codeslick-cli 1.0.0

package/dist/src/lib/analyzers/python/security-checks/code-quality.js

@@ -0,0 +1,206 @@
+"use strict";
+/**
+ * Python Code Quality and Security Misconfiguration Checks
+ * OWASP A05:2021 - Security Misconfiguration, A06:2021 - Vulnerable Components
+ *
+ * Detects code quality issues that can lead to security vulnerabilities,
+ * including dangerous patterns, insecure practices, and configuration problems.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCodeQuality = checkCodeQuality;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for code quality and misconfiguration issues
+ *
+ * Covers:
+ * - Check #13: assert for security validation (MEDIUM)
+ * - Check #14: input() without validation (MEDIUM)
+ * - Check #15: Regex DoS (ReDoS) (MEDIUM)
+ * - Check #16: Empty except blocks (LOW)
+ * - Check #17: print() in production (LOW)
+ * - Check #18: tempfile.mktemp() race condition (MEDIUM)
+ * - Check #19: __import__() dynamic loading (HIGH)
+ * - Check #20: Wildcard imports (MEDIUM)
+ * - Check #21: Circular import patterns (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkCodeQuality(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // CRITICAL: Track Python triple-quote comment blocks (""" ... """ or ''' ... ''')
+        const hasTripleQuote = trimmed.includes('"""') || trimmed.includes("'''");
+        if (hasTripleQuote) {
+            if (!inMultiLineComment) {
+                // Start of multi-line comment
+                inMultiLineComment = true;
+                // Check if it closes on the same line (single-line docstring)
+                const tripleQuoteCount = (trimmed.match(/"""/g) || []).length + (trimmed.match(/'''/g) || []).length;
+                if (tripleQuoteCount >= 2) {
+                    // Opens and closes on same line, reset flag
+                    inMultiLineComment = false;
+                }
+                return; // Skip this line
+            }
+            else {
+                // End of multi-line comment
+                inMultiLineComment = false;
+                return; // Skip this line
+            }
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmed ||
+            inMultiLineComment ||
+            trimmed.startsWith('#')) {
+            return;
+        }
+        // 13. assert for security validation - MEDIUM
+        if (trimmed.startsWith('assert ') && trimmed.match(/password|token|auth|admin|secret/i)) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('assert-security', 'assert statements are removed in optimized Python (-O flag)', 'Use explicit if/raise for security checks', lineNumber, 'assert statements are removed when Python runs with -O (optimize) flag, bypassing security checks entirely in production.', 'assert user.is_admin  # Bypassed with python -O, allowing unauthorized access', [
+                'Security checks bypassed in production',
+                'Authentication bypass',
+                'Authorization bypass',
+                'Privilege escalation'
+            ], 'assert user.is_admin, "Unauthorized"', 'if not user.is_admin:\n    raise SecurityError("Unauthorized access")', 'Never use assert for security validations. Use explicit if/raise statements that cannot be optimized away'));
+        }
+        // 14. input() without validation - MEDIUM
+        if (trimmed.includes('input(') && !trimmed.includes('int(') && !trimmed.includes('float(')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('input-no-validation', 'input() without validation can accept malicious data', 'Validate and sanitize all user input with type conversion or regex', lineNumber, 'Python\'s input() accepts any string, which can be manipulated to cause issues if not validated (especially in scripts with system access).', 'filename = input("Enter filename: ")  # User enters "../../etc/passwd"', [
+                'Path traversal via user input',
+                'SQL injection in composed queries',
+                'Command injection if passed to shell',
+                'Denial of Service with large inputs'
+            ], 'user_age = input("Enter age: ")', 'user_input = input("Enter age: ")\ntry:\n    user_age = int(user_input)\n    if not 0 <= user_age <= 150:\n        raise ValueError("Invalid age")\nexcept ValueError:\n    print("Invalid input")', 'Always validate and convert user input. Use int()/float() for numbers, regex for strings, and whitelist validation'));
+        }
+        // 15. Regex DoS (ReDoS) - MEDIUM
+        if (trimmed.match(/re\.(compile|match|search|findall)\s*\(/)) {
+            const hasNestedQuantifiers = trimmed.match(/\([^)]*\+[^)]*\)\+|\([^)]*\*[^)]*\)\+|\([^)]*\+[^)]*\)\*/);
+            if (hasNestedQuantifiers) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('regex-dos', 'Regular expression with nested quantifiers can cause ReDoS', 'Simplify regex pattern or implement timeout protection', lineNumber, 'Regular expressions with nested quantifiers have exponential time complexity, allowing attackers to cause Denial of Service with crafted input.', 'pattern = re.compile(r"(a+)+$"); pattern.match("a" * 50 + "!")  # Takes exponential time', [
+                    'Denial of Service (DoS)',
+                    'Application freeze/timeout',
+                    'CPU exhaustion',
+                    'Service unavailability'
+                ], 'pattern = re.compile(r"(a+)+$")  # Nested quantifiers', 'pattern = re.compile(r"a+$")  # Simplified, linear time\n# Or use timeout with third-party library', 'Avoid nested quantifiers in regex. Simplify patterns or use libraries with timeout protection'));
+            }
+        }
+        // 16. try/except empty (swallow errors) - LOW
+        if (trimmed === 'except:' || trimmed.match(/except\s+\w*Error:\s*pass/)) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('empty-except', 'Empty except blocks hide errors and make debugging impossible', 'Log exceptions or handle them specifically', lineNumber, 'Empty except blocks silently swallow all errors, including security-relevant exceptions, making it impossible to detect attacks or bugs.', 'try:\n    risky_operation()\nexcept:\n    pass  # Silently hides all errors including security violations', [
+                'Security errors hidden',
+                'Impossible to debug',
+                'Attacks go unnoticed',
+                'Data corruption undetected'
+            ], 'try:\n    risky_operation()\nexcept:\n    pass', 'import logging\nlogger = logging.getLogger(__name__)\ntry:\n    risky_operation()\nexcept ValueError as e:\n    logger.error(f"Operation failed: {e}")\n    raise', 'Always log exceptions or handle them specifically. Never use bare except: pass which hides all errors'));
+        }
+        // 17. print() in production - LOW
+        // Only flag print statements with variables (f-strings, format(), concatenation)
+        // Don't flag static strings like print("File loaded")
+        if (trimmed.startsWith('print(')) {
+            // Skip simple static strings: print("text") or print('text')
+            const isSimpleStaticString = /^print\(["'][^"']*["']\)/.test(trimmed);
+            if (!isSimpleStaticString) {
+                const hasPotentialData = trimmed.includes('f"') || trimmed.includes("f'") || // f-strings
+                    trimmed.includes('.format(') || // .format()
