guardvibe 3.0.51 → 3.0.53

package/build/data/rules/core.js

@@ -7,7 +7,7 @@ export const coreRules = [
         severity: "critical",
         owasp: "A01:2025 Broken Access Control",
         description: "Hardcoded passwords, API keys, or secrets detected in source code.",
-        pattern: /(?:secret_?key|api_?key|api_?secret|private_?key|access_?key|password|passwd|pwd|auth_?token|jwt_?secret|app_?secret|master_?key|signing_?key|encryption_?key)\w*\s*[:=]\s*['"][^'"]{3,}['"]/gi,
+        pattern: /(?:secret_?key|api_?key|api_?secret|private_?key|access_?key|password|passwd|pwd|auth_?token|jwt_?secret|app_?secret|master_?key|signing_?key|encryption_?key)\w*\s*[:=]\s*['"][^'"\n]{3,}['"]/gi,
         languages: ["javascript", "typescript", "python", "go"],
         fix: "Use environment variables (process.env.SECRET) or a secrets manager. Never commit credentials to source code.",
         fixCode: "// Use environment variables instead\nconst password = process.env.DB_PASSWORD;\nconst apiKey = process.env.API_KEY;",
@@ -212,7 +212,7 @@ export const coreRules = [
         severity: "critical",
         owasp: "A07:2025 Auth Failures",
         description: "Variable named secret, password, or apiKey assigned a string literal. Secrets should come from environment variables or a secrets manager, never hardcoded in source.",
-        pattern: /(?:(?:const|let|var|export)\s+)?(?:secret|password|passwd|apiKey|api_key|privateKey|private_key|signingKey|signing_key|encryptionKey|encryption_key|masterKey|master_key|dbPassword|db_password)\s*(?::\s*string\s*)?=\s*["'][^"']{8,}["']/gi,
+        pattern: /(?:(?:const|let|var|export)\s+)?(?:secret|password|passwd|apiKey|api_key|privateKey|private_key|signingKey|signing_key|encryptionKey|encryption_key|masterKey|master_key|dbPassword|db_password)\s*(?::\s*string\s*)?=\s*["'][^"'\n]{8,}["']/gi,
         languages: ["javascript", "typescript", "python"],
         fix: "Use environment variables: const secret = process.env.MY_SECRET. Never hardcode secrets in source code.",
         fixCode: "// Use environment variables\nconst secret = process.env.JWT_SECRET;\nconst apiKey = process.env.API_KEY;\n\n// In .env.local (never commit this file)\nJWT_SECRET=your-secret-here",

