codeslick-cli 1.0.0

package/dist/src/lib/analyzers/python/security-checks/insecure-design.js

@@ -0,0 +1,160 @@
+"use strict";
+/**
+ * Python Insecure Design Security Checks
+ * OWASP A06:2025 - Insecure Design
+ *
+ * Detects design-level security flaws that cannot be fixed by implementation alone.
+ * This is a NEW category in OWASP 2025 focusing on missing security controls.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkInsecureDesign = checkInsecureDesign;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for insecure design vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #1: Missing rate limiting on sensitive endpoints (HIGH)
+ * - Check #2: Mass assignment vulnerabilities (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkInsecureDesign(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    // Track route context
+    let currentRoute = '';
+    let routeLineNumber = -1;
+    let hasRateLimiting = false;
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track Python triple-quote comment blocks (""" ... """ or ''' ... ''')
+        const hasTripleQuote = trimmedLine.includes('"""') || trimmedLine.includes("'''");
+        if (hasTripleQuote) {
+            if (!inMultiLineComment) {
+                // Start of multi-line comment
+                inMultiLineComment = true;
+                // Check if it closes on the same line (single-line docstring)
+                const tripleQuoteCount = (trimmedLine.match(/"""/g) || []).length + (trimmedLine.match(/'''/g) || []).length;
+                if (tripleQuoteCount >= 2) {
+                    // Opens and closes on same line, reset flag
+                    inMultiLineComment = false;
+                }
+                return; // Skip this line
+            }
+            else {
+                // End of multi-line comment
+                inMultiLineComment = false;
+                return; // Skip this line
+            }
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('#')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Check #1: Missing rate limiting on sensitive endpoints
+        // Detect rate limiting decorators
+        if (lowerLine.includes('@limiter.limit') ||
+            lowerLine.includes('@rate_limit') ||
+            lowerLine.includes('@throttle')) {
+            hasRateLimiting = true;
+            return;
+        }
+        // Detect route decorators
+        if (lowerLine.includes('@app.route(') || lowerLine.includes('@route(')) {
+            currentRoute = trimmedLine.toLowerCase();
+            routeLineNumber = index + 1;
+            hasRateLimiting = false; // Reset for new route
+            return;
+        }
+        // Detect function definitions (route handlers)
+        if (lowerLine.startsWith('def ')) {
+            // Check if route needs rate limiting
+            if (currentRoute && !hasRateLimiting) {
+                const isSensitiveRoute = currentRoute.includes('/login') ||
+                    currentRoute.includes('/signin') ||
+                    currentRoute.includes('/reset') ||
+                    currentRoute.includes('/password') ||
+                    currentRoute.includes('/api/') ||
+                    currentRoute.includes('/verify') ||
+                    currentRoute.includes('/otp') ||
+                    currentRoute.includes('/auth') ||
+                    currentRoute.includes('/token');
+                const isPublicStatic = currentRoute.includes('/about') ||
+                    currentRoute.includes('/contact') ||
+                    currentRoute.includes('/home') ||
+                    currentRoute.includes('/static');
+                if (isSensitiveRoute && !isPublicStatic && routeLineNumber > 0) {
+                    vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('missing-rate-limiting', 'Sensitive endpoint missing rate limiting - vulnerable to brute-force and DoS attacks', 'Add rate limiting decorator (@limiter.limit, @rate_limit, or @throttle) to prevent abuse', routeLineNumber, 'Attackers can perform unlimited login attempts, password resets, or API calls, enabling credential stuffing, account enumeration, and denial of service attacks', '@app.route(\'/login\', methods=[\'POST\'])\ndef login():\n    user = authenticate(request.form)  # No rate limit!', [
+                        'Brute-force attacks on login and authentication',
+                        'Credential stuffing with stolen password lists',
+                        'Account enumeration through timing attacks',
+                        'Denial of service through resource exhaustion',
+                        'OTP/2FA bypass through unlimited attempts'
+                    ], '@app.route(\'/login\', methods=[\'POST\'])\ndef login():\n    return authenticate(request.form)', '@app.route(\'/login\', methods=[\'POST\'])\n@limiter.limit("5 per minute")\ndef login():\n    return authenticate(request.form)', 'Add rate limiting to all sensitive endpoints. Use Flask-Limiter or similar middleware. Recommended limits: 5 attempts/minute for login, 3 attempts/hour for password reset.'));
+                }
+            }
+            // Reset route tracking
+            currentRoute = '';
+            routeLineNumber = -1;
+            hasRateLimiting = false;
+            return;
+        }
+        // Check #2: Mass assignment vulnerabilities
+        // Detect direct unpacking of request data to models
+        if ((lowerLine.includes('**request.json') ||
+            lowerLine.includes('**request.form') ||
+            lowerLine.includes('**request.data')) &&
+            !lowerLine.includes('form.data')) { // Exclude validated form data
+            // Check if there's a whitelist validation nearby
+            let hasWhitelist = false;
+            for (let i = Math.max(0, index - 5); i <= Math.min(index + 2, lines.length - 1); i++) {
+                const nearbyLine = lines[i].trim().toLowerCase();
+                if (nearbyLine.includes('allowed_fields') ||
+                    nearbyLine.includes('whitelist') ||
+                    nearbyLine.includes('if k in') ||
+                    nearbyLine.includes('for k, v') && nearbyLine.includes('items()')) {
+                    hasWhitelist = true;
+                    break;
+                }
+            }
+            if (!hasWhitelist) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('mass-assignment', 'Mass assignment vulnerability - allows attackers to modify unintended fields', 'Use explicit field whitelisting or validated form objects instead of direct request data unpacking', index + 1, 'Attackers can inject additional fields in requests to modify protected attributes (is_admin, role, password_hash), escalate privileges, or manipulate business logic', 'user = User(**request.json)  # Attacker can set ANY field!\ndb.session.add(user)  # Including is_admin=True', [
+                    'Privilege escalation through role modification',
+                    'Account takeover by changing email/password',
