insa-check-core 0.1.0

package/dist/code/checks/secrets.js

@@ -0,0 +1,140 @@
+import { djangoSettings } from "../django/settings.js";
+import { NO_PATTERN, pyFinding } from "../findings.js";
+import { callArgs, dotted, identifiers, strConst, walk } from "../python/index.js";
+import { bases, classDefs, PASSWORD_IDENT, patternCheck, SECRET_IDENT, walkStatements } from "./shared.js";
+export const SECRET_ASSIGN = /(password|passwd|secret|token|api_?key|apikey|private_?key|access_?key|secret_?key)$/i;
+export const SECRET_DICT_KEY = /^(password|passwd|secret|secret_key|api_key|apikey|token|access_key|private_key)$/i;
+/** Values that are clearly not secrets: placeholders and templates. */
+const PLACEHOLDER = /^(|.*\{.*\}.*|.*%\(?\w*\)?s.*|<.*>|\*+|x+|changeme|password|none|null)$/i;
+/** An environment variable name (case-sensitive: "DB_PASSWORD" is a name, "Sup3rPass" is not). */
+const ENV_NAME = /^[A-Z][A-Z0-9_]+$/;
+export const looksSecret = (value) => value !== undefined && value.length >= 6 && !PLACEHOLDER.test(value) && !ENV_NAME.test(value);
+/** #6 Hard-coded secrets (Django SECRET_KEY, credentials in code). Snippets are redacted. */
+export const hardcodedSecrets = patternCheck("py-hardcoded-secrets", ["python"], (index, ctx) => {
+    const out = [];
+    const settings = ctx.project.frameworks.includes("django") ? djangoSettings(index) : undefined;
+    const settingsPaths = new Set(settings?.modules.map((m) => m.path));
+    for (const module of index.modules) {
+        for (const n of walk(module.tree)) {
+            if (n._t === "Assign" || n._t === "AnnAssign") {
+                const targets = n._t === "Assign" ? n["targets"] : [n["target"]];
+                const value = strConst(n["value"]);
+                for (const t of targets) {
+                    const name = t._t === "Name" ? t["id"] : t._t === "Attribute" ? t["attr"] : undefined;
+                    if (!name || !SECRET_ASSIGN.test(name) || !looksSecret(value))
+                        continue;
+                    if (name === "SECRET_KEY" && settingsPaths.has(module.path))
+                        continue; // handled below with dev/prod context
+                    out.push(pyFinding(module, n, "py-hardcoded-secret", "medium", "Credentials in source code leak through repositories, backups and builds; load them from the environment or a secret store."));
+                }
+            }
+            else if (n._t === "Dict") {
+                const keys = n["keys"];
+                const values = n["values"];
+                keys.forEach((k, i) => {
+                    if (SECRET_DICT_KEY.test(strConst(k) ?? "") && looksSecret(strConst(values[i]))) {
+                        out.push(pyFinding(module, values[i], "py-hardcoded-secret", "medium", "Credentials in source code leak through repositories, backups and builds; load them from the environment or a secret store."));
+                    }
+                });
+            }
+            else if (n._t === "keyword" && typeof n["arg"] === "string" && SECRET_ASSIGN.test(n["arg"]) && looksSecret(strConst(n["value"]))) {
+                out.push(pyFinding(module, n["value"], "py-hardcoded-secret", "medium", "Credentials passed as literals are stored in source code."));
+            }
+        }
+    }
+    if (settings) {
+        for (const a of settings.all("SECRET_KEY")) {
+            if (typeof a.value !== "string" || a.value.length === 0)
+                continue;
+            out.push(settings.findingAt(a, "django-hardcoded-secret-key", a.kind === "dev" ? "low" : "high", a.kind === "dev"
+                ? "SECRET_KEY is hard-coded in development settings; make sure production never uses it."
+                : "A hard-coded SECRET_KEY lets anyone with the source forge sessions, password-reset tokens and signed data."));
+        }
+    }
+    return out;
+}, (n) => NO_PATTERN("hard-coded credentials or secret keys", n));
+const HASHING_CALL = /(make_password|set_password|hash|bcrypt|argon2|pbkdf2|scrypt|encrypt)/i;
+const MAIL_OR_RESPONSE = /^(django\.core\.mail\.)?(send_mail|send_mass_mail|mail_admins|mail_managers|EmailMessage|EmailMultiAlternatives)$|(^|\.)(HttpResponse|JsonResponse|Response)$/;
+/** #34 Plaintext password storage or retrieval. */
+export const plaintextPasswords = patternCheck("py-plaintext-passwords", ["python"], (index) => {
+    const out = [];
+    // user.password = <not hashed>
+    for (const module of index.modules) {
+        for (const n of walk(module.tree)) {
+            if (n._t !== "Assign")
+                continue;
+            const target = n["targets"][0];
+            if (target?._t !== "Attribute" || !PASSWORD_IDENT.test(target["attr"]))
+                continue;
+            const value = n["value"];
+            if (value._t === "Constant")
+                continue;
+            const text = module.text(value);
+            if (HASHING_CALL.test(text))
+                continue;
+            out.push(pyFinding(module, n, "py-plaintext-password-assign", "high", "Assigning a raw value to a password attribute stores it unhashed; use set_password()/make_password()."));
+        }
+    }
+    // Model fields named password on non-auth models.
+    for (const { module, node } of classDefs(index)) {
+        const b = bases(module, node);
+        if (!b.some((x) => /(^|\.)Model$/.test(x)) || b.some((x) => /AbstractBaseUser|AbstractUser/.test(x)))
+            continue;
+        for (const stmt of walkStatements(node)) {
+            if (stmt._t !== "Assign")
+                continue;
+            const t = stmt["targets"][0];
+            const v = stmt["value"];
+            const field = module.qualify(dotted(v["func"])) ?? "";
+            const fieldName = t?._t === "Name" ? t["id"] : "";
+            if (/hash|digest|salt/i.test(fieldName))
+                continue; // storing a hash is the correct design
+            if (t?._t === "Name" && PASSWORD_IDENT.test(fieldName) && v._t === "Call" && /(CharField|TextField)$/.test(field)) {
+                out.push(pyFinding(module, stmt, "py-password-model-field", "medium", "A password stored in a plain text model field is readable by anyone with database access."));
+            }
+        }
+    }
+    // Passwords sent by e-mail or returned in responses.
