@trust-assurance-protocol/owaspscan 1.0.0

package/dist/rules/owasp-a02/hardcoded-secrets.js

@@ -0,0 +1,97 @@
+// OWASP A02:2021 — Cryptographic Failures
+// Rule: Hardcoded credentials, API keys, secrets, or tokens in source code
+export const HardcodedSecrets = {
+    id: 'OWASP-A02-002',
+    name: 'Hardcoded Secret, API Key, or Credential',
+    owasp: 'A02:2021',
+    cwe: 'CWE-798',
+    severity: 'CRITICAL',
+    languages: ['all'],
+    description: 'Secrets, API keys, passwords, or tokens hardcoded directly in source code. ' +
+        'These are exposed when code is committed to version control and visible to anyone ' +
+        'with repository access. AI tools routinely hardcode example credentials that end up in production.',
+    patterns: [
+        {
+            // Generic: password = "..." (non-empty, not a variable reference)
+            pattern: /(?:password|passwd|pwd|pass)\s*[:=]\s*['"`](?!.*process\.env)[^'"`\s]{6,}['"`]/gi,
+            suppressIf: /(?:process\.env|os\.environ|getenv|config\.|settings\.|placeholder|example|changeme|your[_-]?password|<password>|\$\{|f['"])/i,
+            snippetLines: 1,
+        },
+        {
+            // Generic: secret = "..."
+            pattern: /(?:secret|api_secret|client_secret|app_secret)\s*[:=]\s*['"`](?!.*process\.env)[^'"`\s]{8,}['"`]/gi,
+            suppressIf: /(?:process\.env|os\.environ|getenv|config\.|settings\.|placeholder|example|changeme|\$\{|f['"])/i,
+            snippetLines: 1,
+        },
+        {
+            // Generic: api_key / apiKey = "..."
+            pattern: /(?:api[_-]?key|apikey|access[_-]?key|auth[_-]?key)\s*[:=]\s*['"`](?!.*process\.env)[a-zA-Z0-9_\-]{16,}['"`]/gi,
+            suppressIf: /(?:process\.env|os\.environ|getenv|config\.|settings\.|placeholder|example|test|fake|dummy|\$\{)/i,
+            snippetLines: 1,
+        },
+        {
+            // AWS Access Key ID pattern: AKIA...
+            pattern: /['"`]AKIA[0-9A-Z]{16}['"`]/g,
+            snippetLines: 1,
+        },
+        {
+            // AWS Secret Access Key: 40-char base64-like string after aws context
+            pattern: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[:=]\s*['"`][a-zA-Z0-9+/]{40}['"`]/gi,
+            snippetLines: 1,
+        },
+        {
+            // Generic token assignment
+            pattern: /(?:token|auth_token|access_token|bearer_token|refresh_token)\s*[:=]\s*['"`](?!.*process\.env)[a-zA-Z0-9._\-]{20,}['"`]/gi,
+            suppressIf: /(?:process\.env|os\.environ|getenv|config\.|settings\.|placeholder|example|test|fake|\$\{)/i,
+            snippetLines: 1,
+        },
+        {
+            // JWT hardcoded (3-part base64url)
+            pattern: /['"`]eyJ[a-zA-Z0-9_\-]{10,}\.eyJ[a-zA-Z0-9_\-]{10,}\.[a-zA-Z0-9_\-]{10,}['"`]/g,
+            snippetLines: 1,
+        },
+        {
+            // GitHub PAT
+            pattern: /['"`]gh[pousr]_[a-zA-Z0-9]{36,}['"`]/g,
+            snippetLines: 1,
+        },
+        {
+            // Private key / certificate header
+            pattern: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/g,
+            snippetLines: 1,
+        },
+        {
+            // Stripe secret key
+            pattern: /['"`]sk_(?:live|test)_[a-zA-Z0-9]{24,}['"`]/g,
+            snippetLines: 1,
+        },
+        {
+            // Slack token
+            pattern: /['"`]xox[bpoa]-[a-zA-Z0-9\-]{10,}['"`]/g,
+            snippetLines: 1,
+        },
+        {
+            // SendGrid API key
+            pattern: /['"`]SG\.[a-zA-Z0-9_\-]{22}\.[a-zA-Z0-9_\-]{43}['"`]/g,
+            snippetLines: 1,
+        },
+    ],
+    fix: 'Never hardcode secrets in source code. Use environment variables or a secrets manager.\n\n' +
+        '// Bad:\n' +
+        'const apiKey = "sk_live_abc123...";\n\n' +
+        '// Good — Node.js:\n' +
+        'const apiKey = process.env.STRIPE_API_KEY;\n' +
+        'if (!apiKey) throw new Error("STRIPE_API_KEY environment variable is required");\n\n' +
+        '// Good — Python:\n' +
+        'import os\n' +
+        'api_key = os.environ["STRIPE_API_KEY"]\n\n' +
+        'Use a .env file locally (add .env to .gitignore) and inject via CI/CD secrets.\n' +
+        'Consider HashiCorp Vault, AWS Secrets Manager, or Doppler for production.',
+    references: [
+        'https://owasp.org/Top10/A02_2021-Cryptographic_Failures/',
+        'https://cwe.mitre.org/data/definitions/798.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html',
+    ],
+    tags: ['secrets', 'credentials', 'api-key', 'hardcoded', 'crypto'],
+};
+//# sourceMappingURL=hardcoded-secrets.js.map