+                    /print\([^"']*[a-zA-Z_][a-zA-Z0-9_]*/.test(trimmed) || // variables: print(user_name)
+                    /print\(.*\+.*\)/.test(trimmed); // concatenation: print("User: " + name)
+                if (hasPotentialData) {
+                    vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('print-statement', 'print() can leak sensitive information', 'Use logging module with appropriate levels', lineNumber, 'print() statements can expose sensitive data in logs, stack traces, or console output accessible to unauthorized users.', 'print(f"User logged in: {user.email}, token: {auth_token}")  # Exposes credentials', [
+                        'Sensitive data exposure in logs',
+                        'Credentials leaked',
+                        'Internal state revealed',
+                        'Debugging info in production'
+                    ], 'print(f"User: {user.email}, Token: {token}")', 'import logging\nlogger = logging.getLogger(__name__)\nlogger.info(f"User logged in: {user.email}")  # No sensitive data', 'Use logging module with appropriate levels. Never log sensitive data (tokens, passwords, keys)'));
+                }
+            }
+        }
+        // 18. tempfile.mktemp() - MEDIUM (race condition vulnerability)
+        if (trimmed.includes('tempfile.mktemp(')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('insecure-temp-file', 'tempfile.mktemp() creates insecure temporary files', 'Use tempfile.NamedTemporaryFile() or tempfile.mkstemp() instead', lineNumber, 'tempfile.mktemp() is deprecated and insecure because it creates a race condition between file name generation and file creation, allowing attackers to create malicious files.', 'temp = tempfile.mktemp(); open(temp, "w")  # Attacker can create this file first', [
+                'Race condition attacks',
+                'File content manipulation',
+                'Symlink attacks',
+                'Privilege escalation'
+            ], 'import tempfile\ntemp = tempfile.mktemp()\nwith open(temp, "w") as f:\n    f.write(data)', 'import tempfile\nwith tempfile.NamedTemporaryFile(mode="w", delete=False) as f:\n    f.write(data)\n    temp_name = f.name\n# Or use mkstemp(): fd, temp_name = tempfile.mkstemp()', 'Use tempfile.NamedTemporaryFile() or tempfile.mkstemp() which create files atomically without race conditions'));
+        }
+        // 19. __import__() - HIGH (dynamic module loading)
+        if (trimmed.includes('__import__(')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('dynamic-import', '__import__() allows arbitrary module loading', 'Use importlib.import_module() with strict validation or a whitelist', lineNumber, '__import__() with user-controlled input allows attackers to load arbitrary Python modules, potentially executing malicious code or accessing sensitive functionality.', '__import__(user_module)  where user_module = "os" allows os.system() access', [
+                'Arbitrary code execution',
+                'Access to dangerous modules (os, subprocess)',
+                'Security control bypass',
+                'Data exfiltration'
+            ], 'module = __import__(module_name)', 'import importlib\nALLOWED_MODULES = ["json", "math", "datetime"]\nif module_name not in ALLOWED_MODULES:\n    raise ValueError("Module not allowed")\nmodule = importlib.import_module(module_name)', 'Never use __import__() with untrusted input. Use importlib.import_module() with strict whitelist validation'));
+        }
+        // OWASP A05:2021 - Security Misconfiguration
+        // 20. Wildcard Imports - MEDIUM (namespace pollution)
+        if (trimmed.match(/^from\s+[\w.]+\s+import\s+\*/)) {
+            // Extract module name for better reporting
+            const moduleMatch = trimmed.match(/from\s+([\w.]+)\s+import\s+\*/);
+            const moduleName = moduleMatch ? moduleMatch[1] : 'module';
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('wildcard-import', `Wildcard import (from ${moduleName} import *) pollutes namespace`, 'Import specific names: from module import name1, name2', lineNumber, 'Wildcard imports pollute the namespace with all exported names from a module, making code harder to debug, causing name conflicts, and making it unclear where functions come from.', `from django.contrib.auth.models import *  # Imports 60+ names, conflicts possible`, [
+                'Namespace pollution',
+                'Name conflicts and shadowing',
+                'Debugging difficulty',
+                'Unclear dependencies',
+                'Potential security issues from unintended imports'
+            ], `from ${moduleName} import *`, `from ${moduleName} import ClassName, function_name  # Explicit imports only\n# Or: import ${moduleName}; ${moduleName}.ClassName()`, 'Always import specific names explicitly. Wildcard imports make code unpredictable and harder to maintain'));
+        }
+        // 21. Circular Import Patterns - MEDIUM (runtime errors)
+        // Basic detection: Look for common circular import patterns in file
+        if (trimmed.match(/^from\s+[\w.]+\s+import/)) {
+            const importMatch = trimmed.match(/from\s+([\w.]+)\s+import/);
+            if (importMatch) {
+                const importedModule = importMatch[1];
+                // CRITICAL FIX (2025-11-21): Exclude Django/Flask framework imports
+                // False positive: django.views.decorators.csrf is NOT circular with .models
+                // Only check user modules (relative imports starting with . or same package)
+                const isFrameworkImport = importedModule.startsWith('django.') ||
+                    importedModule.startsWith('flask.') ||
+                    importedModule.startsWith('fastapi.') ||
+                    !importedModule.startsWith('.'); // Absolute imports are usually framework/stdlib
+                if (isFrameworkImport) {
+                    // Skip framework imports - they don't create circular dependencies
+                    return;
+                }
+                // Check for common circular import patterns (only user modules)
+                // Pattern 1: from .views import X in a models file
+                // Pattern 2: from .models import X in a views file
+                const commonPatterns = [
+                    { imports: 'views', suggests: 'models', description: 'models importing views' },
+                    { imports: 'models', suggests: 'views', description: 'views importing models' },
+                    { imports: 'serializers', suggests: 'models', description: 'models importing serializers' },
+                    { imports: 'models', suggests: 'serializers', description: 'serializers importing models' }
+                ];
+                // Check if this line has potential circular import
+                commonPatterns.forEach(pattern => {
+                    if (importedModule.includes(pattern.imports)) {
+                        // Look for reciprocal imports in the same file
+                        const hasReciprocalImport = lines.some((otherLine, otherIndex) => {
+                            if (otherIndex === index)
+                                return false;
+                            const otherTrimmed = otherLine.trim();
+                            // Only check relative imports (starting with .)
