codeslick-cli 1.0.0

package/dist/src/lib/analyzers/java/security-checks/hardcoded-credentials.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Hardcoded Credentials Detection Module
+ *
+ * Detects hardcoded credentials in Java source code including:
+ * - General credentials (passwords, secrets, tokens)
+ * - AWS credentials (Access Keys, Secret Keys)
+ * - Stripe API keys
+ * - Byte array encryption keys
+ * - Spring @Value annotations with hardcoded credentials
+ *
+ * OWASP A07:2021 - Authentication & Identification Failures
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Check for hardcoded credentials in Java code
+ * @param lines - Array of code lines to analyze
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkHardcodedCredentials(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=hardcoded-credentials.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/hardcoded-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-credentials.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/hardcoded-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,qBAAqB,EAAE,CAsKlF"}

package/dist/src/lib/analyzers/java/security-checks/hardcoded-credentials.js

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * Hardcoded Credentials Detection Module
+ *
+ * Detects hardcoded credentials in Java source code including:
+ * - General credentials (passwords, secrets, tokens)
+ * - AWS credentials (Access Keys, Secret Keys)
+ * - Stripe API keys
+ * - Byte array encryption keys
+ * - Spring @Value annotations with hardcoded credentials
+ *
+ * OWASP A07:2021 - Authentication & Identification Failures
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkHardcodedCredentials = checkHardcodedCredentials;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Check for hardcoded credentials in Java code
+ * @param lines - Array of code lines to analyze
+ * @returns Array of security vulnerabilities found
+ */
+function checkHardcodedCredentials(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmed = line.trim();
+        const lineNumber = index + 1;
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        // FIX (Dec 6, 2025): Added proper multi-line comment tracking
+        if (!trimmed ||
+            inMultiLineComment ||
+            trimmed.startsWith('//')) {
+            return;
+        }
+        // 7. Hardcoded credentials - CRITICAL
+        // PHASE 6 FIX (2025-11-21): Skip comment lines to prevent false positives
+        // Priority 1 Improvement (2025-11-24): Expanded patterns for API keys, secrets, tokens
+        // FIX (Dec 9, 2025): Support ALL naming conventions (camelCase, snake_case, SCREAMING_SNAKE_CASE)
+        // Pattern now matches: API_KEY, api_key, apiKey, DB_PASSWORD, dbPassword, AWS_SECRET, awsSecret, etc.
+        const credentialPattern = /(password|passwd|pwd|secret|token|key|auth|credential)/i;
+        const hasCredentialKeyword = credentialPattern.test(trimmed);
+        const hasAssignment = trimmed.match(/\s*=\s*"/);
+        if (hasCredentialKeyword && hasAssignment &&
+            !trimmed.includes('System.getenv') && !trimmed.includes('config.') && !trimmed.includes('properties')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('hardcoded-credentials', 'Hardcoded credentials detected in source code', 'Use environment variables (System.getenv()), configuration files, or secret management services', lineNumber, 'Hardcoded credentials in source code are visible to anyone with access to the codebase, version control history, compiled bytecode, or decompiled classes. This includes developers, contractors, attackers who gain access to repositories, and anyone analyzing JAR files.', 'String password = "SecretPass123"; // Visible in source, Git history, and decompiled bytecode', [
+                'Credential exposure in version control',
+                'Unauthorized system access',
+                'Data breach',
+                'Compliance violations (PCI-DSS, GDPR)',
+                'Credential reuse across systems'
+            ], 'String dbPassword = "MySecretP@ssw0rd";\nConnection conn = DriverManager.getConnection(url, username, dbPassword);', 'String dbPassword = System.getenv("DB_PASSWORD"); // From environment variable\n// Or with Spring: @Value("${db.password}") private String dbPassword;\nConnection conn = DriverManager.getConnection(url, username, dbPassword);', 'Store credentials in environment variables, external configuration files, or dedicated secret management services (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault). Never commit credentials to source control'));
+        }
+        // 7b. AWS credentials - CRITICAL (PRIORITY 1 FIX)
+        // Detect AWS Access Key ID (starts with AKIA) and AWS Secret Access Key patterns
+        if (trimmed.match(/"AKIA[0-9A-Z]{16}"/) || // AWS Access Key ID
+            trimmed.match(/"[A-Za-z0-9/+=]{40}"/) || // AWS Secret Access Key (40 chars base64-like)
+            (trimmed.match(/AWS.*=\s*"/) && !trimmed.includes('System.getenv'))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('hardcoded-credentials', 'Hardcoded AWS credentials detected in source code', 'Use AWS Secrets Manager, Systems Manager Parameter Store, or environment variables', lineNumber, 'Hardcoded AWS credentials grant full access to AWS resources. If exposed in source code or version control, attackers can use these to create resources, steal data, or incur massive costs on your AWS account.', 'String awsAccessKey = "AKIAIOSFODNN7EXAMPLE"; String awsSecretKey = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";', [
+                'Unauthorized AWS resource access',
+                'Data exfiltration from S3/RDS/DynamoDB',
+                'Resource creation/deletion',
+                'Massive AWS billing fraud',
+                'Credential exposure in Git history'
+            ], 'private static final String AWS_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE";\nprivate static final String AWS_SECRET_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";', '// Use AWS SDK default credential provider chain\nAWSCredentialsProvider credentialsProvider = DefaultAWSCredentialsProviderChain.getInstance();\n// Or environment variables:\nString awsAccessKey = System.getenv("AWS_ACCESS_KEY_ID");\nString awsSecretKey = System.getenv("AWS_SECRET_ACCESS_KEY");', 'Use AWS SDK default credential provider chain, AWS Secrets Manager, Systems Manager Parameter Store, or environment variables. Never hardcode AWS credentials. Rotate credentials immediately if exposed'));
+        }
+        // 7c. Stripe API keys - CRITICAL (PRIORITY 1 FIX)
+        // Detect Stripe test and live API keys
