guardvibe 3.1.21 → 3.1.22

package/build/tools/check-code.js

@@ -369,7 +369,7 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         // - VG010/VG011/VG013/VG014: injection rules trigger on payload strings like
         //   agent.get('/?q=' + sqlPayload) which match the regex but aren't database calls
         // - VG042/VG678: HTTP-response/security-header rules (tests don't serve to real users)
-        const isTestFile = filePath && /(?:\.(?:[\w-]+-)?(?:spec|test|e2e|stories|cy)\.(?:ts|tsx|js|jsx|mjs|cjs)$|_test\.go$|\/__tests__\/|\/tests?\/|\/cypress\/|\/playwright\/|\/dockertest\/|\/testutil\/|\/testhelpers?\/|\/testfixtures?\/)/i.test(filePath);
+        const isTestFile = filePath && /(?:\.(?:[\w-]+-)?(?:spec|test|e2e|stories|cy)\.(?:ts|tsx|js|jsx|mjs|cjs)$|_test\.go$|\/__tests__\/|\/__mocks__\/|\/tests?\/|\/cypress\/|\/playwright\/|\/dockertest\/|\/testutil\/|\/testhelpers?\/|\/testfixtures?\/)/i.test(filePath);
         if (isTestFile && ["VG001", "VG003", "VG062", "VG010", "VG011", "VG012", "VG013", "VG014", "VG042", "VG100", "VG130", "VG678", "VG955", "VG133", "VG1021", "VG409"].includes(rule.id))
             continue;
         // VG955 (Missing Pagination on List Endpoint): only fire on actual request-handling
@@ -878,6 +878,18 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                     if (declRe.test(code))
                         continue;
                 }
+                // Property-access shapes that defeat single-identifier matching:
+                //   - `z.enum(table.column.enumValues)` (Drizzle) — column.enumValues is a literal
+                //     array stamped into the schema at compile time, not user-mutable
+                //   - `z.enum(filterConfig.field.operators)` (TS `as const` config object) — when
+                //     the file has any `as const` cast, treat nested property access as static
+                const matchedLine = lines[lineNumber - 1] ?? "";
+                if (/z\.enum\s*\(\s*[\w$]+(?:\.[\w$]+)+/.test(matchedLine)) {
+                    if (/\.enumValues\b/.test(matchedLine))
+                        continue;
+                    if (/\bas\s+const\b/.test(code))
+                        continue;
+                }
             }
             // VG850 (AI Prompt Injection via User Input): only fire when at least one of the
             // interpolations in the system-prompt template literal looks like user input. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.1.21",
+  "version": "3.1.22",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 390 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis, +25 AI-native rules (MCP supply-chain, RAG/vector poisoning, agent loop DoS, public-prefix LLM keys, sandbox bypass). Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",