code-auditor-mcp 4.0.0 → 4.0.2

package/dist/analyzers/universal/UniversalDataAccessAnalyzer.js

@@ -5,7 +5,7 @@
  */
 import { UniversalAnalyzer } from '../../languages/UniversalAnalyzer.js';
 import { withRuleTiming } from '../ruleTiming.js';
-import { buildProvenanceContext, isDBProvenanced, DB_CALL_METHODS, } from '../provenance.js';
+import { buildProvenanceContext, isDBProvenanced, getCallExpressionCallee, DB_CALL_METHODS, ORM_METHODS, } from '../provenance.js';
 import { DB_RECEIVER_NAMES, DB_CALL_METHOD_NAMES, DB_BINDING_NAMES, DB_WRAPPER_NAMES, } from './UniversalSchemaAnalyzer.js';
 import { isSqlKeyword, findEnclosingFunctionIdentity, functionIdentityLabel } from './schema/codeAnalysis.js';
 import { isTestOrSpecPath } from '../../languages/testConventions.js';
@@ -209,6 +209,7 @@ function buildDatabaseCall(node, ast, scan) {
         hasFilter,
         hasParameterizedQuery: security.parameterized,
         hasSqlInjectionRisk: security.injectionRisk,
+        sqlEscaped: security.escaped,
         enclosingFunction: enclosingIdentity(node, adapter, ast.filePath),
     };
 }
@@ -307,20 +308,39 @@ function checkViolations(call, analysis, ctx) {
     const violations = [];
     const symbol = nextSymbol(call.enclosingFunction ?? 'top-level', call.method, symbolOrdinals);
     const push = (message, opts) => violations.push(makeViolation(filePath, { line: call.line, column: call.column }, message, { ...opts, symbol }));
-    // Security: SQL injection — string-interpolated SQL from input is exploitable
-    // now, so `critical`; manual quote-escaping is not sanitization.
+    // Security: SQL injection.  Raw unescaped interpolation of input is a live
+    // vulnerability now → `critical`.  Manual quote-escaping
+    // (`.replace(/'/g, "''")`) is *defended* — single-quote doubling handles only
+    // the single-quote vector, not backslash escapes or unicode quote variants —
+    // so it downgrades to `high` ("verify escaping") rather than asserting a
+    // certified vulnerability.
     if (config.checkSQLInjection && call.hasSqlInjectionRisk) {
-        push(`Potential SQL injection risk in ${call.method}. Use parameterized queries.`, {
-            severity: 'critical',
-            rule: 'sql-injection-risk',
-            resolution: {
-                action: 'parameterize',
-                summary: `Replace the string-interpolated SQL in ${call.method} with a parameterized query — bind values via the driver's placeholder form (\`?\`, \`$1\`, or \`:name\`) instead of concatenating them into the statement.`,
-                symbols: [call.method],
-                files: [filePath],
-                lines: [call.line],
-            },
-        });
+        if (call.sqlEscaped) {
+            push(`Interpolated SQL in ${call.method} — verify escaping is sufficient. Use parameterized queries.`, {
+                severity: 'high',
+                rule: 'sql-injection-risk',
+                resolution: {
+                    action: 'parameterize',
+                    summary: `The SQL in ${call.method} interpolates a manually quote-escaped value. Quote-doubling defends only the single-quote case (not backslash escapes, unicode quote variants, or numeric/identifier positions) — replace the interpolation with a parameterized query (\`?\`, \`$1\`, or \`:name\`) for a full guarantee.`,
+                    symbols: [call.method],
+                    files: [filePath],
+                    lines: [call.line],
+                },
+            });
+        }
+        else {
+            push(`Potential SQL injection risk in ${call.method}. Use parameterized queries.`, {
+                severity: 'critical',
+                rule: 'sql-injection-risk',
+                resolution: {
+                    action: 'parameterize',
+                    summary: `Replace the string-interpolated SQL in ${call.method} with a parameterized query — bind values via the driver's placeholder form (\`?\`, \`$1\`, or \`:name\`) instead of concatenating them into the statement.`,
+                    symbols: [call.method],
+                    files: [filePath],
+                    lines: [call.line],
+                },
+            });
+        }
     }
     // Security: Missing Organization Filter — a query on a tenant-scoped table with
     // no org/tenant filter is a live data-isolation breach: one tenant reads
@@ -331,14 +351,14 @@ function checkViolations(call, analysis, ctx) {
     // Performance: Complex Query — a join-heavy query (many tables).  Spec 55 R5:
     // a subquery alone is no longer "complex" — it is an ordinary SQLite/D1 idiom.
