insa-check-core 0.1.0

package/dist/code/checks/javascript-config.js

@@ -0,0 +1,251 @@
+import { jsFinding, locations, outcomeFromFindings } from "../findings.js";
+import { isJsFalse, isJsTrue, jsArgs, jsDotted, jsString, objectProp, unwrap, walkJs, } from "../javascript/index.js";
+import { codeCheck } from "./shared.js";
+/**
+ * Configuration rules for Node server frameworks. They only run when one is detected, so
+ * front-end JavaScript inside (say) a Django project is not judged as if it were a server.
+ */
+const SERVER = ["express", "koa", "fastify", "next", "nestjs"];
+function serverCheck(key, run) {
+    return codeCheck(key, SERVER, async (ctx) => run(await ctx.javascript(), ctx));
+}
+const numeric = (node) => {
+    const n = unwrap(node);
+    if (!n)
+        return undefined;
+    if (n.type === "NumericLiteral")
+        return n["value"];
+    if (n.type === "BinaryExpression" && ["*", "+"].includes(n["operator"])) {
+        const l = numeric(n["left"]);
+        const r = numeric(n["right"]);
+        if (l === undefined || r === undefined)
+            return undefined;
+        return n["operator"] === "*" ? l * r : l + r;
+    }
+    return undefined;
+};
+// --- #3 Debug functionality ----------------------------------------------------------
+export const jsDebug = serverCheck("js-debug", (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        if (s.name === "errorhandler") {
+            out.push(jsFinding(s.module, s.node, "express-errorhandler", "medium", "The errorhandler middleware sends stack traces to clients; it is for development only."));
+        }
+        const args = jsArgs(s.node);
+        if (s.method === "set" && jsString(args[0]) === "env" && jsString(args[1]) === "development") {
+            out.push(jsFinding(s.module, s.node, "express-env-development", "medium", "Forcing the development environment enables verbose errors in production."));
+        }
+    }
+    for (const module of index.modules) {
+        for (const n of walkJs(module.tree)) {
+            if (n.type !== "ObjectProperty")
+                continue;
+            const key = n["key"]["name"] ?? jsString(n["key"]);
+            if ((key === "playground" || key === "introspection") && isJsTrue(n["value"])) {
+                out.push(jsFinding(module, n, "graphql-introspection", "low", "GraphQL playground/introspection exposes the full API schema; disable it in production."));
+            }
+        }
+    }
+    return outcomeFromFindings(out, `No development-only error handlers or debug settings found in ${index.modules.length} JavaScript/TypeScript file(s).`);
+});
+// --- #61 CSRF --------------------------------------------------------------------------
+const CSRF_PACKAGES = ["csurf", "csrf-csrf", "csrf-sync", "lusca", "@fastify/csrf-protection", "koa-csrf", "tiny-csrf"];
+const SESSION_PACKAGES = ["express-session", "cookie-session", "koa-session", "@fastify/session", "@fastify/secure-session", "iron-session", "next-auth"];
+export const jsCsrf = serverCheck("js-csrf", (index) => {
+    const csrf = CSRF_PACKAGES.filter((p) => index.imports(p));
+    if (csrf.length)
+        return { status: "pass", detail: `CSRF protection middleware is used (${csrf.join(", ")}). Confirm it covers every state-changing route.` };
+    const sessions = SESSION_PACKAGES.filter((p) => index.imports(p));
+    return {
+        status: "manual",
+        detail: sessions.length
+            ? `Cookie sessions are used (${sessions.join(", ")}) but no CSRF middleware was found. Confirm state-changing requests are protected (anti-CSRF token or SameSite cookies).`
+            : "No CSRF middleware and no cookie-session library found. If the API authenticates with headers/tokens only, CSRF does not apply; otherwise review manually.",
+    };
+});
+const cache = new WeakMap();
+/** express-session({ cookie: {...} }) and cookie-session({...}) calls. */
+function sessionConfigs(index) {
