eslint-plugin-secure-coding 1.0.0

package/src/rules/security/no-privilege-escalation.js

@@ -0,0 +1,321 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noPrivilegeEscalation = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+/**
+ * Common role check patterns
+ */
+const DEFAULT_ROLE_CHECK_PATTERNS = [
+    'hasRole',
+    'checkRole',
+    'isAdmin',
+    'isAuthorized',
+    'hasPermission',
+    'checkPermission',
+    'verifyRole',
+    'requireRole',
+];
+/**
+ * Common user input patterns
+ */
+const DEFAULT_USER_INPUT_PATTERNS = [
+    /\breq\.(body|query|params)\b/,
+    /\brequest\.(body|query|params)\b/,
+    /\buserInput\b/,
+    /\binput\b/,
+];
+/**
+ * Check if a string matches any ignore pattern
+ */
+function matchesIgnorePattern(text, patterns) {
+    return patterns.some(pattern => {
+        try {
+            const regex = new RegExp(pattern, 'i');
+            return regex.test(text);
+        }
+        catch {
+            // Invalid regex - treat as literal string match
+            return text.toLowerCase().includes(pattern.toLowerCase());
+        }
+    });
+}
+/**
+ * Check if a node contains user input patterns
+ */
+function containsUserInput(node, sourceCode, userInputPatterns) {
+    const text = sourceCode.getText(node);
+    return userInputPatterns.some(pattern => pattern.test(text));
+}
+/**
+ * Check if a node is inside a role check call
+ */
+function isInsideRoleCheck(node, sourceCode, roleCheckPatterns) {
+    let current = node;
+    while (current) {
+        // Check if current is inside an IfStatement with role check in condition
+        if (current.parent && current.parent.type === 'IfStatement') {
+            const ifStmt = current.parent;
+            const conditionText = sourceCode.getText(ifStmt.test);
+            // Check if condition contains role check patterns
+            if (roleCheckPatterns.some(pattern => conditionText.toLowerCase().includes(pattern.toLowerCase()))) {
+                return true;
+            }
+            /* c8 ignore start -- redundant check: conditionText pattern match above catches these cases first */
+            // Check if condition is a CallExpression with role check
+            if (ifStmt.test.type === 'CallExpression') {
+                const callExpr = ifStmt.test;
+                const callee = callExpr.callee;
+                if (callee.type === 'Identifier') {
+                    const calleeName = callee.name.toLowerCase();
+                    if (roleCheckPatterns.some(pattern => calleeName.includes(pattern.toLowerCase()))) {
+                        return true;
+                    }
+                }
+                if (callee.type === 'MemberExpression' && callee.property.type === 'Identifier') {
+                    const propertyName = callee.property.name.toLowerCase();
+                    if (roleCheckPatterns.some(pattern => propertyName.includes(pattern.toLowerCase()))) {
+                        return true;
+                    }
+                }
+            }
+            /* c8 ignore stop */
+        }
+        // Check if current is inside a ConditionalExpression (ternary) with role check
+        if (current.parent && current.parent.type === 'ConditionalExpression') {
+            const condExpr = current.parent;
+            const testText = sourceCode.getText(condExpr.test);
+            // Check if test contains role check patterns
+            if (roleCheckPatterns.some(pattern => testText.toLowerCase().includes(pattern.toLowerCase()))) {
+                return true;
+            }
+            /* c8 ignore start -- redundant check: testText pattern match above catches these cases first */
+            // Check if test is a CallExpression with role check
+            if (condExpr.test.type === 'CallExpression') {
+                const callExpr = condExpr.test;
+                const callee = callExpr.callee;
+                if (callee.type === 'Identifier') {
+                    const calleeName = callee.name.toLowerCase();
+                    if (roleCheckPatterns.some(pattern => calleeName.includes(pattern.toLowerCase()))) {
+                        return true;
+                    }
+                }
+            }
+            /* c8 ignore stop */
+        }
+        // Check if current is inside a CallExpression with role check
+        if (current.parent && current.parent.type === 'CallExpression') {
+            const callExpr = current.parent;
+            const callee = callExpr.callee;
+            if (callee.type === 'Identifier') {
+                const calleeName = callee.name.toLowerCase();
