bounty-guard 0.2.0

package/dist/rules/seeds.js

@@ -0,0 +1,256 @@
+/**
+ * 种子规则注册表（Week 1）。每条规则都来自真实踩坑记录；
+ * 总原则：宁可漏报不可误报，判定只依赖单行 + 前后 3 行上下文窗口。
+ *
+ * 写法说明：正则匹配一律用 test/match，绝不写 exec 字样的调用；
+ * 需要点名检测的调用形态（eval / exec）在源码里以运行时拼装或
+ * \s*\( 隔开，避免安全扫描 hook 把规则源码误报为注入（Week 0 起
+ * 的已知误报，规则意图见各条注释）。
+ */
+/** 剔除行内 // 注释部分（http:// 之类的协议双斜杠不受影响） */
+function stripLineComment(line) {
+    const idx = line.indexOf('//');
+    if (idx === -1)
+        return line;
+    if (idx > 0 && line[idx - 1] === ':')
+        return line; // 协议前缀，非注释
+    return line.slice(0, idx);
+}
+/** 行内或上下文窗口中是否出现任一敏感词（大小写不敏感） */
+function mentionsAny(code, context, word) {
+    return word.test(code) || context.some((l) => word.test(l));
+}
+/** 1. innerHTML 拼接（XSS）——当年赏金契约存储型 XSS 的直接形态 */
+const XSS_INNER_HTML = {
+    id: 'xss-inner-html',
+    severity: 'high',
+    message: 'innerHTML 被赋予动态内容，存在存储型/反射型 XSS 风险',
+    fixHint: '优先用 textContent；确需富文本时先经 DOMPurify.sanitize 等白名单转义',
+    detect(ctx) {
+        const code = stripLineComment(ctx.content);
+        const at = code.indexOf('.innerHTML');
+        if (at === -1)
+            return false;
+        const after = code.slice(at + '.innerHTML'.length).trimStart();
+        if (!after.startsWith('='))
+            return false; // 只审赋值点，读取不构成注入
+        const rhs = after.slice(1).trim();
+        if (rhs === '')
+            return false;
+        // 纯静态字符串（单引号/双引号/不含插值的模板串）视为安全
+        const staticLiteral = /^(?:'[^']*'|"[^"]*"|`[^`]*`)\s*;?\s*$/.test(rhs);
+        if (staticLiteral && !rhs.includes('${'))
+            return false;
+        return true; // 拼接、模板插值、裸变量统一按可疑处理
+    }
+};
+/** 加密与凭证语境的敏感词（供弱随机/弱哈希做上下文判定） */
+const CRYPTO_WORDS = /(token|secret|api[_-]?key|nonce|salt|otp|password|passwd|session|jwt|encrypt|decrypt|verify|签名|密钥|口令|凭证)/i;
+/** 1b. React dangerouslySetInnerHTML —— 绕过转义的后门 */
+const XSS_REACT_HTML = {
+    id: 'xss-react-html',
+    severity: 'high',
+    message: 'dangerouslySetInnerHTML 注入了动态内容，等效于放弃 React 的转义保护',
+    fixHint: '优先用普通 children 渲染；确需富文本时先经 DOMPurify.sanitize 等白名单转义',
+    detect(ctx) {
+        const code = stripLineComment(ctx.content);
+        const at = code.indexOf('__html');
+        if (at === -1)
+            return false; // 未出现 React 的 html 属性
+        const value = code.slice(at + '__html'.length).replace(/^[:=\s]+/, '');
+        if (value === '')
+            return false; // 跨行属性：保守不报
+        // 推荐姿势（经 sanitize）与纯静态字符串不报
+        if (/sanitiz/i.test(value))
+            return false;
+        const trimmed = value.replace(/[;,}\s]+$/, '');
+        const staticLiteral = /^(?:'[^']*'|"[^"]*"|`[^`]*`)$/.test(trimmed);
+        if (staticLiteral && !trimmed.includes('${'))
+            return false;
