penthera 1.1.1 → 1.4.0

package/lib/fix/diff.js

@@ -0,0 +1,199 @@
+/**
+ * Minimal unified-diff support for fix recipes: create a patch from two
+ * versions of a file, parse one back, and apply its hunks to text.
+ *
+ * Recipes compute the new file content in memory and turn it into a diff here;
+ * nothing in this module touches the filesystem.
+ */
+
+const CONTEXT = 3;
+// Marks a final line that has no trailing newline, so "x" and "x\n" compare as
+// different lines (as they do in git).
+const NOEOL = "\u0000";
+
+function toLines(text) {
+  if (!text) return [];
+  const lines = text.split("\n");
+  if (lines[lines.length - 1] === "") lines.pop();
+  else lines[lines.length - 1] += NOEOL;
+  return lines;
+}
+
+function fromLines(lines) {
+  return lines.map((l, i) => (l.endsWith(NOEOL) && i === lines.length - 1 ? l.slice(0, -1) : l.replace(NOEOL, "") + "\n")).join("");
+}
+
+/** Line diff as a list of ops ({ t: " " | "-" | "+", line }). */
+function diffLines(a, b) {
+  let start = 0;
+  while (start < a.length && start < b.length && a[start] === b[start]) start++;
+  let endA = a.length;
+  let endB = b.length;
+  while (endA > start && endB > start && a[endA - 1] === b[endB - 1]) { endA--; endB--; }
+
+  const midA = a.slice(start, endA);
+  const midB = b.slice(start, endB);
+  const n = midA.length;
+  const m = midB.length;
+  // LCS table over the changed middle only; recipe edits are small and local.
+  const dp = Array.from({ length: n + 1 }, () => new Uint32Array(m + 1));
+  for (let i = n - 1; i >= 0; i--) {
+    for (let j = m - 1; j >= 0; j--) {
+      dp[i][j] = midA[i] === midB[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
+    }
+  }
+  const mid = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (midA[i] === midB[j]) { mid.push({ t: " ", line: midA[i] }); i++; j++; }
+    else if (dp[i + 1][j] >= dp[i][j + 1]) mid.push({ t: "-", line: midA[i++] });
+    else mid.push({ t: "+", line: midB[j++] });
+  }
+  while (i < n) mid.push({ t: "-", line: midA[i++] });
+  while (j < m) mid.push({ t: "+", line: midB[j++] });
+
+  return [
+    ...a.slice(0, start).map((line) => ({ t: " ", line })),
+    ...mid,
+    ...a.slice(endA).map((line) => ({ t: " ", line })),
+  ];
+}
+
+function renderLine(op) {
+  const noeol = op.line.endsWith(NOEOL);
+  const text = `${op.t}${noeol ? op.line.slice(0, -1) : op.line}`;
+  return noeol ? `${text}\n\` : text;
+}
+
+/**
+ * Unified diff for one file. `before` is null for a new file. Returns "" when
+ * nothing changed.
+ */
+export function createPatch(file, before, after) {
+  const a = toLines(before);
+  const b = toLines(after);
+  const ops = diffLines(a, b);
+  if (!ops.some((o) => o.t !== " ")) return "";
+
+  // Group changes into hunks with CONTEXT lines around each.
