codesentry 0.1.10 → 0.1.11

package/README.md

@@ -140,6 +140,7 @@ codesentry scan ./src
 codesentry scan . --json
 codesentry scan . --concurrency 4
 codesentry scan . --config ./rules/security.yml
+codesentry scan . --tests
 ```
 
 O Semgrep CE embutido é executado automaticamente depois das regras nativas,
@@ -153,6 +154,11 @@ apenas inteiros positivos. Sem valor, o limite é ajustado para a máquina
 Semgrep e das regras OWASP chegam em novas releases do CodeSentry. Quando
 necessário, `--config` aceita exclusivamente um arquivo YAML local.
 
+Por padrão, arquivos de teste não são analisados: nenhum diretório chamado
+`tests`, `test` ou `__tests__` (em qualquer profundidade) e nenhum arquivo
+com sufixo `.spec.*`/`.test.*` (em qualquer lugar, mesmo fora dessas pastas)
+entra no scan. Use `--tests` para incluí-los.
+
 Em macOS, ARM e plataformas sem runtime publicado, o comando interrompe
 explicitamente em vez de declarar uma análise parcial como completa.
 
@@ -181,7 +187,7 @@ o scan completo (e sem o Semgrep, que só roda como parte de `scan`). Todos
 seguem o mesmo formato:
 
 ```bash
-codesentry <comando> [path] [--json]
+codesentry <comando> [path] [--json] [--tests]
 ```
 
 Alguns exemplos:
@@ -193,9 +199,13 @@ codesentry xss ./src --json          # possíveis XSS (innerHTML, document.write
 codesentry unsafe-sql ./src          # SQL injection por concatenação
 codesentry command-injection ./src   # child_process com entrada não sanitizada
 codesentry weak-hash-algorithm ./src # uso de MD5/SHA-1 para hashing sensível
-codesentry dependency-audit .        # `npm audit` das dependências do projeto
+codesentry dependency-audit .        # `npm audit` das dependências do projeto (sem --tests: não lê arquivos-fonte)
 ```
 
+Assim como em `scan`, `--tests` inclui arquivos de teste na análise (por
+padrão são ignorados) — exceto em `dependency-audit`, que nunca lê
+arquivos-fonte e por isso não tem essa flag.
+
 A lista completa (30+ comandos, um por regra) sai de `codesentry help` —
 mantê-la sempre em sincronia aqui manualmente não seria viável.
 

package/dist/index.js

@@ -141,6 +141,9 @@ var commandInjectionRule = {
   }
 };
 
