insa-check-core 0.1.0

package/dist/code/checks/index.d.ts

@@ -0,0 +1,9 @@
+import type { CodeCheck } from "../types.js";
+/**
+ * All static-analysis checks, keyed by CodeCheck.key. Annex B items opt in via AnnexItem.checks.code.
+ * "python" / "javascript" checks run on any project with that language; framework checks
+ * (Django, Node server frameworks) need the framework to be detected.
+ * Rule sets for other languages plug in here with their own appliesTo.
+ */
+export declare const CODE_CHECKS: ReadonlyMap<string, CodeCheck>;
+//# sourceMappingURL=index.d.ts.map

package/dist/code/checks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/code/checks/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AA2G7C;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CA8GtD,CAAC"}

package/dist/code/checks/index.js

@@ -0,0 +1,126 @@
+import { cryptoMisuse, weakCrypto } from "./crypto.js";
+import { djangoAuthRateLimit, djangoCsrf, djangoDebug, djangoLoginRotation, djangoMediaRoot, djangoSessionDomain, djangoSessionExpiry, djangoSessionHttpOnly, djangoSessionPath, djangoSessionSecure, djangoUploadPath, djangoUploadSize, djangoUploadType, } from "./django.js";
+import { flaskAuthRateLimit, flaskCsrf, flaskDebug, flaskSessionHttpOnly, flaskSessionSecure } from "./flask.js";
+import { codeInjection, commandInjection, ldapInjection, massAssignment, openRedirect, pathTraversal, regexInjection, sqlInjection, templateInjection, xpathInjection, xss, } from "./injection.js";
+import { jsAuthRateLimit, jsCsrf, jsDebug, jsLoginRotation, jsSessionDomain, jsSessionExpiry, jsSessionHttpOnly, jsSessionPath, jsSessionSecure, jsUploadPath, jsUploadSize, jsUploadType, } from "./javascript-config.js";
+import { jsCodeInjection, jsCommandInjection, jsCryptoMisuse, jsExternalDtd, jsHardcodedSecrets, jsMassAssignment, jsOpenRedirect, jsPathTraversal, jsPlaintextPasswords, jsRegexInjection, jsSecretsInLogs, jsSqlInjection, jsTemplateInjection, jsWeakCrypto, jsXss, jsXxe, } from "./javascript.js";
+import { laravelAuthRateLimit, laravelCsrf, laravelDebug, laravelLoginRotation, laravelSessionExpiry, laravelSessionHttpOnly, laravelSessionSecure, phpCodeInjection, phpCommandInjection, phpCryptoMisuse, phpExternalDtd, phpHardcodedSecrets, phpMassAssignment, phpOpenRedirect, phpPathTraversal, phpPlaintextPasswords, phpRegexInjection, phpSecretsInLogs, phpSqlInjection, phpUploadPath, phpUploadSize, phpUploadType, phpWeakCrypto, phpXss, phpXxe, } from "./php.js";
+import { hardcodedSecrets, plaintextPasswords, secretsInLogs } from "./secrets.js";
+import { tsCodeInjection, tsCommandInjection, tsCryptoMisuse, tsCsrf, tsHardcodedSecrets, tsOpenRedirect, tsPathTraversal, tsSecretsInLogs, tsSqlInjection, tsWeakCrypto, tsXss, tsXxe, } from "./treesitter.js";
+import { entityExpansion, externalDtd, xmlExtensions, xxe } from "./xml.js";
+/**
+ * All static-analysis checks, keyed by CodeCheck.key. Annex B items opt in via AnnexItem.checks.code.
+ * "python" / "javascript" checks run on any project with that language; framework checks
+ * (Django, Node server frameworks) need the framework to be detected.
+ * Rule sets for other languages plug in here with their own appliesTo.
+ */
+export const CODE_CHECKS = new Map([
+    weakCrypto,
+    cryptoMisuse,
+    hardcodedSecrets,
+    plaintextPasswords,
+    secretsInLogs,
+    sqlInjection,
+    commandInjection,
+    codeInjection,
+    xss,
+    pathTraversal,
+    xpathInjection,
+    ldapInjection,
+    regexInjection,
+    templateInjection,
+    massAssignment,
+    openRedirect,
+    xxe,
+    externalDtd,
+    xmlExtensions,
+    entityExpansion,
+    djangoDebug,
+    djangoCsrf,
+    djangoSessionSecure,
+    djangoSessionHttpOnly,
+    djangoSessionDomain,
+    djangoSessionPath,
+    djangoSessionExpiry,
+    djangoMediaRoot,
+    djangoLoginRotation,
+    djangoAuthRateLimit,
+    djangoUploadPath,
+    djangoUploadSize,
+    djangoUploadType,
+    // Flask / FastAPI
+    flaskDebug,
+    flaskCsrf,
+    flaskSessionSecure,
+    flaskSessionHttpOnly,
+    flaskAuthRateLimit,
+    // JavaScript / TypeScript
+    jsHardcodedSecrets,
+    jsWeakCrypto,
+    jsCryptoMisuse,
+    jsPlaintextPasswords,
+    jsSqlInjection,
+    jsCommandInjection,
+    jsCodeInjection,
+    jsPathTraversal,
+    jsXss,
+    jsRegexInjection,
+    jsTemplateInjection,
+    jsMassAssignment,
+    jsOpenRedirect,
+    jsSecretsInLogs,
+    jsXxe,
+    jsExternalDtd,
+    jsDebug,
+    jsCsrf,
+    jsSessionSecure,
+    jsSessionHttpOnly,
+    jsSessionDomain,
+    jsSessionPath,
+    jsSessionExpiry,
+    jsLoginRotation,
+    jsAuthRateLimit,
+    jsUploadPath,
+    jsUploadSize,
+    jsUploadType,
+    // PHP / Laravel
+    phpHardcodedSecrets,
+    phpWeakCrypto,
+    phpCryptoMisuse,
+    phpPlaintextPasswords,
+    phpSqlInjection,
+    phpCommandInjection,
+    phpCodeInjection,
+    phpPathTraversal,
+    phpXss,
+    phpRegexInjection,
+    phpMassAssignment,
+    phpOpenRedirect,
+    phpSecretsInLogs,
+    phpXxe,
+    phpExternalDtd,
+    phpUploadPath,
+    phpUploadSize,
+    phpUploadType,
+    laravelDebug,
+    laravelCsrf,
+    laravelSessionSecure,
+    laravelSessionHttpOnly,
+    laravelSessionExpiry,
+    laravelAuthRateLimit,
+    laravelLoginRotation,
+    // Java / C# / Ruby / Go
+    tsHardcodedSecrets,
+    tsWeakCrypto,
+    tsCryptoMisuse,
+    tsSqlInjection,
+    tsCommandInjection,
+    tsCodeInjection,
+    tsPathTraversal,
+    tsXss,
+    tsOpenRedirect,
+    tsSecretsInLogs,
+    tsXxe,
+    tsCsrf,
+].map((c) => [c.key, c]));
+//# sourceMappingURL=index.js.map

