catch_block_logging/dart/analyzer.js +40 -0
  73. package/rules/common/C029_catch_block_logging/index.js +83 -0
  74. package/rules/common/C030_use_custom_error_classes/config.json +28 -0
  75. package/rules/common/C030_use_custom_error_classes/dart/analyzer.js +40 -0
  76. package/rules/common/C030_use_custom_error_classes/index.js +83 -0
  77. package/rules/common/C031_validation_separation/config.json +28 -0
  78. package/rules/common/C031_validation_separation/dart/analyzer.js +40 -0
  79. package/rules/common/C031_validation_separation/index.js +83 -0
  80. package/rules/common/C033_separate_service_repository/config.json +8 -3
  81. package/rules/common/C033_separate_service_repository/dart/analyzer.js +40 -0
  82. package/rules/common/C033_separate_service_repository/index.js +83 -0
  83. package/rules/common/C035_error_logging_context/config.json +34 -12
  84. package/rules/common/C035_error_logging_context/dart/analyzer.js +40 -0
  85. package/rules/common/C035_error_logging_context/index.js +83 -0
  86. package/rules/common/C040_centralized_validation/config.json +37 -8
  87. package/rules/common/C040_centralized_validation/dart/analyzer.js +40 -0
  88. package/rules/common/C040_centralized_validation/index.js +83 -0
  89. package/rules/common/C041_no_sensitive_hardcode/config.json +7 -2
  90. package/rules/common/C041_no_sensitive_hardcode/dart/analyzer.js +40 -0
  91. package/rules/common/C041_no_sensitive_hardcode/index.js +83 -0
  92. package/rules/common/C042_boolean_name_prefix/config.json +28 -0
  93. package/rules/common/C042_boolean_name_prefix/dart/analyzer.js +40 -0
  94. package/rules/common/C042_boolean_name_prefix/index.js +83 -0
  95. package/rules/common/C043_no_console_or_print/config.json +28 -0
  96. package/rules/common/C043_no_console_or_print/dart/analyzer.js +40 -0
  97. package/rules/common/C043_no_console_or_print/index.js +83 -0
  98. package/rules/common/C047_no_duplicate_retry_logic/config.json +28 -0
  99. package/rules/common/C047_no_duplicate_retry_logic/dart/analyzer.js +40 -0
  100. package/rules/common/C047_no_duplicate_retry_logic/index.js +83 -0
  101. package/rules/common/C048_no_bypass_architectural_layers/config.json +7 -2
  102. package/rules/common/C048_no_bypass_architectural_layers/dart/analyzer.js +40 -0
  103. package/rules/common/C048_no_bypass_architectural_layers/index.js +83 -0
  104. package/rules/common/C052_parsing_or_data_transformation/config.json +7 -2
  105. package/rules/common/C052_parsing_or_data_transformation/dart/analyzer.js +40 -0
  106. package/rules/common/C052_parsing_or_data_transformation/index.js +83 -0
  107. package/rules/common/C060_no_override_superclass/config.json +7 -2
  108. package/rules/common/C060_no_override_superclass/dart/analyzer.js +40 -0
  109. package/rules/common/C060_no_override_superclass/index.js +83 -0
  110. package/rules/common/C065_one_behavior_per_test/config.json +187 -28
  111. package/rules/common/C065_one_behavior_per_test/dart/analyzer.js +40 -0
  112. package/rules/common/C065_one_behavior_per_test/index.js +83 -0
  113. package/rules/common/C067_no_hardcoded_config/config.json +18 -4
  114. package/rules/common/C067_no_hardcoded_config/dart/analyzer.js +40 -0
  115. package/rules/common/C067_no_hardcoded_config/index.js +83 -0
  116. package/rules/common/C070_no_real_time_tests/config.json +41 -12
  117. package/rules/common/C070_no_real_time_tests/dart/analyzer.js +40 -0
  118. package/rules/common/C070_no_real_time_tests/index.js +83 -0
  119. package/rules/common/C072_single_test_behavior/config.json +28 -0
  120. package/rules/common/C072_single_test_behavior/dart/analyzer.js +40 -0
  121. package/rules/common/C072_single_test_behavior/index.js +83 -0
  122. package/rules/common/C073_validate_required_config_on_startup/config.json +93 -18
  123. package/rules/common/C073_validate_required_config_on_startup/dart/analyzer.js +40 -0
  124. package/rules/common/C073_validate_required_config_on_startup/index.js +83 -0
  125. package/rules/common/C073_validate_required_config_on_startup/{analyzer.js → typescript/analyzer.js} +0 -1
  126. package/rules/common/C075_explicit_return_types/config.json +28 -0
  127. package/rules/common/C075_explicit_return_types/dart/analyzer.js +40 -0
  128. package/rules/common/C075_explicit_return_types/index.js +83 -0
  129. package/rules/common/C076_explicit_function_types/config.json +18 -4
  130. package/rules/common/C076_explicit_function_types/dart/analyzer.js +40 -0
  131. package/rules/common/C076_explicit_function_types/index.js +83 -0
  132. package/rules/index.js +26 -6
  133. package/rules/security/S003_open_redirect_protection/config.json +11 -53
  134. package/rules/security/S003_open_redirect_protection/dart/analyzer.js +43 -0
  135. package/rules/security/S003_open_redirect_protection/index.js +94 -0
  136. package/rules/security/S003_open_redirect_protection/typescript/analyzer.js +105 -0
  137. package/rules/security/S003_open_redirect_protection/{symbol-based-analyzer.js → typescript/semantic-analyzer.js} +1 -1
  138. package/rules/security/S004_sensitive_data_logging/config.json +1 -1
  139. package/rules/security/S004_sensitive_data_logging/dart/analyzer.js +58 -0
  140. package/rules/security/S004_sensitive_data_logging/index.js +93 -0
  141. package/rules/security/S005_no_origin_auth/dart/analyzer.js +30 -0
  142. package/rules/security/S005_no_origin_auth/index.js +83 -0
  143. package/rules/security/S005_no_origin_auth/{analyzer.js → typescript/analyzer.js} +1 -0
  144. package/rules/security/S006_no_plaintext_recovery_codes/dart/analyzer.js +30 -0
  145. package/rules/security/S006_no_plaintext_recovery_codes/index.js +83 -0
  146. package/rules/security/S007_no_plaintext_otp/dart/analyzer.js +30 -0
  147. package/rules/security/S007_no_plaintext_otp/index.js +83 -0
  148. package/rules/security/S009_no_insecure_encryption/dart/analyzer.js +30 -0
  149. package/rules/security/S009_no_insecure_encryption/index.js +83 -0
  150. package/rules/security/S010_no_insecure_encryption/dart/analyzer.js +30 -0
  151. package/rules/security/S010_no_insecure_encryption/index.js +83 -0
  152. package/rules/security/S011_secure_guid_generation/dart/analyzer.js +30 -0
  153. package/rules/security/S011_secure_guid_generation/index.js +83 -0
  154. package/rules/security/S012_hardcoded_secrets/dart/analyzer.js +30 -0
  155. package/rules/security/S012_hardcoded_secrets/index.js +83 -0
  156. package/rules/security/S012_hardcoded_secrets/typescript/config.json +75 -0
  157. package/rules/security/S013_tls_enforcement/dart/analyzer.js +30 -0
  158. package/rules/security/S013_tls_enforcement/index.js +83 -0
  159. package/rules/security/S014_tls_version_enforcement/dart/analyzer.js +30 -0
  160. package/rules/security/S014_tls_version_enforcement/index.js +83 -0
