guardvibe 3.0.31 → 3.0.33

package/build/data/rules/dockerfile.js

@@ -29,7 +29,7 @@ export const dockerfileRules = [
         severity: "medium",
         owasp: "A03:2025 Software Supply Chain Failures",
         description: "Using :latest tag or no tag makes builds non-reproducible and vulnerable to supply chain attacks.",
-        pattern: /FROM\s+\S+(?::latest\s|(?!:)\s)/gi,
+        pattern: /^FROM\s+[^\s:@]+(?::latest)?(?=\s)/gim,
         languages: ["dockerfile"],
         fix: "Pin to a specific version tag: FROM node:20-alpine instead of FROM node:latest.",
         fixCode: "# Pin to specific version\nFROM node:20-alpine\n# Not: FROM node:latest\n# Not: FROM node",

package/build/data/rules/web-security.js

@@ -179,7 +179,7 @@ export const webSecurityRules = [
         severity: "high",
         owasp: "A05:2021 Security Misconfiguration",
         description: "Response serving user-uploaded files does not set X-Content-Type-Options: nosniff. Browsers may MIME-sniff the content and execute uploaded files as HTML/JavaScript, enabling stored XSS via file uploads.",
-        pattern: /(?:createReadStream|sendFile|send\s*\(|pipe\s*\(|res\.download|res\.sendFile|getSignedUrl|getPublicUrl)[\s\S]{0,500}?(?:(?!X-Content-Type-Options|nosniff)[\s\S]){10,}?(?:res\.end|\.pipe|return|response)/gi,
+        pattern: /(?:res\.sendFile|res\.download|createReadStream|getSignedUrl|getPublicUrl|\.pipe\s*\(\s*res)[\s\S]{0,500}?(?:(?!X-Content-Type-Options|nosniff)[\s\S]){10,}?(?:res\.end|\.pipe|return|response)/gi,
         languages: ["javascript", "typescript"],
         fix: "Set X-Content-Type-Options: nosniff on all responses serving user-uploaded content.",
         fixCode: '// Set nosniff header for uploaded file responses\nres.setHeader("X-Content-Type-Options", "nosniff");\nres.setHeader("Content-Disposition", "attachment"); // force download for unknown types\nres.sendFile(filePath);',

package/build/tools/check-code.js

@@ -335,6 +335,15 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         const isWebhookRoute = filePath && /webhook/i.test(filePath);
         const isCronRoute = filePath && /(?:cron|scheduled|jobs?)\//i.test(filePath);
         const isAdminRoute = filePath && /\/admin\//i.test(filePath);
+        // Skip rate-limit rules when the file installs a global rate limiter via app.use().
+        // Covers `app.use(rateLimit({...}))`, `app.use(limiter)`, `app.use('/api', rateLimit({...}))`,
+        // and named middleware vars matching limiter naming conventions.
+        if (rateLimitRuleIds.has(rule.id)) {
+            const hasGlobalRateLimit = /(?:app|router)\.use\s*\(\s*(?:[^,)]*,\s*)?(?:rateLimit|slowDown|expressRateLimit|expressSlowDown|RateLimit|Throttle|throttle)\s*\(/i.test(code) ||
+                /(?:app|router)\.use\s*\(\s*(?:[^,)]*,\s*)?\w*(?:[Ll]imiter|[Tt]hrottle|[Rr]ate[Ll]imit|[Ss]low[Dd]own|[Bb]rute)\w*\s*\)/.test(code);
+            if (hasGlobalRateLimit)
+                continue;
+        }
         // Skip auth rules when code has any auth guard pattern (naming-agnostic)
         if (codeHasAuthGuard && authRuleIds.has(rule.id))
             continue;
@@ -597,7 +606,8 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 const hasPublishingFields = /"(?:bin|exports|module|types|typings)"\s*:/i.test(code);
                 const mainPointsToBuild = /"main"\s*:\s*"(?:dist|build|lib|out)\//i.test(code);
                 const runtimeNames = "node|nodemon|tsx|ts-node|next|nest|vite|remix|astro";
-                const startsAsApp = new RegExp('"start"\\s*:\\s*"(?:' + runtimeNames + ')\\b', "i").test(code);
+                // Allow leading env-var assignments: NODE_OPTIONS=..., NODE_ENV=production, PORT=3000, etc.
+                const startsAsApp = new RegExp('"start"\\s*:\\s*"(?:[A-Z_][A-Z0-9_]*=\\S+\\s+)*(?:' + runtimeNames + ')\\b', "i").test(code);
                 if (!hasPublishingFields && !mainPointsToBuild && startsAsApp)
                     continue;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.31",
+  "version": "3.0.33",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 365 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",