@zerothreatai/vulnerability-registry 7.0.0 → 9.0.0

package/dist/compliances/compliance-by-vulnerabilities.d.ts

@@ -0,0 +1,5 @@
+export declare const COMPLIANCE_BY_VULNERABILITIES: {
+    id: number;
+    title: string;
+    vulnerabilities: (number | number[])[];
+}[];

package/dist/compliances/compliance-by-vulnerabilities.js

@@ -0,0 +1,32 @@
+import { accessRestrictionIds, allAppSecIds, authAndCookieIds, cryptoPolicyIds, infoLeakageIds, inputValidationIds, outputValidationIds } from './gdpr.js';
+import { accessControlIds, allAppSecIds as hallAppSecIds, authAndCookieIds as hauthAnCookieIds, cryptoIds, integrityIds } from './hipaa.js';
+import { owaspA1Ids, owaspA2Ids, owaspA3Ids, owaspA5Ids, owaspA7Ids, owaspA8Ids } from './owasp.js';
+import { allAppSecIds as pciAllAppSecIds, misconfigIds as pciMisconfigIds, accessControlIds as pciAccessControlIds, cryptoIds as pciCryptoIds, injectionAndXssIds as pciInjectionAndXssIds, authAndCookieIds as pciAuthAndCookieIds } from './pci-dss.js';
+import { authIds as sauthIds, accessControlIds as saccessControlIds, cmdiIds as scmdiIds, deserializationIds as sdeserializationIds, disclosureIds as sdisclosureIds, injectionIds as sinjectionIds, lfiIds as slfiIds, sqliIds, ssrfIds as ssrfids, sstiIds as ssstiIds, xssIds as sxssIds } from './sans-top-25.js';
+export const COMPLIANCE_BY_VULNERABILITIES = [
+    {
+        id: 3,
+        title: 'GDPR',
+        vulnerabilities: [...accessRestrictionIds, ...allAppSecIds, ...authAndCookieIds, ...cryptoPolicyIds, ...infoLeakageIds, ...inputValidationIds, ...outputValidationIds]
+    },
+    {
+        id: 2,
+        title: 'HIPAA',
+        vulnerabilities: [accessControlIds, ...hallAppSecIds, ...hauthAnCookieIds, ...cryptoIds, ...integrityIds]
+    },
+    {
+        id: 1,
+        title: 'OWASP',
+        vulnerabilities: [...owaspA1Ids, ...owaspA2Ids, ...owaspA3Ids, ...owaspA5Ids, ...owaspA7Ids, ...owaspA8Ids]
+    },
+    {
+        id: 4,
+        title: 'PCI-DSS',
+        vulnerabilities: [...pciAllAppSecIds, ...pciMisconfigIds, ...pciAccessControlIds, ...pciCryptoIds, ...pciInjectionAndXssIds, ...pciAuthAndCookieIds]
+    },
+    {
+        id: 6,
+        title: 'SANS Top 25',
+        vulnerabilities: [...sauthIds, ...saccessControlIds, ...scmdiIds, ...sdeserializationIds, ...sdisclosureIds, ...sinjectionIds, ...slfiIds, ...sqliIds, ...ssrfids, ...ssstiIds, ...sxssIds]
+    }
+];

package/dist/compliances/gdpr.d.ts

@@ -1,2 +1,9 @@
 import { ComplianceRegistry } from '../types';
+export declare const allAppSecIds: number[];
+export declare const authAndCookieIds: number[];
+export declare const accessRestrictionIds: number[];
+export declare const cryptoPolicyIds: number[];
+export declare const inputValidationIds: number[];
+export declare const outputValidationIds: number[];
+export declare const infoLeakageIds: number[];
 export declare const GDPR_COMPLIANCE: ComplianceRegistry;

