@trust-assurance-protocol/owaspscan 1.0.0

package/dist/rules/owasp-a05/default-credentials.js

@@ -0,0 +1,52 @@
+// OWASP A05:2021 — Security Misconfiguration
+// Rule: Default or empty credentials in configuration
+export const DefaultCredentials = {
+    id: 'OWASP-A05-004',
+    name: 'Default or Empty Credentials in Configuration',
+    owasp: 'A05:2021',
+    cwe: 'CWE-1392',
+    severity: 'CRITICAL',
+    languages: ['all'],
+    description: 'Default, empty, or well-known credentials (admin/admin, root/root, postgres/postgres) ' +
+        'hardcoded in database connections, admin panels, or service configurations. ' +
+        'Attackers actively scan for default credentials on exposed services.',
+    patterns: [
+        {
+            // Database URLs with common default credentials
+            pattern: /(?:mongodb|postgres|postgresql|mysql|redis|mariadb):\/\/(?:root|admin|postgres|sa|user|test|guest|default)(?::(?:root|admin|password|123456|password123|admin123|test|guest|''|""))?@/gi,
+            suppressIf: /(?:process\.env|os\.environ|getenv|\$\{|%\()/i,
+            snippetLines: 1,
+        },
+        {
+            // Explicit default password assignments
+            pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"`](?:admin|password|123456|root|test|guest|default|changeme|letmein|qwerty|abc123|welcome|monkey|password123)['"`]/gi,
+            snippetLines: 1,
+        },
+        {
+            // Empty password
+            pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"`]{2}/g,
+            requiresContext: /(?:db|database|mongo|postgres|mysql|redis|connect|auth|login)/i,
+            snippetLines: 3,
+        },
+        {
+            // JWT secret set to weak value
+            pattern: /(?:jwt[_-]?secret|secret[_-]?key|signing[_-]?secret)\s*[:=]\s*['"`](?:secret|mysecret|jwt_secret|your[_-]?secret|changeme|development|test|123456|password)[a-z0-9_]*['"`]/gi,
+            snippetLines: 1,
+        },
+    ],
+    fix: 'Never use default, empty, or weak credentials. Generate strong random values for secrets.\n\n' +
+        '// BAD:\n' +
+        'const client = new MongoClient("mongodb://admin:password@localhost:27017");\n\n' +
+        '// GOOD:\n' +
+        'const client = new MongoClient(process.env.MONGODB_URI!);\n\n' +
+        '// Generate a strong JWT secret (run once, store in secrets manager):\n' +
+        '// node -e "console.log(require(\'crypto\').randomBytes(64).toString(\'hex\'))"\n\n' +
+        '// Store in .env (never commit to git):\n' +
+        'JWT_SECRET=<generated-64-byte-hex-value>',
+    references: [
+        'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/',
+        'https://cwe.mitre.org/data/definitions/1392.html',
+    ],
+    tags: ['misconfiguration', 'default-credentials', 'credentials', 'secrets'],
+};
+//# sourceMappingURL=default-credentials.js.map

package/dist/rules/owasp-a05/default-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-credentials.js","sourceRoot":"","sources":["../../../src/rules/owasp-a05/default-credentials.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,sDAAsD;AAItD,MAAM,CAAC,MAAM,kBAAkB,GAAS;IACtC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,+CAA+C;IACrD,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,UAAU;IACf,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,CAAC,KAAK,CAAC;IAClB,WAAW,EACT,wFAAwF;QACxF,8EAA8E;QAC9E,sEAAsE;IACxE,QAAQ,EAAE;QACR;YACE,gDAAgD;YAChD,OAAO,EACL,yLAAyL;YAC3L,UAAU,EAAE,+CAA+C;YAC3D,YAAY,EAAE,CAAC;SAChB;QACD;YACE,wCAAwC;YACxC,OAAO,EACL,0JAA0J;YAC5J,YAAY,EAAE,CAAC;SAChB;QACD;YACE,iBAAiB;YACjB,OAAO,EACL,4CAA4C;YAC9C,eAAe,EAAE,gEAAgE;YACjF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,+BAA+B;YAC/B,OAAO,EACL,8KAA8K;YAChL,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,+FAA+F;QAC/F,WAAW;QACX,iFAAiF;QACjF,YAAY;QACZ,+DAA+D;QAC/D,yEAAyE;QACzE,qFAAqF;QACrF,2CAA2C;QAC3C,0CAA0C;IAC5C,UAAU,EAAE;QACV,6DAA6D;QAC7D,kDAAkD;KACnD;IACD,IAAI,EAAE,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,aAAa,EAAE,SAAS,CAAC;CAC5E,CAAC"}

package/dist/rules/owasp-a05/error-disclosure.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const ErrorDisclosure: Rule;
+//# sourceMappingURL=error-disclosure.d.ts.map

package/dist/rules/owasp-a05/error-disclosure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-disclosure.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a05/error-disclosure.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,eAAe,EAAE,IAyE7B,CAAC"}

