codeslick-cli 1.0.0

package/dist/src/lib/analyzers/security-checks/python-async-security.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * Python Async/Await Security Checks Module
+ *
+ * Security vulnerability detection for Python async/await patterns.
+ * Detects missing await keywords and asyncio.run() misuse.
+ *
+ * @module python-async-security
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAsyncFunctionStart = isAsyncFunctionStart;
+exports.isAsyncFunctionEnd = isAsyncFunctionEnd;
+exports.detectMissingAwait = detectMissingAwait;
+exports.detectAsyncioRunMisuse = detectAsyncioRunMisuse;
+/**
+ * Check if line starts an async function definition
+ *
+ * @param line - The code line to check
+ * @returns true if line starts async function
+ */
+function isAsyncFunctionStart(line) {
+    return line.trim().match(/\basync\s+def\s+\w+/) !== null;
+}
+/**
+ * Check if line ends async function context (dedent back to module level)
+ *
+ * @param line - The code line to check
+ * @param prevIndent - Previous function body indent level
+ * @returns true if async context should end
+ */
+function isAsyncFunctionEnd(line, prevIndent) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#'))
+        return false;
+    const currentIndent = line.length - line.trimStart().length;
+    // CRITICAL FIX: Don't end on async def lines (they start a NEW async context)
+    if (trimmed.startsWith('async def'))
+        return false;
+    // End when we dedent back to module level (currentIndent < prevIndent)
+    // This includes regular 'def' at module level, class definitions, etc.
+    return currentIndent < prevIndent && trimmed.match(/^\w/) !== null;
+}
+/**
+ * Detect missing await on async function calls
+ *
+ * @param line - The code line to check
+ * @param lineNumber - The line number
+ * @param inAsyncContext - Whether we're inside an async function
+ * @param createVulnerability - Function to create vulnerability object
+ * @returns SecurityVulnerability if detected, null otherwise
+ */
+function detectMissingAwait(line, lineNumber, inAsyncContext, createVulnerability) {
+    if (!inAsyncContext)
+        return null;
+    const trimmed = line.trim();
+    // Check for assignment from function call
+    const hasAsyncCall = trimmed.match(/=\s*(fetch_|get_|query_|save_|update_|delete_|create_|process_|send_|request_)\w*\s*\(/);
+    const hasAwait = trimmed.includes('await ');
+    const isFunctionDef = trimmed.includes('def ');
+    if (hasAsyncCall && !hasAwait && !isFunctionDef) {
+        return createVulnerability('async-await-missing', 'Missing await on potentially async function call', 'Add await keyword before async function calls', lineNumber, 'Calling an async function without await causes the function to return a coroutine object instead of the expected result, leading to silent failures where code appears to run but does nothing.', 'result = fetch_user_data()  # Returns coroutine, not user data', [
+            'Silent failures (no error, no result)',
+            'Data not saved/updated',
+            'Security checks bypassed',
+            'Logic errors',
+            'Hard to debug issues'
+        ], 'user = get_user_by_id(user_id)', 'user = await get_user_by_id(user_id)', 'Always use await with async functions - missing await causes silent failures');
+    }
+    return null;
+}
+/**
+ * Detect asyncio.run() called inside async function
+ *
+ * @param line - The code line to check
+ * @param lineNumber - The line number
+ * @param inAsyncContext - Whether we're inside an async function
+ * @param createVulnerability - Function to create vulnerability object
+ * @returns SecurityVulnerability if detected, null otherwise
+ */
+function detectAsyncioRunMisuse(line, lineNumber, inAsyncContext, createVulnerability) {
+    const trimmed = line.trim();
+    if (trimmed.includes('asyncio.run(') && inAsyncContext) {
+        return createVulnerability('asyncio-run-misuse', 'asyncio.run() called inside async function', 'Use await directly or use asyncio.create_task()', lineNumber, 'asyncio.run() creates a new event loop and cannot be called from within an async function that is already running in an event loop. This causes a RuntimeError.', 'async def process(): asyncio.run(fetch_data())  # RuntimeError', [
+            'RuntimeError crashes',
+            'Application failure',
+            'Event loop conflicts',
+            'Deadlocks'
+        ], 'async def process_data():\n    result = asyncio.run(fetch_data())', 'async def process_data():\n    result = await fetch_data()', 'Inside async functions, use await - asyncio.run() is only for top-level entry points');
+    }
+    return null;
+}
+//# sourceMappingURL=python-async-security.js.map

