codeslick-cli 1.0.0

package/dist/src/lib/analyzers/javascript/security-checks/security-misconfiguration.js

@@ -0,0 +1,775 @@
+"use strict";
+/**
+ * JavaScript Security Misconfiguration Checks
+ * OWASP A02:2025 - Security Misconfiguration
+ *
+ * Detects security misconfigurations that moved from #5 to #2 in OWASP 2025.
+ * Focus: Cloud configs, app settings, security headers, debug modes, etc.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSecurityMisconfiguration = checkSecurityMisconfiguration;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for security misconfiguration vulnerabilities in JavaScript code
+ *
+ * Covers:
+ * - Check #1: Debug mode enabled in production (MEDIUM)
+ * - Check #2: Detailed error messages exposed (MEDIUM)
+ * - Check #3: CORS misconfiguration allowing all origins (HIGH)
+ * - Check #4: Missing security headers (MEDIUM)
+ * - Check #5: Insecure session configuration (MEDIUM)
+ * - Check #6: Default credentials usage (CRITICAL)
+ * - Check #7: Administrative interfaces exposed (HIGH)
+ * - Check #8: Unnecessary HTTP methods enabled (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkSecurityMisconfiguration(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    let hasCsrfMiddleware = false; // Track CSRF middleware presence
+    let hasRateLimiting = false; // Track rate limiting middleware presence
+    let hasExpressApp = false; // Track Express app creation
+    let hasApiRoute = false; // Track API route definition
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmedLine.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmedLine.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('//') ||
+            trimmedLine.startsWith('*')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Track rate limiting middleware
+        if (lowerLine.includes('ratelimit') || lowerLine.includes('rate-limit') || lowerLine.includes('express-rate-limit')) {
+            hasRateLimiting = true;
+        }
+        // Track Express app creation
+        if (lowerLine.includes('express()') || (lowerLine.includes('const') && lowerLine.includes('app') && lowerLine.includes('express'))) {
+            hasExpressApp = true;
+        }
+        // Track API routes
+        if ((lowerLine.includes('app.get') || lowerLine.includes('app.post') || lowerLine.includes('app.put') || lowerLine.includes('app.delete')) &&
+            (lowerLine.includes('/api/') || lowerLine.includes("'/api") || lowerLine.includes('"/api'))) {
+            hasApiRoute = true;
+        }
+        // Check #1: Debug mode enabled in production (Express.js, Node.js)
+        // Detects: app.set('env', 'development') OR process.env.NODE_ENV = 'development' OR const DEBUG = true
+        if ((lowerLine.includes('app.set') && lowerLine.includes('env') &&
+            (lowerLine.includes('development') || lowerLine.includes('debug'))) ||
+            (lowerLine.includes('process.env.node_env') && lowerLine.includes('=') &&
+                (lowerLine.includes("'development'") || lowerLine.includes('"development"'))) ||
+            (lowerLine.includes('debug') && lowerLine.includes('=') && lowerLine.includes('true') &&
+                (lowerLine.includes('const') || lowerLine.includes('let') || lowerLine.includes('var')))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'MEDIUM',
+                confidence: 'HIGH',
+                message: 'debug mode may be enabled in production environment',
+                line: index + 1,
+                suggestion: 'Ensure NODE_ENV is properly set to "production" and debug flags are disabled',
+                owasp: 'A02:2025',
+                cwe: 'CWE-489',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Debug mode exposes sensitive application details that can aid attackers',
+                    before: 'app.set("env", "development")',
+                    after: 'app.set("env", process.env.NODE_ENV || "production")'
+                },
+                attackVector: {
+                    description: 'Debug mode can expose stack traces, environment variables, and internal application structure',
+                    realWorldImpact: [
+                        'Information disclosure through error messages',
+                        'Exposure of file paths and internal structure',
+                        'Potential exposure of environment variables',
+                        'Performance degradation in production'
+                    ]
+                }
+            }));
+        }
+        // Check #2: Detailed error messages exposed to users
+        // FIX (Dec 30, 2025): Handle method chaining like res.status(500).send(err.stack)
+        // Pattern: res.send() or res.status().send() or res.json() with err.stack/err.message
+        const hasSendMethod = /\bres\.(?:\w+\([^)]*\)\.)*(?:send|json)\s*\(/i.test(trimmedLine) ||
+            /\bresponse\.(?:\w+\([^)]*\)\.)*(?:send|json)\s*\(/i.test(trimmedLine);
+        const hasErrorExposure = lowerLine.includes('err.stack') || lowerLine.includes('error.stack') ||
+            lowerLine.includes('err.message') || lowerLine.includes('error.message');