package/dist/rules/owasp-a05/error-disclosure.js

@@ -0,0 +1,70 @@
+// OWASP A05:2021 — Security Misconfiguration
+// Rule: Verbose error messages exposing internal details to clients
+export const ErrorDisclosure = {
+    id: 'OWASP-A05-003',
+    name: 'Sensitive Information in Error Responses',
+    owasp: 'A05:2021',
+    cwe: 'CWE-209',
+    severity: 'MEDIUM',
+    languages: ['javascript', 'typescript', 'python', 'php', 'java', 'ruby'],
+    description: 'Error handlers sending stack traces, internal paths, database errors, or system details ' +
+        'to HTTP clients. This gives attackers a blueprint of your application stack — framework ' +
+        'versions, file paths, database schema. AI error handlers routinely send err.message or err.stack.',
+    patterns: [
+        {
+            // res.json / res.send with error.stack
+            pattern: /res\s*\.\s*(?:send|json|status\s*\([^)]+\)\s*\.\s*(?:send|json))\s*\([^)]*(?:err|error|e)\s*\.\s*stack/gi,
+            snippetLines: 3,
+        },
+        {
+            // res.json with full error object (may include stack)
+            pattern: /res\s*\.\s*(?:send|json)\s*\(\s*\{\s*(?:error|err|message|details)\s*:\s*(?:err|error|e)\s*\}/gi,
+            snippetLines: 3,
+        },
+        {
+            // PHP: print_r($e) or var_dump($e) to output
+            pattern: /(?:print_r|var_dump)\s*\(\s*\$(?:e|err|error|exception)\s*\)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python: traceback.print_exc() or traceback.format_exc() sent to response
+            pattern: /(?:traceback\.print_exc|traceback\.format_exc)\s*\(/gi,
+            requiresContext: /(?:return|response|render|jsonify|make_response)/i,
+            snippetLines: 5,
+        },
+        {
+            // Java: e.printStackTrace() — prints to stdout/response
+            pattern: /(?:e|ex|err|error|exception)\s*\.\s*printStackTrace\s*\(\s*\)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Generic: sending exception message to client in JSON
+            pattern: /(?:message|error|detail)\s*:\s*(?:err|error|e|exception)\s*\.\s*message/gi,
+            requiresContext: /(?:res\.|response\.|return.*json|render.*json|send\()/i,
+            snippetLines: 5,
+        },
+    ],
+    fix: 'Log errors server-side and return generic error messages to clients.\n\n' +
+        '// Express centralized error handler:\n' +
+        'app.use((err: Error, req: Request, res: Response, next: NextFunction) => {\n' +
+        '  // Log full error internally (with request context)\n' +
+        '  logger.error({ err, path: req.path, method: req.method }, "Request error");\n\n' +
+        '  // Return generic message to client — no internals\n' +
+        '  res.status(500).json({\n' +
+        '    error: "An unexpected error occurred.",\n' +
+        '    requestId: req.id, // correlate with server logs\n' +
+        '  });\n' +
+        '});\n\n' +
+        '// Python/FastAPI:\n' +
+        '@app.exception_handler(Exception)\n' +
+        'async def generic_exception_handler(request, exc):\n' +
+        '    logger.exception("Unhandled error")\n' +
+        '    return JSONResponse(status_code=500, content={"error": "Internal server error"})',
+    references: [
+        'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/',
+        'https://cwe.mitre.org/data/definitions/209.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Sheet.html',
+    ],
+    tags: ['error-disclosure', 'information-disclosure', 'misconfiguration', 'stack-trace'],
+};
+//# sourceMappingURL=error-disclosure.js.map

package/dist/rules/owasp-a05/error-disclosure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-disclosure.js","sourceRoot":"","sources":["../../../src/rules/owasp-a05/error-disclosure.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,oEAAoE;AAIpE,MAAM,CAAC,MAAM,eAAe,GAAS;IACnC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,0CAA0C;IAChD,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;IACxE,WAAW,EACT,0FAA0F;QAC1F,0FAA0F;QAC1F,mGAAmG;IACrG,QAAQ,EAAE;QACR;YACE,uCAAuC;YACvC,OAAO,EACL,0GAA0G;YAC5G,YAAY,EAAE,CAAC;SAChB;QACD;YACE,sDAAsD;YACtD,OAAO,EACL,iGAAiG;YACnG,YAAY,EAAE,CAAC;SAChB;QACD;YACE,6CAA6C;YAC7C,OAAO,EACL,gEAAgE;YAClE,YAAY,EAAE,CAAC;SAChB;QACD;YACE,2EAA2E;YAC3E,OAAO,EACL,uDAAuD;YACzD,eAAe,EAAE,mDAAmD;YACpE,YAAY,EAAE,CAAC;SAChB;QACD;YACE,wDAAwD;YACxD,OAAO,EAAE,iEAAiE;YAC1E,YAAY,EAAE,CAAC;SAChB;QACD;YACE,uDAAuD;YACvD,OAAO,EACL,2EAA2E;YAC7E,eAAe,EAAE,wDAAwD;YACzE,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,0EAA0E;QAC1E,yCAAyC;QACzC,8EAA8E;QAC9E,yDAAyD;QACzD,mFAAmF;QACnF,wDAAwD;QACxD,4BAA4B;QAC5B,+CAA+C;QAC/C,wDAAwD;QACxD,SAAS;QACT,SAAS;QACT,sBAAsB;QACtB,qCAAqC;QACrC,sDAAsD;QACtD,2CAA2C;QAC3C,sFAAsF;IACxF,UAAU,EAAE;QACV,6DAA6D;QAC7D,iDAAiD;QACjD,gFAAgF;KACjF;IACD,IAAI,EAAE,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,aAAa,CAAC;CACxF,CAAC"}