package/dist/src/lib/analyzers/security-checks/python-async-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-async-security.js","sourceRoot":"","sources":["../../../../../../../src/lib/analyzers/security-checks/python-async-security.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAuBH,oDAEC;AASD,gDAYC;AAWD,gDAqCC;AAWD,wDA6BC;AArHD;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,IAAY,EAAE,UAAkB;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;IAE5D,8EAA8E;IAC9E,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAElD,uEAAuE;IACvE,uEAAuE;IACvE,OAAO,aAAa,GAAG,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAChC,IAAY,EACZ,UAAkB,EAClB,cAAuB,EACvB,mBAA0C;IAE1C,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAE5B,0CAA0C;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC7H,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/C,IAAI,YAAY,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;QAChD,OAAO,mBAAmB,CACxB,qBAAqB,EACrB,kDAAkD,EAClD,+CAA+C,EAC/C,UAAU,EACV,iMAAiM,EACjM,gEAAgE,EAChE;YACE,uCAAuC;YACvC,wBAAwB;YACxB,0BAA0B;YAC1B,cAAc;YACd,sBAAsB;SACvB,EACD,gCAAgC,EAChC,sCAAsC,EACtC,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,sBAAsB,CACpC,IAAY,EACZ,UAAkB,EAClB,cAAuB,EACvB,mBAA0C;IAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,EAAE,CAAC;QACvD,OAAO,mBAAmB,CACxB,oBAAoB,EACpB,4CAA4C,EAC5C,iDAAiD,EACjD,UAAU,EACV,iKAAiK,EACjK,gEAAgE,EAChE;YACE,sBAAsB;YACtB,qBAAqB;YACrB,sBAAsB;YACtB,WAAW;SACZ,EACD,mEAAmE,EACnE,4DAA4D,EAC5D,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/lib/analyzers/security-checks/react-security.d.ts

@@ -0,0 +1,49 @@
+/**
+ * React Security Checks Module
+ *
+ * Security vulnerability detection for React-specific patterns.
+ * Detects XSS vulnerabilities, performance issues, and state management problems.
+ *
+ * @module react-security
+ */
+import { SecurityVulnerability } from '../types';
+export type CreateVulnerabilityFn = (category: string, message: string, suggestion: string, line: number, description: string, exploitExample: string, realWorldImpact: string[], before: string, after: string, explanation: string) => SecurityVulnerability;
+/**
+ * Detects dangerouslySetInnerHTML usage which can cause XSS
+ *
+ * @param line - The code line to check
+ * @param lineNumber - The line number
+ * @param createVulnerability - Function to create vulnerability object
+ * @returns SecurityVulnerability if detected, null otherwise
+ */
+export declare function detectDangerouslySetInnerHTML(line: string, lineNumber: number, createVulnerability: CreateVulnerabilityFn): SecurityVulnerability | null;
+/**
+ * Detects missing key prop in React list rendering
+ *
+ * @param line - The code line to check
+ * @param lineNumber - The line number
+ * @param lines - All code lines (for multi-line JSX check)
+ * @param index - Current line index
+ * @param createVulnerability - Function to create vulnerability object
+ * @returns SecurityVulnerability if detected, null otherwise
+ */
+export declare function detectMissingKeyProp(line: string, lineNumber: number, lines: string[], index: number, createVulnerability: CreateVulnerabilityFn): SecurityVulnerability | null;
+/**
+ * Detects unsafe href attributes with user input (XSS risk)
+ *
+ * @param line - The code line to check
+ * @param lineNumber - The line number
+ * @param createVulnerability - Function to create vulnerability object
+ * @returns SecurityVulnerability if detected, null otherwise
+ */
+export declare function detectUnsafeHref(line: string, lineNumber: number, createVulnerability: CreateVulnerabilityFn): SecurityVulnerability | null;
+/**
+ * Detects direct React state mutation (anti-pattern)
+ *
+ * @param line - The code line to check
+ * @param lineNumber - The line number
+ * @param createVulnerability - Function to create vulnerability object
+ * @returns SecurityVulnerability if detected, null otherwise
+ */
+export declare function detectStateMutation(line: string, lineNumber: number, createVulnerability: CreateVulnerabilityFn): SecurityVulnerability | null;
+//# sourceMappingURL=react-security.d.ts.map

package/dist/src/lib/analyzers/security-checks/react-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-security.d.ts","sourceRoot":"","sources":["../../../../../../../src/lib/analyzers/security-checks/react-security.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,MAAM,MAAM,qBAAqB,GAAG,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,EAAE,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,KAChB,qBAAqB,CAAC;AAE3B;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,mBAAmB,EAAE,qBAAqB,GACzC,qBAAqB,GAAG,IAAI,CAwB9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EAAE,EACf,KAAK,EAAE,MAAM,EACb,mBAAmB,EAAE,qBAAqB,GACzC,qBAAqB,GAAG,IAAI,CA+B9B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,mBAAmB,EAAE,qBAAqB,GACzC,qBAAqB,GAAG,IAAI,CAmC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,mBAAmB,EAAE,qBAAqB,GACzC,qBAAqB,GAAG,IAAI,CAwC9B"}

package/dist/src/lib/analyzers/security-checks/react-security.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * React Security Checks Module
+ *
+ * Security vulnerability detection for React-specific patterns.
