guardvibe 2.9.7 → 2.9.9

package/build/cli/scan.js

@@ -34,7 +34,7 @@ export async function runScan() {
     else {
         console.log(result);
     }
-    if (format !== "sarif") {
+    if (format !== "sarif" && flags["fail-on"]) {
         const failOn = getStringFlag(flags, "fail-on") ?? "critical";
         if (shouldFail(result, failOn))
             process.exit(1);
@@ -67,7 +67,7 @@ export async function runDirectoryScan(targetPath, flags) {
             : join(scanPath, ".guardvibe-baseline.json");
         safeWriteOutput(baselineFile, result);
     }
-    if (format !== "sarif") {
+    if (format !== "sarif" && flags["fail-on"]) {
         const failOn = getStringFlag(flags, "fail-on") ?? "critical";
         if (shouldFail(result, failOn))
             process.exit(1);
@@ -150,17 +150,19 @@ export async function runDiffScan(base, flags) {
     else {
         console.log(result);
     }
-    const failOn = getStringFlag(flags, "fail-on") ?? "critical";
-    if (failOn !== "none") {
-        const failLevels = {
-            low: ["critical", "high", "medium", "low"],
-            medium: ["critical", "high", "medium"],
-            high: ["critical", "high"],
-            critical: ["critical"],
-        };
-        const levels = failLevels[failOn] || failLevels.critical;
-        if (allFindings.some(f => levels.includes(f.severity)))
-            process.exit(1);
+    if (flags["fail-on"]) {
+        const failOn = getStringFlag(flags, "fail-on") ?? "critical";
+        if (failOn !== "none") {
+            const failLevels = {
+                low: ["critical", "high", "medium", "low"],
+                medium: ["critical", "high", "medium"],
+                high: ["critical", "high"],
+                critical: ["critical"],
+            };
+            const levels = failLevels[failOn] || failLevels.critical;
+            if (allFindings.some(f => levels.includes(f.severity)))
+                process.exit(1);
+        }
     }
 }
 export async function runFileCheck(filePath, flags) {
@@ -196,9 +198,11 @@ export async function runFileCheck(filePath, flags) {
     else {
         console.log(result);
     }
-    const failOn = getStringFlag(flags, "fail-on") ?? "critical";
-    if (shouldFail(result, failOn))
-        process.exit(1);
+    if (flags["fail-on"]) {
+        const failOn = getStringFlag(flags, "fail-on") ?? "critical";
+        if (shouldFail(result, failOn))
+            process.exit(1);
+    }
 }
 export async function handleScanCommand(args) {
     const { flags, positional } = parseArgs(args);

package/build/data/rules/cve-versions.js

@@ -42,7 +42,7 @@ export const cveVersionRules = [
         severity: "high",
         owasp: "A02:2025 Injection",
         description: "React versions before 18.3.1 contain known XSS vulnerabilities. React 16.x and 17.x have multiple unpatched security issues.",
-        pattern: /["']react["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:15\.\d+\.\d+|16\.\d+\.\d+|17\.\d+\.\d+|18\.[0-2]\.\d+|18\.3\.0)["']/g,
+        pattern: /["']react["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:15\.\d+\.\d+|16\.\d+\.\d+|17\.\d+\.\d+|18\.[0-1]\.\d+|18\.3\.0)["']/g,
         languages: ["json"],
         fix: "Upgrade React to 18.3.1 or later: npm install react@latest react-dom@latest",
         fixCode: '// package.json\n"react": "^18.3.1",\n"react-dom": "^18.3.1"',

