codeslick-cli 1.0.0

package/dist/src/lib/analyzers/typescript/security-checks/code-injection.js

@@ -0,0 +1,380 @@
+"use strict";
+/**
+ * TypeScript Code Injection Security Checks
+ * OWASP A03:2021 - Injection
+ * OWASP A08:2021 - Software and Data Integrity Failures
+ * OWASP A10:2021 - Server-Side Request Forgery (SSRF)
+ *
+ * Detects SQL injection, command injection, path traversal, prototype pollution, and SSRF.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCodeInjection = checkCodeInjection;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for code injection vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #5: SSRF via Unsafe URL (CRITICAL) - Phase A P0
+ * - Check #6: Insecure Deserialization (CRITICAL) - Phase A P0
+ * - Check #11: Prototype pollution (HIGH)
+ * - Check #12: SQL Injection (CRITICAL)
+ * - Check #13: Command Injection (CRITICAL)
+ * - Check #14: Path Traversal (HIGH)
+ * - Check #9: XXE (XML External Entity) - HIGH - Phase B
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkCodeInjection(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    // Track variables assigned from user input (for SSRF detection)
+    const userInputVariables = new Map(); // variable name -> line number
+    // Track variables assigned from JSON.parse() (for deserialization detection)
+    const jsonParseVariables = new Map(); // variable name -> line number
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // OWASP A08:2021 - Software and Data Integrity Failures
+        // 11. Prototype pollution - HIGH
+        if (trimmed.match(/__proto__|constructor\[.*\]|prototype\[/)) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('prototype-pollution', 'Possible prototype pollution vulnerability', 'Validate and sanitize input objects, use Object.create(null)', lineNumber, 'Attackers can modify Object.prototype via __proto__, constructor, or prototype access, affecting all objects and potentially leading to RCE or authentication bypass.', 'merge(target, source) where source = JSON.parse(\'{"__proto__": {"isAdmin": true}}\')', [
+                'Remote Code Execution (RCE)',
+                'Authentication bypass',
+                'Privilege escalation',
+                'DoS attacks'
+            ], 'function merge(target: any, source: any) {\n  for (const key in source) {\n    target[key] = source[key]; // DANGEROUS: allows __proto__ pollution\n  }\n}', 'function merge(target: any, source: any) {\n  for (const key in source) {\n    if (key === "__proto__" || key === "constructor" || key === "prototype") continue;\n    target[key] = source[key];\n  }\n}', 'Filter out dangerous keys (__proto__, constructor, prototype) or use Object.create(null) for prototype-less objects'));
+        }
+        // OWASP A03:2021 - Injection
+        // 12. SQL Injection patterns - CRITICAL
+        if (trimmed.match(/SELECT.*FROM.*WHERE.*[+`$]/i) ||
+            trimmed.match(/query\s*=\s*[`'"].*\+/) ||
+            trimmed.match(/execute\(.*\+/)) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('sql-injection', 'CRITICAL: Possible SQL Injection', 'Use prepared statements/parameterized queries (?, $1)', lineNumber, 'Attackers can inject SQL commands through user input, enabling database compromise, data theft, or complete server takeover.', 'const query = "SELECT * FROM users WHERE id = " + userId; // userId = "1 OR 1=1; DROP TABLE users;--"', [
+                'Complete database compromise',
+                'Data theft and exfiltration',
+                'Data modification or deletion',
+                'Authentication bypass',
+                'Remote code execution (via xp_cmdshell, etc.)'
+            ], 'const query = `SELECT * FROM users WHERE name = \'${userName}\'`; // VULNERABLE', 'const query = "SELECT * FROM users WHERE name = $1";\ndb.query(query, [userName]); // Use parameterized queries', 'Always use parameterized queries (prepared statements) - never concatenate user input into SQL strings'));
+        }
+        // 13. Command Injection - CRITICAL
+        if (trimmed.match(/exec\(|spawn\(|execFile\(/) && (trimmed.includes('+') || trimmed.includes('${'))) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('command-injection', 'CRITICAL: Possible Command Injection', 'Validate and escape inputs, use execFile() with array of args', lineNumber, 'Attackers can inject shell commands through user input, leading to complete system compromise via arbitrary command execution.', 'exec("ls " + userInput) where userInput = "; rm -rf / #"', [
+                'Remote Code Execution (RCE)',
+                'Complete system compromise',
+                'Data theft and destruction',
+                'Malware installation',
+                'Lateral movement in networks'
+            ], 'const cmd = `ping ${userInput}`;\nexec(cmd); // VULNERABLE to command injection', 'import { execFile } from "child_process";\nexecFile("ping", [userInput]); // Safe: args are escaped', 'Use execFile() with array arguments instead of exec(). Arguments are automatically escaped and cannot break out of the command'));
+        }
+        // 14. Path Traversal - HIGH
+        // ENHANCED: Now detects template literals (${variable}) and string concatenation
+        if (trimmed.match(/readFile|writeFile|unlink|rmdir/) &&
+            (trimmed.match(/\.\.\/|\.\.\\|\+.*path/) || // Original: ../ or + path
+                trimmed.match(/\$\{[^}]*\}/) || // NEW: Template literal variables
+                trimmed.match(/\+\s*\w+/))) { // ENHANCED: String concatenation
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('path-traversal', 'Path Traversal: file access without validation', 'Use path.resolve(), path.normalize() and validate against whitelist', lineNumber, 'Attackers can use ../ sequences to access files outside the intended directory, potentially reading sensitive files like /etc/passwd or application secrets.', 'readFile("./uploads/" + filename) where filename = "../../etc/passwd"', [
+                'Unauthorized file access',
+                'Sensitive data exposure (/etc/passwd, .env files)',
+                'Source code disclosure',
+                'Configuration file theft'
+            ], 'const filePath = "./uploads/" + userFilename;\nfs.readFile(filePath); // VULNERABLE to path traversal', 'import path from "path";\nconst safeDir = path.resolve("./uploads");\nconst filePath = path.resolve(safeDir, userFilename);\nif (!filePath.startsWith(safeDir)) throw new Error("Invalid path");\nfs.readFile(filePath);', 'Use path.resolve() to canonicalize paths and validate that the final path is within the allowed directory'));
+        }
+        // =============================================================================
+        // PHASE A P0 - SSRF Detection (Dec 20, 2025)
+        // =============================================================================
+        // Track user input variable assignments
+        // Pattern: const url = req.query.url; const endpoint = req.body.endpoint;
+        const userInputAssignment = trimmed.match(/^(?:const|let|var)\s+(\w+)\s*=\s*(req\.(query|body|params|headers)|req\.json\(\))/);