package/dist/rules/owasp-a02/hardcoded-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-secrets.js","sourceRoot":"","sources":["../../../src/rules/owasp-a02/hardcoded-secrets.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,2EAA2E;AAI3E,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,0CAA0C;IAChD,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,CAAC,KAAK,CAAC;IAClB,WAAW,EACT,6EAA6E;QAC7E,oFAAoF;QACpF,oGAAoG;IACtG,QAAQ,EAAE;QACR;YACE,kEAAkE;YAClE,OAAO,EACL,kFAAkF;YACpF,UAAU,EACR,+HAA+H;YACjI,YAAY,EAAE,CAAC;SAChB;QACD;YACE,0BAA0B;YAC1B,OAAO,EACL,oGAAoG;YACtG,UAAU,EACR,kGAAkG;YACpG,YAAY,EAAE,CAAC;SAChB;QACD;YACE,oCAAoC;YACpC,OAAO,EACL,+GAA+G;YACjH,UAAU,EACR,mGAAmG;YACrG,YAAY,EAAE,CAAC;SAChB;QACD;YACE,qCAAqC;YACrC,OAAO,EAAE,6BAA6B;YACtC,YAAY,EAAE,CAAC;SAChB;QACD;YACE,sEAAsE;YACtE,OAAO,EACL,wFAAwF;YAC1F,YAAY,EAAE,CAAC;SAChB;QACD;YACE,2BAA2B;YAC3B,OAAO,EACL,0HAA0H;YAC5H,UAAU,EACR,6FAA6F;YAC/F,YAAY,EAAE,CAAC;SAChB;QACD;YACE,mCAAmC;YACnC,OAAO,EAAE,gFAAgF;YACzF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,aAAa;YACb,OAAO,EAAE,uCAAuC;YAChD,YAAY,EAAE,CAAC;SAChB;QACD;YACE,mCAAmC;YACnC,OAAO,EAAE,6CAA6C;YACtD,YAAY,EAAE,CAAC;SAChB;QACD;YACE,oBAAoB;YACpB,OAAO,EAAE,8CAA8C;YACvD,YAAY,EAAE,CAAC;SAChB;QACD;YACE,cAAc;YACd,OAAO,EAAE,yCAAyC;YAClD,YAAY,EAAE,CAAC;SAChB;QACD;YACE,mBAAmB;YACnB,OAAO,EAAE,uDAAuD;YAChE,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,4FAA4F;QAC5F,WAAW;QACX,yCAAyC;QACzC,sBAAsB;QACtB,8CAA8C;QAC9C,sFAAsF;QACtF,qBAAqB;QACrB,aAAa;QACb,4CAA4C;QAC5C,kFAAkF;QAClF,2EAA2E;IAC7E,UAAU,EAAE;QACV,0DAA0D;QAC1D,iDAAiD;QACjD,oFAAoF;KACrF;IACD,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC;CACnE,CAAC"}

package/dist/rules/owasp-a02/insecure-tls.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const InsecureTLS: Rule;
+//# sourceMappingURL=insecure-tls.d.ts.map

package/dist/rules/owasp-a02/insecure-tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-tls.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a02/insecure-tls.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,WAAW,EAAE,IA0EzB,CAAC"}

package/dist/rules/owasp-a02/insecure-tls.js

@@ -0,0 +1,75 @@
+// OWASP A02:2021 — Cryptographic Failures
+// Rule: Insecure TLS configuration (disabled cert validation, old protocol versions)
+export const InsecureTLS = {
+    id: 'OWASP-A02-004',
+    name: 'Insecure TLS / SSL Configuration',
+    owasp: 'A02:2021',
+    cwe: 'CWE-295',
+    severity: 'HIGH',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go', 'ruby', 'php'],
+    description: 'TLS certificate validation disabled or insecure TLS versions allowed. ' +
+        'Disabling cert verification (rejectUnauthorized: false, verify=False) removes ' +
+        'protection against man-in-the-middle attacks. Commonly added by AI when dealing with self-signed certs.',
+    patterns: [
+        {
+            // Node.js: rejectUnauthorized: false
+            pattern: /rejectUnauthorized\s*:\s*false/gi,
+            snippetLines: 3,
+        },
+        {
+            // Node.js: NODE_TLS_REJECT_UNAUTHORIZED = 0
+            pattern: /NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"`]?0['"`]?/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python requests: verify=False
+            pattern: /requests\s*\.\s*(?:get|post|put|patch|delete|head|options|request)\s*\([^)]*verify\s*=\s*False/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python ssl: check_hostname = False
+            pattern: /(?:context|ctx|ssl_ctx|ssl_context)\s*\.\s*check_hostname\s*=\s*False/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python ssl: verify_mode = ssl.CERT_NONE
+            pattern: /verify_mode\s*=\s*ssl\.CERT_NONE/gi,
+            snippetLines: 3,
+        },
+        {
+            // Java: TrustAllCerts / X509TrustManager that accepts all
+            pattern: /new\s+X509TrustManager\s*\(\s*\)|TrustAllCerts|ALLOW_ALL_HOSTNAME_VERIFIER|setHostnameVerifier\s*\(\s*SSLConnectionSocketFactory\.ALLOW_ALL_HOSTNAME_VERIFIER/gi,
+            snippetLines: 3,
+        },
+        {
+            // Go: InsecureSkipVerify: true
+            pattern: /InsecureSkipVerify\s*:\s*true/gi,
+            snippetLines: 3,
+        },
+        {
+            // Ruby: verify_mode = VERIFY_NONE
+            pattern: /verify_mode\s*=\s*OpenSSL::SSL::VERIFY_NONE/gi,
+            snippetLines: 3,
+        },
+    ],
+    fix: 'Never disable TLS certificate verification in production.\n\n' +
+        '// Node.js — use proper CA bundle:\n' +
+        'import https from "https";\n' +
+        'import fs from "fs";\n' +
+        'const agent = new https.Agent({\n' +
+        '  ca: fs.readFileSync("./certs/ca-bundle.crt"), // trust your CA\n' +
+        '  // rejectUnauthorized: true (default — do NOT set false)\n' +
+        '});\n\n' +
+        '// Python — specify CA bundle:\n' +
+        'import requests\n' +
+        'requests.get("https://api.example.com", verify="/path/to/ca-bundle.crt")\n\n' +
+        '// For development with self-signed certs: add the cert to your system trust store\n' +
+        '// or pass verify="/path/to/self-signed.crt" — never use verify=False.',
+    references: [
+        'https://owasp.org/Top10/A02_2021-Cryptographic_Failures/',
+        'https://cwe.mitre.org/data/definitions/295.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html',
+    ],
+    tags: ['tls', 'ssl', 'certificate', 'crypto', 'network'],
+};
+//# sourceMappingURL=insecure-tls.js.map

