codeslick-cli 1.0.0

package/dist/src/lib/analyzers/python/security-checks/security-misconfiguration.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Python Security Misconfiguration Checks
+ * OWASP A02:2025 - Security Misconfiguration
+ *
+ * Detects security misconfigurations that moved from #5 to #2 in OWASP 2025.
+ * Focus: Django/Flask debug modes, settings, AWS configs, etc.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for security misconfiguration vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #1: Django DEBUG mode enabled (HIGH)
+ * - Check #2: Flask debug mode enabled (HIGH)
+ * - Check #3: Django SECRET_KEY hardcoded (CRITICAL)
+ * - Check #4: Flask SECRET_KEY hardcoded (CRITICAL)
+ * - Check #5: Default Django settings not changed (MEDIUM)
+ * - Check #6: AWS credentials in source code (CRITICAL)
+ * - Check #7: Database credentials exposed (CRITICAL)
+ * - Check #8: Detailed error responses in production (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkSecurityMisconfiguration(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=security-misconfiguration.d.ts.map

package/dist/src/lib/analyzers/python/security-checks/security-misconfiguration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-misconfiguration.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/security-misconfiguration.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CA+XzB"}

package/dist/src/lib/analyzers/python/security-checks/security-misconfiguration.js

@@ -0,0 +1,375 @@
+"use strict";
+/**
+ * Python Security Misconfiguration Checks
+ * OWASP A02:2025 - Security Misconfiguration
+ *
+ * Detects security misconfigurations that moved from #5 to #2 in OWASP 2025.
+ * Focus: Django/Flask debug modes, settings, AWS configs, etc.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSecurityMisconfiguration = checkSecurityMisconfiguration;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for security misconfiguration vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #1: Django DEBUG mode enabled (HIGH)
+ * - Check #2: Flask debug mode enabled (HIGH)
+ * - Check #3: Django SECRET_KEY hardcoded (CRITICAL)
+ * - Check #4: Flask SECRET_KEY hardcoded (CRITICAL)
+ * - Check #5: Default Django settings not changed (MEDIUM)
+ * - Check #6: AWS credentials in source code (CRITICAL)
+ * - Check #7: Database credentials exposed (CRITICAL)
+ * - Check #8: Detailed error responses in production (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkSecurityMisconfiguration(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track Python triple-quote comment blocks (""" ... """ or ''' ... ''')
+        const hasTripleQuote = trimmedLine.includes('"""') || trimmedLine.includes("'''");
+        if (hasTripleQuote) {
+            if (!inMultiLineComment) {
+                // Start of multi-line comment
+                inMultiLineComment = true;
+                // Check if it closes on the same line (single-line docstring)
+                const tripleQuoteCount = (trimmedLine.match(/"""/g) || []).length + (trimmedLine.match(/'''/g) || []).length;
+                if (tripleQuoteCount >= 2) {
+                    // Opens and closes on same line, reset flag
+                    inMultiLineComment = false;
+                }
+                return; // Skip this line
+            }
+            else {
+                // End of multi-line comment
+                inMultiLineComment = false;
+                return; // Skip this line
+            }
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('#')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Check #1: Django DEBUG mode enabled
+        // Don't flag if using environment variables (proper pattern: os.getenv, os.environ)
+        // Don't flag Flask function parameters (app.run(debug=True) is handled by Flask-specific check)
+        if (lowerLine.includes('debug') && lowerLine.includes('=') && lowerLine.includes('true') &&
+            !lowerLine.includes('os.getenv') && !lowerLine.includes('os.environ') &&
+            !lowerLine.includes('getenv(') &&
+            !lowerLine.includes('app.run(') && !lowerLine.includes('.run(')) { // Skip Flask function calls
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'HIGH',
+                confidence: 'HIGH',
+                message: 'Django DEBUG mode enabled in production',
+                line: index + 1,
+                suggestion: 'Set DEBUG = False in production and use environment variables',
+                owasp: 'A02:2025',
+                cwe: 'CWE-489',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'DEBUG mode exposes sensitive information including stack traces, SQL queries, and internal paths',
+                    before: 'DEBUG = True',
+                    after: 'DEBUG = os.getenv("DEBUG", "False").lower() == "true"'
+                },
+                attackVector: {
+                    description: 'DEBUG mode reveals sensitive application internals to attackers',
+                    realWorldImpact: [
+                        'Exposure of source code and file paths',
+                        'Database query revelation with sensitive data',
+                        'Environment variables and settings disclosure',
+                        'Stack traces revealing application architecture'
+                    ]
+                }
+            }));
+        }
+        // Check #2: Flask debug mode enabled
+        // Don't flag if using environment variables or debug=False
+        if (lowerLine.includes('app.run') && lowerLine.includes('debug') && lowerLine.includes('true') &&
+            !lowerLine.includes('os.getenv') && !lowerLine.includes('os.environ') &&
+            !lowerLine.includes('getenv(') && !lowerLine.includes('debug=false')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'HIGH',
+                confidence: 'HIGH',
+                message: 'Flask debug mode enabled in production',
+                line: index + 1,
+                suggestion: 'Set debug=False in production deployments',