+        if (hasSendMethod && hasErrorExposure) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'HIGH',
+                confidence: 'HIGH',
+                message: 'Detailed error details exposed to users',
+                line: index + 1,
+                suggestion: 'Log detailed errors server-side, return generic error messages to users',
+                owasp: 'A02:2025',
+                cwe: 'CWE-209',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Exposing detailed error information can reveal internal application structure and sensitive data',
+                    before: 'res.status(500).send(err.stack)',
+                    after: 'logger.error(err); res.status(500).send("Internal server error")'
+                },
+                attackVector: {
+                    description: 'Error messages can reveal database schemas, file paths, and application internals',
+                    realWorldImpact: [
+                        'Information disclosure about internal systems',
+                        'Database structure revelation',
+                        'File path and directory structure exposure',
+                        'Technology stack fingerprinting'
+                    ]
+                }
+            }));
+        }
+        // Check #3: CORS misconfiguration allowing all origins
+        if ((lowerLine.includes('cors') &&
+            lowerLine.includes('origin') &&
+            (lowerLine.includes('"*"') || lowerLine.includes("'*'") || lowerLine.includes('true'))) ||
+            (lowerLine.includes('res.header') || lowerLine.includes('response.header')) &&
+                lowerLine.includes('access-control-allow-origin') &&
+                (lowerLine.includes('"*"') || lowerLine.includes("'*'"))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'HIGH',
+                confidence: 'HIGH',
+                message: 'CORS configured to allow requests from any origin',
+                line: index + 1,
+                suggestion: 'Restrict CORS to specific trusted domains',
+                owasp: 'A02:2025',
+                cwe: 'CWE-346',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Allowing all origins bypasses Same-Origin Policy protection',
+                    before: 'app.use(cors({ origin: "*" }))',
+                    after: 'app.use(cors({ origin: ["https://trusted-domain.com"] }))'
+                },
+                attackVector: {
+                    description: 'Unrestricted CORS allows malicious websites to make authenticated requests',
+                    realWorldImpact: [
+                        'Cross-site request forgery (CSRF) attacks',
+                        'Data exfiltration from user sessions',
+                        'Unauthorized API access from malicious sites',
+                        'Session hijacking and credential theft'
+                    ]
+                }
+            }));
+        }
+        // Check #4: Missing security headers configuration
+        // Skip if it's specifically CSP/HSTS (handled by Phase B checks #10-12)
+        if (lowerLine.includes('helmet') && lowerLine.includes('false') &&
+            !lowerLine.includes('contentsecuritypolicy') && !lowerLine.includes('hsts')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'MEDIUM',
+                confidence: 'HIGH',
+                message: 'security header disabled or misconfigured',
+                line: index + 1,
+                suggestion: 'Enable security headers (HSTS, CSP, X-Frame-Options) using helmet.js',
+                owasp: 'A02:2025',
+                cwe: 'CWE-16',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Missing security headers expose applications to various client-side attacks',
+                    before: 'app.use(helmet({ frameguard: false }))',
+                    after: 'app.use(helmet({ frameguard: { action: "sameorigin" } }))'
+                },
+                attackVector: {
+                    description: 'Missing security headers enable clickjacking, XSS, and MITM attacks',
+                    realWorldImpact: [
+                        'Clickjacking attacks through iframe embedding',
+                        'Cross-site scripting (XSS) vulnerabilities',
+                        'Man-in-the-middle attacks without HSTS',
+                        'Content injection and data theft'
+                    ]
+                }
+            }));
+        }
+        // Check #5: Missing rate limiting on API routes
+        // Only flag if Express app is explicitly created AND API routes exist
+        if (hasExpressApp && hasApiRoute && !hasRateLimiting) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'MEDIUM',
+                confidence: 'MEDIUM',
+                message: 'API routes defined without rate limiting protection',
+                line: index + 1,
+                suggestion: 'Implement rate limiting middleware (express-rate-limit) to prevent abuse',
+                owasp: 'A02:2025',
+                cwe: 'CWE-770',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Without rate limiting, APIs are vulnerable to brute force attacks, credential stuffing, and denial of service',
