dartmind 17.0.0

package/dist/v10/security/VulnerabilityDetector.js

@@ -0,0 +1,841 @@
+/**
+ * FlutterAI v10 - Vulnerability Detector
+ *
+ * Detects common security vulnerabilities in code.
+ *
+ * Features:
+ * - SQL injection detection
+ * - XSS vulnerability detection
+ * - Path traversal detection
+ * - Command injection detection
+ * - Insecure crypto detection
+ * - Hardcoded credentials detection
+ * - CSRF vulnerability detection
+ * - Insecure deserialization detection
+ *
+ * @module v10/security/VulnerabilityDetector
+ */
+import { EventEmitter } from 'events';
+// ============================================================================
+// Constants
+// ============================================================================
+const SEVERITY_ORDER = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1,
+    info: 0
+};
+// ============================================================================
+// Default Patterns
+// ============================================================================
+const DEFAULT_PATTERNS = [
+    // SQL Injection
+    {
+        type: 'sql_injection',
+        severity: 'critical',
+        owasp: 'A03:2021-Injection',
+        title: 'Potential SQL Injection',
+        description: 'String concatenation in SQL query detected. Use parameterized queries instead.',
+        pattern: /(?:execute|query|raw)\s*\(\s*['"`]?\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\b[^)]*\+/i,
+        recommendation: 'Use parameterized queries or prepared statements instead of string concatenation.',
+        cweId: 'CWE-89',
+        confidence: 0.85,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    {
+        type: 'sql_injection',
+        severity: 'critical',
+        owasp: 'A03:2021-Injection',
+        title: 'SQL Query with Template Literal',
+        description: 'Template literal with variable interpolation in SQL query detected.',
+        pattern: /(?:execute|query|raw)\s*\(\s*`[^`]*\$\{[^}]+\}[^`]*`/i,
+        recommendation: 'Use parameterized queries instead of template literals with interpolation.',
+        cweId: 'CWE-89',
+        confidence: 0.9,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    {
+        type: 'sql_injection',
+        severity: 'high',
+        owasp: 'A03:2021-Injection',
+        title: 'Dynamic Table/Column Name',
+        description: 'Dynamic table or column name in SQL query may lead to injection.',
+        pattern: /(?:FROM|INTO|UPDATE|JOIN)\s+['"`]?\s*\+\s*\w+/i,
+        recommendation: 'Whitelist allowed table/column names instead of using dynamic values.',
+        cweId: 'CWE-89',
+        confidence: 0.7,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    // XSS
+    {
+        type: 'xss',
+        severity: 'high',
+        owasp: 'A03:2021-Injection',
+        title: 'innerHTML Assignment',
+        description: 'Direct innerHTML assignment may lead to XSS vulnerabilities.',
+        pattern: /\.innerHTML\s*=\s*(?!['"`]<)/,
+        recommendation: 'Use textContent or sanitize HTML before insertion.',
+        cweId: 'CWE-79',
+        confidence: 0.75,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    {
+        type: 'xss',
+        severity: 'high',
+        owasp: 'A03:2021-Injection',
+        title: 'document.write Usage',
+        description: 'document.write with dynamic content may lead to XSS.',
+        pattern: /document\.write\s*\([^)]*(?:\+|\$\{)/,
+        recommendation: 'Avoid document.write. Use DOM manipulation methods instead.',
+        cweId: 'CWE-79',
+        confidence: 0.8,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    {
+        type: 'xss',
+        severity: 'high',
+        owasp: 'A03:2021-Injection',
+        title: 'Dangerous React Pattern',
+        description: 'dangerouslySetInnerHTML without sanitization detected.',
+        pattern: /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:/,
+        recommendation: 'Sanitize HTML content before using dangerouslySetInnerHTML.',
+        cweId: 'CWE-79',
+        confidence: 0.7,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    {
+        type: 'xss',
+        severity: 'medium',
+        owasp: 'A03:2021-Injection',
+        title: 'eval() Usage',
+        description: 'eval() with dynamic content can lead to code injection.',
+        pattern: /\beval\s*\(\s*(?!\s*['"`])/,
+        recommendation: 'Avoid eval(). Use JSON.parse() for JSON or safer alternatives.',
