codeslick-cli 1.0.0

package/dist/src/lib/analyzers/python/security-checks/ai-generated-code.js

@@ -0,0 +1,242 @@
+"use strict";
+/**
+ * Python AI-Generated Code Detection Module
+ *
+ * Detects AI-generated code patterns as SECURITY RISKS:
+ * - 15 hallucination patterns (JavaScript influence, case errors)
+ * - 8 code smell heuristics (over-engineering, inconsistency)
+ * - Confidence scoring (HIGH/MEDIUM/LOW)
+ *
+ * OWASP A04:2025 - Insecure Design
+ * CWE-1120 - Excessive Code Complexity
+ * CWE-758 - Reliance on Undefined Behavior
+ *
+ * Phase 1.5, Week 5-7 (AI-Generated Code Detection)
+ * Created: January 8, 2026
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAIGeneratedCode = checkAIGeneratedCode;
+const createVulnerability_1 = require("../utils/createVulnerability");
+const ai_code_detection_utils_1 = require("../../helpers/ai-code-detection-utils");
+/**
+ * Python hallucination patterns (15 patterns)
+ *
+ * AI code generators hallucinate methods from JavaScript:
+ * - JavaScript influence: .push(), .toUpperCase(), .indexOf()
+ * - Property vs method confusion: .length, .size
+ * - Non-existent methods: .hasKey(), .containsKey(), .charAt()
+ */
+const HALLUCINATION_PATTERNS = new Map([
+    // JavaScript-style methods in Python
+    ['push', {
+            correct: '.append()',
+            description: 'Python lists use .append(), not .push(). This is a JavaScript method.'
+        }],
+    ['toUpperCase', {
+            correct: '.upper()',
+            description: 'Python strings use .upper(), not .toUpperCase(). This is JavaScript/Java syntax.'
+        }],
+    ['toLowerCase', {
+            correct: '.lower()',
+            description: 'Python strings use .lower(), not .toLowerCase(). This is JavaScript/Java syntax.'
+        }],
+    ['indexOf', {
+            correct: '.find() or .index()',
+            description: 'Python strings use .find() or .index(), not .indexOf(). This is JavaScript syntax.'
+        }],
+    ['substring', {
+            correct: '[start:end]',
+            description: 'Python uses slice notation [start:end], not .substring(). This is JavaScript syntax.'
+        }],
+    ['charAt', {
+            correct: '[index]',
+            description: 'Python uses indexing [index], not .charAt(). This is JavaScript syntax.'
+        }],
+    // Case sensitivity errors (AI typos)
+    ['toUpper', {
+            correct: '.upper()',
+            description: 'Incomplete method name. Correct Python method is .upper().'
+        }],
+    ['toLower', {
+            correct: '.lower()',
+            description: 'Incomplete method name. Correct Python method is .lower().'
+        }],
+    // Property vs method confusion
+    ['length', {
+            correct: 'len()',
+            description: 'Python uses len() function, not .length property. This is JavaScript syntax.'
+        }],
+    ['size', {
+            correct: 'len()',
+            description: 'Python uses len() function, not .size property/method.'
+        }],
+    // Non-existent methods (hallucinations)
+    ['add', {
+            correct: '.append() for lists',
+            description: 'Lists use .append(), not .add(). Sets use .add(). Context matters.'
+        }],
+    ['remove_at', {
+            correct: '.pop(index)',
+            description: 'Non-existent method. Use .pop(index) to remove element at specific position.'
+        }],
+    ['pop_front', {
+            correct: '.pop(0)',
+            description: 'Non-existent method. Use .pop(0) to remove first element.'
+        }],
+    ['hasKey', {
+            correct: 'in operator',
+            description: 'Python dicts use "key in dict" syntax, not .hasKey(). This is JavaScript/Java syntax.'
+        }],
+    ['containsKey', {
+            correct: 'in operator',
+            description: 'Python dicts use "key in dict" syntax, not .containsKey(). This is Java syntax.'
