codeslick-cli 1.0.0

package/dist/src/lib/analyzers/typescript/security-checks/credentials-crypto.js

@@ -0,0 +1,153 @@
+"use strict";
+/**
+ * TypeScript Credentials & Cryptography Security Checks
+ * OWASP A07:2021 - Authentication & Identification Failures
+ * OWASP A02:2021 - Cryptographic Failures
+ *
+ * Detects hardcoded credentials, weak cryptography, and insecure storage.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCredentialsAndCrypto = checkCredentialsAndCrypto;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for credentials and cryptography vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #8: Hardcoded credentials (CRITICAL)
+ * - Check #9: Math.random() for security (MEDIUM)
+ * - Check #10: localStorage for sensitive data (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkCredentialsAndCrypto(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // OWASP A07:2021 - Authentication & Identification Failures
+        // 8. Hardcoded credentials - CRITICAL
+        // FIXED: Added [\w_-]* to match variable names like SECRET_KEY, API_TOKEN, etc.
+        if (trimmed.match(/(password|passwd|pwd|secret|token|api[-_]?key|private[-_]?key|auth)[\w_-]*\s*[:=]\s*['"]/i) &&
+            !trimmed.includes('process.env') && !trimmed.includes('config.')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('hardcoded-credentials', 'CRITICAL: Hardcoded credentials in code', 'Use environment variables (process.env) or secret managers', lineNumber, 'Hardcoded credentials can be extracted from source code, version control history, or compiled bundles, granting unauthorized access to attackers.', 'const API_KEY = "sk-1234567890abcdef"; // Exposed in git history and production bundles', [
+                'Unauthorized access to APIs and databases',
+                'Data breaches',
+                'Account takeover',
+                'Compliance violations (PCI-DSS, SOC 2)'
+            ], 'const password = "MyP@ssw0rd123"; // NEVER hardcode!', 'const password = process.env.DB_PASSWORD; // Load from environment', 'Store credentials in environment variables or use secret management services (AWS Secrets Manager, HashiCorp Vault)'));
+        }
+        // OWASP A02:2021 - Cryptographic Failures
+        // 8b. Weak cryptographic hashing (MD5, SHA1) - HIGH
+        if (trimmed.match(/createHash\s*\(\s*['"`](md5|sha1|md4)['"`]\)/i)) {
+            const hashMatch = trimmed.match(/createHash\s*\(\s*['"`](md5|sha1|md4)['"`]\)/i);
+            const weakAlgorithm = hashMatch ? hashMatch[1].toUpperCase() : 'MD5/SHA1';
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('weak-hashing', `Weak cryptographic hashing algorithm: ${weakAlgorithm}`, 'Use SHA-256, SHA-384, or SHA-512 for cryptographic purposes', lineNumber, `${weakAlgorithm} is cryptographically broken and should not be used for security purposes. It's vulnerable to collision attacks where attackers can create two different inputs that produce the same hash.`, `crypto.createHash('md5').update(password).digest('hex'); // Vulnerable to collisions`, [
+                'Password hash collisions',
+                'Integrity verification bypass',
+                'Digital signature forgery',
+                'Rainbow table attacks',
+                'Compliance violations (PCI-DSS, HIPAA)'
+            ], `const hash = crypto.createHash('md5').update(data).digest('hex');`, `import crypto from 'crypto';\nconst hash = crypto.createHash('sha256').update(data).digest('hex'); // Use SHA-256 or stronger`, `${weakAlgorithm} is deprecated and insecure. Use SHA-256 or stronger algorithms for password hashing, use bcrypt/argon2 for password storage`));
+        }
+        // 9. Math.random() for security - MEDIUM
+        if (trimmed.match(/Math\.random\(\)/)) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('weak-random', 'Math.random() is cryptographically weak', 'Use crypto.randomBytes() or crypto.getRandomValues()', lineNumber, 'Math.random() uses a predictable pseudo-random algorithm, allowing attackers to predict values for session tokens, passwords, or cryptographic keys.', 'const token = Math.random().toString(36); // Predictable, can be guessed', [
+                'Session hijacking',
+                'Predictable tokens and passwords',
+                'Cryptographic key compromise',
+                'CSRF token bypass'
+            ], 'const sessionId = Math.random().toString(36).substring(7);', 'import crypto from "crypto";\nconst sessionId = crypto.randomBytes(16).toString("hex");', 'Use Node.js crypto.randomBytes() or Web Crypto API crypto.getRandomValues() for cryptographically secure random values'));
+        }
+        // 10. localStorage for sensitive data - MEDIUM
+        if (trimmed.match(/localStorage\.(setItem|set)\([^)]*(?:token|password|key|secret)/i)) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('insecure-storage', 'localStorage is not safe for sensitive data', 'Use httpOnly cookies, temporary sessionStorage, or encrypted IndexedDB', lineNumber, 'localStorage is vulnerable to XSS attacks - any JavaScript code can read it. Sensitive data stored here can be stolen by attackers.', 'localStorage.setItem("authToken", token); // Accessible to any JavaScript code, including XSS payloads', [
+                'Token theft via XSS attacks',
+                'Session hijacking',
+                'Credential theft',
+                'Persistent access for attackers'
+            ], 'localStorage.setItem("token", authToken); // VULNERABLE to XSS', '// Server-side: Set httpOnly cookie\nres.cookie("token", authToken, { httpOnly: true, secure: true, sameSite: "strict" });', 'Use httpOnly cookies (not accessible to JavaScript) or encrypt data with Web Crypto API before storing'));
+        }
+        // =============================================================================