package/dist/code/checks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/code/checks/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACjH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,GAAG,GACJ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,MAAM,EACN,OAAO,EACP,eAAe,EACf,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,YAAY,EACZ,KAAK,EACL,KAAK,GACN,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,EACN,MAAM,GACP,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,MAAM,EACN,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,eAAe,EACf,cAAc,EACd,YAAY,EACZ,KAAK,EACL,KAAK,GACN,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAmC,IAAI,GAAG,CAChE;IACE,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,kBAAkB;IAClB,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,GAAG;IACH,aAAa;IACb,cAAc;IACd,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,cAAc;IACd,YAAY;IACZ,GAAG;IACH,WAAW;IACX,aAAa;IACb,eAAe;IACf,WAAW;IACX,UAAU;IACV,mBAAmB;IACnB,qBAAqB;IACrB,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,eAAe;IACf,mBAAmB;IACnB,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,UAAU;IACV,SAAS;IACT,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,0BAA0B;IAC1B,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,oBAAoB;IACpB,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,eAAe;IACf,KAAK;IACL,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,KAAK;IACL,aAAa;IACb,OAAO;IACP,MAAM;IACN,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,aAAa;IACb,eAAe;IACf,eAAe;IACf,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,qBAAqB;IACrB,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,MAAM;IACN,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,MAAM;IACN,cAAc;IACd,aAAa;IACb,aAAa;IACb,aAAa;IACb,YAAY;IACZ,WAAW;IACX,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,eAAe;IACf,KAAK;IACL,cAAc;IACd,eAAe;IACf,KAAK;IACL,MAAM;CACP,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACzB,CAAC"}

