codeslick-cli 1.0.0

package/dist/src/lib/analyzers/typescript/security-checks/authentication.js

@@ -0,0 +1,357 @@
+"use strict";
+/**
+ * TypeScript Authentication Security Checks
+ * OWASP A07:2021 - Identification and Authentication Failures
+ * OWASP A02:2021 - Cryptographic Failures
+ *
+ * Detects critical authentication vulnerabilities:
+ * - Check #3: JWT None Algorithm bypass
+ * - Check #4: JWT Weak Secret
+ * - Check #88: Plaintext password comparison
+ * - Check #89: Weak/predictable token generation
+ * - Check #90: Master password backdoors
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAuthentication = checkAuthentication;
+const createVulnerability_1 = require("../utils/createVulnerability");
+// Weak JWT Secret Blacklist (Dec 20, 2025 - Phase A P0)
+const WEAK_JWT_SECRETS = [
+    'secret', 'jwt-secret', 'jwtsecret', 'your-secret-key',
+    'your-256-bit-secret', 'mysecret', 'password', '12345',
+    'test', 'dev', 'development', 'localhost', 'example',
+    'supersecret', 'secretkey', 'key', 'token', 'jwt',
+    'auth', 'authentication', 'changeme', 'admin', 'root'
+];
+/**
+ * Checks for authentication vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #3: JWT None Algorithm bypass (CRITICAL) - Phase A P0
+ * - Check #4: JWT Weak Secret (CRITICAL) - Phase A P0
+ * - Check #88: Plaintext password comparison (CRITICAL)
+ * - Check #89: Weak token generation (HIGH)
+ * - Check #90: Master password backdoor (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkAuthentication(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // OWASP A07:2021 - Identification and Authentication Failures
+        // Check #88: Plaintext Password Comparison - CRITICAL
+        // Pattern: rows[0].password === req.body.password
+        // Pattern: user.password === password
+        // Pattern: storedPassword === inputPassword
+        // Detects direct string comparison of passwords without hashing
+        // Look for password comparison patterns
+        const plaintextPasswordPattern = /(rows\[0\]\??\.(password|hash|password_hash)|user\??\.(password|hash|password_hash)|admin\??\.(password|hash|password_hash)|stored(Password|Hash))\s*===\s*(req\.body\.(password|pwd)|password|pwd|inputPassword)/i;
+        const passwordComparisonPattern = /(password|hash|password_hash)\s*===\s*(req\.body\.|password|pwd)/i;
+        if (trimmed.match(plaintextPasswordPattern) || trimmed.match(passwordComparisonPattern)) {
+            // Check context: was data fetched from database?
+            const previousLines = lines.slice(Math.max(0, index - 15), index);
+            const hasPasswordQuery = previousLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return ((lowerLine.includes('select') || lowerLine.includes('query') || lowerLine.includes('find')) &&
+                    (lowerLine.includes('password') || lowerLine.includes('hash')));
+            });
+            // Also check for any database operation (even if not mentioning password)
+            const hasAnyDbQuery = previousLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (lowerLine.includes('db.query') ||
+                    lowerLine.includes('db.execute') ||
+                    lowerLine.includes('await') && (lowerLine.includes('query') || lowerLine.includes('find')));
+            });
+            // Check if bcrypt/argon2/crypto.compare is used
+            const surroundingLines = lines.slice(Math.max(0, index - 5), Math.min(index + 5, lines.length));
+            const hasHashingCheck = surroundingLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (lowerLine.includes('bcrypt.compare') ||
+                    lowerLine.includes('argon2.verify') ||
+                    lowerLine.includes('crypto.compare') ||
+                    lowerLine.includes('password.startswith') || // Bcrypt hash format check
+                    lowerLine.includes('pbkdf2') ||
+                    lowerLine.includes('scrypt'));
+            });
+            // Report vulnerability if either: explicit password query found, OR any DB query with password property comparison
+            if ((hasPasswordQuery || hasAnyDbQuery) && !hasHashingCheck) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('plaintext-password-comparison', 'Plaintext password comparison - passwords appear to be stored and compared without hashing', 'Use bcrypt or Argon2 for password hashing: await bcrypt.compare(inputPassword, storedHash)', lineNumber, 'Direct string comparison of passwords indicates plaintext storage or comparison. If database breach occurs, all user passwords are exposed. This violates OWASP A07 and PCI-DSS requirements for cryptographic password storage.', 'Database query: SELECT password FROM users → if (password === req.body.password) → Attacker gains database access → all passwords exposed in plaintext', [
+                    'Complete authentication system compromise',
+                    'Database breach exposes all user passwords in plaintext',
+                    'Account takeover for all users',
+                    'Regulatory violations (GDPR Article 32, PCI-DSS 8.2.1)',
+                    'Credential stuffing attacks across multiple platforms',
+                    'Inability to detect compromised passwords',
