codeslick-cli 1.0.0

package/dist/src/lib/security/compliance-mapping.js

@@ -0,0 +1,1342 @@
+"use strict";
+/**
+ * Compliance Mapping Database
+ *
+ * Maps security vulnerabilities to compliance frameworks:
+ * - OWASP Top 10 2021
+ * - CWE (Common Weakness Enumeration)
+ * - PCI-DSS (Payment Card Industry Data Security Standard)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getComplianceMapping = getComplianceMapping;
+exports.getOwaspCoverage = getOwaspCoverage;
+/**
+ * Get compliance mapping for a vulnerability type
+ */
+function getComplianceMapping(vulnerabilityType) {
+    const mappings = {
+        'sql-injection': {
+            owasp: 'A03:2025 - Injection',
+            cwe: 'CWE-89',
+            pciDss: '6.5.1',
+            references: [
+                {
+                    title: 'OWASP SQL Injection',
+                    url: 'https://owasp.org/www-community/attacks/SQL_Injection',
+                },
+                {
+                    title: 'CWE-89: SQL Injection',
+                    url: 'https://cwe.mitre.org/data/definitions/89.html',
+                },
+                {
+                    title: 'PCI-DSS Requirement 6.5.1',
+                    url: 'https://www.pcisecuritystandards.org/',
+                },
+            ],
+        },
+        'nosql-injection': {
+            owasp: 'A03:2025 - Injection',
+            cwe: 'CWE-943',
+            pciDss: '6.5.1',
+            references: [
+                {
+                    title: 'OWASP NoSQL Injection',
+                    url: 'https://owasp.org/www-community/attacks/NoSQL_Injection',
+                },
+                {
+                    title: 'CWE-943: NoSQL Injection',
+                    url: 'https://cwe.mitre.org/data/definitions/943.html',
+                },
+                {
+                    title: 'PCI-DSS Requirement 6.5.1',
+                    url: 'https://www.pcisecuritystandards.org/',
+                },
+            ],
+        },
+        'ssrf': {
+            owasp: 'A10:2025 - Server-Side Request Forgery',
+            cwe: 'CWE-918',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'OWASP SSRF',
+                    url: 'https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/',
+                },
+                {
+                    title: 'CWE-918: Server-Side Request Forgery (SSRF)',
+                    url: 'https://cwe.mitre.org/data/definitions/918.html',
+                },
+                {
+                    title: 'PortSwigger SSRF',
+                    url: 'https://portswigger.net/web-security/ssrf',
+                },
+            ],
+        },
+        'xss': {
+            owasp: 'A03:2025 - Injection',
+            cwe: 'CWE-79',
+            pciDss: '6.5.7',
+            references: [
+                {
+                    title: 'OWASP XSS',
+                    url: 'https://owasp.org/www-community/attacks/xss/',
+                },
+                {
+                    title: 'CWE-79: Cross-site Scripting',
+                    url: 'https://cwe.mitre.org/data/definitions/79.html',
+                },
+            ],
+        },
+        'command-injection': {
+            owasp: 'A03:2025 - Injection',
+            cwe: 'CWE-78',
+            pciDss: '6.5.1',
+            references: [
+                {
+                    title: 'OWASP Command Injection',
+                    url: 'https://owasp.org/www-community/attacks/Command_Injection',
+                },
+                {
+                    title: 'CWE-78: OS Command Injection',
+                    url: 'https://cwe.mitre.org/data/definitions/78.html',
+                },
+            ],
+        },
+        'path-traversal': {
+            owasp: 'A01:2025 - Broken Access Control',
+            cwe: 'CWE-22',
+            pciDss: '6.5.8',
+            references: [
+                {
+                    title: 'OWASP Path Traversal',
+                    url: 'https://owasp.org/www-community/attacks/Path_Traversal',
+                },
+                {
+                    title: 'CWE-22: Path Traversal',
+                    url: 'https://cwe.mitre.org/data/definitions/22.html',
+                },
+            ],
+        },
+        'eval-usage': {
+            owasp: 'A03:2025 - Injection',
+            cwe: 'CWE-95',
+            pciDss: '6.5.1',
+            references: [
+                {
+                    title: 'CWE-95: Code Injection',
+                    url: 'https://cwe.mitre.org/data/definitions/95.html',
+                },
+            ],
+        },
+        'deserialization': {
+            owasp: 'A08:2025 - Software and Data Integrity Failures',
+            cwe: 'CWE-502',
+            pciDss: '6.5.8',
+            references: [
+                {
+                    title: 'OWASP Deserialization',
+                    url: 'https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data',
+                },
+                {
+                    title: 'CWE-502: Deserialization of Untrusted Data',
+                    url: 'https://cwe.mitre.org/data/definitions/502.html',
+                },
+            ],
+        },
+        'xxe': {
+            owasp: 'A05:2025 - Security Misconfiguration',
+            cwe: 'CWE-611',
+            pciDss: '6.5.1',
+            references: [
+                {