package/dist/compliances/gdpr.js

@@ -25,13 +25,13 @@ const cookieSecureIds = idsByCodes([
     'COOKIE_HOST_PREFIX_INVALID',
     'COOKIE_SECURE_PREFIX_INVALID',
 ]);
-const allAppSecIds = mergeIds(authIds, injectionIds, xssIds, ssrfIds, configIds, disclosureIds);
-const authAndCookieIds = mergeIds(authIds, cookieIds);
-const accessRestrictionIds = mergeIds(authIds, cookieIds, dirbrowseIds, disclosureIds);
-const cryptoPolicyIds = mergeIds(jwtIds, hstsIds, cookieSecureIds);
-const inputValidationIds = mergeIds(injectionIds, xssIds, ssrfIds);
-const outputValidationIds = mergeIds(injectionIds, xssIds);
-const infoLeakageIds = mergeIds(configIds, disclosureIds);
+export const allAppSecIds = mergeIds(authIds, injectionIds, xssIds, ssrfIds, configIds, disclosureIds);
+export const authAndCookieIds = mergeIds(authIds, cookieIds);
+export const accessRestrictionIds = mergeIds(authIds, cookieIds, dirbrowseIds, disclosureIds);
+export const cryptoPolicyIds = mergeIds(jwtIds, hstsIds, cookieSecureIds);
+export const inputValidationIds = mergeIds(injectionIds, xssIds, ssrfIds);
+export const outputValidationIds = mergeIds(injectionIds, xssIds);
+export const infoLeakageIds = mergeIds(configIds, disclosureIds);
 export const GDPR_COMPLIANCE = {
     [ComplianceCode.GDPR_A_10_1_1_DOCUMENTED_OPERATING_PROCEDURES]: {
         id: 1,

package/dist/compliances/helpers.js

@@ -1,4 +1,4 @@
-import { VULNERABILITY_REGISTRY } from '../index.js';
+import { VULNERABILITY_REGISTRY } from '../registry.js';
 // Lazy getter to avoid circular dependency issues at module load time
 const getAllVulnerabilities = () => Object.values(VULNERABILITY_REGISTRY);
 const uniqueSorted = (ids) => Array.from(new Set(ids)).sort((a, b) => a - b);

package/dist/compliances/hipaa.d.ts

@@ -1,2 +1,7 @@
 import { ComplianceRegistry } from '../types';
+export declare const allAppSecIds: number[];
+export declare const accessControlIds: number[];
+export declare const authAndCookieIds: number[];
+export declare const cryptoIds: number[];
+export declare const integrityIds: number[];
 export declare const HIPAA_COMPLIANCE: ComplianceRegistry;

package/dist/compliances/hipaa.js

@@ -25,11 +25,11 @@ const cookieSecureIds = idsByCodes([
     'COOKIE_HOST_PREFIX_INVALID',
     'COOKIE_SECURE_PREFIX_INVALID',
 ]);
-const allAppSecIds = mergeIds(authIds, injectionIds, xssIds, ssrfIds, configIds, disclosureIds);
-const accessControlIds = mergeIds(authIds, cookieIds, dirbrowseIds, disclosureIds);
-const authAndCookieIds = mergeIds(authIds, cookieIds);
-const cryptoIds = mergeIds(jwtIds, hstsIds, cookieSecureIds);
-const integrityIds = mergeIds(injectionIds, xssIds);
+export const allAppSecIds = mergeIds(authIds, injectionIds, xssIds, ssrfIds, configIds, disclosureIds);
+export const accessControlIds = mergeIds(authIds, cookieIds, dirbrowseIds, disclosureIds);
+export const authAndCookieIds = mergeIds(authIds, cookieIds);
+export const cryptoIds = mergeIds(jwtIds, hstsIds, cookieSecureIds);
+export const integrityIds = mergeIds(injectionIds, xssIds);
 export const HIPAA_COMPLIANCE = {
     [ComplianceCode.HIPAA_164_105_PROTECT_PRIVATE_HEALTH_INFO]: {
         id: 164,

package/dist/compliances/index.d.ts

@@ -3,3 +3,4 @@ export { HIPAA_COMPLIANCE } from './hipaa.js';
 export { GDPR_COMPLIANCE } from './gdpr.js';
 export { PCI_DSS_COMPLIANCE } from './pci-dss.js';
 export { SANS_TOP_25_COMPLIANCE } from './sans-top-25.js';
+export { COMPLIANCE_BY_VULNERABILITIES } from './compliance-by-vulnerabilities.js';

package/dist/compliances/index.js

@@ -3,3 +3,4 @@ export { HIPAA_COMPLIANCE } from './hipaa.js';
 export { GDPR_COMPLIANCE } from './gdpr.js';
 export { PCI_DSS_COMPLIANCE } from './pci-dss.js';
 export { SANS_TOP_25_COMPLIANCE } from './sans-top-25.js';
+export { COMPLIANCE_BY_VULNERABILITIES } from './compliance-by-vulnerabilities.js';