+    let configs = cache.get(index);
+    if (!configs) {
+        configs = [];
+        for (const s of index.calls()) {
+            const options = unwrap(jsArgs(s.node)[0]);
+            if (s.name === "express-session" || s.name === "@fastify/session")
+                configs.push({ site: s, cookie: objectProp(options, "cookie") });
+            else if (s.name === "cookie-session" || s.name === "koa-session")
+                configs.push({ site: s, cookie: options?.type === "ObjectExpression" ? options : undefined });
+        }
+        cache.set(index, configs);
+    }
+    return configs;
+}
+const NO_SESSION = {
+    status: "manual",
+    detail: "No express-session / cookie-session configuration found in the code. Review how session cookies are set (framework, proxy or identity provider).",
+};
+function sessionFlag(key, option, label, defaultSecure, why) {
+    return serverCheck(key, (index) => {
+        const configs = sessionConfigs(index);
+        if (configs.length === 0)
+            return NO_SESSION;
+        const findings = [];
+        const dynamic = [];
+        for (const { site, cookie } of configs) {
+            const value = objectProp(cookie, option);
+            const where = `${site.module.path}:${site.module.lineOf(site.node)}`;
+            if (!value) {
+                if (!defaultSecure)
+                    findings.push(jsFinding(site.module, site.node, `${key}-missing`, "medium", `${label} is not set (default: off). ${why}`));
+            }
+            else if (isJsFalse(value))
+                findings.push(jsFinding(site.module, value, `${key}-false`, "high", why));
+            else if (!isJsTrue(value) && jsString(value) !== "auto")
+                dynamic.push(where);
+        }
+        if (findings.length === 0 && dynamic.length) {
+            return { status: "manual", detail: `${label} is computed at runtime (${dynamic.join(", ")}); confirm the production value.` };
+        }
+        return outcomeFromFindings(findings, `Session cookies set ${label} in ${configs.length} session configuration(s).`);
+    });
+}
+export const jsSessionSecure = sessionFlag("js-session-cookie-secure", "secure", "the Secure flag", false, "The session cookie can be sent over plain HTTP and intercepted.");
+export const jsSessionHttpOnly = sessionFlag("js-session-cookie-httponly", "httpOnly", "HttpOnly", true, "JavaScript (including injected scripts) can read the session cookie.");
+export const jsSessionDomain = serverCheck("js-session-cookie-domain", (index) => {
+    const configs = sessionConfigs(index);
+    if (configs.length === 0)
+        return NO_SESSION;
+    const findings = [];
+    const review = [];
+    for (const { site, cookie } of configs) {
+        const value = objectProp(cookie, "domain");
+        if (!value)
+            continue;
+        const domain = jsString(value);
+        if (domain?.startsWith("."))
+            findings.push(jsFinding(site.module, value, "js-session-cookie-domain", "medium", "A leading-dot domain shares the session cookie with every subdomain."));
+        else
+            review.push(`${site.module.path}:${site.module.lineOf(value)}`);
+    }
+    if (findings.length === 0 && review.length) {
+        return { status: "manual", detail: `A session cookie domain is set (${review.join(", ")}); it also covers subdomains. Confirm it is the site's exact host.` };
+    }
+    return outcomeFromFindings(findings, "No session cookie domain is set, so session cookies are host-only (most restrictive).");
+});
+export const jsSessionPath = serverCheck("js-session-cookie-path", (index) => {
+    const configs = sessionConfigs(index);
+    if (configs.length === 0)
+        return NO_SESSION;
+    const paths = configs.map((c) => jsString(objectProp(c.cookie, "path")) ?? "/ (default)");
+    // Whether "/" is restrictive enough depends on where the app is mounted, which the code does not say.