+                            return otherTrimmed.match(new RegExp(`from\\s+\\.[\\w.]*${pattern.suggests}[\\w.]*\\s+import`));
+                        });
+                        if (hasReciprocalImport) {
+                            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('circular-import', `Potential circular import detected: ${pattern.description}`, 'Refactor: move shared code to a separate module or use lazy imports', lineNumber, 'Circular imports occur when two modules import each other, causing ImportError at runtime. This happens when module A imports B and B imports A, creating a dependency cycle.', `# models.py: from .views import UserView\\n# views.py: from .models import User  # ImportError!`, [
+                                'ImportError at runtime',
+                                'Application crashes',
+                                'Unpredictable behavior',
+                                'Initialization order issues',
+                                'Difficult to debug'
+                            ], `from ${importedModule} import ClassName  # Circular dependency`, `# Option 1: Move shared code to utils.py\n# Option 2: Use lazy imports inside functions\ndef get_user():\n    from ${importedModule} import ClassName\n    return ClassName()\n# Option 3: Use TYPE_CHECKING for type hints only\nfrom typing import TYPE_CHECKING\nif TYPE_CHECKING:\n    from ${importedModule} import ClassName`, 'Avoid circular imports by refactoring shared code into separate modules or using lazy imports inside functions'));
+                        }
+                    }
+                });
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=code-quality.js.map

package/dist/src/lib/analyzers/python/security-checks/code-quality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-quality.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/code-quality.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAsBH,4CA2SC;AA9TD,sEAAiF;AAEjF;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,gBAAgB,CAC9B,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,kFAAkF;QAClF,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,8BAA8B;gBAC9B,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,8DAA8D;gBAC9D,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACrG,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,4CAA4C;oBAC5C,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO,CAAC,iBAAiB;YAC3B,CAAC;iBAAM,CAAC;gBACN,4BAA4B;gBAC5B,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO,CAAC,iBAAiB;YAC3B,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,OAAO;YACR,kBAAkB;YAClB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,EAAE,CAAC;YACxF,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,iBAAiB,EACjB,6DAA6D,EAC7D,2CAA2C,EAC3C,UAAU,EACV,2HAA2H,EAC3H,+EAA+E,EAC/E;gBACE,wCAAwC;gBACxC,uBAAuB;gBACvB,sBAAsB;gBACtB,sBAAsB;aACvB,EACD,sCAAsC,EACtC,uEAAuE,EACvE,2GAA2G,CAC5G,CAAC,CAAC;QACL,CAAC;QAED,0CAA0C;QAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3F,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,qBAAqB,EACrB,sDAAsD,EACtD,oEAAoE,EACpE,UAAU,EACV,6IAA6I,EAC7I,wEAAwE,EACxE;gBACE,+BAA+B;gBAC/B,mCAAmC;gBACnC,sCAAsC;gBACtC,qCAAqC;aACtC,EACD,iCAAiC,EACjC,oMAAoM,EACpM,oHAAoH,CACrH,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,EAAE,CAAC;YAC7D,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;YACvG,IAAI,oBAAoB,EAAE,CAAC;gBACzB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,WAAW,EACX,4DAA4D,EAC5D,wDAAwD,EACxD,UAAU,EACV,iJAAiJ,EACjJ,0FAA0F,EAC1F;oBACE,yBAAyB;oBACzB,4BAA4B;oBAC5B,gBAAgB;oBAChB,wBAAwB;iBACzB,EACD,uDAAuD,EACvD,oGAAoG,EACpG,+FAA+F,CAChG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACxE,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,cAAc,EACd,+DAA+D,EAC/D,4CAA4C,EAC5C,UAAU,EACV,0IAA0I,EAC1I,2GAA2G,EAC3G;gBACE,wBAAwB;gBACxB,qBAAqB;gBACrB,sBAAsB;gBACtB,4BAA4B;aAC7B,EACD,gDAAgD,EAChD,mKAAmK,EACnK,uGAAuG,CACxG,CAAC,CAAC;QACL,CAAC;QAED,kCAAkC;QAClC,iFAAiF;QACjF,sDAAsD;QACtD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,6DAA6D;YAC7D,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtE,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,MAAM,gBAAgB,GACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAK,YAAY;oBACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAA0B,YAAY;oBAClE,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAK,8BAA8B;oBACtF,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAsB,wCAAwC;gBAEhG,IAAI,gBAAgB,EAAE,CAAC;oBACvB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,iBAAiB,EACjB,wCAAwC,EACxC,4CAA4C,EAC5C,UAAU,EACV,yHAAyH,EACzH,oFAAoF,EACpF;wBACE,iCAAiC;wBACjC,oBAAoB;wBACpB,yBAAyB;wBACzB,8BAA8B;qBAC/B,EACD,8CAA8C,EAC9C,yHAAyH,EACzH,gGAAgG,CACjG,CAAC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,oBAAoB,EACpB,oDAAoD,EACpD,iEAAiE,EACjE,UAAU,EACV,gLAAgL,EAChL,kFAAkF,EAClF;gBACE,wBAAwB;gBACxB,2BAA2B;gBAC3B,iBAAiB;gBACjB,sBAAsB;aACvB,EACD,0FAA0F,EAC1F,oLAAoL,EACpL,+GAA+G,CAChH,CAAC,CAAC;QACL,CAAC;QAED,mDAAmD;QACnD,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,gBAAgB,EAChB,8CAA8C,EAC9C,qEAAqE,EACrE,UAAU,EACV,uKAAuK,EACvK,6EAA6E,EAC7E;gBACE,0BAA0B;gBAC1B,8CAA8C;gBAC9C,yBAAyB;gBACzB,mBAAmB;aACpB,EACD,kCAAkC,EAClC,qMAAqM,EACrM,6GAA6G,CAC9G,CAAC,CAAC;QACL,CAAC;QAED,6CAA6C;QAC7C,sDAAsD;QACtD,IAAI,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE,CAAC;YAClD,2CAA2C;YAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnE,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAE3D,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,iBAAiB,EACjB,yBAAyB,UAAU,+BAA+B,EAClE,wDAAwD,EACxD,UAAU,EACV,qLAAqL,EACrL,mFAAmF,EACnF;gBACE,qBAAqB;gBACrB,8BAA8B;gBAC9B,sBAAsB;gBACtB,sBAAsB;gBACtB,mDAAmD;aACpD,EACD,QAAQ,UAAU,WAAW,EAC7B,QAAQ,UAAU,2EAA2E,UAAU,KAAK,UAAU,cAAc,EACpI,0GAA0G,CAC3G,CAAC,CAAC;QACL,CAAC;QAED,yDAAyD;QACzD,oEAAoE;QACpE,IAAI,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAEtC,oEAAoE;gBACpE,4EAA4E;gBAC5E,6EAA6E;gBAC7E,MAAM,iBAAiB,GACrB,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;oBACpC,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC;oBACnC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC;oBACrC,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAE,gDAAgD;gBAEpF,IAAI,iBAAiB,EAAE,CAAC;oBACtB,mEAAmE;oBACnE,OAAO;gBACT,CAAC;gBAED,gEAAgE;gBAChE,mDAAmD;gBACnD,mDAAmD;gBACnD,MAAM,cAAc,GAAG;oBACrB,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE;oBAC/E,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE;oBAC/E,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;oBAC3F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,8BAA8B,EAAE;iBAC5F,CAAC;gBAEF,mDAAmD;gBACnD,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC/B,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC7C,+CAA+C;wBAC/C,MAAM,mBAAmB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE;4BAC/D,IAAI,UAAU,KAAK,KAAK;gCAAE,OAAO,KAAK,CAAC;4BACvC,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;4BACtC,gDAAgD;4BAChD,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,qBAAqB,OAAO,CAAC,QAAQ,mBAAmB,CAAC,CAAC,CAAC;wBAClG,CAAC,CAAC,CAAC;wBAEH,IAAI,mBAAmB,EAAE,CAAC;4BACxB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,iBAAiB,EACjB,uCAAuC,OAAO,CAAC,WAAW,EAAE,EAC5D,qEAAqE,EACrE,UAAU,EACV,+KAA+K,EAC/K,iGAAiG,EACjG;gCACE,wBAAwB;gCACxB,qBAAqB;gCACrB,wBAAwB;gCACxB,6BAA6B;gCAC7B,oBAAoB;6BACrB,EACD,QAAQ,cAAc,0CAA0C,EAChE,sHAAsH,cAAc,+JAA+J,cAAc,mBAAmB,EACpU,gHAAgH,CACjH,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/python/security-checks/credentials-crypto.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Python Credentials and Cryptography Security Checks
+ * OWASP A07:2021 - Authentication Failures, A02:2021 - Cryptographic Failures
+ *
+ * Detects hardcoded credentials, weak cryptographic practices, and insecure
+ * random number generation in Python code.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for credential exposure and cryptographic weaknesses
+ *
+ * Covers:
+ * - Check #7: Hardcoded credentials (CRITICAL)
+ *   - Pattern 1: Simple assignment (API_KEY = "...")
+ *   - Pattern 2: Dictionary values ('password': '...')
+ *   - Pattern 3: Flask secret_key (app.secret_key = '...')
+ * - Check #8a: random module for security (MEDIUM) - Weak RNG
+ * - Check #8b: MD5/SHA1 for password hashing (HIGH) - Broken crypto
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkCredentialsAndCrypto(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=credentials-crypto.d.ts.map

package/dist/src/lib/analyzers/python/security-checks/credentials-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-crypto.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/credentials-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAsJzB"}

package/dist/src/lib/analyzers/python/security-checks/credentials-crypto.js

@@ -0,0 +1,113 @@
+"use strict";
+/**
+ * Python Credentials and Cryptography Security Checks
+ * OWASP A07:2021 - Authentication Failures, A02:2021 - Cryptographic Failures
+ *
+ * Detects hardcoded credentials, weak cryptographic practices, and insecure
+ * random number generation in Python code.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCredentialsAndCrypto = checkCredentialsAndCrypto;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for credential exposure and cryptographic weaknesses
+ *
+ * Covers:
+ * - Check #7: Hardcoded credentials (CRITICAL)
+ *   - Pattern 1: Simple assignment (API_KEY = "...")
+ *   - Pattern 2: Dictionary values ('password': '...')
+ *   - Pattern 3: Flask secret_key (app.secret_key = '...')
+ * - Check #8a: random module for security (MEDIUM) - Weak RNG
+ * - Check #8b: MD5/SHA1 for password hashing (HIGH) - Broken crypto
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkCredentialsAndCrypto(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // CRITICAL: Track Python triple-quote comment blocks (""" ... """ or ''' ... ''')
+        const hasTripleQuote = trimmed.includes('"""') || trimmed.includes("'''");
+        if (hasTripleQuote) {
+            if (!inMultiLineComment) {
+                inMultiLineComment = true;
+                const tripleQuoteCount = (trimmed.match(/"""/g) || []).length + (trimmed.match(/'''/g) || []).length;
+                if (tripleQuoteCount >= 2) {
+                    inMultiLineComment = false;
+                }
+                return;
+            }
+            else {
+                inMultiLineComment = false;
+                return;
+            }
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('#')) {
+            return;
+        }
+        // OWASP A07:2021 - Authentication & Identification Failures
+        // 7. Hardcoded credentials - CRITICAL
+        // Pattern 1: Simple assignment (API_KEY = "...")
