circle-ir 4.9.20 → 4.9.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/config-loader.js.map +1 -1
- package/dist/analysis/constant-propagation/evaluator.d.ts.map +1 -1
- package/dist/analysis/constant-propagation/evaluator.js.map +1 -1
- package/dist/analysis/constant-propagation/index.js.map +1 -1
- package/dist/analysis/constant-propagation/propagator.d.ts.map +1 -1
- package/dist/analysis/constant-propagation/propagator.js +3 -1
- package/dist/analysis/constant-propagation/propagator.js.map +1 -1
- package/dist/analysis/dfg-verifier.d.ts.map +1 -1
- package/dist/analysis/dfg-verifier.js.map +1 -1
- package/dist/analysis/dfg-walk.js.map +1 -1
- package/dist/analysis/findings.d.ts +1 -1
- package/dist/analysis/findings.d.ts.map +1 -1
- package/dist/analysis/findings.js +27 -1
- package/dist/analysis/findings.js.map +1 -1
- package/dist/analysis/interprocedural.js.map +1 -1
- package/dist/analysis/metrics/metric-runner.d.ts.map +1 -1
- package/dist/analysis/metrics/passes/cohesion-metrics-pass.d.ts.map +1 -1
- package/dist/analysis/metrics/passes/complexity-metrics-pass.d.ts.map +1 -1
- package/dist/analysis/metrics/passes/composite-metrics-pass.d.ts.map +1 -1
- package/dist/analysis/metrics/passes/coupling-metrics-pass.d.ts.map +1 -1
- package/dist/analysis/metrics/passes/data-flow-metrics-pass.d.ts.map +1 -1
- package/dist/analysis/metrics/passes/documentation-metrics-pass.d.ts.map +1 -1
- package/dist/analysis/metrics/passes/halstead-metrics-pass.d.ts.map +1 -1
- package/dist/analysis/metrics/passes/inheritance-metrics-pass.d.ts.map +1 -1
- package/dist/analysis/metrics/passes/size-metrics-pass.d.ts.map +1 -1
- package/dist/analysis/modelled-cwes.d.ts +35 -0
- package/dist/analysis/modelled-cwes.d.ts.map +1 -0
- package/dist/analysis/modelled-cwes.js +63 -0
- package/dist/analysis/modelled-cwes.js.map +1 -0
- package/dist/analysis/passes/blocking-main-thread-pass.d.ts +1 -1
- package/dist/analysis/passes/blocking-main-thread-pass.d.ts.map +1 -1
- package/dist/analysis/passes/broad-catch-pass.d.ts +1 -1
- package/dist/analysis/passes/broad-catch-pass.d.ts.map +1 -1
- package/dist/analysis/passes/cache-no-vary-pass.d.ts +1 -1
- package/dist/analysis/passes/cache-no-vary-pass.d.ts.map +1 -1
- package/dist/analysis/passes/circular-dependency-pass.d.ts.map +1 -1
- package/dist/analysis/passes/cleanup-verify-pass.d.ts +1 -1
- package/dist/analysis/passes/cleanup-verify-pass.d.ts.map +1 -1
- package/dist/analysis/passes/cleartext-credential-transport-pass.d.ts +1 -1
- package/dist/analysis/passes/cleartext-credential-transport-pass.d.ts.map +1 -1
- package/dist/analysis/passes/cli-main-reflection-suppress-pass.d.ts +1 -1
- package/dist/analysis/passes/cli-main-reflection-suppress-pass.d.ts.map +1 -1
- package/dist/analysis/passes/constant-propagation-pass.d.ts +1 -1
- package/dist/analysis/passes/constant-propagation-pass.d.ts.map +1 -1
- package/dist/analysis/passes/constant-propagation-pass.js.map +1 -1
- package/dist/analysis/passes/cross-file-pass.d.ts.map +1 -1
- package/dist/analysis/passes/cross-file-pass.js +1 -1
- package/dist/analysis/passes/cross-file-pass.js.map +1 -1
- package/dist/analysis/passes/csrf-protection-disabled-pass.d.ts +1 -1
- package/dist/analysis/passes/csrf-protection-disabled-pass.d.ts.map +1 -1
- package/dist/analysis/passes/dead-code-pass.d.ts +1 -1
- package/dist/analysis/passes/dead-code-pass.d.ts.map +1 -1
- package/dist/analysis/passes/deep-inheritance-pass.d.ts +1 -1
- package/dist/analysis/passes/deep-inheritance-pass.d.ts.map +1 -1
- package/dist/analysis/passes/dependency-fan-out-pass.d.ts +1 -1
- package/dist/analysis/passes/dependency-fan-out-pass.d.ts.map +1 -1
- package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts +1 -1
- package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts.map +1 -1
- package/dist/analysis/passes/deserialization-safety-gate-pass.js.map +1 -1
- package/dist/analysis/passes/double-close-pass.d.ts +1 -1
- package/dist/analysis/passes/double-close-pass.d.ts.map +1 -1
- package/dist/analysis/passes/excessive-allocation-pass.d.ts +1 -1
- package/dist/analysis/passes/excessive-allocation-pass.d.ts.map +1 -1
- package/dist/analysis/passes/feature-envy-pass.d.ts +1 -1
- package/dist/analysis/passes/feature-envy-pass.d.ts.map +1 -1
- package/dist/analysis/passes/god-class-pass.d.ts +1 -1
- package/dist/analysis/passes/god-class-pass.d.ts.map +1 -1
- package/dist/analysis/passes/infinite-loop-pass.d.ts +1 -1
- package/dist/analysis/passes/infinite-loop-pass.d.ts.map +1 -1
- package/dist/analysis/passes/info-disclosure-stacktrace-pass.d.ts +1 -1
- package/dist/analysis/passes/info-disclosure-stacktrace-pass.d.ts.map +1 -1
- package/dist/analysis/passes/insecure-cookie-pass.d.ts +1 -1
- package/dist/analysis/passes/insecure-cookie-pass.d.ts.map +1 -1
- package/dist/analysis/passes/insecure-deserialization-config-pass.d.ts +1 -1
- package/dist/analysis/passes/insecure-deserialization-config-pass.d.ts.map +1 -1
- package/dist/analysis/passes/interprocedural-pass.d.ts +1 -1
- package/dist/analysis/passes/interprocedural-pass.d.ts.map +1 -1
- package/dist/analysis/passes/jwt-verify-disabled-pass.d.ts +1 -1
- package/dist/analysis/passes/jwt-verify-disabled-pass.d.ts.map +1 -1
- package/dist/analysis/passes/language-sources-pass.d.ts +10 -10
- package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
- package/dist/analysis/passes/language-sources-pass.js +3 -8
- package/dist/analysis/passes/language-sources-pass.js.map +1 -1
- package/dist/analysis/passes/leaked-global-pass.d.ts +1 -1
- package/dist/analysis/passes/leaked-global-pass.d.ts.map +1 -1
- package/dist/analysis/passes/library-profile-sink-gate-pass.d.ts +2 -2
- package/dist/analysis/passes/library-profile-sink-gate-pass.d.ts.map +1 -1
- package/dist/analysis/passes/library-profile-source-gate-pass.d.ts +1 -1
- package/dist/analysis/passes/library-profile-source-gate-pass.d.ts.map +1 -1
- package/dist/analysis/passes/library-profile-xss-gate-pass.d.ts +1 -1
- package/dist/analysis/passes/library-profile-xss-gate-pass.d.ts.map +1 -1