+                    'No protection against rainbow table attacks'
+                ], 'const [rows] = await db.query("SELECT password FROM users WHERE email = ?", [email]);\nif (rows[0].password === req.body.password) {\n  res.send({ token: generateToken() });\n}', 'const [rows] = await db.query("SELECT password_hash FROM users WHERE email = ?", [email]);\nconst isValid = await bcrypt.compare(req.body.password, rows[0].password_hash);\nif (isValid) {\n  res.send({ token: generateToken() });\n}', 'Store passwords using bcrypt (cost factor 12+) or Argon2id. Never store plaintext passwords. Use bcrypt.compare() for verification, never string comparison.'));
+            }
+        }
+        // OWASP A07:2021 - Identification and Authentication Failures
+        // Check #89: Weak Token Generation - HIGH
+        // Pattern: Buffer.from(email).toString('base64')
+        // Pattern: Math.random().toString(36)
+        // Pattern: token = userId
+        // Detects predictable or weak token generation
+        // Look for token/session/apiKey variable assignments
+        const tokenAssignmentPattern = /(token|sessionId|apiKey|authToken|accessToken)\s*[=:]\s*/i;
+        if (trimmed.match(tokenAssignmentPattern)) {
+            // Check if uses weak/predictable generation methods
+            const weakTokenPatterns = [
+                // Base64/hex encoding of predictable values
+                /Buffer\.from\([^)]*\)\.toString\(['"](?:base64|hex)['"]\)/,
+                // Math.random (not cryptographically secure)
+                /Math\.random\(\)/,
+                // Date.now() or timestamp
+                /Date\.now\(\)/,
+                // Direct assignment of user data
+                /(email|userId|user\.id|req\.body\.)/i,
+                // String concatenation with predictable values
+                /\+\s*(email|userId|Date\.now)/i,
+            ];
+            const isWeakToken = weakTokenPatterns.some(pattern => trimmed.match(pattern));
+            // Exclude secure methods
+            const secureTokenPatterns = [
+                /crypto\.randomBytes/,
+                /crypto\.randomUUID/,
+                /uuid\.v4/,
+                /crypto\.randomInt/,
+                /jwt\.sign/,
+                /nanoid/,
+                /crypto\.sign/,
+            ];
+            const isSecureToken = secureTokenPatterns.some(pattern => trimmed.match(pattern));
+            if (isWeakToken && !isSecureToken) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('weak-token-generation', 'Weak or predictable token generation using non-cryptographic methods', 'Use cryptographically secure random: crypto.randomBytes(32).toString(\'hex\') or crypto.randomUUID()', lineNumber, 'Token generation uses predictable or weak methods (Base64 encoding, Math.random, timestamps, user data). Attackers can predict or forge tokens, leading to authentication bypass and account takeover.', 'token = Buffer.from(email).toString("base64") → Attacker decodes "YWRtaW5AY29tcGFueS5jb20=" → gains admin access by forging token', [
+                    'Complete authentication bypass',
+                    'Account takeover for any user',
+                    'Session hijacking',
+                    'Privilege escalation (forge admin tokens)',
+                    'Replay attacks',
+                    'Token prediction attacks',
+                    'Brute force attacks on weak entropy'
+                ], 'const token = Buffer.from(req.body.email).toString("base64");\nres.send({ token });', 'const token = crypto.randomBytes(32).toString("hex");\n// Store token-to-user mapping in database/cache\nres.send({ token });', 'Use crypto.randomBytes() for tokens. Tokens must have sufficient entropy (256+ bits), be unpredictable, and cryptographically random. Never use Base64-encoded user data as tokens.'));
+            }
+        }
+        // OWASP A07:2021 - Identification and Authentication Failures
+        // Check #90: Master Password Backdoor - HIGH
+        // Pattern: || password === process.env.MASTER_PASS
+        // Pattern: || password === "admin123"
+        // Pattern: || req.body.password === SUPPORT_PASS
+        // Detects master password backdoors that bypass normal authentication
+        // Look for OR conditions with alternative password checks
+        const masterPasswordPattern = /\|\|\s*(?:req\.body\.)?password\s*===\s*(?:process\.env\.|["']|[A-Z_]+)/;
+        if (trimmed.match(masterPasswordPattern)) {
+            // Check if this is in authentication context
+            const surroundingLines = lines.slice(Math.max(0, index - 5), Math.min(index + 5, lines.length));
+            const isAuthContext = surroundingLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (lowerLine.includes('login') ||
+                    lowerLine.includes('auth') ||
+                    lowerLine.includes('password') ||
+                    lowerLine.includes('token'));
+            });
