guardvibe 2.9.4 → 2.9.5

package/build/tools/check-code.js

@@ -246,10 +246,17 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
     let codeHasAuthGuard = hasAuthGuardPattern(code);
     const codeHasRoleCheck = hasRoleCheckPattern(code);
     // Pre-analyze: detect fix patterns to suppress false positives after remediation
-    const codeHasSanitization = /(?:DOMPurify\.sanitize|sanitize(?:Html|HTML)|xss\s*\(|purify\s*\(|escapeHtml|sanitizeHtml)\s*\(/i.test(code);
-    const codeHasUrlValidation = /(?:(?:validate|verify|check|safe|allowed)(?:Url|URL|Uri|URI)|(?:ALLOWED_(?:HOSTS|URLS|ORIGINS|DOMAINS))|(?:allowlist|whitelist|safelist)[\s\S]{0,50}?(?:includes|has|match))/i.test(code);
-    const codeHasUuidFilename = /(?:randomUUID|nanoid|uuidv4|v4\s*\(\)|crypto\.randomUUID)\s*\(/i.test(code);
-    const codeHasCronVerification = /(?:verify|validate|check)(?:Cron|Secret|Auth|Signature)\s*\(/i.test(code);
+    // These detect BOTH inline usage AND imported utility functions
+    const codeHasSanitization = /(?:DOMPurify\.sanitize|sanitize(?:Html|HTML)|xss\s*\(|purify\s*\(|escapeHtml|sanitizeHtml)\s*\(/i.test(code) ||
+        /import\s+.*(?:sanitize|DOMPurify|escapeHtml|purify|xss)\b/i.test(code);
+    const codeHasUrlValidation = /(?:(?:validate|verify|check|safe|allowed)(?:Url|URL|Uri|URI|Fetch)(?:Url)?|(?:ALLOWED_(?:HOSTS|URLS|ORIGINS|DOMAINS))|(?:allowlist|whitelist|safelist)[\s\S]{0,50}?(?:includes|has|match))/i.test(code) ||
+        /import\s+.*(?:validateUrl|validateFetchUrl|urlValidat|safeUrl|allowedUrl)/i.test(code);
+    const codeHasUuidFilename = /(?:randomUUID|nanoid|uuidv4|v4\s*\(\)|crypto\.randomUUID)\s*\(/i.test(code) ||
+        /import\s+.*(?:sanitizeFilename|sanitizeUploadFilename|safeFilename)/i.test(code);
+    const codeHasCronVerification = /(?:verify|validate|check)(?:Cron|Secret|Auth|Signature)\s*\(/i.test(code) ||
+        /import\s+.*(?:verifyCron|cronAuth|validateCron|checkCron)/i.test(code);
+    const codeHasRedirectValidation = /(?:sanitize|validate|verify|check|safe|allowed)(?:Redirect|RedirectUrl|CallbackUrl)\s*\(/i.test(code) ||
+        /import\s+.*(?:sanitizeRedirect|validateRedirect|safeRedirect)/i.test(code);
     const isMigrationFile = filePath ? /(?:migrations?|supabase\/migrations|seeds?|fixtures)\//i.test(filePath) : false;
     const isPeerDeps = /["']peerDependencies["']/i.test(code);
     // Config: check custom auth function names from .guardviberc
@@ -317,6 +324,18 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         // Skip cron secret rules when custom verification function is present
         if (codeHasCronVerification && ["VG968", "VG503"].includes(rule.id))
             continue;
+        // Skip open redirect rules when redirect URL validation is present
+        if (codeHasRedirectValidation && ["VG425", "VG409", "VG660"].includes(rule.id))
+            continue;
+        // Skip VG131 (state-changing GET) when only read operations are present
+        if (rule.id === "VG131") {
+            // If code only has read operations (findMany, findFirst, count, aggregate, select)
+            // and no actual mutations, skip this rule
+            const hasMutation = /(?:\.create\s*\(|\.update\s*\(|\.delete\s*\(|\.destroy\s*\(|\.remove\s*\(|\.insert\s*\(|DELETE\s+FROM|UPDATE\s+\w|INSERT\s+INTO)/i.test(code);
+            const onlyInComments = !hasMutation;
+            if (onlyInComments)
+                continue;
+        }
         // Skip CVE version rules in peerDependencies (ranges, not actual versions)
         if (isPeerDeps && rule.id === "VG903")
             continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "2.9.4",
+  "version": "2.9.5",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 334 rules, 31 tools, CLI + doctor. Host security: CVE-2025-59536 hook injection, CVE-2026-21852 base URL hijack, MCP config audit, AI host hardening. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",