codeslick-cli 1.0.0

package/dist/src/lib/analyzers/java/security-checks/ai-generated-code.js

@@ -0,0 +1,221 @@
+"use strict";
+/**
+ * Java AI-Generated Code Detection Module
+ *
+ * Detects AI-generated code patterns as SECURITY RISKS:
+ * - 12 hallucination patterns (Python/JavaScript/Rust influence)
+ * - 8 code smell heuristics (over-engineering, inconsistency)
+ * - Confidence scoring (HIGH/MEDIUM/LOW)
+ *
+ * OWASP A04:2025 - Insecure Design
+ * CWE-1120 - Excessive Code Complexity
+ * CWE-758 - Reliance on Undefined Behavior
+ *
+ * Phase 1.5, Week 5-7 (AI-Generated Code Detection)
+ * Created: January 8, 2026
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAIGeneratedCode = checkAIGeneratedCode;
+const createVulnerability_1 = require("../utils/createVulnerability");
+const ai_code_detection_utils_1 = require("../../helpers/ai-code-detection-utils");
+/**
+ * Java hallucination patterns (12 patterns)
+ *
+ * AI code generators hallucinate methods from other languages:
+ * - Python influence: .append(), .len()
+ * - JavaScript influence: .push()
+ * - Rust influence: .to_string(), .is_empty()
+ * - Property/method confusion: .length()
+ */
+const HALLUCINATION_PATTERNS = new Map([
+    // Python-style methods in Java
+    ['append', {
+            correct: '.add() for List',
+            description: 'Java Lists use .add(), not .append(). This is a Python method. Note: StringBuilder uses .append().'
+        }],
+    ['len', {
+            correct: '.length() or .size()',
+            description: 'Java uses .length() for arrays, .size() for Collections, or .length for Strings. Not .len(). This is Python syntax.'
+        }],
+    // JavaScript-style methods in Java
+    ['push', {
+            correct: '.add()',
+            description: 'Java Collections use .add(), not .push(). This is a JavaScript/TypeScript method.'
+        }],
+    // Property/method confusion
+    ['length', {
+            correct: '.length (no parentheses)',
+            description: 'Java String.length is a method .length(), not a property. Arrays use .length property (no parentheses).'
+        }],
+    // Rust/Python influence
+    ['to_string', {
+            correct: '.toString()',
+            description: 'Java uses camelCase: .toString(), not snake_case to_string(). This is Rust/Python syntax.'
+        }],
+    ['is_empty', {
+            correct: '.isEmpty()',
+            description: 'Java uses camelCase: .isEmpty(), not snake_case is_empty(). This is Rust/Python syntax.'
+        }],
+    // Non-existent methods (hallucinations)
+    ['trim_', {
+            correct: '.trim()',
+            description: 'Non-existent method. Java uses .trim() with no trailing underscore.'
+        }],
+    ['substring_of', {
+            correct: '.contains()',
+            description: 'Non-existent method. Use .contains() to check if string contains substring.'
+        }],
+    ['split_by', {
+            correct: '.split()',
+            description: 'Non-existent method. Java uses .split() with camelCase naming.'
+        }],
+    ['remove_at', {
+            correct: '.remove(index)',
+            description: 'Non-existent method. Use .remove(index) for Lists to remove element at specific position.'
+        }],
+    ['contains_key', {
+            correct: '.containsKey()',
+            description: 'Case sensitivity error. Java Maps use .containsKey() with capital K, not underscore.'
+        }],
+    // String.format confusion
+    ['format_', {
+            correct: 'String.format()',
+            description: 'Non-existent method. Java uses String.format() static method, not instance method with underscore.'
+        }],
+]);
+/**
+ * Detect AI-generated code in Java
+ *
+ * @param lines - Array of code lines
+ * @param filename - Optional filename (to skip test files)
+ * @returns Array of security vulnerabilities (0-1 aggregated vulnerability)
+ */
+function checkAIGeneratedCode(lines, filename) {
+    // Skip test files to reduce false positives
+    if ((0, ai_code_detection_utils_1.isTestFile)(filename)) {
+        return [];
+    }
+    let hallucinationCount = 0;
+    const hallucinationLines = new Set();
+    const detectedPatterns = [];
+    // Combined regex for all 12 hallucination patterns (optimized)
+    const combinedPattern = new RegExp('\\.' +
+        '(append|len|push|length|to_string|is_empty|trim_|substring_of|' +
+        'split_by|remove_at|contains_key|format_)' +
+        '\\s*\\(', 'g');
+    let inMultiLineComment = false;
+    // 1. Detect hallucination patterns
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comments (/* ... */)
+        if (trimmed.includes('/*'))
+            inMultiLineComment = true;
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//'))
+            return;
+        // Remove string literals to avoid false positives
+        const cleanedLine = (0, ai_code_detection_utils_1.removeCommentsAndStrings)(line, 'java');
+        // Match hallucination patterns
+        const matches = Array.from(cleanedLine.matchAll(combinedPattern));
+        for (const match of matches) {
+            const method = match[1];
+            const details = HALLUCINATION_PATTERNS.get(method);
+            if (details) {
+                hallucinationCount++;
+                hallucinationLines.add(lineNumber);
+                detectedPatterns.push(method);
+            }
+        }
+    });
+    // 2. Run heuristic detectors
+    const heuristicScores = {
+        overEngineeredErrors: (0, ai_code_detection_utils_1.detectOverEngineeredErrorHandling)(lines),
+        unnecessaryWrappers: (0, ai_code_detection_utils_1.detectUnnecessaryWrappers)(lines),
+        verboseComments: (0, ai_code_detection_utils_1.detectVerboseComments)(lines),
+        mixedNaming: (0, ai_code_detection_utils_1.detectMixedNamingConventions)(lines), // Detects snake_case in Java
+        redundantNullChecks: (0, ai_code_detection_utils_1.detectRedundantNullChecks)(lines),
+        unnecessaryAsync: (0, ai_code_detection_utils_1.detectUnnecessaryAsync)(lines),
+        genericVariables: (0, ai_code_detection_utils_1.detectGenericVariableOveruse)(lines),
+        inconsistentStrings: (0, ai_code_detection_utils_1.detectInconsistentStringConcatenation)(lines),
+    };
+    // 3. Calculate confidence and severity
+    const detection = (0, ai_code_detection_utils_1.calculateAICodeConfidence)(hallucinationCount, heuristicScores);
