codeslick-cli 1.0.0

package/dist/src/lib/analyzers/typescript/security-checks/information-disclosure.d.ts

@@ -0,0 +1,19 @@
+/**
+ * TypeScript Information Disclosure Security Checks
+ * OWASP A05:2021 - Security Misconfiguration
+ *
+ * Detects sensitive information exposure vulnerabilities
+ * in TypeScript Express/Koa error handlers.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for information disclosure vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #86: Stack trace exposure in error handlers (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkInformationDisclosure(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=information-disclosure.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/information-disclosure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"information-disclosure.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/information-disclosure.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAgHzB"}

package/dist/src/lib/analyzers/typescript/security-checks/information-disclosure.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * TypeScript Information Disclosure Security Checks
+ * OWASP A05:2021 - Security Misconfiguration
+ *
+ * Detects sensitive information exposure vulnerabilities
+ * in TypeScript Express/Koa error handlers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkInformationDisclosure = checkInformationDisclosure;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for information disclosure vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #86: Stack trace exposure in error handlers (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkInformationDisclosure(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // OWASP A05:2021 - Security Misconfiguration
+        // Check #86: Stack trace exposure in error handlers - HIGH
+        // Pattern: app.use((err, req, res, next) => { res.json({ stack: err.stack }) })
+        // Detects error handler middleware with 4 parameters exposing err.stack or err.message
+        // First, detect error handler middleware pattern (4 parameters)
+        // Matches both: (err, req, res, next) and (err: any, req: any, res: any, next: any)
+        const errorHandlerPattern = /(app|router)\.use\s*\(\s*\(\s*err\s*(?::\s*\w+)?\s*,\s*req\s*(?::\s*\w+)?\s*,\s*res\s*(?::\s*\w+)?\s*,\s*next\s*(?::\s*\w+)?\s*\)/i;
+        if (trimmed.match(errorHandlerPattern)) {
+            // Check next 15 lines for stack trace exposure
+            const nextLines = lines.slice(index, Math.min(index + 15, lines.length));
+            // Look for patterns that expose error details
+            const exposesStackTrace = nextLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (
+                // err.stack being sent in response
+                (lowerLine.includes('err.stack') || lowerLine.includes('error.stack')) ||
+                    // err.message with stack property access nearby
+                    (lowerLine.includes('err.message') &&
+                        nextLines.some(nl => nl.toLowerCase().includes('.stack'))));
+            });
+            // Look for production environment check
+            const hasProductionCheck = nextLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return (lowerLine.includes('node_env') ||
+                    lowerLine.includes('production') ||
+                    lowerLine.includes('process.env.env'));
+            });
+            if (exposesStackTrace && !hasProductionCheck) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('stack-trace-exposure', 'Error handler exposes sensitive stack traces in production', 'Only expose stack traces in development: if (process.env.NODE_ENV !== "production") { ... }', lineNumber, 'Stack traces contain sensitive information about the application\'s internal structure, file paths, library versions, and database details. Exposing this in production enables attackers to identify vulnerabilities and craft targeted attacks.', 'app.use((err, req, res, next) => res.status(500).json({error: err.message, stack: err.stack})) → attacker sees: "at /home/app/src/database/connection.js:42:15"', [
+                    'Disclosure of internal file paths and project structure',
+                    'Exposure of framework and library versions (enables targeted exploits)',
+                    'Revelation of database connection details and queries',
+                    'Information gathering for targeted attacks',
+                    'Compliance violations (OWASP, PCI-DSS require error message sanitization)'
+                ], 'app.use((err: any, req: any, res: any, next: any) => {\n  res.status(500).json({ error: err.message, stack: err.stack });\n});', 'app.use((err: any, req: any, res: any, next: any) => {\n  if (process.env.NODE_ENV === "production") {\n    res.status(500).json({ error: "Internal server error" });\n  } else {\n    res.status(500).json({ error: err.message, stack: err.stack });\n  }\n});', 'Add environment check to only expose detailed error information in development. In production, return generic error messages to prevent information leakage.'));
+            }
+        }
+        // Additional check: Direct stack trace exposure (not in error handler)
+        // Pattern: res.json({ stack: err.stack }) or res.send(err.stack)
+        if ((trimmed.includes('res.json') || trimmed.includes('res.send')) &&
+            (trimmed.includes('err.stack') || trimmed.includes('error.stack'))) {
+            // Check surrounding lines for environment check
+            const surroundingLines = lines.slice(Math.max(0, index - 3), Math.min(index + 3, lines.length));
+            const hasEnvCheck = surroundingLines.some(l => {
+                const lowerLine = l.toLowerCase();
+                return lowerLine.includes('node_env') || lowerLine.includes('production');
+            });
+            if (!hasEnvCheck) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('direct-stack-exposure', 'Direct exposure of stack trace without environment check', 'Add production check: if (process.env.NODE_ENV !== "production") before exposing stack traces', lineNumber, 'Stack trace exposure reveals internal application details that attackers can use to identify and exploit vulnerabilities.', 'res.json({stack: err.stack}) in production → reveals "/app/src/auth/controller.ts:125:30"', [
+                    'Internal path disclosure',
+                    'Technology stack fingerprinting',
+                    'Vulnerability identification aid',
+                    'Attack surface mapping'
+                ], 'res.status(500).json({ error: err.message, stack: err.stack });', 'if (process.env.NODE_ENV !== "production") {\n  res.status(500).json({ error: err.message, stack: err.stack });\n} else {\n  res.status(500).json({ error: "Internal server error" });\n}', 'Wrap stack trace exposure in environment check to prevent information leakage in production'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=information-disclosure.js.map