+        cweId: 'CWE-95',
+        confidence: 0.85,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    // Path Traversal
+    {
+        type: 'path_traversal',
+        severity: 'high',
+        owasp: 'A01:2021-Broken Access Control',
+        title: 'Path Traversal Risk',
+        description: 'User input directly used in file path without validation.',
+        pattern: /(?:readFile|writeFile|unlink|rmdir|mkdir|readdir|stat|access)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/,
+        recommendation: 'Validate and sanitize file paths. Use path.resolve() and verify within allowed directory.',
+        cweId: 'CWE-22',
+        confidence: 0.8,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    {
+        type: 'path_traversal',
+        severity: 'high',
+        owasp: 'A01:2021-Broken Access Control',
+        title: 'Unchecked Path Join',
+        description: 'path.join with user input may allow traversal.',
+        pattern: /path\.join\s*\([^)]*(?:req\.|params\.|query\.|body\.)/,
+        recommendation: 'Validate the resulting path is within the intended directory.',
+        cweId: 'CWE-22',
+        confidence: 0.7,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    // Command Injection
+    {
+        type: 'command_injection',
+        severity: 'critical',
+        owasp: 'A03:2021-Injection',
+        title: 'Command Injection Risk',
+        description: 'User input in shell command execution detected.',
+        pattern: /(?:exec|spawn|execSync|spawnSync)\s*\([^)]*(?:\+|\$\{|req\.|params\.|query\.|body\.)/,
+        recommendation: 'Use execFile/spawnSync with arguments array. Never interpolate user input into commands.',
+        cweId: 'CWE-78',
+        confidence: 0.9,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    {
+        type: 'command_injection',
+        severity: 'critical',
+        owasp: 'A03:2021-Injection',
+        title: 'Shell Command with Template',
+        description: 'Shell command constructed with template literal.',
+        pattern: /(?:exec|execSync)\s*\(\s*`[^`]*\$\{/,
+        recommendation: 'Use execFile with arguments array instead of shell commands.',
+        cweId: 'CWE-78',
+        confidence: 0.95,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    // Insecure Crypto
+    {
+        type: 'insecure_crypto',
+        severity: 'high',
+        owasp: 'A02:2021-Cryptographic Failures',
+        title: 'Weak Hash Algorithm (MD5)',
+        description: 'MD5 is cryptographically broken and should not be used for security.',
+        pattern: /(?:createHash|crypto\.hash)\s*\(\s*['"`]md5['"`]/i,
+        recommendation: 'Use SHA-256 or stronger hash algorithms.',
+        cweId: 'CWE-328',
+        confidence: 0.95,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    {
+        type: 'insecure_crypto',
+        severity: 'high',
+        owasp: 'A02:2021-Cryptographic Failures',
+        title: 'Weak Hash Algorithm (SHA1)',
+        description: 'SHA1 is deprecated for security purposes.',
+        pattern: /(?:createHash|crypto\.hash)\s*\(\s*['"`]sha1['"`]/i,
+        recommendation: 'Use SHA-256 or stronger hash algorithms.',
+        cweId: 'CWE-328',
+        confidence: 0.9,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    {
+        type: 'insecure_crypto',
+        severity: 'critical',
+        owasp: 'A02:2021-Cryptographic Failures',
+        title: 'Weak Encryption (DES)',
+        description: 'DES encryption is insecure and should not be used.',
+        pattern: /(?:createCipher|createDecipher)\s*\(\s*['"`](?:des|des-ecb|des-cbc)['"`]/i,
+        recommendation: 'Use AES-256-GCM or other modern encryption algorithms.',
+        cweId: 'CWE-327',
+        confidence: 0.95,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    {
+        type: 'insecure_crypto',
+        severity: 'high',
+        owasp: 'A02:2021-Cryptographic Failures',
+        title: 'ECB Mode Encryption',
+        description: 'ECB mode is insecure as identical plaintext blocks produce identical ciphertext.',
+        pattern: /(?:createCipher|createDecipher)\s*\(\s*['"`][^'"`]*-ecb['"`]/i,
+        recommendation: 'Use GCM or CBC mode with proper IV/nonce handling.',
+        cweId: 'CWE-327',
+        confidence: 0.9,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    // Insecure Random
+    {
+        type: 'insecure_random',