+                    title: 'OWASP XXE',
+                    url: 'https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing',
+                },
+                {
+                    title: 'CWE-611: XML External Entity',
+                    url: 'https://cwe.mitre.org/data/definitions/611.html',
+                },
+            ],
+        },
+        'hardcoded-credentials': {
+            owasp: 'A07:2025 - Identification and Authentication Failures',
+            cwe: 'CWE-798',
+            pciDss: '8.2.1',
+            references: [
+                {
+                    title: 'CWE-798: Hardcoded Credentials',
+                    url: 'https://cwe.mitre.org/data/definitions/798.html',
+                },
+                {
+                    title: 'OWASP Authentication Failures',
+                    url: 'https://owasp.org/Top10/2025/-Identification_and_Authentication_Failures/',
+                },
+            ],
+        },
+        'weak-random': {
+            owasp: 'A02:2025 - Cryptographic Failures',
+            cwe: 'CWE-338',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-338: Weak PRNG',
+                    url: 'https://cwe.mitre.org/data/definitions/338.html',
+                },
+            ],
+        },
+        'weak-hash-md5': {
+            owasp: 'A02:2025 - Cryptographic Failures',
+            cwe: 'CWE-327',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-327: Broken Crypto',
+                    url: 'https://cwe.mitre.org/data/definitions/327.html',
+                },
+            ],
+        },
+        'weak-hash-sha1': {
+            owasp: 'A02:2025 - Cryptographic Failures',
+            cwe: 'CWE-327',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-327: Broken Crypto',
+                    url: 'https://cwe.mitre.org/data/definitions/327.html',
+                },
+            ],
+        },
+        'ecb-mode-encryption': {
+            owasp: 'A02:2025 - Cryptographic Failures',
+            cwe: 'CWE-327',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-327: Broken Crypto',
+                    url: 'https://cwe.mitre.org/data/definitions/327.html',
+                },
+            ],
+        },
+        'prototype-pollution': {
+            owasp: 'A08:2025 - Software and Data Integrity Failures',
+            cwe: 'CWE-1321',
+            references: [
+                {
+                    title: 'CWE-1321: Prototype Pollution',
+                    url: 'https://cwe.mitre.org/data/definitions/1321.html',
+                },
+            ],
+        },
+        'ldap-injection': {
+            owasp: 'A03:2025 - Injection',
+            cwe: 'CWE-90',
+            pciDss: '6.5.1',
+            references: [
+                {
+                    title: 'CWE-90: LDAP Injection',
+                    url: 'https://cwe.mitre.org/data/definitions/90.html',
+                },
+            ],
+        },
+        'xpath-injection': {
+            owasp: 'A03:2025 - Injection',
+            cwe: 'CWE-643',
+            pciDss: '6.5.1',
+            references: [
+                {
+                    title: 'CWE-643: XPath Injection',
+                    url: 'https://cwe.mitre.org/data/definitions/643.html',
+                },
+            ],
+        },
+        'unsafe-yaml-load': {
+            owasp: 'A08:2025 - Software and Data Integrity Failures',
+            cwe: 'CWE-502',
+            pciDss: '6.5.8',
+            references: [
+                {
+                    title: 'CWE-502: Deserialization',
+                    url: 'https://cwe.mitre.org/data/definitions/502.html',
+                },
+            ],
+        },
+        'unsafe-pickle': {
+            owasp: 'A08:2025 - Software and Data Integrity Failures',
+            cwe: 'CWE-502',
+            pciDss: '6.5.8',
+            references: [
+                {
+                    title: 'CWE-502: Deserialization',
+                    url: 'https://cwe.mitre.org/data/definitions/502.html',
+                },
+            ],
+        },
+        'regex-dos': {
+            owasp: 'A06:2025 - Vulnerable and Outdated Components',
+            cwe: 'CWE-1333',
+            references: [
+                {
+                    title: 'CWE-1333: ReDoS',
+                    url: 'https://cwe.mitre.org/data/definitions/1333.html',
+                },
+            ],
+        },
+        'insecure-storage': {
+            owasp: 'A02:2025 - Cryptographic Failures',
+            cwe: 'CWE-312',
+            pciDss: '3.4',
+            references: [
+                {
+                    title: 'CWE-312: Cleartext Storage',
+                    url: 'https://cwe.mitre.org/data/definitions/312.html',
+                },
+            ],
+        },
+        'file-upload-no-validation': {
+            owasp: 'A01:2025 - Broken Access Control',
+            cwe: 'CWE-434',
+            pciDss: '6.5.8',
+            references: [
+                {
+                    title: 'CWE-434: Unrestricted Upload',
+                    url: 'https://cwe.mitre.org/data/definitions/434.html',
+                },
+            ],
+        },
+        'unsafe-reflection': {
+            owasp: 'A03:2025 - Injection',
+            cwe: 'CWE-470',
+            pciDss: '6.5.1',
+            references: [
+                {
+                    title: 'CWE-470: Unsafe Reflection',
