pumuki 6.3.339 → 6.3.340

package/core/facts/detectors/text/ios.test.ts

@@ -1979,12 +1979,21 @@ final class Credentials {
   let label = "public title"
   // let apiKey = "sk_live_123456789"
 }
+`;
+  const emptyFormDefaults = `
+@MainActor
+public final class BuyerAppViewModel {
+  public var authEmail: String = ""
+  public var authPassword: String = ""
+}
 `;
 
   assert.equal(hasSwiftHardcodedSensitiveStringUsage(source), true);
   assert.deepEqual(collectSwiftHardcodedSensitiveStringLines(source), [3, 4]);
   assert.equal(hasSwiftHardcodedSensitiveStringUsage(safe), false);
   assert.deepEqual(collectSwiftHardcodedSensitiveStringLines(safe), []);
+  assert.equal(hasSwiftHardcodedSensitiveStringUsage(emptyFormDefaults), false);
+  assert.deepEqual(collectSwiftHardcodedSensitiveStringLines(emptyFormDefaults), []);
 });
 
 test('hasSwiftUnlocalizedDateFormatterUsage detecta dateFormat fijo sin locale explicito', () => {

package/core/facts/detectors/text/ios.ts

@@ -1718,18 +1718,26 @@ export const collectSwiftSensitiveLoggingLines = (source: string): readonly numb
   return sortedUniqueLines(lines);
 };
 
-export const hasSwiftHardcodedSensitiveStringUsage = (source: string): boolean => {
-  return collectSwiftRegexLines(
-    source,
-    /\b(?:(?:private|fileprivate|internal|public|open|static|class|final|lazy)\s+)*(?:let|var)\s+(?=[A-Za-z_])[A-Za-z0-9_]*(?:token|secret|password|apikey|clientsecret|privatekey|sessionid)[A-Za-z0-9_]*\s*(?::\s*String\s*)?=\s*""/i
-  ).length > 0;
-};
+const swiftHardcodedSensitiveStringPattern =
+  /\b(?:(?:private|fileprivate|internal|public|open|static|class|final|lazy)\s+)*(?:let|var)\s+(?=[A-Za-z_])[A-Za-z0-9_]*(?:token|secret|password|apikey|clientsecret|privatekey|sessionid)[A-Za-z0-9_]*\s*(?::\s*String\s*)?=\s*"((?:\\.|[^"\\])*)"/i;
 
 export const collectSwiftHardcodedSensitiveStringLines = (source: string): readonly number[] => {
-  return collectSwiftRegexLines(
-    source,
-    /\b(?:(?:private|fileprivate|internal|public|open|static|class|final|lazy)\s+)*(?:let|var)\s+(?=[A-Za-z_])[A-Za-z0-9_]*(?:token|secret|password|apikey|clientsecret|privatekey|sessionid)[A-Za-z0-9_]*\s*(?::\s*String\s*)?=\s*""/i
-  );
+  const matches: number[] = [];
+
+  source.split(/\r?\n/).forEach((rawLine, index) => {
+    const line = rawLine.replace(/\/\/.*$/, '');
+    const match = swiftHardcodedSensitiveStringPattern.exec(line);
+    const literalValue = match?.[1] ?? '';
+    if (literalValue.length > 0) {
+      matches.push(index + 1);
+    }
+  });
+
+  return matches;
+};
+
+export const hasSwiftHardcodedSensitiveStringUsage = (source: string): boolean => {
+  return collectSwiftHardcodedSensitiveStringLines(source).length > 0;
 };
 
 export const hasSwiftUnlocalizedDateFormatterUsage = (source: string): boolean => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.339",
+  "version": "6.3.340",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {