codeslick-cli 1.0.0

package/dist/src/lib/analyzers/helpers/variable-tracker.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Variable Tracker Module
+ *
+ * Pure functions for tracking variable declarations and usages in JavaScript/TypeScript code.
+ * Helps detect undeclared variables and reference errors.
+ *
+ * @module variable-tracker
+ */
+import { LineError } from '../types';
+/**
+ * Returns the set of built-in JavaScript globals and common APIs
+ *
+ * @returns Set of built-in identifiers
+ */
+export declare function getBuiltIns(): Set<string>;
+/**
+ * Returns the set of JavaScript keywords and patterns to skip during variable tracking
+ *
+ * @returns Set of keywords to skip
+ */
+export declare function getSkipPatterns(): Set<string>;
+/**
+ * Finds all variable declarations in the code
+ *
+ * @param lines - Array of code lines
+ * @param code - Full source code
+ * @param isInsideTemplateLiteral - Function to check if line is inside template literal
+ * @returns Set of declared variable names
+ */
+export declare function findDeclarations(lines: string[], code: string, isInsideTemplateLiteral: (code: string, lineNumber: number) => boolean): Set<string>;
+/**
+ * Finds all variable usages in the code
+ *
+ * @param lines - Array of code lines
+ * @param code - Full source code
+ * @param builtIns - Set of built-in identifiers to skip
+ * @param skipPatterns - Set of keywords to skip
+ * @param removeStringLiterals - Function to remove string literals from a line
+ * @param isInsideTemplateLiteral - Function to check if line is inside template literal
+ * @returns Array of variable usages with line numbers
+ */
+export declare function findUsages(lines: string[], code: string, builtIns: Set<string>, skipPatterns: Set<string>, removeStringLiterals: (line: string) => string, isInsideTemplateLiteral: (code: string, lineNumber: number) => boolean): Array<{
+    line: number;
+    varName: string;
+}>;
+/**
+ * Checks for undeclared variables and returns line errors
+ *
+ * @param usages - Array of variable usages
+ * @param declaredVars - Set of declared variable names
+ * @param lines - Array of code lines
+ * @param hasJSX - Whether JSX was detected in the code
+ * @returns Array of line errors for undeclared variables
+ */
+export declare function checkUndeclaredVariables(usages: Array<{
+    line: number;
+    varName: string;
+}>, declaredVars: Set<string>, lines: string[], hasJSX: boolean): LineError[];
+//# sourceMappingURL=variable-tracker.d.ts.map

package/dist/src/lib/analyzers/helpers/variable-tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variable-tracker.d.ts","sourceRoot":"","sources":["../../../../../../../src/lib/analyzers/helpers/variable-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,GAAG,CAAC,MAAM,CAAC,CAczC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,GAAG,CAAC,MAAM,CAAC,CAU7C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,MAAM,EACZ,uBAAuB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,GACrE,GAAG,CAAC,MAAM,CAAC,CA6Fb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EACrB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EACzB,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAC9C,uBAAuB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,GACrE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAsD1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAChD,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EACzB,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,OAAO,GACd,SAAS,EAAE,CAyBb"}

package/dist/src/lib/analyzers/helpers/variable-tracker.js

@@ -0,0 +1,231 @@
+"use strict";
+/**
+ * Variable Tracker Module
+ *
+ * Pure functions for tracking variable declarations and usages in JavaScript/TypeScript code.
+ * Helps detect undeclared variables and reference errors.
