insa-check-core 0.1.0

package/dist/code/javascript/module.js

@@ -0,0 +1,250 @@
+import { isJsDynamicString, isJsFunction, isJsNode, jsDotted, jsString, unwrap, walkJs } from "./ast.js";
+/** Client-controlled request data in Express, Koa, Fastify, Next.js API routes and NestJS-style handlers. */
+const REQUEST_DATA = /^(?:(?:this\.)?(?:req|request)\.(?:query|body|params|headers|cookies|files|file|url|originalUrl|path|rawBody)|ctx\.(?:query|params|request\.(?:body|query|headers))|searchParams)(?:$|[.[(])/;
+/** Names bound by a declaration target: identifiers, and every name inside destructuring patterns. */
+function boundNames(target) {
+    if (!isJsNode(target))
+        return [];
+    switch (target.type) {
+        case "Identifier":
+            return [target["name"]];
+        case "ObjectPattern":
+            return target["properties"].flatMap((p) => boundNames(p.type === "RestElement" ? p["argument"] : p["value"]));
+        case "ArrayPattern":
+            return target["elements"].flatMap(boundNames);
+        case "AssignmentPattern":
+            return boundNames(target["left"]);
+        case "RestElement":
+            return boundNames(target["argument"]);
+        default:
+            return [];
+    }
+}
+const COMPARISON = new Set(["==", "===", "!=", "!==", "<", "<=", ">", ">=", "in", "instanceof"]);
+/**
+ * Nodes whose value can flow into the expression's result. Skips parts that only produce booleans or
+ * pick between branches: comparison operands, typeof/!, and the test of a conditional expression.
+ */
+function* valueNodes(root) {
+    const stack = [root];
+    while (stack.length) {
+        const n = stack.pop();
+        if (n.type === "BinaryExpression" && COMPARISON.has(n["operator"]))
+            continue;
+        if (n.type === "UnaryExpression" && ["typeof", "!", "void"].includes(n["operator"]))
+            continue;
+        yield n;
+        if (n.type === "ConditionalExpression") {
+            for (const k of ["consequent", "alternate"])
+                if (isJsNode(n[k]))
+                    stack.push(n[k]);
+            continue;
+        }
+        for (const [k, v] of Object.entries(n)) {
+            if (k === "loc" || k === "extra" || k.endsWith("Comments"))
+                continue;
+            if (isJsNode(v))
+                stack.push(v);
+            else if (Array.isArray(v))
+                for (const x of v)
+                    if (isJsNode(x))
+                        stack.push(x);
+        }
+    }
+}
+const moduleName = (source) => source.replace(/^node:/, "");
+export class JsModule {
+    path;
+    tree;
+    lines;
+    /** Local name -> module or "module.export", from import statements and require() calls. */
+    imports = new Map();
+    scopes = new WeakMap();
+    constructor(path, tree, source) {
+        this.path = path;
+        this.tree = tree;
+        this.lines = source.split(/\r?\n/);
+        for (const n of walkJs(tree)) {
+            if (n.type === "ImportDeclaration") {
+                const source = moduleName(jsString(n["source"]) ?? "");
+                for (const s of n["specifiers"]) {
+                    const local = s["local"]["name"];
+                    if (s.type === "ImportSpecifier") {
+                        const imported = s["imported"];
+                        const name = imported.type === "Identifier" ? imported["name"] : (jsString(imported) ?? "");
+                        this.imports.set(local, name === "default" ? source : `${source}.${name}`);
+                    }
+                    else {
+                        this.imports.set(local, source);
+                    }
+                }
+            }
+            else if (n.type === "VariableDeclarator") {