+                    url: 'https://cwe.mitre.org/data/definitions/470.html',
+                },
+            ],
+        },
+        'console-log': {
+            owasp: 'A09:2025 - Security Logging and Monitoring Failures',
+            cwe: 'CWE-532',
+            references: [
+                {
+                    title: 'CWE-532: Information Exposure Through Log Files',
+                    url: 'https://cwe.mitre.org/data/definitions/532.html',
+                },
+            ],
+        },
+        'print-statement': {
+            owasp: 'A09:2025 - Security Logging and Monitoring Failures',
+            cwe: 'CWE-532',
+            references: [
+                {
+                    title: 'CWE-532: Information Exposure',
+                    url: 'https://cwe.mitre.org/data/definitions/532.html',
+                },
+            ],
+        },
+        'printstacktrace': {
+            owasp: 'A09:2025 - Security Logging and Monitoring Failures',
+            cwe: 'CWE-209',
+            references: [
+                {
+                    title: 'CWE-209: Information Exposure',
+                    url: 'https://cwe.mitre.org/data/definitions/209.html',
+                },
+            ],
+        },
+        'empty-except': {
+            owasp: 'A09:2025 - Security Logging and Monitoring Failures',
+            cwe: 'CWE-391',
+            references: [
+                {
+                    title: 'CWE-391: Unchecked Error',
+                    url: 'https://cwe.mitre.org/data/definitions/391.html',
+                },
+            ],
+        },
+        'missing-error-handling': {
+            owasp: 'A09:2025 - Security Logging and Monitoring Failures',
+            cwe: 'CWE-391',
+            references: [
+                {
+                    title: 'CWE-391: Unchecked Error',
+                    url: 'https://cwe.mitre.org/data/definitions/391.html',
+                },
+            ],
+        },
+        // DEC 16, 2025 (Phase 11): Code Quality Issues (Not Security Vulnerabilities)
+        'any-type-usage': {
+            owasp: 'N/A',
+            cwe: 'N/A',
+            references: [
+                {
+                    title: 'TypeScript Handbook: Type Safety',
+                    url: 'https://www.typescriptlang.org/docs/handbook/2/everyday-types.html#any',
+                },
+            ],
+        },
+        // DEC 16, 2025: TypeScript Security Checks (Check #85, #86, #87)
+        'idor-no-authorization': {
+            owasp: 'A01:2025 - Broken Access Control',
+            cwe: 'CWE-639',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'OWASP Broken Access Control',
+                    url: 'https://owasp.org/Top10/2025/-Broken_Access_Control/',
+                },
+                {
+                    title: 'CWE-639: Authorization Bypass Through User-Controlled Key',
+                    url: 'https://cwe.mitre.org/data/definitions/639.html',
+                },
+            ],
+        },
+        'stack-trace-exposure': {
+            owasp: 'A05:2025 - Security Misconfiguration',
+            cwe: 'CWE-209',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'OWASP Security Misconfiguration',
+                    url: 'https://owasp.org/Top10/2025/-Security_Misconfiguration/',
+                },
+                {
+                    title: 'CWE-209: Information Exposure Through Error Message',
+                    url: 'https://cwe.mitre.org/data/definitions/209.html',
+                },
+            ],
+        },
+        'direct-stack-exposure': {
+            owasp: 'A05:2025 - Security Misconfiguration',
+            cwe: 'CWE-209',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'OWASP Security Misconfiguration',
+                    url: 'https://owasp.org/Top10/2025/-Security_Misconfiguration/',
+                },
+                {
+                    title: 'CWE-209: Information Exposure Through Error Message',
+                    url: 'https://cwe.mitre.org/data/definitions/209.html',
+                },
+            ],
+        },
+        'dynamic-require-env-var': {
+            owasp: 'A06:2025 - Vulnerable and Outdated Components',
+            cwe: 'CWE-94',
+            pciDss: '6.5.1',
+            references: [
+                {
+                    title: 'OWASP Vulnerable and Outdated Components',
+                    url: 'https://owasp.org/Top10/2025/-Vulnerable_and_Outdated_Components/',
+                },
+                {
+                    title: 'CWE-94: Improper Control of Generation of Code',
+                    url: 'https://cwe.mitre.org/data/definitions/94.html',
+                },
+            ],
+        },
+        // DEC 16, 2025 (Phase 11): Authentication Failures (Checks #88, #89, #90, #91)
+        'plaintext-password-comparison': {
+            owasp: 'A07:2025 - Identification and Authentication Failures',
+            cwe: 'CWE-256',
+            pciDss: '8.2.1',
+            references: [
+                {
+                    title: 'OWASP Authentication Failures',
+                    url: 'https://owasp.org/Top10/2025/-Identification_and_Authentication_Failures/',
+                },
+                {
+                    title: 'CWE-256: Plaintext Storage of a Password',
+                    url: 'https://cwe.mitre.org/data/definitions/256.html',
+                },