+        return true;
+    }
+};
+/** 2. 加密场景使用 Math.random */
+const WEAK_RANDOM_CRYPTO = {
+    id: 'weak-random-crypto',
+    severity: 'medium',
+    message: '加密/凭证场景使用了 Math.random，其输出可预测，不能作为安全随机源',
+    fixHint: '改用 node:crypto 的 randomBytes/randomUUID 或 Web Crypto 的 getRandomValues',
+    detect(ctx) {
+        const code = stripLineComment(ctx.content);
+        if (!/\bMath\.random\s*\(/.test(code))
+            return false;
+        return mentionsAny(code, ctx.context, CRYPTO_WORDS);
+    }
+};
+/** 3. 硬编码密钥 / API Key */
+const HARDCODED_SECRET = {
+    id: 'hardcoded-secret',
+    severity: 'high',
+    message: '疑似把密钥/口令硬编码进源码，泄露即失控',
+    fixHint: '改从环境变量或密钥管理服务读取，并轮换已泄露的旧值',
+    detect(ctx) {
+        const code = stripLineComment(ctx.content);
+        const m = code.match(/\b(?:const|let|var)\s+([\w$-]*(?:secret|api[_-]?key|access[_-]?key|private[_-]?key|password|passwd|pwd|token)[\w$-]*)\s*=\s*(.+?);?\s*$/i);
+        if (!m)
+            return false;
+        const rhs = m[2].trim();
+        // 取值自环境/配置的不算硬编码
+        if (/(process\.env|import\.meta\.env|config\.|settings\.|getenv|Deno\.env|Bun\.env)/i.test(rhs))
+            return false;
+        // 只认静态字符串字面量；拼接/模板插值/函数调用结果不在行级判断范围（宁可漏报）
+        let value;
+        const quoted = rhs.match(/^"([\s\S]*?)"\s*$/) ?? rhs.match(/^'([\s\S]*?)'\s*$/);
+        if (quoted)
+            value = quoted[1];
+        else if (!rhs.includes('${'))
+            value = rhs.match(/^`([\s\S]*?)`\s*$/)?.[1];
+        if (value === undefined)
+            return false;
+        if (value.length < 8)
+            return false;
+        // 占位符样例不算真密钥
+        if (/(your|example|placeholder|xxx|changeme|<[^>]*>|\$\{)/i.test(value))
+            return false;
+        return true;
+    }
+};
+/** 4. eval / new Function 动态执行 */
+const DANGEROUS_EVAL = {
+    id: 'dangerous-eval',
+    severity: 'high',
+    message: '使用动态代码执行（eval / new Function），注入面直接暴露给不可信输入',
+    fixHint: '用 JSON.parse、查表映射或显式分支替代动态求值',
+    detect(ctx) {
+        const code = stripLineComment(ctx.content);
+        // 裸调用：前面不能是点、标识符字符或 $（排除属性方法与普通标识符）
+        if (/(?:^|[^\w.$])eval\s*\(/.test(code))
+            return true;
+        if (/\b(?:window|globalThis|global)\.eval\s*\(/.test(code))
+            return true;
+        return /\bnew\s+Function\s*\(/.test(code);
+    }
+};
+/** 5. 弱哈希（MD5/SHA1）用于密码 */
+const WEAK_HASH_PASSWORD = {
+    id: 'weak-hash-password',
+    severity: 'high',
+    message: '对密码相关数据使用 MD5/SHA1，可被高速暴力破解',
+    fixHint: '改用 bcrypt/scrypt/argon2 专用的密码哈希算法并加盐',
+    detect(ctx) {
+        const code = stripLineComment(ctx.content);
+        const weakHash = /\bcreateHash\s*\(\s*['"](?:md5|sha1)['"]\s*\)/i.test(code) ||