- package/dist/analysis/passes/mass-assignment-pass.d.ts +1 -1
- package/dist/analysis/passes/mass-assignment-pass.d.ts.map +1 -1
- package/dist/analysis/passes/missing-await-pass.d.ts +1 -1
- package/dist/analysis/passes/missing-await-pass.d.ts.map +1 -1
- package/dist/analysis/passes/missing-guard-dom-pass.d.ts +1 -1
- package/dist/analysis/passes/missing-guard-dom-pass.d.ts.map +1 -1
- package/dist/analysis/passes/missing-override-pass.d.ts +1 -1
- package/dist/analysis/passes/missing-override-pass.d.ts.map +1 -1
- package/dist/analysis/passes/missing-public-doc-pass.d.ts +1 -1
- package/dist/analysis/passes/missing-public-doc-pass.d.ts.map +1 -1
- package/dist/analysis/passes/missing-sanitizer-gate-pass.d.ts +1 -1
- package/dist/analysis/passes/missing-sanitizer-gate-pass.d.ts.map +1 -1
- package/dist/analysis/passes/missing-stream-pass.d.ts +1 -1
- package/dist/analysis/passes/missing-stream-pass.d.ts.map +1 -1
- package/dist/analysis/passes/module-side-effect-pass.d.ts +1 -1
- package/dist/analysis/passes/module-side-effect-pass.d.ts.map +1 -1
- package/dist/analysis/passes/mybatis-annotation-sql-sink-pass.d.ts +1 -1
- package/dist/analysis/passes/mybatis-annotation-sql-sink-pass.d.ts.map +1 -1
- package/dist/analysis/passes/n-plus-one-pass.d.ts +1 -1
- package/dist/analysis/passes/n-plus-one-pass.d.ts.map +1 -1
- package/dist/analysis/passes/naming-convention-pass.d.ts +1 -1
- package/dist/analysis/passes/naming-convention-pass.d.ts.map +1 -1
- package/dist/analysis/passes/naming-convention-pass.js.map +1 -1
- package/dist/analysis/passes/null-deref-pass.d.ts +1 -1
- package/dist/analysis/passes/null-deref-pass.d.ts.map +1 -1
- package/dist/analysis/passes/orphan-module-pass.d.ts.map +1 -1
- package/dist/analysis/passes/plaintext-password-storage-pass.d.ts +1 -1
- package/dist/analysis/passes/plaintext-password-storage-pass.d.ts.map +1 -1
- package/dist/analysis/passes/prompt-injection-safety-gate-pass.d.ts +1 -1
- package/dist/analysis/passes/prompt-injection-safety-gate-pass.d.ts.map +1 -1
- package/dist/analysis/passes/python-receiver-taint-format-pass.d.ts +1 -1
- package/dist/analysis/passes/python-receiver-taint-format-pass.d.ts.map +1 -1
- package/dist/analysis/passes/react-inline-jsx-pass.d.ts +1 -1
- package/dist/analysis/passes/react-inline-jsx-pass.d.ts.map +1 -1
- package/dist/analysis/passes/redundant-loop-pass.d.ts +1 -1
- package/dist/analysis/passes/redundant-loop-pass.d.ts.map +1 -1
- package/dist/analysis/passes/resource-leak-pass.d.ts +1 -1
- package/dist/analysis/passes/resource-leak-pass.d.ts.map +1 -1
- package/dist/analysis/passes/scan-secrets-pass.d.ts +1 -1
- package/dist/analysis/passes/scan-secrets-pass.d.ts.map +1 -1
- package/dist/analysis/passes/security-headers-pass.d.ts +1 -1
- package/dist/analysis/passes/security-headers-pass.d.ts.map +1 -1
- package/dist/analysis/passes/security-headers-pass.js.map +1 -1
- package/dist/analysis/passes/serial-await-pass.d.ts +1 -1
- package/dist/analysis/passes/serial-await-pass.d.ts.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.d.ts +1 -1
- package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.js +1 -1
- package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
- package/dist/analysis/passes/sink-semantics-pass.d.ts +1 -1
- package/dist/analysis/passes/sink-semantics-pass.d.ts.map +1 -1
- package/dist/analysis/passes/source-semantics-pass.d.ts +1 -1
- package/dist/analysis/passes/source-semantics-pass.d.ts.map +1 -1
- package/dist/analysis/passes/speculative-prompt-param-source-pass.d.ts +1 -1
- package/dist/analysis/passes/speculative-prompt-param-source-pass.d.ts.map +1 -1
- package/dist/analysis/passes/speculative-prompt-param-source-pass.js.map +1 -1
- package/dist/analysis/passes/spring4shell-pass.d.ts +1 -1
- package/dist/analysis/passes/spring4shell-pass.d.ts.map +1 -1
- package/dist/analysis/passes/stale-doc-ref-pass.d.ts +1 -1
- package/dist/analysis/passes/stale-doc-ref-pass.d.ts.map +1 -1
- package/dist/analysis/passes/string-concat-loop-pass.d.ts +1 -1
- package/dist/analysis/passes/string-concat-loop-pass.d.ts.map +1 -1
- package/dist/analysis/passes/swallowed-exception-pass.d.ts +1 -1
- package/dist/analysis/passes/swallowed-exception-pass.d.ts.map +1 -1
- package/dist/analysis/passes/sync-io-async-pass.d.ts +1 -1
- package/dist/analysis/passes/sync-io-async-pass.d.ts.map +1 -1
- package/dist/analysis/passes/taint-matcher-pass.d.ts +1 -1
- package/dist/analysis/passes/taint-matcher-pass.d.ts.map +1 -1
- package/dist/analysis/passes/taint-propagation-pass.d.ts +1 -1
- package/dist/analysis/passes/taint-propagation-pass.d.ts.map +1 -1
- package/dist/analysis/passes/tls-verify-disabled-pass.d.ts +1 -1
- package/dist/analysis/passes/tls-verify-disabled-pass.d.ts.map +1 -1
- package/dist/analysis/passes/todo-in-prod-pass.d.ts +1 -1
- package/dist/analysis/passes/todo-in-prod-pass.d.ts.map +1 -1
- package/dist/analysis/passes/unbounded-collection-pass.d.ts +1 -1
- package/dist/analysis/passes/unbounded-collection-pass.d.ts.map +1 -1
- package/dist/analysis/passes/unchecked-return-pass.d.ts +1 -1
- package/dist/analysis/passes/unchecked-return-pass.d.ts.map +1 -1
- package/dist/analysis/passes/unhandled-exception-pass.d.ts +1 -1
- package/dist/analysis/passes/unhandled-exception-pass.d.ts.map +1 -1
- package/dist/analysis/passes/unhandled-exception-pass.js +4 -20
- package/dist/analysis/passes/unhandled-exception-pass.js.map +1 -1
- package/dist/analysis/passes/unrestricted-file-upload-pass.d.ts +1 -1
- package/dist/analysis/passes/unrestricted-file-upload-pass.d.ts.map +1 -1
- package/dist/analysis/passes/unused-interface-method-pass.d.ts +1 -1
- package/dist/analysis/passes/unused-interface-method-pass.d.ts.map +1 -1
- package/dist/analysis/passes/unused-variable-pass.d.ts +1 -1
- package/dist/analysis/passes/unused-variable-pass.d.ts.map +1 -1
- package/dist/analysis/passes/use-after-close-pass.d.ts +1 -1
- package/dist/analysis/passes/use-after-close-pass.d.ts.map +1 -1
- package/dist/analysis/passes/variable-shadowing-pass.d.ts +1 -1
- package/dist/analysis/passes/variable-shadowing-pass.d.ts.map +1 -1
- package/dist/analysis/passes/weak-crypto-pass.d.ts +1 -1
- package/dist/analysis/passes/weak-crypto-pass.d.ts.map +1 -1
- package/dist/analysis/passes/weak-hash-pass.d.ts +1 -1
- package/dist/analysis/passes/weak-hash-pass.d.ts.map +1 -1
- package/dist/analysis/passes/weak-password-encoding-pass.d.ts +1 -1
- package/dist/analysis/passes/weak-password-encoding-pass.d.ts.map +1 -1
- package/dist/analysis/passes/weak-password-hash-pass.d.ts +1 -1
- package/dist/analysis/passes/weak-password-hash-pass.d.ts.map +1 -1
- package/dist/analysis/passes/weak-random-pass.d.ts +1 -1
- package/dist/analysis/passes/weak-random-pass.d.ts.map +1 -1
- package/dist/analysis/passes/xml-entity-expansion-pass.d.ts +47 -4
- package/dist/analysis/passes/xml-entity-expansion-pass.d.ts.map +1 -1
- package/dist/analysis/passes/xml-entity-expansion-pass.js +139 -13
- package/dist/analysis/passes/xml-entity-expansion-pass.js.map +1 -1
- package/dist/analysis/path-finder.d.ts.map +1 -1
- package/dist/analysis/path-finder.js.map +1 -1
- package/dist/analysis/project-profile-transform.js.map +1 -1
- package/dist/analysis/require-entry-path.js.map +1 -1
- package/dist/analysis/sbom.js.map +1 -1
- package/dist/analysis/taint-matcher.js.map +1 -1
- package/dist/analyzer.d.ts.map +1 -1
- package/dist/analyzer.js +4 -0
- package/dist/analyzer.js.map +1 -1
- package/dist/browser/circle-ir.js +199 -62
- package/dist/browser.js.map +1 -1
- package/dist/core/circle-ir-core.cjs +94 -22
- package/dist/core/circle-ir-core.js +94 -22
- package/dist/core/extractors/cfg.js +2 -2
- package/dist/core/extractors/cfg.js.map +1 -1
- package/dist/core/extractors/dfg.js +1 -1
- package/dist/core/extractors/dfg.js.map +1 -1
- package/dist/core/extractors/runtime-registrations.js +2 -2
- package/dist/core/extractors/runtime-registrations.js.map +1 -1
- package/dist/core/extractors/types.js.map +1 -1
- package/dist/core/parser.d.ts.map +1 -1
- package/dist/core/parser.js +4 -0
- package/dist/core/parser.js.map +1 -1
- package/dist/graph/analysis-pass.d.ts.map +1 -1
- package/dist/graph/code-graph.d.ts.map +1 -1
- package/dist/graph/dominator-graph.d.ts.map +1 -1
- package/dist/graph/exception-flow-graph.d.ts.map +1 -1
- package/dist/graph/import-graph.d.ts.map +1 -1
- package/dist/graph/project-graph.d.ts.map +1 -1
- package/dist/graph/scope-graph.d.ts.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -0
- package/dist/index.js.map +1 -1
- package/dist/languages/plugins/base.d.ts.map +1 -1
- package/dist/languages/plugins/bash.d.ts +1 -1
- package/dist/languages/plugins/bash.d.ts.map +1 -1
- package/dist/languages/plugins/csharp.d.ts +1 -1
- package/dist/languages/plugins/csharp.d.ts.map +1 -1
- package/dist/languages/plugins/go.d.ts +1 -1
- package/dist/languages/plugins/go.d.ts.map +1 -1
- package/dist/languages/plugins/html.d.ts +1 -1
- package/dist/languages/plugins/html.d.ts.map +1 -1
- package/dist/languages/plugins/index.d.ts +8 -0
- package/dist/languages/plugins/index.d.ts.map +1 -1
- package/dist/languages/plugins/index.js +21 -9
- package/dist/languages/plugins/index.js.map +1 -1
- package/dist/languages/plugins/java.d.ts +1 -1
- package/dist/languages/plugins/java.d.ts.map +1 -1
- package/dist/languages/plugins/javascript.d.ts +1 -1
- package/dist/languages/plugins/javascript.d.ts.map +1 -1
- package/dist/languages/plugins/python.d.ts +1 -1
- package/dist/languages/plugins/python.d.ts.map +1 -1
- package/dist/languages/plugins/rust.d.ts +1 -1
- package/dist/languages/plugins/rust.d.ts.map +1 -1
- package/dist/languages/plugins/vue.d.ts +1 -1
- package/dist/languages/plugins/vue.d.ts.map +1 -1
- package/dist/resolution/cross-file.d.ts.map +1 -1
- package/dist/resolution/symbol-table.d.ts.map +1 -1
- package/dist/resolution/type-hierarchy.d.ts.map +1 -1
- package/dist/resolution/type-hierarchy.js.map +1 -1
- package/dist/types/index.d.ts +28 -0
- package/dist/types/index.d.ts.map +1 -1
- package/dist/utils/logger.d.ts.map +1 -1
- package/dist/wasm/web-tree-sitter.wasm +0 -0
- package/package.json +7 -7
|
@@ -17,7 +17,7 @@ export interface TaintPropagationPassResult {
|
|
|
17
17
|
}
|
|
18
18
|
export declare class TaintPropagationPass implements AnalysisPass<TaintPropagationPassResult> {
|
|
19
19
|
readonly name = "taint-propagation";
|
|
20
|
-
readonly category:
|
|
20
|
+
readonly category: 'security';
|
|
21
21
|
run(ctx: PassContext): TaintPropagationPassResult;
|
|
22
22
|
}
|
|
23
23
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"taint-propagation-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/taint-propagation-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAU9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,qBAAa,oBAAqB,YAAW,YAAY,CAAC,0BAA0B,CAAC;IACnF,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,0BAA0B;
|
|
1
|
+
{"version":3,"file":"taint-propagation-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/taint-propagation-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAU9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,qBAAa,oBAAqB,YAAW,YAAY,CAAC,0BAA0B,CAAC;IACnF,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,0BAA0B,CA2hBhD;CACF;AA6sBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA6FnE"}
|
|
@@ -43,7 +43,7 @@ export interface TlsVerifyDisabledResult {
|
|
|
43
43
|
}
|
|
44
44
|
export declare class TlsVerifyDisabledPass implements AnalysisPass<TlsVerifyDisabledResult> {
|
|
45
45
|
readonly name = "tls-verify-disabled";
|
|
46
|
-
readonly category:
|
|
46
|
+
readonly category: 'security';
|
|
47
47
|
run(ctx: PassContext): TlsVerifyDisabledResult;
|
|
48
48
|
private detectCall;
|
|
49
49
|
private detectSourceText;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tls-verify-disabled-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/tls-verify-disabled-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA6B9E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,qBAAsB,YAAW,YAAY,CAAC,uBAAuB,CAAC;IACjF,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,uBAAuB;
|
|
1
|
+