+            ],
+        },
+        'weak-token-generation': {
+            owasp: 'A07:2025 - Identification and Authentication Failures',
+            cwe: 'CWE-330',
+            pciDss: '8.2.1',
+            references: [
+                {
+                    title: 'OWASP Authentication Failures',
+                    url: 'https://owasp.org/Top10/2025/-Identification_and_Authentication_Failures/',
+                },
+                {
+                    title: 'CWE-330: Use of Insufficiently Random Values',
+                    url: 'https://cwe.mitre.org/data/definitions/330.html',
+                },
+            ],
+        },
+        'master-password-backdoor': {
+            owasp: 'A07:2025 - Identification and Authentication Failures',
+            cwe: 'CWE-798',
+            pciDss: '8.2.1',
+            references: [
+                {
+                    title: 'OWASP Authentication Failures',
+                    url: 'https://owasp.org/Top10/2025/-Identification_and_Authentication_Failures/',
+                },
+                {
+                    title: 'CWE-798: Use of Hard-coded Credentials',
+                    url: 'https://cwe.mitre.org/data/definitions/798.html',
+                },
+            ],
+        },
+        'fail-open-authorization': {
+            owasp: 'A01:2025 - Broken Access Control',
+            cwe: 'CWE-636',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'OWASP Broken Access Control',
+                    url: 'https://owasp.org/Top10/2025/-Broken_Access_Control/',
+                },
+                {
+                    title: 'CWE-636: Not Failing Securely',
+                    url: 'https://cwe.mitre.org/data/definitions/636.html',
+                },
+            ],
+        },
+        'fail-open-authentication': {
+            owasp: 'A01:2025 - Broken Access Control',
+            cwe: 'CWE-636',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'OWASP Broken Access Control',
+                    url: 'https://owasp.org/Top10/2025/-Broken_Access_Control/',
+                },
+                {
+                    title: 'CWE-636: Not Failing Securely',
+                    url: 'https://cwe.mitre.org/data/definitions/636.html',
+                },
+            ],
+        },
+        // DEC 23, 2025: OWASP 2025 Top 10 Mappings - A03:2025 Software Supply Chain Failures
+        'dynamic-import-no-integrity': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-494',
+            pciDss: '6.2',
+            references: [
+                {
+                    title: 'CWE-494: Download of Code Without Integrity Check',
+                    url: 'https://cwe.mitre.org/data/definitions/494.html',
+                },
+            ],
+        },
+        'runtime-dependency-loading': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-494',
+            pciDss: '6.2',
+            references: [
+                {
+                    title: 'CWE-494: Download of Code Without Integrity Check',
+                    url: 'https://cwe.mitre.org/data/definitions/494.html',
+                },
+            ],
+        },
+        'unrestricted-cdn-usage': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-494',
+            pciDss: '6.2',
+            references: [
+                {
+                    title: 'CWE-494: Download of Code Without Integrity Check',
+                    url: 'https://cwe.mitre.org/data/definitions/494.html',
+                },
+            ],
+        },
+        // DEC 23, 2025: OWASP 2025 Top 10 Mappings - A10:2025 Mishandling of Exceptional Conditions
+        'empty-catch-block': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-391',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-391: Unchecked Error Condition',
+                    url: 'https://cwe.mitre.org/data/definitions/391.html',
+                },
+            ],
+        },
+        'ignored-exception': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-391',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-391: Unchecked Error Condition',
+                    url: 'https://cwe.mitre.org/data/definitions/391.html',
+                },
+            ],
+        },
+        'error-object-exposure': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-209',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-209: Information Exposure Through Error Message',
+                    url: 'https://cwe.mitre.org/data/definitions/209.html',
+                },
+            ],
+        },
+        'missing-resource-cleanup': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-404',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-404: Improper Resource Shutdown',
+                    url: 'https://cwe.mitre.org/data/definitions/404.html',
+                },
+            ],
+        },
+        'resource-leak-on-exception': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-772',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-772: Missing Release of Resource',
+                    url: 'https://cwe.mitre.org/data/definitions/772.html',
+                },
+            ],
+        },
+        'python-exception-traceback': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-209',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-209: Information Exposure Through Error Message',