package/dist/compliances/owasp.d.ts

@@ -1,2 +1,8 @@
 import { ComplianceRegistry } from '../types';
+export declare const owaspA1Ids: number[];
+export declare const owaspA2Ids: number[];
+export declare const owaspA3Ids: number[];
+export declare const owaspA5Ids: number[];
+export declare const owaspA7Ids: number[];
+export declare const owaspA8Ids: number[];
 export declare const OWASP_COMPLIANCE: ComplianceRegistry;

package/dist/compliances/owasp.js

@@ -27,12 +27,12 @@ const cookieSecureIds = idsByCodes([
     'COOKIE_HOST_PREFIX_INVALID',
     'COOKIE_SECURE_PREFIX_INVALID',
 ]);
-const owaspA1Ids = mergeIds(accessControlIds, dirbrowseIds);
-const owaspA2Ids = mergeIds(jwtIds, hstsIds, cookieSecureIds);
-const owaspA3Ids = mergeIds(injectionIds, xssIds);
-const owaspA5Ids = mergeIds(configIds, disclosureIds);
-const owaspA7Ids = mergeIds(authIds, cookieIds);
-const owaspA8Ids = deserializationIds;
+export const owaspA1Ids = mergeIds(accessControlIds, dirbrowseIds);
+export const owaspA2Ids = mergeIds(jwtIds, hstsIds, cookieSecureIds);
+export const owaspA3Ids = mergeIds(injectionIds, xssIds);
+export const owaspA5Ids = mergeIds(configIds, disclosureIds);
+export const owaspA7Ids = mergeIds(authIds, cookieIds);
+export const owaspA8Ids = deserializationIds;
 export const OWASP_COMPLIANCE = {
     [ComplianceCode.OWASP_A1_BROKEN_ACCESS_CONTROL]: {
         id: 154,

package/dist/compliances/pci-dss.d.ts

@@ -1,2 +1,8 @@
 import { ComplianceRegistry } from '../types';
+export declare const allAppSecIds: number[];
+export declare const misconfigIds: number[];
+export declare const accessControlIds: number[];
+export declare const cryptoIds: number[];
+export declare const injectionAndXssIds: number[];
+export declare const authAndCookieIds: number[];
 export declare const PCI_DSS_COMPLIANCE: ComplianceRegistry;

package/dist/compliances/pci-dss.js

@@ -25,12 +25,12 @@ const cookieSecureIds = idsByCodes([
     'COOKIE_HOST_PREFIX_INVALID',
     'COOKIE_SECURE_PREFIX_INVALID',
 ]);
-const allAppSecIds = mergeIds(authIds, injectionIds, xssIds, ssrfIds, configIds, disclosureIds);
-const misconfigIds = mergeIds(configIds, disclosureIds);
-const accessControlIds = mergeIds(authIds, cookieIds, dirbrowseIds, disclosureIds);
-const cryptoIds = mergeIds(jwtIds, hstsIds, cookieSecureIds);
-const injectionAndXssIds = mergeIds(injectionIds, xssIds);
-const authAndCookieIds = mergeIds(authIds, cookieIds);
+export const allAppSecIds = mergeIds(authIds, injectionIds, xssIds, ssrfIds, configIds, disclosureIds);
+export const misconfigIds = mergeIds(configIds, disclosureIds);
+export const accessControlIds = mergeIds(authIds, cookieIds, dirbrowseIds, disclosureIds);
+export const cryptoIds = mergeIds(jwtIds, hstsIds, cookieSecureIds);
+export const injectionAndXssIds = mergeIds(injectionIds, xssIds);
+export const authAndCookieIds = mergeIds(authIds, cookieIds);
 export const PCI_DSS_COMPLIANCE = {
     [ComplianceCode.PCI_REQ_1_INSTALL_FIREWALL]: {
         id: 74,

