code-auditor-mcp 3.4.11 → 3.4.13

package/dist/analyzers/provenance.d.ts

@@ -25,7 +25,26 @@ export declare const DB_PACKAGES: ReadonlySet<string>;
 export declare const VALIDATOR_PACKAGES: ReadonlySet<string>;
 /** Known DB type names — spec R1.1 (propagation rule 8) */
 export declare const DB_TYPES: ReadonlySet<string>;
-/** DB call methods — the fixed API surface (language-invariant) */
+/**
+ * DB call methods — the fixed API surface (language-invariant).
+ *
+ * Spec 33 Item 11 FP category 5: the bare-identifier hybrid fallback in
+ * `isDBProvenanced` treated any `get(...)` / `each(...)` / `values(...)` call
+ * as a DB query, flagging lodash-style object accessors (e.g.
+ * `@directus/utils`'s `get(item, ...)`) as sql-injection. Those three names
+ * are also common non-DB methods (lodash `get`, jQuery/iterator
+ * `each`, Map/WebSocket `.values()`), so they are removed from the fallback —
+ * mirroring the `get`/`each` trim in CHANGELOG 3.4.9 (DB_CALL_METHOD_NAMES).
+ *
+ * `query` is deliberately RETAINED: it is a genuine query-execution method on
+ * mysql2, pg, node-postgres, D1 and Planetscale (`.query(...)`), and the
+ * spec-19 data-access fixtures exercise it as a canonical DB entry point.
+ * Removing it would turn real SQL-injection positives into false negatives.
+ *
+ * `raw` is deliberately retained: it is a genuine raw-execution method on
+ * D1 prepared statements, Knex, and Kysely, and the Item-6 taint-tracking
+ * fixtures exercise it as the canonical raw-SQL entry point.
+ */
 export declare const DB_CALL_METHODS: ReadonlySet<string>;
 /** ORM method patterns — fixed API surface for ORM recognition (Spec 21 R1) */
 export declare const ORM_METHODS: ReadonlySet<string>;
@@ -62,11 +81,17 @@ export interface InferredReceiverSet {
  *
  * An import like `import Database from 'better-sqlite3'` produces
  * `Database` as DB-provenanced with reason "package".
+ * @param adapter
+ * @param ast
+ * @returns
  */
 export declare function extractDBProvenancedImports(ast: AST, adapter: LanguageAdapter): Map<string, ProvenanceEvidence>;
 /**
  * Extract all validator-provenanced identifiers from a file's imports.
  * Same pattern as extractDBProvenancedImports but for validator packages.
+ * @param adapter
+ * @param ast
+ * @returns
  */
 export declare function extractValidatorProvenancedImports(ast: AST, adapter: LanguageAdapter): Map<string, ProvenanceEvidence>;
 /**
@@ -82,6 +107,11 @@ export declare function extractValidatorProvenancedImports(ast: AST, adapter: La
  *   6. default parameter with DB value
  *   7. class field initialized with DB value
  *   8. type annotation with known DB type
+ * @param adapter
+ * @param ast
+ * @param seedMap
+ * @param sourceCode
+ * @returns
  */
 export declare function propagateProvenance(ast: AST, adapter: LanguageAdapter, sourceCode: string, seedMap: Map<string, ProvenanceEvidence>): Map<string, ProvenanceEvidence>;
 export interface BuildProvenanceContextOptions {
@@ -90,6 +120,16 @@ export interface BuildProvenanceContextOptions {
     dbReceiverNames?: string[];
     dbBindingNames?: string[];
     dbCallMethods?: string[];
+    /**
+     * Known DB wrapper function names — e.g. d1Query, d1Exec.
+     * These are project-specific functions that wrap D1/DB API calls
+     * (e.g. function d1Query(sql) { return d1.prepare(sql).all(); }).
+     * When imported from a local module (not a known DB package), provenance
+     * can't trace through the import chain.  These names provide a hybrid-mode
+     * fallback: any call to an identifier matching this list is treated as
+     * DB-provenanced.
+     */
+    dbWrapperNames?: string[];
     /** Validator package list override (defaults to VALIDATOR_PACKAGES) */
     validatorPackageList?: string[];
 }
@@ -98,8 +138,25 @@ export interface BuildProvenanceContextOptions {
  *
  * This is the main entry point — call once per file before analysis.
  * Combines import extraction, propagation, and mode-based fallback.
+ * @param adapter
+ * @param ast
+ * @param options
+ * @param sourceCode
+ * @returns
  */
 export declare function buildProvenanceContext(ast: AST, adapter: LanguageAdapter, sourceCode: string, options: BuildProvenanceContextOptions): ProvenanceContext;
+/**
+ * Bundled inputs for the DB-provenance decision helpers: the adapter and
+ * source needed to read node text, the resolved provenance context, and the
+ * (already defaulted) set of DB call methods.  Collapses the five positional
+ * parameters the `isDB*` family used to thread through every call into one.
+ */
+interface DBProvenanceQuery {
+    adapter: LanguageAdapter;
+    sourceCode: string;
+    context: ProvenanceContext;
+    methods: ReadonlySet<string>;
+}
 /**
  * Determine if a call-expression node's callee is DB-provenanced.
  *
@@ -111,12 +168,19 @@ export declare function buildProvenanceContext(ast: AST, adapter: LanguageAdapte
  *   2. Member expression call → is the receiver DB-provenanced AND is the
  *      method in the DB call method set?
  *   3. ORM patterns → receiver is DB-provenanced and method matches ORM API
+ *
+ * @param node  the call-expression node whose callee is under test
+ * @param query  bundled adapter, source, provenance context, and DB methods
+ * @returns  true if the call's callee resolves to a DB-provenanced target
  */
-export declare function isDBProvenanced(node: ASTNode, adapter: LanguageAdapter, sourceCode: string, context: ProvenanceContext, dbCallMethods?: ReadonlySet<string>): boolean;
+export declare function isDBProvenanced(node: ASTNode, query: DBProvenanceQuery): boolean;
 /**
  * Check if an identifier is validator-provenanced (R4 infrastructure).
  *
  * This will be consumed by Spec 15's validator-bypass detection.
+ * @param context
+ * @param identifier
+ * @returns
  */
 export declare function isValidatorProvenanced(identifier: string, context: ProvenanceContext): boolean;
 /**
@@ -128,6 +192,12 @@ export declare function isValidatorProvenanced(identifier: string, context: Prov
  * (b) can be traced back to a provenanced source through assignments.
  *
  * Deferred: full implementation in R2 step.
+ * @param adapter
+ * @param fileAst
+ * @param provenancedSet
+ * @param sourceCode
+ * @returns
  */
 export declare function inferReceivers(provenancedSet: Map<string, ProvenanceEvidence>, fileAst: AST, adapter: LanguageAdapter, sourceCode: string): InferredReceiverSet;
+export {};
 //# sourceMappingURL=provenance.d.ts.map