+                    url: 'https://cwe.mitre.org/data/definitions/209.html',
+                },
+            ],
+        },
+        // Python A10:2025 - Exception Handling (4 new mappings)
+        'bare-except-clause': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-396',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-396: Declaration of Catch for Generic Exception',
+                    url: 'https://cwe.mitre.org/data/definitions/396.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'exception-details-exposed': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-209',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-209: Information Exposure Through Error Message',
+                    url: 'https://cwe.mitre.org/data/definitions/209.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'silent-exception-suppression': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-391',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-391: Unchecked Error Condition',
+                    url: 'https://cwe.mitre.org/data/definitions/391.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'incorrect-exception-pattern': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-705',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-705: Incorrect Control Flow Scoping',
+                    url: 'https://cwe.mitre.org/data/definitions/705.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // Java A10:2025 - Exception Handling (NEW - Phase 7B Day 6 - DEC 25, 2025)
+        'broad-exception-catching': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-396',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-396: Declaration of Catch for Generic Exception',
+                    url: 'https://cwe.mitre.org/data/definitions/396.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'improper-exception-propagation': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-397',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-397: Declaration of Throws for Generic Exception',
+                    url: 'https://cwe.mitre.org/data/definitions/397.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'resource-leak-exception': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-404',
+            pciDss: '6.5.6',
+            references: [
+                {
+                    title: 'CWE-404: Improper Resource Shutdown or Release',
+                    url: 'https://cwe.mitre.org/data/definitions/404.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'printstacktrace-usage': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-489',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-489: Active Debug Code',
+                    url: 'https://cwe.mitre.org/data/definitions/489.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'swallowed-interrupted-exception': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-391',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-391: Unchecked Error Condition',
+                    url: 'https://cwe.mitre.org/data/definitions/391.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // DEC 25, 2025: Java A03:2025 - Supply Chain Security (Phase 7B Day 7)
+        'dynamic-class-loading': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-470',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-470: Use of Externally-Controlled Input to Select Classes or Code',
+                    url: 'https://cwe.mitre.org/data/definitions/470.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software and Supply Chain Security',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'insecure-maven-repository': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-494',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-494: Download of Code Without Integrity Check',
+                    url: 'https://cwe.mitre.org/data/definitions/494.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software and Supply Chain Security',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'package-typosquatting': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-829',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere',
+                    url: 'https://cwe.mitre.org/data/definitions/829.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software and Supply Chain Security',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'unsigned-jar-usage': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-494',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-494: Download of Code Without Integrity Check',
+                    url: 'https://cwe.mitre.org/data/definitions/494.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software and Supply Chain Security',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'dependency-confusion': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-427',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-427: Uncontrolled Search Path Element',
+                    url: 'https://cwe.mitre.org/data/definitions/427.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software and Supply Chain Security',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'runtime-bytecode-loading': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-94',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-94: Improper Control of Generation of Code',