+    for (const site of index.calls()) {
+        if (!MAIL_OR_RESPONSE.test(site.name ?? ""))
+            continue;
+        const args = [...callArgs(site.node), ...((site.node["keywords"] ?? []).map((k) => k["value"]))];
+        if (args.some((a) => a._t !== "Constant" && identifiers(a).some((i) => PASSWORD_IDENT.test(i)))) {
+            out.push(pyFinding(site.module, site.node, "py-password-disclosed", "medium", "Sending or returning a password in plaintext implies it is stored or handled unhashed."));
+        }
+    }
+    return out;
+}, (n) => NO_PATTERN("plaintext password storage or retrieval", n));
+const LOG_METHOD = new Set(["debug", "info", "warning", "warn", "error", "exception", "critical", "log"]);
+const LOGGER_RECEIVER = /(^|\.)(_?log(ger)?|LOG(GER)?|logging)$/i;
+const REQUEST_DUMP = /^(self\.)?request\.(POST|data|body|META|headers|COOKIES|session)$/;
+/** #77 Secrets/tokens written to logs. */
+export const secretsInLogs = patternCheck("py-secrets-in-logs", ["python"], (index) => {
+    const out = [];
+    for (const site of index.calls()) {
+        const func = site.node["func"];
+        const receiver = func._t === "Attribute" ? (dotted(func["value"]) ?? "") : "";
+        const isLogger = func._t === "Attribute" && LOG_METHOD.has(site.method ?? "") && (LOGGER_RECEIVER.test(receiver) || (site.name ?? "").startsWith("logging."));
+        const isPrint = site.name === "print";
+        if (!isLogger && !isPrint)
+            continue;
+        const args = [...callArgs(site.node), ...((site.node["keywords"] ?? []).map((k) => k["value"]))];
+        for (const arg of args) {
+            if (arg._t === "Constant")
+                continue;
+            const secret = identifiers(arg).find((i) => SECRET_IDENT.test(i));
+            // A dump is the request data itself, wrapped in a call (dict(request.POST)) or an f-string placeholder,
+            // not an expression that merely indexes into it (request.POST["username"]).
+            const candidates = arg._t === "JoinedStr"
+                ? (arg["values"] ?? []).filter((v) => v._t === "FormattedValue").map((v) => v["value"])
+                : [arg._t === "Call" && callArgs(arg)[0] ? callArgs(arg)[0] : arg];
+            const dump = candidates.some((x) => REQUEST_DUMP.test(dotted(x) ?? ""));
+            if (secret || dump) {
+                out.push(pyFinding(site.module, site.node, "py-secret-logged", isPrint ? "low" : "medium", dump ? "Logging raw request data can write passwords, tokens and session IDs to logs." : `Logs a value named "${secret}", which may be a credential or token.`));
+                break;
+            }
+        }
+    }
+    return out;
+}, (n) => NO_PATTERN("logging of passwords, tokens or raw request data", n));
+//# sourceMappingURL=secrets.js.map

package/dist/code/checks/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/code/checks/secrets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAe,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE3G,MAAM,CAAC,MAAM,aAAa,GAAG,uFAAuF,CAAC;AACrH,MAAM,CAAC,MAAM,eAAe,GAAG,oFAAoF,CAAC;AACpH,uEAAuE;AACvE,MAAM,WAAW,GAAG,0EAA0E,CAAC;AAC/F,kGAAkG;AAClG,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAErC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAyB,EAAmB,EAAE,CACxE,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEhG,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAC1C,sBAAsB,EACtB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACb,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;gBAC9C,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,SAAS,CAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,CAAC;gBACzF,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC9G,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;wBAAE,SAAS;oBACxE,IAAI,IAAI,KAAK,YAAY,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;wBAAE,SAAS,CAAC,sCAAsC;oBAC7G,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,qBAAqB,EAAE,QAAQ,EAAE,6HAA6H,CAAC,CAAC,CAAC;gBACjM,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAsB,CAAC;gBAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAa,CAAC;gBACvC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;oBACpB,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBAChF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,6HAA6H,CAAC,CAAC,CAAC;oBAC1M,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAW,EAAE,qBAAqB,EAAE,QAAQ,EAAE,2DAA2D,CAAC,CAAC,CAAC;YAClJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAClE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,6BAA6B,EAAE,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAC7F,CAAC,CAAC,IAAI,KAAK,KAAK;gBACd,CAAC,CAAC,uFAAuF;gBACzF,CAAC,CAAC,4GAA4G,CAAC,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAC9D,CAAC;AAEF,MAAM,YAAY,GAAG,wEAAwE,CAAC;AAC9F,MAAM,gBAAgB,GAAG,+JAA+J,CAAC;AAEzL,mDAAmD;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAC5C,wBAAwB,EACxB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,+BAA+B;IAC/B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;gBAAE,SAAS;YAChC,MAAM,MAAM,GAAI,CAAC,CAAC,SAAS,CAAc,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,MAAM,EAAE,EAAE,KAAK,WAAW,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAW,CAAC;gBAAE,SAAS;YAC3F,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAW,CAAC;YACnC,IAAI,KAAK,CAAC,EAAE,KAAK,UAAU;gBAAE,SAAS;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,8BAA8B,EAAE,MAAM,EAAE,uGAAuG,CAAC,CAAC,CAAC;QAClL,CAAC;IACH,CAAC;IACD,kDAAkD;IAClD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/G,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ;gBAAE,SAAS;YACnC,MAAM,CAAC,GAAI,IAAI,CAAC,SAAS,CAAc,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAW,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,CAAC,EAAE,EAAE,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAS,CAAC,uCAAuC;YAC1F,IAAI,CAAC,EAAE,EAAE,KAAK,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClH,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