guardvibe 3.1.18 → 3.1.20

package/build/tools/check-code.js

@@ -417,6 +417,13 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         // Server-side batch context: scripts, migrations, seeds. These run offline or
         // on-deploy, not against user requests, so DoS-from-unbounded-results doesn't apply.
         const isBatchScriptFile = filePath && /\/(?:scripts?|migrations?|seeds?|fixtures?)\//i.test(filePath);
+        // Code-generator/scaffold templates. CLI tools (create-t3-app, create-next-app,
+        // create-react-app, etc.) bundle "Hello World" example files under cli/template/
+        // or templates/ that are intentionally minimal — no auth, no input validation,
+        // no rate limiting. These get copied into user projects where the user is
+        // expected to customize them. Flagging them in the CLI tool's own audit produces
+        // noise without surfacing real production risk.
+        const isTemplateFile = filePath && /\/(?:templates?|scaffolds?|stubs?|boilerplate)\//i.test(filePath);
         // Skip rate-limit rules when the file installs a global rate limiter via app.use().
         // Covers `app.use(rateLimit({...}))`, `app.use(limiter)`, `app.use('/api', rateLimit({...}))`,
         // and named middleware vars matching limiter naming conventions.
@@ -490,6 +497,11 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         // request handler to authorize. Rule still fires inside route handlers and Server Actions.
         if (rule.id === "VG1008" && isBatchScriptFile)
             continue;
+        // Skip tRPC educational/scaffold rules (VG970 publicProcedure-DB, VG971 missing-input)
+        // in template/scaffold files. CLI tools like create-t3-app ship intentionally simple
+        // examples under cli/template/ that the user is expected to replace before deploying.
+        if ((rule.id === "VG970" || rule.id === "VG971") && isTemplateFile)
+            continue;
         // Skip VG961 (z.any/z.unknown) in batch scripts and cron routes — `data: z.any()` and
         // similar opaque fields in migration/seed scripts and cron job payloads are intentional
         // passthroughs (e.g. Tinybird `tb.buildPipe({ parameters: ..., data: z.any() })`),
@@ -842,6 +854,48 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (/\b\w*Ref\.current\b/.test(matchedLine))
                     continue;
             }
+            // VG850 (AI Prompt Injection via User Input): only fire when at least one of the
+            // interpolations in the system-prompt template literal looks like user input. The
+            // pattern matches any `${...}` interpolation, but apps commonly compose system
+            // prompts from constants — `system: ` + "`${codePrompt}\\n...`" + ` — and these
+            // constants are not attacker-controlled. User-input shapes: `req.X`/`body.X`/
+            // `params.X`/`query.X`/`searchParams.X`, or bare identifiers named `userInput`,
+            // `userMessage`, `userPrompt`, `prompt`, `input`, `message`.
+            if (rule.id === "VG850") {
+                // Match starts at `system:` and ends at `${`. Look at the surrounding window
+                // for the rest of the template literal (it can span multiple lines).
+                const window = lines.slice(Math.max(0, lineNumber - 1), Math.min(lines.length, lineNumber + 6)).join("\n");
+                const interpolations = Array.from(window.matchAll(/\$\{([^}]+)\}/g)).map(m => m[1].trim());
+                if (interpolations.length > 0) {
+                    const isUserInput = (expr) => /\b(?:req|request|body|query|params|searchParams)\.\w+/.test(expr) ||
+                        /^(?:userInput|userMessage|userPrompt|prompt|input|message)\b/.test(expr) ||
+                        /\buser(?:Input|Message|Prompt|Query|Text|Content|Data)\b/.test(expr);
+                    if (!interpolations.some(isUserInput))
+                        continue;
+                }
+            }
+            // VG999 (AI Request Without maxTokens): skip when the call uses structured output
+            // (`output: Output.array(...)` / `output: Output.object(...)`) — token usage is
+            // bounded by the schema, not free-form text. The match already excludes calls
+            // that explicitly set maxTokens; structured-output calls are similarly bounded.
+            // Need to look at a wider window than match[0] because the match terminates at
+            // `}` and `output:` may appear elsewhere in the call options.
+            if (rule.id === "VG999") {
+                if (/\boutput\s*:\s*Output\.(?:array|object|enum)\s*\(/i.test(match[0]))
+                    continue;
+            }
+            // VG1027 (Conversation Messages Serialized to Client With System Role): skip when
+            // the response is built via a filter/conversion helper that strips the system role.
+            // Vercel AI SDK convention names: `convertToUIMessages` (recommended), `filterMessages`,
+            // `pickRole`, `sanitizeMessages`, `publicMessages`. Pattern matches up to the
+            // `messages` key but doesn't include the value, so check the surrounding lines.
+            if (rule.id === "VG1027") {
+                const surrounding = lines.slice(Math.max(0, lineNumber - 1), Math.min(lines.length, lineNumber + 3)).join("\n");
+                // No trailing \b — the helper names are CamelCase and continue with more word chars
+                // (convertToUIMessages, sanitizeMessagesForClient, etc.). Prefix match is intentional.
+                if (/\b(?:convertToUI|filterMessages|pickRole|sanitizeMessages|publicMessages|visibleMessages|userMessages|convertMessages)/i.test(surrounding))
+                    continue;
+            }
             // VG152 (Object Injection via Dynamic Property Access): only fire on bracket-key
             // ASSIGNMENT (`obj[key] = ...`) — that's the prototype-pollution shape. Read-only
             // bracket access (`obj[key]` on RHS, in conditional, in function arg) does not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.1.18",
+  "version": "3.1.20",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 390 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis, +25 AI-native rules (MCP supply-chain, RAG/vector poisoning, agent loop DoS, public-prefix LLM keys, sandbox bypass). Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",