bandit-cli 1.0.3 → 1.0.6

package/README.md

@@ -14,6 +14,7 @@
 - **Live Server Doctor**: Probes your running server for security headers, CORS wildcards, stack trace/error leakage, and payload crash handling.
 - **Environment Variable Auditor**: Compares active `.env` files against `.env.example` to flag missing keys, empty values, and placeholder defaults before you boot.
 - **Static Project Auditor**: Evaluates package setup, file organization, safety configs, and dependency scopes.
+- **Monorepo & Microservices Auto-Discovery**: Automatically scans your workspace for nested packages containing `package.json` and interactively prompts you to target specific services.
 
 ---
 
@@ -38,11 +39,13 @@ npx bandit-cli <command>
 ### 1. Interactive API Playfield
 
 Find and test routes in your codebase interactively:
+
 ```bash
 bandit api
 ```
 
 Or execute a direct API request immediately (acts like a local curl/HTTPie):
+
 ```bash
 bandit api GET /api/v1/products --url http://localhost:8080 --token "jwt-token"
 bandit api POST /api/v1/users --body '{"name":"Raj"}'

package/dist/cli/api.js

@@ -3,41 +3,278 @@ import path from "node:path";
 import fg from "fast-glob";
 import * as clack from "@clack/prompts";
 import chalk from "chalk";
+function normalizePath(filePath) {
+    let normalized = filePath.replace(/\\/g, "/");
+    const winDriveRegex = /^([A-Z]):\//;
+    const match = normalized.match(winDriveRegex);
+    if (match) {
+        normalized = normalized.replace(winDriveRegex, `${match[1].toLowerCase()}:/`);
+    }
+    return normalized;
+}
+function resolveImport(sourceFile, importPath, projectPath) {
+    let absolutePath = "";
+    if (importPath.startsWith("@/") || importPath.startsWith("~/")) {
+        const relativePart = importPath.slice(2);
+        absolutePath = path.resolve(projectPath, "src", relativePart);
+    }
+    else if (importPath.startsWith("src/")) {
+        absolutePath = path.resolve(projectPath, importPath);
+    }
+    else if (importPath.startsWith(".")) {
+        const sourceDir = path.dirname(sourceFile);
+        absolutePath = path.resolve(sourceDir, importPath);
+    }
+    else {
+        return null;
+    }
+    const extensions = [".ts", ".js", ".tsx", ".jsx"];
+    for (const ext of extensions) {
+        const fileWithExt = absolutePath + ext;
+        if (fs.existsSync(fileWithExt)) {
+            return normalizePath(fileWithExt);
+        }
+    }
+    if (fs.existsSync(absolutePath) && fs.statSync(absolutePath).isDirectory()) {
+        for (const ext of extensions) {
+            const indexFile = path.join(absolutePath, "index" + ext);
+            if (fs.existsSync(indexFile)) {
+                return normalizePath(indexFile);
+            }
+            const routerFile = path.join(absolutePath, "router" + ext);
+            if (fs.existsSync(routerFile)) {
+                return normalizePath(routerFile);
+            }
+        }
+    }
+    return null;
+}
+function parseImportNames(importClause) {
+    const names = [];
+    importClause = importClause.trim();
+    const nsMatch = importClause.match(/\*\s+as\s+([a-zA-Z0-9_$]+)/);
+    if (nsMatch) {
+        names.push({ localName: nsMatch[1] });
+        return names;
+    }
+    const destructureMatch = importClause.match(/\{([\s\S]*?)\}/);
+    if (destructureMatch) {
+        const content = destructureMatch[1];
+        const parts = content.split(",");
+        for (const part of parts) {
+            const trimmed = part.trim();
+            if (!trimmed)
+                continue;
+            const aliasMatch = trimmed.match(/([a-zA-Z0-9_$]+)\s+as\s+([a-zA-Z0-9_$]+)/);
+            if (aliasMatch) {
+                names.push({ localName: aliasMatch[2] });
