codeslick-cli 1.0.0

package/dist/src/lib/analyzers/javascript/security-checks/access-control.js

@@ -0,0 +1,168 @@
+"use strict";
+/**
+ * JavaScript Access Control Security Checks
+ * OWASP A01:2025 - Broken Access Control
+ *
+ * Detects missing authentication and client-side authorization vulnerabilities.
+ * Phase 7B Week 3 Day 11: Cross-language access control checks
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAccessControl = checkAccessControl;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for broken access control vulnerabilities in JavaScript code
+ *
+ * Covers:
+ * - Check #92: Missing authentication middleware on routes (HIGH)
+ * - Check #93: Client-side only authorization (HIGH)
+ * - Check #94: Insecure Direct Object Reference (IDOR) (HIGH) - NEW Dec 30, 2025
+ * - Check #95: Hardcoded role checks without server validation (MEDIUM) - NEW Dec 30, 2025
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkAccessControl(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // OWASP A01:2025 - Broken Access Control
+        // Check #92: Missing authentication middleware - HIGH
+        // Pattern: app.get/post/put/delete/patch routes without authentication
+        // FIX (Dec 30, 2025): Remove /api/ restriction - check ALL routes, not just /api/* routes
+        const routePattern = /(app|router)\.(get|post|put|delete|patch)\s*\(\s*['"`]\//i;
+        const nextApiPattern = /export\s+default\s+(?:async\s+)?function\s+handler\s*\(/i;
+        if (trimmed.match(routePattern) || trimmed.match(nextApiPattern)) {
+            // Check if route has authentication middleware
+            const hasMiddleware = trimmed.includes('authenticate') ||
+                trimmed.includes('authMiddleware') ||
+                trimmed.includes('requireAuth') ||
+                trimmed.includes('isAuthenticated') ||
+                trimmed.includes('verifyToken') ||
+                trimmed.includes('checkAuth');
+            // Check next 15 lines for inline authentication check
+            const nextLines = lines.slice(index, Math.min(index + 15, lines.length));
+            const hasInlineAuthCheck = nextLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (
+                // Check for !req.user or !req.session with 401/unauthorized
+                ((lowerLine.includes('!req.user') || lowerLine.includes('!req.session')) &&
+                    (lowerLine.includes('401') || lowerLine.includes('unauthorized'))) ||
+                    // Check for req.headers.authorization
+                    lowerLine.includes('req.headers.authorization') ||
+                    // Check for JWT verification
+                    lowerLine.includes('verifytoken') ||
+                    lowerLine.includes('jwt.verify') ||
+                    // Check for req.user or req.session existence checks
+                    (lowerLine.includes('if') && (lowerLine.includes('req.user') || lowerLine.includes('req.session'))));
+            });
+            if (!hasMiddleware && !hasInlineAuthCheck) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('missing-authentication-middleware', 'API route missing authentication - allows unauthenticated access to protected resources', 'Add authentication middleware: app.get("/api/users", authenticate, handler) or check req.user in handler', lineNumber, 'API endpoints without authentication allow any user (including attackers) to access protected resources. This is a critical access control failure.', 'app.get("/api/users", (req, res) => res.json(users)); → Anyone can access /api/users without logging in', [
+                    'Unauthorized access to sensitive data',
+                    'Data breach from unauthenticated API access',
+                    'Account enumeration and information disclosure',
+                    'Business logic bypass',
+                    'Compliance violations (SOC 2, ISO 27001, GDPR)'
+                ], 'app.get("/api/users", (req, res) => {\n  res.json(users); // No auth\n});', 'app.get("/api/users", authenticate, (req, res) => {\n  res.json(users); // Protected\n});', 'All API routes accessing sensitive data must require authentication via middleware or inline checks'));
+            }
+        }
+        // OWASP A01:2025 - Broken Access Control
+        // Check #93: Client-side only authorization - HIGH
+        // Pattern: Authorization checks in client-side JavaScript (browser code)
+        // Common patterns: if (userRole === 'admin'), if (user.isAdmin), element.style.display based on role
+        const clientSideAuthPattern = /(if|&&|\|\|)\s*\(\s*(userRole|user\.role|user\.isAdmin|isAdmin|currentUser\.role)/i;
+        const uiTogglePattern = /\.style\.display\s*=|\.hidden\s*=|\.classList\.(add|remove|toggle)/i;
+        if (trimmed.match(clientSideAuthPattern)) {
+            // Check if this is followed by API call or UI toggle (client-side behavior)