+        severity: 'medium',
+        owasp: 'A02:2021-Cryptographic Failures',
+        title: 'Insecure Random Number Generator',
+        description: 'Math.random() is not cryptographically secure.',
+        pattern: /Math\.random\s*\(\s*\)/,
+        recommendation: 'Use crypto.randomBytes() or crypto.randomUUID() for security-sensitive operations.',
+        cweId: 'CWE-338',
+        confidence: 0.6,
+        falsePositiveLikelihood: 'high',
+        enabled: true
+    },
+    // Hardcoded Credentials
+    {
+        type: 'hardcoded_credentials',
+        severity: 'high',
+        owasp: 'A07:2021-Auth Failures',
+        title: 'Hardcoded Password',
+        description: 'Hardcoded password detected in code.',
+        pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"`][^'"`]{4,}['"`]/i,
+        recommendation: 'Use environment variables or secure secret management.',
+        cweId: 'CWE-798',
+        confidence: 0.7,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    {
+        type: 'hardcoded_credentials',
+        severity: 'high',
+        owasp: 'A07:2021-Auth Failures',
+        title: 'Hardcoded Secret',
+        description: 'Hardcoded secret or key detected.',
+        pattern: /(?:secret|apikey|api_key)\s*[:=]\s*['"`][^'"`]{8,}['"`]/i,
+        recommendation: 'Use environment variables or secure secret management.',
+        cweId: 'CWE-798',
+        confidence: 0.75,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    // CSRF
+    {
+        type: 'csrf',
+        severity: 'medium',
+        owasp: 'A01:2021-Broken Access Control',
+        title: 'Missing CSRF Protection',
+        description: 'Form submission without CSRF token detected.',
+        pattern: /<form[^>]*method\s*=\s*['"]?post['"]?[^>]*>(?:(?!csrf|_token|authenticity).)*<\/form>/is,
+        recommendation: 'Include CSRF tokens in all state-changing forms.',
+        cweId: 'CWE-352',
+        confidence: 0.5,
+        falsePositiveLikelihood: 'high',
+        enabled: true
+    },
+    // Open Redirect
+    {
+        type: 'open_redirect',
+        severity: 'medium',
+        owasp: 'A01:2021-Broken Access Control',
+        title: 'Open Redirect Vulnerability',
+        description: 'Redirect with user-controlled URL detected.',
+        pattern: /(?:redirect|location\.href|window\.location)\s*(?:=|\()\s*(?:req\.|params\.|query\.|body\.)/,
+        recommendation: 'Validate redirect URLs against a whitelist of allowed destinations.',
+        cweId: 'CWE-601',
+        confidence: 0.8,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    // SSRF
+    {
+        type: 'ssrf',
+        severity: 'high',
+        owasp: 'A10:2021-SSRF',
+        title: 'Server-Side Request Forgery Risk',
+        description: 'User input in URL for server-side request detected.',
+        pattern: /(?:fetch|axios|request|http\.get|https\.get)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/,
+        recommendation: 'Validate and whitelist allowed URLs. Block internal network addresses.',
+        cweId: 'CWE-918',
+        confidence: 0.75,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    // XXE
+    {
+        type: 'xxe',
+        severity: 'high',
+        owasp: 'A05:2021-Security Misconfiguration',
+        title: 'XML External Entity Risk',
+        description: 'XML parser without entity resolution disabled.',
+        pattern: /(?:parseString|parseXml|DOMParser)\s*\([^)]*\)(?:(?!noent|resolveEntities\s*:\s*false).)*$/,
+        recommendation: 'Disable external entity processing in XML parsers.',
+        cweId: 'CWE-611',
+        confidence: 0.6,
+        falsePositiveLikelihood: 'high',
+        enabled: true
+    },
+    // Insecure Deserialization
+    {
+        type: 'insecure_deserialization',
+        severity: 'critical',
+        owasp: 'A08:2021-Data Integrity Failures',
+        title: 'Insecure Deserialization',
+        description: 'Deserializing untrusted data without validation.',
+        pattern: /(?:deserialize|unserialize|pickle\.loads|yaml\.load)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/,
+        recommendation: 'Validate and sanitize data before deserialization. Use safe loading modes.',
+        cweId: 'CWE-502',
+        confidence: 0.85,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    // Sensitive Data Exposure
+    {
+        type: 'sensitive_data_exposure',
+        severity: 'medium',