package/dist/rules/owasp-a06/outdated-packages.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const OutdatedPackages: Rule;
+//# sourceMappingURL=outdated-packages.d.ts.map

package/dist/rules/owasp-a06/outdated-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outdated-packages.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a06/outdated-packages.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,gBAAgB,EAAE,IA0E9B,CAAC"}

package/dist/rules/owasp-a06/outdated-packages.js

@@ -0,0 +1,75 @@
+// OWASP A06:2021 — Vulnerable and Outdated Components
+// Rule: Detects use of packages known to have severe vulnerabilities in common versions
+export const OutdatedPackages = {
+    id: 'OWASP-A06-001',
+    name: 'Known Vulnerable Package or Deprecated API Usage',
+    owasp: 'A06:2021',
+    cwe: 'CWE-1104',
+    severity: 'HIGH',
+    languages: ['javascript', 'typescript', 'python'],
+    description: 'Usage of packages with well-known critical CVEs, or deprecated APIs that have ' +
+        'been superseded by secure alternatives. AI tools often suggest packages they were ' +
+        'trained on regardless of their current CVE status.',
+    patterns: [
+        {
+            // Node.js: require('eval') or similar dangerous packages
+            pattern: /(?:require|import)\s*\(\s*['"`]eval['"`]\s*\)/gi,
+            snippetLines: 1,
+        },
+        {
+            // node-serialize (RCE CVE-2017-5941)
+            pattern: /(?:require|import)\s*\(\s*['"`]node-serialize['"`]\s*\)/gi,
+            snippetLines: 1,
+        },
+        {
+            // js-yaml < 4 safeLoad was removed; yaml.load() without schema is dangerous
+            pattern: /yaml\s*\.\s*load\s*\(/gi,
+            suppressIf: /(?:yaml\.load\s*\([^,)]+,\s*\{[^}]*schema\s*:|yaml\.safeLoad|js-yaml.*4\.|FAILSAFE_SCHEMA|JSON_SCHEMA|DEFAULT_SAFE_SCHEMA)/i,
+            snippetLines: 3,
+        },
+        {
+            // Python pickle: deserialization of untrusted data
+            pattern: /pickle\s*\.\s*(?:loads|load)\s*\(/gi,
+            requiresContext: /(?:request\.|req\.|socket\.|recv\.|read\(|body|data|input)/i,
+            snippetLines: 3,
+        },
+        {
+            // Python PyYAML: yaml.load without Loader — executes arbitrary Python
+            pattern: /yaml\s*\.\s*load\s*\(\s*(?!.*Loader\s*=\s*yaml\.(?:Safe|Base|Full)?Loader)/gi,
+            snippetLines: 3,
+        },
+        {
+            // xmlrpc in Python — known security issues with untrusted servers
+            pattern: /import\s+xmlrpc/gi,
+            requiresContext: /(?:request\.|external|untrusted|user)/i,
+            snippetLines: 3,
+        },
+        {
+            // lodash < 4.17.21 prototype pollution: _.merge/_.set with user input
+            pattern: /_\s*\.\s*(?:merge|set|setWith|zipObjectDeep)\s*\([^)]*(?:req\.|request\.)(?:body|params|query)/gi,
+            snippetLines: 3,
+        },
+    ],
+    fix: 'Run dependency audits regularly and update vulnerable packages.\n\n' +
+        '# Audit commands:\n' +
+        'npm audit                    # Node.js\n' +
+        'npm audit fix                # Auto-fix where possible\n' +
+        'pip install pip-audit && pip-audit  # Python\n' +
+        'bundle audit                 # Ruby\n\n' +
+        '# CI integration — fail on high/critical:\n' +
+        'npm audit --audit-level=high\n\n' +
+        '# YAML (Python) — always specify safe Loader:\n' +
+        'yaml.safe_load(stream)  # instead of yaml.load()\n' +
+        '# or:\n' +
+        'yaml.load(stream, Loader=yaml.SafeLoader)\n\n' +
+        '# js-yaml (Node) — use safeLoad or load with schema:\n' +
+        'import YAML from "js-yaml";\n' +
+        'const data = YAML.load(input, { schema: YAML.FAILSAFE_SCHEMA });',
+    references: [
+        'https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/',
+        'https://cwe.mitre.org/data/definitions/1104.html',
+        'https://nvd.nist.gov/vuln/search',
+    ],
+    tags: ['dependencies', 'vulnerable-components', 'supply-chain', 'cve'],
+};
+//# sourceMappingURL=outdated-packages.js.map