+    return { status: "manual", detail: `Session cookie path: ${[...new Set(paths)].join(", ")}. Restrictive only if it matches the path the application is mounted at.` };
+});
+const MAX_SESSION_MS = 24 * 60 * 60 * 1000;
+export const jsSessionExpiry = serverCheck("js-session-expiry", (index) => {
+    const configs = sessionConfigs(index);
+    if (configs.length === 0)
+        return NO_SESSION;
+    const findings = [];
+    const unknown = [];
+    for (const { site, cookie } of configs) {
+        const value = objectProp(cookie, "maxAge");
+        const ms = numeric(value);
+        if (!value || ms === undefined)
+            unknown.push(`${site.module.path}:${site.module.lineOf(site.node)}`);
+        else if (ms > MAX_SESSION_MS) {
+            findings.push(jsFinding(site.module, value, "js-session-age", "medium", `Sessions stay valid for ${Math.round(ms / 3_600_000)} hours; this tool expects at most 24h as INSA sets no figure.`));
+        }
+    }
+    if (findings.length === 0 && unknown.length) {
+        return { status: "manual", detail: `No fixed session lifetime (cookie maxAge) found in ${unknown.join(", ")}; confirm idle and absolute timeouts are enforced.` };
+    }
+    return outcomeFromFindings(findings, "Session cookies expire within 24 hours.");
+});
+// --- #64 / #73 Session regeneration on login ---------------------------------------------
+const USER_KEY = /^(user|userId|user_id|uid|account|accountId|loggedIn|isLoggedIn|authenticated|auth)$/i;
+export const jsLoginRotation = serverCheck("js-login-session-rotation", (index) => {
+    const findings = [];
+    const regenerates = new Set(index.calls().filter((s) => s.method === "regenerate").map((s) => s.module.path));
+    for (const module of index.modules) {
+        for (const n of walkJs(module.tree)) {
+            if (n.type !== "AssignmentExpression")
+                continue;
+            const m = /^(?:req|request)\.session\.(\w+)$/.exec(jsDotted(n["left"]) ?? "");
+            if (!m || !USER_KEY.test(m[1]) || regenerates.has(module.path))
+                continue;
+            findings.push(jsFinding(module, n, "js-session-login-no-regenerate", "medium", "The user is stored in the existing session without regenerating its ID (session fixation); call req.session.regenerate() on login."));
+        }
+    }
+    if (findings.length)
+        return outcomeFromFindings(findings, "");
+    if (regenerates.size)
+        return { status: "pass", detail: "Sessions are regenerated on login (req.session.regenerate is called where the user is stored)." };
+    if (index.imports("passport"))
+        return { status: "pass", detail: "Logins go through Passport, which regenerates the session on login (passport >= 0.6). Confirm the installed version." };
+    return { status: "manual", detail: "No session-based login found in the code (no req.session user assignment, no Passport); review how users are authenticated." };
+});
+// --- #37 Rate limiting on authentication ---------------------------------------------------
+const RATE_PACKAGES = ["express-rate-limit", "rate-limiter-flexible", "express-slow-down", "express-brute", "@nestjs/throttler", "@fastify/rate-limit", "koa-ratelimit", "@upstash/ratelimit"];
+export const jsAuthRateLimit = serverCheck("js-auth-rate-limit", (index) => {
+    const used = RATE_PACKAGES.filter((p) => index.imports(p));
+    if (used.length)
+        return { status: "pass", detail: `Rate limiting is used (${used.join(", ")}). Confirm it is applied to login, password-reset and token endpoints.`, evidence: used };
+    return { status: "manual", detail: "No application-level rate limiting library found. It may be enforced by a reverse proxy or WAF; verify there." };
+});
+// --- #80 - #82 File uploads ------------------------------------------------------------------
+const UPLOAD_PACKAGES = ["multer", "formidable", "busboy", "express-fileupload", "@fastify/multipart", "multiparty"];
+const handlesUploads = (index) => UPLOAD_PACKAGES.some((p) => index.imports(p));
+const NO_UPLOADS = (n) => ({ status: "pass", detail: `No file upload handling found in ${n} JavaScript/TypeScript file(s) (no multer, formidable, busboy or similar).` });
+const multerCalls = (index) => index.calls().filter((s) => s.name === "multer");
+export const jsUploadPath = serverCheck("js-upload-path", (index) => {
+    if (!handlesUploads(index))
+        return NO_UPLOADS(index.modules.length);
+    const findings = [];
+    for (const module of index.modules) {
+        for (const n of walkJs(module.tree)) {
+            // file.originalname / files.x.name used to build the stored path or name.