,2FAA2F,CAAC,CAAC,CAAC;YACtK,CAAC;QACH,CAAC;IACH,CAAC;IACD,qDAAqD;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,SAAS;QACtD,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAW,CAAC,CAAC,CAAC,CAAC;QACzH,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,wFAAwF,CAAC,CAAC,CAAC;QAC3K,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAChE,CAAC;AAEF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1G,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAClE,MAAM,YAAY,GAAG,mEAAmE,CAAC;AAEzF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CACvC,oBAAoB,EACpB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAW,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,KAAK,WAAW,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9J,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAW,CAAC,CAAC,CAAC,CAAC;QACzH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,EAAE,KAAK,UAAU;gBAAE,SAAS;YACpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,wGAAwG;YACxG,4EAA4E;YAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,EAAE,KAAK,WAAW;gBACvC,CAAC,CAAC,CAAE,GAAG,CAAC,QAAQ,CAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAW,CAAC;gBAC/G,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACxE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EACvF,IAAI,CAAC,CAAC,CAAC,+EAA+E,CAAC,CAAC,CAAC,uBAAuB,MAAM,wCAAwC,CAAC,CAAC,CAAC;gBACnK,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,kDAAkD,EAAE,CAAC,CAAC,CACzE,CAAC"}

package/dist/code/checks/shared.d.ts

@@ -0,0 +1,25 @@
+import type { CheckOutcome, CodeFinding } from "../../types.js";
+import { type PyModule, type PyNode, type PythonIndex } from "../python/index.js";
+import type { CodeCheck, CodeContext, FrameworkId, Language } from "../types.js";
+export declare function codeCheck(key: string, appliesTo: readonly (Language | FrameworkId)[], run: (ctx: CodeContext) => Promise<CheckOutcome>): CodeCheck;
+/** A check whose verdict is the standard findings rule (see outcomeFromFindings). */
+export declare function patternCheck(key: string, appliesTo: readonly (Language | FrameworkId)[], find: (index: PythonIndex, ctx: CodeContext) => CodeFinding[] | Promise<CodeFinding[]>, passDetail: (files: number, index: PythonIndex) => string): CodeCheck;
+/** Names that suggest a security-relevant value. Used to raise or lower confidence, never as the sole match. */
+export declare const SECURITY_CONTEXT: RegExp;
+export declare const PASSWORD_IDENT: RegExp;
+export declare const SECRET_IDENT: RegExp;
+/** Qualified names of a function's decorators (calls unwrapped). */
+export declare function decorators(module: PyModule, fn: PyNode): string[];
+export declare function classDefs(index: PythonIndex): Generator<{
+    module: PyModule;
+    node: PyNode;
+}>;
+export declare function functionDefs(index: PythonIndex): Generator<{
+    module: PyModule;
+    node: PyNode;
+}>;
+/** All statements at any depth (bodies of classes, functions, if/try/with blocks). */
+export declare function walkStatements(node: PyNode): Generator<PyNode>;
+/** Base class names of a ClassDef, qualified. */
+export declare function bases(module: PyModule, cls: PyNode): string[];
+//# sourceMappingURL=shared.d.ts.map

package/dist/code/checks/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/code/checks/shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAkB,KAAK,QAAQ,EAAE,KAAK,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjF,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,WAAW,CAAC,EAAE,EAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,GAC/C,SAAS,CAEX;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,WAAW,CAAC,EAAE,EAC9C,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,KAAK,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,EACtF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,KAAK,MAAM,GACxD,SAAS,CAKX;AAED,gHAAgH;AAChH,eAAO,MAAM,gBAAgB,QAAsG,CAAC;AACpI,eAAO,MAAM,cAAc,QAAoD,CAAC;AAChF,eAAO,MAAM,YAAY,QAAsL,CAAC;AAEhN,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAKjE;AAED,wBAAiB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAI5F;AAED,wBAAiB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAM/F;AAED,sFAAsF;AACtF,wBAAiB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAU/D;AAED,iDAAiD;AACjD,wBAAgB,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAE7D"}

package/dist/code/checks/shared.js

@@ -0,0 +1,57 @@
+import { outcomeFromFindings } from "../findings.js";
+import { dotted, isNode } from "../python/index.js";
+export function codeCheck(key, appliesTo, run) {
+    return { kind: "code", key, appliesTo, run };
+}
+/** A check whose verdict is the standard findings rule (see outcomeFromFindings). */
+export function patternCheck(key, appliesTo, find, passDetail) {
+    return codeCheck(key, appliesTo, async (ctx) => {
+        const index = await ctx.python();
+        return outcomeFromFindings(await find(index, ctx), passDetail(index.modules.length, index));
+    });
+}
+/** Names that suggest a security-relevant value. Used to raise or lower confidence, never as the sole match. */
+export const SECURITY_CONTEXT = /pass(word|wd)?\b|pwd|secret|token|otp|nonce|salt|signature|sign\b|auth|api_?key|credential|reset/i;
+export const PASSWORD_IDENT = /^(.*_)?(password|passwd|pwd|passphrase)(_.*)?$/i;
+export const SECRET_IDENT = /^(.*_)?(password|passwd|pwd|secret|token|api_?key|apikey|secret_?key|private_?key|access_?key|session_?key|sessionid|authorization|jwt|otp|cvv|card_?number|credit_?card)(_.*)?$/i;
+/** Qualified names of a function's decorators (calls unwrapped). */
+export function decorators(module, fn) {
+    return (fn["decorator_list"] ?? []).map((d) => {
+        const target = d._t === "Call" ? d["func"] : d;
+        return module.qualify(dotted(target)) ?? "";
+    });
+}
+export function* classDefs(index) {
+    for (const module of index.modules) {
+        for (const stmt of walkStatements(module.tree))
+            if (stmt._t === "ClassDef")