+        if (trimmed.match(/(password|passwd|pwd|secret|token|api[-_]?key|private[-_]?key|auth_token)\s*=\s*['"]/i) &&
+            !trimmed.includes('os.environ') && !trimmed.includes('config.') && !trimmed.includes('getenv')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('hardcoded-credentials', 'Hardcoded credentials exposed in source code', 'Use environment variables with os.getenv() or python-dotenv', lineNumber, 'Hardcoded credentials in source code are visible to anyone with repository access and persist in version control history forever.', 'API_KEY = "sk-1234567890abcdef" # Visible in Git history, cannot be rotated', [
+                'Unauthorized access to systems',
+                'Account takeover',
+                'Data breach',
+                'Cannot rotate without code changes',
+                'Exposed in version control history'
+            ], 'API_KEY = "sk-1234567890abcdef"', 'import os\nAPI_KEY = os.getenv("API_KEY")  # Store in .env file (add to .gitignore)', 'Store secrets in environment variables. Use python-dotenv for local development, AWS Secrets Manager or similar for production'));
+        }
+        // Pattern 2: Dictionary values (FIX #2a) - 'password': '...'
+        if (trimmed.match(/['"](?:password|passwd|pwd|secret|token|api[-_]?key|private[-_]?key|auth_token)['"]\s*:\s*['"]/i) &&
+            !trimmed.includes('os.environ') && !trimmed.includes('os.getenv') && !trimmed.includes('config.')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('hardcoded-credentials', 'Hardcoded credentials in dictionary/config object', 'Use environment variables with os.getenv() or python-dotenv', lineNumber, 'Hardcoded credentials in configuration dictionaries are visible to anyone with repository access and persist in version control history forever.', '"password": "SuperSecret123!" # Visible in Git history, cannot be rotated', [
+                'Unauthorized database/API access',
+                'Account takeover',
+                'Data breach',
+                'Cannot rotate without code changes',
+                'Exposed in version control history'
+            ], 'DATABASE_CONFIG = {"password": "SuperSecret123!"}', 'import os\nDATABASE_CONFIG = {"password": os.getenv("DB_PASSWORD")}  # Store in .env file', 'Store secrets in environment variables. Use python-dotenv for local development, AWS Secrets Manager or similar for production'));
+        }
+        // Pattern 3: Flask secret_key (FIX #2b) - app.secret_key = '...'
+        if (trimmed.match(/\.secret_key\s*=\s*['"][^'"]{8,}['"]/)) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('hardcoded-credentials', 'Hardcoded Flask secret_key exposes session security', 'Use environment variable for Flask secret_key', lineNumber, 'Flask secret_key is used to sign session cookies. A hardcoded secret_key allows attackers to forge session cookies and impersonate any user.', 'app.secret_key = "my-super-secret-flask-key" # Visible in Git, enables session forgery', [
+                'Session cookie forgery',
+                'Authentication bypass',
+                'User impersonation',
+                'Cannot rotate without code changes',
+                'Exposed in version control history'
+            ], 'app.secret_key = "my-super-secret-flask-key"', 'import os\napp.secret_key = os.getenv("FLASK_SECRET_KEY")  # Store in .env file (add to .gitignore)\n# Generate with: python -c "import secrets; print(secrets.token_hex(32))"', 'Always use environment variables for Flask secret_key. Generate a strong random key with secrets.token_hex(32)'));
+        }
+        // OWASP A02:2021 - Cryptographic Failures
+        // 8. random.random() for security - MEDIUM
+        if (trimmed.match(/random\.(random|randint|choice)\(/)) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('weak-random', 'random module is cryptographically weak', 'Use secrets module for security-sensitive operations', lineNumber, 'The random module uses Mersenne Twister which is predictable and unsuitable for security purposes like token or password generation.', 'token = str(random.randint(100000, 999999))  # Predictable, can be brute-forced', [
+                'Predictable tokens/session IDs',
+                'Session hijacking',
+                'Authentication bypass',
+                'Weak password generation'
+            ], 'import random\ntoken = random.randint(100000, 999999)', 'import secrets\ntoken = secrets.token_hex(32)  # Cryptographically secure\n# Or: secrets.randbelow(999999) for integers', 'Use secrets module for all security-sensitive random number generation (tokens, passwords, session IDs)'));
+        }
+        // 8b. MD5/SHA1 for password hashing - HIGH (FIX #4)
+        // Detects: hashlib.md5(password) or hashlib.sha1(password)
+        if (trimmed.match(/hashlib\.(md5|sha1)\s*\(/) &&
+            (trimmed.match(/password|passwd|pwd|credentials?/i) ||
+                trimmed.match(/\.encode\(\)/) ||