package/dist/rules/owasp-a02/insecure-tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-tls.js","sourceRoot":"","sources":["../../../src/rules/owasp-a02/insecure-tls.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,qFAAqF;AAIrF,MAAM,CAAC,MAAM,WAAW,GAAS;IAC/B,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,kCAAkC;IACxC,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC;IAC9E,WAAW,EACT,wEAAwE;QACxE,gFAAgF;QAChF,yGAAyG;IAC3G,QAAQ,EAAE;QACR;YACE,qCAAqC;YACrC,OAAO,EAAE,kCAAkC;YAC3C,YAAY,EAAE,CAAC;SAChB;QACD;YACE,4CAA4C;YAC5C,OAAO,EAAE,oDAAoD;YAC7D,YAAY,EAAE,CAAC;SAChB;QACD;YACE,gCAAgC;YAChC,OAAO,EAAE,kGAAkG;YAC3G,YAAY,EAAE,CAAC;SAChB;QACD;YACE,qCAAqC;YACrC,OAAO,EAAE,yEAAyE;YAClF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,0CAA0C;YAC1C,OAAO,EAAE,oCAAoC;YAC7C,YAAY,EAAE,CAAC;SAChB;QACD;YACE,0DAA0D;YAC1D,OAAO,EACL,iKAAiK;YACnK,YAAY,EAAE,CAAC;SAChB;QACD;YACE,+BAA+B;YAC/B,OAAO,EAAE,iCAAiC;YAC1C,YAAY,EAAE,CAAC;SAChB;QACD;YACE,kCAAkC;YAClC,OAAO,EAAE,+CAA+C;YACxD,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,+DAA+D;QAC/D,sCAAsC;QACtC,8BAA8B;QAC9B,wBAAwB;QACxB,mCAAmC;QACnC,oEAAoE;QACpE,8DAA8D;QAC9D,SAAS;QACT,kCAAkC;QAClC,mBAAmB;QACnB,8EAA8E;QAC9E,sFAAsF;QACtF,wEAAwE;IAC1E,UAAU,EAAE;QACV,0DAA0D;QAC1D,iDAAiD;QACjD,0FAA0F;KAC3F;IACD,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC;CACzD,CAAC"}

package/dist/rules/owasp-a02/weak-hash.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const WeakHash: Rule;
+//# sourceMappingURL=weak-hash.d.ts.map

package/dist/rules/owasp-a02/weak-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-hash.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a02/weak-hash.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,QAAQ,EAAE,IAyEtB,CAAC"}