package/dist/src/lib/analyzers/typescript/security-checks/information-disclosure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"information-disclosure.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/information-disclosure.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAcH,gEAkHC;AA7HD,sEAAqF;AAErF;;;;;;;;GAQG;AACH,SAAgB,0BAA0B,CACxC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,6CAA6C;QAC7C,2DAA2D;QAC3D,gFAAgF;QAChF,uFAAuF;QAEvF,gEAAgE;QAChE,oFAAoF;QACpF,MAAM,mBAAmB,GAAG,oIAAoI,CAAC;QAEjK,IAAI,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvC,+CAA+C;YAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAEzE,8CAA8C;YAC9C,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO;gBACL,mCAAmC;gBACnC,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;oBACtE,gDAAgD;oBAChD,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;wBACjC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5D,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,wCAAwC;YACxC,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC9B,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAChC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACtC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,sBAAsB,EACtB,4DAA4D,EAC5D,6FAA6F,EAC7F,UAAU,EACV,mPAAmP,EACnP,iKAAiK,EACjK;oBACE,yDAAyD;oBACzD,wEAAwE;oBACxE,uDAAuD;oBACvD,4CAA4C;oBAC5C,2EAA2E;iBAC5E,EACD,gIAAgI,EAChI,kQAAkQ,EAClQ,8JAA8J,CAC/J,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC9D,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAEvE,gDAAgD;YAChD,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAChG,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,uBAAuB,EACvB,0DAA0D,EAC1D,+FAA+F,EAC/F,UAAU,EACV,2HAA2H,EAC3H,2FAA2F,EAC3F;oBACE,0BAA0B;oBAC1B,iCAAiC;oBACjC,kCAAkC;oBAClC,wBAAwB;iBACzB,EACD,iEAAiE,EACjE,2LAA2L,EAC3L,6FAA6F,CAC9F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/typescript/security-checks/injection-attacks.d.ts

@@ -0,0 +1,29 @@
+/**
+ * TypeScript Injection Attack Security Checks
+ * OWASP A03:2021 - Injection
+ *
+ * Detects code injection and XSS vulnerabilities in TypeScript code.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for injection attack vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #1: eval() usage (CRITICAL)
+ * - Check #2: Function constructor (HIGH)
+ * - Check #3: setTimeout/setInterval with strings (MEDIUM)
+ * - Check #4: innerHTML with variables (HIGH) - XSS
+ * - Check #5: outerHTML with variables (HIGH) - XSS
+ * - Check #6: document.write (MEDIUM) - XSS
+ * - Check #7: dangerouslySetInnerHTML (React) (HIGH) - XSS
+ * - Check #8: res.send/res.write with HTML template literals (HIGH) - XSS
+ * - Check #9: NoSQL Injection - MongoDB operator injection (CRITICAL) - Phase A P0
+ * - Check #10: NoSQL Injection - MongoDB $where JavaScript injection (CRITICAL) - Phase A P0
+ * - Check #11: SSTI - Server-Side Template Injection (CRITICAL) - Phase B
+ * - Check #12: LDAP Injection (CRITICAL) - Phase B
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkInjectionAttacks(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=injection-attacks.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/injection-attacks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-attacks.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/injection-attacks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CA2ezB"}

package/dist/src/lib/analyzers/typescript/security-checks/injection-attacks.js

@@ -0,0 +1,319 @@
+"use strict";
+/**
+ * TypeScript Injection Attack Security Checks
+ * OWASP A03:2021 - Injection
+ *
+ * Detects code injection and XSS vulnerabilities in TypeScript code.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkInjectionAttacks = checkInjectionAttacks;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for injection attack vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #1: eval() usage (CRITICAL)
+ * - Check #2: Function constructor (HIGH)
+ * - Check #3: setTimeout/setInterval with strings (MEDIUM)
+ * - Check #4: innerHTML with variables (HIGH) - XSS
+ * - Check #5: outerHTML with variables (HIGH) - XSS
+ * - Check #6: document.write (MEDIUM) - XSS
+ * - Check #7: dangerouslySetInnerHTML (React) (HIGH) - XSS
+ * - Check #8: res.send/res.write with HTML template literals (HIGH) - XSS
+ * - Check #9: NoSQL Injection - MongoDB operator injection (CRITICAL) - Phase A P0
+ * - Check #10: NoSQL Injection - MongoDB $where JavaScript injection (CRITICAL) - Phase A P0
+ * - Check #11: SSTI - Server-Side Template Injection (CRITICAL) - Phase B
+ * - Check #12: LDAP Injection (CRITICAL) - Phase B
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkInjectionAttacks(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    // Track variables assigned from user input (simple within-function tracking)
+    const userInputVariables = new Map(); // variable name -> line number
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // OWASP A03:2021 - Injection
+        // 1. eval() - CRITICAL
+        if (trimmed.includes('eval(')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('eval-usage', 'CRITICAL: eval() allows arbitrary code execution', 'Use JSON.parse() or type-safe alternatives', lineNumber, 'An attacker can inject malicious code through any input that reaches eval(), enabling complete control over the application\'s execution context.', 'eval(userInput) where userInput = "require(\'child_process\').exec(\'rm -rf /\')"', [
+                'Remote Code Execution (RCE)',
+                'Complete system compromise',
+                'Data theft and exfiltration',
+                'Malware installation'
+            ], 'const result = eval(userInput);', 'const result = JSON.parse(userInput); // For data only', 'Replace eval() with JSON.parse() for data parsing, or refactor code to avoid dynamic execution entirely'));
+        }
+        // 2. Function constructor - HIGH
+        if (trimmed.match(/new\s+Function\s*\(/)) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('function-constructor', 'Function constructor similar to eval() - vulnerable to injection', 'Avoid creating functions dynamically from strings', lineNumber, 'The Function constructor creates functions from strings at runtime, allowing arbitrary code execution if the input is attacker-controlled.', 'new Function(userInput)() where userInput = "return process.env"', [
+                'Code injection',
+                'Access to sensitive data',
+                'Bypass of security restrictions',
+                'Remote code execution in certain contexts'
+            ], 'const fn = new Function(userCode); fn();', '// Refactor to avoid dynamic code generation\n// Use predefined functions or safer alternatives', 'Eliminate dynamic function creation. Use predefined functions, configuration objects, or refactor the architecture'));