+ * Detects XSS vulnerabilities, performance issues, and state management problems.
+ *
+ * @module react-security
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectDangerouslySetInnerHTML = detectDangerouslySetInnerHTML;
+exports.detectMissingKeyProp = detectMissingKeyProp;
+exports.detectUnsafeHref = detectUnsafeHref;
+exports.detectStateMutation = detectStateMutation;
+/**
+ * Detects dangerouslySetInnerHTML usage which can cause XSS
+ *
+ * @param line - The code line to check
+ * @param lineNumber - The line number
+ * @param createVulnerability - Function to create vulnerability object
+ * @returns SecurityVulnerability if detected, null otherwise
+ */
+function detectDangerouslySetInnerHTML(line, lineNumber, createVulnerability) {
+    const trimmed = line.trim();
+    if (trimmed.match(/dangerouslySetInnerHTML\s*=\s*{{/)) {
+        return createVulnerability('xss', 'React dangerouslySetInnerHTML can cause XSS', 'Sanitize with DOMPurify or use safer alternatives', lineNumber, 'React\'s dangerouslySetInnerHTML bypasses XSS protection and directly sets HTML, making it vulnerable if content is not sanitized.', '<div dangerouslySetInnerHTML={{__html: userComment}} /> where userComment = "<img src=x onerror=alert(document.cookie)>"', [
+            'XSS attacks in React applications',
+            'Session hijacking',
+            'Credential theft',
+            'DOM-based XSS'
+        ], '<div dangerouslySetInnerHTML={{__html: userContent}} />', 'import DOMPurify from "dompurify";\n<div dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(userContent)}} />', 'Always sanitize HTML with DOMPurify before using dangerouslySetInnerHTML, or avoid it entirely');
+    }
+    return null;
+}
+/**
+ * Detects missing key prop in React list rendering
+ *
+ * @param line - The code line to check
+ * @param lineNumber - The line number
+ * @param lines - All code lines (for multi-line JSX check)
+ * @param index - Current line index
+ * @param createVulnerability - Function to create vulnerability object
+ * @returns SecurityVulnerability if detected, null otherwise
+ */
+function detectMissingKeyProp(line, lineNumber, lines, index, createVulnerability) {
+    const trimmed = line.trim();
+    // Only detect if map with JSX and no key= in the same line or next 2 lines
+    if (trimmed.match(/\.map\s*\(\s*\(?\w+\)?\s*=>\s*</) && !trimmed.includes('key=')) {
+        // Check next 2 lines for key prop (multi-line JSX)
+        const hasKeyInNextLines = (index + 1 < lines.length && lines[index + 1].includes('key=')) ||
+            (index + 2 < lines.length && lines[index + 2].includes('key='));
+        if (!hasKeyInNextLines) {
+            return createVulnerability('react-performance', 'Missing key prop in React list rendering', 'Add unique key prop to list items', lineNumber, 'React uses keys to identify elements in lists. Missing keys cause inefficient re-renders, potential bugs with component state, and poor performance.', '{items.map(item => <div>{item.name}</div>)} causes React to re-render all items when one changes', [
+                'Performance degradation (full list re-render)',
+                'Loss of component state',
+                'Incorrect DOM updates',
+                'Poor user experience'
+            ], '{items.map(item => <div>{item.name}</div>)}', '{items.map(item => <div key={item.id}>{item.name}</div>)}', 'Always use stable, unique keys (IDs) in React lists - never use array index as key');
+        }
+    }
+    return null;
+}
+/**
+ * Detects unsafe href attributes with user input (XSS risk)
+ *
+ * @param line - The code line to check
+ * @param lineNumber - The line number
+ * @param createVulnerability - Function to create vulnerability object
+ * @returns SecurityVulnerability if detected, null otherwise
+ */
+function detectUnsafeHref(line, lineNumber, createVulnerability) {
+    const trimmed = line.trim();
+    // Pattern 1: props., request., params., query., userInput
+    // Pattern 2: destructured props like {url}, {link}, {redirect}, {path}
+    const hasPropsPattern = trimmed.match(/href\s*=\s*{[^}]*\b(props\.|userInput|user\.|request\.|params\.|query\.)/);
+    const hasDestructuredParam = trimmed.match(/href\s*=\s*{\s*(url|link|redirect|path|src|href)\s*}/);
+    if (hasPropsPattern || hasDestructuredParam) {
+        // Exclude if using sanitization function or static string
+        const isSanitized = trimmed.match(/href\s*=\s*{\s*(sanitize|validate|safe)/i);
+        const isStaticUrl = trimmed.match(/href\s*=\s*"(https?:\/\/|\/)/);
+        if (!isSanitized && !isStaticUrl) {
+            return createVulnerability('xss', 'Unsafe href attribute can cause XSS via javascript: protocol', 'Sanitize URLs or use rel="noopener noreferrer"', lineNumber, 'User-controlled href attributes can execute JavaScript using javascript: or data: protocols, leading to XSS attacks.', '<a href={userInput}> where userInput = "javascript:alert(document.cookie)"', [
