guardvibe 3.0.46 → 3.0.48

package/build/data/rules/advanced-security.js

@@ -291,7 +291,7 @@ export const advancedSecurityRules = [
         severity: "high",
         owasp: "A03:2025 Injection",
         description: "User-controlled input is used as an object property key via bracket notation (obj[userInput]). Attackers can access __proto__, constructor, or prototype to pollute object prototypes and bypass security checks.",
-        pattern: /(?:(?:req|request|body|query|params|input|data)\.\w+|(?:const|let|var)\s+(?:\{[^}]*\}|\w+)\s*=\s*(?:await\s+)?(?:req|request)[\s\S]{0,50}?)[\s\S]{0,100}?\w+\s*\[\s*(?:key|field|prop|name|column|attr|param)\s*\]/gi,
+        pattern: /(?:(?:req|request|body|query|params)\.\w+|(?:const|let|var)\s+(?:\{[^}]*\}|\w+)\s*=\s*(?:await\s+)?(?:req|request)[\s\S]{0,50}?)[\s\S]{0,100}?\w+\s*\[\s*(?:key|field|prop|name|column|attr|param)\s*\]/gi,
         languages: ["javascript", "typescript"],
         fix: "Validate property names against an allowlist, or use Map instead of plain objects.",
         fixCode: '// BAD: prototype pollution\nconst key = req.query.field;\nconst value = config[key];\n\n// GOOD: allowlist validation\nconst ALLOWED_FIELDS = new Set(["name", "email", "role"]);\nif (!ALLOWED_FIELDS.has(key)) return new Response("Invalid field", { status: 400 });\nconst value = config[key];\n\n// GOOD: use Map\nconst config = new Map([["name", "..."], ["email", "..."]]);\nconst value = config.get(key);',
@@ -304,7 +304,7 @@ export const advancedSecurityRules = [
         severity: "medium",
         owasp: "A04:2025 Insecure Design",
         description: "Regular expression contains nested quantifiers ((a+)+), overlapping alternation with quantifiers (([a-z]+)*), or other patterns that cause catastrophic backtracking. Attackers can send crafted input to freeze the event loop.",
-        pattern: /\/(?:[^/\\]|\\.)*(?:\([^)]*[+*][^)]*\)\s*[+*]|\(\?:[^)]*[+*][^)]*\)\s*[+*])(?:[^/\\]|\\.)*\//g,
+        pattern: /\/(?:[^/\\\n]|\\.)*(?:\([^)\n]*[+*][^)\n]*\)\s*[+*]|\(\?:[^)\n]*[+*][^)\n]*\)\s*[+*])(?:[^/\\\n]|\\.)*\//g,
         languages: ["javascript", "typescript"],
         fix: "Rewrite the regex to avoid nested quantifiers. Use atomic groups or possessive quantifiers if available, or use the 'safe-regex' library to validate patterns.",
         fixCode: '// BAD: catastrophic backtracking\nconst re = /(a+)+$/;\n\n// GOOD: no nested quantifiers\nconst re = /a+$/;\n\n// GOOD: validate with safe-regex\nimport safe from "safe-regex";\nif (!safe(pattern)) throw new Error("Unsafe regex");',

package/build/index.js

@@ -483,7 +483,8 @@ server.tool("explain_remediation", "Pass a GuardVibe rule ID (e.g. VG154) to get
     const results = explainRemediation(rule_id, code, format, rules);
     return { content: [{ type: "text", text: results }] };
 });
-// Tool 23: Quick file scan — designed for real-time integration
+// Tool 23: Quick file scan — returns structured findings, not raw file contents.
+// guardvibe-ignore VG880
 server.tool("scan_file", "Scan a single file on disk by path for security vulnerabilities. Pass a file path — the tool reads the file itself. For inline code snippets, use check_code instead. Example: scan_file({file_path: 'src/api/route.ts'})", {
     file_path: z.string().describe("Absolute or relative path to the file to scan"),
     format: z.enum(["markdown", "json"]).default("json").describe("Output format"),