+                // const x = require("m") / const { a, b: c } = require("m") / const x = require("m").y
+                const init = unwrap(n["init"]);
+                const required = this.requiredModule(init);
+                if (!required)
+                    continue;
+                const id = n["id"];
+                if (id.type === "Identifier")
+                    this.imports.set(id["name"], required);
+                else if (id.type === "ObjectPattern") {
+                    for (const p of id["properties"]) {
+                        if (p.type !== "ObjectProperty")
+                            continue;
+                        const key = p["key"];
+                        const value = p["value"];
+                        if (key.type === "Identifier" && value.type === "Identifier") {
+                            this.imports.set(value["name"], `${required}.${key["name"]}`);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    /** "m" for require("m"), "m.y" for require("m").y; undefined otherwise. */
+    requiredModule(init) {
+        if (!init)
+            return undefined;
+        if (init.type === "CallExpression" && jsDotted(init["callee"]) === "require") {
+            const arg = jsString(init["arguments"][0]);
+            return arg === undefined ? undefined : moduleName(arg);
+        }
+        if (init.type === "MemberExpression" && !init["computed"]) {
+            const base = this.requiredModule(unwrap(init["object"]));
+            const prop = init["property"];
+            return base && prop.type === "Identifier" ? `${base}.${prop["name"]}` : undefined;
+        }
+        return undefined;
+    }
+    /** Resolves the first segment of a dotted name through this file's imports. */
+    qualify(name) {
+        if (!name)
+            return undefined;
+        const [head, ...rest] = name.split(".");
+        const resolved = this.imports.get(head);
+        return resolved ? [resolved, ...rest].join(".") : name;
+    }
+    line(n) {
+        return n ? (this.lines[n - 1] ?? "") : "";
+    }
+    lineOf(node) {
+        return node.loc?.start.line ?? 1;
+    }
+    /** Exact source text of a node. */
+    text(node) {
+        const loc = node.loc;
+        if (!loc)
+            return "";
+        const { start, end } = loc;
+        if (start.line === end.line)
+            return this.line(start.line).slice(start.column, end.column);
+        const parts = [this.line(start.line).slice(start.column)];
+        for (let i = start.line + 1; i < end.line; i++)
+            parts.push(this.line(i));
+        parts.push(this.line(end.line).slice(0, end.column));
+        return parts.join("\n");
+    }
+    /** True when the expression contains client-controlled data, given the scope's tainted names. */
+    isRequestDerived(node, scope) {
+        if (!isJsNode(node))
+            return false;
+        for (const n of valueNodes(node)) {
+            if (n.type === "Identifier" && scope?.tainted.has(n["name"]))
+                return true;
+            if ((n.type === "MemberExpression" || n.type === "OptionalMemberExpression") && REQUEST_DATA.test(jsDotted(n) ?? ""))
+                return true;
+        }
+        return false;
+    }
+    /** Lightweight intra-procedural taint: request data and names assigned from it. */
+    scope(fn) {
+        if (!fn)
+            return undefined;
+        let scope = this.scopes.get(fn);
+        if (scope)
+            return scope;
+        scope = { tainted: new Set(), dynamicStrings: new Set(), calls: new Set() };
+        this.scopes.set(fn, scope);
+        const body = fn["body"];
+        const nodes = isJsNode(body) ? [...walkJs(body, isJsFunction)] : [];
+        // Two passes so that assignments inside loops propagate.
