mobbdev 1.4.34 → 1.4.35

package/dist/args/commands/upload_ai_blame.mjs

@@ -346,6 +346,9 @@ var init_client_generates = __esm({
           key
           value
         }
+        content
+        description
+        guidance
       }
       extraContext {
         extraContext {
@@ -590,6 +593,9 @@ var init_client_generates = __esm({
           name
           options
           value
+          content
+          description
+          guidance
           __typename
         }
         extraContext {
@@ -599,6 +605,7 @@ var init_client_generates = __esm({
             __typename
           }
           fixDescription
+          guidances
           manifestActionsRequired {
             action
             lib {
@@ -1087,6 +1094,9 @@ var init_client_generates = __esm({
           key
           value
         }
+        content
+        description
+        guidance
       }
       extraContext {
         extraContext {
@@ -1324,7 +1334,11 @@ var init_fix = __esm({
     FixExtraContextZ = z2.object({
       fixDescription: z2.string(),
       manifestActionsRequired: z2.array(ManifestActionRequiredZ),
-      extraContext: z2.array(ExtraContextInternalZ)
+      extraContext: z2.array(ExtraContextInternalZ),
+      // E-2015 PR5c: analyzer-served fix-level guidance. default([]) so a query that
+      // omits it still parses, while the output type is a required string[] to match
+      // the non-null GraphQL field. getFixGuidances prefers served then falls back.
+      guidances: z2.array(z2.string()).default([])
     });
     PatchAndQuestionsZ = z2.object({
       __typename: z2.literal("FixData"),
@@ -1339,7 +1353,14 @@ var init_fix = __esm({
           value: z2.string().nullable(),
           extraContext: z2.array(ExtraContextInternalZ),
           inputType: z2.nativeEnum(FixQuestionInputType),
-          options: z2.array(z2.string())
+          options: z2.array(z2.string()),
+          // E-2015 PR5: analyzer-served question copy. default('') so a query that
+          // omits these still parses (-> '' -> FE falls back to its own copy), while
+          // the output type stays a required `string` to match the non-null GraphQL
+          // fields. Consumers use `served || storedQuestionData`.
+          content: z2.string().default(""),
+          description: z2.string().default(""),
+          guidance: z2.string().default("")
         })
       ),
       extraContext: FixExtraContextZ
@@ -4701,18 +4722,6 @@ Also add a matching \`<resource-ref>\` (or \`<data-source>\`) in your \`WEB-INF/
 This fix is mandated by the J2EE / Jakarta EE specification (CWE-245) \u2014 direct driver management bypasses the container's pooling, retry, and failover policies.`
 };
 
-// src/features/analysis/scm/shared/src/storedFixData/java/sqlInjection.ts
-var sqlInjection = {
-  guidance: ({
-    hasQuestionMarksAfterTaintVar
-  }) => {
-    if (hasQuestionMarksAfterTaintVar) {
-      return "Please make sure to correct the following indices of the setInt()/setString() calls after the new parameter is added.";
-    }
-    return "";
-  }
-};
-
 // src/features/analysis/scm/shared/src/storedFixData/java/systemInformationLeak.ts
 var systemInformationLeak = {
   guidance: ({
@@ -4730,7 +4739,6 @@ var vulnerabilities5 = {
   ["PASSWORD_IN_COMMENT"]: passwordInComment,
   ["INSECURE_DESERIALIZATION"]: insecureDeserialization,
   ["J2EE_GET_CONNECTION"]: j2eeGetConnection,
-  ["SQL_Injection"]: sqlInjection,
   ["SYSTEM_INFORMATION_LEAK"]: systemInformationLeak
 };
 var java_default = vulnerabilities5;
@@ -5073,7 +5081,7 @@ var requestParametersBoundViaInput = {
 };
 
 // src/features/analysis/scm/shared/src/storedQuestionData/csharp/sqlInjection.ts
-var sqlInjection2 = {
+var sqlInjection = {
   databaseProvider: {
     content: () => "Select the database provider",
     description: () => "",
@@ -5227,7 +5235,7 @@ var vulnerabilities12 = {
   ["VALUE_SHADOWING"]: valueShadowing,
   ["INSECURE_RANDOMNESS"]: insecureRandomness,
   ["INSUFFICIENT_LOGGING"]: insufficientLogging,
-  ["SQL_Injection"]: sqlInjection2,
+  ["SQL_Injection"]: sqlInjection,
   ["REQUEST_PARAMETERS_BOUND_VIA_INPUT"]: requestParametersBoundViaInput
 };
 var csharp_default2 = vulnerabilities12;
@@ -5522,81 +5530,6 @@ var relativePathCommand = {
   }
 };
 