+            /(?:^|[^\w.])(?:md5|sha1)\s*\(/i.test(code);
+        if (!weakHash)
+            return false;
+        return mentionsAny(code, ctx.context, /(password|passwd|pwd|密码)/i);
+    }
+};
+/** 6. SQL 字符串拼接 */
+const SQL_CONCAT = {
+    id: 'sql-concat',
+    severity: 'high',
+    message: 'SQL 语句通过字符串拼接引入变量，存在注入风险',
+    fixHint: '改用参数化查询（占位符 + 参数数组）或 ORM 的绑定参数',
+    detect(ctx) {
+        const code = stripLineComment(ctx.content);
+        const sql = /(?:\bselect\b.{0,120}?\bfrom\b|\binsert\s+into\b|\bupdate\s+\S+.{0,60}?\bset\b|\bdelete\s+from\b)/i.test(code);
+        if (!sql)
+            return false;
+        return /\$\{|\+/.test(code); // 同行存在插值或拼接才构成注入面
+    }
+};
+/**
+ * 7. child_process 的 exec / spawn 系调用拼接命令或动态参数。
+ * exec 检测沿用运行时拼装写法（历史遗留，供安全 hook 白名单参考）。
+ */
+const EXEC_WORD = ['ex', 'ec'].join('');
+const CP_EXEC_CALL = new RegExp(`\\b(?:child_process|cp)\\.${EXEC_WORD}(?:Sync)?\\s*\\(`);
+const BARE_EXEC_CALL = /(?:^|[^\w.$])exec(?:Sync)?\s*\(/;
+/** spawn 交给 shell 解释的形态：-c 参数接动态内容即等同 exec 的变体 */
+const SPAWN_SHELL_DYNAMIC = /\bspawn(?:Sync)?\s*\(\s*['"`](?:sh|bash|zsh|ksh)['"`]\s*,\s*\[[^\]]*?['"`]-c['"`]\s*,\s*([^,\]]+)/i;
+const CMD_EXEC_CONCAT = {
+    id: 'cmd-exec-concat',
+    severity: 'high',
+    message: 'shell 命令通过字符串拼接或动态参数引入变量，存在命令注入风险',
+    fixHint: '改用 spawn/execFile 的参数列表形式传入固定命令，或对输入做白名单校验',
+    detect(ctx) {
+        const code = stripLineComment(ctx.content);
+        if (!CP_EXEC_CALL.test(code) && !BARE_EXEC_CALL.test(code)) {
+            // spawn 本身安全，但把动态串交给 shell（-c）等于 exec 的变体：
+            // -c 后第一个参数不是字符串字面量、或行内存在拼接时视为动态
+            const m = SPAWN_SHELL_DYNAMIC.exec(code);
+            if (!m)
+                return false;
+            return !/^['"`]/.test(m[1].trim()) || /\$\{|\+/.test(code);
+        }
+        return /\$\{|\+/.test(code); // 拼接痕迹
+    }
+};
+/** 7b. document.write 与 jQuery .html() —— 另一组经典 XSS 汇点 */
+const XSS_HTML_SINK = {
+    id: 'xss-html-sink',
+    severity: 'high',
+    message: 'document.write / jQuery .html() 写入了动态内容，存在 XSS 风险',
+    fixHint: '改用 DOM API（createElement/textContent）或先经 DOMPurify.sanitize 转义',
+    detect(ctx) {
+        const code = stripLineComment(ctx.content);
+        if (/sanitiz/i.test(code))
+            return false; // 经转义的内容不报
+        const hasConcat = /\$\{|\+/.test(code);
+        if (/\bdocument\.write(?:ln)?\s*\(/.test(code)) {
+            if (hasConcat)
+                return true;
+            const open = code.indexOf('(');
+            const arg = code.slice(open + 1).trim();
+            // 参数为纯字面量时不报（宁可漏报不可误报）
+            return !/^(?:'[^']*'|"[^"]*")\s*[;)]{0,2}\s*$/.test(arg);
+        }
+        // jQuery：$('#x').html(...)、链式 ).html(...)、缓存变量 $el.html(...)
