mobbdev 1.0.199 → 1.0.201

package/dist/args/commands/upload_ai_blame.mjs

@@ -1647,6 +1647,19 @@ var getIssueTypeFriendlyString = (issueType) => {
   }
   return issueTypeMap[issueTypeZParseRes.data];
 };
+var statusMap = {
+  ["Digested" /* Digested */]: "Digested",
+  ["Error" /* Error */]: "Error",
+  ["FalsePositive" /* FalsePositive */]: "False Positive",
+  ["Filtered" /* Filtered */]: "Filtered",
+  ["FilteredAiQuota" /* FilteredAiQuota */]: "Filtered AI Quota",
+  ["Fixed" /* Fixed */]: "Fixable",
+  ["NoFix" /* NoFix */]: "No Fix",
+  ["Pending" /* Pending */]: "Pending",
+  ["Unfixable" /* Unfixable */]: "Unfixable",
+  ["Unsupported" /* Unsupported */]: "Unsupported"
+};
+var statusZ = z5.nativeEnum(Vulnerability_Report_Issue_State_Enum);
 var issueDescription = {
   ["AUTOGENERATED_CODE" /* AutogeneratedCode */]: "The flagged code is generated automatically by tools or frameworks as part of the build or runtime process. This categorization highlights that **the issue resides in non-manual code**, which often requires tool-specific solutions or exemptions.",
   ["AUXILIARY_CODE" /* AuxiliaryCode */]: "The flagged code is auxiliary or supporting code, such as configuration files, build scripts, or other non-application logic. This categorization indicates that the issue is not directly related to the application's core functionality.",
@@ -3824,6 +3837,11 @@ var xss3 = {
     content: ({ expression }) => `Is the expression \`${expression}\` supposed to be not sanitized in this context?`,
     description: () => "You are using unsafe string substitution in the template. This means that if the expression can contain maliciously crafted data, it may lead to XSS injection. To apply the fix, you have to make sure the expression is not sanitized on the backend already, and it does not represent an HTML code block.",
     guidance: () => ""
+  },
+  isServerSideCode: {
+    content: () => "Is this code running on the server side (a NodeJS application)",
+    description: () => "The fix to this vulnerability is different is the code runs in the client (browser) or the server side (NodeJs)",
+    guidance: () => ""
   }
 };
 

package/dist/hash_search/index.d.mts

@@ -0,0 +1,10 @@
+import { Buffer } from 'node:buffer';
+
+declare class HashSearchError extends Error {
+    constructor(message: string);
+}
+
+declare function createIndex(originalText: string, windowSize?: number): Promise<Buffer>;
+declare function searchIndex(searchText: string, index: Buffer): Promise<number[]>;
+
+export { HashSearchError, createIndex, searchIndex };