-// src/features/analysis/scm/shared/src/storedQuestionData/java/sqlInjection.ts
-function capitalizeFirstLetter(item) {
-  return item.charAt(0).toUpperCase() + item.slice(1);
-}
-var typeToSetMethod = {
-  integer: "setInt",
-  date: "setDate",
-  string: "setString"
-};
-var sqlInjection3 = {
-  parameterType: {
-    content: ({ tainted_term }) => `What is the SQL Data Type of the \`${tainted_term}\` parameter?`,
-    description: () => "In order to make sure the statement is built correctly, we must ensure we use the same type that is defined for this parameter in the SQL table. If you are unsure of this type, please consult with your team.",
-    guidance: ({
-      tainted_term,
-      taint_var_type_guidance_required,
-      userInputValue
-    }) => {
-      if (!taint_var_type_guidance_required || !userInputValue) {
-        return "";
-      }
-      if (!taint_var_type_guidance_required[userInputValue]) {
-        return "";
-      }
-      return `Make sure to convert \`${tainted_term}\` to \`${capitalizeFirstLetter(
-        userInputValue
-      )}\` which is the type expected by the new setter method: \`${typeToSetMethod[userInputValue]}\``;
-    }
-  },
-  varName: {
-    content: () => "Name the new PreparedStatement variable",
-    description: () => "We needed to create a new variable for this fix. We actually like the name we picked, but maybe you follow different naming conventions, so you can change it here.",
-    guidance: () => ""
-  },
-  taintIndex: {
-    content: ({ tainted_term }) => `What is the index of \`\`\`${tainted_term}\`\`\` in the query?`,
-    description: () => "When constructing a query, we need to know exactly where to insert this parameter. If the query has more than one parameter, the index gives us this information. Leave the value as 1 if there is only one parameter.",
-    guidance: () => ""
-  },
-  statementAfterQuery: {
-    content: ({ var_name }) => `Is the \`Statement\` variable \`${var_name}\` declared after constructing the query string?`,
-    description: () => "When creating the `PreparedStatement` parameter, we need to give it the constructed query. Currently, Mobb doesn't support the case where the query string is defined after the statement in your code.",
-    guidance: ({ userInputValue }) => userInputValue === "no" ? "You should move the code creating the query so it is executed before being used by the prepared statement" : ""
-  },
-  statementBeforeQuery: {
-    content: ({ var_name }) => `Is the query string variable declared after the \`Statement\` variable \`${var_name}\`?`,
-    description: ({ enquote_func_name }) => `We need to have the \`Statement\` object defined before using the \`${enquote_func_name}()\` method. Currently, Mobb doesn't support the case where the query string is defined before the statement in your code.`,
-    guidance: ({
-      userInputValue,
-      enquote_func_name
-    }) => userInputValue === "no" ? `You should move the code creating the query so it is executed after creating the \`Statement\` object as we need to have the \`Statement\` object defined before using the \`${enquote_func_name}()\` method.` : ""
-  },
-  containsControlCharacters: {
-    content: ({ tainted_term }) => `Does \`\`\`${tainted_term}\`\`\` represent a single SQL parameter value?`,
-    description: () => `This should be 'no' only in the rare cases where the input variable itself does not represent a single SQL parameter value but rather other parts of a SQL query such as a table name, a column name, a list of values, a complete or partial inner SQL statement, etc.
-      
-It may be confusing a bit, so here are some examples:
-      
-* A SQL identifier \`\`\`(SELECT * FROM \${tableName})\`\`\`
-      
-* A SQL statement \`\`\`(SELECT * FROM users ORDER BY id \${order})\`\`\``,
-    guidance: () => ""
-  },
-  javaVersionGreaterOrEqual19: {
-    content: ({ enquote_func_name }) => `Is \`java.sql.Statement.${enquote_func_name}\` method available in your runtime?`,
-    description: ({ enquote_func_name }) => `\`java.sql.Statement.${enquote_func_name}\` is supported in Java 1.9 or greater.`,
-    guidance: () => ""
-  },
-  queryParameterName: {
-    content: () => "What should be the name of the query parameter?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
 // src/features/analysis/scm/shared/src/storedQuestionData/java/ssrf.ts
 var ssrf3 = {
   domainsAllowlist: {
@@ -5723,7 +5656,6 @@ var xxe2 = {
 