+                    'Business logic bypass (price, discount manipulation)',
+                    'Data integrity violations',
+                    'Unauthorized access to protected resources'
+                ], 'user = User(**request.json)\ndb.session.add(user)', 'allowed_fields = [\'name\', \'email\', \'bio\']\ndata = {k: v for k, v in request.json.items() if k in allowed_fields}\nuser = User(**data)', 'Always use explicit field whitelisting. Define allowed fields and filter request data before assignment. Use form validation libraries like WTForms or Marshmallow.'));
+            }
+        }
+        // Detect .update() with request data
+        if (lowerLine.includes('.update(request.') &&
+            !lowerLine.includes('**') && // Already caught above
+            !lowerLine.includes('form.data')) {
+            // Check for whitelist
+            let hasWhitelist = false;
+            for (let i = Math.max(0, index - 5); i <= Math.min(index + 2, lines.length - 1); i++) {
+                const nearbyLine = lines[i].trim().toLowerCase();
+                if (nearbyLine.includes('allowed_fields') ||
+                    nearbyLine.includes('whitelist')) {
+                    hasWhitelist = true;
+                    break;
+                }
+            }
+            if (!hasWhitelist) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('mass-assignment', 'Mass assignment vulnerability in model update - allows modification of unintended fields', 'Use explicit field assignment or whitelist validation before updating', index + 1, 'Attackers can inject additional fields to modify protected model attributes, bypass business logic, or escalate privileges', 'user.update(request.json)  # Attacker controls ALL updated fields', [
+                    'Privilege escalation through protected field modification',
+                    'Business logic bypass',
+                    'Data integrity violations',
+                    'Unauthorized attribute changes'
+                ], 'user.update(request.json)', 'allowed_fields = [\'name\', \'email\']\ndata = {k: v for k, v in request.json.items() if k in allowed_fields}\nuser.update(data)', 'Whitelist allowed fields before calling update(). Only allow users to modify fields they should have access to.'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=insecure-design.js.map

package/dist/src/lib/analyzers/python/security-checks/insecure-design.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-design.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/insecure-design.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAeH,kDAwMC;AApND,sEAAiF;AAEjF;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CACjC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,sBAAsB;IACtB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,eAAe,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,kFAAkF;QAClF,MAAM,cAAc,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,8BAA8B;gBAC9B,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,8DAA8D;gBAC9D,MAAM,gBAAgB,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBAC7G,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,4CAA4C;oBAC5C,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO,CAAC,iBAAiB;YAC3B,CAAC;iBAAM,CAAC;gBACN,4BAA4B;gBAC5B,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO,CAAC,iBAAiB;YAC3B,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,yDAAyD;QAEzD,kCAAkC;QAClC,IAAI,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACpC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;YACjC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,eAAe,GAAG,IAAI,CAAC;YACvB,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACvE,YAAY,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACzC,eAAe,GAAG,KAAK,GAAG,CAAC,CAAC;YAC5B,eAAe,GAAG,KAAK,CAAC,CAAC,sBAAsB;YAC/C,OAAO;QACT,CAAC;QAED,+CAA+C;QAC/C,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,qCAAqC;YACrC,IAAI,YAAY,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrC,MAAM,gBAAgB,GACpB,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC/B,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAChC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC/B,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAClC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC9B,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAChC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC7B,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC9B,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAElC,MAAM,cAAc,GAClB,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC/B,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;oBACjC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC9B,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAEnC,IAAI,gBAAgB,IAAI,CAAC,cAAc,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;oBAC/D,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,uBAAuB,EACvB,sFAAsF,EACtF,0FAA0F,EAC1F,eAAe,EACf,iKAAiK,EACjK,mHAAmH,EACnH;wBACE,iDAAiD;wBACjD,gDAAgD;wBAChD,4CAA4C;wBAC5C,+CAA+C;wBAC/C,2CAA2C;qBAC5C,EACD,iGAAiG,EACjG,iIAAiI,EACjI,6KAA6K,CAC9K,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uBAAuB;YACvB,YAAY,GAAG,EAAE,CAAC;YAClB,eAAe,GAAG,CAAC,CAAC,CAAC;YACrB,eAAe,GAAG,KAAK,CAAC;YACxB,OAAO;QACT,CAAC;QAED,4CAA4C;QAE5C,oDAAoD;QACpD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACpC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACpC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YACtC,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,8BAA8B;YAEpE,iDAAiD;YACjD,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACrC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAChC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAC9B,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtE,YAAY,GAAG,IAAI,CAAC;oBACpB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,iBAAiB,EACjB,8EAA8E,EAC9E,oGAAoG,EACpG,KAAK,GAAG,CAAC,EACT,sKAAsK,EACtK,6GAA6G,EAC7G;oBACE,gDAAgD;oBAChD,6CAA6C;oBAC7C,sDAAsD;oBACtD,2BAA2B;oBAC3B,4CAA4C;iBAC7C,EACD,mDAAmD,EACnD,6IAA6I,EAC7I,qKAAqK,CACtK,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACtC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,uBAAuB;YACpD,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAErC,sBAAsB;YACtB,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACrC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBACrC,YAAY,GAAG,IAAI,CAAC;oBACpB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,iBAAiB,EACjB,0FAA0F,EAC1F,uEAAuE,EACvE,KAAK,GAAG,CAAC,EACT,4HAA4H,EAC5H,mEAAmE,EACnE;oBACE,2DAA2D;oBAC3D,uBAAuB;oBACvB,2BAA2B;oBAC3B,gCAAgC;iBACjC,EACD,2BAA2B,EAC3B,kIAAkI,EAClI,iHAAiH,CAClH,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/python/security-checks/logging-failures.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Python Logging Failures Security Checks
+ * OWASP A09:2025 - Security Logging and Monitoring Failures
+ *
+ * Detects insufficient logging of security events and logging of sensitive data.