+  const hunks = [];
+  let current = null;
+  ops.forEach((op, idx) => {
+    if (op.t === " ") return;
+    const lo = Math.max(0, idx - CONTEXT);
+    const hi = Math.min(ops.length - 1, idx + CONTEXT);
+    if (current && lo <= current.hi + 1) current.hi = Math.max(current.hi, hi);
+    else hunks.push((current = { lo, hi }));
+  });
+
+  const out = [`--- ${before == null ? "/dev/null" : `a/${file}`}`, `+++ b/${file}`];
+  let oldNo = 1;
+  let newNo = 1;
+  let cursor = 0;
+  for (const h of hunks) {
+    for (; cursor < h.lo; cursor++) {
+      if (ops[cursor].t !== "+") oldNo++;
+      if (ops[cursor].t !== "-") newNo++;
+    }
+    const slice = ops.slice(h.lo, h.hi + 1);
+    const oldCount = slice.filter((o) => o.t !== "+").length;
+    const newCount = slice.filter((o) => o.t !== "-").length;
+    out.push(`@@ -${oldCount ? oldNo : oldNo - 1},${oldCount} +${newCount ? newNo : newNo - 1},${newCount} @@`);
+    for (const op of slice) out.push(renderLine(op));
+    for (; cursor <= h.hi; cursor++) {
+      if (ops[cursor].t !== "+") oldNo++;
+      if (ops[cursor].t !== "-") newNo++;
+    }
+  }
+  return out.join("\n") + "\n";
+}
+
+function stripPrefix(p) {
+  if (p === "/dev/null") return null;
+  return p.replace(/^[ab]\//, "").replace(/\t.*$/, "");
+}
+
+/** Parse a (multi-file) unified diff into [{ oldPath, newPath, hunks }]. */
+export function parsePatch(text) {
+  const files = [];
+  const lines = String(text || "").split("\n");
+  let file = null;
+  let hunk = null;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.startsWith("--- ") && lines[i + 1]?.startsWith("+++ ")) {
+      file = { oldPath: stripPrefix(line.slice(4).trim()), newPath: stripPrefix(lines[i + 1].slice(4).trim()), hunks: [] };
+      files.push(file);
+      hunk = null;
+      i++;
+      continue;
+    }
+    const header = line.match(/^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/);
+    if (header) {
+      if (!file) throw new Error("Malformed diff: hunk before file header");
+      hunk = {
+        oldStart: Number(header[1]),
+        oldLines: header[2] == null ? 1 : Number(header[2]),
+        newStart: Number(header[3]),
+        newLines: header[4] == null ? 1 : Number(header[4]),
+        ops: [],
+      };
+      file.hunks.push(hunk);
+      continue;
+    }
+    if (!hunk) continue;
+    if (line.startsWith("\\")) {
+      const last = hunk.ops[hunk.ops.length - 1];
+      if (last) last.line += NOEOL;
+      continue;
+    }
+    const oldSeen = hunk.ops.filter((o) => o.t !== "+").length;
+    const newSeen = hunk.ops.filter((o) => o.t !== "-").length;
+    if (oldSeen >= hunk.oldLines && newSeen >= hunk.newLines) continue; // past the hunk
+    const t = line[0];
+    if (t === " " || t === "-" || t === "+") hunk.ops.push({ t, line: line.slice(1) });
+    // Some editors strip the single space of an empty context line.
+    else if (line === "") hunk.ops.push({ t: " ", line: "" });
+  }
+  for (const f of files) {
+    for (const h of f.hunks) {
+      const oldCount = h.ops.filter((o) => o.t !== "+").length;
+      const newCount = h.ops.filter((o) => o.t !== "-").length;
+      if (oldCount !== h.oldLines || newCount !== h.newLines) {
+        throw new Error(`Malformed diff: hunk line counts do not match its header in ${f.newPath || f.oldPath}`);
+      }
+    }
+  }
+  return files;
+}
+
+function matchesAt(lines, expected, pos) {
+  if (pos < 0 || pos + expected.length > lines.length) return false;
+  for (let k = 0; k < expected.length; k++) if (lines[pos + k] !== expected[k]) return false;
+  return true;
+}
+
+/**
+ * Apply one parsed file's hunks to `text` (null for a new file). Context must
+ * match exactly; a hunk may move by a few lines but is never fuzzed. Throws if
+ * any hunk does not apply.
+ */
+export function applyHunks(text, hunks) {
+  const lines = toLines(text);
+  let offset = 0;
+  for (const h of hunks) {
+    const expected = h.ops.filter((o) => o.t !== "+").map((o) => o.line);
+    const replacement = h.ops.filter((o) => o.t !== "-").map((o) => o.line);
+    const want = (expected.length ? h.oldStart - 1 : h.oldStart) + offset;
+    let pos = -1;
+    for (let d = 0; d <= 50 && pos < 0; d++) {
+      if (matchesAt(lines, expected, want - d)) pos = want - d;
+      else if (matchesAt(lines, expected, want + d)) pos = want + d;
+    }
+    if (pos < 0) throw new Error(`Hunk @@ -${h.oldStart},${h.oldLines} @@ does not apply: the file changed since the plan was made`);
+    lines.splice(pos, expected.length, ...replacement);
+    offset += replacement.length - expected.length;
+  }
+  return fromLines(lines);
+}

package/lib/fix/index.js

@@ -0,0 +1,129 @@
+/**
+ * Fix recipes: deterministic, local fixes for common findings.
