mobbdev 1.4.28 → 1.4.29

package/dist/args/commands/upload_ai_blame.mjs

@@ -338,6 +338,7 @@ var init_client_generates = __esm({
       IssueType_Enum2["Pt"] = "PT";
       IssueType_Enum2["RaceConditionFormatFlaw"] = "RACE_CONDITION_FORMAT_FLAW";
       IssueType_Enum2["Redos"] = "REDOS";
+      IssueType_Enum2["RedundantCondition"] = "REDUNDANT_CONDITION";
       IssueType_Enum2["RedundantNilErrorCheck"] = "REDUNDANT_NIL_ERROR_CHECK";
       IssueType_Enum2["RegexInjection"] = "REGEX_INJECTION";
       IssueType_Enum2["RegexMissingTimeout"] = "REGEX_MISSING_TIMEOUT";
@@ -1919,6 +1920,7 @@ var init_getIssueType = __esm({
       ["RETURN_IN_INIT" /* ReturnInInit */]: "Return in Init",
       ["ACTION_NOT_PINNED_TO_COMMIT_SHA" /* ActionNotPinnedToCommitSha */]: "Action Not Pinned to Commit Sha",
       ["DJANGO_BLANK_FIELD_NEEDS_NULL_OR_DEFAULT" /* DjangoBlankFieldNeedsNullOrDefault */]: "Django Blank Field Needs Null or Default",
+      ["REDUNDANT_CONDITION" /* RedundantCondition */]: "Insider Threat: Redundant Condition",
       ["REDUNDANT_NIL_ERROR_CHECK" /* RedundantNilErrorCheck */]: "Redundant Nil Error Check",
       ["MISSING_WORKFLOW_PERMISSIONS" /* MissingWorkflowPermissions */]: "Missing Workflow Permissions",
       ["EXCESSIVE_SECRETS_EXPOSURE" /* ExcessiveSecretsExposure */]: "Excessive Secrets Exposure",
@@ -5168,6 +5170,7 @@ var fixDetailsData = {
   ["RETURN_IN_INIT" /* ReturnInInit */]: void 0,
   ["ACTION_NOT_PINNED_TO_COMMIT_SHA" /* ActionNotPinnedToCommitSha */]: void 0,
   ["DJANGO_BLANK_FIELD_NEEDS_NULL_OR_DEFAULT" /* DjangoBlankFieldNeedsNullOrDefault */]: void 0,
+  ["REDUNDANT_CONDITION" /* RedundantCondition */]: void 0,
   ["REDUNDANT_NIL_ERROR_CHECK" /* RedundantNilErrorCheck */]: void 0,
   ["MISSING_WORKFLOW_PERMISSIONS" /* MissingWorkflowPermissions */]: void 0,
   ["EXCESSIVE_SECRETS_EXPOSURE" /* ExcessiveSecretsExposure */]: void 0,
@@ -5514,9 +5517,19 @@ Provide the absolute directory that contains the executable (e.g. \`/usr/bin\`);
   }
 };
 
+// src/features/analysis/scm/shared/src/storedQuestionData/cpp/pathManipulation.ts
+var pathManipulation = {
+  baseDirectory: {
+    content: ({ expression }) => `Which directory must \`${expression}\` stay within? Enter the absolute base directory file access is restricted to.`,
+    description: ({ expression }) => `The fix canonicalizes \`${expression}\` (resolving \`.\`, \`..\`, and symlinks) and verifies the result stays inside this base directory. Provide the **absolute** root the application is allowed to read or write under, for example \`/var/app/data\`. The directory must exist at runtime. A path that resolves outside it is rejected at runtime.`,
+    guidance: (_) => "You **must** set this to an absolute path that exists at runtime and that your application confines file access to. If you leave it unset (or give a relative path), the generated fix is emitted with a placeholder identifier (`MOBB_SET_ALLOWED_BASE_DIR`) that **deliberately does not compile**, so a missing security boundary cannot be overlooked \u2014 replace it with your absolute base directory. A relative path would otherwise resolve against the process working directory (moving the boundary). At runtime the guard aborts (C: `exit(EXIT_FAILURE)`) / throws (C++: `std::runtime_error`) on a path that escapes the base. Pick the narrowest directory that still contains every legitimate file the code opens."
+  }
+};
+
 // src/features/analysis/scm/shared/src/storedQuestionData/cpp/index.ts
 var vulnerabilities11 = {
-  ["CMDi" /* CmDi */]: commandInjection
+  ["CMDi" /* CmDi */]: commandInjection,
+  ["PT" /* Pt */]: pathManipulation
 };
 var cpp_default = vulnerabilities11;
 

