guardvibe 3.1.10 → 3.1.11

package/build/data/rules/core.js

@@ -392,7 +392,7 @@ export const coreRules = [
         severity: "high",
         owasp: "A10:2025 Server-Side Request Forgery",
         description: "User-controlled input is passed directly to fetch(), axios, or http.request() as the URL. Attackers can make the server request internal services (169.254.169.254 for cloud metadata, localhost admin panels, internal APIs) leading to data exfiltration or remote code execution.",
-        pattern: /(?:fetch|axios\.(?:get|post|put|delete|patch|request)|got(?:\.(?:get|post|put|delete|patch))?|http\.(?:get|request)|https\.(?:get|request)|urllib\.request\.urlopen)\s*\(\s*(?!["'`]https?:\/\/|["'`]\/|`\/|`\$\{process\.env|new\s+URL)(?:[a-zA-Z_$]\w*)\s*[,)]/gi,
+        pattern: /(?:\bfetch|axios\.(?:get|post|put|delete|patch|request)|got(?:\.(?:get|post|put|delete|patch))?|http\.(?:get|request)|https\.(?:get|request)|urllib\.request\.urlopen)\s*\(\s*(?!["'`]https?:\/\/|["'`]\/|`\/|`\$\{process\.env|new\s+URL)(?:[a-zA-Z_$]\w*)\s*[,)]/gi,
         languages: ["javascript", "typescript", "python"],
         fix: "Validate URLs against an allowlist of trusted domains. Block private/internal IP ranges (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x, ::1). Use a URL parser to check the hostname before making the request.",
         fixCode: '// Validate URL before fetching\nconst ALLOWED_HOSTS = ["api.example.com", "cdn.example.com"];\nconst parsed = new URL(userUrl);\nif (!ALLOWED_HOSTS.includes(parsed.hostname)) {\n  throw new Error("Blocked: untrusted host");\n}\n// Also block private IPs\nconst ip = await dns.resolve(parsed.hostname);\nif (isPrivateIP(ip)) throw new Error("Blocked: internal host");\nawait fetch(parsed.href);',

package/build/tools/check-code.js

@@ -321,6 +321,18 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         /(?:Date\.now\(\)|timestamp|uuid|nanoid|crypto\.randomUUID)[\s\S]{0,80}?\.\s*(?:ext|split|pop)/i.test(code);
     const isPeerDeps = /["']peerDependencies["']/i.test(code);
     const codeHasAuthSession = /(?:supabase\.auth\.getUser|supabase\.auth\.getSession|getServerSession|auth\(\)|getSession\(\)|currentUser\(\))/i.test(code);
+    // Variables assigned a hardcoded URL literal in the same file
+    // (`let requestUrl = "https://graph.microsoft.com/..."`). Used by VG120 to
+    // skip server-side fetch calls whose URL is a compile-time constant. Built
+    // once per file — re-running the regex per match was the dominant cost when
+    // a file had many fetch sites.
+    const literalUrlVars = new Set();
+    if (/\bhttps?:\/\//.test(code)) {
+        const literalUrlAssignRe = /\b(?:const|let|var)\s+([a-zA-Z_$][\w$]*)\s*(?::\s*[\w<>[\]| ]+)?\s*=\s*["'`]https?:\/\//g;
+        let lit;
+        while ((lit = literalUrlAssignRe.exec(code)) !== null)
+            literalUrlVars.add(lit[1]);
+    }
     // Config: check custom auth function names from .guardviberc
     if (!codeHasAuthGuard && config.authFunctions && config.authFunctions.length > 0) {
         const customPattern = new RegExp(`(?:${config.authFunctions.join("|")})\\s*\\(`, "i");
@@ -953,6 +965,25 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (isClientFile)
                     continue;
             }
+            // Skip VG120 (SSRF) when the file is a React client component. SSRF requires the
+            // server to make the request; browser-side fetch in a client component runs from
+            // the user's own machine, so an attacker controlling the URL is just talking to
+            // their own network. Same client-marker shape used by VG106/VG407/VG678 narrowings.
+            if (rule.id === "VG120") {
+                const isClientFile = /^['"]use client['"]/.test(code.trimStart()) ||
+                    /\b(?:useState|useEffect|useReducer|useRef|useMemo|useCallback|useContext|useTransition|useSyncExternalStore|useLayoutEffect)\s*\(/.test(code);
+                if (isClientFile)
+                    continue;
+                // Skip when the URL variable is assigned a hardcoded literal in the same file
+                // (`let requestUrl = "https://..."` then `fetch(requestUrl)`). Mirrors the
+                // v3.1.7 VG409 literal-redirect skip — same shape, different sink. The set of
+                // literal-URL vars is built once per file (see top of analyzeCode).
+                if (literalUrlVars.size > 0) {
+                    const urlVar = /(?:fetch|axios\.\w+|got(?:\.\w+)?|http\.\w+|https\.\w+|urllib\.request\.urlopen)\s*\(\s*([a-zA-Z_$][\w$]*)/.exec(match[0]);
+                    if (urlVar && literalUrlVars.has(urlVar[1]))
+                        continue;
+                }
+            }
             // Skip VG1005 (.or() filter injection) when all interpolated variables are
             // server-verified auth IDs (user.id, session.user.id, auth.uid, currentUser.id)
             if (rule.id === "VG1005" && codeHasAuthSession) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.1.10",
+  "version": "3.1.11",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 390 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis, +25 AI-native rules (MCP supply-chain, RAG/vector poisoning, agent loop DoS, public-prefix LLM keys, sandbox bypass). Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",