codeslick-cli 1.0.0

package/dist/src/lib/analyzers/javascript/security-checks/enhanced-supply-chain.js

@@ -0,0 +1,113 @@
+"use strict";
+/**
+ * JavaScript Enhanced Supply Chain Security Checks
+ * OWASP A03:2025 - Software Supply Chain Failures (Enhanced)
+ *
+ * Enhanced supply chain security checks building on existing dependency scanning.
+ * Focuses on runtime dependencies, package integrity, and malicious code patterns.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkEnhancedSupplyChain = checkEnhancedSupplyChain;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for enhanced supply chain security vulnerabilities in JavaScript code
+ *
+ * Covers:
+ * - Check #1: Dynamic imports without integrity validation (HIGH)
+ * - Check #2: Runtime dependency loading (MEDIUM)
+ * - Check #3: Suspicious package patterns (HIGH)
+ * - Check #4: Unrestricted CDN usage (MEDIUM)
+ * - Check #5: Package typosquatting patterns (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkEnhancedSupplyChain(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        // But handle inline comments (/* */ on same line) correctly
+        if (trimmedLine.includes('/*') && !trimmedLine.includes('*/')) {
+            inMultiLineComment = true;
+        }
+        if (trimmedLine.includes('*/') && inMultiLineComment) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('//') ||
+            trimmedLine.startsWith('*')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Check #1: Dynamic imports without integrity validation
+        // Exclude localhost and 127.0.0.1 (development URLs)
+        if ((lowerLine.includes('import(') || lowerLine.includes('require(')) &&
+            (lowerLine.includes('http://') || lowerLine.includes('https://')) &&
+            !lowerLine.includes('localhost') && !lowerLine.includes('127.0.0.1') &&
+            !lowerLine.includes('integrity') && !lowerLine.includes('sha')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('dynamic-import-no-integrity', 'Dynamic import from URL without integrity validation', 'Use subresource integrity (SRI) or validate package hashes for remote imports', index + 1, 'Dynamic imports without integrity validation can load malicious code from compromised sources', 'import("https://cdn.example.com/lib.js") // no integrity check', [
+                'Malicious code injection from compromised CDNs',
+                'Supply chain attacks through modified packages',
+                'Man-in-the-middle attacks on package loading',
+                'Runtime code modification and backdoor installation'
+            ], 'import("https://cdn.example.com/lib.js")', 'import("https://cdn.example.com/lib.js").then(validateIntegrity)', 'Dynamic imports from remote sources should validate package integrity to prevent supply chain attacks'));
+        }
+        // Check #2: Runtime dependency loading with eval or Function
+        if ((lowerLine.includes('eval(') || lowerLine.includes('function(')) &&
+            (lowerLine.includes('require') || lowerLine.includes('import') ||
+                lowerLine.includes('fetch'))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('runtime-dependency-loading', 'Runtime dependency loading using eval or Function constructor', 'Use static imports or validated dynamic imports instead of runtime code evaluation', index + 1, 'Runtime dependency loading can execute arbitrary code and enable supply chain attacks', 'eval(`require("${userInput}")`) // arbitrary package loading', [
+                'Arbitrary package execution from user input',
+                'Supply chain attacks through malicious packages',
+                'Code injection via dependency names',
+                'Bypass of static analysis and security tools'
+            ], 'eval(`require("${packageName}")`)', 'const allowedPackages = ["safe-pkg1", "safe-pkg2"]; if (allowedPackages.includes(packageName)) { require(packageName) }', 'Runtime dependency loading bypasses security controls and enables arbitrary code execution'));
+        }
+        // Check #3: Suspicious package patterns (common typosquatting names)
+        if ((lowerLine.includes('require(') || lowerLine.includes('import ')) &&
+            (lowerLine.includes('"lodahs"') || lowerLine.includes("'lodahs'") ||
+                lowerLine.includes('"expres"') || lowerLine.includes("'expres'") ||
+                lowerLine.includes('"reqwest"') || lowerLine.includes("'reqwest'") ||
+                lowerLine.includes('"socket.i0"') || lowerLine.includes("'socket.i0'") ||
+                lowerLine.includes('"babeljs"') || lowerLine.includes("'babeljs'"))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('suspicious-package-pattern', 'Potentially typosquatted package name detected', 'Verify package names carefully and use official package registries', index + 1, 'Typosquatting packages can contain malicious code that mimics legitimate packages', 'require("lodahs") // should be "lodash"', [
+                'Malicious code execution from fake packages',
+                'Data theft and credential harvesting',
+                'Backdoor installation and remote access',
+                'Supply chain compromise through package confusion'
+            ], 'require("lodahs")', 'require("lodash") // verify correct package name', 'Typosquatting packages exploit common typos to distribute malicious code'));
+        }
+        // Check #4: Unrestricted CDN usage
+        if ((lowerLine.includes('src=') || lowerLine.includes('href=')) &&
