guardvibe 3.1.5 → 3.1.7

package/build/tools/check-code.js

@@ -351,7 +351,32 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         //   agent.get('/?q=' + sqlPayload) which match the regex but aren't database calls
         // - VG042/VG678: HTTP-response/security-header rules (tests don't serve to real users)
         const isTestFile = filePath && /(?:\.(?:[\w-]+-)?(?:spec|test|e2e|stories|cy)\.(?:ts|tsx|js|jsx|mjs|cjs)$|\/__tests__\/|\/tests?\/|\/cypress\/|\/playwright\/)/i.test(filePath);
-        if (isTestFile && ["VG001", "VG062", "VG010", "VG011", "VG013", "VG014", "VG042", "VG130", "VG678"].includes(rule.id))
+        if (isTestFile && ["VG001", "VG062", "VG010", "VG011", "VG013", "VG014", "VG042", "VG130", "VG678", "VG955", "VG133", "VG1021", "VG409"].includes(rule.id))
+            continue;
+        // VG955 (Missing Pagination on List Endpoint): only fire on actual request-handling
+        // surfaces — API routes, App Router `route.{ts,tsx}`, pages/api, or Server Actions.
+        // Library helpers, getStaticProps, internal _utils, and lib/handler test fixtures
+        // also use `findMany` but aren't list endpoints serving paginated client requests.
+        if (rule.id === "VG955" && filePath) {
+            const isRouteFile = /(?:\/api\/|\/route\.(?:ts|tsx|js|jsx)$|\/pages\/api\/|\/app\/api\/)/.test(filePath);
+            const isServerAction = /^\s*['"]use server['"];?\s*$/m.test(code.slice(0, 500));
+            const isStaticBuildHelper = /(?:getStaticProps|getStaticPaths|generateStaticParams|buildLegacy|getServerSideProps)/.test(filePath);
+            if (!isRouteFile && !isServerAction)
+                continue;
+            if (isStaticBuildHelper)
+                continue;
+        }
+        // VG506 (Hardcoded Secret in Vercel Config): the rule's intent is `vercel.json`
+        // specifically — its `_KEY`/`_SECRET`/`_TOKEN` regex unintentionally matched
+        // translation values in i18n locale JSONs (`packages/i18n/locales/da/common.json`
+        // etc. with strings like "user_secret_phrase": "<long Danish text>"). Restrict to
+        // actual Vercel config files.
+        if (rule.id === "VG506" && filePath && !/(?:^|\/)vercel\.json$/.test(filePath))
+            continue;
+        // VG041 (Debug mode in production): playground/demo/example paths are explicitly
+        // debug-mode showcases — `DEBUG = true` is the entire point of the file. Skip
+        // those paths to avoid swamping the report.
+        if (rule.id === "VG041" && filePath && /\/(?:playground|demos?|examples?|sandbox)\//i.test(filePath))
             continue;
         // Skip Expo-specific rule (VG708) when project is not an Expo app.
         // The rule's regex incorrectly matches the literal strings "app.json"/"app.config.ts"
@@ -696,6 +721,20 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (dockerStageAliases.has(target))
                     continue;
             }
+            // VG409 (Open Redirect via User Input): the rule's pattern matches based on the
+            // variable name (`redirectUrl`, `returnTo`, `callbackUrl`, `next`, etc.) regardless
+            // of how the variable was assigned. Skip when the variable is assigned to a string
+            // literal in the same file with no template-literal interpolation — that's a
+            // hardcoded redirect target, not user input.
+            if (rule.id === "VG409") {
+                const varMatch = match[0].match(/\(\s*(\w+)/);
+                if (varMatch) {
+                    const varName = varMatch[1];
+                    const literalAssign = new RegExp(`\\b(?:const|let|var)\\s+${varName}\\s*(?::\\s*[\\w<>\\[\\],\\s]+\\s*)?=\\s*(?:"[^"]*"|'[^']*'|\`[^\`$]*\`)\\s*;?`);
+                    if (literalAssign.test(code))
+                        continue;
+                }
+            }
             // Skip matches on comment lines and inside string literals.
             // CVE version-pin rules (VG900-VG931) are exempt — they scan package.json
             // dependency declarations where these contexts don't apply.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.1.5",
+  "version": "3.1.7",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 390 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis, +25 AI-native rules (MCP supply-chain, RAG/vector poisoning, agent loop DoS, public-prefix LLM keys, sandbox bypass). Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",