package/dist/rules/owasp-a06/outdated-packages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outdated-packages.js","sourceRoot":"","sources":["../../../src/rules/owasp-a06/outdated-packages.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,wFAAwF;AAIxF,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,kDAAkD;IACxD,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,UAAU;IACf,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC;IACjD,WAAW,EACT,gFAAgF;QAChF,oFAAoF;QACpF,oDAAoD;IACtD,QAAQ,EAAE;QACR;YACE,yDAAyD;YACzD,OAAO,EAAE,iDAAiD;YAC1D,YAAY,EAAE,CAAC;SAChB;QACD;YACE,qCAAqC;YACrC,OAAO,EAAE,2DAA2D;YACpE,YAAY,EAAE,CAAC;SAChB;QACD;YACE,4EAA4E;YAC5E,OAAO,EAAE,yBAAyB;YAClC,UAAU,EAAE,6HAA6H;YACzI,YAAY,EAAE,CAAC;SAChB;QACD;YACE,mDAAmD;YACnD,OAAO,EAAE,qCAAqC;YAC9C,eAAe,EAAE,6DAA6D;YAC9E,YAAY,EAAE,CAAC;SAChB;QACD;YACE,sEAAsE;YACtE,OAAO,EAAE,8EAA8E;YACvF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,kEAAkE;YAClE,OAAO,EAAE,mBAAmB;YAC5B,eAAe,EAAE,wCAAwC;YACzD,YAAY,EAAE,CAAC;SAChB;QACD;YACE,sEAAsE;YACtE,OAAO,EACL,kGAAkG;YACpG,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,qEAAqE;QACrE,qBAAqB;QACrB,0CAA0C;QAC1C,0DAA0D;QAC1D,gDAAgD;QAChD,yCAAyC;QACzC,6CAA6C;QAC7C,kCAAkC;QAClC,iDAAiD;QACjD,oDAAoD;QACpD,SAAS;QACT,+CAA+C;QAC/C,wDAAwD;QACxD,+BAA+B;QAC/B,kEAAkE;IACpE,UAAU,EAAE;QACV,sEAAsE;QACtE,kDAAkD;QAClD,kCAAkC;KACnC;IACD,IAAI,EAAE,CAAC,cAAc,EAAE,uBAAuB,EAAE,cAAc,EAAE,KAAK,CAAC;CACvE,CAAC"}

package/dist/rules/owasp-a07/insecure-cookies.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const InsecureCookies: Rule;
+//# sourceMappingURL=insecure-cookies.d.ts.map

package/dist/rules/owasp-a07/insecure-cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-cookies.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a07/insecure-cookies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,eAAe,EAAE,IAiE7B,CAAC"}

package/dist/rules/owasp-a07/insecure-cookies.js

@@ -0,0 +1,64 @@
+// OWASP A07:2021 — Identification and Authentication Failures
+// Rule: Cookies set without HttpOnly, Secure, or SameSite flags
+export const InsecureCookies = {
+    id: 'OWASP-A07-004',
+    name: 'Insecure Cookie Attributes (Missing HttpOnly/Secure/SameSite)',
+    owasp: 'A07:2021',
+    cwe: 'CWE-614',
+    severity: 'MEDIUM',
+    languages: ['javascript', 'typescript', 'python', 'php', 'ruby'],
+    description: 'Session cookies or authentication cookies set without HttpOnly (accessible to JS), ' +
+        'Secure (sent over HTTP), or SameSite (CSRF vulnerable) flags. ' +
+        'AI tools routinely generate res.cookie("token", value) without security attributes.',
+    patterns: [
+        {
+            // Express: res.cookie without httpOnly
+            pattern: /res\s*\.\s*cookie\s*\(\s*['"`][^'"`]+['"`]\s*,\s*[^,)]+\s*(?:,\s*\{\s*(?![^}]*httpOnly\s*:\s*true)[^}]*\}|)\s*\)/gi,
+            suppressIf: /(?:httpOnly\s*:\s*true|secure\s*:\s*true)/i,
+            snippetLines: 3,
+        },
+        {
+            // PHP: setcookie without secure/httponly flags
+            pattern: /setcookie\s*\(\s*[^,]+,\s*[^,]+,\s*[^,)]+\s*\)/gi,
+            suppressIf: /(?:true\s*,\s*true|httponly|samesite)/i,
+            snippetLines: 3,
+        },
+        {
+            // Python: set_cookie without httponly/secure
+            pattern: /(?:response|resp)\s*\.\s*set_cookie\s*\([^)]*(?!httponly\s*=\s*True|secure\s*=\s*True)[^)]*\)/gi,
+            suppressIf: /(?:httponly\s*=\s*True|secure\s*=\s*True)/i,
+            snippetLines: 3,
+        },
+        {
+            // Explicit insecure=true in cookie options
+            pattern: /(?:secure\s*:\s*false|httpOnly\s*:\s*false)/gi,
+            requiresContext: /(?:cookie|session|token|auth)/i,
+            snippetLines: 3,
+        },
+    ],
+    fix: 'Set security attributes on all authentication and session cookies.\n\n' +
+        '// Express:\n' +
+        'res.cookie("session_token", token, {\n' +
+        '  httpOnly: true,   // prevent JavaScript access (XSS protection)\n' +
+        '  secure: true,     // HTTPS only (never send over HTTP)\n' +
+        '  sameSite: "strict", // CSRF protection\n' +
+        '  maxAge: 3600000,  // 1 hour expiry\n' +
+        '  path: "/",\n' +
+        '});\n\n' +
+        '// Python / Flask:\n' +
+        'response.set_cookie(\n' +
+        '    "session_token",\n' +
+        '    token,\n' +
+        '    httponly=True,\n' +
+        '    secure=True,\n' +
+        '    samesite="Strict",\n' +
+        '    max_age=3600,\n' +
+        ')',
+    references: [
+        'https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/',
+        'https://cwe.mitre.org/data/definitions/614.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html',
+    ],
+    tags: ['cookies', 'session', 'authentication', 'xss', 'csrf'],
+};
+//# sourceMappingURL=insecure-cookies.js.map

