codeslick-cli 1.0.0

package/dist/src/lib/analyzers/java/utils/createVulnerability.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Utility function to create security vulnerability objects for Java analyzer
+ *
+ * This module provides a standardized way to create SecurityVulnerability objects
+ * with proper CVSS scoring, OWASP mapping, and compliance information.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Parameters for creating a security vulnerability object
+ */
+interface VulnerabilityParams {
+    category: string;
+    severity: string;
+    confidence: string;
+    message: string;
+    line: number;
+    suggestion: string;
+    owasp: string;
+    cwe: string;
+    pciDss: string;
+    securityRelevant?: boolean;
+    remediation: {
+        explanation: string;
+        before: string;
+        after: string;
+    };
+    attackVector: {
+        description: string;
+        exploitExample?: string;
+        realWorldImpact: string[];
+    };
+}
+/**
+ * Creates a standardized security vulnerability object for Java code
+ * Supports both object parameter style (OWASP 2025) and legacy individual parameters
+ *
+ * @param params - Object containing all vulnerability parameters (OWASP 2025 style)
+ * @returns SecurityVulnerability object with all required fields
+ */
+export declare function createJavaSecurityVulnerability(params: VulnerabilityParams): SecurityVulnerability;
+/**
+ * Legacy function signature for backward compatibility
+ *
+ * @param vulnerabilityType - Type identifier for severity scoring (e.g., 'sql-injection')
+ * @param message - User-friendly vulnerability message
+ * @param suggestion - Remediation suggestion
+ * @param lineNumber - Line number where vulnerability was detected
+ * @param attackDescription - Detailed description of the attack vector
+ * @param exploitExample - Example of how the vulnerability can be exploited
+ * @param realWorldImpact - Array of potential real-world impacts
+ * @param remediationBefore - Code example showing vulnerable pattern
+ * @param remediationAfter - Code example showing secure pattern
+ * @param remediationExplanation - Explanation of why the fix works
+ * @returns SecurityVulnerability object with all required fields
+ */
+export declare function createJavaSecurityVulnerability(vulnerabilityType: string, message: string, suggestion: string, lineNumber: number, attackDescription: string, exploitExample: string, realWorldImpact: string[], remediationBefore: string, remediationAfter: string, remediationExplanation: string): SecurityVulnerability;
+export {};
+//# sourceMappingURL=createVulnerability.d.ts.map

package/dist/src/lib/analyzers/java/utils/createVulnerability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createVulnerability.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/utils/createVulnerability.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIpD;;GAEG;AACH,UAAU,mBAAmB;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE;QACX,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,YAAY,EAAE;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,mBAAmB,GAC1B,qBAAqB,CAAC;AAEzB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAC7C,iBAAiB,EAAE,MAAM,EACzB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,EAAE,EACzB,iBAAiB,EAAE,MAAM,EACzB,gBAAgB,EAAE,MAAM,EACxB,sBAAsB,EAAE,MAAM,GAC7B,qBAAqB,CAAC"}

package/dist/src/lib/analyzers/java/utils/createVulnerability.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * Utility function to create security vulnerability objects for Java analyzer
+ *
+ * This module provides a standardized way to create SecurityVulnerability objects
+ * with proper CVSS scoring, OWASP mapping, and compliance information.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createJavaSecurityVulnerability = createJavaSecurityVulnerability;
+const severity_scoring_1 = require("../../../security/severity-scoring");
+const compliance_mapping_1 = require("../../../security/compliance-mapping");
+function createJavaSecurityVulnerability(paramsOrType, message, suggestion, lineNumber, attackDescription, exploitExample, realWorldImpact, remediationBefore, remediationAfter, remediationExplanation) {
+    // Check if using new object-style parameters (OWASP 2025)
+    if (typeof paramsOrType === 'object') {
+        const params = paramsOrType;
+        const scoring = (0, severity_scoring_1.calculateSeverityScore)(params.category);