package/dist/code/checks/injection.d.ts

@@ -0,0 +1,27 @@
+import type { Confidence } from "../../types.js";
+import { type CallSite, type PyNode } from "../python/index.js";
+export interface SinkOptions {
+    /** Report values of unknown origin as low confidence (default true). */
+    unknownIsLow?: boolean;
+    /** Only report when request data reaches the sink (file paths, regexes, templates...). */
+    requestOnly?: boolean;
+}
+/**
+ * How risky is passing `arg` to a sink?
+ *  high   - contains request data directly, or is a string built from it
+ *  medium - built dynamically (f-string, %, +, .format), or derived from request data via local variables/URL params
+ *  low    - some other non-literal value (origin unknown)
+ */
+export declare function argRisk(site: CallSite, arg: PyNode | undefined, opts?: SinkOptions): Confidence | undefined;
+export declare const sqlInjection: import("../types.js").CodeCheck;
+export declare const commandInjection: import("../types.js").CodeCheck;
+export declare const codeInjection: import("../types.js").CodeCheck;
+export declare const xss: import("../types.js").CodeCheck;
+export declare const pathTraversal: import("../types.js").CodeCheck;
+export declare const xpathInjection: import("../types.js").CodeCheck;
+export declare const ldapInjection: import("../types.js").CodeCheck;
+export declare const regexInjection: import("../types.js").CodeCheck;
+export declare const templateInjection: import("../types.js").CodeCheck;
+export declare const massAssignment: import("../types.js").CodeCheck;
+export declare const openRedirect: import("../types.js").CodeCheck;
+//# sourceMappingURL=injection.d.ts.map

package/dist/code/checks/injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../../../src/code/checks/injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EASL,KAAK,QAAQ,EACb,KAAK,MAAM,EACZ,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,GAAE,WAAgB,GAAG,UAAU,GAAG,SAAS,CAW/G;AAwBD,eAAO,MAAM,YAAY,iCAoBxB,CAAC;AAOF,eAAO,MAAM,gBAAgB,iCAe5B,CAAC;AAKF,eAAO,MAAM,aAAa,iCA0BzB,CAAC;AAKF,eAAO,MAAM,GAAG,iCAqCf,CAAC;AAKF,eAAO,MAAM,aAAa,iCAOzB,CAAC;AAGF,eAAO,MAAM,cAAc,iCAO1B,CAAC;AAEF,eAAO,MAAM,aAAa,iCAYzB,CAAC;AAEF,eAAO,MAAM,cAAc,iCAU1B,CAAC;AAIF,eAAO,MAAM,iBAAiB,iCAO7B,CAAC;AAGF,eAAO,MAAM,cAAc,iCAuB1B,CAAC;AAMF,eAAO,MAAM,YAAY,iCAkBxB,CAAC"}