package/dist/rules/owasp-a02/weak-hash.js

@@ -0,0 +1,73 @@
+// OWASP A02:2021 — Cryptographic Failures
+// Rule: Weak or broken hashing algorithms used for passwords or sensitive data
+export const WeakHash = {
+    id: 'OWASP-A02-001',
+    name: 'Weak Cryptographic Hash Algorithm',
+    owasp: 'A02:2021',
+    cwe: 'CWE-327',
+    severity: 'HIGH',
+    languages: ['javascript', 'typescript', 'python', 'php', 'java', 'ruby', 'go', 'csharp'],
+    description: 'MD5 and SHA-1 are cryptographically broken hash functions — they are fast and vulnerable ' +
+        'to collision and preimage attacks. They must never be used for passwords, digital signatures, ' +
+        'or integrity verification. AI assistants frequently suggest md5() or SHA1 for "quick hashing".',
+    patterns: [
+        {
+            // Node.js crypto: createHash('md5') or createHash('sha1')
+            pattern: /crypto\s*\.\s*createHash\s*\(\s*['"`]\s*(?:md5|sha1|sha-1|MD5|SHA1|SHA-1)\s*['"`]\s*\)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python hashlib: hashlib.md5() / hashlib.sha1()
+            pattern: /hashlib\s*\.\s*(?:md5|sha1)\s*\(/gi,
+            snippetLines: 3,
+        },
+        {
+            // PHP: md5() / sha1() — especially with password context
+            pattern: /\bmd5\s*\(\s*\$(?:password|passwd|pwd|secret|hash)/gi,
+            snippetLines: 3,
+        },
+        {
+            pattern: /\bsha1\s*\(\s*\$(?:password|passwd|pwd|secret|hash)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Ruby: Digest::MD5 / Digest::SHA1
+            pattern: /Digest\s*::\s*(?:MD5|SHA1)\s*\.\s*(?:hexdigest|digest)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Java: MessageDigest.getInstance("MD5") / getInstance("SHA-1")
+            pattern: /MessageDigest\s*\.\s*getInstance\s*\(\s*['"`]\s*(?:MD5|SHA-1|SHA1)\s*['"`]\s*\)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Go: md5.New() / sha1.New()
+            pattern: /(?:md5|sha1)\s*\.\s*New\s*\(\s*\)/gi,
+            snippetLines: 3,
+        },
+        {
+            // C#: MD5.Create() / SHA1.Create()
+            pattern: /(?:MD5|SHA1)\s*\.\s*Create\s*\(\s*\)/gi,
+            snippetLines: 3,
+        },
+    ],
+    fix: 'For passwords: use bcrypt, Argon2id, or scrypt (NOT a general-purpose hash).\n' +
+        'For integrity/checksums: use SHA-256 or SHA-3 at minimum.\n\n' +
+        '// Node.js password hashing:\n' +
+        'import bcrypt from "bcrypt";\n' +
+        'const hash = await bcrypt.hash(password, 12); // cost factor >= 10\n\n' +
+        '// Node.js data integrity:\n' +
+        'const hash = crypto.createHash("sha256").update(data).digest("hex");\n\n' +
+        '// Python password hashing:\n' +
+        'from passlib.hash import argon2\n' +
+        'hash = argon2.hash(password)\n\n' +
+        '// PHP:\n' +
+        '$hash = password_hash($password, PASSWORD_ARGON2ID);',
+    references: [
+        'https://owasp.org/Top10/A02_2021-Cryptographic_Failures/',
+        'https://cwe.mitre.org/data/definitions/327.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html',
+    ],
+    tags: ['crypto', 'hashing', 'password', 'md5', 'sha1'],
+};
+//# sourceMappingURL=weak-hash.js.map

package/dist/rules/owasp-a02/weak-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-hash.js","sourceRoot":"","sources":["../../../src/rules/owasp-a02/weak-hash.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,+EAA+E;AAI/E,MAAM,CAAC,MAAM,QAAQ,GAAS;IAC5B,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,mCAAmC;IACzC,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC;IACxF,WAAW,EACT,2FAA2F;QAC3F,gGAAgG;QAChG,gGAAgG;IAClG,QAAQ,EAAE;QACR;YACE,0DAA0D;YAC1D,OAAO,EACL,0FAA0F;YAC5F,YAAY,EAAE,CAAC;SAChB;QACD;YACE,iDAAiD;YACjD,OAAO,EAAE,oCAAoC;YAC7C,YAAY,EAAE,CAAC;SAChB;QACD;YACE,yDAAyD;YACzD,OAAO,EAAE,sDAAsD;YAC/D,YAAY,EAAE,CAAC;SAChB;QACD;YACE,OAAO,EAAE,uDAAuD;YAChE,YAAY,EAAE,CAAC;SAChB;QACD;YACE,mCAAmC;YACnC,OAAO,EAAE,0DAA0D;YACnE,YAAY,EAAE,CAAC;SAChB;QACD;YACE,gEAAgE;YAChE,OAAO,EACL,mFAAmF;YACrF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,6BAA6B;YAC7B,OAAO,EAAE,qCAAqC;YAC9C,YAAY,EAAE,CAAC;SAChB;QACD;YACE,mCAAmC;YACnC,OAAO,EAAE,wCAAwC;YACjD,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,gFAAgF;QAChF,+DAA+D;QAC/D,gCAAgC;QAChC,gCAAgC;QAChC,wEAAwE;QACxE,8BAA8B;QAC9B,0EAA0E;QAC1E,+BAA+B;QAC/B,mCAAmC;QACnC,kCAAkC;QAClC,WAAW;QACX,sDAAsD;IACxD,UAAU,EAAE;QACV,0DAA0D;QAC1D,iDAAiD;QACjD,kFAAkF;KACnF;IACD,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC;CACvD,CAAC"}

package/dist/rules/owasp-a02/weak-random.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const WeakRandom: Rule;
+//# sourceMappingURL=weak-random.d.ts.map

package/dist/rules/owasp-a02/weak-random.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-random.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a02/weak-random.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,UAAU,EAAE,IAyExB,CAAC"}

package/dist/rules/owasp-a02/weak-random.js

@@ -0,0 +1,70 @@
+// OWASP A02:2021 — Cryptographic Failures
+// Rule: Cryptographically weak random number generator used for security-sensitive context
+export const WeakRandom = {
+    id: 'OWASP-A02-003',
+    name: 'Cryptographically Weak Random Number Generator',
+    owasp: 'A02:2021',
+    cwe: 'CWE-338',
+    severity: 'HIGH',
+    languages: ['javascript', 'typescript', 'python', 'php', 'java', 'ruby'],
+    description: 'Math.random() (JS) and random.random() (Python) are NOT cryptographically secure — ' +
+        'their output is predictable. Using them to generate tokens, passwords, OTPs, CSRF tokens, ' +
+        'session IDs, or nonces creates guessable values that attackers can brute-force.',
+    patterns: [
+        {
+            // JS: Math.random() near token/password/secret/nonce context
+            pattern: /Math\s*\.\s*random\s*\(\s*\)/gi,
+            requiresContext: /(?:token|password|secret|nonce|salt|otp|csrf|session|id|key|pin|code|random|generate|uuid|hex|bytes)/i,
+            snippetLines: 3,
+        },
+        {
+            // Python: random.random() / random.randint() / random.choice()
+            pattern: /\brandom\s*\.\s*(?:random|randint|choice|randrange|shuffle|sample)\s*\(/gi,
+            requiresContext: /(?:token|password|secret|nonce|salt|otp|csrf|session|key|pin|code)/i,
+            suppressIf: /secrets\s*\.|os\.urandom/i,
+            snippetLines: 3,
+        },
+        {
+            // PHP: rand() / mt_rand()
+            pattern: /\b(?:rand|mt_rand)\s*\(/gi,
+            requiresContext: /(?:token|password|secret|nonce|salt|otp|csrf|session|key|pin|code)/i,
+            snippetLines: 3,
+        },
+        {
+            // Java: new Random() — not SecureRandom
+            pattern: /new\s+Random\s*\(\s*\)/g,
+            requiresContext: /(?:token|password|secret|nonce|salt|otp|csrf|session|key|pin|code)/i,
+            suppressIf: /SecureRandom/i,
+            snippetLines: 3,
+        },
+        {
+            // Ruby: rand() in security context
+            pattern: /\brand\s*\(/gi,
+            requiresContext: /(?:token|password|secret|nonce|salt|otp|csrf|session|key|pin|code)/i,
+            suppressIf: /SecureRandom/i,
+            snippetLines: 3,
+        },
+    ],
+    fix: 'Use a cryptographically secure random number generator (CSPRNG) for all security-sensitive values.\n\n' +
+        '// Node.js — generate a secure token:\n' +
+        'import crypto from "crypto";\n' +
+        'const token = crypto.randomBytes(32).toString("hex"); // 256-bit secure token\n' +
+        'const uuid = crypto.randomUUID(); // cryptographically secure UUID\n\n' +
+        '// Python:\n' +
+        'import secrets\n' +
+        'token = secrets.token_hex(32)  # 64-char hex token\n' +
+        'otp = secrets.randbelow(1000000)  # 6-digit OTP\n\n' +
+        '// PHP:\n' +
+        '$token = bin2hex(random_bytes(32)); // uses CSPRNG\n\n' +
+        '// Java:\n' +
+        'SecureRandom sr = new SecureRandom();\n' +
+        'byte[] token = new byte[32];\n' +
+        'sr.nextBytes(token);',
+    references: [
+        'https://owasp.org/Top10/A02_2021-Cryptographic_Failures/',
+        'https://cwe.mitre.org/data/definitions/338.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html',
+    ],
+    tags: ['crypto', 'random', 'token-generation', 'prng'],
+};
+//# sourceMappingURL=weak-random.js.map

package/dist/rules/owasp-a02/weak-random.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-random.js","sourceRoot":"","sources":["../../../src/rules/owasp-a02/weak-random.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,2FAA2F;AAI3F,MAAM,CAAC,MAAM,UAAU,GAAS;IAC9B,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,gDAAgD;IACtD,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;IACxE,WAAW,EACT,qFAAqF;QACrF,4FAA4F;QAC5F,iFAAiF;IACnF,QAAQ,EAAE;QACR;YACE,6DAA6D;YAC7D,OAAO,EAAE,gCAAgC;YACzC,eAAe,EACb,uGAAuG;YACzG,YAAY,EAAE,CAAC;SAChB;QACD;YACE,+DAA+D;YAC/D,OAAO,EAAE,2EAA2E;YACpF,eAAe,EACb,qEAAqE;YACvE,UAAU,EAAE,2BAA2B;YACvC,YAAY,EAAE,CAAC;SAChB;QACD;YACE,0BAA0B;YAC1B,OAAO,EAAE,2BAA2B;YACpC,eAAe,EACb,qEAAqE;YACvE,YAAY,EAAE,CAAC;SAChB;QACD;YACE,wCAAwC;YACxC,OAAO,EAAE,yBAAyB;YAClC,eAAe,EACb,qEAAqE;YACvE,UAAU,EAAE,eAAe;YAC3B,YAAY,EAAE,CAAC;SAChB;QACD;YACE,mCAAmC;YACnC,OAAO,EAAE,eAAe;YACxB,eAAe,EACb,qEAAqE;YACvE,UAAU,EAAE,eAAe;YAC3B,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,wGAAwG;QACxG,yCAAyC;QACzC,gCAAgC;QAChC,iFAAiF;QACjF,wEAAwE;QACxE,cAAc;QACd,kBAAkB;QAClB,sDAAsD;QACtD,qDAAqD;QACrD,WAAW;QACX,wDAAwD;QACxD,YAAY;QACZ,yCAAyC;QACzC,gCAAgC;QAChC,sBAAsB;IACxB,UAAU,EAAE;QACV,0DAA0D;QAC1D,iDAAiD;QACjD,uFAAuF;KACxF;IACD,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,CAAC;CACvD,CAAC"}

package/dist/rules/owasp-a03/command-injection.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const CommandInjection: Rule;
+//# sourceMappingURL=command-injection.d.ts.map

package/dist/rules/owasp-a03/command-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-injection.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a03/command-injection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,gBAAgB,EAAE,IAsF9B,CAAC"}

