codeslick-cli 1.1.6 → 1.2.0

package/dist/src/lib/analyzers/go/security-checks/ai-generated-code.js

@@ -0,0 +1,545 @@
+"use strict";
+/**
+ * Go AI-Generated Code Detection Module
+ *
+ * Detects AI-generated code patterns as SECURITY RISKS:
+ * - 12 Go-specific hallucination patterns (JavaScript/Python influence)
+ * - 8 code smell heuristics (over-engineering, inconsistency)
+ * - Confidence scoring (HIGH/MEDIUM/LOW)
+ *
+ * OWASP A04:2025 - Insecure Design
+ * CWE-1120 - Excessive Code Complexity
+ * CWE-758 - Reliance on Undefined Behavior
+ *
+ * Phase 2, Day 7 (Go Language Support - AI Code Detection)
+ * Created: January 19, 2026
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAIGeneratedCode = checkAIGeneratedCode;
+const createVulnerability_1 = require("../utils/createVulnerability");
+const ai_code_detection_utils_1 = require("../../helpers/ai-code-detection-utils");
+/**
+ * Go standard library packages (comprehensive list)
+ *
+ * Any import not in this list is likely an AI hallucination.
+ * Source: https://pkg.go.dev/std (Go 1.21+)
+ */
+const GO_STANDARD_LIBRARY = new Set([
+    // Core packages
+    'archive/tar', 'archive/zip',
+    'bufio', 'builtin', 'bytes',
+    'compress/bzip2', 'compress/flate', 'compress/gzip', 'compress/lzw', 'compress/zlib',
+    'container/heap', 'container/list', 'container/ring',
+    'context',
+    'crypto', 'crypto/aes', 'crypto/cipher', 'crypto/des', 'crypto/dsa', 'crypto/ecdh', 'crypto/ecdsa',
+    'crypto/ed25519', 'crypto/elliptic', 'crypto/hmac', 'crypto/md5', 'crypto/rand', 'crypto/rc4',
+    'crypto/rsa', 'crypto/sha1', 'crypto/sha256', 'crypto/sha512', 'crypto/subtle', 'crypto/tls',
+    'crypto/x509', 'crypto/x509/pkix',
+    'database/sql', 'database/sql/driver',
+    'debug/buildinfo', 'debug/dwarf', 'debug/elf', 'debug/gosym', 'debug/macho', 'debug/pe', 'debug/plan9obj',
+    'embed',
+    'encoding', 'encoding/ascii85', 'encoding/asn1', 'encoding/base32', 'encoding/base64',
+    'encoding/binary', 'encoding/csv', 'encoding/gob', 'encoding/hex', 'encoding/json',
+    'encoding/pem', 'encoding/xml',
+    'errors',
+    'expvar',
+    'flag',
+    'fmt',
+    'go/ast', 'go/build', 'go/build/constraint', 'go/constant', 'go/doc', 'go/doc/comment',
+    'go/format', 'go/importer', 'go/parser', 'go/printer', 'go/scanner', 'go/token', 'go/types',
+    'hash', 'hash/adler32', 'hash/crc32', 'hash/crc64', 'hash/fnv', 'hash/maphash',
+    'html', 'html/template',
+    'image', 'image/color', 'image/color/palette', 'image/draw', 'image/gif', 'image/jpeg', 'image/png',
+    'index/suffixarray',
+    'io', 'io/fs', 'io/ioutil',
+    'log', 'log/slog', 'log/syslog',
+    'math', 'math/big', 'math/bits', 'math/cmplx', 'math/rand',
+    'mime', 'mime/multipart', 'mime/quotedprintable',
+    'net', 'net/http', 'net/http/cgi', 'net/http/cookiejar', 'net/http/fcgi', 'net/http/httptest',
+    'net/http/httptrace', 'net/http/httputil', 'net/http/pprof',
+    'net/mail', 'net/netip', 'net/rpc', 'net/rpc/jsonrpc', 'net/smtp', 'net/textproto', 'net/url',
+    'os', 'os/exec', 'os/signal', 'os/user',
+    'path', 'path/filepath',
+    'plugin',
+    'reflect',
+    'regexp', 'regexp/syntax',
+    'runtime', 'runtime/cgo', 'runtime/coverage', 'runtime/debug', 'runtime/metrics', 'runtime/pprof', 'runtime/trace',
+    'slices',
+    'sort',
+    'strconv',
+    'strings',
+    'sync', 'sync/atomic',
+    'syscall', 'syscall/js',
+    'testing', 'testing/fstest', 'testing/iotest', 'testing/quick', 'testing/slogtest',
+    'text/scanner', 'text/tabwriter', 'text/template', 'text/template/parse',
+    'time', 'time/tzdata',
+    'unicode', 'unicode/utf16', 'unicode/utf8',
+    'unsafe',
+    // Golang.org/x (commonly used, often confused as standard)
+    'golang.org/x/crypto', 'golang.org/x/net', 'golang.org/x/text', 'golang.org/x/tools',
+    'golang.org/x/crypto/bcrypt', 'golang.org/x/crypto/ssh', 'golang.org/x/net/html',
+]);
+/**
+ * Go hallucination patterns (12 patterns)
+ *
+ * AI code generators hallucinate methods from JavaScript/Python:
+ * - JavaScript influence: string.toUpperCase(), array.push(), string.charAt()
+ * - Python influence: string.upper(), list.append()
+ * - Non-existent methods: string.contains(), string.isEmpty()
+ */
+const HALLUCINATION_PATTERNS = new Map([
+    // JavaScript-style string methods in Go
+    ['toUpperCase', {
+            correct: 'strings.ToUpper()',
+            description: 'Go uses strings.ToUpper(s), not s.toUpperCase(). This is JavaScript syntax.'
+        }],
+    ['toLowerCase', {
+            correct: 'strings.ToLower()',
+            description: 'Go uses strings.ToLower(s), not s.toLowerCase(). This is JavaScript syntax.'
+        }],
+    ['indexOf', {
+            correct: 'strings.Index()',
+            description: 'Go uses strings.Index(s, substr), not s.indexOf(). This is JavaScript syntax.'
+        }],
+    ['charAt', {
+            correct: '[index]',
+            description: 'Go uses indexing s[index], not s.charAt(). This is JavaScript syntax.'
+        }],
+    ['substring', {
+            correct: '[start:end]',
+            description: 'Go uses slice notation s[start:end], not s.substring(). This is JavaScript syntax.'
+        }],
+    // Python-style methods in Go
+    ['upper', {
+            correct: 'strings.ToUpper()',
+            description: 'Go uses strings.ToUpper(s), not s.upper(). This is Python syntax.'
+        }],
+    ['lower', {
+            correct: 'strings.ToLower()',
+            description: 'Go uses strings.ToLower(s), not s.lower(). This is Python syntax.'
+        }],
+    ['append', {
+            correct: 'built-in append()',
+            description: 'Go uses built-in append(slice, elem), not slice.append(). This is Python syntax.'
+        }],
+    // Non-existent Go methods (AI hallucinations)
+    ['contains', {
+            correct: 'strings.Contains()',
+            description: 'Go uses strings.Contains(s, substr), not s.contains(). Method does not exist on strings.'
+        }],
+    ['isEmpty', {
+            correct: 'len(s) == 0',
+            description: 'Go uses len(s) == 0, not s.isEmpty(). Method does not exist.'
+        }],
+    ['size', {
+            correct: 'len()',
+            description: 'Go uses len() built-in function, not .size(). This is Java/Python syntax.'
+        }],
+    ['length', {
+            correct: 'len()',
+            description: 'Go uses len() built-in function, not .length property. This is JavaScript syntax.'
+        }],
+]);
+/**
+ * Checks for AI-generated code patterns in Go code
+ *
+ * @param lines - Array of code lines
+ * @param filename - Name of the file being analyzed
+ * @returns Array of security vulnerabilities found
+ */
+function checkAIGeneratedCode(lines, filename = '') {
+    const vulnerabilities = [];
+    // Skip test files (AI-generated tests are less critical)
+    if ((0, ai_code_detection_utils_1.isTestFile)(filename)) {
+        return vulnerabilities;
+    }
+    const code = lines.join('\n');
+    const cleanedCode = (0, ai_code_detection_utils_1.removeCommentsAndStrings)(code, 'go');
+    const cleanedLines = cleanedCode.split('\n');
+    // Track hallucination detections
+    const hallucinationsDetected = [];
+    // Track imports and their aliases for package validation
+    const importedPackages = new Map();
+    // =============================================================================
+    // IMPORT PACKAGE VALIDATION (Detect non-existent packages)
+    // =============================================================================
+    // Track if we're inside an import block
+    let inImportBlock = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Skip comments and empty lines
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('/*')) {
+            return;
+        }
+        // Detect import block start
+        if (/^import\s*\(/.test(trimmed)) {
+            inImportBlock = true;
+            return;
+        }
+        // Detect import block end
+        if (inImportBlock && trimmed === ')') {
+            inImportBlock = false;
+            return;
+        }
+        // Single import: import "package/name"
+        const singleImportMatch = trimmed.match(/^import\s+"([^"]+)"/);
+        if (singleImportMatch) {
+            const packagePath = singleImportMatch[1];
+            const packageName = packagePath.split('/').pop() || packagePath;
+            importedPackages.set(packageName, { packagePath, alias: packageName, line: lineNumber });
+            return;
+        }
+        // Aliased import: import alias "package/name"
+        const aliasImportMatch = trimmed.match(/^import\s+(\w+)\s+"([^"]+)"/);
+        if (aliasImportMatch) {
+            const alias = aliasImportMatch[1];
+            const packagePath = aliasImportMatch[2];
+            importedPackages.set(alias, { packagePath, alias, line: lineNumber });
+            return;
+        }
+        // Inside import block: "package/name"
+        if (inImportBlock) {
+            const blockImportMatch = trimmed.match(/^"([^"]+)"/);
+            if (blockImportMatch) {
+                const packagePath = blockImportMatch[1];
+                const packageName = packagePath.split('/').pop() || packagePath;
+                importedPackages.set(packageName, { packagePath, alias: packageName, line: lineNumber });
+                return;
+            }
+            // Aliased in block: alias "package/name"
+            const blockAliasMatch = trimmed.match(/^(\w+)\s+"([^"]+)"/);
+            if (blockAliasMatch) {
+                const alias = blockAliasMatch[1];
+                const packagePath = blockAliasMatch[2];
+                importedPackages.set(alias, { packagePath, alias, line: lineNumber });
+                return;
+            }
+        }
+    });
+    // Validate each imported package against Go standard library
+    importedPackages.forEach((importInfo, alias) => {
+        const { packagePath, line } = importInfo;
+        // Skip blank imports (side effects only)
+        if (alias === '_') {
+            return;
+        }
+        // Check if package exists in standard library
+        // Skip third-party packages (github.com, gopkg.in, etc.)
