@warlock.js/core 5.30.0 → 5.32.0

package/esm/tooling/check/security-conventions.mjs

@@ -0,0 +1,650 @@
+import { isAuthGuardName, isMutatingHttpMethod } from "../../router/route-guard-names.mjs";
+import { expressionOf, isArrayLiteralExpression, isArrowFunction, isAsExpression, isAwaitExpression, isBinaryExpression, isCallExpression, isConditionalExpression, isElementAccessExpression, isFunctionExpression, isIdentifier, isIfStatement, isJsxAttribute, isJsxExpression, isJsxOpeningElement, isJsxSelfClosingElement, isNewExpression, isNonNullExpression, isObjectLiteralExpression, isOmittedExpression, isParenthesizedExpression, isPropertyAssignment, isRegularExpressionLiteral, isSatisfiesExpression, isShorthandPropertyAssignment, isSpreadAssignment, isSpreadElement, isTemplateExpression, isTypeAssertionExpression, isVariableDeclaration, nameNode, parentOf, valueText } from "../syntax/ast.mjs";
+import { ancestors, calleeName, isFunctionLike, isMemberAccess, keyName, literalString, memberName, referencesOf, resolveInitializer, rootIdentifier, unwrap, walk } from "./source-ast.mjs";
+import { REQUEST_BODY_MEMBERS, REQUEST_NAMES, containsRequestInput, requestMemberAccess } from "./request-input.mjs";
+import { DEFAULT_REDACT_KEY_SET, normalizeRedactKey } from "@warlock.js/logger";
+
+//#region ../../packages/core/src/tooling/check/security-conventions.ts
+/** Request methods that return every input the client sent, validated or not. */
+const UNFILTERED_METHODS = /* @__PURE__ */ new Set([
+	"all",
+	"allExceptParams",
+	"heavy",
+	"heavyExceptParams"
+]);
+/**
+* Responses and loggers are not the data sinks `WL9005` guards: echoing input
+* back is not mass assignment, and logging it is `WL9008`'s concern.
+*/
+const IGNORED_RECEIVERS = /* @__PURE__ */ new Set([
+	"response",
+	"reply",
+	"res",
+	"console",
+	"log",
+	"logger"
+]);
+function displayCallee(callee) {
+	const target = unwrap(callee);
+	if (isIdentifier(target)) return `${valueText(target)}()`;
+	if (isMemberAccess(target)) {
+		const name = memberName(target);
+		const object = unwrap(expressionOf(target));
+		const owner = isIdentifier(object) ? `${valueText(object)}.` : "";
+		return name ? `${owner}${name}()` : "a call";
+	}
+	return "a call";
+}
+function isIgnoredReceiver(callee) {
+	const target = unwrap(callee);
+	if (!isMemberAccess(target)) return false;
+	const object = unwrap(expressionOf(target));
+	return isIdentifier(object) && IGNORED_RECEIVERS.has(valueText(object));
+}
+/** When `node` flows into a call's arguments, the callee's display name. */
+function callReceiving(node) {
+	let current = node;
+	for (;;) {
+		const parent = parentOf(current);
+		if (!parent) return void 0;
+		if (isCallExpression(parent) || isNewExpression(parent)) {
+			if (!(parent.arguments ?? []).some((argument) => argument === current)) return void 0;
+			if (isIgnoredReceiver(expressionOf(parent))) return void 0;
+			return displayCallee(expressionOf(parent));
+		}
+		if (isSpreadElement(parent) || isSpreadAssignment(parent) || isObjectLiteralExpression(parent) || isArrayLiteralExpression(parent) || isPropertyAssignment(parent) && parent.value === current || isShorthandPropertyAssignment(parent) || isAsExpression(parent) || isNonNullExpression(parent) || isSatisfiesExpression(parent) || isTypeAssertionExpression(parent) || isParenthesizedExpression(parent) || isAwaitExpression(parent)) {
+			current = parent;
+			continue;
+		}
+		return;
+	}
+}
+/**
+* The call that ends up receiving this value: directly as an argument, spread
+* into an object/array argument, or through a local constant later passed to
+* a call.