+                line.toLowerCase().includes('password'))) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('weak-crypto', 'MD5/SHA1 are cryptographically broken for password hashing', 'Use bcrypt, scrypt, or argon2 for password hashing', lineNumber, 'MD5 and SHA1 are fast cryptographic hashes designed for data integrity, not password storage. Modern GPUs can compute billions of MD5/SHA1 hashes per second, making brute-force attacks trivial. Password hashes need slow, adaptive algorithms.', 'hashlib.md5(password.encode()).hexdigest()  # Can be cracked at 200+ billion hashes/second', [
+                'Password cracking (rainbow tables, brute force)',
+                'Account takeover',
+                'Data breach',
+                'Credential stuffing attacks',
+                'GPU-accelerated attacks'
+            ], 'import hashlib\ndef hash_password(password):\n    return hashlib.md5(password.encode()).hexdigest()', 'import bcrypt\n\ndef hash_password(password):\n    salt = bcrypt.gensalt(rounds=12)  # Adaptive cost factor\n    return bcrypt.hashpw(password.encode(), salt)\n\ndef verify_password(password, hashed):\n    return bcrypt.checkpw(password.encode(), hashed)', 'Use bcrypt, scrypt, or argon2 for password hashing. These algorithms are intentionally slow and resistant to GPU/ASIC attacks'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=credentials-crypto.js.map

package/dist/src/lib/analyzers/python/security-checks/credentials-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-crypto.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/credentials-crypto.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAmBH,8DAwJC;AAxKD,sEAAiF;AAEjF;;;;;;;;;;;;;GAaG;AACH,SAAgB,yBAAyB,CACvC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,kFAAkF;QAClF,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACrG,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO;YACT,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO;YACT,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,sCAAsC;QACtC,iDAAiD;QACjD,IAAI,OAAO,CAAC,KAAK,CAAC,uFAAuF,CAAC;YACtG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnG,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,uBAAuB,EACvB,8CAA8C,EAC9C,6DAA6D,EAC7D,UAAU,EACV,mIAAmI,EACnI,6EAA6E,EAC7E;gBACE,gCAAgC;gBAChC,kBAAkB;gBAClB,aAAa;gBACb,oCAAoC;gBACpC,oCAAoC;aACrC,EACD,iCAAiC,EACjC,qFAAqF,EACrF,gIAAgI,CACjI,CAAC,CAAC;QACL,CAAC;QAED,6DAA6D;QAC7D,IAAI,OAAO,CAAC,KAAK,CAAC,iGAAiG,CAAC;YAChH,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACtG,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,uBAAuB,EACvB,mDAAmD,EACnD,6DAA6D,EAC7D,UAAU,EACV,kJAAkJ,EAClJ,2EAA2E,EAC3E;gBACE,kCAAkC;gBAClC,kBAAkB;gBAClB,aAAa;gBACb,oCAAoC;gBACpC,oCAAoC;aACrC,EACD,mDAAmD,EACnD,2FAA2F,EAC3F,gIAAgI,CACjI,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,IAAI,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,EAAE,CAAC;YAC1D,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,uBAAuB,EACvB,qDAAqD,EACrD,+CAA+C,EAC/C,UAAU,EACV,8IAA8I,EAC9I,wFAAwF,EACxF;gBACE,wBAAwB;gBACxB,uBAAuB;gBACvB,oBAAoB;gBACpB,oCAAoC;gBACpC,oCAAoC;aACrC,EACD,8CAA8C,EAC9C,gLAAgL,EAChL,gHAAgH,CACjH,CAAC,CAAC;QACL,CAAC;QAED,0CAA0C;QAC1C,2CAA2C;QAC3C,IAAI,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,EAAE,CAAC;YACvD,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,aAAa,EACb,yCAAyC,EACzC,sDAAsD,EACtD,UAAU,EACV,sIAAsI,EACtI,iFAAiF,EACjF;gBACE,gCAAgC;gBAChC,mBAAmB;gBACnB,uBAAuB;gBACvB,0BAA0B;aAC3B,EACD,uDAAuD,EACvD,yHAAyH,EACzH,yGAAyG,CAC1G,CAAC,CAAC;QACL,CAAC;QAED,oDAAoD;QACpD,2DAA2D;QAC3D,IAAI,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC;YACzC,CAAC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC;gBAClD,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC7B,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC9C,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,aAAa,EACb,4DAA4D,EAC5D,oDAAoD,EACpD,UAAU,EACV,mPAAmP,EACnP,4FAA4F,EAC5F;gBACE,iDAAiD;gBACjD,kBAAkB;gBAClB,aAAa;gBACb,6BAA6B;gBAC7B,yBAAyB;aAC1B,EACD,qGAAqG,EACrG,gQAAgQ,EAChQ,+HAA+H,CAChI,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/python/security-checks/crypto-failures.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Python Cryptographic Failures Security Checks
+ * OWASP A04:2025 - Cryptographic Failures
+ *
+ * Detects cryptographic vulnerabilities that can lead to data exposure.
+ * This category includes weak algorithms and insecure random generation.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for cryptographic security vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #1: Weak cryptographic algorithms (HIGH)
+ * - Check #2: Insecure random number generation (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkCryptoFailures(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=crypto-failures.d.ts.map

package/dist/src/lib/analyzers/python/security-checks/crypto-failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-failures.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/crypto-failures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAmNzB"}

package/dist/src/lib/analyzers/python/security-checks/crypto-failures.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * Python Cryptographic Failures Security Checks
+ * OWASP A04:2025 - Cryptographic Failures
+ *
+ * Detects cryptographic vulnerabilities that can lead to data exposure.