package/dist/rules/owasp-a03/command-injection.js

@@ -0,0 +1,79 @@
+// OWASP A03:2021 — Injection
+// Rule: OS Command Injection via user-controlled input
+export const CommandInjection = {
+    id: 'OWASP-A03-002',
+    name: 'OS Command Injection via User-Controlled Input',
+    owasp: 'A03:2021',
+    cwe: 'CWE-78',
+    severity: 'CRITICAL',
+    languages: ['javascript', 'typescript', 'python', 'php', 'ruby', 'go', 'java'],
+    description: 'Shell commands constructed using unsanitized user input allow attackers to execute ' +
+        'arbitrary system commands. A single semicolon or pipe character can break out of the ' +
+        'intended command. AI tools often reach for exec() when a safer API exists.',
+    patterns: [
+        {
+            // Node.js: exec/execSync with user input via string concat
+            pattern: /(?:exec|execSync)\s*\(\s*(?:['"`][^'"`]*['"`]\s*\+|`[^`]*\$\{[^}]*(?:req\.|request\.|params\.|query\.|body\.))/gi,
+            snippetLines: 3,
+        },
+        {
+            // Node.js: exec/execSync with req.* directly
+            pattern: /(?:exec|execSync)\s*\([^)]*(?:req\.|request\.)(?:body|params|query|headers)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Node.js: child_process.exec/spawn with user input
+            pattern: /child_process\s*\.\s*(?:exec|execSync|spawn|spawnSync)\s*\([^)]*(?:req\.|request\.)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python: os.system / os.popen with user input or f-string interpolation
+            pattern: /os\s*\.\s*(?:system|popen|execv?p?e?)\s*\(\s*(?:f['"`]|['"`][^'"`]*['"`]\s*%|(?:request\.|req\.)(?:args|form|json|data|params))/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python: subprocess.call/run/Popen with shell=True + user input
+            pattern: /subprocess\s*\.\s*(?:call|run|Popen|check_output|check_call)\s*\([^)]*(?:request\.|req\.)(?:args|form|json|data)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python: subprocess with shell=True (always risky with dynamic args)
+            pattern: /subprocess\s*\.\s*(?:call|run|Popen)\s*\([^)]*shell\s*=\s*True[^)]*(?:request\.|req\.)/gi,
+            snippetLines: 3,
+        },
+        {
+            // PHP: exec/system/shell_exec/passthru with $_GET/$_POST
+            pattern: /(?:\bexec\b|system|shell_exec|passthru|popen)\s*\([^)]*\$_(?:GET|POST|REQUEST|SERVER)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Ruby: backtick execution / system with user input
+            pattern: /(?:system|exec|IO\.popen|Open3\.popen)\s*\([^)]*(?:params|request\.)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Go: exec.Command with user-provided args directly
+            pattern: /exec\s*\.\s*Command\s*\([^)]*(?:r\.(?:URL\.Query|FormValue|PostForm)|req\.)/gi,
+            snippetLines: 3,
+        },
+    ],
+    fix: 'Avoid shell commands when possible. Use language-native APIs.\n' +
+        'If shell is necessary, use argument arrays (never strings) and whitelist inputs.\n\n' +
+        '// Node.js — BAD:\n' +
+        'exec(`convert ${req.body.file} output.pdf`);\n\n' +
+        '// Node.js — GOOD (use spawn with arg array, no shell):\n' +
+        'import { spawn } from "child_process";\n' +
+        'const safe = spawn("convert", [req.body.file, "output.pdf"], { shell: false });\n\n' +
+        '// Python — GOOD (list of args, shell=False):\n' +
+        'import subprocess\n' +
+        'subprocess.run(["convert", user_file, "output.pdf"], shell=False, check=True)\n\n' +
+        '// Validate and whitelist input before use:\n' +
+        'if (!/^[a-zA-Z0-9._-]+$/.test(filename)) throw new Error("Invalid filename");',
+    references: [
+        'https://owasp.org/Top10/A03_2021-Injection/',
+        'https://cwe.mitre.org/data/definitions/78.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html',
+    ],
+    tags: ['injection', 'command-injection', 'rce', 'shell', 'os'],
+};
+//# sourceMappingURL=command-injection.js.map

package/dist/rules/owasp-a03/command-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-injection.js","sourceRoot":"","sources":["../../../src/rules/owasp-a03/command-injection.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,uDAAuD;AAIvD,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,gDAAgD;IACtD,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,QAAQ;IACb,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;IAC9E,WAAW,EACT,qFAAqF;QACrF,uFAAuF;QACvF,4EAA4E;IAC9E,QAAQ,EAAE;QACR;YACE,2DAA2D;YAC3D,OAAO,EACL,kHAAkH;YACpH,YAAY,EAAE,CAAC;SAChB;QACD;YACE,6CAA6C;YAC7C,OAAO,EACL,+EAA+E;YACjF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,oDAAoD;YACpD,OAAO,EACL,uFAAuF;YACzF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,yEAAyE;YACzE,OAAO,EACL,mIAAmI;YACrI,YAAY,EAAE,CAAC;SAChB;QACD;YACE,iEAAiE;YACjE,OAAO,EACL,oHAAoH;YACtH,YAAY,EAAE,CAAC;SAChB;QACD;YACE,sEAAsE;YACtE,OAAO,EACL,0FAA0F;YAC5F,YAAY,EAAE,CAAC;SAChB;QACD;YACE,yDAAyD;YACzD,OAAO,EACL,yFAAyF;YAC3F,YAAY,EAAE,CAAC;SAChB;QACD;YACE,oDAAoD;YACpD,OAAO,EACL,wEAAwE;YAC1E,YAAY,EAAE,CAAC;SAChB;QACD;YACE,oDAAoD;YACpD,OAAO,EACL,+EAA+E;YACjF,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,iEAAiE;QACjE,sFAAsF;QACtF,qBAAqB;QACrB,kDAAkD;QAClD,2DAA2D;QAC3D,0CAA0C;QAC1C,qFAAqF;QACrF,iDAAiD;QACjD,qBAAqB;QACrB,mFAAmF;QACnF,+CAA+C;QAC/C,+EAA+E;IACjF,UAAU,EAAE;QACV,6CAA6C;QAC7C,gDAAgD;QAChD,8FAA8F;KAC/F;IACD,IAAI,EAAE,CAAC,WAAW,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;CAC/D,CAAC"}

