mobbdev 1.4.19 → 1.4.20

package/dist/args/commands/upload_ai_blame.mjs

@@ -291,6 +291,7 @@ var init_client_generates = __esm({
       IssueType_Enum2["InsufficientLogging"] = "INSUFFICIENT_LOGGING";
       IssueType_Enum2["J2EeGetConnection"] = "J2EE_GET_CONNECTION";
       IssueType_Enum2["JqueryDeprecatedSymbols"] = "JQUERY_DEPRECATED_SYMBOLS";
+      IssueType_Enum2["JwtDecodeWithoutVerify"] = "JWT_DECODE_WITHOUT_VERIFY";
       IssueType_Enum2["LeftoverDebugCode"] = "LEFTOVER_DEBUG_CODE";
       IssueType_Enum2["LocaleDependentComparison"] = "LOCALE_DEPENDENT_COMPARISON";
       IssueType_Enum2["LogForging"] = "LOG_FORGING";
@@ -353,6 +354,7 @@ var init_client_generates = __esm({
       IssueType_Enum2["UnencryptedAwsSqsQueue"] = "UNENCRYPTED_AWS_SQS_QUEUE";
       IssueType_Enum2["UnnecessaryImports"] = "UNNECESSARY_IMPORTS";
       IssueType_Enum2["UnsafeDeserialization"] = "UNSAFE_DESERIALIZATION";
+      IssueType_Enum2["UnsafeReflection"] = "UNSAFE_REFLECTION";
       IssueType_Enum2["UnsafeTargetBlank"] = "UNSAFE_TARGET_BLANK";
       IssueType_Enum2["UnsafeWebThread"] = "UNSAFE_WEB_THREAD";
       IssueType_Enum2["UnvalidatedPublicMethodArgument"] = "UNVALIDATED_PUBLIC_METHOD_ARGUMENT";
@@ -1778,6 +1780,7 @@ var init_getIssueType = __esm({
       ["TRUST_BOUNDARY_VIOLATION" /* TrustBoundaryViolation */]: "Trust Boundary Violation",
       ["NULL_DEREFERENCE" /* NullDereference */]: "Null Dereference",
       ["UNSAFE_DESERIALIZATION" /* UnsafeDeserialization */]: "Unsafe deserialization",
+      ["UNSAFE_REFLECTION" /* UnsafeReflection */]: "Unsafe Reflection",
       ["INSECURE_BINDER_CONFIGURATION" /* InsecureBinderConfiguration */]: "Insecure Binder Configuration",
       ["UNSAFE_TARGET_BLANK" /* UnsafeTargetBlank */]: "Unsafe use of target blank",
       ["IFRAME_WITHOUT_SANDBOX" /* IframeWithoutSandbox */]: "Client use of iframe without sandbox",
@@ -1892,7 +1895,8 @@ var init_getIssueType = __esm({
       ["OFTEN_MISUSED_BOOLEAN_GET_BOOLEAN" /* OftenMisusedBooleanGetBoolean */]: "Often Misused: Boolean.getBoolean()",
       ["UNENCRYPTED_AWS_SQS_QUEUE" /* UnencryptedAwsSqsQueue */]: "AWS SQS Queue Unencrypted",
       ["INSECURE_DESERIALIZATION" /* InsecureDeserialization */]: "Insecure Deserialization",
-      ["AWS_DYNAMODB_POINT_IN_TIME_RECOVERY_DISABLED" /* AwsDynamodbPointInTimeRecoveryDisabled */]: "AWS DynamoDB Point-in-Time Recovery Disabled"
+      ["AWS_DYNAMODB_POINT_IN_TIME_RECOVERY_DISABLED" /* AwsDynamodbPointInTimeRecoveryDisabled */]: "AWS DynamoDB Point-in-Time Recovery Disabled",
+      ["JWT_DECODE_WITHOUT_VERIFY" /* JwtDecodeWithoutVerify */]: "JWT Decoded Without Signature Verification"
     };
     issueTypeZ = z5.nativeEnum(IssueType_Enum);
     getIssueTypeFriendlyString = (issueType) => {
@@ -2049,6 +2053,7 @@ var init_types = __esm({
         expirationOn: z7.string().nullable(),
         state: z7.nativeEnum(Fix_Report_State_Enum),
         failReason: z7.string().nullable(),
+        candidateToRerun: z7.boolean(),
         fixes: z7.array(
           z7.object({
             id: z7.string().uuid(),
@@ -5134,6 +5139,7 @@ var fixDetailsData = {
   ["INCORRECT_INTEGER_CONVERSION" /* IncorrectIntegerConversion */]: void 0,
   ["IMPROPER_CERTIFICATE_VALIDATION" /* ImproperCertificateValidation */]: void 0,
   ["OFTEN_MISUSED_BOOLEAN_GET_BOOLEAN" /* OftenMisusedBooleanGetBoolean */]: void 0,
+  ["UNSAFE_REFLECTION" /* UnsafeReflection */]: void 0,
   ["UNENCRYPTED_AWS_SQS_QUEUE" /* UnencryptedAwsSqsQueue */]: {
     issueDescription: "AWS SQS queue contents are unencrypted; data could be read if the queue is compromised.",
     fixInstructions: "Enable server-side encryption by setting sqs_managed_sse_enabled = true, or supply a KMS key via kms_master_key_id."
@@ -5142,6 +5148,10 @@ var fixDetailsData = {
   ["AWS_DYNAMODB_POINT_IN_TIME_RECOVERY_DISABLED" /* AwsDynamodbPointInTimeRecoveryDisabled */]: {
     issueDescription: "AWS DynamoDB table has point-in-time recovery disabled; accidental or malicious writes/deletes cannot be rolled back from a known-good snapshot.",
     fixInstructions: "Enable point-in-time recovery by adding `point_in_time_recovery { enabled = true }` to the aws_dynamodb_table resource."
+  },
+  ["JWT_DECODE_WITHOUT_VERIFY" /* JwtDecodeWithoutVerify */]: {
+    issueDescription: "Decoding a JWT with `JWT.decode()` only base64-decodes the token without checking its signature, so an attacker can forge a token with arbitrary claims (identity, roles, expiration) and have it trusted. CWE-345, OWASP A08:2021 Software and Data Integrity Failures.",
+    fixInstructions: "Verify the signature before trusting any claims: build a verifier with the expected algorithm and secret/key (e.g. `JWT.require(Algorithm.HMAC256(secret)).build().verify(token)`) instead of calling `JWT.decode(token)`. After merging, confirm the verifier is configured with the same algorithm and secret/key used to sign your tokens \u2014 an incorrect or placeholder secret will make verification throw `JWTVerificationException` at runtime and reject legitimate tokens."
   }
 };
 