+        if (trimmed.match(/"(sk|pk)_(test|live)_[0-9a-zA-Z]{24,}"/) ||
+            (trimmed.match(/STRIPE.*=\s*"(sk|pk)_/) && !trimmed.includes('System.getenv'))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('hardcoded-credentials', 'Hardcoded Stripe API key detected in source code', 'Use environment variables (System.getenv()) or secret management services', lineNumber, 'Hardcoded Stripe API keys allow attackers to access payment data, create refunds, view customer information, or perform unauthorized transactions. Secret keys (sk_) grant full API access while publishable keys (pk_) can expose business information.', 'String stripeKey = "sk_live_4eC39HqLyjWDarjtT1zdp7dc"; // Full payment system access', [
+                'Unauthorized payment processing',
+                'Customer data theft (PII, payment info)',
+                'Fraudulent refunds',
+                'Stripe account takeover',
+                'PCI-DSS compliance violations'
+            ], 'private static final String STRIPE_API_KEY = "sk_test_4eC39HqLyjWDarjtT1zdp7dc";', 'String stripeApiKey = System.getenv("STRIPE_API_KEY"); // From environment variable\n// Or with Spring: @Value("${stripe.api.key}") private String stripeApiKey;\nStripe.apiKey = stripeApiKey;', 'Store Stripe API keys in environment variables or secret management services. Use restricted API keys with minimal scopes when possible. Rotate keys immediately if exposed. Never commit to version control'));
+        }
+        // 7d. Byte array encryption keys - MEDIUM (PRIORITY 1 FIX)
+        // Detect hardcoded byte arrays used for encryption (often seen as new byte[] { ... })
+        if (trimmed.match(/new\s+byte\s*\[\s*\]\s*\{.*\d+.*\}/) &&
+            (trimmed.match(/key|secret|salt|iv|encrypt|cipher/i) ||
+                lines[Math.max(0, index - 1)]?.match(/key|secret|salt|iv|encrypt|cipher/i) ||
+                lines[Math.min(lines.length - 1, index + 1)]?.match(/key|secret|salt|iv|encrypt|cipher/i))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('hardcoded-credentials', 'Hardcoded encryption key detected as byte array', 'Generate keys at runtime using KeyGenerator or derive from secure password-based key derivation (PBKDF2)', lineNumber, 'Hardcoded encryption keys in byte arrays are visible in compiled bytecode and can be extracted by attackers. This defeats the purpose of encryption since the key is as accessible as the plaintext data.', 'byte[] encryptionKey = new byte[] { 0x01, 0x23, 0x45, 0x67, 0x89, 0xAB, 0xCD, 0xEF }; // Visible in bytecode', [
+                'Encryption key exposure',
+                'Data decryption by attackers',
+                'Compliance violations',
+                'Key visible in decompiled code',
+                'Cannot rotate keys without code changes'
+            ], 'private static final byte[] ENCRYPTION_KEY = new byte[] {\n    0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,\n    0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F\n};', '// Generate key at runtime:\nKeyGenerator keyGen = KeyGenerator.getInstance("AES");\nkeyGen.init(256);\nSecretKey secretKey = keyGen.generateKey();\n// Or derive from password:\nSecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");\nKeySpec spec = new PBEKeySpec(password, salt, 65536, 256);\nSecretKey secret = new SecretKeySpec(factory.generateSecret(spec).getEncoded(), "AES");', 'Generate encryption keys at runtime using KeyGenerator or derive from passwords using PBKDF2. Store keys in Java KeyStore or external key management systems (AWS KMS, Azure Key Vault, HashiCorp Vault)'));
+        }
+        // 7e. Spring @Value with hardcoded credentials - CRITICAL (PRIORITY 4 FIX)
+        // Detect @Value annotations with literal strings (not placeholders like ${DB_URL})
+        // FIX (Dec 6, 2025): Removed old comment checks - now handled by inMultiLineComment tracking
+        if (trimmed.match(/@Value\s*\(\s*"[^$][^"]*"\s*\)/)) {
+            // Check next line for sensitive variable names
+            const nextLine = lines[index + 1];
+            // PHASE 6 FIX (2025-11-21): Added username, email, user to sensitive keyword list
+            // Previous bug: @Value("myapp@gmail.com") with emailUsername variable was missed
+            const isSensitive = nextLine &&
+                nextLine.match(/(password|passwd|pwd|secret|token|apiKey|privateKey|key|auth|credential|username|email|user)/i);
+            if (isSensitive) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('hardcoded-credentials', 'Hardcoded credentials in @Value annotation', 'Use Spring placeholders: @Value("${db.password}") or environment variables', lineNumber, 'Hardcoded credentials in @Value annotations are visible in source code, version control, and compiled bytecode. Spring applications should use placeholders that reference external configuration (application.properties, environment variables, or secret management services).', '@Value("MySecretP@ss123") private String password; // Hardcoded password visible in source', [
+                    'Credential exposure in version control',
+                    'Unauthorized system access',
+                    'Compliance violations (PCI-DSS, SOC2)',
+                    'Credential reuse across environments',
+                    'Visible in decompiled bytecode'
+                ], '@Value("smtp.password.hardcoded")\nprivate String emailPassword;\n// or\n@Value("AKIAIOSFODNN7EXAMPLE")\nprivate String awsAccessKey;', '// Use Spring placeholders:\n@Value("${smtp.password}")\nprivate String emailPassword;\n\n// application.properties:\n// smtp.password=${SMTP_PASSWORD}\n\n// Or environment variable directly:\n@Value("${SMTP_PASSWORD}")\nprivate String emailPassword;', 'Use Spring placeholder syntax @Value("${property.name}") to reference external configuration. Store secrets in application-<profile>.properties, environment variables, or Spring Cloud Config. Never hardcode credentials in @Value annotations'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=hardcoded-credentials.js.map