+                    before: 'app.get(\'/api/login\', loginHandler);',
+                    after: 'const rateLimit = require(\'express-rate-limit\');\nconst limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });\napp.use(\'/api/\', limiter);'
+                },
+                attackVector: {
+                    description: 'Missing rate limiting allows unlimited request attempts',
+                    realWorldImpact: [
+                        'Brute force password attacks',
+                        'Credential stuffing attacks',
+                        'API abuse and resource exhaustion',
+                        'Denial of Service (DoS)',
+                        'Data scraping'
+                    ]
+                }
+            }));
+            // Only report once
+            hasApiRoute = false;
+        }
+        // Check #6: Insecure session configuration
+        if (lowerLine.includes('session') &&
+            (lowerLine.includes('secure') && lowerLine.includes('false')) ||
+            (lowerLine.includes('httponly') && lowerLine.includes('false'))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'MEDIUM',
+                confidence: 'HIGH',
+                message: 'Insecure session cookie configuration',
+                line: index + 1,
+                suggestion: 'Enable secure and httpOnly flags for session cookies',
+                owasp: 'A02:2025',
+                cwe: 'CWE-614',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Insecure session cookies can be intercepted or accessed by malicious scripts',
+                    before: 'app.use(session({ cookie: { secure: false, httpOnly: false } }))',
+                    after: 'app.use(session({ cookie: { secure: true, httpOnly: true } }))'
+                },
+                attackVector: {
+                    description: 'Insecure session cookies enable session hijacking and XSS exploitation',
+                    realWorldImpact: [
+                        'Session hijacking over unencrypted connections',
+                        'JavaScript-based session theft (XSS)',
+                        'Man-in-the-middle session interception',
+                        'Account takeover and unauthorized access'
+                    ]
+                }
+            }));
+        }
+        // Check #7: Default credentials usage
+        if (((lowerLine.includes('username') &&
+            (lowerLine.includes('"admin"') || lowerLine.includes("'admin'") ||
+                lowerLine.includes('"root"') || lowerLine.includes("'root'"))) ||
+            (lowerLine.includes('password') &&
+                (lowerLine.includes('"password"') || lowerLine.includes("'password'") ||
+                    lowerLine.includes('"admin"') || lowerLine.includes("'admin'") ||
+                    lowerLine.includes('"123456"') || lowerLine.includes("'123456'") ||
+                    lowerLine.includes('"password123"') || lowerLine.includes("'password123'") ||
+                    lowerLine.includes('"admin123"') || lowerLine.includes("'admin123'")))) &&
+            !lowerLine.includes('process.env')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'CRITICAL',
+                confidence: 'HIGH',
+                message: 'default admin credentials or weak password detected',
+                line: index + 1,
+                suggestion: 'Use strong, unique credentials and store securely using environment variables',
+                owasp: 'A02:2025',
+                cwe: 'CWE-798',
+                pciDss: 'Requirement 2.1',
+                remediation: {
+                    explanation: 'Default credentials are well-known and easily exploited by attackers',
+                    before: 'const auth = { username: "admin", password: "password" }',
+                    after: 'const auth = { username: process.env.DB_USER, password: process.env.DB_PASS }'
+                },
+                attackVector: {
+                    description: 'Default credentials provide immediate unauthorized access to systems',
+                    realWorldImpact: [
+                        'Complete system compromise',
+                        'Unauthorized data access and modification',
+                        'Privilege escalation opportunities',
+                        'Lateral movement within network'
+                    ]
+                }
+            }));
+        }
+        // Check #8: Administrative interfaces exposed
+        if (lowerLine.includes('app.get') || lowerLine.includes('router.get') || lowerLine.includes('app.use')) {
+            const urlPattern = trimmedLine.match(/['"`]([^'"`]+)['"`]/);
+            if (urlPattern) {
+                const url = urlPattern[1].toLowerCase();
+                if (url.includes('/admin') || url.includes('/management') ||
+                    url.includes('/console') || url.includes('/dashboard') ||
+                    url.includes('/config') || url.includes('/status')) {
+                    // Check if route has authentication middleware (requireAuth, isAuth, authenticate, etc.)