+ *
+ * @module variable-tracker
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBuiltIns = getBuiltIns;
+exports.getSkipPatterns = getSkipPatterns;
+exports.findDeclarations = findDeclarations;
+exports.findUsages = findUsages;
+exports.checkUndeclaredVariables = checkUndeclaredVariables;
+const jsx_helpers_1 = require("./jsx-helpers");
+/**
+ * Returns the set of built-in JavaScript globals and common APIs
+ *
+ * @returns Set of built-in identifiers
+ */
+function getBuiltIns() {
+    return new Set([
+        'console', 'window', 'document', 'Math', 'Date', 'Array', 'Object', 'String',
+        'Number', 'Boolean', 'Promise', 'Set', 'Map', 'JSON', 'parseInt', 'parseFloat',
+        'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'fetch', 'alert',
+        'confirm', 'prompt', 'undefined', 'null', 'true', 'false', 'Infinity', 'NaN',
+        'Error', 'TypeError', 'ReferenceError', 'require', 'module', 'exports', 'process',
+        '__dirname', '__filename', 'Buffer', 'global', 'FormData', 'URLSearchParams',
+        'eval', // Built-in function for code execution (dangerous but valid JS)
+        // Browser APIs
+        'URL', 'URLSearchParams', 'Response', 'Request', 'Headers',
+        // Node.js APIs
+        'exec', 'spawn', 'execFile', 'fork'
+    ]);
+}
+/**
+ * Returns the set of JavaScript keywords and patterns to skip during variable tracking
+ *
+ * @returns Set of keywords to skip
+ */
+function getSkipPatterns() {
+    return new Set(['if', 'else', 'for', 'while', 'switch', 'case', 'break', 'continue',
+        'return', 'try', 'catch', 'finally', 'throw', 'new', 'this', 'super',
+        'typeof', 'instanceof', 'delete', 'void', 'yield', 'await', 'async',
+        'static', 'extends', 'implements', 'Interface', 'type', 'enum', 'export',
+        'default', 'from', 'import', 'as', 'in', 'of', 'do', 'get', 'set',
+        // React lifecycle methods
+        'constructor', 'render', 'componentDidMount', 'componentDidUpdate',
+        'componentWillUnmount', 'shouldComponentUpdate', 'componentDidCatch',
+        'getDerivedStateFromProps', 'getSnapshotBeforeUpdate']);
+}
+/**
+ * Finds all variable declarations in the code
+ *
+ * @param lines - Array of code lines
+ * @param code - Full source code
+ * @param isInsideTemplateLiteral - Function to check if line is inside template literal
+ * @returns Set of declared variable names
+ */
+function findDeclarations(lines, code, isInsideTemplateLiteral) {
+    const declaredVars = new Set();
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        // Skip lines inside template literals
+        if (isInsideTemplateLiteral(code, lineNumber)) {
+            return;
+        }
+        const trimmed = line.trim();
+        // Skip comments
+        if (trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*')) {
+            return;
+        }
+        // Match variable declarations: const/let/var name
+        const declMatch = trimmed.match(/\b(const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)/g);
+        if (declMatch) {
+            declMatch.forEach(decl => {
+                const varName = decl.replace(/^(const|let|var)\s+/, '').split(/[=\s;,]/)[0];
+                declaredVars.add(varName);
+            });
+        }
+        // Match function declarations: function name()
+        const funcMatch = trimmed.match(/function\s+([a-zA-Z_$][a-zA-Z0-9_$]*)/);
+        if (funcMatch) {
+            declaredVars.add(funcMatch[1]);
+        }
+        // Match class declarations
+        const classMatch = trimmed.match(/class\s+([a-zA-Z_$][a-zA-Z0-9_$]*)/);
+        if (classMatch) {
+            declaredVars.add(classMatch[1]);
+        }
+        // Match imports
+        const importMatch = trimmed.match(/import\s+(?:\{([^}]+)\}|([a-zA-Z_$][a-zA-Z0-9_$]*))\s+from/);
+        if (importMatch) {
+            if (importMatch[1]) {
+                importMatch[1].split(',').forEach(name => {
+                    const cleanName = name.trim().split(/\s+as\s+/)[1] || name.trim();
+                    declaredVars.add(cleanName);
+                });
+            }
+            else if (importMatch[2]) {
+                declaredVars.add(importMatch[2]);
+            }
+        }
+        // Match arrow function parameters (e.g., .then(response => ...), .catch(error => ...))
+        const arrowParamMatch = trimmed.matchAll(/\(([a-zA-Z_$][a-zA-Z0-9_$]*)\s*(?:,\s*[a-zA-Z_$][a-zA-Z0-9_$]*)?\)\s*=>/g);
+        for (const match of arrowParamMatch) {
+            if (match[1])
+                declaredVars.add(match[1]);
+        }
+        // Match single arrow function parameters (e.g., item => ...)