+            const nextLines = lines.slice(index, Math.min(index + 5, lines.length));
+            const hasClientSideBehavior = nextLines.some(l => l.includes('fetch(') ||
+                l.includes('axios.') ||
+                l.match(uiTogglePattern) ||
+                l.includes('getElementById') ||
+                l.includes('querySelector'));
+            // Make sure this is NOT a server-side check (no req.user or res.status)
+            const isServerSide = nextLines.some(l => l.includes('req.user') ||
+                l.includes('res.status(403)') ||
+                l.includes('res.status(401)') ||
+                l.includes('return res.'));
+            if (hasClientSideBehavior && !isServerSide) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('client-side-authorization', 'Authorization enforced only on client-side - can be bypassed by manipulating JavaScript', 'Move authorization logic to server-side: Validate user role in API endpoint, not in browser code', lineNumber, 'Client-side authorization can be easily bypassed by modifying JavaScript in browser DevTools or using direct API calls. Attackers can access admin features by changing local variables.', 'if (userRole === "admin") fetch("/api/admin/delete") → Attacker opens DevTools, sets userRole="admin", bypasses check', [
+                    'Complete authorization bypass via DevTools manipulation',
+                    'Privilege escalation (user → admin)',
+                    'Unauthorized access to admin features',
+                    'Data manipulation and deletion',
+                    'Business logic bypass',
+                    'False sense of security (UI hiding is not access control)'
+                ], 'if (userRole === "admin") {\n  fetch("/api/admin/delete", { method: "POST" });\n}', 'fetch("/api/admin/delete", { method: "POST" }); // Server validates role\n\n// Server-side:\napp.post("/api/admin/delete", (req, res) => {\n  if (req.user.role !== "admin") return res.status(403).send("Forbidden");\n  // Perform delete\n});', 'Never rely on client-side checks for authorization. Always validate user permissions on the server before performing sensitive operations.'));
+            }
+        }
+        // OWASP A01:2025 - Broken Access Control
+        // Check #94: Insecure Direct Object Reference (IDOR) - HIGH
+        // Pattern: Database queries using req.params/req.query without ownership validation
+        // Examples: getUserById(req.params.id), findOne({ _id: req.query.userId })
+        const idorPattern = /(getUserById|findById|findOne|getById|deleteById|updateById|get\w+ById)\s*\(\s*(req\.params|req\.query|req\.body)/i;
+        const dbAccessPattern = /\.(find|findOne|update|delete|remove)\s*\(\s*\{\s*(_?id|userId|user_id|accountId|account_id)\s*:\s*(req\.params|req\.query|req\.body)/i;
+        if (trimmed.match(idorPattern) || trimmed.match(dbAccessPattern)) {
+            // Check if there's ownership validation in next 10 lines
+            const nextLines = lines.slice(index, Math.min(index + 10, lines.length));
+            const hasOwnershipCheck = nextLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (
+                // Check for ownership validation patterns
+                (lowerLine.includes('if') && lowerLine.includes('user') && lowerLine.includes('!==')) ||
+                    (lowerLine.includes('if') && lowerLine.includes('owner') && lowerLine.includes('!==')) ||
+                    lowerLine.includes('checkOwnership') ||
+                    lowerLine.includes('verifyOwner') ||
+                    lowerLine.includes('isOwner') ||
+                    (lowerLine.includes('403') || lowerLine.includes('forbidden')) ||
+                    (lowerLine.includes('401') || lowerLine.includes('unauthorized')));
+            });
+            if (!hasOwnershipCheck) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('insecure-direct-object-reference', 'IDOR: Direct object access without ownership validation - users can access others\' data', 'Validate ownership before accessing resources: if (resource.userId !== req.user.id) return res.status(403)', lineNumber, 'Insecure Direct Object References allow attackers to access, modify, or delete resources owned by other users by manipulating ID parameters. This is a critical access control failure.', 'app.get("/user/:userId", (req, res) => res.json(getUserById(req.params.userId))) → Attacker can access /user/123 to see any user\'s profile', [
+                    'Unauthorized access to other users\' data',
+                    'Privacy violations and data leaks (GDPR, CCPA)',
+                    'Horizontal privilege escalation',
+                    'Unauthorized data modification or deletion',
+                    'Account takeover via accessing sensitive user info',
+                    'Business logic bypass'