+                    url: 'https://cwe.mitre.org/data/definitions/94.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software and Supply Chain Security',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // DEC 25, 2025: Java A01:2025 - Access Control (Phase 7B Day 8)
+        'missing-authorization': {
+            owasp: 'A01:2025',
+            cwe: 'CWE-862',
+            pciDss: '6.5.8',
+            references: [
+                {
+                    title: 'CWE-862: Missing Authorization',
+                    url: 'https://cwe.mitre.org/data/definitions/862.html',
+                },
+                {
+                    title: 'OWASP A01:2025 - Broken Access Control',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'hardcoded-roles': {
+            owasp: 'A01:2025',
+            cwe: 'CWE-547',
+            pciDss: '6.5.8',
+            references: [
+                {
+                    title: 'CWE-547: Use of Hard-coded, Security-relevant Constants',
+                    url: 'https://cwe.mitre.org/data/definitions/547.html',
+                },
+                {
+                    title: 'OWASP A01:2025 - Broken Access Control',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // DEC 25, 2025: JavaScript/TypeScript A01:2025 - Access Control (Phase 7B Day 11)
+        'missing-authentication-middleware': {
+            owasp: 'A01:2025',
+            cwe: 'CWE-306',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'CWE-306: Missing Authentication for Critical Function',
+                    url: 'https://cwe.mitre.org/data/definitions/306.html',
+                },
+                {
+                    title: 'OWASP A01:2025 - Broken Access Control',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'client-side-authorization': {
+            owasp: 'A01:2025',
+            cwe: 'CWE-602',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'CWE-602: Client-Side Enforcement of Server-Side Security',
+                    url: 'https://cwe.mitre.org/data/definitions/602.html',
+                },
+                {
+                    title: 'OWASP A01:2025 - Broken Access Control',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // DEC 25, 2025: JavaScript/TypeScript A07:2025 - Authentication Failures (Phase 7B Day 11)
+        'missing-mfa': {
+            owasp: 'A07:2025',
+            cwe: 'CWE-308',
+            pciDss: '8.3',
+            references: [
+                {
+                    title: 'CWE-308: Use of Single-factor Authentication',
+                    url: 'https://cwe.mitre.org/data/definitions/308.html',
+                },
+                {
+                    title: 'OWASP A07:2025 - Identification and Authentication Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'no-rate-limiting': {
+            owasp: 'A07:2025',
+            cwe: 'CWE-307',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'CWE-307: Improper Restriction of Excessive Authentication Attempts',
+                    url: 'https://cwe.mitre.org/data/definitions/307.html',
+                },
+                {
+                    title: 'OWASP A07:2025 - Identification and Authentication Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // DEC 25, 2025: Java A04:2025 - Cryptographic Failures (Phase 7B Day 8)
+        'weak-cipher-rc4': {
+            owasp: 'A04:2025',
+            cwe: 'CWE-327',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm',
+                    url: 'https://cwe.mitre.org/data/definitions/327.html',
+                },
+                {
+                    title: 'OWASP A04:2025 - Cryptographic Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // DEC 25, 2025: Java A06:2025 - Insecure Design (Phase 7B Day 9)
+        'missing-input-validation': {
+            owasp: 'A06:2025',
+            cwe: 'CWE-20',
+            pciDss: '6.5.1',
+            references: [
+                {
+                    title: 'CWE-20: Improper Input Validation',
+                    url: 'https://cwe.mitre.org/data/definitions/20.html',
+                },
+                {
+                    title: 'OWASP A06:2025 - Insecure Design',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'direct-database-query': {
+            owasp: 'A06:2025',
+            cwe: 'CWE-1021',
+            pciDss: '6.5.8',
+            references: [
+                {
+                    title: 'CWE-1021: Improper Restriction of Rendered UI Layers or Frames',
+                    url: 'https://cwe.mitre.org/data/definitions/1021.html',
+                },
+                {
+                    title: 'OWASP A06:2025 - Insecure Design',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // DEC 25, 2025: Java A09:2025 - Logging Failures (Phase 7B Day 9)
+        'missing-security-logging': {
+            owasp: 'A09:2025',
+            cwe: 'CWE-778',
+            pciDss: '10.2',
+            references: [
+                {
+                    title: 'CWE-778: Insufficient Logging',
+                    url: 'https://cwe.mitre.org/data/definitions/778.html',
+                },
+                {
+                    title: 'OWASP A09:2025 - Security Logging and Monitoring Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'system-out-println': {
+            owasp: 'A09:2025',
+            cwe: 'CWE-778',
+            pciDss: '10.2',
+            references: [
+                {
+                    title: 'CWE-778: Insufficient Logging',