+        const singleArrowMatch = trimmed.matchAll(/\b([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=>/g);
+        for (const match of singleArrowMatch) {
+            if (match[1] && match[1] !== 'null' && match[1] !== 'undefined') {
+                declaredVars.add(match[1]);
+            }
+        }
+        // Match function parameters in regular functions: function name(param1, param2)
+        const funcParamMatch = trimmed.match(/function\s+[a-zA-Z_$][a-zA-Z0-9_$]*\s*\(([^)]*)\)/);
+        if (funcParamMatch && funcParamMatch[1]) {
+            funcParamMatch[1].split(',').forEach(param => {
+                const paramName = param.trim().split(/[=\s]/)[0];
+                if (paramName)
+                    declaredVars.add(paramName);
+            });
+        }
+        // Match class methods: methodName() { or methodName(params) {
+        // This includes React methods like increment(), render(), etc.
+        const classMethodMatch = trimmed.match(/^\s*([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\([^)]*\)\s*\{/);
+        if (classMethodMatch) {
+            declaredVars.add(classMethodMatch[1]);
+            // Also collect parameters from class methods
+            const methodParamMatch = trimmed.match(/^\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*\(([^)]*)\)/);
+            if (methodParamMatch && methodParamMatch[1]) {
+                methodParamMatch[1].split(',').forEach(param => {
+                    const paramName = param.trim().split(/[=\s:]/)[0]; // Handle TypeScript types too
+                    if (paramName && paramName !== '')
+                        declaredVars.add(paramName);
+                });
+            }
+        }
+    });
+    return declaredVars;
+}
+/**
+ * Finds all variable usages in the code
+ *
+ * @param lines - Array of code lines
+ * @param code - Full source code
+ * @param builtIns - Set of built-in identifiers to skip
+ * @param skipPatterns - Set of keywords to skip
+ * @param removeStringLiterals - Function to remove string literals from a line
+ * @param isInsideTemplateLiteral - Function to check if line is inside template literal
+ * @returns Array of variable usages with line numbers
+ */
+function findUsages(lines, code, builtIns, skipPatterns, removeStringLiterals, isInsideTemplateLiteral) {
+    const usages = [];
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        // Skip lines inside template literals
+        if (isInsideTemplateLiteral(code, lineNumber)) {
+            return;
+        }
+        const trimmed = line.trim();
+        // Skip comments
+        if (trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*')) {
+            return;
+        }
+        // Skip declaration lines
+        if (trimmed.startsWith('const ') || trimmed.startsWith('let ') || trimmed.startsWith('var ') ||
+            trimmed.startsWith('function ') || trimmed.startsWith('import ') || trimmed.startsWith('class ')) {
+            return;
+        }
+        // CRITICAL FIX (2025-11-18): Remove BOTH comments AND string content before analyzing
+        // Previous bug: Detected words inside strings as variables (e.g., "Test Code" → "Code" flagged)
+        // Step 1: Remove comments first
+        const lineWithoutComments = line.split('//')[0];
+        // Step 2: Remove string literals (replaces string content with spaces)
+        const lineWithoutStrings = removeStringLiterals(lineWithoutComments);
+        const usagePattern = /(?<![.\w])([a-zA-Z_$][a-zA-Z0-9_$]*)(?=\s*(?:\(|=(?!=)|;|,|\+|-|\*|\/|%|>|<|&|\||$))/g;
+        const matches = lineWithoutStrings.matchAll(usagePattern);
+        const seenOnLine = new Set();
+        for (const match of matches) {
+            const varName = match[1];
+            const matchIndex = match.index || 0;
+            // Skip duplicates, property access, built-ins, keywords
+            if (seenOnLine.has(varName) ||
+                (matchIndex > 0 && lineWithoutStrings[matchIndex - 1] === '.') ||
+                builtIns.has(varName) ||
+                skipPatterns.has(varName) ||
+                trimmed.includes(`${varName}:`)) {
+                continue;
+            }
+            seenOnLine.add(varName);
+            usages.push({ line: lineNumber, varName });
+        }
+    });
+    return usages;
+}
+/**
+ * Checks for undeclared variables and returns line errors
+ *
+ * @param usages - Array of variable usages
+ * @param declaredVars - Set of declared variable names
+ * @param lines - Array of code lines
+ * @param hasJSX - Whether JSX was detected in the code
+ * @returns Array of line errors for undeclared variables
+ */
+function checkUndeclaredVariables(usages, declaredVars, lines, hasJSX) {
+    const lineErrors = [];
+    usages.forEach(({ line, varName }) => {
+        // Skip JSX elements and attributes if JSX is detected
+        if ((0, jsx_helpers_1.isJSXElement)(varName, hasJSX)) {
+            return; // Don't report as error
+        }
+        // Skip if it's JSX text content (appears between > and </ in JSX)
+        if ((0, jsx_helpers_1.isJSXTextContent)(varName, line, lines, hasJSX)) {
+            return; // It's JSX text content, not a variable
+        }
+        if (!declaredVars.has(varName)) {
+            lineErrors.push({
+                line,
+                error: `ReferenceError: Variable '${varName}' used but never declared`,
+                suggestion: `Declare the variable: const ${varName} = ... or let ${varName} = ...`,
+                severity: 'error'
+            });
+        }
+    });
+    return lineErrors;
+}
+//# sourceMappingURL=variable-tracker.js.map

package/dist/src/lib/analyzers/helpers/variable-tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"variable-tracker.js","sourceRoot":"","sources":["../../../../../../../src/lib/analyzers/helpers/variable-tracker.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAUH,kCAcC;AAOD,0CAUC;AAUD,4CAiGC;AAaD,gCA6DC;AAWD,4DA8BC;AArQD,+CAA+D;AAG/D;;;;GAIG;AACH,SAAgB,WAAW;IACzB,OAAO,IAAI,GAAG,CAAC;QACb,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;QAC5E,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY;QAC9E,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO;QAC9E,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK;QAC5E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;QACjF,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB;QAC5E,MAAM,EAAE,gEAAgE;QACxE,eAAe;QACf,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS;QAC1D,eAAe;QACf,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe;IAC7B,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU;QACnE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;QACpE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;QACnE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;QACxE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK;QACjE,0BAA0B;QAC1B,aAAa,EAAE,QAAQ,EAAE,mBAAmB,EAAE,oBAAoB;QAClE,sBAAsB,EAAE,uBAAuB,EAAE,mBAAmB;QACpE,0BAA0B,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAC9B,KAAe,EACf,IAAY,EACZ,uBAAsE;IAEtE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAE7B,sCAAsC;QACtC,IAAI,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,gBAAgB;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpF,OAAO;QACT,CAAC;QAED,kDAAkD;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC;QAED,+CAA+C;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACzE,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,2BAA2B;QAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvE,IAAI,UAAU,EAAE,CAAC;YACf,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,gBAAgB;QAChB,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChG,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;oBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAClE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9B,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1B,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,uFAAuF;QACvF,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,0EAA0E,CAAC,CAAC;QACrH,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC,CAAC,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;QAED,6DAA6D;QAC7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC;QAChF,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBAChE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC1F,IAAI,cAAc,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,IAAI,SAAS;oBAAE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,+DAA+D;QAC/D,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC1F,IAAI,gBAAgB,EAAE,CAAC;YACrB,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtC,6CAA6C;YAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACrF,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;oBAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,8BAA8B;oBACjF,IAAI,SAAS,IAAI,SAAS,KAAK,EAAE;wBAAE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACjE,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,UAAU,CACxB,KAAe,EACf,IAAY,EACZ,QAAqB,EACrB,YAAyB,EACzB,oBAA8C,EAC9C,uBAAsE;IAEtE,MAAM,MAAM,GAA6C,EAAE,CAAC;IAE5D,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAE7B,sCAAsC;QACtC,IAAI,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,gBAAgB;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpF,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YACxF,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrG,OAAO;QACT,CAAC;QAED,sFAAsF;QACtF,gGAAgG;QAChG,gCAAgC;QAChC,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,uEAAuE;QACvE,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QAErE,MAAM,YAAY,GAAG,uFAAuF,CAAC;QAC7G,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YAEpC,wDAAwD;YACxD,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;gBACvB,CAAC,UAAU,GAAG,CAAC,IAAI,kBAAkB,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAC9D,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;gBACrB,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;gBACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YAED,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,MAAgD,EAChD,YAAyB,EACzB,KAAe,EACf,MAAe;IAEf,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,sDAAsD;QACtD,IAAI,IAAA,0BAAY,EAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,kEAAkE;QAClE,IAAI,IAAA,8BAAgB,EAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,wCAAwC;QAClD,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI;gBACJ,KAAK,EAAE,6BAA6B,OAAO,2BAA2B;gBACtE,UAAU,EAAE,+BAA+B,OAAO,iBAAiB,OAAO,QAAQ;gBAClF,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/access-control.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Java Access Control Security Checks
+ * OWASP A01:2025 - Broken Access Control
+ *
+ * Detects access control vulnerabilities in Java/Spring applications.