+    if (!detection) {
+        return []; // No AI-generated code detected
+    }
+    // 4. Create aggregated vulnerability
+    const categoryId = detection.severity === 'CRITICAL' ? 'ai-generated-code-high' :
+        detection.severity === 'HIGH' ? 'ai-generated-code-medium' :
+            'ai-generated-code-low';
+    // Build message based on detection type
+    let message = `AI-generated code detected (${detection.confidence} confidence): `;
+    if (hallucinationCount > 0) {
+        message += `${hallucinationCount} hallucinated method(s) found`;
+        if (detectedPatterns.length > 0) {
+            const uniquePatterns = Array.from(new Set(detectedPatterns)).slice(0, 3);
+            message += ` (.${uniquePatterns.join(', .')})`;
+        }
+    }
+    else {
+        message += 'Multiple code smell patterns detected (over-engineering, snake_case naming, etc.)';
+    }
+    // Build suggestion
+    const suggestion = hallucinationCount > 0
+        ? `Replace hallucinated methods with correct Java equivalents. Found: ${Array.from(new Set(detectedPatterns)).map(p => `.${p}()`).join(', ')}. Review and rewrite AI-generated code sections.`
+        : 'Simplify code structure, use consistent naming conventions (camelCase), and follow Java idioms. Remove unnecessary async functions, redundant null checks, and over-engineered error handling.';
+    // Find first occurrence line for reporting
+    const reportLine = hallucinationLines.size > 0
+        ? Math.min(...hallucinationLines)
+        : 1; // Use first line if only heuristics detected
+    // Get first detected pattern details for remediation example
+    const firstPattern = detectedPatterns[0];
+    const firstPatternDetails = firstPattern ? HALLUCINATION_PATTERNS.get(firstPattern) : null;
+    return [
+        (0, createVulnerability_1.createJavaSecurityVulnerability)({
+            category: categoryId,
+            severity: detection.severity.toLowerCase(),
+            confidence: detection.confidence,
+            message,
+            line: reportLine,
+            suggestion,
+            owasp: 'A04:2025 - Insecure Design',
+            cwe: 'CWE-1120, CWE-758',
+            pciDss: '6.5',
+            remediation: {
+                explanation: 'AI code generators (like GitHub Copilot, ChatGPT, Claude) can hallucinate non-existent methods or generate over-engineered patterns. ' +
+                    'This creates reliability issues and potential security vulnerabilities. Hallucinated methods cause runtime exceptions that expose stack traces with ' +
+                    'sensitive information. Over-engineered code patterns make security audits difficult, hiding real vulnerabilities. ' +
+                    'Always verify AI-generated code matches Java specifications and follows security best practices.',
+                before: firstPatternDetails
+                    ? `list.${firstPattern}(item)  // Hallucinated method`
+                    : '// Over-engineered or inconsistent code patterns\n// Example: try { ... } catch (Exception e) { if (...) { if (...) { if (...) { } } } }',
+                after: firstPatternDetails
+                    ? `list${firstPatternDetails.correct}  // Correct Java`
+                    : '// Simplified, idiomatic code following Java conventions\n// Example: try { ... } catch (Exception e) { logger.error("Error", e); throw e; }',
+            },
+            attackVector: {
+                description: 'AI-generated code with hallucinated methods creates runtime exceptions exposing system internals through stack traces. ' +
+                    'Attackers can trigger these errors repeatedly to map application structure and identify vulnerable endpoints. ' +
+                    'Inconsistent code patterns (mixing snake_case and camelCase) make security reviews difficult, allowing real vulnerabilities to hide among AI-generated noise. ' +
+                    'Over-engineered error handling may leak sensitive information in catch blocks.',
+                exploitExample: "User triggers: list.append(item)\n" +
+                    "Result: NoSuchMethodError: 'append' in class 'ArrayList'\n" +
+                    "Stack trace reveals: Internal file paths, class names, database schema hints\n" +
+                    "Attacker uses this to map application architecture and plan targeted attacks.",
+                realWorldImpact: [
+                    'Runtime errors revealing sensitive stack traces with internal paths',
+                    'Logic bugs in access control or validation code (AI-generated if statements)',
+                    'Performance degradation from inefficient AI-generated loops and algorithms',
+                    'Maintenance burden: Developers spend hours debugging AI hallucinations',
+                    'Hidden security vulnerabilities masked by over-engineered code patterns',
+                ],
+            },
+        })
+    ];
+}
+//# sourceMappingURL=ai-generated-code.js.map

package/dist/src/lib/analyzers/java/security-checks/ai-generated-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-generated-code.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/ai-generated-code.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAwGH,oDA0JC;AA/PD,sEAA+E;AAC/E,mFAY+C;AAU/C;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAA+B;IACnE,+BAA+B;IAC/B,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,iBAAiB;YAC1B,WAAW,EAAE,oGAAoG;SAClH,CAAC;IACF,CAAC,KAAK,EAAE;YACN,OAAO,EAAE,sBAAsB;YAC/B,WAAW,EAAE,qHAAqH;SACnI,CAAC;IAEF,mCAAmC;IACnC,CAAC,MAAM,EAAE;YACP,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,mFAAmF;SACjG,CAAC;IAEF,4BAA4B;IAC5B,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,0BAA0B;YACnC,WAAW,EAAE,yGAAyG;SACvH,CAAC;IAEF,wBAAwB;IACxB,CAAC,WAAW,EAAE;YACZ,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,2FAA2F;SACzG,CAAC;IACF,CAAC,UAAU,EAAE;YACX,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,yFAAyF;SACvG,CAAC;IAEF,wCAAwC;IACxC,CAAC,OAAO,EAAE;YACR,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,qEAAqE;SACnF,CAAC;IACF,CAAC,cAAc,EAAE;YACf,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,6EAA6E;SAC3F,CAAC;IACF,CAAC,UAAU,EAAE;YACX,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,gEAAgE;SAC9E,CAAC;IACF,CAAC,WAAW,EAAE;YACZ,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