package/dist/src/lib/analyzers/java/security-checks/hardcoded-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-credentials.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/hardcoded-credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAUH,8DAsKC;AA7KD,sEAA+E;AAE/E;;;;GAIG;AACH,SAAgB,yBAAyB,CAAC,KAAe;IACvD,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAE7B,wDAAwD;QACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,8DAA8D;QAC9D,IAAI,CAAC,OAAO;YACR,kBAAkB;YAClB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,0EAA0E;QAC1E,uFAAuF;QACvF,kGAAkG;QAClG,sGAAsG;QACtG,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;QACpF,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEhD,IAAI,oBAAoB,IAAI,aAAa;YACrC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1G,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,uBAAuB,EACvB,+CAA+C,EAC/C,iGAAiG,EACjG,UAAU,EACV,8QAA8Q,EAC9Q,+FAA+F,EAC/F;gBACE,wCAAwC;gBACxC,4BAA4B;gBAC5B,aAAa;gBACb,uCAAuC;gBACvC,iCAAiC;aAClC,EACD,oHAAoH,EACpH,mOAAmO,EACnO,uNAAuN,CACxN,CAAC,CAAC;QACL,CAAC;QAED,kDAAkD;QAClD,iFAAiF;QACjF,IAAI,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,oBAAoB;YAC3D,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,+CAA+C;YACxF,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACxE,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,uBAAuB,EACvB,mDAAmD,EACnD,oFAAoF,EACpF,UAAU,EACV,kNAAkN,EAClN,iHAAiH,EACjH;gBACE,kCAAkC;gBAClC,wCAAwC;gBACxC,4BAA4B;gBAC5B,2BAA2B;gBAC3B,oCAAoC;aACrC,EACD,gKAAgK,EAChK,0SAA0S,EAC1S,0MAA0M,CAC3M,CAAC,CAAC;QACL,CAAC;QAED,kDAAkD;QAClD,uCAAuC;QACvC,IAAI,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC;YACvD,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACnF,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,uBAAuB,EACvB,kDAAkD,EAClD,2EAA2E,EAC3E,UAAU,EACV,0PAA0P,EAC1P,sFAAsF,EACtF;gBACE,iCAAiC;gBACjC,yCAAyC;gBACzC,oBAAoB;gBACpB,yBAAyB;gBACzB,+BAA+B;aAChC,EACD,kFAAkF,EAClF,iMAAiM,EACjM,8MAA8M,CAC/M,CAAC,CAAC;QACL,CAAC;QAED,2DAA2D;QAC3D,sFAAsF;QACtF,IAAI,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC;YACnD,CAAC,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,oCAAoC,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC;YAChG,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,uBAAuB,EACvB,iDAAiD,EACjD,0GAA0G,EAC1G,UAAU,EACV,2MAA2M,EAC3M,8GAA8G,EAC9G;gBACE,yBAAyB;gBACzB,8BAA8B;gBAC9B,uBAAuB;gBACvB,gCAAgC;gBAChC,yCAAyC;aAC1C,EACD,wKAAwK,EACxK,yZAAyZ,EACzZ,0MAA0M,CAC3M,CAAC,CAAC;QACL,CAAC;QAED,2EAA2E;QAC3E,mFAAmF;QACnF,6FAA6F;QAC7F,IAAI,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACpD,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAClC,kFAAkF;YAClF,iFAAiF;YACjF,MAAM,WAAW,GAAG,QAAQ;gBAC1B,QAAQ,CAAC,KAAK,CAAC,+FAA+F,CAAC,CAAC;YAElH,IAAI,WAAW,EAAE,CAAC;gBAChB,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,uBAAuB,EACvB,4CAA4C,EAC5C,4EAA4E,EAC5E,UAAU,EACV,mRAAmR,EACnR,4FAA4F,EAC5F;oBACE,wCAAwC;oBACxC,4BAA4B;oBAC5B,uCAAuC;oBACvC,sCAAsC;oBACtC,gCAAgC;iBACjC,EACD,uIAAuI,EACvI,4PAA4P,EAC5P,kPAAkP,CACnP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/injection-attacks.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Java Injection Attack Detection Module
+ *
+ * OWASP A03:2021 - Injection
+ *
+ * This module detects various injection vulnerabilities in Java code:
+ * - SQL Injection (CRITICAL)
+ * - Command Injection (CRITICAL)
+ * - LDAP Injection (HIGH)
+ * - XPath Injection (HIGH)
+ *
+ * All checks follow the pattern matching approach to identify vulnerable
+ * string concatenation in security-sensitive contexts.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for injection vulnerabilities in Java code
+ *
+ * @param lines - Array of code lines to analyze
+ * @returns Array of detected security vulnerabilities
+ */
+export declare function checkInjectionAttacks(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=injection-attacks.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/injection-attacks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-attacks.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/injection-attacks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,qBAAqB,EAAE,CAgQ9E"}

package/dist/src/lib/analyzers/java/security-checks/injection-attacks.js

@@ -0,0 +1,201 @@
+"use strict";
+/**
+ * Java Injection Attack Detection Module
+ *
+ * OWASP A03:2021 - Injection
+ *
+ * This module detects various injection vulnerabilities in Java code:
+ * - SQL Injection (CRITICAL)
+ * - Command Injection (CRITICAL)
+ * - LDAP Injection (HIGH)
+ * - XPath Injection (HIGH)
+ *
+ * All checks follow the pattern matching approach to identify vulnerable
+ * string concatenation in security-sensitive contexts.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkInjectionAttacks = checkInjectionAttacks;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for injection vulnerabilities in Java code
+ *
+ * @param lines - Array of code lines to analyze
+ * @returns Array of detected security vulnerabilities
+ */
+function checkInjectionAttacks(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // 1. SQL Injection - CRITICAL (Enhanced for Phase B)
+        // Detects:
+        // - JDBC: executeQuery/executeUpdate with concatenation
+        // - JPA/JPQL: createQuery/createNativeQuery with concatenation
+        // - Hibernate: session.createSQLQuery with concatenation
+        // - MyBatis: ${} vulnerable interpolation (vs #{} safe)
+        // - StringBuilder usage in queries
+        // - Query string construction with SQL keywords + concatenation
+        const hasJDBCExecution = trimmed.match(/executeQuery\s*\(.*\+/) ||
+            trimmed.match(/executeUpdate\s*\(.*\+/);
+        // Check for JPA/Hibernate with concatenation on current line OR when calling with a variable
+        // that was constructed with SQL keywords + concatenation on previous lines
+        const hasJPAHibernateConcat = trimmed.match(/createQuery\s*\(.*\+/) ||
+            trimmed.match(/createNativeQuery\s*\(.*\+/) ||
+            trimmed.match(/createSQLQuery\s*\(.*\+/);
+        // Check if calling createQuery/createNativeQuery with a variable that was built with concatenation
+        const hasJPAHibernateCall = trimmed.match(/create(Query|NativeQuery|SQLQuery)\s*\(/);
+        const prevLines = lines.slice(Math.max(0, index - 5), index);
+        const hasQueryVarWithConcat = hasJPAHibernateCall && prevLines.some(l => l.match(/\b(query|sql|jpql|hql)\b.*=/) && l.includes('+') && l.match(/SELECT|INSERT|UPDATE|DELETE/i));
+        const hasJPAHibernate = hasJPAHibernateConcat || hasQueryVarWithConcat;
+        // MyBatis vulnerable interpolation: ${variable} instead of #{variable}
+        const hasMyBatisVuln = trimmed.match(/\$\{[^}]+\}/) &&
+            (trimmed.match(/SELECT|INSERT|UPDATE|DELETE/i) || trimmed.match(/<select|<insert|<update|<delete/));
+        // StringBuilder usage in SQL queries
+        const hasStringBuilderSQL = trimmed.match(/StringBuilder.*SELECT|INSERT|UPDATE|DELETE/i) ||
+            (trimmed.match(/\.append\s*\(/) && index > 0 &&
+                lines.slice(Math.max(0, index - 3), index).some(l => l.match(/StringBuilder/) && l.match(/SELECT|INSERT|UPDATE|DELETE/i)));
+        // SQL query string construction with concatenation
+        const hasSQLKeywords = trimmed.match(/\b(SELECT|INSERT|UPDATE|DELETE|FROM|WHERE)\b/i);
+        const hasStringConcat = trimmed.includes(' + ') || trimmed.includes('+ "') || trimmed.includes('" +');