+        const compliance = (0, compliance_mapping_1.getComplianceMapping)(params.category);
+        return {
+            severity: params.severity.toUpperCase(),
+            message: params.message,
+            suggestion: params.suggestion,
+            line: params.line,
+            category: params.category,
+            securityRelevant: params.securityRelevant, // P3: Propagate security relevance flag
+            cvssScore: scoring.cvssScore,
+            exploitLikelihood: scoring.exploitLikelihood,
+            impact: scoring.impact,
+            owasp: params.owasp,
+            cwe: params.cwe,
+            pciDss: params.pciDss,
+            attackVector: {
+                description: params.attackVector.description,
+                exploitExample: params.attackVector.exploitExample || '',
+                realWorldImpact: params.attackVector.realWorldImpact
+            },
+            remediation: {
+                before: params.remediation.before,
+                after: params.remediation.after,
+                explanation: params.remediation.explanation
+            }
+        };
+    }
+    // Legacy 10-parameter signature (backward compatibility)
+    const vulnerabilityType = paramsOrType;
+    const scoring = (0, severity_scoring_1.calculateSeverityScore)(vulnerabilityType);
+    const compliance = (0, compliance_mapping_1.getComplianceMapping)(vulnerabilityType);
+    return {
+        severity: scoring.severity,
+        message: message,
+        suggestion: suggestion,
+        line: lineNumber,
+        category: vulnerabilityType,
+        cvssScore: scoring.cvssScore,
+        exploitLikelihood: scoring.exploitLikelihood,
+        impact: scoring.impact,
+        owasp: compliance.owasp,
+        cwe: compliance.cwe,
+        pciDss: compliance.pciDss,
+        attackVector: {
+            description: attackDescription,
+            exploitExample: exploitExample,
+            realWorldImpact: realWorldImpact
+        },
+        remediation: {
+            before: remediationBefore,
+            after: remediationAfter,
+            explanation: remediationExplanation
+        }
+    };
+}
+//# sourceMappingURL=createVulnerability.js.map

package/dist/src/lib/analyzers/java/utils/createVulnerability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createVulnerability.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/utils/createVulnerability.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAuEH,0EAyEC;AA7ID,yEAA4E;AAC5E,6EAA4E;AAmE5E,SAAgB,+BAA+B,CAC7C,YAA0C,EAC1C,OAAgB,EAChB,UAAmB,EACnB,UAAmB,EACnB,iBAA0B,EAC1B,cAAuB,EACvB,eAA0B,EAC1B,iBAA0B,EAC1B,gBAAyB,EACzB,sBAA+B;IAE/B,0DAA0D;IAC1D,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,YAAmC,CAAC;QAEnD,MAAM,OAAO,GAAG,IAAA,yCAAsB,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAA,yCAAoB,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEzD,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAS;YAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,wCAAwC;YACnF,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,YAAY,EAAE;gBACZ,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;gBAC5C,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc,IAAI,EAAE;gBACxD,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,eAAe;aACrD;YACD,WAAW,EAAE;gBACX,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;gBACjC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK;gBAC/B,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,MAAM,iBAAiB,GAAG,YAAsB,CAAC;IACjD,MAAM,OAAO,GAAG,IAAA,yCAAsB,EAAC,iBAAiB,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAA,yCAAoB,EAAC,iBAAiB,CAAC,CAAC;IAE3D,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAQ;QACjB,UAAU,EAAE,UAAW;QACvB,IAAI,EAAE,UAAW;QACjB,QAAQ,EAAE,iBAAiB;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,YAAY,EAAE;YACZ,WAAW,EAAE,iBAAkB;YAC/B,cAAc,EAAE,cAAe;YAC/B,eAAe,EAAE,eAAgB;SAClC;QACD,WAAW,EAAE;YACX,MAAM,EAAE,iBAAkB;YAC1B,KAAK,EAAE,gBAAiB;YACxB,WAAW,EAAE,sBAAuB;SACrC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/lib/analyzers/java-analyzer.d.ts

@@ -0,0 +1,209 @@
+/**
+ * ⚠️ SHARED MODULE: Java Security Analyzer
+ *
+ * CRITICAL: This module is used by BOTH WebTool and GitHub App
+ *
+ * WebTool uses this for:
+ * - /api/analyze endpoint - Interactive single-file analysis (<3s target)
+ * - Real-time vulnerability detection for individual developers
+ *
+ * GitHub App uses this for:
+ * - /api/github/webhook - Batch PR analysis (10-30s OK)