+                    const hasAuthMiddleware = trimmedLine.includes('requireAuth') ||
+                        trimmedLine.includes('isAuth') ||
+                        trimmedLine.includes('authenticate') ||
+                        trimmedLine.includes('ensureAuth') ||
+                        trimmedLine.includes('checkAuth') ||
+                        trimmedLine.includes('verifyAuth');
+                    if (!hasAuthMiddleware) {
+                        vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                            category: 'Security Misconfiguration',
+                            severity: 'HIGH',
+                            confidence: 'MEDIUM',
+                            message: 'admin interface may be exposed without proper protection',
+                            line: index + 1,
+                            suggestion: 'Implement authentication and authorization for administrative endpoints',
+                            owasp: 'A02:2025',
+                            cwe: 'CWE-200',
+                            pciDss: 'Requirement 7.1',
+                            remediation: {
+                                explanation: 'Exposed administrative interfaces provide attack entry points',
+                                before: 'app.get("/admin", (req, res) => { ... })',
+                                after: 'app.get("/admin", authenticateAdmin, authorizeAdmin, (req, res) => { ... })'
+                            },
+                            attackVector: {
+                                description: 'Unprotected admin interfaces allow unauthorized system control',
+                                realWorldImpact: [
+                                    'Unauthorized administrative access',
+                                    'System configuration changes',
+                                    'User account manipulation',
+                                    'Complete application compromise'
+                                ]
+                            }
+                        }));
+                    }
+                }
+            }
+        }
+        // Check #9: Unnecessary HTTP methods enabled globally
+        if (lowerLine.includes('app.use') &&
+            (lowerLine.includes('methodoverride') || lowerLine.includes('method-override'))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'MEDIUM',
+                confidence: 'MEDIUM',
+                message: 'HTTP method override enabled - may expose unnecessary HTTP methods',
+                line: index + 1,
+                suggestion: 'Disable method override or restrict to specific routes if not needed',
+                owasp: 'A02:2025',
+                cwe: 'CWE-16',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Method override can enable unintended HTTP methods that bypass security controls',
+                    before: 'app.use(methodOverride())',
+                    after: 'app.use(methodOverride({ methods: ["POST"] })) // or remove if not needed'
+                },
+                attackVector: {
+                    description: 'Additional HTTP methods can bypass security controls and access restrictions',
+                    realWorldImpact: [
+                        'Bypass of access control mechanisms',
+                        'Unintended data modification via PUT/DELETE',
+                        'Web application firewall evasion',
+                        'Cross-site request forgery opportunities'
+                    ]
+                }
+            }));
+        }
+        // Check #9: HTTP TRACE method enabled (NEW - OWASP 2025 Test)
+        if (lowerLine.match(/app\.(trace|connect|options)\s*\(/)) {
+            const method = trimmedLine.match(/app\.(\w+)\s*\(/)?.[1]?.toUpperCase() || 'UNKNOWN';
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'MEDIUM',
+                confidence: 'HIGH',
+                message: `unsafe HTTP method ${method} enabled - should be disabled in production`,
+                line: index + 1,
+                suggestion: `Disable ${method} method or restrict to development environment only`,
+                owasp: 'A05:2021',
+                cwe: 'CWE-16',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: `${method} method can expose sensitive information and enable cross-site tracing (XST) attacks`,
+                    before: `app.${method.toLowerCase()}('/api/debug', (req, res) => { ... })`,
+                    after: `// Remove ${method} endpoints in production or use environment check:\nif (process.env.NODE_ENV !== 'production') {\n  app.${method.toLowerCase()}('/api/debug', ...);\n}`
+                },
+                attackVector: {
+                    description: `${method} method can be exploited for reconnaissance and cross-site attacks`,
+                    realWorldImpact: [
+                        'Information disclosure (TRACE echoes request headers)',
+                        'Cross-site tracing (XST) attacks',
+                        'Session hijacking via stolen cookies',
+                        'Bypassing HTTPOnly cookie protection'
+                    ]
+                }
+            }));
+        }
+        // =============================================================================
+        // PHASE B - Enhanced Helmet Configuration Detection (Dec 21, 2025)
+        // =============================================================================