+                if (roleCheckPatterns.some(pattern => calleeName.includes(pattern.toLowerCase()))) {
+                    return true;
+                }
+            }
+            if (callee.type === 'MemberExpression' && callee.property.type === 'Identifier') {
+                const propertyName = callee.property.name.toLowerCase();
+                if (roleCheckPatterns.some(pattern => propertyName.includes(pattern.toLowerCase()))) {
+                    return true;
+                }
+            }
+        }
+        // Traverse up the AST
+        if ('parent' in current && current.parent) {
+            current = current.parent;
+        }
+        else {
+            break;
+        }
+    }
+    return false;
+}
+exports.noPrivilegeEscalation = (0, eslint_devkit_2.createRule)({
+    name: 'no-privilege-escalation',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects potential privilege escalation vulnerabilities',
+        },
+        hasSuggestions: true,
+        messages: {
+            privilegeEscalation: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Privilege Escalation',
+                cwe: 'CWE-269',
+                description: 'Potential privilege escalation: {{issue}} - user input used without role validation',
+                severity: 'HIGH',
+                fix: 'Add role check before using user input: if (!hasRole(user, requiredRole)) throw new Error("Unauthorized");',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/269.html',
+            }),
+            addRoleCheck: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Add Role Check',
+                description: 'Add role check before privilege operations',
+                severity: 'LOW',
+                fix: 'if (!hasRole(user, requiredRole)) throw new Error("Unauthorized")',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/269.html',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowInTests: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow privilege escalation patterns in test files',
+                    },
+                    testFilePattern: {
+                        type: 'string',
+                        default: '\\.(test|spec)\\.(ts|tsx|js|jsx)$',
+                        description: 'Test file pattern regex string',
+                    },
+                    roleCheckPatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: DEFAULT_ROLE_CHECK_PATTERNS,
+                        description: 'Role check patterns to recognize',
+                    },
+                    userInputPatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional user input patterns to check (regex strings)',
+                    },
+                    ignorePatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional patterns to ignore',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowInTests: false,
+            testFilePattern: '\\.(test|spec)\\.(ts|tsx|js|jsx)$',
+            roleCheckPatterns: DEFAULT_ROLE_CHECK_PATTERNS,
+            userInputPatterns: [],
+            ignorePatterns: [],
+        },
+    ],
+    create(context, [options = {}]) {
+        const { allowInTests = false, testFilePattern = '\\.(test|spec)\\.(ts|tsx|js|jsx)$', roleCheckPatterns = DEFAULT_ROLE_CHECK_PATTERNS, userInputPatterns: additionalUserInputPatterns = [], ignorePatterns = [], } = options;
+        const filename = context.getFilename();
+        const testFileRegex = new RegExp(testFilePattern);
+        const isTestFile = allowInTests && testFileRegex.test(filename);
+        const sourceCode = context.sourceCode || context.sourceCode;
+        // Combine default and additional user input patterns
+        const userInputPatterns = [
+            ...DEFAULT_USER_INPUT_PATTERNS,
+            ...additionalUserInputPatterns.map(pattern => new RegExp(pattern, 'i')),
+        ];
+        /**
+         * Check AssignmentExpression for privilege escalation
+         */
+        function checkAssignmentExpression(node) {
+            if (isTestFile) {
+                return;
+            }
+            // Check for role assignment from user input
+            // Pattern: user.role = req.body.role
+            if (node.left.type === 'MemberExpression' &&
+                node.left.property.type === 'Identifier') {
+                const propertyName = node.left.property.name.toLowerCase();
+                // Check if it's a role/permission related property
+                if (['role', 'permission', 'privilege', 'access', 'level'].includes(propertyName)) {
+                    const text = sourceCode.getText(node);
+                    // Check if it matches any ignore pattern
+                    if (matchesIgnorePattern(text, ignorePatterns)) {