package/dist/analyzers/provenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/analyzers/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAM3E,oCAAoC;AACpC,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAiB1C,CAAC;AAEH,qCAAqC;AACrC,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AAEH,2DAA2D;AAC3D,eAAO,MAAM,QAAQ,EAAE,WAAW,CAAC,MAAM,CAWvC,CAAC;AAEH,mEAAmE;AACnE,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAY9C,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CA4B1C,CAAC;AAMH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;AAE3F,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,gEAAgE;IAChE,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtD,4BAA4B;IAC5B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAwBD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,GACvB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA6BjC;AAED;;;GAGG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,GACvB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA4BjC;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAgJjC;AAqVD,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,aAAa,CAAC;IACpB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,6BAA6B,GACrC,iBAAiB,CA0CnB;AA8FD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,EAC1B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAClC,OAAO,CAoCT;AAmJD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAET;AAMD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC/C,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,mBAAmB,CAmDrB"}
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/analyzers/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAM3E,oCAAoC;AACpC,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAiB1C,CAAC;AAEH,qCAAqC;AACrC,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AAEH,2DAA2D;AAC3D,eAAO,MAAM,QAAQ,EAAE,WAAW,CAAC,MAAM,CAWvC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAS9C,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CA4B1C,CAAC;AAMH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;AAE3F,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,gEAAgE;IAChE,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtD,4BAA4B;IAC5B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,GACvB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA6BjC;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,GACvB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA4BjC;AAiND;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAqBjC;AA0WD,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,aAAa,CAAC;IACpB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,6BAA6B,GACrC,iBAAiB,CA0CnB;AAsHD;;;;;GAKG;AACH,UAAU,iBAAiB;IACzB,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CA8BhF;AA0JD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAET;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC/C,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,mBAAmB,CAerB"}