+        }],
+]);
+/**
+ * Detect AI-generated code in Python
+ *
+ * @param lines - Array of code lines
+ * @param filename - Optional filename (to skip test files)
+ * @returns Array of security vulnerabilities (0-1 aggregated vulnerability)
+ */
+function checkAIGeneratedCode(lines, filename) {
+    // Skip test files to reduce false positives
+    if ((0, ai_code_detection_utils_1.isTestFile)(filename)) {
+        return [];
+    }
+    let hallucinationCount = 0;
+    const hallucinationLines = new Set();
+    const detectedPatterns = [];
+    // Combined regex for all 15 hallucination patterns (optimized)
+    const combinedPattern = new RegExp('\\.' +
+        '(push|toUpperCase|toLowerCase|indexOf|substring|charAt|toUpper|toLower|' +
+        'length|size|add|remove_at|pop_front|hasKey|containsKey)' +
+        '\\s*\\(', 'g');
+    let inMultiLineString = false;
+    let stringDelimiter = '';
+    // 1. Detect hallucination patterns
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line strings (""" or ''')
+        if (!inMultiLineString) {
+            if (trimmed.startsWith('"""')) {
+                inMultiLineString = true;
+                stringDelimiter = '"""';
+            }
+            else if (trimmed.startsWith("'''")) {
+                inMultiLineString = true;
+                stringDelimiter = "'''";
+            }
+        }
+        else {
+            if (trimmed.endsWith(stringDelimiter)) {
+                inMultiLineString = false;
+                return;
+            }
+            return; // Skip lines inside multi-line strings
+        }
+        // Skip comments and empty lines
+        if (!trimmed || trimmed.startsWith('#'))
+            return;
+        // Remove string literals to avoid false positives
+        const cleanedLine = (0, ai_code_detection_utils_1.removeCommentsAndStrings)(line, 'python');
+        // Match hallucination patterns
+        const matches = Array.from(cleanedLine.matchAll(combinedPattern));
+        for (const match of matches) {
+            const method = match[1];
+            const details = HALLUCINATION_PATTERNS.get(method);
+            if (details) {
+                hallucinationCount++;
+                hallucinationLines.add(lineNumber);
+                detectedPatterns.push(method);
+            }
+        }
+    });
+    // 2. Run heuristic detectors
+    const heuristicScores = {
+        overEngineeredErrors: (0, ai_code_detection_utils_1.detectOverEngineeredErrorHandling)(lines),
+        unnecessaryWrappers: (0, ai_code_detection_utils_1.detectUnnecessaryWrappers)(lines),
+        verboseComments: (0, ai_code_detection_utils_1.detectVerboseComments)(lines),
+        mixedNaming: (0, ai_code_detection_utils_1.detectMixedNamingConventions)(lines), // Detects camelCase in Python
+        redundantNullChecks: (0, ai_code_detection_utils_1.detectRedundantNullChecks)(lines),
+        unnecessaryAsync: (0, ai_code_detection_utils_1.detectUnnecessaryAsync)(lines),
+        genericVariables: (0, ai_code_detection_utils_1.detectGenericVariableOveruse)(lines),
+        inconsistentStrings: (0, ai_code_detection_utils_1.detectInconsistentStringConcatenation)(lines),
+    };
+    // 3. Calculate confidence and severity
+    const detection = (0, ai_code_detection_utils_1.calculateAICodeConfidence)(hallucinationCount, heuristicScores);
+    if (!detection) {
+        return []; // No AI-generated code detected
+    }
+    // 4. Create aggregated vulnerability
+    const categoryId = detection.severity === 'CRITICAL' ? 'ai-generated-code-high' :
+        detection.severity === 'HIGH' ? 'ai-generated-code-medium' :
+            'ai-generated-code-low';
+    // Build message based on detection type
+    let message = `AI-generated code detected (${detection.confidence} confidence): `;
+    if (hallucinationCount > 0) {
+        message += `${hallucinationCount} hallucinated method(s) found`;
+        if (detectedPatterns.length > 0) {
+            const uniquePatterns = Array.from(new Set(detectedPatterns)).slice(0, 3);
+            message += ` (.${uniquePatterns.join(', .')})`;
+        }
+    }
+    else {
+        message += 'Multiple code smell patterns detected (over-engineering, camelCase naming, etc.)';
+    }
+    // Build suggestion
+    const suggestion = hallucinationCount > 0
+        ? `Replace hallucinated methods with correct Python equivalents. Found: ${Array.from(new Set(detectedPatterns)).map(p => `.${p}()`).join(', ')}. Review and rewrite AI-generated code sections.`
+        : 'Simplify code structure, use consistent naming conventions (snake_case), and follow Python idioms (PEP 8). Remove unnecessary async functions, redundant None checks, and over-engineered error handling.';
+    // Find first occurrence line for reporting
+    const reportLine = hallucinationLines.size > 0
+        ? Math.min(...hallucinationLines)
+        : 1; // Use first line if only heuristics detected
+    // Get first detected pattern details for remediation example
+    const firstPattern = detectedPatterns[0];