+ *
+ * A recipe is { id, matches(finding), detect(repoPath), plan(repoPath, finding,
+ * framework) } and may add probe(repoPath), a static check that reports the
+ * finding from source so a fix can be verified without a live server. plan()
+ * returns { diff, files, ownerActions, confidence } or null when it cannot find
+ * a safe anchor. Recipes never write: applyDiff() is the separate step that does.
+ */
+import { createHash } from "node:crypto";
+import headers from "./recipes/headers.js";
+import cookies from "./recipes/cookies.js";
+import cors from "./recipes/cors.js";
+import rateLimit from "./recipes/rate-limit.js";
+import secrets from "./recipes/secrets.js";
+
+export { applyDiff, assertCleanTree, FixError } from "./apply.js";
+export { createPatch, parsePatch, applyHunks } from "./diff.js";
+export { createModelFixer } from "./model.js";
+
+export const RECIPES = [headers, cookies, cors, rateLimit, secrets];
+
+const SEV_ORDER = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+
+/** Findings from every recipe's static probe (headers, cookies, CORS, auth rate limits). */
+export function probeRepo(repoPath, recipes = RECIPES) {
+  return recipes.flatMap((r) => {
+    if (!r.probe) return [];
+    try {
+      return r.probe(repoPath);
+    } catch {
+      return [];
+    }
+  });
+}
+
+export function findingKey(f) {
+  return `${f.category || ""}|${f.title || ""}|${f.url || ""}`;
+}
+
+function planId(recipeId, diff) {
+  return `${recipeId}-${createHash("sha256").update(diff).digest("hex").slice(0, 8)}`;
+}
+
+const brief = (f) => ({ title: f.title, severity: f.severity, category: f.category, url: f.url || null });
+
+/**
+ * Plan fixes for findings. Findings that resolve to the same diff (say, five
+ * missing headers fixed by one middleware) share one plan.
+ *
+ * @param {string} repoPath
+ * @param {object[]} findings
+ * @param {{ model?: { plan(repoPath, finding): Promise<object|null> }, recipes?: object[] }} [opts]
+ * @returns {Promise<{ plans: object[], unmatched: object[] }>}
+ */
+export async function planFixes(repoPath, findings, opts = {}) {
+  const recipes = opts.recipes || RECIPES;
+  const plans = new Map();
+  const unmatched = [];
+  const frameworks = new Map();
+  const sorted = [...(findings || [])].sort((a, b) => (SEV_ORDER[a.severity] ?? 5) - (SEV_ORDER[b.severity] ?? 5));
+
+  const add = (plan, finding) => {
+    const id = planId(plan.recipe, plan.diff);
+    const existing = plans.get(id);
+    if (existing) {
+      if (!existing.findings.some((f) => findingKey(f) === findingKey(finding))) existing.findings.push(brief(finding));
+      return;
+    }
+    plans.set(id, { id, ...plan, findings: [brief(finding)] });
+  };
+
+  for (const finding of sorted) {
+    let planned = false;
+    for (const recipe of recipes) {
+      if (!recipe.matches(finding)) continue;
+      if (!frameworks.has(recipe.id)) frameworks.set(recipe.id, recipe.detect(repoPath));
+      const framework = frameworks.get(recipe.id);
+      if (!framework) continue;
+      let p = null;
+      try {
+        p = recipe.plan(repoPath, finding, framework);
+      } catch {
+        p = null; // a recipe that trips over unexpected code declines rather than guessing
+      }
+      if (!p?.diff) continue;
+      add({
+        recipe: recipe.id,
+        title: recipe.title,
+        framework,
+        source: "recipe",
+        confidence: p.confidence || "medium",
+        diff: p.diff,
+        files: p.files,
+        ownerActions: p.ownerActions || [],
+        redactions: p.redactions || [],
+      }, finding);
+      planned = true;
+      break;
+    }
+    if (planned) continue;
+    if (opts.model && finding.severity !== "info") {
+      let p = null;
+      try {
+        p = await opts.model.plan(repoPath, finding);
+      } catch {
+        p = null;
+      }
+      if (p?.diff) {
+        add({ recipe: "local-model", title: "Model-suggested fix", framework: null, redactions: [], ...p }, finding);
+        continue;
+      }
+    }
+    unmatched.push(finding);
+  }
+  return { plans: [...plans.values()], unmatched };
+}
+
+/** Mask redacted values (hardcoded secrets) so a plan is safe to print or store. */
+export function redactPlan(plan) {
+  let diff = plan.diff;
+  for (const value of plan.redactions || []) {
+    if (!value) continue;
+    const mask = value.length <= 8 ? "***" : `${value.slice(0, 4)}…${value.slice(-4)}`;
+    diff = diff.split(value).join(mask);
+  }
+  const { redactions, ...rest } = plan;
+  return { ...rest, diff, redacted: Boolean(redactions?.length) };
+}

package/lib/fix/model.js

@@ -0,0 +1,108 @@
+/**
+ * Optional local-model fallback for findings no recipe matches.