package/dist/code/checks/injection.js

@@ -0,0 +1,189 @@
+import { NO_PATTERN, pyFinding, snippetOf } from "../findings.js";
+import { callArgs, dotted, isDynamicString, isNode, isTrue, kwarg, starKwargs, strConst, } from "../python/index.js";
+import { bases, classDefs, patternCheck, walkStatements } from "./shared.js";
+/**
+ * How risky is passing `arg` to a sink?
+ *  high   - contains request data directly, or is a string built from it
+ *  medium - built dynamically (f-string, %, +, .format), or derived from request data via local variables/URL params
+ *  low    - some other non-literal value (origin unknown)
+ */
+export function argRisk(site, arg, opts = {}) {
+    if (!arg || strConst(arg) !== undefined || arg._t === "Constant")
+        return undefined;
+    if (arg._t === "JoinedStr" && !isDynamicString(arg))
+        return undefined;
+    const scope = site.module.scope(site.fn);
+    if (site.module.isRequestDerived(arg))
+        return "high";
+    const derived = site.module.isRequestDerived(arg, scope);
+    if (opts.requestOnly && !derived)
+        return undefined;
+    if (isDynamicString(arg))
+        return derived ? "high" : "medium";
+    if (derived)
+        return "medium";
+    if (arg._t === "Name" && scope?.dynamicStrings.has(arg["id"]))
+        return "medium";
+    return opts.unknownIsLow === false ? undefined : "low";
+}
+function sinkFindings(sites, match, rule, why, opts = {}) {
+    const out = [];
+    for (const site of sites) {
+        const m = match(site);
+        if (!m)
+            continue;
+        const risks = (Array.isArray(m) ? m : [m]).map((a) => argRisk(site, a, opts)).filter((r) => !!r);
+        if (risks.length === 0)
+            continue;
+        const confidence = risks.includes("high") ? "high" : risks.includes("medium") ? "medium" : "low";
+        out.push(pyFinding(site.module, site.node, rule, confidence, why));
+    }
+    return out;
+}
+const first = (s) => callArgs(s.node)[0];
+// --- #41 SQL injection --------------------------------------------------------
+export const sqlInjection = patternCheck("py-sql-injection", ["python"], (index) => {
+    const calls = index.calls();
+    return [
+        ...sinkFindings(calls, (s) => (["execute", "executemany", "executescript"].includes(s.method ?? "") ? first(s) : undefined), "py-sql-string-building", "SQL built from strings can be manipulated by user input; pass parameters separately (cursor.execute(sql, params))."),
+        ...sinkFindings(calls, (s) => (s.method === "raw" && /objects/.test(dotted(s.node["func"]) ?? "") ? first(s) : undefined), "django-raw-sql", "Manager.raw() with an interpolated query is injectable; use params=[...]."),
+        ...sinkFindings(calls, (s) => (/(^|\.)RawSQL$/.test(s.name ?? "") || s.name === "sqlalchemy.text" ? first(s) : undefined), "py-raw-sql-expression", "Raw SQL expressions built from strings are injectable; use bound parameters."),
+        ...sinkFindings(calls, (s) => {
+            if (s.method !== "extra")
+                return undefined;
+            const parts = ["where", "select", "tables", "order_by"].map((k) => kwarg(s.node, k)).filter(isNode);
+            return parts.flatMap((p) => (p._t === "List" || p._t === "Tuple" ? p["elts"] : p._t === "Dict" ? p["values"] : [p]));
+        }, "django-extra-sql", "QuerySet.extra() with interpolated SQL is injectable; use params or the ORM.", { unknownIsLow: false }),
+    ];
+}, (n) => NO_PATTERN("SQL built by string concatenation or formatting", n));
+// --- #44 OS command injection -------------------------------------------------
+const SHELL_FN = /^(os\.(system|popen|popen2|popen3|popen4)|commands\.getoutput|commands\.getstatusoutput|subprocess\.(getoutput|getstatusoutput))$/;
+const SUBPROCESS_FN = /^subprocess\.(run|call|Popen|check_output|check_call)$/;
+const EXEC_FN = /^os\.(exec\w+|spawn\w+)$/;
+export const commandInjection = patternCheck("py-command-injection", ["python"], (index) => {
+    const calls = index.calls();
+    return [
+        ...sinkFindings(calls, (s) => (SHELL_FN.test(s.name ?? "") ? first(s) : undefined), "py-shell-command", "Running a shell command built from variables allows command injection; use subprocess with an argument list and no shell."),
+        ...sinkFindings(calls, (s) => (SUBPROCESS_FN.test(s.name ?? "") && isTrue(kwarg(s.node, "shell")) ? (first(s) ?? kwarg(s.node, "args")) : undefined), "py-subprocess-shell", "shell=True with a variable command allows command injection; pass an argument list without shell=True."),
+        ...sinkFindings(calls, (s) => (EXEC_FN.test(s.name ?? "") ? callArgs(s.node) : undefined), "py-exec-spawn", "Executing programs with request-controlled arguments allows command/argument injection.", { unknownIsLow: false }),
+    ];
+}, (n) => NO_PATTERN("OS command execution with variable input", n));
+// --- #54 Dynamic scripting / code injection -----------------------------------