+// src/commands/scan/scan-options.ts
+var withScanOptions = (command) => command.option("--json", "exibe o resultado em JSON").option("--tests", "inclui arquivos de teste na an\xE1lise (por padr\xE3o s\xE3o ignorados)");
+
 // src/commands/scan/scan-runner.ts
 import { writeFile } from "fs/promises";
 import { join as join2 } from "path";
@@ -169,6 +172,26 @@ var formatErrorChain = (error) => {
 // src/reporters/console.reporter.ts
 import chalk from "chalk";
 import Table from "cli-table3";
+
+// src/scanner/scan-result.ts
+var DEPENDENCY_AUDIT_NOTE = 'Dependency audit n\xE3o foi inclu\xEDdo neste scan \u2014 rode "codesentry dependency-audit" separadamente.';
+var ZERO_SEMGREP_COVERAGE_WARNING = "Semgrep n\xE3o analisou nenhum arquivo nesta execu\xE7\xE3o \u2014 verifique se o ruleset offline est\xE1 instalado/preparado.";
+var mergeScanResults = (nativeResult, semgrepResult) => ({
+  scannedFiles: nativeResult.scannedFiles,
+  findings: [...nativeResult.findings, ...semgrepResult.findings],
+  durationMs: nativeResult.durationMs + semgrepResult.durationMs,
+  engines: {
+    codesentry: nativeResult.engines?.codesentry ?? nativeResult.scannedFiles,
+    semgrep: semgrepResult.engines?.semgrep ?? semgrepResult.scannedFiles
+  }
+});
+var finalizeScanResult = (result) => ({
+  ...result,
+  engines: { ...result.engines, dependencyAudit: false },
+  warnings: result.engines?.semgrep === 0 ? [...result.warnings ?? [], ZERO_SEMGREP_COVERAGE_WARNING] : result.warnings
+});
+
+// src/reporters/console.reporter.ts
 var SEVERITY_COLOR = {
   low: (text2) => chalk.gray(text2),
   medium: (text2) => chalk.yellow(text2),
@@ -176,8 +199,17 @@ var SEVERITY_COLOR = {
   critical: (text2) => chalk.bgRed.white(text2)
 };
 var coverageText = (result) => result.engines?.semgrep === void 0 ? "" : ` CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s).`;
+var printNotes = (result) => {
+  if (result.engines?.dependencyAudit === false) {
+    console.log(chalk.cyan(DEPENDENCY_AUDIT_NOTE));
+  }
+  for (const warning of result.warnings ?? []) {
+    console.log(chalk.yellow(`Aviso: ${warning}`));
+  }
+};
 var printCleanReport = (result, coverage) => {
   console.log(chalk.green(`Nenhum problema encontrado (${result.scannedFiles} arquivos analisados).${coverage}`));
+  printNotes(result);
 };
 var findingsTable = (result) => {
   const table = new Table({ head: ["Severity", "Rule", "File", "Line", "Message"] });
@@ -201,6 +233,7 @@ var printFindingsReport = (result, coverage) => {
 ${result.findings.length} problema(s) encontrado(s) em ${result.scannedFiles} arquivo(s) (${result.durationMs}ms).${coverage}`
     )
   );
+  printNotes(result);
 };
 var printConsoleReport = (result) => {
   const coverage = coverageText(result);
@@ -261,8 +294,10 @@ var reportHeader = (result, generatedAt) => [
   ],
   `- **Dura\xE7\xE3o:** ${result.durationMs}ms`,
   `- **Total de problemas:** ${result.findings.length}`,
+  ...result.engines?.dependencyAudit === false ? [`- **Nota:** ${DEPENDENCY_AUDIT_NOTE}`] : [],
   ""
 ];
+var warningsSection = (result) => (result.warnings ?? []).length === 0 ? [] : ["## Avisos", "", ...(result.warnings ?? []).map((warning) => `- ${warning}`), ""];
 var summaryTable = (bySeverity) => {
   const lines = ["## Resumo por severidade", "", "| Severidade | Quantidade |", "| --- | --- |"];
   for (const severity of SEVERITY_ORDER) {
@@ -283,22 +318,14 @@ var severitySections = (bySeverity) => {
 };
 var toMarkdownReport = (result, generatedAt = /* @__PURE__ */ new Date()) => {
   const bySeverity = groupBy(result.findings, (f) => f.severity);
-  return [...reportHeader(result, generatedAt), ...summaryTable(bySeverity), ...severitySections(bySeverity)].join(
-    "\n"
-  );
+  return [
+    ...reportHeader(result, generatedAt),
+    ...warningsSection(result),
+    ...summaryTable(bySeverity),
+    ...severitySections(bySeverity)
+  ].join("\n");
 };
 