     if (analysis.performanceRisk === 'high') {
-        push(`Query references ${call.tables.length} tables`, { severity: 'severe', rule: 'complex-query' });
+        push(`Query references ${call.tables.length} tables`, { severity: 'high', rule: 'complex-query' });
     }
     // Performance: Unfiltered Query — an unfiltered write (DELETE/UPDATE with no
     // row-limiting clause), the classic mass-mutation foot-gun.  Spec 55 R3: it is
     // a query-shape rule excluded from test files; R5: it is about writes now, not
     // reads (an unfiltered SELECT is often an intentional full-set load).
     if (!skipTestRules && analysis.performanceRisk === 'medium') {
-        push(`Unfiltered write on ${call.tables.join(', ')} has no WHERE/HAVING/LIMIT`, { severity: 'severe', rule: 'unfiltered-query' });
+        push(`Unfiltered write on ${call.tables.join(', ')} has no WHERE/HAVING/LIMIT`, { severity: 'high', rule: 'unfiltered-query' });
     }
     return violations;
 }
@@ -662,6 +682,64 @@ function isStatementConstructionOnly(node, adapter, sourceCode) {
     const method = dbCallMethodName(node, adapter, sourceCode);
     return (method === 'prepare' || method === 'bind') && !hasEagerMethodInCallChain(node, adapter, sourceCode);
 }
+/**
+ * True when a db-call node is SQL-string construction inside a query compiler:
+ * an ORM *builder* method (e.g. `aggregate`, `select`, `where` — never an eager
+ * I/O method) invoked on an unprovenanced `this` receiver whose result is
+ * accumulated into an array via `.push(...)`. knex's query compilers build SQL
+ * exactly this way — `sql.push(...this.aggregate(stmt))` inside a
+ * column-iteration loop — and the call returns a string fragment, not a query
+ * result, so the loop is not an N+1 (Spec 52 R1 extension). Eager methods
+ * (`run`/`all`/`exec`/`query`/…) are excluded, so a genuine
+ * `results.push(db.query(...))` still fires.
+ */
+function isSqlStringConstruction(node, adapter, sourceCode) {
+    const method = dbCallMethodName(node, adapter, sourceCode);
+    if (!method || EAGER_DB_METHODS.has(method))
+        return false;
+    if (!ORM_METHODS.has(method))
+        return false;
+    const call = resolveDbCallNode(node, adapter);
+    if (!call)
+        return false;
+    const memberExpr = findMemberCallee(call, adapter);
+    if (!memberExpr)
+        return false;
+    // The receiver must be an unprovenanced `this`/`super` — the query-compiler
+    // object itself. `this.db.aggregate(...)` (receiver `this.db`) would be a real
+    // ORM query on a provenanced `db`, not a compiler fragment.
+    const objectText = memberObjectText(memberExpr, adapter, sourceCode);
+    if (objectText !== 'this' && objectText !== 'super')
+        return false;
+    return isConsumedByArrayPush(call, adapter, sourceCode);
+}
+/** The object text of a member_expression (`this.aggregate` → `this`). */
+function memberObjectText(node, adapter, sourceCode) {
+    const object = adapter.getChildren(node).find((c) => {
+        const t = adapter.getNodeType(c);
+        return t !== 'property_identifier' && t !== 'field_identifier' && t !== '.';
+    });
+    return object ? adapter.getNodeText(object, sourceCode) : null;
+}
+/**
+ * True when a call's result is consumed by an array `.push(...)` — the call is
+ * an argument (possibly spread) of a `push` invocation. The accumulation
+ * signature (`sql.push(...this.aggregate(stmt))`) marks the value as a string
+ * fragment being collected, not a query result being read.