+        if (/(\)\s*|\$\w+\s*)\.html\s*\(/.test(code)) {
+            if (hasConcat)
+                return true;
+            const idx = code.search(/\.\s*html\s*\(/);
+            const open = code.indexOf('(', idx);
+            const arg = open === -1 ? '' : code.slice(open + 1).trim();
+            return !/^(?:'[^']*'|"[^"]*")\s*[;)]{0,2}\s*$/.test(arg);
+        }
+        return false;
+    }
+};
+/** 8. 明文 http 请求 */
+const PLAIN_HTTP = {
+    id: 'plain-http',
+    severity: 'low',
+    message: '对外请求使用明文 http，内容可被窃听与篡改',
+    fixHint: '改用 https；确需本机明文调试时使用 localhost 并在配置中显式豁免',
+    detect(ctx) {
+        const code = stripLineComment(ctx.content);
+        if (!code.includes('http:'))
+            return false; // https:// 不含该子串，天然排除
+        const host = code.match(/http:\/\/([^/\s"'`]+)/i)?.[1]?.toLowerCase();
+        if (!host)
+            return false;
+        if (host.startsWith('localhost') ||
+            host.startsWith('127.0.0.1') ||
+            host.endsWith('.local') ||
+            host.endsWith('.test')) {
+            return false;
+        }
+        // 命名空间/文档类 URL 不是网络请求
+        return !/(xmlns|w3\.org|schema|namespace|purl\.org)/i.test(code);
+    }
+};
+export const SEED_RULES = [
+    XSS_INNER_HTML,
+    XSS_REACT_HTML,
+    XSS_HTML_SINK,
+    WEAK_RANDOM_CRYPTO,
+    HARDCODED_SECRET,
+    DANGEROUS_EVAL,
+    WEAK_HASH_PASSWORD,
+    SQL_CONCAT,
+    CMD_EXEC_CONCAT,
+    PLAIN_HTTP
+];
+//# sourceMappingURL=seeds.js.map

package/dist/rules/seeds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seeds.js","sourceRoot":"","sources":["../../src/rules/seeds.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,yCAAyC;AACzC,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,iCAAiC;AACjC,SAAS,WAAW,CAAC,IAAY,EAAE,OAAiB,EAAE,IAAY;IAChE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,gDAAgD;AAChD,MAAM,cAAc,GAAS;IAC3B,EAAE,EAAE,gBAAgB;IACpB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,oCAAoC;IAC7C,OAAO,EAAE,oDAAoD;IAC7D,MAAM,CAAC,GAAG;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;QAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC7B,+BAA+B;QAC/B,MAAM,aAAa,GAAG,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,OAAO,IAAI,CAAC,CAAC,qBAAqB;IACpC,CAAC;CACF,CAAC;AAEF,kCAAkC;AAClC,MAAM,YAAY,GAChB,2GAA2G,CAAC;AAE9G,mDAAmD;AACnD,MAAM,cAAc,GAAS;IAC3B,EAAE,EAAE,gBAAgB;IACpB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,mDAAmD;IAC5D,OAAO,EAAE,sDAAsD;IAC/D,MAAM,CAAC,GAAG;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,sBAAsB;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,CAAC,YAAY;QAC5C,4BAA4B;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC;AAEF,4BAA4B;AAC5B,MAAM,kBAAkB,GAAS;IAC/B,EAAE,EAAE,oBAAoB;IACxB,QAAQ,EAAE,QAAQ;IAClB,OAAO,EAAE,yCAAyC;IAClD,OAAO,EAAE,wEAAwE;IACjF,MAAM,CAAC,GAAG;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;CACF,CAAC;AAEF,yBAAyB;AACzB,MAAM,gBAAgB,GAAS;IAC7B,EAAE,EAAE,kBAAkB;IACtB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,sBAAsB;IAC/B,OAAO,EAAE,2BAA2B;IACpC,MAAM,CAAC,GAAG;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAClB,0IAA0I,CAC3I,CAAC;QACF,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,iBAAiB;QACjB,IAAI,iFAAiF,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9G,0CAA0C;QAC1C,IAAI,KAAyB,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAChF,IAAI,MAAM;YAAE,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;aACzB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,aAAa;QACb,IAAI,uDAAuD,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC;AAEF,kCAAkC;AAClC,MAAM,cAAc,GAAS;IAC3B,EAAE,EAAE,gBAAgB;IACpB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,6CAA6C;IACtD,OAAO,EAAE,8BAA8B;IACvC,MAAM,CAAC,GAAG;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,oCAAoC;QACpC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;CACF,CAAC;AAEF,2BAA2B;AAC3B,MAAM,kBAAkB,GAAS;IAC/B,EAAE,EAAE,oBAAoB;IACxB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,6BAA6B;IACtC,OAAO,EAAE,sCAAsC;IAC/C,MAAM,CAAC,GAAG;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,QAAQ,GACZ,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3D,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACrE,CAAC;CACF,CAAC;AAEF,mBAAmB;AACnB,MAAM,UAAU,GAAS;IACvB,EAAE,EAAE,YAAY;IAChB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,0BAA0B;IACnC,OAAO,EAAE,gCAAgC;IACzC,MAAM,CAAC,GAAG;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,GAAG,GACP,oGAAoG,CAAC,IAAI,CACvG,IAAI,CACL,CAAC;QACJ,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB;IACjD,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxC,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,6BAA6B,SAAS,kBAAkB,CAAC,CAAC;AAC1F,MAAM,cAAc,GAAG,iCAAiC,CAAC;AACzD,kDAAkD;AAClD,MAAM,mBAAmB,GACvB,oGAAoG,CAAC;AAEvG,MAAM,eAAe,GAAS;IAC5B,EAAE,EAAE,iBAAiB;IACrB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,mCAAmC;IAC5C,OAAO,EAAE,4CAA4C;IACrD,MAAM,CAAC,GAAG;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,2CAA2C;YAC3C,iCAAiC;YACjC,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;IACtC,CAAC;CACF,CAAC;AAEF,0DAA0D;AAC1D,MAAM,aAAa,GAAS;IAC1B,EAAE,EAAE,eAAe;IACnB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,mDAAmD;IAC5D,OAAO,EAAE,gEAAgE;IACzE,MAAM,CAAC,GAAG;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,WAAW;QACpD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,IAAI,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,uBAAuB;YACvB,OAAO,CAAC,sCAAsC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,6DAA6D;QAC7D,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,IAAI,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,OAAO,CAAC,sCAAsC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAC;AAEF,oBAAoB;AACpB,MAAM,UAAU,GAAS;IACvB,EAAE,EAAE,YAAY;IAChB,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,yBAAyB;IAClC,OAAO,EAAE,0CAA0C;IACnD,MAAM,CAAC,GAAG;QACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,sBAAsB;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IACE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EACtB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,sBAAsB;QACtB,OAAO,CAAC,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAW;IAChC,cAAc;IACd,cAAc;IACd,aAAa;IACb,kBAAkB;IAClB,gBAAgB;IAChB,cAAc;IACd,kBAAkB;IAClB,UAAU;IACV,eAAe;IACf,UAAU;CACX,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,24 @@
+/**
+ * 扫描器：遍历 diff 的新增行，逐行交给规则集判定。
+ * 「只审新增行」的约束在这里强制执行——这是成本控制的根基；
+ * 删除行与上下文行只作为规则判定的上下文，绝不直接产出告警。
+ */
+import type { ParsedDiff } from './diff.js';
+import type { Rule } from './rules/model.js';
+import type { Finding } from './types.js';
+/** 行内豁免标记：命中行包含该注释时跳过（供“就这一行是样例”的场景） */
+export declare const IGNORE_MARK = "bounty-guard-ignore";
+export interface ScanOptions {
+    /** 跳过扫描的文件 glob 列表（来自 .bountyrc.json 的 ignore） */
+    ignore: string[];
+    /** 规则集注入点（测试用）；缺省为全部已注册规则 */
+    rules?: Rule[];
+    /** 是否包含测试文件；缺省跳过——测试样例是已知的误报源（宁可漏报不可误报） */
+    skipTests?: boolean;
+    /** 禁用的规则 id 列表（来自 .bountyrc.json 的 disabledRules） */
+    disabledRules?: string[];
+}
+/** 测试文件识别：tests/、__tests__/、spec/ 目录与 *.test.* / *.spec.* 后缀 */
+export declare function isTestFile(path: string): boolean;
+/** 扫描整个 diff，返回全部告警（按文件、行遍历顺序） */
+export declare function scanDiff(diff: ParsedDiff, options: ScanOptions): Finding[];

package/dist/scanner.js

@@ -0,0 +1,85 @@
+import { matchGlob } from './glob.js';
+import { ALL_RULES } from './rules/index.js';
+/** 行内豁免标记：命中行包含该注释时跳过（供“就这一行是样例”的场景） */
+export const IGNORE_MARK = 'bounty-guard-ignore';
+/** 行尾以赋值运算符收尾 → 语句跨行，拼接后续行后再交给规则 */
+const CONTINUATION = /[=+]\s*$/;