+ * Updated for OWASP 2025 with enhanced monitoring requirements.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for logging security vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #1: Missing security event logging (MEDIUM)
+ * - Check #2: Logging sensitive data (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkLoggingFailures(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=logging-failures.d.ts.map

package/dist/src/lib/analyzers/python/security-checks/logging-failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-failures.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/logging-failures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CA0IzB"}

package/dist/src/lib/analyzers/python/security-checks/logging-failures.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Python Logging Failures Security Checks
+ * OWASP A09:2025 - Security Logging and Monitoring Failures
+ *
+ * Detects insufficient logging of security events and logging of sensitive data.
+ * Updated for OWASP 2025 with enhanced monitoring requirements.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkLoggingFailures = checkLoggingFailures;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for logging security vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #1: Missing security event logging (MEDIUM)
+ * - Check #2: Logging sensitive data (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkLoggingFailures(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track Python triple-quote comment blocks (""" ... """ or ''' ... ''')
+        const hasTripleQuote = trimmedLine.includes('"""') || trimmedLine.includes("'''");
+        if (hasTripleQuote) {
+            if (!inMultiLineComment) {
+                // Start of multi-line comment
+                inMultiLineComment = true;
+                // Check if it closes on the same line (single-line docstring)
+                const tripleQuoteCount = (trimmedLine.match(/"""/g) || []).length + (trimmedLine.match(/'''/g) || []).length;
+                if (tripleQuoteCount >= 2) {
+                    // Opens and closes on same line, reset flag
+                    inMultiLineComment = false;
+                }
+                return; // Skip this line
+            }
+            else {
+                // End of multi-line comment
+                inMultiLineComment = false;
+                return; // Skip this line
+            }
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('#')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Check #1: Missing security event logging
+        // Detect security failures without logging
+        const isSecurityFailure = (lowerLine.includes('return') || lowerLine.includes('abort(')) &&
+            (lowerLine.includes('401') || lowerLine.includes('403') ||
+                lowerLine.includes('"access denied"') || lowerLine.includes("'access denied'") ||
+                lowerLine.includes('"unauthorized"') || lowerLine.includes("'unauthorized'") ||
+                lowerLine.includes('"invalid credentials"') || lowerLine.includes("'invalid credentials'"));
+        if (isSecurityFailure) {
+            // Check if logging exists in nearby lines (within 5 lines before)
+            let hasLogging = false;
+            for (let i = Math.max(0, index - 5); i < index; i++) {
+                const prevLine = lines[i].trim().toLowerCase();
+                if (prevLine.includes('logger.') ||
+                    prevLine.includes('logging.') ||
+                    prevLine.includes('log.')) {
+                    hasLogging = true;
+                    break;
+                }
+            }
+            if (!hasLogging) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('missing-security-logging', 'Security event not logged - authentication/authorization failures should be logged for security monitoring', 'Add logging statement (logger.warning, logger.error) before security failures to track attack attempts', index + 1, 'Without logging security events, attackers can perform reconnaissance, brute-force attacks, and privilege escalation attempts undetected, making incident response and forensics impossible', 'if not user.check_password(password):\n    return "Invalid credentials", 401  # No logging!', [
+                    'Undetected brute-force and credential stuffing attacks',
+                    'No audit trail for security incidents',
+                    'Impossible forensics after breach',
+                    'Compliance violations (PCI-DSS, HIPAA, SOC2)',
+                    'Delayed incident detection and response'
+                ], 'if not authenticate(username, password):\n    return "Invalid credentials", 401', 'if not authenticate(username, password):\n    logger.warning(f"Failed login attempt for {username} from {request.remote_addr}")\n    return "Invalid credentials", 401', 'Always log security events: failed logins, authorization failures, access denials. Include username, IP address, and timestamp. Use centralized logging for monitoring.'));
+            }
+        }
+        // Check #2: Logging sensitive data
+        // Detect logging of sensitive data
+        const hasLogging = lowerLine.includes('logger.') ||
+            lowerLine.includes('logging.') ||
+            lowerLine.includes('log.');
+        if (hasLogging) {
+            const sensitivePatterns = [
+                'password',
+                'token',
+                'secret',
+                'api_key',
+                'apikey',
+                'credit_card',
+                'creditcard',
+                'ssn',
+                'private_key',
+                'privatekey',
+                'session_id',
+                'sessionid',
+                'auth_token',
+                'bearer'
+            ];
+            for (const pattern of sensitivePatterns) {