@@ -6172,6 +6182,15 @@ var uncheckedLoopCondition = {
   }
 };
 
+// src/features/analysis/scm/shared/src/storedQuestionData/java/unsafeReflection.ts
+var unsafeReflection = {
+  classAllowlist: {
+    content: () => "Allowed class names for reflection",
+    description: () => `Provide a comma-separated list of fully-qualified class names that are permitted to be loaded via reflection (e.g. \`com.example.MyClass\`). Any other class name will be rejected at runtime.`,
+    guidance: () => ""
+  }
+};
+
 // src/features/analysis/scm/shared/src/storedQuestionData/java/useOfSystemOutputStream.ts
 var useOfSystemOutputStream2 = {
   noLoggerAction: {
@@ -6257,6 +6276,7 @@ var vulnerabilities13 = {
   ["UNCHECKED_LOOP_CONDITION" /* UncheckedLoopCondition */]: uncheckedLoopCondition,
   ["INSECURE_COOKIE" /* InsecureCookie */]: insecureCookie2,
   ["TRUST_BOUNDARY_VIOLATION" /* TrustBoundaryViolation */]: trustBoundaryViolation2,
+  ["UNSAFE_REFLECTION" /* UnsafeReflection */]: unsafeReflection,
   ["J2EE_GET_CONNECTION" /* J2EeGetConnection */]: j2eeGetConnection2,
   ["LEFTOVER_DEBUG_CODE" /* LeftoverDebugCode */]: leftoverDebugCode,
   ["ERRONEOUS_STRING_COMPARE" /* ErroneousStringCompare */]: erroneousStringCompare,