+            (lowerLine.includes('unpkg.com') || lowerLine.includes('jsdelivr.net') ||
+                lowerLine.includes('cdnjs.cloudflare.com')) &&
+            !lowerLine.includes('integrity=')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('unrestricted-cdn-usage', 'CDN resource loaded without subresource integrity', 'Add integrity attribute with SHA hash for CDN resources', index + 1, 'CDN resources without integrity checks can be compromised and serve malicious content', '<script src="https://unpkg.com/lib@1.0.0/dist/lib.js"></script> // no integrity', [
+                'CDN compromise serving malicious scripts',
+                'Supply chain attacks through modified CDN content',
+                'Man-in-the-middle attacks on CDN requests',
+                'Unauthorized code modification and injection'
+            ], 'src="https://unpkg.com/lib@1.0.0/dist/lib.js"', 'src="https://unpkg.com/lib@1.0.0/dist/lib.js" integrity="sha384-..."', 'CDN resources should use subresource integrity to prevent tampering'));
+        }
+        // Check #5: Package typosquatting patterns in strings
+        if ((lowerLine.includes('npm install') || lowerLine.includes('yarn add')) &&
+            (lowerLine.includes('reactjs') || lowerLine.includes('react-js') ||
+                lowerLine.includes('vue-js') || lowerLine.includes('vuejs') ||
+                lowerLine.includes('angularjs') || lowerLine.includes('angular-js') ||
+                lowerLine.includes('jquery-') || lowerLine.includes('jqeury'))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('package-typosquatting-pattern', 'Package name follows common typosquatting pattern', 'Verify official package names and avoid packages with suspicious naming patterns', index + 1, 'Package names that mimic popular packages may contain malicious code', 'npm install reactjs // should be "react"', [
+                'Installation of malicious packages instead of legitimate ones',
+                'Supply chain attacks through package confusion',
+                'Backdoor code execution in development and production',
+                'Credential theft and data exfiltration'
+            ], 'npm install reactjs', 'npm install react // use official package name', 'Package names should be verified against official registries to avoid typosquatting attacks'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=enhanced-supply-chain.js.map

package/dist/src/lib/analyzers/javascript/security-checks/enhanced-supply-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enhanced-supply-chain.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/enhanced-supply-chain.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAkBH,4DAqKC;AApLD,sEAAqF;AAErF;;;;;;;;;;;;GAYG;AACH,SAAgB,wBAAwB,CACtC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wDAAwD;QACxD,4DAA4D;QAC5D,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACrD,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;YAC5B,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,yDAAyD;QACzD,qDAAqD;QACrD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpE,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,6BAA6B,EAC7B,sDAAsD,EACtD,+EAA+E,EAC/E,KAAK,GAAG,CAAC,EACT,+FAA+F,EAC/F,gEAAgE,EAChE;gBACE,gDAAgD;gBAChD,gDAAgD;gBAChD,8CAA8C;gBAC9C,qDAAqD;aACtD,EACD,0CAA0C,EAC1C,kEAAkE,EAClE,uGAAuG,CACxG,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7D,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,4BAA4B,EAC5B,+DAA+D,EAC/D,oFAAoF,EACpF,KAAK,GAAG,CAAC,EACT,uFAAuF,EACvF,8DAA8D,EAC9D;gBACE,6CAA6C;gBAC7C,iDAAiD;gBACjD,qCAAqC;gBACrC,8CAA8C;aAC/C,EACD,mCAAmC,EACnC,yHAAyH,EACzH,4FAA4F,CAC7F,CACF,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjE,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAChE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAChE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAClE,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACtE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACzE,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,4BAA4B,EAC5B,gDAAgD,EAChD,oEAAoE,EACpE,KAAK,GAAG,CAAC,EACT,mFAAmF,EACnF,yCAAyC,EACzC;gBACE,6CAA6C;gBAC7C,sCAAsC;gBACtC,yCAAyC;gBACzC,mDAAmD;aACpD,EACD,mBAAmB,EACnB,kDAAkD,EAClD,0EAA0E,CAC3E,CACF,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3D,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACrE,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YAC5C,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,wBAAwB,EACxB,mDAAmD,EACnD,yDAAyD,EACzD,KAAK,GAAG,CAAC,EACT,uFAAuF,EACvF,iFAAiF,EACjF;gBACE,0CAA0C;gBAC1C,mDAAmD;gBACnD,2CAA2C;gBAC3C,8CAA8C;aAC/C,EACD,+CAA+C,EAC/C,sEAAsE,EACtE,qEAAqE,CACtE,CACF,CAAC;QACJ,CAAC;QAED,sDAAsD;QACtD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACrE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/D,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC3D,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACnE,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpE,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,+BAA+B,EAC/B,mDAAmD,EACnD,kFAAkF,EAClF,KAAK,GAAG,CAAC,EACT,sEAAsE,EACtE,0CAA0C,EAC1C;gBACE,+DAA+D;gBAC/D,gDAAgD;gBAChD,uDAAuD;gBACvD,wCAAwC;aACzC,EACD,qBAAqB,EACrB,gDAAgD,EAChD,6FAA6F,CAC9F,CACF,CAAC;QACJ,CAAC;IAEH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/javascript/security-checks/exception-handling.d.ts

@@ -0,0 +1,28 @@
+/**
+ * JavaScript Exception Handling Security Checks
+ * OWASP A10:2025 - Mishandling of Exceptional Conditions
+ *
+ * Detects improper exception handling that can lead to security vulnerabilities.