+ */
+function isConsumedByArrayPush(call, adapter, sourceCode) {
+    let cur = adapter.getParent(call);
+    if (cur && adapter.getNodeType(cur) === 'spread_element') {
+        cur = adapter.getParent(cur);
+    }
+    if (!cur || adapter.getNodeType(cur) !== 'arguments')
+        return false;
+    const pushCall = adapter.getParent(cur);
+    if (!pushCall || adapter.getNodeType(pushCall) !== 'call_expression')
+        return false;
+    const pushMember = findMemberCallee(pushCall, adapter);
+    return !!pushMember && memberPropertyName(pushMember, adapter, sourceCode) === 'push';
+}
 /** True when a call's arguments contain a spread_element (…binds). */
 function hasSpreadArgument(call, adapter) {
     const args = adapter.getChildren(call).find(c => adapter.getNodeType(c) === 'arguments');
@@ -756,10 +834,12 @@ function isWrapperFunctionWithBindParams(node, adapter, sourceCode, wrapperNames
     if (!call || adapter.getNodeType(call) !== 'call_expression')
         return false;
     // Check if the callee is a simple identifier (not member expression)
-    // matching one of the wrapper names.
-    const children = adapter.getChildren(call);
-    const callee = children.find(c => adapter.getNodeType(c) === 'identifier');
-    if (!callee)
+    // matching one of the wrapper names.  Use the shared callee extractor so an
+    // `await fn<T>(...)` call — whose callee is an `await_expression` wrapping the
+    // identifier, plus a `type_arguments` child — resolves the same way the
+    // provenance detector does.  A naive `children.find(identifier)` misses it.
+    const callee = getCallExpressionCallee(call, adapter);
+    if (!callee || adapter.getNodeType(callee) !== 'identifier')
         return false;
     const calleeName = adapter.getNodeText(callee, sourceCode);
     if (!wrapperNames.includes(calleeName))
@@ -1050,17 +1130,35 @@ function isUnfilteredWrite(call) {
  * wrapper function with bind params).  All four short-circuit checkQuerySecurity
  * to a "safe" result.
  */
-function isParameterizedByChain(node, adapter, sourceCode, config) {
+function isParameterizedByChain(node, adapter, sourceCode, config, wrapperNames) {
     if (isInPrepareBindChain(node, adapter, sourceCode))
         return true;
     if (isInExecChain(node, adapter, sourceCode))
         return true;
     if (isD1ConvenienceCall(node, adapter, sourceCode))
         return true;
-    if (isWrapperFunctionWithBindParams(node, adapter, sourceCode, config.dbWrapperNames ?? []))
+    if (isWrapperFunctionWithBindParams(node, adapter, sourceCode, wrapperNames))
         return true;
     return false;
 }
+/**
+ * The effective set of DB-wrapper names the FP guards recognize as
+ * parameterized.  This is the union of the static `config.dbWrapperNames`
+ * (d1Query, d1Exec) and the names the provenance detector *learned* at
+ * file-scan time (`reason: 'wrapper'` — e.g. a bare `d1(sql, params)` D1 REST
+ * helper).  Keeping the two in sync is what prevents a wrapper the detector
+ * already treats as DB-bound from being re-flagged as raw interpolation by
+ * `checkQuerySecurity`.
+ */
+function effectiveWrapperNames(scan) {
+    const staticNames = scan.config.dbWrapperNames ?? [];
+    const learned = scan.provenanceContext
+        ? [...scan.provenanceContext.dbProvenanced.values()]
+            .filter(ev => ev.reason === 'wrapper')
+            .map(ev => ev.identifier)
+        : [];
+    return [...new Set([...staticNames, ...learned])];
+}
 /**
  * True when a single dynamic interpolation part is provably safe — via a
  * config-driven sanitizer allowlist, the adapter's cross-function safety
@@ -1106,30 +1204,33 @@ function checkQuerySecurity(node, text, ast, scan) {
     const { adapter, sourceCode, config } = scan;
     // Parameterized chains (.prepare().bind(), .exec() spread, D1 convenience,
     // DB wrappers) and explicit parameterization are always safe.