package/dist/compliances/sans-top-25.d.ts

@@ -1,2 +1,14 @@
 import { ComplianceRegistry } from '../types';
+export declare const authIds: number[];
+export declare const injectionIds: number[];
+export declare const xssIds: number[];
+export declare const ssrfIds: number[];
+export declare const disclosureIds: number[];
+export declare const accessControlIds: number[];
+export declare const sqliIds: number[];
+export declare const cmdiIds: number[];
+export declare const sstiIds: number[];
+export declare const lfiIds: number[];
+export declare const deserializationIds: number[];
+export declare const inputValidationIds: number[];
 export declare const SANS_TOP_25_COMPLIANCE: ComplianceRegistry;

package/dist/compliances/sans-top-25.js

@@ -1,18 +1,18 @@
 import { ComplianceCode } from '../compliance-codes';
 import { ComplianceCategory } from '../types';
 import { idsByCategory, idsByCodePrefix, mergeIds } from './helpers.js';
-const authIds = idsByCategory('authentication');
-const injectionIds = idsByCategory('injection');
-const xssIds = idsByCategory('xss');
-const ssrfIds = idsByCategory('ssrf');
-const disclosureIds = idsByCategory('information_disclosure');
-const accessControlIds = idsByCodePrefix(['BAC_', 'MASSASSIGN_']);
-const sqliIds = idsByCodePrefix(['SQLI_']);
-const cmdiIds = idsByCodePrefix(['CMDI_']);
-const sstiIds = idsByCodePrefix(['SSTI_']);
-const lfiIds = idsByCodePrefix(['LFI_']);
-const deserializationIds = idsByCodePrefix(['DESER_']);
-const inputValidationIds = mergeIds(injectionIds, xssIds, ssrfIds);
+export const authIds = idsByCategory('authentication');
+export const injectionIds = idsByCategory('injection');
+export const xssIds = idsByCategory('xss');
+export const ssrfIds = idsByCategory('ssrf');
+export const disclosureIds = idsByCategory('information_disclosure');
+export const accessControlIds = idsByCodePrefix(['BAC_', 'MASSASSIGN_']);
+export const sqliIds = idsByCodePrefix(['SQLI_']);
+export const cmdiIds = idsByCodePrefix(['CMDI_']);
+export const sstiIds = idsByCodePrefix(['SSTI_']);
+export const lfiIds = idsByCodePrefix(['LFI_']);
+export const deserializationIds = idsByCodePrefix(['DESER_']);
+export const inputValidationIds = mergeIds(injectionIds, xssIds, ssrfIds);
 export const SANS_TOP_25_COMPLIANCE = {
     [ComplianceCode.SANS_TOP_25_CWE_79_XSS]: {
         id: 181,

package/dist/index.d.ts

@@ -5,6 +5,7 @@
  */
 import { VulnerabilityCode } from './error-codes.js';
 import type { VulnerabilityDefinition, VulnerabilityLookup, Severity, VulnerabilityCategory } from './types.js';
+import { VULNERABILITY_REGISTRY } from './registry.js';
 import { INJECTION_VULNERABILITIES } from './categories/injection.js';
 import { XSS_VULNERABILITIES } from './categories/xss.js';
 import { SSRF_VULNERABILITIES } from './categories/ssrf.js';
@@ -14,10 +15,6 @@ import { SENSITIVE_PATH_VULNERABILITIES } from './categories/sensitive-paths.js'
 import { CATEGORY_REGISTRY } from './category.js';
 import { SCANNER_REGISTRY } from './scanner.js';
 import { OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE } from './compliances/index.js';
-/**
- * Complete vulnerability registry combining all categories
- */
-export declare const VULNERABILITY_REGISTRY: Record<string, VulnerabilityDefinition>;
 /**
  * Get vulnerability definition by code
  */
@@ -48,7 +45,7 @@ export declare function getVulnerabilityCount(): number;
 export declare function createFinding(code: VulnerabilityCode | string, overrides?: Partial<VulnerabilityDefinition>): VulnerabilityDefinition | null;
 export { VulnerabilityCode } from './error-codes.js';
 export type { VulnerabilityDefinition, VulnerabilityLookup, CVSSProfile, CWEReference, OWASPReference, Severity, VulnerabilityCategory, } from './types.js';
-export { INJECTION_VULNERABILITIES, XSS_VULNERABILITIES, SSRF_VULNERABILITIES, AUTH_VULNERABILITIES, CONFIG_VULNERABILITIES, SENSITIVE_PATH_VULNERABILITIES, OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, CATEGORY_REGISTRY, SCANNER_REGISTRY, };
+export { INJECTION_VULNERABILITIES, XSS_VULNERABILITIES, SSRF_VULNERABILITIES, AUTH_VULNERABILITIES, CONFIG_VULNERABILITIES, SENSITIVE_PATH_VULNERABILITIES, VULNERABILITY_REGISTRY, OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, CATEGORY_REGISTRY, SCANNER_REGISTRY, };
 declare const _default: {
     VulnerabilityCode: typeof VulnerabilityCode;
     VULNERABILITY_REGISTRY: Record<string, VulnerabilityDefinition>;