+        if (userInputAssignment) {
+            const varName = userInputAssignment[1];
+            userInputVariables.set(varName, lineNumber);
+        }
+        // Check #5: SSRF via Unsafe URL - CRITICAL
+        // Detect HTTP client method calls with user-controlled URLs
+        // OWASP A10:2021 - Server-Side Request Forgery
+        // CWE-918: Server-Side Request Forgery (SSRF)
+        // Pattern 1: fetch() with user-controlled URL
+        if (trimmed.match(/\bfetch\s*\(/)) {
+            const fetchCallMatch = trimmed.match(/\bfetch\s*\(\s*([^,)]+)/);
+            if (fetchCallMatch) {
+                const urlArg = fetchCallMatch[1].trim();
+                // Check for direct user input
+                const hasDirectUserInput = urlArg.includes('req.query') ||
+                    urlArg.includes('req.body') ||
+                    urlArg.includes('req.params') ||
+                    urlArg.includes('req.headers') ||
+                    urlArg.includes('req.json()');
+                // Check for user input variable
+                const hasUserInputVariable = userInputVariables.has(urlArg);
+                // Check for template literal with user input
+                const hasTemplateLiteralWithInput = trimmed.includes('`') &&
+                    (trimmed.includes('${req.') || trimmed.match(/\$\{[^}]*\}/));
+                // Check for string concatenation with potential user input
+                const hasStringConcat = urlArg.includes('+') && !urlArg.match(/^['"`]/);
+                if (hasDirectUserInput || hasUserInputVariable || hasTemplateLiteralWithInput || hasStringConcat) {
+                    // Exclude safe patterns: hardcoded URLs
+                    const isHardcodedUrl = urlArg.match(/^['"`]https?:\/\//);
+                    if (!isHardcodedUrl) {
+                        vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('ssrf', 'SSRF: fetch() with user-controlled URL allows access to internal services', 'Use URL allowlist validation and block private IP ranges', lineNumber, 'Server-Side Request Forgery (SSRF) allows attackers to make the server send requests to internal services, cloud metadata endpoints (AWS, GCP), or arbitrary external URLs. This can expose sensitive data, bypass firewalls, access internal admin panels, or leak cloud credentials.', 'const url = req.query.url; fetch(url); // Attack: url="http://169.254.169.254/latest/meta-data/iam/security-credentials/" → AWS credentials leaked', [
+                            'Access to internal services (databases, admin panels, Redis, etc.)',
+                            'Cloud metadata endpoint access (AWS, GCP, Azure credentials)',
+                            'Port scanning internal network',
+                            'Bypass firewall and access control',
+                            'Read local files via file:// protocol',
+                            'Denial of Service (request loops, large files)',
+                            'Data exfiltration to attacker-controlled server'
+                        ], `const url = req.query.url;\nconst response = await fetch(url); // SSRF vulnerability!`, 'const ALLOWED_HOSTS = [\'api.example.com\', \'cdn.example.com\'];\nconst url = new URL(req.query.url);\nif (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error(\'Invalid URL\');\n// Also block private IPs: 127.0.0.1, 10.0.0.0/8, 192.168.0.0/16, 169.254.0.0/16\nconst response = await fetch(url.toString());', 'Always validate URLs using an allowlist of permitted hostnames. Block private IP ranges (127.0.0.1, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 169.254.0.0/16) and cloud metadata endpoints (169.254.169.254). Use URL parsing (new URL()) to prevent bypasses. Never use user input directly in fetch/axios/http.request.'));
+                    }
+                }
+            }
+        }
+        // Pattern 2: axios methods with user-controlled URL
+        if (trimmed.match(/axios\.(get|post|put|patch|delete|head|options|request)\s*\(/)) {
+            const axiosCallMatch = trimmed.match(/axios\.(get|post|put|patch|delete|head|options|request)\s*\(\s*([^,)]+)/);
+            if (axiosCallMatch) {
+                const urlArg = axiosCallMatch[2].trim();
+                const hasDirectUserInput = urlArg.includes('req.query') ||
+                    urlArg.includes('req.body') ||
+                    urlArg.includes('req.params') ||
+                    urlArg.includes('req.headers');
+                const hasUserInputVariable = userInputVariables.has(urlArg);
+                const hasTemplateLiteralWithInput = trimmed.includes('`') &&
+                    (trimmed.includes('${req.') || trimmed.match(/\$\{[^}]*\}/));
+                if (hasDirectUserInput || hasUserInputVariable || hasTemplateLiteralWithInput) {
+                    const isHardcodedUrl = urlArg.match(/^['"`]https?:\/\//);
+                    if (!isHardcodedUrl) {
+                        vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('ssrf', `SSRF: axios.${axiosCallMatch[1]}() with user-controlled URL`, 'Use URL allowlist validation and block private IP ranges', lineNumber, 'Server-Side Request Forgery (SSRF) via axios allows attackers to abuse the server as a proxy to access internal services, cloud metadata endpoints, or scan internal networks.', `axios.${axiosCallMatch[1]}(userUrl) // Attack: userUrl="http://localhost:6379/admin" → access internal Redis admin`, [
+                            'Internal service access',
+                            'Cloud credentials theft',
+                            'Internal network reconnaissance',
+                            'Firewall bypass',
+                            'Data exfiltration'
+                        ], `const url = req.body.url;\nconst response = await axios.${axiosCallMatch[1]}(url);`, 'const ALLOWED_HOSTS = [\'api.example.com\'];\nconst url = new URL(req.body.url);\nif (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error(\'Invalid URL\');\nconst response = await axios.get(url.toString());', 'Validate all URLs against an allowlist. Block private IPs and cloud metadata endpoints. Use URL parsing to prevent protocol and hostname bypasses.'));
+                    }
+                }
+            }
+        }
+        // Pattern 3: http.request() / https.request() with user-controlled options
+        if (trimmed.match(/(http|https)\.request\s*\(/)) {
+            const hasUserInput = trimmed.includes('req.query') ||
+                trimmed.includes('req.body') ||
+                trimmed.includes('req.params') ||
+                trimmed.includes('req.headers');
+            // Check for hostname/host in options object
+            const hasHostnameOption = trimmed.match(/hostname\s*:\s*([^,}]+)/);
+            if (hasUserInput || hasHostnameOption) {
+                const hostnameArg = hasHostnameOption ? hasHostnameOption[1].trim() : '';
+                const hasUserControlledHost = hostnameArg.includes('req.') ||
+                    userInputVariables.has(hostnameArg) ||
+                    hasUserInput;
+                if (hasUserControlledHost) {