-// src/scanner/scan-result.ts
-var mergeScanResults = (nativeResult, semgrepResult) => ({
-  scannedFiles: nativeResult.scannedFiles,
-  findings: [...nativeResult.findings, ...semgrepResult.findings],
-  durationMs: nativeResult.durationMs + semgrepResult.durationMs,
-  engines: {
-    codesentry: nativeResult.engines?.codesentry ?? nativeResult.scannedFiles,
-    semgrep: semgrepResult.engines?.semgrep ?? semgrepResult.scannedFiles
-  }
-});
-
 // src/scanner/scanner.ts
 import { readFile } from "fs/promises";
 import { availableParallelism } from "os";
@@ -306,26 +333,35 @@ import { availableParallelism } from "os";
 // src/scanner/file-finder.ts
 import { readdir } from "fs/promises";
 import { join } from "path";
+
+// src/scanner/ignore-patterns.ts
+var ALWAYS_IGNORED_DIR_NAMES = ["node_modules", ".git", "dist", ".next"];
+var TEST_DIR_NAMES = ["tests", "test", "__tests__"];
+var TEST_FILE_GLOBS = ["*.spec.*", "*.test.*"];
+var TEST_FILE_NAME_PATTERN = /\.(spec|test)\.[^./]+$/;
+var isIgnoredDirName = (name, includeTests = false) => ALWAYS_IGNORED_DIR_NAMES.includes(name) || !includeTests && TEST_DIR_NAMES.includes(name);
+var isTestFileName = (fileName) => TEST_FILE_NAME_PATTERN.test(fileName);
+
+// src/scanner/file-finder.ts
 var SCANNABLE_EXTENSIONS = [".js", ".ts", ".jsx", ".tsx"];
-var IGNORED_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".next", "tests"]);
 var isScannable = (fileName) => SCANNABLE_EXTENSIONS.some((ext) => fileName.endsWith(ext));
-var filesFromEntry = async (currentDir, entry) => {
+var filesFromEntry = async (currentDir, entry, includeTests) => {
   if (entry.isDirectory()) {
-    return IGNORED_DIRS.has(entry.name) ? [] : walk(join(currentDir, entry.name));
+    return isIgnoredDirName(entry.name, includeTests) ? [] : walk(join(currentDir, entry.name), includeTests);
   }
-  return entry.isFile() && isScannable(entry.name) ? [join(currentDir, entry.name)] : [];
+  return entry.isFile() && isScannable(entry.name) && (includeTests || !isTestFileName(entry.name)) ? [join(currentDir, entry.name)] : [];
 };
-var walk = async (currentDir) => {
+var walk = async (currentDir, includeTests) => {
   try {
     const entries = await readdir(currentDir, { withFileTypes: true });
-    return (await Promise.all(entries.map((entry) => filesFromEntry(currentDir, entry)))).flat();
+    return (await Promise.all(entries.map((entry) => filesFromEntry(currentDir, entry, includeTests)))).flat();
   } catch (error) {
     throw new Error(`N\xE3o foi poss\xEDvel listar os arquivos em "${currentDir}".`, { cause: error });
   }
 };
-var findFiles = async (targetDir) => {
+var findFiles = async (targetDir, includeTests = false) => {
   try {
-    return await walk(targetDir);
+    return await walk(targetDir, includeTests);
   } catch (error) {
     throw new Error(`N\xE3o foi poss\xEDvel listar os arquivos em "${targetDir}".`, { cause: error });
   }
@@ -380,10 +416,10 @@ var scanFile = async (filePath, rules) => {
     throw new Error(`N\xE3o foi poss\xEDvel analisar o arquivo "${filePath}".`, { cause: error });
   }
 };
-var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY) => {
+var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY, includeTests = false) => {
   try {
     const startedAt = Date.now();
-    const files = await findFiles(targetDir);
+    const files = await findFiles(targetDir, includeTests);
     const findings = (await runWithConcurrencyLimit(files, concurrency, (filePath) => scanFile(filePath, rules))).flat();
     return {
       scannedFiles: files.length,
@@ -482,23 +518,16 @@ var mapSemgrepReportToFindings = (report) => report.results.map((finding) => ({
   severity: SEMGREP_SEVERITIES[finding.extra.severity] ?? "medium"
 }));
 var outputFromError = (error) => typeof error.stdout === "string" ? error.stdout : void 0;
-var semgrepArgs = (ruleset) => [
+var excludeArgs = (names) => names.flatMap((name) => ["--exclude", name]);
+var semgrepArgs = (ruleset, includeTests) => [
   "scan",
   "--config",
   ruleset,
   "--metrics=off",
   "--json",
   "--quiet",
-  "--exclude",
-  "node_modules",
-  "--exclude",
-  ".git",
-  "--exclude",
-  "dist",
-  "--exclude",
-  ".next",
-  "--exclude",
-  "tests",
+  ...excludeArgs(ALWAYS_IGNORED_DIR_NAMES),
+  ...includeTests ? [] : excludeArgs([...TEST_DIR_NAMES, ...TEST_FILE_GLOBS]),
   // Não repetir targetDir aqui: o processo já roda com cwd = targetDir,
   // então o alvo relativo a esse cwd é o diretório atual.
   "."
@@ -511,9 +540,9 @@ var semgrepEnvironment = (runtime) => {
     PATH: `${semgrepDir}${delimiter}${dirname2(semgrepDir)}${delimiter}${process.env.PATH ?? ""}${delimiter}${systemPathFallback}`
   };
 };
-var executeSemgrep = async (targetDir, runtime, ruleset, execute) => {
+var executeSemgrep = async (targetDir, runtime, ruleset, execute, includeTests) => {
   try {
-    const { stdout } = await execute(runtime.semgrep, semgrepArgs(ruleset), {
+    const { stdout } = await execute(runtime.semgrep, semgrepArgs(ruleset, includeTests), {
       cwd: targetDir,
       maxBuffer: 20 * 1024 * 1024,
       env: semgrepEnvironment(runtime)
@@ -527,10 +556,10 @@ var executeSemgrep = async (targetDir, runtime, ruleset, execute) => {
     throw new Error("N\xE3o foi poss\xEDvel executar o Semgrep embutido.", { cause: error });
   }
 };
-var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync) => {
+var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync, includeTests = false) => {
   const startedAt = Date.now();
   try {
-    const report = parseSemgrepReport(await executeSemgrep(targetDir, runtime, ruleset, execute));
+    const report = parseSemgrepReport(await executeSemgrep(targetDir, runtime, ruleset, execute, includeTests));
     const scannedFiles = report.paths?.scanned.length ?? 0;
     return {
       scannedFiles,
@@ -578,12 +607,13 @@ Relat\xF3rio detalhado gerado em: ${filePath}`));
 };
 var runScanEngines = async (path, rules, options) => {
   try {
-    const nativeResult = await runScan(path, rules, options.concurrency);
+    const includeTests = options.tests ?? false;
+    const nativeResult = await runScan(path, rules, options.concurrency, includeTests);
     if (!options.semgrep) {
-      return nativeResult;
+      return finalizeScanResult(nativeResult);
     }
-    const semgrepResult = await runBundledSemgrep(path, void 0, options.config);
-    return mergeScanResults(nativeResult, semgrepResult);
+    const semgrepResult = await runBundledSemgrep(path, void 0, options.config, void 0, includeTests);
+    return finalizeScanResult(mergeScanResults(nativeResult, semgrepResult));
   } catch (error) {
     throw new Error(`Falha durante a an\xE1lise: ${errorMessage2(error)}`, { cause: error });
   }
@@ -618,7 +648,9 @@ var scanAndReport = async (path, rules, taskTitle, options) => {
 