package/dist/index.js

@@ -4,7 +4,7 @@
  * Exports all vulnerability codes, definitions, and lookup utilities
  */
 import { VulnerabilityCode } from './error-codes.js';
-// Import all category definitions
+import { VULNERABILITY_REGISTRY } from './registry.js';
 import { INJECTION_VULNERABILITIES } from './categories/injection.js';
 import { XSS_VULNERABILITIES } from './categories/xss.js';
 import { SSRF_VULNERABILITIES } from './categories/ssrf.js';
@@ -14,17 +14,6 @@ import { SENSITIVE_PATH_VULNERABILITIES } from './categories/sensitive-paths.js'
 import { CATEGORY_REGISTRY } from './category.js';
 import { SCANNER_REGISTRY } from './scanner.js';
 import { OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE } from './compliances/index.js';
-/**
- * Complete vulnerability registry combining all categories
- */
-export const VULNERABILITY_REGISTRY = {
-    ...INJECTION_VULNERABILITIES,
-    ...XSS_VULNERABILITIES,
-    ...SSRF_VULNERABILITIES,
-    ...AUTH_VULNERABILITIES,
-    ...CONFIG_VULNERABILITIES,
-    ...SENSITIVE_PATH_VULNERABILITIES,
-};
 /**
  * Get vulnerability definition by code
  */
@@ -81,7 +70,7 @@ export function createFinding(code, overrides) {
 // Re-export all types and enums
 export { VulnerabilityCode } from './error-codes.js';
 // Export category definitions for direct access
-export { INJECTION_VULNERABILITIES, XSS_VULNERABILITIES, SSRF_VULNERABILITIES, AUTH_VULNERABILITIES, CONFIG_VULNERABILITIES, SENSITIVE_PATH_VULNERABILITIES, OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, CATEGORY_REGISTRY, SCANNER_REGISTRY, };
+export { INJECTION_VULNERABILITIES, XSS_VULNERABILITIES, SSRF_VULNERABILITIES, AUTH_VULNERABILITIES, CONFIG_VULNERABILITIES, SENSITIVE_PATH_VULNERABILITIES, VULNERABILITY_REGISTRY, OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, CATEGORY_REGISTRY, SCANNER_REGISTRY, };
 export default {
     VulnerabilityCode,
     VULNERABILITY_REGISTRY,

package/dist/registry.d.ts

@@ -0,0 +1,6 @@
+import type { VulnerabilityDefinition } from './types.js';
+/**
+ * Complete vulnerability registry combining all categories.
+ * Kept in a standalone module to avoid circular imports with compliances.
+ */
+export declare const VULNERABILITY_REGISTRY: Record<string, VulnerabilityDefinition>;

package/dist/registry.js

@@ -0,0 +1,18 @@
+import { INJECTION_VULNERABILITIES } from './categories/injection.js';
+import { XSS_VULNERABILITIES } from './categories/xss.js';
+import { SSRF_VULNERABILITIES } from './categories/ssrf.js';
+import { AUTH_VULNERABILITIES } from './categories/authentication.js';
+import { CONFIG_VULNERABILITIES } from './categories/configuration.js';
+import { SENSITIVE_PATH_VULNERABILITIES } from './categories/sensitive-paths.js';
+/**
+ * Complete vulnerability registry combining all categories.
+ * Kept in a standalone module to avoid circular imports with compliances.
+ */
+export const VULNERABILITY_REGISTRY = {
+    ...INJECTION_VULNERABILITIES,
+    ...XSS_VULNERABILITIES,
+    ...SSRF_VULNERABILITIES,
+    ...AUTH_VULNERABILITIES,
+    ...CONFIG_VULNERABILITIES,
+    ...SENSITIVE_PATH_VULNERABILITIES,
+};