+                        return;
+                    }
+                    // Check if right side contains user input
+                    if (containsUserInput(node.right, sourceCode, userInputPatterns)) {
+                        // Check if it's inside a role check
+                        if (!isInsideRoleCheck(node, sourceCode, roleCheckPatterns)) {
+                            context.report({
+                                node: node,
+                                messageId: 'privilegeEscalation',
+                                data: {
+                                    issue: `Role assignment from user input: ${sourceCode.getText(node.left)} = ${sourceCode.getText(node.right)}`,
+                                },
+                                suggest: [
+                                    {
+                                        messageId: 'addRoleCheck',
+                                        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                                        fix: (_fixer) => null,
+                                    },
+                                ],
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        /**
+         * Check CallExpression for privilege operations with user input
+         */
+        function checkCallExpression(node) {
+            if (isTestFile) {
+                return;
+            }
+            // Check for privilege-related function calls with user input
+            const callee = node.callee;
+            let isPrivilegeOperation = false;
+            let operationName = '';
+            if (callee.type === 'Identifier') {
+                const calleeName = callee.name.toLowerCase();
+                if (['setrole', 'grant', 'revoke', 'elevate', 'promote'].some(op => calleeName.includes(op))) {
+                    isPrivilegeOperation = true;
+                    operationName = callee.name;
+                }
+            }
+            if (callee.type === 'MemberExpression' && callee.property.type === 'Identifier') {
+                const propertyName = callee.property.name.toLowerCase();
+                if (['setrole', 'grant', 'revoke', 'elevate', 'promote', 'updaterole'].some(op => propertyName.includes(op))) {
+                    isPrivilegeOperation = true;
+                    operationName = propertyName;
+                }
+            }
+            if (isPrivilegeOperation) {
+                const text = sourceCode.getText(node);
+                // Check if it matches any ignore pattern
+                if (matchesIgnorePattern(text, ignorePatterns)) {
+                    return;
+                }
+                // Check if any argument contains user input
+                for (const arg of node.arguments) {
+                    if (containsUserInput(arg, sourceCode, userInputPatterns)) {
+                        // Check if it's inside a role check
+                        if (!isInsideRoleCheck(node, sourceCode, roleCheckPatterns)) {
+                            context.report({
+                                node: node,
+                                messageId: 'privilegeEscalation',
+                                data: {
+                                    issue: `Privilege operation (${operationName}) with user input without role validation`,
+                                },
+                                suggest: [
+                                    {
+                                        messageId: 'addRoleCheck',
+                                        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                                        fix: (_fixer) => null,
+                                    },
+                                ],
+                            });
+                            return; // Report once per call
+                        }
+                    }
+                }
+            }
+        }
+        return {
+            AssignmentExpression: checkAssignmentExpression,
+            CallExpression: checkCallExpression,
+        };
+    },
+});
+//# sourceMappingURL=no-privilege-escalation.js.map

package/src/rules/security/no-privilege-escalation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-privilege-escalation.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/no-privilege-escalation.ts"],"names":[],"mappings":";;;AASA,4DAA0E;AAC1E,4DAAsD;AAuBtD;;GAEG;AACH,MAAM,2BAA2B,GAAG;IAClC,SAAS;IACT,WAAW;IACX,SAAS;IACT,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,YAAY;IACZ,aAAa;CACd,CAAC;AAEF;;GAEG;AACH,MAAM,2BAA2B,GAAG;IAClC,8BAA8B;IAC9B,kCAAkC;IAClC,eAAe;IACf,WAAW;CACZ,CAAC;AAEF;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAAkB;IAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,IAAmB,EACnB,UAA+B,EAC/B,iBAA2B;IAE3B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,IAAmB,EACnB,UAA+B,EAC/B,iBAA2B;IAE3B,IAAI,OAAO,GAAyB,IAAI,CAAC;IAEzC,OAAO,OAAO,EAAE,CAAC;QACf,yEAAyE;QACzE,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAA8B,CAAC;YACtD,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAEtD,kDAAkD;YAClD,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACnC,aAAa,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAC5D,EAAE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qGAAqG;YACrG,yDAAyD;YACzD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAE/B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC7C,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;wBAClF,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAED,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAChF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACxD,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;wBACpF,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YACD,oBAAoB;QACtB,CAAC;QAED,+EAA+E;QAC/E,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAwC,CAAC;YAClE,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAEnD,6CAA6C;YAC7C,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACnC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CACvD,EAAE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gGAAgG;YAChG,oDAAoD;YACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAE/B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC7C,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;wBAClF,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YACD,oBAAoB;QACtB,CAAC;QAED,8DAA8D;QAC9D,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAiC,CAAC;YAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAE/B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7C,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;oBAClF,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxD,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;oBACpF,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,qBAAqB,GAAG,IAAA,0BAAU,EAA0B;IACvE,IAAI,EAAE,yBAAyB;IAC/B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,wDAAwD;SACtE;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,sBAAsB;gBACjC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,qFAAqF;gBAClG,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,4GAA4G;gBACjH,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,WAAW,EAAE,4CAA4C;gBACzD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mEAAmE;gBACxE,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,mDAAmD;qBACjE;oBACD,eAAe,EAAE;wBACf,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,mCAAmC;wBAC5C,WAAW,EAAE,gCAAgC;qBAC9C;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,2BAA2B;wBACpC,WAAW,EAAE,kCAAkC;qBAChD;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,yDAAyD;qBACvE;oBACD,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,+BAA+B;qBAC7C;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,mCAAmC;YACpD,iBAAiB,EAAE,2BAA2B;YAC9C,iBAAiB,EAAE,EAAE;YACrB,cAAc,EAAE,EAAE;SACnB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EACJ,YAAY,GAAG,KAAK,EACpB,eAAe,GAAG,mCAAmC,EACrD,iBAAiB,GAAG,2BAA2B,EAC/C,iBAAiB,EAAE,2BAA2B,GAAG,EAAE,EACnD,cAAc,GAAG,EAAE,GACpB,GAAG,OAAkB,CAAC;QAEvB,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,YAAY,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;QAE5D,qDAAqD;QACrD,MAAM,iBAAiB,GAAG;YACxB,GAAG,2BAA2B;YAC9B,GAAG,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;SACxE,CAAC;QAEF;;WAEG;QACH,SAAS,yBAAyB,CAAC,IAAmC;YACpE,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,4CAA4C;YAC5C,qCAAqC;YACrC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB;gBACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAE3D,mDAAmD;gBACnD,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBAClF,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAEtC,yCAAyC;oBACzC,IAAI,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;wBAC/C,OAAO;oBACT,CAAC;oBAED,0CAA0C;oBAC1C,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC;wBACjE,oCAAoC;wBACpC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC;4BAC5D,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI,EAAE,IAAI;gCACV,SAAS,EAAE,qBAAqB;gCAChC,IAAI,EAAE;oCACJ,KAAK,EAAE,oCAAoC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;iCAC/G;gCACD,OAAO,EAAE;oCACP;wCACE,SAAS,EAAE,cAAc;wCACzB,6DAA6D;wCAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;qCAC1C;iCACF;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED;;WAEG;QACH,SAAS,mBAAmB,CAAC,IAA6B;YACxD,