+ * - Automated security checks for professional teams
+ *
+ * ⚠️ BEFORE MODIFYING THIS FILE:
+ * 1. Run all 96 analyzer tests: npm test analyzers
+ * 2. Test WebTool: Paste Java code at /analyze → Verify results
+ * 3. Test GitHub: Open PR with Java → Verify webhook comment
+ * 4. Verify performance: Analysis must complete in <2s per file
+ * 5. Check detection rate: All 18 Java checks must still detect
+ *
+ * CRITICAL OUTPUT FORMAT (DO NOT CHANGE):
+ * - result.security.vulnerabilities - Used by both systems
+ * - Each vulnerability has: line, message, severity, cvssScore, owasp, cwe
+ * - Changing this structure breaks BOTH WebTool and GitHub UI parsing
+ *
+ * See: docs/technical/WEBTOOL_GITHUB_SEPARATION.md
+ *
+ * Last modified: 2025-11-18
+ * Last verified (both systems): 2025-11-18
+ */
+import { ICodeAnalyzer, AnalyzerInput, AnalyzerResult } from './types';
+import { SupportedLanguage } from '../types';
+export declare class JavaAnalyzer implements ICodeAnalyzer {
+    readonly language: SupportedLanguage;
+    analyze(input: AnalyzerInput): Promise<AnalyzerResult>;
+    validateSyntax(code: string): Promise<boolean>;
+    getLanguageInfo(): {
+        name: string;
+        extensions: string[];
+        description: string;
+    };
+    private analyzeSyntax;
+    /**
+     * Detect method signature errors - Missing parentheses, malformed signatures
+     *
+     * Fixed logic:
+     * - Checks ALL lines ending with { (not just method signatures)
+     * - Detects missing ) in method signatures, catch blocks, if/while/for statements
+     * - Avoids false positives on multi-line declarations (lines without {)
+     */
+    private detectMethodSignatureErrors;
+    /**
+     * Detect unbalanced braces - Missing opening or closing braces
+     *
+     * Tracks brace balance across the entire file to detect:
+     * - Methods/blocks with missing closing }
+     * - Extra closing } without matching opening {
+     */
+    private detectUnbalancedBraces;
+    /**
+     * Detect NullPointerException risks - null checks and Optional usage
+     */
+    private detectNullPointerRisks;
+    /**
+     * Detect compilation errors - Cannot find symbol, type mismatches
+     */
+    private detectCompilationErrors;
+    /**
+     * Detect runtime exceptions - ClassCast, ArrayBounds, IllegalArgument, IllegalState
+     */
+    private detectRuntimeExceptions;
+    /**
+     * Detect concurrency issues - ConcurrentModification, synchronized, volatile
+     */
+    private detectConcurrencyIssues;
+    /**
+     * Detect memory leaks - Unclosed resources, static collections, listeners
+     */
+    private detectMemoryLeaks;
+    /**
+     * Detect IO exceptions - File operations without try-with-resources
+     */
+    private detectIOExceptions;
+    /**
+     * Detect SQL injection - String concatenation in SQL
+     *
+     * NOTE: SQL Injection is now detected in analyzeSecurity() with full CVSS scoring,
+     * compliance mapping (OWASP/CWE/PCI-DSS), and remediation details.
+     * This method is kept for backward compatibility but does NOT add duplicates to lineErrors.
+     */
+    private detectSQLInjection;
+    /**
+     * Detect serialization issues - Unsafe deserialization
+     */
+    private detectSerializationIssues;
+    /**
+     * Detect performance issues - Vector/Hashtable, String concat in loops, inefficient loops
+     */
+    private detectPerformanceIssues;
+    /**
+     * Detect naming convention violations - camelCase, PascalCase, UPPER_CASE
+     */
+    private detectNamingConventions;
+    /**
+     * Detect access modifier issues - Methods without explicit modifiers
+     */
+    private detectAccessModifierIssues;
+    /**
+     * Detect resource leaks - Missing try-with-resources for AutoCloseable
+     */
+    private detectResourceLeaks;
+    /**
+     * Detect boxing/unboxing - Unnecessary autoboxing
+     */
+    private detectBoxingUnboxing;
+    /**
+     * Detect deprecated APIs - Date, Vector, Hashtable, etc.
+     */
+    private detectDeprecatedAPIs;
+    /**
+     * Detect exception handling issues - Empty catch, catching Exception/Throwable
+     */
+    private detectExceptionHandling;
+    /**
+     * Detect duplicate variable declarations - SYNTAX ERROR (Error 26)
+     *
+     * Tracks variable declarations within method scope and detects when
+     * the same variable name is declared twice, which is a compilation error.