package/dist-cjs/compliances/compliance-by-vulnerabilities.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPLIANCE_BY_VULNERABILITIES = void 0;
+const gdpr_js_1 = require("./gdpr.js");
+const hipaa_js_1 = require("./hipaa.js");
+const owasp_js_1 = require("./owasp.js");
+const pci_dss_js_1 = require("./pci-dss.js");
+const sans_top_25_js_1 = require("./sans-top-25.js");
+exports.COMPLIANCE_BY_VULNERABILITIES = [
+    {
+        id: 3,
+        title: 'GDPR',
+        vulnerabilities: [...gdpr_js_1.accessRestrictionIds, ...gdpr_js_1.allAppSecIds, ...gdpr_js_1.authAndCookieIds, ...gdpr_js_1.cryptoPolicyIds, ...gdpr_js_1.infoLeakageIds, ...gdpr_js_1.inputValidationIds, ...gdpr_js_1.outputValidationIds]
+    },
+    {
+        id: 2,
+        title: 'HIPAA',
+        vulnerabilities: [hipaa_js_1.accessControlIds, ...hipaa_js_1.allAppSecIds, ...hipaa_js_1.authAndCookieIds, ...hipaa_js_1.cryptoIds, ...hipaa_js_1.integrityIds]
+    },
+    {
+        id: 1,
+        title: 'OWASP',
+        vulnerabilities: [...owasp_js_1.owaspA1Ids, ...owasp_js_1.owaspA2Ids, ...owasp_js_1.owaspA3Ids, ...owasp_js_1.owaspA5Ids, ...owasp_js_1.owaspA7Ids, ...owasp_js_1.owaspA8Ids]
+    },
+    {
+        id: 4,
+        title: 'PCI-DSS',
+        vulnerabilities: [...pci_dss_js_1.allAppSecIds, ...pci_dss_js_1.misconfigIds, ...pci_dss_js_1.accessControlIds, ...pci_dss_js_1.cryptoIds, ...pci_dss_js_1.injectionAndXssIds, ...pci_dss_js_1.authAndCookieIds]
+    },
+    {
+        id: 6,
+        title: 'SANS Top 25',
+        vulnerabilities: [...sans_top_25_js_1.authIds, ...sans_top_25_js_1.accessControlIds, ...sans_top_25_js_1.cmdiIds, ...sans_top_25_js_1.deserializationIds, ...sans_top_25_js_1.disclosureIds, ...sans_top_25_js_1.injectionIds, ...sans_top_25_js_1.lfiIds, ...sans_top_25_js_1.sqliIds, ...sans_top_25_js_1.ssrfIds, ...sans_top_25_js_1.sstiIds, ...sans_top_25_js_1.xssIds]
+    }
+];