+                yield { module, node: stmt };
+    }
+}
+export function* functionDefs(index) {
+    for (const module of index.modules) {
+        for (const stmt of walkStatements(module.tree)) {
+            if (stmt._t === "FunctionDef" || stmt._t === "AsyncFunctionDef")
+                yield { module, node: stmt };
+        }
+    }
+}
+/** All statements at any depth (bodies of classes, functions, if/try/with blocks). */
+export function* walkStatements(node) {
+    for (const key of ["body", "orelse", "finalbody", "handlers"]) {
+        const list = node[key];
+        if (!Array.isArray(list))
+            continue;
+        for (const stmt of list) {
+            if (!isNode(stmt))
+                continue;
+            yield stmt;
+            yield* walkStatements(stmt);
+        }
+    }
+}
+/** Base class names of a ClassDef, qualified. */
+export function bases(module, cls) {
+    return (cls["bases"] ?? []).map((b) => module.qualify(dotted(b)) ?? "");
+}
+//# sourceMappingURL=shared.js.map

package/dist/code/checks/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/code/checks/shared.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAgD,MAAM,oBAAoB,CAAC;AAGlG,MAAM,UAAU,SAAS,CACvB,GAAW,EACX,SAA8C,EAC9C,GAAgD;IAEhD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC/C,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,SAA8C,EAC9C,IAAsF,EACtF,UAAyD;IAEzD,OAAO,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,mBAAmB,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,gBAAgB,GAAG,mGAAmG,CAAC;AACpI,MAAM,CAAC,MAAM,cAAc,GAAG,iDAAiD,CAAC;AAChF,MAAM,CAAC,MAAM,YAAY,GAAG,mLAAmL,CAAC;AAEhN,oEAAoE;AACpE,MAAM,UAAU,UAAU,CAAC,MAAgB,EAAE,EAAU;IACrD,OAAO,CAAE,EAAE,CAAC,gBAAgB,CAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,SAAS,CAAC,KAAkB;IAC3C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,IAAI,IAAI,CAAC,EAAE,KAAK,UAAU;gBAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,YAAY,CAAC,KAAkB;IAC9C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,EAAE,KAAK,aAAa,IAAI,IAAI,CAAC,EAAE,KAAK,kBAAkB;gBAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAChG,CAAC;IACH,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,SAAS,CAAC,CAAC,cAAc,CAAC,IAAY;IAC1C,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,IAAI,IAAI,IAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5B,MAAM,IAAI,CAAC;YACX,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,KAAK,CAAC,MAAgB,EAAE,GAAW;IACjD,OAAO,CAAE,GAAG,CAAC,OAAO,CAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACxF,CAAC"}

package/dist/code/checks/treesitter.d.ts

@@ -0,0 +1,15 @@
+import type { CodeCheck } from "../types.js";
+export declare const tsHardcodedSecrets: CodeCheck;
+export declare const tsWeakCrypto: CodeCheck;
+export declare const tsCryptoMisuse: CodeCheck;
+export declare const tsSqlInjection: CodeCheck;
+export declare const tsCommandInjection: CodeCheck;
+export declare const tsCodeInjection: CodeCheck;
+export declare const tsPathTraversal: CodeCheck;
+export declare const tsXss: CodeCheck;
+export declare const tsOpenRedirect: CodeCheck;
+export declare const tsSecretsInLogs: CodeCheck;
+export declare const tsXxe: CodeCheck;
+/** Framework CSRF protection: explicit opt-outs are findings; evidence of protection passes; otherwise manual. */
+export declare const tsCsrf: CodeCheck;
+//# sourceMappingURL=treesitter.d.ts.map

package/dist/code/checks/treesitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"treesitter.d.ts","sourceRoot":"","sources":["../../../src/code/checks/treesitter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAmF7C,eAAO,MAAM,kBAAkB,WAa7B,CAAC;AAgBH,eAAO,MAAM,YAAY,WAgBvB,CAAC;AAWH,eAAO,MAAM,cAAc,WAoBzB,CAAC;AAWH,eAAO,MAAM,cAAc,WAgBzB,CAAC;AAWH,eAAO,MAAM,kBAAkB,WAmB7B,CAAC;AAcH,eAAO,MAAM,eAAe,WAU1B,CAAC;AAUH,eAAO,MAAM,eAAe,WAE3B,CAAC;AAUF,eAAO,MAAM,KAAK,WAahB,CAAC;AAUH,eAAO,MAAM,cAAc,WAWzB,CAAC;AAMH,eAAO,MAAM,eAAe,WAQ1B,CAAC;AAMH,eAAO,MAAM,KAAK,WAQhB,CAAC;AAGH,kHAAkH;AAClH,eAAO,MAAM,MAAM,WAoBjB,CAAC"}

package/dist/code/checks/treesitter.js

@@ -0,0 +1,322 @@
+import { outcomeFromFindings, snippetOf } from "../findings.js";
+import { SPECS } from "../treesitter/index.js";
+import { looksSecret, SECRET_ASSIGN } from "./secrets.js";
+import { codeCheck, SECRET_IDENT, SECURITY_CONTEXT } from "./shared.js";
+/** Pattern rules for Java, C#, Ruby and Go, driven by per-language sink tables. */
+const LANGS = ["java", "csharp", "ruby", "go"];
+function finding(module, node, rule, confidence, why) {
+    const line = module.lineOf(node);
+    return { file: module.path, line, snippet: snippetOf(module.line(line)), why, confidence, method: "ast", rule };
+}
+function tsCheck(key, what, find) {
+    return codeCheck(key, LANGS, async (ctx) => {
+        const index = await ctx.treeSitter();
+        const langs = [...new Set(index.modules.map((m) => SPECS[m.lang].label))].join(", ");
+        return outcomeFromFindings(find(index), `No ${what} found in ${index.modules.length} ${langs} file(s). Static analysis cannot prove absence; review dynamic code paths.`);
+    });
+}
+/** Same scale as the other languages: direct request data = high, derived/built = medium, unknown = low. */
+function risk(site, arg, opts = {}) {
+    if (!arg)
+        return undefined;
+    const m = site.module;
+    if (m.isLiteral(arg))
+        return undefined;
+    const scope = m.scope(site.fn);
+    const direct = m.spec.requestData.test(arg.text);
+    const derived = direct || m.isRequestDerived(arg, scope);
+    const dynamic = m.isDynamicString(arg) || (m.spec.identifierTypes.includes(arg.type) && scope.dynamicStrings.has(arg.text));
+    if (opts.requestOnly && !derived)
+        return undefined;
+    if (opts.dynamicOnly && !dynamic)
+        return undefined;
+    if (direct)
+        return "high";
+    if (dynamic)
+        return derived ? "high" : "medium";
+    if (derived)
+        return "medium";
+    return opts.unknownIsLow === false ? undefined : "low";
+}
