insa-check-core 0.1.0

package/dist/code/checks/crypto.js

@@ -0,0 +1,100 @@
+import { djangoSettings } from "../django/settings.js";
+import { NO_PATTERN, pyFinding } from "../findings.js";
+import { callArgs, identifiers, isNode, kwarg, strConst, walk } from "../python/index.js";
+import { PASSWORD_IDENT, patternCheck, SECURITY_CONTEXT } from "./shared.js";
+const WEAK_HASH = new Set([
+    "hashlib.md5", "hashlib.sha1",
+    "Crypto.Hash.MD5.new", "Crypto.Hash.SHA.new", "Crypto.Hash.SHA1.new",
+    "Cryptodome.Hash.MD5.new", "Cryptodome.Hash.SHA1.new",
+]);
+const WEAK_CIPHER_MODULE = /^(Crypto|Cryptodome)\.Cipher\.(DES|DES3|ARC2|ARC4|Blowfish|CAST|XOR)\.new$/;
+const WEAK_CIPHER_ALG = /^cryptography\.hazmat\.primitives\.ciphers\.algorithms\.(TripleDES|ARC4|Blowfish|IDEA|CAST5|SEED)$/;
+const WEAK_TLS_CONST = /^ssl\.PROTOCOL_(SSLv2|SSLv3|SSLv23|TLSv1|TLSv1_1)$/;
+const WEAK_HASHERS = /(MD5|SHA1|UnsaltedMD5|UnsaltedSHA1|Crypt)PasswordHasher$/;
+const FAST_HASH = /^hashlib\.(md5|sha1|sha224|sha256|sha384|sha512|sha3_\w+|blake2[bs]|new)$/;
+const RANDOM_FN = /^random\.(random|randint|randrange|choice|choices|getrandbits|sample|uniform)$/;
+const HTTP_CLIENT = /^(requests|httpx)\.(get|post|put|patch|delete|head|options|request|Client|AsyncClient|Session)$/;
+const hashAlg = (call) => strConst(callArgs(call)[0] ?? kwarg(call, "name"))?.toLowerCase();
+/** #19 Weak / unproven algorithms. */
+export const weakCrypto = patternCheck("py-weak-crypto", ["python"], (index, ctx) => {
+    const out = [];
+    for (const site of index.calls()) {
+        const { module, node, name = "" } = site;
+        if (kwarg(node, "usedforsecurity")?.["value"] === false)
+            continue; // explicitly non-security use
+        const isWeakHash = WEAK_HASH.has(name) || (name === "hashlib.new" && ["md5", "sha1"].includes(hashAlg(node) ?? ""));
+        if (isWeakHash) {
+            // MD5/SHA-1 are fine for cache keys/ETags; only security use is a definite problem.
+            const security = SECURITY_CONTEXT.test(module.line(node._l)) || SECURITY_CONTEXT.test(site.fn?.["name"] ?? "");
+            out.push(pyFinding(module, node, "py-weak-hash", security ? "high" : "low", security ? "MD5/SHA-1 are broken for security purposes (collisions, fast brute force)." : "MD5/SHA-1 in use; acceptable only for non-security checksums. Confirm how it is used."));
+        }
+        else if (WEAK_CIPHER_MODULE.test(name) || WEAK_CIPHER_ALG.test(name)) {
+            out.push(pyFinding(module, node, "py-weak-cipher", "high", "DES/3DES/RC4/Blowfish-class ciphers are deprecated and breakable."));
+        }
+    }
+    for (const module of index.modules) {
+        for (const n of walk(module.tree)) {
+            if (n._t === "Attribute" && WEAK_TLS_CONST.test(module.qualify(`${dottedAttr(n)}`) ?? "")) {
+                out.push(pyFinding(module, n, "py-weak-tls-protocol", "high", "Selects SSL/TLS protocol versions with known weaknesses."));
+            }
+        }
+    }
+    if (ctx.project.frameworks.includes("django")) {
+        const hashers = djangoSettings(index).get("PASSWORD_HASHERS");
+        if (hashers && Array.isArray(hashers.value) && typeof hashers.value[0] === "string" && WEAK_HASHERS.test(hashers.value[0])) {
+            out.push(djangoSettings(index).findingAt(hashers.at, "django-weak-password-hasher", "high", "Passwords are hashed with a weak default hasher (MD5/SHA-1/crypt)."));
+        }
+    }
+    return out;
+}, (n) => NO_PATTERN("use of weak hashes, ciphers or TLS protocol constants", n));
+/** #20 Incorrect use of primitives. */
+export const cryptoMisuse = patternCheck("py-crypto-misuse", ["python"], (index) => {
+    const out = [];
+    for (const site of index.calls()) {
+        const { module, node, name = "" } = site;
+        const args = [...callArgs(node), ...((node["keywords"] ?? []).map((k) => k["value"]))];
+        if (FAST_HASH.test(name) && callArgs(node).some((a) => identifiers(a).some((i) => PASSWORD_IDENT.test(i)))) {
+            out.push(pyFinding(module, node, "py-fast-password-hash", "high", "Passwords hashed with a fast, unsalted hash can be brute-forced; use a password hasher (PBKDF2, bcrypt, Argon2)."));
+        }
+        else if (RANDOM_FN.test(name) && SECURITY_CONTEXT.test(module.line(node._l))) {
+            out.push(pyFinding(module, node, "py-insecure-random", "medium", "The random module is predictable; use the secrets module for tokens, passwords and keys."));
+        }
+        else if (/\.(AES|DES3?|Blowfish)\.new$/.test(name) || /ciphers\.Cipher$/.test(name)) {
+            if (args.some((a) => isNode(a) && a._t === "Constant" && a["_bytes"])) {
+                out.push(pyFinding(module, node, "py-static-key-iv", "medium", "A hard-coded key or IV makes encryption predictable or reusable."));
+            }
+        }
+        else if (/\.modes\.ECB$/.test(name)) {
+            out.push(pyFinding(module, node, "py-ecb-mode", "high", "ECB mode leaks plaintext patterns; use an authenticated mode such as GCM."));
+        }
+        else if (name === "ssl._create_unverified_context") {
+            out.push(pyFinding(module, node, "py-tls-unverified", "high", "Disables TLS certificate verification, allowing man-in-the-middle attacks."));
+        }
+        else if (HTTP_CLIENT.test(name) && kwarg(node, "verify")?.["value"] === false) {
+            out.push(pyFinding(module, node, "py-tls-verify-false", "high", "verify=False disables TLS certificate verification, allowing man-in-the-middle attacks."));
+        }
+    }
+    for (const module of index.modules) {
+        for (const n of walk(module.tree)) {
+            if (n._t === "Attribute" && n["attr"] === "MODE_ECB") {
+                out.push(pyFinding(module, n, "py-ecb-mode", "high", "ECB mode leaks plaintext patterns; use an authenticated mode such as GCM."));
+            }
+            else if (n._t === "Attribute" && module.qualify(dottedAttr(n)) === "ssl.CERT_NONE") {
+                out.push(pyFinding(module, n, "py-tls-cert-none", "medium", "ssl.CERT_NONE disables certificate verification."));
+            }
+        }
+    }
+    return out;
+}, (n) => NO_PATTERN("cryptographic misuse (fast password hashes, insecure randomness, ECB, static keys/IVs, disabled TLS verification)", n));
+function dottedAttr(n) {
+    const parts = [];
+    let cur = n;
+    while (isNode(cur) && cur._t === "Attribute") {
+        parts.unshift(cur["attr"]);
+        cur = cur["value"];
+    }
+    if (isNode(cur) && cur._t === "Name")
+        parts.unshift(cur["id"]);
+    return parts.join(".");
+}
+//# sourceMappingURL=crypto.js.map