,2FAA2F;SACzG,CAAC;IACF,CAAC,cAAc,EAAE;YACf,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,sFAAsF;SACpG,CAAC;IAEF,0BAA0B;IAC1B,CAAC,SAAS,EAAE;YACV,OAAO,EAAE,iBAAiB;YAC1B,WAAW,EAAE,oGAAoG;SAClH,CAAC;CACH,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,KAAe,EACf,QAAiB;IAEjB,4CAA4C;IAC5C,IAAI,IAAA,oCAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,+DAA+D;IAC/D,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,KAAK;QACL,gEAAgE;QAChE,0CAA0C;QAC1C,SAAS,EACT,GAAG,CACJ,CAAC;IAEF,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,mCAAmC;IACnC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,wCAAwC;QACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,kBAAkB,GAAG,IAAI,CAAC;QACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAEvE,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAA,kDAAwB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE3D,+BAA+B;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAElE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEnD,IAAI,OAAO,EAAE,CAAC;gBACZ,kBAAkB,EAAE,CAAC;gBACrB,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACnC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6BAA6B;IAC7B,MAAM,eAAe,GAAG;QACtB,oBAAoB,EAAE,IAAA,2DAAiC,EAAC,KAAK,CAAC;QAC9D,mBAAmB,EAAE,IAAA,mDAAyB,EAAC,KAAK,CAAC;QACrD,eAAe,EAAE,IAAA,+CAAqB,EAAC,KAAK,CAAC;QAC7C,WAAW,EAAE,IAAA,sDAA4B,EAAC,KAAK,CAAC,EAAE,6BAA6B;QAC/E,mBAAmB,EAAE,IAAA,mDAAyB,EAAC,KAAK,CAAC;QACrD,gBAAgB,EAAE,IAAA,gDAAsB,EAAC,KAAK,CAAC;QAC/C,gBAAgB,EAAE,IAAA,sDAA4B,EAAC,KAAK,CAAC;QACrD,mBAAmB,EAAE,IAAA,+DAAqC,EAAC,KAAK,CAAC;KAClE,CAAC;IAEF,uCAAuC;IACvC,MAAM,SAAS,GAAG,IAAA,mDAAyB,EAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;IAEjF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,CAAC,CAAC,gCAAgC;IAC7C,CAAC;IAED,qCAAqC;IACrC,MAAM,UAAU,GACd,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9D,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;YAC5D,uBAAuB,CAAC;IAE1B,wCAAwC;IACxC,IAAI,OAAO,GAAG,+BAA+B,SAAS,CAAC,UAAU,gBAAgB,CAAC;IAElF,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,GAAG,kBAAkB,+BAA+B,CAAC;QAChE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzE,OAAO,IAAI,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACjD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,mFAAmF,CAAC;IACjG,CAAC;IAED,mBAAmB;IACnB,MAAM,UAAU,GAAG,kBAAkB,GAAG,CAAC;QACvC,CAAC,CAAC,sEAAsE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;QAC9L,CAAC,CAAC,gMAAgM,CAAC;IAErM,2CAA2C;IAC3C,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC;QACjC,CAAC,CAAC,CAAC,CAAC,CAAC,6CAA6C;IAEpD,6DAA6D;IAC7D,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,mBAAmB,GAAG,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3F,OAAO;QACL,IAAA,qDAA+B,EAAC;YAC9B,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAoC;YAC5E,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,OAAO;YACP,IAAI,EAAE,UAAU;YAChB,UAAU;YACV,KAAK,EAAE,4BAA4B;YACnC,GAAG,EAAE,mBAAmB;YACxB,MAAM,EAAE,KAAK;YACb,WAAW,EAAE;gBACX,WAAW,EACT,uIAAuI;oBACvI,sJAAsJ;oBACtJ,oHAAoH;oBACpH,kGAAkG;gBACpG,MAAM,EAAE,mBAAmB;oBACzB,CAAC,CAAC,QAAQ,YAAY,gCAAgC;oBACtD,CAAC,CAAC,0IAA0I;gBAC9I,KAAK,EAAE,mBAAmB;oBACxB,CAAC,CAAC,OAAO,mBAAmB,CAAC,OAAO,mBAAmB;oBACvD,CAAC,CAAC,8IAA8I;aACnJ;YACD,YAAY,EAAE;gBACZ,WAAW,EACT,yHAAyH;oBACzH,gHAAgH;oBAChH,gKAAgK;oBAChK,gFAAgF;gBAClF,cAAc,EACZ,oCAAoC;oBACpC,4DAA4D;oBAC5D,gFAAgF;oBAChF,+EAA+E;gBACjF,eAAe,EAAE;oBACf,qEAAqE;oBACrE,8EAA8E;oBAC9E,4EAA4E;oBAC5E,wEAAwE;oBACxE,yEAAyE;iBAC1E;aACF;SACF,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/code-quality.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Code Quality Security Module
+ *
+ * Detects code quality issues with security implications in Java source code including:
+ * - God Class (overly large classes)
+ * - System.out.println in production
+ * - printStackTrace() usage
+ *
+ * SOLID & Enterprise Patterns
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Check for code quality issues with security implications in Java code
+ * @param lines - Array of code lines to analyze
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkCodeQuality(lines: string[], code: string): SecurityVulnerability[];
+//# sourceMappingURL=code-quality.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/code-quality.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-quality.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/code-quality.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,qBAAqB,EAAE,CA0GvF"}

package/dist/src/lib/analyzers/java/security-checks/code-quality.js

@@ -0,0 +1,84 @@
+"use strict";
+/**
+ * Code Quality Security Module
+ *
+ * Detects code quality issues with security implications in Java source code including:
+ * - God Class (overly large classes)
+ * - System.out.println in production
+ * - printStackTrace() usage
+ *
+ * SOLID & Enterprise Patterns
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCodeQuality = checkCodeQuality;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Check for code quality issues with security implications in Java code
+ * @param lines - Array of code lines to analyze
+ * @returns Array of security vulnerabilities found
+ */
+function checkCodeQuality(lines, code) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmed = line.trim();
+        const lineNumber = index + 1;
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        // FIX (Dec 6, 2025): Added proper multi-line comment tracking
+        if (!trimmed ||
+            inMultiLineComment ||
+            trimmed.startsWith('//')) {
+            return;
+        }
+        // 15. God Class (very large class) - LOW
+        // FIXED: Skip commented lines and only check file size (class-level tracking done in detectGodClasses method)
+        if (trimmed.match(/class\s+\w+/) &&
+            code.split('\n').length > 500) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('god-class', 'God Class detected - class is too large (>500 lines)', 'Refactor into smaller, focused classes following Single Responsibility Principle', lineNumber, 'Very large classes (God Classes) violate the Single Responsibility Principle, making code hard to maintain, test, and review for security issues. Security vulnerabilities are easier to hide in large classes, and changes to one functionality can inadvertently affect others.', 'A 1000-line User class handling authentication, profile management, permissions, and notifications is hard to audit', [