+*/
+function receivingCall(node) {
+	const direct = callReceiving(node);
+	if (direct) return direct;
+	const parent = parentOf(node);
+	if (parent && isVariableDeclaration(parent) && parent.init === node && isIdentifier(parent.id)) for (const reference of referencesOf(parent)) {
+		const name = callReceiving(reference);
+		if (name) return name;
+	}
+}
+function checkRequestAll(node, findings) {
+	if (!isCallExpression(node)) return;
+	const callee = unwrap(expressionOf(node));
+	if (!isMemberAccess(callee)) return;
+	const object = unwrap(expressionOf(callee));
+	if (!isIdentifier(object) || !REQUEST_NAMES.has(valueText(object))) return;
+	const method = memberName(callee);
+	if (!method || !UNFILTERED_METHODS.has(method)) return;
+	const target = receivingCall(node);
+	if (!target) return;
+	findings.push({
+		code: "WL9005",
+		node,
+		message: `\`${valueText(object)}.${method}()\` passes every client-sent field to \`${target}\`. Use \`${valueText(object)}.validated()\` so only the fields the validation schema accepted reach it.`
+	});
+}
+const ROUTER_NAMES = /* @__PURE__ */ new Set(["router"]);
+/** Wrappers whose callback routes are guarded, e.g. `guarded(() => …)`. */
+const GUARD_FUNCTIONS = /* @__PURE__ */ new Set(["guarded"]);
+/** `router.post(…)` and friends. */
+const MUTATING_ROUTER_METHODS = /* @__PURE__ */ new Set([
+	"post",
+	"put",
+	"patch",
+	"delete"
+]);
+/** Route builder methods (`router.route(path).create(…)`) that register a mutating route. */
+const MUTATING_BUILDER_METHODS = /* @__PURE__ */ new Set([
+	"post",
+	"postOne",
+	"put",
+	"updateOne",
+	"patch",
+	"patchOne",
+	"delete",
+	"deleteOne",
+	"create",
+	"update",
+	"destroy"
+]);
+const READ_ONLY_RESOURCE_METHODS = /* @__PURE__ */ new Set([
+	"list",
+	"get",
+	"show"
+]);
+function isRouter(node) {
+	const target = unwrap(node);
+	return isIdentifier(target) && ROUTER_NAMES.has(valueText(target));
+}
+function isGuardName(name) {
+	return name !== void 0 && isAuthGuardName(name);
+}
+/** Whether a constant is initialised with `markAuthGuard(fn)` (not `markAuthGuard(fn, false)`). */
+function isMarkedGuard(identifier) {
+	const initializer = resolveInitializer(identifier);
+	const value = initializer ? unwrap(initializer) : void 0;
+	return value !== void 0 && isCallExpression(value) && calleeName(value) === "markAuthGuard" && !(value.arguments[1]?.type === "Literal" && value.arguments[1].value === false);
+}
+function middlewareHasGuard(node) {
+	const value = unwrap(node);
+	if (!isArrayLiteralExpression(value)) return true;
+	return value.elements.some((element) => {
+		if (!element) return false;
+		if (isSpreadElement(element)) return true;
+		const item = unwrap(element);
+		if (isIdentifier(item)) return isGuardName(valueText(item)) || isMarkedGuard(item);
+		if (isCallExpression(item)) return isGuardName(calleeName(item));
+		if (isMemberAccess(item)) return isGuardName(memberName(item));
+		return false;
+	});
+}
+/** `public: true`, a guard in `middleware`, or an options value the check cannot see into. */
+function optionsGuard(node) {
+	if (!node) return "none";
+	const value = unwrap(node);
+	if (!isObjectLiteralExpression(value)) return "guarded";
+	let verdict = "unguarded";
+	for (const property of value.properties) {
+		if (isSpreadAssignment(property)) {
+			verdict = "guarded";
+			continue;
+		}
+		let key;
+		let propertyValue;
+		if (isPropertyAssignment(property)) {
+			key = keyName(property.key);
+			propertyValue = unwrap(property.value);
+		} else if (isShorthandPropertyAssignment(property)) {
+			key = valueText(property.key);
+			propertyValue = property.key;
+		}
+		if (!propertyValue) continue;
+		if (key === "public" && propertyValue.type === "Literal" && propertyValue.value === true) return "guarded";
+		if (key === "middleware" && middlewareHasGuard(propertyValue)) return "guarded";
+	}
+	return verdict;
+}
+/** Whether an enclosing function is a guarded (or public) group callback. */
+function insideGuardedGroup(node) {
+	for (const ancestor of ancestors(node)) {
+		if (!isArrowFunction(ancestor) && !isFunctionExpression(ancestor)) continue;
+		const parent = parentOf(ancestor);
+		if (!parent || !isCallExpression(parent)) continue;
+		if (!parent.arguments.some((argument) => argument === ancestor)) continue;
+		const name = calleeName(parent);
+		if (name !== void 0 && GUARD_FUNCTIONS.has(name)) return true;
+		const callee = unwrap(expressionOf(parent));
+		if (isMemberAccess(callee) && memberName(callee) === "group" && isRouter(expressionOf(callee)) && optionsGuard(parent.arguments[0]) === "guarded") return true;
+	}
+	return false;
+}
+function pathText(node) {
+	return literalString(node) ?? "(dynamic path)";
+}
+/**
+* Walk a builder chain back to `router.route(path, options)`, collecting every
+* options object passed along the way (`route()`, `nest()`).
+*/
+function builderChain(node) {
+	const optionNodes = [];
+	let current = unwrap(node);
+	while (isCallExpression(current)) {
+		const callee = unwrap(expressionOf(current));
+		if (!isMemberAccess(callee)) return void 0;
+		const name = memberName(callee);
+		if (name === "route" && isRouter(expressionOf(callee))) {
+			const options = current.arguments[1];
+			if (options) optionNodes.push(options);
+			return {
+				path: pathText(current.arguments[0]),
+				optionNodes
+			};
+		}
+		if (name === "nest") {
+			const options = current.arguments[1];
+			if (options) optionNodes.push(options);
+		}
+		current = unwrap(expressionOf(callee));
+	}
+}
+function resourceIsReadOnly(node) {
+	if (!node) return false;
+	const value = unwrap(node);
+	if (!isObjectLiteralExpression(value)) return false;
+	for (const property of value.properties) {
+		if (!isPropertyAssignment(property) || keyName(property.key) !== "only") continue;
+		const only = unwrap(property.value);
+		if (!isArrayLiteralExpression(only)) return false;
+		return only.elements.every((element) => {
+			if (!element) return false;
+			const method = literalString(element);
+			return method !== void 0 && READ_ONLY_RESOURCE_METHODS.has(method);
+		});
+	}
+	return false;
+}
+function unguardedRoute(node, route) {
+	return {
+		code: "WL9006",
+		node,
+		message: `Mutating route \`${route}\` has no auth middleware. Add an auth guard (\`middleware: [authMiddleware()]\`, or register it inside a guarded group) or mark it intentionally open with \`public: true\`.`
+	};
+}
+function checkRouteGuard(node, findings) {
+	if (!isCallExpression(node)) return;
+	const callee = unwrap(expressionOf(node));
+	if (!isMemberAccess(callee)) return;
+	const method = memberName(callee);
+	if (!method) return;
+	const guarded = (options) => optionsGuard(options) === "guarded" || insideGuardedGroup(node);
+	if (isRouter(expressionOf(callee))) {
+		if (MUTATING_ROUTER_METHODS.has(method)) {
+			if (!guarded(node.arguments[2])) findings.push(unguardedRoute(node, `${method.toUpperCase()} ${pathText(node.arguments[0])}`));
+			return;
+		}
+		if (method === "add") {
+			const httpMethod = literalString(node.arguments[0])?.toUpperCase();
+			if (!httpMethod || !isMutatingHttpMethod(httpMethod)) return;
+			if (!guarded(node.arguments[3])) findings.push(unguardedRoute(node, `${httpMethod} ${pathText(node.arguments[1])}`));
+			return;
+		}
+		if (method === "restfulResource") {
+			if (resourceIsReadOnly(node.arguments[2])) return;
+			if (!guarded(node.arguments[2])) findings.push(unguardedRoute(node, `resource ${pathText(node.arguments[0])}`));
+		}
+		return;
+	}