package/dist/code/checks/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/code/checks/crypto.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAe,MAAM,oBAAoB,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,aAAa,EAAE,cAAc;IAC7B,qBAAqB,EAAE,qBAAqB,EAAE,sBAAsB;IACpE,yBAAyB,EAAE,0BAA0B;CACtD,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,4EAA4E,CAAC;AACxG,MAAM,eAAe,GAAG,oGAAoG,CAAC;AAC7H,MAAM,cAAc,GAAG,oDAAoD,CAAC;AAC5E,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAChF,MAAM,SAAS,GAAG,2EAA2E,CAAC;AAC9F,MAAM,SAAS,GAAG,gFAAgF,CAAC;AACnG,MAAM,WAAW,GAAG,iGAAiG,CAAC;AAEtH,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;AAEpG,sCAAsC;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CACpC,gBAAgB,EAChB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACb,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK;YAAE,SAAS,CAAC,8BAA8B;QACjG,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpH,IAAI,UAAU,EAAE,CAAC;YACf,oFAAoF;YACpF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAY,IAAI,EAAE,CAAC,CAAC;YAC3H,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EACxE,QAAQ,CAAC,CAAC,CAAC,4EAA4E,CAAC,CAAC,CAAC,uFAAuF,CAAC,CAAC,CAAC;QACxL,CAAC;aAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,mEAAmE,CAAC,CAAC,CAAC;QACnI,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC1F,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,sBAAsB,EAAE,MAAM,EAAE,0DAA0D,CAAC,CAAC,CAAC;YAC7H,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3H,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,6BAA6B,EAAE,MAAM,EACxF,oEAAoE,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,uDAAuD,EAAE,CAAC,CAAC,CAC9E,CAAC;AAEF,uCAAuC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CACtC,kBAAkB,EAClB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAE,IAAI,CAAC,UAAU,CAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAW,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3G,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAC9D,kHAAkH,CAAC,CAAC,CAAC;QACzH,CAAC;aAAM,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAC7D,0FAA0F,CAAC,CAAC,CAAC;QACjG,CAAC;aAAM,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,kEAAkE,CAAC,CAAC,CAAC;YACtI,CAAC;QACH,CAAC;aAAM,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,2EAA2E,CAAC,CAAC,CAAC;QACxI,CAAC;aAAM,IAAI,IAAI,KAAK,gCAAgC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,4EAA4E,CAAC,CAAC,CAAC;QAC/I,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,yFAAyF,CAAC,CAAC,CAAC;QAC9J,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;gBACrD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,2EAA2E,CAAC,CAAC,CAAC;YACrI,CAAC;iBAAM,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;gBACrF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,kBAAkB,EAAE,QAAQ,EAAE,kDAAkD,CAAC,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,mHAAmH,EAAE,CAAC,CAAC,CAC1I,CAAC;AAEF,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,GAAY,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC,CAAC;QACrC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,MAAM;QAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}

package/dist/code/checks/django.d.ts

@@ -0,0 +1,14 @@
+export declare const djangoDebug: import("../types.js").CodeCheck;
+export declare const djangoCsrf: import("../types.js").CodeCheck;
+export declare const djangoSessionSecure: import("../types.js").CodeCheck;
+export declare const djangoSessionHttpOnly: import("../types.js").CodeCheck;
+export declare const djangoSessionDomain: import("../types.js").CodeCheck;
+export declare const djangoSessionPath: import("../types.js").CodeCheck;
+export declare const djangoSessionExpiry: import("../types.js").CodeCheck;
+export declare const djangoMediaRoot: import("../types.js").CodeCheck;
+export declare const djangoLoginRotation: import("../types.js").CodeCheck;
+export declare const djangoAuthRateLimit: import("../types.js").CodeCheck;
+export declare const djangoUploadPath: import("../types.js").CodeCheck;
+export declare const djangoUploadSize: import("../types.js").CodeCheck;
+export declare const djangoUploadType: import("../types.js").CodeCheck;
+//# sourceMappingURL=django.d.ts.map

package/dist/code/checks/django.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"django.d.ts","sourceRoot":"","sources":["../../../src/code/checks/django.ts"],"names":[],"mappings":"AAkCA,eAAO,MAAM,WAAW,iCAgBtB,CAAC;AAKH,eAAO,MAAM,UAAU,iCAyBrB,CAAC;AAkBH,eAAO,MAAM,mBAAmB,iCAG/B,CAAC;AAEF,eAAO,MAAM,qBAAqB,iCAGjC,CAAC;AAEF,eAAO,MAAM,mBAAmB,iCAS9B,CAAC;AAEH,eAAO,MAAM,iBAAiB,iCAM5B,CAAC;AAIH,eAAO,MAAM,mBAAmB,iCAmB9B,CAAC;AAGH,eAAO,MAAM,eAAe,iCA6B1B,CAAC;AAKH,eAAO,MAAM,mBAAmB,iCAwB9B,CAAC;AAMH,eAAO,MAAM,mBAAmB,iCAuB9B,CAAC;AAiCH,eAAO,MAAM,gBAAgB,iCAkB3B,CAAC;AAEH,eAAO,MAAM,gBAAgB,iCAc3B,CAAC;AAEH,eAAO,MAAM,gBAAgB,iCAiB3B,CAAC"}