+        // Check #10: Enhanced Helmet Configuration - Disabled CSP
+        // Check multiline for helmet config
+        const checkDisabledCSP = () => {
+            if (trimmedLine.includes('helmet(')) {
+                // Check current line first
+                if (trimmedLine.includes('contentSecurityPolicy') && trimmedLine.includes('false')) {
+                    return true;
+                }
+                // Check next few lines for multiline config
+                const lookAhead = 10;
+                for (let i = index + 1; i < Math.min(index + lookAhead, lines.length); i++) {
+                    const checkLine = lines[i].trim();
+                    if (checkLine.includes('contentSecurityPolicy') && checkLine.includes('false')) {
+                        return true;
+                    }
+                    // Stop if we hit closing bracket
+                    if (checkLine.includes('});') || checkLine.includes('));')) {
+                        break;
+                    }
+                }
+            }
+            return false;
+        };
+        if (checkDisabledCSP()) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'MEDIUM',
+                confidence: 'HIGH',
+                message: 'security header CSP (Content Security Policy) disabled - leaves app vulnerable to XSS',
+                line: index + 1,
+                suggestion: 'Enable CSP with strict directives',
+                owasp: 'A02:2025',
+                cwe: 'CWE-693',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Content Security Policy is one of the most important security headers. Disabling it removes a critical defense against XSS attacks, allowing attackers to inject malicious scripts.',
+                    before: 'app.use(helmet({ contentSecurityPolicy: false }));',
+                    after: 'app.use(helmet({\n  contentSecurityPolicy: {\n    directives: {\n      defaultSrc: ["\'self\'"],\n      scriptSrc: ["\'self\'"],\n      styleSrc: ["\'self\'"]\n    }\n  }\n}));'
+                },
+                attackVector: {
+                    description: 'Without CSP, XSS attacks can execute malicious scripts freely',
+                    realWorldImpact: [
+                        'Cross-Site Scripting (XSS) attacks',
+                        'Data theft via malicious scripts',
+                        'Session hijacking',
+                        'Phishing attacks',
+                        'Malware distribution'
+                    ]
+                }
+            }));
+        }
+        // Check #11: Enhanced Helmet Configuration - Disabled HSTS
+        const checkDisabledHSTS = () => {
+            if (trimmedLine.includes('helmet(')) {
+                // Check current line first
+                if (trimmedLine.includes('hsts') && trimmedLine.includes('false')) {
+                    return true;
+                }
+                // Check next few lines for multiline config
+                const lookAhead = 10;
+                for (let i = index + 1; i < Math.min(index + lookAhead, lines.length); i++) {
+                    const checkLine = lines[i].trim();
+                    if (checkLine.includes('hsts') && checkLine.includes('false')) {
+                        return true;
+                    }
+                    // Stop if we hit closing bracket
+                    if (checkLine.includes('});') || checkLine.includes('));')) {
+                        break;
+                    }
+                }
+            }
+            return false;
+        };
+        if (checkDisabledHSTS()) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'HIGH',
+                confidence: 'HIGH',
+                message: 'Helmet HSTS (Strict-Transport-Security) disabled - allows downgrade attacks',
+                line: index + 1,
+                suggestion: 'Enable HSTS with maxAge >= 31536000 (1 year)',
+                owasp: 'A02:2025',
+                cwe: 'CWE-693',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'HTTP Strict Transport Security forces browsers to use HTTPS. Disabling it allows man-in-the-middle attacks to downgrade connections to unencrypted HTTP.',
+                    before: 'app.use(helmet({ hsts: false }));',
+                    after: 'app.use(helmet({\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n    preload: true\n  }\n}));'
+                },
+                attackVector: {
+                    description: 'Without HSTS, MITM attackers can downgrade HTTPS to HTTP',
+                    realWorldImpact: [
+                        'Man-in-the-middle attacks',
+                        'SSL stripping attacks',
+                        'Session hijacking',
+                        'Credential theft',
+                        'Traffic eavesdropping'
+                    ]
+                }
+            }));
+        }
+        // Check #12: Enhanced Helmet Configuration - Unsafe CSP directives
+        // Check multiple lines ahead for multiline helmet config
+        const checkUnsafeDirectives = () => {
+            const lookAhead = 10;
+            let hasUnsafeDirective = false;
+            // Check if helmet( is on current line or nearby
+            if (trimmedLine.includes('helmet(')) {
+                // Look ahead for unsafe directives in multiline config
+                for (let i = index; i < Math.min(index + lookAhead, lines.length); i++) {