-    if (isParameterizedByChain(node, adapter, sourceCode, config)) {
-        return { parameterized: true, injectionRisk: false };
+    if (isParameterizedByChain(node, adapter, sourceCode, config, effectiveWrapperNames(scan))) {
+        return { parameterized: true, injectionRisk: false, escaped: false };
     }
     if ((config.securityPatterns?.parameterizedQueries || []).some(p => text.includes(p))) {
-        return { parameterized: true, injectionRisk: false };
+        return { parameterized: true, injectionRisk: false, escaped: false };
     }
     // No dynamic-string capability → can't prove unsafe; err quiet.
     if (!adapter.isDynamicStringConstruction || !adapter.getDynamicParts) {
-        return { parameterized: false, injectionRisk: false };
+        return { parameterized: false, injectionRisk: false, escaped: false };
     }
     // Only a dynamically-constructed string carrying SQL keywords can inject.
     if (!adapter.isDynamicStringConstruction(node) || !containsSQLKeywords(text)) {
-        return { parameterized: false, injectionRisk: false };
+        return { parameterized: false, injectionRisk: false, escaped: false };
     }
     const unresolved = adapter.getDynamicParts(node, sourceCode)
-        .filter(part => !isSafeDynamicPart(part, ast, scan))
-        .map(part => part.text);
+        .filter(part => !isSafeDynamicPart(part, ast, scan));
     if (unresolved.length === 0) {
-        return { parameterized: false, injectionRisk: false };
+        return { parameterized: false, injectionRisk: false, escaped: false };
     }
+    // Manual quote-escaping (`.replace(/'/g, "''")`) is defended, not raw — every
+    // unresolved part being quote-escaped downgrades the finding to high.
+    const escaped = unresolved.every(part => !!part.node && !!adapter.isEscapedInterpolation && adapter.isEscapedInterpolation(part.node, ast, sourceCode));
     return {
         parameterized: false,
         injectionRisk: true,
-        message: `Cannot protect interpolated content: ${unresolved.map(id => '${' + id + '}').join(', ')}`,
+        escaped,
+        message: `Cannot protect interpolated content: ${unresolved.map(part => '${' + part.text + '}').join(', ')}`,
     };
 }
 function extractCallExpressionMethod(callExpr, adapter, sourceCode) {
@@ -1139,11 +1240,10 @@ function extractCallExpressionMethod(callExpr, adapter, sourceCode) {
     // keywords (COUNT, JOIN, WHERE, ...) that appear inside template literals
     // in the call arguments, which a regex scan of the full call-expression
     // text would incorrectly match.
-    const children = adapter.getChildren(callExpr);
-    const callee = children.find(c => {
-        const t = adapter.getNodeType(c);
-        return t === 'member_expression' || t === 'identifier';
-    });
+    // Use the shared callee extractor: it recurses through `await_expression` and
+    // skips `type_arguments`, so `await d1<{...}>(...)` resolves to `d1` rather
+    // than falling through to the "unknown" regex fallback.
+    const callee = getCallExpressionCallee(callExpr, adapter);
     if (callee) {
         const calleeType = adapter.getNodeType(callee);
         if (calleeType === 'member_expression') {
@@ -1246,6 +1346,42 @@ function isConnectionString(text) {
     return patterns.some(pattern => pattern.test(text));
 }
 // ── R4.1: Loop-query detection ──────────────────────────────────────
+/**
+ * LLM provider / SDK namespaces. A callee whose text carries one of these is
+ * an unambiguous LLM/agent invocation (e.g. `gatewayDeepseekModel`,
+ * `anthropic.messages.create`, `openai.chat`).
+ */
+const LLM_PROVIDER_RE = /(?:anthropic|openai|deepseek|claude|gpt|gemini|cohere|mistral|bedrock|vertex|ollama|llm|gateway)/i;
+/**
+ * LLM action verbs — AI SDK methods and the wrapper names that survive the
+ * provider-token check (e.g. `aiEmbed`, `chatCompletion`, `thesisEngine`).
+ * Deliberately narrower than `generate`/`extract` (those collide with ordinary
+ * helpers like `insertSingleGeneratedBuild`); the provider namespace and the
+ * model-client argument signal cover the rest.
+ */
+const LLM_ACTION_RE = /(?:embed|reembed|completion|chat|prompt|synthesize|thesis|agent|classify|summarize|translate)/i;
+/**
+ * Identifier names that denote an LLM/model client when they appear as a call
+ * argument (e.g. `extractBuildsFromCorpus(db, model, …)`) or as the object of a
+ * member callee (e.g. `model.chat(…)`). Deliberately excludes `client`/`ai`
+ * (ambiguous — a DB client is also a `client`) so we never suppress a real N+1
+ * on a generic variable name.