package/dist/index.mjs

@@ -291,6 +291,7 @@ var init_client_generates = __esm({
       IssueType_Enum2["InsufficientLogging"] = "INSUFFICIENT_LOGGING";
       IssueType_Enum2["J2EeGetConnection"] = "J2EE_GET_CONNECTION";
       IssueType_Enum2["JqueryDeprecatedSymbols"] = "JQUERY_DEPRECATED_SYMBOLS";
+      IssueType_Enum2["JwtDecodeWithoutVerify"] = "JWT_DECODE_WITHOUT_VERIFY";
       IssueType_Enum2["LeftoverDebugCode"] = "LEFTOVER_DEBUG_CODE";
       IssueType_Enum2["LocaleDependentComparison"] = "LOCALE_DEPENDENT_COMPARISON";
       IssueType_Enum2["LogForging"] = "LOG_FORGING";
@@ -353,6 +354,7 @@ var init_client_generates = __esm({
       IssueType_Enum2["UnencryptedAwsSqsQueue"] = "UNENCRYPTED_AWS_SQS_QUEUE";
       IssueType_Enum2["UnnecessaryImports"] = "UNNECESSARY_IMPORTS";
       IssueType_Enum2["UnsafeDeserialization"] = "UNSAFE_DESERIALIZATION";
+      IssueType_Enum2["UnsafeReflection"] = "UNSAFE_REFLECTION";
       IssueType_Enum2["UnsafeTargetBlank"] = "UNSAFE_TARGET_BLANK";
       IssueType_Enum2["UnsafeWebThread"] = "UNSAFE_WEB_THREAD";
       IssueType_Enum2["UnvalidatedPublicMethodArgument"] = "UNVALIDATED_PUBLIC_METHOD_ARGUMENT";
@@ -1444,6 +1446,7 @@ var init_getIssueType = __esm({
       ["TRUST_BOUNDARY_VIOLATION" /* TrustBoundaryViolation */]: "Trust Boundary Violation",
       ["NULL_DEREFERENCE" /* NullDereference */]: "Null Dereference",
       ["UNSAFE_DESERIALIZATION" /* UnsafeDeserialization */]: "Unsafe deserialization",
+      ["UNSAFE_REFLECTION" /* UnsafeReflection */]: "Unsafe Reflection",
       ["INSECURE_BINDER_CONFIGURATION" /* InsecureBinderConfiguration */]: "Insecure Binder Configuration",
       ["UNSAFE_TARGET_BLANK" /* UnsafeTargetBlank */]: "Unsafe use of target blank",
       ["IFRAME_WITHOUT_SANDBOX" /* IframeWithoutSandbox */]: "Client use of iframe without sandbox",
@@ -1558,7 +1561,8 @@ var init_getIssueType = __esm({
       ["OFTEN_MISUSED_BOOLEAN_GET_BOOLEAN" /* OftenMisusedBooleanGetBoolean */]: "Often Misused: Boolean.getBoolean()",
       ["UNENCRYPTED_AWS_SQS_QUEUE" /* UnencryptedAwsSqsQueue */]: "AWS SQS Queue Unencrypted",
       ["INSECURE_DESERIALIZATION" /* InsecureDeserialization */]: "Insecure Deserialization",
-      ["AWS_DYNAMODB_POINT_IN_TIME_RECOVERY_DISABLED" /* AwsDynamodbPointInTimeRecoveryDisabled */]: "AWS DynamoDB Point-in-Time Recovery Disabled"
+      ["AWS_DYNAMODB_POINT_IN_TIME_RECOVERY_DISABLED" /* AwsDynamodbPointInTimeRecoveryDisabled */]: "AWS DynamoDB Point-in-Time Recovery Disabled",
+      ["JWT_DECODE_WITHOUT_VERIFY" /* JwtDecodeWithoutVerify */]: "JWT Decoded Without Signature Verification"
     };
     issueTypeZ = z.nativeEnum(IssueType_Enum);
     getIssueTypeFriendlyString = (issueType) => {
@@ -2094,6 +2098,7 @@ var init_types = __esm({
         expirationOn: z11.string().nullable(),
         state: z11.nativeEnum(Fix_Report_State_Enum),
         failReason: z11.string().nullable(),
+        candidateToRerun: z11.boolean(),
         fixes: z11.array(
           z11.object({
             id: z11.string().uuid(),
@@ -4838,6 +4843,7 @@ var fixDetailsData = {
   ["INCORRECT_INTEGER_CONVERSION" /* IncorrectIntegerConversion */]: void 0,
   ["IMPROPER_CERTIFICATE_VALIDATION" /* ImproperCertificateValidation */]: void 0,
   ["OFTEN_MISUSED_BOOLEAN_GET_BOOLEAN" /* OftenMisusedBooleanGetBoolean */]: void 0,
+  ["UNSAFE_REFLECTION" /* UnsafeReflection */]: void 0,
   ["UNENCRYPTED_AWS_SQS_QUEUE" /* UnencryptedAwsSqsQueue */]: {
     issueDescription: "AWS SQS queue contents are unencrypted; data could be read if the queue is compromised.",
     fixInstructions: "Enable server-side encryption by setting sqs_managed_sse_enabled = true, or supply a KMS key via kms_master_key_id."
@@ -4846,6 +4852,10 @@ var fixDetailsData = {
   ["AWS_DYNAMODB_POINT_IN_TIME_RECOVERY_DISABLED" /* AwsDynamodbPointInTimeRecoveryDisabled */]: {
     issueDescription: "AWS DynamoDB table has point-in-time recovery disabled; accidental or malicious writes/deletes cannot be rolled back from a known-good snapshot.",
     fixInstructions: "Enable point-in-time recovery by adding `point_in_time_recovery { enabled = true }` to the aws_dynamodb_table resource."
+  },
+  ["JWT_DECODE_WITHOUT_VERIFY" /* JwtDecodeWithoutVerify */]: {
+    issueDescription: "Decoding a JWT with `JWT.decode()` only base64-decodes the token without checking its signature, so an attacker can forge a token with arbitrary claims (identity, roles, expiration) and have it trusted. CWE-345, OWASP A08:2021 Software and Data Integrity Failures.",
+    fixInstructions: "Verify the signature before trusting any claims: build a verifier with the expected algorithm and secret/key (e.g. `JWT.require(Algorithm.HMAC256(secret)).build().verify(token)`) instead of calling `JWT.decode(token)`. After merging, confirm the verifier is configured with the same algorithm and secret/key used to sign your tokens \u2014 an incorrect or placeholder secret will make verification throw `JWTVerificationException` at runtime and reject legitimate tokens."
   }
 };
 