+ * This is a completely NEW category in OWASP 2025.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for exception handling security vulnerabilities in JavaScript code
+ *
+ * Covers (Enhanced Dec 30, 2025 - Phase 3):
+ * - Check #1: Unhandled Promise rejections (HIGH)
+ * - Check #2: Empty catch blocks (MEDIUM) - FIXED pattern
+ * - Check #3: Catching and ignoring errors (MEDIUM)
+ * - Check #4: Error objects exposed in responses (HIGH)
+ * - Check #5: Resource cleanup missing in exceptions (MEDIUM)
+ * - Check #6: Missing audit logging for security events (HIGH) - NEW
+ * - Check #7: Missing failure logging (authentication/authorization) (MEDIUM) - NEW
+ * - Check #8: Sensitive data in logs (CRITICAL) - NEW
+ * - Check #9: Log injection vulnerabilities (HIGH) - NEW
+ * - Check #10: Missing error logging in critical operations (MEDIUM) - NEW
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkExceptionHandling(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=exception-handling.d.ts.map

package/dist/src/lib/analyzers/javascript/security-checks/exception-handling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exception-handling.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/exception-handling.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAmWzB"}

package/dist/src/lib/analyzers/javascript/security-checks/exception-handling.js

@@ -0,0 +1,227 @@
+"use strict";
+/**
+ * JavaScript Exception Handling Security Checks
+ * OWASP A10:2025 - Mishandling of Exceptional Conditions
+ *
+ * Detects improper exception handling that can lead to security vulnerabilities.
+ * This is a completely NEW category in OWASP 2025.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkExceptionHandling = checkExceptionHandling;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for exception handling security vulnerabilities in JavaScript code
+ *
+ * Covers (Enhanced Dec 30, 2025 - Phase 3):
+ * - Check #1: Unhandled Promise rejections (HIGH)
+ * - Check #2: Empty catch blocks (MEDIUM) - FIXED pattern
+ * - Check #3: Catching and ignoring errors (MEDIUM)
+ * - Check #4: Error objects exposed in responses (HIGH)
+ * - Check #5: Resource cleanup missing in exceptions (MEDIUM)
+ * - Check #6: Missing audit logging for security events (HIGH) - NEW
+ * - Check #7: Missing failure logging (authentication/authorization) (MEDIUM) - NEW
+ * - Check #8: Sensitive data in logs (CRITICAL) - NEW
+ * - Check #9: Log injection vulnerabilities (HIGH) - NEW
+ * - Check #10: Missing error logging in critical operations (MEDIUM) - NEW
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkExceptionHandling(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmedLine.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmedLine.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('//') ||
+            trimmedLine.startsWith('*')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Check #1: Unhandled Promise rejections
+        // Only trigger on lines that START a promise chain (not continuation lines)
+        if ((lowerLine.includes('promise') ||
+            (lowerLine.includes('.then(') && !trimmedLine.startsWith('.'))) &&
+            !lowerLine.includes('.catch(') &&
+            !lines.slice(index, Math.min(index + 5, lines.length)).some(nextLine => nextLine.toLowerCase().includes('.catch('))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('unhandled-promise-rejection', 'Promise without catch handler may cause unhandled rejections', 'Add .catch() handler or use try-catch with async/await', index + 1, 'Unhandled promise rejections can crash Node.js applications and expose error details', 'fetch("/api/data").then(data => process(data)); // no error handling', [
+                'Application crashes in Node.js environment',
+                'Sensitive error information exposure',
+                'Service unavailability and denial of service',
+                'Memory leaks from unresolved promises'
+            ], 'fetch("/api/data").then(data => process(data));', 'fetch("/api/data").then(data => process(data)).catch(err => logger.error("Request failed"));', 'Unhandled promise rejections can crash applications and expose sensitive debugging information'));
+        }
+        // Check #2: Empty catch blocks
+        // FIX (Dec 30, 2025): Handle spaces in empty blocks: { } and {}
+        // Detect: catch (e) {}, catch (e) { }, catch { } on same line OR multi-line empty blocks
+        const emptyCatchPattern = /catch\s*(?:\([^)]*\))?\s*\{\s*\}/i; // Matches { } and {}
+        const isEmptyCatchSameLine = trimmedLine.match(emptyCatchPattern);
+        const isEmptyCatchMultiLine = lowerLine.includes('catch') &&
+            lowerLine.includes('{') &&
+            index + 1 < lines.length &&