+	if (!MUTATING_BUILDER_METHODS.has(method)) return;
+	const chain = builderChain(expressionOf(callee));
+	if (!chain) return;
+	if (optionsGuard(node.arguments[1]) === "guarded") return;
+	if (chain.optionNodes.some((options) => optionsGuard(options) === "guarded")) return;
+	if (insideGuardedGroup(node)) return;
+	findings.push(unguardedRoute(node, `${method} ${chain.path}`));
+}
+/** Calls that turn their first argument into a redirect or a navigation. */
+const REDIRECT_CALLS = /* @__PURE__ */ new Set([
+	"redirect",
+	"permanentRedirect",
+	"navigateTo"
+]);
+/** Components whose `to`/`href` prop navigates. */
+const LINK_COMPONENTS = /* @__PURE__ */ new Set(["Link", "NavLink"]);
+/** Helpers that return an allowed target (or a fallback) for any input. */
+const REDIRECT_SANITIZERS = /* @__PURE__ */ new Set(["safeRedirect", "safeRedirectTarget"]);
+/** Predicates that, used in an enclosing `if` or `? :`, prove the target was checked. */
+const REDIRECT_VALIDATORS = /* @__PURE__ */ new Set(["isSafeRedirect", "isSafeRedirectUrl"]);
+/** Client-side input: query-string hooks. */
+const CLIENT_INPUT_CALLS = /* @__PURE__ */ new Set([
+	"useQueryString",
+	"useSearchParams",
+	"useParams"
+]);
+/** Identifiers whose members are client-controlled (a loader's `query`, URLSearchParams). */
+const CLIENT_INPUT_NAMES = /* @__PURE__ */ new Set(["query", "searchParams"]);
+function isClientSource(node) {
+	if (isCallExpression(node)) {
+		const name = calleeName(node);
+		if (name !== void 0 && CLIENT_INPUT_CALLS.has(name)) return true;
+	}
+	if (isMemberAccess(node)) {
+		const root = rootIdentifier(node);
+		if (root && CLIENT_INPUT_NAMES.has(valueText(root))) return true;
+		const name = memberName(node);
+		if (name === "search" || name === "hash") {
+			const object = unwrap(expressionOf(node));
+			if (isIdentifier(object) && valueText(object) === "location") return true;
+			if (isMemberAccess(object) && memberName(object) === "location") return true;
+		}
+	}
+	return false;
+}
+function isRedirectTainted(node) {
+	return containsRequestInput(node, {
+		sanitizers: REDIRECT_SANITIZERS,
+		isSource: isClientSource
+	});
+}
+/** An enclosing `if (isSafeRedirect(x))` or `isSafeRedirect(x) ? … : …` validated the target. */
+function checkedByValidator(node) {
+	for (const ancestor of ancestors(node)) {
+		let test;
+		if (isIfStatement(ancestor)) test = expressionOf(ancestor);
+		else if (isConditionalExpression(ancestor)) test = ancestor.test;
+		else continue;
+		let validated = false;
+		walk(test, (child) => {
+			if (isCallExpression(child)) {
+				const name = calleeName(child);
+				if (name !== void 0 && REDIRECT_VALIDATORS.has(name)) validated = true;
+			}
+		});
+		if (validated) return true;
+	}
+	return false;
+}
+function unsafeRedirect(node, what, helper, from) {
+	return {
+		code: "WL9007",
+		node,
+		message: `This ${what} target comes from request input. Pass it through \`${helper}()\` from \`${from}\` so only same-origin paths and allow-listed origins are followed (open redirects and \`javascript:\` URLs otherwise).`
+	};
+}
+function checkRedirect(node, findings) {
+	if (isCallExpression(node)) {
+		const name = calleeName(node);
+		if (name === void 0 || !REDIRECT_CALLS.has(name)) return;
+		const callee = unwrap(expressionOf(node));
+		if (isMemberAccess(callee)) {
+			const owner = unwrap(expressionOf(callee));
+			if (isIdentifier(owner) && valueText(owner) === "router") return;
+		}
+		const target = node.arguments[0];
+		if (!target || isSpreadElement(target)) return;
+		if (!isRedirectTainted(target) || checkedByValidator(node)) return;
+		findings.push(name === "navigateTo" ? unsafeRedirect(target, "navigation", "safeRedirectTarget", "@warlock.js/web") : unsafeRedirect(target, "redirect", "safeRedirect", "@warlock.js/core"));