+                owasp: 'A02:2025',
+                cwe: 'CWE-489',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Flask debug mode enables code reloading and exposes the interactive debugger',
+                    before: 'app.run(debug=True)',
+                    after: 'app.run(debug=os.getenv("FLASK_DEBUG", "False").lower() == "true")'
+                },
+                attackVector: {
+                    description: 'Debug mode provides interactive debugger and exposes internal application state',
+                    realWorldImpact: [
+                        'Interactive debugger access in browser',
+                        'Code execution through debug console',
+                        'Source code and variable inspection',
+                        'Application state manipulation'
+                    ]
+                }
+            }));
+        }
+        // Check #3: Django SECRET_KEY hardcoded (NOT Flask - exclude app.secret_key and app.config patterns)
+        if (lowerLine.includes('secret_key') && lowerLine.includes('=') &&
+            (trimmedLine.includes("'") || trimmedLine.includes('"')) &&
+            !lowerLine.includes('os.environ') && !lowerLine.includes('getenv') &&
+            !lowerLine.includes('app.secret_key') && !lowerLine.includes('app.config')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'CRITICAL',
+                confidence: 'HIGH',
+                message: 'Django SECRET_KEY hardcoded in source code',
+                line: index + 1,
+                suggestion: 'Use environment variables to store SECRET_KEY securely',
+                owasp: 'A02:2025',
+                cwe: 'CWE-798',
+                pciDss: 'Requirement 3.4',
+                remediation: {
+                    explanation: 'Hardcoded SECRET_KEY compromises session security and CSRF protection',
+                    before: 'SECRET_KEY = "django-insecure-hardcoded-key"',
+                    after: 'SECRET_KEY = os.environ.get("SECRET_KEY")'
+                },
+                attackVector: {
+                    description: 'SECRET_KEY exposure enables session forgery and CSRF attacks',
+                    realWorldImpact: [
+                        'Session hijacking and forgery',
+                        'CSRF token prediction and bypass',
+                        'Cookie tampering and manipulation',
+                        'Authentication mechanism compromise'
+                    ]
+                }
+            }));
+        }
+        // Check #4: Flask SECRET_KEY hardcoded
+        if ((lowerLine.includes('app.secret_key') || lowerLine.includes('app.config["secret_key"]')) &&
+            lowerLine.includes('=') && (trimmedLine.includes("'") || trimmedLine.includes('"')) &&
+            !lowerLine.includes('os.environ') && !lowerLine.includes('getenv')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'CRITICAL',
+                confidence: 'HIGH',
+                message: 'Flask SECRET_KEY hardcoded in source code',
+                line: index + 1,
+                suggestion: 'Use environment variables to store SECRET_KEY securely',
+                owasp: 'A02:2025',
+                cwe: 'CWE-798',
+                pciDss: 'Requirement 3.4',
+                remediation: {
+                    explanation: 'Hardcoded SECRET_KEY compromises session security in Flask applications',
+                    before: 'app.secret_key = "hardcoded-secret"',
+                    after: 'app.secret_key = os.environ.get("SECRET_KEY")'
+                },
+                attackVector: {
+                    description: 'SECRET_KEY exposure enables session manipulation and security bypass',
+                    realWorldImpact: [
+                        'Session data tampering',
+                        'Flash message manipulation',
+                        'CSRF protection bypass',
+                        'Authentication state forgery'
+                    ]
+                }
+            }));
+        }
+        // Check #5: Default Django settings not changed
+        if (lowerLine.includes('allowed_hosts') && lowerLine.includes('=') &&
+            (lowerLine.includes('[]') || lowerLine.includes('["*"]') || lowerLine.includes("['*']"))) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'MEDIUM',
+                confidence: 'HIGH',
+                message: 'Django ALLOWED_HOSTS misconfigured or allows all hosts',
+                line: index + 1,
+                suggestion: 'Configure ALLOWED_HOSTS with specific domain names for production',
+                owasp: 'A02:2025',
+                cwe: 'CWE-346',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Unrestricted ALLOWED_HOSTS enables Host Header attacks',
+                    before: 'ALLOWED_HOSTS = ["*"]',
+                    after: 'ALLOWED_HOSTS = ["yourdomain.com", "www.yourdomain.com"]'
+                },
+                attackVector: {
+                    description: 'Host header manipulation can lead to password reset poisoning and cache poisoning',
+                    realWorldImpact: [
+                        'Password reset link hijacking',
+                        'Cache poisoning attacks',
+                        'DNS rebinding attacks',
+                        'HTTP Host header attacks'
+                    ]
+                }
+            }));
+        }
+        // Check #6: AWS credentials in source code
+        // Don't flag if using environment variables (proper pattern: os.getenv, os.environ)
+        if ((lowerLine.includes('aws_access_key_id') || lowerLine.includes('aws_secret_access_key')) &&
+            lowerLine.includes('=') && (trimmedLine.includes("'") || trimmedLine.includes('"')) &&
+            !lowerLine.includes('os.getenv') && !lowerLine.includes('os.environ') &&
+            !lowerLine.includes('getenv')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)({
+                category: 'hardcoded-aws-credentials',