+        const isQueryStringConstruction = hasSQLKeywords && hasStringConcat;
+        if (hasJDBCExecution || hasJPAHibernate || hasMyBatisVuln || hasStringBuilderSQL || isQueryStringConstruction) {
+            let message = 'SQL Injection vulnerability detected';
+            let recommendation = 'Use PreparedStatement with parameterized queries or JPA with named parameters';
+            if (hasJPAHibernate) {
+                message = 'SQL Injection vulnerability detected in JPA/JPQL/Hibernate query';
+                recommendation = 'Use JPA named parameters (:name) with setParameter(), not string concatenation';
+            }
+            else if (hasMyBatisVuln) {
+                message = 'SQL Injection vulnerability detected in MyBatis query';
+                recommendation = 'Use #{} parameter binding instead of ${} interpolation in MyBatis queries';
+            }
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('sql-injection', message, recommendation, lineNumber, 'String concatenation in SQL queries allows attackers to inject malicious SQL code, bypassing authentication, accessing sensitive data, modifying or deleting records, and potentially executing administrative operations on the database. This applies to JDBC, JPA/JPQL, Hibernate HQL/SQL, and MyBatis dynamic queries.', 'entityManager.createQuery("SELECT u FROM User u WHERE u.name = \'" + username + "\'") where username = "\' OR \'1\'=\'1" bypasses filters and returns all users', [
+                'Full database access (read/write/delete)',
+                'Authentication bypass',
+                'Data exfiltration (passwords, credit cards, PII)',
+                'Data destruction (DROP TABLE attacks)',
+                'Privilege escalation to DBA',
+                'Business logic bypass'
+            ], 'String query = "SELECT u FROM User u WHERE u.name = \'" + username + "\'";\nentityManager.createQuery(query);', 'String query = "SELECT u FROM User u WHERE u.name = :name";\nentityManager.createQuery(query).setParameter("name", username);', 'Use parameterized queries with named parameters (:name) for JPA/JPQL, PreparedStatement placeholders (?) for JDBC, and #{} parameter binding for MyBatis. Never use string concatenation or ${} interpolation with user input'));
+        }
+        // 2. Command Injection - CRITICAL (Enhanced for Phase B)
+        // Detects:
+        // - Runtime.exec() with concatenation or shell invocation
+        // - ProcessBuilder with shell ("sh", "bash", "cmd.exe", "/c")
+        // - Apache Commons Exec with user input
+        // - Environment variable injection
+        // Pattern 1: Runtime.exec with concatenation
+        const hasRuntimeExec = trimmed.match(/\.exec\s*\(/i) && trimmed.includes('+');
+        // Pattern 2: ProcessBuilder with shell invocation
+        const hasProcessBuilderShell = trimmed.match(/ProcessBuilder\s*\(/) &&
+            (trimmed.match(/"sh"|"bash"|"cmd\.exe"|"\/c"/) ||
+                trimmed.match(/'sh'|'bash'|'cmd\.exe'|'\/c'/));
+        // Pattern 3: ProcessBuilder with concatenation
+        const hasProcessBuilderConcat = trimmed.includes('ProcessBuilder(') && trimmed.includes('+');
+        // Pattern 4: Commons Exec with user input
+        const hasCommonsExec = trimmed.match(/CommandLine\s*\(/) || trimmed.match(/\.execute\s*\(/);
+        // Pattern 5: String command construction (for next line exec check)
+        const isCommandConstruction = trimmed.match(/String\s+\w*(cmd|command|exec)\w*\s*=/) && trimmed.includes('+');
+        if (hasRuntimeExec || hasProcessBuilderShell || hasProcessBuilderConcat || hasCommonsExec || isCommandConstruction) {
+            let message = 'Command Injection vulnerability detected';
+            let recommendation = 'Use ProcessBuilder with separate arguments array, never concatenate user input into shell commands';
+            if (hasProcessBuilderShell) {
+                message = 'Command Injection vulnerability detected - ProcessBuilder with shell invocation';
+                recommendation = 'Do not invoke shell (sh, bash, cmd.exe). Use ProcessBuilder with direct command and separate arguments';
+            }
+            else if (hasCommonsExec) {
+                message = 'Command Injection vulnerability detected in Apache Commons Exec';
+                recommendation = 'Validate and sanitize all user input before passing to CommandLine. Use argument array, not string parsing';
+            }
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('command-injection', message, recommendation, lineNumber, 'String concatenation in system commands allows attackers to inject shell metacharacters (;, |, &, $, `, \\n) to execute arbitrary commands on the server with the application\'s privileges, potentially taking complete control of the system. This applies to Runtime.exec(), ProcessBuilder, and Apache Commons Exec.', 'Runtime.getRuntime().exec("ping " + userInput) where userInput = "8.8.8.8; rm -rf /" executes file deletion after ping', [
+                'Complete server compromise',
+                'Arbitrary code execution (RCE)',
+                'Data exfiltration',
+                'Installation of backdoors',
+                'Lateral movement to other systems',
+                'Cryptomining/ransomware deployment'
+            ], 'String cmd = "ping " + userInput;\nRuntime.getRuntime().exec(cmd);\n// OR\nProcessBuilder pb = new ProcessBuilder("sh", "-c", userCommand);', 'ProcessBuilder pb = new ProcessBuilder("ping", "-c", "4", userInput);\nProcess p = pb.start();\n// User input is a separate argument, not part of command string', 'Use ProcessBuilder with separate argument array. Each argument is passed as a distinct parameter, preventing shell interpretation of metacharacters. Never invoke shell wrappers (sh, bash, cmd.exe) with user input. Validate input against strict whitelist if command construction is unavoidable'));
+        }
+        // 3. LDAP Injection - HIGH (Enhanced for Phase B)
+        // Detects:
+        // - JNDI DirContext.search() with concatenated filters
+        // - InitialDirContext.bind/lookup with user input
+        // - UnboundID SDK Filter.create() with concatenation
+        // - LdapTemplate.search() with concatenation
+        // - ModificationItem operations with user input
+        // - Bind DN construction with concatenation
+        // Pattern 1: JNDI search with filter concatenation
+        const hasLdapSearch = trimmed.match(/\.search\s*\(/i) &&
+            (trimmed.match(/ldap|LDAP|DirContext|ctx|context|LdapTemplate/i) ||
+                trimmed.match(/search\s*\(.*,.*".*\(/)); // search(baseDN, "(uid=...")