+/** Findings for calls whose callee matches the language's pattern; `pick` chooses which arguments matter. */
+function sinks(index, patterns, rule, why, opts = {}, pick = (s) => s.args) {
+    const out = [];
+    for (const site of index.calls()) {
+        const pattern = patterns[site.module.lang];
+        if (!pattern || !pattern.test(site.callee))
+            continue;
+        const risks = pick(site).map((a) => risk(site, a, opts)).filter((r) => !!r);
+        if (risks.length === 0)
+            continue;
+        out.push(finding(site.module, site.node, rule, risks.includes("high") ? "high" : risks.includes("medium") ? "medium" : "low", why));
+    }
+    return out;
+}
+/** Findings for nodes of given types whose text matches (configuration constants, option fields...). */
+function markers(index, lang, types, pattern, rule, confidence, why) {
+    const out = [];
+    for (const m of index.byLang(lang)) {
+        for (const n of m.root.descendantsOfType(types))
+            if (pattern.test(n.text))
+                out.push(finding(m, n, rule, confidence, why));
+    }
+    return out;
+}
+const firstArg = (s) => [s.args[0]];
+const lineOfSite = (s) => s.module.line(s.module.lineOf(s.node));
+// --- #6 Hard-coded secrets -----------------------------------------------------------------
+const SECRET_WHY = "Credentials in source code leak through repositories, backups and builds; load them from the environment or a secret store.";
+const PAIR_TYPES = { ruby: ["pair"], go: ["keyed_element"] };
+export const tsHardcodedSecrets = tsCheck("ts-hardcoded-secrets", "hard-coded credentials", (index) => {
+    const out = [];
+    for (const m of index.modules) {
+        for (const a of m.root.descendantsOfType([...m.spec.assignTypes, ...(PAIR_TYPES[m.lang] ?? []), "const_spec"])) {
+            const left = a.childForFieldName("left") ?? a.childForFieldName("name") ?? a.childForFieldName("key") ?? a.namedChildren[0];
+            const right = a.childForFieldName("right") ?? a.childForFieldName("value") ?? a.namedChildren.at(-1);
+            if (!left || !right || left.id === right.id)
+                continue;
+            const name = left.text.replace(/^[@$:"']+|["':]+$/g, "").split(/[.\s]/).pop() ?? "";
+            const literal = right.type === "equals_value_clause" || right.type === "expression_list" || right.type === "literal_element" ? right.namedChildren[0] : right;
+            if (SECRET_ASSIGN.test(name) && looksSecret(m.stringValue(literal ?? undefined)))
+                out.push(finding(m, a, "ts-hardcoded-secret", "medium", SECRET_WHY));
+        }
+    }
+    return out;
+});
+// --- #19 Weak algorithms ---------------------------------------------------------------------
+const WEAK_HASH_ARG = /^(md5|sha-?1|md2|md4)$/i;
+const WEAK_CIPHER_ARG = /^(des|desede|3des|rc2|rc4|arcfour|blowfish)(\/|-|$)/i;
+const WEAK_HASH_WHY = "MD5/SHA-1 are broken for security purposes (collisions, fast brute force).";
+const WEAK_HASH_CALL = {
+    csharp: /(^|\.)(MD5|SHA1)\.Create$|^new (MD5CryptoServiceProvider|SHA1CryptoServiceProvider|SHA1Managed)$/,
+    ruby: /^(Digest|OpenSSL::Digest)::(MD5|SHA1)(\.(hexdigest|digest|base64digest|new|file))?$/,
+    go: /^(md5|sha1)\.(New|Sum)$/,
+};
+const WEAK_CIPHER_CALL = {
+    csharp: /(^|\.)(DES|TripleDES|RC2)\.Create$|^new (DES|TripleDES|RC2)CryptoServiceProvider$/,
+    go: /^(des\.NewCipher|des\.NewTripleDESCipher|rc4\.NewCipher)$/,
+};
+export const tsWeakCrypto = tsCheck("ts-weak-crypto", "use of weak hashes or ciphers", (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        const lang = s.module.lang;
+        const arg = s.module.stringValue(s.args[0]) ?? "";
+        const security = SECURITY_CONTEXT.test(lineOfSite(s));
+        const weakHash = () => out.push(finding(s.module, s.node, "ts-weak-hash", security ? "high" : "low", security ? WEAK_HASH_WHY : "MD5/SHA-1 in use; acceptable only for non-security checksums. Confirm how it is used."));
+        const weakCipher = () => out.push(finding(s.module, s.node, "ts-weak-cipher", "high", "DES/3DES/RC2/RC4/Blowfish-class ciphers are deprecated and breakable."));
+        if (lang === "java" && /(^|\.)MessageDigest\.getInstance$/.test(s.callee) && WEAK_HASH_ARG.test(arg))
+            weakHash();
+        else if (lang === "java" && /(^|\.)(Cipher|KeyGenerator|SecretKeyFactory)\.getInstance$/.test(s.callee) && WEAK_CIPHER_ARG.test(arg))
+            weakCipher();
+        else if (lang === "ruby" && /^OpenSSL::Cipher(::Cipher)?\.new$/.test(s.callee) && WEAK_CIPHER_ARG.test(arg))
+            weakCipher();
+        else if (WEAK_HASH_CALL[lang]?.test(s.callee))
+            weakHash();
+        else if (WEAK_CIPHER_CALL[lang]?.test(s.callee))
+            weakCipher();
+    }
+    return out;
+});
+// --- #20 Misuse of primitives --------------------------------------------------------------------
+const TLS_WHY = "Disabling certificate verification allows man-in-the-middle attacks.";
+const INSECURE_RANDOM = {
+    java: /^new Random$|^Math\.random$/,
+    csharp: /^new Random$/,
+    ruby: /^(rand|Random\.rand|Kernel\.rand)$/,
+    go: /^rand\.(Intn|Int|Int31|Int63|Float64|Read|Perm)$/,
+};
+export const tsCryptoMisuse = tsCheck("ts-crypto-misuse", "cryptographic misuse (ECB, insecure randomness, disabled TLS verification)", (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        const lang = s.module.lang;
+        const arg = s.module.stringValue(s.args[0]) ?? "";
+        if (lang === "java" && /(^|\.)Cipher\.getInstance$/.test(s.callee) && (/\/ECB\//i.test(arg) || /^AES$/i.test(arg))) {
+            out.push(finding(s.module, s.node, "ts-ecb-mode", "high", "ECB mode (the default for a bare \"AES\") leaks plaintext patterns; use AES/GCM/NoPadding."));
+        }
+        else if (INSECURE_RANDOM[lang]?.test(s.callee) && SECURITY_CONTEXT.test(lineOfSite(s))) {
+            // Go: crypto/rand shares the package name; only math/rand is predictable.