+		return;
+	}
+	if (!isJsxAttribute(node) || nameNode(node).type !== "JSXIdentifier") return;
+	if (valueText(nameNode(node)) !== "to" && valueText(nameNode(node)) !== "href") return;
+	const element = parentOf(node);
+	if (!element || !isJsxOpeningElement(element) && !isJsxSelfClosingElement(element)) return;
+	if (element.name.type !== "JSXIdentifier" || !LINK_COMPONENTS.has(element.name.name)) return;
+	const initializer = node.value;
+	if (!initializer || !isJsxExpression(initializer) || !initializer.expression) return;
+	const expression = initializer.expression;
+	if (!isRedirectTainted(expression) || checkedByValidator(expression)) return;
+	findings.push(unsafeRedirect(expression, "link", "safeRedirectTarget", "@warlock.js/web"));
+}
+const LOGGER_NAMES = /* @__PURE__ */ new Set([
+	"log",
+	"logger",
+	"console"
+]);
+const LOG_METHODS = /* @__PURE__ */ new Set([
+	"info",
+	"warn",
+	"error",
+	"debug",
+	"success",
+	"fatal",
+	"log",
+	"assert",
+	"trace"
+]);
+/** Helpers that make a value safe to log; their arguments are not inspected. */
+const REDACTORS = /* @__PURE__ */ new Set([
+	"maskEmail",
+	"maskEmailsInText",
+	"redact",
+	"redactHeaders",
+	"redactError",
+	"redactUrlCredentials",
+	"redactQueryCredentials",
+	"escapeLogValue",
+	"toLogSnapshot"
+]);
+/** Name endings that mark a value as a credential. */
+const SECRET_SUFFIXES = [
+	"token",
+	"password",
+	"passwd",
+	"secret",
+	"apikey",
+	"authorization",
+	"cookie",
+	"cookies",
+	"otp",
+	"jwt",
+	"privatekey"
+];
+/**
+* Whether the logger censors this key by default (`DEFAULT_REDACT_KEYS` from
+* `@warlock.js/logger`). A secret logged under one of them never reaches a
+* channel. Emails are not on that list: they are not censored by default.
+*/
+function isCensoredKey(key) {
+	return DEFAULT_REDACT_KEY_SET.has(normalizeRedactKey(key));
+}
+/** `email` for addresses, `secret` for credentials, otherwise `undefined`. */
+function sensitiveCategory(name) {
+	const normalized = normalizeRedactKey(name);
+	if (normalized.endsWith("email") || normalized.endsWith("emailaddress")) return "email";
+	if (DEFAULT_REDACT_KEY_SET.has(normalized)) return "secret";
+	if (SECRET_SUFFIXES.some((suffix) => normalized.endsWith(suffix))) return "secret";
+}
+function describeCategory(category, name) {
+	if (category === "email") return "a raw email address";
+	return name ? `the credential \`${name}\`` : "a credential";
+}
+function describeMember(member) {
+	if (member === "headers" || member === "cookies") return member;
+	return `body (\`${member}\`)`;
+}
+/** `request.all()` / `request.body` itself, not `request.body.title`. */
+function isWholeAccess(node, member) {
+	if (isCallExpression(node)) {
+		const callee = unwrap(expressionOf(node));
+		return isMemberAccess(callee) && memberName(callee) === member;
+	}
+	return isMemberAccess(node) && memberName(node) === member;
+}
+function inspectLogged(node, censoredKey, found) {
+	const value = unwrap(node);
+	if (isFunctionLike(value)) return;
+	if (isCallExpression(value)) {
+		const name = calleeName(value);
+		if (name !== void 0 && REDACTORS.has(name)) return;
+	}
+	if (isCallExpression(value) || isMemberAccess(value)) {
+		const member = requestMemberAccess(value);
+		if (member !== void 0 && isWholeAccess(value, member)) {
+			if (REQUEST_BODY_MEMBERS.has(member)) {
+				found.push({
+					node: value,
+					what: `the request ${describeMember(member)}`
+				});
+				return;
+			}
+			if (member === "email") {
+				found.push({
+					node: value,
+					what: "a raw email address"
+				});
+				return;
+			}
+		}
+		if (isCallExpression(value) && member !== void 0) {
+			const key = literalString(value.arguments[0]);