+                if (lowerLine.includes(pattern) && !lowerLine.includes('username')) {
+                    vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('sensitive-data-logging', 'Sensitive data logged in plaintext - exposes credentials and secrets in log files', 'Never log passwords, tokens, API keys, or other sensitive data. Log only non-sensitive identifiers', index + 1, 'Sensitive data in logs can be exposed through log aggregation systems, backup files, or compromised logging servers, leading to credential theft and unauthorized access', 'logger.info(f"User logged in with password: {password}")  # Password exposed in logs!', [
+                        'Credential exposure through log files',
+                        'API key/token theft from logging systems',
+                        'Compliance violations (PCI-DSS, GDPR)',
+                        'Secrets leaked through log aggregation tools',
+                        'Long-term exposure in log archives'
+                    ], 'logger.debug(f"Login attempt with password: {password}")', 'logger.info(f"Login attempt for user: {username}")  # Only log username, not password', 'Never log passwords, tokens, API keys, credit cards, or other secrets. Log only non-sensitive identifiers like username, user ID, or transaction ID. Sanitize logs before storage.'));
+                    break; // Only report once per line
+                }
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=logging-failures.js.map

package/dist/src/lib/analyzers/python/security-checks/logging-failures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-failures.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/logging-failures.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAeH,oDA4IC;AAxJD,sEAAiF;AAEjF;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,kFAAkF;QAClF,MAAM,cAAc,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,8BAA8B;gBAC9B,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,8DAA8D;gBAC9D,MAAM,gBAAgB,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBAC7G,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,4CAA4C;oBAC5C,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO,CAAC,iBAAiB;YAC3B,CAAC;iBAAM,CAAC;gBACN,4BAA4B;gBAC5B,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO,CAAC,iBAAiB;YAC3B,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,2CAA2C;QAE3C,2CAA2C;QAC3C,MAAM,iBAAiB,GACrB,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9D,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACtD,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC9E,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAC5E,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAE/F,IAAI,iBAAiB,EAAE,CAAC;YACtB,kEAAkE;YAClE,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC/C,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAC5B,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC7B,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9B,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,0BAA0B,EAC1B,4GAA4G,EAC5G,wGAAwG,EACxG,KAAK,GAAG,CAAC,EACT,6LAA6L,EAC7L,6FAA6F,EAC7F;oBACE,wDAAwD;oBACxD,uCAAuC;oBACvC,mCAAmC;oBACnC,8CAA8C;oBAC9C,yCAAyC;iBAC1C,EACD,iFAAiF,EACjF,wKAAwK,EACxK,yKAAyK,CAC1K,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mCAAmC;QAEnC,mCAAmC;QACnC,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC7B,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC9B,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE9C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,iBAAiB,GAAG;gBACxB,UAAU;gBACV,OAAO;gBACP,QAAQ;gBACR,SAAS;gBACT,QAAQ;gBACR,aAAa;gBACb,YAAY;gBACZ,KAAK;gBACL,aAAa;gBACb,YAAY;gBACZ,YAAY;gBACZ,WAAW;gBACX,YAAY;gBACZ,QAAQ;aACT,CAAC;YAEF,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnE,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAC/B,wBAAwB,EACxB,mFAAmF,EACnF,oGAAoG,EACpG,KAAK,GAAG,CAAC,EACT,0KAA0K,EAC1K,uFAAuF,EACvF;wBACE,uCAAuC;wBACvC,0CAA0C;wBAC1C,uCAAuC;wBACvC,8CAA8C;wBAC9C,oCAAoC;qBACrC,EACD,0DAA0D,EAC1D,uFAAuF,EACvF,oLAAoL,CACrL,CACF,CAAC;oBACF,MAAM,CAAC,4BAA4B;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/python/security-checks/nosql-injection.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Python NoSQL Injection Security Checks
+ * OWASP A03:2021 - Injection (CWE-943)
+ *
+ * Detects NoSQL injection vulnerabilities in Python code, particularly
+ * with MongoDB, Cassandra, Redis, and other NoSQL databases.
+ *
+ * Created: 2025-12-18 (Phase 0 - Priority 0 Critical Gap)
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for NoSQL injection vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #35: MongoDB operator injection (CRITICAL)
+ * - Check #36: MongoDB direct JSON payload (CRITICAL)
+ * - Check #37: Cassandra CQL string interpolation (CRITICAL)
+ * - Check #38: Redis command injection (HIGH)
+ * - Check #39: MongoDB $where JavaScript injection (CRITICAL)
+ *
+ * @param lines - Array of code lines
+ * @param userInputVariables - Map of variable names assigned from user input
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkNoSQLInjection(lines: string[], userInputVariables: Map<string, number>): SecurityVulnerability[];
+//# sourceMappingURL=nosql-injection.d.ts.map

package/dist/src/lib/analyzers/python/security-checks/nosql-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nosql-injection.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/nosql-injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EAAE,EACf,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,qBAAqB,EAAE,CAmTzB"}

package/dist/src/lib/analyzers/python/security-checks/nosql-injection.js

@@ -0,0 +1,248 @@
+"use strict";
+/**
+ * Python NoSQL Injection Security Checks
+ * OWASP A03:2021 - Injection (CWE-943)
+ *
+ * Detects NoSQL injection vulnerabilities in Python code, particularly
+ * with MongoDB, Cassandra, Redis, and other NoSQL databases.