{"version":3,"file":"tls-verify-disabled-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/tls-verify-disabled-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA6B9E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,qBAAsB,YAAW,YAAY,CAAC,uBAAuB,CAAC;IACjF,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,uBAAuB,CA2D7C;IAED,OAAO,CAAC,UAAU;IA4ElB,OAAO,CAAC,gBAAgB;IAuExB,OAAO,CAAC,MAAM;CAiCf"}
|
|
@@ -23,7 +23,7 @@ export interface TodoInProdPassResult {
|
|
|
23
23
|
}
|
|
24
24
|
export declare class TodoInProdPass implements AnalysisPass<TodoInProdPassResult> {
|
|
25
25
|
readonly name = "todo-in-prod";
|
|
26
|
-
readonly category:
|
|
26
|
+
readonly category: 'maintainability';
|
|
27
27
|
run(ctx: PassContext): TodoInProdPassResult;
|
|
28
28
|
}
|
|
29
29
|
//# sourceMappingURL=todo-in-prod-pass.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"todo-in-prod-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/todo-in-prod-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAwB9E,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,oBAAoB,CAAC;IACvE,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,QAAQ,EAAG,iBAAiB,CAAU;IAE/C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,oBAAoB;
|
|
1
|
+
{"version":3,"file":"todo-in-prod-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/todo-in-prod-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAwB9E,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,oBAAoB,CAAC;IACvE,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,QAAQ,EAAG,iBAAiB,CAAU;IAE/C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,oBAAoB,CAsC1C;CACF"}
|
|
@@ -38,7 +38,7 @@ export interface UnboundedCollectionResult {
|
|
|
38
38
|
}
|
|
39
39
|
export declare class UnboundedCollectionPass implements AnalysisPass<UnboundedCollectionResult> {
|
|
40
40
|
readonly name = "unbounded-collection";
|
|
41
|
-
readonly category:
|
|
41
|
+
readonly category: 'performance';
|
|
42
42
|
private readonly skipPatterns;
|
|
43
43
|
constructor(options?: UnboundedCollectionOptions);
|
|
44
44
|
run(ctx: PassContext): UnboundedCollectionResult;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unbounded-collection-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unbounded-collection-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA+B9E;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,oBAAoB,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrG;AAED,qBAAa,uBAAwB,YAAW,YAAY,CAAC,yBAAyB,CAAC;IACrF,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;
|
|
1
|
+
{"version":3,"file":"unbounded-collection-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unbounded-collection-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA+B9E;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,oBAAoB,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrG;AAED,qBAAa,uBAAwB,YAAW,YAAY,CAAC,yBAAyB,CAAC;IACrF,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAE3C,YAAY,OAAO,CAAC,EAAE,0BAA0B,EAE/C;IAED,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,yBAAyB,CAwG/C;CACF"}
|
|
@@ -29,7 +29,7 @@ export interface UncheckedReturnResult {
|
|
|
29
29
|
}
|
|
30
30
|
export declare class UncheckedReturnPass implements AnalysisPass<UncheckedReturnResult> {
|
|
31
31
|
readonly name = "unchecked-return";
|
|
32
|
-
readonly category:
|
|
32
|
+
readonly category: 'reliability';
|
|
33
33
|
run(ctx: PassContext): UncheckedReturnResult;
|
|
34
34
|
}
|
|
35
35
|
//# sourceMappingURL=unchecked-return-pass.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unchecked-return-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unchecked-return-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyC9E,MAAM,WAAW,qBAAqB;IACpC,0DAA0D;IAC1D,cAAc,EAAE,KAAK,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC,CAAC;CACJ;AAED,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;
|
|
1
|
+
{"version":3,"file":"unchecked-return-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unchecked-return-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyC9E,MAAM,WAAW,qBAAqB;IACpC,0DAA0D;IAC1D,cAAc,EAAE,KAAK,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC,CAAC;CACJ;AAED,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB,CAsD3C;CACF"}
|
|
@@ -29,7 +29,7 @@ export interface UnhandledExceptionResult {
|
|
|
29
29
|
}
|
|
30
30
|
export declare class UnhandledExceptionPass implements AnalysisPass<UnhandledExceptionResult> {
|
|
31
31
|
readonly name = "unhandled-exception";
|
|
32
|
-
readonly category:
|
|
32
|
+
readonly category: 'reliability';
|
|
33
33
|
run(ctx: PassContext): UnhandledExceptionResult;
|
|
34
34
|
}
|
|
35
35
|
//# sourceMappingURL=unhandled-exception-pass.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unhandled-exception-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unhandled-exception-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA4H9E,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,qBAAa,sBAAuB,YAAW,YAAY,CAAC,wBAAwB,CAAC;IACnF,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,wBAAwB;
|
|
1
|
+
{"version":3,"file":"unhandled-exception-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unhandled-exception-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA4H9E,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,qBAAa,sBAAuB,YAAW,YAAY,CAAC,wBAAwB,CAAC;IACnF,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,wBAAwB,CA8G9C;CACF"}
|
|
@@ -72,7 +72,7 @@ function buildJsCoveredRanges(codeLines) {
|
|
|
72
72
|
const ranges = [];
|
|
73
73
|
// Stack of try-line numbers; push on `try {`, pop on matching `} catch`
|
|
74
74
|
const tryStack = [];
|
|
75
|
-
|
|
75
|
+
const braceDepthAtTry = [];
|
|
76
76
|
let braceDepth = 0;
|
|
77
77
|
for (let i = 0; i < codeLines.length; i++) {
|
|
78
78
|
const line = codeLines[i];
|
|
@@ -156,10 +156,6 @@ export class UnhandledExceptionPass {
|
|
|
156
156
|
}
|
|
157
157
|
// Collect catch-block start lines (to detect re-throws)
|
|
158
158
|
// Include both CFG-based and source-based catch lines
|
|
159
|
-
const catchStarts = new Set(exGraph.pairs.map(p => p.catchBlock.start_line));
|
|
160