+                ], 'const user = getUserById(req.params.userId);\nres.json(user); // No ownership check', 'const user = getUserById(req.params.userId);\nif (user.id !== req.user.id) return res.status(403).send("Forbidden");\nres.json(user); // Ownership validated', 'Always validate that the authenticated user has permission to access the requested resource before returning it'));
+            }
+        }
+        // OWASP A01:2025 - Broken Access Control
+        // Check #95: Hardcoded role checks (privilege escalation risk) - MEDIUM
+        // Pattern: if (user.role === 'admin') in server-side code without proper RBAC
+        const hardcodedRolePattern = /(if|&&|\|\|)\s*\(\s*(req\.user\.role|user\.role|req\.session\.role)\s*(!==|===)\s*['"`](admin|superuser|root|administrator)['"]/i;
+        if (trimmed.match(hardcodedRolePattern)) {
+            // This is OK if followed by proper authorization response (403/401)
+            const nextLines = lines.slice(index, Math.min(index + 5, lines.length));
+            const hasProperAuth = nextLines.some(l => l.includes('res.status(403)') ||
+                l.includes('res.status(401)') ||
+                l.includes('return res.') ||
+                l.includes('throw new'));
+            // Flag if it's just an IF without proper auth enforcement
+            if (!hasProperAuth && !trimmed.includes('return')) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('hardcoded-role-check', 'Hardcoded role check may be bypassable - use centralized RBAC middleware instead', 'Use centralized role-based access control (RBAC) middleware instead of scattered role checks', lineNumber, 'Hardcoded role checks scattered throughout code are error-prone and can be bypassed if not implemented consistently. Centralized RBAC middleware provides better security and maintainability.', 'if (req.user.role === "admin") { performAdminAction(); } → Inconsistent checks across codebase lead to bypasses', [
+                    'Privilege escalation via inconsistent role checks',
+                    'Authorization bypass if checks are incomplete',
+                    'Maintenance issues with scattered auth logic',
+                    'Role manipulation via session/token tampering',
+                    'Business logic bypass'
+                ], 'if (req.user.role === "admin") {\n  performAdminAction();\n}', '// Use centralized RBAC middleware\napp.post("/admin/action", requireRole("admin"), (req, res) => {\n  performAdminAction();\n});', 'Use centralized authorization middleware to enforce role-based access control consistently across all routes'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=access-control.js.map

package/dist/src/lib/analyzers/javascript/security-checks/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/access-control.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAiBH,gDAsNC;AApOD,sEAAqF;AAErF;;;;;;;;;;;GAWG;AACH,SAAgB,kBAAkB,CAChC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,yCAAyC;QACzC,sDAAsD;QACtD,uEAAuE;QACvE,0FAA0F;QAC1F,MAAM,YAAY,GAAG,2DAA2D,CAAC;QACjF,MAAM,cAAc,GAAG,0DAA0D,CAAC;QAElF,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YACjE,+CAA+C;YAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAEnD,sDAAsD;YACtD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACzE,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO;gBACL,4DAA4D;gBAC5D,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;oBACvE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;oBACnE,sCAAsC;oBACtC,SAAS,CAAC,QAAQ,CAAC,2BAA2B,CAAC;oBAC/C,6BAA6B;oBAC7B,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;oBACjC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAChC,qDAAqD;oBACrD,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CACpG,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC1C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,mCAAmC,EACnC,yFAAyF,EACzF,0GAA0G,EAC1G,UAAU,EACV,qJAAqJ,EACrJ,yGAAyG,EACzG;oBACE,uCAAuC;oBACvC,6CAA6C;oBAC7C,gDAAgD;oBAChD,uBAAuB;oBACvB,gDAAgD;iBACjD,EACD,2EAA2E,EAC3E,2FAA2F,EAC3F,qGAAqG,CACtG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,mDAAmD;QACnD,yEAAyE;QACzE,qGAAqG;QACrG,MAAM,qBAAqB,GAAG,oFAAoF,CAAC;QACnH,MAAM,eAAe,GAAG,qEAAqE,CAAC;QAE9F,IAAI,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACzC,4EAA4E;YAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACxE,MAAM,qBAAqB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/C,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACpB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACpB,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;gBACxB,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAC5B,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAC5B,CAAC;YAEF,wEAAwE;YACxE,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACtC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACtB,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC7B,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC7B