+ *
+ * Created: 2025-12-18 (Phase 0 - Priority 0 Critical Gap)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkNoSQLInjection = checkNoSQLInjection;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for NoSQL injection vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #35: MongoDB operator injection (CRITICAL)
+ * - Check #36: MongoDB direct JSON payload (CRITICAL)
+ * - Check #37: Cassandra CQL string interpolation (CRITICAL)
+ * - Check #38: Redis command injection (HIGH)
+ * - Check #39: MongoDB $where JavaScript injection (CRITICAL)
+ *
+ * @param lines - Array of code lines
+ * @param userInputVariables - Map of variable names assigned from user input
+ * @returns Array of security vulnerabilities found
+ */
+function checkNoSQLInjection(lines, userInputVariables) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    // Track MongoDB/NoSQL query variables that use dict-based queries
+    const noSqlQueryVariables = new Map(); // variable name -> line number
+    // Track CQL query variables with string interpolation
+    const cqlInterpolatedVariables = new Map(); // variable name -> line number
+    // Track Redis client variables (e.g., r = redis.Redis(), client = redis.StrictRedis())
+    const redisClientVariables = new Set(); // variable names
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // CRITICAL: Track Python triple-quote comment blocks (""" ... """ or ''' ... ''')
+        const hasTripleQuote = trimmed.includes('"""') || trimmed.includes("'''");
+        if (hasTripleQuote) {
+            if (!inMultiLineComment) {
+                inMultiLineComment = true;
+                const tripleQuoteCount = (trimmed.match(/"""/g) || []).length + (trimmed.match(/'''/g) || []).length;
+                if (tripleQuoteCount >= 2) {
+                    inMultiLineComment = false;
+                }
+                return;
+            }
+            else {
+                inMultiLineComment = false;
+                return;
+            }
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('#')) {
+            return;
+        }
+        // =============================================================================
+        // CHECK #35: MongoDB Operator Injection (CRITICAL)
+        // =============================================================================
+        // Pattern: collection.find(query) where query contains user input that could be dict
+        // ENHANCED: Also handle multi-line calls like update_one(\n  filter,\n  update_data\n)
+        // Detect MongoDB query methods: find(), find_one(), update(), delete(), etc.
+        const mongoMethodMatch = trimmed.match(/\.(find|find_one|update|update_one|update_many|replace_one|delete|delete_one|delete_many|insert_one|insert_many|find_one_and_update|find_one_and_replace|count|aggregate)\s*\((.*)$/);
+        if (mongoMethodMatch) {
+            const methodName = mongoMethodMatch[1];
+            let allArgs = mongoMethodMatch[2].trim();
+            // ENHANCED: Handle multi-line calls (Test 3.3 fix)
+            // If the line doesn't end with ), check next few lines for arguments
+            if (!allArgs.includes(')')) {
+                const nextLines = lines.slice(index + 1, Math.min(index + 10, lines.length));
+                for (const nextLine of nextLines) {
+                    allArgs += ' ' + nextLine.trim();
+                    if (nextLine.includes(')')) {
+                        break;
+                    }
+                }
+            }
+            // Remove trailing ) if present
+            allArgs = allArgs.replace(/\).*$/, '').trim();
+            // For update_one/update_many/replace_one: check SECOND argument (update document)
+            // For insert_one/insert_many: check FIRST argument (document to insert)
+            // For find/delete: check FIRST argument (query document)
+            const args = allArgs.split(',').map(arg => arg.trim());
+            let argToCheck;
+            if (methodName.match(/update|replace/)) {
+                // Update/replace operations: check second argument (update document)
+                argToCheck = args.length > 1 ? args[1] : '';
+            }
+            else if (methodName.match(/insert/)) {
+                // Insert operations: check first argument (document to insert)
+                argToCheck = args[0] || '';
+            }
+            else {
+                // Read/delete operations: check first argument (query)
+                argToCheck = args[0] || '';
+            }
+            const queryArg = argToCheck || allArgs;
+            // Check if query argument is a user input variable
+            if (queryArg && userInputVariables.has(queryArg)) {
+                const userInputLine = userInputVariables.get(queryArg);
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('nosql-injection', `MongoDB ${methodName}() with user input variable '${queryArg}' (line ${userInputLine}) - operator injection risk`, 'Validate input structure, ensure only expected fields, reject $ operators', lineNumber, `MongoDB query methods accept dict-like objects. If user input contains MongoDB operators like {"$gt": ""}, {"$ne": null}, or {"$or": [...]}, attackers can bypass authentication or access unauthorized data. Variable '${queryArg}' was assigned from user input on line ${userInputLine}.`, `# Line ${userInputLine}:\ncredentials = request.json()  # {"username": {"$ne": null}, "password": {"$ne": null}}\n# Line ${lineNumber}:\nuser = db.users.${methodName}(credentials)  # Bypasses authentication!`, [
+                    'Authentication bypass (login without credentials)',
+                    'Unauthorized data access (read all records)',
+                    'Data exfiltration via operator injection',
+                    'Privilege escalation (access admin accounts)',
+                    'Database enumeration'