+                severity: 'CRITICAL',
+                confidence: 'HIGH',
+                message: 'AWS credentials hardcoded in source code',
+                line: index + 1,
+                suggestion: 'Use AWS IAM roles, environment variables, or AWS credentials file',
+                owasp: 'A02:2025',
+                cwe: 'CWE-798',
+                pciDss: 'Requirement 3.4',
+                remediation: {
+                    explanation: 'Hardcoded AWS credentials provide full access to cloud resources',
+                    before: 'aws_access_key_id = "AKIA1234567890"',
+                    after: 'aws_access_key_id = os.environ.get("AWS_ACCESS_KEY_ID")'
+                },
+                attackVector: {
+                    description: 'AWS credential exposure enables complete cloud infrastructure compromise',
+                    realWorldImpact: [
+                        'Complete AWS account takeover',
+                        'Data exfiltration from S3 buckets',
+                        'EC2 instance compromise',
+                        'Unauthorized resource provisioning and billing'
+                    ]
+                }
+            }));
+        }
+        // Check #7: Database credentials exposed
+        if ((lowerLine.includes('database') || lowerLine.includes('db_password') ||
+            lowerLine.includes('db_user') || lowerLine.includes('connection_string')) &&
+            lowerLine.includes('=') && (trimmedLine.includes("'") || trimmedLine.includes('"')) &&
+            !lowerLine.includes('os.environ') && !lowerLine.includes('getenv')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)({
+                category: 'hardcoded-database-credentials',
+                severity: 'CRITICAL',
+                confidence: 'MEDIUM',
+                message: 'Database credentials may be hardcoded in source code',
+                line: index + 1,
+                suggestion: 'Use environment variables or secure configuration files for database credentials',
+                owasp: 'A02:2025',
+                cwe: 'CWE-798',
+                pciDss: 'Requirement 3.4',
+                remediation: {
+                    explanation: 'Hardcoded database credentials expose sensitive data access',
+                    before: 'DB_PASSWORD = "secretpassword123"',
+                    after: 'DB_PASSWORD = os.environ.get("DB_PASSWORD")'
+                },
+                attackVector: {
+                    description: 'Database credential exposure enables unauthorized data access',
+                    realWorldImpact: [
+                        'Complete database access and data theft',
+                        'Customer data exposure (PII, financial)',
+                        'Data manipulation and deletion',
+                        'Compliance violations (GDPR, HIPAA)'
+                    ]
+                }
+            }));
+        }
+        // Check #8A: Traceback usage (standalone - may expose sensitive information)
+        if ((lowerLine.includes('traceback.print_exc') ||
+            lowerLine.includes('traceback.format_exc')) &&
+            !trimmedLine.startsWith('#')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)({
+                category: 'python-exception-traceback',
+                severity: 'MEDIUM',
+                confidence: 'MEDIUM',
+                message: 'Detailed error information may be exposed to users',
+                line: index + 1,
+                suggestion: 'Use logging.exception() for server-side logs instead of traceback output',
+                owasp: 'A10:2025',
+                cwe: 'CWE-209',
+                pciDss: 'Requirement 6.5.5',
+                remediation: {
+                    explanation: 'Traceback output reveals internal application structure and file paths',
+                    before: 'traceback.print_exc()',
+                    after: 'logging.exception("Error occurred")  # Server-side only'
+                },
+                attackVector: {
+                    description: 'Traceback exposure reveals file paths and internal logic',
+                    realWorldImpact: [
+                        'Internal file path disclosure',
+                        'Application architecture fingerprinting',
+                        'Stack trace information leakage'
+                    ]
+                }
+            }));
+        }
+        // Check #8B: exc_info=True usage (may expose detailed error information)
+        if (lowerLine.includes('exc_info') &&
+            (lowerLine.includes('true') || lowerLine.includes('1')) &&
+            !trimmedLine.startsWith('#')) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)({
+                category: 'python-exception-traceback',
+                severity: 'MEDIUM',
+                confidence: 'MEDIUM',
+                message: 'Detailed error information may be exposed to users',
+                line: index + 1,
+                suggestion: 'Ensure exc_info logs are server-side only and not exposed to users',
+                owasp: 'A10:2025',
+                cwe: 'CWE-209',
+                pciDss: 'Requirement 6.5.5',
+                remediation: {
+                    explanation: 'exc_info=True includes full stack traces in logs which may be exposed',
+                    before: 'logger.exception("error", exc_info=True)',
+                    after: 'logging.exception("error")  # Includes traceback by default, server-side only'
+                },
+                attackVector: {
+                    description: 'Exception info exposure reveals internal errors and stack traces',
+                    realWorldImpact: [
+                        'Stack trace disclosure',
+                        'Internal error message exposure',
+                        'Debug information leakage'
+                    ]
+                }
+            }));
+        }
+        // Check #8: Detailed error responses in production