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC1B,CAAC;YAEF,IAAI,qBAAqB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,2BAA2B,EAC3B,yFAAyF,EACzF,kGAAkG,EAClG,UAAU,EACV,0LAA0L,EAC1L,uHAAuH,EACvH;oBACE,yDAAyD;oBACzD,qCAAqC;oBACrC,uCAAuC;oBACvC,gCAAgC;oBAChC,uBAAuB;oBACvB,2DAA2D;iBAC5D,EACD,mFAAmF,EACnF,kPAAkP,EAClP,4IAA4I,CAC7I,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,4DAA4D;QAC5D,oFAAoF;QACpF,2EAA2E;QAC3E,MAAM,WAAW,GAAG,oHAAoH,CAAC;QACzI,MAAM,eAAe,GAAG,wIAAwI,CAAC;QAEjK,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YACjE,yDAAyD;YACzD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACzE,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO;gBACL,0CAA0C;gBAC1C,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACrF,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACtF,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACpC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;oBACjC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAC7B,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;oBAC9D,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAClE,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,kCAAkC,EAClC,0FAA0F,EAC1F,4GAA4G,EAC5G,UAAU,EACV,yLAAyL,EACzL,6IAA6I,EAC7I;oBACE,2CAA2C;oBAC3C,gDAAgD;oBAChD,iCAAiC;oBACjC,4CAA4C;oBAC5C,oDAAoD;oBACpD,uBAAuB;iBACxB,EACD,qFAAqF,EACrF,8JAA8J,EAC9J,iHAAiH,CAClH,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,wEAAwE;QACxE,8EAA8E;QAC9E,MAAM,oBAAoB,GAAG,kIAAkI,CAAC;QAEhK,IAAI,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACxC,oEAAoE;YACpE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACvC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC7B,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC7B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACzB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CACxB,CAAC;YAEF,0DAA0D;YAC1D,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,sBAAsB,EACtB,kFAAkF,EAClF,8FAA8F,EAC9F,UAAU,EACV,gMAAgM,EAChM,iHAAiH,EACjH;oBACE,mDAAmD;oBACnD,+CAA+C;oBAC/C,8CAA8C;oBAC9C,+CAA+C;oBAC/C,uBAAuB;iBACxB,EACD,8DAA8D,EAC9D,mIAAmI,EACnI,8GAA8G,CAC/G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/javascript/security-checks/ai-generated-code.d.ts

@@ -0,0 +1,25 @@
+/**
+ * JavaScript AI-Generated Code Detection Module
+ *
+ * Detects AI-generated code patterns as SECURITY RISKS:
+ * - 15 hallucination patterns (language confusion, method typos)
+ * - 8 code smell heuristics (over-engineering, inconsistency)
+ * - Confidence scoring (HIGH/MEDIUM/LOW)
+ *
+ * OWASP A04:2025 - Insecure Design
+ * CWE-1120 - Excessive Code Complexity
+ * CWE-758 - Reliance on Undefined Behavior
+ *
+ * Phase 1.5, Week 5-7 (AI-Generated Code Detection)
+ * Created: January 8, 2026
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Detect AI-generated code in JavaScript
+ *
+ * @param lines - Array of code lines
+ * @param filename - Optional filename (to skip test files)
+ * @returns Array of security vulnerabilities (0-1 aggregated vulnerability)
+ */
+export declare function checkAIGeneratedCode(lines: string[], filename?: string): SecurityVulnerability[];
+//# sourceMappingURL=ai-generated-code.d.ts.map

package/dist/src/lib/analyzers/javascript/security-checks/ai-generated-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-generated-code.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/ai-generated-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA0GpD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,qBAAqB,EAAE,CAuJzB"}

package/dist/src/lib/analyzers/javascript/security-checks/ai-generated-code.js

@@ -0,0 +1,232 @@
+"use strict";
+/**
+ * JavaScript AI-Generated Code Detection Module
+ *
+ * Detects AI-generated code patterns as SECURITY RISKS:
+ * - 15 hallucination patterns (language confusion, method typos)
+ * - 8 code smell heuristics (over-engineering, inconsistency)
+ * - Confidence scoring (HIGH/MEDIUM/LOW)
+ *
+ * OWASP A04:2025 - Insecure Design
+ * CWE-1120 - Excessive Code Complexity
+ * CWE-758 - Reliance on Undefined Behavior
+ *
+ * Phase 1.5, Week 5-7 (AI-Generated Code Detection)
+ * Created: January 8, 2026
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAIGeneratedCode = checkAIGeneratedCode;
+const createVulnerability_1 = require("../utils/createVulnerability");
+const ai_code_detection_utils_1 = require("../../helpers/ai-code-detection-utils");
+/**
+ * JavaScript hallucination patterns (15 patterns)
+ *
+ * AI code generators hallucinate methods from other languages:
+ * - Python influence: .append(), .strip(), .len()
+ * - Case sensitivity errors: .toUppercase(), .toLowercase()
+ * - Non-existent methods: .contains(), .remove(), .split_by()
+ */
+const HALLUCINATION_PATTERNS = new Map([
+    // Python-style methods in JavaScript
+    ['append', {
+            correct: '.push()',
+            description: 'JavaScript arrays use .push(), not .append(). This is a Python method.'