+ *
+ * Talks to Ollama on this machine only (http://127.0.0.1:11434), with a model
+ * the user names via --fix-model. The host is fixed: there is no option to point
+ * it anywhere else, redirects are refused, and the URL is checked before every
+ * request. Off by default. Its output is always labelled
+ * confidence "needs-human-review" and source "local-model", and a diff that
+ * does not parse, leaves the repo, or fails to apply is dropped.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { applyDiff } from "./apply.js";
+import { parsePatch } from "./diff.js";
+import { detectFramework, walkCodeFiles, findEntryFile } from "./util.js";
+
+export const OLLAMA_ORIGIN = "http://127.0.0.1:11434";
+const MAX_CONTEXT_CHARS = 12_000;
+
+/** Throws unless `url` is the local Ollama endpoint. Exported for tests. */
+export function assertLocalModelUrl(url) {
+  const u = new URL(url);
+  if (u.origin !== OLLAMA_ORIGIN) throw new Error(`Refusing to contact ${u.origin}: the fix model may only use ${OLLAMA_ORIGIN}`);
+  return u;
+}
+
+function contextFile(repoPath, finding) {
+  const files = walkCodeFiles(repoPath);
+  if (finding.url && files.includes(finding.url)) return finding.url;
+  const fw = detectFramework(repoPath);
+  if (fw === "next") {
+    for (const f of ["next.config.mjs", "next.config.js", "next.config.ts"]) if (existsSync(join(repoPath, f))) return f;
+  }
+  return findEntryFile(repoPath, /\S/)?.file || null;
+}
+
+export function buildPrompt(finding, file, source) {
+  return [
+    "You fix one security finding in a web app. Reply with a single unified diff and nothing else.",
+    "Rules: change as little as possible; edit only the file shown unless a new file is unavoidable;",
+    "use paths relative to the repo root with a/ and b/ prefixes; add no dependencies; never invent secrets.",
+    "If you cannot fix it safely, reply with NO_FIX.",
+    "",
+    `Finding: ${JSON.stringify({ title: finding.title, category: finding.category, severity: finding.severity, description: finding.description })}`,
+    "",
+    `File: ${file}`,
+    "```",
+    source.slice(0, MAX_CONTEXT_CHARS),
+    "```",
+  ].join("\n");
+}
+
+/** Pull a unified diff out of a model reply (fenced or bare). */
+export function extractDiff(text) {
+  if (!text || /^\s*NO_FIX\b/.test(text)) return null;
+  const fenced = text.match(/```(?:diff|patch)?\s*\n([\s\S]*?)```/);
+  const body = fenced ? fenced[1] : text;
+  const start = body.search(/^--- /m);
+  if (start < 0) return null;
+  const diff = body.slice(start).trimEnd() + "\n";
+  return diff;
+}
+
+/**
+ * @param {{ model: string, fetch?: typeof fetch, timeout?: number }} opts
+ * @returns {{ model: string, plan(repoPath: string, finding: object): Promise<object|null> }}
+ */
+export function createModelFixer({ model, fetch: fetchImpl = globalThis.fetch, timeout = 120_000 } = {}) {
+  if (!model || typeof model !== "string") throw new Error("A local model name is required (--fix-model <name>)");
+  const url = assertLocalModelUrl(`${OLLAMA_ORIGIN}/api/generate`).href;
+
+  return {
+    model,
+    async plan(repoPath, finding) {
+      const file = contextFile(repoPath, finding);
+      if (!file) return null;
+      const source = readFileSync(join(repoPath, file), "utf-8");
+      assertLocalModelUrl(url);
+      const res = await fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ model, prompt: buildPrompt(finding, file, source), stream: false, options: { temperature: 0 } }),
+        redirect: "error",
+        signal: AbortSignal.timeout(timeout),
+      });
+      if (!res.ok) return null;
+      const data = await res.json();
+      const diff = extractDiff(data?.response);
+      if (!diff) return null;
+      let files;
+      try {
+        files = parsePatch(diff).map((f) => f.newPath);
+        // Validates paths stay inside the repo and every hunk applies; writes nothing.