+                'Security vulnerabilities harder to find',
+                'Code review ineffectiveness',
+                'Difficult to test thoroughly',
+                'Higher bug introduction risk',
+                'Maintenance complexity'
+            ], 'public class UserManager { // 800 lines\n  // Authentication, profile, permissions, notifications, logging...\n}', 'public class AuthenticationService { // 100 lines - focused\n  // Only authentication logic\n}\npublic class UserProfileService { // 80 lines\n  // Only profile management\n}\npublic class PermissionService { // 120 lines\n  // Only permission checks\n}', 'Break large classes into smaller, focused classes with single responsibilities. Each class should have one reason to change, making security reviews and testing more effective'));
+        }
+        // 16. System.out.println in production - LOW
+        // FIX (Dec 6, 2025): Skip System.out.println inside main() methods (acceptable for CLI apps)
+        // Example acceptable: public static void main(String[] args) { System.out.println("Hello"); }
+        // Now checks: previous 5 lines for "public static void main(" to skip CLI apps
+        if (trimmed.match(/System\s*\.\s*out\s*\.\s*print/)) {
+            // Check if we're inside main() method (previous 5-15 lines)
+            const prevLines = lines.slice(Math.max(0, index - 15), index);
+            const isInMainMethod = prevLines.some(l => l.includes('public static void main(') || l.includes('public static void main ('));
+            if (!isInMainMethod) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('system-out-println', 'System.out.println detected - inappropriate for production code', 'Use a proper logging framework (SLF4J, Log4j2, Logback) with appropriate log levels', lineNumber, 'System.out.println writes directly to standard output without any controls. In production, this can expose sensitive data in logs, create performance bottlenecks, lacks log levels/filtering, and makes it impossible to centralize or secure log management.', 'System.out.println("User password: " + password); // Logs plaintext password to stdout', [
+                    'Sensitive data exposure in logs',
+                    'Performance degradation (synchronous I/O)',
+                    'No log level control',
+                    'Difficult to disable or redirect',
+                    'Compliance violations (logging PII)'
+                ], 'System.out.println("Processing user: " + username + " with password: " + password);', 'import org.slf4j.Logger;\nimport org.slf4j.LoggerFactory;\n\nprivate static final Logger logger = LoggerFactory.getLogger(MyClass.class);\n\nlogger.info("Processing user: {}", username); // No password logged\n// Use appropriate log levels: debug, info, warn, error', 'Use a logging framework (SLF4J/Logback/Log4j2) that provides log levels, filtering, secure handling, and centralized configuration. Never log sensitive data like passwords or tokens'));
+            }
+        }
+        // 17. printStackTrace() - LOW
+        if (trimmed.match(/\.printStackTrace\s*\(/)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('printstacktrace', 'printStackTrace() usage detected - can leak sensitive information', 'Use proper logging: logger.error("Error occurred", exception)', lineNumber, 'printStackTrace() outputs the full stack trace to standard error, including class names, method names, line numbers, and potentially sensitive data in exception messages. In production, this can expose internal application structure, file paths, database schemas, and business logic to attackers.', 'catch (SQLException e) { e.printStackTrace(); } // Exposes SQL query, table names, connection details', [
+                'Internal structure disclosure',
+                'File path exposure',
+                'Database schema leakage',
+                'Business logic revelation',
+                'Attack surface mapping'
+            ], 'try {\n  // database operation\n} catch (SQLException e) {\n  e.printStackTrace(); // Prints stack trace to stderr\n}', 'import org.slf4j.Logger;\nimport org.slf4j.LoggerFactory;\n\nprivate static final Logger logger = LoggerFactory.getLogger(MyClass.class);\n\ntry {\n  // database operation\n} catch (SQLException e) {\n  logger.error("Database error occurred", e); // Controlled logging\n}', 'Use a logging framework that can be configured to control what gets logged, where it\'s logged, and who can access it. This prevents information leakage while maintaining debugging capability'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=code-quality.js.map

package/dist/src/lib/analyzers/java/security-checks/code-quality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-quality.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/code-quality.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAUH,4CA0GC;AAjHD,sEAA+E;AAE/E;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,KAAe,EAAE,IAAY;IAC5D,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAE7B,wDAAwD;QACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,8DAA8D;QAC9D,IAAI,CAAC,OAAO;YACR,kBAAkB;YAClB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,yCAAyC;QACzC,8GAA8G;QAC9G,IAAI,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAClC,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,WAAW,EACX,sDAAsD,EACtD,kFAAkF,EAClF,UAAU,EACV,mRAAmR,EACnR,qHAAqH,EACrH;gBACE,yCAAyC;gBACzC,6BAA6B;gBAC7B,8BAA8B;gBAC9B,8BAA8B;gBAC9B,wBAAwB;aACzB,EACD,kHAAkH,EAClH,+PAA+P,EAC/P,iLAAiL,CAClL,CAAC,CAAC;QACL,CAAC;QAED,6CAA6C;QAC7C,6FAA6F;QAC7F,8FAA8F;QAC9F,+EAA+E;QAC/E,IAAI,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACpD,4DAA4D;YAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9D,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACxC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAClF,CAAC;YAEF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,oBAAoB,EACpB,iEAAiE,EACjE,qFAAqF,EACrF,UAAU,EACV,gQAAgQ,EAChQ,wFAAwF,EACxF;oBACE,iCAAiC;oBACjC,2CAA2C;oBAC3C,sBAAsB;oBACtB,kCAAkC;oBAClC,qCAAqC;iBACtC,EACD,qFAAqF,EACrF,2QAA2Q,EAC3Q,uLAAuL,CACxL,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC5C,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,iBAAiB,EACjB,mEAAmE,EACnE,+DAA+D,EAC/D,UAAU,EACV,0SAA0S,EAC1S,uGAAuG,EACvG;gBACE,+BAA+B;gBAC/B,oBAAoB;gBACpB,yBAAyB;gBACzB,2BAA2B;gBAC3B,wBAAwB;aACzB,EACD,uHAAuH,EACvH,iRAAiR,EACjR,iMAAiM,CAClM,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/crypto-validation.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Cryptography Validation Module