 // src/commands/command-injection/command-injection.command.ts
 var registerCommandInjectionCommand = (program) => {
-  program.command("command-injection").description("Detecta child_process.exec()/execSync() recebendo entrada externa").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("command-injection").description("Detecta child_process.exec()/execSync() recebendo entrada externa").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [commandInjectionRule], "Checking command injection...", options)
   );
 };
@@ -717,7 +749,9 @@ var deepNestingRule = {
 
 // src/commands/deep-nesting/deep-nesting.command.ts
 var registerDeepNestingCommand = (program) => {
-  program.command("deep-nesting").description("Detecta blocos aninhados al\xE9m do limite recomendado").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("deep-nesting").description("Detecta blocos aninhados al\xE9m do limite recomendado").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [deepNestingRule], "Checking nesting depth...", options)
   );
 };
@@ -829,7 +863,9 @@ var emptyCatchRule = {
 
 // src/commands/empty-catch/empty-catch.command.ts
 var registerEmptyCatchCommand = (program) => {
-  program.command("empty-catch").description("Detecta blocos catch vazios").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("empty-catch").description("Detecta blocos catch vazios").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [emptyCatchRule], "Checking empty catch blocks...", options)
   );
 };
@@ -881,11 +917,85 @@ var expressMissingBodyLimitRule = {
 
 // src/commands/express-missing-body-limit/express-missing-body-limit.command.ts
 var registerExpressMissingBodyLimitCommand = (program) => {
-  program.command("express-missing-body-limit").description("Detecta middlewares de body parsing do Express sem limite de tamanho de requisi\xE7\xE3o").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("express-missing-body-limit").description("Detecta middlewares de body parsing do Express sem limite de tamanho de requisi\xE7\xE3o").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [expressMissingBodyLimitRule], "Checking Express body limits...", options)
   );
 };
 