  161. package/rules/security/S015_insecure_tls_certificate/config.json +41 -0
  162. package/rules/security/S015_insecure_tls_certificate/dart/analyzer.js +19 -0
  163. package/rules/security/S015_insecure_tls_certificate/index.js +83 -0
  164. package/rules/security/S016_no_sensitive_querystring/dart/analyzer.js +30 -0
  165. package/rules/security/S016_no_sensitive_querystring/index.js +83 -0
  166. package/rules/security/S017_use_parameterized_queries/dart/analyzer.js +30 -0
  167. package/rules/security/S017_use_parameterized_queries/index.js +83 -0
  168. package/rules/security/S019_smtp_injection_protection/dart/analyzer.js +30 -0
  169. package/rules/security/S019_smtp_injection_protection/index.js +83 -0
  170. package/rules/security/S020_no_eval_dynamic_code/dart/analyzer.js +30 -0
  171. package/rules/security/S020_no_eval_dynamic_code/index.js +83 -0
  172. package/rules/security/S022_escape_output_context/dart/analyzer.js +30 -0
  173. package/rules/security/S022_escape_output_context/index.js +83 -0
  174. package/rules/security/S023_no_json_injection/dart/analyzer.js +30 -0
  175. package/rules/security/S023_no_json_injection/index.js +83 -0
  176. package/rules/security/S024_xpath_xxe_protection/dart/analyzer.js +30 -0
  177. package/rules/security/S024_xpath_xxe_protection/index.js +83 -0
  178. package/rules/security/S025_server_side_validation/dart/analyzer.js +30 -0
  179. package/rules/security/S025_server_side_validation/index.js +83 -0
  180. package/rules/security/S026_json_schema_validation/dart/analyzer.js +30 -0
  181. package/rules/security/S026_json_schema_validation/index.js +83 -0
  182. package/rules/security/S027_no_hardcoded_secrets/dart/analyzer.js +30 -0
  183. package/rules/security/S027_no_hardcoded_secrets/index.js +83 -0
  184. package/rules/security/S028_file_upload_size_limits/dart/analyzer.js +30 -0
  185. package/rules/security/S028_file_upload_size_limits/index.js +83 -0
  186. package/rules/security/S029_csrf_protection/dart/analyzer.js +30 -0
  187. package/rules/security/S029_csrf_protection/index.js +83 -0
  188. package/rules/security/S030_directory_browsing_protection/dart/analyzer.js +30 -0
  189. package/rules/security/S030_directory_browsing_protection/index.js +83 -0
  190. package/rules/security/S031_secure_session_cookies/dart/analyzer.js +30 -0
  191. package/rules/security/S031_secure_session_cookies/index.js +83 -0
  192. package/rules/security/S032_httponly_session_cookies/dart/analyzer.js +30 -0
  193. package/rules/security/S032_httponly_session_cookies/index.js +83 -0
  194. package/rules/security/S033_samesite_session_cookies/dart/analyzer.js +30 -0
  195. package/rules/security/S033_samesite_session_cookies/index.js +83 -0
  196. package/rules/security/S034_host_prefix_session_cookies/dart/analyzer.js +30 -0
  197. package/rules/security/S034_host_prefix_session_cookies/index.js +83 -0
  198. package/rules/security/S035_path_session_cookies/dart/analyzer.js +30 -0
  199. package/rules/security/S035_path_session_cookies/index.js +83 -0
  200. package/rules/security/S036_lfi_rfi_protection/dart/analyzer.js +30 -0
  201. package/rules/security/S036_lfi_rfi_protection/index.js +83 -0
  202. package/rules/security/S037_cache_headers/dart/analyzer.js +30 -0
  203. package/rules/security/S037_cache_headers/index.js +83 -0
  204. package/rules/security/S038_no_version_headers/dart/analyzer.js +30 -0
  205. package/rules/security/S038_no_version_headers/index.js +83 -0
  206. package/rules/security/S039_no_session_tokens_in_url/dart/analyzer.js +30 -0
  207. package/rules/security/S039_no_session_tokens_in_url/index.js +83 -0
  208. package/rules/security/S040_session_fixation_protection/dart/analyzer.js +30 -0
  209. package/rules/security/S040_session_fixation_protection/index.js +83 -0
  210. package/rules/security/S041_session_token_invalidation/dart/analyzer.js +30 -0
  211. package/rules/security/S041_session_token_invalidation/index.js +83 -0
  212. package/rules/security/S042_require_re_authentication_for_long_lived/dart/analyzer.js +30 -0
  213. package/rules/security/S042_require_re_authentication_for_long_lived/index.js +83 -0
  214. package/rules/security/S043_password_changes_invalidate_all_sessions/dart/analyzer.js +30 -0
  215. package/rules/security/S043_password_changes_invalidate_all_sessions/index.js +83 -0
  216. package/rules/security/S044_re_authentication_required/dart/analyzer.js +30 -0
  217. package/rules/security/S044_re_authentication_required/index.js +83 -0
  218. package/rules/security/S045_brute_force_protection/dart/analyzer.js +30 -0
  219. package/rules/security/S045_brute_force_protection/index.js +83 -0
  220. package/rules/security/S048_no_current_password_in_reset/dart/analyzer.js +30 -0
  221. package/rules/security/S048_no_current_password_in_reset/index.js +83 -0
  222. package/rules/security/S049_short_validity_tokens/dart/analyzer.js +30 -0
  223. package/rules/security/S049_short_validity_tokens/index.js +83 -0
  224. package/rules/security/S049_short_validity_tokens/typescript/config.json +124 -0
  225. package/rules/security/S051_password_length_policy/dart/analyzer.js +30 -0
  226. package/rules/security/S051_password_length_policy/index.js +83 -0
  227. package/rules/security/S051_password_length_policy/typescript/config.json +83 -0
  228. package/rules/security/S052_weak_otp_entropy/dart/analyzer.js +30 -0
  229. package/rules/security/S052_weak_otp_entropy/index.js +83 -0
  230. package/rules/security/S052_weak_otp_entropy/typescript/config.json +57 -0
  231. package/rules/security/S054_no_default_accounts/dart/analyzer.js +30 -0
  232. package/rules/security/S054_no_default_accounts/index.js +83 -0
  233. package/rules/security/S054_no_default_accounts/typescript/config.json +101 -0
  234. package/rules/security/S055_content_type_validation/dart/analyzer.js +30 -0
  235. package/rules/security/S055_content_type_validation/index.js +83 -0
  236. package/rules/security/S056_log_injection_protection/dart/analyzer.js +30 -0
  237. package/rules/security/S056_log_injection_protection/index.js +83 -0
  238. package/rules/security/S057_utc_logging/dart/analyzer.js +30 -0
  239. package/rules/security/S057_utc_logging/index.js +83 -0
  240. package/rules/security/S057_utc_logging/typescript/config.json +105 -0
  241. package/rules/security/S058_no_ssrf/dart/analyzer.js +30 -0
  242. package/rules/security/S058_no_ssrf/index.js +83 -0
  243. package/rules/security/S058_no_ssrf/{analyzer.js → typescript/analyzer.js} +0 -1
  244. package/rules/security/S058_no_ssrf/typescript/config.json +125 -0
  245. package/scripts/build-release.sh +12 -0
  246. package/scripts/copy-arch-detect.js +78 -0
  247. package/rules/common/C002_no_duplicate_code/test-cases/api-handlers.ts +0 -64
  248. package/rules/common/C002_no_duplicate_code/test-cases/data-processor.ts +0 -46