+ * This category includes weak algorithms and insecure random generation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCryptoFailures = checkCryptoFailures;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for cryptographic security vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #1: Weak cryptographic algorithms (HIGH)
+ * - Check #2: Insecure random number generation (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkCryptoFailures(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track Python triple-quote comment blocks (""" ... """ or ''' ... ''')
+        const hasTripleQuote = trimmedLine.includes('"""') || trimmedLine.includes("'''");
+        if (hasTripleQuote) {
+            if (!inMultiLineComment) {
+                // Start of multi-line comment
+                inMultiLineComment = true;
+                // Check if it closes on the same line (single-line docstring)
+                const tripleQuoteCount = (trimmedLine.match(/"""/g) || []).length + (trimmedLine.match(/'''/g) || []).length;
+                if (tripleQuoteCount >= 2) {
+                    // Opens and closes on same line, reset flag
+                    inMultiLineComment = false;
+                }
+                return; // Skip this line
+            }
+            else {
+                // End of multi-line comment
+                inMultiLineComment = false;
+                return; // Skip this line
+            }
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('#')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Check #1: Weak cryptographic algorithms
+        // Detect weak hash algorithms
+        if (lowerLine.includes('hashlib.md5(') ||
+            lowerLine.includes('hashlib.md5 (')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('weak-crypto-algorithm', 'MD5 is a weak cryptographic hash algorithm - vulnerable to collision attacks', 'Use SHA-256, SHA-512, or bcrypt/argon2 for password hashing', index + 1, 'MD5 hash collisions allow attackers to create forged data with the same hash, bypass integrity checks, or crack passwords faster through rainbow tables and GPU attacks', 'import hashlib\npassword_hash = hashlib.md5(password.encode()).hexdigest()  # Easily cracked!', [
+                'Password cracking through precomputed rainbow tables',
+                'Hash collision attacks for data forgery',
+                'Integrity bypass in digital signatures',
+                'Fast brute-force attacks using GPUs'
+            ], 'import hashlib\npassword_hash = hashlib.md5(password.encode()).hexdigest()', 'from argon2 import PasswordHasher\nph = PasswordHasher()\npassword_hash = ph.hash(password)', 'Use bcrypt or argon2 for password hashing. For general hashing, use SHA-256 or SHA-512. MD5 is cryptographically broken and should never be used for security purposes.'));
+        }
+        if (lowerLine.includes('hashlib.sha1(') ||
+            lowerLine.includes('hashlib.sha1 (')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('weak-crypto-algorithm', 'SHA-1 is a weak cryptographic hash algorithm - deprecated due to collision attacks', 'Use SHA-256 or SHA-512 instead', index + 1, 'SHA-1 collision attacks (demonstrated in 2017) allow attackers to create different inputs with identical hashes, breaking digital signatures, certificates, and integrity checks', 'import hashlib\ntoken = hashlib.sha1(data).hexdigest()  # Vulnerable to collision attacks', [
+                'Collision attacks allowing data forgery',
+                'Certificate spoofing and digital signature bypass',
+                'Git commit signature forgery',
+                'PDF and file integrity bypass'
+            ], 'import hashlib\ntoken = hashlib.sha1(data).hexdigest()', 'import hashlib\ntoken = hashlib.sha256(data).hexdigest()', 'SHA-1 was officially deprecated in 2017. Use SHA-256 or SHA-512 for all cryptographic hashing needs.'));
+        }
+        // Detect weak encryption algorithms
+        if ((lowerLine.includes('from crypto.cipher import des') && !lowerLine.includes('des3')) ||
+            lowerLine.includes('cipher = des.')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('weak-crypto-algorithm', 'DES encryption is extremely weak - 56-bit key broken in 1998', 'Use AES-256 or ChaCha20 for encryption', index + 1, 'DES 56-bit keys can be brute-forced in hours using modern hardware, allowing attackers to decrypt all encrypted data', 'from Crypto.Cipher import DES\ncipher = DES.new(key, DES.MODE_ECB)  # Broken in 1998!', [
+                'Complete data decryption through brute-force',
+                'Real-time decryption with specialized hardware',
+                'Historical data exposure if keys are compromised',
+                'Compliance violations (PCI-DSS, HIPAA)'
+            ], 'from Crypto.Cipher import DES\ncipher = DES.new(key, DES.MODE_ECB)', 'from Crypto.Cipher import AES\ncipher = AES.new(key, AES.MODE_GCM)', 'DES is cryptographically broken. Use AES-256 with GCM mode for authenticated encryption.'));
+        }
+        if (lowerLine.includes('from crypto.cipher import des3') ||
+            lowerLine.includes('cipher = des3.')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('weak-crypto-algorithm', '3DES (Triple DES) is deprecated - limited by 64-bit block size', 'Use AES-256 for encryption', index + 1, '3DES suffers from the Sweet32 birthday attack due to 64-bit block size, allowing attackers to recover plaintext after encrypting ~32GB of data', 'from Crypto.Cipher import DES3\ncipher = DES3.new(key, DES3.MODE_CBC, iv)  # Deprecated', [
+                'Sweet32 birthday attack after ~32GB encrypted',
+                'Slower performance than modern algorithms',
+                'Compliance violations (NIST deprecated 3DES)',
+                'Limited security margin'
+            ], 'from Crypto.Cipher import DES3\ncipher = DES3.new(key, DES3.MODE_CBC, iv)', 'from Crypto.Cipher import AES\ncipher = AES.new(key, AES.MODE_GCM)', '3DES was deprecated by NIST in 2017. Use AES-256 for all encryption needs.'));
+        }
+        if (lowerLine.includes('from crypto.cipher import blowfish') ||
+            lowerLine.includes('cipher = blowfish.')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('weak-crypto-algorithm', 'Blowfish encryption is outdated - vulnerable to birthday attacks', 'Use AES-256 or ChaCha20 for encryption', index + 1, 'Blowfish 64-bit block size makes it vulnerable to birthday attacks when encrypting large amounts of data, similar to 3DES', 'from Crypto.Cipher import Blowfish\ncipher = Blowfish.new(key, Blowfish.MODE_CBC)  # Outdated', [
+                'Birthday attacks on 64-bit blocks',
+                'Weak key schedule vulnerabilities',
+                'Not recommended by modern security standards',
+                'Better alternatives available (AES)'
+            ], 'from Crypto.Cipher import Blowfish\ncipher = Blowfish.new(key, Blowfish.MODE_CBC)', 'from Crypto.Cipher import AES\ncipher = AES.new(key, AES.MODE_GCM)', 'Blowfish is superseded by AES. Use AES-256 for modern encryption needs.'));
+        }
+        if (lowerLine.includes('from crypto.cipher import arc4') ||
+            lowerLine.includes('cipher = arc4.') ||