package/build/tools/check-code.js

@@ -212,6 +212,8 @@ const LEGITIMATE_PREFIXED_PACKAGES = new Set([
     "fast-sha256", "fast-text-encoding",
     "svix",
     "cheerio",
+    "simple-plist", "simple-git", "simple-update-notifier", "simple-swizzle", "simple-concat",
+    "simple-html-tokenizer", "simple-ast",
 ]);
 function isLegitimatePackage(name) {
     return LEGITIMATE_PREFIXED_PACKAGES.has(name);
@@ -271,7 +273,8 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
     const isSqlSchemaFile = filePath ? /(?:schema|migration|seed|ddl|init).*\.sql$/i.test(filePath) : false;
     const isReactNative = /(?:react-native|from\s+['"]react-native['"]|from\s+['"]expo|import\s+.*\bexpo\b)/i.test(code);
     const codeHasTimingSafeEqual = /(?:timingSafeEqual|timing.?safe|constant.?time)/i.test(code);
-    const codeHasFilenameSanitization = /(?:\.replace\s*\(\s*\/\[?\^?[a-z0-9\\-_\]]*\]?\/?[gi]*\s*,|sanitize(?:File|Name|Path)|safeName|cleanName)/i.test(code);
+    const codeHasFilenameSanitization = /(?:\.replace\s*\(\s*\/\[?\^?[a-z0-9\\-_\]]*\]?\/?[gi]*\s*,|sanitize(?:File|Name|Path)|safeName|cleanName)/i.test(code) ||
+        /(?:Date\.now\(\)|timestamp|uuid|nanoid|crypto\.randomUUID)[\s\S]{0,80}?\.\s*(?:ext|split|pop)/i.test(code);
     const isPeerDeps = /["']peerDependencies["']/i.test(code);
     // Config: check custom auth function names from .guardviberc
     if (!codeHasAuthGuard && config.authFunctions && config.authFunctions.length > 0) {
@@ -434,23 +437,31 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         // Skip CVE version rules in peerDependencies (ranges, not actual versions)
         if (isPeerDeps && rule.id === "VG903")
             continue;
-        // Skip VG140 (XXE) when file doesn't actually parse XML — just has XML-related imports
+        // Skip VG140 (XXE) when file doesn't actually parse XML or uses browser DOMParser
+        // Browser DOMParser with 'text/html' is safe by design — no external entity processing
         if (rule.id === "VG140") {
-            const hasXmlParsing = /(?:parseString|parseXml|xml2js|DOMParser|XMLParser)\s*\(/i.test(code);
+            const hasXmlParsing = /(?:parseString|parseXml|xml2js|xmldom|libxmljs|XMLParser)\s*\(/i.test(code);
             if (!hasXmlParsing)
                 continue;
+            // Browser DOMParser with text/html is inherently safe
+            const hasBrowserDomParser = /new\s+DOMParser\s*\(\s*\)[\s\S]{0,50}?['"]text\/html['"]/i.test(code);
+            if (hasBrowserDomParser && !hasXmlParsing)
+                continue;
         }
         // Skip VG020 (wildcard dependency version) in lock files — engine constraints
         // like "node": ">=6" are not dependency versions
         if (rule.id === "VG020" && filePath && /(?:package-lock\.json|yarn\.lock|pnpm-lock\.yaml|npm-shrinkwrap\.json)$/.test(filePath))
             continue;
         // Skip VG430 (Supabase anon key on server) when file properly separates client/server
-        // Pattern: file exports both a client (anon key) and server (service_role) function
+        // or is a React Native/mobile client (anon key with AsyncStorage is correct pattern)
         if (rule.id === "VG430") {
             const hasServiceRole = /(?:SUPABASE_SERVICE_ROLE|service_role|serviceRole)/i.test(code);
             const hasClientServer = /(?:createClient|createServerClient|createBrowserClient)/i.test(code) && hasServiceRole;
             if (hasClientServer)
                 continue;
+            const isMobileClient = isReactNative || /AsyncStorage/i.test(code) || /EXPO_PUBLIC_/i.test(code);
+            if (isMobileClient)
+                continue;
         }
         // Skip VG448 (Supabase RPC bypass RLS) when using service_role key (server-side)
         if (rule.id === "VG448" && /(?:SUPABASE_SERVICE_ROLE|service_role|createServerSupabaseClient|createServerClient)/i.test(code))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "2.9.7",
+  "version": "2.9.9",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 334 rules, 31 tools, CLI + doctor. Host security: CVE-2025-59536 hook injection, CVE-2026-21852 base URL hijack, MCP config audit, AI host hardening. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",