+                    url: 'https://cwe.mitre.org/data/definitions/778.html',
+                },
+                {
+                    title: 'OWASP A09:2025 - Security Logging and Monitoring Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // DEC 25, 2025: TypeScript A10:2025 - Exception Handling (Phase 7B Day 9)
+        'async-without-try-catch': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-755',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-755: Improper Handling of Exceptional Conditions',
+                    url: 'https://cwe.mitre.org/data/definitions/755.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'unhandled-promise-rejection': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-755',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-755: Improper Handling of Exceptional Conditions',
+                    url: 'https://cwe.mitre.org/data/definitions/755.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'error-details-exposed': {
+            owasp: 'A10:2025',
+            cwe: 'CWE-209',
+            pciDss: '6.5.5',
+            references: [
+                {
+                    title: 'CWE-209: Generation of Error Message Containing Sensitive Information',
+                    url: 'https://cwe.mitre.org/data/definitions/209.html',
+                },
+                {
+                    title: 'OWASP A10:2025 - Mishandling of Exceptional Conditions',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // Python A03:2025 - Supply Chain Failures (5 new mappings)
+        'dynamic-import-no-validation': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-494',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-494: Download of Code Without Integrity Check',
+                    url: 'https://cwe.mitre.org/data/definitions/494.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software Supply Chain Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'runtime-package-installation': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-494',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-494: Download of Code Without Integrity Check',
+                    url: 'https://cwe.mitre.org/data/definitions/494.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software Supply Chain Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'suspicious-package-pattern': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-1357',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-1357: Reliance on Insufficiently Trustworthy Component',
+                    url: 'https://cwe.mitre.org/data/definitions/1357.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software Supply Chain Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'untrusted-package-source': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-494',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-494: Download of Code Without Integrity Check',
+                    url: 'https://cwe.mitre.org/data/definitions/494.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software Supply Chain Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'package-typosquatting-pattern': {
+            owasp: 'A03:2025',
+            cwe: 'CWE-1357',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-1357: Reliance on Insufficiently Trustworthy Component',
+                    url: 'https://cwe.mitre.org/data/definitions/1357.html',
+                },
+                {
+                    title: 'OWASP A03:2025 - Software Supply Chain Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // Python A01:2025 - Broken Access Control (DEC 24, 2025)
+        'missing-authentication-decorator': {
+            owasp: 'A01:2025',
+            cwe: 'CWE-306',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'CWE-306: Missing Authentication for Critical Function',
+                    url: 'https://cwe.mitre.org/data/definitions/306.html',
+                },
+                {
+                    title: 'OWASP A01:2025 - Broken Access Control',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'insecure-direct-object-reference': {
+            owasp: 'A01:2025',
+            cwe: 'CWE-639',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'CWE-639: Authorization Bypass Through User-Controlled Key',
+                    url: 'https://cwe.mitre.org/data/definitions/639.html',
+                },
+                {
+                    title: 'OWASP A01:2025 - Broken Access Control',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // Python A04:2025 - Cryptographic Failures (DEC 24, 2025)
+        'weak-crypto-algorithm': {
+            owasp: 'A04:2025',
+            cwe: 'CWE-327',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm',
+                    url: 'https://cwe.mitre.org/data/definitions/327.html',
+                },
+                {
+                    title: 'OWASP A04:2025 - Cryptographic Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'insecure-random': {
+            owasp: 'A04:2025',
+            cwe: 'CWE-338',
+            pciDss: '6.5.3',
+            references: [
+                {
+                    title: 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator',
+                    url: 'https://cwe.mitre.org/data/definitions/338.html',
+                },
+                {
+                    title: 'OWASP A04:2025 - Cryptographic Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // Python A06:2025 - Insecure Design (DEC 24, 2025)