+        }
+        // 3. setTimeout/setInterval with strings OR variables - MEDIUM
+        if (trimmed.match(/set(Timeout|Interval)\s*\(\s*['"]/) ||
+            trimmed.match(/set(Timeout|Interval)\s*\(\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*,/)) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('settimeout-string', 'setTimeout/setInterval with string or code variable executes code like eval()', 'Use anonymous function: setTimeout(() => {...}, delay)', lineNumber, 'Passing a string or variable containing code to setTimeout/setInterval causes it to be evaluated as code, similar to eval().', 'setTimeout("alert(userInput)", 1000) or setTimeout(code, 1000) where code/userInput is attacker-controlled', [
+                'Code injection via timing functions',
+                'XSS attacks',
+                'Bypass of CSP (Content Security Policy)'
+            ], 'setTimeout("doSomething()", 1000); // or setTimeout(code, 1000);', 'setTimeout(() => doSomething(), 1000);', 'Always pass a function reference or arrow function to setTimeout/setInterval, never a string or variable containing code'));
+        }
+        // OWASP A03:2021 - XSS (Cross-Site Scripting)
+        // 4. innerHTML with variables - HIGH
+        if (trimmed.match(/\.innerHTML\s*=/) && (trimmed.includes('+') || trimmed.includes('${'))) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('xss', 'XSS: innerHTML with unsanitized variables', 'Use textContent, DOMPurify, or createElement()', lineNumber, 'An attacker can inject malicious JavaScript code through user input, stealing session cookies, credentials, or performing actions on behalf of the user.', 'element.innerHTML = "<div>" + userInput + "</div>" where userInput = "<img src=x onerror=alert(document.cookie)>"', [
+                'Session hijacking (cookie theft)',
+                'Credential theft (keylogging)',
+                'Phishing attacks',
+                'Malware distribution',
+                'Defacement'
+            ], 'element.innerHTML = "<div>" + userContent + "</div>";', 'element.textContent = userContent; // Safe for plain text\n// Or: element.innerHTML = DOMPurify.sanitize(userContent);', 'Use textContent for plain text, or sanitize HTML with DOMPurify before setting innerHTML'));
+        }
+        // 5. outerHTML - HIGH
+        if (trimmed.match(/\.outerHTML\s*=/) && (trimmed.includes('+') || trimmed.includes('${'))) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('xss', 'XSS: outerHTML with unsanitized variables', 'Use safe DOM methods', lineNumber, 'Setting outerHTML with user content allows XSS attacks by replacing the entire element with malicious HTML.', 'element.outerHTML = userHTML where userHTML contains <img src=x onerror=alert(1)>', [
+                'Cross-site scripting (XSS)',
+                'Session hijacking',
+                'Credential theft',
+                'Malware distribution'
+            ], 'element.outerHTML = "<div>" + userContent + "</div>";', 'const div = document.createElement("div");\ndiv.textContent = userContent;\nelement.replaceWith(div);', 'Create elements using createElement() and set content with textContent, or sanitize HTML with DOMPurify'));
+        }
+        // 6. document.write - MEDIUM
+        if (trimmed.includes('document.write')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('document-write', 'document.write is unsafe, deprecated and can cause XSS', 'Use createElement() and appendChild()', lineNumber, 'document.write() is synchronous, deprecated, and can be exploited for XSS if used with untrusted data.', 'document.write("<div>" + userInput + "</div>")', [
+                'XSS vulnerability',
+                'Performance issues (parser-blocking)',
+                'Overwrites page content if called after page load'
+            ], 'document.write("<h1>" + title + "</h1>");', 'const h1 = document.createElement("h1");\nh1.textContent = title;\ndocument.body.appendChild(h1);', 'Use modern DOM APIs: createElement(), textContent, and appendChild()'));
+        }
+        // 7. dangerouslySetInnerHTML (React) - HIGH
+        if (trimmed.match(/dangerouslySetInnerHTML\s*=\s*{{/)) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('xss', 'React dangerouslySetInnerHTML can cause XSS', 'Sanitize with DOMPurify before use', lineNumber, 'Using dangerouslySetInnerHTML without sanitization allows XSS attacks through user-supplied HTML content.', '<div dangerouslySetInnerHTML={{__html: userInput}} /> where userInput contains malicious script', [
+                'Cross-site scripting (XSS)',
+                'Session hijacking',
+                'Credential theft',
+                'Malware distribution'
+            ], '<div dangerouslySetInnerHTML={{__html: userInput}} />', 'import DOMPurify from "dompurify";\n<div dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(userInput)}} />', 'Always sanitize HTML content with DOMPurify before passing to dangerouslySetInnerHTML'));
+        }
+        // 8. Express res.send/res.write with HTML template literals - HIGH
+        // Detects: res.send(`<h1>Hello ${name}</h1>`) - Reflected XSS
+        if (trimmed.match(/(res|response)\.(send|write)\s*\(/) &&
+            trimmed.includes('`') &&
+            trimmed.match(/<[^>]+>/) &&
+            trimmed.includes('${')) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('xss', 'XSS: res.send/res.write with HTML template literals and variables', 'Escape HTML or use a templating engine with auto-escaping', lineNumber, 'Sending HTML with unescaped user input allows attackers to inject malicious scripts that execute in the victim\'s browser, stealing cookies or performing actions on their behalf.', 'res.send(`<h1>Hello ${req.query.name}</h1>`) where name = "<script>alert(document.cookie)</script>"', [
+                'Reflected XSS attacks',
+                'Session hijacking (cookie theft)',
+                'Credential theft',
+                'Phishing attacks',
+                'Malware distribution'
+            ], 'res.send(`<h1>Hello ${userName}</h1>`);', 'import { escapeHtml } from "escape-html";\nres.send(`<h1>Hello ${escapeHtml(userName)}</h1>`);\n// Or use template engine: res.render("template", { userName });', 'Use HTML escaping libraries (escape-html) or template engines with auto-escaping (EJS, Handlebars, Pug)'));
+        }
+        // =============================================================================
+        // PHASE A P0 - NoSQL Injection Detection (Dec 19, 2025)
+        // =============================================================================
+        // Track user input variable assignments (simple within-function tracking)
+        // Pattern: const query = req.body; const filter = req.json(); etc.