  249. package/rules/common/C002_no_duplicate_code/test-cases/good-example.tsx +0 -40
  250. package/rules/common/C002_no_duplicate_code/test-cases/product-service.ts +0 -57
  251. package/rules/common/C002_no_duplicate_code/test-cases/user-service.ts +0 -49
  252. package/rules/common/C067_no_hardcoded_config/symbol-based-analyzer.js.backup +0 -3853
  253. package/rules/security/S003_open_redirect_protection/analyzer.js +0 -135
  254. /package/rules/common/C002_no_duplicate_code/{analyzer.js → typescript/analyzer.js} +0 -0
  255. /package/rules/common/C003_no_vague_abbreviations/{analyzer.js → typescript/analyzer.js} +0 -0
  256. /package/rules/common/C006_function_naming/{analyzer.js → typescript/analyzer.js} +0 -0
  257. /package/rules/common/{C008 → C008_variable_declaration_locality}/config.json +0 -0
  258. /package/rules/common/{C008 → C008_variable_declaration_locality/typescript}/analyzer.js +0 -0
  259. /package/rules/common/{C008 → C008_variable_declaration_locality/typescript}/ts-morph-analyzer.js +0 -0
  260. /package/rules/common/C010_limit_block_nesting/{analyzer.js → typescript/analyzer.js} +0 -0
  261. /package/rules/common/C010_limit_block_nesting/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  262. /package/rules/common/C010_limit_block_nesting/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  263. /package/rules/common/C012_command_query_separation/{analyzer.js → typescript/analyzer.js} +0 -0
  264. /package/rules/common/C012_command_query_separation/{ast-analyzer.js → typescript/ast-analyzer.js} +0 -0
  265. /package/rules/common/C013_no_dead_code/{analyzer.js → typescript/analyzer.js} +0 -0
  266. /package/rules/common/C013_no_dead_code/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  267. /package/rules/common/C013_no_dead_code/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  268. /package/rules/common/C014_dependency_injection/{analyzer.js → typescript/analyzer.js} +0 -0
  269. /package/rules/common/C014_dependency_injection/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  270. /package/rules/common/C017_constructor_logic/{analyzer.js → typescript/analyzer.js} +0 -0
  271. /package/rules/common/C017_constructor_logic/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  272. /package/rules/common/C018_no_throw_generic_error/{analyzer.js → typescript/analyzer.js} +0 -0
  273. /package/rules/common/C018_no_throw_generic_error/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  274. /package/rules/common/C018_no_throw_generic_error/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  275. /package/rules/common/C019_log_level_usage/{analyzer.js → typescript/analyzer.js} +0 -0
  276. /package/rules/common/C019_log_level_usage/{pattern-analyzer.js → typescript/pattern-analyzer.js} +0 -0
  277. /package/rules/common/C019_log_level_usage/{system-log-analyzer.js → typescript/system-log-analyzer.js} +0 -0
  278. /package/rules/common/C020_unused_imports/{analyzer.js → typescript/analyzer.js} +0 -0
  279. /package/rules/common/C021_import_organization/{analyzer.js → typescript/analyzer.js} +0 -0
  280. /package/rules/common/C023_no_duplicate_variable/{analyzer.js → typescript/analyzer.js} +0 -0
  281. /package/rules/common/C023_no_duplicate_variable/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  282. /package/rules/common/C024_no_scatter_hardcoded_constants/{analyzer.js → typescript/analyzer.js} +0 -0
  283. /package/rules/common/C029_catch_block_logging/{analyzer.js → typescript/analyzer.js} +0 -0
  284. /package/rules/common/C030_use_custom_error_classes/{analyzer.js → typescript/analyzer.js} +0 -0
  285. /package/rules/common/C031_validation_separation/{analyzer.js → typescript/analyzer.js} +0 -0
  286. /package/rules/common/C033_separate_service_repository/{README.md → typescript/README.md} +0 -0
  287. /package/rules/common/C033_separate_service_repository/{analyzer.js → typescript/analyzer.js} +0 -0
  288. /package/rules/common/C033_separate_service_repository/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  289. /package/rules/common/C033_separate_service_repository/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  290. /package/rules/common/C035_error_logging_context/{STRATEGY.md → typescript/STRATEGY.md} +0 -0
  291. /package/rules/common/C035_error_logging_context/{analyzer.js → typescript/analyzer.js} +0 -0
  292. /package/rules/common/C035_error_logging_context/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  293. /package/rules/common/C035_error_logging_context/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  294. /package/rules/common/C040_centralized_validation/{analyzer.js → typescript/analyzer.js} +0 -0
  295. /package/rules/common/C040_centralized_validation/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  296. /package/rules/common/C040_centralized_validation/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  297. /package/rules/common/C041_no_sensitive_hardcode/{analyzer.js → typescript/analyzer.js} +0 -0
  298. /package/rules/common/C041_no_sensitive_hardcode/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  299. /package/rules/common/C042_boolean_name_prefix/{analyzer.js → typescript/analyzer.js} +0 -0
  300. /package/rules/common/C043_no_console_or_print/{analyzer.js → typescript/analyzer.js} +0 -0
  301. /package/rules/common/C047_no_duplicate_retry_logic/{analyzer.js → typescript/analyzer.js} +0 -0
  302. /package/rules/common/C047_no_duplicate_retry_logic/{c047-semantic-rule.js → typescript/c047-semantic-rule.js} +0 -0
  303. /package/rules/common/C047_no_duplicate_retry_logic/{symbol-analyzer-enhanced.js → typescript/symbol-analyzer-enhanced.js} +0 -0
  304. /package/rules/common/C047_no_duplicate_retry_logic/{symbol-config.json → typescript/symbol-config.json} +0 -0
  305. /package/rules/common/C048_no_bypass_architectural_layers/{analyzer.js → typescript/analyzer.js} +0 -0
  306. /package/rules/common/C048_no_bypass_architectural_layers/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  307. /package/rules/common/C052_parsing_or_data_transformation/{analyzer.js → typescript/analyzer.js} +0 -0
  308. /package/rules/common/C052_parsing_or_data_transformation/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  309. /package/rules/common/C060_no_override_superclass/{analyzer.js → typescript/analyzer.js} +0 -0
  310. /package/rules/common/C060_no_override_superclass/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  311. /package/rules/common/C065_one_behavior_per_test/{analyzer.js → typescript/analyzer.js} +0 -0
  312. /package/rules/common/C067_no_hardcoded_config/{analyzer.js → typescript/analyzer.js} +0 -0
  313. /package/rules/common/C067_no_hardcoded_config/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  314. /package/rules/common/C070_no_real_time_tests/{analyzer.js → typescript/analyzer.js} +0 -0
