@vibedrift/cli 0.4.3 → 0.4.4

package/dist/index.js

@@ -2735,10 +2735,13 @@ var importsAnalyzer = {
     );
     const esmFiles = [];
     const cjsFiles = [];
+    const SKIP_PATH = /(?:fixtures?|testdata|__fixtures__|__mocks__)[/\\]/i;
     for (const file of jsFiles) {
       if (CONFIG_FILE_PATTERN.test(file.relativePath)) continue;
+      if (SKIP_PATH.test(file.relativePath)) continue;
+      const stripped = file.content.replace(/\/[^/\n]+\/[gimsuvy]*/g, '""').replace(/`[^`]*`/g, '""');
       const hasESM = ESM_PATTERN.test(file.content);
-      const hasCJS = CJS_PATTERN.test(file.content);
+      const hasCJS = CJS_PATTERN.test(stripped);
       if (hasESM && hasCJS) {
         findings.push({
           analyzerId: "imports",
@@ -2908,8 +2911,11 @@ var NODE_BUILTINS = /* @__PURE__ */ new Set([
 ]);
 var JS_IMPORT_PATTERNS = [
   /(?:import|from)\s+['"]([^./][^'"]*)['"]/g,
-  /require\(\s*['"]([^./][^'"]*)['"]\s*\)/g
+  /require\(\s*['"]([^./][^'"]*)['"]\s*\)/g,
+  // Dynamic imports: await import("pkg") or import("pkg")
+  /import\(\s*['"]([^./][^'"]*)['"]\s*\)/g
 ];
+var FIXTURE_PATH_PATTERN = /(?:fixtures?|testdata|__fixtures__|__mocks__)[/\\]/i;
 function extractGoImports(content) {
   const imports = [];
   const singlePattern = /^import\s+"([^"]+)"/gm;
@@ -2998,7 +3004,7 @@ function analyzeJsDeps(ctx) {
   const imported = /* @__PURE__ */ new Set();
   const importLocations = /* @__PURE__ */ new Map();
   const jsFiles = ctx.files.filter(
-    (f) => f.language === "javascript" || f.language === "typescript"
+    (f) => (f.language === "javascript" || f.language === "typescript") && !FIXTURE_PATH_PATTERN.test(f.relativePath)
   );
   for (const file of jsFiles) {
     for (const pattern of JS_IMPORT_PATTERNS) {
@@ -3856,11 +3862,12 @@ var SECURITY_PATTERNS = [
     id: "ssrf-risk",
     name: "SSRF risk",
     pattern: /(?:fetch|axios\.get|http\.get|requests\.get|httpClient)\s*\(\s*(?:[`'"].*\$\{|[^'"]*\+)/g,
-    severity: "warning",
-    confidence: 0.6,
-    message: "Potential SSRF: user-controlled value in URL construction",
+    severity: "info",
+    confidence: 0.4,
+    message: "URL constructed from variable \u2014 review if the source is user-controlled",
     languages: "all",
-    tags: ["security", "ssrf"]
+    tags: ["security", "ssrf"],
+    negativeFilter: /(?:API_URL|BASE_URL|apiUrl|baseUrl|base\s*\+|endpoint|config\.|process\.env)/i
   },
   // === Python-specific ===
   {
@@ -3916,7 +3923,9 @@ var securityAnalyzer = {
   async analyze(ctx) {
     const findings = [];
     const projectLanguages = [...ctx.languageBreakdown.keys()];
+    const PATTERN_DEF = /(?:pattern\s*:|regex\s*:|RegExp\s*\(|name\s*:|message\s*:|id\s*:|label\s*:)/;
     for (const file of ctx.files) {
+      if (/(?:fixtures?|testdata|__fixtures__|__mocks__)[/\\]/i.test(file.relativePath)) continue;
       for (const pattern of SECURITY_PATTERNS) {
         if (pattern.languages !== "all") {
           if (!file.language || !pattern.languages.includes(file.language)) continue;
@@ -3924,10 +3933,11 @@ var securityAnalyzer = {
         const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
         let match;
         while ((match = regex.exec(file.content)) !== null) {
+          const lineStart = file.content.lastIndexOf("\n", match.index) + 1;
+          const lineEnd = file.content.indexOf("\n", match.index);
+          const line = file.content.slice(lineStart, lineEnd === -1 ? void 0 : lineEnd);
+          if (PATTERN_DEF.test(line)) continue;
           if (pattern.negativeFilter) {
-            const lineStart2 = file.content.lastIndexOf("\n", match.index) + 1;
-            const lineEnd2 = file.content.indexOf("\n", match.index);
-            const line = file.content.slice(lineStart2, lineEnd2 === -1 ? void 0 : lineEnd2);
             if (pattern.negativeFilter.test(line)) continue;
           }
           if (pattern.contextRequired) {
@@ -3939,9 +3949,7 @@ var securityAnalyzer = {
             if (!pattern.contextRequired.test(context)) continue;
           }
           const lineNum = getLineNumber(file.content, match.index);
-          const lineStart = file.content.lastIndexOf("\n", match.index) + 1;
-          const lineEnd = file.content.indexOf("\n", match.index);
-          const snippet = file.content.slice(lineStart, lineEnd === -1 ? void 0 : lineEnd).trim();
+          const snippet = line.trim();
           findings.push({
             analyzerId: "security",
             severity: pattern.severity,