package/dist-cjs/compliances/gdpr.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GDPR_COMPLIANCE = void 0;
+exports.GDPR_COMPLIANCE = exports.infoLeakageIds = exports.outputValidationIds = exports.inputValidationIds = exports.cryptoPolicyIds = exports.accessRestrictionIds = exports.authAndCookieIds = exports.allAppSecIds = void 0;
 const compliance_codes_1 = require("../compliance-codes");
 const types_1 = require("../types");
 const helpers_js_1 = require("./helpers.js");
@@ -28,13 +28,13 @@ const cookieSecureIds = (0, helpers_js_1.idsByCodes)([
     'COOKIE_HOST_PREFIX_INVALID',
     'COOKIE_SECURE_PREFIX_INVALID',
 ]);
-const allAppSecIds = (0, helpers_js_1.mergeIds)(authIds, injectionIds, xssIds, ssrfIds, configIds, disclosureIds);
-const authAndCookieIds = (0, helpers_js_1.mergeIds)(authIds, cookieIds);
-const accessRestrictionIds = (0, helpers_js_1.mergeIds)(authIds, cookieIds, dirbrowseIds, disclosureIds);
-const cryptoPolicyIds = (0, helpers_js_1.mergeIds)(jwtIds, hstsIds, cookieSecureIds);
-const inputValidationIds = (0, helpers_js_1.mergeIds)(injectionIds, xssIds, ssrfIds);
-const outputValidationIds = (0, helpers_js_1.mergeIds)(injectionIds, xssIds);
-const infoLeakageIds = (0, helpers_js_1.mergeIds)(configIds, disclosureIds);
+exports.allAppSecIds = (0, helpers_js_1.mergeIds)(authIds, injectionIds, xssIds, ssrfIds, configIds, disclosureIds);
+exports.authAndCookieIds = (0, helpers_js_1.mergeIds)(authIds, cookieIds);
+exports.accessRestrictionIds = (0, helpers_js_1.mergeIds)(authIds, cookieIds, dirbrowseIds, disclosureIds);
+exports.cryptoPolicyIds = (0, helpers_js_1.mergeIds)(jwtIds, hstsIds, cookieSecureIds);
+exports.inputValidationIds = (0, helpers_js_1.mergeIds)(injectionIds, xssIds, ssrfIds);
+exports.outputValidationIds = (0, helpers_js_1.mergeIds)(injectionIds, xssIds);
+exports.infoLeakageIds = (0, helpers_js_1.mergeIds)(configIds, disclosureIds);
 exports.GDPR_COMPLIANCE = {
     [compliance_codes_1.ComplianceCode.GDPR_A_10_1_1_DOCUMENTED_OPERATING_PROCEDURES]: {
         id: 1,
@@ -87,7 +87,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.10.3.2 System acceptance',
         description: 'Before fully using updated systems, ensure they meet security and performance standards through thorough testing.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: allAppSecIds,
+        relatedVulnerabilityIds: exports.allAppSecIds,
         isNotApplicable: false,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_11_2_3_USER_PASSWORD_MANAGEMENT]: {
@@ -96,7 +96,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.11.2.3 User Password Management',
         description: 'Manage password distribution securely through a formal process.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: authAndCookieIds,
+        relatedVulnerabilityIds: exports.authAndCookieIds,
         isNotApplicable: true,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_11_3_1_PASSWORD_USE]: {
@@ -105,7 +105,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.11.3.1 Password Use',
         description: 'Users must follow strong security practices when creating and using passwords.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: authAndCookieIds,
+        relatedVulnerabilityIds: exports.authAndCookieIds,
         isNotApplicable: true,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_11_4_4_REMOTE_DIAGNOSTIC_PORT_PROTECTION]: {
@@ -123,7 +123,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.11.5.3 Password Management System',
         description: 'Use an interactive system to manage passwords, ensuring they are strong and meet security standards.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: authAndCookieIds,
+        relatedVulnerabilityIds: exports.authAndCookieIds,
         isNotApplicable: true,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_11_5_4_USE_OF_SYSTEM_UTILITIES]: {
@@ -132,7 +132,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.11.5.4 Use of System Utilities',
         description: 'Restrict and control the use of utility programs that can bypass system or application security.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: accessRestrictionIds,
+        relatedVulnerabilityIds: exports.accessRestrictionIds,
         isNotApplicable: true,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_11_5_5_SESSION_TIMEOUT]: {
@@ -141,7 +141,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.11.5.5 Session Time-out',
         description: 'Automatically log users out after a period of inactivity to protect the system.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: authAndCookieIds,
+        relatedVulnerabilityIds: exports.authAndCookieIds,
         isNotApplicable: true,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_11_5_6_LIMITATION_CONNECTION_TIME]: {
@@ -150,7 +150,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.11.5.6 Limitation of Connection Time',
         description: 'Limit connection times, especially for high-risk applications, to enhance security.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: authAndCookieIds,
+        relatedVulnerabilityIds: exports.authAndCookieIds,
         isNotApplicable: true,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_11_6_1_INFORMATION_ACCESS_RESTRICTION]: {
@@ -159,7 +159,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.11.6.1 Information Access Restriction',
         description: 'Limit access to information and system functions based on the access control policy for users and support staff.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: accessRestrictionIds,
+        relatedVulnerabilityIds: exports.accessRestrictionIds,
         isNotApplicable: false,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_12_1_1_SECURITY_REQUIREMENTS_ANALYSIS]: {
@@ -177,7 +177,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.12.2.1 Input Data Validation',
         description: 'Validate all data entered into applications to ensure it\'s accurate and appropriate.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: inputValidationIds,
+        relatedVulnerabilityIds: exports.inputValidationIds,
         isNotApplicable: false,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_12_2_4_OUTPUT_DATA_VALIDATION]: {
@@ -186,7 +186,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.12.2.4 Output Data Validation',
         description: 'Validate the data output from applications to confirm that the processed information is correct and relevant.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: outputValidationIds,
+        relatedVulnerabilityIds: exports.outputValidationIds,
         isNotApplicable: false,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_12_3_1_POLICY_CRYPTOGRAPHIC_CONTROLS]: {
@@ -195,7 +195,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.12.3.1 Policy on the Use of Cryptographic Controls',
         description: 'Develop and implement a policy for using cryptographic methods to protect information.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: cryptoPolicyIds,
+        relatedVulnerabilityIds: exports.cryptoPolicyIds,
         isNotApplicable: false,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_12_3_2_KEY_MANAGEMENT]: {
@@ -204,7 +204,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.12.3.2 Key Management',
         description: 'Establish a key management system to support the organization\'s use of encryption and cryptographic techniques.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: cryptoPolicyIds,
+        relatedVulnerabilityIds: exports.cryptoPolicyIds,
         isNotApplicable: false,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_12_4_3_ACCESS_CONTROL_SOURCE_CODE]: {
@@ -213,7 +213,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.12.4.3 Access Control to Program Source Code',
         description: 'Restrict access to the source code of programs to authorized personnel only.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: accessRestrictionIds,
+        relatedVulnerabilityIds: exports.accessRestrictionIds,
         isNotApplicable: true,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_12_5_3_RESTRICTIONS_CHANGES_SOFTWARE]: {
@@ -222,7 +222,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.12.5.3 Restrictions on Changes to Software Packages',
         description: 'Limit modifications to software packages to necessary changes only, and tightly control all adjustments.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: accessRestrictionIds,
+        relatedVulnerabilityIds: exports.accessRestrictionIds,
         isNotApplicable: true,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_12_5_4_INFORMATION_LEAKAGE]: {
@@ -231,7 +231,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.12.5.4  Information Leakage',
         description: 'Prevent any opportunities that could lead to unauthorized information leakage.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: infoLeakageIds,
+        relatedVulnerabilityIds: exports.infoLeakageIds,
         isNotApplicable: true,
     },
     [compliance_codes_1.ComplianceCode.GDPR_A_12_5_5_OUTSOURCED_SOFTWARE_DEV]: {
@@ -249,7 +249,7 @@ exports.GDPR_COMPLIANCE = {
         title: 'A.12.6.1 Control of Technical Vulnerabilities',
         description: 'Stay informed about technical vulnerabilities in the systems being used, assess the organization\'s exposure to them, and take necessary actions to manage the associated risks.',
         complianceStandard: types_1.ComplianceCategory.GDPR,
-        relatedVulnerabilityIds: allAppSecIds,
+        relatedVulnerabilityIds: exports.allAppSecIds,
         isNotApplicable: true,
     },
 };