+        // Only flag if detailed errors are exposed in HTTP responses, not standalone logging
+        const hasDetailedError = (lowerLine.includes('traceback') || lowerLine.includes('exc_info')) &&
+            (lowerLine.includes('true') || lowerLine.includes('1'));
+        const isHttpResponse = lowerLine.includes('return') ||
+            lowerLine.includes('jsonify') ||
+            lowerLine.includes('render_template') ||
+            lowerLine.includes('httpresponse');
+        // Standalone logging is fine (logging.error(..., exc_info=True))
+        // Only flag if errors are exposed in HTTP responses
+        if (hasDetailedError && isHttpResponse) {
+            vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)({
+                category: 'Security Misconfiguration',
+                severity: 'MEDIUM',
+                confidence: 'MEDIUM',
+                message: 'Detailed error information may be exposed to users',
+                line: index + 1,
+                suggestion: 'Log detailed errors server-side, return generic messages to users',
+                owasp: 'A02:2025',
+                cwe: 'CWE-209',
+                pciDss: 'Requirement 6.1',
+                remediation: {
+                    explanation: 'Detailed error messages reveal internal application structure',
+                    before: 'return jsonify({"error": traceback.format_exc()})',
+                    after: 'logging.exception("Internal error occurred"); return jsonify({"error": "Internal server error"})'
+                },
+                attackVector: {
+                    description: 'Error messages can reveal file paths, database schemas, and internal logic',
+                    realWorldImpact: [
+                        'Internal file path disclosure',
+                        'Database schema revelation',
+                        'Third-party library version exposure',
+                        'Application architecture fingerprinting'
+                    ]
+                }
+            }));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=security-misconfiguration.js.map

package/dist/src/lib/analyzers/python/security-checks/security-misconfiguration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-misconfiguration.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/security-misconfiguration.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAqBH,sEAiYC;AAnZD,sEAAiF;AAEjF;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,6BAA6B,CAC3C,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,kFAAkF;QAClF,MAAM,cAAc,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,8BAA8B;gBAC9B,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,8DAA8D;gBAC9D,MAAM,gBAAgB,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBAC7G,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,4CAA4C;oBAC5C,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO,CAAC,iBAAiB;YAC3B,CAAC;iBAAM,CAAC;gBACN,4BAA4B;gBAC5B,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO,CAAC,iBAAiB;YAC3B,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,sCAAsC;QACtC,oFAAoF;QACpF,gGAAgG;QAChG,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpF,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;YACrE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC9B,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAE,4BAA4B;YAClG,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAAC;gBAChC,QAAQ,EAAE,2BAA2B;gBACrC,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,yCAAyC;gBAClD,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,UAAU,EAAE,+DAA+D;gBAC3E,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE;oBACX,WAAW,EAAE,kGAAkG;oBAC/G,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,uDAAuD;iBAC/D;gBACD,YAAY,EAAE;oBACZ,WAAW,EAAE,iEAAiE;oBAC9E,eAAe,EAAE;wBACf,wCAAwC;wBACxC,+CAA+C;wBAC/C,+CAA+C;wBAC/C,iDAAiD;qBAClD;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,2DAA2D;QAC3D,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1F,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;YACrE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACzE,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAAC;gBAChC,QAAQ,EAAE,2BAA2B;gBACrC,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,wCAAwC;gBACjD,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,UAAU,EAAE,2CAA2C;gBACvD,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE;oBACX,WAAW,EAAE,8EAA8E;oBAC3F,MAAM,EAAE,qBAAqB;oBAC7B,KAAK,EAAE,oEAAoE;iBAC5E;gBACD,YAAY,EAAE;oBACZ,WAAW,EAAE,iFAAiF;oBAC9F,eAAe,EAAE;wBACf,wCAAwC;wBACxC,sCAAsC;wBACtC,qCAAqC;wBACrC,gCAAgC;qBACjC;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,qGAAqG;QACrG,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC3D,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAClE,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/E,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAAC;gBAChC,QAAQ,EAAE,2BAA2B;gBACrC,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,4CAA4C;gBACrD,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,UAAU,EAAE,wDAAwD;gBACpE,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE;oBACX,WAAW,EAAE,uEAAuE;oBACpF,MAAM,EAAE,8CAA8C;oBACtD,KAAK,EAAE,2CAA2C;iBACnD;gBACD,YAAY,EAAE;oBACZ,WAAW,EAAE,8DAA8D;oBAC3E,eAAe,EAAE;wBACf,+BAA+B;wBAC/B,kCAAkC;wBAClC,mCAAmC;wBACnC,qCAAqC;qBACtC;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;YACxF,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnF,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvE,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAAC;gBAChC,QAAQ,EAAE,2BAA2B;gBACrC,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,2CAA2C;gBACpD,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,UAAU,EAAE,wDAAwD;gBACpE,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE;oBACX,WAAW,EAAE,yEAAyE;oBACtF,MAAM,EAAE,qCAAqC;oBAC7C,KAAK,EAAE,+CAA+C;iBACvD;gBACD,YAAY,EAAE;oBACZ,WAAW,EAAE,sEAAsE;oBACnF,eAAe,EAAE;wBACf,wBAAwB;wBACxB,4BAA4B;wBAC5B,wBAAwB;wBACxB,8BAA8B;qBAC/B;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC9D,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