+    const firstPatternDetails = firstPattern ? HALLUCINATION_PATTERNS.get(firstPattern) : null;
+    return [
+        (0, createVulnerability_1.createPythonSecurityVulnerability)({
+            category: categoryId,
+            severity: detection.severity.toLowerCase(),
+            confidence: detection.confidence,
+            message,
+            line: reportLine,
+            suggestion,
+            owasp: 'A04:2025 - Insecure Design',
+            cwe: 'CWE-1120, CWE-758',
+            pciDss: '6.5',
+            remediation: {
+                explanation: 'AI code generators (like GitHub Copilot, ChatGPT, Claude) can hallucinate non-existent methods or generate over-engineered patterns. ' +
+                    'This creates reliability issues and potential security vulnerabilities. Hallucinated methods cause AttributeError exceptions that expose stack traces with ' +
+                    'sensitive information. Over-engineered code patterns make security audits difficult, hiding real vulnerabilities. ' +
+                    'Always verify AI-generated code matches Python specifications (PEP 8) and follows security best practices.',
+                before: firstPatternDetails
+                    ? `items.${firstPattern}(value)  # Hallucinated method`
+                    : '# Over-engineered or inconsistent code patterns\n# Example: try: ... except Exception as e: if ...: if ...: if ...: pass',
+                after: firstPatternDetails
+                    ? `items${firstPatternDetails.correct}  # Correct Python`
+                    : '# Simplified, idiomatic code following Python conventions (PEP 8)\n# Example: try: ... except Exception as e: logger.error(e); raise',
+            },
+            attackVector: {
+                description: 'AI-generated code with hallucinated methods creates runtime AttributeError exceptions exposing system internals through stack traces. ' +
+                    'Attackers can trigger these errors repeatedly to map application structure and identify vulnerable endpoints. ' +
+                    'Inconsistent code patterns (mixing camelCase and snake_case) make security reviews difficult, allowing real vulnerabilities to hide among AI-generated noise. ' +
+                    'Over-engineered error handling may leak sensitive information in except blocks.',
+                exploitExample: "User triggers: items.push(value)\n" +
+                    "Result: AttributeError: 'list' object has no attribute 'push'\n" +
+                    "Stack trace reveals: Internal file paths, function names, database schema hints\n" +
+                    "Attacker uses this to map application architecture and plan targeted attacks.",
+                realWorldImpact: [
+                    'Runtime errors revealing sensitive stack traces with internal paths',
+                    'Logic bugs in access control or validation code (AI-generated if statements)',
+                    'Performance degradation from inefficient AI-generated loops and algorithms',
+                    'Maintenance burden: Developers spend hours debugging AI hallucinations',
+                    'Hidden security vulnerabilities masked by over-engineered code patterns',
+                ],
+            },
+        })
+    ];
+}
+//# sourceMappingURL=ai-generated-code.js.map

package/dist/src/lib/analyzers/python/security-checks/ai-generated-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-generated-code.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/ai-generated-code.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA+GH,oDAqKC;AAjRD,sEAAiF;AACjF,mFAY+C;AAU/C;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAA+B;IACnE,qCAAqC;IACrC,CAAC,MAAM,EAAE;YACP,OAAO,EAAE,WAAW;YACpB,WAAW,EAAE,uEAAuE;SACrF,CAAC;IACF,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,kFAAkF;SAChG,CAAC;IACF,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,kFAAkF;SAChG,CAAC;IACF,CAAC,SAAS,EAAE;YACV,OAAO,EAAE,qBAAqB;YAC9B,WAAW,EAAE,oFAAoF;SAClG,CAAC;IACF,CAAC,WAAW,EAAE;YACZ,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,sFAAsF;SACpG,CAAC;IACF,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,yEAAyE;SACvF,CAAC;IAEF,qCAAqC;IACrC,CAAC,SAAS,EAAE;YACV,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,4DAA4D;SAC1E,CAAC;IACF,CAAC,SAAS,EAAE;YACV,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,4DAA4D;SAC1E,CAAC;IAEF,+BAA+B;IAC/B,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,8EAA8E;SAC5F,CAAC;IACF,CAAC,MAAM,EAAE;YACP,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,wDAAwD;SACtE,CAAC;IAEF,wCAAwC;IACxC,CAAC,KAAK,EAAE;YACN,OAAO,EAAE,qBAAqB;YAC9B,WAAW,EAAE,oEAAoE;SAClF,CAAC;IACF,CAAC,WAAW,EAAE;YACZ,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,8EAA8E;SAC5F,CAAC;IACF,CAAC,WAAW,EAAE;YACZ,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,2DAA2D;SACzE,CAAC;IACF,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,uFAAuF;SACrG,CAAC;IACF,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,iFAAiF;SAC/F,CAAC;CACH,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,KAAe,EACf,QAAiB;IAEjB,4CAA4C