mobbdev 1.0.200 → 1.0.201

package/dist/args/commands/upload_ai_blame.mjs

@@ -3837,6 +3837,11 @@ var xss3 = {
     content: ({ expression }) => `Is the expression \`${expression}\` supposed to be not sanitized in this context?`,
     description: () => "You are using unsafe string substitution in the template. This means that if the expression can contain maliciously crafted data, it may lead to XSS injection. To apply the fix, you have to make sure the expression is not sanitized on the backend already, and it does not represent an HTML code block.",
     guidance: () => ""
+  },
+  isServerSideCode: {
+    content: () => "Is this code running on the server side (a NodeJS application)",
+    description: () => "The fix to this vulnerability is different is the code runs in the client (browser) or the server side (NodeJs)",
+    guidance: () => ""
   }
 };
 

package/dist/hash_search/index.d.mts

@@ -0,0 +1,10 @@
+import { Buffer } from 'node:buffer';
+
+declare class HashSearchError extends Error {
+    constructor(message: string);
+}
+
+declare function createIndex(originalText: string, windowSize?: number): Promise<Buffer>;
+declare function searchIndex(searchText: string, index: Buffer): Promise<number[]>;
+
+export { HashSearchError, createIndex, searchIndex };

package/dist/hash_search/index.mjs

@@ -0,0 +1,112 @@
+// src/hash_search/index.ts
+import { Buffer } from "buffer";
+import { randomBytes } from "crypto";
+import { blake3 } from "hash-wasm";
+
+// src/hash_search/errors.ts
+var HashSearchError = class _HashSearchError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HashSearchError";
+    Object.setPrototypeOf(this, _HashSearchError.prototype);
+  }
+};
+
+// src/hash_search/index.ts
+var MIN_WINDOW_SIZE = 8;
+var DEFAULT_WINDOW_SIZE = 30;
+async function createIndex(originalText, windowSize = DEFAULT_WINDOW_SIZE) {
+  if (!originalText || typeof originalText !== "string") {
+    throw new HashSearchError("Original text must be a non-empty string");
+  }
+  if (windowSize < MIN_WINDOW_SIZE) {
+    throw new HashSearchError(`Window size must be at least ${MIN_WINDOW_SIZE}`);
+  }
+  if (originalText.length < windowSize) {
+    throw new HashSearchError(
+      `Text length must be at least ${windowSize} characters (window size)`
+    );
+  }
+  const originalLength = originalText.length;
+  const paddingNeeded = (windowSize - originalLength % windowSize) % windowSize;
+  const paddedText = originalText + "\0".repeat(paddingNeeded);
+  const numChunks = paddedText.length - windowSize + 1;
+  const bufferSize = 12 + numChunks * 24;
+  const buffer = Buffer.alloc(bufferSize);
+  buffer.writeUInt8(114, 0);
+  buffer.writeUInt8(131, 1);
+  buffer.writeUInt8(0, 2);
+  buffer.writeUInt8(1, 3);
+  buffer.writeUInt32BE(originalLength, 4);
+  buffer.writeUInt32BE(windowSize, 8);
+  for (let i = 0; i < numChunks; i++) {
+    const chunk = paddedText.slice(i, i + windowSize);
+    const salt = randomBytes(8);
+    const dataToHash = Buffer.concat([salt, Buffer.from(chunk, "utf-8")]);
+    const hashHex = await blake3(dataToHash, 128);
+    const hash = Buffer.from(hashHex, "hex");
+    const offset = 12 + i * 24;
+    salt.copy(buffer, offset);
+    hash.copy(buffer, offset + 8);
+  }
+  return buffer;
+}
+async function searchIndex(searchText, index) {
+  if (!searchText || typeof searchText !== "string") {
+    throw new HashSearchError("Search text must be a non-empty string");
+  }
+  if (!Buffer.isBuffer(index)) {
+    throw new HashSearchError("Index must be a Buffer");
+  }
+  if (index.length < 12) {
+    throw new HashSearchError("Invalid index buffer: too small");
+  }
+  if ((index.length - 12) % 24 !== 0) {
+    throw new HashSearchError("Invalid index buffer: incorrect structure");
+  }
+  if (index.readUInt8(0) !== 114 || index.readUInt8(1) !== 131 || index.readUInt8(2) !== 0 || index.readUInt8(3) !== 1) {
+    throw new HashSearchError("Invalid magic number in index buffer");
+  }
+  const windowSize = index.readUInt32BE(8);
+  if (searchText.length < windowSize) {
+    throw new HashSearchError(
+      `Search text must be at least ${windowSize} characters (window size)`
+    );
+  }
+  const originalTextLength = index.readUInt32BE(4);
+  const searchLength = searchText.length;
+  const paddingNeeded = (windowSize - searchLength % windowSize) % windowSize;
+  const paddedSearch = searchText + "\0".repeat(paddingNeeded);
+  const numPositions = (index.length - 12) / 24;
+  const searchChunks = searchLength - windowSize + 1;
+  const results = [];
+  for (let startPos = 0; startPos <= numPositions - searchChunks; startPos++) {
+    let match = true;
+    for (let j = 0; j < searchChunks; j++) {
+      const searchChunk = paddedSearch.slice(j, j + windowSize);
+      const saltOffset = 12 + (startPos + j) * 24;
+      const salt = index.subarray(saltOffset, saltOffset + 8);
+      const dataToHash = Buffer.concat([
+        salt,
+        Buffer.from(searchChunk, "utf-8")
+      ]);
+      const expectedHashHex = await blake3(dataToHash, 128);
+      const expectedHash = Buffer.from(expectedHashHex, "hex");
+      const hashOffset = saltOffset + 8;
+      const actualHash = index.subarray(hashOffset, hashOffset + 16);
+      if (!expectedHash.equals(actualHash)) {
+        match = false;
+        break;
+      }
+    }
+    if (match && startPos + searchLength <= originalTextLength) {
+      results.push(startPos);
+    }
+  }
+  return results;
+}
+export {
+  HashSearchError,
+  createIndex,
+  searchIndex
+};

package/dist/index.mjs

@@ -4564,6 +4564,11 @@ var xss3 = {
     content: ({ expression }) => `Is the expression \`${expression}\` supposed to be not sanitized in this context?`,
     description: () => "You are using unsafe string substitution in the template. This means that if the expression can contain maliciously crafted data, it may lead to XSS injection. To apply the fix, you have to make sure the expression is not sanitized on the backend already, and it does not represent an HTML code block.",
     guidance: () => ""
+  },
+  isServerSideCode: {
+    content: () => "Is this code running on the server side (a NodeJS application)",
+    description: () => "The fix to this vulnerability is different is the code runs in the client (browser) or the server side (NodeJs)",
+    guidance: () => ""
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "1.0.200",
+  "version": "1.0.201",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.mjs",
@@ -71,6 +71,7 @@
     "graphql": "16.11.0",
     "graphql-request": "6.1.0",
     "graphql-ws": "5.16.2",
+    "hash-wasm": "4.12.0",
     "http-proxy-agent": "7.0.2",
     "https-proxy-agent": "7.0.6",
     "ignore": "7.0.5",