package/dist-cjs/compliances/helpers.js

@@ -1,16 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mergeIds = exports.idsByCodePrefix = exports.idsByCodes = exports.idsByCategory = exports.allVulnerabilityIds = void 0;
-const index_js_1 = require("../index.js");
+const registry_js_1 = require("../registry.js");
 // Lazy getter to avoid circular dependency issues at module load time
-const getAllVulnerabilities = () => Object.values(index_js_1.VULNERABILITY_REGISTRY);
+const getAllVulnerabilities = () => Object.values(registry_js_1.VULNERABILITY_REGISTRY);
 const uniqueSorted = (ids) => Array.from(new Set(ids)).sort((a, b) => a - b);
 const allVulnerabilityIds = () => uniqueSorted(getAllVulnerabilities().map(v => v.id));
 exports.allVulnerabilityIds = allVulnerabilityIds;
 const idsByCategory = (category) => uniqueSorted(getAllVulnerabilities().filter(v => v.category === category).map(v => v.id));
 exports.idsByCategory = idsByCategory;
 const idsByCodes = (codes) => uniqueSorted(codes
-    .map(code => index_js_1.VULNERABILITY_REGISTRY[code]?.id)
+    .map(code => registry_js_1.VULNERABILITY_REGISTRY[code]?.id)
     .filter((id) => typeof id === 'number'));
 exports.idsByCodes = idsByCodes;
 const idsByCodePrefix = (prefixes) => uniqueSorted(getAllVulnerabilities().filter(v => prefixes.some(prefix => v.code.startsWith(prefix)))