+ * Updated for OWASP 2025 with enhanced Spring Security patterns (Phase 7B Day 8).
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for access control security vulnerabilities in Java code
+ *
+ * Covers:
+ * - Check #1: Missing @PreAuthorize/@Secured annotations (HIGH)
+ * - Check #2: Hard-coded roles in access control (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkAccessControl(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=access-control.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/access-control.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAsKzB"}

package/dist/src/lib/analyzers/java/security-checks/access-control.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * Java Access Control Security Checks
+ * OWASP A01:2025 - Broken Access Control
+ *
+ * Detects access control vulnerabilities in Java/Spring applications.
+ * Updated for OWASP 2025 with enhanced Spring Security patterns (Phase 7B Day 8).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAccessControl = checkAccessControl;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for access control security vulnerabilities in Java code
+ *
+ * Covers:
+ * - Check #1: Missing @PreAuthorize/@Secured annotations (HIGH)
+ * - Check #2: Hard-coded roles in access control (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkAccessControl(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    // Public endpoints that don't require authorization
+    const publicEndpoints = [
+        '/auth', '/login', '/register', '/signup',
+        '/health', '/actuator', '/metrics', '/info',
+        '/public', '/static', '/css', '/js', '/images',
+        '/api-docs', '/swagger', '/favicon'
+    ];
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmedLine.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmedLine.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('//')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Check #1: Missing @PreAuthorize/@Secured annotations on controller methods
+        // Detect Spring MVC/REST controller method mappings
+        const isMappingAnnotation = lowerLine.match(/@(get|post|put|delete|patch|request)mapping/);
+        if (isMappingAnnotation) {
+            // Extract endpoint path from annotation
+            const pathMatch = trimmedLine.match(/@(?:Get|Post|Put|Delete|Patch|Request)Mapping\s*\(\s*["']([^"']+)["']/i);
+            const endpointPath = pathMatch ? pathMatch[1] : '';
+            // Check if this is a public endpoint
+            const isPublicEndpoint = publicEndpoints.some(pub => endpointPath.toLowerCase().includes(pub));
+            if (!isPublicEndpoint) {
+                // Look for authorization annotations in previous 5 lines (method signature area)
+                const prevLines = lines.slice(Math.max(0, index - 5), index);
+                const hasAuthorization = prevLines.some(prevLine => {
+                    const lowerPrev = prevLine.toLowerCase();
+                    return lowerPrev.includes('@preauthorize') ||
+                        lowerPrev.includes('@secured') ||
+                        lowerPrev.includes('@rolesallowed');
+                });
+                // Look for method declaration in next 2 lines
+                const nextLines = lines.slice(index + 1, Math.min(index + 3, lines.length));
+                const hasMethodDeclaration = nextLines.some(nextLine => {
+                    const trimmedNext = nextLine.trim();
+                    return trimmedNext.match(/^(public|private|protected)\s+\w+\s+\w+\s*\(/);
+                });
+                // Check if endpoint is sensitive (delete, admin, etc.)