+        }],
+    ['strip', {
+            correct: '.trim()',
+            description: 'JavaScript strings use .trim(), not .strip(). This is a Python method.'
+        }],
+    ['len', {
+            correct: '.length',
+            description: 'JavaScript uses .length property, not .len() method. This is Python/Rust syntax.'
+        }],
+    ['split_by', {
+            correct: '.split()',
+            description: 'Non-existent method. JavaScript uses .split() with camelCase naming.'
+        }],
+    // Case sensitivity errors (common AI typos)
+    ['toUppercase', {
+            correct: '.toUpperCase()',
+            description: 'Case sensitivity error. Correct method is .toUpperCase() with capital C.'
+        }],
+    ['toLowercase', {
+            correct: '.toLowerCase()',
+            description: 'Case sensitivity error. Correct method is .toLowerCase() with capital C.'
+        }],
+    // Non-existent methods (hallucinations)
+    ['contains', {
+            correct: '.includes()',
+            description: 'JavaScript arrays/strings use .includes(), not .contains(). This is Java syntax.'
+        }],
+    ['remove', {
+            correct: '.splice() or .filter()',
+            description: 'Arrays do not have .remove() method. Use .splice() or .filter().'
+        }],
+    ['replace_all', {
+            correct: '.replaceAll()',
+            description: 'Incorrect method name. JavaScript uses camelCase: .replaceAll().'
+        }],
+    ['substring_of', {
+            correct: '.includes()',
+            description: 'Non-existent method. Use .includes() to check if string contains substring.'
+        }],
+    ['to_string', {
+            correct: '.toString()',
+            description: 'JavaScript uses camelCase: .toString(), not snake_case to_string().'
+        }],
+    ['is_empty', {
+            correct: '.length === 0',
+            description: 'No .is_empty() method. Check .length property instead. This is Rust/Python syntax.'
+        }],
+    // Rust/Python influence
+    ['size', {
+            correct: '.length or .size()',
+            description: 'Arrays use .length property. Maps/Sets use .size property (not method).'
+        }],
+    // Java influence
+    ['indexOf', {
+            correct: '.indexOf() or .findIndex()',
+            description: 'Method exists but often misused. Consider .findIndex() for complex searches.'
+        }],
+    // String method confusion
+    ['charAt', {
+            correct: '[index]',
+            description: 'Modern JavaScript prefers bracket notation [index] over .charAt().'
+        }],
+]);
+/**
+ * Detect AI-generated code in JavaScript
+ *
+ * @param lines - Array of code lines
+ * @param filename - Optional filename (to skip test files)
+ * @returns Array of security vulnerabilities (0-1 aggregated vulnerability)
+ */
+function checkAIGeneratedCode(lines, filename) {
+    // Skip test files to reduce false positives
+    if ((0, ai_code_detection_utils_1.isTestFile)(filename)) {
+        return [];
+    }
+    let hallucinationCount = 0;
+    const hallucinationLines = new Set();
+    const detectedPatterns = [];
+    // Combined regex for all 15 hallucination patterns (optimized)
+    const combinedPattern = new RegExp('\\.' +
+        '(append|strip|len|split_by|toUppercase|toLowercase|contains|remove|' +
+        'replace_all|substring_of|to_string|is_empty|size|indexOf|charAt)' +
+        '\\s*\\(', 'g');
+    let inMultiLineComment = false;
+    // 1. Detect hallucination patterns
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comments (/* ... */)
+        if (trimmed.includes('/*'))
+            inMultiLineComment = true;
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//'))
+            return;
+        // Remove string literals and template literals to avoid false positives
+        const cleanedLine = (0, ai_code_detection_utils_1.removeCommentsAndStrings)(line, 'javascript');
+        // Match hallucination patterns
+        const matches = Array.from(cleanedLine.matchAll(combinedPattern));
+        for (const match of matches) {
+            const method = match[1];
+            const details = HALLUCINATION_PATTERNS.get(method);
+            if (details) {