+                'XSS via javascript: protocol',
+                'Session hijacking',
+                'Credential theft',
+                'Phishing attacks'
+            ], '<a href={props.url}>Click here</a>', 'const sanitizeUrl = (url) => {\n  if (url.startsWith("http://") || url.startsWith("https://")) return url;\n  return "#";\n};\n<a href={sanitizeUrl(props.url)} rel="noopener noreferrer">Click here</a>', 'Validate URLs start with http:// or https://, or use a URL sanitization library');
+        }
+    }
+    return null;
+}
+/**
+ * Detects direct React state mutation (anti-pattern)
+ *
+ * @param line - The code line to check
+ * @param lineNumber - The line number
+ * @param createVulnerability - Function to create vulnerability object
+ * @returns SecurityVulnerability if detected, null otherwise
+ */
+function detectStateMutation(line, lineNumber, createVulnerability) {
+    const trimmed = line.trim();
+    // Pattern 1: this.state.prop = value (assignment)
+    // Pattern 2: this.state.array.push() (mutation methods)
+    // Pattern 3: this.state.array[index] = value (array mutation)
+    const hasDirectAssignment = trimmed.match(/this\.state\.\w+\s*=(?!=)/) || trimmed.match(/\w+State\.\w+\s*=(?!=)/);
+    const hasMutationMethod = trimmed.match(/this\.state\.\w+\.(push|pop|shift|unshift|splice|sort|reverse)\s*\(/);
+    const hasArrayMutation = trimmed.match(/this\.state\.\w+\[\w+\]\s*=/);
+    const hasDirectMutation = hasDirectAssignment || hasMutationMethod || hasArrayMutation;
+    if (hasDirectMutation) {
+        // Exclude setState calls, comparisons, and function definitions
+        const isSetStateCall = trimmed.includes('setState(');
+        const isComparison = trimmed.includes('===') || trimmed.includes('!==');
+        const isFunctionDef = trimmed.includes('=>') || trimmed.match(/function\s+\w+\s*\(/);
+        if (!isSetStateCall && !isComparison && !isFunctionDef) {
+            return createVulnerability('react-state-mutation', 'Direct state mutation in React', 'Use setState() or state setter functions', lineNumber, 'Directly mutating state in React bypasses React\'s change detection, causing bugs where UI doesn\'t update even though state changed.', 'this.state.count = 5 does not trigger re-render', [
+                'UI not updating (stale renders)',
+                'Component state inconsistency',
+                'Difficult to debug issues',
+                'Broken React lifecycle'
+            ], 'this.state.count = this.state.count + 1;', 'this.setState({ count: this.state.count + 1 });', 'Never mutate state directly - always use setState() or state setter functions from useState()');
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=react-security.js.map

package/dist/src/lib/analyzers/security-checks/react-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-security.js","sourceRoot":"","sources":["../../../../../../../src/lib/analyzers/security-checks/react-security.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAyBH,sEA4BC;AAYD,oDAqCC;AAUD,4CAuCC;AAUD,kDA4CC;AA5LD;;;;;;;GAOG;AACH,SAAgB,6BAA6B,CAC3C,IAAY,EACZ,UAAkB,EAClB,mBAA0C;IAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,EAAE,CAAC;QACtD,OAAO,mBAAmB,CACxB,KAAK,EACL,6CAA6C,EAC7C,mDAAmD,EACnD,UAAU,EACV,oIAAoI,EACpI,0HAA0H,EAC1H;YACE,mCAAmC;YACnC,mBAAmB;YACnB,kBAAkB;YAClB,eAAe;SAChB,EACD,yDAAyD,EACzD,iHAAiH,EACjH,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,IAAY,EACZ,UAAkB,EAClB,KAAe,EACf,KAAa,EACb,mBAA0C;IAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAE5B,2EAA2E;IAC3E,IAAI,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClF,mDAAmD;QACnD,MAAM,iBAAiB,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/D,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,mBAAmB,CACxB,mBAAmB,EACnB,0CAA0C,EAC1C,mCAAmC,EACnC,UAAU,EACV,sJAAsJ,EACtJ,kGAAkG,EAClG;gBACE,+CAA+C;gBAC/C,yBAAyB;gBACzB,uBAAuB;gBACvB,sBAAsB;aACvB,EACD,6CAA6C,EAC7C,2DAA2D,EAC3D,oFAAoF,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAC9B,IAAY,EACZ,UAAkB,EAClB,mBAA0C;IAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAE5B,0DAA0D;IAC1D,uEAAuE;IACvE,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAClH,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAEnG,IAAI,eAAe,IAAI,oBAAoB,EAAE,CAAC;QAC5C,0DAA0D;QAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAElE,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,OAAO,mBAAmB,CACxB,KAAK,EACL,8DAA8D,EAC9D,gDAAgD,EAChD,UAAU,EACV,sHAAsH,EACtH,4EAA4E,EAC5E;gBACE,8BAA8B;gBAC9B,mBAAmB;gBACnB,kBAAkB;gBAClB,kBAAkB;aACnB,EACD,oCAAoC,EACpC,0MAA0M,EAC1M,iFAAiF,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CACjC,IAAY,EACZ,UAAkB,EAClB,mBAA0C;IAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAE5B,kDAAkD;IAClD,wDAAwD;IACxD,8DAA8D;IAC9D,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAClH,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;IAC/G,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAEtE,MAAM,iBAAiB,GAAG,mBAAmB,IAAI,iBAAiB,IAAI,gBAAgB,CAAC;IAEvF,IAAI,iBAAiB,EAAE,CAAC;QACtB,gEAAgE;QAChE,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAErF,IAAI,CAAC,cAAc,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;YACvD,OAAO,mBAAmB,CACxB,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,UAAU,EACV,uIAAuI,EACvI,iDAAiD,EACjD;gBACE,iCAAiC;gBACjC,+BAA+B;gBAC/B,2BAA2B;gBAC3B,wBAAwB;aACzB,EACD,0CAA0C,EAC1C,iDAAiD,EACjD,+FAA+F,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/lib/analyzers/types.d.ts