+        for (let pass = 0; pass < 2; pass++) {
+            for (const n of nodes) {
+                let target;
+                let value;
+                if (n.type === "VariableDeclarator")
+                    [target, value] = [n["id"], n["init"]];
+                else if (n.type === "AssignmentExpression")
+                    [target, value] = [n["left"], n["right"]];
+                else if (n.type === "ForOfStatement" || n.type === "ForInStatement") {
+                    const left = n["left"];
+                    target = left.type === "VariableDeclaration" ? left["declarations"][0]?.["id"] : left;
+                    value = n["right"];
+                }
+                else
+                    continue;
+                const names = boundNames(target);
+                if (this.isRequestDerived(value, scope))
+                    names.forEach((x) => scope.tainted.add(x));
+                if (isJsDynamicString(value))
+                    names.forEach((x) => scope.dynamicStrings.add(x));
+            }
+        }
+        for (const n of nodes) {
+            if (n.type === "CallExpression" || n.type === "OptionalCallExpression")
+                scope.calls.add(this.qualify(jsDotted(n["callee"])) ?? "");
+        }
+        return scope;
+    }
+}
+export class JsIndex {
+    modules;
+    parseErrors;
+    callSites;
+    constructor(modules, parseErrors) {
+        this.modules = modules;
+        this.parseErrors = parseErrors;
+    }
+    /** Every call and `new` expression with its resolved name and enclosing function. Computed once. */
+    calls() {
+        if (this.callSites)
+            return this.callSites;
+        const sites = [];
+        for (const module of this.modules) {
+            const stack = [[module.tree, undefined]];
+            while (stack.length) {
+                const [n, fn] = stack.pop();
+                if (n.type === "CallExpression" || n.type === "OptionalCallExpression" || n.type === "NewExpression") {
+                    const callee = unwrap(n["callee"]);
+                    const name = module.qualify(jsDotted(callee));
+                    const method = callee?.type === "Identifier"
+                        ? callee["name"]
+                        : callee && /MemberExpression$/.test(callee.type) && !callee["computed"]
+                            ? callee["property"]["name"]
+                            : undefined;
+                    sites.push({ module, node: n, name, method, fn, isNew: n.type === "NewExpression" });
+                }
+                const inner = isJsFunction(n) ? n : fn;
+                for (const [k, v] of Object.entries(n)) {
+                    if (k === "loc" || k === "extra" || k.endsWith("Comments"))
+                        continue;
+                    if (isJsNode(v))
+                        stack.push([v, inner]);
+                    else if (Array.isArray(v))
+                        for (const x of v)
+                            if (isJsNode(x))
+                                stack.push([x, inner]);
+                }
+            }
+        }
+        sites.sort((a, b) => a.module.path.localeCompare(b.module.path) || a.module.lineOf(a.node) - b.module.lineOf(b.node));
+        this.callSites = sites;
+        return sites;
+    }
+    /** Whether any module imports the given package (or a subpath of it). */
+    imports(pkg) {
+        return this.modules.some((m) => [...m.imports.values()].some((v) => v === pkg || v.startsWith(`${pkg}.`) || v.startsWith(`${pkg}/`)));
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/code/javascript/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/code/javascript/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAe,MAAM,UAAU,CAAC;AAEtH,6GAA6G;AAC7G,MAAM,YAAY,GAChB,8LAA8L,CAAC;AAwBjM,sGAAsG;AACtG,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,YAAY;YACf,OAAO,CAAC,MAAM,CAAC,MAAM,CAAW,CAAC,CAAC;QACpC,KAAK,eAAe;YAClB,OAAQ,MAAM,CAAC,YAAY,CAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9H,KAAK,cAAc;YACjB,OAAQ,MAAM,CAAC,UAAU,CAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/D,KAAK,mBAAmB;YACtB,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,KAAK,aAAa;YAChB,OAAO,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACxC;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;AAEjG;;;GAGG;AACH,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAY;IAC/B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAW,CAAC;YAAE,SAAS;QACvF,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAW,CAAC;YAAE,SAAS;QACxG,MAAM,CAAC,CAAC;QACR,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC;gBAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,SAAS;YACrE,IAAI,QAAQ,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,KAAK,MAAM,CAAC,IAAI,CAAC;oBAAE,IAAI,QAAQ,CAAC,CAAC,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEpE,MAAM,OAAO,QAAQ;IAOR,IAAI;IACJ,IAAI;IAPN,KAAK,CAAW;IACzB,2FAA2F;IAClF,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5B,MAAM,GAAG,IAAI,OAAO,EAA2B,CAAC;IAEjE,YACW,IAAY,EACZ,IAAY,EACrB,MAAc;oBAFL,IAAI;oBACJ,IAAI;QAGb,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAa,EAAE,CAAC;oBAC5C,MAAM,KAAK,GAAI,CAAC,CAAC,OAAO,CAAY,CAAC,MAAM,CAAW,CAAC;oBACvD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBACjC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAW,CAAC;wBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAE,QAAQ,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;wBACxG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;oBAC7E,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAClC,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC3C,uFAAuF;gBACvF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAW,CAAC;gBAC7B,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY;oBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAW,EAAE,QAAQ,CAAC,CAAC;qBAC1E,IAAI,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACrC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,CAAa,EAAE,CAAC;wBAC7C,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;4BAAE,SAAS;wBAC1C,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAW,CAAC;wBAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAW,CAAC;wBACnC,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;4BAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAW,EAAE,GAAG,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAW,EAAE,CAAC,CAAC;wBACpF,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,cAAc,CAAC,IAAwB;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7E,MAAM,GAAG,GAAG,QAAQ,CAAE,IAAI,CAAC,WAAW,CAAe,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAW,CAAC;YACxC,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,+EAA+E;IAC/E,OAAO,CAAC,IAAwB;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAK,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,CAAqB;QACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,IAAY;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iGAAiG;IACjG,gBAAgB,CAAC,IAAa,EAAE,KAAuB;QACrD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpF,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,IAAI,KAAK,0BAA0B,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpI,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,EAAsB;QAC1B,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1B,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAE3B,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,yDAAyD;QACzD,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,MAAe,CAAC;gBACpB,IAAI,KAAc,CAAC;gBACnB,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;oBAAE,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;qBACvE,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB;oBAAE,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;qBACjF,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACpE,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAW,CAAC;oBACjC,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAE,IAAI,CAAC,cAAc,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpG,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;gBACrB,CAAC;;oBAAM,SAAS;gBAChB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC;oBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrF,IAAI,iBAAiB,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,wBAAwB;gBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrI,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,OAAO,OAAO;IAIP,OAAO;IACP,WAAW;IAJd,SAAS,CAAgB;IAEjC,YACW,OAAmB,EACnB,WAA8C;uBAD9C,OAAO;2BACP,WAAW;IACnB,CAAC;IAEJ,oGAAoG;IACpG,KAAK;QACH,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAmC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YACzE,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;gBAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,wBAAwB,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACrG,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACnC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC9C,MAAM,MAAM,GACV,MAAM,EAAE,IAAI,KAAK,YAAY;wBAC3B,CAAC,CAAE,MAAM,CAAC,MAAM,CAAY;wBAC5B,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;4BACtE,CAAC,CAAG,MAAM,CAAC,UAAU,CAAY,CAAC,MAAM,CAAY;4BACpD,CAAC,CAAC,SAAS,CAAC;oBAClB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAAE,SAAS;oBACrE,IAAI,QAAQ,CAAC,CAAC,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;yBACnC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;wBAAE,KAAK,MAAM,CAAC,IAAI,CAAC;4BAAE,IAAI,QAAQ,CAAC,CAAC,CAAC;gCAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACtH,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACxI,CAAC;CACF"}

package/dist/code/php/index.d.ts

@@ -0,0 +1,92 @@
+/**
+ * PHP syntax trees come from php-parser (glayzzle), a pure-JavaScript PHP parser.
+ * Rules are written against its AST, loosely typed like the Python and JavaScript bridges.
+ */
+export interface PhpNode {
+    kind: string;
+    loc?: {
+        start: {
+            line: number;
+            column: number;
+            offset: number;
+        };
+        end: {
+            line: number;
+            column: number;
+            offset: number;
+        };
+    } | null;
+    [field: string]: unknown;
+}
+export interface PhpParseResult {
+    ast?: PhpNode;
+    error?: string;
+}
+/** Parses one file. Syntax errors are returned, not thrown, so one bad file never stops a scan. */
+export declare function parsePhp(source: string, filePath: string): PhpParseResult;
+export declare function isPhpNode(x: unknown): x is PhpNode;
+export declare function walkPhp(root: PhpNode, skip?: (n: PhpNode) => boolean): Generator<PhpNode>;
+export declare const isPhpFunction: (n: PhpNode) => boolean;
+/**
+ * Dotted form of an expression: "$var", "$obj->prop", "Class::member", "$_GET[id]", "func()".
+ * Namespaces lose their leading backslash.