+            if (isAuthContext) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('master-password-backdoor', 'Master password backdoor allows bypassing normal authentication for any account', 'Remove master password bypass. Implement proper admin access through role-based access control (RBAC)', lineNumber, 'Master password or support password allows authentication bypass for any user account. Single password grants access to all accounts, creating massive insider threat and compliance risk.', 'if (password === userPassword || password === process.env.SUPPORT_PASS) → Attacker discovers SUPPORT_PASS → gains access to any account including admin', [
+                    'Complete authentication bypass for all accounts',
+                    'Unauthorized access to any user account',
+                    'Privilege escalation to admin without authorization',
+                    'Insider threat amplification (one leaked password compromises entire system)',
+                    'Compliance violations (SOC 2, ISO 27001, GDPR)',
+                    'Audit trail bypassed (actions performed as legitimate users)',
+                    'No way to revoke access without changing single password'
+                ], 'if (rows[0].password === req.body.password || req.body.password === process.env.SUPPORT_PASS) {\n  res.send({ token: generateToken(rows[0].id) });\n}', '// Remove master password bypass\nconst isValid = await bcrypt.compare(req.body.password, rows[0].password_hash);\nif (isValid) {\n  res.send({ token: generateToken(rows[0].id) });\n}\n// For admin access, use separate admin authentication endpoint with MFA', 'Never implement master password backdoors. Use proper RBAC with admin roles, separate admin authentication, and multi-factor authentication for privileged access.'));
+            }
+        }
+        // OWASP A07:2025 - Identification and Authentication Failures
+        // Check #91: Session Fixation - MEDIUM
+        // Pattern: req.session.userId = ... (without session.regenerate())
+        // Detects session ID not being regenerated after authentication
+        // Session fixation allows attackers to hijack user sessions
+        // Look for session assignment after authentication
+        const sessionAssignmentPattern = /req\.session\.(userId|user|isAuthenticated|authenticated)/i;
+        if (trimmed.match(sessionAssignmentPattern)) {
+            // Check if this is in authentication context (login/signin)
+            const surroundingLines = lines.slice(Math.max(0, index - 10), Math.min(index + 5, lines.length));
+            const isAuthContext = surroundingLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return ((lowerLine.includes('login') || lowerLine.includes('signin') || lowerLine.includes('authenticate')) &&
+                    (lowerLine.includes('post') || lowerLine.includes('app.post') || lowerLine.includes('router.post')));
+            });
+            // Check if bcrypt.compare or authentication check is present
+            const hasAuthCheck = surroundingLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (lowerLine.includes('bcrypt.compare') ||
+                    lowerLine.includes('argon2.verify') ||
+                    lowerLine.includes('isvalid') ||
+                    lowerLine.includes('authenticated'));
+            });
+            // Check if session.regenerate() is called
+            const hasSessionRegenerate = surroundingLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return lowerLine.includes('session.regenerate') || lowerLine.includes('regeneratesession');
+            });
+            if (isAuthContext && hasAuthCheck && !hasSessionRegenerate) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('session-fixation', 'Session ID not regenerated after authentication - vulnerable to session fixation attacks', 'Regenerate session ID after successful login: req.session.regenerate((err) => { req.session.userId = user.id; })', lineNumber, 'Session fixation occurs when the session ID is not changed after authentication. Attackers can set a known session ID for a victim, then hijack the session after the victim logs in. This allows attackers to impersonate authenticated users without knowing their credentials.', 'Attacker sets victim\'s sessionId=ABC123 → Victim logs in (session not regenerated) → Attacker uses sessionId=ABC123 → gains access as victim', [
+                    'Session hijacking after authentication',
+                    'Account takeover without knowing password',
+                    'Unauthorized access to user data',
+                    'Bypasses authentication mechanism',
+                    'Man-in-the-middle session attacks',
+                    'Cross-site session fixation'
+                ], 'app.post(\'/login\', async (req, res) => {\n  const isValid = await bcrypt.compare(password, user.password_hash);\n  if (isValid) {\n    req.session.userId = user.id; // Session ID not regenerated!\n    res.json({ success: true });\n  }\n});', 'app.post(\'/login\', async (req, res) => {\n  const isValid = await bcrypt.compare(password, user.password_hash);\n  if (isValid) {\n    req.session.regenerate((err) => {\n      if (err) return res.status(500).json({ error: \'Session error\' });\n      req.session.userId = user.id; // Safe - new session ID\n      res.json({ success: true });\n    });\n  }\n});', 'Always regenerate session IDs after successful authentication using req.session.regenerate(). This creates a new session ID, preventing session fixation attacks. Also set session cookie attributes: httpOnly, secure, sameSite=\'strict\'.'));