;IAC5C,IAAI,IAAA,oCAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,+DAA+D;IAC/D,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,KAAK;QACL,yEAAyE;QACzE,yDAAyD;QACzD,SAAS,EACT,GAAG,CACJ,CAAC;IAEF,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,eAAe,GAAG,EAAE,CAAC;IAEzB,mCAAmC;IACnC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,wCAAwC;QACxC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,iBAAiB,GAAG,IAAI,CAAC;gBACzB,eAAe,GAAG,KAAK,CAAC;YAC1B,CAAC;iBAAM,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,iBAAiB,GAAG,IAAI,CAAC;gBACzB,eAAe,GAAG,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACtC,iBAAiB,GAAG,KAAK,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,OAAO,CAAC,uCAAuC;QACjD,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAEhD,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAA,kDAAwB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE7D,+BAA+B;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAElE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEnD,IAAI,OAAO,EAAE,CAAC;gBACZ,kBAAkB,EAAE,CAAC;gBACrB,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACnC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6BAA6B;IAC7B,MAAM,eAAe,GAAG;QACtB,oBAAoB,EAAE,IAAA,2DAAiC,EAAC,KAAK,CAAC;QAC9D,mBAAmB,EAAE,IAAA,mDAAyB,EAAC,KAAK,CAAC;QACrD,eAAe,EAAE,IAAA,+CAAqB,EAAC,KAAK,CAAC;QAC7C,WAAW,EAAE,IAAA,sDAA4B,EAAC,KAAK,CAAC,EAAE,8BAA8B;QAChF,mBAAmB,EAAE,IAAA,mDAAyB,EAAC,KAAK,CAAC;QACrD,gBAAgB,EAAE,IAAA,gDAAsB,EAAC,KAAK,CAAC;QAC/C,gBAAgB,EAAE,IAAA,sDAA4B,EAAC,KAAK,CAAC;QACrD,mBAAmB,EAAE,IAAA,+DAAqC,EAAC,KAAK,CAAC;KAClE,CAAC;IAEF,uCAAuC;IACvC,MAAM,SAAS,GAAG,IAAA,mDAAyB,EAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;IAEjF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,CAAC,CAAC,gCAAgC;IAC7C,CAAC;IAED,qCAAqC;IACrC,MAAM,UAAU,GACd,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9D,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;YAC5D,uBAAuB,CAAC;IAE1B,wCAAwC;IACxC,IAAI,OAAO,GAAG,+BAA+B,SAAS,CAAC,UAAU,gBAAgB,CAAC;IAElF,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,GAAG,kBAAkB,+BAA+B,CAAC;QAChE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzE,OAAO,IAAI,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACjD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,kFAAkF,CAAC;IAChG,CAAC;IAED,mBAAmB;IACnB,MAAM,UAAU,GAAG,kBAAkB,GAAG,CAAC;QACvC,CAAC,CAAC,wEAAwE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;QAChM,CAAC,CAAC,2MAA2M,CAAC;IAEhN,2CAA2C;IAC3C,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC;QACjC,CAAC,CAAC,CAAC,CAAC,CAAC,6CAA6C;IAEpD,6DAA6D;IAC7D,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,mBAAmB,GAAG,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3F,OAAO;QACL,IAAA,uDAAiC,EAAC;YAChC,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAoC;YAC5E,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,OAAO;YACP,IAAI,EAAE,UAAU;YAChB,UAAU;YACV,KAAK,EAAE,4BAA4B;YACnC,GAAG,EAAE,mBAAmB;YACxB,MAAM,EAAE,KAAK;YACb,WAAW,EAAE;gBACX,WAAW,EACT,uIAAuI;oBACvI,6JAA6J;oBAC7J,oHAAoH;oBACpH,4GAA4G;gBAC9G,MAAM,EAAE,mBAAmB;oBACzB,CAAC,CAAC,SAAS,YAAY,gCAAgC;oBACvD,CAAC,CAAC,0HAA0H;gBAC9H,KAAK,EAAE,mBAAmB;oBACxB,CAAC,CAAC,QAAQ,mBAAmB,CAAC,OAAO,oBAAoB;oBACzD,CAAC,CAAC,sIAAsI;aAC3I;YACD,YAAY,EAAE;gBACZ,WAAW,EACT,wIAAwI;oBACxI,gHAAgH;oBAChH,gKAAgK;oBAChK,iFAAiF;gBACnF,cAAc,EACZ,oCAAoC;oBACpC,iEAAiE;oBACjE,mFAAmF;oBACnF,+EAA+E;gBACjF,eAAe,EAAE;oBACf,qEAAqE;oBACrE,8EAA8E;oBAC9E,4EAA4E;oBAC5E,wEAAwE;oBACxE,yEAAyE;iBAC1E;aACF;SACF,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/src/lib/analyzers/python/security-checks/authentication-flaws.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Python Authentication Logic Flaws Security Checks
+ * OWASP A07:2021 - Identification and Authentication Failures
+ *
+ * Detects broken authentication patterns that allow complete bypass of
+ * authentication systems, account takeover, and privilege escalation.
+ *
+ * Created: 2025-12-18 (Phase 0 - Priority 0 Critical Gap)
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for authentication logic flaws in Python code
+ *
+ * Covers:
+ * - Check #45: Plaintext password comparison (CRITICAL)
+ * - Check #46: Weak token generation (HIGH)
+ * - Check #47: Master password backdoor (HIGH)
+ * - Check #48: Fail-open authorization (CRITICAL)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkAuthenticationFlaws(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=authentication-flaws.d.ts.map

package/dist/src/lib/analyzers/python/security-checks/authentication-flaws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-flaws.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/authentication-flaws.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAiQzB"}

package/dist/src/lib/analyzers/python/security-checks/authentication-flaws.js

@@ -0,0 +1,207 @@
+"use strict";
+/**
+ * Python Authentication Logic Flaws Security Checks
+ * OWASP A07:2021 - Identification and Authentication Failures
+ *
+ * Detects broken authentication patterns that allow complete bypass of
+ * authentication systems, account takeover, and privilege escalation.