+ *
+ * Detects weak cryptographic practices in Java source code including:
+ * - Use of java.util.Random for security-sensitive operations
+ * - Weak hash algorithms (MD5, SHA-1)
+ * - Insecure encryption modes (ECB)
+ *
+ * OWASP A02:2021 - Cryptographic Failures
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Check for weak cryptographic practices in Java code
+ * @param lines - Array of code lines to analyze
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkCryptoValidation(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=crypto-validation.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/crypto-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-validation.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/crypto-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,qBAAqB,EAAE,CA2Q9E"}

package/dist/src/lib/analyzers/java/security-checks/crypto-validation.js

@@ -0,0 +1,161 @@
+"use strict";
+/**
+ * Cryptography Validation Module
+ *
+ * Detects weak cryptographic practices in Java source code including:
+ * - Use of java.util.Random for security-sensitive operations
+ * - Weak hash algorithms (MD5, SHA-1)
+ * - Insecure encryption modes (ECB)
+ *
+ * OWASP A02:2021 - Cryptographic Failures
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCryptoValidation = checkCryptoValidation;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Check for weak cryptographic practices in Java code
+ * @param lines - Array of code lines to analyze
+ * @returns Array of security vulnerabilities found
+ */
+function checkCryptoValidation(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmed = line.trim();
+        const lineNumber = index + 1;
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // 8. Random() for security - MEDIUM
+        // Fix: Check method context (previous AND next 3 lines) for security keywords
+        // FIX (Dec 9, 2025): Added otp, 2fa, mfa keywords to detect OTP generation with weak Random
+        // FIX (Dec 22, 2025 Phase B): Check next lines too, not just previous
+        const hasRandomCreation = trimmed.match(/new\s+Random\s*\(/);
+        if (hasRandomCreation) {
+            const hasSameLineKeyword = trimmed.match(/password|token|key|secret|salt|nonce|session|auth|otp|2fa|mfa/i);
+            const prevLines = lines.slice(Math.max(0, index - 3), index);
+            const nextLines = lines.slice(index + 1, Math.min(lines.length, index + 4));
+            const hasContextKeyword = [...prevLines, ...nextLines].some(l => l.match(/password|token|key|secret|salt|nonce|session|auth|otp|2fa|mfa|generate/i) ||
+                l.match(/(public|private|protected)\s+\w+\s+(generate|create)(Token|Key|Password|Secret|Session|Auth|Otp)/i));
+            if (hasSameLineKeyword || hasContextKeyword) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('weak-random', 'Cryptographically weak random number generator detected', 'Use java.security.SecureRandom for security-sensitive operations', lineNumber, 'java.util.Random uses a predictable linear congruential generator algorithm. If an attacker observes a few random values, they can predict all future values. This makes it unsuitable for security purposes like generating session IDs, tokens, passwords, or cryptographic keys.', 'Random rand = new Random(); sessionId = rand.nextLong(); // Predictable, attacker can guess next session IDs', [
+                    'Session hijacking',
+                    'Token prediction',
+                    'Weak password generation',
+                    'Cryptographic key compromise',
+                    'Authentication bypass'
+                ], 'Random random = new Random();\nString token = String.valueOf(random.nextLong()); // Predictable', 'import java.security.SecureRandom;\nSecureRandom secureRandom = new SecureRandom();\nbyte[] tokenBytes = new byte[32];\nsecureRandom.nextBytes(tokenBytes);\nString token = Base64.getEncoder().encodeToString(tokenBytes); // Cryptographically secure', 'SecureRandom uses cryptographically strong algorithms (like SHA1PRNG) that are unpredictable even if an attacker sees previous values. Always use it for security-sensitive random generation'));
+            }
+        }
+        // 9. MD5/SHA1 - MEDIUM
+        if (trimmed.match(/MessageDigest\s*\.\s*getInstance\s*\(\s*["'](?:MD5|SHA-1|SHA1)['"]\s*\)/)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('weak-hash-md5', 'Weak cryptographic hash algorithm detected (MD5/SHA-1)', 'Use SHA-256, SHA-512 for integrity checks, or bcrypt/Argon2id for password hashing', lineNumber, 'MD5 and SHA-1 are cryptographically broken hash algorithms. MD5 collisions can be generated in seconds, and SHA-1 collisions have been demonstrated. Attackers can create two different inputs that produce the same hash, bypassing integrity checks, forging signatures, or cracking password hashes using rainbow tables.', 'MessageDigest.getInstance("MD5").digest(password) can be reversed using rainbow tables or brute force in minutes', [
+                'Password hash cracking (rainbow tables)',
+                'Collision attacks (forge signatures)',
+                'Data integrity bypass',
+                'Certificate forgery',
+                'Authentication bypass'
+            ], 'MessageDigest md = MessageDigest.getInstance("MD5");\nbyte[] hash = md.digest(password.getBytes()); // Weak, easily cracked', 'import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;\nBCryptPasswordEncoder encoder = new BCryptPasswordEncoder();\nString hashedPassword = encoder.encode(password); // Strong, salted, adaptive', 'For password hashing, use bcrypt, scrypt, or Argon2id which are designed to be slow and include salts. For general hashing (integrity checks), use SHA-256 or SHA-512'));
+        }
+        // 10. ECB mode encryption - MEDIUM
+        if (trimmed.match(/Cipher\s*\.\s*getInstance\s*\(.*\/ECB\//)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('ecb-mode-encryption', 'Insecure ECB (Electronic Codebook) encryption mode detected', 'Use authenticated encryption: Cipher.getInstance("AES/GCM/NoPadding") with unique IV', lineNumber, 'ECB mode encrypts identical plaintext blocks into identical ciphertext blocks, revealing patterns in the data. This allows attackers to detect repeated data, manipulate ciphertext blocks, or use known-plaintext attacks to decrypt portions of the message without the key.', 'Encrypting an image with ECB mode reveals the outline of the original image in the ciphertext (famous ECB penguin example)', [