+            }
+        }
+        // =============================================================================
+        // PHASE A P0 - JWT None Algorithm Detection (Dec 20, 2025)
+        // =============================================================================
+        // Check #3: JWT None Algorithm Bypass - CRITICAL
+        // Pattern 1: jwt.verify() without algorithm restriction
+        // Pattern 2: jwt.decode() used for authentication
+        // OWASP A07:2021 - Identification and Authentication Failures
+        // CWE-347: Improper Verification of Cryptographic Signature
+        // Detect jwt.verify() calls
+        if (trimmed.match(/jwt\.verify\s*\(/)) {
+            // Extract the full jwt.verify() call to check for options
+            const verifyCallMatch = trimmed.match(/jwt\.verify\s*\([^)]*\)/);
+            if (verifyCallMatch) {
+                const callContent = verifyCallMatch[0];
+                // Check if third argument (options) exists
+                const argsMatch = callContent.match(/jwt\.verify\s*\(\s*([^,]+)\s*,\s*([^,]+)(?:\s*,\s*({[^}]*}))?\s*\)/);
+                if (argsMatch) {
+                    const optionsArg = argsMatch[3];
+                    // Flag if no options (no third argument)
+                    if (!optionsArg) {
+                        vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('jwt-none-algorithm', 'JWT verification without algorithm restriction allows "none" algorithm bypass', 'Always specify allowed algorithms: jwt.verify(token, secret, { algorithms: [\'HS256\'] })', lineNumber, 'JWT verification without algorithm restriction allows attackers to forge tokens using the "none" algorithm, completely bypassing signature verification. Attackers can create valid tokens with any payload (admin access, privilege escalation) without knowing the secret key.', 'Attacker creates token: {"alg": "none", "typ": "JWT"}.{"userId": "admin", "role": "admin"}. (no signature) → jwt.verify() accepts it → complete authentication bypass', [
+                            'Complete authentication bypass',
+                            'Privilege escalation to admin/superuser',
+                            'Unauthorized access to all user accounts',
+                            'Data breach and exfiltration',
+                            'System takeover',
+                            'Token forgery without secret knowledge'
+                        ], 'const decoded = jwt.verify(token, secret); // Accepts "alg": "none"!', 'const decoded = jwt.verify(token, secret, { algorithms: [\'HS256\'] }); // Only allow HS256, reject "none"', 'Always explicitly specify allowed algorithms in jwt.verify() options. Never allow the "none" algorithm. Use strong algorithms: HS256, RS256, ES256. Never use jwt.decode() for authentication (it doesn\'t verify signatures).'));
+                    }
+                    // Flag if options contains 'none' algorithm
+                    else if (optionsArg.includes("'none'") || optionsArg.includes('"none"')) {
+                        vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('jwt-none-algorithm', 'JWT algorithms array explicitly allows "none" - complete authentication bypass', 'Remove "none" from algorithms array: jwt.verify(token, secret, { algorithms: [\'HS256\'] })', lineNumber, 'Explicitly allowing the "none" algorithm in JWT verification completely disables signature verification, allowing attackers to forge arbitrary tokens without knowing the secret key.', 'jwt.verify(token, secret, { algorithms: [\'HS256\', \'none\'] }) → Attacker uses "none" → bypasses all authentication', [
+                            'Complete authentication bypass',
+                            'Token forgery without secret',
+                            'Privilege escalation',
+                            'Unauthorized access to all accounts',
+                            'Critical security vulnerability'
+                        ], 'jwt.verify(token, secret, { algorithms: [\'HS256\', \'none\'] }); // Allows "none"!', 'jwt.verify(token, secret, { algorithms: [\'HS256\'] }); // Only HS256, never "none"', 'Never include "none" in the algorithms array. Only use cryptographic algorithms: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512.'));
+                    }
+                }
+            }
+        }
+        // Detect jwt.decode() used for authentication
+        // jwt.decode() does NOT verify signature - it only decodes the token
+        if (trimmed.match(/jwt\.decode\s*\(/)) {
+            // Check if the result is used in authentication logic (next 5 lines)
+            const nextLines = lines.slice(index + 1, Math.min(index + 6, lines.length));
+            const isUsedForAuth = nextLines.some(nextLine => {
+                const lowerLine = nextLine.toLowerCase();
+                return (lowerLine.includes('if') &&
+                    (lowerLine.includes('decoded') ||
+                        lowerLine.includes('user') ||
+                        lowerLine.includes('auth') ||