+ *
+ * Created: 2025-12-18 (Phase 0 - Priority 0 Critical Gap)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAuthenticationFlaws = checkAuthenticationFlaws;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for authentication logic flaws in Python code
+ *
+ * Covers:
+ * - Check #45: Plaintext password comparison (CRITICAL)
+ * - Check #46: Weak token generation (HIGH)
+ * - Check #47: Master password backdoor (HIGH)
+ * - Check #48: Fail-open authorization (CRITICAL)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkAuthenticationFlaws(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // CRITICAL: Track Python triple-quote comment blocks (""" ... """ or ''' ... ''')
+        const hasTripleQuote = trimmed.includes('"""') || trimmed.includes("'''");
+        if (hasTripleQuote) {
+            if (!inMultiLineComment) {
+                inMultiLineComment = true;
+                const tripleQuoteCount = (trimmed.match(/"""/g) || []).length + (trimmed.match(/'''/g) || []).length;
+                if (tripleQuoteCount >= 2) {
+                    inMultiLineComment = false;
+                }
+                return;
+            }
+            else {
+                inMultiLineComment = false;
+                return;
+            }
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('#')) {
+            return;
+        }
+        // =============================================================================
+        // CHECK #45: Plaintext Password Comparison (CRITICAL)
+        // =============================================================================
+        // Pattern: if password == user.password or if rows[0]['password'] == input_password
+        // Enhancement: Also detect tuple/list index access: user[2] == password
+        // Should use: bcrypt.checkpw() or secrets.compare_digest() with hashed passwords
+        // ENHANCED: Detect password comparison with == operator
+        // Pattern 1: password on both sides (original)
+        const plaintextPasswordMatch = trimmed.match(/(?:if|elif|and|or)\s+.*(?:password|passwd|pwd).*\s*==\s*.*(?:password|passwd|pwd)/i);
+        // Pattern 2: password on one side + tuple/list index on other side (NEW - Fix for Test 2.1)
+        // Matches: user[2] == password, password == user[0], row[1] == pwd, etc.
+        const tupleIndexPasswordMatch = trimmed.match(/(?:if|elif|and|or)\s+.*\w+\[\d+\]\s*==\s*(?:password|passwd|pwd)\b/i) ||
+            trimmed.match(/(?:if|elif|and|or)\s+.*(?:password|passwd|pwd)\b\s*==\s*\w+\[\d+\]/i);
+        // Pattern 3: password on one side + dictionary access on other (NEW)
+        // Matches: user['password'] == password, password == data['pwd'], etc.
+        const dictAccessPasswordMatch = trimmed.match(/(?:if|elif|and|or)\s+.*\w+\[['"]\w*(?:password|passwd|pwd)\w*['"]\]\s*==\s*(?:password|passwd|pwd)\b/i) ||
+            trimmed.match(/(?:if|elif|and|or)\s+.*(?:password|passwd|pwd)\b\s*==\s*\w+\[['"]\w*(?:password|passwd|pwd)\w*['"]\]/i);
+        if (plaintextPasswordMatch || tupleIndexPasswordMatch || dictAccessPasswordMatch) {
+            // Check if bcrypt or argon2 is being used (safe patterns)
+            const hasBcrypt = trimmed.includes('bcrypt.checkpw') ||
+                trimmed.includes('bcrypt.verify') ||
+                trimmed.includes('argon2.verify') ||
+                trimmed.includes('check_password_hash');
+            // Check if secrets.compare_digest is being used
+            const hasSecureCompare = trimmed.includes('secrets.compare_digest') ||
+                trimmed.includes('hmac.compare_digest');
+            if (!hasBcrypt && !hasSecureCompare) {
+                // Look back a few lines to see if there's a database query for password
+                const hasDbQuery = lines.slice(Math.max(0, index - 15), index).some(prevLine => (prevLine.includes('SELECT') || prevLine.includes('WHERE') ||
+                    prevLine.includes('.get(') || prevLine.includes('[') && prevLine.includes('password')) &&
+                    (prevLine.toLowerCase().includes('user') || prevLine.toLowerCase().includes('password')));
+                // ENHANCED: Also check for tuple/list index or dict access patterns (Test 2.1 fix)
+                const hasTupleOrDictAccess = tupleIndexPasswordMatch || dictAccessPasswordMatch ||
+                    trimmed.includes('[') || trimmed.includes('.get(');
+                if (hasDbQuery || hasTupleOrDictAccess) {
+                    vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('plaintext-password-comparison', 'Plaintext password comparison detected - passwords should be hashed', 'Use bcrypt.checkpw() or argon2.verify() to compare hashed passwords', lineNumber, 'Direct password comparison with == indicates passwords are stored in plaintext in the database. This is a critical security flaw. Passwords must be hashed using bcrypt, argon2, or scrypt before storage, and compared using secure comparison functions.', 'if user.password == request.form["password"]:  # Plaintext password stored in DB!', [
+                        'Complete authentication system compromise',
+                        'All user accounts accessible with plaintext passwords',
+                        'Regulatory violations (PCI-DSS 8.2.1, GDPR)',
+                        'Cannot detect password database breaches',