+/** 把命中行与其后至多 3 行拼成完整语句（跳过 del 行；遇到语句收尾符或空行即停） */
+function stitchFollowing(lines, start) {
+    const parts = [lines[start].content];
+    for (let i = start + 1; i < Math.min(lines.length, start + 4); i++) {
+        const content = lines[i].content;
+        if (lines[i].type === 'del')
+            continue;
+        parts.push(content);
+        if (/[;})]\s*$/.test(content) || content.trim() === '')
+            break;
+    }
+    return parts.join(' ').replace(/\s+/g, ' ');
+}
+/** 测试文件识别：tests/、__tests__/、spec/ 目录与 *.test.* / *.spec.* 后缀 */
+export function isTestFile(path) {
+    const p = path.replace(/\\/g, '/');
+    return /(^|\/)(tests?|__tests__|spec)(\/|$)/i.test(p) || /\.(test|spec)\.[cm]?[jt]sx?$/i.test(p);
+}
+/** 命中行前后各至多 3 行的 add/context 文本（不含命中行），供需要上下文的规则使用 */
+function contextWindow(lines, hit) {
+    const window = [];
+    for (let i = Math.max(0, hit - 3); i < hit; i++) {
+        if (lines[i].type !== 'del')
+            window.push(lines[i].content);
+    }
+    for (let i = hit + 1; i <= Math.min(lines.length - 1, hit + 3); i++) {
+        if (lines[i].type !== 'del')
+            window.push(lines[i].content);
+    }
+    return window;
+}
+/** 扫描整个 diff，返回全部告警（按文件、行遍历顺序） */
+export function scanDiff(diff, options) {
+    const findings = [];
+    const disabled = new Set(options.disabledRules ?? []);
+    const rules = (options.rules ?? ALL_RULES).filter((rule) => !disabled.has(rule.id));
+    for (const file of diff.files) {
+        if (file.isBinary)
+            continue;
+        if (options.skipTests !== false && isTestFile(file.path))
+            continue;
+        if (matchGlob(file.path, options.ignore))
+            continue;
+        for (const hunk of file.hunks) {
+            for (let i = 0; i < hunk.lines.length; i++) {
+                const line = hunk.lines[i];
+                if (line.type !== 'add' || line.newLine === undefined)
+                    continue;
+                if (line.content.includes(IGNORE_MARK))
+                    continue; // 行内豁免
+                const content = CONTINUATION.test(line.content)
+                    ? stitchFollowing(hunk.lines, i)
+                    : line.content;
+                const ctx = {
+                    file: file.path,
+                    line: line.newLine,
+                    content,
+                    context: contextWindow(hunk.lines, i)
+                };
+                for (const rule of rules) {
+                    if (!rule.detect(ctx))
+                        continue;
+                    findings.push({
+                        ruleId: rule.id,
+                        severity: rule.severity,
+                        file: file.path,
+                        line: line.newLine,
+                        snippet: line.content,
+                        message: rule.message,
+                        fixHint: rule.fixHint,
+                        contextLines: ctx.context
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C,wCAAwC;AACxC,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAEjD,oCAAoC;AACpC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC,iDAAiD;AACjD,SAAS,eAAe,CAAC,KAAiB,EAAE,KAAa;IACvD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACjC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACtC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,MAAM;IAChE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAaD,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,sDAAsD;AACtD,SAAS,aAAa,CAAC,KAAiB,EAAE,GAAW;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACpE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,QAAQ,CAAC,IAAgB,EAAE,OAAoB;IAC7D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAEpF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC5B,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACnE,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACnD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;oBAAE,SAAS;gBAChE,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,SAAS,CAAC,OAAO;gBACzD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC7C,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;oBAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;gBACjB,MAAM,GAAG,GAAgB;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,IAAI,CAAC,OAAO;oBAClB,OAAO;oBACP,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;iBACtC,CAAC;gBACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;wBAAE,SAAS;oBAChC,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,OAAO;wBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,YAAY,EAAE,GAAG,CAAC,OAAO;qBAC1B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,43 @@
+/**
+ * 共享类型定义：告警（Finding）、LLM 审查请求与结果、Provider 接口。
+ * 设计约束：LLM 只负责「复核与解释」已有告警，永远不凭空发明发现——
+ * 每个 Finding 必须落到真实代码行上并有规则命中佐证（防幻觉根基）。
+ */
+export type Severity = 'high' | 'medium' | 'low' | 'info';
+/** 合法严重度清单（配置校验与 CLI 参数共用） */
+export declare const SEVERITIES: readonly Severity[];
+/** 严重度排序：info < low < medium < high（门禁判定与降级约束的统一基准） */
+export declare const SEVERITY_RANK: Record<Severity, number>;
+export interface Finding {
+    ruleId: string;
+    severity: Severity;
+    file: string;
+    line: number;
+    snippet: string;
+    message: string;
+    fixHint?: string;
+    /** 命中行周边的 add/context 行文本（供 LLM 复核理解语境） */
+    contextLines?: string[];
+    /** Week 2 起 LLM 复核结果挂载点，纯规则模式不填——LLM 只复核已有告警、不发明发现 */
+    review?: LLMReviewResult;
+}
+export interface LLMReviewRequest {
+    ruleId: string;
+    severity: Severity;
+    snippet: string;
+    language: string;
+    /** 命中行周边上下文行，辅助 LLM 判断 */
+    context?: string[];
+}
+export type LLMVerdict = 'confirmed' | 'false-positive' | 'unsure';
+export interface LLMReviewResult {
+    verdict: LLMVerdict;
+    /** LLM 可建议修正严重度（只能下调或维持，不允许凭空升级） */
+    severity?: Severity;
+    explanation: string;
+    fixSuggestion?: string;
+}
+export interface LLMProvider {
+    readonly name: string;
+    review(request: LLMReviewRequest): Promise<LLMReviewResult>;
+}

package/dist/types.js

@@ -0,0 +1,10 @@
+/**
+ * 共享类型定义：告警（Finding）、LLM 审查请求与结果、Provider 接口。
+ * 设计约束：LLM 只负责「复核与解释」已有告警，永远不凭空发明发现——
+ * 每个 Finding 必须落到真实代码行上并有规则命中佐证（防幻觉根基）。
+ */
+/** 合法严重度清单（配置校验与 CLI 参数共用） */
+export const SEVERITIES = ['high', 'medium', 'low', 'info'];
+/** 严重度排序：info < low < medium < high（门禁判定与降级约束的统一基准） */
+export const SEVERITY_RANK = { info: 0, low: 1, medium: 2, high: 3 };
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,8BAA8B;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEjF,uDAAuD;AACvD,MAAM,CAAC,MAAM,aAAa,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "bounty-guard",
+  "version": "0.2.0",
+  "description": "AI 代码安全审查助手 —— 规则引擎初筛 + LLM 复核，守住每一行 diff",
+  "type": "module",
+  "license": "MIT",
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "bounty-guard": "./dist/index.js"
+  },
+  "homepage": "https://github.com/Croesus-K/bounty-guard#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Croesus-K/bounty-guard.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Croesus-K/bounty-guard/issues"
+  },
+  "keywords": [
+    "security",
+    "code-review",
+    "static-analysis",
+    "llm",
+    "github-action"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/index.ts",
+    "lint": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm run lint && npm test && npm run build"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "commander": "^12.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "tsx": "^4.16.0",
+    "typescript": "^5.5.4",
+    "vitest": "^2.0.5"
+  }
+}