@@ -5964,6 +5974,15 @@ var uncheckedLoopCondition = {
   }
 };
 
+// src/features/analysis/scm/shared/src/storedQuestionData/java/unsafeReflection.ts
+var unsafeReflection = {
+  classAllowlist: {
+    content: () => "Allowed class names for reflection",
+    description: () => `Provide a comma-separated list of fully-qualified class names that are permitted to be loaded via reflection (e.g. \`com.example.MyClass\`). Any other class name will be rejected at runtime.`,
+    guidance: () => ""
+  }
+};
+
 // src/features/analysis/scm/shared/src/storedQuestionData/java/useOfSystemOutputStream.ts
 var useOfSystemOutputStream2 = {
   noLoggerAction: {
@@ -6049,6 +6068,7 @@ var vulnerabilities13 = {
   ["UNCHECKED_LOOP_CONDITION" /* UncheckedLoopCondition */]: uncheckedLoopCondition,
   ["INSECURE_COOKIE" /* InsecureCookie */]: insecureCookie2,
   ["TRUST_BOUNDARY_VIOLATION" /* TrustBoundaryViolation */]: trustBoundaryViolation2,
+  ["UNSAFE_REFLECTION" /* UnsafeReflection */]: unsafeReflection,
   ["J2EE_GET_CONNECTION" /* J2EeGetConnection */]: j2eeGetConnection2,
   ["LEFTOVER_DEBUG_CODE" /* LeftoverDebugCode */]: leftoverDebugCode,
   ["ERRONEOUS_STRING_COMPARE" /* ErroneousStringCompare */]: erroneousStringCompare,
@@ -19448,7 +19468,7 @@ function createLogger(config2) {
 
 // src/features/claude_code/hook_logger.ts
 var DD_RUM_TOKEN = true ? "pubf59c0182545bfb4c299175119f1abf9b" : "";
-var CLI_VERSION = true ? "1.4.19" : "unknown";
+var CLI_VERSION = true ? "1.4.20" : "unknown";
 var NAMESPACE = "mobbdev-claude-code-hook-logs";
 var claudeCodeVersion;
 function buildDdTags() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "1.4.19",
+  "version": "1.4.20",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.mjs",