  315. /package/rules/common/C070_no_real_time_tests/{regex-analyzer.js → typescript/regex-analyzer.js} +0 -0
  316. /package/rules/common/C072_single_test_behavior/{analyzer.js → typescript/analyzer.js} +0 -0
  317. /package/rules/common/C073_validate_required_config_on_startup/{README.md → typescript/README.md} +0 -0
  318. /package/rules/common/C073_validate_required_config_on_startup/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  319. /package/rules/common/C075_explicit_return_types/{analyzer.js → typescript/analyzer.js} +0 -0
  320. /package/rules/common/C076_explicit_function_types/{README.md → typescript/README.md} +0 -0
  321. /package/rules/common/C076_explicit_function_types/{analyzer.js → typescript/analyzer.js} +0 -0
  322. /package/rules/common/C076_explicit_function_types/{semantic-analyzer.js → typescript/semantic-analyzer.js} +0 -0
  323. /package/rules/security/S003_open_redirect_protection/{README.md → typescript/README.md} +0 -0
  324. /package/rules/security/S004_sensitive_data_logging/{analyzer.js → typescript/analyzer.js} +0 -0
  325. /package/rules/security/S004_sensitive_data_logging/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  326. /package/rules/security/S005_no_origin_auth/{README.md → typescript/README.md} +0 -0
  327. /package/rules/security/S005_no_origin_auth/{ast-analyzer.js → typescript/ast-analyzer.js} +0 -0
  328. /package/rules/security/S005_no_origin_auth/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  329. /package/rules/security/S006_no_plaintext_recovery_codes/{README.md → typescript/README.md} +0 -0
  330. /package/rules/security/S006_no_plaintext_recovery_codes/{analyzer.js → typescript/analyzer.js} +0 -0
  331. /package/rules/security/S006_no_plaintext_recovery_codes/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  332. /package/rules/security/S007_no_plaintext_otp/{README.md → typescript/README.md} +0 -0
  333. /package/rules/security/S007_no_plaintext_otp/{analyzer.js → typescript/analyzer.js} +0 -0
  334. /package/rules/security/S007_no_plaintext_otp/{semantic-analyzer.js → typescript/semantic-analyzer.js} +0 -0
  335. /package/rules/security/S007_no_plaintext_otp/{semantic-config.json → typescript/semantic-config.json} +0 -0
  336. /package/rules/security/S007_no_plaintext_otp/{semantic-wrapper.js → typescript/semantic-wrapper.js} +0 -0
  337. /package/rules/security/S009_no_insecure_encryption/{README.md → typescript/README.md} +0 -0
  338. /package/rules/security/S009_no_insecure_encryption/{analyzer.js → typescript/analyzer.js} +0 -0
  339. /package/rules/security/S010_no_insecure_encryption/{README.md → typescript/README.md} +0 -0
  340. /package/rules/security/S010_no_insecure_encryption/{analyzer.js → typescript/analyzer.js} +0 -0
  341. /package/rules/security/S011_secure_guid_generation/{README.md → typescript/README.md} +0 -0
  342. /package/rules/security/S011_secure_guid_generation/{analyzer.js → typescript/analyzer.js} +0 -0
  343. /package/rules/security/S011_secure_guid_generation/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  344. /package/rules/security/S012_hardcoded_secrets/{analyzer.js → typescript/analyzer.js} +0 -0
  345. /package/rules/security/S012_hardcoded_secrets/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  346. /package/rules/security/S013_tls_enforcement/{README.md → typescript/README.md} +0 -0
  347. /package/rules/security/S013_tls_enforcement/{analyzer.js → typescript/analyzer.js} +0 -0
  348. /package/rules/security/S013_tls_enforcement/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  349. /package/rules/security/S014_tls_version_enforcement/{README.md → typescript/README.md} +0 -0
  350. /package/rules/security/S014_tls_version_enforcement/{analyzer.js → typescript/analyzer.js} +0 -0
  351. /package/rules/security/S014_tls_version_enforcement/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  352. /package/rules/security/S015_insecure_tls_certificate/{analyzer.js → typescript/analyzer.js} +0 -0
  353. /package/rules/security/S015_insecure_tls_certificate/{ast-analyzer.js → typescript/ast-analyzer.js} +0 -0
  354. /package/rules/security/S016_no_sensitive_querystring/{analyzer.js → typescript/analyzer.js} +0 -0
  355. /package/rules/security/S016_no_sensitive_querystring/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  356. /package/rules/security/S016_no_sensitive_querystring/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  357. /package/rules/security/S017_use_parameterized_queries/{README.md → typescript/README.md} +0 -0
  358. /package/rules/security/S017_use_parameterized_queries/{analyzer.js → typescript/analyzer.js} +0 -0
  359. /package/rules/security/S017_use_parameterized_queries/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  360. /package/rules/security/S019_smtp_injection_protection/{analyzer.js → typescript/analyzer.js} +0 -0
  361. /package/rules/security/S019_smtp_injection_protection/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  362. /package/rules/security/S020_no_eval_dynamic_code/{README.md → typescript/README.md} +0 -0
  363. /package/rules/security/S020_no_eval_dynamic_code/{analyzer.js → typescript/analyzer.js} +0 -0
  364. /package/rules/security/S020_no_eval_dynamic_code/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  365. /package/rules/security/S022_escape_output_context/{README.md → typescript/README.md} +0 -0
  366. /package/rules/security/S022_escape_output_context/{analyzer.js → typescript/analyzer.js} +0 -0
  367. /package/rules/security/S023_no_json_injection/{analyzer.js → typescript/analyzer.js} +0 -0
  368. /package/rules/security/S023_no_json_injection/{ast-analyzer.js → typescript/ast-analyzer.js} +0 -0
  369. /package/rules/security/S024_xpath_xxe_protection/{analyzer.js → typescript/analyzer.js} +0 -0
  370. /package/rules/security/S024_xpath_xxe_protection/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  371. /package/rules/security/S024_xpath_xxe_protection/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  372. /package/rules/security/S025_server_side_validation/{README.md → typescript/README.md} +0 -0
  373. /package/rules/security/S025_server_side_validation/{analyzer.js → typescript/analyzer.js} +0 -0
  374. /package/rules/security/S025_server_side_validation/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  375. /package/rules/security/S025_server_side_validation/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  376. /package/rules/security/S026_json_schema_validation/{analyzer.js → typescript/analyzer.js} +0 -0
  377. /package/rules/security/S027_no_hardcoded_secrets/{analyzer.js → typescript/analyzer.js} +0 -0
  378. /package/rules/security/S027_no_hardcoded_secrets/{categories.json → typescript/categories.json} +0 -0