+        const isThirdParty = packagePath.includes('github.com') ||
+            packagePath.includes('gitlab.com') ||
+            packagePath.includes('gopkg.in') ||
+            packagePath.includes('bitbucket.org');
+        if (!isThirdParty && !GO_STANDARD_LIBRARY.has(packagePath)) {
+            hallucinationsDetected.push(`package:${packagePath}`);
+            vulnerabilities.push((0, createVulnerability_1.createGoSecurityVulnerability)({
+                category: 'go-ai-hallucination',
+                severity: 'critical',
+                confidence: 'high',
+                message: `AI hallucination detected: Package "${packagePath}" does not exist in Go standard library`,
+                line,
+                suggestion: `Remove this import or check the correct package name. Common mistakes: "html/sanitize" (use "html" + "html/template"), "crypto/random" (use "crypto/rand"), "ldap/client" (use third-party "github.com/go-ldap/ldap")`,
+                owasp: 'A04:2025 - Insecure Design',
+                cwe: 'CWE-758',
+                pciDss: 'N/A',
+                remediation: {
+                    explanation: `The package "${packagePath}" does not exist in Go's standard library. This is likely AI-generated code that hallucinated a package name. Check the official Go standard library documentation at https://pkg.go.dev/std`,
+                    before: `import "${packagePath}" // AI hallucination - does not exist`,
+                    after: `// Use the correct Go standard library package:\n// For HTML sanitization: import "html" and "html/template"\n// For cryptographic random: import "crypto/rand"\n// For LDAP: use third-party "github.com/go-ldap/ldap"`
+                },
+                attackVector: {
+                    description: 'Non-existent package imports indicate AI-generated code that has never been compiled or tested. This code will fail to build and likely contains other hallucinated methods and logic.',
+                    exploitExample: `import "${packagePath}"\n// Compilation error: package ${packagePath} is not in std`,
+                    realWorldImpact: [
+                        'Build failures from non-existent packages',
+                        'Code has never been compiled or run',
+                        'Likely contains other AI-generated bugs',
+                        'Security vulnerabilities from untested code paths',
+                        'Indicates entire codebase may be AI-generated without review'
+                    ]
+                }
+            }));
+        }
+    });
+    // =============================================================================
+    // HALLUCINATION DETECTION (12 Go-specific method patterns)
+    // =============================================================================
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Skip comments and empty lines
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('/*')) {
+            return;
+        }
+        // Check for each hallucination pattern
+        HALLUCINATION_PATTERNS.forEach((pattern, method) => {
+            // Properties (no parentheses): length, size
+            const isProperty = method === 'length' || method === 'size';
+            // Pattern: variable.method() for methods, variable.property for properties
+            // Case-sensitive to avoid false positives (strings.Contains vs strings.contains)
+            const regex = isProperty
+                ? new RegExp(`\\w+\\.${method}(?!\\w)`) // Property access (no parens, case-sensitive)
+                : new RegExp(`\\w+\\.${method}\\s*\\(`);
+            if (regex.test(trimmed)) {
+                hallucinationsDetected.push(method);
+                vulnerabilities.push((0, createVulnerability_1.createGoSecurityVulnerability)({
+                    category: 'go-ai-hallucination',
+                    severity: 'critical',
+                    confidence: 'high',
+                    message: `AI hallucination detected: .${method}${isProperty ? '' : '()'} does not exist in Go`,
+                    line: lineNumber,
+                    suggestion: `Use ${pattern.correct} instead. ${pattern.description}`,
+                    owasp: 'A04:2025 - Insecure Design',
+                    cwe: 'CWE-758',
+                    pciDss: 'N/A',
+                    remediation: {
+                        explanation: pattern.description,
+                        before: `str.${method}${isProperty ? '' : '()'} // AI hallucination - does not compile`,
+                        after: pattern.correct
+                    },
+                    attackVector: {
+                        description: 'AI-generated code with hallucinated methods will not compile, causing build failures. More critically, it indicates the code was not written by a human developer and has not been tested.',
+                        exploitExample: `// AI hallucination:\nresult := username.${method}${isProperty ? '' : '()'}\n// Compilation error: ${method} not defined`,
+                        realWorldImpact: [
+                            'Build failures from non-existent methods',
+                            'Code has never been tested or run',
+                            'Likely contains other AI-generated bugs',
+                            'Security vulnerabilities from untested code paths',
+                            'Maintenance burden from incorrect patterns'
+                        ]
+                    }
+                }));
+            }
+        });
+    });
+    // =============================================================================
+    // METHOD CALLS ON NON-EXISTENT PACKAGES
+    // =============================================================================
+    // Detect method calls on packages that don't exist (e.g., sanitize.HTML() from "html/sanitize")