+            }
+            else {
+                const nameMatch = trimmed.match(/^([a-zA-Z0-9_$]+)$/);
+                if (nameMatch) {
+                    names.push({ localName: nameMatch[1] });
+                }
+            }
+        }
+        const beforeDestruct = importClause.split("{")[0].trim().replace(/,$/, "").trim();
+        if (beforeDestruct && !beforeDestruct.startsWith("import")) {
+            names.push({ localName: beforeDestruct });
+        }
+        return names;
+    }
+    if (importClause && !importClause.includes("{") && !importClause.includes("*")) {
+        names.push({ localName: importClause });
+    }
+    return names;
+}
+function resolvePaths(pref, p) {
+    let combined = `${pref}/${p}`.replace(/\/+/g, "/");
+    if (!combined.startsWith("/"))
+        combined = "/" + combined;
+    if (combined.length > 1 && combined.endsWith("/")) {
+        combined = combined.slice(0, -1);
+    }
+    return combined;
+}
 // Scans files for common route definitions and mounts
-async function scanForRoutes(projectPath) {
+export async function scanForRoutes(projectPath) {
+    projectPath = normalizePath(projectPath);
     const routes = [];
-    const files = await fg(["src/**/*.{ts,js}", "*.{ts,js}", "routes/**/*.{ts,js}", "controllers/**/*.{ts,js}"], {
+    const files = (await fg(["src/**/*.{ts,js}", "*.{ts,js}", "routes/**/*.{ts,js}", "controllers/**/*.{ts,js}"], {
         cwd: projectPath,
         absolute: true,
         ignore: ["**/node_modules/**", "**/dist/**", "**/*.test.{ts,js}", "**/*.spec.{ts,js}"],
-    });
-    const prefixMap = new Map();
-    // Regex to detect router mounts, e.g. app.use('/api/v1/auth', authRouter) or router.use('/auth', authRouter)
-    // Group 3 matches the path prefix, Group 4 matches the router variable name
-    const mountPattern = /\b([a-zA-Z0-9_]+)\.(use|route|group)\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*([a-zA-Z0-9_]+)/gi;
-    // Read files first to construct prefixMap
+    })).map(normalizePath);
+    const importsByFile = new Map();
+    // Step 1: Scan imports & requires for all files
+    for (const file of files) {
+        const localToTarget = new Map();
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            const esImportRegex = /import\s+([\s\S]*?)\s+from\s+['"`]([^'"`]+)['"`]/g;
+            let match;
+            while ((match = esImportRegex.exec(content)) !== null) {
+                const importClause = match[1];
+                const importPath = match[2];
+                const targetFile = resolveImport(file, importPath, projectPath);
+                if (targetFile) {
+                    const names = parseImportNames(importClause);
+                    for (const name of names) {
+                        localToTarget.set(name.localName, targetFile);
+                    }
+                }
+            }
+            const requireRegex = /(?:const|let|var)\s+([\s\S]*?)\s*=\s*require\s*\(\s*['"`]([^'"`]+)['"`]\s*\)/g;
+            while ((match = requireRegex.exec(content)) !== null) {
+                const varClause = match[1];
+                const importPath = match[2];
+                const targetFile = resolveImport(file, importPath, projectPath);
+                if (targetFile) {
+                    const names = parseImportNames(varClause);
+                    for (const name of names) {
+                        localToTarget.set(name.localName, targetFile);
+                    }
+                }
+            }
+        }
+        catch { }
+        importsByFile.set(file, localToTarget);
+    }
+    // Step 2: Build Dependency Graph Nodes and Edges
+    const nodes = new Map();