+            if (lang === "go" && !/"math\/rand"/.test(s.module.source))
+                continue;
+            out.push(finding(s.module, s.node, "ts-insecure-random", "medium", "This random generator is predictable; use a cryptographically secure one for tokens, passwords and keys."));
+        }
+    }
+    out.push(...markers(index, "csharp", ["member_access_expression"], /^CipherMode\.ECB$/, "ts-ecb-mode", "high", "ECB mode leaks plaintext patterns; use an authenticated mode such as GCM."), ...markers(index, "csharp", ["assignment_expression"], /ServerCertificate(Custom)?ValidationCallback\s*[+]?=/, "ts-tls-verify-off", "medium", "A custom certificate validation callback often accepts every certificate; confirm it validates properly."), ...markers(index, "ruby", ["scope_resolution"], /VERIFY_NONE$/, "ts-tls-verify-off", "high", TLS_WHY), ...markers(index, "go", ["keyed_element"], /^InsecureSkipVerify:\s*true$/, "ts-tls-verify-off", "high", TLS_WHY));
+    return out;
+});
+// --- #41 SQL injection ------------------------------------------------------------------------------
+const SQL = {
+    java: /\.(executeQuery|executeUpdate|execute|addBatch|prepareStatement|prepareCall|createQuery|createNativeQuery|queryForObject|queryForList|queryForMap|query|update)$/,
+    csharp: /^new \w*(Sql|MySql|Npgsql|Oracle|SQLite|Sqlite|OleDb|Odbc)Command$|\.(ExecuteSqlRaw|ExecuteSqlRawAsync|FromSqlRaw|SqlQuery|ExecuteSqlCommand)$/,
+    ruby: /\.(where|find_by_sql|execute|exec_query|select_all|select_value|order|having|joins|group|pluck|count_by_sql)$/,
+    go: /\.(Query|QueryRow|Exec|QueryContext|QueryRowContext|ExecContext|Raw|Prepare|Select|Get)$/,
+};
+const SQL_WHY = "SQL built from strings can be manipulated by user input; use parameterised queries / bound placeholders.";
+export const tsSqlInjection = tsCheck("ts-sql-injection", "SQL built by string concatenation or interpolation", (index) => {
+    // Method names like "query", "where" or "Exec" are generic, so only built strings count.
+    // Only the query text is judged: later arguments are bound values (the safe form). In Go's *Context variants the query is second.
+    const out = sinks(index, SQL, "ts-sql-string-building", SQL_WHY, { dynamicOnly: true }, (s) => [/Context$/.test(s.callee) ? s.args[1] : s.args[0]]);
+    // C#: command.CommandText = "..." + x
+    for (const m of index.byLang("csharp")) {
+        for (const a of m.root.descendantsOfType(["assignment_expression"])) {
+            const left = a.childForFieldName("left");
+            const right = a.childForFieldName("right");
+            if (!left || !right || !/\.CommandText$/.test(left.text))
+                continue;
+            const site = { module: m, node: a, callee: "CommandText", args: [right], fn: m.enclosingFunction(a) };
+            const r = risk(site, right, { dynamicOnly: true });
+            if (r)
+                out.push(finding(m, a, "ts-sql-string-building", r, SQL_WHY));
+        }
+    }
+    return out;
+});
+// --- #44 OS command injection --------------------------------------------------------------------------
+const COMMAND = {
+    java: /(^|\.)getRuntime\(\)\.exec$|^new ProcessBuilder$/,
+    csharp: /(^|\.)Process\.Start$|^new ProcessStartInfo$/,
+    ruby: /^(system|exec|spawn|IO\.popen|Kernel\.system|Kernel\.exec|Open3\.(capture2|capture2e|capture3|popen2|popen3))$/,
+    go: /^exec\.(Command|CommandContext)$/,
+};
+const COMMAND_WHY = "Running a command built from variables allows command injection; pass a fixed program and separate arguments, without a shell.";
+export const tsCommandInjection = tsCheck("ts-command-injection", "OS command execution with variable input", (index) => {
+    const out = sinks(index, COMMAND, "ts-shell-command", COMMAND_WHY, {}, (s) => {
+        // Go: exec.Command with fixed program and non-shell arguments is the safe form; only request data or "sh -c" count.
+        if (s.module.lang === "go") {
+            const literals = s.args.map((a) => s.module.stringValue(a));
+            const shell = literals.some((l) => l === "-c") && literals.some((l) => /^(sh|bash|cmd|\/bin\/sh|\/bin\/bash)$/.test(l ?? ""));
+            return shell ? s.args : s.args.filter((a) => s.module.isRequestDerived(a, s.module.scope(s.fn)));
+        }
+        return s.args;
+    });
+    // Ruby backticks with interpolation.