  379. /package/rules/security/S027_no_hardcoded_secrets/{categorized-analyzer.js → typescript/categorized-analyzer.js} +0 -0
  380. /package/rules/security/S028_file_upload_size_limits/{README.md → typescript/README.md} +0 -0
  381. /package/rules/security/S028_file_upload_size_limits/{analyzer.js → typescript/analyzer.js} +0 -0
  382. /package/rules/security/S028_file_upload_size_limits/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  383. /package/rules/security/S029_csrf_protection/{analyzer.js → typescript/analyzer.js} +0 -0
  384. /package/rules/security/S030_directory_browsing_protection/{README.md → typescript/README.md} +0 -0
  385. /package/rules/security/S030_directory_browsing_protection/{analyzer.js → typescript/analyzer.js} +0 -0
  386. /package/rules/security/S030_directory_browsing_protection/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  387. /package/rules/security/S030_directory_browsing_protection/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  388. /package/rules/security/S031_secure_session_cookies/{README.md → typescript/README.md} +0 -0
  389. /package/rules/security/S031_secure_session_cookies/{analyzer.js → typescript/analyzer.js} +0 -0
  390. /package/rules/security/S031_secure_session_cookies/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  391. /package/rules/security/S032_httponly_session_cookies/{FRAMEWORK_SUPPORT.md → typescript/FRAMEWORK_SUPPORT.md} +0 -0
  392. /package/rules/security/S032_httponly_session_cookies/{README.md → typescript/README.md} +0 -0
  393. /package/rules/security/S032_httponly_session_cookies/{analyzer.js → typescript/analyzer.js} +0 -0
  394. /package/rules/security/S032_httponly_session_cookies/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  395. /package/rules/security/S032_httponly_session_cookies/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  396. /package/rules/security/S033_samesite_session_cookies/{README.md → typescript/README.md} +0 -0
  397. /package/rules/security/S033_samesite_session_cookies/{analyzer.js → typescript/analyzer.js} +0 -0
  398. /package/rules/security/S033_samesite_session_cookies/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  399. /package/rules/security/S033_samesite_session_cookies/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  400. /package/rules/security/S034_host_prefix_session_cookies/{README.md → typescript/README.md} +0 -0
  401. /package/rules/security/S034_host_prefix_session_cookies/{analyzer.js → typescript/analyzer.js} +0 -0
  402. /package/rules/security/S034_host_prefix_session_cookies/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  403. /package/rules/security/S034_host_prefix_session_cookies/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  404. /package/rules/security/S035_path_session_cookies/{README.md → typescript/README.md} +0 -0
  405. /package/rules/security/S035_path_session_cookies/{analyzer.js → typescript/analyzer.js} +0 -0
  406. /package/rules/security/S035_path_session_cookies/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  407. /package/rules/security/S035_path_session_cookies/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  408. /package/rules/security/S036_lfi_rfi_protection/{analyzer.js → typescript/analyzer.js} +0 -0
  409. /package/rules/security/S037_cache_headers/{README.md → typescript/README.md} +0 -0
  410. /package/rules/security/S037_cache_headers/{analyzer.js → typescript/analyzer.js} +0 -0
  411. /package/rules/security/S037_cache_headers/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  412. /package/rules/security/S037_cache_headers/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  413. /package/rules/security/S038_no_version_headers/{README.md → typescript/README.md} +0 -0
  414. /package/rules/security/S038_no_version_headers/{analyzer.js → typescript/analyzer.js} +0 -0
  415. /package/rules/security/S038_no_version_headers/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  416. /package/rules/security/S038_no_version_headers/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  417. /package/rules/security/S039_no_session_tokens_in_url/{README.md → typescript/README.md} +0 -0
  418. /package/rules/security/S039_no_session_tokens_in_url/{analyzer.js → typescript/analyzer.js} +0 -0
  419. /package/rules/security/S039_no_session_tokens_in_url/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  420. /package/rules/security/S039_no_session_tokens_in_url/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  421. /package/rules/security/S040_session_fixation_protection/{analyzer.js → typescript/analyzer.js} +0 -0
  422. /package/rules/security/S041_session_token_invalidation/{README.md → typescript/README.md} +0 -0
  423. /package/rules/security/S041_session_token_invalidation/{analyzer.js → typescript/analyzer.js} +0 -0
  424. /package/rules/security/S041_session_token_invalidation/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  425. /package/rules/security/S041_session_token_invalidation/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  426. /package/rules/security/S042_require_re_authentication_for_long_lived/{README.md → typescript/README.md} +0 -0
  427. /package/rules/security/S042_require_re_authentication_for_long_lived/{analyzer.js → typescript/analyzer.js} +0 -0
  428. /package/rules/security/S042_require_re_authentication_for_long_lived/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  429. /package/rules/security/S043_password_changes_invalidate_all_sessions/{README.md → typescript/README.md} +0 -0
  430. /package/rules/security/S043_password_changes_invalidate_all_sessions/{analyzer.js → typescript/analyzer.js} +0 -0
  431. /package/rules/security/S043_password_changes_invalidate_all_sessions/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  432. /package/rules/security/S044_re_authentication_required/{README.md → typescript/README.md} +0 -0
  433. /package/rules/security/S044_re_authentication_required/{analyzer.js → typescript/analyzer.js} +0 -0
  434. /package/rules/security/S044_re_authentication_required/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  435. /package/rules/security/S044_re_authentication_required/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  436. /package/rules/security/S045_brute_force_protection/{README.md → typescript/README.md} +0 -0
  437. /package/rules/security/S045_brute_force_protection/{analyzer.js → typescript/analyzer.js} +0 -0
  438. /package/rules/security/S045_brute_force_protection/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  439. /package/rules/security/S048_no_current_password_in_reset/{README.md → typescript/README.md} +0 -0
  440. /package/rules/security/S048_no_current_password_in_reset/{analyzer.js → typescript/analyzer.js} +0 -0
  441. /package/rules/security/S049_short_validity_tokens/{analyzer.js → typescript/analyzer.js} +0 -0