+                        lowerLine.includes('role') ||
+                        lowerLine.includes('admin'))) ||
+                    lowerLine.includes('req.user') ||
+                    lowerLine.includes('req.auth') ||
+                    lowerLine.includes('session');
+            });
+            if (isUsedForAuth) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('jwt-decode-authentication', 'jwt.decode() used for authentication - does NOT verify signature', 'Use jwt.verify() instead: jwt.verify(token, secret, { algorithms: [\'HS256\'] })', lineNumber, 'jwt.decode() only decodes the JWT payload without verifying the signature. This allows attackers to forge tokens with arbitrary claims (admin role, any user ID) by simply base64-encoding malicious payloads. There is NO cryptographic verification.', 'Attacker creates: btoa(\'{"userId":"admin","role":"superuser"}\') → jwt.decode() accepts it → gains admin access without knowing secret', [
+                    'Complete authentication bypass',
+                    'Token forgery trivial (no secret needed)',
+                    'Privilege escalation to admin',
+                    'Unauthorized access to all accounts',
+                    'No cryptographic security whatsoever'
+                ], 'const decoded = jwt.decode(token); // NO signature verification!\nif (decoded.role === \'admin\') { grantAccess(); }', 'const decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: [\'HS256\'] });\nif (decoded.role === \'admin\') { grantAccess(); } // Signature verified!', 'NEVER use jwt.decode() for authentication or authorization. It does not verify signatures. Always use jwt.verify() with secret and algorithms option. Use jwt.decode() only for debugging or displaying non-sensitive token information.'));
+            }
+        }
+        // Check #4: JWT Weak Secret - CRITICAL
+        // Pattern: jwt.sign() with weak/short secret or hardcoded secret
+        // OWASP A02:2021 - Cryptographic Failures
+        // CWE-326: Inadequate Encryption Strength
+        // Detect jwt.sign() calls
+        if (trimmed.match(/jwt\.sign\s*\(/)) {
+            // Extract the jwt.sign() call to check secret
+            const signCallMatch = trimmed.match(/jwt\.sign\s*\([^)]*\)/);
+            if (signCallMatch) {
+                const callContent = signCallMatch[0];
+                // Extract second argument (secret)
+                // Pattern: jwt.sign(payload, secret, options?)
+                const argsMatch = callContent.match(/jwt\.sign\s*\(\s*[^,]+\s*,\s*([^,)]+)/);
+                if (argsMatch) {
+                    const secretArg = argsMatch[1].trim();
+                    // Check if secret is a string literal (not from env)
+                    const isStringLiteral = secretArg.match(/^['"`](.*)['"`]$/);
+                    if (isStringLiteral) {
+                        const secretValue = isStringLiteral[1];
+                        const secretLength = secretValue.length;
+                        // CRITICAL: Check for weak/common secrets FIRST (higher priority than length check)
+                        // If a secret is both weak AND short (e.g., 'password'), we want to report the
+                        // more specific "weak/common" message, not the generic "short" message.
+                        const secretLower = secretValue.toLowerCase();
+                        const isWeakSecret = WEAK_JWT_SECRETS.some(weak => secretLower === weak.toLowerCase() ||
+                            secretLower.includes(weak.toLowerCase()));
+                        // Flag if secret is in weak secrets blacklist (highest priority)
+                        if (isWeakSecret) {
+                            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('jwt-weak-secret', `JWT secret is common/weak and easily guessable: "${secretValue}"`, 'Use cryptographically random secret: process.env.JWT_SECRET', lineNumber, `Common JWT secrets like "${secretValue}" are trivially guessed by attackers using dictionary attacks. These secrets are publicly known and tried first in any JWT attack. Once guessed, attackers can forge tokens with arbitrary claims, completely bypassing authentication.`, `Secret: "${secretValue}" (in common secrets list) → Attacker tries common secrets → succeeds immediately → forges admin token → complete system compromise`, [
+                                'Trivial JWT secret guessing',
+                                'Token forgery within seconds',
+                                'Complete authentication bypass',
+                                'Privilege escalation to admin',
+                                'Zero-effort attack (no brute-force needed)',
+                                'Publicly known vulnerability'
+                            ], `const token = jwt.sign(payload, '${secretValue}'); // Common/weak secret!`, '// Generate: openssl rand -base64 32\nconst secret = process.env.JWT_SECRET; // Cryptographically random\nconst token = jwt.sign(payload, secret, { expiresIn: \'1h\' });', `NEVER use common/weak secrets. Avoid: ${WEAK_JWT_SECRETS.join(', ')}. Always generate cryptographically random secrets (openssl rand -base64 32) and store in environment variables.`));