+    const edges = [];
+    const ensureNode = (id, type, filePath, varName) => {
+        if (!nodes.has(id)) {
+            nodes.set(id, { id, type, filePath, varName, prefixes: new Set() });
+        }
+    };
+    // Create file nodes
+    for (const file of files) {
+        ensureNode(`file:${file}`, "file", file);
+    }
+    // Pre-populate route variable nodes from route declarations
+    const routeVarPattern = /\b([a-zA-Z0-9_]+)\.(get|post|put|delete|patch|options|head)\s*\(/gi;
+    for (const file of files) {
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            let match;
+            routeVarPattern.lastIndex = 0;
+            while ((match = routeVarPattern.exec(content)) !== null) {
+                const instanceName = match[1];
+                ensureNode(`var:${file}:${instanceName}`, "var", file, instanceName);
+            }
+        }
+        catch { }
+    }
+    const mountPattern = /\b([a-zA-Z0-9_]+)\.(use|route|group)\s*\(\s*(?:['"`]([^'"`]+)['"`]\s*,\s*)?(?:require\s*\(\s*['"`]([^'"`]+)['"`]\s*\)|([a-zA-Z0-9_]+))/gi;
     for (const file of files) {
         try {
             const content = fs.readFileSync(file, "utf-8");
             let match;
             mountPattern.lastIndex = 0;
             while ((match = mountPattern.exec(content)) !== null) {
-                const prefix = match[3];
-                const routerName = match[4];
-                if (prefix && routerName && routerName !== "express" && routerName !== "cors" && routerName !== "helmet") {
-                    prefixMap.set(routerName, prefix);
+                const parentVar = match[1];
+                const mountPath = match[3] || "/";
+                const inlineRequire = match[4];
+                const childVar = match[5];
+                const parentId = `var:${file}:${parentVar}`;
+                ensureNode(parentId, "var", file, parentVar);
+                if (inlineRequire) {
+                    const targetFile = resolveImport(file, inlineRequire, projectPath);
+                    if (targetFile) {
+                        const targetFileId = `file:${targetFile}`;
+                        ensureNode(targetFileId, "file", targetFile);
+                        edges.push({ from: parentId, to: targetFileId, path: mountPath });
+                    }
+                }
+                else if (childVar) {
+                    const childId = `var:${file}:${childVar}`;
+                    ensureNode(childId, "var", file, childVar);
+                    edges.push({ from: parentId, to: childId, path: mountPath });
+                    // Check if childVar is imported
+                    const targetFile = importsByFile.get(file)?.get(childVar);
+                    if (targetFile) {
+                        const targetFileId = `file:${targetFile}`;
+                        ensureNode(targetFileId, "file", targetFile);
+                        edges.push({ from: childId, to: targetFileId, path: "/" });
+                    }
                 }
             }
         }
         catch { }
     }
-    // Regex patterns
-    // 1. Generic Router paths: authRouter.post('/login', ...)
-    // Group 1 matches the router variable, Group 2 matches method, Group 3 matches endpoint path
+    // Step 3: Link file nodes to their root variables within that file
+    for (const file of files) {
+        const fileId = `file:${file}`;
+        // Find all variable nodes in this file
+        const varNodesInFile = Array.from(nodes.values()).filter((n) => n.type === "var" && n.filePath === file);
+        for (const vNode of varNodesInFile) {
+            // Is there an incoming edge to this variable from another variable/file in the same file?