+			const category = key ? sensitiveCategory(key) : void 0;
+			if (category && !(censoredKey && category === "secret")) {
+				found.push({
+					node: value,
+					what: describeCategory(category, key)
+				});
+				return;
+			}
+		}
+	}
+	if (isIdentifier(value) || isMemberAccess(value)) {
+		const name = isIdentifier(value) ? valueText(value) : memberName(value);
+		const category = name ? sensitiveCategory(name) : void 0;
+		if (category && !(censoredKey && category === "secret")) {
+			found.push({
+				node: value,
+				what: describeCategory(category, name)
+			});
+			return;
+		}
+		if (isMemberAccess(value) && requestMemberAccess(value) === void 0) {
+			inspectLogged(expressionOf(value), false, found);
+			if (isElementAccessExpression(value)) inspectLogged(value.property, false, found);
+		}
+		return;
+	}
+	if (isObjectLiteralExpression(value)) {
+		for (const property of value.properties) if (isSpreadAssignment(property)) inspectLogged(expressionOf(property), false, found);
+		else if (isPropertyAssignment(property)) {
+			const key = keyName(property.key);
+			inspectLogged(property.value, key !== void 0 && isCensoredKey(key), found);
+		} else if (isShorthandPropertyAssignment(property)) inspectLogged(property.key, isCensoredKey(valueText(property.key)), found);
+		return;
+	}
+	if (isTemplateExpression(value)) {
+		for (const expression of value.expressions) inspectLogged(expression, false, found);
+		return;
+	}
+	if (isBinaryExpression(value)) {
+		inspectLogged(value.left, false, found);
+		inspectLogged(value.right, false, found);
+		return;
+	}
+	if (isConditionalExpression(value)) {
+		inspectLogged(value.consequent, censoredKey, found);
+		inspectLogged(value.alternate, censoredKey, found);
+		return;
+	}
+	if (isArrayLiteralExpression(value)) {
+		for (const element of value.elements) {
+			if (isOmittedExpression(element)) continue;
+			inspectLogged(isSpreadElement(element) ? expressionOf(element) : element, false, found);
+		}
+		return;
+	}
+	if (isCallExpression(value)) {
+		const callee = unwrap(expressionOf(value));
+		if (isMemberAccess(callee)) inspectLogged(expressionOf(callee), false, found);
+		for (const argument of value.arguments) inspectLogged(isSpreadElement(argument) ? expressionOf(argument) : argument, false, found);
+		return;
+	}
+	if (isAwaitExpression(value)) inspectLogged(expressionOf(value), censoredKey, found);
+}
+function checkSensitiveLog(node, findings) {
+	if (!isCallExpression(node)) return;
+	const callee = unwrap(expressionOf(node));
+	if (!isMemberAccess(callee)) return;
+	const method = memberName(callee);
+	if (!method || !LOG_METHODS.has(method)) return;
+	const owner = unwrap(expressionOf(callee));
+	if (!isIdentifier(owner)) return;
+	if (!(LOGGER_NAMES.has(valueText(owner)) || REQUEST_NAMES.has(valueText(owner)) && method === "log")) return;
+	const found = [];
+	for (const argument of node.arguments) inspectLogged(isSpreadElement(argument) ? expressionOf(argument) : argument, false, found);
+	for (const finding of found) findings.push({
+		code: "WL9008",
+		node: finding.node,
+		message: `Do not log ${finding.what} as-is. Pass it through a redaction helper (\`maskEmail()\`, \`redact()\`, \`request.toLogSnapshot()\`), or log it under a key the logger censors.`
+	});
+}
+/** `regex.test(input)` / `regex.exec(input)`. */
+const REGEX_METHODS = /* @__PURE__ */ new Set(["test", "exec"]);
+/** `input.match(regex)` and friends: the regex is the first argument. */
+const STRING_METHODS = /* @__PURE__ */ new Set([
+	"match",
+	"matchAll",
+	"replace",
+	"replaceAll",
+	"search",
+	"split"
+]);
+/**
+* The first unbounded quantifier in a regex source (`*`, `+`, `{n,}`), skipping
+* escapes and character classes, or `undefined` when every repetition is
+* bounded.