+                ], `user_query = request.json()\nresult = collection.${methodName}(user_query)  # Vulnerable to operator injection`, `# Validate input structure and sanitize\nuser_query = request.json()\n\n# Only allow expected fields, reject operators\nallowed_fields = ["username", "email"]\nquery = {k: v for k, v in user_query.items() if k in allowed_fields and not k.startswith("$")}\n\n# Ensure values are strings, not dicts\nfor key, value in query.items():\n    if isinstance(value, dict):\n        raise ValueError(f"Invalid query structure for field {key}")\n\nresult = collection.${methodName}(query)`, 'Validate input structure: only allow expected fields, reject keys starting with $, ensure values are primitives (not dicts). Use schema validation libraries like pydantic or marshmallow.'));
+            }
+            // Check for direct request.json() or request.get_json() in query (check all args)
+            if (allArgs.includes('request.json') || allArgs.includes('request.get_json')) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('nosql-injection', `MongoDB ${methodName}() with direct request.json() - operator injection risk`, 'Validate input structure before using in queries', lineNumber, 'Passing request.json() directly to MongoDB query methods allows attackers to inject MongoDB operators like $gt, $ne, $or, bypassing authentication and accessing unauthorized data.', `user = db.users.${methodName}(request.json())  # {"username": {"$ne": null}} bypasses auth`, [
+                    'Authentication bypass',
+                    'Unauthorized data access',
+                    'Data exfiltration',
+                    'Privilege escalation',
+                    'Complete database compromise'
+                ], `result = collection.${methodName}(request.json())`, `# Validate input structure\nfrom pydantic import BaseModel\n\nclass UserQuery(BaseModel):\n    username: str  # Only string, not dict\n    email: str\n\nuser_data = UserQuery(**request.json())  # Validates structure\nresult = collection.${methodName}(user_data.dict())`, 'Use schema validation (pydantic, marshmallow) to ensure query structure. Never pass request.json() directly to query methods.'));
+            }
+            // Track query variables for data flow analysis
+            if (queryArg && !queryArg.includes('(')) {
+                noSqlQueryVariables.set(queryArg, lineNumber);
+            }
+        }
+        // =============================================================================
+        // CHECK #36: MongoDB dict-based query construction with user input
+        // =============================================================================
+        // Pattern: query = {"field": user_input} where user_input could be dict
+        const dictQueryMatch = trimmed.match(/^(\w+)\s*=\s*\{[^}]*(\w+)[^}]*\}/);
+        if (dictQueryMatch) {
+            const queryVarName = dictQueryMatch[1];
+            const potentialUserInput = dictQueryMatch[2];
+            // Check if the value in the dict is a user input variable
+            if (userInputVariables.has(potentialUserInput)) {
+                noSqlQueryVariables.set(queryVarName, lineNumber);
+            }
+        }
+        // =============================================================================
+        // TRACK: Redis Client Variables
+        // =============================================================================
+        // Track variables assigned from redis.Redis(), redis.StrictRedis(), etc.
+        // Pattern: r = redis.Redis(), client = redis.StrictRedis()
+        const redisClientMatch = trimmed.match(/^(\w+)\s*=\s*redis\.(Redis|StrictRedis|Sentinel)/);
+        if (redisClientMatch) {
+            const varName = redisClientMatch[1];
+            redisClientVariables.add(varName);
+        }
+        // =============================================================================
+        // TRACK: CQL Query Variables with String Interpolation
+        // =============================================================================
+        // Track variables assigned with string interpolation (f-strings, .format(), %, +)
+        // Pattern: cql = f"SELECT ...", query = "...".format(), query = "..." % var
+        const cqlVarMatch = trimmed.match(/^(\w+)\s*=\s*(.+)/);
+        if (cqlVarMatch) {
+            const varName = cqlVarMatch[1];
+            const varValue = cqlVarMatch[2];
+            // Check if value contains string interpolation
+            const hasInterpolation = varValue.includes('f"') || varValue.includes("f'") ||
+                varValue.includes('.format(') ||
+                varValue.includes('%s') || varValue.includes('% ') ||
+                (varValue.includes('+') && (varValue.includes('"') || varValue.includes("'")));
+            if (hasInterpolation && (varValue.includes('SELECT') || varValue.includes('INSERT') || varValue.includes('UPDATE') || varValue.includes('DELETE'))) {
+                // This looks like a CQL query with interpolation
+                cqlInterpolatedVariables.set(varName, lineNumber);
+            }
+        }
+        // =============================================================================
+        // CHECK #37: Cassandra CQL String Interpolation (CRITICAL)
+        // =============================================================================
+        // Pattern: session.execute() with f-strings, .format(), or % in CQL (inline or variable)
+        if (trimmed.includes('session.execute(') || trimmed.includes('execute_async(')) {
+            const executeMatch = trimmed.match(/session\.execute(?:_async)?\s*\(([^)]+)\)/);
+            let hasVulnerability = false;
+            let vulnSource = '';
+            // Check 1: Inline string interpolation on same line
+            if (trimmed.includes('f"') || trimmed.includes("f'") ||
+                trimmed.includes('.format(') ||
+                trimmed.includes('%s') ||
+                trimmed.includes('+')) {
+                hasVulnerability = true;
+                vulnSource = 'inline';
+            }
+            // Check 2: Variable with tracked string interpolation
+            if (executeMatch) {
+                const executeArg = executeMatch[1].trim();
+                if (cqlInterpolatedVariables.has(executeArg)) {