+ */
+const LLM_CLIENT_ARG_NAMES = new Set([
+    'model', 'llm', 'embedder', 'gateway',
+    'anthropic', 'openai', 'deepseek', 'claude', 'gpt', 'gemini', 'cohere', 'mistral', 'bedrock',
+]);
+/**
+ * Message-lifecycle methods a queue consumer invokes per message (`msg.ack()`,
+ * `msg.retry()`, `msg.nack()`, …). A loop whose body acknowledges or retries the
+ * item it iterates over is a queue-consumer message loop: each message is an
+ * independent job that must be acked/nacked/retried in isolation, so a
+ * per-iteration query is the contract, not a batchable N+1. Batching or joining
+ * would regress the retry semantics. `ack`/`nack`/`acknowledge`/`deleteMessage`
+ * are unambiguous queue vocabulary; `retry` is queue-contextual (a lone
+ * `.retry()` inside a collection loop is overwhelmingly a per-item queue retry).
+ */
+const MESSAGE_LIFECYCLE_METHODS = new Set(['ack', 'nack', 'acknowledge', 'deleteMessage', 'retry']);
 /**
  * R4.1: Find database queries inside loops and flag them as N+1 risks.
  * Each finding carries the query call location (never line 1).
@@ -1275,12 +1411,35 @@ function checkLoopQueries(ast, scan) {
         // an eager call or a prepare chained into one still fires.
         if (isStatementConstructionOnly(node, adapter, sourceCode))
             continue;
+        // Spec 52 R1 (extension) — skip SQL-string construction inside a query
+        // compiler: an ORM builder method (e.g. `aggregate`) on an unprovenanced
+        // `this` whose result is accumulated via `.push(...)` returns a string
+        // fragment, not a query result (knex `sql.push(...this.aggregate(stmt))`).
+        if (isSqlStringConstruction(node, adapter, sourceCode))
+            continue;
         const loopInfo = findEnclosingLoop(node, adapter);
         if (!loopInfo)
             continue;
-        // R4.1: query node's actual location (never line 1) + runtime dedup.
-        const queryLine = node.location.start.line;
-        const dedupKey = `${queryLine}:${loopInfo.loopNode.location.start.line}`;
+        // R4.1 (Spec 46): LLM-pipeline discriminator. A loop whose body invokes an
+        // LLM/agent (embedding, model completion, corpus extraction) is an intentional
+        // *sequential pipeline* — its per-item DB calls are persistence steps gated by
+        // rate limits and per-item crash-recovery, not a batchable N+1. Batching or
+        // joining would regress those semantics, so suppress the finding rather than
+        // emit an unfixable `severe`.
+        if (loopBodyContainsLlmCall(loopInfo.loopNode, adapter, sourceCode))
+            continue;
+        // R4.1 (queue consumer): a loop whose body acks/nacks/retries the message it
+        // iterates over is a queue consumer, not a batchable N+1. Each message is an
+        // independent job that must ack/retry in isolation, so batching or joining the
+        // per-iteration queries would break the retry contract — suppress the finding.
+        if (loopBodyContainsMessageLifecycleCall(loopInfo.loopNode, adapter, sourceCode))
+            continue;
+        // R4.1: one finding per *loop*, not per query — an N+1 is a property of the
+        // loop, so a loop issuing several queries is still one violation (defect #51).
+        // Key on the loop node's start byte offset so distinct loops (including
+        // nested ones) never collapse, while every query in the same loop dedups to
+        // the first. The finding anchors to that first query's location below.
+        const dedupKey = String(loopInfo.loopNode.range[0]);
         if (reported.has(dedupKey))
             continue;
         reported.add(dedupKey);
@@ -1293,6 +1452,91 @@ function checkLoopQueries(ast, scan) {
     }
     return violations;
 }
+/**
+ * R4.1 (Spec 46): True when the loop's subtree contains an LLM/agent invocation.