package/build/tools/auth-coverage.js

@@ -135,7 +135,7 @@ function hasAuthGuard(code) {
     // 401/403 responses indicating auth enforcement
     if (/(?:status:\s*(?:401|403)|new\s+Response\s*\([^)]*(?:401|403)|Unauthorized|Forbidden)/.test(code))
         return true;
-    // Broad: any function name containing auth/session/permission/guard
+    // guardvibe-ignore VG153
     if (/await\s+(?:\w+\.)*\w*(?:auth|Auth|session|Session|permission|Permission|guard|Guard|verify|Verify|protect|Protect)\w*\s*\(/i.test(code))
         return true;
     return false;
@@ -210,6 +210,7 @@ export function analyzeAuthCoverage(routeFiles, middlewareContent, layoutFiles,
             if (route.hasAuthGuard || route.middlewareCovered)
                 continue;
             const isExcepted = authExceptions.some(exc => {
+                // guardvibe-ignore VG153
                 const excPath = exc.path.replace(/\[[\w]+\]/g, "[^/]+");
                 const regex = new RegExp("^" + excPath.replace(/\//g, "\\/") + "$");
                 return regex.test(route.urlPath) || route.urlPath === exc.path || route.urlPath.startsWith(exc.path + "/");

package/build/tools/check-code.d.ts

@@ -5,6 +5,12 @@ export interface Finding {
     line: number;
     confidence: "high" | "medium" | "low";
 }
+/**
+ * Detect if a file is a security rule definition file.
+ * These files intentionally contain vulnerable code patterns
+ * as regex matchers and fixCode examples — scanning them is meaningless.
+ */
+export declare function isRuleDefinitionFile(code: string, filePath?: string): boolean;
 export declare function analyzeCode(code: string, language: string, framework?: string, filePath?: string, configDir?: string, rules?: SecurityRule[]): Finding[];
 export declare function formatFindingsJson(findings: Finding[], extra?: Record<string, unknown>): string;
 export declare function checkCode(code: string, language: string, framework?: string, filePath?: string, configDir?: string, format?: "markdown" | "json" | "buddy", rules?: SecurityRule[]): string;