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,6DAA6D;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,oBAAoB,GAAG,KAAK,CAAC;YACjC,IAAI,aAAa,GAAG,EAAE,CAAC;YAEvB,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7C,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACjE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CACxB,EAAE,CAAC;oBACF,oBAAoB,GAAG,IAAI,CAAC;oBAC5B,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC9B,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxD,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC/E,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC1B,EAAE,CAAC;oBACF,oBAAoB,GAAG,IAAI,CAAC;oBAC5B,aAAa,GAAG,YAAY,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,IAAI,oBAAoB,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAEtC,yCAAyC;gBACzC,IAAI,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;oBAC/C,OAAO;gBACT,CAAC;gBAED,4CAA4C;gBAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjC,IAAI,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC;wBAC1D,oCAAoC;wBACpC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC;4BAC5D,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI,EAAE,IAAI;gCACV,SAAS,EAAE,qBAAqB;gCAChC,IAAI,EAAE;oCACJ,KAAK,EAAE,wBAAwB,aAAa,2CAA2C;iCACxF;gCACD,OAAO,EAAE;oCACP;wCACE,SAAS,EAAE,cAAc;wCACzB,6DAA6D;wCAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;qCAC1C;iCACF;6BACF,CAAC,CAAC;4BACH,OAAO,CAAC,uBAAuB;wBACjC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,oBAAoB,EAAE,yBAAyB;YAC/C,cAAc,EAAE,mBAAmB;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/no-redos-vulnerable-regex.d.ts

@@ -0,0 +1,7 @@
+export interface Options {
+    /** Allow certain common patterns. Default: false */
+    allowCommonPatterns?: boolean;
+    /** Maximum pattern length to analyze. Default: 500 */
+    maxPatternLength?: number;
+}
+export declare const noRedosVulnerableRegex: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;

package/src/rules/security/no-redos-vulnerable-regex.js

@@ -0,0 +1,307 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noRedosVulnerableRegex = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+// Type guard for regex literal nodes
+const isRegExpLiteral = (node) => {
+    return node.type === 'Literal' && Object.prototype.hasOwnProperty.call(node, 'regex');
+};
+const REDOS_PATTERNS = [
+    {
+        pattern: /\([^)]*\+\)\+|\([^)]*\*\)\*|\([^)]*\?\)\?/,
+        name: 'Nested Quantifiers',
+        description: 'Nested quantifiers like (a+)+, (a*)*, (a?)? cause exponential backtracking',
+        example: {
+            bad: '/(a+)+b/',
+            good: '/(?>a+)b/ or /a+b/'
+        },
+        fix: 'Use atomic groups (?>...) or restructure to avoid nesting',
+        severity: 'critical'
+    },
+    {
+        pattern: /\([^)]*\+[^)]*\)\+|\([^)]*\*[^)]*\)\*/,
+        name: 'Nested Repetition',
+        description: 'Quantifiers nested within groups with quantifiers',
+        example: {
+            bad: '/(x+)+y/',
+            good: '/x+y/'
+        },
+        fix: 'Flatten nested quantifiers',
+        severity: 'critical'
+    },
+    {
+        pattern: /\([^)]*\|[^)]*\)\+|\([^)]*\|[^)]*\)\*/,
+        name: 'Alternation with Quantifier',
+        description: 'Alternation groups with quantifiers can cause backtracking',
+        example: {
+            bad: '/(a|b)+c/',
+            good: '/[ab]+c/'
+        },
+        fix: 'Use character classes instead of alternation when possible',
+        severity: 'high'
+    },
+    {
+        pattern: /\.\*\.\*|\.\+\+\.\+/,
+        name: 'Nested Wildcards',
+        description: 'Nested wildcard quantifiers cause catastrophic backtracking',
+        example: {
+            bad: '/.*.*/',
+            good: '/.*/ or be more specific'
+        },
+        fix: 'Remove redundant wildcards or be more specific',
+        severity: 'critical'
+    },
+    {
+        pattern: /\([^)]*\)\{[0-9]+,\}[^)]*\([^)]*\)\{[0-9]+,\}/,
+        name: 'Multiple Repetition Groups',
+        description: 'Multiple repetition groups can cause exponential backtracking',
+        example: {
+            bad: '/(a{2,})+(b{2,})+/',
+            good: 'Restructure to avoid nested repetitions'
+        },
+        fix: 'Restructure regex to avoid nested repetitions',
+        severity: 'high'
+    }
+];
+/**
+ * Check if a regex pattern contains ReDoS vulnerabilities
+ */
+function hasReDoSVulnerability(pattern) {
+    for (const redosPattern of REDOS_PATTERNS) {
+        if (redosPattern.pattern.test(pattern)) {
+            return redosPattern;
+        }
+    }
+    // Additional checks for common ReDoS patterns
+    // Nested quantifiers: (a+)+, (a*)*, (a?)?