+            if (n.type !== "CallExpression")
+                continue;
+            const name = module.qualify(jsDotted(n["callee"])) ?? "";
+            const usesClientName = jsArgs(n).some((a) => [...walkJs(a)].some((x) => /MemberExpression$/.test(x.type) && /\.(originalname|originalFilename)$|files?(\.\w+|\[\])?\.name$/.test(jsDotted(x) ?? "")));
+            if (!usesClientName)
+                continue;
+            if (/^path\.(join|resolve)$/.test(name) || /^(fs|fs\.promises)\./.test(name) || /\.(mv|cb|callback)$/.test(name) || name === "cb") {
+                findings.push(jsFinding(module, n, "js-upload-client-filename", "high", "Storing an upload under the client-supplied file name allows ../ to escape the upload directory and overwrites; generate the name or use path.basename plus an allow-list."));
+            }
+        }
+    }
+    return outcomeFromFindings(findings, "Uploads are not stored under client-supplied file names.");
+});
+export const jsUploadSize = serverCheck("js-upload-size", (index) => {
+    if (!handlesUploads(index))
+        return NO_UPLOADS(index.modules.length);
+    const limited = [];
+    for (const module of index.modules) {
+        for (const n of walkJs(module.tree)) {
+            if (n.type !== "ObjectProperty")
+                continue;
+            const key = n["key"]["name"] ?? jsString(n["key"]);
+            if (key === "fileSize" || key === "maxFileSize" || key === "maxFieldsSize")
+                limited.push(`${module.path}:${module.lineOf(n)}`);
+        }
+    }
+    if (limited.length)
+        return { status: "pass", detail: `Upload size limits are configured (${limited.slice(0, 3).join(", ")}).`, evidence: limited };
+    return { status: "manual", detail: "The project handles uploads but no size limit (e.g. multer limits.fileSize) was found in code. Confirm a limit at the web server or add one." };
+});
+export const jsUploadType = serverCheck("js-upload-type", (index) => {
+    if (!handlesUploads(index))
+        return NO_UPLOADS(index.modules.length);
+    const calls = multerCalls(index);
+    if (calls.length === 0) {
+        return { status: "manual", detail: "Uploads are handled without multer; review type validation in the handling code." };
+    }
+    const findings = calls
+        .filter((s) => !objectProp(jsArgs(s.node)[0], "fileFilter"))
+        .map((s) => jsFinding(s.module, s.node, "multer-no-filefilter", "medium", "multer accepts any file type unless a fileFilter (or later content check) restricts it."));
+    if (findings.length)
+        return { status: "fail", detail: `${findings.length} upload handler(s) without a fileFilter: ${locations(findings)}.`, findings };
+    return { status: "pass", detail: `All ${calls.length} multer configuration(s) define a fileFilter.` };
+});
+//# sourceMappingURL=javascript-config.js.map

package/dist/code/checks/javascript-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript-config.js","sourceRoot":"","sources":["../../../src/code/checks/javascript-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EACL,SAAS,EACT,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,MAAM,EACN,MAAM,GAIP,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;GAGG;AACH,MAAM,MAAM,GAA2B,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEvF,SAAS,WAAW,CAAC,GAAW,EAAE,GAAuD;IACvF,OAAO,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,IAAa,EAAsB,EAAE;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,CAAC,CAAC,OAAO,CAAW,CAAC;IAC7D,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAW,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACzD,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,wFAAwF;AACxF,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;IACvD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,wFAAwF,CAAC,CAAC,CAAC;QACpK,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;YAC7F,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,2EAA2E,CAAC,CAAC,CAAC;QAC1J,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;gBAAE,SAAS;YAC1C,MAAM,GAAG,GAAI,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,eAAe,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,EAAE,KAAK,EAAE,yFAAyF,CAAC,CAAC,CAAC;YAC5J,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,GAAG,EAAE,iEAAiE,KAAK,CAAC,OAAO,CAAC,MAAM,iCAAiC,CAAC,CAAC;AAC1J,CAAC,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AACxH,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;AAE1J,MAAM,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;IACrD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uCAAuC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD,EAAE,CAAC;IAC7J,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACrB,CAAC,CAAC,6BAA6B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,0HAA0H;YAC5K,CAAC,CAAC,4JAA4J;KACjK,CAAC;AACJ,CAAC,CAAC,CAAC;AASH,MAAM,KAAK,GAAG,IAAI,OAAO,EAA4B,CAAC;AAEtD,0EAA0E;AAC1E,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBAC/H,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAClK,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,GAAiB;IAC/B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,kJAAkJ;CAC3J,CAAC;AAEF,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc,EAAE,KAAa,EAAE,aAAsB,EAAE,GAAW;IAClG,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAC5C,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,aAAa;oBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,UAAU,EAAE