+            lines[index + 1].trim() === '}';
+        if (isEmptyCatchSameLine || isEmptyCatchMultiLine) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('empty-catch-block', 'Empty catch block silently ignores exceptions', 'Add proper error handling, logging, or re-throw the exception', index + 1, 'Silent exception suppression can hide security issues and cause unpredictable behavior', 'try { riskyOperation(); } catch (e) {} // error completely ignored', [
+                'Security vulnerabilities hidden and undetected',
+                'Application state corruption from ignored errors',
+                'Debugging difficulties and maintenance issues',
+                'Potential for cascading failures'
+            ], 'try { operation(); } catch (e) {}', 'try { operation(); } catch (e) { logger.error("Operation failed", e); throw e; }', 'Empty catch blocks prevent error visibility and can hide security-critical failures'));
+        }
+        // Check #3: Catching and ignoring specific errors
+        if (lowerLine.includes('catch') &&
+            (lowerLine.includes('// ignore') || lowerLine.includes('/* ignore') ||
+                lowerLine.includes('return') || lowerLine.includes('continue'))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('ignored-exception', 'Exception caught but improperly ignored or suppressed', 'Log the exception and handle it appropriately instead of ignoring', index + 1, 'Ignoring exceptions can mask security vulnerabilities and lead to unpredictable application behavior', 'catch (SecurityError) { return; } // security error silently ignored', [
+                'Security exceptions masked and unaddressed',
+                'Authentication and authorization bypasses',
+                'Data integrity issues from ignored validation errors',
+                'Audit trail gaps from suppressed security events'
+            ], 'catch (e) { return; } // ignore error', 'catch (e) { logger.warn("Operation failed, using fallback", e); return fallbackValue; }', 'Ignoring exceptions without proper handling can hide security-critical issues'));
+        }
+        // Check #4: Error objects exposed in HTTP responses
+        if ((lowerLine.includes('res.send') || lowerLine.includes('response.send') ||
+            lowerLine.includes('res.json') || lowerLine.includes('response.json')) &&
+            (lowerLine.includes('error') || lowerLine.includes('err')) &&
+            lowerLine.includes('.')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('error-object-exposure', 'Error object may be exposed in HTTP response', 'Return generic error messages to clients, log detailed errors server-side', index + 1, 'Exposing error objects reveals sensitive internal information including stack traces and file paths', 'res.json({ error: err.stack }); // exposes full stack trace to client', [
+                'Internal application structure exposure',
+                'File paths and directory structure revelation',
+                'Database schema and connection details disclosure',
+                'Third-party service configuration exposure'
+            ], 'res.send(error.message);', 'logger.error("Request failed", error); res.status(500).send("Internal server error");', 'Error objects contain sensitive debugging information that should not be exposed to clients'));
+        }
+        // Check #5: Resource cleanup missing in exception scenarios
+        if ((lowerLine.includes('connection') || lowerLine.includes('stream') ||
+            lowerLine.includes('file') || lowerLine.includes('socket') ||
+            lowerLine.includes('db.') || lowerLine.includes('database')) &&
+            (lowerLine.includes('.open') || lowerLine.includes('.connect') ||
+                lowerLine.includes('.create') || lowerLine.includes('new ')) &&
+            !lines.slice(index, Math.min(index + 10, lines.length)).some(nextLine => nextLine.toLowerCase().includes('finally') ||
+                nextLine.toLowerCase().includes('.close') ||
+                nextLine.toLowerCase().includes('.end'))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('missing-resource-cleanup', 'Resource may not be properly cleaned up in exception scenarios', 'Use finally blocks or try-with-resources pattern to ensure cleanup', index + 1, 'Improper resource cleanup during exceptions can lead to resource leaks and denial of service', 'const conn = database.connect(); // no finally block for cleanup', [
+                'Memory leaks from unclosed resources',
+                'File descriptor exhaustion',
+                'Database connection pool depletion',
+                'Denial of service from resource exhaustion'
+            ], 'const connection = db.connect();', 'const connection = db.connect(); try { /* operations */ } finally { connection.close(); }', 'Resources opened without guaranteed cleanup can cause leaks when exceptions occur'));