+        // PHASE B - Weak Encryption (AES-ECB) Detection (Dec 20, 2025)
+        // =============================================================================
+        // 12. Weak Encryption - AES-ECB Mode - HIGH
+        // Pattern: crypto.createCipher('aes-*-ecb') or createCipheriv with ECB mode
+        if (trimmed.includes('crypto.create') &&
+            (trimmed.includes('Cipher') || trimmed.includes('Decipher')) &&
+            (trimmed.includes('ecb') || trimmed.includes('ECB'))) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('weak-encryption-ecb', 'Weak encryption - AES-ECB mode does not hide data patterns', 'Use AES-GCM or AES-CBC mode with proper IV instead of ECB', lineNumber, 'Electronic Codebook (ECB) mode is insecure because identical plaintext blocks produce identical ciphertext blocks, revealing data patterns. This allows attackers to detect repeated data and perform pattern analysis attacks.', 'const cipher = crypto.createCipheriv(\'aes-256-ecb\', key, null); // Identical blocks = identical ciphertext', [
+                'Data pattern disclosure',
+                'Plaintext recovery through pattern analysis',
+                'Cryptographic attacks (block rearrangement)',
+                'Weak confidentiality protection'
+            ], 'crypto.createCipheriv(\'aes-256-ecb\', key, null)', 'const iv = crypto.randomBytes(16);\nconst cipher = crypto.createCipheriv(\'aes-256-gcm\', key, iv); // GCM provides authentication', 'Never use ECB mode. Use AES-GCM (authenticated encryption) or AES-CBC with random IV'));
+        }
+        // 13. Insecure crypto.createCipher (deprecated) - HIGH
+        // Pattern: crypto.createCipher (uses weak MD5 key derivation)
+        if (trimmed.includes('crypto.createCipher(') || trimmed.includes('crypto.createDecipher(')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('deprecated-createcipher', 'Deprecated crypto.createCipher uses weak MD5 key derivation', 'Use crypto.createCipheriv with properly derived keys (PBKDF2/scrypt)', lineNumber, 'crypto.createCipher is deprecated because it uses weak MD5-based key derivation, making it vulnerable to brute force and rainbow table attacks. Modern standards require proper key derivation functions.', 'const cipher = crypto.createCipher(\'aes-256-cbc\', \'password\'); // Weak MD5 key derivation', [
+                'Weak key derivation (MD5)',
+                'Password brute force attacks',
+                'Rainbow table attacks',
+                'Insufficient protection against cryptanalysis'
+            ], 'crypto.createCipher(\'aes-256-cbc\', password)', 'const key = crypto.pbkdf2Sync(password, salt, 100000, 32, \'sha256\');\nconst iv = crypto.randomBytes(16);\nconst cipher = crypto.createCipheriv(\'aes-256-gcm\', key, iv);', 'Use createCipheriv with PBKDF2 or scrypt for key derivation, never createCipher'));
+        }
+        // =============================================================================
+        // PHASE B - Insecure TLS Configuration Detection (Dec 20, 2025)
+        // =============================================================================
+        // 14. Insecure TLS - rejectUnauthorized: false - HIGH
+        // Pattern: HTTPS/TLS with certificate validation disabled
+        if (trimmed.includes('rejectUnauthorized') && trimmed.includes('false')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('insecure-tls-reject-unauthorized', 'TLS certificate validation disabled - vulnerable to man-in-the-middle attacks', 'Never set rejectUnauthorized: false in production - use proper certificates', lineNumber, 'Disabling certificate validation (rejectUnauthorized: false) allows man-in-the-middle attackers to intercept encrypted connections by presenting fake certificates. This defeats the entire purpose of TLS/HTTPS.', 'https.request({ hostname: \'api.example.com\', rejectUnauthorized: false }); // Attack: MITM intercepts traffic', [
+                'Man-in-the-middle attacks',
+                'Data interception and theft',
+                'Credential theft',
+                'Session hijacking',
+                'Complete loss of confidentiality'
+            ], 'rejectUnauthorized: false', '// Use valid certificates instead of disabling validation\n// For development: Use self-signed certs with NODE_EXTRA_CA_CERTS\nconst options = { hostname: \'api.example.com\' }; // Default: rejectUnauthorized: true', 'Never disable certificate validation. Use proper CA-signed certificates or NODE_EXTRA_CA_CERTS for development'));
+        }
+        // 15. Insecure TLS - minVersion < TLS 1.2 - HIGH
+        // Pattern: TLS configurations with outdated protocol versions
+        // CRITICAL: Must NOT match TLSv1.2 or TLSv1.3 (secure versions)
+        const hasMinVersionOrProtocol = trimmed.includes('minVersion') || trimmed.includes('secureProtocol');
+        const hasInsecureTLS = (trimmed.includes('TLSv1.0') || trimmed.includes('TLSv1.1') ||
+            (trimmed.includes('TLSv1\'') && !trimmed.includes('TLSv1.')) ||
+            (trimmed.includes('TLSv1"') && !trimmed.includes('TLSv1.')) ||
+            trimmed.includes('SSLv') ||
+            trimmed.includes('TLS1_0') || trimmed.includes('TLS1_1'));
+        if (hasMinVersionOrProtocol && hasInsecureTLS) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('insecure-tls-version', 'Insecure TLS version - use TLS 1.2 or higher', 'Set minVersion to \'TLSv1.2\' or \'TLSv1.3\' to enforce secure protocols', lineNumber, 'TLS 1.0 and 1.1 are deprecated and vulnerable to attacks like BEAST, POODLE, and downgrade attacks. Modern standards require TLS 1.2 or higher for secure communications.', 'tls.createServer({ minVersion: \'TLSv1\' }); // Vulnerable to BEAST, POODLE attacks', [
+                'Protocol downgrade attacks',
+                'BEAST attack (TLS 1.0)',
+                'POODLE attack (SSLv3)',
+                'Weak cipher suite negotiation',