+                    vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('ssrf', 'SSRF: http.request() with user-controlled hostname', 'Validate hostname against allowlist', lineNumber, 'User-controlled hostname in http.request() allows SSRF attacks to access internal services and cloud metadata endpoints.', 'http.request({ hostname: req.body.host }) // Attack: host="169.254.169.254" → AWS metadata', [
+                        'Internal service access',
+                        'Cloud credentials theft',
+                        'Port scanning',
+                        'Firewall bypass'
+                    ], 'const options = { hostname: req.body.host, path: \'/\' };\nhttp.request(options);', 'const ALLOWED_HOSTS = [\'api.example.com\'];\nif (!ALLOWED_HOSTS.includes(req.body.host)) throw new Error(\'Invalid host\');\nconst options = { hostname: req.body.host, path: \'/\' };\nhttp.request(options);', 'Validate all hostnames against an allowlist. Never allow user input to directly control the hostname parameter.'));
+                }
+            }
+        }
+        // Pattern 4: URL construction with user input (template literals or concatenation)
+        if (trimmed.match(/(?:const|let|var)\s+\w+\s*=\s*`.*\$\{.*\}`/) && trimmed.includes('req.')) {
+            // Check if this URL variable is used in fetch/axios
+            const urlVarMatch = trimmed.match(/(?:const|let|var)\s+(\w+)\s*=\s*`([^`]*\$\{[^}]*\}[^`]*)`/);
+            if (urlVarMatch) {
+                const urlVarName = urlVarMatch[1];
+                const urlTemplate = urlVarMatch[2];
+                // Check if template contains user input
+                const hasUserInput = urlTemplate.includes('req.query') ||
+                    urlTemplate.includes('req.body') ||
+                    urlTemplate.includes('req.params') ||
+                    urlTemplate.includes('req.headers');
+                if (hasUserInput) {
+                    // Mark this variable as user-controlled for future fetch/axios detection
+                    userInputVariables.set(urlVarName, lineNumber);
+                    vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('ssrf', 'SSRF: URL constructed with user input - vulnerable to SSRF attacks', 'Validate and sanitize user input, use URL allowlist', lineNumber, 'Constructing URLs with unsanitized user input allows attackers to inject malicious hostnames, paths, or protocols, leading to SSRF attacks on internal services.', `const url = \`https://api.example.com/\${req.params.endpoint}\`; // Attack: endpoint="../../../admin" or "@attacker.com/?" → URL manipulation`, [
+                        'URL injection and manipulation',
+                        'Access to internal services',
+                        'Protocol smuggling (http → file, gopher, etc.)',
+                        'Hostname injection',
+                        'Path traversal in URLs'
+                    ], `const url = \`https://api.example.com/\${req.query.path}\`;\nfetch(url);`, 'const ALLOWED_PATHS = [\'/users\', \'/posts\'];\nconst path = req.query.path;\nif (!ALLOWED_PATHS.includes(path)) throw new Error(\'Invalid path\');\nconst url = \`https://api.example.com\${path}\`;\nfetch(url);', 'Never interpolate user input directly into URLs. Use allowlists for paths/endpoints. Validate with URL parsing (new URL()) to prevent hostname injection. Block dangerous protocols (file, gopher, dict).'));
+                }
+            }
+        }
+        // =============================================================================
+        // PHASE A P0 - Insecure Deserialization Detection (Dec 20, 2025)
+        // =============================================================================
+        // Track JSON.parse() variable assignments
+        // Pattern: const userData = JSON.parse(req.body); const config = JSON.parse(input);
+        const jsonParseAssignment = trimmed.match(/^(?:const|let|var)\s+(\w+)\s*=\s*JSON\.parse\s*\(/);
+        if (jsonParseAssignment) {
+            const varName = jsonParseAssignment[1];
+            jsonParseVariables.set(varName, lineNumber);
+        }
+        // Check #6: Insecure Deserialization - CRITICAL
+        // Detect JSON.parse() with object merge operations (prototype pollution risk)
+        // OWASP A08:2021 - Software and Data Integrity Failures
+        // CWE-502: Deserialization of Untrusted Data
+        // Pattern 1: Object.assign() with JSON.parse() result
+        if (trimmed.match(/Object\.assign\s*\(/)) {
+            const assignMatch = trimmed.match(/Object\.assign\s*\([^,]*,\s*([^,)]+)/);
+            if (assignMatch) {
+                const sourceArg = assignMatch[1].trim();
+                // Check if source is from JSON.parse()
+                const hasJsonParse = sourceArg.includes('JSON.parse');
+                const hasJsonParseVariable = jsonParseVariables.has(sourceArg);
+                // Check if JSON.parse() input is from user
+                const hasUserInput = trimmed.includes('req.body') ||
+                    trimmed.includes('req.query') ||
+                    trimmed.includes('req.params') ||
+                    trimmed.includes('req.json()');
+                if ((hasJsonParse || hasJsonParseVariable) && (hasUserInput || hasJsonParseVariable)) {
+                    vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('deserialization', 'Insecure deserialization: Object.assign() with JSON.parse() allows prototype pollution', 'Filter dangerous keys (__proto__, constructor, prototype) before merge', lineNumber, 'Using Object.assign() with unsanitized JSON.parse() results allows attackers to inject __proto__, constructor, or prototype properties, polluting Object.prototype. This can lead to authentication bypass, privilege escalation, or remote code execution by modifying behavior of all objects in the application.', 'const userData = JSON.parse(req.body); Object.assign(target, userData); // Attack: {"__proto__": {"isAdmin": true}} → ALL objects now have isAdmin=true', [
+                        'Prototype pollution of Object.prototype',
+                        'Authentication bypass (inject isAdmin, isAuthenticated)',
+                        'Privilege escalation',
+                        'Remote Code Execution (RCE)',
+                        'Denial of Service',
+                        'Application-wide state corruption'
+                    ], 'const userData = JSON.parse(req.body);\nObject.assign(target, userData); // VULNERABLE!', 'const userData = JSON.parse(req.body);\nconst safe = Object.keys(userData)\n  .filter(key => ![\'__proto__\', \'constructor\', \'prototype\'].includes(key))\n  .reduce((obj, key) => ({ ...obj, [key]: userData[key] }), {});\nObject.assign(target, safe);', 'Always filter dangerous keys (__proto__, constructor, prototype) before merging parsed JSON. Use schema validation (zod, joi) that rejects these keys. Or use Object.create(null) for prototype-less objects. Never merge unsanitized user input into objects.'));
+                }
+            }
+        }
+        // Pattern 2: Spread operator with JSON.parse()
+        if (trimmed.match(/\.\.\.\s*JSON\.parse\s*\(/) ||