+                    hasVulnerability = true;
+                    const interpolatedLine = cqlInterpolatedVariables.get(executeArg);
+                    vulnSource = `variable '${executeArg}' (constructed with interpolation on line ${interpolatedLine})`;
+                }
+            }
+            if (hasVulnerability) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('nosql-injection', `Cassandra CQL injection via string interpolation ${vulnSource ? '(' + vulnSource + ')' : ''}`, 'Use session.prepare() with bound parameters', lineNumber, 'String interpolation in Cassandra CQL queries (using f-strings, .format(), % operators, or +) allows attackers to inject malicious CQL code, similar to SQL injection.', 'session.execute(f"SELECT * FROM users WHERE id = \'{user_id}\' ALLOW FILTERING") where user_id = "\' OR 1=1--"', [
+                    'Unauthorized data access',
+                    'CQL injection attacks',
+                    'Data exfiltration',
+                    'Authentication bypass',
+                    'Database enumeration'
+                ], 'cql = f"SELECT * FROM users WHERE id = \'{user_id}\' ALLOW FILTERING"\nsession.execute(cql)', 'from cassandra.cluster import Cluster\ncluster = Cluster()\nsession = cluster.connect("keyspace")\n\n# Use prepared statements\nprepared = session.prepare("SELECT * FROM users WHERE id = ?")\nsession.execute(prepared, (user_id,))  # Parameterized, safe', 'Always use session.prepare() with parameterized queries. Never use string interpolation (f-strings, .format(), %) in CQL queries.'));
+            }
+        }
+        // =============================================================================
+        // CHECK #38: Redis Command Injection (HIGH)
+        // =============================================================================
+        // Pattern: redis.get/set/delete with user-controlled keys or values
+        // Matches: redis.get(), r.get(), client.get(), etc. (only tracked Redis clients)
+        const redisMethodMatch = trimmed.match(/(\w+)\.(get|set|delete|hget|hset|lpush|rpush|sadd|zadd|incr|decr|append)\s*\(/);
+        if (redisMethodMatch) {
+            const clientVarName = redisMethodMatch[1];
+            // Only check if this is a tracked Redis client
+            if (redisClientVariables.has(clientVarName) || clientVarName === 'redis') {
+                // Check for user input in Redis commands
+                const hasUserInput = Array.from(userInputVariables.keys()).some(varName => trimmed.includes(varName));
+                if (hasUserInput) {
+                    vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('redis-injection', 'Redis command injection with user-controlled key or value', 'Validate and sanitize input, use allowlist for keys', lineNumber, 'Using user input directly in Redis keys or values can lead to key injection attacks, where attackers can access or modify unintended keys, enumerate the keyspace, or cause denial of service.', 'redis.get(user_key)  # user_key = "*" (returns all keys), or "\nFLUSHDB\n" (deletes database)', [
+                        'Unauthorized data access (read arbitrary keys)',
+                        'Data manipulation (modify unintended keys)',
+                        'Key enumeration (discover sensitive keys)',
+                        'Denial of Service (FLUSHDB, FLUSHALL)',
+                        'Cache poisoning'
+                    ], 'import redis\nr = redis.Redis()\nuser_key = request.args.get("key")\nvalue = r.get(user_key)  # Vulnerable', 'import redis\nimport re\n\nr = redis.Redis()\nuser_key = request.args.get("key")\n\n# Validate key format (only alphanumeric + underscore)\nif not re.match(r\'^[a-zA-Z0-9_]+$\', user_key):\n    raise ValueError("Invalid key format")\n\n# Prefix user keys to namespace them\nnamespaced_key = f"user:{user_key}"\nvalue = r.get(namespaced_key)  # Safe', 'Validate Redis keys with strict allowlists or regex patterns. Namespace user-controlled keys with prefixes. Never allow special characters or newlines in keys.'));
+                }
+            }
+        }
+        // =============================================================================
+        // CHECK #39: MongoDB $where JavaScript Injection (CRITICAL)
+        // =============================================================================
+        // Pattern: collection.find({"$where": ...}) with string interpolation
+        if (trimmed.includes('$where') || trimmed.includes('"$where"') || trimmed.includes("'$where'")) {
+            // Check for string interpolation in $where clause
+            if (trimmed.includes('f"') || trimmed.includes("f'") ||
+                trimmed.includes('.format(') ||
+                trimmed.includes('+')) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('nosql-injection', 'MongoDB $where clause with JavaScript injection risk', 'Avoid $where entirely, use native MongoDB operators instead', lineNumber, 'MongoDB $where operator executes JavaScript on the server. If user input is interpolated into $where clauses, attackers can inject arbitrary JavaScript code, leading to code execution, data exfiltration, or DoS.', 'collection.find({"$where": f"this.username == \'{username}\'"})  # username = "\'; db.dropDatabase(); \'"', [
+                    'Remote Code Execution (JavaScript in MongoDB)',
+                    'Database compromise',
+                    'Data exfiltration',
+                    'Denial of Service (infinite loops)',
+                    'Complete server takeover'
+                ], 'query = {"$where": f"this.age > {min_age}"}\nresult = collection.find(query)', '# NEVER use $where - use native MongoDB operators instead\nquery = {"age": {"$gt": min_age}}  # Native operator, safe\nresult = collection.find(query)', 'Never use MongoDB $where operator with user input. Use native MongoDB operators ($gt, $lt, $eq, etc.) which do not execute code. If $where is absolutely necessary, use prepared statements with proper escaping (but native operators are always preferred).'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=nosql-injection.js.map