  442. /package/rules/security/S049_short_validity_tokens/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  443. /package/rules/security/S049_short_validity_tokens/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  444. /package/rules/security/S051_password_length_policy/{analyzer.js → typescript/analyzer.js} +0 -0
  445. /package/rules/security/S052_weak_otp_entropy/{analyzer.js → typescript/analyzer.js} +0 -0
  446. /package/rules/security/S054_no_default_accounts/{README.md → typescript/README.md} +0 -0
  447. /package/rules/security/S054_no_default_accounts/{analyzer.js → typescript/analyzer.js} +0 -0
  448. /package/rules/security/S055_content_type_validation/{README.md → typescript/README.md} +0 -0
  449. /package/rules/security/S055_content_type_validation/{analyzer.js → typescript/analyzer.js} +0 -0
  450. /package/rules/security/S055_content_type_validation/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  451. /package/rules/security/S056_log_injection_protection/{analyzer.js → typescript/analyzer.js} +0 -0
  452. /package/rules/security/S056_log_injection_protection/{regex-based-analyzer.js → typescript/regex-based-analyzer.js} +0 -0
  453. /package/rules/security/S056_log_injection_protection/{symbol-based-analyzer.js → typescript/symbol-based-analyzer.js} +0 -0
  454. /package/rules/security/S057_utc_logging/{README.md → typescript/README.md} +0 -0
  455. /package/rules/security/S057_utc_logging/{analyzer.js → typescript/analyzer.js} +0 -0
  456. /package/rules/security/S058_no_ssrf/{README.md → typescript/README.md} +0 -0
@@ -0,0 +1,658 @@
1
+ /**
2
+ * Dart Analyzer
3
+ * Implements ILanguageAnalyzer for Dart files
4
+ * Communicates with embedded Dart binary via JSON-RPC over STDIO
5
+ *
6
+ * Following Rule C005: Single responsibility - Dart analysis only
7
+ * Following Rule C014: Dependency injection - implements ILanguageAnalyzer
8
+ */
9
+
10
+ const path = require('path');
11
+ const fs = require('fs');
12
+ const { spawn } = require('child_process');
13
+ const { EventEmitter } = require('events');
14
+ const { ILanguageAnalyzer } = require('../interfaces/language-analyzer.interface');
15
+
16
+ /**
17
+ * JSON-RPC Client for Dart Analyzer subprocess
18
+ */
19
+ class DartAnalyzerClient extends EventEmitter {
20
+ constructor(options = {}) {
21
+ super();
22
+ this.process = null;
23
+ this.requestId = 0;
24
+ this.pendingRequests = new Map();
25
+ this.buffer = '';
26
+ this.timeout = options.timeout || 30000;
27
+ this.verbose = options.verbose || false;
28
+ }
29
+
30
+ /**
31
+ * Start the Dart analyzer subprocess
32
+ * @param {string} binaryPath - Path to the Dart analyzer binary
33
+ * @returns {Promise<boolean>}
34
+ */
35
+ async start(binaryPath) {
36
+ return new Promise((resolve, reject) => {
37
+ try {
38
+ if (this.verbose) {
39
+ console.log(`🎯 Starting Dart analyzer: ${binaryPath}`);
40
+ }
41
+
42
+ this.process = spawn(binaryPath, [], {
43
+ stdio: ['pipe', 'pipe', 'pipe'],
44
+ env: { ...process.env }
45
+ });
46
+
47
+ // Handle stdout (JSON-RPC responses)
48
+ this.process.stdout.on('data', (data) => {
49
+ this.handleData(data.toString());
50
+ });
51
+
52
+ // Handle stderr (debug output)
53
+ this.process.stderr.on('data', (data) => {
54
+ if (this.verbose) {
55
+ console.log(`[Dart Analyzer] ${data.toString().trim()}`);
56
+ }
57
+ });
58
+
59
+ // Handle process errors
60
+ this.process.on('error', (error) => {
61
+ console.error(`❌ Dart analyzer process error:`, error.message);
62
+ this.emit('error', error);
63
+ reject(error);
64
+ });
65
+
66
+ // Handle process exit
67
+ this.process.on('exit', (code, signal) => {
68
+ if (code !== 0 && this.verbose) {
69
+ console.warn(`⚠️ Dart analyzer exited with code ${code}, signal ${signal}`);
70
+ }
71
+ this.emit('exit', code, signal);
72
+ });
73
+
74
+ // Wait a bit for the process to start
75
+ setTimeout(() => resolve(true), 100);
76
+
77
+ } catch (error) {
78
+ reject(error);
79
+ }
80
+ });
81
+ }
82
+
83
+ /**
84
+ * Handle incoming data from the subprocess
85
+ * @param {string} data - Raw data from stdout
86
+ */
87
+ handleData(data) {
88
+ this.buffer += data;
89
+
90
+ // Process complete lines (newline-delimited JSON)
91
+ const lines = this.buffer.split('\n');
92
+ this.buffer = lines.pop() || ''; // Keep incomplete line in buffer
93
+
94
+ for (const line of lines) {
95
+ if (!line.trim()) continue;
96
+
97
+ try {
98
+ const response = JSON.parse(line);
99
+ this.handleResponse(response);
100
+ } catch (error) {
101
+ if (this.verbose) {
102
+ console.warn(`⚠️ Invalid JSON from Dart analyzer:`, line.substring(0, 100));
103
+ }
104
+ }
105
+ }
106
+ }
107
+
108
+ /**
109
+ * Handle a JSON-RPC response
110
+ * @param {Object} response - Parsed JSON-RPC response
111
+ */
112
+ handleResponse(response) {
113
+ if (response.id !== undefined) {
114
+ const pending = this.pendingRequests.get(response.id);
115
+ if (pending) {
116
+ this.pendingRequests.delete(response.id);
117
+ clearTimeout(pending.timeout);
118
+
119
+ if (response.error) {
120
+ pending.reject(new Error(response.error.message || 'Unknown error'));
121
+ } else {
122
+ pending.resolve(response.result);
123
+ }
124
+ }
125
+ } else if (response.method) {
126
+ // Notification from server
127
+ this.emit('notification', response.method, response.params);
128
+ }
129
+ }
130
+
131
+ /**
132
+ * Send a JSON-RPC request
133
+ * @param {string} method - RPC method name
134
+ * @param {Object} params - Method parameters
135
+ * @returns {Promise<Object>} - Response result
136
+ */
137
+ async sendRequest(method, params = {}) {
138
+ return new Promise((resolve, reject) => {
139
+ if (!this.process) {
140
+ reject(new Error('Dart analyzer not started'));
141
+ return;
142
+ }
143
+
144
+ const id = ++this.requestId;
145
+ const request = {
146
+ jsonrpc: '2.0',
147
+ id,
148
+ method,
149
+ params
150
+ };
151
+
152
+ // Set up timeout
153
+ const timeoutId = setTimeout(() => {
154
+ this.pendingRequests.delete(id);
155
+ reject(new Error(`Request ${method} timed out after ${this.timeout}ms`));
156
+ }, this.timeout);
157
+
158
+ // Store pending request
159
+ this.pendingRequests.set(id, { resolve, reject, timeout: timeoutId });
160
+
161
+ // Send request
162
+ try {
163
+ this.process.stdin.write(JSON.stringify(request) + '\n');
164
+ } catch (error) {
165
+ this.pendingRequests.delete(id);
166
+ clearTimeout(timeoutId);
167
+ reject(error);
168
+ }
169
+ });
170
+ }
171
+
172
+ /**
173
+ * Stop the subprocess
174
+ */
175
+ async stop() {
176
+ if (this.process) {
177
+ // Cancel all pending requests
178
+ for (const [id, pending] of this.pendingRequests) {
179
+ clearTimeout(pending.timeout);
180
+ pending.reject(new Error('Analyzer stopped'));
181
+ }
182
+ this.pendingRequests.clear();
183
+
184
+ // Kill the process