+        // Pattern 2: UnboundID Filter.create with concatenation
+        const hasUnboundIDVuln = trimmed.match(/Filter\.create\s*\(.*\+/);
+        // Pattern 3: LDAP bind/lookup with DN concatenation
+        // Check both current line and previous lines for DN construction
+        const hasBindOrLookup = trimmed.match(/\.bind\s*\(/) || trimmed.match(/\.lookup\s*\(/);
+        const hasLdapBindLookup = hasBindOrLookup &&
+            (trimmed.includes('+') || trimmed.match(/cn=.*\+/) ||
+                prevLines.some(l => l.match(/\bdn\s*=/) && l.includes('+')));
+        // Pattern 4: ModificationItem with user input or modifyAttributes with DN concat
+        const hasLdapModify = (trimmed.match(/ModificationItem\s*\[/) || trimmed.match(/modifyAttributes\s*\(/)) &&
+            (trimmed.includes('+') || prevLines.some(l => l.includes('ModificationItem') || l.includes('+')));
+        if (hasLdapSearch || hasUnboundIDVuln || hasLdapBindLookup || hasLdapModify) {
+            // Check previous 5 lines for string concatenation with filter/dn variable
+            const prevLines = lines.slice(Math.max(0, index - 5), index);
+            const hasFilterConcat = prevLines.some(l => l.match(/filter.*=.*\+/) ||
+                l.match(/dn.*=.*\+/) ||
+                l.match(/=.*\+.*\).*"/) ||
+                l.match(/cn=.*\+/) ||
+                l.match(/uid=.*\+/));
+            // Check current line for direct concatenation in filters or DNs
+            const hasDirectConcat = trimmed.includes('+') &&
+                (trimmed.match(/\(uid=/) || trimmed.match(/\(cn=/) ||
+                    trimmed.match(/dn=/) || trimmed.match(/"cn=/) ||
+                    trimmed.match(/"uid=/) || trimmed.match(/"ou=/));
+            if (hasFilterConcat || hasDirectConcat || hasUnboundIDVuln) {
+                let message = 'LDAP Injection vulnerability detected';
+                let recommendation = 'Use LdapEncoder.filterEncode() or properly escape special LDAP characters in user input';
+                if (hasUnboundIDVuln) {
+                    message = 'LDAP Injection vulnerability detected in UnboundID Filter.create()';
+                    recommendation = 'Use Filter.createEqualityFilter() instead of Filter.create() with concatenation';
+                }
+                else if (hasLdapBindLookup) {
+                    message = 'LDAP Injection vulnerability detected in bind/lookup DN';
+                    recommendation = 'Use LdapEncoder.nameEncode() for DN components, validate against whitelist';
+                }
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('ldap-injection', message, recommendation, lineNumber, 'String concatenation in LDAP filters or DNs allows attackers to inject LDAP metacharacters like *, (, ), &, |, to modify the query logic, bypass authentication, access unauthorized data, enumerate directory entries, or manipulate LDAP operations. This applies to JNDI, UnboundID SDK, and Spring LDAP.', 'ctx.search("ou=users", "(uid=" + username + ")", controls) where username = "*)(uid=*" returns all users bypassing authentication', [
+                    'Authentication bypass',
+                    'Unauthorized data access',
+                    'Directory enumeration',
+                    'Information disclosure (email, phone, department)',
+                    'Privilege escalation',
+                    'LDAP data manipulation'
+                ], 'String filter = "(uid=" + username + ")";\nNamingEnumeration results = ctx.search("ou=users", filter, controls);', 'import org.springframework.ldap.support.LdapEncoder;\nString safeUsername = LdapEncoder.filterEncode(username);\nString filter = "(uid=" + safeUsername + ")";\n// Or use UnboundID safe API:\nFilter filter = Filter.createEqualityFilter("uid", username);', 'Use LdapEncoder.filterEncode() to escape special LDAP characters (*, (, ), \\, /, NULL) before inserting into filters. For UnboundID SDK, use Filter.createEqualityFilter() instead of Filter.create(). For DNs, use LdapEncoder.nameEncode() and validate components against whitelist'));
+            }
+        }
+        // 4. XPath Injection - HIGH
+        if (trimmed.match(/evaluate\s*\(.*\+/) && trimmed.match(/XPath|xpath/)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('xpath-injection', 'XPath Injection vulnerability detected', 'Use parameterized XPath queries or properly escape/validate all user input', lineNumber, 'String concatenation in XPath queries allows attackers to manipulate XML query logic by injecting XPath operators and functions, potentially accessing unauthorized XML data, bypassing authentication, or extracting the entire document structure.', 'xpath.evaluate("//users/user[username=\'" + username + "\' and password=\'" + password + "\']", doc) where username = "\' or \'1\'=\'1" bypasses authentication', [
+                'Authentication bypass',
+                'Unauthorized XML data access',
+                'Information disclosure',
+                'XML structure enumeration',
+                'Business logic bypass'
+            ], 'String query = "//users/user[username=\'" + username + "\' and password=\'" + password + "\']";\nxpath.evaluate(query, doc);', '// Use parameterized XPath (if supported) or sanitize input\nString safeUsername = username.replaceAll("[\'\\\"\\\\]", "");\nString query = "//users/user[username=\'" + safeUsername + "\']";\n// Better: Use XPathExpression with setXPathVariableResolver', 'Validate and sanitize user input by removing XPath metacharacters. Preferably use XPath parameterization if your XML library supports it, or switch to safer alternatives like XQuery with parameters'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=injection-attacks.js.map