package/dist/rules/owasp-a07/insecure-cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-cookies.js","sourceRoot":"","sources":["../../../src/rules/owasp-a07/insecure-cookies.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAIhE,MAAM,CAAC,MAAM,eAAe,GAAS;IACnC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,+DAA+D;IACrE,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC;IAChE,WAAW,EACT,qFAAqF;QACrF,gEAAgE;QAChE,qFAAqF;IACvF,QAAQ,EAAE;QACR;YACE,uCAAuC;YACvC,OAAO,EACL,oHAAoH;YACtH,UAAU,EAAE,4CAA4C;YACxD,YAAY,EAAE,CAAC;SAChB;QACD;YACE,+CAA+C;YAC/C,OAAO,EACL,kDAAkD;YACpD,UAAU,EAAE,wCAAwC;YACpD,YAAY,EAAE,CAAC;SAChB;QACD;YACE,6CAA6C;YAC7C,OAAO,EACL,iGAAiG;YACnG,UAAU,EAAE,4CAA4C;YACxD,YAAY,EAAE,CAAC;SAChB;QACD;YACE,2CAA2C;YAC3C,OAAO,EAAE,+CAA+C;YACxD,eAAe,EAAE,gCAAgC;YACjD,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,wEAAwE;QACxE,eAAe;QACf,wCAAwC;QACxC,qEAAqE;QACrE,4DAA4D;QAC5D,4CAA4C;QAC5C,wCAAwC;QACxC,gBAAgB;QAChB,SAAS;QACT,sBAAsB;QACtB,wBAAwB;QACxB,wBAAwB;QACxB,cAAc;QACd,sBAAsB;QACtB,oBAAoB;QACpB,0BAA0B;QAC1B,qBAAqB;QACrB,GAAG;IACL,UAAU,EAAE;QACV,8EAA8E;QAC9E,iDAAiD;QACjD,oFAAoF;KACrF;IACD,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC;CAC9D,CAAC"}

package/dist/rules/owasp-a07/jwt-none-alg.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const JwtNoneAlgorithm: Rule;
+//# sourceMappingURL=jwt-none-alg.d.ts.map

package/dist/rules/owasp-a07/jwt-none-alg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-none-alg.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a07/jwt-none-alg.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,gBAAgB,EAAE,IAsF9B,CAAC"}

package/dist/rules/owasp-a07/jwt-none-alg.js

@@ -0,0 +1,81 @@
+// OWASP A07:2021 — Identification and Authentication Failures
+// Rule: JWT "none" algorithm vulnerability or insecure JWT configuration
+export const JwtNoneAlgorithm = {
+    id: 'OWASP-A07-001',
+    name: 'JWT None Algorithm or Insecure JWT Configuration',
+    owasp: 'A07:2021',
+    cwe: 'CWE-347',
+    severity: 'CRITICAL',
+    languages: ['javascript', 'typescript', 'python', 'java', 'ruby', 'go'],
+    description: 'JWT libraries that accept the "none" algorithm (no signature) allow attackers to ' +
+        'forge tokens with any claims they want — bypassing authentication entirely. ' +
+        'Also detects JWTs verified without algorithm pinning (susceptible to algorithm confusion attacks).',
+    patterns: [
+        {
+            // jwt.sign/verify with algorithm: 'none'
+            pattern: /jwt\s*\.\s*(?:sign|verify|decode)\s*\([^)]*algorithm\s*s?\s*:\s*['"`]none['"`]/gi,
+            snippetLines: 3,
+        },
+        {
+            // jwt.verify without algorithms option (any algorithm accepted)
+            pattern: /jwt\s*\.\s*verify\s*\(\s*\w+\s*,\s*\w+\s*\)/g,
+            suppressIf: /(?:algorithms\s*:|algorithm\s*:)/i,
+            snippetLines: 3,
+        },
+        {
+            // jsonwebtoken: algorithms not specified in verify options
+            pattern: /(?:jsonwebtoken|jwt)\s*\.\s*verify\s*\(\s*[^,]+,\s*[^,{)]+\s*(?:,\s*(?!\{))?\s*\)/gi,
+            suppressIf: /(?:algorithms|algorithm)/i,
+            snippetLines: 3,
+        },
+        {
+            // PyJWT: decode without algorithms list
+            pattern: /jwt\s*\.\s*decode\s*\(\s*[^,]+,\s*[^,)]+\s*(?:,\s*(?!\{))?\s*\)/gi,
+            suppressIf: /algorithms\s*=/i,
+            snippetLines: 3,
+        },
+        {
+            // Python: algorithms=["none"] or verify=False
+            pattern: /(?:algorithms\s*=\s*\[\s*['"`]none['"`]|options\s*=\s*\{[^}]*['"`]verify[^}]*:\s*False)/gi,
+            snippetLines: 3,
+        },
+        {
+            // Weak JWT secret (too short)
+            pattern: /jwt\s*\.\s*sign\s*\([^,]+,\s*['"`][a-zA-Z0-9]{1,15}['"`]/gi,
+            snippetLines: 3,
+        },
+        {
+            // Missing expiry (no expiresIn)
+            pattern: /jwt\s*\.\s*sign\s*\(\s*\{[^}]+\}\s*,\s*[^,{)]+\s*\)/g,
+            suppressIf: /(?:expiresIn|exp\s*:|expires_in)/i,
+            snippetLines: 3,
+        },
+    ],
+    fix: 'Always pin the expected algorithm and verify token expiry.\n\n' +
+        '// Node.js — jsonwebtoken:\n' +
+        'import jwt from "jsonwebtoken";\n\n' +
+        '// Signing:\n' +
+        'const token = jwt.sign(\n' +
+        '  { userId: user.id, role: user.role },\n' +
+        '  process.env.JWT_SECRET!,\n' +
+        '  { algorithm: "HS256", expiresIn: "15m" } // short expiry\n' +
+        ');\n\n' +
+        '// Verifying — MUST specify algorithms:\n' +
+        'const payload = jwt.verify(token, process.env.JWT_SECRET!, {\n' +
+        '  algorithms: ["HS256"], // reject any other algorithm including "none"\n' +
+        '});\n\n' +
+        '// Python — PyJWT:\n' +
+        'payload = jwt.decode(\n' +
+        '    token,\n' +
+        '    secret,\n' +
+        '    algorithms=["HS256"],  # must specify allowed algorithms\n' +
+        ')',
+    references: [
+        'https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/',
+        'https://cwe.mitre.org/data/definitions/347.html',
+        'https://portswigger.net/web-security/jwt',
+        'https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/',
+    ],
+    tags: ['jwt', 'authentication', 'auth', 'token', 'cryptography'],
+};
+//# sourceMappingURL=jwt-none-alg.js.map