package/dist/code/checks/django.js

@@ -0,0 +1,313 @@
+import { djangoSettings, DYNAMIC, describe } from "../django/settings.js";
+import { locations, outcomeFromFindings, pyFinding } from "../findings.js";
+import { callArgs, dotted, isNode, kwarg, strConst, walk } from "../python/index.js";
+import { codeCheck, decorators, functionDefs, walkStatements } from "./shared.js";
+const NO_SETTINGS = {
+    status: "manual",
+    detail: "Django detected but no settings module was found (looked for settings.py / settings/*.py / files defining INSTALLED_APPS). Review the configuration manually.",
+};
+/** A Django check that needs the parsed settings. */
+function settingsCheck(key, run) {
+    return codeCheck(key, ["django"], async (ctx) => {
+        const index = await ctx.python();
+        const settings = djangoSettings(index);
+        return settings.found ? run(settings, index, ctx) : NO_SETTINGS;
+    });
+}
+/** Production value of a setting; dev-only definitions are treated as absent (Django's default applies in production). */
+function prodValue(settings, name) {
+    const v = settings.get(name);
+    return v && !v.devOnly ? v : undefined;
+}
+const dynamicOutcome = (name, v) => ({
+    status: "manual",
+    detail: `${name} is computed at runtime (${v.at.module.path}:${v.at.line}); confirm the production value.`,
+    evidence: [v.at.module.line(v.at.line).trim()],
+});
+// --- #3 Debug functionality ----------------------------------------------------
+export const djangoDebug = settingsCheck("django-debug", (settings) => {
+    const findings = [];
+    const debug = prodValue(settings, "DEBUG");
+    if (debug?.value === true) {
+        findings.push(settings.findingAt(debug.at, "django-debug-true", "high", "DEBUG = True in production shows stack traces, settings and SQL to visitors."));
+    }
+    const apps = prodValue(settings, "INSTALLED_APPS");
+    if (apps && Array.isArray(apps.value) && apps.value.some((a) => typeof a === "string" && /^(debug_toolbar|silk|django_extensions)$/.test(a))) {
+        findings.push(settings.findingAt(apps.at, "django-debug-apps", "medium", "Debug/profiling apps are enabled in non-development settings."));
+    }
+    const propagate = prodValue(settings, "DEBUG_PROPAGATE_EXCEPTIONS");
+    if (propagate?.value === true) {
+        findings.push(settings.findingAt(propagate.at, "django-debug-propagate", "medium", "DEBUG_PROPAGATE_EXCEPTIONS exposes raw exceptions to the server/client."));
+    }
+    if (findings.length === 0 && debug?.value === DYNAMIC)
+        return dynamicOutcome("DEBUG", debug);
+    return outcomeFromFindings(findings, debug ? `DEBUG is ${describe(debug.value)} in production settings; no debug apps enabled.` : "DEBUG is not enabled in production settings (Django default: False); no debug apps enabled.");
+});
+// --- #61 CSRF ------------------------------------------------------------------
+const CSRF_MW = "django.middleware.csrf.CsrfViewMiddleware";
+export const djangoCsrf = settingsCheck("django-csrf", (settings, index) => {
+    const mw = prodValue(settings, "MIDDLEWARE") ?? prodValue(settings, "MIDDLEWARE_CLASSES");
+    if (!mw)
+        return { status: "manual", detail: "MIDDLEWARE is not defined in the settings found; review CSRF protection manually." };
+    if (mw.value === DYNAMIC)
+        return dynamicOutcome("MIDDLEWARE", mw);
+    if (!Array.isArray(mw.value) || !mw.value.includes(CSRF_MW)) {
+        return outcomeFromFindings([settings.findingAt(mw.at, "django-csrf-middleware-missing", "high", "Without CsrfViewMiddleware, state-changing requests can be forged from other sites.")], "");
+    }
+    // Exempted views: legitimate for webhooks, but each must be justified.
+    const exempt = [];
+    for (const { module, node } of functionDefs(index)) {
+        if (decorators(module, node).some((d) => d.endsWith("csrf_exempt"))) {
+            exempt.push(pyFinding(module, node, "django-csrf-exempt", "low", "This view is exempt from CSRF protection; confirm it changes no state or uses another defence (e.g. signed webhooks)."));
+        }
+    }
+    for (const s of index.calls()) {
+        if (s.name?.endsWith("csrf_exempt"))
+            exempt.push(pyFinding(s.module, s.node, "django-csrf-exempt", "low", "This view is exempt from CSRF protection; confirm it is safe."));
+    }
+    if (exempt.length) {
+        return { status: "manual", detail: `CsrfViewMiddleware is enabled, but ${exempt.length} view(s) are exempted: ${locations(exempt)}. Review each.`, findings: exempt };
+    }
+    return { status: "pass", detail: `CsrfViewMiddleware is enabled (${mw.at.module.path}:${mw.at.line}) and no views are exempted.` };
+});
+// --- #67-#70, #76 Session cookie settings -------------------------------------
+function boolSetting(name, defaultValue, insecure, why, rule) {
+    return (settings) => {
+        const v = prodValue(settings, name);
+        if (v?.value === DYNAMIC)
+            return dynamicOutcome(name, v);
+        const effective = v ? v.value : defaultValue;
+        if (effective === insecure) {
+            const f = v
+                ? settings.findingAt(v.at, rule, "high", why)
+                : settings.findingAbsent(name, String(defaultValue), rule, "high", why);
+            return { status: "fail", detail: `${name} is ${String(effective)}${v ? ` (${v.at.module.path}:${v.at.line})` : " (not set; Django default)"}. ${why}`, findings: [f] };
+        }
+        return { status: "pass", detail: `${name} is ${String(effective)}${v ? ` (${v.at.module.path}:${v.at.line})` : " (Django default)"}.` };
+    };
+}
+export const djangoSessionSecure = settingsCheck("django-session-cookie-secure", boolSetting("SESSION_COOKIE_SECURE", false, false, "The session cookie can be sent over plain HTTP and intercepted.", "django-session-cookie-secure"));
+export const djangoSessionHttpOnly = settingsCheck("django-session-cookie-httponly", boolSetting("SESSION_COOKIE_HTTPONLY", true, false, "JavaScript (including injected scripts) can read the session cookie.", "django-session-cookie-httponly"));
+export const djangoSessionDomain = settingsCheck("django-session-cookie-domain", (settings) => {
+    const v = prodValue(settings, "SESSION_COOKIE_DOMAIN");
+    if (!v || v.value === null)
+        return { status: "pass", detail: "SESSION_COOKIE_DOMAIN is not set, so the session cookie is host-only (most restrictive)." };
+    if (v.value === DYNAMIC)
+        return dynamicOutcome("SESSION_COOKIE_DOMAIN", v);
+    if (typeof v.value === "string" && v.value.startsWith(".")) {
+        const why = "A leading-dot domain shares the session cookie with every subdomain.";