+                const isSensitiveEndpoint = endpointPath.toLowerCase().match(/\/(delete|remove|admin|update|edit)/);
+                if (!hasAuthorization && (isSensitiveEndpoint || hasMethodDeclaration)) {
+                    // Find the actual method line number
+                    let methodLineIndex = index + 1;
+                    for (let i = index + 1; i < Math.min(index + 3, lines.length); i++) {
+                        if (lines[i].trim().match(/^(public|private|protected)\s+\w+\s+\w+\s*\(/)) {
+                            methodLineIndex = i;
+                            break;
+                        }
+                    }
+                    vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('missing-authorization', 'Controller method missing authorization check', 'Add @PreAuthorize, @Secured, or @RolesAllowed annotation to restrict access', methodLineIndex + 1, 'Controller methods without authorization annotations allow unauthenticated or unauthorized users to access sensitive operations, leading to privilege escalation, data breaches, and unauthorized modifications', '@DeleteMapping("/admin/users/{id}")\npublic void deleteUser(@PathVariable Long id) { } // Missing @PreAuthorize!', [
+                        'Unauthorized access to sensitive operations',
+                        'Privilege escalation from regular user to admin',
+                        'Data breach through unprotected endpoints',
+                        'Unauthorized data modification or deletion',
+                        'Complete bypass of access control policies'
+                    ], '@DeleteMapping("/users/{id}")\npublic void deleteUser(@PathVariable Long id) { }', '@PreAuthorize("hasRole(\'ADMIN\') or #id == authentication.principal.id")\n@DeleteMapping("/users/{id}")\npublic void deleteUser(@PathVariable Long id) { }', 'Always add authorization annotations to Spring controller methods. Use @PreAuthorize for fine-grained access control with SpEL expressions'));
+                }
+            }
+        }
+        // Check #2: Hard-coded roles in access control
+        // Check for hard-coded role strings in annotations
+        if (lowerLine.includes('@preauthorize') || lowerLine.includes('@secured') || lowerLine.includes('@rolesallowed')) {
+            // Look for quoted role strings (e.g., 'ADMIN', "ROLE_USER")
+            const hasQuotedRole = trimmedLine.match(/["'](?:ROLE_)?[A-Z_]+["']/);
+            // Exclude if using constants (no quotes around identifier)
+            const usesConstant = trimmedLine.match(/@(?:PreAuthorize|Secured|RolesAllowed)\s*\([^"']*(?:ROLE_[A-Z_]+|[A-Z_]+\.[A-Z_]+)[^"']*\)/i);
+            // Exclude if using configuration/method reference (e.g., @rolesConfig.getAdminRole())
+            const usesExternalConfig = trimmedLine.match(/@\w+\.\w+\(/);
+            if (hasQuotedRole && !usesConstant && !usesExternalConfig) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('hardcoded-roles', 'Authorization check uses hard-coded role string', 'Use role constants or externalize role configuration', index + 1, 'Hard-coding role names in authorization annotations makes roles difficult to change, leads to inconsistencies across the codebase, and violates the principle of configuration externalization', '@PreAuthorize("hasRole(\'ADMIN\')") // Hard-coded role string', [
+                    'Difficult to modify roles across large codebases',
+                    'Risk of typos and inconsistencies',
+                    'Cannot change roles without recompilation',
+                    'Violation of configuration externalization principle',
+                    'Testing complexity (cannot mock roles easily)'
+                ], '@PreAuthorize("hasRole(\'ADMIN\')")', 'public static final String ROLE_ADMIN = "ADMIN";\n@PreAuthorize("hasRole(ROLE_ADMIN)")', 'Define role constants in a central location (e.g., Roles.java) and reference them in authorization annotations'));
+            }
+        }
+        // Check for hard-coded roles in manual role checks (if statements)
+        if (lowerLine.match(/\.getrole\s*\(\s*\)\s*\.\s*equals\s*\(/)) {
+            const hasQuotedRole = trimmedLine.match(/\.equals\s*\(\s*["'](?:ROLE_)?[A-Z_]+["']\s*\)/);
+            if (hasQuotedRole) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('hardcoded-roles', 'Manual access control uses hard-coded role string', 'Use role constants instead of string literals', index + 1, 'Hard-coding role names in manual access control checks makes the codebase fragile and error-prone', 'if (user.getRole().equals("ADMIN")) { } // Hard-coded role', [
+                    'Typos can break access control',
+                    'Difficult to refactor role names',
+                    'Inconsistent role checking across code',
+                    'Cannot configure roles externally',
+                    'Maintenance nightmare in large codebases'
+                ], 'if (user.getRole().equals("ADMIN")) { }', 'if (user.getRole().equals(Roles.ADMIN)) { }', 'Always use role constants to ensure consistency and enable easy refactoring'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=access-control.js.map