|
-
for (const range of coveredRanges) {
|
|
161
|
-
catchStarts.add(range.end + 1); // catch line = end of covered range + 1
|
|
162
|
-
}
|
|
163
159
|
const throwRe = language === 'python' ? PYTHON_RAISE_RE : JS_THROW_RE;
|
|
164
160
|
const unhandled = [];
|
|
165
161
|
const reportedMethods = new Set();
|
|
@@ -167,22 +163,10 @@ export class UnhandledExceptionPass {
|
|
|
167
163
|
const lineText = codeLines[ln - 1] ?? '';
|
|
168
164
|
if (!throwRe.test(lineText))
|
|
169
165
|
continue;
|
|
170
|
-
// Skip re-throws inside catch blocks
|
|
166
|
+
// Skip re-throws inside catch blocks: the throw must follow a catch
|
|
167
|
+
// start *within the same method* — a bare line-number comparison would
|
|
168
|
+
// also match throws in later, unrelated methods.
|
|
171
169
|
let inCatch = false;
|
|
172
|
-
for (const cs of catchStarts) {
|
|
173
|
-
if (ln >= cs) {
|
|
174
|
-
inCatch = true;
|
|
175
|
-
break;
|
|
176
|
-
}
|
|
177
|
-
}
|
|
178
|
-
// More precise: only skip if ln is actually within a catch body
|
|
179
|
-
// (not just any line after a catch start). Use method boundary check.
|
|
180
|
-
// Simplified: if the line is >= any catch start within the same method, skip.
|
|
181
|
-
// Better heuristic: check if any pair has catchBlock.start_line <= ln
|
|
182
|
-
// and the throw is inside that catch body (ln <= methodEnd of that catch).
|
|
183
|
-
// We use a simple check: if the throw line is >= a catch start and
|
|
184
|
-
// the enclosing method contains the corresponding try, treat as re-throw.
|
|
185
|
-
inCatch = false;
|
|
186
170
|
for (const pair of exGraph.pairs) {
|
|
187
171
|
if (ln >= pair.catchBlock.start_line) {
|
|
188
172
|
// Check same method
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unhandled-exception-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/unhandled-exception-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,eAAe,GAAG,aAAa,CAAC;AAEtC;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAe,EAAE,SAAiB;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,sEAAsE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,sEAAsE;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,oDAAoD;QACpD,IACE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACtB,wGAAwG,CAAC,IAAI,CAAC,IAAI,CAAC,EACnH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,qEAAqE;QACrE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,MAAM,SAAS,GAAG,cAAc,CAAC;AACjC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,YAAY,GAAG,cAAc,CAAC;AAEpC;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,SAAmB,EACnB,QAAgB;IAEhB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB,CAC3B,SAAmB;IAEnB,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,wEAAwE;IACxE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,
|
|
1
|
+
{"version":3,"file":"unhandled-exception-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/unhandled-exception-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,eAAe,GAAG,aAAa,CAAC;AAEtC;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAe,EAAE,SAAiB;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,sEAAsE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,sEAAsE;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,oDAAoD;QACpD,IACE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACtB,wGAAwG,CAAC,IAAI,CAAC,IAAI,CAAC,EACnH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,qEAAqE;QACrE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,MAAM,SAAS,GAAG,cAAc,CAAC;AACjC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,YAAY,GAAG,cAAc,CAAC;AAEpC;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,SAAmB,EACnB,QAAgB;IAEhB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB,CAC3B,SAAmB;IAEnB,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,wEAAwE;IACxE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAE1B,oDAAoD;QACpD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,oDAAoD;YACpD,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;QAED,oDAAoD;QACpD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAG,CAAC;YAChC,eAAe,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,yDAAyD;QACpG,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACtB,IAAI,EAAE,KAAK,GAAG;gBAAE,UAAU,EAAE,CAAC;iBACxB,IAAI,EAAE,KAAK,GAAG;gBAAE,UAAU,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAC/B,SAAmB;IAEnB,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,MAAM,QAAQ,GAA4C,EAAE,CAAC;IAE7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,yCAAyC;YACzC,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACjC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;oBACxC,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAMD,MAAM,OAAO,sBAAsB;IACxB,IAAI,GAAG,qBAAqB,CAAC;IAC7B,QAAQ,GAAG,aAAsB,CAAC;IAE3C,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAEtC,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpF,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAE7D,yEAAyE;QACzE,8EAA8E;QAC9E,+FAA+F;QAC/F,MAAM,aAAa,GAA0C,EAAE,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC1D,aAAa,CAAC,IAAI,CAAC;oBACjB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;oBAC/B,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,KAAK,MAAM,KAAK,IAAI,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClE,uDAAuD;YACvD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAClD,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,sDAAsD;QACtD,MAAM,OAAO,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC;QAEtE,MAAM,SAAS,GAA0C,EAAE,CAAC;QAC5D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAE1C,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEtC,oEAAoE;YACpE,uEAAuE;YACvE,iDAAiD;YACjD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACjC,IAAI,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;oBACrC,oBAAoB;oBACpB,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;oBACtC,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;oBAC9D,IACE,MAAM;wBACN,MAAM;wBACN,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EACrD,CAAC;wBACD,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,OAAO;gBAAE,SAAS;YAEtB,wCAAwC;YACxC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACxE,IAAI,SAAS;gBAAE,SAAS;YAExB,kCAAkC;YAClC,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,UAAU;gBAC1B,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE;gBACjE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;YAEnB,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,SAAS;YAE7C,uEAAuE;YACvE,IAAI,iBAAiB,CAAC,SAAS,EAAE,EAAE,CAAC;gBAAE,SAAS;YAE/C,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAE/B,MAAM,UAAU,GAAG,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,aAAa,CAAC;YAC5D,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAEjD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,uBAAuB,IAAI,IAAI,EAAE,EAAE;gBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,0CAA0C,EAAE,SAAS,UAAU,mBAAmB;oBAClF,uDAAuD;gBACzD,IAAI;gBACJ,IAAI,EAAE,EAAE;gBACR,OAAO;gBACP,GAAG,EAAE,wFAAwF;gBAC7F,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;CACF"}
|
|
@@ -40,7 +40,7 @@ export interface UnrestrictedFileUploadResult {
|
|
|
40
40
|
}
|
|
41
41
|
export declare class UnrestrictedFileUploadPass implements AnalysisPass<UnrestrictedFileUploadResult> {
|
|
42
42
|
readonly name = "unrestricted-file-upload";
|
|
43
|
-
readonly category:
|
|
43
|
+
readonly category: 'security';
|
|
44
44
|
run(ctx: PassContext): UnrestrictedFileUploadResult;
|
|
45
45
|
private emit;
|
|
46
46
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unrestricted-file-upload-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unrestricted-file-upload-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AA4BD,qBAAa,0BAA2B,YAAW,YAAY,CAAC,4BAA4B,CAAC;IAC3F,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,4BAA4B;
|
|
1
|
+
{"version":3,"file":"unrestricted-file-upload-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unrestricted-file-upload-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AA4BD,qBAAa,0BAA2B,YAAW,YAAY,CAAC,4BAA4B,CAAC;IAC3F,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,4BAA4B,CAwIlD;IAED,OAAO,CAAC,IAAI;CAgCb"}
|
|
@@ -22,7 +22,7 @@ export interface UnusedInterfaceMethodResult {
|
|
|
22
22
|
}
|
|
23
23
|
export declare class UnusedInterfaceMethodPass implements AnalysisPass<UnusedInterfaceMethodResult> {
|
|
24
24
|
readonly name = "unused-interface-method";
|
|
25
|
-
readonly category:
|
|
25
|
+
readonly category: 'maintainability';
|
|
26
26
|
run(ctx: PassContext): UnusedInterfaceMethodResult;
|
|
27
27
|
}
|
|
28
28
|
//# sourceMappingURL=unused-interface-method-pass.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unused-interface-method-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unused-interface-method-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,yBAA0B,YAAW,YAAY,CAAC,2BAA2B,CAAC;IACzF,QAAQ,CAAC,IAAI,6BAA6B;IAC1C,QAAQ,CAAC,QAAQ,EAAG,iBAAiB,CAAU;IAE/C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,2BAA2B;
|
|
1
|
+
{"version":3,"file":"unused-interface-method-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unused-interface-method-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,yBAA0B,YAAW,YAAY,CAAC,2BAA2B,CAAC;IACzF,QAAQ,CAAC,IAAI,6BAA6B;IAC1C,QAAQ,CAAC,QAAQ,EAAG,iBAAiB,CAAU;IAE/C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,2BAA2B,CA4CjD;CACF"}
|
|
@@ -31,7 +31,7 @@ export interface UnusedVariableResult {
|
|
|
31
31
|
}
|
|
32
32
|
export declare class UnusedVariablePass implements AnalysisPass<UnusedVariableResult> {
|
|
33
33
|
readonly name = "unused-variable";
|
|
34
|
-
readonly category:
|
|
34
|
+
readonly category: 'reliability';
|
|
35
35
|
run(ctx: PassContext): UnusedVariableResult;
|
|
36
36
|
}
|
|
37
37
|
//# sourceMappingURL=unused-variable-pass.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unused-variable-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unused-variable-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAgB9E,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvD;AAED,qBAAa,kBAAmB,YAAW,YAAY,CAAC,oBAAoB,CAAC;IAC3E,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,oBAAoB;
|
|
1
|
+
{"version":3,"file":"unused-variable-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/unused-variable-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAgB9E,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvD;AAED,qBAAa,kBAAmB,YAAW,YAAY,CAAC,oBAAoB,CAAC;IAC3E,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,oBAAoB,CAwJ1C;CACF"}
|
|
@@ -25,7 +25,7 @@ export interface UseAfterCloseResult {
|
|
|
25
25
|
}
|
|
26
26
|
export declare class UseAfterClosePass implements AnalysisPass<UseAfterCloseResult> {
|
|
27
27
|
readonly name = "use-after-close";
|
|
28
|
-
readonly category:
|
|
28
|
+
readonly category: 'reliability';
|
|
29
29
|
run(ctx: PassContext): UseAfterCloseResult;
|
|
30
30
|
}
|
|
31
31
|
//# sourceMappingURL=use-after-close-pass.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"use-after-close-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/use-after-close-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAsB9E,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnG;AAED,qBAAa,iBAAkB,YAAW,YAAY,CAAC,mBAAmB,CAAC;IACzE,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,mBAAmB;
|
|
1
|
+
{"version":3,"file":"use-after-close-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/use-after-close-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAsB9E,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnG;AAED,qBAAa,iBAAkB,YAAW,YAAY,CAAC,mBAAmB,CAAC;IACzE,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,mBAAmB,CA4EzC;CACF"}
|
|
@@ -36,7 +36,7 @@ export interface VariableShadowingResult {
|
|
|
36
36
|
}
|
|
37
37
|
export declare class VariableShadowingPass implements AnalysisPass<VariableShadowingResult> {
|
|
38
38
|
readonly name = "variable-shadowing";
|
|
39
|
-
readonly category:
|
|
39
|
+
readonly category: 'reliability';
|
|
40
40
|
run(ctx: PassContext): VariableShadowingResult;
|
|
41
41
|
}
|
|
42
42
|