+        return { status: "fail", detail: `SESSION_COOKIE_DOMAIN is "${v.value}". ${why}`, findings: [settings.findingAt(v.at, "django-session-cookie-domain", "medium", why)] };
+    }
+    return { status: "manual", detail: `SESSION_COOKIE_DOMAIN is ${describe(v.value)} (${v.at.module.path}:${v.at.line}); this also covers subdomains. Confirm it is the site's exact host and no untrusted subdomains exist.` };
+});
+export const djangoSessionPath = settingsCheck("django-session-cookie-path", (settings) => {
+    const v = prodValue(settings, "SESSION_COOKIE_PATH");
+    if (v?.value === DYNAMIC)
+        return dynamicOutcome("SESSION_COOKIE_PATH", v);
+    const value = v ? describe(v.value) : '"/" (Django default)';
+    // Whether "/" is restrictive enough depends on where the app is mounted, which the code does not say.
+    return { status: "manual", detail: `SESSION_COOKIE_PATH is ${value}. Restrictive only if it matches the path the application is mounted at; confirm other apps do not share this host/path.` };
+});
+const MAX_SESSION_AGE = 24 * 60 * 60;
+export const djangoSessionExpiry = settingsCheck("django-session-expiry", (settings) => {
+    const age = prodValue(settings, "SESSION_COOKIE_AGE");
+    const atClose = prodValue(settings, "SESSION_EXPIRE_AT_BROWSER_CLOSE");
+    if (age?.value === DYNAMIC)
+        return dynamicOutcome("SESSION_COOKIE_AGE", age);
+    const seconds = age ? age.value : 1_209_600;
+    const extra = atClose?.value === true ? " SESSION_EXPIRE_AT_BROWSER_CLOSE is True." : "";
+    if (typeof seconds !== "number")
+        return { status: "manual", detail: `SESSION_COOKIE_AGE has an unexpected value ${describe(seconds)}.` };
+    if (seconds > MAX_SESSION_AGE) {
+        const why = `Sessions stay valid for ${Math.round(seconds / 3600)} hours; long-lived sessions widen the window for hijacking.`;
+        const f = age
+            ? settings.findingAt(age.at, "django-session-age", "medium", why)
+            : settings.findingAbsent("SESSION_COOKIE_AGE", "1209600 (2 weeks)", "django-session-age", "medium", why);
+        return {
+            status: "fail",
+            detail: `SESSION_COOKIE_AGE is ${seconds}s${age ? "" : " (Django default, 2 weeks)"}; this tool expects at most ${MAX_SESSION_AGE}s (24h) as INSA sets no figure.${extra}`,
+            findings: [f],
+        };
+    }
+    return { status: "pass", detail: `Sessions expire after ${seconds}s (${age.at.module.path}:${age.at.line}).${extra}` };
+});
+// --- #78 Uploads stored in the document root ----------------------------------
+export const djangoMediaRoot = settingsCheck("django-media-root", (settings, index) => {
+    const media = prodValue(settings, "MEDIA_ROOT");
+    const stat = prodValue(settings, "STATIC_ROOT");
+    const findings = [];
+    const text = (v) => (v ? v.at.module.text(v.at.node["value"] ?? v.at.node) : "");
+    if (media && stat && text(media) && text(media) === text(stat)) {
+        findings.push(settings.findingAt(media.at, "django-media-equals-static", "high", "Uploads share the static files directory, which is served directly by the web server."));
+    }
+    else if (media && /static/i.test(text(media))) {
+        findings.push(settings.findingAt(media.at, "django-media-in-static", "medium", "MEDIA_ROOT appears to sit inside the static files tree."));
+    }
+    // Django serving media itself outside of DEBUG.
+    for (const module of index.modules.filter((m) => /(^|\/)urls\.py$/.test(m.path))) {
+        for (const stmt of module.tree["body"]) {
+            if (stmt._t === "If" && /DEBUG/.test(module.text(stmt["test"])))
+                continue;
+            for (const n of walk(stmt)) {
+                if (n._t !== "Call" || !/(^|\.)static$/.test(module.qualify(dotted(n["func"])) ?? ""))
+                    continue;
+                if (/MEDIA_URL/.test(module.text(n))) {
+                    findings.push(pyFinding(module, n, "django-serves-media", "medium", "Uploaded files are served by Django outside DEBUG; serve them from a non-executing location via the web server."));
+                }
+            }
+        }
+    }
+    if (findings.length)
+        return outcomeFromFindings(findings, "");
+    return {
+        status: "manual",
+        detail: media
+            ? `MEDIA_ROOT = ${text(media) || describe(media.value)} (${media.at.module.path}:${media.at.line}) is separate from static files. Confirm the web server serves it without executing scripts.`
+            : "MEDIA_ROOT is not set. Confirm where uploads are stored and that they are not served from an executable location.",
+    };
+});
+// --- #64 / #73 Session regeneration on login / session fixation ---------------
+const USER_SESSION_KEY = /user|uid|auth|logged|account|member/i;
+export const djangoLoginRotation = codeCheck("django-login-session-rotation", ["django"], async (ctx) => {
+    const index = await ctx.python();
+    const usesAuthLogin = index.calls().some((s) => /^django\.contrib\.auth\.(login|views\.LoginView(\.as_view)?)$/.test(s.name ?? "") || s.name === "auth.login") ||
+        index.modules.some((m) => /django\.contrib\.auth\.urls|allauth\.urls|dj_rest_auth/.test(m.lines.join("\n")));
+    const findings = [];
+    for (const module of index.modules) {
+        for (const n of walk(module.tree)) {
+            if (n._t !== "Assign")
+                continue;
+            for (const t of n["targets"]) {
+                if (t._t !== "Subscript" || !/request\.session$/.test(dotted(t["value"]) ?? ""))
+                    continue;
+                const key = strConst(t["slice"]);
+                if (!key || !USER_SESSION_KEY.test(key))
+                    continue;
+                findings.push(pyFinding(module, n, "django-manual-session-login", "medium", "Hand-rolled login stores the user in the existing session without rotating its key (session fixation); use django.contrib.auth.login() or request.session.cycle_key()."));
+            }
+        }
+    }
+    // A cycle_key()/flush() anywhere in the same file is treated as rotation.
+    const rotated = new Set(index.calls().filter((s) => s.method === "cycle_key" || s.method === "flush").map((s) => s.module.path));
+    const real = findings.filter((f) => !rotated.has(f.file));
+    if (real.length)
+        return outcomeFromFindings(real, "");
+    if (usesAuthLogin)
+        return { status: "pass", detail: "Logins go through django.contrib.auth.login(), which rotates the session key; no hand-rolled session logins found." };
+    return { status: "manual", detail: "No use of django.contrib.auth.login() found and no hand-rolled session login detected; review how users are authenticated." };
+});
+// --- #37 Rate limiting on authentication ---------------------------------------