+            trimmed.match(/\.\.\.\s*\w+/)) {
+            // Check for spread with direct JSON.parse()
+            const hasDirectSpreadParse = trimmed.match(/\.\.\.\s*JSON\.parse\s*\(/);
+            // Check for spread with JSON.parse() variable (e.g., { ...userData } or { defaults: true, ...userData })
+            const spreadVarMatch = trimmed.match(/\.\.\.\s*(\w+)/);
+            const hasSpreadWithParsedVar = spreadVarMatch && jsonParseVariables.has(spreadVarMatch[1]);
+            if (hasDirectSpreadParse || hasSpreadWithParsedVar) {
+                const hasUserInput = trimmed.includes('req.body') ||
+                    trimmed.includes('req.query') ||
+                    trimmed.includes('req.params');
+                if (hasUserInput || hasSpreadWithParsedVar) {
+                    vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('deserialization', 'Insecure deserialization: Spread operator with JSON.parse() allows prototype pollution', 'Filter dangerous keys before spreading parsed JSON', lineNumber, 'Spread operator with unsanitized JSON.parse() results allows __proto__ pollution. Attackers can inject properties into Object.prototype, affecting all objects and potentially leading to authentication bypass or RCE.', 'const config = { ...JSON.parse(req.body) }; // Attack: {"__proto__": {"isAdmin": true}} → prototype polluted', [
+                        'Prototype pollution via spread operator',
+                        'Authentication bypass',
+                        'Privilege escalation',
+                        'Remote Code Execution',
+                        'Global state corruption'
+                    ], 'const config = { ...JSON.parse(userInput) }; // VULNERABLE!', 'const parsed = JSON.parse(userInput);\nconst safe = Object.keys(parsed)\n  .filter(key => ![\'__proto__\', \'constructor\', \'prototype\'].includes(key))\n  .reduce((obj, key) => ({ ...obj, [key]: parsed[key] }), {});\nconst config = { ...safe };', 'Filter dangerous keys before using spread operator with parsed JSON. Use schema validation libraries that reject __proto__. Validate object shape before merging.'));
+                }
+            }
+        }
+        // Pattern 3: Deep merge libraries (lodash _.merge, _.extend)
+        if (trimmed.match(/(_\.merge|_\.extend|merge|extend)\s*\(/)) {
+            const mergeMatch = trimmed.match(/(_\.merge|_\.extend|merge|extend)\s*\([^,]*,\s*([^,)]+)/);
+            if (mergeMatch) {
+                const sourceArg = mergeMatch[2].trim();
+                const hasJsonParse = sourceArg.includes('JSON.parse');
+                const hasJsonParseVariable = jsonParseVariables.has(sourceArg);
+                const hasUserInput = trimmed.includes('req.body') ||
+                    trimmed.includes('req.query') ||
+                    trimmed.includes('req.params');
+                if ((hasJsonParse || hasJsonParseVariable) && (hasUserInput || hasJsonParseVariable)) {
+                    vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('deserialization', 'Insecure deserialization: Deep merge with JSON.parse() allows prototype pollution', 'Use safe merge libraries or filter dangerous keys', lineNumber, 'Deep merge functions (_.merge, _.extend) with unsanitized JSON.parse() results enable __proto__ pollution. Lodash merge recursively copies properties including __proto__, polluting Object.prototype and affecting all objects globally.', '_.merge(target, JSON.parse(req.body)); // Attack: {"__proto__": {"isAdmin": true}} → prototype polluted', [
+                        'Prototype pollution via deep merge',
+                        'Authentication bypass',
+                        'Privilege escalation',
+                        'Remote Code Execution',
+                        'Recursive pollution of nested objects'
+                    ], 'const userData = JSON.parse(req.body);\n_.merge(config, userData); // VULNERABLE!', 'import { merge } from \'lodash-es\';\nconst userData = JSON.parse(req.body);\nconst safe = Object.keys(userData)\n  .filter(key => ![\'__proto__\', \'constructor\', \'prototype\'].includes(key))\n  .reduce((obj, key) => ({ ...obj, [key]: userData[key] }), {});\nmerge(config, safe);', 'Use safe merge alternatives or filter dangerous keys. Libraries like \'just-safe-set\' prevent prototype pollution. Always validate and sanitize user input before merging. Use schema validation (zod, joi) that rejects __proto__.'));
+                }
+            }
+        }
+        // Pattern 4: Direct JSON.parse() with user input (warn about potential misuse)
+        if (trimmed.match(/JSON\.parse\s*\(/) &&
+            (trimmed.includes('req.body') ||
+                trimmed.includes('req.query') ||
+                trimmed.includes('req.params'))) {
+            // Check if this line is just assignment (not already caught by merge/spread)
+            const isSimpleAssignment = trimmed.match(/^(?:const|let|var)\s+\w+\s*=\s*JSON\.parse/);
+            if (isSimpleAssignment) {
+                // Look ahead to next few lines to see if result is used in unsafe operations
+                const nextLines = lines.slice(index + 1, Math.min(index + 6, lines.length));
+                const hasUnsafeUsage = nextLines.some(nextLine => {
+                    const lowerLine = nextLine.toLowerCase();
+                    return (lowerLine.includes('object.assign') ||
+                        lowerLine.includes('.merge') ||
+                        lowerLine.includes('.extend') ||
+                        lowerLine.match(/\{\s*\.\.\./));
+                });
+                if (hasUnsafeUsage) {
+                    vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('deserialization', 'Potentially insecure JSON deserialization - ensure __proto__ filtering', 'Filter dangerous keys before using parsed JSON in object operations', lineNumber, 'JSON.parse() with user input followed by object merge operations can enable prototype pollution if __proto__ is not filtered.', 'const data = JSON.parse(req.body); // Later used in Object.assign() → prototype pollution risk', [
+                        'Potential prototype pollution',
+                        'Authentication bypass risk',
+                        'Privilege escalation risk'
+                    ], 'const data = JSON.parse(req.body);\n// Later: Object.assign(target, data);', 'const parsed = JSON.parse(req.body);\nconst data = Object.keys(parsed)\n  .filter(key => ![\'__proto__\', \'constructor\', \'prototype\'].includes(key))\n  .reduce((obj, key) => ({ ...obj, [key]: parsed[key] }), {});', 'Always filter dangerous keys after JSON.parse() if result will be merged into objects. Use schema validation that rejects __proto__.'));
+                }
+            }
+        }
+        // =============================================================================
+        // PHASE B - XXE (XML External Entity) Detection (Dec 20, 2025)
+        // =============================================================================
+        // 9. XXE - XML External Entity - HIGH
+        // Pattern: XML parsing without secure options (DTD/external entity disabling)