,QAAQ,EAAE,GAAG,KAAK,+BAA+B,GAAG,EAAE,CAAC,CAAC,CAAC;YACjJ,CAAC;iBAAM,IAAI,SAAS,CAAC,KAAK,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;iBAClG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC,EAAE,CAAC;QAChI,CAAC;QACD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,uBAAuB,KAAK,OAAO,OAAO,CAAC,MAAM,4BAA4B,CAAC,CAAC;IACtH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC,0BAA0B,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iEAAiE,CAAC,CAAC;AAC9K,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC,4BAA4B,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,sEAAsE,CAAC,CAAC;AAEjL,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE;IAC/E,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5C,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,sEAAsE,CAAC,CAAC,CAAC;;YACnL,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oEAAoE,EAAE,CAAC;IAChK,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,uFAAuF,CAAC,CAAC;AAChI,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE;IAC3E,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC;IAC1F,sGAAsG;IACtG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,wBAAwB,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0EAA0E,EAAE,CAAC;AACxK,CAAC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE;IACxE,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5C,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aAChG,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EACpE,2BAA2B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,+DAA+D,CAAC,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC5C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,sDAAsD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD,EAAE,CAAC;IACpK,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,yCAAyC,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,QAAQ,GAAG,uFAAuF,CAAC;AAEzG,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC,2BAA2B,EAAE,CAAC,KAAK,EAAE,EAAE;IAChF,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9G,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB;gBAAE,SAAS;YAChD,MAAM,CAAC,GAAG,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9E,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1E,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,gCAAgC,EAAE,QAAQ,EAC3E,oIAAoI,CAAC,CAAC,CAAC;QAC3I,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,mBAAmB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,IAAI,WAAW,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gGAAgG,EAAE,CAAC;IAC1J,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sHAAsH,EAAE,CAAC;IACzL,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,6HAA6H,EAAE,CAAC;AACrK,CAAC,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,aAAa,GAAG,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;AAE/L,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE;IACzE,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,wEAAwE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtL,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,+GAA+G,EAAE,CAAC;AACvJ,CAAC,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC;AACrH,MAAM,cAAc,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,UAAU,GAAG,CAAC,CAAS,EAAgB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oCAAoC,CAAC,4EAA4E,EAAE,CAAC,CAAC;AAChM,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;IAClE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,0EAA0E;YAC1E,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;gBAAE,SAAS;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,+DAA+D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACtM,IAAI,CAAC,cAAc;gBAAE,SAAS;YAC9B,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,2BAA2B,EAAE,MAAM,EACpE,4KAA4K,CAAC,CAAC,CAAC;YACnL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,0DAA0D,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;IAClE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;gBAAE,SAAS;YAC1C,MAAM,GAAG,GAAI,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,eAAe;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjI,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sCAAsC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACnJ,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,8IAA8I,EAAE,CAAC;AACtL,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;IAClE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAC;IAC1H,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,yFAAyF,CAAC,CAAC,CAAC;IACxK,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,4CAA4C,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;IACvJ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,+CAA+C,EAAE,CAAC;AACxG,CAAC,CAAC,CAAC"}

package/dist/code/checks/javascript.d.ts

@@ -0,0 +1,34 @@
+import type { CodeFinding, Confidence } from "../../types.js";
+import { type JsCallSite, type JsIndex, type JsNode } from "../javascript/index.js";
+import type { CodeCheck, CodeContext } from "../types.js";
+export declare function jsPatternCheck(key: string, find: (index: JsIndex, ctx: CodeContext) => CodeFinding[] | Promise<CodeFinding[]>, what: string): CodeCheck;
+export interface SinkOptions {
+    /** Report values of unknown origin as low confidence (default true). */
+    unknownIsLow?: boolean;
+    /** Only report when request data reaches the sink (file paths, regexes, templates...). */
+    requestOnly?: boolean;
+}
+/**
+ * How risky is passing `arg` to a sink?