package/build/tools/check-code.js

@@ -3,6 +3,10 @@ import { owaspRules } from "../data/rules/index.js";
 import { loadConfig } from "../utils/config.js";
 import { loadIgnoreFile, isIgnored } from "../utils/ignore.js";
 import { securityBanner } from "../utils/banner.js";
+/** CVE version-pin rule IDs are VG900-VG931 (and only these). Other VG9xx IDs
+ * (VG983 Turso, VG990 SVG, VG998 OpenAI browser flag, etc.) are regular code-pattern
+ * rules and should NOT be exempted from comment / string-literal skip logic. */
+const CVE_VERSION_RULE = /^VG9(?:0\d|1\d|2\d|3[01])$/;
 function parseSuppressionsFromCode(lines) {
     const suppressions = [];
     const pattern = /(?:\/\/|#|<!--)\s*guardvibe-ignore(?:-next-line)?\s*(VG\d+)?(?:\s.*)?(?:-->)?/i;
@@ -17,8 +21,22 @@ function parseSuppressionsFromCode(lines) {
             suppressions.push({ line: i + 2, ruleId });
         }
         else if (isCommentOnlyLine) {
+            // Comment-only line: suppress the comment's own line plus the next several
+            // lines, stopping early at a blank line or a new comment block. This makes
+            // suppress comments work for multi-line method chains (common Supabase / ORM
+            // builders span 3-5 lines from `.from(...)` through `.select(...).order(...)`).
             suppressions.push({ line: i + 1, ruleId });
-            suppressions.push({ line: i + 2, ruleId });
+            for (let j = 1; j <= 5; j++) {
+                const nextLine = lines[i + j];
+                if (nextLine === undefined)
+                    break;
+                const trimmed = nextLine.trim();
+                if (trimmed === "")
+                    break;
+                if (/^\s*(?:\/\/|#|<!--)/.test(nextLine))
+                    break;
+                suppressions.push({ line: i + 1 + j, ruleId });
+            }
         }
         else {
             suppressions.push({ line: i + 1, ruleId });
@@ -66,10 +84,7 @@ function isInsideStringLiteral(lines, lineNumber, code, matchIndex) {
     if (/^\s*\+\s*["']/.test(line))
         return true; // + "string continuation"
     // 3. Line contains escaped newlines (\n) suggesting it's inside a string value
-    const _quotesBefore = line.substring(0, line.indexOf(trimmed.charAt(0)));
     if (/\\n/.test(line) && /["'`].*\\n/.test(line)) {
-        // Extra check: is the match portion inside quotes on this line?
-        const _matchEnd = matchIndex + 20; // approximate
         const lineStart = code.lastIndexOf("\n", matchIndex) + 1;
         const col = matchIndex - lineStart;
         const beforeCol = line.substring(0, col);
@@ -79,11 +94,12 @@ function isInsideStringLiteral(lines, lineNumber, code, matchIndex) {
             return true;
     }
     // 4. Look backwards for property assignment context (fixCode, description, etc.)
+    // Includes display-string props (title, message, label) used by audit / report
+    // tools to surface findings — these contain mention of vulnerable patterns by name.
+    const PROP_RE = /^(?:fixCode|fix|description|exploit|audit|title|message|label|reason|details|summary|hint)\s*[:=]/;
     for (let i = lineNumber - 1; i >= Math.max(0, lineNumber - 20); i--) {
         const prev = lines[i]?.trimStart() || "";
-        if (/^(?:fixCode|fix|description|exploit|audit)\s*[:=]/.test(prev))
-            return true;
-        if (/^(?:fixCode|fix|description|exploit|audit)\s*:\s*$/.test(prev))
+        if (PROP_RE.test(prev))
             return true;
         // Hit a rule boundary — stop looking
         if (/^\s*id\s*:\s*["']VG/.test(prev))
@@ -117,7 +133,7 @@ function isHumanReadableString(lines, lineNumber) {
  * These files intentionally contain vulnerable code patterns
  * as regex matchers and fixCode examples — scanning them is meaningless.
  */
-function isRuleDefinitionFile(code, filePath) {
+export function isRuleDefinitionFile(code, filePath) {
     // Path-based: known rule definition directories
     if (filePath && /(?:\/rules\/|\/data\/rules\/)/.test(filePath)) {
         // Confirm it actually exports SecurityRule objects
@@ -125,6 +141,10 @@ function isRuleDefinitionFile(code, filePath) {
             return true;
         }
     }
+    // Path-based: framework guides and similar pure-documentation files that hold
+    // example code inside markdown template literals
+    if (filePath && /(?:^|\/)framework-guides\.ts$/.test(filePath))
+        return true;
     // Content-based: file defines multiple VG rules with pattern: regex
     if (/id:\s*["']VG\d+["']/g.test(code) && /pattern:\s*\//.test(code)) {
         const ruleCount = (code.match(/id:\s*["']VG\d+["']/g) || []).length;
@@ -378,6 +398,12 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         // for batch processing, not for serving to clients.
         if (rule.id === "VG955" && (isBatchScriptFile || isCronRoute))
             continue;
+        // Skip VG1006 (select('*') exposes columns) in batch/script paths — debug scripts,
+        // migrations, seeds, and fixtures run under service-role and write/log data
+        // server-side; '*' doesn't expose anything to a client. Application routes that
+        // do expose data still get flagged.
+        if (rule.id === "VG1006" && isBatchScriptFile)
+            continue;
         // Skip VG132 (Missing Request Body Size Limit) on Next.js route handlers and