+        // Detects: xml2js.parseString(), libxmljs.parseXml(), DOMParser.parseFromString()
+        const xmlParseMethods = [
+            { method: 'xml2js.parseString', secureOption: null },
+            { method: 'parseString', secureOption: null }, // xml2js method called directly
+            { method: 'libxmljs.parseXml', secureOption: 'noent: false' },
+            { method: 'parseXml', secureOption: 'noent: false' }, // libxmljs method
+            { method: 'DOMParser', secureOption: null },
+            { method: 'parseFromString', secureOption: null } // DOMParser method
+        ];
+        for (const xmlMethod of xmlParseMethods) {
+            if (trimmed.includes(xmlMethod.method)) {
+                // Check if parsing user-controlled XML
+                const hasUserInput = trimmed.includes('req.body') ||
+                    trimmed.includes('req.json()') ||
+                    trimmed.includes('req.query') ||
+                    trimmed.includes('req.params') ||
+                    Array.from(userInputVariables.keys()).some(varName => trimmed.includes(varName));
+                if (hasUserInput) {
+                    // For xml2js and DOMParser, any usage with user input is vulnerable
+                    // (they don't disable DTD by default)
+                    if (xmlMethod.method.includes('xml2js') || xmlMethod.method.includes('parseString') ||
+                        xmlMethod.method.includes('DOMParser') || xmlMethod.method.includes('parseFromString')) {
+                        vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('xxe', `XXE (XML External Entity) risk via ${xmlMethod.method}() with user-controlled XML`, 'Disable DTD processing and external entities in XML parser', lineNumber, 'XML parsers that process Document Type Definitions (DTD) and external entities are vulnerable to XXE attacks. Attackers can read local files, perform SSRF attacks, or cause denial of service by referencing external resources in malicious XML.', `${xmlMethod.method}(req.body.xml) // Attack: XML with <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> reads sensitive files`, [
+                            'Local file disclosure (read /etc/passwd, application secrets)',
+                            'Server-Side Request Forgery (SSRF) to internal services',
+                            'Denial of Service (billion laughs attack)',
+                            'Remote Code Execution (in rare cases with PHP expect)',
+                            'Port scanning of internal network'
+                        ], `import xml2js from 'xml2js';\nconst parser = new xml2js.Parser();\nparser.parseString(req.body.xml, callback); // Vulnerable: DTD enabled by default`, `import xml2js from 'xml2js';\nconst parser = new xml2js.Parser({\n  explicitRoot: false,\n  explicitArray: false,\n  // CRITICAL: Disable DTD processing to prevent XXE\n  // xml2js uses sax parser - need to configure sax options\n  strict: false,\n  // For libxmljs:\n  // { noent: false, dtdload: false, dtdvalid: false }\n});\nparser.parseString(req.body.xml, callback);`, 'Always disable DTD processing and external entity resolution in XML parsers. For xml2js, use sax parser with secure options. For libxmljs, set noent: false. For DOMParser, do not use with untrusted XML. Consider using JSON instead of XML for APIs.'));
+                    }
+                    // For libxmljs, check if secure options are present
+                    else if (xmlMethod.method.includes('libxmljs') || xmlMethod.method.includes('parseXml')) {
+                        const hasSecureOption = trimmed.includes('noent') && trimmed.includes('false');
+                        if (!hasSecureOption) {
+                            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('xxe', `XXE (XML External Entity) risk via ${xmlMethod.method}() without secure options`, 'Set noent: false to disable entity expansion', lineNumber, 'libxmljs XML parser enables entity expansion by default, allowing XXE attacks through malicious XML documents containing external entity references.', `${xmlMethod.method}(userXml) // Attack: <!ENTITY xxe SYSTEM "http://internal.server/admin"> causes SSRF`, [
+                                'XML External Entity injection',
+                                'Local file disclosure',
+                                'SSRF attacks',
+                                'Denial of Service'
+                            ], `libxmljs.parseXml(req.body.xml); // Missing noent: false`, `libxmljs.parseXml(req.body.xml, { noent: false, dtdload: false, dtdvalid: false });`, 'Always configure libxmljs with noent: false, dtdload: false, and dtdvalid: false to prevent XXE'));
+                        }
+                    }
+                }
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=code-injection.js.map

package/dist/src/lib/analyzers/typescript/security-checks/code-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-injection.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/code-injection.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAoBH,gDAskBC;AAvlBD,sEAAqF;AAErF;;;;;;;;;;;;;;GAcG;AACH,SAAgB,kBAAkB,CAChC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,+BAA+B;IAErF,6EAA6E;IAC7E,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,+BAA+B;IAErF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,wDAAwD;QACxD,iCAAiC;QACjC,IAAI,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,EAAE,CAAC;YAC7D,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,qBAAqB,EACrB,4CAA4C,EAC5C,8DAA8D,EAC9D,UAAU,EACV,uKAAuK,EACvK,uFAAuF,EACvF;gBACE,6BAA6B;gBAC7B,uBAAuB;gBACvB,sBAAsB;gBACtB,aAAa;aACd,EACD,4JAA4J,EAC5J,2MAA2M,EAC3M,qHAAqH,CACtH,CAAC,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,wCAAwC;QACxC,IAAI,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC;YAC5C,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,eAAe,EACf,kCAAkC,EAClC,uDAAuD,EACvD,UAAU,EACV,8HAA8H,EAC9H,uGAAuG,EACvG;gBACE,8BAA8B;gBAC9B,6BAA6B;gBAC7B,+BAA+B;gBAC/B,uBAAuB;gBACvB,+CAA+C;aAChD,EACD,iFAAiF,EACjF,iHAAiH,EACjH,wGAAwG,CACzG,CAAC,CAAC;QACL,CAAC;QAED,mCAAmC;QACnC,IAAI,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACpG,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,mBAAmB,EACnB,sCAAsC,EACtC,+DAA+D,EAC/D,UAAU,EACV,gIAAgI,EAChI,0DAA0D,EAC1D;gBACE,6BAA6B;gBAC7B,4BAA4B;gBAC5B,4BAA4B;gBAC5B,sBAAsB;gBACtB,8BAA8B;aAC/B,EACD,iFAAiF,EACjF,qGAAqG,EACrG,gIAAgI,CACjI,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,iFAAiF;QACjF,IAAI,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC;YAChD,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAM,0BAA0B;gBACvE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAiB,kCAAkC;gBAC/E,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAgB,iCAAiC;YACjF,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,gBAAgB,EAChB,gDAAgD,EAChD,qEAAqE,EACrE,UAAU,EACV,8JAA8J,EAC9J,uEAAuE,EACvE;gBACE,0BAA0B;gBAC1B,mDAAmD;gBACnD,wBAAwB;gBACxB,0BAA0B;aAC3B,EACD,uGAAuG,EACvG,0NAA0N,EAC1N,2GAA2G,CAC5G,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,6CAA6C;QAC7C,gFAAgF;QAEhF,wCAAwC;QACxC,0EAA0E;QAC1E,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC/H,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;YACvC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;QAED,2CAA2C;QAC3C,4DAA4D;QAC5D,+CAA+C;QAC/C,8CAA8C;QAE9C,8CAA8C;QAC9C,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAEhE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAExC,8BAA8B;gBAC9B,MAAM,kBAAkB,GACtB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC5B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC3B,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC7B,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;oBAC9B,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAEhC,gCAAgC;gBAChC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAE5D,6CAA6C;gBAC7C,MAAM,2BAA2B,GAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACrB,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;gBAE/D,2DAA2D;gBAC3D,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAExE,IAAI,kBAAkB,IAAI,oBAAoB,IAAI,2BAA2B,IAAI,eAAe,EAAE,CAAC;oBACjG,wCAAwC;oBACxC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;oBAEzD,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,MAAM,EACN,2EAA2E,EAC3E,0DAA0D,EAC1D,UAAU,EACV,wRAAwR,EACxR,oJAAoJ,EACpJ;4BACE,oEAAoE;4BACpE,8DAA8D;4BAC9D,gCAAgC;4BAChC,oCAAoC;4BACpC,uCAAuC;4BACvC,gDAAgD;4BAChD,iDAAiD;yBAClD,EACD,uFAAuF,EACvF,uTAAuT,EACvT,4TAA4T,CAC7T,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,EAAE,CAAC;YAClF,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;YAEhH,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAExC,MAAM,kBAAkB,GACtB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC5B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC3B,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC7B,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBAEjC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAE5D,MAAM,2BAA2B,GAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACrB,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;gBAE/D,IAAI,kBAAkB,IAAI,oBAAoB,IAAI,2BAA2B,EAAE,CAAC;oBAC9E,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;oBAEzD,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,MAAM,EACN,eAAe,cAAc,CAAC,CAAC,CAAC,6BAA6B,EAC7D,0DAA0D,EAC1D,UAAU,EACV,gLAAgL,EAChL,SAAS,cAAc,CAAC,CAAC,CAAC,0FAA0F,EACpH;4BACE,yBAAyB;4BACzB,yBAAyB;4BACzB,iCAAiC;4BACjC,iBAAiB;4BACjB,mBAAmB;yBACpB,EACD,2DAA2D,cAAc,CAAC,CAAC,CAAC,QAAQ,EACpF,mNAAmN,EACnN,oJAAoJ,CACrJ,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,IAAI,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC;YAChD,MAAM,YAAY,GAChB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAElC,4CAA4C;YAC5C,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAEnE,IAAI,YAAY,IAAI,iBAAiB,EAAE,CAAC;gBACtC,MAAM,WAAW,GAAG,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,MAAM,qBAAqB,GACzB,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC5B,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC;oBACnC,YAAY,CAAC;gBAEf,IAAI,qBAAqB,EAAE,CAAC;oBAC1B,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,MAAM,EACN,oDAAoD,EACpD,qCAAqC,EACrC,UAAU,EACV,0HAA0H,EAC1H,4FAA4F,EAC5F;wBACE,yBAAyB;wBACzB,yBAAyB;wBACzB,eAAe;wBACf,iBAAiB;qBAClB,EACD,mFAAmF,EACnF,iNAAiN,EACjN,iHAAiH,CAClH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,mFAAmF;QACnF,IAAI,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5F,oDAAoD;YACpD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAE/F,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAClC,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAEnC,wCAAwC;gBACxC,MAAM,YAAY,GAChB,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACjC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAChC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAClC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBAEtC,IAAI,YAAY,EAAE,CAAC;oBACjB,yEAAyE;oBACzE,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;oBAE/C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,MAAM,EACN,oEAAoE,EACpE,qDAAqD,EACrD,UAAU,EACV,kKAAkK,EAClK,+IAA+I,EAC/I;wBACE,gCAAgC;wBAChC,6BAA6B;wBAC7B,gDAAgD;wBAChD,oBAAoB;wBACpB,wBAAwB;qBACzB,EACD,0EAA0E,EAC1E,qNAAqN,EACrN,2MAA2M,CAC5M,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,iEAAiE;QACjE,gFAAgF;QAEhF,0CAA0C;QAC1C,oFAAoF;QACpF,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC/F,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;YACvC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;QAED,gDAAgD;QAChD,8EAA8E;QAC9E,wDAAwD;QACxD,6CAA6C;QAE7C,sDAAsD;QACtD,IAAI,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAE1E,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAExC,uCAAuC;gBACvC,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBACtD,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAE/D,2CAA2C;gBAC3C,MAAM,YAAY,GAChB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAEjC,IAAI,CAAC,YAAY,IAAI,oBAAoB,CAAC,IAAI,CAAC,YAAY,IAAI,oBAAoB,CAAC,EAAE,CAAC;oBACrF,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,iBAAiB,EACjB,wFAAwF,EACxF,wEAAwE,EACxE,UAAU,EACV,qTAAqT,EACrT,yJAAyJ,EACzJ;wBACE,yCAAyC;wBACzC,yDAAyD;wBACzD,sBAAsB;wBACtB,6BAA6B;wBAC7B,mBAAmB;wBACnB,mCAAmC;qBACpC,EACD,yFAAyF,EACzF,8PAA8P,EAC9P,gQAAgQ,CACjQ,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAElC,4CAA4C;YAC5C,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAExE,yGAAyG;YACzG,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACvD,MAAM,sBAAsB,GAAG,cAAc,IAAI,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;YAE3F,IAAI,oBAAoB,IAAI,sBAAsB,EAAE,CAAC;gBACnD,MAAM,YAAY,GAChB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAEjC,IAAI,YAAY,IAAI,sBAAsB,EAAE,CAAC;oBAC3C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,iBAAiB,EACjB,wFAAwF,EACxF,oDAAoD,EACpD,UAAU,EACV,yNAAyN,EACzN,8GAA8G,EAC9G;wBACE,yCAAyC;wBACzC,uBAAuB;wBACvB,sBAAsB;wBACtB,uBAAuB;wBACvB,yBAAyB;qBAC1B,EACD,6DAA6D,EAC7D,wPAAwP,EACxP,mKAAmK,CACpK,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,IAAI,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAE5F,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAEvC,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBACtD,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAE/D,MAAM,YAAY,GAChB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAEjC,IAAI,CAAC,YAAY,IAAI,oBAAoB,CAAC,IAAI,CAAC,YAAY,IAAI,oBAAoB,CAAC,EAAE,CAAC;oBACrF,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,iBAAiB,EACjB,mFAAmF,EACnF,mDAAmD,EACnD,UAAU,EACV,2OAA2O,EAC3O,yGAAyG,EACzG;wBACE,oCAAoC;wBACpC,uBAAuB;wBACvB,sBAAsB;wBACtB,uBAAuB;wBACvB,uCAAuC;qBACxC,EACD,mFAAmF,EACnF,4RAA4R,EAC5R,sOAAsO,CACvO,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACjC,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAErC,6EAA6E;YAC7E,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAEvF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,6EAA6E;gBAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5E,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAC/C,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;oBACzC,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;wBACnC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC5B,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC7B,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAC/B,CAAC