+        const userInputAssignment = trimmed.match(/^(?:const|let|var)\s+(\w+)\s*=\s*(req\.(body|json|query|params|get))/);
+        if (userInputAssignment) {
+            const varName = userInputAssignment[1];
+            userInputVariables.set(varName, lineNumber);
+        }
+        // 9. MongoDB Operator Injection - CRITICAL
+        // Pattern: collection.find(req.body) or collection.findOne(userQuery)
+        // Detects MongoDB query methods with user-controlled input
+        const mongoMethodMatch = trimmed.match(/\.(find|findOne|findOneAndUpdate|update|updateOne|updateMany|delete|deleteOne|deleteMany|count|countDocuments|aggregate)\s*\(/);
+        if (mongoMethodMatch) {
+            const methodName = mongoMethodMatch[1];
+            // Extract argument to MongoDB method
+            const methodCallMatch = trimmed.match(/\.(find|findOne|findOneAndUpdate|update|updateOne|updateMany|delete|deleteOne|deleteMany|count|countDocuments|aggregate)\s*\(\s*([^)]+)\s*\)/);
+            if (methodCallMatch) {
+                const args = methodCallMatch[2].trim();
+                // Check for direct user input
+                const hasDirectUserInput = args.includes('req.body') ||
+                    args.includes('req.json()') ||
+                    args.includes('req.query') ||
+                    args.includes('req.params');
+                // Check for user input variable
+                const firstArg = args.split(',')[0].trim();
+                const hasUserInputVariable = userInputVariables.has(firstArg);
+                // Check for object spread with potential user input
+                const hasSpreadWithUserInput = args.match(/\.\.\.\s*req\.(body|json\(\)|query|params)/) ||
+                    (args.includes('...') && userInputVariables.has(args.match(/\.\.\.\s*(\w+)/)?.[1] || ''));
+                if (hasDirectUserInput || hasUserInputVariable || hasSpreadWithUserInput) {
+                    const userInputSource = hasDirectUserInput
+                        ? args.match(/req\.(body|json|query|params)/)?.[0] || 'req.body'
+                        : (hasUserInputVariable ? `${firstArg} (line ${userInputVariables.get(firstArg)})` : 'spread operator');
+                    // Only flag if not using safe field extraction pattern
+                    // Safe: { username: req.body.username } or { username, password } destructured
+                    const isSafeFieldExtraction = args.match(/\{\s*\w+\s*:\s*req\.(body|query|params)\.\w+\s*\}/) ||
+                        !args.includes('req.') && !hasUserInputVariable && !hasSpreadWithUserInput;
+                    if (!isSafeFieldExtraction) {
+                        vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('nosql-injection', `MongoDB ${methodName}() with user-controlled input - operator injection risk`, 'Use schema validation (zod/joi) or explicit field extraction', lineNumber, `MongoDB query methods accept object-like inputs. Attackers can inject MongoDB operators like {$gt: ""}, {$ne: null}, or {$or: [...]} to bypass authentication, access unauthorized data, or manipulate queries. User input from ${userInputSource} is passed directly to the query.`, `const user = await db.users.findOne(req.body); // Attack: POST {\"username\": {\"$ne\": null}, \"password\": {\"$ne\": null}} bypasses authentication`, [
+                            'Authentication bypass (login without valid credentials)',
+                            'Unauthorized data access (read all database records)',
+                            'Data exfiltration via operator injection',
+                            'Privilege escalation (access admin accounts)',
+                            'Database enumeration and information disclosure'
+                        ], `const credentials = req.body;\nconst user = await db.users.${methodName}(credentials); // Vulnerable to MongoDB operator injection`, `// Option 1: Schema validation (recommended)\nimport { z } from 'zod';\nconst LoginSchema = z.object({\n  username: z.string().min(1).max(50),\n  password: z.string().min(1)\n});\nconst validated = LoginSchema.parse(req.body);\nconst user = await db.users.${methodName}(validated);\n\n// Option 2: Explicit field extraction\nconst { username, password } = req.body;\nconst user = await db.users.${methodName}({ username, password }); // Only expected fields`, 'Never pass user input directly to MongoDB query methods. Use schema validation (zod, joi, class-validator) to ensure only expected fields with correct types, or extract fields explicitly. Reject objects containing keys starting with $ or containing nested objects.'));
+                    }
+                }
+            }
+        }
+        // 10. MongoDB $where JavaScript Injection - CRITICAL
+        // Pattern: collection.find({ "$where": `this.age > ${minAge}` })
+        // Detects $where operator with string interpolation
+        if (trimmed.includes('$where') || trimmed.includes('"$where"') || trimmed.includes("'$where'")) {
+            // Check for template literal interpolation
+            const hasTemplateLiteral = trimmed.match(/\$where['"]?\s*:\s*`[^`]*\$\{/) ||
+                trimmed.match(/\$where['"]?\s*:\s*['"].*\$\{/);
+            // Check for string concatenation
+            const hasStringConcat = trimmed.match(/\$where['"]?\s*:\s*['"][^'"]*['"]?\s*\+/) ||
+                trimmed.match(/\$where['"]?\s*:\s*.*\+\s*\w+/);
+            if (hasTemplateLiteral || hasStringConcat) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('nosql-injection', 'MongoDB $where clause with JavaScript injection risk', 'Avoid $where entirely - use native MongoDB operators ($gt, $lt, $eq, etc.)', lineNumber, 'MongoDB $where operator executes JavaScript code on the server. If user input is interpolated into $where clauses using template literals or string concatenation, attackers can inject arbitrary JavaScript code, leading to remote code execution, data exfiltration, or denial of service.', 'const query = { "$where": `this.age > ${req.body.minAge}` }; // Attack: minAge = "0; return true; //" returns all documents', [
