pumuki 6.3.7

package/core/facts/detectors/security/securityJwt.ts

@@ -0,0 +1,134 @@
+import { hasNode, isObject } from '../utils/astHelpers';
+
+export const hasJwtDecodeWithoutVerifyCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    return (
+      isObject(objectNode) &&
+      objectNode.type === 'Identifier' &&
+      (objectNode.name === 'jwt' || objectNode.name === 'jsonwebtoken') &&
+      isObject(propertyNode) &&
+      propertyNode.type === 'Identifier' &&
+      propertyNode.name === 'decode'
+    );
+  });
+};
+
+export const hasJwtVerifyIgnoreExpirationCall = (node: unknown): boolean => {
+  const hasIgnoreExpirationTrueOption = (candidate: unknown): boolean => {
+    return hasNode(candidate, (value) => {
+      if (value.type !== 'ObjectProperty') {
+        return false;
+      }
+
+      const keyNode = value.key;
+      const valueNode = value.value;
+      const keyMatches =
+        (isObject(keyNode) && keyNode.type === 'Identifier' && keyNode.name === 'ignoreExpiration') ||
+        (isObject(keyNode) && keyNode.type === 'StringLiteral' && keyNode.value === 'ignoreExpiration');
+      return keyMatches && isObject(valueNode) && valueNode.type === 'BooleanLiteral' && valueNode.value === true;
+    });
+  };
+
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    if (
+      !isObject(objectNode) ||
+      objectNode.type !== 'Identifier' ||
+      (objectNode.name !== 'jwt' && objectNode.name !== 'jsonwebtoken') ||
+      !isObject(propertyNode) ||
+      propertyNode.type !== 'Identifier' ||
+      propertyNode.name !== 'verify'
+    ) {
+      return false;
+    }
+
+    const args = value.arguments;
+    if (!Array.isArray(args) || args.length < 3) {
+      return false;
+    }
+
+    return hasIgnoreExpirationTrueOption(args[2]);
+  });
+};
+
+export const hasJwtSignWithoutExpirationCall = (node: unknown): boolean => {
+  const hasExpClaim = (candidate: unknown): boolean => {
+    return hasNode(candidate, (value) => {
+      if (value.type !== 'ObjectProperty') {
+        return false;
+      }
+      const keyNode = value.key;
+      return (
+        (isObject(keyNode) && keyNode.type === 'Identifier' && keyNode.name === 'exp') ||
+        (isObject(keyNode) && keyNode.type === 'StringLiteral' && keyNode.value === 'exp')
+      );
+    });
+  };
+
+  const hasExpiresInOption = (candidate: unknown): boolean => {
+    return hasNode(candidate, (value) => {
+      if (value.type !== 'ObjectProperty') {
+        return false;
+      }
+      const keyNode = value.key;
+      return (
+        (isObject(keyNode) && keyNode.type === 'Identifier' && keyNode.name === 'expiresIn') ||
+        (isObject(keyNode) && keyNode.type === 'StringLiteral' && keyNode.value === 'expiresIn')
+      );
+    });
+  };
+
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    if (
+      !isObject(objectNode) ||
+      objectNode.type !== 'Identifier' ||
+      (objectNode.name !== 'jwt' && objectNode.name !== 'jsonwebtoken') ||
+      !isObject(propertyNode) ||
+      propertyNode.type !== 'Identifier' ||
+      propertyNode.name !== 'sign'
+    ) {
+      return false;
+    }
+
+    const args = value.arguments;
+    if (!Array.isArray(args) || args.length < 2) {
+      return false;
+    }
+
+    const payloadArg = args[0];
+    const optionsArg = args[2];
+    return !hasExpClaim(payloadArg) && !hasExpiresInOption(optionsArg);
+  });
+};