+const SAFE_YAML_LOADER = /(Safe|Base)Loader$/;
+export const codeInjection = patternCheck("py-code-injection", ["python"], (index) => {
+    const calls = index.calls();
+    const out = [
+        ...sinkFindings(calls, (s) => (s.name === "eval" || s.name === "exec" || s.name === "builtins.eval" || s.name === "builtins.exec" ? first(s) : undefined), "py-eval", "eval()/exec() of non-constant input runs arbitrary code."),
+        ...sinkFindings(calls, (s) => (s.name === "__import__" || s.name === "importlib.import_module" ? first(s) : undefined), "py-dynamic-import", "Importing modules chosen by input can load attacker-chosen code.", { unknownIsLow: false }),
+        ...sinkFindings(calls, (s) => (/^(pickle|cPickle|_pickle|dill|marshal|shelve|jsonpickle)\.(loads?|decode|open)$/.test(s.name ?? "") ? first(s) : undefined), "py-unsafe-deserialization", "Unpickling untrusted data executes arbitrary code.", { unknownIsLow: false }),
+    ];
+    for (const s of calls) {
+        if (s.name === "yaml.unsafe_load" || s.name === "yaml.full_load") {
+            out.push(pyFinding(s.module, s.node, "py-yaml-unsafe-load", "high", "Unsafe YAML loading can construct arbitrary Python objects; use yaml.safe_load()."));
+        }
+        else if (s.name === "yaml.load") {
+            const loader = kwarg(s.node, "Loader") ?? callArgs(s.node)[1];
+            if (!loader || !SAFE_YAML_LOADER.test(dotted(loader) ?? "")) {
+                out.push(pyFinding(s.module, s.node, "py-yaml-unsafe-load", loader ? "high" : "medium", "yaml.load() without SafeLoader can construct arbitrary Python objects; use yaml.safe_load()."));
+            }
+        }
+    }
+    return out;
+}, (n) => NO_PATTERN("eval/exec, unsafe deserialisation or dynamic imports of variable input", n));
+// --- #43 Cross-site scripting -------------------------------------------------
+const MARK_SAFE = /(^|\.)(mark_safe|SafeString|SafeText|Markup)$/;
+export const xss = patternCheck("py-xss", ["python"], async (index, ctx) => {
+    const calls = index.calls();
+    const out = [
+        ...sinkFindings(calls, (s) => (MARK_SAFE.test(s.name ?? "") ? first(s) : undefined), "django-mark-safe", "mark_safe() on non-constant content disables auto-escaping; use format_html() or escape the input."),
+        ...sinkFindings(calls, (s) => (/(^|\.)format_html$/.test(s.name ?? "") && isDynamicString(first(s)) ? first(s) : undefined), "django-format-html-prebuilt", "Pre-formatting the string passed to format_html() bypasses its escaping; pass values as arguments."),
+        ...sinkFindings(calls, (s) => {
+            const a = first(s);
+            return /(^|\.)HttpResponse$/.test(s.name ?? "") && a && isDynamicString(a) ? a : undefined;
+        }, "django-httpresponse-interpolation", "Writing request data into an HTML response without escaping enables reflected XSS.", { requestOnly: true }),
+    ];
+    // Templates are not Python; regex is the only option here (higher false-positive rate, flagged in output).
+    for (const f of ctx.files.filter((x) => /(^|\/)templates\/.+\.(html?|txt|jinja2?|j2)$/.test(x.path))) {
+        const lines = (await ctx.read(f.path)).split(/\r?\n/);
+        lines.forEach((line, i) => {
+            const autoescapeOff = /\{%-?\s*autoescape\s+(off|false)\s*-?%\}/i.test(line);
+            const safeFilter = /\|\s*safe\b/.test(line);
+            if (autoescapeOff || safeFilter) {
+                out.push({
+                    file: f.path,
+                    line: i + 1,
+                    snippet: snippetOf(line),
+                    why: autoescapeOff ? "Turning auto-escaping off renders variables as raw HTML." : "The |safe filter renders a variable as raw HTML; safe only if the value can never contain user input.",
+                    confidence: autoescapeOff ? "medium" : "low",
+                    method: "regex",
+                    rule: autoescapeOff ? "django-template-autoescape-off" : "django-template-safe-filter",
+                });
+            }
+        });
+    }
+    return out;
+}, (n) => NO_PATTERN("auto-escaping bypasses (mark_safe, |safe, autoescape off, unescaped responses)", n));
+// --- #42 Path traversal / filename injection ----------------------------------
+const PATH_SINK = /^(open|io\.open|codecs\.open|os\.path\.join|pathlib\.Path|os\.(remove|unlink|rename|replace|rmdir|makedirs|mkdir|listdir|scandir|stat)|shutil\.\w+|django\.http\.FileResponse|django\.views\.static\.serve|flask\.send_file|flask\.send_from_directory)$/;
+export const pathTraversal = patternCheck("py-path-traversal", ["python"], (index) => sinkFindings(index.calls(), (s) => (PATH_SINK.test(s.name ?? "") ? callArgs(s.node) : undefined), "py-path-from-request", "File paths built from request data allow ../ traversal; normalise and confine paths to an allowed directory.", { requestOnly: true }), (n) => NO_PATTERN("file paths built from request data", n));
+// --- #46 XPath / #53 LDAP / #55 regex / #58 template injection -----------------