+        }
+        // =============================================================================
+        // PHASE 3 ENHANCEMENTS (Dec 30, 2025) - A09 Logging & Monitoring
+        // =============================================================================
+        // Check #6: Missing audit logging for security events (HIGH)
+        // Pattern: Login success without logging the event
+        const loginSuccessPattern = /(req\.session\.userId|session\.user|jwt\.sign|res\.json.*token|res\.cookie.*token)/i;
+        const isLoginRoute = /\.(post|put)\s*\(\s*['"`]\/(login|auth|signin)/i.test(trimmedLine);
+        if (trimmedLine.match(loginSuccessPattern) || isLoginRoute) {
+            // Check for logging in nearby lines
+            const contextLines = lines.slice(Math.max(0, index - 5), Math.min(index + 10, lines.length));
+            const hasLogging = contextLines.some(l => {
+                const lowerContextLine = l.toLowerCase();
+                return lowerContextLine.includes('logger.') ||
+                    lowerContextLine.includes('log.') ||
+                    lowerContextLine.includes('console.log') ||
+                    lowerContextLine.includes('audit') ||
+                    lowerContextLine.includes('logEvent');
+            });
+            if (!hasLogging && (trimmedLine.match(loginSuccessPattern) || isLoginRoute)) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('missing-audit-logging', 'Security event (login/authentication) not logged - audit trail gap', 'Log all security events: logger.info("Login successful", { userId, ip: req.ip, timestamp })', index + 1, 'Missing audit logs for security-critical events prevents incident detection, forensic analysis, and compliance with regulatory requirements (SOC 2, PCI-DSS, HIPAA).', 'User logs in successfully → No log entry → Account takeover undetected → No forensic trail', [
+                    'Impossible to detect unauthorized access',
+                    'No forensic evidence for security incidents',
+                    'Compliance violations (SOC 2, PCI-DSS 10.2, HIPAA)',
+                    'Cannot track login patterns or anomalies',
+                    'Accountability gaps for security events'
+                ], 'req.session.userId = user.id; // No audit log', 'logger.info("Login successful", { userId: user.id, ip: req.ip, userAgent: req.headers["user-agent"], timestamp: new Date() });\nreq.session.userId = user.id;', 'Log ALL security events: successful logins, failed logins, logouts, password changes, privilege escalations, access denials. Include: user ID, IP, timestamp, user agent.'));
+            }
+        }
+        // Check #7: Missing failure logging (authentication/authorization) (MEDIUM)
+        // Pattern: 401/403 responses without logging
+        const failureResponsePattern = /res\.status\s*\(\s*(401|403)\s*\)/i;
+        if (trimmedLine.match(failureResponsePattern)) {
+            // Check for logging before the response
+            const previousLines = lines.slice(Math.max(0, index - 5), index);
+            const hasFailureLogging = previousLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return lowerLine.includes('logger.') ||
+                    lowerLine.includes('log.') ||
+                    lowerLine.includes('console.log');
+            });
+            if (!hasFailureLogging) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('missing-failure-logging', 'Authentication/authorization failure not logged - security monitoring gap', 'Log failures: logger.warn("Auth failed", { userId, ip, reason, timestamp })', index + 1, 'Failing to log authentication and authorization failures prevents detection of brute-force attacks, credential stuffing, and privilege escalation attempts.', '100 failed login attempts → Not logged → Brute-force attack undetected → Account compromised', [
+                    'Brute-force attacks go undetected',
+                    'Credential stuffing attempts invisible',
+                    'Cannot implement account lockout',
+                    'No anomaly detection possible',
+                    'Compliance violations (PCI-DSS 10.2.4, 10.2.5)'
+                ], 'return res.status(401).send("Unauthorized"); // No log', 'logger.warn("Authentication failed", { email: req.body.email, ip: req.ip, reason: "invalid credentials" });\nreturn res.status(401).send("Unauthorized");', 'Log ALL authentication and authorization failures with user identifier, IP address, timestamp, and failure reason.'));
+            }
+        }
+        // Check #8: Sensitive data in logs (CRITICAL)
+        // Pattern: Logging passwords, tokens, credit cards, SSN, etc.