+    if (/(\([^)]*[+*?][^)]*\)[+*?])/.test(pattern)) {
+        return {
+            pattern: /\([^)]*[+*?][^)]*\)[+*?]/,
+            name: 'Nested Quantifier Pattern',
+            description: 'Pattern contains nested quantifiers that can cause exponential backtracking',
+            example: {
+                bad: pattern.substring(0, 30),
+                good: 'Restructure to avoid nested quantifiers'
+            },
+            fix: 'Use atomic groups or restructure regex',
+            severity: 'critical'
+        };
+    }
+    return null;
+}
+/**
+ * Generate fix suggestions based on the vulnerability
+ */
+function generateFixSuggestions(vulnerability) {
+    const suggestions = [];
+    if (vulnerability.severity === 'critical' || vulnerability.name.includes('Nested')) {
+        suggestions.push({
+            messageId: 'useAtomicGroups',
+            description: vulnerability.fix
+        });
+        suggestions.push({
+            messageId: 'restructureRegex',
+            description: 'Restructure the regex to avoid nested quantifiers'
+        });
+    }
+    if (vulnerability.name.includes('Quantifier')) {
+        suggestions.push({
+            messageId: 'usePossessiveQuantifiers',
+            description: 'Use possessive quantifiers (*+, ++, ?+) if supported'
+        });
+    }
+    suggestions.push({
+        messageId: 'useSafeLibrary',
+        description: 'Consider using safe-regex library to validate patterns'
+    });
+    return suggestions;
+}
+exports.noRedosVulnerableRegex = (0, eslint_devkit_2.createRule)({
+    name: 'no-redos-vulnerable-regex',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects ReDoS-vulnerable regex patterns in literal regex patterns',
+        },
+        hasSuggestions: true,
+        messages: {
+            redosVulnerable: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'ReDoS vulnerable regex',
+                cwe: 'CWE-400',
+                description: '{{vulnerabilityName}}: {{description}}',
+                severity: '{{severity}}',
+                fix: '{{fix}}',
+                documentationLink: 'https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS',
+            }),
+            useAtomicGroups: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Atomic Groups',
+                description: 'Use atomic groups to prevent backtracking',
+                severity: 'LOW',
+                fix: '(?>...) to prevent backtracking',
+                documentationLink: 'https://www.regular-expressions.info/atomic.html',
+            }),
+            usePossessiveQuantifiers: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Possessive Quantifiers',
+                description: 'Use possessive quantifiers',
+                severity: 'LOW',
+                fix: '*+, ++, ?+ (if supported)',
+                documentationLink: 'https://www.regular-expressions.info/possessive.html',
+            }),
+            restructureRegex: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Restructure Regex',
+                description: 'Restructure to avoid nested quantifiers',
+                severity: 'LOW',
+                fix: 'Avoid (a+)+ patterns',
+                documentationLink: 'https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS',
+            }),
+            useSafeLibrary: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use safe-regex',
+                description: 'Validate with safe-regex library',
+                severity: 'LOW',
+                fix: 'if (safeRegex(pattern)) { new RegExp(pattern) }',
+                documentationLink: 'https://github.com/substack/safe-regex',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowCommonPatterns: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow certain common patterns',
+                    },
+                    maxPatternLength: {
+                        type: 'number',
+                        default: 500,
+                        minimum: 1,
+                        description: 'Maximum pattern length to analyze',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowCommonPatterns: false,
+            maxPatternLength: 500,
+        },
+    ],
+    create(context, [options = {}]) {
+        const { allowCommonPatterns = false, maxPatternLength = 500 } = options || {};
+        /**
+         * Check literal regex patterns for ReDoS vulnerabilities
+         */
+        function checkLiteralRegExp(node) {
+            if (!isRegExpLiteral(node)) {
+                return;
+            }
+            const pattern = node.regex.pattern;
+            // Skip if pattern is too long (performance)
+            if (pattern.length > maxPatternLength) {
+                return;
+            }
+            const vulnerability = hasReDoSVulnerability(pattern);
+            if (!vulnerability) {
+                return;
+            }
+            // Allow common patterns if configured
+            if (allowCommonPatterns && (vulnerability.severity === 'medium' || vulnerability.name === 'Alternation with Quantifier')) {