+                    'Remote Code Execution (JavaScript execution in MongoDB process)',
+                    'Complete database compromise and data theft',
+                    'Denial of Service (infinite loops, resource exhaustion)',
+                    'Bypass of all authentication and authorization',
+                    'Server takeover via process.mainModule.require'
+                ], 'const minAge = req.query.age;\nconst users = await db.users.find({ "$where": `this.age > ${minAge}` }); // JavaScript injection!', '// NEVER use $where with user input\n// Use native MongoDB operators instead:\nconst minAge = parseInt(req.query.age, 10);\nconst users = await db.users.find({ age: { $gt: minAge } }); // Safe: native operator, no code execution', 'MongoDB $where operator is extremely dangerous and should never be used with user input. Always use native MongoDB query operators ($gt, $lt, $eq, $in, $and, $or, etc.) which do not execute code. If complex logic is needed, implement it in application code, not in database queries.'));
+            }
+        }
+        // Additional check: Detect spread operator with user input (catches multi-line MongoDB calls)
+        // Pattern: { ...req.body } or { ...req.json() } anywhere in code
+        if (trimmed.match(/\{\s*\.\.\.\s*req\.(body|json\(\)|query|params)/)) {
+            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('nosql-injection', 'Object spread with user input - potential NoSQL injection', 'Extract specific fields or use schema validation', lineNumber, 'Using object spread operator with unsanitized user input allows attackers to inject arbitrary fields into database queries, potentially bypassing authentication or accessing unauthorized data.', '{ ...req.body } // Attack: POST {"$ne": null} bypasses all authentication checks', [
+                'Authentication bypass (NoSQL operator injection)',
+                'Unauthorized data access',
+                'Privilege escalation',
+                'Data exfiltration'
+            ], 'const updateData = { ...req.body };\nawait db.users.updateOne({ _id: userId }, updateData);', 'const { field1, field2 } = req.body;\nconst updateData = { field1, field2 };\nawait db.users.updateOne({ _id: userId }, updateData);', 'Always explicitly extract required fields from user input instead of using spread operator. This prevents attackers from injecting NoSQL operators like $ne, $gt, $or, etc.'));
+        }
+        // =============================================================================
+        // PHASE B - Server-Side Template Injection & LDAP Injection (Dec 20, 2025)
+        // =============================================================================
+        // 11. SSTI - Server-Side Template Injection - CRITICAL
+        // Pattern: Handlebars.compile(userInput), Pug.compile(), EJS.render(), etc.
+        // Detects template compilation with user-controlled input
+        const templateMethods = [
+            'Handlebars.compile',
+            'Pug.compile',
+            'EJS.render',
+            'Nunjucks.renderString',
+            'res.render'
+        ];
+        for (const method of templateMethods) {
+            if (trimmed.includes(method)) {
+                // Extract argument to template method
+                const methodPattern = new RegExp(`${method.replace('.', '\\.')}\\s*\\(`);
+                const methodMatch = trimmed.match(methodPattern);
+                if (methodMatch) {
+                    // Check for direct user input
+                    const hasDirectUserInput = trimmed.includes('req.body') ||
+                        trimmed.includes('req.json()') ||
+                        trimmed.includes('req.query') ||
+                        trimmed.includes('req.params');
+                    // Check for user input variable
+                    const argMatch = trimmed.match(new RegExp(`${method.replace('.', '\\.')}\\s*\\(\\s*([^),]+)`));
+                    const firstArg = argMatch ? argMatch[1].trim() : '';
+                    const hasUserInputVariable = userInputVariables.has(firstArg);
+                    // Check for template literal with user input
+                    const hasTemplateLiteral = trimmed.match(/`[^`]*\$\{/) &&
+                        (trimmed.includes('req.') || Array.from(userInputVariables.keys()).some(varName => trimmed.includes(varName)));
+                    if (hasDirectUserInput || hasUserInputVariable || hasTemplateLiteral) {
+                        const userInputSource = hasDirectUserInput
+                            ? (trimmed.match(/req\.(body|json\(\)|query|params)/)?.[0] || 'req.body')
+                            : (hasUserInputVariable ? `${firstArg} (line ${userInputVariables.get(firstArg)})` : 'template literal');
+                        vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('ssti', `Server-Side Template Injection via ${method}() with user-controlled template`, 'Never compile user input as templates - only use user data in template variables', lineNumber, `Template engines like Handlebars, Pug, EJS, and Nunjucks execute code when compiling templates. If attackers control the template string (from ${userInputSource}), they can inject template expressions that execute arbitrary code on the server, leading to Remote Code Execution (RCE).`, `${method}(req.body.template) // Attack: template = "{{constructor.constructor('return process.env')()}}" exposes all environment variables including secrets`, [
+                            'Remote Code Execution (RCE)',
+                            'Complete server takeover',
+                            'Environment variable disclosure (API keys, secrets)',