package/build/tools/check-code.js

@@ -648,6 +648,11 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
             if (rule.id === "VG001" || rule.id === "VG062") {
                 if (isHumanReadableString(lines, lineNumber))
                     continue;
+                // Translation/locale files and event-tracker key maps are not credential stores —
+                // values are UI strings (`password: "Heslo"`) or analytics event names
+                // (`forgot_password: "forgot_password_clicked"`).
+                if (filePath && /(?:\/i18n\/|\/locales?\/|\/translations?\/|\/event[-_]tracker\/|\/analytics\/events\/|\/messages\/[a-z]{2}(?:[-_][A-Z]{2})?\.[jt]sx?$)/i.test(filePath))
+                    continue;
             }
             // Skip credential rules when the variable name signals test/example/mock intent.
             // e.g. `testingPassword`, `examplePassword`, `mockApiKey`, `placeholderSecret`.
@@ -655,6 +660,15 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 const matchedLine = lines[lineNumber - 1] ?? "";
                 if (/(?:^|\s|\b)(?:testing|example|mock|placeholder|sample|demo|fake|dummy|stub|fixture)[A-Z_]/.test(matchedLine))
                     continue;
+                // Skip TypeScript string-enum stringification: `INLINE_PASSWORD = "INLINE_PASSWORD"`.
+                // No real credential has identical name and value — canonical TS enum-key pattern.
+                // Covers both SCREAMING_SNAKE (TS string enums) and snake_case (event-tracker key maps).
+                if (/\b([A-Za-z_][A-Za-z0-9_]*)\s*[:=]\s*["']\1["']/.test(matchedLine))
+                    continue;
+                // Skip SCREAMING_SNAKE error/status codes whose value is digits-only.
+                // e.g. `INVALID_PASSWORD = "5020"` — error code, not a credential.
+                if (/\b[A-Z][A-Z0-9_]*\s*=\s*["']\d+["']/.test(matchedLine))
+                    continue;
             }
             // Skip VG010 (SQL injection) on Angular HTTP service calls — http.get/post/etc.
             // are HTTP client methods, not SQL. The existing pattern's `get` keyword catches them.
@@ -667,9 +681,21 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                     continue;
                 // Also skip when matched call has no SQL keyword anywhere on the line — covers fetch/axios template-literal URLs.
                 const hasSqlKeyword = /\b(?:SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|JOIN|UNION|DROP|TRUNCATE|ALTER|CREATE\s+TABLE)\b/i.test(matchedLine);
-                const isFetchOrAxios = /(?:fetch|axios|got|ky|undici|request)\s*[.\(]|axios\.(?:get|post|put|delete|patch)/i.test(matchedLine);
+                // Python `requests.get/post` and `requests.request(...)` are HTTP, not SQL.
+                const isFetchOrAxios = /(?:fetch|axios|got|ky|undici|requests?)\s*[.\(]|axios\.(?:get|post|put|delete|patch)/i.test(matchedLine);
                 if (isFetchOrAxios && !hasSqlKeyword)
                     continue;
+                // Skip when the first call argument is a URL path (starts with `/`) and no SQL keyword is on the line.
+                // Covers service-class HTTP wrappers like `this.get(`/api/...${id}/...`)` where the receiver
+                // isn't named http/api/client. SQL queries never start with `/`; URL paths always do.
+                const firstArgIsUrlPath = /\(\s*[`'"]\s*\/[a-zA-Z0-9_\-/{}$]/.test(matchedLine);
+                if (firstArgIsUrlPath && !hasSqlKeyword)
+                    continue;
+                // Service-class HTTP wrapper: `this.get/post/...` with first arg starting from a URL-base var
+                // like `${this.basePath}/...` or `${apiUrl}/...`. SQL queries don't use `this.<verb>` style.
+                const isServiceVerbCall = /(?:^|[\s=])(?:return\s+|await\s+)?this\.(?:get|post|put|delete|patch|head|options|fetch|request)\s*\(/i.test(matchedLine);
+                if (isServiceVerbCall && !hasSqlKeyword)
+                    continue;
             }
             // Skip supply chain rules for known legitimate packages
             if (["VG872", "VG873"].includes(rule.id)) {

package/build/tools/full-audit.js

@@ -223,11 +223,30 @@ export async function runFullAudit(path, options) {
     }
     // --- Section 3: Dependencies ---
     if (!options?.skipDeps) {
-        const manifestPath = resolve(projectRoot, "package.json");
+        // Prefer lockfiles for resolved (installed) versions over package.json spec ranges.
+        // package.json says `"@clerk/nextjs": "^7.0.1"` but the installed version may be 7.2.8.
+        // OSV needs the resolved version to give accurate vuln matches; spec lower bound
+        // produces false positives where the bug was already patched in a higher minor.
+        const lockCandidates = ["package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml"];
+        let manifestPath = resolve(projectRoot, "package.json");
+        for (const lock of lockCandidates) {
+            const lockPath = resolve(projectRoot, lock);
+            if (existsSync(lockPath)) {
+                manifestPath = lockPath;
+                break;
+            }
+        }
         if (existsSync(manifestPath)) {
             try {
                 const depsJson = await scanDependencies(manifestPath, "json");
                 const parsed = safeJsonParse(depsJson);
+                if (!parsed) {
+                    // scanDependencies returned a markdown error (OSV API unreachable, parse failed, etc).
+                    // Push a dependencies section so downstream consumers always see it; surface the
+                    // error in `details` so users can troubleshoot instead of silently missing the section.
+                    const errSnippet = (depsJson.match(/Error:[^\n]+/) || ["Scan failed"])[0];
+                    sections.push({ name: "dependencies", status: "error", findings: 0, critical: 0, high: 0, medium: 0, details: errSnippet });
+                }
                 if (parsed) {
                     const vulnPackages = parsed.summary?.vulnerable ?? 0;
                     const depFindings = [];

