kodingo-cli 1.1.1 → 1.1.3

package/dist/commands/security-scan.js

@@ -115,7 +115,22 @@ async function securityScanCommand(options = {}) {
                 }
                 catch { }
             }
-            const candidates = (0, security_code_analyzer_1.analyzeForSecurityCandidates)(repoRoot, graph, symbols);
+            // Fetch dynamically generated rules from OSV-driven rule generation
+            let dynamicRules = [];
+            try {
+                const rulesRes = await fetch(`${apiUrl}/security/rules`, {
+                    headers: { "X-Kodingo-Token": token },
+                });
+                if (rulesRes.ok) {
+                    const rulesData = await rulesRes.json();
+                    dynamicRules = rulesData.rules ?? [];
+                    if (!options.silent && dynamicRules.length > 0) {
+                        console.log(`  Loaded ${dynamicRules.length} dynamically generated detection rule${dynamicRules.length === 1 ? "" : "s"} from OSV intelligence\n`);
+                    }
+                }
+            }
+            catch { }
+            const candidates = (0, security_code_analyzer_1.analyzeForSecurityCandidates)(repoRoot, graph, symbols, dynamicRules);
             if (candidates.length === 0) {
                 if (!options.silent)
                     console.log("  ✔ No suspicious patterns detected.");

package/dist/commands/sync-graph.js

@@ -70,6 +70,7 @@ async function syncGraphCommand(options = {}) {
                         fanOut: n.fanOut,
                         centrality: n.centrality,
                         rawCalls: n.rawCalls,
+                        rawRoutes: n.rawRoutes,
                     })),
                     removed: i === 0 ? diff.removed : [],
                     edgesAdded: edgeChunk.map(e => ({

package/dist/utils/ast-parser.js

@@ -142,6 +142,45 @@ function extractCallNames(node, acc = new Set()) {
     walk(node);
     return Array.from(acc);
 }
+const ROUTE_HTTP_METHODS = new Set(["get", "post", "put", "patch", "delete", "all"]);
+function extractRoutes(node) {
+    const routes = [];
+    function walk(n) {
+        if (!n || typeof n !== "object")
+            return;
+        if (n.type === "CallExpression") {
+            const callee = n.callee;
+            if (callee?.type === "MemberExpression" &&
+                ROUTE_HTTP_METHODS.has(callee.property?.name?.toLowerCase())) {
+                const firstArg = n.arguments?.[0];
+                if (firstArg?.type === "Literal" && typeof firstArg.value === "string" &&
+                    firstArg.value.startsWith("/")) {
+                    routes.push({ method: callee.property.name.toUpperCase(), path: firstArg.value });
+                }
+                if (firstArg?.type === "TemplateLiteral") {
+                    const raw = firstArg.quasis?.map((q) => q.value?.raw ?? "").join("*") ?? "";
+                    if (raw.startsWith("/")) {
+                        routes.push({ method: callee.property.name.toUpperCase(), path: raw });
+                    }
+                }
+            }
+        }
+        for (const key of Object.keys(n)) {
+            if (key === "parent")
+                continue;
+            const child = n[key];
+            if (Array.isArray(child)) {
+                for (const c of child)
+                    walk(c);
+            }
+            else if (child && typeof child === "object" && child.type) {
+                walk(child);
+            }
+        }
+    }
+    walk(node);
+    return routes;
+}
 async function parseTypeScript(filePath, source) {
     try {
         const parse = tsParse;
@@ -173,6 +212,7 @@ async function parseTypeScript(filePath, source) {
                     body,
                     fingerprint: computeFingerprint(body),
                     calls: extractCallNames(node.body),
+                    routes: extractRoutes(node.body),
                     imports: fileImports,
                 });
             }
@@ -190,6 +230,7 @@ async function parseTypeScript(filePath, source) {
                     body,
                     fingerprint: computeFingerprint(body),
                     calls: extractCallNames(node.init.body),
+                    routes: extractRoutes(node.init.body),
                     imports: fileImports,
                 });
             }
@@ -207,6 +248,7 @@ async function parseTypeScript(filePath, source) {
                         body,
                         fingerprint: computeFingerprint(body),
                         calls: extractCallNames(node.body),
+                        routes: extractRoutes(node.body),
                         imports: fileImports,
                     });
                     // Visit methods inside the class
@@ -225,6 +267,7 @@ async function parseTypeScript(filePath, source) {
                                     body: mBody,
                                     fingerprint: computeFingerprint(mBody),
                                     calls: extractCallNames(member.value?.body),
+                                    routes: extractRoutes(member.value?.body),
                                     imports: fileImports,
                                 });
                             }
@@ -299,6 +342,7 @@ function parseStructural(filePath, source, patterns) {
                 body,
                 fingerprint: computeFingerprint(body),
                 calls: extractCallNamesRegex(body),
+                routes: [],
                 imports: [],
             });
             break;
@@ -344,6 +388,7 @@ function parsePython(filePath, source) {
             body,
             fingerprint: computeFingerprint(body),
             calls: extractCallNamesRegex(body),
+            routes: [],
             imports: [],
         });
     }