package/dist/rules/owasp-a03/ldap-injection.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const LdapInjection: Rule;
+//# sourceMappingURL=ldap-injection.d.ts.map

package/dist/rules/owasp-a03/ldap-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ldap-injection.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a03/ldap-injection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,IA0D3B,CAAC"}

package/dist/rules/owasp-a03/ldap-injection.js

@@ -0,0 +1,56 @@
+// OWASP A03:2021 — Injection
+// Rule: LDAP Injection via unsanitized user input
+export const LdapInjection = {
+    id: 'OWASP-A03-006',
+    name: 'LDAP Injection via Unsanitized User Input',
+    owasp: 'A03:2021',
+    cwe: 'CWE-90',
+    severity: 'HIGH',
+    languages: ['javascript', 'typescript', 'python', 'java', 'php'],
+    description: 'LDAP queries constructed with unescaped user input allow attackers to manipulate ' +
+        'directory queries, bypass authentication, or enumerate LDAP directory information. ' +
+        'Special characters like *, (, ), \\, NUL have meaning in LDAP filter syntax.',
+    patterns: [
+        {
+            // Node.js ldapjs: search/bind with user input in filter string
+            pattern: /(?:ldap|client)\s*\.\s*(?:search|bind|compare|modify|add|del)\s*\([^)]*(?:req\.|request\.)(?:body|params|query)/gi,
+            snippetLines: 3,
+        },
+        {
+            // LDAP filter string with user input concatenation
+            pattern: /['"`]\s*(?:\(&|\(\||\(!)?\s*\(\s*\w+\s*=\s*['"`]\s*\+\s*(?:req\.|request\.)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python python-ldap: search_s with user input
+            pattern: /(?:conn|ldap_conn|lc)\s*\.\s*search_s\s*\([^)]*(?:request\.|req\.)(?:args|form|json|data)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Java: NamingEnumeration with DirContext.search() + user input
+            pattern: /ctx\s*\.\s*search\s*\([^)]*\+\s*(?:request\.|req\.|username|input|filter)/gi,
+            snippetLines: 3,
+        },
+    ],
+    fix: 'Escape all special LDAP characters in user input before using in filters.\n\n' +
+        '// Node.js — use ldapjs escaping:\n' +
+        'import { Client } from "ldapts";\n' +
+        '// Whitelist: only allow alphanumeric usernames\n' +
+        'if (!/^[a-zA-Z0-9@._-]{1,64}$/.test(username)) {\n' +
+        '  throw new Error("Invalid username format");\n' +
+        '}\n' +
+        'const result = await client.search(baseDN, {\n' +
+        '  filter: `(uid=${username})`, // now safe after whitelist validation\n' +
+        '});\n\n' +
+        '// Python — use ldap3 with proper escaping:\n' +
+        'from ldap3.utils.conv import escape_filter_chars\n' +
+        'safe_user = escape_filter_chars(username)\n' +
+        'conn.search(base_dn, f"(uid={safe_user})")',
+    references: [
+        'https://owasp.org/Top10/A03_2021-Injection/',
+        'https://cwe.mitre.org/data/definitions/90.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html',
+    ],
+    tags: ['injection', 'ldap', 'directory'],
+};
+//# sourceMappingURL=ldap-injection.js.map

package/dist/rules/owasp-a03/ldap-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ldap-injection.js","sourceRoot":"","sources":["../../../src/rules/owasp-a03/ldap-injection.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kDAAkD;AAIlD,MAAM,CAAC,MAAM,aAAa,GAAS;IACjC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,2CAA2C;IACjD,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,QAAQ;IACb,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC;IAChE,WAAW,EACT,mFAAmF;QACnF,qFAAqF;QACrF,8EAA8E;IAChF,QAAQ,EAAE;QACR;YACE,+DAA+D;YAC/D,OAAO,EACL,mHAAmH;YACrH,YAAY,EAAE,CAAC;SAChB;QACD;YACE,mDAAmD;YACnD,OAAO,EACL,+EAA+E;YACjF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,+CAA+C;YAC/C,OAAO,EACL,6FAA6F;YAC/F,YAAY,EAAE,CAAC;SAChB;QACD;YACE,gEAAgE;YAChE,OAAO,EACL,6EAA6E;YAC/E,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,+EAA+E;QAC/E,qCAAqC;QACrC,oCAAoC;QACpC,mDAAmD;QACnD,oDAAoD;QACpD,iDAAiD;QACjD,KAAK;QACL,gDAAgD;QAChD,yEAAyE;QACzE,SAAS;QACT,+CAA+C;QAC/C,oDAAoD;QACpD,6CAA6C;QAC7C,4CAA4C;IAC9C,UAAU,EAAE;QACV,6CAA6C;QAC7C,gDAAgD;QAChD,2FAA2F;KAC5F;IACD,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC;CACzC,CAAC"}

package/dist/rules/owasp-a03/nosql-injection.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const NoSqlInjection: Rule;
+//# sourceMappingURL=nosql-injection.d.ts.map