+        applyDiff(repoPath, diff, { dryRun: true, allowDirty: true });
+      } catch {
+        return null;
+      }
+      return {
+        diff,
+        files,
+        ownerActions: ["A local model wrote this diff, not a deterministic recipe. Read every line before applying, then re-scan."],
+        confidence: "needs-human-review",
+        source: "local-model",
+        model,
+      };
+    },
+  };
+}

package/lib/fix/recipes/cookies.js

@@ -0,0 +1,130 @@
+/**
+ * Recipe: Secure, HttpOnly and SameSite on cookies set in code (Express
+ * res.cookie, Fastify reply.setCookie, Hono setCookie, Next.js cookies().set).
+ * Guidance: remediation rule "cookie", references/remediation.md#insecure-cookies.
+ *
+ * Only single-line calls with a literal cookie name and either no options or an
+ * inline options object are edited. Explicit `httpOnly: false` and the like are
+ * left alone: someone chose them, and a human should revisit that choice.
+ */
+import { detectFramework, readText, walkCodeFiles, splitCallArgs, toDiff } from "../util.js";
+
+const CALLS = [
+  { re: /\b\w+\.cookie\s*\(/g, name: 0, options: 2 }, // Express
+  { re: /\b\w+\.setCookie\s*\(/g, name: 0, options: 2 }, // Fastify (@fastify/cookie)
+  { re: /(?<![\w.$])setCookie\s*\(/g, name: 1, options: 3, sameSite: "Lax" }, // Hono (hono/cookie)
+  { re: /\b(?:cookies\(\)\)?|cookies|cookieStore)\.set\s*\(/g, name: 0, options: 2 }, // Next.js
+];
+
+const FLAGS = [
+  { key: "httpOnly", label: "HttpOnly" },
+  { key: "secure", label: "Secure" },
+  { key: "sameSite", label: "SameSite" },
+];
+
+const literal = (s) => s.match(/^(['"`])([^'"`$]+)\1$/)?.[2] ?? null;
+
+/** Every cookie-setting call in `source`, with which flags are missing. */
+function cookieCalls(source) {
+  const calls = [];
+  // Next.js: `const store = await cookies(); store.set(...)`.
+  const stores = [...source.matchAll(/(?:const|let|var)\s+(\w+)\s*=\s*(?:await\s+)?cookies\(\)/g)].map((m) => m[1]);
+  const specs = stores.length ? [...CALLS, { re: new RegExp(`\\b(?:${stores.join("|")})\\.set\\s*\\(`, "g"), name: 0, options: 2 }] : CALLS;
+  for (const spec of specs) {
+    spec.re.lastIndex = 0;
+    for (const m of source.matchAll(spec.re)) {
+      const open = m.index + m[0].length - 1;
+      const parsed = splitCallArgs(source, open);
+      if (!parsed) continue;
+      const name = parsed.args[spec.name] && literal(parsed.args[spec.name].text);
+      if (!name) continue;
+      const opt = parsed.args[spec.options];
+      if (parsed.args.length > spec.options + 1) continue;
+      if (opt && !/^\{[\s\S]*\}$/.test(opt.text)) {
+        calls.push({ name, index: m.index, fixable: false, missing: [] }); // options in a variable: can't see them
+        continue;
+      }
+      const text = opt?.text || "";
+      const missing = FLAGS.filter((f) => !new RegExp(`\\b${f.key}\\s*:`).test(text) || new RegExp(`\\b${f.key}\\s*:\\s*false\\b`).test(text));
+      const absent = FLAGS.filter((f) => !new RegExp(`\\b${f.key}\\s*:`).test(text));
+      calls.push({ name, index: m.index, spec, parsed, opt, missing, absent, fixable: parsed.args.length >= spec.options });
+    }
+  }
+  return calls.sort((a, b) => a.index - b.index);
+}
+
+function lineOf(source, index) {
+  return source.slice(0, index).split("\n").length;
+}
+
+function fixCall(source, call) {
+  const sameSite = call.spec.sameSite || "lax";
+  const adds = call.absent.map((f) => (f.key === "sameSite" ? `sameSite: "${sameSite}"` : `${f.key}: true`));
+  if (adds.length === 0) return source;
+  if (!call.opt) {
+    const last = call.parsed.args[call.parsed.args.length - 1];
+    return source.slice(0, last.end) + `, { ${adds.join(", ")} }` + source.slice(last.end);
+  }
+  const start = source.indexOf("{", call.opt.start);