;gBACJ,CAAC,CAAC,CAAC;gBAEH,IAAI,cAAc,EAAE,CAAC;oBACnB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,iBAAiB,EACjB,wEAAwE,EACxE,qEAAqE,EACrE,UAAU,EACV,+HAA+H,EAC/H,gGAAgG,EAChG;wBACE,+BAA+B;wBAC/B,4BAA4B;wBAC5B,2BAA2B;qBAC5B,EACD,4EAA4E,EAC5E,0NAA0N,EAC1N,sIAAsI,CACvI,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+DAA+D;QAC/D,gFAAgF;QAEhF,sCAAsC;QACtC,8EAA8E;QAC9E,kFAAkF;QAElF,MAAM,eAAe,GAAG;YACtB,EAAE,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,IAAI,EAAE;YACpD,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,gCAAgC;YAC/E,EAAE,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE;YAC7D,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,kBAAkB;YACxE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE;YAC3C,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,mBAAmB;SACtE,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,eAAe,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,uCAAuC;gBACvC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC9B,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEtG,IAAI,YAAY,EAAE,CAAC;oBACjB,oEAAoE;oBACpE,sCAAsC;oBACtC,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;wBAC/E,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;wBAC3F,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,KAAK,EACL,sCAAsC,SAAS,CAAC,MAAM,6BAA6B,EACnF,4DAA4D,EAC5D,UAAU,EACV,oPAAoP,EACpP,GAAG,SAAS,CAAC,MAAM,qHAAqH,EACxI;4BACE,+DAA+D;4BAC/D,yDAAyD;4BACzD,2CAA2C;4BAC3C,uDAAuD;4BACvD,mCAAmC;yBACpC,EACD,sJAAsJ,EACtJ,sXAAsX,EACtX,yPAAyP,CAC1P,CAAC,CAAC;oBACL,CAAC;oBACD,oDAAoD;yBAC/C,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACxF,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;wBAC/E,IAAI,CAAC,eAAe,EAAE,CAAC;4BACrB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,KAAK,EACL,sCAAsC,SAAS,CAAC,MAAM,2BAA2B,EACjF,8CAA8C,EAC9C,UAAU,EACV,sJAAsJ,EACtJ,GAAG,SAAS,CAAC,MAAM,sFAAsF,EACzG;gCACE,+BAA+B;gCAC/B,uBAAuB;gCACvB,cAAc;gCACd,mBAAmB;6BACpB,EACD,0DAA0D,EAC1D,qFAAqF,EACrF,iGAAiG,CAClG,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/typescript/security-checks/code-quality.d.ts

@@ -0,0 +1,23 @@
+/**
+ * TypeScript Code Quality Security Checks
+ * OWASP A01:2021 - Broken Access Control
+ * OWASP A06:2021 - Vulnerable and Outdated Components
+ *
+ * Detects ReDoS, missing error handling, console.log, and insecure cookies.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for code quality security vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #15: Regex DoS (ReDoS) (MEDIUM)
+ * - Check #16: Missing error handling (LOW)
+ * - Check #17: console.log in production (LOW)
+ * - Check #18: Insecure cookie settings (MEDIUM)
+ *
+ * @param code - Full code string (for global checks like try/catch presence)
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkCodeQuality(code: string, lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=code-quality.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/code-quality.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-quality.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/code-quality.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CA2IzB"}

package/dist/src/lib/analyzers/typescript/security-checks/code-quality.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * TypeScript Code Quality Security Checks
+ * OWASP A01:2021 - Broken Access Control
+ * OWASP A06:2021 - Vulnerable and Outdated Components
+ *
+ * Detects ReDoS, missing error handling, console.log, and insecure cookies.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCodeQuality = checkCodeQuality;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for code quality security vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #15: Regex DoS (ReDoS) (MEDIUM)
+ * - Check #16: Missing error handling (LOW)
+ * - Check #17: console.log in production (LOW)
+ * - Check #18: Insecure cookie settings (MEDIUM)
+ *
+ * @param code - Full code string (for global checks like try/catch presence)
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkCodeQuality(code, lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmed ||
+            inMultiLineComment ||
+            trimmed.startsWith('//') ||
+            trimmed.startsWith('*')) {
+            return;
+        }
+        // 15. Regex DoS (ReDoS) - MEDIUM
+        if (trimmed.match(/new\s+RegExp|\/.*\(.*\+.*\)/)) {
+            const hasNestedQuantifiers = trimmed.match(/\([^)]*\+[^)]*\)\+|\([^)]*\*[^)]*\)\+|\([^)]*\+[^)]*\)\*/);
+            if (hasNestedQuantifiers) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('redos', 'Regex with nested quantifiers can cause DoS (ReDoS)', 'Simplify regex or use safe-regex libraries', lineNumber, 'Complex regex patterns with nested quantifiers can cause exponential backtracking, making the application freeze when processing crafted input.', 'const pattern = /(a+)+b/; pattern.test("aaaaaaaaaaaaaaaaaaaaX"); // Takes exponentially longer with more "a"s', [
+                    'Denial of Service (DoS)',
+                    'Application freeze',
+                    'CPU exhaustion',
+                    'Timeouts for legitimate users'
+                ], 'const emailRegex = /^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$/; // Safe', 'const emailRegex = /^([a-zA-Z0-9_\\-\\.]+)+@([a-zA-Z0-9_\\-\\.]+)+\\.([a-zA-Z]{2,5})+$/; // DANGEROUS: nested quantifiers', 'Avoid nested quantifiers like (a+)+ or (a*)*. Test regex with safe-regex library or refactor to use simpler patterns'));
+            }
+        }
+        // 16. Missing error handling - LOW
+        if ((trimmed.includes('fetch(') || trimmed.includes('await ')) &&
+            !code.includes('try') && !code.includes('.catch')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('missing-error-handling', 'Asynchronous operation without error handling', 'Add try/catch or .catch() to prevent crashes', lineNumber, 'Unhandled promise rejections can crash Node.js processes or leak error messages to users, potentially exposing sensitive information.', 'await fetch("/api/data"); // If fetch fails, uncaught exception crashes the app', [
+                'Application crashes',
+                'Information disclosure via error messages',
+                'Poor user experience',
+                'Potential security info leakage'
+            ], 'const data = await fetch("/api/users"); // No error handling', 'try {\n  const data = await fetch("/api/users");\n} catch (error) {\n  console.error("Failed to fetch:", error);\n}', 'Always wrap async operations in try/catch blocks or use .catch() to handle errors gracefully'));
+        }
+        // 17. console.log in production - LOW
+        // ENHANCED: Only flag console.log/info, NOT console.error/warn/debug (legitimate error logging)
+        // console.error and console.warn are standard error logging practices and should not be flagged
+        const consoleMatch = trimmed.match(/console\.(log|info)\b/);
+        if (consoleMatch) {
+            const consoleMethod = consoleMatch[1]; // log or info
+            // FIXED: Skip console.log in test files (Dec 10, 2025)
+            // Detect test file patterns: test-related messages, test framework usage, etc.