+                'Man-in-the-middle attacks'
+            ], 'minVersion: \'TLSv1\'', 'const options = { minVersion: \'TLSv1.2\' }; // Or \'TLSv1.3\' for maximum security', 'Use TLS 1.2 or 1.3. TLS 1.0/1.1 and SSLv3 are deprecated and insecure'));
+        }
+        // 16. Insecure TLS - NODE_TLS_REJECT_UNAUTHORIZED=0 - HIGH
+        // Pattern: Environment variable disabling TLS validation
+        if (trimmed.includes('NODE_TLS_REJECT_UNAUTHORIZED') && trimmed.includes('0')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('node-tls-reject-unauthorized', 'NODE_TLS_REJECT_UNAUTHORIZED=0 disables all TLS certificate validation', 'Remove NODE_TLS_REJECT_UNAUTHORIZED=0 - it disables certificate validation globally', lineNumber, 'Setting NODE_TLS_REJECT_UNAUTHORIZED=0 disables certificate validation for ALL HTTPS connections in the Node.js process, making every connection vulnerable to man-in-the-middle attacks.', 'process.env.NODE_TLS_REJECT_UNAUTHORIZED = \'0\'; // Disables ALL certificate validation', [
+                'Global TLS validation bypass',
+                'All HTTPS connections vulnerable to MITM',
+                'Complete loss of transport security',
+                'Credential and data theft'
+            ], 'NODE_TLS_REJECT_UNAUTHORIZED = \'0\'', '// Use proper certificates or NODE_EXTRA_CA_CERTS for custom CAs\n// NEVER disable validation globally', 'NEVER set NODE_TLS_REJECT_UNAUTHORIZED=0. Use NODE_EXTRA_CA_CERTS for custom CAs instead'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=credentials-crypto.js.map

package/dist/src/lib/analyzers/typescript/security-checks/credentials-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-crypto.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/credentials-crypto.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAgBH,8DAsPC;AAnQD,sEAAqF;AAErF;;;;;;;;;;GAUG;AACH,SAAgB,yBAAyB,CACvC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,4DAA4D;QAC5D,sCAAsC;QACtC,gFAAgF;QAChF,IAAI,OAAO,CAAC,KAAK,CAAC,2FAA2F,CAAC;YAC1G,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACrE,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,uBAAuB,EACvB,yCAAyC,EACzC,4DAA4D,EAC5D,UAAU,EACV,mJAAmJ,EACnJ,yFAAyF,EACzF;gBACE,2CAA2C;gBAC3C,eAAe;gBACf,kBAAkB;gBAClB,wCAAwC;aACzC,EACD,sDAAsD,EACtD,oEAAoE,EACpE,qHAAqH,CACtH,CAAC,CAAC;QACL,CAAC;QAED,0CAA0C;QAC1C,oDAAoD;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,EAAE,CAAC;YACnE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACjF,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;YAE1E,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,cAAc,EACd,yCAAyC,aAAa,EAAE,EACxD,6DAA6D,EAC7D,UAAU,EACV,GAAG,aAAa,6LAA6L,EAC7M,sFAAsF,EACtF;gBACE,0BAA0B;gBAC1B,+BAA+B;gBAC/B,2BAA2B;gBAC3B,uBAAuB;gBACvB,wCAAwC;aACzC,EACD,mEAAmE,EACnE,+HAA+H,EAC/H,GAAG,aAAa,8HAA8H,CAC/I,CAAC,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,aAAa,EACb,yCAAyC,EACzC,sDAAsD,EACtD,UAAU,EACV,sJAAsJ,EACtJ,0EAA0E,EAC1E;gBACE,mBAAmB;gBACnB,kCAAkC;gBAClC,8BAA8B;gBAC9B,mBAAmB;aACpB,EACD,4DAA4D,EAC5D,yFAAyF,EACzF,wHAAwH,CACzH,CAAC,CAAC;QACL,CAAC;QAED,+CAA+C;QAC/C,IAAI,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,EAAE,CAAC;YACtF,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,kBAAkB,EAClB,6CAA6C,EAC7C,wEAAwE,EACxE,UAAU,EACV,qIAAqI,EACrI,wGAAwG,EACxG;gBACE,6BAA6B;gBAC7B,mBAAmB;gBACnB,kBAAkB;gBAClB,iCAAiC;aAClC,EACD,gEAAgE,EAChE,4HAA4H,EAC5H,wGAAwG,CACzG,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,+DAA+D;QAC/D,gFAAgF;QAEhF,4CAA4C;QAC5C,4EAA4E;QAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;YACjC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC5D,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,qBAAqB,EACrB,4DAA4D,EAC5D,2DAA2D,EAC3D,UAAU,EACV,iOAAiO,EACjO,8GAA8G,EAC9G;gBACE,yBAAyB;gBACzB,6CAA6C;gBAC7C,6CAA6C;gBAC7C,iCAAiC;aAClC,EACD,mDAAmD,EACnD,oIAAoI,EACpI,sFAAsF,CACvF,CAAC,CAAC;QACL,CAAC;QAED,uDAAuD;QACvD,8DAA8D;QAC9D,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC3F,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,yBAAyB,EACzB,6DAA6D,EAC7D,sEAAsE,EACtE,UAAU,EACV,2MAA2M,EAC3M,+FAA+F,EAC/F;gBACE,2BAA2B;gBAC3B,8BAA8B;gBAC9B,uBAAuB;gBACvB,+CAA+C;aAChD,EACD,gDAAgD,EAChD,6KAA6K,EAC7K,iFAAiF,CAClF,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,gEAAgE;QAChE,gFAAgF;QAEhF,sDAAsD;QACtD,0DAA0D;QAC1D,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxE,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,kCAAkC,EAClC,+EAA+E,EAC/E,6EAA6E,EAC7E,UAAU,EACV,mNAAmN,EACnN,iHAAiH,EACjH;gBACE,2BAA2B;gBAC3B,6BAA6B;gBAC7B,kBAAkB;gBAClB,mBAAmB;gBACnB,kCAAkC;aACnC,EACD,2BAA2B,EAC3B,wNAAwN,EACxN,gHAAgH,CACjH,CAAC,CAAC;QACL,CAAC;QAED,iDAAiD;QACjD,8DAA8D;QAC9D,gEAAgE;QAChE,MAAM,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACrG,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC1D,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5D,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAElF,IAAI,uBAAuB,IAAI,cAAc,EAAE,CAAC;YAC9C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,sBAAsB,EACtB,8CAA8C,EAC9C,0EAA0E,EAC1E,UAAU,EACV,2KAA2K,EAC3K,qFAAqF,EACrF;gBACE,4BAA4B;gBAC5B,wBAAwB;gBACxB,uBAAuB;gBACvB,+BAA+B;gBAC/B,2BAA2B;aAC5B,EACD,uBAAuB,EACvB,qFAAqF,EACrF,uEAAuE,CACxE,CAAC,CAAC;QACL,CAAC;QAED,2DAA2D;QAC3D,yDAAyD;QACzD,IAAI,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9E,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,8BAA8B,EAC9B,wEAAwE,EACxE,qFAAqF,EACrF,UAAU,EACV,2LAA2L,EAC3L,0FAA0F,EAC1F;gBACE,8BAA8B;gBAC9B,0CAA0C;gBAC1C,qCAAqC;gBACrC,2BAA2B;aAC5B,EACD,sCAAsC,EACtC,wGAAwG,EACxG,0FAA0F,CAC3F,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/typescript/security-checks/enhanced-supply-chain.d.ts

@@ -0,0 +1,23 @@
+/**
+ * TypeScript Enhanced Supply Chain Security Checks
+ * OWASP A03:2025 - Software Supply Chain Failures (Enhanced)
+ *
+ * Enhanced supply chain security checks building on existing dependency scanning.