+                    const checkLine = lines[i].trim();
+                    if (checkLine.includes('unsafe-inline') ||
+                        checkLine.includes('unsafe-eval') ||
+                        (checkLine.includes('defaultSrc') && checkLine.includes('[') && checkLine.includes('*'))) {
+                        hasUnsafeDirective = true;
+                        break;
+                    }
+                }
+            }
+            return hasUnsafeDirective;
+        };
+        if (checkUnsafeDirectives()) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'HIGH',
+                confidence: 'HIGH',
+                message: 'Helmet CSP with unsafe directives (unsafe-inline, unsafe-eval, or *)',
+                line: index + 1,
+                suggestion: 'Remove unsafe-inline, unsafe-eval, and * from CSP directives',
+                owasp: 'A02:2025',
+                cwe: 'CWE-693',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Using unsafe-inline, unsafe-eval, or wildcard (*) in Content Security Policy defeats its purpose by allowing execution of inline scripts and eval(), which are primary XSS attack vectors.',
+                    before: 'app.use(helmet({\n  contentSecurityPolicy: {\n    directives: { scriptSrc: ["\'unsafe-inline\'", "*"] }\n  }\n}));',
+                    after: 'app.use(helmet({\n  contentSecurityPolicy: {\n    directives: {\n      defaultSrc: ["\'self\'"],\n      scriptSrc: ["\'self\'"],\n      styleSrc: ["\'self\'"]\n    }\n  }\n}));'
+                },
+                attackVector: {
+                    description: 'Unsafe CSP directives allow XSS attacks despite having CSP enabled',
+                    realWorldImpact: [
+                        'XSS attacks despite CSP being enabled',
+                        'Inline script execution',
+                        'eval() code execution',
+                        'Loading scripts from any origin (*)'
+                    ]
+                }
+            }));
+        }
+        // =============================================================================
+        // PHASE B - CSRF Protection Detection (Dec 21, 2025)
+        // =============================================================================
+        // Track CSRF middleware usage
+        if (trimmedLine.includes('csurf') || trimmedLine.includes('csrf')) {
+            hasCsrfMiddleware = true;
+        }
+        // Check #13: Missing CSRF Protection on state-changing routes
+        const stateChangingRoute = trimmedLine.match(/\.(post|put|delete|patch)\s*\(/);
+        if (stateChangingRoute && !hasCsrfMiddleware) {
+            const method = stateChangingRoute[1].toUpperCase();
+            // Check if route handles sensitive operations
+            const isSensitiveRoute = trimmedLine.includes('/login') ||
+                trimmedLine.includes('/signup') ||
+                trimmedLine.includes('/register') ||
+                trimmedLine.includes('/transfer') ||
+                trimmedLine.includes('/payment') ||
+                trimmedLine.includes('/delete') ||
+                trimmedLine.includes('/update') ||
+                trimmedLine.includes('/create');
+            if (isSensitiveRoute) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                    category: 'Security Misconfiguration',
+                    severity: 'HIGH',
+                    confidence: 'HIGH',
+                    message: `Missing CSRF protection on ${method} route - vulnerable to cross-site request forgery`,
+                    line: index + 1,
+                    suggestion: 'Add CSRF middleware (csurf) to protect state-changing routes',
+                    owasp: 'A01:2021',
+                    cwe: 'CWE-352',
+                    pciDss: 'Requirement 6.5.9',
+                    remediation: {
+                        explanation: 'Cross-Site Request Forgery (CSRF) allows attackers to trick authenticated users into executing unwanted actions. Without CSRF tokens, an attacker can forge requests using the victim\'s session cookies.',
+                        before: `app.${stateChangingRoute[1]}('/transfer', (req, res) => { ... });`,
+                        after: `import csrf from 'csurf';\nconst csrfProtection = csrf({ cookie: true });\napp.use(csrfProtection);\napp.${stateChangingRoute[1]}('/transfer', csrfProtection, (req, res) => { ... });`
+                    },
+                    attackVector: {
+                        description: 'CSRF allows attackers to perform actions on behalf of authenticated users',
+                        realWorldImpact: [
+                            'Unauthorized state changes (money transfer, password change)',
+                            'Account takeover via forced actions',
+                            'Data manipulation and deletion',
+                            'Privilege escalation attacks'
+                        ]
+                    }
+                }));
+            }
+        }
+        // Check #14: Session cookie without SameSite attribute
+        if ((trimmedLine.includes('session(') || trimmedLine.includes('cookie(')) &&
+            trimmedLine.includes('{')) {
+            // Check if sameSite is present in current line or nearby lines (multiline config)
+            let hasSameSite = false;
+            const lookAhead = 10;
+            for (let i = index; i < Math.min(index + lookAhead, lines.length); i++) {
+                if (lines[i].includes('sameSite')) {