+const RATE_APPS = /^(axes|defender|django_ratelimit|ratelimit|rest_framework\.throttling)$/;
+const AUTH_NAME = /login|signin|sign_in|auth|token|password|otp|register|signup/i;
+export const djangoAuthRateLimit = codeCheck("django-auth-rate-limit", ["django"], async (ctx) => {
+    const index = await ctx.python();
+    const settings = djangoSettings(index);
+    const evidence = [];
+    const apps = prodValue(settings, "INSTALLED_APPS");
+    if (apps && Array.isArray(apps.value)) {
+        for (const a of apps.value)
+            if (typeof a === "string" && RATE_APPS.test(a))
+                evidence.push(`INSTALLED_APPS includes ${a} (${apps.at.module.path}:${apps.at.line})`);
+    }
+    for (const { module, node } of functionDefs(index)) {
+        if (decorators(module, node).some((d) => /ratelimit$/.test(d)) && AUTH_NAME.test(node["name"])) {
+            evidence.push(`@ratelimit on ${node["name"]} (${module.path}:${node._l})`);
+        }
+    }
+    const rf = prodValue(settings, "REST_FRAMEWORK");
+    if (rf && rf.value !== DYNAMIC && typeof rf.value === "object" && rf.value !== null && !Array.isArray(rf.value)) {
+        const classes = rf.value["DEFAULT_THROTTLE_CLASSES"];
+        if (Array.isArray(classes) && classes.length)
+            evidence.push(`REST_FRAMEWORK DEFAULT_THROTTLE_CLASSES set (${rf.at.module.path}:${rf.at.line})`);
+    }
+    if (evidence.length)
+        return { status: "pass", detail: "Application-level rate limiting is configured for authentication.", evidence };
+    return {
+        status: "manual",
+        detail: "No application-level rate limiting found (django-axes, django-defender, django-ratelimit, DRF throttling). It may be enforced by a reverse proxy or WAF; verify there.",
+    };
+});
+function uploads(index) {
+    const fields = [];
+    for (const module of index.modules) {
+        for (const stmt of walkStatements(module.tree)) {
+            if (stmt._t !== "Assign" || !isNode(stmt["value"]) || stmt["value"]._t !== "Call")
+                continue;
+            const call = stmt["value"];
+            const name = module.qualify(dotted(call["func"])) ?? "";
+            const m = /(^|\.)(models|forms|serializers)\.(FileField|ImageField)$|^(django\.db\.models|django\.forms|rest_framework\.serializers)\.(FileField|ImageField)$/.exec(name);
+            if (!m)
+                continue;
+            const t = stmt["targets"][0];
+            fields.push({
+                module,
+                node: stmt,
+                kind: name.endsWith("ImageField") ? "image" : "file",
+                validated: !!kwarg(call, "validators"),
+                name: t?._t === "Name" ? t["id"] : "",
+            });
+        }
+    }
+    const handlesFiles = fields.length > 0 || index.modules.some((m) => m.lines.some((l) => /request\.FILES/.test(l)));
+    return { fields, handlesFiles };
+}
+const NO_UPLOADS = (n) => ({ status: "pass", detail: `No file upload handling found in ${n} Python file(s) (no FileField/ImageField or request.FILES).` });
+export const djangoUploadPath = codeCheck("django-upload-path", ["django"], async (ctx) => {
+    const index = await ctx.python();
+    if (!uploads(index).handlesFiles)
+        return NO_UPLOADS(index.modules.length);
+    const findings = [];
+    for (const s of index.calls()) {
+        if (!/^(open|io\.open)$/.test(s.name ?? ""))
+            continue;
+        const mode = strConst(callArgs(s.node)[1] ?? kwarg(s.node, "mode")) ?? "r";
+        const target = callArgs(s.node)[0];
+        if (!/[wax+]/.test(mode) || !target)
+            continue;
+        const scope = s.module.scope(s.fn);
+        // Client-supplied file name (upload.name) or other request data in the destination path.
+        const usesClientName = [...walk(target)].some((n) => n._t === "Attribute" && n["attr"] === "name" && s.module.isRequestDerived(n["value"], scope));
+        if (usesClientName || s.module.isRequestDerived(target, scope)) {
+            findings.push(pyFinding(s.module, s.node, "django-upload-client-filename", "high", "Writing an upload to a path built from the client-supplied name allows ../ to escape the upload directory; use Django storage (default_storage.save) or generate the name."));
+        }
+    }
+    return outcomeFromFindings(findings, "Uploads are not written with client-supplied paths (no open(..., 'w') using upload names or request data).");
+});
+export const djangoUploadSize = codeCheck("django-upload-size", ["django"], async (ctx) => {
+    const index = await ctx.python();
+    if (!uploads(index).handlesFiles)
+        return NO_UPLOADS(index.modules.length);
+    const evidence = [];
+    for (const module of index.modules) {
+        for (const n of walk(module.tree)) {
+            if (n._t === "Compare" && [...walk(n)].some((x) => x._t === "Attribute" && x["attr"] === "size"))
+                evidence.push(`${module.path}:${n._l}`);
+        }
+    }
+    if (evidence.length)
+        return { status: "pass", detail: `Upload size is checked in code (${evidence.slice(0, 3).join(", ")}).`, evidence };
+    return {
+        status: "manual",
+        detail: "The project handles uploads but no size check was found in code (Django does not limit file upload size by default). Confirm a limit at the web server (e.g. nginx client_max_body_size) or add validation.",
+    };
+});
+export const djangoUploadType = codeCheck("django-upload-type", ["django"], async (ctx) => {
+    const index = await ctx.python();
+    const inv = uploads(index);
+    if (!inv.handlesFiles)
+        return NO_UPLOADS(index.modules.length);
+    const all = index.modules.map((m) => m.lines.join("\n")).join("\n");
+    const typeCheckedSomewhere = /FileExtensionValidator|content_type|magic\.from_|filetype\.guess|imghdr|PIL\.Image|Image\.open/.test(all);
+    const findings = [];
+    for (const f of inv.fields) {
+        if (f.kind === "image" || f.validated)
+            continue; // ImageField verifies the file is an image
+        const cleaned = f.name && new RegExp(`def clean_${f.name}\\b`).test(all);
+        findings.push(pyFinding(f.module, f.node, "django-filefield-no-validation", typeCheckedSomewhere || cleaned ? "low" : "medium", "FileField accepts any file type unless validators (e.g. FileExtensionValidator) or content checks are applied."));
+    }
+    if (findings.length === 0 && inv.fields.length === 0) {
+        return { status: "manual", detail: "Uploads are handled via request.FILES without model/form fields; review type validation in the handling code." };
+    }
+    return outcomeFromFindings(findings, `All ${inv.fields.length} upload field(s) are ImageFields or have validators.`);
+});
+//# sourceMappingURL=django.js.map