7F,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAAC;gBAChC,QAAQ,EAAE,2BAA2B;gBACrC,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,wDAAwD;gBACjE,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,UAAU,EAAE,mEAAmE;gBAC/E,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE;oBACX,WAAW,EAAE,wDAAwD;oBACrE,MAAM,EAAE,uBAAuB;oBAC/B,KAAK,EAAE,0DAA0D;iBAClE;gBACD,YAAY,EAAE;oBACZ,WAAW,EAAE,mFAAmF;oBAChG,eAAe,EAAE;wBACf,+BAA+B;wBAC/B,yBAAyB;wBACzB,uBAAuB;wBACvB,0BAA0B;qBAC3B;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,oFAAoF;QACpF,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;YACxF,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnF,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;YACrE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAAC;gBAChC,QAAQ,EAAE,2BAA2B;gBACrC,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,0CAA0C;gBACnD,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,UAAU,EAAE,mEAAmE;gBAC/E,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE;oBACX,WAAW,EAAE,kEAAkE;oBAC/E,MAAM,EAAE,sCAAsC;oBAC9C,KAAK,EAAE,yDAAyD;iBACjE;gBACD,YAAY,EAAE;oBACZ,WAAW,EAAE,0EAA0E;oBACvF,eAAe,EAAE;wBACf,+BAA+B;wBAC/B,mCAAmC;wBACnC,yBAAyB;wBACzB,gDAAgD;qBACjD;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;YACnE,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAC1E,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnF,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvE,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAAC;gBAChC,QAAQ,EAAE,gCAAgC;gBAC1C,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE,sDAAsD;gBAC/D,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,UAAU,EAAE,kFAAkF;gBAC9F,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE;oBACX,WAAW,EAAE,6DAA6D;oBAC1E,MAAM,EAAE,mCAAmC;oBAC3C,KAAK,EAAE,6CAA6C;iBACrD;gBACD,YAAY,EAAE;oBACZ,WAAW,EAAE,+DAA+D;oBAC5E,eAAe,EAAE;wBACf,yCAAyC;wBACzC,yCAAyC;wBACzC,gCAAgC;wBAChC,qCAAqC;qBACtC;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACzC,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YAC5C,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAAC;gBAChC,QAAQ,EAAE,4BAA4B;gBACtC,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE,oDAAoD;gBAC7D,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,UAAU,EAAE,0EAA0E;gBACtF,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,mBAAmB;gBAC3B,WAAW,EAAE;oBACX,WAAW,EAAE,wEAAwE;oBACrF,MAAM,EAAE,uBAAuB;oBAC/B,KAAK,EAAE,yDAAyD;iBACjE;gBACD,YAAY,EAAE;oBACZ,WAAW,EAAE,0DAA0D;oBACvE,eAAe,EAAE;wBACf,+BAA+B;wBAC/B,yCAAyC;wBACzC,iCAAiC;qBAClC;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC9B,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAAC;gBAChC,QAAQ,EAAE,4BAA4B;gBACtC,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE,oDAAoD;gBAC7D,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,UAAU,EAAE,oEAAoE;gBAChF,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,mBAAmB;gBAC3B,WAAW,EAAE;oBACX,WAAW,EAAE,uEAAuE;oBACpF,MAAM,EAAE,0CAA0C;oBAClD,KAAK,EAAE,+EAA+E;iBACvF;gBACD,YAAY,EAAE;oBACZ,WAAW,EAAE,kEAAkE;oBAC/E,eAAe,EAAE;wBACf,wBAAwB;wBACxB,iCAAiC;wBACjC,2BAA2B;qBAC5B;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,qFAAqF;QACrF,MAAM,gBAAgB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACnE,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5B,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC7B,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACrC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAE1D,iEAAiE;QACjE,oDAAoD;QACpD,IAAI,gBAAgB,IAAI,cAAc,EAAE,CAAC;YACvC,eAAe,CAAC,IAAI,CAClB,IAAA,uDAAiC,EAAC;gBAChC,QAAQ,EAAE,2BAA2B;gBACrC,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE,oDAAoD;gBAC7D,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,UAAU,EAAE,mEAAmE;gBAC/E,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE;oBACX,WAAW,EAAE,+DAA+D;oBAC5E,MAAM,EAAE,mDAAmD;oBAC3D,KAAK,EAAE,kGAAkG;iBAC1G;gBACD,YAAY,EAAE;oBACZ,WAAW,EAAE,4EAA4E;oBACzF,eAAe,EAAE;wBACf,+BAA+B;wBAC/B,4BAA4B;wBAC5B,sCAAsC;wBACtC,yCAAyC;qBAC1C;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;IAEH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/python/security-checks/ssrf-detection.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Python SSRF (Server-Side Request Forgery) Security Checks
+ * OWASP A10:2021 - Server-Side Request Forgery (CWE-918)
+ *
+ * Detects SSRF vulnerabilities where user input controls URLs in HTTP requests,
+ * allowing attackers to access internal services, cloud metadata, or arbitrary hosts.
+ *
+ * Created: 2025-12-18 (Phase 0 - Priority 0 Critical Gap)
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for SSRF vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #40: requests library with user-controlled URLs (CRITICAL)
+ * - Check #41: urllib with user-controlled URLs (CRITICAL)
+ * - Check #42: httplib/http.client with user input (HIGH)
+ * - Check #43: No URL validation or whitelist (HIGH)
+ * - Check #44: Internal IP access without validation (CRITICAL)
+ *
+ * @param lines - Array of code lines
+ * @param userInputVariables - Map of variable names assigned from user input
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkSSRF(lines: string[], userInputVariables: Map<string, number>): SecurityVulnerability[];
+//# sourceMappingURL=ssrf-detection.d.ts.map

package/dist/src/lib/analyzers/python/security-checks/ssrf-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-detection.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/ssrf-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,MAAM,EAAE,EACf,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,qBAAqB,EAAE,CA2NzB"}

package/dist/src/lib/analyzers/python/security-checks/ssrf-detection.js

@@ -0,0 +1,160 @@
+"use strict";
+/**
+ * Python SSRF (Server-Side Request Forgery) Security Checks
+ * OWASP A10:2021 - Server-Side Request Forgery (CWE-918)
+ *
+ * Detects SSRF vulnerabilities where user input controls URLs in HTTP requests,
+ * allowing attackers to access internal services, cloud metadata, or arbitrary hosts.
