pr-checkmate 1.22.8 → 1.23.1

package/dist/core/checks/diff-security.js

@@ -1,145 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.diffSecurityCheck = void 0;
-const utils_1 = require("../../utils");
-const types_1 = require("../types");
-const findings_1 = require("./findings");
-const SECURITY_PATTERNS = [
-    {
-        pattern: /^\+(?!\+).*dangerouslySetInnerHTML\s*=/,
-        label: 'dangerouslySetInnerHTML (XSS risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\.innerHTML\s*=/,
-        label: 'innerHTML assignment (XSS risk)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*document\.write\s*\(/,
-        label: 'document.write() (XSS risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+)(?![^'"`]*['"`]).*\beval\s*\(/,
-        label: 'eval() (code injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\bnew\s+Function\s*\(/,
-        label: 'new Function() (code injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*__proto__\s*[=:[]/,
-        label: '__proto__ mutation (prototype pollution)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\.constructor\.prototype\b/,
-        label: 'constructor.prototype access (prototype pollution)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]md5['"]/,
-        label: 'MD5 (weak hash — use sha256 or stronger)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]sha1['"]/,
-        label: 'SHA-1 (weak hash — use sha256 or stronger)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*\bcreateDecipher\s*\(/,
-        label: 'deprecated createDecipher() — use createDecipheriv()',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*\bcreateCipher\s*\(/,
-        label: 'deprecated createCipher() — use createCipheriv()',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/,
-        label: "CORS wildcard origin: '*' (allows any domain)",
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/,
-        label: "Access-Control-Allow-Origin: '*' header (CORS wildcard)",
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|http\.get|http\.request)\s*\(\s*['"]http:\/\//,
-        label: 'Insecure HTTP (non-HTTPS) in external call',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*(exec|execSync|spawn|spawnSync)\s*\(\s*`[^`]*\$\{/,
-        label: 'exec/spawn with template literal (command injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*(exec|execSync)\s*\(\s*['"][^'"]*['"\s]*\+/,
-        label: 'exec/spawn with string concatenation (command injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\b(query|execute|raw)\s*\(\s*`[^`]*\$\{/,
-        label: 'SQL query with template literal interpolation (SQL injection risk)',
-        severity: 'error',
-    },
-    {
-        // A quoted string that contains a whole SQL keyword, concatenated with a
-        // variable — the real injection shape. Word boundaries + the quote context
-        // stop identifiers like `insertions + deletions` from false-positiving.
-        pattern: /^\+(?!\+).*['"`][^'"`]*\b(SELECT|INSERT|UPDATE|DELETE|WHERE)\b[^'"`]*['"`]\s*\+\s*\w/i,
-        label: 'SQL string concatenation (SQL injection risk)',
-        severity: 'error',
-    },
-];
-/** Bucket added-line matches by severity, keyed by pattern label. */
-function scanDiff(stdout) {
-    const errors = {};
-    const warnings = {};
-    for (const line of stdout.split('\n')) {
-        for (const { pattern, label, severity } of SECURITY_PATTERNS) {
-            if (pattern.test(line)) {
-                const bucket = severity === 'error' ? errors : warnings;
-                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
-            }
-        }
-    }
-    return { errors, warnings };
-}
-exports.diffSecurityCheck = {
-    name: 'Diff Security',
-    phase: 'informational',
-    applies(ctx) {
-        return ctx.config.diffSecurity?.enabled !== false && Boolean(ctx.baseSha);
-    },
-    async run(ctx) {
-        try {
-            const stdout = await (0, findings_1.diffAddedLines)(ctx, [
-                '*.ts',
-                '*.tsx',
-                '*.js',
-                '*.jsx',
-                '*.mjs',
-                '*.cjs',
-            ]);
-            const { errors, warnings } = scanDiff(stdout);
-            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
-                prefix: 'Diff Security',
-                errorSummary: n => `${n} issue(s)`,
-                warningSummary: n => `${n} warning(s)`,
-                sampleLimit: 3,
-            });
-        }
-        catch (err) {
-            utils_1.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
-        }
-    },
-};