package/dist/src/lib/analyzers/java/security-checks/injection-attacks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-attacks.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/injection-attacks.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAWH,sDAgQC;AAxQD,sEAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,KAAe;IACnD,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,qDAAqD;QACrD,WAAW;QACX,wDAAwD;QACxD,+DAA+D;QAC/D,yDAAyD;QACzD,wDAAwD;QACxD,mCAAmC;QACnC,gEAAgE;QAEhE,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAElE,6FAA6F;QAC7F,2EAA2E;QAC3E,MAAM,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAExE,mGAAmG;QACnG,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7D,MAAM,qBAAqB,GAAG,mBAAmB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACtE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CACrG,CAAC;QAEF,MAAM,eAAe,GAAG,qBAAqB,IAAI,qBAAqB,CAAC;QAEvE,uEAAuE;QACvE,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;YAC3B,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAE5H,qCAAqC;QACrC,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC;YAC3D,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,KAAK,GAAG,CAAC;gBAC3C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAClD,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CACpE,CAAC,CAAC;QAEjC,mDAAmD;QACnD,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACtF,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtG,MAAM,yBAAyB,GAAG,cAAc,IAAI,eAAe,CAAC;QAEpE,IAAI,gBAAgB,IAAI,eAAe,IAAI,cAAc,IAAI,mBAAmB,IAAI,yBAAyB,EAAE,CAAC;YAC9G,IAAI,OAAO,GAAG,sCAAsC,CAAC;YACrD,IAAI,cAAc,GAAG,+EAA+E,CAAC;YAErG,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,GAAG,kEAAkE,CAAC;gBAC7E,cAAc,GAAG,gFAAgF,CAAC;YACpG,CAAC;iBAAM,IAAI,cAAc,EAAE,CAAC;gBAC1B,OAAO,GAAG,uDAAuD,CAAC;gBAClE,cAAc,GAAG,2EAA2E,CAAC;YAC/F,CAAC;YAED,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,eAAe,EACf,OAAO,EACP,cAAc,EACd,UAAU,EACV,4TAA4T,EAC5T,iKAAiK,EACjK;gBACE,0CAA0C;gBAC1C,uBAAuB;gBACvB,kDAAkD;gBAClD,uCAAuC;gBACvC,6BAA6B;gBAC7B,uBAAuB;aACxB,EACD,+GAA+G,EAC/G,+HAA+H,EAC/H,+NAA+N,CAChO,CAAC,CAAC;QACL,CAAC;QAED,yDAAyD;QACzD,WAAW;QACX,0DAA0D;QAC1D,8DAA8D;QAC9D,wCAAwC;QACxC,mCAAmC;QAEnC,6CAA6C;QAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE9E,kDAAkD;QAClD,MAAM,sBAAsB,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC;YACnC,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC;gBAC7C,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAEhF,+CAA+C;QAC/C,MAAM,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE7F,0CAA0C;QAC1C,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAE5F,oEAAoE;QACpE,MAAM,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE9G,IAAI,cAAc,IAAI,sBAAsB,IAAI,uBAAuB,IAAI,cAAc,IAAI,qBAAqB,EAAE,CAAC;YACnH,IAAI,OAAO,GAAG,0CAA0C,CAAC;YACzD,IAAI,cAAc,GAAG,oGAAoG,CAAC;YAE1H,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,OAAO,GAAG,iFAAiF,CAAC;gBAC5F,cAAc,GAAG,wGAAwG,CAAC;YAC5H,CAAC;iBAAM,IAAI,cAAc,EAAE,CAAC;gBAC1B,OAAO,GAAG,iEAAiE,CAAC;gBAC5E,cAAc,GAAG,4GAA4G,CAAC;YAChI,CAAC;YAED,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,mBAAmB,EACnB,OAAO,EACP,cAAc,EACd,UAAU,EACV,0TAA0T,EAC1T,wHAAwH,EACxH;gBACE,4BAA4B;gBAC5B,gCAAgC;gBAChC,mBAAmB;gBACnB,2BAA2B;gBAC3B,mCAAmC;gBACnC,oCAAoC;aACrC,EACD,6IAA6I,EAC7I,kKAAkK,EAClK,sSAAsS,CACvS,CAAC,CAAC;QACL,CAAC;QAED,kDAAkD;QAClD,WAAW;QACX,uDAAuD;QACvD,kDAAkD;QAClD,qDAAqD;QACrD,6CAA6C;QAC7C,gDAAgD;QAChD,4CAA4C;QAE5C,mDAAmD;QACnD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC/B,CAAC,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC;gBAC/D,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,6BAA6B;QAE7F,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAElE,oDAAoD;QACpD,iEAAiE;QACjE,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvF,MAAM,iBAAiB,GAAG,eAAe;YACb,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;gBACjD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAE1F,iFAAiF;QACjF,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACjF,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEzH,IAAI,aAAa,IAAI,gBAAgB,IAAI,iBAAiB,IAAI,aAAa,EAAE,CAAC;YAC5E,0EAA0E;YAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7D,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACzC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;gBACxB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;gBACpB,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;gBACvB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;gBAClB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CACpB,CAAC;YAEF,gEAAgE;YAChE,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACpB,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;oBACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;oBAC7C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAE3E,IAAI,eAAe,IAAI,eAAe,IAAI,gBAAgB,EAAE,CAAC;gBAC3D,IAAI,OAAO,GAAG,uCAAuC,CAAC;gBACtD,IAAI,cAAc,GAAG,yFAAyF,CAAC;gBAE/G,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO,GAAG,oEAAoE,CAAC;oBAC/E,cAAc,GAAG,iFAAiF,CAAC;gBACrG,CAAC;qBAAM,IAAI,iBAAiB,EAAE,CAAC;oBAC7B,OAAO,GAAG,yDAAyD,CAAC;oBACpE,cAAc,GAAG,4EAA4E,CAAC;gBAChG,CAAC;gBAED,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,UAAU,EACV,8SAA8S,EAC9S,mIAAmI,EACnI;oBACE,uBAAuB;oBACvB,0BAA0B;oBAC1B,uBAAuB;oBACvB,mDAAmD;oBACnD,sBAAsB;oBACtB,wBAAwB;iBACzB,EACD,kHAAkH,EAClH,8PAA8P,EAC9P,yRAAyR,CAC1R,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACvE,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,iBAAiB,EACjB,wCAAwC,EACxC,4EAA4E,EAC5E,UAAU,EACV,sPAAsP,EACtP,iKAAiK,EACjK;gBACE,uBAAuB;gBACvB,8BAA8B;gBAC9B,wBAAwB;gBACxB,2BAA2B;gBAC3B,uBAAuB;aACxB,EACD,8HAA8H,EAC9H,8PAA8P,EAC9P,uMAAuM,CACxM,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/insecure-design.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Java Insecure Design Security Checks
+ * OWASP A06:2025 - Insecure Design
+ *
+ * Detects insecure design patterns in Java applications.