+                'Data pattern disclosure',
+                'Block manipulation attacks',
+                'Known-plaintext attacks',
+                'Message structure leakage',
+                'Weak confidentiality guarantees'
+            ], 'Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding"); // Insecure mode\ncipher.init(Cipher.ENCRYPT_MODE, key);\nbyte[] ciphertext = cipher.doFinal(plaintext);', 'Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding"); // Authenticated encryption\nbyte[] iv = new byte[12]; // 96-bit IV\nnew SecureRandom().nextBytes(iv);\nGCMParameterSpec spec = new GCMParameterSpec(128, iv);\ncipher.init(Cipher.ENCRYPT_MODE, key, spec);\nbyte[] ciphertext = cipher.doFinal(plaintext);', 'Use GCM (Galois/Counter Mode) which provides both confidentiality and authenticity. Always use a unique IV for each encryption operation'));
+        }
+        // 11. DES/3DES weak encryption algorithms - HIGH (Phase B)
+        if (trimmed.match(/Cipher\s*\.\s*getInstance\s*\(\s*["'](DES|DESede|TripleDES)/i)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('weak-encryption-des', 'Weak encryption algorithm detected (DES/3DES)', 'Use AES-256-GCM for modern encryption with authenticated encryption', lineNumber, 'DES (Data Encryption Standard) has a 56-bit key which can be brute-forced in hours using modern hardware. 3DES (Triple DES) is deprecated and vulnerable to Sweet32 attacks when encrypting large amounts of data. Both are considered cryptographically weak and should not be used for new applications.', 'DES encryption with 56-bit key can be broken in ~24 hours on modern GPUs using brute force', [
+                'Brute force key recovery (DES: hours, 3DES: theoretical)',
+                'Sweet32 birthday attack on 3DES (64-bit block)',
+                'Insufficient key length for modern security',
+                'Data confidentiality compromise',
+                'Compliance violations (PCI-DSS, HIPAA)'
+            ], 'Cipher cipher = Cipher.getInstance("DES/CBC/PKCS5Padding"); // 56-bit key, broken\ncipher.init(Cipher.ENCRYPT_MODE, key);', 'Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding"); // 256-bit key, modern\nSecureRandom random = new SecureRandom();\nbyte[] iv = new byte[12];\nrandom.nextBytes(iv);\nGCMParameterSpec spec = new GCMParameterSpec(128, iv);\ncipher.init(Cipher.ENCRYPT_MODE, key, spec);', 'Migrate to AES-256-GCM which provides both strong encryption (256-bit keys) and authentication. AES is the current standard approved by NIST and used globally'));
+        }
+        // 11b. RC4 weak stream cipher - HIGH (Phase 7B Day 8)
+        if (trimmed.match(/Cipher\s*\.\s*getInstance\s*\(\s*["'](RC4|ARCFOUR)/i)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('weak-cipher-rc4', 'Weak stream cipher RC4 detected - vulnerable to multiple attacks', 'Use AES-256-GCM for modern authenticated encryption', lineNumber, 'RC4 (Rivest Cipher 4) is a deprecated stream cipher with multiple known vulnerabilities including biased keystream output, related-key attacks, and the NOMORE attack. It has been prohibited by IETF (RFC 7465) and removed from TLS 1.3. RC4 is completely broken for modern cryptographic use.', 'RC4 cipher broken by statistical biases - attackers can recover plaintext from intercepted TLS traffic', [
+                'Keystream bias attacks (RC4 NOMORE attack)',
+                'Related-key cryptanalysis',
+                'Plaintext recovery from encrypted traffic',
+                'IETF prohibits RC4 use (RFC 7465)',
+                'Removed from TLS 1.2+ and modern protocols'
+            ], 'Cipher cipher = Cipher.getInstance("RC4"); // Completely broken stream cipher\ncipher.init(Cipher.ENCRYPT_MODE, key);', 'Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding"); // Modern AEAD cipher\nSecureRandom random = new SecureRandom();\nbyte[] iv = new byte[12];\nrandom.nextBytes(iv);\nGCMParameterSpec spec = new GCMParameterSpec(128, iv);\ncipher.init(Cipher.ENCRYPT_MODE, key, spec);', 'RC4 is completely broken and banned from modern cryptographic standards. Migrate to AES-GCM immediately'));
+        }
+        // 12. Hardcoded encryption keys - CRITICAL (Phase B)
+        // Check if current line has new SecretKeySpec AND nearby lines have string literal with .getBytes()
+        if (trimmed.match(/\bnew\s+SecretKeySpec\s*\(/) &&
+            (trimmed.match(/["'][A-Za-z0-9+/=]{8,}["']\.getBytes/) ||
+                lines.slice(Math.max(0, index - 2), Math.min(lines.length, index + 2)).some(l => l.match(/["'][A-Za-z0-9+/=]{8,}["']\.getBytes\s*\(\s*\)/)))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('hardcoded-encryption-key', 'Hardcoded encryption key detected', 'Use KeyStore or secure key management system (AWS KMS, HashiCorp Vault, Azure Key Vault)', lineNumber, 'Hardcoded cryptographic keys in source code can be easily extracted by attackers through decompilation, repository access, or binary analysis. Once extracted, all data encrypted with that key can be decrypted. Keys should be stored securely and rotated regularly.', 'Hardcoded key in source code allows attacker who obtains the .jar file to decrypt all encrypted data', [
+                'Complete encryption bypass',
+                'Mass data decryption',
+                'Cannot rotate compromised keys',
+                'Source code disclosure reveals key',
+                'Compliance violations (PCI-DSS 3.6.4)'
+            ], 'byte[] keyBytes = "hardcoded1234567".getBytes(); // Key in source code\nSecretKeySpec key = new SecretKeySpec(keyBytes, "AES");', 'import java.security.KeyStore;\n// Load key from secure keystore\nKeyStore keyStore = KeyStore.getInstance("JCEKS");\nkeyStore.load(new FileInputStream("keystore.jks"), password);\nKey key = keyStore.getKey("mykey", keyPassword);\n// OR use cloud KMS\nKmsClient kms = KmsClient.create();\nDecryptResponse response = kms.decrypt(req -> req.ciphertextBlob(encryptedKey));', 'Store keys in KeyStore, environment variables (with restrictions), or use cloud key management services (AWS KMS, Azure Key Vault). Never commit keys to version control. Implement key rotation policies'));