package/dist/src/lib/analyzers/python/security-checks/nosql-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nosql-injection.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/nosql-injection.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAmBH,kDAsTC;AAtUD,sEAAiF;AAEjF;;;;;;;;;;;;;GAaG;AACH,SAAgB,mBAAmB,CACjC,KAAe,EACf,kBAAuC;IAEvC,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,+BAA+B;IAEtF,sDAAsD;IACtD,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,+BAA+B;IAE3F,uFAAuF;IACvF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,iBAAiB;IAEjE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,kFAAkF;QAClF,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACrG,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO;YACT,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO;YACT,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,gFAAgF;QAChF,mDAAmD;QACnD,gFAAgF;QAChF,qFAAqF;QACrF,uFAAuF;QAEvF,6EAA6E;QAC7E,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,qLAAqL,CAAC,CAAC;QAE9N,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAEzC,mDAAmD;YACnD,qEAAqE;YACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;oBACjC,OAAO,IAAI,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACjC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC3B,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+BAA+B;YAC/B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAE9C,kFAAkF;YAClF,wEAAwE;YACxE,yDAAyD;YACzD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAEvD,IAAI,UAAkB,CAAC;YACvB,IAAI,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACvC,qEAAqE;gBACrE,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;iBAAM,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,+DAA+D;gBAC/D,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,uDAAuD;gBACvD,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,QAAQ,GAAG,UAAU,IAAI,OAAO,CAAC;YAEvC,mDAAmD;YACnD,IAAI,QAAQ,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjD,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;gBACxD,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,iBAAiB,EACjB,WAAW,UAAU,gCAAgC,QAAQ,WAAW,aAAa,6BAA6B,EAClH,2EAA2E,EAC3E,UAAU,EACV,2NAA2N,QAAQ,0CAA0C,aAAa,GAAG,EAC7R,UAAU,aAAa,qGAAqG,UAAU,sBAAsB,UAAU,2CAA2C,EACjN;oBACE,mDAAmD;oBACnD,6CAA6C;oBAC7C,0CAA0C;oBAC1C,8CAA8C;oBAC9C,sBAAsB;iBACvB,EACD,oDAAoD,UAAU,kDAAkD,EAChH,4cAA4c,UAAU,SAAS,EAC/d,4LAA4L,CAC7L,CAAC,CAAC;YACL,CAAC;YAED,kFAAkF;YAClF,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC7E,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,iBAAiB,EACjB,WAAW,UAAU,yDAAyD,EAC9E,kDAAkD,EAClD,UAAU,EACV,qLAAqL,EACrL,mBAAmB,UAAU,+DAA+D,EAC5F;oBACE,uBAAuB;oBACvB,0BAA0B;oBAC1B,mBAAmB;oBACnB,sBAAsB;oBACtB,8BAA8B;iBAC/B,EACD,uBAAuB,UAAU,kBAAkB,EACnD,gPAAgP,UAAU,oBAAoB,EAC9Q,+HAA+H,CAChI,CAAC,CAAC;YACL,CAAC;YAED,+CAA+C;YAC/C,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,mEAAmE;QACnE,gFAAgF;QAChF,wEAAwE;QACxE,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzE,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,kBAAkB,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAE7C,0DAA0D;YAC1D,IAAI,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC/C,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,gCAAgC;QAChC,gFAAgF;QAChF,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC3F,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACpC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,gFAAgF;QAChF,uDAAuD;QACvD,gFAAgF;QAChF,kFAAkF;QAClF,4EAA4E;QAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAEhC,+CAA+C;YAC/C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAClD,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC7B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAClD,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAExG,IAAI,gBAAgB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACnJ,iDAAiD;gBACjD,wBAAwB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,2DAA2D;QAC3D,gFAAgF;QAChF,yFAAyF;QACzF,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAChF,IAAI,gBAAgB,GAAG,KAAK,CAAC;YAC7B,IAAI,UAAU,GAAG,EAAE,CAAC;YAEpB,oDAAoD;YACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,gBAAgB,GAAG,IAAI,CAAC;gBACxB,UAAU,GAAG,QAAQ,CAAC;YACxB,CAAC;YAED,sDAAsD;YACtD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,IAAI,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7C,gBAAgB,GAAG,IAAI,CAAC;oBACxB,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;oBACnE,UAAU,GAAG,aAAa,UAAU,6CAA6C,gBAAgB,GAAG,CAAC;gBACvG,CAAC;YACH,CAAC;YAED,IAAI,gBAAgB,EAAE,CAAC;gBACrB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,iBAAiB,EACjB,oDAAoD,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAC9F,6CAA6C,EAC7C,UAAU,EACV,wKAAwK,EACxK,gHAAgH,EAChH;oBACE,0BAA0B;oBAC1B,uBAAuB;oBACvB,mBAAmB;oBACnB,uBAAuB;oBACvB,sBAAsB;iBACvB,EACD,6FAA6F,EAC7F,8PAA8P,EAC9P,mIAAmI,CACpI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,4CAA4C;QAC5C,gFAAgF;QAChF,oEAAoE;QACpE,iFAAiF;QACjF,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACxH,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAE1C,+CAA+C;YAC/C,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;gBACzE,yCAAyC;gBACzC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACxE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC1B,CAAC;gBAEF,IAAI,YAAY,EAAE,CAAC;oBACnB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,iBAAiB,EACjB,2DAA2D,EAC3D,qDAAqD,EACrD,UAAU,EACV,gMAAgM,EAChM,+FAA+F,EAC/F;wBACE,gDAAgD;wBAChD,4CAA4C;wBAC5C,2CAA2C;wBAC3C,uCAAuC;wBACvC,iBAAiB;qBAClB,EACD,4GAA4G,EAC5G,8VAA8V,EAC9V,iKAAiK,CAClK,CAAC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,4DAA4D;QAC5D,gFAAgF;QAChF,sEAAsE;QACtE,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/F,kDAAkD;YAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAE1B,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,iBAAiB,EACjB,sDAAsD,EACtD,6DAA6D,EAC7D,UAAU,EACV,qNAAqN,EACrN,2GAA2G,EAC3G;oBACE,+CAA+C;oBAC/C,qBAAqB;oBACrB,mBAAmB;oBACnB,oCAAoC;oBACpC,0BAA0B;iBAC3B,EACD,8EAA8E,EAC9E,wJAAwJ,EACxJ,+PAA+P,CAChQ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}