+export const xpathInjection = patternCheck("py-xpath-injection", ["python"], (index) => sinkFindings(index.calls(), (s) => (s.method === "xpath" || /(^|\.)XPath$/.test(s.name ?? "") ? first(s) : undefined), "py-xpath-string-building", "XPath queries built from strings are injectable; use XPath variables (xpath(expr, name=value)).", { unknownIsLow: false }), (n) => NO_PATTERN("XPath queries built from strings", n));
+export const ldapInjection = patternCheck("py-ldap-injection", ["python"], (index) => {
+    if (!index.imports("ldap") && !index.imports("ldap3"))
+        return [];
+    return sinkFindings(index.calls(), (s) => {
+        if (!/^search(_s|_st|_ext|_ext_s)?$/.test(s.method ?? ""))
+            return undefined;
+        const args = callArgs(s.node);
+        return kwarg(s.node, "filterstr") ?? kwarg(s.node, "search_filter") ?? (s.method === "search" ? args[1] : args[2]);
+    }, "py-ldap-filter-building", "LDAP filters built from input are injectable; escape values with ldap.filter.escape_filter_chars().", { unknownIsLow: false });
+}, (n) => NO_PATTERN("LDAP filters built from strings", n));
+export const regexInjection = patternCheck("py-regex-injection", ["python"], (index) => sinkFindings(index.calls(), (s) => {
+    if (!/^re\.(compile|search|match|fullmatch|findall|finditer|sub|subn|split)$/.test(s.name ?? ""))
+        return undefined;
+    const a = first(s);
+    return a && !(a._t === "Call" && dotted(a["func"])?.endsWith("escape")) ? a : undefined;
+}, "py-regex-from-request", "Regular expressions taken from input allow ReDoS and pattern manipulation; use re.escape().", { requestOnly: true }), (n) => NO_PATTERN("regular expressions built from request data", n));
+const TEMPLATE_CTOR = /^(flask\.render_template_string|django\.template\.(Template|engines\[\]\.from_string)|jinja2\.(Template|Environment\(\)\.from_string)|mako\.template\.Template)$|(^|\.)from_string$/;
+export const templateInjection = patternCheck("py-template-injection", ["python"], (index) => sinkFindings(index.calls(), (s) => (TEMPLATE_CTOR.test(s.name ?? "") ? first(s) : undefined), "py-template-from-input", "Compiling templates from variable input enables server-side template injection."), (n) => NO_PATTERN("templates compiled from variable input", n));
+// --- #56 Data property / field injection (mass assignment) ---------------------
+export const massAssignment = patternCheck("py-mass-assignment", ["python"], (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        if (starKwargs(s.node).some((v) => s.module.isRequestDerived(v, s.module.scope(s.fn)))) {
+            out.push(pyFinding(s.module, s.node, "py-kwargs-from-request", "high", "Passing **request data into a model/ORM call lets clients set any field (e.g. is_staff)."));
+        }
+    }
+    for (const { module, node } of classDefs(index)) {
+        if (!bases(module, node).some((b) => /(ModelForm|ModelSerializer|HyperlinkedModelSerializer)$/.test(b)))
+            continue;
+        const meta = node["body"].find((b) => b._t === "ClassDef" && b["name"] === "Meta");
+        for (const stmt of meta ? walkStatements(meta) : []) {
+            const t = stmt._t === "Assign" ? stmt["targets"][0] : undefined;
+            if (t?._t === "Name" && t["id"] === "fields" && strConst(stmt["value"]) === "__all__") {
+                out.push(pyFinding(module, stmt, "django-fields-all", "medium", 'fields = "__all__" exposes every model field to client input, including ones added later.'));
+            }
+        }
+    }
+    return out;
+}, (n) => NO_PATTERN("mass-assignment patterns (**request data, fields = \"__all__\")", n));
+// --- #60 / #97 Open redirect ----------------------------------------------------
+const REDIRECT = /^(django\.shortcuts\.redirect|django\.http\.(HttpResponseRedirect|HttpResponsePermanentRedirect)|flask\.redirect)$|^(redirect|HttpResponseRedirect|HttpResponsePermanentRedirect)$/;
+const REDIRECT_GUARD = /(url_has_allowed_host_and_scheme|is_safe_url)$/;
+export const openRedirect = patternCheck("py-open-redirect", ["python"], (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        if (!REDIRECT.test(s.name ?? ""))
+            continue;
+        const target = first(s) ?? kwarg(s.node, "to");
+        const scope = s.module.scope(s.fn);
+        if (!target || !s.module.isRequestDerived(target, scope))
+            continue;
+        if (scope && [...scope.calls].some((c) => REDIRECT_GUARD.test(c)))
+            continue; // validated in the same function
+        const direct = s.module.isRequestDerived(target);
+        out.push(pyFinding(s.module, s.node, "py-open-redirect", direct ? "high" : "medium", "Redirecting to a URL taken from the request lets attackers send users to malicious sites; validate with url_has_allowed_host_and_scheme()."));
+    }
+    return out;
+}, (n) => NO_PATTERN("redirects to request-controlled URLs without validation", n));
+//# sourceMappingURL=injection.js.map