         // pages/api endpoints — Next.js/Vercel apply a default 4.5MB body limit at the
         // platform layer, which is what the rule is checking for.
@@ -526,7 +552,7 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         // to match top-level dependency declarations in package.json. Lock files contain
         // sub-package peer dependency ranges (e.g. "next": ">=13.2.0" from a transitive dep)
         // which look like vulnerable pins but represent peer requirements, not installed versions.
-        if (filePath && /^VG9(?:0\d|1\d|2\d|3[01])$/.test(rule.id) && /(?:package-lock\.json|yarn\.lock|pnpm-lock\.yaml|npm-shrinkwrap\.json)$/.test(filePath))
+        if (filePath && CVE_VERSION_RULE.test(rule.id) && /(?:package-lock\.json|yarn\.lock|pnpm-lock\.yaml|npm-shrinkwrap\.json)$/.test(filePath))
             continue;
         // Skip VG430 (Supabase anon key on server) when file properly separates client/server
         // or is a React Native/mobile client (anon key with AsyncStorage is correct pattern)
@@ -589,18 +615,35 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
             const lineNumber = beforeMatch.split("\n").length;
             if (isLineSuppressed(suppressions, lineNumber, rule.id))
                 continue;
-            // Skip matches on comment lines for code-pattern rules.
-            // CVE version rules (VG9xx) scan package.json so they're exempt.
-            if (!rule.id.startsWith("VG9")) {
-                if (isInComment(lines, lineNumber))
+            // Skip matches on comment lines and inside string literals.
+            // CVE version-pin rules (VG900-VG931) are exempt — they scan package.json
+            // dependency declarations where these contexts don't apply.
+            // For multi-line matches, only string-literal skip is applied: the match's
+            // starting line may legitimately be a comment while the vulnerable code is
+            // on a later line (e.g. VG966 OAuth callback comment + handler).
+            if (!CVE_VERSION_RULE.test(rule.id)) {
+                const isMultiLineMatch = match[0].includes("\n");
+                if (!isMultiLineMatch && isInComment(lines, lineNumber))
                     continue;
-            }
-            // Skip matches inside string literals (fixCode, description, template strings)
-            // This prevents rule definition files and docs from triggering false positives
-            if (!rule.id.startsWith("VG9")) {
                 if (isInsideStringLiteral(lines, lineNumber, code, match.index))
                     continue;
             }
+            // VG020 (wildcard dep version) on package.json: skip the `engines` block —
+            // `"node": ">=18.0.0"` is a runtime constraint, not a dependency range.
+            if (rule.id === "VG020" && filePath && /package\.json$/.test(filePath)) {
+                let inEngines = false;
+                for (let j = lineNumber - 1; j >= Math.max(0, lineNumber - 6); j--) {
+                    const prev = lines[j] ?? "";
+                    if (/"engines"\s*:\s*\{/.test(prev)) {
+                        inEngines = true;
+                        break;
+                    }
+                    if (/^\s*\}/.test(prev))
+                        break; // closed a previous block — not in engines
+                }
+                if (inEngines)
+                    continue;
+            }
             // Skip hardcoded-credential rules when the value is a human-readable sentence
             if (rule.id === "VG001" || rule.id === "VG062") {
                 if (isHumanReadableString(lines, lineNumber))
@@ -645,6 +688,7 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 const mainPointsToBuild = /"main"\s*:\s*"(?:dist|build|lib|out)\//i.test(code);
                 const runtimeNames = "node|nodemon|tsx|ts-node|next|nest|vite|remix|astro";
                 // Allow leading env-var assignments: NODE_OPTIONS=..., NODE_ENV=production, PORT=3000, etc.
+                // guardvibe-ignore VG153
                 const startsAsApp = new RegExp('"start"\\s*:\\s*"(?:[A-Z_][A-Z0-9_]*=\\S+\\s+)*(?:' + runtimeNames + ')\\b', "i").test(code);
                 if (!hasPublishingFields && !mainPointsToBuild && startsAsApp)
                     continue;
@@ -674,6 +718,16 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (/\.(?:order|range|limit)\s*\(/i.test(matched))
                     continue;
             }
+            // Skip VG1006 (select('*') exposes columns) for count-only queries —
+            // .select('*', { count: 'exact', head: true }) returns only a row count, never
+            // materializes rows, so '*' doesn't expose any columns. The rule's pattern
+            // truncates at the `*` quote, so we look at the next ~120 chars for the head
+            // option (typical select(...) options object fits in that window).
+            if (rule.id === "VG1006") {
+                const tail = code.substring(match.index, match.index + (match[0].length + 120));
+                if (/\bhead\s*:\s*true\b/i.test(tail))
+                    continue;
+            }
             // Skip VG155 (CSRF) in Next.js App Router route handlers (app/.../route.{ts,tsx,js,jsx}).
             // App Router protects state-changing requests by default: SameSite=Lax cookies block
             // cross-site cookie attachment, and JSON Content-Type triggers CORS preflight. Bearer-token