package/dist/code/checks/django.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"django.js","sourceRoot":"","sources":["../../../src/code/checks/django.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAA8C,MAAM,uBAAuB,CAAC;AACtH,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAgD,MAAM,oBAAoB,CAAC;AAEnI,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,GAAiB;IAChC,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,+JAA+J;CACxK,CAAC;AAEF,qDAAqD;AACrD,SAAS,aAAa,CAAC,GAAW,EAAE,GAA8E;IAChH,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0HAA0H;AAC1H,SAAS,SAAS,CAAC,QAAwB,EAAE,IAAY;IACvD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzC,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,CAAmB,EAAgB,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,GAAG,IAAI,4BAA4B,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,kCAAkC;IAC1G,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE;IACpE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE,8EAA8E,CAAC,CAAC,CAAC;IAC3J,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACnD,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,0CAA0C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7I,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,+DAA+D,CAAC,CAAC,CAAC;IAC7I,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IACpE,IAAI,SAAS,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,wBAAwB,EAAE,QAAQ,EAAE,yEAAyE,CAAC,CAAC,CAAC;IACjK,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,EAAE,KAAK,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7F,OAAO,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC,6FAA6F,CAAC,CAAC;AACnO,CAAC,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,OAAO,GAAG,2CAA2C,CAAC;AAE5D,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;IACzE,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC1F,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,mFAAmF,EAAE,CAAC;IAClI,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAElE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,mBAAmB,CACxB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,gCAAgC,EAAE,MAAM,EAAE,qFAAqF,CAAC,CAAC,EAC5J,EAAE,CACH,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,uHAAuH,CAAC,CAAC,CAAC;QAC7L,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,+DAA+D,CAAC,CAAC,CAAC;IAC9K,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,sCAAsC,MAAM,CAAC,MAAM,0BAA0B,SAAS,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACxK,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,8BAA8B,EAAE,CAAC;AACrI,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,SAAS,WAAW,CAAC,IAAY,EAAE,YAAqB,EAAE,QAAiB,EAAE,GAAW,EAAE,IAAY;IACpG,OAAO,CAAC,QAAwB,EAAgB,EAAE;QAChD,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,KAAK,KAAK,OAAO;YAAE,OAAO,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QAC7C,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC;gBACT,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;gBAC7C,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,4BAA4B,KAAK,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzK,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,mBAAmB,GAAG,EAAE,CAAC;IAC1I,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAC9C,8BAA8B,EAC9B,WAAW,CAAC,uBAAuB,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,EAAE,8BAA8B,CAAC,CACtJ,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAChD,gCAAgC,EAChC,WAAW,CAAC,yBAAyB,EAAE,IAAI,EAAE,KAAK,EAAE,sEAAsE,EAAE,gCAAgC,CAAC,CAC9J,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC,8BAA8B,EAAE,CAAC,QAAQ,EAAE,EAAE;IAC5F,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0FAA0F,EAAE,CAAC;IAC1J,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,sEAAsE,CAAC;QACnF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,KAAK,MAAM,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,8BAA8B,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAC1K,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,4BAA4B,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,wGAAwG,EAAE,CAAC;AAC/N,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC,4BAA4B,EAAE,CAAC,QAAQ,EAAE,EAAE;IACxF,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,KAAK,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAC7D,sGAAsG;IACtG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,0BAA0B,KAAK,0HAA0H,EAAE,CAAC;AACjM,CAAC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAErC,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC,uBAAuB,EAAE,CAAC,QAAQ,EAAE,EAAE;IACrF,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,iCAAiC,CAAC,CAAC;IACvE,IAAI,GAAG,EAAE,KAAK,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,8CAA8C,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACzI,IAAI,OAAO,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,2BAA2B,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,6DAA6D,CAAC;QAC/H,MAAM,CAAC,GAAG,GAAG;YACX,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,CAAC;YACjE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC3G,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,yBAAyB,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,+BAA+B,eAAe,kCAAkC,KAAK,EAAE;YAC1K,QAAQ,EAAE,CAAC,CAAC,CAAC;SACd,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,OAAO,MAAM,GAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,GAAI,CAAC,EAAE,CAAC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;AAC3H,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAY,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChH,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,4BAA4B,EAAE,MAAM,EAAE,uFAAuF,CAAC,CAAC,CAAC;IAC7K,CAAC;SAAM,IAAI,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,wBAAwB,EAAE,QAAQ,EAAE,yDAAyD,CAAC,CAAC,CAAC;IAC7I,CAAC;IACD,gDAAgD;IAChD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACjF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAa,EAAE,CAAC;YACnD,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAW,CAAC,CAAC;gBAAE,SAAS;YACpF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAAE,SAAS;gBAChG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,qBAAqB,EAAE,QAAQ,EAAE,iHAAiH,CAAC,CAAC,CAAC;gBAC1L,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,mBAAmB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,KAAK;YACX,CAAC,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,8FAA8F;YAC9L,CAAC,CAAC,mHAAmH;KACxH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AAEhE,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,+BAA+B,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IACtG,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,aAAa,GACjB,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,+DAA+D,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;QACxI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wDAAwD,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;gBAAE,SAAS;YAChC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAa,EAAE,CAAC;gBACzC,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;oBAAE,SAAS;gBAC1F,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,6BAA6B,EAAE,QAAQ,EACxE,wKAAwK,CAAC,CAAC,CAAC;YAC/K,CAAC;QACH,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oHAAoH,EAAE,CAAC;IAC3K,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,4HAA4H,EAAE,CAAC;AACpK,CAAC,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,SAAS,GAAG,yEAAyE,CAAC;AAC5F,MAAM,SAAS,GAAG,+DAA+D,CAAC;AAElF,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,wBAAwB,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC/F,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACnD,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;IACrK,CAAC;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAW,CAAC,EAAE,CAAC;YACzG,QAAQ,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAW,KAAK,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAChH,MAAM,OAAO,GAAI,EAAE,CAAC,KAAiC,CAAC,0BAA0B,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,gDAAgD,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;IAClJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mEAAmE,EAAE,QAAQ,EAAE,CAAC;IACtI,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,wKAAwK;KACjL,CAAC;AACJ,CAAC,CAAC,CAAC;AAQH,SAAS,OAAO,CAAC,KAAkB;IACjC,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAK,IAAI,CAAC,OAAO,CAAY,CAAC,EAAE,KAAK,MAAM;gBAAE,SAAS;YACxG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAW,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxD,MAAM,CAAC,GAAG,oJAAoJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1K,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,CAAC,GAAI,IAAI,CAAC,SAAS,CAAc,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC;gBACV,MAAM;gBACN,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBACpD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC;gBACtC,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAS,EAAgB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oCAAoC,CAAC,6DAA6D,EAAE,CAAC,CAAC;AAEjL,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IACxF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,SAAS;QACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC;QAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnC,yFAAyF;QACzF,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACnJ,IAAI,cAAc,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAC/E,4KAA4K,CAAC,CAAC,CAAC;QACnL,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,4GAA4G,CAAC,CAAC;AACrJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IACxF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5I,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mCAAmC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;IACzI,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,6MAA6M;KACtN,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IACxF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,oBAAoB,GAAG,gGAAgG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxI,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS;YAAE,SAAS,CAAC,2CAA2C;QAC5F,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,gCAAgC,EAAE,oBAAoB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAC5H,gHAAgH,CAAC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,+GAA+G,EAAE,CAAC;IACvJ,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,sDAAsD,CAAC,CAAC;AACvH,CAAC,CAAC,CAAC"}