@@ -0,0 +1,92 @@
+import { SupportedLanguage, SecuritySeverity, ExploitLikelihood, SecurityImpact } from '../types';
+export interface LineError {
+    line: number;
+    error: string;
+    suggestion: string;
+    severity: 'error' | 'warning' | 'info';
+    securityRelevant?: boolean;
+    references?: Array<{
+        title: string;
+        url: string;
+        description: string;
+    }>;
+}
+export interface QualityIssue {
+    type: 'error' | 'warning' | 'info';
+    message: string;
+    line?: number;
+    column?: number;
+    rule?: string;
+    severity: 'high' | 'medium' | 'low';
+}
+export interface SecurityVulnerability {
+    severity: SecuritySeverity;
+    message: string;
+    line?: number;
+    suggestion?: string;
+    category?: string;
+    securityRelevant?: boolean;
+    cvssScore?: number;
+    exploitLikelihood?: ExploitLikelihood;
+    impact?: SecurityImpact;
+    owasp?: string;
+    cwe?: string;
+    pciDss?: string;
+    attackVector?: {
+        description: string;
+        exploitExample: string;
+        realWorldImpact: string[];
+    };
+    remediation?: {
+        before: string;
+        after: string;
+        explanation: string;
+    };
+}
+export interface AnalysisMetrics {
+    complexity: number;
+    maintainability: number;
+    lines: number;
+    functions: number;
+}
+export interface AnalyzerResult {
+    syntax: {
+        valid: boolean;
+        errors: string[];
+        lineErrors: LineError[];
+    };
+    quality: {
+        score: number;
+        issues: QualityIssue[];
+    };
+    performance: {
+        score: number;
+        suggestions: string[];
+    };
+    security: {
+        vulnerabilities: SecurityVulnerability[];
+    };
+    metrics: AnalysisMetrics;
+    languageSpecific?: Record<string, unknown>;
+}
+export interface AnalyzerInput {
+    code: string;
+    filename?: string;
+    options?: Record<string, unknown>;
+}
+export interface ICodeAnalyzer {
+    language: SupportedLanguage;
+    analyze(input: AnalyzerInput): Promise<AnalyzerResult>;
+    validateSyntax(code: string): Promise<boolean>;
+    getLanguageInfo(): {
+        name: string;
+        extensions: string[];
+        description: string;
+    };
+}
+export interface AnalyzerFactory {
+    createAnalyzer(language: SupportedLanguage): ICodeAnalyzer;
+    getSupportedLanguages(): SupportedLanguage[];
+    isLanguageSupported(language: string): boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/lib/analyzers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/lib/analyzers/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAElG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IACF,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE;QACN,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,UAAU,EAAE,SAAS,EAAE,CAAC;KACzB,CAAC;IACF,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,YAAY,EAAE,CAAC;KACxB,CAAC;IACF,WAAW,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,QAAQ,EAAE;QACR,eAAe,EAAE,qBAAqB,EAAE,CAAC;KAC1C,CAAC;IACF,OAAO,EAAE,eAAe,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvD,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,eAAe,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,aAAa,CAAC;IAC3D,qBAAqB,IAAI,iBAAiB,EAAE,CAAC;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAChD"}

package/dist/src/lib/analyzers/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/src/lib/analyzers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/lib/analyzers/types.ts"],"names":[],"mappings":""}

package/dist/src/lib/analyzers/typescript/security-checks/access-control.d.ts

@@ -0,0 +1,19 @@
+/**
+ * TypeScript Access Control Security Checks
+ * OWASP A01:2021 - Broken Access Control
+ *
+ * Detects Insecure Direct Object Reference (IDOR) vulnerabilities
+ * in TypeScript Express/Koa route handlers.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for broken access control vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #85: IDOR in Express/Koa routes with :id parameters (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkAccessControl(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=access-control.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/access-control.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAqQzB"}

package/dist/src/lib/analyzers/typescript/security-checks/access-control.js

@@ -0,0 +1,210 @@
+"use strict";
+/**
+ * TypeScript Access Control Security Checks
+ * OWASP A01:2021 - Broken Access Control
+ *