+            const hasIncomingLocal = edges.some((e) => e.to === vNode.id && e.from.startsWith(`var:${file}:`));
+            if (!hasIncomingLocal) {
+                // It is a root variable in this file, link the file node to it
+                edges.push({ from: fileId, to: vNode.id, path: "/" });
+            }
+        }
+    }
+    // Step 4: Identify entry points and initialize their prefixes
+    // Entry points are file nodes that have no incoming edges from OTHER files
+    const fileIncomingFromOthers = new Set();
+    for (const edge of edges) {
+        if (edge.to.startsWith("file:")) {
+            const fromFile = nodes.get(edge.from)?.filePath;
+            const toFile = nodes.get(edge.to)?.filePath;
+            if (fromFile && toFile && fromFile !== toFile) {
+                fileIncomingFromOthers.add(edge.to);
+            }
+        }
+    }
+    for (const file of files) {
+        const fileId = `file:${file}`;
+        if (!fileIncomingFromOthers.has(fileId)) {
+            const fNode = nodes.get(fileId);
+            if (fNode) {
+                fNode.prefixes.add("/");
+            }
+        }
+    }
+    // Step 5: Propagate prefixes using BFS
+    const queue = [];
+    for (const node of nodes.values()) {
+        if (node.prefixes.size > 0) {
+            queue.push(node.id);
+        }
+    }
+    const inQueue = new Set(queue);
+    while (queue.length > 0) {
+        const currId = queue.shift();
+        inQueue.delete(currId);
+        const currNode = nodes.get(currId);
+        if (!currNode)
+            continue;
+        // Find outgoing edges
+        const outgoing = edges.filter((e) => e.from === currId);
+        for (const edge of outgoing) {
+            const targetNode = nodes.get(edge.to);
+            if (!targetNode)
+                continue;
+            let changed = false;
+            for (const pref of currNode.prefixes) {
+                const combined = resolvePaths(pref, edge.path);
+                if (!targetNode.prefixes.has(combined)) {
+                    targetNode.prefixes.add(combined);
+                    changed = true;
+                }
+            }
+            if (changed && !inQueue.has(edge.to)) {
+                queue.push(edge.to);
+                inQueue.add(edge.to);
+            }
+        }
+    }
+    // Step 6: Scan files for actual routes and use propagated prefixes
     const expressPattern = /\b([a-zA-Z0-9_]+)\.(get|post|put|delete|patch|options|head)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
-    // 2. NestJS decorators: @Get('/path')
     const nestPattern = /@(Get|Post|Put|Delete|Patch)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
-    // 3. NestJS controllers: @Controller('/prefix')
     const controllerPattern = /@Controller\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
     for (const file of files) {
         try {
@@ -58,21 +295,19 @@ async function scanForRoutes(projectPath) {
                 const instanceName = match[1];
                 const method = match[2].toUpperCase();
                 const subPath = match[3];
-                let rPath = subPath;
-                // If the instanceName has a registered mount prefix, prepend it!
-                if (prefixMap.has(instanceName)) {
-                    const prefix = prefixMap.get(instanceName).replace(/\/$/, "");
-                    rPath = `${prefix}/${subPath.replace(/^\//, "")}`;
+                const varNodeId = `var:${file}:${instanceName}`;
+                const varNode = nodes.get(varNodeId);
+                const targetPrefixes = (varNode && varNode.prefixes.size > 0)
+                    ? Array.from(varNode.prefixes)
+                    : ["/"];
+                for (const prefix of targetPrefixes) {
+                    const rPath = resolvePaths(prefix, subPath);
+                    routes.push({
+                        method,
+                        routePath: rPath,
+                        sourceFile: relativePath,
+                    });
                 }
-                // Clean up double slashes
-                rPath = rPath.replace(/\/+/g, "/");
-                if (!rPath.startsWith("/"))
-                    rPath = `/${rPath}`;
-                routes.push({
-                    method,
-                    routePath: rPath,
-                    sourceFile: relativePath,
-                });
             }
             // 2. NestJS
             nestPattern.lastIndex = 0;
@@ -304,7 +539,7 @@ export async function runApiCommand(methodOrPath = ".", routePath, opts = {}) {
         // Let the developer confirm and edit the path (highly convenient for prefix additions!)