+ * Focuses on runtime dependencies, package integrity, and malicious code patterns.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for enhanced supply chain security vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #1: Dynamic imports without integrity validation (HIGH)
+ * - Check #2: Runtime dependency loading (MEDIUM)
+ * - Check #3: Suspicious package patterns (HIGH)
+ * - Check #4: Unrestricted CDN usage (MEDIUM)
+ * - Check #5: Package typosquatting patterns (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkEnhancedSupplyChain(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=enhanced-supply-chain.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/enhanced-supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enhanced-supply-chain.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/enhanced-supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAyNzB"}

package/dist/src/lib/analyzers/typescript/security-checks/enhanced-supply-chain.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * TypeScript Enhanced Supply Chain Security Checks
+ * OWASP A03:2025 - Software Supply Chain Failures (Enhanced)
+ *
+ * Enhanced supply chain security checks building on existing dependency scanning.
+ * Focuses on runtime dependencies, package integrity, and malicious code patterns.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkEnhancedSupplyChain = checkEnhancedSupplyChain;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for enhanced supply chain security vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #1: Dynamic imports without integrity validation (HIGH)
+ * - Check #2: Runtime dependency loading (MEDIUM)
+ * - Check #3: Suspicious package patterns (HIGH)
+ * - Check #4: Unrestricted CDN usage (MEDIUM)
+ * - Check #5: Package typosquatting patterns (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkEnhancedSupplyChain(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmedLine.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmedLine.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('//') ||
+            trimmedLine.startsWith('*')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Check #1: Dynamic imports without integrity validation
+        if ((lowerLine.includes('import(') || lowerLine.includes('require(')) &&
+            (lowerLine.includes('http://') || lowerLine.includes('https://')) &&
+            !lowerLine.includes('integrity') && !lowerLine.includes('sha')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('dynamic-import-no-integrity', 'Dynamic import from URL without integrity validation', 'Use subresource integrity or validate package hashes for remote imports', index + 1, 'Dynamic imports without integrity validation can load malicious code from compromised sources', 'import("https://cdn.example.com/lib.js") // no integrity check', [
+                'Malicious code injection from compromised CDNs',
+                'Supply chain attacks through modified packages',
+                'Man-in-the-middle attacks on package loading',
+                'Runtime code modification and backdoor installation'
+            ], 'import("https://cdn.example.com/lib.js")', 'import("https://cdn.example.com/lib.js").then(validateIntegrity)', 'Dynamic imports from remote sources should validate package integrity to prevent supply chain attacks'));
+        }
+        // Check #2: Runtime dependency loading with eval or Function
+        if ((lowerLine.includes('eval(') || lowerLine.includes('function(')) &&
+            (lowerLine.includes('require') || lowerLine.includes('import') ||
+                lowerLine.includes('fetch'))) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('runtime-dependency-loading', 'Runtime dependency loading using eval or Function constructor', 'Use static imports or validated dynamic imports instead of runtime code evaluation', index + 1, 'Runtime dependency loading can execute arbitrary code and enable supply chain attacks', 'eval(`import("${userInput}")`) // arbitrary package loading', [
+                'Arbitrary package execution from user input',
+                'Supply chain attacks through malicious packages',
+                'Code injection via dependency names',
+                'Bypass of static analysis and security tools'
+            ], 'eval(`import("${packageName}")`)', 'const allowedPackages = ["safe-pkg1"]; if (allowedPackages.includes(packageName)) { import(packageName) }', 'Runtime dependency loading bypasses security controls and enables arbitrary code execution'));
+        }
+        // Check #3: Suspicious package patterns (TypeScript specific typosquatting)
+        // FIXED: Exclude type-only imports (import type) - they're compile-time only, not runtime dependencies
+        const isTypeOnlyImport = lowerLine.startsWith('import type') || lowerLine.includes('import type {');
+        if (!isTypeOnlyImport &&
+            (lowerLine.includes('import ') || lowerLine.includes('from ')) &&
+            (lowerLine.includes('"@types/') || lowerLine.includes("'@types/")) &&
+            (lowerLine.includes('@types/reactt') || lowerLine.includes('@types/expresss') ||
+                lowerLine.includes('@types/nodee') || lowerLine.includes('@types/lodashh') ||
+                lowerLine.includes('@types/typescriptt'))) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('suspicious-types-package', 'Potentially typosquatted @types package detected', 'Verify @types package names against DefinitelyTyped official packages', index + 1, 'Malicious @types packages can inject code through TypeScript declaration files', 'import { Component } from "@types/reactt"; // should be "@types/react"', [
+                'Type definition pollution and code injection',
+                'Supply chain attacks through malicious type declarations',
+                'Build-time code injection via declaration files',
+                'Development environment compromise'
+            ], 'import type { Request } from "@types/expresss";', 'import type { Request } from "@types/express"; // verify correct @types package', 'Type definition packages should be verified against DefinitelyTyped to avoid malicious declarations'));
+        }
+        // Check #4: Unrestricted CDN usage in TypeScript projects
+        if ((lowerLine.includes('src=') || lowerLine.includes('href=')) &&
+            (lowerLine.includes('unpkg.com') || lowerLine.includes('jsdelivr.net') ||
+                lowerLine.includes('cdnjs.cloudflare.com')) &&
+            !lowerLine.includes('integrity=')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('unrestricted-cdn-usage', 'CDN resource loaded without subresource integrity', 'Add integrity attribute with SHA hash for CDN resources', index + 1, 'CDN resources without integrity checks can be compromised and serve malicious content', '<script src="https://unpkg.com/typescript@latest/lib/typescript.js"></script>', [
+                'CDN compromise serving malicious TypeScript runtime',
+                'Supply chain attacks through modified CDN content',
+                'Man-in-the-middle attacks on CDN requests',