+ * Detects Insecure Direct Object Reference (IDOR) vulnerabilities
+ * in TypeScript Express/Koa route handlers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAccessControl = checkAccessControl;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for broken access control vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #85: IDOR in Express/Koa routes with :id parameters (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkAccessControl(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // OWASP A01:2021 - Broken Access Control
+        // Check #85: IDOR in route handlers - HIGH
+        // Pattern: app.get("/users/:id", ...) or app.post("/accounts/:accountId", ...)
+        // with :id, :userId, :accountId, :profileId, :orderId, :documentId parameters
+        const routeWithIdPattern = /(app|router)\.(get|post|put|delete|patch)\s*\(\s*["'][^"']*:(id|userId|accountId|profileId|orderId|documentId|fileId|recordId)[^"']*["']/i;
+        if (trimmed.match(routeWithIdPattern)) {
+            // Check next 15 lines for authorization checks
+            const nextLines = lines.slice(index, Math.min(index + 15, lines.length));
+            // Look for authorization patterns:
+            // - req.session.userId, req.user.id, req.session, req.user
+            // - Authorization header checks
+            // - Permission/role checks
+            // - Ownership validation (comparing req.session.userId with req.params.id)
+            const hasAuthCheck = nextLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (
+                // Session checks
+                lowerLine.includes('req.session') ||
+                    lowerLine.includes('req.user') ||
+                    // Authorization header
+                    lowerLine.includes('authorization') ||
+                    lowerLine.includes('req.headers.authorization') ||
+                    // Permission/role checks
+                    lowerLine.includes('permission') ||
+                    lowerLine.includes('isauthorized') ||
+                    lowerLine.includes('hasaccess') ||
+                    lowerLine.includes('checkaccess') ||
+                    lowerLine.includes('role') ||
+                    // Status code 403 (Forbidden) indicates auth check
+                    lowerLine.includes('403') ||
+                    lowerLine.includes('forbidden'));
+            });
+            if (!hasAuthCheck) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('idor-no-authorization', 'Route accesses user-specific data without authorization check (Insecure Direct Object Reference)', 'Add authorization check: if (req.session.userId !== req.params.id) return res.status(403).json({error: "Forbidden"});', lineNumber, 'Attacker can access other users\' data by changing the ID in the URL. No ownership validation is performed, allowing any authenticated user to access any resource by guessing or iterating through IDs.', 'GET /users/123 returns user data for ID 123. Attacker changes to /users/456 and accesses another user\'s data without authorization.', [
+                    'Unauthorized access to sensitive user data (emails, addresses, financial info)',
+                    'Privacy violations and data leakage',
+                    'Account takeover via profile manipulation',
+                    'Horizontal privilege escalation (user accessing other users\' data)',
+                    'Compliance violations (GDPR, HIPAA, PCI-DSS)'
+                ], 'app.get("/users/:id", async (req, res) => {\n  const user = await db.query("SELECT * FROM users WHERE id = ?", [req.params.id]);\n  res.json(user); // No auth check\n});', 'app.get("/users/:id", async (req, res) => {\n  if (req.session.userId !== req.params.id) {\n    return res.status(403).json({ error: "Forbidden" });\n  }\n  const user = await db.query("SELECT * FROM users WHERE id = ?", [req.params.id]);\n  res.json(user);\n});', 'Add ownership validation by comparing the authenticated user\'s ID (from session/JWT) with the requested resource ID. Return 403 Forbidden if they don\'t match.'));
+            }
+        }
+        // OWASP A01:2021 - Broken Access Control / A10:2025 - Mishandling Exceptional Conditions
+        // Check #91: Fail-Open Authentication - CRITICAL
+        // Pattern: if (authorized) res.send(X); else res.send(X);
+        // Pattern: if (isAdmin) return data; else return data;
+        // Detects identical responses for authorized and unauthorized paths (fail-open design)
+        // Look for if/else statements with authorization-related conditions
+        const ifStatementPattern = /if\s*\(\s*([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\)/;
+        const ifMatch = trimmed.match(ifStatementPattern);
+        if (ifMatch) {
+            const conditionVar = ifMatch[1];
+            // Check if variable name suggests authorization
+            const authVariablePattern = /(auth|authorized|isAdmin|hasPermission|canAccess|allowed|granted|authenticated)/i;