+                    hasSameSite = true;
+                    break;
+                }
+                // Stop looking if we hit a closing bracket/parenthesis
+                if (lines[i].includes('});') || lines[i].includes('));')) {
+                    break;
+                }
+            }
+            if (!hasSameSite) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                    category: 'Security Misconfiguration',
+                    severity: 'HIGH',
+                    confidence: 'HIGH',
+                    message: 'Session cookie without SameSite attribute - vulnerable to CSRF',
+                    line: index + 1,
+                    suggestion: 'Set SameSite attribute to \'Strict\' or \'Lax\' for session cookies',
+                    owasp: 'A01:2021',
+                    cwe: 'CWE-352',
+                    pciDss: 'Requirement 6.5.9',
+                    remediation: {
+                        explanation: 'Without the SameSite cookie attribute, browsers send cookies with cross-origin requests, enabling CSRF attacks. The SameSite attribute prevents browsers from sending cookies with cross-site requests.',
+                        before: 'app.use(session({ secret: \'key\', cookie: { httpOnly: true } }));',
+                        after: 'app.use(session({ secret: \'key\', cookie: { httpOnly: true, sameSite: \'Strict\', secure: true } }));'
+                    },
+                    attackVector: {
+                        description: 'Missing SameSite attribute allows CSRF attacks via cross-origin requests',
+                        realWorldImpact: [
+                            'Cross-Site Request Forgery (CSRF) attacks',
+                            'Session hijacking via cross-origin requests',
+                            'Unauthorized actions on behalf of authenticated users'
+                        ]
+                    }
+                }));
+            }
+        }
+        // =============================================================================
+        // PHASE 1 ENHANCEMENTS (Dec 30, 2025) - A05 Coverage Improvements
+        // =============================================================================
+        // Check #15: Error middleware with error exposure (NEW)
+        // Pattern: app.use((err, req, res, next) => { res.send(err.stack) })
+        // This is the EXACT user test case that failed
+        const errorMiddlewarePattern = /\(\s*(err|error)\s*,\s*req\s*,\s*res\s*,\s*next\s*\)/i;
+        if (trimmedLine.match(errorMiddlewarePattern)) {
+            // Check next 10 lines for error exposure
+            const nextLines = lines.slice(index, Math.min(index + 10, lines.length));
+            const hasErrorExposureInHandler = nextLines.some(l => {
+                const lowerNextLine = l.toLowerCase();
+                return ((lowerNextLine.includes('res.send') || lowerNextLine.includes('res.json')) &&
+                    (lowerNextLine.includes('err.stack') || lowerNextLine.includes('error.stack') ||
+                        lowerNextLine.includes('err.message') || lowerNextLine.includes('error.message') ||
+                        lowerNextLine.includes('err)') || lowerNextLine.includes('error)')));
+            });
+            if (hasErrorExposureInHandler) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                    category: 'Security Misconfiguration',
+                    severity: 'CRITICAL',
+                    confidence: 'HIGH',
+                    message: 'Error middleware exposes sensitive error details to clients',
+                    line: index + 1,
+                    suggestion: 'Return generic error messages to clients, log detailed errors server-side only',
+                    owasp: 'A05:2021',
+                    cwe: 'CWE-209',
+                    pciDss: 'Requirement 6.5.5',
+                    remediation: {
+                        explanation: 'Error handling middleware that sends detailed error information (stack traces, error messages) to clients reveals internal application structure, file paths, and sensitive debugging information that attackers can exploit.',
+                        before: 'app.use((err, req, res, next) => {\n  res.status(500).send(err.stack);\n});',
+                        after: 'app.use((err, req, res, next) => {\n  logger.error("Error:", err); // Log server-side\n  res.status(500).send("Internal server error"); // Generic message to client\n});'
+                    },
+                    attackVector: {
+                        description: 'Error middleware exposing stack traces reveals file paths, function names, and internal logic',
+                        realWorldImpact: [
+                            'File path and directory structure exposure',
+                            'Function names and call stack revelation',
+                            'Database query exposure via error messages',
+                            'Third-party library versions disclosed',
+                            'Sensitive configuration details leaked',
+                            'Enables targeted attacks based on internal knowledge'
+                        ]
+                    }
+                }));
+            }
+        }
+        // Check #16: Debug/status endpoints exposing sensitive information (NEW)
+        // Pattern: app.get('/debug') or app.get('/status') returning process.env, config, etc.