+        }
+        // 13. Static IV (Initialization Vector) - HIGH (Phase B)
+        const prevLine = index > 0 ? lines[index - 1] : '';
+        if ((trimmed.match(/\bIvParameterSpec\s*\(\s*new\s+byte\s*\[/) && !prevLine.match(/nextBytes|SecureRandom/)) ||
+            (trimmed.match(/\bIvParameterSpec/) && (trimmed.match(/\{\s*0/) || prevLine.match(/=\s*new\s+byte\s*\[/) && !prevLine.match(/nextBytes/)))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('static-iv', 'Static or zero initialization vector (IV) detected', 'Generate unique random IV for each encryption operation using SecureRandom', lineNumber, 'Using the same IV (initialization vector) for multiple encryption operations with the same key allows attackers to detect patterns, compare messages, and potentially decrypt data. The IV must be unique and unpredictable for each encryption to ensure security. Zero IVs provide no randomness at all.', 'Encrypting two messages with same key and IV allows attacker to XOR ciphertexts and recover plaintext differences', [
+                'Pattern analysis across encrypted messages',
+                'Chosen-plaintext attacks',
+                'Message forgery',
+                'Partial plaintext recovery',
+                'Breaks semantic security'
+            ], 'byte[] iv = new byte[16]; // All zeros\nIvParameterSpec ivSpec = new IvParameterSpec(iv); // Static IV, insecure', 'SecureRandom random = new SecureRandom();\nbyte[] iv = new byte[16];\nrandom.nextBytes(iv); // Unique random IV\nIvParameterSpec ivSpec = new IvParameterSpec(iv);\n// Store IV with ciphertext (IV is not secret)', 'Generate a new random IV for every encryption operation. The IV should be stored alongside the ciphertext (it does not need to be secret). For GCM mode, use 96-bit (12-byte) IVs'));
+        }
+        // 14. Insecure TLS configuration - CRITICAL (Phase B)
+        // Pattern 1: TrustManager that accepts all certificates
+        if (trimmed.match(/new\s+X509TrustManager\s*\(\s*\)/) ||
+            trimmed.match(/checkServerTrusted\s*\(/) && trimmed.match(/\{\s*\}/)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('insecure-tls-trustmanager', 'Insecure TLS configuration - Trust all certificates detected', 'Use default TrustManager or configure proper certificate validation', lineNumber, 'Implementing a TrustManager that accepts all certificates (empty checkServerTrusted) disables certificate validation, making the application vulnerable to man-in-the-middle attacks. Attackers can intercept HTTPS traffic by presenting fake certificates, compromising all transmitted data including credentials and sensitive information.', 'Attacker uses self-signed certificate to intercept HTTPS traffic, capturing all transmitted data including API keys and passwords', [
+                'Man-in-the-middle attacks',
+                'Complete HTTPS security bypass',
+                'Credential interception',
+                'Data manipulation in transit',
+                'Session hijacking'
+            ], 'TrustManager[] trustAll = new TrustManager[] {\n  new X509TrustManager() {\n    public void checkServerTrusted(X509Certificate[] certs, String authType) {} // Accepts all\n  }\n};', '// Use default trust manager (validates certificates properly)\nSSLContext context = SSLContext.getInstance("TLSv1.3");\ncontext.init(null, null, null); // Uses default TrustManager\n// OR configure custom trust store with proper validation', 'Never disable certificate validation. Use the default TrustManager which validates against system trust store. If custom certificates are needed, add them to a KeyStore and configure a TrustManager that validates against it'));
+        }
+        // 15. Weak TLS versions - HIGH (Phase B)
+        if (trimmed.match(/SSLContext\s*\.\s*getInstance\s*\(\s*["'](SSL|SSLv2|SSLv3|TLSv1\.0|TLSv1\.1|TLSv1)['"]\s*\)/)) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('weak-tls-version', 'Weak TLS/SSL protocol version detected', 'Use TLSv1.2 or TLSv1.3: SSLContext.getInstance("TLSv1.3")', lineNumber, 'SSLv2, SSLv3, TLSv1.0, and TLSv1.1 have known vulnerabilities (POODLE, BEAST, CRIME) that allow attackers to decrypt traffic. These protocols are deprecated and should not be used. Modern applications must use TLS 1.2 (minimum) or TLS 1.3 (recommended) for secure communication.', 'TLSv1.0 vulnerable to BEAST attack allows attacker to decrypt HTTPS cookies and session tokens', [
+                'POODLE attack (SSLv3)',
+                'BEAST attack (TLSv1.0)',
+                'CRIME/BREACH attacks',
+                'Weak cipher suites',
+                'Compliance violations (PCI-DSS requires TLS 1.2+)'
+            ], 'SSLContext context = SSLContext.getInstance("TLSv1"); // Weak, vulnerable to BEAST', 'SSLContext context = SSLContext.getInstance("TLSv1.3"); // Modern, secure\ncontext.init(null, null, null);', 'Use TLS 1.3 for new applications (best security and performance). TLS 1.2 is acceptable for compatibility. Disable all older protocols (SSLv2, SSLv3, TLSv1.0, TLSv1.1). Configure strong cipher suites'));
+        }
+        // 16. Disabled hostname verification - CRITICAL (Phase B)
+        // Detect lambda patterns: (hostname, session) -> true or ALLOW_ALL constant
+        if ((trimmed.includes('HostnameVerifier') && (trimmed.includes('-> true') || trimmed.includes('->true'))) ||
+            (trimmed.includes('HostnameVerifier') && trimmed.includes('return true')) ||
+            trimmed.includes('ALLOW_ALL_HOSTNAME_VERIFIER')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('disabled-hostname-verification', 'Hostname verification disabled in TLS connection', 'Use default hostname verifier or implement proper hostname validation', lineNumber, 'Disabling hostname verification allows attackers to present valid certificates for different domains in man-in-the-middle attacks. Even with certificate validation, the attacker can use a legitimately issued certificate for a different domain they control to intercept traffic.', 'Attacker with certificate for evil.com can intercept traffic to bank.com because hostname is not verified', [
+                'Man-in-the-middle with valid certificates',
+                'Domain impersonation',
+                'Certificate mismatch attacks',