+ *
+ * Created: 2025-12-18 (Phase 0 - Priority 0 Critical Gap)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSSRF = checkSSRF;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for SSRF vulnerabilities in Python code
+ *
+ * Covers:
+ * - Check #40: requests library with user-controlled URLs (CRITICAL)
+ * - Check #41: urllib with user-controlled URLs (CRITICAL)
+ * - Check #42: httplib/http.client with user input (HIGH)
+ * - Check #43: No URL validation or whitelist (HIGH)
+ * - Check #44: Internal IP access without validation (CRITICAL)
+ *
+ * @param lines - Array of code lines
+ * @param userInputVariables - Map of variable names assigned from user input
+ * @returns Array of security vulnerabilities found
+ */
+function checkSSRF(lines, userInputVariables) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    // Track URL variables that come from user input
+    const urlVariablesFromInput = new Map(); // variable name -> line number
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // CRITICAL: Track Python triple-quote comment blocks (""" ... """ or ''' ... ''')
+        const hasTripleQuote = trimmed.includes('"""') || trimmed.includes("'''");
+        if (hasTripleQuote) {
+            if (!inMultiLineComment) {
+                inMultiLineComment = true;
+                const tripleQuoteCount = (trimmed.match(/"""/g) || []).length + (trimmed.match(/'''/g) || []).length;
+                if (tripleQuoteCount >= 2) {
+                    inMultiLineComment = false;
+                }
+                return;
+            }
+            else {
+                inMultiLineComment = false;
+                return;
+            }
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('#')) {
+            return;
+        }
+        // Track URL variables from user input
+        // Pattern: url = request.args.get('url') or url = request.form['url']
+        const urlAssignMatch = trimmed.match(/^(\w*url\w*)\s*=\s*request\.(args|form|data|json|values|params|get_json|cookies)/i);
+        if (urlAssignMatch) {
+            const varName = urlAssignMatch[1];
+            urlVariablesFromInput.set(varName, lineNumber);
+        }
+        // =============================================================================
+        // CHECK #40: requests Library with User-Controlled URLs (CRITICAL)
+        // =============================================================================
+        // Pattern: requests.get(url) where url is from user input
+        const requestsMatch = trimmed.match(/requests\.(get|post|put|delete|patch|head|options|request)\s*\(\s*([^)]+)\s*\)/);
+        if (requestsMatch) {
+            const httpMethod = requestsMatch[1];
+            const urlArg = requestsMatch[2].split(',')[0].trim(); // First argument is URL
+            // Check if URL is a user input variable
+            if (userInputVariables.has(urlArg) || urlVariablesFromInput.has(urlArg)) {
+                const userInputLine = userInputVariables.get(urlArg) || urlVariablesFromInput.get(urlArg);
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('ssrf', `SSRF: requests.${httpMethod}() with user-controlled URL '${urlArg}' (line ${userInputLine})`, 'Validate URL against allowlist, block private IPs (127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16)', lineNumber, `Server-Side Request Forgery allows attackers to make the server send HTTP requests to arbitrary URLs. This can access internal services (databases, admin panels), cloud metadata endpoints (AWS EC2: 169.254.169.254), or perform port scanning. Variable '${urlArg}' was assigned from user input on line ${userInputLine}.`, `# Line ${userInputLine}:\nurl = request.args.get('url')  # User controls: "http://169.254.169.254/latest/meta-data/"\n# Line ${lineNumber}:\nresponse = requests.${httpMethod}(url)  # Fetches AWS credentials!`, [
+                    'Access to internal services (databases, Redis, admin panels)',
+                    'Cloud metadata theft (AWS/Azure/GCP credentials)',
+                    'Port scanning of internal network',
+                    'Bypass of firewall restrictions',
+                    'Reading local files via file:// protocol',
+                    'Denial of Service (target external services)'
+                ], `url = request.args.get('url')\nresponse = requests.${httpMethod}(url)  # Vulnerable to SSRF`, `import re\nimport ipaddress\nfrom urllib.parse import urlparse\n\nurl = request.args.get('url')\n\n# Validate URL scheme (only allow http/https)\nparsed = urlparse(url)\nif parsed.scheme not in ['http', 'https']:\n    raise ValueError("Invalid URL scheme")\n\n# Block private IP addresses\nhostname = parsed.hostname\ntry:\n    ip = ipaddress.ip_address(hostname)\n    if ip.is_private or ip.is_loopback or ip.is_link_local:\n        raise ValueError("Private IP addresses not allowed")\nexcept ValueError:\n    pass  # Hostname, not IP\n\n# Whitelist allowed domains\nallowed_domains = ['api.example.com', 'trusted.com']\nif parsed.hostname not in allowed_domains:\n    raise ValueError(f"Domain {parsed.hostname} not in allowlist")\n\nresponse = requests.${httpMethod}(url, timeout=5)  # Safe with validation`, 'Always validate URLs against an allowlist of allowed domains. Block private IP ranges (127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 169.254.0.0/16). Only allow http/https schemes. Set timeouts to prevent hanging.'));
+            }
+            // Check for direct request.args.get() in URL parameter
+            if (urlArg.includes('request.args') || urlArg.includes('request.form') ||
+                urlArg.includes('request.json') || urlArg.includes('request.data')) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('ssrf', `SSRF: requests.${httpMethod}() with direct user input from request`, 'Extract URL to variable and validate against allowlist', lineNumber, 'Passing user input directly to HTTP request functions allows Server-Side Request Forgery attacks. Attackers can access internal services, cloud metadata endpoints, or arbitrary external URLs.', `response = requests.${httpMethod}(request.args.get('url'))  # Direct SSRF`, [