+            if (conditionVar.match(authVariablePattern)) {
+                let ifBranch = '';
+                let elseBranch = '';
+                // Try to extract if/else branches - handle both single-line and multi-line
+                // Pattern 1: Single line if/else: if (x) statement; else statement;
+                const singleLinePattern = /if\s*\([^)]+\)\s*(.+?);\s*else\s*(.+?);/;
+                const singleLineMatch = trimmed.match(singleLinePattern);
+                if (singleLineMatch) {
+                    ifBranch = singleLineMatch[1].trim();
+                    elseBranch = singleLineMatch[2].trim();
+                }
+                else {
+                    // Pattern 2: Multi-line if/else across separate lines
+                    // Check if the if statement has its body on the same line
+                    const ifBodyPattern = /if\s*\([^)]+\)\s*(.+)/;
+                    const ifBodyMatch = trimmed.match(ifBodyPattern);
+                    if (ifBodyMatch) {
+                        ifBranch = ifBodyMatch[1].trim().replace(/;$/, '');
+                    }
+                    // Look for else in next few lines
+                    const nextLines = lines.slice(index + 1, Math.min(index + 5, lines.length));
+                    for (const nextLine of nextLines) {
+                        const nextTrimmed = nextLine.trim();
+                        if (nextTrimmed.startsWith('else')) {
+                            const elseBodyPattern = /else\s+(.+)/;
+                            const elseBodyMatch = nextTrimmed.match(elseBodyPattern);
+                            if (elseBodyMatch) {
+                                elseBranch = elseBodyMatch[1].trim().replace(/;$/, '');
+                            }
+                            break;
+                        }
+                    }
+                }
+                // Check if both branches are identical (fail-open)
+                if (ifBranch && elseBranch && ifBranch === elseBranch) {
+                    vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('fail-open-authentication', 'Fail-open authentication - identical response for authorized and unauthorized users (complete access control bypass)', 'Fix access control logic: authorized users should get different response than unauthorized. Use early return for unauthorized: if (!authorized) return res.status(403).send("Forbidden");', lineNumber, 'Authorization check has identical code in both if and else branches, making the check completely ineffective. This is a fail-open design where authentication/authorization failures do not change behavior, allowing unauthorized access.', 'if (authorized) res.send("Dashboard"); else res.send("Dashboard"); → Any user (authorized or not) gets Dashboard → complete access control bypass', [
+                        'Complete access control bypass',
+                        'Unauthorized access to protected resources',
+                        'Admin panel accessible without authentication',
+                        'Privilege escalation',
+                        'Data breach (unauthorized data access)',
+                        'Compliance violations (SOC 2, ISO 27001, GDPR Article 32)',
+                        'Authorization logic rendered completely ineffective'
+                    ], 'let authorized = false;\ntry {\n  authorized = JSON.parse(req.headers.auth).role === "admin";\n} catch { }\n\nif (authorized) res.send("Dashboard");\nelse res.send("Dashboard");', 'let authorized = false;\ntry {\n  authorized = JSON.parse(req.headers.auth).role === "admin";\n} catch { }\n\nif (!authorized) {\n  return res.status(403).send("Forbidden");\n}\n\nres.send("Dashboard");', 'Ensure authorized and unauthorized paths have different behavior. Use early returns for unauthorized access. Fail securely: if authorization fails, deny access by default.'));
+                }
+            }
+        }
+        // OWASP A01:2025 - Broken Access Control - Phase 7B Day 11
+        // Check #92: Missing authentication middleware - HIGH
+        // Pattern: app.get/post/put/delete/patch routes without authentication
+        const routePattern = /(app|router)\.(get|post|put|delete|patch)\s*\(\s*['"`]\/api\//i;
+        const nextApiPattern = /export\s+default\s+(?:async\s+)?function\s+handler\s*\(/i;
+        if (trimmed.match(routePattern) || trimmed.match(nextApiPattern)) {
+            // Check if route has authentication middleware
+            const hasMiddleware = trimmed.includes('authenticate') ||
+                trimmed.includes('authMiddleware') ||
+                trimmed.includes('requireAuth') ||
+                trimmed.includes('isAuthenticated') ||
+                trimmed.includes('verifyToken') ||
+                trimmed.includes('checkAuth');
+            // Check next 15 lines for inline authentication check
+            const nextLines = lines.slice(index, Math.min(index + 15, lines.length));