+ * Updated for OWASP 2025 with architectural security patterns (Phase 7B Day 9).
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for insecure design security vulnerabilities in Java code
+ *
+ * Covers:
+ * - Check #1: Missing input validation (no @Valid/@Validated) (HIGH)
+ * - Check #2: Direct database queries in controllers (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkInsecureDesign(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=insecure-design.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/insecure-design.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-design.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/insecure-design.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAuKzB"}

package/dist/src/lib/analyzers/java/security-checks/insecure-design.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Java Insecure Design Security Checks
+ * OWASP A06:2025 - Insecure Design
+ *
+ * Detects insecure design patterns in Java applications.
+ * Updated for OWASP 2025 with architectural security patterns (Phase 7B Day 9).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkInsecureDesign = checkInsecureDesign;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for insecure design security vulnerabilities in Java code
+ *
+ * Covers:
+ * - Check #1: Missing input validation (no @Valid/@Validated) (HIGH)
+ * - Check #2: Direct database queries in controllers (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkInsecureDesign(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    let inControllerClass = false;
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmedLine.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmedLine.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('//')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Track if we're inside a @RestController or @Controller class
+        // Also set flag when seeing mapping annotations (indicates controller method)
+        if (lowerLine.includes('@restcontroller') || lowerLine.includes('@controller')) {
+            inControllerClass = true;
+        }
+        if (lowerLine.match(/@(get|post|put|patch|delete|request)mapping/)) {
+            inControllerClass = true;
+        }
+        // Check #1: Missing input validation on POST/PUT/PATCH endpoints
+        const isModifyingEndpoint = lowerLine.match(/@(post|put|patch)mapping/);
+        if (isModifyingEndpoint) {
+            // Look for @RequestBody in the next 2 lines (method signature)
+            const nextLines = lines.slice(index + 1, Math.min(index + 3, lines.length));
+            const hasRequestBody = nextLines.some(nextLine => nextLine.toLowerCase().includes('@requestbody'));
+            if (hasRequestBody) {
+                // Check if @Valid or @Validated is present
+                const hasValidation = nextLines.some(nextLine => {
+                    const lowerNext = nextLine.toLowerCase();
+                    return lowerNext.includes('@valid') || lowerNext.includes('@validated');
+                });
+                if (!hasValidation) {
+                    // Find the actual method line number
+                    let methodLineIndex = index + 1;
+                    for (let i = index + 1; i < Math.min(index + 3, lines.length); i++) {
+                        if (lines[i].trim().match(/^(public|private|protected)\s+\w+\s+\w+\s*\(/)) {
+                            methodLineIndex = i;
+                            break;
+                        }
+                    }
+                    vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('missing-input-validation', 'Controller method missing input validation annotation', 'Add @Valid or @Validated annotation to @RequestBody parameters', methodLineIndex + 1, 'Missing input validation allows attackers to send malformed or malicious data that can cause application crashes, data corruption, business logic bypass, or injection attacks', '@PostMapping("/users")\npublic User create(@RequestBody User user) { } // No @Valid!', [
+                        'SQL injection through unvalidated input',
+                        'Business logic bypass with invalid data',
+                        'Data corruption from malformed requests',
+                        'Application crashes from unexpected values',
+                        'Mass assignment vulnerabilities'
+                    ], '@PostMapping("/users")\npublic User create(@RequestBody User user) { }', '@PostMapping("/users")\npublic User create(@Valid @RequestBody UserDTO dto) {\n  // Spring validates DTO constraints\n}', 'Always use @Valid or @Validated with Bean Validation constraints (@NotNull, @Size, @Email, etc.) to validate all user input'));
+                }
+            }
+        }
+        // Check #2: Direct database access in controllers
+        // Detect EntityManager, JdbcTemplate in controller classes
+        if (inControllerClass) {
+            // Check for EntityManager field declaration
+            if (lowerLine.includes('entitymanager') &&
+                (lowerLine.includes('private') || lowerLine.includes('autowired') || lowerLine.includes('@persistencecontext'))) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('direct-database-query', 'direct database access detected in controller layer', 'Move database queries to service or repository layer', index + 1, 'Controllers with direct database access violate separation of concerns, make testing difficult, bypass business logic validation, and create security and maintainability issues', '@RestController\nclass UserController {\n  @PersistenceContext EntityManager em; // Direct DB access!', [
+                    'Bypass of business logic validation',
+                    'SQL injection if queries are constructed dynamically',
+                    'Difficult to implement access control',
+                    'Cannot reuse database logic across endpoints',
+                    'Testing complexity and maintenance issues'
+                ], '@PersistenceContext\nprivate EntityManager entityManager;', '@Autowired\nprivate UserService userService; // Use service layer', 'Controllers should only handle HTTP concerns. Move all database queries to repository or service layers'));
+            }