+                return;
+            }
+            const suggestions = generateFixSuggestions(vulnerability);
+            const severity = vulnerability.severity.toUpperCase();
+            context.report({
+                node,
+                messageId: 'redosVulnerable',
+                data: {
+                    vulnerabilityName: vulnerability.name,
+                    description: vulnerability.description,
+                    severity,
+                    fix: vulnerability.fix,
+                },
+                suggest: suggestions.map(suggestion => ({
+                    messageId: suggestion.messageId,
+                    fix: () => null, // Complex refactoring, cannot auto-fix
+                })),
+            });
+        }
+        /**
+         * Check new RegExp() calls for ReDoS vulnerabilities
+         */
+        function checkNewRegExp(node) {
+            // Check for new RegExp(pattern) or RegExp(pattern)
+            let callee;
+            if (node.type === 'NewExpression') {
+                callee = node.callee;
+            }
+            else if (node.type === 'CallExpression') {
+                callee = node.callee;
+            }
+            else {
+                /* c8 ignore next */
+                return;
+            }
+            const isRegExp = callee.type === 'Identifier' && callee.name === 'RegExp';
+            if (!isRegExp) {
+                /* c8 ignore next */
+                return;
+            }
+            // Check if first argument is a string literal
+            if (node.arguments.length === 0) {
+                /* c8 ignore next */
+                return;
+            }
+            const firstArg = node.arguments[0];
+            if (firstArg.type !== 'Literal' || typeof firstArg.value !== 'string') {
+                /* c8 ignore next */
+                return;
+            }
+            const pattern = firstArg.value;
+            // Skip if pattern is too long (performance)
+            if (pattern.length > maxPatternLength) {
+                /* c8 ignore next */
+                return;
+            }
+            const vulnerability = hasReDoSVulnerability(pattern);
+            if (!vulnerability) {
+                /* c8 ignore next */
+                return;
+            }
+            // Allow common patterns if configured
+            if (allowCommonPatterns && (vulnerability.severity === 'medium' || vulnerability.name === 'Alternation with Quantifier')) {
+                /* c8 ignore next */
+                return;
+            }
+            const suggestions = generateFixSuggestions(vulnerability);
+            const severity = vulnerability.severity.toUpperCase();
+            context.report({
+                node,
+                messageId: 'redosVulnerable',
+                data: {
+                    vulnerabilityName: vulnerability.name,
+                    description: vulnerability.description,
+                    severity,
+                    fix: vulnerability.fix,
+                },
+                suggest: suggestions.map(suggestion => ({
+                    messageId: suggestion.messageId,
+                    fix: () => null, // Complex refactoring, cannot auto-fix
+                })),
+            });
+        }
+        return {
+            Literal: checkLiteralRegExp,
+            CallExpression: checkNewRegExp,
+            NewExpression: checkNewRegExp,
+        };
+    },
+});
+//# sourceMappingURL=no-redos-vulnerable-regex.js.map

package/src/rules/security/no-redos-vulnerable-regex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-redos-vulnerable-regex.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/no-redos-vulnerable-regex.ts"],"names":[],"mappings":";;;AAWA,4DAA0E;AAC1E,4DAAsD;AAmBtD,qCAAqC;AACrC,MAAM,eAAe,GAAG,CACtB,IAAmB,EACuD,EAAE;IAC5E,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxF,CAAC,CAAC;AAcF,MAAM,cAAc,GAAmB;IACrC;QACE,OAAO,EAAE,2CAA2C;QACpD,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE;YACP,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,oBAAoB;SAC3B;QACD,GAAG,EAAE,2DAA2D;QAChE,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,uCAAuC;QAChD,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE;YACP,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,OAAO;SACd;QACD,GAAG,EAAE,4BAA4B;QACjC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,uCAAuC;QAChD,IAAI,EAAE,6BAA6B;QACnC,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE;YACP,GAAG,EAAE,WAAW;YAChB,IAAI,EAAE,UAAU;SACjB;QACD,GAAG,EAAE,4DAA4D;QACjE,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE;YACP,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,0BAA0B;SACjC;QACD,GAAG,EAAE,gDAAgD;QACrD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,+CAA+C;QACxD,IAAI,EAAE,4BAA4B;QAClC,WAAW,EAAE,+DAA+D;QAC5E,OAAO,EAAE;YACP,GAAG,EAAE,oBAAoB;YACzB,IAAI,EAAE,yCAAyC;SAChD;QACD,GAAG,EAAE,+CAA+C;QACpD,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC;AAEF;;GAEG;AACH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,KAAK,MAAM,YAAY,IAAI,cAAc,EAAE,CAAC;QAC1C,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,0CAA0C;IAC1C,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,0BAA0B;YACnC,IAAI,EAAE,2BAA2B;YACjC,WAAW,EAAE,6EAA6E;YAC1F,OAAO,EAAE;gBACP,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC7B,IAAI,EAAE,yCAAyC;aAChD;YACD,GAAG,EAAE,wCAAwC;YAC7C,QAAQ,EAAE,UAAU;SACrB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,aAA2B;IACzD,MAAM,WAAW,GAAqD,EAAE,CAAC;IAEzE,IAAI,aAAa,CAAC,QAAQ,KAAK,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnF,WAAW,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,iBAAiB;YAC5B,WAAW,EAAE,aAAa,CAAC,GAAG;SAC/B,CAAC,CAAC;QACH,WAAW,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,kBAAkB;YAC7B,WAAW,EAAE,mDAAmD;SACjE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9C,WAAW,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,0BAA0B;YACrC,WAAW,EAAE,sDAAsD;SACpE,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,IAAI,CAAC;QACf,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,wDAAwD;KACtE,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC;AACrB,CAAC;AAEY,QAAA,sBAAsB,GAAG,IAAA,0BAAU,EAA0B;IACxE,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,mEAAmE;SACjF;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,wBAAwB;gBACnC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,wCAAwC;gBACrD,QAAQ,EAAE,cAAc;gBACxB,GAAG,EAAE,SAAS;gBACd,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,2CAA2C;gBACxD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,iCAAiC;gBACtC,iBAAiB,EAAE,kDAAkD;aACtE,CAAC;YACF,wBAAwB,EAAE,IAAA,gCAAgB,EAAC;gBACzC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,4BAA4B;gBACvC,WAAW,EAAE,4BAA4B;gBACzC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,2BAA2B;gBAChC,iBAAiB,EAAE,sDAAsD;aAC1E,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,sBAAsB;gBAC3B,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,WAAW,EAAE,kCAAkC;gBAC/C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,iDAAiD;gBACtD,iBAAiB,EAAE,wCAAwC;aAC5D,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,mBAAmB,EAAE;wBACnB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,+BAA+B;qBAC7C;oBACD,gBAAgB,EAAE;wBAChB,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,GAAG;wBACZ,OAAO,EAAE,CAAC;wBACV,WAAW,EAAE,mCAAmC;qBACjD;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,mBAAmB,EAAE,KAAK;YAC1B,gBAAgB,EAAE,GAAG;SACtB;KACF;IACD,MAAM,CAAC,OAAsD,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC;QAC3E,MAAM,EACV,mBAAmB,GAAG,KAAK,EAAE,gBAAgB,GAAG,GAAG,EAClD,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvB;;WAEG;QACH,SAAS,kBAAkB,CAAC,IAAmB;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAEnC,4CAA4C;YAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBACtC,OAAO;YACT,CAAC;YAED,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAErD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YAED,sCAAsC;YACtC,IAAI,mBAAmB,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,6BAA6B,CAAC,EAAE,CAAC;gBACzH,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAoC,CAAC;YAExF,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE;oBACJ,iBAAiB,EAAE,aAAa,CAAC,IAAI;oBACrC,WAAW,EAAE,aAAa,CAAC,WAAW;oBACtC,QAAQ;oBACR,GAAG,EAAE,aAAa,CAAC,GAAG;iBACvB;gBACD,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBACtC,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,uCAAuC;iBACzD,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QAED;;WAEG;QACH,SAAS,cAAc,CAAC,IAAsD;YAC5E,mDAAmD;YACnD,IAAI,MAA2B,CAAC;YAEhC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAClC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACvB,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC1C,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,oBAAoB;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;YAE1E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,oBAAoB;gBACpB,OAAO;YACT,CAAC;YAED,8CAA8C;YAC9C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,oBAAoB;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtE,oBAAoB;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;YAE/B,4CAA4C;YAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBACtC,oBAAoB;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAErD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,oBAAoB;gBACpB,OAAO;YACT,CAAC;YAED,sCAAsC;YACtC,IAAI,mBAAmB,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,6BAA6B,CAAC,EAAE,CAAC;gBACzH,oBAAoB;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAoC,CAAC;YAExF,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE;oBACJ,iBAAiB,EAAE,aAAa,CAAC,IAAI;oBACrC,WAAW,EAAE,aAAa,CAAC,WAAW;oBACtC,QAAQ;oBACR,GAAG,EAAE,aAAa,CAAC,GAAG;iBACvB;gBACD,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBACtC,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,uCAAuC;iBACzD,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,OAAO,EAAE,kBAAkB;YAC3B,cAAc,EAAE,cAAc;YAC9B,aAAa,EAAE,cAAc;SAC9B,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}