         const editPath = await clack.text({
             message: "Confirm or edit the route path:",
-            defaultValue: selectedRoute.routePath,
+            initialValue: selectedRoute.routePath,
             placeholder: selectedRoute.routePath,
             validate: (v) => (!v || !v.startsWith("/") ? "Route path must start with a slash '/'" : undefined),
         });

package/dist/cli/bench.js

@@ -131,5 +131,17 @@ export async function runBenchCommand(targetUrl, opts) {
         console.log(`  ${chalk.gray(label)} : [${chalk.green(bar)}] ${count.toString().padStart(4)} (${percentage.toFixed(1)}%)`);
     }
     console.log(chalk.gray("──────────────────────────────────────────────────"));
+    try {
+        const { StudioDB } = await import("../studio/db.js");
+        const db = new StudioDB();
+        db.saveBenchmark({
+            targetUrl,
+            connections: opts.connections,
+            requests: opts.requests,
+            rps,
+            latency: { min, avg, max, p50, p90, p95, p99 },
+        });
+    }
+    catch { }
     clack.outro(chalk.bold.green("Benchmark complete!"));
 }

package/dist/cli/doctor.js

@@ -16,6 +16,26 @@ async function fetchWithTimeout(url, options = {}, timeoutMs = 4000) {
         throw err;
     }
 }
+function findSensitiveKeys(obj) {
+    const sensitiveKeywords = [
+        "password", "hashed_password", "salt", "secret", "ssn",
+        "credit_card", "creditcard", "passwd", "token", "auth_token"
+    ];
+    const found = [];
+    function search(current) {
+        if (!current || typeof current !== "object")
+            return;
+        for (const key of Object.keys(current)) {
+            const lowerKey = key.toLowerCase();
+            if (sensitiveKeywords.includes(lowerKey)) {
+                found.push(key);
+            }
+            search(current[key]);
+        }
+    }
+    search(obj);
+    return found;
+}
 export async function runDoctorCommand(targetUrl = "http://localhost:3000") {
     clack.intro(chalk.bold.bgBlue.white(" Bandit Live Server Doctor "));
     clack.log.info(`Target URL: ${chalk.bold.cyan(targetUrl)}`);
@@ -205,6 +225,155 @@ export async function runDoctorCommand(targetUrl = "http://localhost:3000") {
         }
     }
     s.stop("Oversized payload probe complete.");
+    // 4. Sensitive Data Leak Scanner
+    s.start("Scanning response for sensitive data leakage...");
+    try {
+        const rootText = await rootResponse.text();
+        let rootJson = null;
+        try {
+            rootJson = JSON.parse(rootText);
+        }
+        catch { }
+        if (rootJson) {
+            const leaked = findSensitiveKeys(rootJson);
+            if (leaked.length > 0) {
+                reports.push({
+                    title: "Sensitive Data Leak Check",
+                    status: "fail",
+                    details: `Root JSON response exposed sensitive field(s): [${leaked.join(", ")}]`,
+                    suggestion: "Remove database columns like password/salt/secret from response serializers/DTOs.",
+                });
+            }
+            else {
+                reports.push({
+                    title: "Sensitive Data Leak Check",
+                    status: "pass",
+                    details: "No sensitive fields leaked in root JSON response.",
+                });
+            }
+        }
+        else {
+            reports.push({
+                title: "Sensitive Data Leak Check",
+                status: "pass",
+                details: "Root response did not return JSON (no leaks scanned).",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "Sensitive Data Leak Check",
+            status: "warn",
+            details: `Failed to audit sensitive data leaks: ${err.message}`,
+        });
+    }
+    s.stop("Sensitive data scan complete.");
+    // 5. Active Security Penetration Probes (SQLi, NoSQLi, XSS)
+    s.start("Executing active security penetration probes...");
+    // SQLi Probe
+    try {
+        const sqliUrl = `${targetUrl.replace(/\/$/, "")}/?id=%27%20OR%20%271%27%3D%271`;
+        const sqliRes = await fetchWithTimeout(sqliUrl, {}, 3000);
+        const sqliText = await sqliRes.text();
+        const sqlErrors = [
+            "SQLITE_ERROR",
+            "syntax error near",
+            "PostgreSQL query failed",