+        const sensitiveDataPattern = /(logger|console\.log|log\.).*\b(password|passwd|pwd|token|secret|apikey|api_key|creditcard|ssn|cvv|pin)\b/i;
+        if (trimmedLine.match(sensitiveDataPattern)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('sensitive-data-in-logs', 'CRITICAL: Sensitive data (password/token/secret) logged - credential exposure risk', 'Never log sensitive data. Redact passwords, tokens, and PII before logging', index + 1, 'Logging sensitive data (passwords, tokens, API keys, credit cards, SSN) exposes credentials in log files, which are often stored insecurely, backed up, or accessible to multiple teams.', 'logger.info("Login attempt", req.body) → Password in logs → Log file stolen → All credentials exposed', [
+                'Credential exposure in log files',
+                'API keys and secrets leaked',
+                'Credit card data exposure (PCI-DSS violation)',
+                'PII leakage (GDPR/CCPA violation)',
+                'Log aggregation tools expose secrets',
+                'Permanent record of sensitive data'
+            ], 'logger.info("User data:", { password, token, creditCard });', 'logger.info("User data:", { email, role }); // Exclude sensitive fields\n// OR use redaction:\nconst safeData = { ...userData, password: "[REDACTED]", token: "[REDACTED]" };', 'NEVER log passwords, tokens, secrets, API keys, credit cards, SSN, or other sensitive data. Implement automatic redaction for sensitive fields.'));
+        }
+        // Check #9: Log injection vulnerabilities (HIGH)
+        // Pattern: User input directly in log messages without sanitization
+        const logInjectionPattern = /(logger|console\.log|log\.).*\b(req\.body|req\.query|req\.params|userInput|user\.\w+)\b/i;
+        if (trimmedLine.match(logInjectionPattern)) {
+            // Check if input is sanitized
+            const hasSanitization = trimmedLine.includes('JSON.stringify') ||
+                trimmedLine.includes('.replace') ||
+                trimmedLine.includes('sanitize') ||
+                trimmedLine.includes('escape');
+            if (!hasSanitization) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('log-injection', 'Log injection: User input in logs without sanitization - enables log poisoning', 'Sanitize user input before logging: logger.info("Input:", JSON.stringify(req.body))', index + 1, 'Including unsanitized user input in log messages enables log injection attacks, where attackers can inject newlines and fake log entries to hide malicious activity or trigger log parsing vulnerabilities.', 'logger.info("User: " + req.body.username) → Attacker sends username="admin\\n[SUCCESS] Logged in as admin" → Fake admin login in logs', [
+                    'Log poisoning and fake entries',
+                    'Hiding malicious activity in logs',
+                    'Log parsing vulnerabilities',
+                    'SIEM evasion',
+                    'Forensic evidence corruption'
+                ], 'logger.info("User input: " + req.body.name);', 'logger.info("User input:", JSON.stringify(req.body.name)); // Safely serialized', 'Always sanitize or serialize user input before including in logs. Use JSON.stringify() or remove newlines to prevent log injection.'));
+            }
+        }
+        // Check #10: Missing error logging in critical operations (MEDIUM)
+        // Pattern: Database operations, payment processing without error logging
+        const criticalOperationPattern = /(db\.|database\.|stripe\.|payment\.|charge\.|transfer\.).*\.(create|update|delete|charge|transfer)/i;
+        if (trimmedLine.match(criticalOperationPattern)) {
+            // Check for error handling with logging
+            const nextLines = lines.slice(index, Math.min(index + 10, lines.length));
+            const hasTryCatch = nextLines.some(l => l.toLowerCase().includes('try') || l.toLowerCase().includes('catch'));
+            const hasLogging = nextLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (lowerLine.includes('catch') || lowerLine.includes('error')) &&
+                    (lowerLine.includes('logger.') || lowerLine.includes('log.'));
+            });
+            if (!hasTryCatch || !hasLogging) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)('missing-critical-error-logging', 'Critical operation (database/payment) without error logging', 'Wrap in try-catch with logging: try { operation } catch (err) { logger.error("Op failed", err) }', index + 1, 'Critical operations (database writes, payments, transfers) without error logging make it impossible to detect and diagnose failures, financial errors, or security incidents.', 'Database write fails silently → Data loss undetected → Business impact unknown', [
+                    'Silent failures in critical operations',