+// src/rules/hardcoded-authorization-value.rule.ts
+var HEADER_OR_COOKIE_NAME_PATTERN = /headers|cookies?/i;
+var accessObjectName = (object) => {
+  const objectProperty = object?.type === "MemberExpression" ? object.property : object;
+  return objectProperty?.type === "Identifier" ? objectProperty.name : void 0;
+};
+var isHeaderOrCookieAccessCall = (node) => {
+  const callee = node?.callee;
+  const property = callee?.property;
+  const object = callee?.object;
+  return node?.type === "CallExpression" && callee?.type === "MemberExpression" && property?.type === "Identifier" && property.name === "get" && HEADER_OR_COOKIE_NAME_PATTERN.test(accessObjectName(object) ?? "");
+};
+var collectStringConstants = (sourceFile) => {
+  const constants = /* @__PURE__ */ new Map();
+  visitSourceNodes(sourceFile, (node) => {
+    if (node.type !== "VariableDeclarator") {
+      return;
+    }
+    const id = node.id;
+    const init = node.init;
+    if (id?.type === "Identifier" && init?.type === "StringLiteral") {
+      constants.set(id.name, init.value);
+    }
+  });
+  return constants;
+};
+var isConstantStringSide = (node, constants) => {
+  if (node?.type === "StringLiteral") {
+    return true;
+  }
+  return node?.type === "Identifier" && constants.has(node.name);
+};
+var isHardcodedAuthorizationComparison = (node, constants) => {
+  const left = node.left;
+  const right = node.right;
+  const isEquality = node.operator === "===" || node.operator === "==";
+  return node.type === "BinaryExpression" && isEquality && (isHeaderOrCookieAccessCall(left) && isConstantStringSide(right, constants) || isHeaderOrCookieAccessCall(right) && isConstantStringSide(left, constants));
+};
+var findHardcodedAuthorizationLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  const constants = collectStringConstants(sourceFile);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isHardcodedAuthorizationComparison(node, constants) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var hardcodedAuthorizationValueRule = {
+  id: "hardcoded-authorization-value",
+  description: "Detecta um header/cookie de requisi\xE7\xE3o comparado com um valor fixo no c\xF3digo para conceder acesso",
+  check(filePath, content) {
+    return findHardcodedAuthorizationLines(filePath, content).map((line) => ({
+      ruleId: "hardcoded-authorization-value",
+      message: "Autoriza\xE7\xE3o baseada em compara\xE7\xE3o de header/cookie com valor fixo no c\xF3digo-fonte",
+      file: filePath,
+      line,
+      severity: "critical"
+    }));
+  }
+};
+
+// src/commands/hardcoded-authorization-value/hardcoded-authorization-value.command.ts
+var registerHardcodedAuthorizationValueCommand = (program) => {
+  withScanOptions(
+    program.command("hardcoded-authorization-value").description("Detecta compara\xE7\xE3o de headers/cookies de autoriza\xE7\xE3o com um valor fixo no c\xF3digo").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [hardcodedAuthorizationValueRule], "Checking hardcoded authorization values...", options)
+  );
+};
+
 // src/commands/help/help.command.ts
 import Table2 from "cli-table3";
 var buildHelpTable = (commands) => {
@@ -1040,7 +1150,9 @@ var highComplexityRule = createFunctionStatementCountRule({
 
 // src/commands/high-complexity/high-complexity.command.ts
 var registerHighComplexityCommand = (program) => {
-  program.command("high-complexity").description("Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("high-complexity").description("Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [highComplexityRule], "Checking function complexity...", options)
   );
 };
@@ -1190,7 +1302,9 @@ var insecureRandomTokenRule = {
 
 // src/commands/insecure-random-token/insecure-random-token.command.ts
 var registerInsecureRandomTokenCommand = (program) => {
-  program.command("insecure-random-token").description("Detecta o uso de Math.random() para gerar tokens/segredos previs\xEDveis").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("insecure-random-token").description("Detecta o uso de Math.random() para gerar tokens/segredos previs\xEDveis").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [insecureRandomTokenRule], "Checking insecure random tokens...", options)
   );
 };
@@ -1274,13 +1388,12 @@ var jwtDecodeWithoutVerifyRule = {
 
 // src/commands/jwt-decode-without-verify/jwt-decode-without-verify.command.ts
 var registerJwtDecodeWithoutVerifyCommand = (program) => {
-  program.command("jwt-decode-without-verify").description("Detecta decodifica\xE7\xE3o manual de um token (base64 + JSON.parse) sem verificar a assinatura").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
-    (path, options) => scanAndReport(
-      path,
-      [jwtDecodeWithoutVerifyRule],
-      "Checking JWT decode without verification...",
-      options
-    )
+  withScanOptions(
+    program.command("jwt-decode-without-verify").description(
+      "Detecta decodifica\xE7\xE3o manual de um token (base64 + JSON.parse) sem verificar a assinatura"
+    ).argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [jwtDecodeWithoutVerifyRule], "Checking JWT decode without verification...", options)
   );
 };
 
@@ -1333,7 +1446,9 @@ var jwtNoExpirationRule = {
 
 // src/commands/jwt-no-expiration/jwt-no-expiration.command.ts
 var registerJwtNoExpirationCommand = (program) => {
-  program.command("jwt-no-expiration").description("Detecta jwt.sign() sem expira\xE7\xE3o configurada").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("jwt-no-expiration").description("Detecta jwt.sign() sem expira\xE7\xE3o configurada").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [jwtNoExpirationRule], "Checking JWT expiration...", options)
   );
 };
@@ -1386,7 +1501,9 @@ var longFunctionRule = {
 