+*/
+function findUnboundedQuantifier(source) {
+	let inClass = false;
+	for (let index = 0; index < source.length; index++) {
+		const char = source[index];
+		if (char === "\\") {
+			index++;
+			continue;
+		}
+		if (inClass) {
+			if (char === "]") inClass = false;
+			continue;
+		}
+		if (char === "[") {
+			inClass = true;
+			continue;
+		}
+		if (char === "*" || char === "+") return `${char}${source[index + 1] === "?" ? "?" : ""}`;
+		if (char === "{") {
+			const match = /^\{(\d+),\}/.exec(source.slice(index));
+			if (match) return match[0];
+		}
+	}
+}
+/** The pattern of a regex literal, `new RegExp("…")`, or a constant holding either. */
+function regexSource(node, depth = 0) {
+	if (!node || depth > 8) return void 0;
+	const value = unwrap(node);
+	if (isRegularExpressionLiteral(value)) return valueText(value).slice(1, valueText(value).lastIndexOf("/"));
+	if ((isNewExpression(value) || isCallExpression(value)) && isIdentifier(expressionOf(value)) && valueText(expressionOf(value)) === "RegExp") return literalString(value.arguments?.[0]);
+	if (isIdentifier(value)) {
+		const initializer = resolveInitializer(value);
+		return initializer ? regexSource(initializer, depth + 1) : void 0;
+	}
+}
+function checkUnboundedRegex(node, findings) {
+	if (!isCallExpression(node)) return;
+	const callee = unwrap(expressionOf(node));
+	if (!isMemberAccess(callee)) return;
+	const method = memberName(callee);
+	if (!method) return;
+	const first = node.arguments[0];
+	const firstArgument = first && !isSpreadElement(first) ? first : void 0;
+	let regex;
+	let input;
+	if (REGEX_METHODS.has(method)) {
+		regex = expressionOf(callee);
+		input = firstArgument;
+	} else if (STRING_METHODS.has(method)) {
+		regex = firstArgument;
+		input = expressionOf(callee);
+	} else return;
+	if (!input) return;
+	const source = regexSource(regex);
+	if (source === void 0) return;
+	const quantifier = findUnboundedQuantifier(source);
+	if (!quantifier || !containsRequestInput(input)) return;
+	findings.push({
+		code: "WL9009",
+		node,
+		message: `This regex has an unbounded quantifier (\`${quantifier}\`) and runs on request input, so a crafted input can make it backtrack for a long time (ReDoS). Bound the repetition, e.g. \`{1,256}\`, or cap the input length before matching.`
+	});
+}
+/**
+* The security conventions in one parsed file:
+*
+* - `WL9005` `request.all()` (or `heavy()`, `allExceptParams()`) passed to a
+*   query, a service or `inApp()`;
+* - `WL9006` a POST/PUT/PATCH/DELETE route with no auth middleware and no
+*   `public: true`;
+* - `WL9007` a `redirect()` / `navigateTo()` / `<Link to|href>` target taken
+*   from request input without `safeRedirect()` / `safeRedirectTarget()` or an
+*   `isSafeRedirect()` check;
+* - `WL9008` a raw email, credential or request body passed to a logger;
+* - `WL9009` a regex with an unbounded quantifier run on request input.
+*/
+function securityFindings(sourceFile) {
+	const findings = [];
+	walk(sourceFile, (node) => {
+		checkRequestAll(node, findings);
+		checkRouteGuard(node, findings);
+		checkRedirect(node, findings);
+		checkSensitiveLog(node, findings);
+		checkUnboundedRegex(node, findings);
+	}, true);
+	return findings;
+}
+
+//#endregion
+export { findUnboundedQuantifier, securityFindings };
+//# sourceMappingURL=security-conventions.mjs.map