+ * Used as the discriminator between a batchable N+1 (no LLM call — the queries
+ * should be batched/joined) and an intentional sequential pipeline (an LLM call
+ * — the per-item DB calls are persistence steps behind rate limits and
+ * crash-recovery). Walking the whole loop subtree (header + body) is safe: a
+ * loop header rarely hosts an LLM call, and a body-level one is exactly the
+ * signal we want.
+ */
+function loopBodyContainsLlmCall(loopNode, adapter, sourceCode) {
+    let found = false;
+    walkSubtree(loopNode, adapter, (node) => {
+        if (found || adapter.getNodeType(node) !== 'call_expression')
+            return;
+        if (isLlmCallNode(node, adapter, sourceCode))
+            found = true;
+    });
+    return found;
+}
+/**
+ * R4.1 (queue consumer): True when the loop's subtree contains a
+ * message-lifecycle call — a member call whose property is a queue lifecycle
+ * method (`ack`, `nack`, `acknowledge`, `deleteMessage`, `retry`). The signature
+ * of a queue consumer (`for (const msg of batch.messages) { …; msg.ack(); }`)
+ * marks per-message independent jobs, not a batchable N+1. Walking the whole loop
+ * subtree is safe: the header (`batch.messages`) carries no lifecycle property,
+ * and a body-level `msg.ack()`/`msg.retry()` is exactly the signal we want.
+ */
+function loopBodyContainsMessageLifecycleCall(loopNode, adapter, sourceCode) {
+    let found = false;
+    walkSubtree(loopNode, adapter, (node) => {
+        if (found || adapter.getNodeType(node) !== 'member_expression')
+            return;
+        const prop = memberPropertyName(node, adapter, sourceCode);
+        if (prop && MESSAGE_LIFECYCLE_METHODS.has(prop))
+            found = true;
+    });
+    return found;
+}
+/** Depth-first walk over an ASTNode subtree (children only, no parent links). */
+function walkSubtree(node, adapter, visitor) {
+    visitor(node);
+    for (const child of adapter.getChildren(node)) {
+        walkSubtree(child, adapter, visitor);
+    }
+}
+/**
+ * Classify a call_expression as an LLM/agent invocation via three unambiguous
+ * signals: a provider/SDK namespace in the callee text, an LLM action verb in the
+ * callee text, or a model-client identifier passed as an argument / used as the
+ * member-callee object.
+ */
+function isLlmCallNode(node, adapter, sourceCode) {
+    const children = adapter.getChildren(node);
+    const callee = children.find(c => adapter.getNodeType(c) !== 'arguments');
+    if (callee) {
+        const calleeText = adapter.getNodeText(callee, sourceCode);
+        if (LLM_PROVIDER_RE.test(calleeText) || LLM_ACTION_RE.test(calleeText))
+            return true;
+        // Member callee whose object is an LLM client: `model.chat(…)`, `llm.invoke(…)`.
+        if (adapter.getNodeType(callee) === 'member_expression') {
+            const obj = adapter.getChildren(callee).find(c => adapter.getNodeType(c) === 'identifier');
+            if (obj && LLM_CLIENT_ARG_NAMES.has(adapter.getNodeText(obj, sourceCode)))
+                return true;
+        }
+    }
+    // Argument signal: an LLM client identifier passed into the call, e.g.
+    // `extractBuildsFromCorpus(db, model, …)`.
+    const args = children.find(c => adapter.getNodeType(c) === 'arguments');
+    if (args) {
+        for (const arg of adapter.getChildren(args)) {
+            if (adapter.getNodeType(arg) === 'identifier' &&
+                LLM_CLIENT_ARG_NAMES.has(adapter.getNodeText(arg, sourceCode))) {
+                return true;
+            }
+            // Member access argument (`client.messages`) — check its object identifier.
+            if (adapter.getNodeType(arg) === 'member_expression') {
+                const obj = adapter.getChildren(arg).find(c => adapter.getNodeType(c) === 'identifier');
+                if (obj && LLM_CLIENT_ARG_NAMES.has(adapter.getNodeText(obj, sourceCode)))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
 /** True when `node` is a function call whose callee is DB-provenanced. */
 function isDBProvenancedFunctionCall(node, adapter, sourceCode, provenanceContext) {
     return isFunctionCall(node, adapter) &&