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Skip comments and empty lines
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('/*')) {
+            return;
+        }
+        // Pattern: packageName.MethodName() - detect any method call on a package
+        const methodCallMatch = trimmed.match(/(\w+)\.(\w+)\s*\(/g);
+        if (methodCallMatch) {
+            methodCallMatch.forEach(call => {
+                const parts = call.match(/(\w+)\.(\w+)\s*\(/);
+                if (!parts)
+                    return;
+                const packageAlias = parts[1];
+                const methodName = parts[2];
+                // Check if this package alias is from a non-existent import
+                const importInfo = importedPackages.get(packageAlias);
+                if (importInfo) {
+                    // Case 1: Package was imported, but doesn't exist in Go stdlib
+                    const { packagePath } = importInfo;
+                    // Skip third-party packages
+                    const isThirdParty = packagePath.includes('github.com') ||
+                        packagePath.includes('gitlab.com') ||
+                        packagePath.includes('gopkg.in') ||
+                        packagePath.includes('bitbucket.org');
+                    // If package doesn't exist, report method call as hallucination
+                    if (!isThirdParty && !GO_STANDARD_LIBRARY.has(packagePath)) {
+                        hallucinationsDetected.push(`method:${packageAlias}.${methodName}`);
+                        vulnerabilities.push((0, createVulnerability_1.createGoSecurityVulnerability)({
+                            category: 'go-ai-hallucination',
+                            severity: 'critical',
+                            confidence: 'high',
+                            message: `AI hallucination detected: Method ${packageAlias}.${methodName}() called on non-existent package "${packagePath}"`,
+                            line: lineNumber,
+                            suggestion: `Package "${packagePath}" does not exist. Remove this code or use the correct Go standard library package.`,
+                            owasp: 'A04:2025 - Insecure Design',
+                            cwe: 'CWE-758',
+                            pciDss: 'N/A',
+                            remediation: {
+                                explanation: `The method call ${packageAlias}.${methodName}() is from package "${packagePath}" which does not exist in Go's standard library. This is AI-generated code that has never been tested.`,
+                                before: `${packageAlias}.${methodName}() // AI hallucination - package doesn't exist`,
+                                after: `// Use the correct Go standard library:\n// For HTML sanitization: html.EscapeString() or template.HTMLEscapeString()\n// For crypto random: rand.Read() from "crypto/rand"`
+                            },
+                            attackVector: {
+                                description: 'Method calls on non-existent packages indicate AI-generated code that will not compile. This code has never been tested and likely contains critical security vulnerabilities.',
+                                exploitExample: `${packageAlias}.${methodName}()\n// Compilation error: package ${packagePath} is not in std`,
+                                realWorldImpact: [
+                                    'Build failures from method calls on non-existent packages',
+                                    'Code has never been compiled or run',
+                                    'Security vulnerabilities from untested logic',
+                                    'Complete lack of code review or testing',
+                                    'High risk of additional AI hallucinations in surrounding code'
+                                ]
+                            }
+                        }));
+                    }
+                }
+                else {
+                    // Case 2: Package was NEVER imported - undefined identifier
+                    // Check if it looks like a package (not a variable)
+                    // Skip common Go built-ins and variables that might have methods
+                    const skipList = ['err', 'ctx', 'req', 'resp', 'w', 'r', 'db', 'tx', 'conn', 'client',
+                        'config', 'logger', 'cache', 'session', 'user', 'data', 'result',
+                        'response', 'request', 'handler', 'server', 'router', 'app'];
+                    // Skip if it's likely a variable name (lowercase first letter and in skip list)
+                    const isLikelyVariable = /^[a-z]/.test(packageAlias) && skipList.includes(packageAlias.toLowerCase());
+                    if (!isLikelyVariable) {
+                        // Check if this looks like a package name that should exist
+                        // Common hallucinations: crypto.X, html.X, strings.X without importing
+                        const commonPackages = ['crypto', 'html', 'strings', 'json', 'xml', 'http', 'sql',
+                            'rand', 'time', 'sync', 'atomic', 'context', 'errors',
+                            'fmt', 'io', 'os', 'log', 'net', 'url', 'path', 'filepath'];
+                        if (commonPackages.includes(packageAlias.toLowerCase())) {
+                            hallucinationsDetected.push(`undefined:${packageAlias}.${methodName}`);
+                            vulnerabilities.push((0, createVulnerability_1.createGoSecurityVulnerability)({
+                                category: 'go-ai-hallucination',
+                                severity: 'critical',
+                                confidence: 'high',
+                                message: `AI hallucination detected: Method ${packageAlias}.${methodName}() called on undefined package "${packageAlias}" (never imported)`,