+ */
+export declare function phpDotted(node: unknown): string | undefined;
+/** Value of a plain string literal (no interpolation). */
+export declare function phpString(node: unknown): string | undefined;
+export declare function isPhpLiteral(node: unknown): boolean;
+/** Interpolated string ("... $x ...") or "." concatenation involving a string. */
+export declare function isPhpDynamicString(node: unknown): boolean;
+export declare function phpArgs(call: PhpNode): PhpNode[];
+/** Variable, property and array-key names used in an expression (without "$"). */
+export declare function phpIdentifiers(node: PhpNode): string[];
+export interface PhpScope {
+    tainted: Set<string>;
+    dynamicStrings: Set<string>;
+    calls: Set<string>;
+}
+export interface PhpCallSite {
+    module: PhpModule;
+    node: PhpNode;
+    /** Qualified name: "mysqli_query", "$db->query", "Illuminate\\Support\\Facades\\DB::select". */
+    name: string | undefined;
+    /** Last segment: function or method name. */
+    method: string | undefined;
+    fn: PhpNode | undefined;
+    isNew: boolean;
+}
+export declare class PhpModule {
+    readonly path: string;
+    readonly tree: PhpNode;
+    readonly lines: string[];
+    /** Alias -> fully qualified class name, from `use` statements. */
+    readonly uses: Map<string, string>;
+    private readonly scopes;
+    constructor(path: string, tree: PhpNode, source: string);
+    /** Resolves the class part of "Class::member" / "Class" through `use` statements. */
+    qualify(name: string | undefined): string | undefined;
+    line(n: number | undefined): string;
+    lineOf(node: PhpNode): number;
+    text(node: PhpNode): string;
+    /** True when the expression contains client-controlled data, given the scope's tainted names. */
+    isRequestDerived(node: unknown, scope?: PhpScope): boolean;
+    /** Lightweight intra-procedural taint: request data, controller route parameters, and names assigned from them. */
+    scope(fnOrTop: PhpNode | undefined, inController?: boolean): PhpScope;
+}
+export declare class PhpIndex {
+    readonly modules: PhpModule[];
+    readonly parseErrors: {
+        file: string;
+        error: string;
+    }[];
+    private callSites?;
+    constructor(modules: PhpModule[], parseErrors: {
+        file: string;
+        error: string;
+    }[]);
+    /** Every call and `new` expression with its resolved name and enclosing function. Computed once. */
+    calls(): PhpCallSite[];
+    /** Whether any file contains the given text (for coarse "is this used at all" questions). */
+    mentions(pattern: RegExp): boolean;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/code/php/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/code/php/index.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE;QAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAChI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAQD,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mGAAmG;AACnG,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAOzE;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,OAAO,CAElD;AAED,wBAAiB,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAa1F;AAGD,eAAO,MAAM,aAAa,MAAO,OAAO,YAA+B,CAAC;AAKxE;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAsC3D;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAQ3D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEnD;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAUzD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,CAEhD;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAatD;AA2BD,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,gGAAgG;IAChG,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,EAAE,EAAE,OAAO,GAAG,SAAS,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,qBAAa,SAAS;IAOlB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO;IAPxB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,sBAA6B;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D,YACW,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACtB,MAAM,EAAE,MAAM,EASf;IAED,qFAAqF;IACrF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAMpD;IAED,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAElC;IAED,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAE5B;IAED,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAI1B;IAED,iGAAiG;IACjG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,CAYzD;IAED,mHAAmH;IACnH,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,YAAY,UAAQ,GAAG,QAAQ,CA8BlE;CACF;AAED,qBAAa,QAAQ;IAIjB,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE;IAC7B,QAAQ,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE;IAJzD,OAAO,CAAC,SAAS,CAAC,CAAgB;IAElC,YACW,OAAO,EAAE,SAAS,EAAE,EACpB,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,EACrD;IAEJ,oGAAoG;IACpG,KAAK,IAAI,WAAW,EAAE,CA0BrB;IAED,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEjC;CACF"}