 // src/features/analysis/scm/shared/src/storedQuestionData/java/index.ts
 var vulnerabilities14 = {
-  ["SQL_Injection"]: sqlInjection3,
   ["CMDi_relative_path_command"]: relativePathCommand,
   ["CMDi"]: commandInjection2,
   ["CONFUSING_NAMING"]: confusingNaming,

package/dist/index.mjs

@@ -346,6 +346,9 @@ var init_client_generates = __esm({
           key
           value
         }
+        content
+        description
+        guidance
       }
       extraContext {
         extraContext {
@@ -590,6 +593,9 @@ var init_client_generates = __esm({
           name
           options
           value
+          content
+          description
+          guidance
           __typename
         }
         extraContext {
@@ -599,6 +605,7 @@ var init_client_generates = __esm({
             __typename
           }
           fixDescription
+          guidances
           manifestActionsRequired {
             action
             lib {
@@ -1087,6 +1094,9 @@ var init_client_generates = __esm({
           key
           value
         }
+        content
+        description
+        guidance
       }
       extraContext {
         extraContext {
@@ -1426,7 +1436,11 @@ var init_fix = __esm({
     FixExtraContextZ = z6.object({
       fixDescription: z6.string(),
       manifestActionsRequired: z6.array(ManifestActionRequiredZ),
-      extraContext: z6.array(ExtraContextInternalZ)
+      extraContext: z6.array(ExtraContextInternalZ),
+      // E-2015 PR5c: analyzer-served fix-level guidance. default([]) so a query that
+      // omits it still parses, while the output type is a required string[] to match
+      // the non-null GraphQL field. getFixGuidances prefers served then falls back.
+      guidances: z6.array(z6.string()).default([])
     });
     PatchAndQuestionsZ = z6.object({
       __typename: z6.literal("FixData"),
@@ -1441,7 +1455,14 @@ var init_fix = __esm({
           value: z6.string().nullable(),
           extraContext: z6.array(ExtraContextInternalZ),
           inputType: z6.nativeEnum(FixQuestionInputType),
-          options: z6.array(z6.string())
+          options: z6.array(z6.string()),
+          // E-2015 PR5: analyzer-served question copy. default('') so a query that
+          // omits these still parses (-> '' -> FE falls back to its own copy), while
+          // the output type stays a required `string` to match the non-null GraphQL
+          // fields. Consumers use `served || storedQuestionData`.
+          content: z6.string().default(""),
+          description: z6.string().default(""),
+          guidance: z6.string().default("")
         })
       ),
       extraContext: FixExtraContextZ
@@ -4495,18 +4516,6 @@ Also add a matching \`<resource-ref>\` (or \`<data-source>\`) in your \`WEB-INF/
 This fix is mandated by the J2EE / Jakarta EE specification (CWE-245) \u2014 direct driver management bypasses the container's pooling, retry, and failover policies.`
 };
 
-// src/features/analysis/scm/shared/src/storedFixData/java/sqlInjection.ts
-var sqlInjection = {
-  guidance: ({
-    hasQuestionMarksAfterTaintVar
-  }) => {
-    if (hasQuestionMarksAfterTaintVar) {
-      return "Please make sure to correct the following indices of the setInt()/setString() calls after the new parameter is added.";
-    }
-    return "";
-  }
-};
-
 // src/features/analysis/scm/shared/src/storedFixData/java/systemInformationLeak.ts
 var systemInformationLeak = {
   guidance: ({
@@ -4524,7 +4533,6 @@ var vulnerabilities5 = {
   ["PASSWORD_IN_COMMENT"]: passwordInComment,
   ["INSECURE_DESERIALIZATION"]: insecureDeserialization,
   ["J2EE_GET_CONNECTION"]: j2eeGetConnection,
-  ["SQL_Injection"]: sqlInjection,
   ["SYSTEM_INFORMATION_LEAK"]: systemInformationLeak
 };
 var java_default = vulnerabilities5;
@@ -4867,7 +4875,7 @@ var requestParametersBoundViaInput = {
 };
 
 // src/features/analysis/scm/shared/src/storedQuestionData/csharp/sqlInjection.ts
-var sqlInjection2 = {
+var sqlInjection = {
   databaseProvider: {
     content: () => "Select the database provider",
     description: () => "",
@@ -5021,7 +5029,7 @@ var vulnerabilities12 = {
   ["VALUE_SHADOWING"]: valueShadowing,
   ["INSECURE_RANDOMNESS"]: insecureRandomness,
   ["INSUFFICIENT_LOGGING"]: insufficientLogging,
-  ["SQL_Injection"]: sqlInjection2,
+  ["SQL_Injection"]: sqlInjection,
   ["REQUEST_PARAMETERS_BOUND_VIA_INPUT"]: requestParametersBoundViaInput
 };
 var csharp_default2 = vulnerabilities12;
@@ -5316,81 +5324,6 @@ var relativePathCommand = {
   }
 };
 