+                'Unauthorized code modification and injection'
+            ], 'src="https://unpkg.com/lib@1.0.0/dist/lib.js"', 'src="https://unpkg.com/lib@1.0.0/dist/lib.js" integrity="sha384-..."', 'CDN resources should use subresource integrity to prevent tampering'));
+        }
+        // Check #5: Package typosquatting patterns in npm commands
+        if ((lowerLine.includes('npm install') || lowerLine.includes('yarn add') ||
+            lowerLine.includes('pnpm add')) &&
+            (lowerLine.includes('typescriptt') || lowerLine.includes('typescript-') ||
+                lowerLine.includes('ts-nodee') || lowerLine.includes('tslint-') ||
+                lowerLine.includes('@typescript-eslint-') || lowerLine.includes('@types-'))) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('package-typosquatting-pattern', 'Package name follows TypeScript ecosystem typosquatting pattern', 'Verify official TypeScript ecosystem package names before installation', index + 1, 'Typosquatted TypeScript packages can compromise development and build processes', 'npm install typescriptt // should be "typescript"', [
+                'Development environment compromise',
+                'Build process injection and backdoors',
+                'Supply chain attacks through fake TypeScript tools',
+                'Source code theft and credential harvesting'
+            ], 'npm install typescriptt', 'npm install typescript // verify official TypeScript ecosystem packages', 'TypeScript ecosystem packages should be verified against official npm registry to avoid typosquatting'));
+        }
+        // Check #6: Dynamic require() with environment variables or expressions (NEW - Check #87)
+        // Pattern: require(process.env.VAR) or require(variable) or require(expr || "default")
+        // This is CRITICAL because it enables arbitrary module loading at startup
+        if (lowerLine.includes('require(') || lowerLine.includes('import(')) {
+            // Check if require/import argument is NOT a static string
+            // Match: require(variable), require(process.env.X), require(a || b), require(config.module)
+            // Don't match: require("static-string"), require('static-string')
+            const dynamicRequirePattern = /(?:require|import)\s*\(\s*(?!['"`])([^)]+)\)/i;
+            const match = trimmedLine.match(dynamicRequirePattern);
+            if (match) {
+                const argument = match[1].trim();
+                // Check if argument contains dynamic expressions
+                const isDynamic = (argument.includes('process.env') || // Environment variables
+                    argument.includes('||') || // Fallback expressions
+                    argument.includes('+') || // Concatenation
+                    argument.includes('config.') || // Config object access
+                    argument.includes('options.') || // Options object access
+                    /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(argument) // Variable name (not a string)
+                );
+                // Additional check: Exclude template literals that are commonly used for valid dynamic imports
+                // like import(`./locale/${lang}.js`) which are often used for code splitting
+                const isTemplateLiteral = trimmedLine.includes('`') && trimmedLine.includes('${');
+                if (isDynamic && !isTemplateLiteral) {
+                    vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('dynamic-require-env-var', 'Dynamic require() with environment variable enables arbitrary module loading', 'Use static imports only. Avoid dynamic require() with user-controlled input or environment variables.', index + 1, 'Dynamic require() with environment variables or user input allows an attacker to load ANY Node.js module, including built-in modules like child_process or fs, enabling arbitrary code execution on application startup.', 'const lib = require(process.env.REPORT_LIB || "report-helper"); // attacker sets REPORT_LIB="child_process" → attacker can execute system commands', [
+                        'Arbitrary module loading (child_process, fs, vm, etc.)',
+                        'Remote code execution on startup',
+                        'Complete system compromise',
+                        'Supply chain attacks through malicious module names',
+                        'Environment variable injection enables backdoors',
+                        'Bypass of dependency scanning and security tools'
+                    ], 'const reportUtil = require(process.env.REPORT_LIB || "report-helper");', '// Use static imports with explicit allowed list\nconst ALLOWED_MODULES = { "report-helper": require("report-helper") };\nconst moduleName = process.env.REPORT_LIB || "report-helper";\nconst reportUtil = ALLOWED_MODULES[moduleName];', 'Replace dynamic require() with static imports. If dynamic loading is necessary, maintain an explicit allowlist of permitted modules and validate against it.'));
+                }
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=enhanced-supply-chain.js.map

package/dist/src/lib/analyzers/typescript/security-checks/enhanced-supply-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enhanced-supply-chain.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/enhanced-supply-chain.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAkBH,4DA2NC;AA1OD,sEAAqF;AAErF;;;;;;;;;;;;GAYG;AACH,SAAgB,wBAAwB,CACtC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wDAAwD;QACxD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;YAC5B,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,yDAAyD;QACzD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,6BAA6B,EAC7B,sDAAsD,EACtD,yEAAyE,EACzE,KAAK,GAAG,CAAC,EACT,+FAA+F,EAC/F,gEAAgE,EAChE;gBACE,gDAAgD;gBAChD,gDAAgD;gBAChD,8CAA8C;gBAC9C,qDAAqD;aACtD,EACD,0CAA0C,EAC1C,kEAAkE,EAClE,uGAAuG,CACxG,CACF,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7D,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,4BAA4B,EAC5B,+DAA+D,EAC/D,oFAAoF,EACpF,KAAK,GAAG,CAAC,EACT,uFAAuF,EACvF,6DAA6D,EAC7D;gBACE,6CAA6C;gBAC7C,iDAAiD;gBACjD,qCAAqC;gBACrC,8CAA8C;aAC/C,EACD,kCAAkC,EAClC,2GAA2G,EAC3G,4FAA4F,CAC7F,CACF,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,uGAAuG;QACvG,MAAM,gBAAgB,GAAG,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAEpG,IAAI,CAAC,gBAAgB;YACjB,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9D,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAClE,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC5E,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAC1E,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAC/C,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,0BAA0B,EAC1B,kDAAkD,EAClD,uEAAuE,EACvE,KAAK,GAAG,CAAC,EACT,gFAAgF,EAChF,wEAAwE,EACxE;gBACE,8CAA8C;gBAC9C,0DAA0D;gBAC1D,iDAAiD;gBACjD,oCAAoC;aACrC,EACD,iDAAiD,EACjD,iFAAiF,EACjF,qGAAqG,CACtG,CACF,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3D,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACrE,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YAC5C,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,wBAAwB,EACxB,mDAAmD,EACnD,yDAAyD,EACzD,KAAK,GAAG,CAAC,EACT,uFAAuF,EACvF,+EAA+E,EAC/E;gBACE,qDAAqD;gBACrD,mDAAmD;gBACnD,2CAA2C;gBAC3C,8CAA8C;aAC/C,EACD,+CAA+C,EAC/C,sEAAsE,EACtE,qEAAqE,CACtE,CACF,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;YACnE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACtE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC/D,SAAS,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACjF,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,+BAA+B,EAC/B,iEAAiE,EACjE,wEAAwE,EACxE,KAAK,GAAG,CAAC,EACT,iFAAiF,EACjF,mDAAmD,EACnD;gBACE,oCAAoC;gBACpC,uCAAuC;gBACvC,oDAAoD;gBACpD,6CAA6C;aAC9C,EACD,yBAAyB,EACzB,yEAAyE,EACzE,uGAAuG,CACxG,CACF,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,uFAAuF;QACvF,0EAA0E;QAC1E,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpE,0DAA0D;YAC1D,4FAA4F;YAC5F,kEAAkE;YAElE,MAAM,qBAAqB,GAAG,+CAA+C,CAAC;YAC9E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAEvD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAEjC,iDAAiD;gBACjD,MAAM,SAAS,GAAG,CAChB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAK,wBAAwB;oBAC7D,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAe,uBAAuB;oBAC7D,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAgB,gBAAgB;oBACtD,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAU,uBAAuB;oBAC7D,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAS,wBAAwB;oBAC9D,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,+BAA+B;iBAC5E,CAAC;gBAEF,+FAA+F;gBAC/F,6EAA6E;gBAC7E,MAAM,iBAAiB,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAElF,IAAI,SAAS,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACpC,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,yBAAyB,EACzB,8EAA8E,EAC9E,uGAAuG,EACvG,KAAK,GAAG,CAAC,EACT,0NAA0N,EAC1N,oJAAoJ,EACpJ;wBACE,wDAAwD;wBACxD,kCAAkC;wBAClC,4BAA4B;wBAC5B,qDAAqD;wBACrD,kDAAkD;wBAClD,kDAAkD;qBACnD,EACD,wEAAwE,EACxE,0OAA0O,EAC1O,8JAA8J,CAC/J,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IAEH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/typescript/security-checks/exception-handling.d.ts

@@ -0,0 +1,23 @@
+/**
+ * TypeScript Exception Handling Security Checks
+ * OWASP A10:2025 - Mishandling of Exceptional Conditions
+ *
+ * Detects improper exception handling that can lead to security vulnerabilities.
+ * This is a completely NEW category in OWASP 2025.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for exception handling security vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #1: Unhandled Promise rejections (MEDIUM)
+ * - Check #2: Empty catch blocks (MEDIUM)
+ * - Check #3: Error details exposed in responses (MEDIUM) - Phase 7B Day 9
+ * - Check #4: Missing error type checking (MEDIUM)
+ * - Check #5: Async functions without try-catch (MEDIUM) - Phase 7B Day 9
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkExceptionHandling(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=exception-handling.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/exception-handling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exception-handling.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/exception-handling.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAuQzB"}

package/dist/src/lib/analyzers/typescript/security-checks/exception-handling.js

@@ -0,0 +1,187 @@
+"use strict";
+/**
+ * TypeScript Exception Handling Security Checks
+ * OWASP A10:2025 - Mishandling of Exceptional Conditions
+ *
+ * Detects improper exception handling that can lead to security vulnerabilities.
+ * This is a completely NEW category in OWASP 2025.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkExceptionHandling = checkExceptionHandling;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for exception handling security vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #1: Unhandled Promise rejections (MEDIUM)
+ * - Check #2: Empty catch blocks (MEDIUM)
+ * - Check #3: Error details exposed in responses (MEDIUM) - Phase 7B Day 9
+ * - Check #4: Missing error type checking (MEDIUM)
+ * - Check #5: Async functions without try-catch (MEDIUM) - Phase 7B Day 9
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkExceptionHandling(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmedLine.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmedLine.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('//') ||
+            trimmedLine.startsWith('*')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Check #1: Unhandled Promise rejections
+        // FIXED: Exclude import statements (e.g., import mysql from "mysql2/promise")
+        const isImportStatement = lowerLine.startsWith('import ') || lowerLine.includes(' from ');
+        // FIXED: Exclude type annotations (e.g., Promise<User>, Promise<void>)
+        const isTypeAnnotation = lowerLine.includes('promise<') ||
+            lowerLine.match(/:\s*promise/i) ||
+            lowerLine.match(/function.*:\s*promise/i);
+        // Check if inside try-catch block (look back for try)
+        const insideTryBlock = lines.slice(Math.max(0, index - 10), index + 1).some(prevLine => prevLine.trim().toLowerCase() === 'try {' ||
+            prevLine.trim().toLowerCase().endsWith('try {'));
+        if (!isImportStatement &&
+            !isTypeAnnotation &&
+            !insideTryBlock &&
+            (lowerLine.includes('promise') || lowerLine.includes('.then(')) &&
+            !lowerLine.includes('.catch(') &&
+            !lines.slice(index, Math.min(index + 3, lines.length)).some(nextLine => nextLine.toLowerCase().includes('.catch('))) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('unhandled-promise-rejection', 'promise without catch handler may cause unhandled rejections', 'Add .catch() handler or use try-catch with async/await', index + 1, 'Unhandled promise rejections can crash Node.js applications and expose error details', 'fetch("/api/data").then(data => process(data)); // no error handling', [
+                'Application crashes in Node.js environment',
+                'Sensitive error information exposure',
+                'Service unavailability and denial of service',
+                'Memory leaks from unresolved promises'
+            ], 'fetch("/api/data").then(data => process(data));', 'fetch("/api/data").then(data => process(data)).catch(err => console.error("Request failed", err));', 'Unhandled promise rejections can crash applications and expose sensitive debugging information'));
+        }
+        // Check #2: Empty catch blocks
+        if (lowerLine.includes('catch') && lowerLine.includes('{')) {
+            // Check if catch block is truly empty (inline {} or no content before closing brace)
+            const isInlineCatch = lowerLine.includes('{}');
+            // Check if there's any non-empty, non-comment content between catch and closing brace
+            const nextLines = lines.slice(index + 1, Math.min(index + 10, lines.length));
+            let hasContent = false;
+            let foundClosingBrace = false;
+            for (const nextLine of nextLines) {
+                const trimmed = nextLine.trim();
+                // Found closing brace
+                if (trimmed === '}' || trimmed.startsWith('}')) {