+            "mysql server version",
+            "MariaDB server version",
+            "You have an error in your SQL syntax",
+            "pg_query",
+        ];
+        const leakedSqlError = sqlErrors.find(err => sqliText.toLowerCase().includes(err.toLowerCase()));
+        if (leakedSqlError) {
+            reports.push({
+                title: "SQL Injection (SQLi) Vulnerability Probe",
+                status: "fail",
+                details: `Server exposed SQL error token [${leakedSqlError}] when queried with SQL injection payload.`,
+                suggestion: "Use parameterized queries or ORMs (Prisma/Drizzle) and never concatenate raw inputs into SQL.",
+            });
+        }
+        else {
+            reports.push({
+                title: "SQL Injection (SQLi) Vulnerability Probe",
+                status: "pass",
+                details: "No raw SQL exceptions leaked in response to injection payload.",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "SQL Injection (SQLi) Vulnerability Probe",
+            status: "warn",
+            details: `Failed to execute SQLi probe: ${err.message}`,
+        });
+    }
+    // XSS Probe
+    try {
+        const xssPayload = "<script>alert(1)</script>";
+        const xssUrl = `${targetUrl.replace(/\/$/, "")}/?search=${encodeURIComponent(xssPayload)}`;
+        const xssRes = await fetchWithTimeout(xssUrl, {}, 3000);
+        const xssText = await xssRes.text();
+        if (xssRes.ok && xssText.includes(xssPayload)) {
+            reports.push({
+                title: "Cross-Site Scripting (XSS) Vulnerability Probe",
+                status: "fail",
+                details: "Server reflected unescaped HTML script tags in the response body.",
+                suggestion: "Sanitize user inputs and HTML-encode reflected outputs to prevent script execution.",
+            });
+        }
+        else {
+            reports.push({
+                title: "Cross-Site Scripting (XSS) Vulnerability Probe",
+                status: "pass",
+                details: "Input reflected HTML script tags are properly escaped or omitted by the server.",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "Cross-Site Scripting (XSS) Vulnerability Probe",
+            status: "warn",
+            details: `Failed to execute XSS probe: ${err.message}`,
+        });
+    }
+    // NoSQLi Probe
+    try {
+        const nosqliUrl = `${targetUrl.replace(/\/$/, "")}/?username[%24ne]=admin`;
+        const nosqliRes = await fetchWithTimeout(nosqliUrl, {}, 3000);
+        const nosqliText = await nosqliRes.text();
+        const nosqlErrors = [
+            "MongoError",
+            "MongoServerError",
+            "CastError",
+            "ObjectParameterError",
+            "MongooseError",
+        ];
+        const leakedNoSqlError = nosqlErrors.find(err => nosqliText.toLowerCase().includes(err.toLowerCase()));
+        if (leakedNoSqlError) {
+            reports.push({
+                title: "NoSQL Injection Vulnerability Probe",
+                status: "fail",
+                details: `Server exposed NoSQL error token [${leakedNoSqlError}] in response to query parameters.`,
+                suggestion: "Sanitize input parameters and sanitize mongo operator prefixes ($) using tools like 'mongo-sanitize'.",
+            });
+        }
+        else {
+            reports.push({
+                title: "NoSQL Injection Vulnerability Probe",
+                status: "pass",
+                details: "No NoSQL database exceptions leaked in response to query payload.",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "NoSQL Injection Vulnerability Probe",
+            status: "warn",
+            details: `Failed to execute NoSQLi probe: ${err.message}`,
+        });
+    }
+    s.stop("Active penetration probes complete.");
     // Print results
     console.log("\n" + chalk.bold("Diagnostic Results:"));
     for (const report of reports) {
@@ -227,5 +396,11 @@ export async function runDoctorCommand(targetUrl = "http://localhost:3000") {
         }
         console.log("");
     }
+    try {
+        const { StudioDB } = await import("../studio/db.js");
+        const db = new StudioDB();
+        db.saveAudit(reports);
+    }
+    catch { }
     clack.outro(chalk.bold.green("Doctor diagnostic scan completed."));
 }