 // src/commands/long-functions/long-functions.command.ts
 var registerLongFunctionsCommand = (program) => {
-  program.command("long-functions").description("Detecta fun\xE7\xF5es com mais de 30 linhas").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("long-functions").description("Detecta fun\xE7\xF5es com mais de 30 linhas").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [longFunctionRule], "Checking function length...", options)
   );
 };
@@ -1418,7 +1535,9 @@ var noAnyRule = {
 
 // src/commands/no-any/no-any.command.ts
 var registerNoAnyCommand = (program) => {
-  program.command("no-any").description('Detecta o uso do tipo "any" no TypeScript').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("no-any").description('Detecta o uso do tipo "any" no TypeScript').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [noAnyRule], "Checking any usage...", options)
   );
 };
@@ -1466,7 +1585,9 @@ var noEvalRule = {
 
 // src/commands/no-eval/no-eval.command.ts
 var registerNoEvalCommand = (program) => {
-  program.command("no-eval").description("Detecta o uso de eval() ou new Function()").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("no-eval").description("Detecta o uso de eval() ou new Function()").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [noEvalRule], "Checking eval/new Function usage...", options)
   );
 };
@@ -1534,7 +1655,9 @@ var noHardcodedSecretRule = {
 
 // src/commands/no-hardcoded-secret/no-hardcoded-secret.command.ts
 var registerNoHardcodedSecretCommand = (program) => {
-  program.command("no-hardcoded-secret").description("Detecta segredos/credenciais hardcoded no c\xF3digo-fonte").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("no-hardcoded-secret").description("Detecta segredos/credenciais hardcoded no c\xF3digo-fonte").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [noHardcodedSecretRule], "Checking hardcoded secrets...", options)
   );
 };
@@ -1597,7 +1720,9 @@ var permissiveCorsRule = {
 
 // src/commands/permissive-cors/permissive-cors.command.ts
 var registerPermissiveCorsCommand = (program) => {
-  program.command("permissive-cors").description("Detecta CORS configurado para permitir qualquer origem").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("permissive-cors").description("Detecta CORS configurado para permitir qualquer origem").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [permissiveCorsRule], "Checking permissive CORS...", options)
   );
 };
@@ -1642,7 +1767,11 @@ var publicEnvVarSecretRule = {
 
 // src/commands/public-env-var-secret/public-env-var-secret.command.ts
 var registerPublicEnvVarSecretCommand = (program) => {
-  program.command("public-env-var-secret").description("Detecta uma vari\xE1vel de ambiente p\xFAblica (NEXT_PUBLIC_/VITE_/REACT_APP_) com nome de segredo").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("public-env-var-secret").description(
+      "Detecta uma vari\xE1vel de ambiente p\xFAblica (NEXT_PUBLIC_/VITE_/REACT_APP_) com nome de segredo"
+    ).argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [publicEnvVarSecretRule], "Checking public env var secrets...", options)
   );
 };
@@ -2143,6 +2272,40 @@ var unsafeSqlRule = {
   }
 };
 
+// src/rules/weak-cipher-mode.rule.ts
+var CIPHER_METHOD_NAMES = /* @__PURE__ */ new Set(["createCipheriv", "createDecipheriv"]);
+var WEAK_MODE_PATTERN = /-(cbc|ecb)$/i;
+var isWeakCipherModeCall = (node) => {
+  const callee = node.callee;
+  const property = callee?.property;
+  const args = node.arguments;
+  const algorithm = args?.[0];
+  return node.type === "CallExpression" && callee?.type === "MemberExpression" && property?.type === "Identifier" && CIPHER_METHOD_NAMES.has(property.name) && algorithm?.type === "StringLiteral" && WEAK_MODE_PATTERN.test(algorithm.value);
+};
+var findWeakCipherModeLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isWeakCipherModeCall(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var weakCipherModeRule = {
+  id: "weak-cipher-mode",
+  description: "Detecta cifragem em modo n\xE3o autenticado (CBC/ECB) sem AEAD/HMAC associado",
+  check(filePath, content) {
+    return findWeakCipherModeLines(filePath, content).map((line) => ({
+      ruleId: "weak-cipher-mode",
+      message: "Modo de cifra sem autentica\xE7\xE3o (CBC/ECB) \u2014 considere um modo AEAD como GCM",
+      file: filePath,
+      line,
+      severity: "high"
+    }));
+  }
+};
+
 // src/rules/weak-hash-algorithm.rule.ts
 var WEAK_ALGORITHMS = /^(md5|sha1)$/i;
 var isWeakCreateHashCall = (node) => {
@@ -2352,7 +2515,9 @@ var allRules = [
   jwtDecodeWithoutVerifyRule,
   xxeUnsafeXmlParsingRule,
   sensitiveDataInLogsRule,
-  publicEnvVarSecretRule
+  publicEnvVarSecretRule,
+  weakCipherModeRule,
+  hardcodedAuthorizationValueRule
 ];
 