+                    foundClosingBrace = true;
+                    break;
+                }
+                // Skip empty lines and comments
+                if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*')) {
+                    continue;
+                }
+                // Found actual content
+                hasContent = true;
+                break;
+            }
+            // Only flag if truly empty (inline {} or no content before closing brace)
+            if (isInlineCatch || (foundClosingBrace && !hasContent)) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('empty-catch-block', 'Empty catch block silently ignores exceptions', 'Add proper error handling, logging, or re-throw the exception', index + 1, 'Silent exception suppression can hide security vulnerabilities and cause unpredictable application behavior', 'try { riskyOperation(); } catch (e) {} // error completely ignored', [
+                    'Security vulnerabilities hidden and undetected',
+                    'Application state corruption from ignored errors',
+                    'Type safety bypass through ignored errors',
+                    'Debugging difficulties and maintenance issues'
+                ], 'try { operation(); } catch (e) {}', 'try { operation(); } catch (e) { console.error("Operation failed", e); throw e; }', 'Empty catch blocks prevent error visibility and can hide security-critical failures'));
+            }
+        }
+        // Check #3: Error details exposed in responses (Phase 7B Day 9)
+        // Enhanced: Detect error exposure in single-line and multi-line response patterns
+        const hasResObject = lowerLine.match(/\bres\s*\./) || lowerLine.match(/\bres\s*\)/);
+        const hasResponseCall = lowerLine.includes('.json(') || lowerLine.includes('.send(');
+        const isResponseSend = hasResObject && hasResponseCall;
+        // Exclude fetch API response.json() - check if it's await response.json()
+        const isFetchResponse = lowerLine.includes('response.') && lowerLine.includes('.json(') &&
+            lowerLine.includes('await') && !lowerLine.includes('(err');
+        const hasErrorInResponse = isResponseSend || (hasResponseCall && !isFetchResponse && lowerLine.includes('response.') && lowerLine.includes('(err'));
+        // Also check if we're inside a res.json() or res.send() call (look back 5 lines)
+        const prevLines = lines.slice(Math.max(0, index - 5), index);
+        const hasResponseInPrevLines = prevLines.some(prevLine => {
+            const lower = prevLine.toLowerCase();
+            const hasRes = lower.match(/\bres\s*\./) || lower.match(/\bres\s*\)/);
+            const hasCall = lower.includes('.json(') || lower.includes('.send(');
+            const isFetch = lower.includes('await') && lower.includes('response.') && !lower.includes('(err');
+            return (hasRes || (lower.includes('response.') && lower.includes('(err'))) && hasCall && !isFetch;
+        });
+        const hasStackExposure = lowerLine.includes('.stack') ||
+            lowerLine.match(/stack\s*:\s*(err|error)\.stack/);
+        const hasMessageExposure = (lowerLine.includes('.message') &&
+            (lowerLine.includes('error') || lowerLine.includes('err')));
+        const hasToStringExposure = lowerLine.includes('.tostring()');
+        if ((hasErrorInResponse || hasResponseInPrevLines) &&
+            (hasStackExposure || hasMessageExposure || hasToStringExposure)) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('error-details-exposed', 'error object details may be exposed in API responses', 'Return generic error messages to clients, log detailed errors server-side', index + 1, 'Exposing error objects reveals sensitive internal application information including stack traces and file paths', 'res.json({ error: err.stack }); // exposes full stack trace to client', [
+                'Internal application structure exposure',
+                'File paths and directory structure revelation',
+                'Database connection details disclosure',
+                'Third-party service configuration exposure'
+            ], 'res.json({ error: error.message });', 'console.error("Request failed", error); res.status(500).json({ error: "Internal server error" });', 'Error objects contain sensitive debugging information that should not be exposed to clients'));
+        }
+        // Check #4: Missing error type checking in catch blocks
+        // FIXED: Only match traditional try-catch blocks, NOT .catch() promise handlers
+        // Traditional: "} catch (e) {" or "catch (error) {"
+        // Promise: ".catch(error => ..." or ".catch((error) => ..."
+        const isTraditionalCatchBlock = trimmedLine.match(/\}\s*catch\s*\(/) ||
+            trimmedLine.match(/^catch\s*\(/);
+        const isPromiseCatchHandler = trimmedLine.includes('.catch(');
+        if (isTraditionalCatchBlock && !isPromiseCatchHandler &&
+            !lowerLine.includes(': ') && !lowerLine.includes('instanceof') &&
+            !lines.slice(index + 1, Math.min(index + 5, lines.length)).some(nextLine => nextLine.toLowerCase().includes('instanceof') ||
+                nextLine.toLowerCase().includes('typeof'))) {
+            // Don't flag if catch block just logs the error (common acceptable pattern)
+            const nextLines = lines.slice(index + 1, Math.min(index + 5, lines.length));
+            const hasOnlyLogging = nextLines.some(nextLine => {
+                const lower = nextLine.toLowerCase();
+                return lower.includes('console.error') || lower.includes('logger.error') ||
+                    lower.includes('console.warn') || lower.includes('logger.warn');
+            });
+            // Also don't flag if error is re-thrown
+            const hasRethrow = nextLines.some(nextLine => nextLine.toLowerCase().includes('throw'));
+            if (!hasOnlyLogging && !hasRethrow) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('missing-error-type-check', 'Catch block without error type checking may mishandle different error types', 'Add type checking to handle different error types appropriately', index + 1, 'Without error type checking, different types of errors may be handled inappropriately', 'catch (e) { console.log(e.message); } // assumes e has message property', [
+                    'Runtime errors from invalid property access',
+                    'Inappropriate error handling for security exceptions',
+                    'Loss of type safety in error handling paths',
+                    'Potential for error handling bypasses'
+                ], 'catch (e) { console.log(e.message); }', 'catch (e) { if (e instanceof Error) { console.log(e.message); } else { console.log("Unknown error"); } }', 'TypeScript catch blocks should check error types to maintain type safety'));
+            }
+        }
+        // Check #5: Async functions without try-catch (Phase 7B Day 9)
+        // Detect async function declarations and check for try-catch in body
+        const isAsyncFunction = lowerLine.match(/^(export\s+)?(async\s+function|const\s+\w+\s*=\s*async|function\s+\w+\s*=\s*async)/);