+                hallucinationCount++;
+                hallucinationLines.add(lineNumber);
+                detectedPatterns.push(method);
+            }
+        }
+    });
+    // 2. Run heuristic detectors
+    const heuristicScores = {
+        overEngineeredErrors: (0, ai_code_detection_utils_1.detectOverEngineeredErrorHandling)(lines),
+        unnecessaryWrappers: (0, ai_code_detection_utils_1.detectUnnecessaryWrappers)(lines),
+        verboseComments: (0, ai_code_detection_utils_1.detectVerboseComments)(lines),
+        mixedNaming: (0, ai_code_detection_utils_1.detectMixedNamingConventions)(lines),
+        redundantNullChecks: (0, ai_code_detection_utils_1.detectRedundantNullChecks)(lines),
+        unnecessaryAsync: (0, ai_code_detection_utils_1.detectUnnecessaryAsync)(lines),
+        genericVariables: (0, ai_code_detection_utils_1.detectGenericVariableOveruse)(lines),
+        inconsistentStrings: (0, ai_code_detection_utils_1.detectInconsistentStringConcatenation)(lines),
+    };
+    // 3. Calculate confidence and severity
+    const detection = (0, ai_code_detection_utils_1.calculateAICodeConfidence)(hallucinationCount, heuristicScores);
+    if (!detection) {
+        return []; // No AI-generated code detected
+    }
+    // 4. Create aggregated vulnerability
+    const categoryId = detection.severity === 'CRITICAL' ? 'ai-generated-code-high' :
+        detection.severity === 'HIGH' ? 'ai-generated-code-medium' :
+            'ai-generated-code-low';
+    // Build message based on detection type
+    let message = `AI-generated code detected (${detection.confidence} confidence): `;
+    if (hallucinationCount > 0) {
+        message += `${hallucinationCount} hallucinated method(s) found`;
+        if (detectedPatterns.length > 0) {
+            const uniquePatterns = Array.from(new Set(detectedPatterns)).slice(0, 3);
+            message += ` (.${uniquePatterns.join(', .')})`;
+        }
+    }
+    else {
+        message += 'Multiple code smell patterns detected (over-engineering, inconsistent naming, etc.)';
+    }
+    // Build suggestion
+    const suggestion = hallucinationCount > 0
+        ? `Replace hallucinated methods with correct JavaScript equivalents. Found: ${Array.from(new Set(detectedPatterns)).map(p => `.${p}()`).join(', ')}. Review and rewrite AI-generated code sections.`
+        : 'Simplify code structure, use consistent naming conventions (camelCase), and follow JavaScript idioms. Remove unnecessary async functions, redundant null checks, and over-engineered error handling.';
+    // Find first occurrence line for reporting
+    const reportLine = hallucinationLines.size > 0
+        ? Math.min(...hallucinationLines)
+        : 1; // Use first line if only heuristics detected
+    // Get first detected pattern details for remediation example
+    const firstPattern = detectedPatterns[0];
+    const firstPatternDetails = firstPattern ? HALLUCINATION_PATTERNS.get(firstPattern) : null;
+    return [
+        (0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+            category: categoryId,
+            severity: detection.severity.toLowerCase(),
+            confidence: detection.confidence,
+            message,
+            line: reportLine,
+            suggestion,
+            owasp: 'A04:2025 - Insecure Design',
+            cwe: 'CWE-1120, CWE-758',
+            pciDss: '6.5',
+            remediation: {
+                explanation: 'AI code generators (like GitHub Copilot, ChatGPT, Claude) can hallucinate non-existent methods or generate over-engineered patterns. ' +
+                    'This creates reliability issues and potential security vulnerabilities. Hallucinated methods cause runtime errors that expose stack traces with ' +
+                    'sensitive information. Over-engineered code patterns make security audits difficult, hiding real vulnerabilities. ' +
+                    'Always verify AI-generated code matches language specifications and follows security best practices.',
+                before: firstPatternDetails
+                    ? `array.${firstPattern}(item)  // Hallucinated method`
+                    : '// Over-engineered or inconsistent code patterns\n// Example: try { ... } catch (e) { if (...) { if (...) { if (...) { } } } }',