+     */
+    private detectDuplicateVariables;
+    /**
+     * Detect method naming issues - Methods not in camelCase (e.g., Process_User_Data)
+     */
+    private detectMethodNamingIssues;
+    /**
+     * Detect magic numbers - Numeric literals that should be named constants
+     */
+    private detectMagicNumbers;
+    /**
+     * Detect God Classes - Classes with too many methods (violates SRP)
+     */
+    private detectGodClasses;
+    /**
+     * Detect methods with too many parameters (>7 is a code smell)
+     * Methods with many parameters are hard to test, maintain, and understand.
+     * Consider using parameter objects or builder pattern.
+     */
+    private detectTooManyParameters;
+    /**
+     * Detect string comparison using == instead of .equals()
+     * IMPORTANT: This is a QUALITY/LOGIC issue, NOT a syntax error
+     * Using == compares object references, not string content
+     */
+    private detectStringComparisonWithEquals;
+    /**
+     * Detect empty catch blocks - Multi-line empty catch blocks
+     */
+    private detectEmptyCatchBlocks;
+    /**
+     * Detect uninitialized variables - Variables declared but not initialized
+     */
+    private detectUninitializedVariables;
+    /**
+     * Detect missing return statements - Non-void methods without return in all paths
+     */
+    private detectMissingReturnStatements;
+    /**
+     * Detect invalid modifier order - Incorrect order (e.g., "static public" instead of "public static")
+     */
+    private detectInvalidModifierOrder;
+    private analyzeQuality;
+    private analyzePerformance;
+    /**
+     * Analyzes Java code for security vulnerabilities using modular security checks
+     *
+     * This method coordinates all security analysis by delegating to specialized modules:
+     * - Injection attacks (SQL, Command, LDAP, XPath)
+     * - Deserialization and XXE vulnerabilities
+     * - Hardcoded credentials detection
+     * - Cryptographic validation (weak algorithms, insecure random)
+     * - File operation security (path traversal, upload validation)
+     * - Unsafe patterns (reflection, NPE, exception handling)
+     * - Code quality issues (God classes, debug output)
+     *
+     * All checks are performed in parallel for optimal performance.
+     */
+    private analyzeSecurity;
+    /**
+     * Deduplicate vulnerabilities that appear on the same line
+     *
+     * Beta Testing Fix (Dec 9, 2025):
+     * - Deserialization reported twice (line 56, CVSS 9.8 and 5.0)
+     * - XXE reported twice (lines 50 and 52)
+     *
+     * Strategy: For each line with multiple vulnerabilities of similar type,
+     * keep only the one with the highest CVSS score.
+     *
+     * @param vulnerabilities - Array of all detected vulnerabilities
+     * @returns Deduplicated array with highest CVSS per line
+     */
+    /**
+     * P1-5: Generic deduplication for ALL vulnerability types (Dec 30, 2025)
+     * Previous: Only handled deserialization and XXE
+     * Now: Handles all duplicates using category-based deduplication
+     */
+    private deduplicateVulnerabilities;
+    private calculateMetrics;
+}
+//# sourceMappingURL=java-analyzer.d.ts.map

package/dist/src/lib/analyzers/java-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"java-analyzer.d.ts","sourceRoot":"","sources":["../../../../../../src/lib/analyzers/java-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAkD,MAAM,SAAS,CAAC;AACvH,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAsB7C,qBAAa,YAAa,YAAW,aAAa;IAChD,SAAgB,QAAQ,EAAE,iBAAiB,CAAU;IAE/C,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IA4BtD,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBpD,eAAe;;;;;IAQf,OAAO,CAAC,aAAa;IA0FrB;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAiFnC;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IA4D9B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyC9B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA6D/B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA+D/B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA0D/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAqDzB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA8B1B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAoCjC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA4D/B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgD/B;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAkClC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAkC3B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAoC5B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA8B5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAqD/B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAuEhC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAwChC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAqD1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAoDxB;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IA0E/B;;;;OAIG;IACH,OAAO,CAAC,gCAAgC;IAsCxC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAwD9B;;OAEG;IACH,OAAO,CAAC,4BAA4B;IA+DpC;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAyErC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAoClC,OAAO,CAAC,cAAc;IAyDtB,OAAO,CAAC,kBAAkB;IAqC1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAwCvB;;;;;;;;;;;;OAYG;IACH;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;IA8ClC,OAAO,CAAC,gBAAgB;CA4BzB"}