+                                line: lineNumber,
+                                suggestion: `Package "${packageAlias}" was never imported. Add the correct import or check if you meant a different package. Common mistake: using "crypto" when "crypto/rand" was imported (should use "rand.${methodName}()")`,
+                                owasp: 'A04:2025 - Insecure Design',
+                                cwe: 'CWE-758',
+                                pciDss: 'N/A',
+                                remediation: {
+                                    explanation: `The package "${packageAlias}" was never imported. This is likely AI-generated code that confused package import paths with package names. In Go, when you import "crypto/rand", the package name is "rand", not "crypto".`,
+                                    before: `import "crypto/random"\n...\nsessionToken := crypto.RandomString(32) // Wrong: 'crypto' not imported`,
+                                    after: `import "crypto/rand"\n...\ntoken := make([]byte, 32)\nrand.Read(token) // Correct: use 'rand' (from crypto/rand) with proper method`
+                                },
+                                attackVector: {
+                                    description: 'Method calls on undefined packages indicate AI-generated code that will not compile. The AI confused import paths with package names, a common hallucination pattern.',
+                                    exploitExample: `${packageAlias}.${methodName}()\n// Compilation error: undefined: ${packageAlias}`,
+                                    realWorldImpact: [
+                                        'Build failures from undefined identifiers',
+                                        'Code has never been compiled or tested',
+                                        'AI confusion between import paths and package names',
+                                        'Indicates lack of understanding of Go package system',
+                                        'High probability of other AI-generated errors'
+                                    ]
+                                }
+                            }));
+                        }
+                    }
+                }
+            });
+        }
+    });
+    // =============================================================================
+    // CODE SMELL HEURISTICS (8 patterns from shared utilities)
+    // =============================================================================
+    const codeSmells = [];
+    // Heuristic 1: Over-engineered error handling (30+ points)
+    const errorHandlingScore = (0, ai_code_detection_utils_1.detectOverEngineeredErrorHandling)(cleanedLines);
+    if (errorHandlingScore > 0) {
+        codeSmells.push({ name: 'over-engineered-error-handling', score: errorHandlingScore });
+    }
+    // Heuristic 2: Unnecessary wrappers (25+ points)
+    const wrappersScore = (0, ai_code_detection_utils_1.detectUnnecessaryWrappers)(cleanedLines);
+    if (wrappersScore > 0) {
+        codeSmells.push({ name: 'unnecessary-wrappers', score: wrappersScore });
+    }
+    // Heuristic 3: Verbose comments (20+ points)
+    const commentsScore = (0, ai_code_detection_utils_1.detectVerboseComments)(lines);
+    if (commentsScore > 0) {
+        codeSmells.push({ name: 'verbose-comments', score: commentsScore });
+    }
+    // Heuristic 4: Mixed naming conventions (15+ points)
+    const namingScore = (0, ai_code_detection_utils_1.detectMixedNamingConventions)(cleanedLines);
+    if (namingScore > 0) {
+        codeSmells.push({ name: 'mixed-naming', score: namingScore });
+    }
+    // Heuristic 5: Redundant nil checks (10+ points)
+    const nullChecksScore = (0, ai_code_detection_utils_1.detectRedundantNullChecks)(cleanedLines);
+    if (nullChecksScore > 0) {
+        codeSmells.push({ name: 'redundant-nil-checks', score: nullChecksScore });
+    }
+    // Heuristic 6: Unnecessary goroutines (10+ points) - Go-specific
+    const unnecessaryGoroutinesScore = detectUnnecessaryGoroutines(cleanedCode);
+    if (unnecessaryGoroutinesScore > 0) {
+        codeSmells.push({ name: 'unnecessary-goroutines', score: unnecessaryGoroutinesScore });
+    }
+    // Heuristic 7: Generic variable overuse (15+ points)
+    const genericVarsScore = (0, ai_code_detection_utils_1.detectGenericVariableOveruse)(cleanedLines);
+    if (genericVarsScore > 0) {
+        codeSmells.push({ name: 'generic-variables', score: genericVarsScore });
+    }
+    // Heuristic 8: Inconsistent string concatenation (10+ points)
+    const stringConcatScore = (0, ai_code_detection_utils_1.detectInconsistentStringConcatenation)(cleanedLines);
+    if (stringConcatScore > 0) {
+        codeSmells.push({ name: 'inconsistent-strings', score: stringConcatScore });
+    }
+    // =============================================================================
+    // CONFIDENCE SCORING & REPORTING
+    // =============================================================================
+    // Convert code smells array to HeuristicScores object
+    const heuristicScores = {
+        overEngineeredErrors: codeSmells.find(s => s.name === 'over-engineered-error-handling')?.score || 0,
+        unnecessaryWrappers: codeSmells.find(s => s.name === 'unnecessary-wrappers')?.score || 0,
+        verboseComments: codeSmells.find(s => s.name === 'verbose-comments')?.score || 0,
+        mixedNaming: codeSmells.find(s => s.name === 'mixed-naming')?.score || 0,
+        redundantNullChecks: codeSmells.find(s => s.name === 'redundant-nil-checks')?.score || 0,
+        unnecessaryAsync: 0, // Not applicable to Go
+        genericVariables: codeSmells.find(s => s.name === 'generic-variables')?.score || 0,
+        inconsistentStrings: codeSmells.find(s => s.name === 'inconsistent-strings')?.score || 0,
+    };