+                            'File system access and data exfiltration',
+                            'Denial of Service (infinite loops)',
+                            'Lateral movement to other services'
+                        ], `const template = req.query.template;\nconst compiled = ${method}(template); // User controls template code!`, `// NEVER compile user input as templates\n// Use user input only as data in pre-defined templates:\nconst template = ${method}('Hello {{name}}'); // Safe: template is hardcoded\nconst result = template({ name: req.body.name }); // User data in variables only`, 'Never allow user input to be used as template code. Always use pre-defined, hardcoded templates and only pass user data as template variables. For dynamic content, use parameterized templates with user input in data context, never in template strings.'));
+                    }
+                }
+            }
+        }
+        // =============================================================================
+        // 12. LDAP Injection - CRITICAL
+        // Pattern: LDAP filter construction with user input via template literals or concatenation
+        // Detects: client.search() with user-controlled filters
+        // =============================================================================
+        // Detect LDAP search operations
+        if (trimmed.match(/\.(search|searchOne|bind)\s*\(/)) {
+            // Check for LDAP filter construction with user input
+            // Pattern 1: Filter as template literal with user input
+            // const filter = `(uid=${req.body.username})`;
+            const hasFilterTemplateLiteral = trimmed.match(/filter\s*[:=]\s*`[^`]*\$\{/) &&
+                (trimmed.includes('req.') ||
+                    Array.from(userInputVariables.keys()).some(varName => trimmed.includes(varName)));
+            // Pattern 2: LDAP method with template literal filter in argument
+            // client.search('ou=users', { filter: `(uid=${username})` })
+            const hasInlineFilterTemplate = trimmed.match(/filter\s*:\s*`[^`]*\$\{/) &&
+                (trimmed.includes('req.') ||
+                    Array.from(userInputVariables.keys()).some(varName => trimmed.includes(varName)));
+            // Pattern 3: String concatenation in filter
+            // const filter = "(uid=" + req.body.username + ")";
+            const hasFilterConcat = trimmed.match(/filter\s*[:=]\s*['"][^'"]*['"]?\s*\+/) &&
+                (trimmed.includes('req.') ||
+                    Array.from(userInputVariables.keys()).some(varName => trimmed.includes(varName)));
+            // Pattern 4: User input variable used in filter
+            const filterMatch = trimmed.match(/filter\s*[:=]\s*([a-zA-Z_$][a-zA-Z0-9_$]*)/);
+            const filterVarName = filterMatch ? filterMatch[1] : '';
+            const hasUserInputFilterVar = userInputVariables.has(filterVarName);
+            // Pattern 5: ES6 shorthand property syntax { filter } where filter is user input variable
+            const shorthandMatch = trimmed.match(/\{\s*filter\s*[,}]/);
+            const hasShorthandFilter = shorthandMatch && userInputVariables.has('filter');
+            if (hasFilterTemplateLiteral || hasInlineFilterTemplate || hasFilterConcat || hasUserInputFilterVar || hasShorthandFilter) {
+                const userInputSource = hasShorthandFilter
+                    ? `filter variable (line ${userInputVariables.get('filter')})`
+                    : (hasUserInputFilterVar
+                        ? `${filterVarName} (line ${userInputVariables.get(filterVarName)})`
+                        : 'user input in filter');
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('ldap-injection', `LDAP Injection via filter construction with ${userInputSource}`, 'Use parameterized LDAP queries or escape LDAP special characters', lineNumber, 'LDAP queries constructed with unescaped user input allow attackers to manipulate the query logic by injecting LDAP filter operators like *, (, ), &, |, or !. This can bypass authentication, access unauthorized data, or enumerate directory information.', 'const filter = `(uid=${req.body.username})`; // Attack: username = "*)(uid=*))(|(uid=*" bypasses authentication and returns all users', [
+                    'Authentication bypass (login as any user)',
+                    'Unauthorized data access (read sensitive directory information)',
+                    'Directory enumeration (discover user accounts, groups)',
+                    'Privilege escalation (access admin accounts)',
+                    'Information disclosure (email addresses, phone numbers, organizational structure)'
+                ], 'const username = req.body.username;\nconst filter = `(uid=${username})`;\nclient.search(\'ou=users,dc=example,dc=com\', { filter }); // Vulnerable to LDAP injection', '// Option 1: Use LDAP escape function\nimport { escape } from \'ldap-escape\';\nconst username = req.body.username;\nconst filter = `(uid=${escape(username)})`; // Escapes special chars: * ( ) \\ NUL\nclient.search(\'ou=users,dc=example,dc=com\', { filter });\n\n// Option 2: Use parameterized queries if library supports\nconst filter = { uid: req.body.username }; // Some libraries support object filters', 'Never construct LDAP filters using string concatenation or template literals with user input. Use LDAP escape functions (ldap-escape npm package) to escape special characters: * ( ) \\ & | ! = < > ~ NUL. Alternatively, use parameterized query APIs if your LDAP library supports them. Validate user input against a whitelist of allowed characters.'));
+            }
+        }
+        // Detect LDAP filter variable assignments with user input
+        // Pattern: const filter = `(uid=${req.body.username})`;
+        if (trimmed.match(/(?:const|let|var)\s+\w+\s*=\s*`[^`]*\(uid=|\(cn=|\(mail=/)) {