package/dist/hash_search/index.mjs

@@ -0,0 +1,112 @@
+// src/hash_search/index.ts
+import { Buffer } from "buffer";
+import { randomBytes } from "crypto";
+import { blake3 } from "hash-wasm";
+
+// src/hash_search/errors.ts
+var HashSearchError = class _HashSearchError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HashSearchError";
+    Object.setPrototypeOf(this, _HashSearchError.prototype);
+  }
+};
+
+// src/hash_search/index.ts
+var MIN_WINDOW_SIZE = 8;
+var DEFAULT_WINDOW_SIZE = 30;
+async function createIndex(originalText, windowSize = DEFAULT_WINDOW_SIZE) {
+  if (!originalText || typeof originalText !== "string") {
+    throw new HashSearchError("Original text must be a non-empty string");
+  }
+  if (windowSize < MIN_WINDOW_SIZE) {
+    throw new HashSearchError(`Window size must be at least ${MIN_WINDOW_SIZE}`);
+  }
+  if (originalText.length < windowSize) {
+    throw new HashSearchError(
+      `Text length must be at least ${windowSize} characters (window size)`
+    );
+  }
+  const originalLength = originalText.length;
+  const paddingNeeded = (windowSize - originalLength % windowSize) % windowSize;
+  const paddedText = originalText + "\0".repeat(paddingNeeded);
+  const numChunks = paddedText.length - windowSize + 1;
+  const bufferSize = 12 + numChunks * 24;
+  const buffer = Buffer.alloc(bufferSize);
+  buffer.writeUInt8(114, 0);
+  buffer.writeUInt8(131, 1);
+  buffer.writeUInt8(0, 2);
+  buffer.writeUInt8(1, 3);
+  buffer.writeUInt32BE(originalLength, 4);
+  buffer.writeUInt32BE(windowSize, 8);
+  for (let i = 0; i < numChunks; i++) {
+    const chunk = paddedText.slice(i, i + windowSize);
+    const salt = randomBytes(8);
+    const dataToHash = Buffer.concat([salt, Buffer.from(chunk, "utf-8")]);
+    const hashHex = await blake3(dataToHash, 128);
+    const hash = Buffer.from(hashHex, "hex");
+    const offset = 12 + i * 24;
+    salt.copy(buffer, offset);
+    hash.copy(buffer, offset + 8);
+  }
+  return buffer;
+}
+async function searchIndex(searchText, index) {
+  if (!searchText || typeof searchText !== "string") {
+    throw new HashSearchError("Search text must be a non-empty string");
+  }
+  if (!Buffer.isBuffer(index)) {
+    throw new HashSearchError("Index must be a Buffer");
+  }
+  if (index.length < 12) {
+    throw new HashSearchError("Invalid index buffer: too small");
+  }
+  if ((index.length - 12) % 24 !== 0) {
+    throw new HashSearchError("Invalid index buffer: incorrect structure");
+  }
+  if (index.readUInt8(0) !== 114 || index.readUInt8(1) !== 131 || index.readUInt8(2) !== 0 || index.readUInt8(3) !== 1) {
+    throw new HashSearchError("Invalid magic number in index buffer");
+  }
+  const windowSize = index.readUInt32BE(8);
+  if (searchText.length < windowSize) {
+    throw new HashSearchError(
+      `Search text must be at least ${windowSize} characters (window size)`
+    );
+  }
+  const originalTextLength = index.readUInt32BE(4);
+  const searchLength = searchText.length;
+  const paddingNeeded = (windowSize - searchLength % windowSize) % windowSize;
+  const paddedSearch = searchText + "\0".repeat(paddingNeeded);
+  const numPositions = (index.length - 12) / 24;
+  const searchChunks = searchLength - windowSize + 1;
+  const results = [];
+  for (let startPos = 0; startPos <= numPositions - searchChunks; startPos++) {
+    let match = true;
+    for (let j = 0; j < searchChunks; j++) {
+      const searchChunk = paddedSearch.slice(j, j + windowSize);
+      const saltOffset = 12 + (startPos + j) * 24;
+      const salt = index.subarray(saltOffset, saltOffset + 8);
+      const dataToHash = Buffer.concat([
+        salt,
+        Buffer.from(searchChunk, "utf-8")
+      ]);
+      const expectedHashHex = await blake3(dataToHash, 128);
+      const expectedHash = Buffer.from(expectedHashHex, "hex");
+      const hashOffset = saltOffset + 8;
+      const actualHash = index.subarray(hashOffset, hashOffset + 16);
+      if (!expectedHash.equals(actualHash)) {
+        match = false;
+        break;
+      }
+    }
+    if (match && startPos + searchLength <= originalTextLength) {
+      results.push(startPos);
+    }
+  }
+  return results;
+}
+export {
+  HashSearchError,
+  createIndex,
+  searchIndex
+};

package/dist/index.mjs

@@ -3075,6 +3075,19 @@ var getIssueTypeFriendlyString = (issueType) => {
   }
   return issueTypeMap[issueTypeZParseRes.data];
 };
+var statusMap = {
+  ["Digested" /* Digested */]: "Digested",
+  ["Error" /* Error */]: "Error",
+  ["FalsePositive" /* FalsePositive */]: "False Positive",
+  ["Filtered" /* Filtered */]: "Filtered",
+  ["FilteredAiQuota" /* FilteredAiQuota */]: "Filtered AI Quota",
+  ["Fixed" /* Fixed */]: "Fixable",
+  ["NoFix" /* NoFix */]: "No Fix",
+  ["Pending" /* Pending */]: "Pending",
+  ["Unfixable" /* Unfixable */]: "Unfixable",
+  ["Unsupported" /* Unsupported */]: "Unsupported"
+};
+var statusZ = z.nativeEnum(Vulnerability_Report_Issue_State_Enum);
 function getTagTooltip(tag) {
   switch (tag) {
     case "FALSE_POSITIVE":
@@ -4551,6 +4564,11 @@ var xss3 = {
     content: ({ expression }) => `Is the expression \`${expression}\` supposed to be not sanitized in this context?`,
     description: () => "You are using unsafe string substitution in the template. This means that if the expression can contain maliciously crafted data, it may lead to XSS injection. To apply the fix, you have to make sure the expression is not sanitized on the backend already, and it does not represent an HTML code block.",
     guidance: () => ""
+  },
+  isServerSideCode: {
+    content: () => "Is this code running on the server side (a NodeJS application)",
+    description: () => "The fix to this vulnerability is different is the code runs in the client (browser) or the server side (NodeJs)",
+    guidance: () => ""
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "1.0.199",
+  "version": "1.0.201",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.mjs",
@@ -71,6 +71,7 @@
     "graphql": "16.11.0",
     "graphql-request": "6.1.0",
     "graphql-ws": "5.16.2",
+    "hash-wasm": "4.12.0",
     "http-proxy-agent": "7.0.2",
     "https-proxy-agent": "7.0.6",
     "ignore": "7.0.5",