package/dist/src/lib/analyzers/java/security-checks/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/access-control.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAeH,gDAwKC;AApLD,sEAA+E;AAE/E;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAChC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,oDAAoD;IACpD,MAAM,eAAe,GAAG;QACtB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS;QACzC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;QAC3C,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS;QAC9C,WAAW,EAAE,UAAU,EAAE,UAAU;KACpC,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wDAAwD;QACxD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,6EAA6E;QAC7E,oDAAoD;QACpD,MAAM,mBAAmB,GAAG,SAAS,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAE3F,IAAI,mBAAmB,EAAE,CAAC;YACxB,wCAAwC;YACxC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;YAC9G,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAEnD,qCAAqC;YACrC,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAE/F,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,iFAAiF;gBACjF,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC7D,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;oBACjD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;oBACzC,OAAO,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;wBACnC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAC9B,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;gBAC7C,CAAC,CAAC,CAAC;gBAEH,8CAA8C;gBAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5E,MAAM,oBAAoB,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;oBACrD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACpC,OAAO,WAAW,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC3E,CAAC,CAAC,CAAC;gBAEH,uDAAuD;gBACvD,MAAM,mBAAmB,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBAEpG,IAAI,CAAC,gBAAgB,IAAI,CAAC,mBAAmB,IAAI,oBAAoB,CAAC,EAAE,CAAC;oBACvE,qCAAqC;oBACrC,IAAI,eAAe,GAAG,KAAK,GAAG,CAAC,CAAC;oBAChC,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;wBACnE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,8CAA8C,CAAC,EAAE,CAAC;4BAC1E,eAAe,GAAG,CAAC,CAAC;4BACpB,MAAM;wBACR,CAAC;oBACH,CAAC;oBAED,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,uBAAuB,EACvB,+CAA+C,EAC/C,6EAA6E,EAC7E,eAAe,GAAG,CAAC,EACnB,iNAAiN,EACjN,kHAAkH,EAClH;wBACE,6CAA6C;wBAC7C,iDAAiD;wBACjD,2CAA2C;wBAC3C,4CAA4C;wBAC5C,4CAA4C;qBAC7C,EACD,kFAAkF,EAClF,6JAA6J,EAC7J,4IAA4I,CAC7I,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,mDAAmD;QACnD,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACjH,4DAA4D;YAC5D,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAErE,2DAA2D;YAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,6FAA6F,CAAC,CAAC;YAEtI,sFAAsF;YACtF,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAE5D,IAAI,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC1D,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,iBAAiB,EACjB,iDAAiD,EACjD,sDAAsD,EACtD,KAAK,GAAG,CAAC,EACT,gMAAgM,EAChM,+DAA+D,EAC/D;oBACE,kDAAkD;oBAClD,mCAAmC;oBACnC,2CAA2C;oBAC3C,sDAAsD;oBACtD,+CAA+C;iBAChD,EACD,qCAAqC,EACrC,wFAAwF,EACxF,gHAAgH,CACjH,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,IAAI,SAAS,CAAC,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC;YAC9D,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAE1F,IAAI,aAAa,EAAE,CAAC;gBAClB,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,iBAAiB,EACjB,mDAAmD,EACnD,+CAA+C,EAC/C,KAAK,GAAG,CAAC,EACT,mGAAmG,EACnG,4DAA4D,EAC5D;oBACE,gCAAgC;oBAChC,kCAAkC;oBAClC,wCAAwC;oBACxC,mCAAmC;oBACnC,0CAA0C;iBAC3C,EACD,yCAAyC,EACzC,6CAA6C,EAC7C,6EAA6E,CAC9E,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IAEH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/ai-generated-code.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Java AI-Generated Code Detection Module
+ *
+ * Detects AI-generated code patterns as SECURITY RISKS:
+ * - 12 hallucination patterns (Python/JavaScript/Rust influence)
+ * - 8 code smell heuristics (over-engineering, inconsistency)
+ * - Confidence scoring (HIGH/MEDIUM/LOW)
+ *
+ * OWASP A04:2025 - Insecure Design
+ * CWE-1120 - Excessive Code Complexity
+ * CWE-758 - Reliance on Undefined Behavior
+ *
+ * Phase 1.5, Week 5-7 (AI-Generated Code Detection)
+ * Created: January 8, 2026
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Detect AI-generated code in Java
+ *
+ * @param lines - Array of code lines
+ * @param filename - Optional filename (to skip test files)
+ * @returns Array of security vulnerabilities (0-1 aggregated vulnerability)
+ */
+export declare function checkAIGeneratedCode(lines: string[], filename?: string): SecurityVulnerability[];
+//# sourceMappingURL=ai-generated-code.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/ai-generated-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-generated-code.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/ai-generated-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA+FpD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,qBAAqB,EAAE,CAuJzB"}