+            const isTestFileContext = trimmed.toLowerCase().includes('test') ||
+                trimmed.toLowerCase().includes('spec') ||
+                trimmed.toLowerCase().includes('loaded successfully') ||
+                trimmed.toLowerCase().includes('fixture') ||
+                trimmed.toLowerCase().includes('mock') ||
+                code.includes('describe(') ||
+                code.includes('it(') ||
+                code.includes('test(') ||
+                code.includes('expect(');
+            if (!isTestFileContext) {
+                console.log(`[code-quality.ts] Line ${lineNumber}: FLAGGING console.${consoleMethod}`);
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('console-log', 'console.log can leak sensitive information in production', 'Use professional logger (winston, pino) and remove in build', lineNumber, 'Console statements in production can leak sensitive data (tokens, passwords, PII) to browser DevTools or server logs accessible to attackers.', 'console.log("User logged in:", user.email, user.password); // Leaks password to logs', [
+                    'Sensitive data exposure',
+                    'PII leakage (GDPR violation)',
+                    'Token and credential theft',
+                    'Debug information disclosure'
+                ], 'console.log("API Response:", apiResponse); // May contain sensitive data', 'import logger from "winston";\nlogger.info("API Response", { userId: user.id }); // Structured logging, redact sensitive fields', 'Use proper logging libraries (winston, pino) with log levels, redaction, and production-safe configuration'));
+            }
+        }
+        // 18. Insecure cookie settings - MEDIUM
+        if (trimmed.includes('document.cookie') && trimmed.includes('=') &&
+            !trimmed.includes('httpOnly') && !trimmed.includes('secure') &&
+            !trimmed.startsWith('//')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('insecure-cookies', 'Cookie set without security flags (httpOnly, secure, sameSite)', 'Set cookies server-side with httpOnly, secure, and sameSite flags', lineNumber, 'Cookies without httpOnly flag are accessible to JavaScript (XSS vulnerability). Cookies without secure flag can be intercepted over HTTP.', 'document.cookie = "sessionToken=" + token; // Accessible to XSS, transmitted over HTTP', [
+                'Session hijacking via XSS',
+                'Token theft',
+                'Man-in-the-middle attacks (if not secure)',
+                'CSRF attacks (if no sameSite)'
+            ], 'document.cookie = "token=" + authToken; // INSECURE', '// Server-side (Express.js):\nres.cookie("token", authToken, {\n  httpOnly: true,  // Not accessible to JavaScript\n  secure: true,    // Only sent over HTTPS\n  sameSite: "strict" // CSRF protection\n});', 'Always set cookies server-side with httpOnly (XSS protection), secure (HTTPS only), and sameSite (CSRF protection) flags'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=code-quality.js.map

package/dist/src/lib/analyzers/typescript/security-checks/code-quality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-quality.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/code-quality.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAkBH,4CA8IC;AA7JD,sEAAqF;AAErF;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAC9B,IAAY,EACZ,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,wDAAwD;QACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,OAAO;YACR,kBAAkB;YAClB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACjD,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;YACvG,IAAI,oBAAoB,EAAE,CAAC;gBACzB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,OAAO,EACP,qDAAqD,EACrD,4CAA4C,EAC5C,UAAU,EACV,iJAAiJ,EACjJ,+GAA+G,EAC/G;oBACE,yBAAyB;oBACzB,oBAAoB;oBACpB,gBAAgB;oBAChB,+BAA+B;iBAChC,EACD,+FAA+F,EAC/F,2HAA2H,EAC3H,sHAAsH,CACvH,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1D,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,wBAAwB,EACxB,+CAA+C,EAC/C,8CAA8C,EAC9C,UAAU,EACV,uIAAuI,EACvI,iFAAiF,EACjF;gBACE,qBAAqB;gBACrB,2CAA2C;gBAC3C,sBAAsB;gBACtB,iCAAiC;aAClC,EACD,8DAA8D,EAC9D,qHAAqH,EACrH,8FAA8F,CAC/F,CAAC,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC5D,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc;YAErD,uDAAuD;YACvD,+EAA+E;YAC/E,MAAM,iBAAiB,GACrB,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACtC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACtC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACrD,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACzC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACtC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,0BAA0B,UAAU,sBAAsB,aAAa,EAAE,CAAC,CAAC;gBAEvF,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,aAAa,EACb,0DAA0D,EAC1D,6DAA6D,EAC7D,UAAU,EACV,+IAA+I,EAC/I,sFAAsF,EACtF;oBACE,yBAAyB;oBACzB,8BAA8B;oBAC9B,4BAA4B;oBAC5B,8BAA8B;iBAC/B,EACD,0EAA0E,EAC1E,iIAAiI,EACjI,4GAA4G,CAC7G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5D,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5D,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,kBAAkB,EAClB,gEAAgE,EAChE,mEAAmE,EACnE,UAAU,EACV,2IAA2I,EAC3I,wFAAwF,EACxF;gBACE,2BAA2B;gBAC3B,aAAa;gBACb,2CAA2C;gBAC3C,+BAA+B;aAChC,EACD,qDAAqD,EACrD,8MAA8M,EAC9M,0HAA0H,CAC3H,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/typescript/security-checks/credentials-crypto.d.ts

@@ -0,0 +1,21 @@
+/**
+ * TypeScript Credentials & Cryptography Security Checks
+ * OWASP A07:2021 - Authentication & Identification Failures
+ * OWASP A02:2021 - Cryptographic Failures
+ *
+ * Detects hardcoded credentials, weak cryptography, and insecure storage.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for credentials and cryptography vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #8: Hardcoded credentials (CRITICAL)
+ * - Check #9: Math.random() for security (MEDIUM)
+ * - Check #10: localStorage for sensitive data (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkCredentialsAndCrypto(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=credentials-crypto.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/credentials-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-crypto.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/credentials-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAoPzB"}