+        if (isAsyncFunction) {
+            // Look ahead in function body for await and try-catch
+            const functionBody = lines.slice(index + 1, Math.min(index + 20, lines.length));
+            const hasAwait = functionBody.some(line => line.toLowerCase().includes('await '));
+            const hasTryCatch = functionBody.some(line => {
+                const lower = line.toLowerCase().trim();
+                return lower === 'try {' || lower.endsWith('try {');
+            });
+            const hasCatchChain = functionBody.some(line => line.toLowerCase().includes('.catch('));
+            if (hasAwait && !hasTryCatch && !hasCatchChain) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('async-without-try-catch', 'async function without try-catch may cause unhandled exceptions', 'Wrap await calls in try-catch blocks for proper error handling', index + 1, 'Unhandled async exceptions can crash applications and expose sensitive error information', 'async function fetchUser() { await fetch(); } // no error handling', [
+                    'Application crashes from unhandled async exceptions',
+                    'Sensitive error information exposure',
+                    'Service unavailability from uncaught errors',
+                    'Resource cleanup failures in error scenarios'
+                ], 'async function fetchUser() { const data = await fetch(); }', 'async function fetchUser() { try { const data = await fetch(); } catch (error) { console.error(error); } }', 'Async functions should use try-catch to handle potential exceptions from await calls'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=exception-handling.js.map

package/dist/src/lib/analyzers/typescript/security-checks/exception-handling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exception-handling.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/exception-handling.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAkBH,wDAyQC;AAxRD,sEAAqF;AAErF;;;;;;;;;;;;GAYG;AACH,SAAgB,sBAAsB,CACpC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wDAAwD;QACxD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;YAC5B,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,yCAAyC;QACzC,8EAA8E;QAC9E,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE1F,uEAAuE;QACvE,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC9B,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC;YAC/B,SAAS,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAEnE,sDAAsD;QACtD,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACrF,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;YACzC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAChD,CAAC;QAEF,IAAI,CAAC,iBAAiB;YAClB,CAAC,gBAAgB;YACjB,CAAC,cAAc;YACf,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC/D,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC9B,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACrE,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAClD,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,6BAA6B,EAC7B,8DAA8D,EAC9D,wDAAwD,EACxD,KAAK,GAAG,CAAC,EACT,sFAAsF,EACtF,sEAAsE,EACtE;gBACE,4CAA4C;gBAC5C,sCAAsC;gBACtC,8CAA8C;gBAC9C,uCAAuC;aACxC,EACD,iDAAiD,EACjD,oGAAoG,EACpG,gGAAgG,CACjG,CACF,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,qFAAqF;YACrF,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE/C,sFAAsF;YACtF,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7E,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAE9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAEhC,sBAAsB;gBACtB,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,iBAAiB,GAAG,IAAI,CAAC;oBACzB,MAAM;gBACR,CAAC;gBAED,gCAAgC;gBAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChG,SAAS;gBACX,CAAC;gBAED,uBAAuB;gBACvB,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;YAED,0EAA0E;YAC1E,IAAI,aAAa,IAAI,CAAC,iBAAiB,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxD,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,mBAAmB,EACnB,+CAA+C,EAC/C,+DAA+D,EAC/D,KAAK,GAAG,CAAC,EACT,6GAA6G,EAC7G,oEAAoE,EACpE;oBACE,gDAAgD;oBAChD,kDAAkD;oBAClD,2CAA2C;oBAC3C,+CAA+C;iBAChD,EACD,mCAAmC,EACnC,mFAAmF,EACnF,qFAAqF,CACtF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,kFAAkF;QAClF,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrF,MAAM,cAAc,GAAG,YAAY,IAAI,eAAe,CAAC;QAEvD,0EAA0E;QAC1E,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/D,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEnF,MAAM,kBAAkB,GAAG,cAAc,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpJ,iFAAiF;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7D,MAAM,sBAAsB,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClG,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC;QACpG,CAAC,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5B,SAAS,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAE3E,MAAM,kBAAkB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC9B,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAExF,MAAM,mBAAmB,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAE9D,IAAI,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;YAC9C,CAAC,gBAAgB,IAAI,kBAAkB,IAAI,mBAAmB,CAAC,EAAE,CAAC;YACpE,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,uBAAuB,EACvB,sDAAsD,EACtD,2EAA2E,EAC3E,KAAK,GAAG,CAAC,EACT,iHAAiH,EACjH,uEAAuE,EACvE;gBACE,yCAAyC;gBACzC,+CAA+C;gBAC/C,wCAAwC;gBACxC,4CAA4C;aAC7C,EACD,qCAAqC,EACrC,mGAAmG,EACnG,6FAA6F,CAC9F,CACF,CAAC;QACJ,CAAC;QAED,wDAAwD;QACxD,gFAAgF;QAChF,oDAAoD;QACpD,4DAA4D;QAC5D,MAAM,uBAAuB,GAAG,WAAW,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACpC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,qBAAqB,GAAG,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE9D,IAAI,uBAAuB,IAAI,CAAC,qBAAqB;YACjD,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9D,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACzE,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC7C,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAEjD,4EAA4E;YAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;oBACjE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YAEH,wCAAwC;YACxC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAExF,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;gBACnC,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,0BAA0B,EAC1B,6EAA6E,EAC7E,iEAAiE,EACjE,KAAK,GAAG,CAAC,EACT,uFAAuF,EACvF,yEAAyE,EACzE;oBACE,6CAA6C;oBAC7C,sDAAsD;oBACtD,6CAA6C;oBAC7C,uCAAuC;iBACxC,EACD,uCAAuC,EACvC,0GAA0G,EAC1G,0EAA0E,CAC3E,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,qEAAqE;QACrE,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;QAE9H,IAAI,eAAe,EAAE,CAAC;YACpB,sDAAsD;YACtD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClF,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YAExF,IAAI,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC/C,eAAe,CAAC,IAAI,CAClB,IAAA,2DAAqC,EACnC,yBAAyB,EACzB,iEAAiE,EACjE,gEAAgE,EAChE,KAAK,GAAG,CAAC,EACT,0FAA0F,EAC1F,oEAAoE,EACpE;oBACE,qDAAqD;oBACrD,sCAAsC;oBACtC,6CAA6C;oBAC7C,8CAA8C;iBAC/C,EACD,4DAA4D,EAC5D,4GAA4G,EAC5G,sFAAsF,CACvF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IAEH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}