+        owasp: 'A02:2021-Cryptographic Failures',
+        title: 'Sensitive Data in Logs',
+        description: 'Potentially sensitive data being logged.',
+        pattern: /(?:console\.log|logger\.\w+)\s*\([^)]*(?:password|token|secret|credit|ssn|card)/i,
+        recommendation: 'Remove or mask sensitive data before logging.',
+        cweId: 'CWE-532',
+        confidence: 0.7,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    },
+    {
+        type: 'sensitive_data_exposure',
+        severity: 'medium',
+        owasp: 'A02:2021-Cryptographic Failures',
+        title: 'HTTP for Sensitive Data',
+        description: 'HTTP (not HTTPS) URL detected for potentially sensitive endpoint.',
+        pattern: /['"`]http:\/\/[^'"`]*(?:login|auth|payment|api|admin)/i,
+        recommendation: 'Always use HTTPS for sensitive communications.',
+        cweId: 'CWE-319',
+        confidence: 0.8,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    // Broken Authentication
+    {
+        type: 'broken_auth',
+        severity: 'high',
+        owasp: 'A07:2021-Auth Failures',
+        title: 'JWT Without Verification',
+        description: 'JWT decoded without signature verification.',
+        pattern: /jwt\.decode\s*\([^)]*,\s*\{\s*(?:complete\s*:\s*true|verify\s*:\s*false)/,
+        recommendation: 'Always verify JWT signatures using jwt.verify().',
+        cweId: 'CWE-347',
+        confidence: 0.9,
+        falsePositiveLikelihood: 'low',
+        enabled: true
+    },
+    {
+        type: 'broken_auth',
+        severity: 'medium',
+        owasp: 'A07:2021-Auth Failures',
+        title: 'Weak Password Requirement',
+        description: 'Password validation allows weak passwords.',
+        pattern: /password.*\.length\s*[<>=]+\s*[1-5]\b/i,
+        recommendation: 'Require passwords of at least 8 characters with complexity requirements.',
+        cweId: 'CWE-521',
+        confidence: 0.6,
+        falsePositiveLikelihood: 'medium',
+        enabled: true
+    }
+];
+// ============================================================================
+// VulnerabilityDetector Class
+// ============================================================================
+/**
+ * Security vulnerability detector
+ *
+ * @example
+ * ```typescript
+ * const detector = new VulnerabilityDetector();
+ *
+ * const result = detector.scan(code, { file: 'app.js' });
+ * console.log(`Found ${result.findings.length} vulnerabilities`);
+ *
+ * for (const finding of result.findings) {
+ *   console.log(`${finding.severity}: ${finding.title}`);
+ *   console.log(`  Location: ${finding.location.snippet}`);
+ *   console.log(`  Fix: ${finding.recommendation}`);
+ * }
+ * ```
+ */
+export class VulnerabilityDetector extends EventEmitter {
+    patterns = new Map();
+    config;
+    findingCounter = 0;
+    constructor(config = {}) {
+        super();
+        this.config = {
+            enabledTypes: config.enabledTypes || [],
+            minSeverity: config.minSeverity || 'low',
+            maxFindingsPerFile: config.maxFindingsPerFile || 100,
+            includeInfo: config.includeInfo ?? false,
+            customPatterns: config.customPatterns || []
+        };
+        this.initializePatterns();
+    }
+    // --------------------------------------------------------------------------
+    // Initialization
+    // --------------------------------------------------------------------------
+    /**
+     * Initialize default patterns
+     */
+    initializePatterns() {
+        // Add default patterns
+        for (const pattern of DEFAULT_PATTERNS) {
+            const id = `vuln_${this.patterns.size + 1}`;
+            this.patterns.set(id, { ...pattern, id });
+        }
+        // Add custom patterns
+        for (const pattern of this.config.customPatterns) {
+            this.patterns.set(pattern.id, pattern);
+        }
+    }
+    // --------------------------------------------------------------------------
+    // Scanning
+    // --------------------------------------------------------------------------
+    /**
+     * Scan content for vulnerabilities
+     */
+    scan(content, options = {}) {
+        const startTime = Date.now();
+        const findings = [];
+        const lines = content.split('\n');
+        let patternsChecked = 0;
+        this.emit('event', {
+            type: 'scan_started',
+            timestamp: Date.now()
+        });