package/dist/utils/code-pattern-scanner.js

@@ -93,6 +93,109 @@ const RULES = [
         regex: /\b(fetch|axios\.get|axios\.post|request)\s*\(\s*[^)]*\+\s*\w+/,
         description: "Outbound HTTP request built via concatenation with a variable — potential SSRF if that variable is user-controlled.",
     },
+    // ── Insecure deserialization ───────────────────────────────────────────────
+    {
+        type: "insecure_deserialization",
+        severity: "critical",
+        regex: /\b(unserialize|pickle\.loads|deserialize)\s*\(/,
+        description: "Unvalidated data passed to a deserialization function — can enable remote code execution if input is attacker-controlled.",
+    },
+    {
+        type: "insecure_deserialization",
+        severity: "critical",
+        regex: /yaml\.load\s*\([^,)]+\)(?!.*Loader)/,
+        description: "yaml.load() without a safe Loader — enables arbitrary code execution via crafted YAML input.",
+        languages: ["python"],
+    },
+    // ── XXE injection ──────────────────────────────────────────────────────────
+    {
+        type: "xxe_injection",
+        severity: "high",
+        regex: /resolve_entities\s*=\s*True|load_dtd\s*=\s*True/,
+        description: "XML parser configured with external entity resolution or DTD loading enabled — XXE injection vulnerability.",
+        languages: ["python"],
+    },
+    {
+        type: "xxe_injection",
+        severity: "high",
+        regex: /libxml_disable_entity_loader\s*\(\s*false\s*\)/,
+        description: "PHP XML external entity loading explicitly enabled — XXE injection vulnerability.",
+        languages: ["php"],
+    },
+    // ── Open redirect ─────────────────────────────────────────────────────────
+    {
+        type: "open_redirect",
+        severity: "high",
+        regex: /\bres\.redirect\s*\([^)]*(?:req\.|params\.|query\.)/,
+        description: "Redirect target built from user-supplied request data — potential open redirect enabling phishing attacks.",
+    },
+    {
+        type: "open_redirect",
+        severity: "high",
+        regex: /header\s*\(\s*['"]Location.*(?:\$_GET|\$_POST|\$_REQUEST)/,
+        description: "Location header set from user-supplied input — open redirect vulnerability.",
+        languages: ["php"],
+    },
+    // ── Mass assignment ───────────────────────────────────────────────────────
+    {
+        type: "mass_assignment",
+        severity: "high",
+        regex: /Object\.assign\s*\([^,)]+,\s*req\.body/,
+        description: "User-supplied request body merged directly into an object via Object.assign — potential mass assignment.",
+    },
+    {
+        type: "mass_assignment",
+        severity: "high",
+        regex: /\$request->all\(\)|\$request->input\(\)/,
+        description: "All user input bound directly to model without allowlist — mass assignment vulnerability in Laravel/PHP.",
+        languages: ["php"],
+    },
+    // ── Prototype pollution ───────────────────────────────────────────────────
+    {
+        type: "prototype_pollution",
+        severity: "critical",
+        regex: /\[['"]__proto__['"]\]|__proto__\s*=/,
+        description: "Prototype pollution — modification of __proto__ through user-controlled input can corrupt the global object prototype.",
+    },
+    {
+        type: "prototype_pollution",
+        severity: "critical",
+        regex: /constructor\.prototype\s*=/,
+        description: "Direct modification of constructor.prototype — potential prototype pollution vulnerability.",
+    },
+    // ── CORS misconfiguration ─────────────────────────────────────────────────
+    {
+        type: "cors_misconfiguration",
+        severity: "high",
+        regex: /['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/,
+        description: "Wildcard CORS policy — allows any origin to make cross-origin requests to this endpoint.",
+    },
+    {
+        type: "cors_misconfiguration",
+        severity: "moderate",
+        regex: /origin\s*[:=]\s*req\.headers(?:\.origin|\.get\s*\(\s*['"]origin)/,
+        description: "CORS origin reflected directly from request headers without validation — allows attacker-controlled origins.",
+    },
+    // ── Timing attacks ────────────────────────────────────────────────────────
+    {
+        type: "timing_attack",
+        severity: "moderate",
+        regex: /(?:token|secret|password|apiKey|api_key)\s*===\s*(?:req|request|input|provided)/,
+        description: "Non-constant-time comparison in a security-sensitive context — vulnerable to timing attacks that can leak secret values.",
+    },
+    // ── Insecure session management ───────────────────────────────────────────
+    {
+        type: "insecure_session",
+        severity: "high",
+        regex: /(?:session|sessionId|session_id)\s*[:=][^;\n]*Math\.random/,
+        description: "Session ID generated using Math.random() — not cryptographically secure, session IDs are predictable.",
+    },
+    {
+        type: "insecure_session",
+        severity: "moderate",
+        regex: /res\.cookie\s*\([^)]+\)(?!.*httpOnly)(?!.*secure)/,
+        description: "Cookie set without httpOnly or Secure flags — session cookie may be accessible to JavaScript or transmitted over HTTP.",
+    },
 ];
 /**
  * Scans a single symbol's body against all pattern rules. Returns every match —