+            // Check for JdbcTemplate field declaration
+            if (lowerLine.includes('jdbctemplate') &&
+                (lowerLine.includes('private') || lowerLine.includes('autowired'))) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('direct-database-query', 'direct database access detected in controller layer', 'Move database queries to service or repository layer', index + 1, 'Controllers with direct database access violate separation of concerns and create security vulnerabilities', '@Autowired\nprivate JdbcTemplate jdbcTemplate; // Direct DB access in controller!', [
+                    'Bypass of business logic validation',
+                    'SQL injection risks',
+                    'Difficult to implement proper access control',
+                    'Cannot reuse queries across the application',
+                    'Testing and maintenance complexity'
+                ], '@Autowired\nprivate JdbcTemplate jdbcTemplate;', '@Autowired\nprivate UserRepository userRepository; // Use repository layer', 'Use the repository pattern to encapsulate all data access logic'));
+            }
+            // Check for createQuery calls in controller methods
+            if (lowerLine.includes('createquery') || lowerLine.includes('createnativequery')) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('direct-database-query', 'direct database query execution in controller method', 'Move query execution to service or repository layer', index + 1, 'Executing database queries directly in controllers bypasses proper layering and security controls', 'entityManager.createQuery("SELECT u FROM User u").getResultList(); // Direct query!', [
+                    'Business logic bypass',
+                    'SQL injection if query uses string concatenation',
+                    'Cannot enforce consistent access control',
+                    'Difficult to test and maintain',
+                    'Violates single responsibility principle'
+                ], 'return entityManager.createQuery("SELECT u FROM User u").getResultList();', 'return userService.findAll(); // Service handles queries', 'All database queries should be encapsulated in service or repository methods'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=insecure-design.js.map

package/dist/src/lib/analyzers/java/security-checks/insecure-design.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-design.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/insecure-design.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAeH,kDAyKC;AArLD,sEAA+E;AAE/E;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CACjC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wDAAwD;QACxD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,+DAA+D;QAC/D,8EAA8E;QAC9E,IAAI,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/E,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,6CAA6C,CAAC,EAAE,CAAC;YACnE,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QAED,iEAAiE;QACjE,MAAM,mBAAmB,GAAG,SAAS,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAExE,IAAI,mBAAmB,EAAE,CAAC;YACxB,+DAA+D;YAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAC/C,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAChD,CAAC;YAEF,IAAI,cAAc,EAAE,CAAC;gBACnB,2CAA2C;gBAC3C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAC9C,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;oBACzC,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC1E,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,qCAAqC;oBACrC,IAAI,eAAe,GAAG,KAAK,GAAG,CAAC,CAAC;oBAChC,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;wBACnE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,8CAA8C,CAAC,EAAE,CAAC;4BAC1E,eAAe,GAAG,CAAC,CAAC;4BACpB,MAAM;wBACR,CAAC;oBACH,CAAC;oBAED,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,0BAA0B,EAC1B,uDAAuD,EACvD,gEAAgE,EAChE,eAAe,GAAG,CAAC,EACnB,gLAAgL,EAChL,sFAAsF,EACtF;wBACE,yCAAyC;wBACzC,yCAAyC;wBACzC,yCAAyC;wBACzC,4CAA4C;wBAC5C,iCAAiC;qBAClC,EACD,wEAAwE,EACxE,yHAAyH,EACzH,6HAA6H,CAC9H,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,2DAA2D;QAC3D,IAAI,iBAAiB,EAAE,CAAC;YACtB,4CAA4C;YAC5C,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACnC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC;gBACpH,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,uBAAuB,EACvB,qDAAqD,EACrD,sDAAsD,EACtD,KAAK,GAAG,CAAC,EACT,kLAAkL,EAClL,uGAAuG,EACvG;oBACE,qCAAqC;oBACrC,sDAAsD;oBACtD,uCAAuC;oBACvC,8CAA8C;oBAC9C,2CAA2C;iBAC5C,EACD,2DAA2D,EAC3D,mEAAmE,EACnE,yGAAyG,CAC1G,CACF,CAAC;YACJ,CAAC;YAED,2CAA2C;YAC3C,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAClC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBACvE,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,uBAAuB,EACvB,qDAAqD,EACrD,sDAAsD,EACtD,KAAK,GAAG,CAAC,EACT,4GAA4G,EAC5G,mFAAmF,EACnF;oBACE,qCAAqC;oBACrC,qBAAqB;oBACrB,8CAA8C;oBAC9C,6CAA6C;oBAC7C,oCAAoC;iBACrC,EACD,gDAAgD,EAChD,4EAA4E,EAC5E,iEAAiE,CAClE,CACF,CAAC;YACJ,CAAC;YAED,oDAAoD;YACpD,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACjF,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,uBAAuB,EACvB,sDAAsD,EACtD,qDAAqD,EACrD,KAAK,GAAG,CAAC,EACT,mGAAmG,EACnG,qFAAqF,EACrF;oBACE,uBAAuB;oBACvB,kDAAkD;oBAClD,0CAA0C;oBAC1C,gCAAgC;oBAChC,0CAA0C;iBAC3C,EACD,2EAA2E,EAC3E,0DAA0D,EAC1D,8EAA8E,CAC/E,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IAEH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/logging-failures.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Java Logging Failures Security Checks
+ * OWASP A09:2025 - Security Logging and Monitoring Failures
+ *
+ * Detects logging security failures in Java applications.
+ * Updated for OWASP 2025 with security logging patterns (Phase 7B Day 9).
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for logging security vulnerabilities in Java code
+ *
+ * Covers:
+ * - Check #1: Missing security event logging (MEDIUM)
+ * - Check #2: System.out.println in production (LOW)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkLoggingFailures(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=logging-failures.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/logging-failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-failures.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/logging-failures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CA0GzB"}