guardvibe 3.1.14 → 3.1.16

package/build/data/rules/database.js

@@ -17,14 +17,14 @@ export const databaseRules = [
     // RLS is a database-level config, not detectable from application code patterns.
     {
         id: "VG432",
-        name: "Prisma Raw Query Injection",
+        name: "Prisma Raw Query Injection (call-form)",
         severity: "critical",
         owasp: "A03:2025 Injection",
-        description: "Prisma $queryRaw or $executeRaw with template literal interpolation. Use Prisma.sql tagged template for safe parameterization.",
-        pattern: /\.\$(?:queryRaw|executeRaw)`[^`]*\$\{(?!Prisma\.)/g,
+        description: "Prisma $queryRaw / $executeRaw invoked as a function with a non-Prisma.sql backtick string argument. The tagged-template form (prisma.$queryRaw`...${var}...`) is auto-parameterized by Prisma and is safe; the call-form (prisma.$queryRaw(`...${var}...`)) interpolates the variable in JS first and bypasses parameterization. Prisma rejects the non-Prisma.sql call-form at runtime, but if it slipped past review it would be a critical injection vector.",
+        pattern: /\.\$(?:queryRaw|executeRaw)\s*\(\s*`[^`]*\$\{(?!Prisma\.)/g,
         languages: ["javascript", "typescript"],
-        fix: "Use Prisma.sql tagged template for safe parameterization.",
-        fixCode: 'import { Prisma } from "@prisma/client";\n\nconst result = await prisma.$queryRaw(\n  Prisma.sql`SELECT * FROM users WHERE id = ${userId}`\n);',
+        fix: "Use the tagged-template form (prisma.$queryRaw`SELECT ... ${var}`) or wrap the argument in Prisma.sql (prisma.$queryRaw(Prisma.sql`SELECT ... ${var}`)). Both are auto-parameterized.",
+        fixCode: "// Tagged template (preferred — auto-parameterized)\nconst rows = await prisma.$queryRaw`SELECT * FROM users WHERE id = ${userId}`;\n\n// Or with Prisma.sql wrapper\nimport { Prisma } from \"@prisma/client\";\nconst rows = await prisma.$queryRaw(Prisma.sql`SELECT * FROM users WHERE id = ${userId}`);",
         compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
     },
     {

package/build/data/rules/other-services.js

@@ -28,8 +28,8 @@ export const otherServiceRules = [
         name: "Neon/Postgres Connection String Exposure",
         severity: "critical",
         owasp: "A07:2025 Sensitive Data Exposure",
-        description: "Neon or PostgreSQL connection string hardcoded in source code. Contains hostname, credentials, and database name.",
-        pattern: /(?:DATABASE_URL|connectionString|connection_string|pgConnectionString)\s*[:=]\s*["']postgres(?:ql)?:\/\/[^"'\s]{10,}["']/gi,
+        description: "Neon or PostgreSQL connection string hardcoded in source code with embedded credentials (user:pass@host shape). Local/docker URIs without credentials (e.g. postgres://localhost/db) are not flagged.",
+        pattern: /(?:DATABASE_URL|connectionString|connection_string|pgConnectionString)\s*[:=]\s*["']postgres(?:ql)?:\/\/[^"'\s/@]*@[^"'\s]+["']/gi,
         languages: ["javascript", "typescript"],
         fix: "Use DATABASE_URL environment variable. Never hardcode connection strings.",
         fixCode: 'import { neon } from "@neondatabase/serverless";\nconst sql = neon(process.env.DATABASE_URL!);',
@@ -52,8 +52,8 @@ export const otherServiceRules = [
         name: "MongoDB Connection String Exposure",
         severity: "critical",
         owasp: "A07:2025 Sensitive Data Exposure",
-        description: "MongoDB connection string hardcoded in source code. Contains credentials and cluster information.",
-        pattern: /(?:MONGODB_URI|MONGO_URL|mongoUri|mongoUrl|connectionString)\s*[:=]\s*["']mongodb(?:\+srv)?:\/\/[^"'\s]{10,}["']/gi,
+        description: "MongoDB connection string hardcoded in source code with embedded credentials (user:pass@host shape). Local/docker URIs without credentials (e.g. mongodb://localhost/db) are not flagged.",
+        pattern: /(?:MONGODB_URI|MONGO_URL|mongoUri|mongoUrl|connectionString)\s*[:=]\s*["']mongodb(?:\+srv)?:\/\/[^"'\s/@]*@[^"'\s]+["']/gi,
         languages: ["javascript", "typescript"],
         fix: "Use MONGODB_URI environment variable. Never hardcode connection strings.",
         fixCode: 'import { MongoClient } from "mongodb";\nconst client = new MongoClient(process.env.MONGODB_URI!);',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.1.14",
+  "version": "3.1.16",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 390 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis, +25 AI-native rules (MCP supply-chain, RAG/vector poisoning, agent loop DoS, public-prefix LLM keys, sandbox bypass). Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",