package/dist/utils/graph-builder.js

@@ -302,6 +302,7 @@ async function buildGraph(repoRoot) {
             fanOut: 0,
             centrality: 0,
             rawCalls: sym.calls ?? [],
+            rawRoutes: sym.routes ?? [],
         };
     }
     const tsFiles = symbols

package/dist/utils/security-code-analyzer.js

@@ -73,12 +73,39 @@ function findMissingAuthCandidatesLocal(graph, symbolsByFingerprint) {
 /**
  * Runs both Layer 1 detectors and assembles full code context for every
  * flagged candidate — ready to send to the server for Layer 2 LLM judgment.
+ * Dynamic rules from OSV-driven generation are applied alongside static rules.
  */
-function analyzeForSecurityCandidates(repoRoot, graph, symbols) {
+function analyzeForSecurityCandidates(repoRoot, graph, symbols, dynamicRules = []) {
     const symbolsByFingerprint = new Map(symbols.map(s => [s.fingerprint, s]));
     const candidates = [];
-    // ── Code pattern findings ────────────────────────────────────────────────
+    // ── Code pattern findings — static + dynamic rules ────────────────────────
     const patternFindings = (0, code_pattern_scanner_1.scanAllSymbolsForPatterns)(symbols);
+    // Apply dynamic rules generated from OSV vulnerability data
+    for (const sym of symbols) {
+        const language = sym.language ?? "unknown";
+        for (const rule of dynamicRules) {
+            if (rule.languages && !rule.languages.includes(language))
+                continue;
+            try {
+                const regex = new RegExp(rule.regexPattern);
+                const match = sym.body.match(regex);
+                if (match && match.index !== undefined) {
+                    patternFindings.push({
+                        patternType: rule.patternType,
+                        symbol: sym.name,
+                        file: sym.file,
+                        startLine: sym.startLine,
+                        severity: rule.severity,
+                        snippet: sym.body.slice(Math.max(0, match.index - 20), match.index + 100).trim(),
+                        description: rule.description,
+                    });
+                }
+            }
+            catch {
+                continue;
+            }
+        }
+    }
     for (const finding of patternFindings) {
         const sym = symbols.find(s => s.name === finding.symbol && s.file === finding.file);
         const fingerprint = sym?.fingerprint ?? "";

package/dist/utils/tree-sitter-parser.js

@@ -260,6 +260,7 @@ async function parseWithTreeSitter(filePath, source) {
                         body,
                         fingerprint: (0, ast_parser_1.computeFingerprint)(body),
                         calls: extractCallNamesTs(node, config),
+                        routes: [],
                         imports: fileImports,
                     });
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodingo-cli",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Kodingo CLI",
   "license": "MIT",
   "private": false,