package/dist/index.mjs

@@ -338,6 +338,7 @@ var init_client_generates = __esm({
       IssueType_Enum2["Pt"] = "PT";
       IssueType_Enum2["RaceConditionFormatFlaw"] = "RACE_CONDITION_FORMAT_FLAW";
       IssueType_Enum2["Redos"] = "REDOS";
+      IssueType_Enum2["RedundantCondition"] = "REDUNDANT_CONDITION";
       IssueType_Enum2["RedundantNilErrorCheck"] = "REDUNDANT_NIL_ERROR_CHECK";
       IssueType_Enum2["RegexInjection"] = "REGEX_INJECTION";
       IssueType_Enum2["RegexMissingTimeout"] = "REGEX_MISSING_TIMEOUT";
@@ -1584,6 +1585,7 @@ var init_getIssueType = __esm({
       ["RETURN_IN_INIT" /* ReturnInInit */]: "Return in Init",
       ["ACTION_NOT_PINNED_TO_COMMIT_SHA" /* ActionNotPinnedToCommitSha */]: "Action Not Pinned to Commit Sha",
       ["DJANGO_BLANK_FIELD_NEEDS_NULL_OR_DEFAULT" /* DjangoBlankFieldNeedsNullOrDefault */]: "Django Blank Field Needs Null or Default",
+      ["REDUNDANT_CONDITION" /* RedundantCondition */]: "Insider Threat: Redundant Condition",
       ["REDUNDANT_NIL_ERROR_CHECK" /* RedundantNilErrorCheck */]: "Redundant Nil Error Check",
       ["MISSING_WORKFLOW_PERMISSIONS" /* MissingWorkflowPermissions */]: "Missing Workflow Permissions",
       ["EXCESSIVE_SECRETS_EXPOSURE" /* ExcessiveSecretsExposure */]: "Excessive Secrets Exposure",
@@ -4873,6 +4875,7 @@ var fixDetailsData = {
   ["RETURN_IN_INIT" /* ReturnInInit */]: void 0,
   ["ACTION_NOT_PINNED_TO_COMMIT_SHA" /* ActionNotPinnedToCommitSha */]: void 0,
   ["DJANGO_BLANK_FIELD_NEEDS_NULL_OR_DEFAULT" /* DjangoBlankFieldNeedsNullOrDefault */]: void 0,
+  ["REDUNDANT_CONDITION" /* RedundantCondition */]: void 0,
   ["REDUNDANT_NIL_ERROR_CHECK" /* RedundantNilErrorCheck */]: void 0,
   ["MISSING_WORKFLOW_PERMISSIONS" /* MissingWorkflowPermissions */]: void 0,
   ["EXCESSIVE_SECRETS_EXPOSURE" /* ExcessiveSecretsExposure */]: void 0,
@@ -5307,9 +5310,19 @@ Provide the absolute directory that contains the executable (e.g. \`/usr/bin\`);
   }
 };
 
+// src/features/analysis/scm/shared/src/storedQuestionData/cpp/pathManipulation.ts
+var pathManipulation = {
+  baseDirectory: {
+    content: ({ expression }) => `Which directory must \`${expression}\` stay within? Enter the absolute base directory file access is restricted to.`,
+    description: ({ expression }) => `The fix canonicalizes \`${expression}\` (resolving \`.\`, \`..\`, and symlinks) and verifies the result stays inside this base directory. Provide the **absolute** root the application is allowed to read or write under, for example \`/var/app/data\`. The directory must exist at runtime. A path that resolves outside it is rejected at runtime.`,
+    guidance: (_) => "You **must** set this to an absolute path that exists at runtime and that your application confines file access to. If you leave it unset (or give a relative path), the generated fix is emitted with a placeholder identifier (`MOBB_SET_ALLOWED_BASE_DIR`) that **deliberately does not compile**, so a missing security boundary cannot be overlooked \u2014 replace it with your absolute base directory. A relative path would otherwise resolve against the process working directory (moving the boundary). At runtime the guard aborts (C: `exit(EXIT_FAILURE)`) / throws (C++: `std::runtime_error`) on a path that escapes the base. Pick the narrowest directory that still contains every legitimate file the code opens."
+  }
+};
+
 // src/features/analysis/scm/shared/src/storedQuestionData/cpp/index.ts
 var vulnerabilities11 = {
-  ["CMDi" /* CmDi */]: commandInjection
+  ["CMDi" /* CmDi */]: commandInjection,
+  ["PT" /* Pt */]: pathManipulation
 };
 var cpp_default = vulnerabilities11;
 
@@ -19930,7 +19943,7 @@ function createLogger(config2) {
 
 // src/features/claude_code/hook_logger.ts
 var DD_RUM_TOKEN = true ? "pubf59c0182545bfb4c299175119f1abf9b" : "";
-var CLI_VERSION = true ? "1.4.28" : "unknown";
+var CLI_VERSION = true ? "1.4.29" : "unknown";
 var NAMESPACE = "mobbdev-claude-code-hook-logs";
 var claudeCodeVersion;
 function buildDdTags() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "1.4.28",
+  "version": "1.4.29",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.mjs",