+ *  high   - contains request data directly, or is a string built from it
+ *  medium - built dynamically (template literal, +), or derived from request data via local variables
+ *  low    - some other non-literal value (origin unknown)
+ */
+export declare function jsArgRisk(site: JsCallSite, arg: JsNode | undefined, opts?: SinkOptions): Confidence | undefined;
+export declare const jsHardcodedSecrets: CodeCheck;
+export declare const jsWeakCrypto: CodeCheck;
+export declare const jsCryptoMisuse: CodeCheck;
+export declare const jsPlaintextPasswords: CodeCheck;
+export declare const jsSqlInjection: CodeCheck;
+export declare const jsCommandInjection: CodeCheck;
+export declare const jsCodeInjection: CodeCheck;
+export declare const jsPathTraversal: CodeCheck;
+export declare const jsXss: CodeCheck;
+export declare const jsRegexInjection: CodeCheck;
+export declare const jsTemplateInjection: CodeCheck;
+export declare const jsMassAssignment: CodeCheck;
+export declare const jsOpenRedirect: CodeCheck;
+export declare const jsSecretsInLogs: CodeCheck;
+export declare const jsXxe: CodeCheck;
+export declare const jsExternalDtd: CodeCheck;
+//# sourceMappingURL=javascript.d.ts.map

package/dist/code/checks/javascript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript.d.ts","sourceRoot":"","sources":["../../../src/code/checks/javascript.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAYL,KAAK,UAAU,EACf,KAAK,OAAO,EAEZ,KAAK,MAAM,EACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ1D,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,KAAK,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,EAClF,IAAI,EAAE,MAAM,GACX,SAAS,CAKX;AAED,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,GAAE,WAAgB,GAAG,UAAU,GAAG,SAAS,CAWnH;AAqCD,eAAO,MAAM,kBAAkB,WA4B9B,CAAC;AAGF,eAAO,MAAM,YAAY,WAsBxB,CAAC;AAEF,eAAO,MAAM,cAAc,WA0B1B,CAAC;AAKF,eAAO,MAAM,oBAAoB,WAiChC,CAAC;AAQF,eAAO,MAAM,cAAc,WAmB1B,CAAC;AAGF,eAAO,MAAM,kBAAkB,WAe9B,CAAC;AAGF,eAAO,MAAM,eAAe,WAkB3B,CAAC;AAKF,eAAO,MAAM,eAAe,WAW3B,CAAC;AAGF,eAAO,MAAM,KAAK,WAwCjB,CAAC;AAGF,eAAO,MAAM,gBAAgB,WAM5B,CAAC;AAEF,eAAO,MAAM,mBAAmB,WAM/B,CAAC;AAKF,eAAO,MAAM,gBAAgB,WAkB5B,CAAC;AAGF,eAAO,MAAM,cAAc,WAc1B,CAAC;AAMF,eAAO,MAAM,eAAe,WAsB3B,CAAC;AAWF,eAAO,MAAM,KAAK,WAIjB,CAAC;AAEF,eAAO,MAAM,aAAa,WAOzB,CAAC"}