185
+ this.process.kill('SIGTERM');
186
+ this.process = null;
187
+ }
188
+ }
189
+
190
+ /**
191
+ * Check if the client is connected
192
+ * @returns {boolean}
193
+ */
194
+ isConnected() {
195
+ return this.process !== null && !this.process.killed;
196
+ }
197
+ }
198
+
199
+ /**
200
+ * Dart Language Analyzer
201
+ */
202
+ class DartAnalyzer extends ILanguageAnalyzer {
203
+ constructor() {
204
+ super('dart', ['.dart']);
205
+
206
+ this.client = null;
207
+ this.binaryPath = null;
208
+ this.projectPath = null;
209
+ this.useFallback = false; // Use regex fallback if binary not available
210
+
211
+ // Symbol table cache
212
+ this.symbolTableCache = new Map();
213
+ }
214
+
215
+ /**
216
+ * Initialize the Dart analyzer
217
+ * @param {Object} config - Configuration
218
+ * @returns {Promise<boolean>}
219
+ */
220
+ async initialize(config) {
221
+ const {
222
+ projectPath = process.cwd(),
223
+ targetFiles = null,
224
+ verbose = false
225
+ } = config;
226
+
227
+ this.projectPath = projectPath;
228
+ this.verbose = verbose;
229
+
230
+ // Filter only Dart files from targetFiles
231
+ const dartFiles = targetFiles
232
+ ? targetFiles.filter(f => this.supportsFile(f))
233
+ : [];
234
+
235
+ if (dartFiles.length === 0 && targetFiles) {
236
+ if (verbose) {
237
+ console.log(`🔷 DartAnalyzer: No Dart files to analyze, skipping initialization`);
238
+ }
239
+ this.initialized = true;
240
+ return true;
241
+ }
242
+
243
+ try {
244
+ // Resolve the Dart analyzer binary
245
+ this.binaryPath = await this.resolveBinary();
246
+
247
+ if (this.binaryPath) {
248
+ // Initialize the JSON-RPC client
249
+ this.client = new DartAnalyzerClient({ verbose, timeout: 30000 });
250
+ await this.client.start(this.binaryPath);
251
+
252
+ // Send initialization request
253
+ await this.client.sendRequest('initialize', {
254
+ projectPath,
255
+ targetFiles: dartFiles
256
+ });
257
+
258
+ this.initialized = true;
259
+ if (verbose) {
260
+ console.log(`✅ DartAnalyzer initialized with binary: ${this.binaryPath}`);
261
+ console.log(` 📄 Target files: ${dartFiles.length} Dart files`);
262
+ }
263
+
264
+ return true;
265
+ } else {
266
+ // Fall back to regex-based analysis
267
+ if (verbose) {
268
+ console.log(`ℹ️ DartAnalyzer: Binary not found, using regex fallback mode`);
269
+ }
270
+ this.useFallback = true;
271
+ this.initialized = true;
272
+ return true;
273
+ }
274
+ } catch (error) {
275
+ // Silent fallback - Dart analyzer not available
276
+ // Fall back to regex mode
277
+ this.useFallback = true;
278
+ this.initialized = true;
279
+ return false;
280
+ }
281
+ }
282
+
283
+ /**
284
+ * Resolve the path to the Dart analyzer binary
285
+ * Priority: bundled > downloaded > pub global
286
+ * @returns {Promise<string|null>}
287
+ */
288
+ async resolveBinary() {
289
+ const platform = process.platform;
290
+ const binaryName = platform === 'win32'
291
+ ? 'sunlint-dart-windows.exe'
292
+ : `sunlint-dart-${platform === 'darwin' ? 'macos' : 'linux'}`;
293
+
294
+ // Priority 1: Bundled binary in dart_analyzer/bin
295
+ const bundledPath = path.join(__dirname, '../../dart_analyzer/bin', binaryName);
296
+ if (fs.existsSync(bundledPath)) {
297
+ // Ensure executable on Unix
298
+ if (platform !== 'win32') {
299
+ try {
300
+ fs.chmodSync(bundledPath, '755');
301
+ } catch (e) {
302
+ // Ignore chmod errors
303
+ }
304
+ }
305
+ return bundledPath;
306
+ }
307
+
308
+ // Priority 2: Cached binary (downloaded on first use)
309
+ const cachePath = path.join(
310
+ process.env.HOME || process.env.USERPROFILE || '/tmp',
311
+ '.sunlint',
312
+ 'bin',
313
+ binaryName
314
+ );
315
+ if (fs.existsSync(cachePath)) {
316
+ return cachePath;
317
+ }
318
+
319
+ // Priority 3: Check if Dart is available (pub global)
320
+ if (await this.isDartAvailable()) {
321
+ if (this.verbose) {
322
+ console.log(`ℹ️ Dart SDK detected, can use pub global analyzer`);
323
+ }
324
+ // For now, return null and use fallback
325
+ // In future, could run 'dart pub global run sunlint_analyzer'
326
+ return null;
327
+ }
328
+
329
+ // No binary available
330
+ if (this.verbose) {
331
+ console.log(`ℹ️ Dart analyzer binary not found at:`);
332
+ console.log(` - ${bundledPath}`);
333
+ console.log(` - ${cachePath}`);
334
+ }
335
+
336
+ return null;
337
+ }
338
+
339
+ /**
340
+ * Check if Dart SDK is available
341
+ * @returns {Promise<boolean>}
342
+ */
343
+ async isDartAvailable() {
344
+ return new Promise((resolve) => {
345
+ const dartProcess = spawn('dart', ['--version'], {
346
+ stdio: ['ignore', 'pipe', 'pipe'],
347
+ shell: true
348
+ });
349
+
350
+ dartProcess.on('error', () => resolve(false));
351
+ dartProcess.on('exit', (code) => resolve(code === 0));
352
+
353
+ // Timeout after 2 seconds
354
+ setTimeout(() => {
355
+ dartProcess.kill();
356
+ resolve(false);
357
+ }, 2000);
358
+ });
359
+ }
360
+
361
+ /**
362
+ * Analyze a single Dart file
363
+ * @param {string} filePath - Path to the file
364
+ * @param {Object[]} rules - Rules to apply
365
+ * @param {Object} [options] - Analysis options
366
+ * @returns {Promise<Object[]>} - Array of violations
367
+ */
368
+ async analyzeFile(filePath, rules, options = {}) {
369
+ if (!this.initialized || !this.supportsFile(filePath)) {
370
+ return [];
371
+ }
372
+
373
+ const startTime = Date.now();
374
+ let violations = [];
375
+
376
+ try {
377
+ if (this.useFallback) {
378
+ // Use regex-based fallback analysis
379
+ violations = await this.analyzeWithRegex(filePath, rules, options);
380
+ } else if (this.client && this.client.isConnected()) {
381
+ // Use the binary analyzer
382
+ const result = await this.client.sendRequest('analyze', {
383
+ filePath,
384
+ rules: rules.map(r => ({
385
+ id: r.id || r.ruleId,
386
+ config: r.config || {}
387
+ }))
388
+ });
389
+ violations = result.violations || [];
390
+ } else {
391
+ // Fallback if client disconnected
392
+ violations = await this.analyzeWithRegex(filePath, rules, options);
393
+ }
394
+
395
+ this.stats.filesAnalyzed++;
396
+ this.stats.totalAnalysisTime += Date.now() - startTime;
397
+
398
+ } catch (error) {
399
+ if (this.verbose) {
400
+ console.warn(`⚠️ Error analyzing ${path.basename(filePath)}:`, error.message);
401
+ }
402
+ }
403
+
404
+ return violations;
405
+ }
406
+
407
+ /**
408
+ * Fallback regex-based analysis for Dart files
409
+ * @param {string} filePath - Path to the file
410
+ * @param {Object[]} rules - Rules to apply
411
+ * @param {Object} [options] - Analysis options
412
+ * @returns {Promise<Object[]>}
413
+ */
414
+ async analyzeWithRegex(filePath, rules, options = {}) {
415
+ const violations = [];
416
+
417
+ try {
418
+ const content = fs.readFileSync(filePath, 'utf8');
419
+ const lines = content.split('\n');
420
+
421
+ for (const rule of rules) {
422
+ const ruleId = rule.id || rule.ruleId;