package/dist/code/checks/flask.d.ts

@@ -0,0 +1,6 @@
+export declare const flaskDebug: import("../types.js").CodeCheck;
+export declare const flaskSessionSecure: import("../types.js").CodeCheck;
+export declare const flaskSessionHttpOnly: import("../types.js").CodeCheck;
+export declare const flaskCsrf: import("../types.js").CodeCheck;
+export declare const flaskAuthRateLimit: import("../types.js").CodeCheck;
+//# sourceMappingURL=flask.d.ts.map

package/dist/code/checks/flask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flask.d.ts","sourceRoot":"","sources":["../../../src/code/checks/flask.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,UAAU,iCAsBrB,CAAC;AA2DH,eAAO,MAAM,kBAAkB,iCAA+I,CAAC;AAC/K,eAAO,MAAM,oBAAoB,iCAAuJ,CAAC;AAGzL,eAAO,MAAM,SAAS,iCAIpB,CAAC;AAEH,eAAO,MAAM,kBAAkB,iCAI7B,CAAC"}

package/dist/code/checks/flask.js

@@ -0,0 +1,100 @@
+import { outcomeFromFindings, pyFinding } from "../findings.js";
+import { dotted, isTrue, kwarg, strConst, walk } from "../python/index.js";
+import { codeCheck } from "./shared.js";
+/** Configuration rules for Flask and FastAPI. The generic Python pattern rules cover the rest. */
+const flaskCheck = (key, frameworks, run) => codeCheck(key, frameworks, async (ctx) => run(await ctx.python(), ctx));
+// --- #3 Debug mode -------------------------------------------------------------------
+export const flaskDebug = flaskCheck("flask-debug", ["flask", "fastapi"], (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        if (s.method === "run" && isTrue(kwarg(s.node, "debug"))) {
+            out.push(pyFinding(s.module, s.node, "flask-run-debug", "high", "debug=True enables the interactive debugger, which lets anyone who triggers an error run code on the server."));
+        }
+        else if (/(^|\.)FastAPI$/.test(s.name ?? "") && isTrue(kwarg(s.node, "debug"))) {
+            out.push(pyFinding(s.module, s.node, "fastapi-debug", "high", "debug=True returns stack traces to clients."));
+        }
+        else if (s.name === "uvicorn.run" && isTrue(kwarg(s.node, "reload"))) {
+            out.push(pyFinding(s.module, s.node, "uvicorn-reload", "medium", "reload=True is a development setting; do not run production with it."));
+        }
+    }
+    for (const { module, node, value } of configAssignments(index, "DEBUG")) {
+        if (isTrue(value))
+            out.push(pyFinding(module, node, "flask-config-debug", "high", "DEBUG is enabled in the application configuration."));
+    }
+    for (const module of index.modules) {
+        for (const n of walk(module.tree)) {
+            if (n._t === "Assign" && /(^|\.)app\.debug$/.test(dotted(n["targets"][0]) ?? "") && isTrue(n["value"])) {
+                out.push(pyFinding(module, n, "flask-app-debug", "high", "app.debug = True enables the interactive debugger."));
+            }
+        }
+    }
+    return outcomeFromFindings(out, `No debug mode enabled in ${index.modules.length} Python file(s).`);
+});
+/**
+ * Values assigned to a Flask config key, in any of the usual forms:
+ * app.config["KEY"] = v, app.config.update(KEY=v), and KEY = v in a module or Config class.
+ */
+function configAssignments(index, key) {
+    const out = [];
+    for (const module of index.modules) {
+        for (const n of walk(module.tree)) {
+            if (n._t === "Assign") {
+                const target = n["targets"][0];
+                const value = n["value"];
+                if (target._t === "Name" && target["id"] === key)
+                    out.push({ module, node: n, value });
+                else if (target._t === "Subscript" && /config$/.test(dotted(target["value"]) ?? "") && strConst(target["slice"]) === key) {
+                    out.push({ module, node: n, value });
+                }
+            }
+            else if (n._t === "Call" && /config\.(update|from_mapping)$/.test(dotted(n["func"]) ?? "")) {
+                const v = kwarg(n, key);
+                if (v)
+                    out.push({ module, node: n, value: v });
+            }
+        }
+    }
+    return out;
+}
+function cookieFlag(key, setting, defaultValue, why) {
+    return flaskCheck(key, ["flask"], (index) => {
+        const values = configAssignments(index, setting);
+        const literal = values.filter((v) => v.value._t === "Constant" && typeof v.value["value"] === "boolean");
+        const off = literal.filter((v) => v.value["value"] === false);
+        if (off.length) {
+            return outcomeFromFindings(off.map((v) => pyFinding(v.module, v.node, `${key}-false`, "high", why)), "");
+        }
+        if (literal.length) {
+            const at = literal[0];
+            return { status: "pass", detail: `${setting} is True (${at.module.path}:${at.node._l}).` };
+        }
+        if (values.length) {
+            const at = values[0];
+            return { status: "manual", detail: `${setting} is computed at runtime (${at.module.path}:${at.node._l}); confirm the production value.` };
+        }
+        if (defaultValue)
+            return { status: "pass", detail: `${setting} is not set; Flask's default is True.` };
+        const where = index.modules.find((m) => [...m.imports.values()].some((v) => v === "flask" || v.startsWith("flask.")));