+            const hasUserInput = trimmed.match(/\$\{[^}]*req\./) ||
+                Array.from(userInputVariables.keys()).some(varName => trimmed.includes('${' + varName));
+            if (hasUserInput) {
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('ldap-injection', 'LDAP Injection via filter template literal with user input', 'Use LDAP escape function (ldap-escape) for user input in filters', lineNumber, 'LDAP filters constructed with template literals containing user input are vulnerable to LDAP injection attacks. Attackers can inject filter operators to bypass authentication or access unauthorized data.', 'const filter = `(uid=${req.body.username})`; // Attack: username = "*)(uid=*))(|(uid=*" returns all users', [
+                    'Authentication bypass',
+                    'Unauthorized data access',
+                    'Directory enumeration',
+                    'Information disclosure'
+                ], 'const filter = `(uid=${req.body.username})`;', 'import { escape } from \'ldap-escape\';\nconst filter = `(uid=${escape(req.body.username)})`;', 'Always escape user input in LDAP filters using the ldap-escape npm package or equivalent LDAP escape function'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=injection-attacks.js.map

package/dist/src/lib/analyzers/typescript/security-checks/injection-attacks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-attacks.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/injection-attacks.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAyBH,sDA6eC;AAngBD,sEAAqF;AAErF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,qBAAqB,CACnC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,6EAA6E;IAC7E,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,+BAA+B;IAErF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,6BAA6B;QAC7B,uBAAuB;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,YAAY,EACZ,kDAAkD,EAClD,4CAA4C,EAC5C,UAAU,EACV,mJAAmJ,EACnJ,mFAAmF,EACnF;gBACE,6BAA6B;gBAC7B,4BAA4B;gBAC5B,6BAA6B;gBAC7B,sBAAsB;aACvB,EACD,iCAAiC,EACjC,wDAAwD,EACxD,yGAAyG,CAC1G,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACzC,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,sBAAsB,EACtB,kEAAkE,EAClE,mDAAmD,EACnD,UAAU,EACV,4IAA4I,EAC5I,kEAAkE,EAClE;gBACE,gBAAgB;gBAChB,0BAA0B;gBAC1B,iCAAiC;gBACjC,2CAA2C;aAC5C,EACD,0CAA0C,EAC1C,iGAAiG,EACjG,oHAAoH,CACrH,CAAC,CAAC;QACL,CAAC;QAED,+DAA+D;QAC/D,IAAI,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,EAAE,CAAC;YAC/E,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,mBAAmB,EACnB,+EAA+E,EAC/E,wDAAwD,EACxD,UAAU,EACV,8HAA8H,EAC9H,4GAA4G,EAC5G;gBACE,qCAAqC;gBACrC,aAAa;gBACb,yCAAyC;aAC1C,EACD,kEAAkE,EAClE,wCAAwC,EACxC,0HAA0H,CAC3H,CAAC,CAAC;QACL,CAAC;QAED,8CAA8C;QAC9C,qCAAqC;QACrC,IAAI,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1F,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,KAAK,EACL,2CAA2C,EAC3C,gDAAgD,EAChD,UAAU,EACV,0JAA0J,EAC1J,mHAAmH,EACnH;gBACE,kCAAkC;gBAClC,+BAA+B;gBAC/B,kBAAkB;gBAClB,sBAAsB;gBACtB,YAAY;aACb,EACD,uDAAuD,EACvD,wHAAwH,EACxH,0FAA0F,CAC3F,CAAC,CAAC;QACL,CAAC;QAED,sBAAsB;QACtB,IAAI,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1F,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,KAAK,EACL,2CAA2C,EAC3C,sBAAsB,EACtB,UAAU,EACV,6GAA6G,EAC7G,mFAAmF,EACnF;gBACE,4BAA4B;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,sBAAsB;aACvB,EACD,uDAAuD,EACvD,uGAAuG,EACvG,yGAAyG,CAC1G,CAAC,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvC,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,gBAAgB,EAChB,wDAAwD,EACxD,uCAAuC,EACvC,UAAU,EACV,wGAAwG,EACxG,gDAAgD,EAChD;gBACE,mBAAmB;gBACnB,sCAAsC;gBACtC,mDAAmD;aACpD,EACD,2CAA2C,EAC3C,mGAAmG,EACnG,sEAAsE,CACvE,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,EAAE,CAAC;YACtD,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,KAAK,EACL,6CAA6C,EAC7C,oCAAoC,EACpC,UAAU,EACV,2GAA2G,EAC3G,iGAAiG,EACjG;gBACE,4BAA4B;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,sBAAsB;aACvB,EACD,uDAAuD,EACvD,+GAA+G,EAC/G,uFAAuF,CACxF,CAAC,CAAC;QACL,CAAC;QAED,mEAAmE;QACnE,8DAA8D;QAC9D,IAAI,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC;YAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,KAAK,EACL,mEAAmE,EACnE,2DAA2D,EAC3D,UAAU,EACV,oLAAoL,EACpL,qGAAqG,EACrG;gBACE,uBAAuB;gBACvB,kCAAkC;gBAClC,kBAAkB;gBAClB,kBAAkB;gBAClB,sBAAsB;aACvB,EACD,yCAAyC,EACzC,kKAAkK,EAClK,yGAAyG,CAC1G,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,wDAAwD;QACxD,gFAAgF;QAEhF,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAClH,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;YACvC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;QAED,2CAA2C;QAC3C,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,+HAA+H,CAAC,CAAC;QAExK,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAEvC,qCAAqC;YACrC,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,8IAA8I,CAAC,CAAC;YAEtL,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAEvC,8BAA8B;gBAC9B,MAAM,kBAAkB,GACtB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;oBACzB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC3B,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC1B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAE9B,gCAAgC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3C,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAE9D,oDAAoD;gBACpD,MAAM,sBAAsB,GAAG,IAAI,CAAC,KAAK,CAAC,4CAA4C,CAAC;oBACvD,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAE1H,IAAI,kBAAkB,IAAI,oBAAoB,IAAI,sBAAsB,EAAE,CAAC;oBACzE,MAAM,eAAe,GAAG,kBAAkB;wBACxC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU;wBAChE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,QAAQ,UAAU,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;oBAE1G,uDAAuD;oBACvD,+EAA+E;oBAC/E,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAAC,mDAAmD,CAAC;wBAC9D,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,sBAAsB,CAAC;oBAE1G,IAAI,CAAC,qBAAqB,EAAE,CAAC;wBAC3B,