+                    'Access to internal services',
+                    'Cloud metadata theft',
+                    'Port scanning',
+                    'Firewall bypass',
+                    'Local file reading (file:// protocol)'
+                ], `response = requests.${httpMethod}(request.args.get('url'))`, `url = request.args.get('url')\n\n# Validate URL\nallowed_domains = ['api.example.com']\nparsed = urlparse(url)\nif parsed.hostname not in allowed_domains:\n    raise ValueError("Invalid domain")\n\nresponse = requests.${httpMethod}(url, timeout=5)`, 'Always validate URLs before making HTTP requests. Use domain allowlists and block private IP ranges.'));
+            }
+        }
+        // =============================================================================
+        // CHECK #41: urllib with User-Controlled URLs (CRITICAL)
+        // =============================================================================
+        // Pattern: urllib.request.urlopen(url) where url is from user input
+        const urllibMatch = trimmed.match(/urllib\.request\.urlopen\s*\(\s*([^)]+)\s*\)/);
+        if (urllibMatch) {
+            const urlArg = urllibMatch[1].trim();
+            // Check if URL is a user input variable
+            if (userInputVariables.has(urlArg) || urlVariablesFromInput.has(urlArg)) {
+                const userInputLine = userInputVariables.get(urlArg) || urlVariablesFromInput.get(urlArg);
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('ssrf', `SSRF: urllib.request.urlopen() with user-controlled URL '${urlArg}' (line ${userInputLine})`, 'Validate URL against allowlist, block private IPs', lineNumber, `urllib.request.urlopen() with user-controlled URLs allows Server-Side Request Forgery. Attackers can access internal services, cloud metadata, or arbitrary external resources. Variable '${urlArg}' was assigned from user input on line ${userInputLine}.`, `url = request.args.get('url')\nresponse = urllib.request.urlopen(url)  # Can access http://169.254.169.254/`, [
+                    'Internal service access',
+                    'Cloud metadata theft (AWS/Azure/GCP)',
+                    'Port scanning',
+                    'File protocol abuse (file:///etc/passwd)',
+                    'Firewall bypass'
+                ], `import urllib.request\nurl = request.args.get('url')\nresponse = urllib.request.urlopen(url)`, `import urllib.request\nfrom urllib.parse import urlparse\nimport ipaddress\n\nurl = request.args.get('url')\n\n# Validate URL\nparsed = urlparse(url)\nif parsed.scheme not in ['http', 'https']:\n    raise ValueError("Invalid scheme")\n\n# Block private IPs\nhostname = parsed.hostname\ntry:\n    ip = ipaddress.ip_address(hostname)\n    if ip.is_private or ip.is_loopback:\n        raise ValueError("Private IPs not allowed")\nexcept ValueError:\n    pass\n\nresponse = urllib.request.urlopen(url, timeout=5)`, 'Validate URLs with allowlists, block private IP ranges, only allow http/https schemes, set timeouts'));
+            }
+            // Check for direct request input
+            if (urlArg.includes('request.')) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('ssrf', 'SSRF: urllib.request.urlopen() with direct user input', 'Validate URL before making request', lineNumber, 'Direct use of user input in urllib.request.urlopen() enables SSRF attacks', 'urllib.request.urlopen(request.args.get("url"))  # Direct SSRF', [
+                    'Internal service access',
+                    'Cloud metadata theft',
+                    'Port scanning',
+                    'File protocol abuse'
+                ], `urllib.request.urlopen(request.args.get('url'))`, `url = request.args.get('url')\n# Validate URL against allowlist\nif not is_allowed_url(url):\n    raise ValueError("Invalid URL")\nurllib.request.urlopen(url, timeout=5)`, 'Always validate URLs before using urllib.request.urlopen()'));
+            }
+        }
+        // =============================================================================
+        // CHECK #42: httplib/http.client with User Input (HIGH)
+        // =============================================================================
+        // Pattern: httplib.HTTPConnection(host) where host is from user input
+        const httplibMatch = trimmed.match(/(httplib|http\.client)\.(HTTPConnection|HTTPSConnection)\s*\(\s*([^)]+)\s*\)/);
+        if (httplibMatch) {
+            const hostArg = httplibMatch[3].trim();
+            if (userInputVariables.has(hostArg)) {
+                const userInputLine = userInputVariables.get(hostArg);
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('ssrf', `SSRF: HTTP connection with user-controlled host '${hostArg}' (line ${userInputLine})`, 'Validate host against allowlist', lineNumber, `Creating HTTP connections with user-controlled hostnames enables SSRF attacks. Variable '${hostArg}' was assigned from user input on line ${userInputLine}.`, `host = request.args.get('host')\nconn = httplib.HTTPConnection(host)  # Can connect to internal services`, [
+                    'Internal network scanning',
+                    'Access to internal services',
+                    'Cloud metadata access',
+                    'Port enumeration'
+                ], `host = request.args.get('host')\nconn = httplib.HTTPConnection(host)`, `host = request.args.get('host')\n\n# Validate against allowlist\nallowed_hosts = ['api.example.com']\nif host not in allowed_hosts:\n    raise ValueError("Host not allowed")\n\nconn = httplib.HTTPConnection(host, timeout=5)`, 'Validate hostnames against allowlists before creating HTTP connections'));
+            }
+        }
+        // =============================================================================
+        // CHECK #43: URL Construction with User Input (HIGH)
+        // =============================================================================