+        return {
+            status: "fail",
+            detail: `${setting} is not set (Flask default: False). ${why}`,
+            findings: [{ file: where?.path ?? "(app)", line: 1, snippet: `${setting} not set (Flask default: False)`, why, confidence: "medium", method: "ast", rule: `${key}-missing` }],
+        };
+    });
+}
+export const flaskSessionSecure = cookieFlag("flask-session-cookie-secure", "SESSION_COOKIE_SECURE", false, "The session cookie can be sent over plain HTTP and intercepted.");
+export const flaskSessionHttpOnly = cookieFlag("flask-session-cookie-httponly", "SESSION_COOKIE_HTTPONLY", true, "JavaScript (including injected scripts) can read the session cookie.");
+// --- #61 CSRF / #37 rate limiting --------------------------------------------------------
+export const flaskCsrf = flaskCheck("flask-csrf", ["flask"], (index) => {
+    const used = ["flask_wtf", "flask_seasurf"].filter((p) => index.imports(p));
+    if (used.length)
+        return { status: "pass", detail: `CSRF protection is used (${used.join(", ")}). Confirm CSRFProtect is initialised for the app and covers every state-changing route.` };
+    return { status: "manual", detail: "No CSRF extension (Flask-WTF, Flask-SeaSurf) found. If the app uses cookie sessions and forms, add one; token-only APIs are not affected." };
+});
+export const flaskAuthRateLimit = flaskCheck("flask-auth-rate-limit", ["flask", "fastapi"], (index) => {
+    const used = ["flask_limiter", "slowapi", "fastapi_limiter"].filter((p) => index.imports(p));
+    if (used.length)
+        return { status: "pass", detail: `Rate limiting is used (${used.join(", ")}). Confirm it is applied to login, password-reset and token endpoints.`, evidence: used };
+    return { status: "manual", detail: "No rate-limiting extension (Flask-Limiter, SlowAPI) found. It may be enforced by a reverse proxy or WAF; verify there." };
+});
+//# sourceMappingURL=flask.js.map

package/dist/code/checks/flask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flask.js","sourceRoot":"","sources":["../../../src/code/checks/flask.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAgD,MAAM,oBAAoB,CAAC;AAEzH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,kGAAkG;AAElG,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,UAAyB,EAAE,GAA2D,EAAE,EAAE,CACzH,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AAE1E,wFAAwF;AACxF,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE;IAClF,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,8GAA8G,CAAC,CAAC,CAAC;QACnL,CAAC;aAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,6CAA6C,CAAC,CAAC,CAAC;QAChH,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,sEAAsE,CAAC,CAAC,CAAC;QAC5I,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACxE,IAAI,MAAM,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,oDAAoD,CAAC,CAAC,CAAC;IAC3I,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAE,CAAC,CAAC,SAAS,CAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACrH,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE,oDAAoD,CAAC,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,GAAG,EAAE,4BAA4B,KAAK,CAAC,OAAO,CAAC,MAAM,kBAAkB,CAAC,CAAC;AACtG,CAAC,CAAC,CAAC;AASH;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAkB,EAAE,GAAW;IACxD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAI,CAAC,CAAC,SAAS,CAAc,CAAC,CAAC,CAAE,CAAC;gBAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAW,CAAC;gBACnC,IAAI,MAAM,CAAC,EAAE,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;qBAClF,IAAI,MAAM,CAAC,EAAE,KAAK,WAAW,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACzH,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC7F,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACxB,IAAI,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,OAAe,EAAE,YAAqB,EAAE,GAAW;IAClF,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC;QACzG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7F,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,4BAA4B,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,kCAAkC,EAAE,CAAC;QAC5I,CAAC;QACD,IAAI,YAAY;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,uCAAuC,EAAE,CAAC;QACvG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtH,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,OAAO,uCAAuC,GAAG,EAAE;YAC9D,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,iCAAiC,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,UAAU,EAAE,CAAC;SAC9K,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAC,6BAA6B,EAAE,uBAAuB,EAAE,KAAK,EAAE,iEAAiE,CAAC,CAAC;AAC/K,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC,+BAA+B,EAAE,yBAAyB,EAAE,IAAI,EAAE,sEAAsE,CAAC,CAAC;AAEzL,4FAA4F;AAC5F,MAAM,CAAC,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE;IACrE,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0FAA0F,EAAE,CAAC;IAC1L,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,2IAA2I,EAAE,CAAC;AACnL,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAC,uBAAuB,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE;IACpG,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,wEAAwE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtL,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,wHAAwH,EAAE,CAAC;AAChK,CAAC,CAAC,CAAC"}