+    const confidence = (0, ai_code_detection_utils_1.calculateAICodeConfidence)(hallucinationsDetected.length, heuristicScores);
+    // Report code smell summary if medium/high confidence
+    if (confidence && confidence.confidence !== 'LOW' && codeSmells.length > 0) {
+        const severity = confidence.confidence === 'HIGH' ? 'high' : 'medium';
+        vulnerabilities.push((0, createVulnerability_1.createGoSecurityVulnerability)({
+            category: 'go-ai-code-smell',
+            severity,
+            confidence: confidence.confidence.toLowerCase(),
+            message: `AI-generated code detected (${confidence.confidence} confidence, score: ${confidence.heuristicScore})`,
+            line: 1,
+            suggestion: 'Review code for over-engineering, verbose comments, and mixed conventions. AI-generated code should be tested and refactored.',
+            owasp: 'A04:2025 - Insecure Design',
+            cwe: 'CWE-1120',
+            pciDss: 'N/A',
+            remediation: {
+                explanation: 'AI-generated code often exhibits patterns like over-engineered error handling, unnecessary abstractions, verbose comments, and mixed naming conventions. This code should be thoroughly reviewed and tested.',
+                before: `// AI-generated characteristics:\n// - Verbose comments\n// - Unnecessary wrappers\n// - Mixed naming (snake_case + camelCase)\n// - Over-engineered error handling`,
+                after: `// Human-refactored code:\n// - Concise comments only where needed\n// - Direct implementations\n// - Consistent Go naming (camelCase)\n// - Simple error handling`
+            },
+            attackVector: {
+                description: 'AI-generated code may contain subtle bugs, inefficiencies, or security vulnerabilities that were not caught by testing. The code patterns indicate it was not written by an experienced Go developer.',
+                exploitExample: 'Code smells detected: ' + codeSmells.map(s => s.name).join(', '),
+                realWorldImpact: [
+                    'Untested code paths with potential bugs',
+                    'Over-engineered solutions reducing maintainability',
+                    'Performance issues from unnecessary abstractions',
+                    'Security vulnerabilities from AI hallucinations',
+                    'Technical debt from non-idiomatic Go code'
+                ]
+            }
+        }));
+    }
+    return vulnerabilities;
+}
+/**
+ * Detects unnecessary goroutines (Go-specific heuristic)
+ *
+ * Patterns:
+ * - Single-line goroutines that could be synchronous
+ * - Goroutines without any channel/sync usage
+ * - Goroutines that only call one function
+ *
+ * @param code - Code to analyze
+ * @returns Score (10+ points indicates AI pattern)
+ */
+function detectUnnecessaryGoroutines(code) {
+    let score = 0;
+    // Pattern: go functionCall() with no channels or sync
+    const singleLineGoroutines = code.match(/go\s+\w+\s*\([^)]*\)/g) || [];
+    singleLineGoroutines.forEach(goroutine => {
+        // Check if there's any channel or sync usage nearby (within 100 chars)
+        const contextStart = Math.max(0, code.indexOf(goroutine) - 100);
+        const contextEnd = Math.min(code.length, code.indexOf(goroutine) + 100);
+        const context = code.substring(contextStart, contextEnd);
+        if (!/chan|sync\.|<-|WaitGroup/.test(context)) {
+            score += 5; // Suspicious: goroutine with no concurrency primitives
+        }
+    });
+    return score;
+}
+//# sourceMappingURL=ai-generated-code.js.map

package/dist/src/lib/analyzers/go/security-checks/ai-generated-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-generated-code.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/go/security-checks/ai-generated-code.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA+JH,oDAsbC;AAllBD,sEAA6E;AAC7E,mFAY+C;AAU/C;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC1C,gBAAgB;IAChB,aAAa,EAAE,aAAa;IAC5B,OAAO,EAAE,SAAS,EAAE,OAAO;IAC3B,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe;IACpF,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB;IACpD,SAAS;IACT,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc;IAClG,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY;IAC7F,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY;IAC5F,aAAa,EAAE,kBAAkB;IACjC,cAAc,EAAE,qBAAqB;IACrC,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB;IACzG,OAAO;IACP,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB;IACrF,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe;IAClF,cAAc,EAAE,cAAc;IAC9B,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,KAAK;IACL,QAAQ,EAAE,UAAU,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB;IACtF,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU;IAC3F,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc;IAC9E,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;IACnG,mBAAmB;IACnB,IAAI,EAAE,OAAO,EAAE,WAAW;IAC1B,KAAK,EAAE,UAAU,EAAE,YAAY;IAC/B,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;IAC1D,MAAM,EAAE,gBAAgB,EAAE,sBAAsB;IAChD,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,oBAAoB,EAAE,eAAe,EAAE,mBAAmB;IAC7F,oBAAoB,EAAE,mBAAmB,EAAE,gBAAgB;IAC3D,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS;IAC7F,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS;IACvC,MAAM,EAAE,eAAe;IACvB,QAAQ;IACR,SAAS;IACT,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe;IAClH,QAAQ;IACR,MAAM;IACN,SAAS;IACT,SAAS;IACT,MAAM,EAAE,aAAa;IACrB,SAAS,EAAE,YAAY;IACvB,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB;IAClF,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,qBAAqB;IACxE,MAAM,EAAE,aAAa;IACrB,SAAS,EAAE,eAAe,EAAE,cAAc;IAC1C,QAAQ;IACR,2DAA2D;IAC3D,qBAAqB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB;IACpF,4BAA4B,EAAE,yBAAyB,EAAE,uBAAuB;CACjF,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAA+B;IACnE,wCAAwC;IACxC,