-// src/features/analysis/scm/shared/src/storedQuestionData/java/sqlInjection.ts
-function capitalizeFirstLetter2(item) {
-  return item.charAt(0).toUpperCase() + item.slice(1);
-}
-var typeToSetMethod = {
-  integer: "setInt",
-  date: "setDate",
-  string: "setString"
-};
-var sqlInjection3 = {
-  parameterType: {
-    content: ({ tainted_term }) => `What is the SQL Data Type of the \`${tainted_term}\` parameter?`,
-    description: () => "In order to make sure the statement is built correctly, we must ensure we use the same type that is defined for this parameter in the SQL table. If you are unsure of this type, please consult with your team.",
-    guidance: ({
-      tainted_term,
-      taint_var_type_guidance_required,
-      userInputValue
-    }) => {
-      if (!taint_var_type_guidance_required || !userInputValue) {
-        return "";
-      }
-      if (!taint_var_type_guidance_required[userInputValue]) {
-        return "";
-      }
-      return `Make sure to convert \`${tainted_term}\` to \`${capitalizeFirstLetter2(
-        userInputValue
-      )}\` which is the type expected by the new setter method: \`${typeToSetMethod[userInputValue]}\``;
-    }
-  },
-  varName: {
-    content: () => "Name the new PreparedStatement variable",
-    description: () => "We needed to create a new variable for this fix. We actually like the name we picked, but maybe you follow different naming conventions, so you can change it here.",
-    guidance: () => ""
-  },
-  taintIndex: {
-    content: ({ tainted_term }) => `What is the index of \`\`\`${tainted_term}\`\`\` in the query?`,
-    description: () => "When constructing a query, we need to know exactly where to insert this parameter. If the query has more than one parameter, the index gives us this information. Leave the value as 1 if there is only one parameter.",
-    guidance: () => ""
-  },
-  statementAfterQuery: {
-    content: ({ var_name }) => `Is the \`Statement\` variable \`${var_name}\` declared after constructing the query string?`,
-    description: () => "When creating the `PreparedStatement` parameter, we need to give it the constructed query. Currently, Mobb doesn't support the case where the query string is defined after the statement in your code.",
-    guidance: ({ userInputValue }) => userInputValue === "no" ? "You should move the code creating the query so it is executed before being used by the prepared statement" : ""
-  },
-  statementBeforeQuery: {
-    content: ({ var_name }) => `Is the query string variable declared after the \`Statement\` variable \`${var_name}\`?`,
-    description: ({ enquote_func_name }) => `We need to have the \`Statement\` object defined before using the \`${enquote_func_name}()\` method. Currently, Mobb doesn't support the case where the query string is defined before the statement in your code.`,
-    guidance: ({
-      userInputValue,
-      enquote_func_name
-    }) => userInputValue === "no" ? `You should move the code creating the query so it is executed after creating the \`Statement\` object as we need to have the \`Statement\` object defined before using the \`${enquote_func_name}()\` method.` : ""
-  },
-  containsControlCharacters: {
-    content: ({ tainted_term }) => `Does \`\`\`${tainted_term}\`\`\` represent a single SQL parameter value?`,
-    description: () => `This should be 'no' only in the rare cases where the input variable itself does not represent a single SQL parameter value but rather other parts of a SQL query such as a table name, a column name, a list of values, a complete or partial inner SQL statement, etc.
-      
-It may be confusing a bit, so here are some examples:
-      
-* A SQL identifier \`\`\`(SELECT * FROM \${tableName})\`\`\`
-      
-* A SQL statement \`\`\`(SELECT * FROM users ORDER BY id \${order})\`\`\``,
-    guidance: () => ""
-  },
-  javaVersionGreaterOrEqual19: {
-    content: ({ enquote_func_name }) => `Is \`java.sql.Statement.${enquote_func_name}\` method available in your runtime?`,
-    description: ({ enquote_func_name }) => `\`java.sql.Statement.${enquote_func_name}\` is supported in Java 1.9 or greater.`,
-    guidance: () => ""
-  },
-  queryParameterName: {
-    content: () => "What should be the name of the query parameter?",
-    description: () => "",
-    guidance: () => ""
-  }
-};
-
 // src/features/analysis/scm/shared/src/storedQuestionData/java/ssrf.ts
 var ssrf3 = {
   domainsAllowlist: {
@@ -5517,7 +5450,6 @@ var xxe2 = {
 