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,iBAAiB,EACjB,WAAW,UAAU,yDAAyD,EAC9E,8DAA8D,EAC9D,UAAU,EACV,mOAAmO,eAAe,mCAAmC,EACrR,uJAAuJ,EACvJ;4BACE,yDAAyD;4BACzD,sDAAsD;4BACtD,0CAA0C;4BAC1C,8CAA8C;4BAC9C,iDAAiD;yBAClD,EACD,8DAA8D,UAAU,4DAA4D,EACpI,mQAAmQ,UAAU,iIAAiI,UAAU,mDAAmD,EAC3c,0QAA0Q,CAC3Q,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,iEAAiE;QACjE,oDAAoD;QACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/F,2CAA2C;YAC3C,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC;gBAC5C,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAE5E,iCAAiC;YACjC,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC;gBACvD,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAExE,IAAI,kBAAkB,IAAI,eAAe,EAAE,CAAC;gBAC1C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,iBAAiB,EACjB,sDAAsD,EACtD,4EAA4E,EAC5E,UAAU,EACV,+RAA+R,EAC/R,6HAA6H,EAC7H;oBACE,iEAAiE;oBACjE,6CAA6C;oBAC7C,yDAAyD;oBACzD,gDAAgD;oBAChD,gDAAgD;iBACjD,EACD,kIAAkI,EAClI,sOAAsO,EACtO,4RAA4R,CAC7R,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,8FAA8F;QAC9F,iEAAiE;QACjE,IAAI,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,EAAE,CAAC;YACrE,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,iBAAiB,EACjB,2DAA2D,EAC3D,kDAAkD,EAClD,UAAU,EACV,kMAAkM,EAClM,kFAAkF,EAClF;gBACE,kDAAkD;gBAClD,0BAA0B;gBAC1B,sBAAsB;gBACtB,mBAAmB;aACpB,EACD,6FAA6F,EAC7F,sIAAsI,EACtI,6KAA6K,CAC9K,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,2EAA2E;QAC3E,gFAAgF;QAEhF,uDAAuD;QACvD,4EAA4E;QAC5E,0DAA0D;QAC1D,MAAM,eAAe,GAAG;YACtB,oBAAoB;YACpB,aAAa;YACb,YAAY;YACZ,uBAAuB;YACvB,YAAY;SACb,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,sCAAsC;gBACtC,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBACzE,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBAEjD,IAAI,WAAW,EAAE,CAAC;oBAChB,8BAA8B;oBAC9B,MAAM,kBAAkB,GACtB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;wBAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;wBAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;oBAEjC,gCAAgC;oBAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;oBAC/F,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAE9D,6CAA6C;oBAC7C,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;wBAC1B,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBAE3I,IAAI,kBAAkB,IAAI,oBAAoB,IAAI,kBAAkB,EAAE,CAAC;wBACrE,MAAM,eAAe,GAAG,kBAAkB;4BACxC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;4BACzE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,QAAQ,UAAU,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;wBAE3G,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,MAAM,EACN,sCAAsC,MAAM,kCAAkC,EAC9E,kFAAkF,EAClF,UAAU,EACV,kJAAkJ,eAAe,4HAA4H,EAC7R,GAAG,MAAM,qJAAqJ,EAC9J;4BACE,6BAA6B;4BAC7B,0BAA0B;4BAC1B,qDAAqD;4BACrD,0CAA0C;4BAC1C,oCAAoC;4BACpC,oCAAoC;yBACrC,EACD,0DAA0D,MAAM,6CAA6C,EAC7G,wHAAwH,MAAM,sIAAsI,EACpQ,6PAA6P,CAC9P,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,gCAAgC;QAChC,2FAA2F;QAC3F,wDAAwD;QACxD,gFAAgF;QAEhF,gCAAgC;QAChC,IAAI,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACpD,qDAAqD;YAErD,wDAAwD;YACxD,+CAA+C;YAC/C,MAAM,wBAAwB,GAAG,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC;gBAC1C,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAErH,kEAAkE;YAClE,6DAA6D;YAC7D,MAAM,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC;gBACvC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAEpH,4CAA4C;YAC5C,oDAAoD;YACpD,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC;gBACpD,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAE5G,gDAAgD;YAChD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChF,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,qBAAqB,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAEpE,0FAA0F;YAC1F,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC3D,MAAM,kBAAkB,GAAG,cAAc,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAE9E,IAAI,wBAAwB,IAAI,uBAAuB,IAAI,eAAe,IAAI,qBAAqB,IAAI,kBAAkB,EAAE,CAAC;gBAC1H,MAAM,eAAe,GAAG,kBAAkB;oBACxC,CAAC,CAAC,yBAAyB,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG;oBAC9D,CAAC,CAAC,CAAC,qBAAqB;wBACtB,CAAC,CAAC,GAAG,aAAa,UAAU,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG;wBACpE,CAAC,CAAC,sBAAsB,CAAC,CAAC;gBAE9B,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,gBAAgB,EAChB,+CAA+C,eAAe,EAAE,EAChE,kEAAkE,EAClE,UAAU,EACV,6PAA6P,EAC7P,uIAAuI,EACvI;oBACE,2CAA2C;oBAC3C,iEAAiE;oBACjE,wDAAwD;oBACxD,8CAA8C;oBAC9C,mFAAmF;iBACpF,EACD,sKAAsK,EACtK,wZAAwZ,EACxZ,4VAA4V,CAC7V,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,wDAAwD;QACxD,IAAI,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,EAAE,CAAC;YAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC;YAE1D,IAAI,YAAY,EAAE,CAAC;gBACjB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,gBAAgB,EAChB,4DAA4D,EAC5D,kEAAkE,EAClE,UAAU,EACV,6MAA6M,EAC7M,2GAA2G,EAC3G;oBACE,uBAAuB;oBACvB,0BAA0B;oBAC1B,uBAAuB;oBACvB,wBAAwB;iBACzB,EACD,8CAA8C,EAC9C,+FAA+F,EAC/F,+GAA+G,CAChH,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/typescript/security-checks/logging-failures.d.ts

@@ -0,0 +1,21 @@
+/**
+ * TypeScript Logging and Monitoring Security Checks
+ * OWASP A09:2025 - Security Logging and Monitoring Failures
+ *
+ * Detects critical logging vulnerabilities:
+ * - Check #92: Missing audit logging for critical operations
+ * - Check #93: Sensitive data in logs
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for logging and monitoring failures in TypeScript code
+ *
+ * Covers:
+ * - Check #92: Missing audit logging for critical operations (MEDIUM)
+ * - Check #93: Sensitive data logged (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkLoggingFailures(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=logging-failures.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/logging-failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-failures.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/logging-failures.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CA0IzB"}