guardvibe 3.1.11 → 3.1.12

package/build/tools/check-code.js

@@ -333,6 +333,13 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         while ((lit = literalUrlAssignRe.exec(code)) !== null)
             literalUrlVars.add(lit[1]);
     }
+    // jsforce SOQL skip signal for VG123. jsforce's `conn.query()` is SOQL
+    // (Salesforce's query language), not SQL — different injection semantics, and
+    // jsforce does not support parameterized queries. The documented practice is
+    // manual escape via a `sanitize*Soql*` helper. File-level boolean: cheaper
+    // than re-testing both regexes per match.
+    const fileIsJsforceWithSoqlSanitizer = /from\s+["']@?jsforce[\w@/-]*["']/i.test(code) &&
+        /sanitiz\w*Soql\w*/i.test(code);
     // Config: check custom auth function names from .guardviberc
     if (!codeHasAuthGuard && config.authFunctions && config.authFunctions.length > 0) {
         const customPattern = new RegExp(`(?:${config.authFunctions.join("|")})\\s*\\(`, "i");
@@ -877,6 +884,16 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (isServiceVerbCall && !hasSqlKeyword)
                     continue;
             }
+            // Skip VG010/VG123 (SQL injection family) on jsforce SOQL calls. SOQL has
+            // different injection semantics than SQL and jsforce does not support
+            // parameterized queries — the documented practice is manual escape via a
+            // `sanitize*Soql*` helper. File must import jsforce AND use a SOQL
+            // sanitizer — both required, so a jsforce file that forgets to escape
+            // still fires. Both VG010 and VG123 are listed because the dedup logic
+            // (isDuplicatePair) collapses them on the same line; without skipping
+            // both, VG010 just takes over when VG123 is suppressed.
+            if ((rule.id === "VG123" || rule.id === "VG010") && fileIsJsforceWithSoqlSanitizer)
+                continue;
             // Skip supply chain rules for known legitimate packages
             if (["VG872", "VG873"].includes(rule.id)) {
                 const pkgMatch = /"([\w@/-]+)"/.exec(match[0]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.1.11",
+  "version": "3.1.12",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 390 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis, +25 AI-native rules (MCP supply-chain, RAG/vector poisoning, agent loop DoS, public-prefix LLM keys, sandbox bypass). Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",