package/build/utils/osv-client.js

@@ -15,47 +15,51 @@ export async function queryOsv(name, version, ecosystem) {
     return data.vulns ?? [];
 }
 export async function queryOsvBatch(packages) {
-    const queries = packages.map(pkg => ({
-        package: { name: pkg.name, ecosystem: pkg.ecosystem },
-        version: pkg.version,
-    }));
-    const response = await fetch("https://api.osv.dev/v1/querybatch", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ queries }),
-        signal: AbortSignal.timeout(10000),
-    });
     const results = new Map();
-    if (!response.ok) {
-        throw new Error(`OSV batch API error: ${response.status} ${response.statusText}`);
-    }
-    const data = await response.json();
-    // Batch API returns minimal vuln info (just id). Fetch full details for each.
-    for (let i = 0; i < packages.length; i++) {
-        const key = `${packages[i].name}@${packages[i].version}`;
-        const batchVulns = data.results[i]?.vulns || [];
-        if (batchVulns.length === 0) {
-            results.set(key, []);
-            continue;
+    // OSV batch can time out on large monorepo lockfiles (1000+ packages),
+    // and very-large requests can be rate-limited. Chunk into 500-pkg batches
+    // and process sequentially so the per-request timeout is generous.
+    const CHUNK_SIZE = 500;
+    for (let start = 0; start < packages.length; start += CHUNK_SIZE) {
+        const chunk = packages.slice(start, start + CHUNK_SIZE);
+        const queries = chunk.map(pkg => ({
+            package: { name: pkg.name, ecosystem: pkg.ecosystem },
+            version: pkg.version,
+        }));
+        const response = await fetch("https://api.osv.dev/v1/querybatch", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ queries }),
+            signal: AbortSignal.timeout(60000),
+        });
+        if (!response.ok) {
+            throw new Error(`OSV batch API error: ${response.status} ${response.statusText}`);
         }
-        // Fetch full vulnerability details by ID
-        const fullVulns = [];
-        for (const bv of batchVulns) {
-            try {
-                const vulnResponse = await fetch(`https://api.osv.dev/v1/vulns/${bv.id}`, {
-                    signal: AbortSignal.timeout(5000),
-                });
-                if (vulnResponse.ok) {
-                    const vulnData = await vulnResponse.json();
-                    fullVulns.push(vulnData);
-                }
+        const data = await response.json();
+        for (let i = 0; i < chunk.length; i++) {
+            const key = `${chunk[i].name}@${chunk[i].version}`;
+            const batchVulns = data.results[i]?.vulns || [];
+            if (batchVulns.length === 0) {
+                results.set(key, []);
+                continue;
             }
-            catch {
-                // If individual fetch fails, use minimal info
-                fullVulns.push({ id: bv.id, summary: "Details unavailable" });
+            const fullVulns = [];
+            for (const bv of batchVulns) {
+                try {
+                    const vulnResponse = await fetch(`https://api.osv.dev/v1/vulns/${bv.id}`, {
+                        signal: AbortSignal.timeout(5000),
+                    });
+                    if (vulnResponse.ok) {
+                        const vulnData = await vulnResponse.json();
+                        fullVulns.push(vulnData);
+                    }
+                }
+                catch {
+                    fullVulns.push({ id: bv.id, summary: "Details unavailable" });
+                }
             }
+            results.set(key, fullVulns);
         }
-        results.set(key, fullVulns);
     }
     return results;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.51",
+  "version": "3.0.53",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 365 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",