+            lowerLine.includes('from crypto.cipher import rc4')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('weak-crypto-algorithm', 'RC4 stream cipher is completely broken - multiple practical attacks exist', 'Use AES-256-GCM or ChaCha20-Poly1305', index + 1, 'RC4 has multiple biases in its keystream that allow practical attacks to recover plaintext, as demonstrated in attacks against WEP, WPA-TKIP, and TLS', 'from Crypto.Cipher import ARC4\ncipher = ARC4.new(key)  # Completely broken!', [
+                'Keystream bias exploitation (RC4NOMORE)',
+                'Real-time decryption in TLS (Bar-Mitzvah attack)',
+                'WEP/WPA cracking in seconds',
+                'Compliance violations (prohibited by RFC 7465)'
+            ], 'from Crypto.Cipher import ARC4\ncipher = ARC4.new(key)', 'from Crypto.Cipher import AES\ncipher = AES.new(key, AES.MODE_GCM)', 'RC4 is prohibited by RFC 7465. Use AES-GCM or ChaCha20-Poly1305 for stream encryption.'));
+        }
+        // Check #2: Insecure random number generation
+        // Detect insecure random functions used for security purposes
+        if (lowerLine.includes('random.random(') ||
+            lowerLine.includes('random.randint(') ||
+            lowerLine.includes('random.randrange(') ||
+            lowerLine.includes('random.choice(') ||
+            lowerLine.includes('random.shuffle(')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('insecure-random', 'Insecure random number generator used - predictable for security purposes', 'Use secrets module (secrets.token_hex(), secrets.token_urlsafe()) or os.urandom() for cryptographic randomness', index + 1, 'Python\'s random module uses Mersenne Twister which is not cryptographically secure. Attackers can predict future outputs after observing a sequence of values, allowing session hijacking, token forgery, and password prediction', 'import random\ntoken = str(random.random())  # Predictable! Can be guessed', [
+                'Session token prediction and hijacking',
+                'Password/PIN guessing through state recovery',
+                'CSRF token forgery',
+                'API key and authentication bypass'
+            ], 'import random\ntoken = str(random.random())\nsession_id = random.randint(1000, 9999)', 'import secrets\ntoken = secrets.token_hex(32)\nsession_id = secrets.randbelow(9000) + 1000', 'Never use random module for security. Use secrets module for tokens, passwords, and security-critical random values. The secrets module uses os.urandom() which is cryptographically secure.'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=crypto-failures.js.map

package/dist/src/lib/analyzers/python/security-checks/crypto-failures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-failures.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/crypto-failures.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAeH,kDAqNC;AAjOD,sEAAiF;AAEjF;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CACjC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,kFAAkF;QAClF,MAAM,cAAc,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,8BAA8B;gBAC9B,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,8DAA8D;gBAC9D,MAAM,gBAAgB,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBAC7G,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,4CAA4C;oBAC5C,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO,CAAC,iBAAiB;YAC3B,CAAC;iBAAM,CAAC;gBACN,4BAA4B;gBAC5B,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO,CAAC,iBAAiB;YAC3B,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,0CAA0C;QAE1C,8BAA8B;QAC9B,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;YAClC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACxC,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,uBAAuB,EACvB,8EAA8E,EAC9E,6DAA6D,EAC7D,KAAK,GAAG,CAAC,EACT,yKAAyK,EACzK,+FAA+F,EAC/F;gBACE,sDAAsD;gBACtD,yCAAyC;gBACzC,wCAAwC;gBACxC,qCAAqC;aACtC,EACD,4EAA4E,EAC5E,6FAA6F,EAC7F,yKAAyK,CAC1K,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;YACnC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzC,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,uBAAuB,EACvB,oFAAoF,EACpF,gCAAgC,EAChC,KAAK,GAAG,CAAC,EACT,kLAAkL,EAClL,2FAA2F,EAC3F;gBACE,yCAAyC;gBACzC,mDAAmD;gBACnD,8BAA8B;gBAC9B,+BAA+B;aAChC,EACD,wDAAwD,EACxD,0DAA0D,EAC1D,sGAAsG,CACvG,CACF,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpF,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACxC,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,uBAAuB,EACvB,8DAA8D,EAC9D,wCAAwC,EACxC,KAAK,GAAG,CAAC,EACT,sHAAsH,EACtH,uFAAuF,EACvF;gBACE,8CAA8C;gBAC9C,gDAAgD;gBAChD,kDAAkD;gBAClD,wCAAwC;aACzC,EACD,oEAAoE,EACpE,oEAAoE,EACpE,0FAA0F,CAC3F,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YACpD,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzC,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,uBAAuB,EACvB,gEAAgE,EAChE,4BAA4B,EAC5B,KAAK,GAAG,CAAC,EACT,gJAAgJ,EAChJ,yFAAyF,EACzF;gBACE,+CAA+C;gBAC/C,2CAA2C;gBAC3C,8CAA8C;gBAC9C,yBAAyB;aAC1B,EACD,2EAA2E,EAC3E,oEAAoE,EACpE,4EAA4E,CAC7E,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YACxD,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC7C,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,uBAAuB,EACvB,kEAAkE,EAClE,wCAAwC,EACxC,KAAK,GAAG,CAAC,EACT,2HAA2H,EAC3H,+FAA+F,EAC/F;gBACE,mCAAmC;gBACnC,mCAAmC;gBACnC,8CAA8C;gBAC9C,qCAAqC;aACtC,EACD,mFAAmF,EACnF,oEAAoE,EACpE,yEAAyE,CAC1E,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YACpD,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACpC,SAAS,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;YACxD,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,uBAAuB,EACvB,2EAA2E,EAC3E,sCAAsC,EACtC,KAAK,GAAG,CAAC,EACT,uJAAuJ,EACvJ,8EAA8E,EAC9E;gBACE,yCAAyC;gBACzC,kDAAkD;gBAClD,6BAA6B;gBAC7B,gDAAgD;aACjD,EACD,wDAAwD,EACxD,oEAAoE,EACpE,wFAAwF,CACzF,CACF,CAAC;QACJ,CAAC;QAED,8CAA8C;QAE9C,8DAA8D;QAC9D,IAAI,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACpC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACrC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACvC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACpC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC1C,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,iBAAiB,EACjB,2EAA2E,EAC3E,gHAAgH,EAChH,KAAK,GAAG,CAAC,EACT,oOAAoO,EACpO,4EAA4E,EAC5E;gBACE,wCAAwC;gBACxC,8CAA8C;gBAC9C,oBAAoB;gBACpB,mCAAmC;aACpC,EACD,sFAAsF,EACtF,4FAA4F,EAC5F,8LAA8L,CAC/L,CACF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/python/security-checks/data-integrity.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Python Data Integrity Failures Security Checks
+ * OWASP A08:2025 - Software and Data Integrity Failures
+ *
+ * Detects insecure deserialization with pickle module.
+ * Updated for OWASP 2025 with enhanced detection patterns.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for data integrity vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #1: Insecure deserialization with pickle (CRITICAL)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkDataIntegrity(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=data-integrity.d.ts.map

package/dist/src/lib/analyzers/python/security-checks/data-integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-integrity.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/data-integrity.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAyFzB"}