package/dist/rules/owasp-a03/nosql-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nosql-injection.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a03/nosql-injection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,cAAc,EAAE,IA8D5B,CAAC"}

package/dist/rules/owasp-a03/nosql-injection.js

@@ -0,0 +1,61 @@
+// OWASP A03:2021 — Injection
+// Rule: NoSQL Injection (MongoDB operator injection)
+export const NoSqlInjection = {
+    id: 'OWASP-A03-003',
+    name: 'NoSQL Injection via Unsanitized Query Operator',
+    owasp: 'A03:2021',
+    cwe: 'CWE-943',
+    severity: 'CRITICAL',
+    languages: ['javascript', 'typescript', 'python'],
+    description: 'MongoDB and other NoSQL databases support special query operators ($where, $gt, $ne, $regex). ' +
+        'When user input is passed directly as a query object, attackers can inject operators to bypass ' +
+        'authentication or exfiltrate data. A classic example: { password: { $ne: null } } bypasses login.',
+    patterns: [
+        {
+            // Mongoose/MongoDB: find/findOne with req.body spread or direct assignment
+            pattern: /(?:find|findOne|findMany|findById|updateOne|updateMany|deleteOne|deleteMany)\s*\(\s*(?:req\.body|request\.body|req\.query|request\.query)\s*(?:\)|,)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Spreading req.body into a Mongoose query
+            pattern: /(?:find|findOne|findMany)\s*\(\s*\{\s*\.\.\.\s*(?:req\.body|request\.body)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python PyMongo: collection.find(request.json)
+            pattern: /collection\s*\.\s*(?:find|find_one|update_one|update_many|delete_one|delete_many|count_documents)\s*\(\s*(?:request\.json|request\.get_json|data|body)\s*(?:\)|,)/gi,
+            snippetLines: 3,
+        },
+        {
+            // $where operator usage (always dangerous — executes JS server-side)
+            pattern: /['"`]\$where['"`]\s*:/gi,
+            snippetLines: 3,
+        },
+        {
+            // mapReduce — can execute arbitrary JS server-side
+            pattern: /\.\s*mapReduce\s*\(/gi,
+            requiresContext: /(?:req\.|request\.|input|user|body|query)/i,
+            snippetLines: 3,
+        },
+    ],
+    fix: 'Never pass raw request body/query objects to MongoDB queries.\n' +
+        'Explicitly extract and validate each field.\n\n' +
+        '// BAD — susceptible to operator injection:\n' +
+        'const user = await User.findOne(req.body); // body could be { "$ne": null }\n\n' +
+        '// GOOD — explicit field extraction:\n' +
+        'const { username, password } = req.body;\n' +
+        'if (typeof username !== "string" || typeof password !== "string") {\n' +
+        '  return res.status(400).json({ error: "Invalid input" });\n' +
+        '}\n' +
+        'const user = await User.findOne({ username }); // exact match\n\n' +
+        '// Additional protection: use mongoose-sanitize or express-mongo-sanitize:\n' +
+        'import mongoSanitize from "express-mongo-sanitize";\n' +
+        'app.use(mongoSanitize()); // strips $ and . from keys',
+    references: [
+        'https://owasp.org/Top10/A03_2021-Injection/',
+        'https://cwe.mitre.org/data/definitions/943.html',
+        'https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection',
+    ],
+    tags: ['injection', 'nosql', 'mongodb', 'database'],
+};
+//# sourceMappingURL=nosql-injection.js.map

package/dist/rules/owasp-a03/nosql-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nosql-injection.js","sourceRoot":"","sources":["../../../src/rules/owasp-a03/nosql-injection.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,qDAAqD;AAIrD,MAAM,CAAC,MAAM,cAAc,GAAS;IAClC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,gDAAgD;IACtD,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC;IACjD,WAAW,EACT,gGAAgG;QAChG,iGAAiG;QACjG,mGAAmG;IACrG,QAAQ,EAAE;QACR;YACE,2EAA2E;YAC3E,OAAO,EACL,wJAAwJ;YAC1J,YAAY,EAAE,CAAC;SAChB;QACD;YACE,2CAA2C;YAC3C,OAAO,EACL,8EAA8E;YAChF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,gDAAgD;YAChD,OAAO,EACL,qKAAqK;YACvK,YAAY,EAAE,CAAC;SAChB;QACD;YACE,qEAAqE;YACrE,OAAO,EAAE,yBAAyB;YAClC,YAAY,EAAE,CAAC;SAChB;QACD;YACE,mDAAmD;YACnD,OAAO,EAAE,uBAAuB;YAChC,eAAe,EAAE,4CAA4C;YAC7D,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,iEAAiE;QACjE,iDAAiD;QACjD,+CAA+C;QAC/C,iFAAiF;QACjF,wCAAwC;QACxC,4CAA4C;QAC5C,uEAAuE;QACvE,8DAA8D;QAC9D,KAAK;QACL,mEAAmE;QACnE,8EAA8E;QAC9E,uDAAuD;QACvD,uDAAuD;IACzD,UAAU,EAAE;QACV,6CAA6C;QAC7C,iDAAiD;QACjD,iKAAiK;KAClK;IACD,IAAI,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC;CACpD,CAAC"}

package/dist/rules/owasp-a03/sql-injection.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const SqlInjection: Rule;
+//# sourceMappingURL=sql-injection.d.ts.map

package/dist/rules/owasp-a03/sql-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a03/sql-injection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,YAAY,EAAE,IA+F1B,CAAC"}