+        'missing-rate-limiting': {
+            owasp: 'A06:2025',
+            cwe: 'CWE-307',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'CWE-307: Improper Restriction of Excessive Authentication Attempts',
+                    url: 'https://cwe.mitre.org/data/definitions/307.html',
+                },
+                {
+                    title: 'OWASP A06:2025 - Insecure Design',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        'mass-assignment': {
+            owasp: 'A06:2025',
+            cwe: 'CWE-915',
+            pciDss: '6.5.10',
+            references: [
+                {
+                    title: 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes',
+                    url: 'https://cwe.mitre.org/data/definitions/915.html',
+                },
+                {
+                    title: 'OWASP A06:2025 - Insecure Design',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // Python A09:2025 - Logging Failures (DEC 24, 2025)
+        'sensitive-data-logging': {
+            owasp: 'A09:2025',
+            cwe: 'CWE-532',
+            pciDss: '10.3.1',
+            references: [
+                {
+                    title: 'CWE-532: Insertion of Sensitive Information into Log File',
+                    url: 'https://cwe.mitre.org/data/definitions/532.html',
+                },
+                {
+                    title: 'OWASP A09:2025 - Security Logging and Monitoring Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // Python A08:2025 - Software and Data Integrity Failures (DEC 24, 2025)
+        'insecure-deserialization': {
+            owasp: 'A08:2025',
+            cwe: 'CWE-502',
+            pciDss: '6.5.8',
+            references: [
+                {
+                    title: 'CWE-502: Deserialization of Untrusted Data',
+                    url: 'https://cwe.mitre.org/data/definitions/502.html',
+                },
+                {
+                    title: 'OWASP A08:2025 - Software and Data Integrity Failures',
+                    url: 'https://owasp.org/Top10/2025/',
+                },
+            ],
+        },
+        // AI-Generated Code Detection (Phase 1.5 Week 5-7)
+        'ai-generated-code-high': {
+            owasp: 'A04:2025 - Insecure Design',
+            cwe: 'CWE-1120, CWE-758',
+            pciDss: '6.5',
+            references: [
+                {
+                    title: 'OWASP Insecure Design',
+                    url: 'https://owasp.org/Top10/A04_2021-Insecure_Design/',
+                },
+                {
+                    title: 'CWE-1120: Excessive Code Complexity',
+                    url: 'https://cwe.mitre.org/data/definitions/1120.html',
+                },
+                {
+                    title: 'CWE-758: Reliance on Undefined Behavior',
+                    url: 'https://cwe.mitre.org/data/definitions/758.html',
+                },
+            ],
+        },
+        'ai-generated-code-medium': {
+            owasp: 'A04:2025 - Insecure Design',
+            cwe: 'CWE-1120, CWE-758',
+            pciDss: '6.5',
+            references: [
+                {
+                    title: 'OWASP Insecure Design',
+                    url: 'https://owasp.org/Top10/A04_2021-Insecure_Design/',
+                },
+                {
+                    title: 'CWE-1120: Excessive Code Complexity',
+                    url: 'https://cwe.mitre.org/data/definitions/1120.html',
+                },
+                {
+                    title: 'CWE-758: Reliance on Undefined Behavior',
+                    url: 'https://cwe.mitre.org/data/definitions/758.html',
+                },
+            ],
+        },
+        'ai-generated-code-low': {
+            owasp: 'A04:2025 - Insecure Design',
+            cwe: 'CWE-1120',
+            pciDss: '6.5',
+            references: [
+                {
+                    title: 'OWASP Insecure Design',
+                    url: 'https://owasp.org/Top10/A04_2021-Insecure_Design/',
+                },
+                {
+                    title: 'CWE-1120: Excessive Code Complexity',
+                    url: 'https://cwe.mitre.org/data/definitions/1120.html',
+                },
+            ],
+        },
+    };
+    // Default mapping if not found
+    return mappings[vulnerabilityType] || {
+        owasp: 'N/A',
+        cwe: 'N/A',
+        references: [],
+    };
+}
+/**
+ * Get all OWASP Top 10 2021 & 2025 categories covered
+ */
+function getOwaspCoverage() {
+    return [
+        // OWASP Top 10 2021
+        { category: 'A01:2025 - Broken Access Control', count: 3 },
+        { category: 'A02:2025 - Cryptographic Failures', count: 5 },
+        { category: 'A03:2025 - Injection', count: 10 },
+        { category: 'A05:2025 - Security Misconfiguration', count: 1 },
+        { category: 'A07:2025 - Identification and Authentication Failures', count: 1 },
+        { category: 'A08:2025 - Software and Data Integrity Failures', count: 4 },
+        { category: 'A09:2025 - Security Logging and Monitoring Failures', count: 6 },
+        // OWASP Top 10 2025 (NEW)
+        { category: 'A03:2025 - Software Supply Chain Failures', count: 5 },
+        { category: 'A10:2025 - Mishandling of Exceptional Conditions', count: 7 },
+    ];
+}
+//# sourceMappingURL=compliance-mapping.js.map