+    for (const m of index.byLang("ruby")) {
+        for (const n of m.root.descendantsOfType(["subshell"])) {
+            if (n.descendantsOfType(["interpolation"]).length === 0)
+                continue;
+            const derived = m.isRequestDerived(n, m.scope(m.enclosingFunction(n)));
+            out.push(finding(m, n, "ts-shell-command", derived ? "high" : "medium", COMMAND_WHY));
+        }
+    }
+    return out;
+});
+// --- #54 Dynamic code / unsafe deserialisation ------------------------------------------------------------
+const CODE_EVAL = {
+    java: /\.eval$/,
+    ruby: /^(eval|instance_eval|class_eval|module_eval)$|\.(instance_eval|class_eval)$/,
+};
+const DESERIALIZE = {
+    java: /\.readObject$|^new XMLDecoder$/,
+    csharp: /(BinaryFormatter|LosFormatter|NetDataContractSerializer|ObjectStateFormatter)\w*\.Deserialize$|JavaScriptSerializer\w*\.DeserializeObject$/,
+    ruby: /^(Marshal\.load|YAML\.load|YAML\.unsafe_load|Psych\.load)$/,
+};
+const REFLECTION = { ruby: /\.(constantize|send|public_send)$|^(send|public_send)$/, java: /^Class\.forName$/, csharp: /^Type\.GetType$/ };
+export const tsCodeInjection = tsCheck("ts-code-injection", "evaluation of variable input, unsafe deserialisation or request-driven reflection", (index) => [
+    ...sinks(index, CODE_EVAL, "ts-eval", "Evaluating non-constant input runs arbitrary code.", {}, firstArg),
+    ...index.calls()
+        .filter((s) => DESERIALIZE[s.module.lang]?.test(s.callee) && (s.module.lang !== "java" || /ObjectInputStream|XMLDecoder/.test(s.module.source)))
+        .map((s) => finding(s.module, s.node, "ts-unsafe-deserialization", s.args.some((a) => s.module.isRequestDerived(a, s.module.scope(s.fn))) ? "high" : "medium", "Deserialising untrusted data with this API can instantiate arbitrary objects and run code; use a data-only format such as JSON.")),
+    ...sinks(index, REFLECTION, "ts-request-reflection", "Choosing classes or methods from request data lets attackers call unintended code.", { requestOnly: true }, (s) => {
+        const receiver = s.node.childForFieldName("receiver");
+        return [...s.args, ...(receiver ? [receiver] : [])];
+    }),
+]);
+// --- #42 Path traversal --------------------------------------------------------------------------------------
+const PATHS = {
+    java: /^new (File|FileInputStream|FileOutputStream|FileReader|FileWriter|RandomAccessFile)$|^(Paths\.get|Path\.of|Files\.(readAllBytes|readString|readAllLines|newInputStream|newOutputStream|write|delete|lines|copy))$/,
+    csharp: /(^|\.)File\.(ReadAllText|ReadAllBytes|ReadAllLines|OpenRead|OpenWrite|WriteAllText|WriteAllBytes|Delete|Open|Copy)$|(^|\.)Path\.Combine$|^new (FileStream|StreamReader|StreamWriter)$|^(PhysicalFile|File)$/,
+    ruby: /^(File\.(open|read|new|delete|readlines|write|binread)|IO\.(read|readlines)|send_file|send_data|Pathname\.new)$/,
+    go: /^(os\.(Open|OpenFile|ReadFile|WriteFile|Remove|Create)|ioutil\.(ReadFile|WriteFile)|filepath\.Join|path\.Join|http\.ServeFile)$/,
+};
+export const tsPathTraversal = tsCheck("ts-path-traversal", "file paths built from request data", (index) => sinks(index, PATHS, "ts-path-from-request", "File paths built from request data allow ../ traversal; normalise and confine paths to an allowed directory.", { requestOnly: true }));
+// --- #43 Cross-site scripting ---------------------------------------------------------------------------------
+const RESPONSE_WRITE = {
+    java: /getWriter\(\)\.(print|println|write|printf|append)$|^out\.(print|println|write)$/,
+    csharp: /(^|\.)Response\.Write(Async)?$/,
+    go: /^(fmt\.(Fprintf|Fprint|Fprintln)|io\.WriteString)$/,
+};
+const RAW_HTML = { csharp: /(^|\.)Html\.Raw$|^new (HtmlString|MvcHtmlString)$/, ruby: /^raw$/, go: /^template\.(HTML|JS|URL)$/ };
+export const tsXss = tsCheck("ts-xss", "unescaped output of request data", (index) => {
+    const out = [
+        ...sinks(index, RESPONSE_WRITE, "ts-response-write", "Writing request data into a response without escaping enables reflected XSS.", { requestOnly: true }),
+        ...sinks(index, RAW_HTML, "ts-raw-html", "This marks a value as safe HTML and bypasses escaping; safe only if it can never contain user input.", {}, firstArg),
+    ];
+    // Ruby: "...".html_safe on a non-literal receiver.