//# sourceMappingURL=variable-shadowing-pass.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"variable-shadowing-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/variable-shadowing-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAsD9E,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,KAAK,CAAC;QACb,iDAAiD;QACjD,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,6DAA6D;QAC7D,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;KAC/B,CAAC,CAAC;CACJ;AAED,qBAAa,qBAAsB,YAAW,YAAY,CAAC,uBAAuB,CAAC;IACjF,QAAQ,CAAC,IAAI,wBAAwB;IACrC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,uBAAuB;
|
|
1
|
+
{"version":3,"file":"variable-shadowing-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/variable-shadowing-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAsD9E,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,KAAK,CAAC;QACb,iDAAiD;QACjD,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,6DAA6D;QAC7D,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;KAC/B,CAAC,CAAC;CACJ;AAED,qBAAa,qBAAsB,YAAW,YAAY,CAAC,uBAAuB,CAAC;IACjF,QAAQ,CAAC,IAAI,wBAAwB;IACrC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,uBAAuB,CA8I7C;CACF"}
|
|
@@ -60,7 +60,7 @@ export interface WeakCryptoResult {
|
|
|
60
60
|
}
|
|
61
61
|
export declare class WeakCryptoPass implements AnalysisPass<WeakCryptoResult> {
|
|
62
62
|
readonly name = "weak-crypto";
|
|
63
|
-
readonly category:
|
|
63
|
+
readonly category: 'security';
|
|
64
64
|
run(ctx: PassContext): WeakCryptoResult;
|
|
65
65
|
private buildMessage;
|
|
66
66
|
private buildFix;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"weak-crypto-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-crypto-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyV9E,MAAM,MAAM,eAAe,GACvB,aAAa,GACb,UAAU,GACV,gBAAgB,GAChB,WAAW,GACX,eAAe,GACf,cAAc,CAAC;AAYnB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,eAAe,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAKD,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;
|
|
1
|
+
{"version":3,"file":"weak-crypto-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-crypto-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyV9E,MAAM,MAAM,eAAe,GACvB,aAAa,GACb,UAAU,GACV,gBAAgB,GAChB,WAAW,GACX,eAAe,GACf,cAAc,CAAC;AAYnB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,eAAe,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAKD,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,CAwEtC;IAED,OAAO,CAAC,YAAY;IA0CpB,OAAO,CAAC,QAAQ;IA2BhB,OAAO,CAAC,MAAM;CAkRf"}
|
|
@@ -38,7 +38,7 @@ export interface WeakHashResult {
|
|
|
38
38
|
}
|
|
39
39
|
export declare class WeakHashPass implements AnalysisPass<WeakHashResult> {
|
|
40
40
|
readonly name = "weak-hash";
|
|
41
|
-
readonly category:
|
|
41
|
+
readonly category: 'security';
|
|
42
42
|
run(ctx: PassContext): WeakHashResult;
|
|
43
43
|
private detect;
|
|
44
44
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"weak-hash-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-hash-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqE9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAwGD,qBAAa,YAAa,YAAW,YAAY,CAAC,cAAc,CAAC;IAC/D,QAAQ,CAAC,IAAI,eAAe;IAC5B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc;
|
|
1
|
+
{"version":3,"file":"weak-hash-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-hash-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqE9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAwGD,qBAAa,YAAa,YAAW,YAAY,CAAC,cAAc,CAAC;IAC/D,QAAQ,CAAC,IAAI,eAAe;IAC5B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAiDpC;IAED,OAAO,CAAC,MAAM;CAwFf"}
|
|
@@ -33,7 +33,7 @@ export interface WeakPasswordEncodingResult {
|
|
|
33
33
|
}
|
|
34
34
|
export declare class WeakPasswordEncodingPass implements AnalysisPass<WeakPasswordEncodingResult> {
|
|
35
35
|
readonly name = "weak-password-encoding";
|
|
36
|
-
readonly category:
|
|
36
|
+
readonly category: 'security';
|
|
37
37
|
run(ctx: PassContext): WeakPasswordEncodingResult;
|
|
38
38
|
private detect;
|
|
39
39
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"weak-password-encoding-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-password-encoding-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAO9E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAcD,qBAAa,wBAAyB,YAAW,YAAY,CAAC,0BAA0B,CAAC;IACvF,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,0BAA0B;
|
|
1
|
+
{"version":3,"file":"weak-password-encoding-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-password-encoding-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAO9E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAcD,qBAAa,wBAAyB,YAAW,YAAY,CAAC,0BAA0B,CAAC;IACvF,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,0BAA0B,CAkChD;IAED,OAAO,CAAC,MAAM;CAsFf"}
|
|
@@ -42,7 +42,7 @@ export interface WeakPasswordHashResult {
|
|
|
42
42
|
}
|
|
43
43
|
export declare class WeakPasswordHashPass implements AnalysisPass<WeakPasswordHashResult> {
|
|
44
44
|
readonly name = "weak-password-hash";
|
|
45
|
-
readonly category:
|
|
45
|
+
readonly category: 'security';
|
|
46
46
|
run(ctx: PassContext): WeakPasswordHashResult;
|
|
47
47
|
private detect;
|
|
48
48
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"weak-password-hash-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-password-hash-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAoB9E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,oBAAoB,GAAG,iBAAiB,GAAG,uBAAuB,CAAC;QACzE,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAsBD,qBAAa,oBAAqB,YAAW,YAAY,CAAC,sBAAsB,CAAC;IAC/E,QAAQ,CAAC,IAAI,wBAAwB;IACrC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,sBAAsB;
|
|
1
|
+
{"version":3,"file":"weak-password-hash-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-password-hash-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAoB9E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,oBAAoB,GAAG,iBAAiB,GAAG,uBAAuB,CAAC;QACzE,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAsBD,qBAAa,oBAAqB,YAAW,YAAY,CAAC,sBAAsB,CAAC;IAC/E,QAAQ,CAAC,IAAI,wBAAwB;IACrC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,sBAAsB,CAiD5C;IAED,OAAO,CAAC,MAAM;CAyIf"}
|
|
@@ -39,7 +39,7 @@ export interface WeakRandomResult {
|