package/dist/rules/owasp-a07/jwt-none-alg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-none-alg.js","sourceRoot":"","sources":["../../../src/rules/owasp-a07/jwt-none-alg.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,yEAAyE;AAIzE,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,kDAAkD;IACxD,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC;IACvE,WAAW,EACT,mFAAmF;QACnF,8EAA8E;QAC9E,oGAAoG;IACtG,QAAQ,EAAE;QACR;YACE,yCAAyC;YACzC,OAAO,EACL,kFAAkF;YACpF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,gEAAgE;YAChE,OAAO,EACL,8CAA8C;YAChD,UAAU,EAAE,mCAAmC;YAC/C,YAAY,EAAE,CAAC;SAChB;QACD;YACE,2DAA2D;YAC3D,OAAO,EACL,qFAAqF;YACvF,UAAU,EAAE,2BAA2B;YACvC,YAAY,EAAE,CAAC;SAChB;QACD;YACE,wCAAwC;YACxC,OAAO,EACL,mEAAmE;YACrE,UAAU,EAAE,iBAAiB;YAC7B,YAAY,EAAE,CAAC;SAChB;QACD;YACE,8CAA8C;YAC9C,OAAO,EACL,2FAA2F;YAC7F,YAAY,EAAE,CAAC;SAChB;QACD;YACE,8BAA8B;YAC9B,OAAO,EACL,4DAA4D;YAC9D,YAAY,EAAE,CAAC;SAChB;QACD;YACE,gCAAgC;YAChC,OAAO,EACL,sDAAsD;YACxD,UAAU,EAAE,mCAAmC;YAC/C,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,gEAAgE;QAChE,8BAA8B;QAC9B,qCAAqC;QACrC,eAAe;QACf,2BAA2B;QAC3B,2CAA2C;QAC3C,8BAA8B;QAC9B,8DAA8D;QAC9D,QAAQ;QACR,2CAA2C;QAC3C,gEAAgE;QAChE,2EAA2E;QAC3E,SAAS;QACT,sBAAsB;QACtB,yBAAyB;QACzB,cAAc;QACd,eAAe;QACf,gEAAgE;QAChE,GAAG;IACL,UAAU,EAAE;QACV,8EAA8E;QAC9E,iDAAiD;QACjD,0CAA0C;QAC1C,8EAA8E;KAC/E;IACD,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC;CACjE,CAAC"}

package/dist/rules/owasp-a07/no-password-hashing.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const NoPasswordHashing: Rule;
+//# sourceMappingURL=no-password-hashing.d.ts.map

package/dist/rules/owasp-a07/no-password-hashing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-password-hashing.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a07/no-password-hashing.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,iBAAiB,EAAE,IA0E/B,CAAC"}