423
+
424
+ // Basic pattern-based analysis
425
+ const ruleViolations = this.applyPatternRule(filePath, content, lines, rule);
426
+ violations.push(...ruleViolations);
427
+ }
428
+ } catch (error) {
429
+ if (this.verbose) {
430
+ console.warn(`⚠️ Regex analysis failed for ${path.basename(filePath)}:`, error.message);
431
+ }
432
+ }
433
+
434
+ return violations;
435
+ }
436
+
437
+ /**
438
+ * Apply a pattern-based rule to Dart content
439
+ * @param {string} filePath - File path
440
+ * @param {string} content - File content
441
+ * @param {string[]} lines - Lines of content
442
+ * @param {Object} rule - Rule definition
443
+ * @returns {Object[]}
444
+ */
445
+ applyPatternRule(filePath, content, lines, rule) {
446
+ const violations = [];
447
+ const ruleId = rule.id || rule.ruleId;
448
+
449
+ // Common Dart patterns for basic analysis
450
+ const patterns = this.getDartPatterns(ruleId);
451
+
452
+ for (const pattern of patterns) {
453
+ let match;
454
+ while ((match = pattern.regex.exec(content)) !== null) {
455
+ // Find line number
456
+ const upToMatch = content.substring(0, match.index);
457
+ const lineNumber = (upToMatch.match(/\n/g) || []).length + 1;
458
+ const column = match.index - upToMatch.lastIndexOf('\n');
459
+
460
+ violations.push({
461
+ ruleId,
462
+ filePath,
463
+ line: lineNumber,
464
+ column,
465
+ message: pattern.message,
466
+ severity: rule.severity || 'warning',
467
+ analysisMethod: 'regex'
468
+ });
469
+ }
470
+ }
471
+
472
+ return violations;
473
+ }
474
+
475
+ /**
476
+ * Get Dart-specific patterns for a rule
477
+ * @param {string} ruleId - Rule ID
478
+ * @returns {Array<{regex: RegExp, message: string}>}
479
+ */
480
+ getDartPatterns(ruleId) {
481
+ // Common Dart anti-patterns by rule category
482
+ const patterns = {
483
+ // Complexity rules
484
+ 'C001': [], // High complexity - requires AST
485
+ 'C008': [], // Deep nesting - requires AST
486
+
487
+ // Naming rules
488
+ 'N001': [
489
+ {
490
+ regex: /\bclass\s+[a-z][a-zA-Z0-9_]*/g,
491
+ message: 'Class names should use UpperCamelCase'
492
+ },
493
+ {
494
+ regex: /\b(var|final|const)\s+[A-Z][a-zA-Z0-9_]*\s*=/g,
495
+ message: 'Variable names should use lowerCamelCase'
496
+ }
497
+ ],
498
+
499
+ // Error handling rules
500
+ 'E001': [
501
+ {
502
+ regex: /catch\s*\(\s*e\s*\)\s*\{\s*\}/g,
503
+ message: 'Empty catch block - errors are silently ignored'
504
+ },
505
+ {
506
+ regex: /catch\s*\(\s*_\s*\)\s*\{/g,
507
+ message: 'Ignoring caught exception'
508
+ }
509
+ ],
510
+
511
+ // Security rules
512
+ 'S003': [
513
+ {
514
+ regex: /print\s*\(\s*['"]?(password|secret|token|key|api[_-]?key)/gi,
515
+ message: 'Potential sensitive data in print statement'
516
+ }
517
+ ],
518
+ 'S022': [
519
+ {
520
+ regex: /\$\{[^}]*\}/g,
521
+ message: 'String interpolation - check for XSS vulnerability if rendering HTML'
522
+ }
523
+ ]
524
+ };
525
+
526
+ return patterns[ruleId] || [];
527
+ }
528
+
529
+ /**
530
+ * Get the Symbol Table for a Dart file
531
+ * @param {string} filePath - Path to the file
532
+ * @returns {Promise<Object|null>}
533
+ */
534
+ async getSymbolTable(filePath) {
535
+ if (!this.initialized || !this.supportsFile(filePath)) {
536
+ return null;
537
+ }
538
+
539
+ // Check cache
540
+ const absolutePath = path.resolve(filePath);
541
+ if (this.symbolTableCache.has(absolutePath)) {
542
+ this.stats.cacheHits++;
543
+ return this.symbolTableCache.get(absolutePath);
544
+ }
545
+
546
+ this.stats.cacheMisses++;
547
+
548
+ try {
549
+ if (this.client && this.client.isConnected()) {
550
+ const result = await this.client.sendRequest('getSymbolTable', { filePath });
551
+ if (result) {
552
+ this.symbolTableCache.set(absolutePath, result);
553
+ }
554
+ return result;
555
+ } else {
556
+ // Basic symbol table from regex parsing
557
+ return await this.buildBasicSymbolTable(filePath);
558
+ }
559
+ } catch (error) {
560
+ if (this.verbose) {
561
+ console.warn(`⚠️ Failed to get symbol table for ${path.basename(filePath)}:`, error.message);
562
+ }
563
+ return null;
564
+ }
565
+ }
566
+
567
+ /**
568
+ * Build a basic symbol table using regex parsing
569
+ * @param {string} filePath - Path to the file
570
+ * @returns {Promise<Object|null>}
571
+ */
572
+ async buildBasicSymbolTable(filePath) {
573
+ try {
574
+ const content = fs.readFileSync(filePath, 'utf8');
575
+
576
+ const symbolTable = {
577
+ filePath,
578
+ fileName: path.basename(filePath),
579
+ imports: [],
580
+ exports: [],
581
+ classes: [],
582
+ functions: [],
583
+ variables: [],
584
+ lastModified: Date.now()
585
+ };
586
+
587
+ // Extract imports
588
+ const importRegex = /import\s+['"]([^'"]+)['"]/g;
589
+ let match;
590
+ while ((match = importRegex.exec(content)) !== null) {
591
+ const lineNumber = (content.substring(0, match.index).match(/\n/g) || []).length + 1;
592
+ symbolTable.imports.push({
593
+ module: match[1],
594
+ line: lineNumber
595
+ });
596
+ }
597
+
598
+ // Extract classes
599
+ const classRegex = /class\s+(\w+)(?:\s+extends\s+(\w+))?(?:\s+with\s+([\w,\s]+))?(?:\s+implements\s+([\w,\s]+))?\s*\{/g;
600
+ while ((match = classRegex.exec(content)) !== null) {
601
+ const lineNumber = (content.substring(0, match.index).match(/\n/g) || []).length + 1;
602
+ symbolTable.classes.push({
603
+ name: match[1],
604
+ extends: match[2] || null,
605
+ with: match[3] ? match[3].split(',').map(s => s.trim()) : [],
606
+ implements: match[4] ? match[4].split(',').map(s => s.trim()) : [],
607
+ line: lineNumber
608
+ });
609
+ }
610
+
611
+ // Extract functions
612
+ const functionRegex = /(?:Future|void|int|double|bool|String|dynamic|\w+)\s+(\w+)\s*\([^)]*\)\s*(?:async\s*)?\{/g;
613
+ while ((match = functionRegex.exec(content)) !== null) {
614
+ const lineNumber = (content.substring(0, match.index).match(/\n/g) || []).length + 1;
615
+ symbolTable.functions.push({
616
+ name: match[1],
617
+ line: lineNumber
618
+ });
619
+ }
620
+
621
+ this.symbolTableCache.set(path.resolve(filePath), symbolTable);
622
+ return symbolTable;
623
+
624
+ } catch (error) {
625
+ return null;
626
+ }
627
+ }
628
+
629
+ /**
630
+ * Clear the symbol table cache
631
+ */
632
+ clearCache() {
633
+ this.symbolTableCache.clear();
634
+ }
635
+
636
+ /**
637
+ * Cleanup resources
638
+ * @returns {Promise<void>}
639
+ */
640
+ async dispose() {
641
+ if (this.client) {
642
+ await this.client.stop();
643
+ this.client = null;
644
+ }
645
+
646
+ this.symbolTableCache.clear();
647
+ this.initialized = false;
648
+
649
+ if (this.verbose) {
650
+ console.log(`🧹 DartAnalyzer disposed`);
651
+ console.log(` 📊 Files analyzed: ${this.stats.filesAnalyzed}`);
652
+ console.log(` 🎯 Cache hits: ${this.stats.cacheHits}`);
653
+ console.log(` 📦 Fallback mode: ${this.useFallback}`);
654
+ }
655
+ }
656
+ }
657
+
658
+ module.exports = DartAnalyzer;