|
|
39
39
|
}
|
|
40
40
|
export declare class WeakRandomPass implements AnalysisPass<WeakRandomResult> {
|
|
41
41
|
readonly name = "weak-random";
|
|
42
|
-
readonly category:
|
|
42
|
+
readonly category: 'security';
|
|
43
43
|
run(ctx: PassContext): WeakRandomResult;
|
|
44
44
|
private fixFor;
|
|
45
45
|
private detect;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"weak-random-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-random-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyB9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;
|
|
1
|
+
{"version":3,"file":"weak-random-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-random-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyB9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,CAiCtC;IAED,OAAO,CAAC,MAAM;IAqBd,OAAO,CAAC,MAAM;IAqEd;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;CAiB3B"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Pass: xml-entity-expansion (CWE-
|
|
2
|
+
* Pass: xml-entity-expansion (CWE-611 / CWE-776, category: security)
|
|
3
3
|
*
|
|
4
4
|
* Pattern pass — flags XML parser instantiation that does *not* disable
|
|
5
5
|
* DTD / external-entity processing in the same file. This covers:
|
|
@@ -14,8 +14,11 @@
|
|
|
14
14
|
* - `XMLInputFactory.newInstance()` (StAX)
|
|
15
15
|
* - `SchemaFactory.newInstance(...)`
|
|
16
16
|
* - `TransformerFactory.newInstance()`
|
|
17
|
-
* Safe-feature setters
|
|
18
|
-
*
|
|
17
|
+
* Safe-feature setters. Any of these in the file silences a factory
|
|
18
|
+
* UNLESS that factory is a local variable which provably never receives
|
|
19
|
+
* one (no hardening-capable setter on it in its method, never passed to
|
|
20
|
+
* another call, never returned) — so one hardened factory no longer masks
|
|
21
|
+
* an unhardened one beside it:
|
|
19
22
|
* - `setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`
|
|
20
23
|
* - `setFeature("http://xml.org/sax/features/external-general-entities", false)`
|
|
21
24
|
* - `setFeature("http://xml.org/sax/features/external-parameter-entities", false)`
|
|
@@ -35,6 +38,19 @@
|
|
|
35
38
|
* because billion-laughs is exploitable via any attacker-supplied entity
|
|
36
39
|
* file even when the parse() argument itself is trusted.
|
|
37
40
|
*
|
|
41
|
+
* CWE is assigned PER API, by which weakness the unhardened default actually
|
|
42
|
+
* leaves open (#426) — the same per-API reasoning `language-sources-pass`
|
|
43
|
+
* applies to Python's `xml.sax`:
|
|
44
|
+
* - Java JAXP factories -> CWE-611. External entity resolution is ON by
|
|
45
|
+
* default, while JAXP has shipped a default entity-expansion limit for
|
|
46
|
+
* years, so the live risk on a current JDK is external entities. Every
|
|
47
|
+
* hardening token this pass looks for is an external-entity control.
|
|
48
|
+
* - `lxml.etree` -> CWE-611. `resolve_entities` defaults on.
|
|
49
|
+
* - `xml.etree.ElementTree` -> CWE-776. It never resolves external entities;
|
|
50
|
+
* what remains is entity expansion.
|
|
51
|
+
* The JS variant of this rule (`libxmljs` `noent: true`) already reported
|
|
52
|
+
* CWE-611, so before this the rule disagreed with itself across languages.
|
|
53
|
+
*
|
|
38
54
|
* Issue: #86, Sprint 6.
|
|
39
55
|
*/
|
|
40
56
|
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
|
|
@@ -48,8 +64,35 @@ export interface XmlEntityExpansionResult {
|
|
|
48
64
|
}
|
|
49
65
|
export declare class XmlEntityExpansionPass implements AnalysisPass<XmlEntityExpansionResult> {
|
|
50
66
|
readonly name = "xml-entity-expansion";
|
|
51
|
-
readonly category:
|
|
67
|
+
readonly category: 'security';
|
|
52
68
|
run(ctx: PassContext): XmlEntityExpansionResult;
|
|
69
|
+
private methodRanges;
|
|
70
|
+
/**
|
|
71
|
+
* In a file that DOES contain hardening evidence, is the factory created on
|
|
72
|
+
* `line` one that provably never receives it?
|
|
73
|
+
*
|
|
74
|
+
* Deliberately one-sided. It answers true for exactly two shapes:
|
|
75
|
+
*
|
|
76
|
+
* 1. CHAINED — `Factory.newInstance().newDocumentBuilder()`, where the
|
|
77
|
+
* product is not handed on or returned either.
|
|
78
|
+
* 2. LOCAL — `Factory f = Factory.newInstance();` where the enclosing method
|
|
79
|
+
* builds a parser from `f`, never hands `f` to another call, and never
|
|
80
|
+
* returns it.
|
|
81
|
+
*
|
|
82
|
+
* and in both only when the enclosing method contains NO hardening-capable
|
|
83
|
+
* setter on ANY receiver, since hardening may land on the factory's product
|
|
84
|
+
* (`parser.getXMLReader().setFeature(…)`) rather than the factory.
|
|
85
|
+
*
|
|
86
|
+
* Every other shape — a field, a helper that takes the factory, a caller that
|
|
87
|
+
* receives it — may be hardened somewhere this check cannot see, so it keeps
|
|
88
|
+
* the previous file-level silence.
|
|
89
|
+
*
|
|
90
|
+
* A TransformerFactory additionally needs a `StreamSource` in its method: that
|
|
91
|
+
* is the input the transformer parses with its OWN parser. Fed a `DOMSource`
|
|
92
|
+
* it parses nothing, and fed a `SAXSource` it uses the reader it was given —
|
|
93
|
+
* whose hardening is that reader's business, not this factory's.
|
|
94
|
+
*/
|
|
95
|
+
private isProvablyUnhardened;
|
|
53
96
|
private detectJavaCall;
|
|
54
97
|
private detectPythonCall;
|
|
55
98
|
private fixForJava;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xml-entity-expansion-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/xml-entity-expansion-pass.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"xml-entity-expansion-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/xml-entity-expansion-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAwD9E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,sBACX,YAAW,YAAY,CAAC,wBAAwB,CAAC;IAEjD,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,wBAAwB,CAmG9C;IAED,OAAO,CAAC,YAAY;IAWpB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,oBAAoB;IA0D5B,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,gBAAgB;IAyBxB,OAAO,CAAC,UAAU;IA6BlB,OAAO,CAAC,YAAY;CAarB"}
|