+        // Get applicable patterns
+        const patterns = this.getApplicablePatterns(options);
+        patternsChecked = patterns.length;
+        // Scan each line
+        for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+            const line = lines[lineNum];
+            // Skip comments and empty lines
+            if (this.isCommentOrEmpty(line)) {
+                continue;
+            }
+            // Check against each pattern
+            for (const pattern of patterns) {
+                if (pattern.pattern.test(line)) {
+                    const finding = this.createFinding(pattern, line, lineNum + 1, options.file);
+                    findings.push(finding);
+                    this.emit('event', {
+                        type: 'vulnerability_found',
+                        timestamp: Date.now(),
+                        finding
+                    });
+                    // Check max findings
+                    if (findings.length >= (options.maxFindings || this.config.maxFindingsPerFile)) {
+                        break;
+                    }
+                }
+            }
+            if (findings.length >= (options.maxFindings || this.config.maxFindingsPerFile)) {
+                break;
+            }
+        }
+        // Also scan multi-line patterns
+        const multilineFindings = this.scanMultiline(content, patterns, options);
+        findings.push(...multilineFindings);
+        // Sort by severity
+        findings.sort((a, b) => SEVERITY_ORDER[b.severity] - SEVERITY_ORDER[a.severity]);
+        const result = {
+            file: options.file,
+            findings: findings.slice(0, options.maxFindings || this.config.maxFindingsPerFile),
+            scannedAt: Date.now(),
+            duration: Date.now() - startTime,
+            linesScanned: lines.length,
+            patternsChecked
+        };
+        this.emit('event', {
+            type: 'scan_completed',
+            timestamp: Date.now(),
+            result
+        });
+        return result;
+    }
+    /**
+     * Scan multiple files
+     */
+    scanMany(files, options = {}) {
+        const startTime = Date.now();
+        const results = new Map();
+        let totalFindings = 0;
+        let criticalCount = 0;
+        let highCount = 0;
+        let mediumCount = 0;
+        let lowCount = 0;
+        let infoCount = 0;
+        for (const [file, content] of files) {
+            const result = this.scan(content, { ...options, file });
+            results.set(file, result);
+            totalFindings += result.findings.length;
+            for (const finding of result.findings) {
+                switch (finding.severity) {
+                    case 'critical':
+                        criticalCount++;
+                        break;
+                    case 'high':
+                        highCount++;
+                        break;
+                    case 'medium':
+                        mediumCount++;
+                        break;
+                    case 'low':
+                        lowCount++;
+                        break;
+                    case 'info':
+                        infoCount++;
+                        break;
+                }
+            }
+        }
+        return {
+            files: results,
+            totalFindings,
+            criticalCount,
+            highCount,
+            mediumCount,
+            lowCount,
+            infoCount,
+            scannedAt: Date.now(),
+            duration: Date.now() - startTime
+        };
+    }
+    /**
+     * Quick check if content has vulnerabilities
+     */
+    hasVulnerabilities(content, options = {}) {
+        const result = this.scan(content, { ...options, maxFindings: 1 });
+        return result.findings.length > 0;
+    }
+    /**
+     * Get vulnerabilities by severity
+     */
+    scanBySeverity(content, severity, options = {}) {
+        const result = this.scan(content, { ...options, minSeverity: severity });
+        return result.findings.filter(f => f.severity === severity);
+    }
+    /**
+     * Get vulnerabilities by type
+     */
+    scanByType(content, type, options = {}) {
+        const result = this.scan(content, { ...options, types: [type] });
+        return result.findings;
+    }
+    // --------------------------------------------------------------------------
+    // Pattern Management