package/dist/rules/owasp-a07/no-password-hashing.js

@@ -0,0 +1,70 @@
+// OWASP A07:2021 — Identification and Authentication Failures
+// Rule: Passwords stored or compared without proper hashing
+export const NoPasswordHashing = {
+    id: 'OWASP-A07-002',
+    name: 'Password Stored or Compared Without Secure Hashing',
+    owasp: 'A07:2021',
+    cwe: 'CWE-256',
+    severity: 'CRITICAL',
+    languages: ['javascript', 'typescript', 'python', 'php', 'java', 'ruby', 'go'],
+    description: 'Passwords stored in plaintext, or compared directly without using a constant-time ' +
+        'comparison of hashed values. A database breach immediately exposes all user passwords. ' +
+        'AI tools commonly generate password: req.body.password stored directly in DB models.',
+    patterns: [
+        {
+            // Mongoose/Sequelize: password field set directly from request without hashing
+            pattern: /password\s*:\s*req(?:uest)?\s*\.\s*body\s*\.\s*password\b/gi,
+            suppressIf: /(?:bcrypt|argon2|scrypt|pbkdf2|hash|crypto)/i,
+            snippetLines: 5,
+        },
+        {
+            // new User({ password: req.body.password })
+            pattern: /\{\s*[^}]*password\s*:\s*req(?:uest)?\s*\.\s*body\s*\.\s*password[^}]*\}/gi,
+            suppressIf: /(?:bcrypt|argon2|scrypt|pbkdf2|\.hash\s*\(|hashPassword)/i,
+            snippetLines: 5,
+        },
+        {
+            // Direct equality comparison: user.password === req.body.password
+            pattern: /(?:user|account|record)\s*\.\s*password\s*===?\s*(?:req|request)\s*\.\s*body\s*\.\s*password/gi,
+            snippetLines: 3,
+        },
+        {
+            // Python: user.password == request.form['password']
+            pattern: /(?:user|account)\s*\.\s*password\s*==\s*request\s*\.\s*(?:form|json|data|args)/gi,
+            snippetLines: 3,
+        },
+        {
+            // PHP: $user['password'] == $_POST['password'] (not password_verify)
+            pattern: /\$(?:user|row|record)\s*(?:\[['"`]password['"`]\]|->\s*password)\s*==\s*\$_(?:POST|GET|REQUEST)\s*\[['"`]password['"`]\]/gi,
+            snippetLines: 3,
+        },
+        {
+            // Java: .equals() comparison for password strings
+            pattern: /(?:password|passwd|pwd)\s*\.\s*equals\s*\(\s*(?:request|req)\.(?:getParameter|body)/gi,
+            snippetLines: 3,
+        },
+    ],
+    fix: 'Use a password hashing function with a work factor (bcrypt, Argon2id, or scrypt). ' +
+        'NEVER compare passwords with == or ===.\n\n' +
+        '// Node.js registration:\n' +
+        'import bcrypt from "bcrypt";\n' +
+        'const SALT_ROUNDS = 12;\n' +
+        'const hashedPassword = await bcrypt.hash(req.body.password, SALT_ROUNDS);\n' +
+        'await User.create({ email: req.body.email, password: hashedPassword });\n\n' +
+        '// Node.js login verification:\n' +
+        'const user = await User.findOne({ email: req.body.email });\n' +
+        'if (!user) return res.status(401).json({ error: "Invalid credentials" });\n' +
+        'const valid = await bcrypt.compare(req.body.password, user.password);\n' +
+        'if (!valid) return res.status(401).json({ error: "Invalid credentials" });\n\n' +
+        '// Python:\n' +
+        'from passlib.hash import argon2\n' +
+        'hashed = argon2.hash(password)          # store\n' +
+        'valid = argon2.verify(input_pwd, hashed) # verify',
+    references: [
+        'https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/',
+        'https://cwe.mitre.org/data/definitions/256.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html',
+    ],
+    tags: ['password', 'hashing', 'authentication', 'plaintext', 'bcrypt'],
+};
+//# sourceMappingURL=no-password-hashing.js.map

package/dist/rules/owasp-a07/no-password-hashing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-password-hashing.js","sourceRoot":"","sources":["../../../src/rules/owasp-a07/no-password-hashing.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,4DAA4D;AAI5D,MAAM,CAAC,MAAM,iBAAiB,GAAS;IACrC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,oDAAoD;IAC1D,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC;IAC9E,WAAW,EACT,oFAAoF;QACpF,yFAAyF;QACzF,sFAAsF;IACxF,QAAQ,EAAE;QACR;YACE,+EAA+E;YAC/E,OAAO,EACL,6DAA6D;YAC/D,UAAU,EAAE,8CAA8C;YAC1D,YAAY,EAAE,CAAC;SAChB;QACD;YACE,4CAA4C;YAC5C,OAAO,EACL,4EAA4E;YAC9E,UAAU,EAAE,2DAA2D;YACvE,YAAY,EAAE,CAAC;SAChB;QACD;YACE,kEAAkE;YAClE,OAAO,EACL,gGAAgG;YAClG,YAAY,EAAE,CAAC;SAChB;QACD;YACE,oDAAoD;YACpD,OAAO,EACL,kFAAkF;YACpF,YAAY,EAAE,CAAC;SAChB;QACD;YACE,qEAAqE;YACrE,OAAO,EACL,4HAA4H;YAC9H,YAAY,EAAE,CAAC;SAChB;QACD;YACE,kDAAkD;YAClD,OAAO,EACL,uFAAuF;YACzF,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,oFAAoF;QACpF,6CAA6C;QAC7C,4BAA4B;QAC5B,gCAAgC;QAChC,2BAA2B;QAC3B,6EAA6E;QAC7E,6EAA6E;QAC7E,kCAAkC;QAClC,+DAA+D;QAC/D,6EAA6E;QAC7E,yEAAyE;QACzE,gFAAgF;QAChF,cAAc;QACd,mCAAmC;QACnC,mDAAmD;QACnD,mDAAmD;IACrD,UAAU,EAAE;QACV,8EAA8E;QAC9E,iDAAiD;QACjD,kFAAkF;KACnF;IACD,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,CAAC;CACvE,CAAC"}

package/dist/rules/owasp-a07/weak-session.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const WeakSessionConfig: Rule;
+//# sourceMappingURL=weak-session.d.ts.map

package/dist/rules/owasp-a07/weak-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-session.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a07/weak-session.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,iBAAiB,EAAE,IAkE/B,CAAC"}