+                    'Financial transaction errors undetected',
+                    'Data loss without notification',
+                    'Impossible to diagnose production issues',
+                    'Compliance gaps for financial operations'
+                ], 'await db.users.update({ id }, { role: "admin" }); // No error handling', 'try {\n  await db.users.update({ id }, { role: "admin" });\n  logger.info("User role updated", { userId: id, newRole: "admin" });\n} catch (err) {\n  logger.error("Failed to update user role", { userId: id, error: err });\n  throw err;\n}', 'Wrap all critical operations in try-catch blocks with comprehensive error logging including context (user, operation, timestamp).'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=exception-handling.js.map

package/dist/src/lib/analyzers/javascript/security-checks/exception-handling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exception-handling.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/exception-handling.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAuBH,wDAqWC;AAzXD,sEAAqF;AAErF;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,sBAAsB,CACpC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wDAAwD;QACxD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;YAC5B,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,yCAAyC;QACzC,4EAA4E;QAC5E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC7B,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC9B,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACrE,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAClD,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,6BAA6B,EAC7B,8DAA8D,EAC9D,wDAAwD,EACxD,KAAK,GAAG,CAAC,EACT,sFAAsF,EACtF,sEAAsE,EACtE;gBACE,4CAA4C;gBAC5C,sCAAsC;gBACtC,8CAA8C;gBAC9C,uCAAuC;aACxC,EACD,iDAAiD,EACjD,8FAA8F,EAC9F,gGAAgG,CACjG,CACF,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,gEAAgE;QAChE,yFAAyF;QACzF,MAAM,iBAAiB,GAAG,mCAAmC,CAAC,CAAC,qBAAqB;QACpF,MAAM,oBAAoB,GAAG,WAAW,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAClE,MAAM,qBAAqB,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1B,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvB,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;YACxB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;QAE/D,IAAI,oBAAoB,IAAI,qBAAqB,EAAE,CAAC;YAClD,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,mBAAmB,EACnB,+CAA+C,EAC/C,+DAA+D,EAC/D,KAAK,GAAG,CAAC,EACT,wFAAwF,EACxF,oEAAoE,EACpE;gBACE,gDAAgD;gBAChD,kDAAkD;gBAClD,+CAA+C;gBAC/C,kCAAkC;aACnC,EACD,mCAAmC,EACnC,kFAAkF,EAClF,qFAAqF,CACtF,CACF,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAClE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACrE,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,mBAAmB,EACnB,uDAAuD,EACvD,mEAAmE,EACnE,KAAK,GAAG,CAAC,EACT,sGAAsG,EACtG,sEAAsE,EACtE;gBACE,4CAA4C;gBAC5C,2CAA2C;gBAC3C,sDAAsD;gBACtD,kDAAkD;aACnD,EACD,uCAAuC,EACvC,yFAAyF,EACzF,+EAA+E,CAChF,CACF,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;YACrE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;YACvE,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1D,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,uBAAuB,EACvB,8CAA8C,EAC9C,2EAA2E,EAC3E,KAAK,GAAG,CAAC,EACT,qGAAqG,EACrG,uEAAuE,EACvE;gBACE,yCAAyC;gBACzC,+CAA+C;gBAC/C,mDAAmD;gBACnD,4CAA4C;aAC7C,EACD,0BAA0B,EAC1B,uFAAuF,EACvF,6FAA6F,CAC9F,CACF,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1D,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC7D,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC7D,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7D,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACtE,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC1C,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACzC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/C,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,0BAA0B,EAC1B,gEAAgE,EAChE,oEAAoE,EACpE,KAAK,GAAG,CAAC,EACT,8FAA8F,EAC9F,kEAAkE,EAClE;gBACE,sCAAsC;gBACtC,4BAA4B;gBAC5B,oCAAoC;gBACpC,4CAA4C;aAC7C,EACD,kCAAkC,EAClC,2FAA2F,EAC3F,mFAAmF,CACpF,CACF,CAAC;QACJ,CAAC;QAED,gFAAgF;QAChF,iEAAiE;QACjE,gFAAgF;QAEhF,6DAA6D;QAC7D,mDAAmD;QACnD,MAAM,mBAAmB,GAAG,qFAAqF,CAAC;QAClH,MAAM,YAAY,GAAG,iDAAiD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEzF,IAAI,WAAW,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,YAAY,EAAE,CAAC;YAC3D,oCAAoC;YACpC,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7F,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACvC,MAAM,gBAAgB,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBACzC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC;oBACpC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACjC,gBAAgB,CAAC,QAAQ,CAAC,aAAa,CAAC;oBACxC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAClC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC;gBAC5E,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,uBAAuB,EACvB,oEAAoE,EACpE,6FAA6F,EAC7F,KAAK,GAAG,CAAC,EACT,sKAAsK,EACtK,4FAA4F,EAC5F;oBACE,0CAA0C;oBAC1C,6CAA6C;oBAC7C,oDAAoD;oBACpD,0CAA0C;oBAC1C,yCAAyC;iBAC1C,EACD,+CAA+C,EAC/C,+JAA+J,EAC/J,2KAA2K,CAC5K,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,6CAA6C;QAC7C,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;QAEpE,IAAI,WAAW,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC9C,wCAAwC;YACxC,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACjE,MAAM,iBAAiB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAC7B,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC1B,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,yBAAyB,EACzB,2EAA2E,EAC3E,6EAA6E,EAC7E,KAAK,GAAG,CAAC,EACT,6JAA6J,EAC7J,8FAA8F,EAC9F;oBACE,mCAAmC;oBACnC,wCAAwC;oBACxC,kCAAkC;oBAClC,+BAA+B;oBAC/B,gDAAgD;iBACjD,EACD,wDAAwD,EACxD,2JAA2J,EAC3J,oHAAoH,CACrH,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,8DAA8D;QAC9D,MAAM,oBAAoB,GAAG,4GAA4G,CAAC;QAE1I,IAAI,WAAW,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,wBAAwB,EACxB,oFAAoF,EACpF,4EAA4E,EAC5E,KAAK,GAAG,CAAC,EACT,0LAA0L,EAC1L,uGAAuG,EACvG;gBACE,kCAAkC;gBAClC,6BAA6B;gBAC7B,+CAA+C;gBAC/C,mCAAmC;gBACnC,sCAAsC;gBACtC,oCAAoC;aACrC,EACD,6DAA6D,EAC7D,+KAA+K,EAC/K,iJAAiJ,CAClJ,CACF,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,oEAAoE;QACpE,MAAM,mBAAmB,GAAG,0FAA0F,CAAC;QAEvH,IAAI,WAAW,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3C,8BAA8B;YAC9B,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBACtC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAChC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAChC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEvD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,eAAe,EACf,gFAAgF,EAChF,qFAAqF,EACrF,KAAK,GAAG,CAAC,EACT,6MAA6M,EAC7M,uIAAuI,EACvI;oBACE,gCAAgC;oBAChC,mCAAmC;oBACnC,6BAA6B;oBAC7B,cAAc;oBACd,8BAA8B;iBAC/B,EACD,8CAA8C,EAC9C,iFAAiF,EACjF,qIAAqI,CACtI,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,wBAAwB,GAAG,qGAAqG,CAAC;QAEvI,IAAI,WAAW,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAChD,wCAAwC;YACxC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACzE,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9G,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACpC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAC5D,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChC,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,gCAAgC,EAChC,6DAA6D,EAC7D,kGAAkG,EAClG,KAAK,GAAG,CAAC,EACT,+KAA+K,EAC/K,gFAAgF,EAChF;oBACE,wCAAwC;oBACxC,yCAAyC;oBACzC,gCAAgC;oBAChC,0CAA0C;oBAC1C,0CAA0C;iBAC3C,EACD,wEAAwE,EACxE,gPAAgP,EAChP,mIAAmI,CACpI,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IAEH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/javascript/security-checks/injection-attacks.d.ts

@@ -0,0 +1,32 @@
+/**
+ * JavaScript Injection Attack Detection Module
+ *
+ * Detects critical injection vulnerabilities:
+ * - Code injection (eval, Function constructor, setTimeout/setInterval)
+ * - SQL injection patterns
+ * - Command injection
+ * - Path traversal
+ * - Regex DoS (ReDoS)
+ *
+ * Part of modularized JavaScript analyzer (150-300 LOC per module)
+ * Extracted from monolithic javascript-analyzer.ts (2,672 LOC)
+ *
+ * @module injection-attacks
+ */
+import { SecurityVulnerability } from '../../types';
+export interface InjectionCheckResult {
+    vulnerabilities: SecurityVulnerability[];
+}
+/**
+ * Type for createSecurityVulnerability function
+ */
+export type CreateVulnerabilityFn = (id: string, message: string, fix: string, lineNumber: number, explanation: string, example: string, impacts: string[], codeExample: string, fixedCodeExample: string, fixDetails: string) => SecurityVulnerability;
+/**
+ * Check for injection attack vulnerabilities in JavaScript code
+ *
+ * @param code - Full source code
+ * @param createVulnerability - Function to create vulnerability objects
+ * @returns Array of detected vulnerabilities
+ */
+export declare function checkInjectionAttacks(code: string, createVulnerability: CreateVulnerabilityFn): SecurityVulnerability[];
+//# sourceMappingURL=injection-attacks.d.ts.map

package/dist/src/lib/analyzers/javascript/security-checks/injection-attacks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-attacks.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/javascript/security-checks/injection-attacks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,qBAAqB,EAAE,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EAAE,EACjB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,KACf,qBAAqB,CAAC;AAE3B;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,mBAAmB,EAAE,qBAAqB,GACzC,qBAAqB,EAAE,CAmSzB"}