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,mBAAmB;YAC5B,WAAW,EAAE,6EAA6E;SAC3F,CAAC;IACF,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,mBAAmB;YAC5B,WAAW,EAAE,6EAA6E;SAC3F,CAAC;IACF,CAAC,SAAS,EAAE;YACV,OAAO,EAAE,iBAAiB;YAC1B,WAAW,EAAE,+EAA+E;SAC7F,CAAC;IACF,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,uEAAuE;SACrF,CAAC;IACF,CAAC,WAAW,EAAE;YACZ,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,oFAAoF;SAClG,CAAC;IAEF,6BAA6B;IAC7B,CAAC,OAAO,EAAE;YACR,OAAO,EAAE,mBAAmB;YAC5B,WAAW,EAAE,mEAAmE;SACjF,CAAC;IACF,CAAC,OAAO,EAAE;YACR,OAAO,EAAE,mBAAmB;YAC5B,WAAW,EAAE,mEAAmE;SACjF,CAAC;IACF,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,mBAAmB;YAC5B,WAAW,EAAE,kFAAkF;SAChG,CAAC;IAEF,8CAA8C;IAC9C,CAAC,UAAU,EAAE;YACX,OAAO,EAAE,oBAAoB;YAC7B,WAAW,EAAE,0FAA0F;SACxG,CAAC;IACF,CAAC,SAAS,EAAE;YACV,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,8DAA8D;SAC5E,CAAC;IACF,CAAC,MAAM,EAAE;YACP,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,2EAA2E;SACzF,CAAC;IACF,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,mFAAmF;SACjG,CAAC;CACH,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,KAAe,EAAE,WAAmB,EAAE;IACzE,MAAM,eAAe,GAA4B,EAAE,CAAC;IAEpD,yDAAyD;IACzD,IAAI,IAAA,oCAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAA,kDAAwB,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE7C,iCAAiC;IACjC,MAAM,sBAAsB,GAAa,EAAE,CAAC;IAE5C,yDAAyD;IACzD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAgE,CAAC;IAEjG,gFAAgF;IAChF,2DAA2D;IAC3D,gFAAgF;IAEhF,wCAAwC;IACxC,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QAED,4BAA4B;QAC5B,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,aAAa,GAAG,IAAI,CAAC;YACrB,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,IAAI,aAAa,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACrC,aAAa,GAAG,KAAK,CAAC;YACtB,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC/D,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC;YAChE,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACtE,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACxC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC;gBAChE,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YAED,yCAAyC;YACzC,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC5D,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;gBACvC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,gBAAgB,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAEzC,yCAAyC;QACzC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,yDAAyD;QACzD,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAChC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAE3D,IAAI,CAAC,YAAY,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,sBAAsB,CAAC,IAAI,CAAC,WAAW,WAAW,EAAE,CAAC,CAAC;YAEtD,eAAe,CAAC,IAAI,CAClB,IAAA,mDAA6B,EAAC;gBAC5B,QAAQ,EAAE,qBAAqB;gBAC/B,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,uCAAuC,WAAW,yCAAyC;gBACpG,IAAI;gBACJ,UAAU,EAAE,uNAAuN;gBACnO,KAAK,EAAE,4BAA4B;gBACnC,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE;oBACX,WAAW,EAAE,gBAAgB,WAAW,8LAA8L;oBACtO,MAAM,EAAE,WAAW,WAAW,wCAAwC;oBACtE,KAAK,EAAE,yNAAyN;iBACjO;gBACD,YAAY,EAAE;oBACZ,WAAW,EACT,wLAAwL;oBAC1L,cAAc,EAAE,WAAW,WAAW,oCAAoC,WAAW,gBAAgB;oBACrG,eAAe,EAAE;wBACf,2CAA2C;wBAC3C,qCAAqC;wBACrC,yCAAyC;wBACzC,mDAAmD;wBACnD,8DAA8D;qBAC/D;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,2DAA2D;IAC3D,gFAAgF;IAEhF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,sBAAsB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,4CAA4C;YAC5C,MAAM,UAAU,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,CAAC;YAE5D,2EAA2E;YAC3E,iFAAiF;YACjF,MAAM,KAAK,GAAG,UAAU;gBACtB,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,MAAM,SAAS,CAAC,CAAE,8CAA8C;gBACvF,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,MAAM,SAAS,CAAC,CAAC;YAE1C,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAEpC,eAAe,CAAC,IAAI,CAClB,IAAA,mDAA6B,EAAC;oBAC5B,QAAQ,EAAE,qBAAqB;oBAC/B,QAAQ,EAAE,UAAU;oBACpB,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,+BAA+B,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,uBAAuB;oBAC9F,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,OAAO,OAAO,CAAC,OAAO,aAAa,OAAO,CAAC,WAAW,EAAE;oBACpE,KAAK,EAAE,4BAA4B;oBACnC,GAAG,EAAE,SAAS;oBACd,MAAM,EAAE,KAAK;oBACb,WAAW,EAAE;wBACX,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,MAAM,EAAE,OAAO,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,yCAAyC;wBACvF,KAAK,EAAE,OAAO,CAAC,OAAO;qBACvB;oBACD,YAAY,EAAE;wBACZ,WAAW,EACT,4LAA4L;wBAC9L,cAAc,EAAE,4CAA4C,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,2BAA2B,MAAM,cAAc;wBAC1I,eAAe,EAAE;4BACf,0CAA0C;4BAC1C,mCAAmC;4BACnC,yCAAyC;4BACzC,mDAAmD;4BACnD,4CAA4C;yBAC7C;qBACF;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,wCAAwC;IACxC,gFAAgF;IAEhF,gGAAgG;IAChG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC5D,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK;oBAAE,OAAO;gBAEnB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAE5B,4DAA4D;gBAC5D,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAEtD,IAAI,UAAU,EAAE,CAAC;oBACf,+DAA+D;oBAC/D,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC;oBAEnC,4BAA4B;oBAC5B,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;wBAClC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;wBAClC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAChC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;oBAE3D,gEAAgE;oBAChE,IAAI,CAAC,YAAY,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC3D,sBAAsB,CAAC,IAAI,CAAC,UAAU,YAAY,IAAI,UAAU,EAAE,CAAC,CAAC;wBAEpE,eAAe,CAAC,IAAI,CAClB,IAAA,mDAA6B,EAAC;4BAC5B,QAAQ,EAAE,qBAAqB;4BAC/B,QAAQ,EAAE,UAAU;4BACpB,UAAU,EAAE,MAAM;4BAClB,OAAO,EAAE,qCAAqC,YAAY,IAAI,UAAU,sCAAsC,WAAW,GAAG;4BAC5H,IAAI,EAAE,UAAU;4BAChB,UAAU,EAAE,YAAY,WAAW,oFAAoF;4BACvH,KAAK,EAAE,4BAA4B;4BACnC,GAAG,EAAE,SAAS;4BACd,MAAM,EAAE,KAAK;4BACb,WAAW,EAAE;gCACX,WAAW,EAAE,mBAAmB,YAAY,IAAI,UAAU,uBAAuB,WAAW,wGAAwG;gCACpM,MAAM,EAAE,GAAG,YAAY,IAAI,UAAU,gDAAgD;gCACrF,KAAK,EAAE,6KAA6K