 // src/features/analysis/scm/shared/src/storedQuestionData/java/index.ts
 var vulnerabilities14 = {
-  ["SQL_Injection"]: sqlInjection3,
   ["CMDi_relative_path_command"]: relativePathCommand,
   ["CMDi"]: commandInjection2,
   ["CONFUSING_NAMING"]: confusingNaming,
@@ -6056,13 +5988,18 @@ function getQuestionInformation({
   issueType,
   language
 }) {
-  const { name } = fixQuestionData;
+  const { name, content, description, guidance } = fixQuestionData;
   const storedQuestionDataItem = storedQuestionData_default[language]?.[issueType]?.[name] ?? {
     content: () => "",
     description: () => "",
     guidance: () => ""
   };
-  return StoredQuestionDataItemZ.parse(storedQuestionDataItem);
+  const stored = StoredQuestionDataItemZ.parse(storedQuestionDataItem);
+  return {
+    content: (args) => content || stored.content(args),
+    description: (args) => description || stored.description(args),
+    guidance: (args) => guidance || stored.guidance(args)
+  };
 }
 function curriedQuestionInformationByQuestion({
   issueType,
@@ -6125,7 +6062,8 @@ function getFixGuidances({
     },
     {}
   );
-  const fixGuidance = storeFixResult.success ? [storeFixResult.data.guidance({ questions, ...extraContext })] : [];
+  const servedFixGuidances = fixExtraContext.guidances ?? [];
+  const fixGuidance = servedFixGuidances.length > 0 ? servedFixGuidances : storeFixResult.success ? [storeFixResult.data.guidance({ questions, ...extraContext })] : [];
   return libGuidances.concat(fixGuidance).filter((guidance) => !!guidance);
 }
 var IssueTypeAndLanguageZ = z4.object({
@@ -19416,7 +19354,7 @@ function createLogger(config2) {
 
 // src/features/claude_code/hook_logger.ts
 var DD_RUM_TOKEN = true ? "pubf59c0182545bfb4c299175119f1abf9b" : "";
-var CLI_VERSION = true ? "1.4.34" : "unknown";
+var CLI_VERSION = true ? "1.4.35" : "unknown";
 var NAMESPACE = "mobbdev-claude-code-hook-logs";
 var claudeCodeVersion;
 function buildDdTags() {
@@ -20988,7 +20926,12 @@ var FixQuestionSchema = z32.object({
   inputType: z32.nativeEnum(FixQuestionInputType),
   options: z32.array(z32.string()),
   index: z32.number(),
-  extraContext: z32.array(UnstructuredFixExtraContextSchema)
+  extraContext: z32.array(UnstructuredFixExtraContextSchema),
+  // E-2015 PR5: analyzer-served question copy. default('') -> FE falls back when
+  // a query omits it, while the output type stays a required string.
+  content: z32.string().default(""),
+  description: z32.string().default(""),
+  guidance: z32.string().default("")
 });
 var FixDataSchema = z32.object({
   __typename: z32.literal("FixData"),
@@ -24718,6 +24661,12 @@ var resolveQuestionText = ({
   fix,
   question
 }) => {
+  if (question.content || question.description) {
+    return {
+      content: question.content || question.name,
+      description: question.description ?? ""
+    };
+  }
   const language = fix.safeIssueLanguage ?? void 0;
   const issueType = fix.safeIssueType ?? void 0;
   if (!language || !issueType) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "1.4.34",
+  "version": "1.4.35",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.mjs",
@@ -62,7 +62,7 @@
     "@octokit/request-error": "5.1.1",
     "@openredaction/openredaction": "1.0.4",
     "adm-zip": "0.5.17",
-    "axios": "1.16.1",
+    "axios": "1.18.1",
     "azure-devops-node-api": "15.1.2",
     "bitbucket": "2.12.0",
     "chalk": "5.6.2",
@@ -101,9 +101,9 @@
     "simple-git": "3.36.0",
     "snyk": "1.1305.0",
     "tar": "7.5.15",
-    "tmp": "0.2.6",
+    "tmp": "0.2.7",
     "tmp-promise": "3.0.3",
-    "undici": "6.24.0",
+    "undici": "6.27.0",
     "uuid": "11.1.1",
     "ws": "8.20.1",
     "xml2js": "0.6.2",