package/dist/code/checks/injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.js","sourceRoot":"","sources":["../../../src/code/checks/injection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,QAAQ,EACR,MAAM,EACN,eAAe,EACf,MAAM,EACN,MAAM,EACN,KAAK,EACL,UAAU,EACV,QAAQ,GAGT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAS7E;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAc,EAAE,GAAuB,EAAE,IAAI,GAAgB,EAAE;IACrF,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACnF,IAAI,GAAG,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7D,IAAI,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC7B,IAAI,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzF,OAAO,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CACnB,KAAiB,EACjB,KAAwD,EACxD,IAAY,EACZ,GAAW,EACX,IAAI,GAAgB,EAAE;IAEtB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QACjG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnD,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CACtC,kBAAkB,EAClB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5B,OAAO;QACL,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACzH,wBAAwB,EAAE,oHAAoH,CAAC;QACjJ,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACvH,gBAAgB,EAAE,2EAA2E,CAAC;QAChG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACvH,uBAAuB,EAAE,8EAA8E,CAAC;QAC1G,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC3C,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpG,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnJ,CAAC,EAAE,kBAAkB,EAAE,8EAA8E,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;KAChI,CAAC;AACJ,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,iDAAiD,EAAE,CAAC,CAAC,CACxE,CAAC;AAEF,iFAAiF;AACjF,MAAM,QAAQ,GAAG,mIAAmI,CAAC;AACrJ,MAAM,aAAa,GAAG,wDAAwD,CAAC;AAC/E,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAE3C,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAC1C,sBAAsB,EACtB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5B,OAAO;QACL,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAChF,kBAAkB,EAAE,2HAA2H,CAAC;QAClJ,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAClJ,qBAAqB,EAAE,wGAAwG,CAAC;QAClI,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACvF,eAAe,EAAE,yFAAyF,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;KACvI,CAAC;AACJ,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,0CAA0C,EAAE,CAAC,CAAC,CACjE,CAAC;AAEF,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CACvC,mBAAmB,EACnB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG;QACV,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACvJ,SAAS,EAAE,0DAA0D,CAAC;QACxE,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACpH,mBAAmB,EAAE,kEAAkE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACnH,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iFAAiF,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACzJ,2BAA2B,EAAE,oDAAoD,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;KAC9G,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,mFAAmF,CAAC,CAAC,CAAC;QAC5J,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,8FAA8F,CAAC,CAAC,CAAC;YAC3L,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAC/F,CAAC;AAEF,iFAAiF;AACjF,MAAM,SAAS,GAAG,+CAA+C,CAAC;AAElE,MAAM,CAAC,MAAM,GAAG,GAAG,YAAY,CAC7B,QAAQ,EACR,CAAC,QAAQ,CAAC,EACV,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IACnB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG;QACV,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACjF,kBAAkB,EAAE,oGAAoG,CAAC;QAC3H,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACzH,6BAA6B,EAAE,oGAAoG,CAAC;QACtI,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;YAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,CAAC,EAAE,mCAAmC,EAAE,oFAAoF,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;KACrJ,CAAC;IACF,2GAA2G;IAC3G,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YACxB,MAAM,aAAa,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7E,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,aAAa,IAAI,UAAU,EAAE,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC;oBACxB,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,0DAA0D,CAAC,CAAC,CAAC,uGAAuG;oBACzL,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;oBAC5C,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,6BAA6B;iBACvF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,gFAAgF,EAAE,CAAC,CAAC,CACvG,CAAC;AAEF,iFAAiF;AACjF,MAAM,SAAS,GAAG,0PAA0P,CAAC;AAE7Q,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CACvC,mBAAmB,EACnB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE,CACR,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAC9F,sBAAsB,EAAE,8GAA8G,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAClK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAC3D,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CACxC,oBAAoB,EACpB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE,CACR,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACnH,0BAA0B,EAAE,iGAAiG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAC3J,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,kCAAkC,EAAE,CAAC,CAAC,CACzD,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CACvC,mBAAmB,EACnB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC,EAAE,yBAAyB,EAAE,qGAAqG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AAChK,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,iCAAiC,EAAE,CAAC,CAAC,CACxD,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CACxC,oBAAoB,EACpB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE,CACR,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;IAChC,IAAI,CAAC,wEAAwE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACnH,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC,EAAE,uBAAuB,EAAE,6FAA6F,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EACnJ,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,6CAA6C,EAAE,CAAC,CAAC,CACpE,CAAC;AAEF,MAAM,aAAa,GAAG,qLAAqL,CAAC;AAE5M,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAC3C,uBAAuB,EACvB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE,CACR,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAC1F,wBAAwB,EAAE,iFAAiF,CAAC,EAChH,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAC/D,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CACxC,oBAAoB,EACpB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,0FAA0F,CAAC,CAAC,CAAC;QACtK,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAClH,MAAM,IAAI,GAAI,IAAI,CAAC,MAAM,CAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC;QACjG,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,SAAS,CAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,IAAI,CAAC,EAAE,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACtF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,2FAA2F,CAAC,CAAC,CAAC;YAChK,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,iEAAiE,EAAE,CAAC,CAAC,CACxF,CAAC;AAEF,mFAAmF;AACnF,MAAM,QAAQ,GAAG,oLAAoL,CAAC;AACtM,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAExE,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CACtC,kBAAkB,EAClB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,SAAS;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,SAAS;QACnE,IAAI,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,iCAAiC;QAC9G,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EACjF,4IAA4I,CAAC,CAAC,CAAC;IACnJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAChF,CAAC"}