 // src/commands/rules/rules.command.ts
@@ -2382,70 +2547,90 @@ var parseLocalSemgrepConfig = (value) => {
   return resolve2(value);
 };
 var registerScanCommand = (program) => {
-  program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig).action(
+  withScanOptions(
+    program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig)
+  ).action(
     (path, options) => scanAndReport(path, allRules, "Scanning files...", { ...options, semgrep: true })
   );
 };
 
 // src/commands/security-lint/security-lint.command.ts
 var registerSecurityLintCommand = (program) => {
-  program.command("security-lint").description("Detecta padr\xF5es de seguran\xE7a gen\xE9ricos via eslint-plugin-security").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("security-lint").description("Detecta padr\xF5es de seguran\xE7a gen\xE9ricos via eslint-plugin-security").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [securityLintRule], "Checking generic security patterns...", options)
   );
 };
 
 // src/commands/sensitive-data-in-logs/sensitive-data-in-logs.command.ts
 var registerSensitiveDataInLogsCommand = (program) => {
-  program.command("sensitive-data-in-logs").description("Detecta senhas/segredos/tokens sendo passados para chamadas de log").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("sensitive-data-in-logs").description("Detecta senhas/segredos/tokens sendo passados para chamadas de log").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [sensitiveDataInLogsRule], "Checking sensitive data in logs...", options)
   );
 };
 
 // src/commands/tls-validation-disabled/tls-validation-disabled.command.ts
 var registerTlsValidationDisabledCommand = (program) => {
-  program.command("tls-validation-disabled").description("Detecta a desativa\xE7\xE3o da valida\xE7\xE3o de certificados TLS").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("tls-validation-disabled").description("Detecta a desativa\xE7\xE3o da valida\xE7\xE3o de certificados TLS").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tlsValidationDisabledRule], "Checking TLS validation...", options)
   );
 };
 
 // src/commands/too-many-for-loops/too-many-for-loops.command.ts
 var registerTooManyForLoopsCommand = (program) => {
-  program.command("too-many-for-loops").description('Detecta fun\xE7\xF5es com muitos loops "for"/"for-in"/"for-of"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-for-loops").description('Detecta fun\xE7\xF5es com muitos loops "for"/"for-in"/"for-of"').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyForLoopsRule], "Checking for-loop count...", options)
   );
 };
 
 // src/commands/too-many-ifs/too-many-ifs.command.ts
 var registerTooManyIfsCommand = (program) => {
-  program.command("too-many-ifs").description('Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-ifs").description('Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyIfsRule], "Checking if count...", options)
   );
 };
 
 // src/commands/too-many-switch-cases/too-many-switch-cases.command.ts
 var registerTooManySwitchCasesCommand = (program) => {
-  program.command("too-many-switch-cases").description('Detecta "switch" com muitos "case" (considere um mapa/lookup)').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-switch-cases").description('Detecta "switch" com muitos "case" (considere um mapa/lookup)').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManySwitchCasesRule], "Checking switch cases...", options)
   );
 };
 
 // src/commands/too-many-try-catch/too-many-try-catch.command.ts
 var registerTooManyTryCatchCommand = (program) => {
-  program.command("too-many-try-catch").description('Detecta fun\xE7\xF5es com muitos blocos "try/catch"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-try-catch").description('Detecta fun\xE7\xF5es com muitos blocos "try/catch"').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyTryCatchRule], "Checking try/catch count...", options)
   );
 };
 
 // src/commands/too-many-while-loops/too-many-while-loops.command.ts
 var registerTooManyWhileLoopsCommand = (program) => {
-  program.command("too-many-while-loops").description('Detecta fun\xE7\xF5es com muitos loops "while"/"do-while"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-while-loops").description('Detecta fun\xE7\xF5es com muitos loops "while"/"do-while"').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyWhileLoopsRule], "Checking while-loop count...", options)
   );
 };
 
 // src/commands/unhandled-promises/unhandled-promises.command.ts
 var registerUnhandledPromisesCommand = (program) => {
-  program.command("unhandled-promises").description("Detecta promises sem tratamento (sem .catch, await sem try/catch ou promises soltas)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("unhandled-promises").description("Detecta promises sem tratamento (sem .catch, await sem try/catch ou promises soltas)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(
       path,
       [promiseNoCatchRule, awaitNoTryCatchRule, floatingPromiseRule],
@@ -2457,37 +2642,56 @@ var registerUnhandledPromisesCommand = (program) => {
 