+        const debugEndpointPattern = /\.(get|use|all)\s*\(\s*['"`]\/(?:debug|status|health|info|config|env)/i;
+        if (trimmedLine.match(debugEndpointPattern)) {
+            // Check next 10 lines for sensitive data exposure
+            const nextLines = lines.slice(index, Math.min(index + 10, lines.length));
+            const exposesSensitiveData = nextLines.some(l => {
+                const lowerNextLine = l.toLowerCase();
+                return (lowerNextLine.includes('process.env') ||
+                    lowerNextLine.includes('config') ||
+                    lowerNextLine.includes('credentials') ||
+                    lowerNextLine.includes('secret') ||
+                    lowerNextLine.includes('password') ||
+                    lowerNextLine.includes('apikey') ||
+                    lowerNextLine.includes('api_key'));
+            });
+            if (exposesSensitiveData) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                    category: 'Security Misconfiguration',
+                    severity: 'CRITICAL',
+                    confidence: 'HIGH',
+                    message: 'Debug/status endpoint exposes sensitive configuration or environment variables',
+                    line: index + 1,
+                    suggestion: 'Remove debug endpoints from production or protect with strong authentication',
+                    owasp: 'A05:2021',
+                    cwe: 'CWE-215',
+                    pciDss: 'Requirement 6.5.5',
+                    remediation: {
+                        explanation: 'Debug and status endpoints that expose environment variables, configuration, or credentials provide attackers with sensitive information needed to compromise the system.',
+                        before: 'app.get("/debug", (req, res) => {\n  res.json({ env: process.env, config });\n});',
+                        after: '// Remove debug endpoints from production\nif (process.env.NODE_ENV !== "production") {\n  app.get("/debug", authenticate, (req, res) => {\n    res.json({ version: pkg.version }); // Only non-sensitive info\n  });\n}'
+                    },
+                    attackVector: {
+                        description: 'Debug endpoints reveal sensitive configuration enabling credential theft and system access',
+                        realWorldImpact: [
+                            'API keys and secrets exposure',
+                            'Database credentials disclosure',
+                            'Internal service URLs revealed',
+                            'Authentication tokens leaked',
+                            'Environment configuration exposed',
+                            'Complete system compromise possible'
+                        ]
+                    }
+                }));
+            }
+        }
+        // Check #17: Production code with verbose error details (NEW)
+        // Pattern: Detailed error responses in production code
+        if ((lowerLine.includes('res.status(500)') || lowerLine.includes('res.status(400)') ||
+            lowerLine.includes('res.status(401)') || lowerLine.includes('res.status(403)')) &&
+            (trimmedLine.includes('err') || trimmedLine.includes('error')) &&
+            !trimmedLine.includes('logger') &&
+            !trimmedLine.includes('log(')) {
+            // Check if it's exposing error details
+            const exposesErrorDetails = trimmedLine.match(/\.send\s*\(\s*(err|error)(?:\.|\))/i) ||
+                trimmedLine.match(/\.json\s*\(\s*\{\s*error\s*:\s*(err|error)/i);
+            if (exposesErrorDetails) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaScriptSecurityVulnerability)({
+                    category: 'Security Misconfiguration',
+                    severity: 'MEDIUM',
+                    confidence: 'MEDIUM',
+                    message: 'Error response may expose internal error details without logging',
+                    line: index + 1,
+                    suggestion: 'Log errors server-side and return generic messages to clients',
+                    owasp: 'A05:2021',
+                    cwe: 'CWE-209',
+                    pciDss: 'Requirement 6.5.5',
+                    remediation: {
+                        explanation: 'Returning raw error objects or messages directly to clients can leak sensitive information.',
+                        before: 'res.status(500).json({ error: err });',
+                        after: 'logger.error(err);\nres.status(500).json({ error: "Internal server error" });'
+                    },
+                    attackVector: {
+                        description: 'Detailed error responses enable information gathering and targeted attacks',
+                        realWorldImpact: [
+                            'Internal logic exposure',
+                            'Stack trace leakage',
+                            'Dependency version disclosure',
+                            'Database schema hints'
+                        ]
+                    }
+                }));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=security-misconfiguration.js.map