+        // Pattern: url = "http://api.com/" + user_input (path traversal in URLs)
+        if (trimmed.match(/url\w*\s*=.*["']https?:\/\//) &&
+            (trimmed.includes('+') || trimmed.includes('f"') || trimmed.includes("f'"))) {
+            // Check if line contains user input variables
+            const hasUserInput = Array.from(userInputVariables.keys()).some(varName => trimmed.includes(varName));
+            if (hasUserInput) {
+                vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('ssrf', 'SSRF: URL constructed with user input via string concatenation', 'Validate input, use URL parsing libraries to prevent manipulation', lineNumber, 'Constructing URLs by concatenating user input can lead to SSRF if attackers inject special characters or path traversal sequences to change the target host.', 'url = f"http://api.internal.com/{user_path}"  # user_path = "../../../169.254.169.254/meta-data/"', [
+                    'URL manipulation to internal services',
+                    'Path traversal in URLs',
+                    'Host header injection',
+                    'Access to unintended endpoints'
+                ], `url = f"http://api.internal.com/{user_path}"\nresponse = requests.get(url)`, `from urllib.parse import urljoin, urlparse\n\nbase_url = "http://api.internal.com/"\nuser_path = request.args.get('path')\n\n# Build URL safely\nurl = urljoin(base_url, user_path)\n\n# Validate final URL is still on same host\nparsed = urlparse(url)\nif parsed.hostname != 'api.internal.com':\n    raise ValueError("URL manipulation detected")\n\nresponse = requests.get(url, timeout=5)`, 'Use urllib.parse.urljoin() for safe URL construction. Validate final URL hostname matches expected domain.'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=ssrf-detection.js.map

package/dist/src/lib/analyzers/python/security-checks/ssrf-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-detection.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/ssrf-detection.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAmBH,8BA8NC;AA9OD,sEAAiF;AAEjF;;;;;;;;;;;;;GAaG;AACH,SAAgB,SAAS,CACvB,KAAe,EACf,kBAAuC;IAEvC,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,gDAAgD;IAChD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,+BAA+B;IAExF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,kFAAkF;QAClF,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACrG,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO;YACT,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO;YACT,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,sEAAsE;QACtE,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC1H,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAClC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QAED,gFAAgF;QAChF,mEAAmE;QACnE,gFAAgF;QAChF,0DAA0D;QAE1D,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACtH,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,wBAAwB;YAE9E,wCAAwC;YACxC,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxE,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;gBAC3F,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,MAAM,EACN,kBAAkB,UAAU,gCAAgC,MAAM,WAAW,aAAa,GAAG,EAC7F,6FAA6F,EAC7F,UAAU,EACV,+PAA+P,MAAM,0CAA0C,aAAa,GAAG,EAC/T,UAAU,aAAa,yGAAyG,UAAU,0BAA0B,UAAU,mCAAmC,EACjN;oBACE,8DAA8D;oBAC9D,kDAAkD;oBAClD,mCAAmC;oBACnC,iCAAiC;oBACjC,0CAA0C;oBAC1C,8CAA8C;iBAC/C,EACD,sDAAsD,UAAU,6BAA6B,EAC7F,wvBAAwvB,UAAU,0CAA0C,EAC5yB,kNAAkN,CACnN,CAAC,CAAC;YACL,CAAC;YAED,uDAAuD;YACvD,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAClE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvE,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,MAAM,EACN,kBAAkB,UAAU,wCAAwC,EACpE,wDAAwD,EACxD,UAAU,EACV,iMAAiM,EACjM,uBAAuB,UAAU,0CAA0C,EAC3E;oBACE,6BAA6B;oBAC7B,sBAAsB;oBACtB,eAAe;oBACf,iBAAiB;oBACjB,uCAAuC;iBACxC,EACD,uBAAuB,UAAU,2BAA2B,EAC5D,6NAA6N,UAAU,kBAAkB,EACzP,sGAAsG,CACvG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,yDAAyD;QACzD,gFAAgF;QAChF,oEAAoE;QAEpE,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClF,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAErC,wCAAwC;YACxC,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxE,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;gBAC3F,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,MAAM,EACN,4DAA4D,MAAM,WAAW,aAAa,GAAG,EAC7F,mDAAmD,EACnD,UAAU,EACV,6LAA6L,MAAM,0CAA0C,aAAa,GAAG,EAC7P,6GAA6G,EAC7G;oBACE,yBAAyB;oBACzB,sCAAsC;oBACtC,eAAe;oBACf,0CAA0C;oBAC1C,iBAAiB;iBAClB,EACD,8FAA8F,EAC9F,8fAA8f,EAC9f,qGAAqG,CACtG,CAAC,CAAC;YACL,CAAC;YAED,iCAAiC;YACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,MAAM,EACN,uDAAuD,EACvD,oCAAoC,EACpC,UAAU,EACV,2EAA2E,EAC3E,gEAAgE,EAChE;oBACE,yBAAyB;oBACzB,sBAAsB;oBACtB,eAAe;oBACf,qBAAqB;iBACtB,EACD,iDAAiD,EACjD,2KAA2K,EAC3K,4DAA4D,CAC7D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,wDAAwD;QACxD,gFAAgF;QAChF,sEAAsE;QAEtE,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;QACnH,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAEvC,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;gBACvD,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,MAAM,EACN,oDAAoD,OAAO,WAAW,aAAa,GAAG,EACtF,iCAAiC,EACjC,UAAU,EACV,4FAA4F,OAAO,0CAA0C,aAAa,GAAG,EAC7J,0GAA0G,EAC1G;oBACE,2BAA2B;oBAC3B,6BAA6B;oBAC7B,uBAAuB;oBACvB,kBAAkB;iBACnB,EACD,sEAAsE,EACtE,iOAAiO,EACjO,wEAAwE,CACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,qDAAqD;QACrD,gFAAgF;QAChF,yEAAyE;QAEzE,IAAI,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC;YAC5C,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChF,8CAA8C;YAC9C,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACxE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC1B,CAAC;YAEF,IAAI,YAAY,EAAE,CAAC;gBACjB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,MAAM,EACN,gEAAgE,EAChE,mEAAmE,EACnE,UAAU,EACV,8JAA8J,EAC9J,mGAAmG,EACnG;oBACE,uCAAuC;oBACvC,wBAAwB;oBACxB,uBAAuB;oBACvB,gCAAgC;iBACjC,EACD,4EAA4E,EAC5E,oYAAoY,EACpY,4GAA4G,CAC7G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}