guardvibe 3.1.10 → 3.1.12

package/build/data/rules/core.js

@@ -392,7 +392,7 @@ export const coreRules = [
         severity: "high",
         owasp: "A10:2025 Server-Side Request Forgery",
         description: "User-controlled input is passed directly to fetch(), axios, or http.request() as the URL. Attackers can make the server request internal services (169.254.169.254 for cloud metadata, localhost admin panels, internal APIs) leading to data exfiltration or remote code execution.",
-        pattern: /(?:fetch|axios\.(?:get|post|put|delete|patch|request)|got(?:\.(?:get|post|put|delete|patch))?|http\.(?:get|request)|https\.(?:get|request)|urllib\.request\.urlopen)\s*\(\s*(?!["'`]https?:\/\/|["'`]\/|`\/|`\$\{process\.env|new\s+URL)(?:[a-zA-Z_$]\w*)\s*[,)]/gi,
+        pattern: /(?:\bfetch|axios\.(?:get|post|put|delete|patch|request)|got(?:\.(?:get|post|put|delete|patch))?|http\.(?:get|request)|https\.(?:get|request)|urllib\.request\.urlopen)\s*\(\s*(?!["'`]https?:\/\/|["'`]\/|`\/|`\$\{process\.env|new\s+URL)(?:[a-zA-Z_$]\w*)\s*[,)]/gi,
         languages: ["javascript", "typescript", "python"],
         fix: "Validate URLs against an allowlist of trusted domains. Block private/internal IP ranges (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x, ::1). Use a URL parser to check the hostname before making the request.",
         fixCode: '// Validate URL before fetching\nconst ALLOWED_HOSTS = ["api.example.com", "cdn.example.com"];\nconst parsed = new URL(userUrl);\nif (!ALLOWED_HOSTS.includes(parsed.hostname)) {\n  throw new Error("Blocked: untrusted host");\n}\n// Also block private IPs\nconst ip = await dns.resolve(parsed.hostname);\nif (isPrivateIP(ip)) throw new Error("Blocked: internal host");\nawait fetch(parsed.href);',

package/build/tools/check-code.js

@@ -321,6 +321,25 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         /(?:Date\.now\(\)|timestamp|uuid|nanoid|crypto\.randomUUID)[\s\S]{0,80}?\.\s*(?:ext|split|pop)/i.test(code);
     const isPeerDeps = /["']peerDependencies["']/i.test(code);
     const codeHasAuthSession = /(?:supabase\.auth\.getUser|supabase\.auth\.getSession|getServerSession|auth\(\)|getSession\(\)|currentUser\(\))/i.test(code);
+    // Variables assigned a hardcoded URL literal in the same file
+    // (`let requestUrl = "https://graph.microsoft.com/..."`). Used by VG120 to
+    // skip server-side fetch calls whose URL is a compile-time constant. Built
+    // once per file — re-running the regex per match was the dominant cost when
+    // a file had many fetch sites.
+    const literalUrlVars = new Set();
+    if (/\bhttps?:\/\//.test(code)) {
+        const literalUrlAssignRe = /\b(?:const|let|var)\s+([a-zA-Z_$][\w$]*)\s*(?::\s*[\w<>[\]| ]+)?\s*=\s*["'`]https?:\/\//g;
+        let lit;
+        while ((lit = literalUrlAssignRe.exec(code)) !== null)
+            literalUrlVars.add(lit[1]);
+    }
+    // jsforce SOQL skip signal for VG123. jsforce's `conn.query()` is SOQL
+    // (Salesforce's query language), not SQL — different injection semantics, and
+    // jsforce does not support parameterized queries. The documented practice is
+    // manual escape via a `sanitize*Soql*` helper. File-level boolean: cheaper
+    // than re-testing both regexes per match.
+    const fileIsJsforceWithSoqlSanitizer = /from\s+["']@?jsforce[\w@/-]*["']/i.test(code) &&
+        /sanitiz\w*Soql\w*/i.test(code);
     // Config: check custom auth function names from .guardviberc
     if (!codeHasAuthGuard && config.authFunctions && config.authFunctions.length > 0) {
         const customPattern = new RegExp(`(?:${config.authFunctions.join("|")})\\s*\\(`, "i");
@@ -865,6 +884,16 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (isServiceVerbCall && !hasSqlKeyword)
                     continue;
             }
+            // Skip VG010/VG123 (SQL injection family) on jsforce SOQL calls. SOQL has
+            // different injection semantics than SQL and jsforce does not support
+            // parameterized queries — the documented practice is manual escape via a
+            // `sanitize*Soql*` helper. File must import jsforce AND use a SOQL
+            // sanitizer — both required, so a jsforce file that forgets to escape
+            // still fires. Both VG010 and VG123 are listed because the dedup logic
+            // (isDuplicatePair) collapses them on the same line; without skipping
+            // both, VG010 just takes over when VG123 is suppressed.
+            if ((rule.id === "VG123" || rule.id === "VG010") && fileIsJsforceWithSoqlSanitizer)
+                continue;
             // Skip supply chain rules for known legitimate packages
             if (["VG872", "VG873"].includes(rule.id)) {
                 const pkgMatch = /"([\w@/-]+)"/.exec(match[0]);
@@ -953,6 +982,25 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (isClientFile)
                     continue;
             }
+            // Skip VG120 (SSRF) when the file is a React client component. SSRF requires the
+            // server to make the request; browser-side fetch in a client component runs from
+            // the user's own machine, so an attacker controlling the URL is just talking to
+            // their own network. Same client-marker shape used by VG106/VG407/VG678 narrowings.
+            if (rule.id === "VG120") {
+                const isClientFile = /^['"]use client['"]/.test(code.trimStart()) ||
+                    /\b(?:useState|useEffect|useReducer|useRef|useMemo|useCallback|useContext|useTransition|useSyncExternalStore|useLayoutEffect)\s*\(/.test(code);
+                if (isClientFile)
+                    continue;
+                // Skip when the URL variable is assigned a hardcoded literal in the same file
+                // (`let requestUrl = "https://..."` then `fetch(requestUrl)`). Mirrors the
+                // v3.1.7 VG409 literal-redirect skip — same shape, different sink. The set of
+                // literal-URL vars is built once per file (see top of analyzeCode).
+                if (literalUrlVars.size > 0) {
+                    const urlVar = /(?:fetch|axios\.\w+|got(?:\.\w+)?|http\.\w+|https\.\w+|urllib\.request\.urlopen)\s*\(\s*([a-zA-Z_$][\w$]*)/.exec(match[0]);
+                    if (urlVar && literalUrlVars.has(urlVar[1]))
+                        continue;
+                }
+            }
             // Skip VG1005 (.or() filter injection) when all interpolated variables are
             // server-verified auth IDs (user.id, session.user.id, auth.uid, currentUser.id)
             if (rule.id === "VG1005" && codeHasAuthSession) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.1.10",
+  "version": "3.1.12",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 390 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis, +25 AI-native rules (MCP supply-chain, RAG/vector poisoning, agent loop DoS, public-prefix LLM keys, sandbox bypass). Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",