package/dist/rules/owasp-a07/weak-session.js

@@ -0,0 +1,64 @@
+// OWASP A07:2021 — Identification and Authentication Failures
+// Rule: Insecure session configuration
+export const WeakSessionConfig = {
+    id: 'OWASP-A07-003',
+    name: 'Insecure Session Configuration',
+    owasp: 'A07:2021',
+    cwe: 'CWE-732',
+    severity: 'HIGH',
+    languages: ['javascript', 'typescript', 'python'],
+    description: 'Session middleware configured with insecure defaults: missing secret, non-persistent ' +
+        'storage in production, or sessions not invalidated on logout. ' +
+        'AI tools often generate express-session with no secret or MemoryStore in production.',
+    patterns: [
+        {
+            // express-session with no secret or weak secret
+            pattern: /session\s*\(\s*\{\s*(?![^}]*secret\s*:)[^}]*\}\s*\)/gi,
+            snippetLines: 5,
+        },
+        {
+            // MemoryStore in production (causes memory leaks and doesn't scale)
+            pattern: /(?:store\s*:\s*new\s+MemoryStore|resave\s*:\s*true)/gi,
+            suppressIf: /(?:test|development|dev|spec)/i,
+            snippetLines: 3,
+        },
+        {
+            // Missing httpOnly or secure in session cookie
+            pattern: /cookie\s*:\s*\{\s*(?![^}]*(?:httpOnly|secure)\s*:\s*true)[^}]*\}/gi,
+            requiresContext: /(?:session|express-session|cookie-session)/i,
+            snippetLines: 5,
+        },
+        {
+            // Session secret in code (not from env)
+            pattern: /secret\s*:\s*['"`](?!.*process\.env)[a-zA-Z0-9_\-]{1,30}['"`]/gi,
+            requiresContext: /(?:session\s*\(|express-session)/i,
+            snippetLines: 5,
+        },
+    ],
+    fix: 'Configure sessions with a strong secret, secure cookies, and a production-ready store.\n\n' +
+        '// Express:\n' +
+        'import session from "express-session";\n' +
+        'import RedisStore from "connect-redis";\n' +
+        'import { createClient } from "redis";\n\n' +
+        'const redisClient = createClient({ url: process.env.REDIS_URL });\n' +
+        'await redisClient.connect();\n\n' +
+        'app.use(session({\n' +
+        '  secret: process.env.SESSION_SECRET!, // min 32 chars, from env\n' +
+        '  resave: false,\n' +
+        '  saveUninitialized: false,\n' +
+        '  store: new RedisStore({ client: redisClient }), // not MemoryStore\n' +
+        '  cookie: {\n' +
+        '    httpOnly: true,  // not accessible via JS\n' +
+        '    secure: process.env.NODE_ENV === "production", // HTTPS only\n' +
+        '    sameSite: "strict", // CSRF protection\n' +
+        '    maxAge: 30 * 60 * 1000, // 30 minutes\n' +
+        '  },\n' +
+        '}));',
+    references: [
+        'https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/',
+        'https://cwe.mitre.org/data/definitions/732.html',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html',
+    ],
+    tags: ['session', 'authentication', 'cookies', 'configuration'],
+};
+//# sourceMappingURL=weak-session.js.map

package/dist/rules/owasp-a07/weak-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-session.js","sourceRoot":"","sources":["../../../src/rules/owasp-a07/weak-session.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,uCAAuC;AAIvC,MAAM,CAAC,MAAM,iBAAiB,GAAS;IACrC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,gCAAgC;IACtC,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC;IACjD,WAAW,EACT,uFAAuF;QACvF,gEAAgE;QAChE,sFAAsF;IACxF,QAAQ,EAAE;QACR;YACE,gDAAgD;YAChD,OAAO,EACL,uDAAuD;YACzD,YAAY,EAAE,CAAC;SAChB;QACD;YACE,oEAAoE;YACpE,OAAO,EACL,uDAAuD;YACzD,UAAU,EAAE,gCAAgC;YAC5C,YAAY,EAAE,CAAC;SAChB;QACD;YACE,+CAA+C;YAC/C,OAAO,EACL,oEAAoE;YACtE,eAAe,EAAE,6CAA6C;YAC9D,YAAY,EAAE,CAAC;SAChB;QACD;YACE,wCAAwC;YACxC,OAAO,EACL,iEAAiE;YACnE,eAAe,EAAE,mCAAmC;YACpD,YAAY,EAAE,CAAC;SAChB;KACF;IACD,GAAG,EACD,4FAA4F;QAC5F,eAAe;QACf,0CAA0C;QAC1C,2CAA2C;QAC3C,2CAA2C;QAC3C,qEAAqE;QACrE,kCAAkC;QAClC,qBAAqB;QACrB,oEAAoE;QACpE,oBAAoB;QACpB,+BAA+B;QAC/B,wEAAwE;QACxE,eAAe;QACf,iDAAiD;QACjD,oEAAoE;QACpE,8CAA8C;QAC9C,6CAA6C;QAC7C,QAAQ;QACR,MAAM;IACR,UAAU,EAAE;QACV,8EAA8E;QAC9E,iDAAiD;QACjD,oFAAoF;KACrF;IACD,IAAI,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,CAAC;CAChE,CAAC"}

package/dist/rules/owasp-a08/unsafe-deserialization.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../types/index.js';
+export declare const UnsafeDeserialization: Rule;
+//# sourceMappingURL=unsafe-deserialization.d.ts.map

package/dist/rules/owasp-a08/unsafe-deserialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafe-deserialization.d.ts","sourceRoot":"","sources":["../../../src/rules/owasp-a08/unsafe-deserialization.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,eAAO,MAAM,qBAAqB,EAAE,IAkFnC,CAAC"}