+                'Complete HTTPS bypass with legitimate certs',
+                'Credential theft'
+            ], 'HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true); // Accepts any hostname', '// Use default hostname verifier (validates hostname matches certificate)\nHttpsURLConnection conn = (HttpsURLConnection) url.openConnection();\n// Default verifier is secure, no need to override', 'Never disable hostname verification. The default hostname verifier ensures the certificate common name (CN) or subject alternative name (SAN) matches the requested hostname. This is critical for preventing MITM attacks'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=crypto-validation.js.map

package/dist/src/lib/analyzers/java/security-checks/crypto-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-validation.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/crypto-validation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAUH,sDA2QC;AAlRD,sEAA+E;AAE/E;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,KAAe;IACnD,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAE7B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,oCAAoC;QACpC,8EAA8E;QAC9E,4FAA4F;QAC5F,sEAAsE;QACtE,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAC3G,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5E,MAAM,iBAAiB,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC9D,CAAC,CAAC,KAAK,CAAC,yEAAyE,CAAC;gBAClF,CAAC,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAC7G,CAAC;YAEF,IAAI,kBAAkB,IAAI,iBAAiB,EAAE,CAAC;gBAC5C,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,aAAa,EACb,yDAAyD,EACzD,kEAAkE,EAClE,UAAU,EACV,qRAAqR,EACrR,8GAA8G,EAC9G;oBACE,mBAAmB;oBACnB,kBAAkB;oBAClB,0BAA0B;oBAC1B,8BAA8B;oBAC9B,uBAAuB;iBACxB,EACD,iGAAiG,EACjG,yPAAyP,EACzP,+LAA+L,CAChM,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,EAAE,CAAC;YAC7F,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,eAAe,EACf,wDAAwD,EACxD,oFAAoF,EACpF,UAAU,EACV,8TAA8T,EAC9T,kHAAkH,EAClH;gBACE,yCAAyC;gBACzC,sCAAsC;gBACtC,uBAAuB;gBACvB,qBAAqB;gBACrB,uBAAuB;aACxB,EACD,6HAA6H,EAC7H,uNAAuN,EACvN,uKAAuK,CACxK,CAAC,CAAC;QACL,CAAC;QAED,mCAAmC;QACnC,IAAI,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,EAAE,CAAC;YAC7D,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,qBAAqB,EACrB,6DAA6D,EAC7D,sFAAsF,EACtF,UAAU,EACV,gRAAgR,EAChR,4HAA4H,EAC5H;gBACE,yBAAyB;gBACzB,4BAA4B;gBAC5B,yBAAyB;gBACzB,2BAA2B;gBAC3B,iCAAiC;aAClC,EACD,sKAAsK,EACtK,uTAAuT,EACvT,0IAA0I,CAC3I,CAAC,CAAC;QACL,CAAC;QAED,2DAA2D;QAC3D,IAAI,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,EAAE,CAAC;YAClF,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,qBAAqB,EACrB,+CAA+C,EAC/C,qEAAqE,EACrE,UAAU,EACV,4SAA4S,EAC5S,4FAA4F,EAC5F;gBACE,0DAA0D;gBAC1D,gDAAgD;gBAChD,6CAA6C;gBAC7C,iCAAiC;gBACjC,wCAAwC;aACzC,EACD,2HAA2H,EAC3H,oRAAoR,EACpR,gKAAgK,CACjK,CAAC,CAAC;QACL,CAAC;QAED,sDAAsD;QACtD,IAAI,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,EAAE,CAAC;YACzE,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,iBAAiB,EACjB,kEAAkE,EAClE,qDAAqD,EACrD,UAAU,EACV,mSAAmS,EACnS,wGAAwG,EACxG;gBACE,4CAA4C;gBAC5C,2BAA2B;gBAC3B,2CAA2C;gBAC3C,mCAAmC;gBACnC,4CAA4C;aAC7C,EACD,uHAAuH,EACvH,mRAAmR,EACnR,yGAAyG,CAC1G,CAAC,CAAC;QACL,CAAC;QAED,qDAAqD;QACrD,oGAAoG;QACpG,IAAI,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC;YAC3C,CAAC,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC;gBACrD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC9E,CAAC,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,0BAA0B,EAC1B,mCAAmC,EACnC,0FAA0F,EAC1F,UAAU,EACV,yQAAyQ,EACzQ,sGAAsG,EACtG;gBACE,4BAA4B;gBAC5B,sBAAsB;gBACtB,gCAAgC;gBAChC,oCAAoC;gBACpC,uCAAuC;aACxC,EACD,iIAAiI,EACjI,mXAAmX,EACnX,2MAA2M,CAC5M,CAAC,CAAC;QACL,CAAC;QAED,yDAAyD;QACzD,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACxG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/I,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,WAAW,EACX,oDAAoD,EACpD,4EAA4E,EAC5E,UAAU,EACV,4SAA4S,EAC5S,mHAAmH,EACnH;gBACE,4CAA4C;gBAC5C,0BAA0B;gBAC1B,iBAAiB;gBACjB,4BAA4B;gBAC5B,0BAA0B;aAC3B,EACD,kHAAkH,EAClH,oNAAoN,EACpN,mLAAmL,CACpL,CAAC,CAAC;QACL,CAAC;QAED,sDAAsD;QACtD,wDAAwD;QACxD,IAAI,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC;YACjD,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACzE,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,2BAA2B,EAC3B,8DAA8D,EAC9D,qEAAqE,EACrE,UAAU,EACV,iVAAiV,EACjV,mIAAmI,EACnI;gBACE,2BAA2B;gBAC3B,gCAAgC;gBAChC,yBAAyB;gBACzB,8BAA8B;gBAC9B,mBAAmB;aACpB,EACD,qLAAqL,EACrL,kPAAkP,EAClP,iOAAiO,CAClO,CAAC,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,IAAI,OAAO,CAAC,KAAK,CAAC,6FAA6F,CAAC,EAAE,CAAC;YACjH,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,kBAAkB,EAClB,wCAAwC,EACxC,2DAA2D,EAC3D,UAAU,EACV,wRAAwR,EACxR,gGAAgG,EAChG;gBACE,uBAAuB;gBACvB,wBAAwB;gBACxB,sBAAsB;gBACtB,oBAAoB;gBACpB,mDAAmD;aACpD,EACD,oFAAoF,EACpF,4GAA4G,EAC5G,yMAAyM,CAC1M,CAAC,CAAC;QACL,CAAC;QAED,0DAA0D;QAC1D,4EAA4E;QAC5E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACzE,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACpD,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,gCAAgC,EAChC,kDAAkD,EAClD,uEAAuE,EACvE,UAAU,EACV,uRAAuR,EACvR,2GAA2G,EAC3G;gBACE,2CAA2C;gBAC3C,sBAAsB;gBACtB,8BAA8B;gBAC9B,6CAA6C;gBAC7C,kBAAkB;aACnB,EACD,qGAAqG,EACrG,qMAAqM,EACrM,4NAA4N,CAC7N,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/deserialization-xxe.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Java Deserialization and XXE Detection Module
+ *
+ * OWASP A08:2021 - Software and Data Integrity Failures
+ *
+ * This module detects vulnerabilities related to unsafe data processing:
+ * - Insecure Deserialization (CRITICAL)
+ * - XML External Entity (XXE) attacks (HIGH)
+ *
+ * Both vulnerabilities can lead to Remote Code Execution and severe data breaches.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for deserialization and XXE vulnerabilities in Java code
+ *
+ * @param lines - Array of code lines to analyze
+ * @returns Array of detected security vulnerabilities
+ */
+export declare function checkDeserializationAndXXE(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=deserialization-xxe.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/deserialization-xxe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deserialization-xxe.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/deserialization-xxe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,qBAAqB,EAAE,CA+LnF"}