package/core/facts/detectors/security/securityTls.test.ts

@@ -0,0 +1,121 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  hasTlsEnvRejectUnauthorizedZeroOverride,
+  hasTlsRejectUnauthorizedFalseOption,
+} from './securityTls';
+
+test('hasTlsRejectUnauthorizedFalseOption detecta rejectUnauthorized: false', () => {
+  const identifierKeyAst = {
+    type: 'ObjectProperty',
+    key: { type: 'Identifier', name: 'rejectUnauthorized' },
+    value: { type: 'BooleanLiteral', value: false },
+  };
+  const stringKeyAst = {
+    type: 'ObjectProperty',
+    key: { type: 'StringLiteral', value: 'rejectUnauthorized' },
+    value: { type: 'BooleanLiteral', value: false },
+  };
+  const safeAst = {
+    type: 'ObjectProperty',
+    key: { type: 'Identifier', name: 'rejectUnauthorized' },
+    value: { type: 'BooleanLiteral', value: true },
+  };
+
+  assert.equal(hasTlsRejectUnauthorizedFalseOption(identifierKeyAst), true);
+  assert.equal(hasTlsRejectUnauthorizedFalseOption(stringKeyAst), true);
+  assert.equal(hasTlsRejectUnauthorizedFalseOption(safeAst), false);
+});
+
+test('hasTlsEnvRejectUnauthorizedZeroOverride detecta process.env.NODE_TLS_REJECT_UNAUTHORIZED = 0', () => {
+  const dotNotationAst = {
+    type: 'AssignmentExpression',
+    left: {
+      type: 'MemberExpression',
+      computed: false,
+      object: {
+        type: 'MemberExpression',
+        computed: false,
+        object: { type: 'Identifier', name: 'process' },
+        property: { type: 'Identifier', name: 'env' },
+      },
+      property: { type: 'Identifier', name: 'NODE_TLS_REJECT_UNAUTHORIZED' },
+    },
+    right: { type: 'StringLiteral', value: '0' },
+  };
+  const computedNotationAst = {
+    type: 'AssignmentExpression',
+    left: {
+      type: 'MemberExpression',
+      computed: true,
+      object: {
+        type: 'MemberExpression',
+        computed: true,
+        object: { type: 'Identifier', name: 'process' },
+        property: { type: 'StringLiteral', value: 'env' },
+      },
+      property: { type: 'StringLiteral', value: 'NODE_TLS_REJECT_UNAUTHORIZED' },
+    },
+    right: { type: 'NumericLiteral', value: 0 },
+  };
+  const templateLiteralZeroAst = {
+    type: 'AssignmentExpression',
+    left: {
+      type: 'MemberExpression',
+      computed: false,
+      object: {
+        type: 'MemberExpression',
+        computed: false,
+        object: { type: 'Identifier', name: 'process' },
+        property: { type: 'Identifier', name: 'env' },
+      },
+      property: { type: 'Identifier', name: 'NODE_TLS_REJECT_UNAUTHORIZED' },
+    },
+    right: {
+      type: 'TemplateLiteral',
+      expressions: [],
+      quasis: [
+        {
+          type: 'TemplateElement',
+          value: { cooked: '0', raw: '0' },
+        },
+      ],
+    },
+  };
+  const safeValueAst = {
+    type: 'AssignmentExpression',
+    left: {
+      type: 'MemberExpression',
+      computed: false,
+      object: {
+        type: 'MemberExpression',
+        computed: false,
+        object: { type: 'Identifier', name: 'process' },
+        property: { type: 'Identifier', name: 'env' },
+      },
+      property: { type: 'Identifier', name: 'NODE_TLS_REJECT_UNAUTHORIZED' },
+    },
+    right: { type: 'StringLiteral', value: '1' },
+  };
+  const otherEnvAst = {
+    type: 'AssignmentExpression',
+    left: {
+      type: 'MemberExpression',
+      computed: false,
+      object: {
+        type: 'MemberExpression',
+        computed: false,
+        object: { type: 'Identifier', name: 'config' },
+        property: { type: 'Identifier', name: 'env' },
+      },
+      property: { type: 'Identifier', name: 'NODE_TLS_REJECT_UNAUTHORIZED' },
+    },
+    right: { type: 'StringLiteral', value: '0' },
+  };
+
+  assert.equal(hasTlsEnvRejectUnauthorizedZeroOverride(dotNotationAst), true);
+  assert.equal(hasTlsEnvRejectUnauthorizedZeroOverride(computedNotationAst), true);
+  assert.equal(hasTlsEnvRejectUnauthorizedZeroOverride(templateLiteralZeroAst), true);
+  assert.equal(hasTlsEnvRejectUnauthorizedZeroOverride(safeValueAst), false);
+  assert.equal(hasTlsEnvRejectUnauthorizedZeroOverride(otherEnvAst), false);
+});

package/core/facts/detectors/security/securityTls.ts

@@ -0,0 +1,88 @@
+import { hasNode, isObject } from '../utils/astHelpers';
+
+export const hasTlsRejectUnauthorizedFalseOption = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'ObjectProperty') {
+      return false;
+    }
+
+    const keyNode = value.key;
+    const valueNode = value.value;
+    const keyMatches =
+      (isObject(keyNode) && keyNode.type === 'Identifier' && keyNode.name === 'rejectUnauthorized') ||
+      (isObject(keyNode) && keyNode.type === 'StringLiteral' && keyNode.value === 'rejectUnauthorized');
+    return keyMatches && isObject(valueNode) && valueNode.type === 'BooleanLiteral' && valueNode.value === false;
+  });
+};
+
+export const hasTlsEnvRejectUnauthorizedZeroOverride = (node: unknown): boolean => {
+  const isZeroLikeLiteral = (candidate: unknown): boolean => {
+    if (!isObject(candidate)) {
+      return false;
+    }
+    if (candidate.type === 'StringLiteral') {
+      return candidate.value === '0';
+    }
+    if (candidate.type === 'NumericLiteral') {
+      return candidate.value === 0;
+    }
+    if (
+      candidate.type === 'TemplateLiteral' &&
+      Array.isArray(candidate.expressions) &&
+      candidate.expressions.length === 0 &&
+      Array.isArray(candidate.quasis) &&
+      candidate.quasis.length === 1
+    ) {
+      return candidate.quasis[0]?.value?.cooked === '0';
+    }
+    return false;
+  };
+
+  const isNodeTlsEnvMember = (candidate: unknown): boolean => {
+    if (!isObject(candidate) || candidate.type !== 'MemberExpression') {
+      return false;
+    }
+
+    const envMember = candidate.object;
+    const keyNode = candidate.property;
+    if (!isObject(envMember) || envMember.type !== 'MemberExpression') {
+      return false;
+    }
+
+    const processNode = envMember.object;
+    const envKeyNode = envMember.property;
+    const isProcessEnv =
+      isObject(processNode) &&
+      processNode.type === 'Identifier' &&
+      processNode.name === 'process' &&
+      ((envMember.computed === true &&
+        isObject(envKeyNode) &&
+        envKeyNode.type === 'StringLiteral' &&
+        envKeyNode.value === 'env') ||
+        (envMember.computed !== true &&
+          isObject(envKeyNode) &&
+          envKeyNode.type === 'Identifier' &&
+          envKeyNode.name === 'env'));
+    if (!isProcessEnv) {
+      return false;
+    }
+
+    return (
+      (candidate.computed === true &&
+        isObject(keyNode) &&
+        keyNode.type === 'StringLiteral' &&
+        keyNode.value === 'NODE_TLS_REJECT_UNAUTHORIZED') ||
+      (candidate.computed !== true &&
+        isObject(keyNode) &&
+        keyNode.type === 'Identifier' &&
+        keyNode.name === 'NODE_TLS_REJECT_UNAUTHORIZED')
+    );
+  };
+
+  return hasNode(node, (value) => {
+    if (value.type !== 'AssignmentExpression') {
+      return false;
+    }
+    return isNodeTlsEnvMember(value.left) && isZeroLikeLiteral(value.right);
+  });
+};