+            const hasInlineAuthCheck = nextLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (
+                // Check for !req.user or !req.session with 401/unauthorized
+                ((lowerLine.includes('!req.user') || lowerLine.includes('!req.session')) &&
+                    (lowerLine.includes('401') || lowerLine.includes('unauthorized'))) ||
+                    // Check for req.headers.authorization
+                    lowerLine.includes('req.headers.authorization') ||
+                    // Check for JWT verification
+                    lowerLine.includes('verifytoken') ||
+                    lowerLine.includes('jwt.verify') ||
+                    // Check for req.user or req.session existence checks
+                    (lowerLine.includes('if') && (lowerLine.includes('req.user') || lowerLine.includes('req.session'))));
+            });
+            if (!hasMiddleware && !hasInlineAuthCheck) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('missing-authentication-middleware', 'API route missing authentication - allows unauthenticated access to protected resources', 'Add authentication middleware: app.get("/api/users", authenticate, handler) or check req.user in handler', lineNumber, 'API endpoints without authentication allow any user (including attackers) to access protected resources. This is a critical access control failure.', 'app.get("/api/users", (req, res) => res.json(users)); → Anyone can access /api/users without logging in', [
+                    'Unauthorized access to sensitive data',
+                    'Data breach from unauthenticated API access',
+                    'Account enumeration and information disclosure',
+                    'Business logic bypass',
+                    'Compliance violations (SOC 2, ISO 27001, GDPR)'
+                ], 'app.get("/api/users", (req, res) => {\n  res.json(users); // No auth\n});', 'app.get("/api/users", authenticate, (req, res) => {\n  res.json(users); // Protected\n});', 'All API routes accessing sensitive data must require authentication via middleware or inline checks'));
+            }
+        }
+        // OWASP A01:2025 - Broken Access Control - Phase 7B Day 11
+        // Check #93: Client-side only authorization - HIGH
+        // Pattern: Authorization checks in client-side TypeScript (browser code)
+        const clientSideAuthPattern = /(if|&&|\|\|)\s*\(\s*(userRole|user\.role|user\.isAdmin|isAdmin|currentUser\.role)/i;
+        const uiTogglePattern = /\.style\.display\s*=|\.hidden\s*=|\.classList\.(add|remove|toggle)/i;
+        if (trimmed.match(clientSideAuthPattern)) {
+            // Check if this is followed by API call or UI toggle (client-side behavior)
+            const nextLines = lines.slice(index, Math.min(index + 5, lines.length));
+            const hasClientSideBehavior = nextLines.some(l => l.includes('fetch(') ||
+                l.includes('axios.') ||
+                l.match(uiTogglePattern) ||
+                l.includes('getElementById') ||
+                l.includes('querySelector'));
+            // Make sure this is NOT a server-side check (no req.user or res.status)
+            const isServerSide = nextLines.some(l => l.includes('req.user') ||
+                l.includes('res.status(403)') ||
+                l.includes('res.status(401)') ||
+                l.includes('return res.'));
+            if (hasClientSideBehavior && !isServerSide) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('client-side-authorization', 'Authorization enforced only on client-side - can be bypassed by manipulating JavaScript', 'Move authorization logic to server-side: Validate user role in API endpoint, not in browser code', lineNumber, 'Client-side authorization can be easily bypassed by modifying JavaScript in browser DevTools or using direct API calls. Attackers can access admin features by changing local variables.', 'if (userRole === "admin") fetch("/api/admin/delete") → Attacker opens DevTools, sets userRole="admin", bypasses check', [
+                    'Complete authorization bypass via DevTools manipulation',
+                    'Privilege escalation (user → admin)',
+                    'Unauthorized access to admin features',
+                    'Data manipulation and deletion',
+                    'Business logic bypass',
+                    'False sense of security (UI hiding is not access control)'
+                ], 'if (userRole === "admin") {\n  fetch("/api/admin/delete", { method: "POST" });\n}', 'fetch("/api/admin/delete", { method: "POST" }); // Server validates role\n\n// Server-side:\napp.post("/api/admin/delete", (req, res) => {\n  if (req.user.role !== "admin") return res.status(403).send("Forbidden");\n  // Perform delete\n});', 'Never rely on client-side checks for authorization. Always validate user permissions on the server before performing sensitive operations.'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=access-control.js.map