+                        }
+                        // Flag if secret is too short (< 32 characters / 256 bits) - only if NOT already flagged as weak/common
+                        else if (secretLength < 32) {
+                            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('jwt-weak-secret', `JWT secret is too short (${secretLength} chars) - minimum 32 characters (256 bits) required`, 'Use cryptographically strong secret: process.env.JWT_SECRET (at least 32 characters)', lineNumber, `Short JWT secrets are vulnerable to brute-force attacks. With only ${secretLength} characters, an attacker can try all combinations in hours/days using modern GPU clusters. Once secret is cracked, attackers can forge tokens with arbitrary claims (admin role, any user ID), completely bypassing authentication.`, `Secret: "${secretValue}" (${secretLength * 8} bits) → Attacker brute-forces in ${secretLength < 10 ? 'minutes' : secretLength < 20 ? 'hours' : 'days'} → forges admin token → complete authentication bypass`, [
+                                'JWT secret brute-force attack',
+                                'Token forgery with arbitrary claims',
+                                'Complete authentication bypass',
+                                'Privilege escalation to admin',
+                                'Unauthorized access to all accounts',
+                                'Permanent compromise (secret cannot be changed without invalidating all tokens)'
+                            ], `const token = jwt.sign({ userId: user.id }, '${secretValue}'); // ${secretLength} chars = ${secretLength * 8} bits`, '// Generate: openssl rand -base64 32\nconst secret = process.env.JWT_SECRET; // At least 32 chars (256 bits)\nconst token = jwt.sign({ userId: user.id }, secret, { expiresIn: \'1h\' });', 'Always use secrets of at least 32 characters (256 bits) for JWT signing. Generate cryptographically random secrets using: openssl rand -base64 32. Store in environment variables, never hardcode. For HS256: 32+ chars. For HS512: 64+ chars.'));
+                        }
+                    }
+                    // Flag if secret is hardcoded (not from process.env or config)
+                    else if (!secretArg.includes('process.env') &&
+                        !secretArg.includes('env.') &&
+                        !secretArg.includes('config.') &&
+                        !secretArg.includes('Config.') &&
+                        !secretArg.match(/^[A-Z_]+$/)) { // Allow UPPERCASE_CONSTANTS (likely from env)
+                        vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('jwt-weak-secret', 'JWT secret is hardcoded - use environment variable: process.env.JWT_SECRET', 'Store JWT secret in environment variable, never hardcode', lineNumber, 'Hardcoded JWT secrets are embedded in source code, making them visible to anyone with repository access. If code is leaked, decompiled, or exposed via version control, attackers can extract the secret and forge arbitrary tokens. Hardcoded secrets cannot be rotated without code changes.', 'Hardcoded secret in code → Repository leaked/exposed → Attacker extracts secret → forges admin tokens → authentication bypass', [
+                            'Secret exposure via source code',
+                            'Version control history exposes secret permanently',
+                            'Cannot rotate secret without code deployment',
+                            'Token forgery if code is leaked',
+                            'Insider threat (all developers have access)',
+                            'Compliance violations (secret storage)'
+                        ], `const token = jwt.sign(payload, ${secretArg}); // Hardcoded secret`, 'const secret = process.env.JWT_SECRET; // From environment\nconst token = jwt.sign(payload, secret, { expiresIn: \'1h\' });', 'NEVER hardcode JWT secrets. Always store in environment variables (process.env.JWT_SECRET). Use secret management systems (AWS Secrets Manager, HashiCorp Vault, etc.) in production. Generate with: openssl rand -base64 32'));
+                    }
+                }
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=authentication.js.map

package/dist/src/lib/analyzers/typescript/security-checks/authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/authentication.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AA2BH,kDA2eC;AAngBD,sEAAqF;AAErF,wDAAwD;AACxD,MAAM,gBAAgB,GAAG;IACvB,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB;IACtD,qBAAqB,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO;IACtD,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS;IACpD,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;IACjD,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM;CACtD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,SAAgB,mBAAmB,CACjC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,8DAA8D;QAC9D,sDAAsD;QACtD,kDAAkD;QAClD,sCAAsC;QACtC,4CAA4C;QAC5C,gEAAgE;QAEhE,wCAAwC;QACxC,MAAM,wBAAwB,GAAG,oNAAoN,CAAC;QACtP,MAAM,yBAAyB,GAAG,mEAAmE,CAAC;QAEtG,IAAI,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC;YACxF,iDAAiD;YACjD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,gBAAgB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