 // src/commands/unsafe-sql/unsafe-sql.command.ts
 var registerUnsafeSqlCommand = (program) => {
-  program.command("unsafe-sql").description("Detecta concatena\xE7\xE3o insegura de SQL (risco de SQL injection)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("unsafe-sql").description("Detecta concatena\xE7\xE3o insegura de SQL (risco de SQL injection)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [unsafeSqlRule], "Checking unsafe SQL...", options)
   );
 };
 
+// src/commands/weak-cipher-mode/weak-cipher-mode.command.ts
+var registerWeakCipherModeCommand = (program) => {
+  withScanOptions(
+    program.command("weak-cipher-mode").description("Detecta o uso de modos de cifra fracos (CBC, ECB) em createCipheriv/createDecipheriv").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [weakCipherModeRule], "Checking weak cipher modes...", options)
+  );
+};
+
 // src/commands/weak-hash-algorithm/weak-hash-algorithm.command.ts
 var registerWeakHashAlgorithmCommand = (program) => {
-  program.command("weak-hash-algorithm").description("Detecta o uso de algoritmos de hash fracos (MD5, SHA-1)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("weak-hash-algorithm").description("Detecta o uso de algoritmos de hash fracos (MD5, SHA-1)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [weakHashAlgorithmRule], "Checking weak hash algorithms...", options)
   );
 };
 
 // src/commands/weak-secret-fallback/weak-secret-fallback.command.ts
 var registerWeakSecretFallbackCommand = (program) => {
-  program.command("weak-secret-fallback").description(
-    "Detecta uma vari\xE1vel de ambiente de segredo/chave com um valor hardcoded como fallback (|| ou ??)"
-  ).argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("weak-secret-fallback").description(
+      "Detecta uma vari\xE1vel de ambiente de segredo/chave com um valor hardcoded como fallback (|| ou ??)"
+    ).argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [weakSecretFallbackRule], "Checking weak secret fallbacks...", options)
   );
 };
 
 // src/commands/xss/xss.command.ts
 var registerXssCommand = (program) => {
-  program.command("xss").description("Detecta sinks perigosos de XSS (innerHTML, document.write, etc.)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("xss").description("Detecta sinks perigosos de XSS (innerHTML, document.write, etc.)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [xssRule], "Checking XSS sinks...", options)
   );
 };
 
 // src/commands/xxe-unsafe-xml-parsing/xxe-unsafe-xml-parsing.command.ts
 var registerXxeUnsafeXmlParsingCommand = (program) => {
-  program.command("xxe-unsafe-xml-parsing").description("Detecta parsing de XML com noent/dtdload habilitados (risco de XXE)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("xxe-unsafe-xml-parsing").description("Detecta parsing de XML com noent/dtdload habilitados (risco de XXE)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [xxeUnsafeXmlParsingRule], "Checking unsafe XML parsing...", options)
   );
 };
@@ -2537,6 +2741,8 @@ var registerSecurityCommands = (program) => {
   registerXxeUnsafeXmlParsingCommand(program);
   registerSensitiveDataInLogsCommand(program);
   registerPublicEnvVarSecretCommand(program);
+  registerWeakCipherModeCommand(program);
+  registerHardcodedAuthorizationValueCommand(program);
 };
 var require5 = createRequire4(import.meta.url);
 var readPackageVersion = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codesentry",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "workspaces": [
     "packages/semgrep-rules"
   ],
@@ -48,7 +48,7 @@
     "@clack/prompts": "^1.7.0",
     "chalk": "^6.0.0",
     "cli-table3": "^0.6.5",
-    "codesentry-semgrep-rules": "0.1.10",
+    "codesentry-semgrep-rules": "0.1.11",
     "commander": "^15.0.0",
     "eslint": "^10.10.0",
     "eslint-plugin-no-unsanitized": "^4.1.5",
@@ -59,8 +59,8 @@
     "p-limit": "^7.3.2"
   },
   "optionalDependencies": {
-    "codesentry-semgrep-linux-x64": "0.1.10",
-    "codesentry-semgrep-win32-x64": "0.1.10"
+    "codesentry-semgrep-linux-x64": "0.1.11",
+    "codesentry-semgrep-win32-x64": "0.1.11"
   },
   "devDependencies": {
     "@types/node": "^26.4.1",