;6BACrL;4BACD,YAAY,EAAE;gCACZ,WAAW,EACT,gLAAgL;gCAClL,cAAc,EAAE,GAAG,YAAY,IAAI,UAAU,qCAAqC,WAAW,gBAAgB;gCAC7G,eAAe,EAAE;oCACf,2DAA2D;oCAC3D,qCAAqC;oCACrC,8CAA8C;oCAC9C,yCAAyC;oCACzC,+DAA+D;iCAChE;6BACF;yBACF,CAAC,CACH,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,4DAA4D;oBAC5D,oDAAoD;oBACpD,iEAAiE;oBACjE,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;wBACpE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;wBAChE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;oBAE9E,gFAAgF;oBAChF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;oBAEtG,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBACtB,4DAA4D;wBAC5D,uEAAuE;wBACvE,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;4BAC1D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;4BACrD,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;wBAEnF,IAAI,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;4BACxD,sBAAsB,CAAC,IAAI,CAAC,aAAa,YAAY,IAAI,UAAU,EAAE,CAAC,CAAC;4BAEvE,eAAe,CAAC,IAAI,CAClB,IAAA,mDAA6B,EAAC;gCAC5B,QAAQ,EAAE,qBAAqB;gCAC/B,QAAQ,EAAE,UAAU;gCACpB,UAAU,EAAE,MAAM;gCAClB,OAAO,EAAE,qCAAqC,YAAY,IAAI,UAAU,mCAAmC,YAAY,oBAAoB;gCAC3I,IAAI,EAAE,UAAU;gCAChB,UAAU,EAAE,YAAY,YAAY,4KAA4K,UAAU,MAAM;gCAChO,KAAK,EAAE,4BAA4B;gCACnC,GAAG,EAAE,SAAS;gCACd,MAAM,EAAE,KAAK;gCACb,WAAW,EAAE;oCACX,WAAW,EAAE,gBAAgB,YAAY,+LAA+L;oCACxO,MAAM,EAAE,sGAAsG;oCAC9G,KAAK,EAAE,qIAAqI;iCAC7I;gCACD,YAAY,EAAE;oCACZ,WAAW,EACT,uKAAuK;oCACzK,cAAc,EAAE,GAAG,YAAY,IAAI,UAAU,wCAAwC,YAAY,EAAE;oCACnG,eAAe,EAAE;wCACf,2CAA2C;wCAC3C,wCAAwC;wCACxC,qDAAqD;wCACrD,sDAAsD;wCACtD,+CAA+C;qCAChD;iCACF;6BACF,CAAC,CACH,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,2DAA2D;IAC3D,gFAAgF;IAEhF,MAAM,UAAU,GAA2C,EAAE,CAAC;IAE9D,2DAA2D;IAC3D,MAAM,kBAAkB,GAAG,IAAA,2DAAiC,EAAC,YAAY,CAAC,CAAC;IAC3E,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAA,mDAAyB,EAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,6CAA6C;IAC7C,MAAM,aAAa,GAAG,IAAA,+CAAqB,EAAC,KAAK,CAAC,CAAC;IACnD,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,qDAAqD;IACrD,MAAM,WAAW,GAAG,IAAA,sDAA4B,EAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,iDAAiD;IACjD,MAAM,eAAe,GAAG,IAAA,mDAAyB,EAAC,YAAY,CAAC,CAAC;IAChE,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,iEAAiE;IACjE,MAAM,0BAA0B,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAC5E,IAAI,0BAA0B,GAAG,CAAC,EAAE,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,qDAAqD;IACrD,MAAM,gBAAgB,GAAG,IAAA,sDAA4B,EAAC,YAAY,CAAC,CAAC;IACpE,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACzB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,8DAA8D;IAC9D,MAAM,iBAAiB,GAAG,IAAA,+DAAqC,EAAC,YAAY,CAAC,CAAC;IAC9E,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,gFAAgF;IAChF,iCAAiC;IACjC,gFAAgF;IAEhF,sDAAsD;IACtD,MAAM,eAAe,GAAG;QACtB,oBAAoB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gCAAgC,CAAC,EAAE,KAAK,IAAI,CAAC;QACnG,mBAAmB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,EAAE,KAAK,IAAI,CAAC;QACxF,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAAE,KAAK,IAAI,CAAC;QAChF,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,KAAK,IAAI,CAAC;QACxE,mBAAmB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,EAAE,KAAK,IAAI,CAAC;QACxF,gBAAgB,EAAE,CAAC,EAAE,uBAAuB;QAC5C,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,EAAE,KAAK,IAAI,CAAC;QAClF,mBAAmB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,EAAE,KAAK,IAAI,CAAC;KACzF,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,mDAAyB,EAAC,sBAAsB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAE7F,sDAAsD;IACtD,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,KAAK,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEtE,eAAe,CAAC,IAAI,CAClB,IAAA,mDAA6B,EAAC;YAC5B,QAAQ,EAAE,kBAAkB;YAC5B,QAAQ;YACR,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,WAAW,EAA+B;YAC5E,OAAO,EAAE,+BAA+B,UAAU,CAAC,UAAU,uBAAuB,UAAU,CAAC,cAAc,GAAG;YAChH,IAAI,EAAE,CAAC;YACP,UAAU,EAAE,+HAA+H;YAC3I,KAAK,EAAE,4BAA4B;YACnC,GAAG,EAAE,UAAU;YACf,MAAM,EAAE,KAAK;YACb,WAAW,EAAE;gBACX,WAAW,EACT,8MAA8M;gBAChN,MAAM,EAAE,qKAAqK;gBAC7K,KAAK,EAAE,oKAAoK;aAC5K;YACD,YAAY,EAAE;gBACZ,WAAW,EACT,uMAAuM;gBACzM,cAAc,EAAE,wBAAwB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACjF,eAAe,EAAE;oBACf,yCAAyC;oBACzC,oDAAoD;oBACpD,kDAAkD;oBAClD,iDAAiD;oBACjD,2CAA2C;iBAC5C;aACF;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,2BAA2B,CAAC,IAAY;IAC/C,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,sDAAsD;IACtD,MAAM,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;IAEvE,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;QACvC,uEAAuE;QACvE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAEzD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,KAAK,IAAI,CAAC,CAAC,CAAC,uDAAuD;QACrE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/lib/analyzers/go/security-checks/concurrency-safety.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Go Concurrency Safety Security Checks
+ * OWASP A04:2025 - Insecure Design
+ *
+ * Detects concurrency-related vulnerabilities in Go code including race conditions
+ * and goroutine leaks.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for concurrency safety issues
+ *
+ * Covers:
+ * - Check #1: Race conditions (unsynchronized variable access in concurrent contexts) (HIGH)
+ *   - Map access without mutex protection
+ *   - Slice modifications without synchronization
+ *   - Simple variable operations (counter++, assignments) without mutex/atomic
+ * - Check #2: Goroutine leaks (unclosed channels) (MEDIUM)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkConcurrencySafety(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=concurrency-safety.d.ts.map

package/dist/src/lib/analyzers/go/security-checks/concurrency-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency-safety.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/go/security-checks/concurrency-safety.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,qBAAqB,EAAE,CA2V/E"}