CACL,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC3F,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC/D,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,0EAA0E;YAC1E,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC9B,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAChC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC3F,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,gDAAgD;YAChD,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAChG,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAChD,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACpC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;oBACnC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACpC,SAAS,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,2BAA2B;oBACxE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC5B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC7B,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,mHAAmH;YACnH,IAAI,CAAC,gBAAgB,IAAI,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC5D,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,+BAA+B,EAC/B,4FAA4F,EAC5F,4FAA4F,EAC5F,UAAU,EACV,kOAAkO,EAClO,wJAAwJ,EACxJ;oBACE,2CAA2C;oBAC3C,yDAAyD;oBACzD,gCAAgC;oBAChC,wDAAwD;oBACxD,uDAAuD;oBACvD,2CAA2C;oBAC3C,6CAA6C;iBAC9C,EACD,kLAAkL,EAClL,yOAAyO,EACzO,8JAA8J,CAC/J,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,0CAA0C;QAC1C,iDAAiD;QACjD,sCAAsC;QACtC,0BAA0B;QAC1B,+CAA+C;QAE/C,qDAAqD;QACrD,MAAM,sBAAsB,GAAG,2DAA2D,CAAC;QAE3F,IAAI,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC1C,oDAAoD;YACpD,MAAM,iBAAiB,GAAG;gBACxB,4CAA4C;gBAC5C,2DAA2D;gBAC3D,6CAA6C;gBAC7C,kBAAkB;gBAClB,0BAA0B;gBAC1B,eAAe;gBACf,iCAAiC;gBACjC,sCAAsC;gBACtC,+CAA+C;gBAC/C,gCAAgC;aACjC,CAAC;YAEF,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAE9E,yBAAyB;YACzB,MAAM,mBAAmB,GAAG;gBAC1B,qBAAqB;gBACrB,oBAAoB;gBACpB,UAAU;gBACV,mBAAmB;gBACnB,WAAW;gBACX,QAAQ;gBACR,cAAc;aACf,CAAC;YAEF,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAElF,IAAI,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;gBAClC,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,uBAAuB,EACvB,sEAAsE,EACtE,sGAAsG,EACtG,UAAU,EACV,wMAAwM,EACxM,mIAAmI,EACnI;oBACE,gCAAgC;oBAChC,+BAA+B;oBAC/B,mBAAmB;oBACnB,2CAA2C;oBAC3C,gBAAgB;oBAChB,0BAA0B;oBAC1B,qCAAqC;iBACtC,EACD,qFAAqF,EACrF,+HAA+H,EAC/H,qLAAqL,CACtL,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,6CAA6C;QAC7C,mDAAmD;QACnD,sCAAsC;QACtC,iDAAiD;QACjD,sEAAsE;QAEtE,0DAA0D;QAC1D,MAAM,qBAAqB,GAAG,yEAAyE,CAAC;QAExG,IAAI,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACzC,6CAA6C;YAC7C,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAChG,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC3B,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC1B,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC9B,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC5B,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,aAAa,EAAE,CAAC;gBAClB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,0BAA0B,EAC1B,iFAAiF,EACjF,uGAAuG,EACvG,UAAU,EACV,4LAA4L,EAC5L,yJAAyJ,EACzJ;oBACE,iDAAiD;oBACjD,yCAAyC;oBACzC,qDAAqD;oBACrD,8EAA8E;oBAC9E,gDAAgD;oBAChD,8DAA8D;oBAC9D,0DAA0D;iBAC3D,EACD,uJAAuJ,EACvJ,mQAAmQ,EACnQ,oKAAoK,CACrK,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,uCAAuC;QACvC,mEAAmE;QACnE,gEAAgE;QAChE,4DAA4D;QAE5D,mDAAmD;QACnD,MAAM,wBAAwB,GAAG,4DAA4D,CAAC;QAE9F,IAAI,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC5C,4DAA4D;YAC5D,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAEjG,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CACL,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;oBACnG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CACpG,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,6DAA6D;YAC7D,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACpC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;oBACnC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAC7B,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CACpC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,0CAA0C;YAC1C,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACrD,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAC7F,CAAC,CAAC,CAAC;YAEH,IAAI,aAAa,IAAI,YAAY,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC3D,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,kBAAkB,EAClB,0FAA0F,EAC1F,kHAAkH,EAClH,UAAU,EACV,mRAAmR,EACnR,+IAA+I,EAC/I;oBACE,wCAAwC;oBACxC,2CAA2C;oBAC3C,kCAAkC;oBAClC,mCAAmC;oBACnC,mCAAmC;oBACnC,6BAA6B;iBAC9B,EACD,mPAAmP,EACnP,4WAA4W,EAC5W,8OAA8O,CAC/O,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,2DAA2D;QAC3D,gFAAgF;QAEhF,iDAAiD;QACjD,wDAAwD;QACxD,kDAAkD;QAClD,8DAA8D;QAC9D,4DAA4D;QAE5D,4BAA4B;QAC5B,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,0DAA0D;YAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAEjE,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;gBAEvC,2CAA2C;gBAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBAE1G,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;oBAEhC,yCAAyC;oBACzC,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,oBAAoB,EACpB,+EAA+E,EAC/E,2FAA2F,EAC3F,UAAU,EACV,kRAAkR,EAClR,uKAAuK,EACvK;4BACE,gCAAgC;4BAChC,yCAAyC;4BACzC,0CAA0C;4BAC1C,8BAA8B;4BAC9B,iBAAiB;4BACjB,wCAAwC;yBACzC,EACD,sEAAsE,EACtE,4GAA4G,EAC5G,gOAAgO,CACjO,CAAC,CAAC;oBACL,CAAC;oBACD,4CAA4C;yBACvC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACxE,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,oBAAoB,EACpB,gFAAgF,EAChF,6FAA6F,EAC7F,UAAU,EACV,uLAAuL,EACvL,uHAAuH,EACvH;4BACE,gCAAgC;4BAChC,8BAA8B;4BAC9B,sBAAsB;4BACtB,qCAAqC;4BACrC,iCAAiC;yBAClC,EACD,qFAAqF,EACrF,qFAAqF,EACrF,iJAAiJ,CAClJ,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,qEAAqE;QACrE,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,qEAAqE;YACrE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAC9C,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzC,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACxB,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC7B,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;wBAC1B,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;wBAC1B,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;wBAC1B,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAC9B;oBACD,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC9B,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC9B,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,aAAa,EAAE,CAAC;gBAClB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,2BAA2B,EAC3B,kEAAkE,EAClE,kFAAkF,EAClF,UAAU,EACV,wPAAwP,EACxP,yIAAyI,EACzI;oBACE,gCAAgC;oBAChC,0CAA0C;oBAC1C,+BAA+B;oBAC/B,qCAAqC;oBACrC,sCAAsC;iBACvC,EACD,sHAAsH,EACtH,oKAAoK,EACpK,0OAA0O,CAC3O,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,iEAAiE;QACjE,0CAA0C;QAC1C,0CAA0C;QAE1C,0BAA0B;QAC1B,IAAI,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,8CAA8C;YAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAE7D,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;gBAErC,mCAAmC;gBACnC,+CAA+C;gBAC/C,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAE7E,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAEtC,qDAAqD;oBACrD,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;oBAE5D,IAAI,eAAe,EAAE,CAAC;wBACpB,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;wBACvC,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC;wBAExC,oFAAoF;wBACpF,+EAA+E;wBAC/E,wEAAwE;wBACxE,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;wBAC9C,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChD,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE;4BAClC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CACzC,CAAC;wBAEF,iEAAiE;wBACjE,IAAI,YAAY,EAAE,CAAC;4BACjB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,iBAAiB,EACjB,oDAAoD,WAAW,GAAG,EAClE,6DAA6D,EAC7D,UAAU,EACV,4BAA4B,WAAW,yOAAyO,EAChR,YAAY,WAAW,qIAAqI,EAC5J;gCACE,6BAA6B;gCAC7B,8BAA8B;gCAC9B,gCAAgC;gCAChC,+BAA+B;gCAC/B,4CAA4C;gCAC5C,8BAA8B;6BAC/B,EACD,oCAAoC,WAAW,4BAA4B,EAC3E,2KAA2K,EAC3K,yCAAyC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,kHAAkH,CACvL,CAAC,CAAC;wBACL,CAAC;wBACD,wGAAwG;6BACnG,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;4BAC3B,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,iBAAiB,EACjB,4BAA4B,YAAY,qDAAqD,EAC7F,sFAAsF,EACtF,UAAU,EACV,sEAAsE,YAAY,qOAAqO,EACvT,YAAY,WAAW,MAAM,YAAY,GAAG,CAAC,qCAAqC,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,wDAAwD,EAC9M;gCACE,+BAA+B;gCAC/B,qCAAqC;gCACrC,gCAAgC;gCAChC,+BAA+B;gCAC/B,qCAAqC;gCACrC,iFAAiF;6BAClF,EACD,gDAAgD,WAAW,UAAU,YAAY,YAAY,YAAY,GAAG,CAAC,OAAO,EACpH,2LAA2L,EAC3L,gPAAgP,CACjP,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBACD,+DAA+D;yBAC1D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;wBAClC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;wBAC3B,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC9B,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC9B,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,8CAA8C;wBACtF,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,iBAAiB,EACjB,4EAA4E,EAC5E,0DAA0D,EAC1D,UAAU,EACV,gSAAgS,EAChS,+HAA+H,EAC/H;4BACE,iCAAiC;4BACjC,oDAAoD;4BACpD,8CAA8C;4BAC9C,iCAAiC;4BACjC,6CAA6C;4BAC7C,wCAAwC;yBACzC,EACD,mCAAmC,SAAS,wBAAwB,EACpE,6HAA6H,EAC7H,8NAA8N,CAC/N,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/typescript/security-checks/code-injection.d.ts

@@ -0,0 +1,26 @@
+/**
+ * TypeScript Code Injection Security Checks
+ * OWASP A03:2021 - Injection
+ * OWASP A08:2021 - Software and Data Integrity Failures
+ * OWASP A10:2021 - Server-Side Request Forgery (SSRF)
+ *
+ * Detects SQL injection, command injection, path traversal, prototype pollution, and SSRF.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for code injection vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #5: SSRF via Unsafe URL (CRITICAL) - Phase A P0
+ * - Check #6: Insecure Deserialization (CRITICAL) - Phase A P0
+ * - Check #11: Prototype pollution (HIGH)
+ * - Check #12: SQL Injection (CRITICAL)
+ * - Check #13: Command Injection (CRITICAL)
+ * - Check #14: Path Traversal (HIGH)
+ * - Check #9: XXE (XML External Entity) - HIGH - Phase B
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkCodeInjection(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=code-injection.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/code-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-injection.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/code-injection.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAokBzB"}