+  const end = source.lastIndexOf("}", call.opt.end);
+  const inner = source.slice(start + 1, end).trim().replace(/,\s*$/, "");
+  const obj = inner ? `{ ${inner}, ${adds.join(", ")} }` : `{ ${adds.join(", ")} }`;
+  return source.slice(0, start) + obj + source.slice(end + 1);
+}
+
+function filesSettingCookies(repoPath) {
+  return walkCodeFiles(repoPath)
+    .map((file) => ({ file, source: readText(repoPath, file) }))
+    .filter((f) => f.source && /cookie|cookies/i.test(f.source));
+}
+
+export default {
+  id: "cookie-flags",
+  title: "Set Secure, HttpOnly and SameSite on cookies",
+  matches(finding) {
+    return finding.category === "cookie";
+  },
+  detect(repoPath) {
+    return detectFramework(repoPath) || "node";
+  },
+  plan(repoPath, finding) {
+    const name = (finding.title || "").match(/Cookie "([^"]+)"/)?.[1];
+    if (!name) return null;
+    const changes = [];
+    for (const { file, source } of filesSettingCookies(repoPath)) {
+      const targets = cookieCalls(source).filter((c) => c.name === name && c.fixable && c.absent.length);
+      if (targets.length === 0) continue;
+      let after = source;
+      // Edit from the end so earlier offsets stay valid.
+      for (const call of [...targets].reverse()) after = fixCall(after, call);
+      changes.push({ file, before: source, after });
+    }
+    const change = toDiff(changes);
+    if (!change) return null;
+    return {
+      ...change,
+      ownerActions: [
+        `If "${name}" must be readable from browser JavaScript or sent cross-site, revisit HttpOnly or SameSite for it; the defaults here are the safe choice for session cookies.`,
+        "Secure cookies are not sent over plain http, so local development needs https or a NODE_ENV check.",
+      ],
+      confidence: "high",
+    };
+  },
+  probe(repoPath) {
+    const findings = [];
+    for (const { file, source } of filesSettingCookies(repoPath)) {
+      for (const call of cookieCalls(source)) {
+        if (call.missing.length === 0) continue;
+        findings.push({
+          severity: /sess|token|auth|jwt|sid/i.test(call.name) ? "medium" : "low",
+          title: `Cookie "${call.name}" ${call.missing.map((f) => `missing ${f.label}`).join(", ")}`,
+          description: `Set in ${file}:${lineOf(source, call.index)}`,
+          url: file,
+          category: "cookie",
+          source: "fix-probe:cookies",
+        });
+      }
+    }
+    return findings;
+  },
+};

package/lib/fix/recipes/cors.js

@@ -0,0 +1,116 @@
+/**
+ * Recipe: replace a wildcard or reflect-any CORS policy with an explicit
+ * allowlist read from CORS_ALLOWED_ORIGINS. Guidance: remediation rule "cors",
+ * references/remediation.md#cors.
+ *
+ * Handles cors() with no options (Express `cors`, Hono `hono/cors`, Fastify
+ * `@fastify/cors` registered bare), `origin: "*"` / `origin: true` inside those
+ * calls, and the `origin || "*"` fallback the route scanner flags.
+ */
+import { detectFramework, readText, walkCodeFiles, insertAfterImports, envExampleChange, toDiff, isTypeScript } from "../util.js";
+
+const ENV = "CORS_ALLOWED_ORIGINS";
+
+function corsModule(source) {
+  return /['"](?:cors|hono\/cors|@fastify\/cors)['"]/.test(source);
+}
+
+/** [{ index, length, replacement, line }] for each wildcard CORS site in `source`. */
+function wildcardSites(source) {
+  const sites = [];
+  if (corsModule(source)) {
+    const name = source.match(/import\s+(?:\{\s*)?(\w+)(?:\s*\})?\s+from\s+['"](?:cors|hono\/cors|@fastify\/cors)['"]/)?.[1]
+      || source.match(/(?:const|let|var)\s+(?:\{\s*)?(\w+)(?:\s*\})?\s*=\s*require\(\s*['"](?:cors|@fastify\/cors)['"]\s*\)/)?.[1]
+      || "cors";
+    // cors() with no options defaults to Access-Control-Allow-Origin: *.