+    for (const s of index.calls().filter((c) => c.module.lang === "ruby" && /\.html_safe$/.test(c.callee))) {
+        const receiver = s.node.childForFieldName("receiver");
+        if (!receiver || s.module.isLiteral(receiver))
+            continue;
+        const derived = s.module.isRequestDerived(receiver, s.module.scope(s.fn));
+        out.push(finding(s.module, s.node, "ts-raw-html", derived ? "high" : "low", "html_safe bypasses escaping; safe only if the value can never contain user input."));
+    }
+    return out;
+});
+// --- #60 / #97 Open redirect ---------------------------------------------------------------------------------------
+const REDIRECT = {
+    java: /\.sendRedirect$|^new (RedirectView|ModelAndView)$/,
+    csharp: /^(this\.)?(Redirect|RedirectPermanent)$|(^|\.)Response\.Redirect$/,
+    ruby: /^redirect_to$/,
+    go: /^http\.Redirect$|\.Redirect$/,
+};
+export const tsOpenRedirect = tsCheck("ts-open-redirect", "redirects to request-controlled URLs", (index) => {
+    const why = "Redirecting to a URL taken from the request lets attackers send users to malicious sites; allow only relative paths or known hosts.";
+    const out = sinks(index, REDIRECT, "ts-open-redirect", why, { requestOnly: true });
+    // Spring MVC: return "redirect:" + target
+    for (const m of index.byLang("java")) {
+        for (const b of m.root.descendantsOfType(["binary_expression"])) {
+            if (!/^"redirect:/.test(b.text) || !m.isRequestDerived(b, m.scope(m.enclosingFunction(b))))
+                continue;
+            out.push(finding(m, b, "ts-open-redirect", "medium", why));
+        }
+    }
+    return out;
+});
+// --- #77 Secrets in logs ---------------------------------------------------------------------------------------------
+const LOG_CALL = /(^|\.)(log|logger|LOG|LOGGER|Logger|_logger|_log|Log|slog|logging|Rails\.logger)\.(debug|info|warn|warning|error|fatal|trace|Debug|Info|Warn|Error|Fatal|Printf|Println|Print|Infof|Errorf|Debugf|Warnf|LogInformation|LogWarning|LogError|LogDebug|LogCritical|Information|Warning)$|^(puts|p|System\.out\.println|System\.err\.println|Console\.WriteLine|fmt\.Println|fmt\.Printf)$/;
+export const tsSecretsInLogs = tsCheck("ts-secrets-in-logs", "logging of passwords or tokens", (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        if (!LOG_CALL.test(s.callee))
+            continue;
+        const secret = s.args.filter((a) => !s.module.isLiteral(a)).flatMap((a) => s.module.identifiers(a)).find((i) => SECRET_IDENT.test(i.replace(/^@/, "")));
+        if (secret)
+            out.push(finding(s.module, s.node, "ts-secret-logged", "medium", `Logs a value named "${secret}", which may be a credential or token.`));
+    }
+    return out;
+});
+// --- #86 XML external entities ------------------------------------------------------------------------------------------
+const JAVA_XML_FACTORY = /(^|\.)(DocumentBuilderFactory|SAXParserFactory|XMLInputFactory|TransformerFactory|SchemaFactory)\.newInstance$|^new (SAXBuilder|SAXReader)$/;
+const JAVA_XML_HARDENED = /disallow-doctype-decl|FEATURE_SECURE_PROCESSING|setExpandEntityReferences\(\s*false|SUPPORT_DTD|ACCESS_EXTERNAL_DTD|IS_SUPPORTING_EXTERNAL_ENTITIES/;
+export const tsXxe = tsCheck("ts-xml-xxe", "XML parser configuration that allows external entities", (index) => [
+    ...index.calls()
+        .filter((s) => s.module.lang === "java" && JAVA_XML_FACTORY.test(s.callee) && !JAVA_XML_HARDENED.test(s.module.source))
+        .map((s) => finding(s.module, s.node, "java-xml-factory-not-hardened", "medium", "This XML parser is created without disabling DTDs or external entities in the same file (XXE). Set disallow-doctype-decl or the secure-processing feature.")),
+    ...markers(index, "csharp", ["member_access_expression"], /^DtdProcessing\.Parse$/, "dotnet-dtd-processing", "high", "DtdProcessing.Parse enables DTDs and external entities (XXE)."),
+    ...markers(index, "csharp", ["object_creation_expression"], /^new XmlUrlResolver\b/, "dotnet-xml-url-resolver", "high", "XmlUrlResolver lets documents load external resources (XXE, SSRF)."),
+    ...markers(index, "ruby", ["scope_resolution", "identifier", "call"], /(^|::|\.)(NOENT|DTDLOAD|noent|dtdload)$/, "nokogiri-noent", "high", "NOENT / DTDLOAD make Nokogiri substitute external entities or load DTDs (XXE)."),
+]);
+// --- #61 CSRF ------------------------------------------------------------------------------------------------------------
+/** Framework CSRF protection: explicit opt-outs are findings; evidence of protection passes; otherwise manual. */
+export const tsCsrf = codeCheck("ts-csrf", LANGS, async (ctx) => {
+    const index = await ctx.treeSitter();
+    const out = [
+        ...index.calls()
+            .filter((s) => s.module.lang === "java" && (/csrf\(\)\.disable$/.test(s.callee) || (/\.csrf$/.test(s.callee) && /disable/.test(s.node.text))))
+            .map((s) => finding(s.module, s.node, "spring-csrf-disabled", "medium", "CSRF protection is disabled in Spring Security; safe only for token-authenticated, stateless APIs.")),
+        ...markers(index, "csharp", ["attribute"], /^IgnoreAntiforgeryToken/, "aspnet-ignore-antiforgery", "low", "This action or controller opts out of anti-forgery validation; confirm it is safe."),
+        ...index.calls()
+            .filter((s) => s.module.lang === "ruby" && (/^skip_forgery_protection$/.test(s.callee) || (/^skip_before_action$/.test(s.callee) && /verify_authenticity_token/.test(s.node.text))))
+            .map((s) => finding(s.module, s.node, "rails-csrf-skipped", "low", "CSRF verification is skipped for this controller; confirm it is safe (e.g. token-authenticated API).")),
+    ];
+    if (out.length)
+        return outcomeFromFindings(out, "");
+    const protectedBy = [
+        index.mentions("java", /EnableWebSecurity|SecurityFilterChain|WebSecurityConfigurerAdapter/) ? "Spring Security (CSRF on by default)" : "",
+        index.mentions("csharp", /AutoValidateAntiforgeryToken|ValidateAntiForgeryToken|AddAntiforgery/) ? "ASP.NET anti-forgery validation" : "",
+        index.mentions("ruby", /protect_from_forgery|ActionController::Base/) ? "Rails forgery protection" : "",
+        index.mentions("go", /gorilla\/csrf|justinas\/nosurf|csrf\.Protect/) ? "a Go CSRF middleware" : "",
+    ].filter(Boolean);
+    if (protectedBy.length)
+        return { status: "pass", detail: `CSRF protection is in place: ${protectedBy.join("; ")}. No opt-outs found.` };
+    return { status: "manual", detail: "No CSRF protection or opt-out was found in the code. If the application uses cookie sessions, confirm state-changing requests are protected." };
+});
+//# sourceMappingURL=treesitter.js.map