+    // --------------------------------------------------------------------------
+    /**
+     * Add custom pattern
+     */
+    addPattern(pattern) {
+        this.patterns.set(pattern.id, pattern);
+        this.emit('event', {
+            type: 'pattern_added',
+            timestamp: Date.now(),
+            pattern
+        });
+    }
+    /**
+     * Remove pattern
+     */
+    removePattern(patternId) {
+        return this.patterns.delete(patternId);
+    }
+    /**
+     * Enable pattern
+     */
+    enablePattern(patternId) {
+        const pattern = this.patterns.get(patternId);
+        if (pattern) {
+            pattern.enabled = true;
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Disable pattern
+     */
+    disablePattern(patternId) {
+        const pattern = this.patterns.get(patternId);
+        if (pattern) {
+            pattern.enabled = false;
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Get all patterns
+     */
+    getPatterns() {
+        return Array.from(this.patterns.values());
+    }
+    /**
+     * Get patterns by type
+     */
+    getPatternsByType(type) {
+        return Array.from(this.patterns.values()).filter(p => p.type === type);
+    }
+    // --------------------------------------------------------------------------
+    // Analysis
+    // --------------------------------------------------------------------------
+    /**
+     * Get vulnerability summary
+     */
+    getSummary(result) {
+        const bySeverity = {
+            critical: 0,
+            high: 0,
+            medium: 0,
+            low: 0,
+            info: 0
+        };
+        const byType = {};
+        const byOwasp = {};
+        for (const finding of result.findings) {
+            bySeverity[finding.severity]++;
+            byType[finding.type] = (byType[finding.type] || 0) + 1;
+            byOwasp[finding.owasp] = (byOwasp[finding.owasp] || 0) + 1;
+        }
+        // Calculate risk score (0-100)
+        const riskScore = Math.min(100, bySeverity.critical * 25 +
+            bySeverity.high * 10 +
+            bySeverity.medium * 5 +
+            bySeverity.low * 2 +
+            bySeverity.info * 0.5);
+        return {
+            total: result.findings.length,
+            bySeverity,
+            byType,
+            byOwasp,
+            riskScore
+        };
+    }
+    /**
+     * Generate report
+     */
+    generateReport(result) {
+        const summary = this.getSummary(result);
+        const lines = [];
+        lines.push('# Security Vulnerability Report');
+        lines.push('');
+        lines.push(`Scanned: ${result.file || 'inline content'}`);
+        lines.push(`Date: ${new Date(result.scannedAt).toISOString()}`);
+        lines.push(`Duration: ${result.duration}ms`);
+        lines.push(`Lines scanned: ${result.linesScanned}`);
+        lines.push('');
+        lines.push('## Summary');
+        lines.push('');
+        lines.push(`Total findings: ${summary.total}`);
+        lines.push(`Risk score: ${summary.riskScore}/100`);
+        lines.push('');
+        lines.push('### By Severity');
+        lines.push(`- Critical: ${summary.bySeverity.critical}`);
+        lines.push(`- High: ${summary.bySeverity.high}`);
+        lines.push(`- Medium: ${summary.bySeverity.medium}`);
+        lines.push(`- Low: ${summary.bySeverity.low}`);
+        lines.push(`- Info: ${summary.bySeverity.info}`);
+        lines.push('');
+        if (result.findings.length > 0) {
+            lines.push('## Findings');
+            lines.push('');
+            for (const finding of result.findings) {
+                lines.push(`### ${finding.severity.toUpperCase()}: ${finding.title}`);
+                lines.push('');
+                lines.push(`**Type:** ${finding.type}`);
+                lines.push(`**OWASP:** ${finding.owasp}`);
+                if (finding.cweId) {
+                    lines.push(`**CWE:** ${finding.cweId}`);
+                }
+                lines.push(`**Confidence:** ${Math.round(finding.confidence * 100)}%`);
+                lines.push('');
+                lines.push('**Description:**');
+                lines.push(finding.description);
+                lines.push('');
+                lines.push('**Location:**');
+                lines.push('```');
+                if (finding.location.line) {
+                    lines.push(`Line ${finding.location.line}: ${finding.location.snippet}`);