+                        'Passwords exposed to DBAs and backups'
+                    ], 'if rows[0]["password"] == request.form["password"]:\n    login_user(user)', 'import bcrypt\n\n# At registration:\nhashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt())\ndb.execute("INSERT INTO users (password) VALUES (?)", (hashed,))\n\n# At login:\nstored_hash = rows[0]["password"]\nif bcrypt.checkpw(password.encode(), stored_hash):\n    login_user(user)', 'Always hash passwords with bcrypt, argon2, or scrypt before storage. Use bcrypt.checkpw() or argon2.verify() to compare passwords. Never store plaintext passwords.'));
+                }
+            }
+        }
+        // =============================================================================
+        // CHECK #46: Weak Token Generation (HIGH)
+        // =============================================================================
+        // Pattern: token = str(time.time()) or token = random.randint() or base64(timestamp)
+        // Should use: secrets.token_urlsafe() or secrets.token_hex() or uuid.uuid4()
+        const weakTokenPatterns = [
+            /token\w*\s*=\s*str\s*\(\s*time\./i,
+            /token\w*\s*=\s*str\s*\(\s*datetime\./i,
+            /token\w*\s*=\s*base64\.[^(]*\(\s*str\s*\(/i,
+            /token\w*\s*=\s*hashlib\.(md5|sha1)\s*\(/i,
+            /token\w*\s*=.*random\.(randint|random|choice)/i,
+        ];
+        const hasWeakToken = weakTokenPatterns.some(pattern => pattern.test(trimmed));
+        if (hasWeakToken) {
+            // Check if secure token generation is being used
+            const hasSecureToken = trimmed.includes('secrets.token') ||
+                trimmed.includes('uuid.uuid4') ||
+                trimmed.includes('os.urandom');
+            if (!hasSecureToken) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('weak-token-generation', 'Weak token generation using predictable source', 'Use secrets.token_urlsafe() or secrets.token_hex() for cryptographic tokens', lineNumber, 'Tokens generated from timestamps, random.random(), or hashes of predictable data are completely predictable. Attackers can forge valid tokens for any user, bypassing authentication entirely.', 'token = str(time.time())  # Predictable: anyone can generate valid tokens', [
+                    'Complete authentication bypass',
+                    'Account takeover for any user',
+                    'Session hijacking',
+                    'Privilege escalation',
+                    'Cannot revoke compromised tokens'
+                ], 'import time\ntoken = base64.b64encode(str(time.time()).encode()).decode()', 'import secrets\n\n# Generate cryptographically secure token\ntoken = secrets.token_urlsafe(32)  # 32 bytes = 256 bits of randomness\n\n# Or for hex tokens:\n# token = secrets.token_hex(32)', 'Use secrets.token_urlsafe() or secrets.token_hex() from Python\'s secrets module for authentication tokens. Never use time.time(), random module, or predictable data.'));
+            }
+        }
+        // =============================================================================
+        // CHECK #47: Master Password Backdoor (HIGH)
+        // =============================================================================
+        // Pattern: if password == user_password or password == MASTER_KEY
+        // Allows single password to access any account
+        // Check for pattern: password comparison + or/and + password comparison with master indicator
+        // Simpler approach: check if line has all three components
+        const hasPasswordComparison = /(password|passwd|pwd)\s*==/i.test(trimmed);
+        const hasLogicalOperator = /\s+(or|and|\|\|)\s+/i.test(trimmed);
+        const hasMasterPasswordIndicator = /(os\.environ|MASTER[_\s]*(?:PASSWORD|KEY|PASS)|SUPPORT[_\s]*(?:PASSWORD|KEY)|ADMIN[_\s]*(?:PASSWORD|KEY|OVERRIDE)|BACKDOOR|DEBUG[_\s]*(?:PASSWORD|KEY))/i.test(trimmed);
+        // Also check for two password comparisons (not just one)
+        const passwordComparisons = trimmed.match(/(password|passwd|pwd)\s*==/gi);
+        const hasTwoPasswordComparisons = passwordComparisons && passwordComparisons.length >= 2;
+        if (hasPasswordComparison && hasLogicalOperator && hasMasterPasswordIndicator && hasTwoPasswordComparisons) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('master-password-backdoor', 'Master password backdoor detected', 'Remove master password bypass - use proper admin authentication', lineNumber, 'Master password backdoors allow a single password to access any user account, completely bypassing normal authentication. This violates the principle of least privilege and creates a massive security risk if the master password is discovered.', 'if password == user.password or password == os.environ["SUPPORT_PASSWORD"]:', [
+                'Complete authentication bypass',
+                'Unauthorized access to all accounts',
+                'Insider threat amplification',
+                'Compliance violations',
+                'Cannot audit which admin accessed which account'
+            ], 'if password == user.password or password == os.environ.get("MASTER_KEY"):\n    login_user(user)', '# Remove master password entirely\nif bcrypt.checkpw(password.encode(), user.password_hash):\n    login_user(user)\n\n# For admin access, use separate admin authentication:\nif user.is_admin and bcrypt.checkpw(password.encode(), user.password_hash):\n    grant_admin_access(user)', 'Never use master passwords. Implement proper role-based access control (RBAC) with separate admin accounts and audit logging.'));