package/dist/code/checks/javascript-config.d.ts

@@ -0,0 +1,14 @@
+import type { CodeCheck } from "../types.js";
+export declare const jsDebug: CodeCheck;
+export declare const jsCsrf: CodeCheck;
+export declare const jsSessionSecure: CodeCheck;
+export declare const jsSessionHttpOnly: CodeCheck;
+export declare const jsSessionDomain: CodeCheck;
+export declare const jsSessionPath: CodeCheck;
+export declare const jsSessionExpiry: CodeCheck;
+export declare const jsLoginRotation: CodeCheck;
+export declare const jsAuthRateLimit: CodeCheck;
+export declare const jsUploadPath: CodeCheck;
+export declare const jsUploadSize: CodeCheck;
+export declare const jsUploadType: CodeCheck;
+//# sourceMappingURL=javascript-config.d.ts.map

package/dist/code/checks/javascript-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript-config.d.ts","sourceRoot":"","sources":["../../../src/code/checks/javascript-config.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAA4B,MAAM,aAAa,CAAC;AA2BvE,eAAO,MAAM,OAAO,WAqBlB,CAAC;AAMH,eAAO,MAAM,MAAM,WAUjB,CAAC;AAoDH,eAAO,MAAM,eAAe,WAAiJ,CAAC;AAC9K,eAAO,MAAM,iBAAiB,WAAkJ,CAAC;AAEjL,eAAO,MAAM,eAAe,WAgB1B,CAAC;AAEH,eAAO,MAAM,aAAa,WAMxB,CAAC;AAIH,eAAO,MAAM,eAAe,WAkB1B,CAAC;AAKH,eAAO,MAAM,eAAe,WAgB1B,CAAC;AAKH,eAAO,MAAM,eAAe,WAI1B,CAAC;AAQH,eAAO,MAAM,YAAY,WAiBvB,CAAC;AAEH,eAAO,MAAM,YAAY,WAYvB,CAAC;AAEH,eAAO,MAAM,YAAY,WAWvB,CAAC"}