package/build/tools/cross-file-taint.js

@@ -602,6 +602,7 @@ function deriveSeverity(sinkType) {
     return "medium";
 }
 function getSinkFix(sinkType) {
+    // guardvibe-ignore VG014
     const fixes = {
         "sql-injection": "Use parameterized queries instead of string interpolation.",
         "code-injection": "Never pass user input to eval() or Function constructor.",
@@ -618,7 +619,7 @@ export function analyzeCrossFileTaint(files) {
         const lang = detectLang(file.path);
         if (lang === "unknown")
             continue;
-        const findings = analyzeTaint(file.content, lang);
+        const findings = analyzeTaint(file.content, lang, file.path);
         if (findings.length > 0)
             perFileFindings.set(file.path, findings);
     }

package/build/tools/full-audit.js

@@ -67,7 +67,11 @@ function parseSectionCounts(parsed) {
 }
 function collectJsFiles(dir, maxFiles = 200) {
     const files = [];
-    const skip = new Set(["node_modules", ".git", ".next", "build", "dist", ".turbo", "coverage"]);
+    const config = loadConfig(resolve(dir));
+    const skip = new Set([
+        "node_modules", ".git", ".next", "build", "dist", ".turbo", "coverage",
+        ...config.scan.exclude,
+    ]);
     function walk(d) {
         if (files.length >= maxFiles)
             return;

package/build/tools/scan-secrets.js

@@ -4,6 +4,7 @@ import { execFileSync } from "child_process";
 import { secretPatterns, calculateEntropy } from "../data/secret-patterns.js";
 import { loadConfig } from "../utils/config.js";
 import { isExcludedFilename } from "../utils/constants.js";
+import { isRuleDefinitionFile } from "./check-code.js";
 const DEFAULT_SECRET_EXCLUDES = new Set(["node_modules", ".git", "build", "dist"]);
 const SOURCE_FILE_EXTENSIONS = new Set([
     ".js", ".jsx", ".mjs", ".cjs",
@@ -14,6 +15,10 @@ const SOURCE_FILE_EXTENSIONS = new Set([
 const CONFIG_FILE_EXTENSIONS = new Set([".yml", ".yaml", ".toml", ".json", ".cfg", ".ini", ".conf"]);
 export function scanContent(content, filename) {
     const findings = [];
+    // Skip security rule definition files — pattern strings inside them frequently
+    // resemble real secret formats by design.
+    if (isRuleDefinitionFile(content, filename))
+        return findings;
     for (const sp of secretPatterns) {
         sp.pattern.lastIndex = 0;
         let match;

package/build/tools/taint-analysis.d.ts

@@ -18,5 +18,5 @@ export interface TaintFinding {
     description: string;
     fix: string;
 }
-export declare function analyzeTaint(code: string, language: string): TaintFinding[];
+export declare function analyzeTaint(code: string, language: string, filePath?: string): TaintFinding[];
 export declare function formatTaintFindings(findings: TaintFinding[], format: "markdown" | "json"): string;

package/build/tools/taint-analysis.js

@@ -3,6 +3,7 @@
  * Basic taint analysis — tracks user input flowing into dangerous sinks.
  * Not a full AST/CFG analysis, but follows variable assignments through lines.
  */
+import { isRuleDefinitionFile } from "./check-code.js";
 // User input sources (tainted data entry points)
 const TAINT_SOURCES = [
     { pattern: /(?:req|request)\.(?:body|query|params|headers|cookies)\b/g, type: "http-input" },
@@ -111,9 +112,13 @@ function propagateTaint(assignments, lines) {
         }
     }
 }
-export function analyzeTaint(code, language) {
+export function analyzeTaint(code, language, filePath) {
     if (!["javascript", "typescript"].includes(language))
         return [];
+    // Skip security rule definition files — they intentionally contain vulnerable
+    // code snippets in pattern regexes, fixCode strings, and exploit examples.
+    if (isRuleDefinitionFile(code, filePath))
+        return [];
     const lines = code.split("\n");
     const findings = [];
     const assignments = extractAssignments(lines);

package/build/utils/ignore.js

@@ -90,6 +90,8 @@ function matchGlob(pattern, path) {
         }
     }
     try {
+        // regexStr is built from explicitly escaped glob chars (see line 90), not raw input.
+        // guardvibe-ignore VG126
         return new RegExp(regexStr).test(normalizedPath);
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.46",
+  "version": "3.0.48",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 365 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",