+        }
+        // =============================================================================
+        // CHECK #48: Fail-Open Authorization (CRITICAL)
+        // =============================================================================
+        // Pattern: if authorized: return data; else: return data (same data in both branches)
+        // Authorization check is ineffective
+        // Look for authorization patterns where both branches return same data
+        if (trimmed.match(/if\s+(is_authorized|authorized|has_permission|check_auth|is_admin)/i)) {
+            // Check next few lines for both if and else branches
+            const nextLines = lines.slice(index + 1, Math.min(index + 10, lines.length));
+            let ifBranchReturn = null;
+            let elseBranchReturn = null;
+            let inElse = false;
+            for (let i = 0; i < nextLines.length; i++) {
+                const nextLine = nextLines[i].trim();
+                if (nextLine.startsWith('else:') || nextLine.startsWith('else ')) {
+                    inElse = true;
+                    continue;
+                }
+                // Check for return statements
+                const returnMatch = nextLine.match(/return\s+(.+)/);
+                if (returnMatch) {
+                    const returnValue = returnMatch[1].trim();
+                    if (!inElse && !ifBranchReturn) {
+                        ifBranchReturn = returnValue;
+                    }
+                    else if (inElse && !elseBranchReturn) {
+                        elseBranchReturn = returnValue;
+                    }
+                }
+                // Check for response.send/jsonify statements
+                const responseMatch = nextLine.match(/(?:return\s+)?(?:jsonify|response|res\.send|res\.json)\s*\((.+)\)/);
+                if (responseMatch) {
+                    const responseValue = responseMatch[1].trim();
+                    if (!inElse && !ifBranchReturn) {
+                        ifBranchReturn = responseValue;
+                    }
+                    else if (inElse && !elseBranchReturn) {
+                        elseBranchReturn = responseValue;
+                    }
+                }
+                // If we found both branches, check if they're the same
+                if (ifBranchReturn && elseBranchReturn) {
+                    // Check if return values are identical (exact match only)
+                    // Don't use .includes() to avoid false positives like "full_data" vs "public_data"
+                    if (ifBranchReturn === elseBranchReturn) {
+                        vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('fail-open-authorization', 'Fail-open authorization: both authorized and unauthorized paths return same data', 'Fix authorization logic to deny access when not authorized', lineNumber, 'Authorization check is ineffective because both the authorized and unauthorized code paths return the same data. This makes the authorization check completely useless - all users get access regardless of authorization.', 'if is_authorized:\n    return user_data\nelse:\n    return user_data  # Same data!', [
+                            'Complete access control bypass',
+                            'Unauthorized admin panel access',
+                            'Privilege escalation',
+                            'Data breach (all users access admin data)',
+                            'Compliance violations'
+                        ], 'if is_authorized:\n    return jsonify(user_data)\nelse:\n    return jsonify(user_data)  # Authorization is ineffective!', 'if is_authorized:\n    return jsonify(user_data)\nelse:\n    return jsonify({"error": "Unauthorized"}), 403  # Deny access', 'Ensure authorization checks actually prevent access. Unauthorized paths should return 403 Forbidden, not the same data as authorized paths.'));
+                    }
+                    break;
+                }
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=authentication-flaws.js.map

package/dist/src/lib/analyzers/python/security-checks/authentication-flaws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-flaws.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/authentication-flaws.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAiBH,4DAmQC;AAjRD,sEAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,SAAgB,wBAAwB,CACtC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,kFAAkF;QAClF,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACrG,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO;YACT,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO;YACT,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,gFAAgF;QAChF,sDAAsD;QACtD,gFAAgF;QAChF,oFAAoF;QACpF,wEAAwE;QACxE,iFAAiF;QAEjF,wDAAwD;QACxD,+CAA+C;QAC/C,MAAM,sBAAsB,GAAG,OAAO,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;QAEnI,4FAA4F;QAC5F,yEAAyE;QACzE,MAAM,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC;YACnF,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAEtH,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,uGAAuG,CAAC;YACrH,OAAO,CAAC,KAAK,CAAC,uGAAuG,CAAC,CAAC;QAExJ,IAAI,sBAAsB,IAAI,uBAAuB,IAAI,uBAAuB,EAAE,CAAC;YACjF,0DAA0D;YAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YAEzD,gDAAgD;YAChD,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;gBAC1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YAEjE,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACpC,wEAAwE;gBACxE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAC7E,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACzD,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;oBACvF,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CACzF,CAAC;gBAEF,mFAAmF;gBACnF,MAAM,oBAAoB,GAAG,uBAAuB,IAAI,uBAAuB;oBACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAEjF,IAAI,UAAU,IAAI,oBAAoB,EAAE,CAAC;oBACvC,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,+BAA+B,EAC/B,qEAAqE,EACrE,qEAAqE,EACrE,UAAU,EACV,4PAA4P,EAC5P,mFAAmF,EACnF;wBACE,2CAA2C;wBAC3C,uDAAuD;wBACvD,6CAA6C;wBAC7C,0CAA0C;wBAC1C,uCAAuC;qBACxC,EACD,2EAA2E,EAC3E,gSAAgS,EAChS,qKAAqK,CACtK,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,0CAA0C;QAC1C,gFAAgF;QAChF,qFAAqF;QACrF,6EAA6E;QAE7E,MAAM,iBAAiB,GAAG;YACxB,mCAAmC;YACnC,uCAAuC;YACvC,4CAA4C;YAC5C,0CAA0C;YAC1C,gDAAgD;SACjD,CAAC;QAEF,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAE9E,IAAI,YAAY,EAAE,CAAC;YACjB,iDAAiD;YACjD,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAErD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,uBAAuB,EACvB,gDAAgD,EAChD,6EAA6E,EAC7E,UAAU,EACV,gMAAgM,EAChM,2EAA2E,EAC3E;oBACE,gCAAgC;oBAChC,+BAA+B;oBAC/B,mBAAmB;oBACnB,sBAAsB;oBACtB,kCAAkC;iBACnC,EACD,2EAA2E,EAC3E,8LAA8L,EAC9L,wKAAwK,CACzK,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,6CAA6C;QAC7C,gFAAgF;QAChF,kEAAkE;QAClE,+CAA+C;QAE/C,8FAA8F;QAC9F,2DAA2D;QAC3D,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1E,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,0BAA0B,GAAG,0JAA0J,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE5M,yDAAyD;QACzD,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC1E,MAAM,yBAAyB,GAAG,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,IAAI,CAAC,CAAC;QAEzF,IAAI,qBAAqB,IAAI,kBAAkB,IAAI,0BAA0B,IAAI,yBAAyB,EAAE,CAAC;YAC3G,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,0BAA0B,EAC1B,mCAAmC,EACnC,iEAAiE,EACjE,UAAU,EACV,oPAAoP,EACpP,6EAA6E,EAC7E;gBACE,gCAAgC;gBAChC,qCAAqC;gBACrC,8BAA8B;gBAC9B,uBAAuB;gBACvB,iDAAiD;aAClD,EACD,iGAAiG,EACjG,yRAAyR,EACzR,+HAA+H,CAChI,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,gDAAgD;QAChD,gFAAgF;QAChF,sFAAsF;QACtF,qCAAqC;QAErC,uEAAuE;QACvE,IAAI,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,EAAE,CAAC;YACzF,qDAAqD;YACrD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAE7E,IAAI,cAAc,GAAkB,IAAI,CAAC;YACzC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;YAC3C,IAAI,MAAM,GAAG,KAAK,CAAC;YAEnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAErC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjE,MAAM,GAAG,IAAI,CAAC;oBACd,SAAS;gBACX,CAAC;gBAED,8BAA8B;gBAC9B,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBACpD,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAE1C,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;wBAC/B,cAAc,GAAG,WAAW,CAAC;oBAC/B,CAAC;yBAAM,IAAI,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBACvC,gBAAgB,GAAG,WAAW,CAAC;oBACjC,CAAC;gBACH,CAAC;gBAED,6CAA6C;gBAC7C,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;gBAC1G,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAE9C,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;wBAC/B,cAAc,GAAG,aAAa,CAAC;oBACjC,CAAC;yBAAM,IAAI,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBACvC,gBAAgB,GAAG,aAAa,CAAC;oBACnC,CAAC;gBACH,CAAC;gBAED,uDAAuD;gBACvD,IAAI,cAAc,IAAI,gBAAgB,EAAE,CAAC;oBACvC,0DAA0D;oBAC1D,mFAAmF;oBACnF,IAAI,cAAc,KAAK,gBAAgB,EAAE,CAAC;wBAExC,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,yBAAyB,EACzB,kFAAkF,EAClF,4DAA4D,EAC5D,UAAU,EACV,4NAA4N,EAC5N,oFAAoF,EACpF;4BACE,gCAAgC;4BAChC,iCAAiC;4BACjC,sBAAsB;4BACtB,2CAA2C;4BAC3C,uBAAuB;yBACxB,EACD,yHAAyH,EACzH,4HAA4H,EAC5H,6IAA6I,CAC9I,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/python/security-checks/code-quality.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Python Code Quality and Security Misconfiguration Checks
+ * OWASP A05:2021 - Security Misconfiguration, A06:2021 - Vulnerable Components
+ *
+ * Detects code quality issues that can lead to security vulnerabilities,
+ * including dangerous patterns, insecure practices, and configuration problems.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for code quality and misconfiguration issues
+ *
+ * Covers:
+ * - Check #13: assert for security validation (MEDIUM)
+ * - Check #14: input() without validation (MEDIUM)
+ * - Check #15: Regex DoS (ReDoS) (MEDIUM)
+ * - Check #16: Empty except blocks (LOW)
+ * - Check #17: print() in production (LOW)
+ * - Check #18: tempfile.mktemp() race condition (MEDIUM)
+ * - Check #19: __import__() dynamic loading (HIGH)
+ * - Check #20: Wildcard imports (MEDIUM)
+ * - Check #21: Circular import patterns (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkCodeQuality(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=code-quality.d.ts.map

package/dist/src/lib/analyzers/python/security-checks/code-quality.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-quality.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/code-quality.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAySzB"}