+                }
+                else {
+                    lines.push(finding.location.snippet);
+                }
+                lines.push('```');
+                lines.push('');
+                lines.push('**Recommendation:**');
+                lines.push(finding.recommendation);
+                lines.push('');
+                lines.push('---');
+                lines.push('');
+            }
+        }
+        return lines.join('\n');
+    }
+    // --------------------------------------------------------------------------
+    // Private Methods
+    // --------------------------------------------------------------------------
+    /**
+     * Get applicable patterns based on options
+     */
+    getApplicablePatterns(options) {
+        return Array.from(this.patterns.values()).filter(pattern => {
+            // Check if enabled
+            if (!pattern.enabled) {
+                return false;
+            }
+            // Check type filter
+            if (options.types && options.types.length > 0) {
+                if (!options.types.includes(pattern.type)) {
+                    return false;
+                }
+            }
+            // Check enabled types from config
+            if (this.config.enabledTypes.length > 0) {
+                if (!this.config.enabledTypes.includes(pattern.type)) {
+                    return false;
+                }
+            }
+            // Check severity filter
+            const minSeverity = options.minSeverity || this.config.minSeverity;
+            if (SEVERITY_ORDER[pattern.severity] < SEVERITY_ORDER[minSeverity]) {
+                return false;
+            }
+            // Check info inclusion
+            if (pattern.severity === 'info' && !options.includeInfo && !this.config.includeInfo) {
+                return false;
+            }
+            // Check language filter
+            if (options.languages && pattern.languages) {
+                const hasMatch = options.languages.some(lang => pattern.languages.includes(lang));
+                if (!hasMatch) {
+                    return false;
+                }
+            }
+            return true;
+        });
+    }
+    /**
+     * Check if line is comment or empty
+     */
+    isCommentOrEmpty(line) {
+        const trimmed = line.trim();
+        return (trimmed === '' ||
+            trimmed.startsWith('//') ||
+            trimmed.startsWith('#') ||
+            trimmed.startsWith('*') ||
+            trimmed.startsWith('/*') ||
+            trimmed.startsWith('<!--'));
+    }
+    /**
+     * Create finding from pattern match
+     */
+    createFinding(pattern, snippet, line, file) {
+        return {
+            id: `finding_${++this.findingCounter}`,
+            type: pattern.type,
+            severity: pattern.severity,
+            owasp: pattern.owasp,
+            title: pattern.title,
+            description: pattern.description,
+            location: {
+                file,
+                line,
+                snippet: snippet.trim().substring(0, 200)
+            },
+            recommendation: pattern.recommendation,
+            cweId: pattern.cweId,
+            confidence: pattern.confidence,
+            falsePositiveLikelihood: pattern.falsePositiveLikelihood,
+            timestamp: Date.now()
+        };
+    }
+    /**
+     * Scan for multi-line patterns
+     */
+    scanMultiline(content, patterns, options) {
+        const findings = [];
+        // Only check patterns that make sense for multi-line
+        const multilinePatterns = patterns.filter(p => p.type === 'csrf' || p.type === 'xxe');
+        for (const pattern of multilinePatterns) {
+            const matches = content.match(pattern.pattern);
+            if (matches) {
+                for (const match of matches) {
+                    const finding = this.createFinding(pattern, match.substring(0, 100), undefined, options.file);
+                    findings.push(finding);
+                }
+            }
+        }
+        return findings;
+    }
+    // --------------------------------------------------------------------------
+    // Lifecycle
+    // --------------------------------------------------------------------------
+    /**
+     * Shutdown detector
+     */
+    shutdown() {
+        this.removeAllListeners();
+        this.patterns.clear();
+    }
+}
+//# sourceMappingURL=VulnerabilityDetector.js.map