+                after: firstPatternDetails
+                    ? `array${firstPatternDetails.correct}  // Correct JavaScript`
+                    : '// Simplified, idiomatic code following JavaScript conventions\n// Example: try { ... } catch (e) { logError(e); throw e; }',
+            },
+            attackVector: {
+                description: 'AI-generated code with hallucinated methods creates runtime TypeError exceptions exposing system internals through stack traces. ' +
+                    'Attackers can trigger these errors repeatedly to map application structure and identify vulnerable endpoints. ' +
+                    'Inconsistent code patterns make security reviews difficult, allowing real vulnerabilities to hide among AI-generated noise. ' +
+                    'Over-engineered error handling may leak sensitive information in catch blocks.',
+                exploitExample: "User triggers: array.append(item)\n" +
+                    "Result: TypeError: array.append is not a function\n" +
+                    "Stack trace reveals: Internal file paths, function names, database schema hints\n" +
+                    "Attacker uses this to map application architecture and plan targeted attacks.",
+                realWorldImpact: [
+                    'Runtime errors revealing sensitive stack traces with internal paths',
+                    'Logic bugs in access control or validation code (AI-generated if statements)',
+                    'Performance degradation from inefficient AI-generated loops and algorithms',
+                    'Maintenance burden: Developers spend hours debugging AI hallucinations',
+                    'Hidden security vulnerabilities masked by over-engineered code patterns',
+                ],
+            },
+        })
+    ];
+}
+//# sourceMappingURL=ai-generated-code.js.map

package/dist/src/lib/analyzers/javascript/security-checks/ai-generated-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-generated-code.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/ai-generated-code.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAmHH,oDA0JC;AA1QD,sEAAqF;AACrF,mFAY+C;AAU/C;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAA+B;IACnE,qCAAqC;IACrC,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,wEAAwE;SACtF,CAAC;IACF,CAAC,OAAO,EAAE;YACR,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,wEAAwE;SACtF,CAAC;IACF,CAAC,KAAK,EAAE;YACN,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,kFAAkF;SAChG,CAAC;IACF,CAAC,UAAU,EAAE;YACX,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,sEAAsE;SACpF,CAAC;IAEF,4CAA4C;IAC5C,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,0EAA0E;SACxF,CAAC;IACF,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,0EAA0E;SACxF,CAAC;IAEF,wCAAwC;IACxC,CAAC,UAAU,EAAE;YACX,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,kFAAkF;SAChG,CAAC;IACF,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,wBAAwB;YACjC,WAAW,EAAE,kEAAkE;SAChF,CAAC;IACF,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,kEAAkE;SAChF,CAAC;IACF,CAAC,cAAc,EAAE;YACf,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,6EAA6E;SAC3F,CAAC;IACF,CAAC,WAAW,EAAE;YACZ,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,qEAAqE;SACnF,CAAC;IACF,CAAC,UAAU,EAAE;YACX,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,oFAAoF;SAClG,CAAC;IAEF,wBAAwB;IACxB,CAAC,MAAM,EAAE;YACP,OAAO,EAAE,oBAAoB;YAC7B,WAAW,EAAE,yEAAyE;SACvF,CAAC;IAEF,iBAAiB;IACjB,CAAC,SAAS,EAAE;YACV,OAAO,EAAE,4BAA4B;YACrC,WAAW,EAAE,8EAA8E;SAC5F,CAAC;IAEF,0BAA0B;IAC1B,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,oEAAoE;SAClF,CAAC;CACH,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,KAAe,EACf,QAAiB;IAEjB,4CAA4C;IAC5C,IAAI,IAAA,oCAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,+DAA+D;IAC/D,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,KAAK;QACL,qEAAqE;QACrE,kEAAkE;QAClE,SAAS,EACT,GAAG,CACJ,CAAC;IAEF,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,mCAAmC;IACnC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,wCAAwC;QACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,kBAAkB,GAAG,IAAI,CAAC;QACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAEvE,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAA,kDAAwB,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAEjE,+BAA+B;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAElE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEnD,IAAI,OAAO,EAAE,CAAC;gBACZ,kBAAkB,EAAE,CAAC;gBACrB,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACnC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6BAA6B;IAC7B,MAAM,eAAe,GAAG;QACtB,oBAAoB,EAAE,IAAA,2DAAiC,EAAC,KAAK,CAAC;QAC9D,mBAAmB,EAAE,IAAA,mDAAyB,EAAC,KAAK,CAAC;QACrD,eAAe,EAAE,IAAA,+CAAqB,EAAC,KAAK,CAAC;QAC7C,WAAW,EAAE,IAAA,sDAA4B,EAAC,KAAK,CAAC;QAChD,mBAAmB,EAAE,IAAA,mDAAyB,EAAC,KAAK,CAAC;QACrD,gBAAgB,EAAE,IAAA,gDAAsB,EAAC,KAAK,CAAC;QAC/C,gBAAgB,EAAE,IAAA,sDAA4B,EAAC,KAAK,CAAC;QACrD,mBAAmB,EAAE,IAAA,+DAAqC,EAAC,KAAK,CAAC;KAClE,CAAC;IAEF,uCAAuC;IACvC,MAAM,SAAS,GAAG,IAAA,mDAAyB,EAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;IAEjF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,CAAC,CAAC,gCAAgC;IAC7C,CAAC;IAED,qCAAqC;IACrC,MAAM,UAAU,GACd,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9D,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;YAC5D,uBAAuB,CAAC;IAE1B,wCAAwC;IACxC,IAAI,OAAO,GAAG,+BAA+B,SAAS,CAAC,UAAU,gBAAgB,CAAC;IAElF,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,GAAG,kBAAkB,+BAA+B,CAAC;QAChE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzE,OAAO,IAAI,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACjD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,qFAAqF,CAAC;IACnG,CAAC;IAED,mBAAmB;IACnB,MAAM,UAAU,GAAG,kBAAkB,GAAG,CAAC;QACvC,CAAC,CAAC,4EAA4E,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;QACpM,CAAC,CAAC,sMAAsM,CAAC;IAE3M,2CAA2C;IAC3C,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC;QACjC,CAAC,CAAC,CAAC,CAAC,CAAC,6CAA6C;IAEpD,6DAA6D;IAC7D,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,mBAAmB,GAAG,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3F,OAAO;QACL,IAAA,2DAAqC,EAAC;YACpC,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAoC;YAC5E,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,OAAO;YACP,IAAI,EAAE,UAAU;YAChB,UAAU;YACV,KAAK,EAAE,4BAA4B;YACnC,GAAG,EAAE,mBAAmB;YACxB,MAAM,EAAE,KAAK;YACb,WAAW,EAAE;gBACX,WAAW,EACT,uIAAuI;oBACvI,kJAAkJ;oBAClJ,oHAAoH;oBACpH,sGAAsG;gBACxG,MAAM,EAAE,mBAAmB;oBACzB,CAAC,CAAC,SAAS,YAAY,gCAAgC;oBACvD,CAAC,CAAC,gIAAgI;gBACpI,KAAK,EAAE,mBAAmB;oBACxB,CAAC,CAAC,QAAQ,mBAAmB,CAAC,OAAO,yBAAyB;oBAC9D,CAAC,CAAC,6HAA6H;aAClI;YACD,YAAY,EAAE;gBACZ,WAAW,EACT,mIAAmI;oBACnI,gHAAgH;oBAChH,8HAA8H;oBAC9H,gFAAgF;gBAClF,cAAc,EACZ,qCAAqC;oBACrC,qDAAqD;oBACrD,mFAAmF;oBACnF,+EAA+E;gBACjF,eAAe,EAAE;oBACf,qEAAqE;oBACrE,8EAA8E;oBAC9E,4EAA4E;oBAC5E,wEAAwE;oBACxE,yEAAyE;iBAC1E;aACF;SACF,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/src/lib/analyzers/javascript/security-checks/authentication-failures.d.ts

@@ -0,0 +1,27 @@
+/**
+ * JavaScript Authentication Failures Security Checks
+ * OWASP A07:2025 - Identification and Authentication Failures
+ *
+ * Detects missing MFA/2FA and lack of rate limiting on authentication endpoints.
+ * Phase 7B Week 3 Day 11: Cross-language authentication checks
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for authentication failure vulnerabilities in JavaScript code
+ *
+ * Covers (Enhanced Dec 30, 2025 - Phase 2):
+ * - Check #94: Missing MFA/2FA on login endpoints (MEDIUM)
+ * - Check #95: No rate limiting on login routes (MEDIUM)
+ * - Check #96: Plain-text password storage (CRITICAL) - NEW
+ * - Check #97: Weak password comparison (HIGH) - NEW
+ * - Check #98: Missing password hashing (CRITICAL) - NEW
+ * - Check #99: Session fixation vulnerability (HIGH) - NEW
+ * - Check #100: JWT without expiration (HIGH) - NEW
+ * - Check #101: Insecure session timeout (MEDIUM) - NEW
+ * - Check #102: Weak password requirements (LOW) - NEW
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkAuthenticationFailures(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=authentication-failures.d.ts.map

package/dist/src/lib/analyzers/javascript/security-checks/authentication-failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-failures.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/authentication-failures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAiUzB"}