+    for (const m of source.matchAll(new RegExp(`\\b${name}\\(\\s*\\)`, "g"))) {
+      sites.push({ index: m.index, length: m[0].length, replacement: `${name}({ origin: allowedOrigins })` });
+    }
+    // Fastify: app.register(cors) with no options.
+    for (const m of source.matchAll(new RegExp(`\\.register\\(\\s*${name}\\s*\\)`, "g"))) {
+      sites.push({ index: m.index, length: m[0].length, replacement: `.register(${name}, { origin: allowedOrigins })` });
+    }
+    // origin: "*" or origin: true (reflects any origin) on a line that configures CORS.
+    for (const m of source.matchAll(/\borigin\s*:\s*(?:(['"])\*\1|true\b)/g)) {
+      const lineStart = source.lastIndexOf("\n", m.index) + 1;
+      const lineEnd = source.indexOf("\n", m.index);
+      const line = source.slice(lineStart, lineEnd < 0 ? undefined : lineEnd);
+      if (!new RegExp(`\\b${name}\\b`).test(line)) continue;
+      sites.push({ index: m.index, length: m[0].length, replacement: "origin: allowedOrigins" });
+    }
+  }
+  // The `origin || "*"` fallback (lib/attack-surface.js RISK:cors-wildcard).
+  for (const m of source.matchAll(/([\w$.]+(?:\.get\(\s*['"]origin['"]\s*\))?)\s*\|\|\s*(['"])\*\2/g)) {
+    const expr = m[1];
+    sites.push({ index: m.index, length: m[0].length, replacement: `(allowedOrigins.find((o) => o === ${expr}) ?? "")` });
+  }
+  return sites.sort((a, b) => a.index - b.index);
+}
+
+function helperLines(file) {
+  const ts = isTypeScript(file) ? ": string[]" : "";
+  return [
+    `// Allowed CORS origins, comma-separated in ${ENV} (added by penthera fix).`,
+    `const allowedOrigins${ts} = (process.env.${ENV} || "")`,
+    '  .split(",")',
+    "  .map((o) => o.trim())",
+    "  .filter(Boolean);",
+  ];
+}
+
+function candidateFiles(repoPath, finding) {
+  const files = walkCodeFiles(repoPath);
+  const named = finding.url && files.includes(finding.url) ? [finding.url] : files;
+  return named.map((file) => ({ file, source: readText(repoPath, file) })).filter((f) => f.source);
+}
+
+export default {
+  id: "cors-allowlist",
+  title: "Restrict CORS to an allowlist from the environment",
+  matches(finding) {
+    return finding.category === "cors" || finding.category === "cors-misconfiguration" || /cors-wildcard/i.test(finding.title || "");
+  },
+  detect(repoPath) {
+    return detectFramework(repoPath) || "node";
+  },
+  plan(repoPath, finding) {
+    const changes = [];
+    for (const { file, source } of candidateFiles(repoPath, finding)) {
+      const sites = wildcardSites(source);
+      if (sites.length === 0) continue;
+      let after = source;
+      for (const s of [...sites].reverse()) after = after.slice(0, s.index) + s.replacement + after.slice(s.index + s.length);
+      if (!/\ballowedOrigins\s*=/.test(source)) after = insertAfterImports(after, helperLines(file));
+      changes.push({ file, before: source, after });
+    }
+    if (changes.length === 0) return null;
+    changes.push(envExampleChange(repoPath, ENV, "https://app.example.com", "Comma-separated origins allowed to call this API cross-origin"));
+    const change = toDiff(changes);
+    if (!change) return null;
+    return {
+      ...change,
+      ownerActions: [
+        `Set ${ENV} in every environment to the exact origins that call this API (for example https://app.example.com). With it unset, all cross-origin requests are refused.`,
+      ],
+      confidence: "high",
+    };
+  },
+  probe(repoPath) {
+    const findings = [];
+    for (const file of walkCodeFiles(repoPath)) {
+      const source = readText(repoPath, file);
+      if (!source) continue;
+      for (const s of wildcardSites(source)) {
+        findings.push({
+          severity: "medium",
+          title: "CORS allows any origin (cors-wildcard)",
+          description: `Set in ${file}:${source.slice(0, s.index).split("\n").length}`,
+          url: file,
+          category: "cors",
+          source: "fix-probe:cors",
+        });
+      }
+    }
+    return findings;
+  },
+};