package/core/facts/detectors/text/android.test.ts

@@ -0,0 +1,87 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  hasKotlinGlobalScopeUsage,
+  hasKotlinRunBlockingUsage,
+  hasKotlinThreadSleepCall,
+} from './android';
+
+test('hasKotlinThreadSleepCall detecta Thread.sleep en codigo Kotlin real', () => {
+  const source = `
+fun waitForRetry() {
+  Thread.sleep(250)
+}
+`;
+  assert.equal(hasKotlinThreadSleepCall(source), true);
+});
+
+test('hasKotlinThreadSleepCall ignora coincidencias en comentarios y strings', () => {
+  const source = `
+// Thread.sleep(500)
+val debug = "Thread.sleep(500)"
+`;
+  assert.equal(hasKotlinThreadSleepCall(source), false);
+});
+
+test('hasKotlinGlobalScopeUsage detecta launch y async sobre GlobalScope', () => {
+  const launchSource = `
+fun loadData() {
+  GlobalScope.launch {
+    println("ok")
+  }
+}
+`;
+  const asyncSource = `
+fun loadAsync() {
+  GlobalScope.async {
+    42
+  }
+}
+`;
+  assert.equal(hasKotlinGlobalScopeUsage(launchSource), true);
+  assert.equal(hasKotlinGlobalScopeUsage(asyncSource), true);
+});
+
+test('hasKotlinGlobalScopeUsage descarta metodos no bloqueados por la regla', () => {
+  const source = `
+fun cancelScope() {
+  GlobalScope.cancel()
+}
+`;
+  assert.equal(hasKotlinGlobalScopeUsage(source), false);
+});
+
+test('hasKotlinRunBlockingUsage detecta runBlocking con llaves y con generics', () => {
+  const bracesSource = `
+fun main() {
+  runBlocking {
+    println("done")
+  }
+}
+`;
+  const genericSource = `
+fun main() {
+  runBlocking<Unit> {
+    println("done")
+  }
+}
+`;
+  assert.equal(hasKotlinRunBlockingUsage(bracesSource), true);
+  assert.equal(hasKotlinRunBlockingUsage(genericSource), true);
+});
+
+test('hasKotlinRunBlockingUsage ignora comentarios y nombres parciales', () => {
+  const commentedSource = `
+// runBlocking { println("debug") }
+val sample = "runBlocking { println(\\"debug\\") }"
+`;
+  const partialSource = `
+fun main() {
+  myrunBlocking {
+    println("done")
+  }
+}
+`;
+  assert.equal(hasKotlinRunBlockingUsage(commentedSource), false);
+  assert.equal(hasKotlinRunBlockingUsage(partialSource), false);
+});

package/core/facts/detectors/text/android.ts

@@ -0,0 +1,38 @@
+import { hasIdentifierAt, scanCodeLikeSource } from './utils';
+
+export const hasKotlinThreadSleepCall = (source: string): boolean => {
+  return scanCodeLikeSource(source, ({ source: kotlinSource, index, current }) => {
+    if (current !== 'T') {
+      return false;
+    }
+
+    return (
+      hasIdentifierAt(kotlinSource, index, 'Thread') &&
+      kotlinSource.startsWith('.sleep', index + 'Thread'.length)
+    );
+  });
+};
+
+export const hasKotlinGlobalScopeUsage = (source: string): boolean => {
+  return scanCodeLikeSource(source, ({ source: kotlinSource, index, current }) => {
+    if (current !== 'G' || !hasIdentifierAt(kotlinSource, index, 'GlobalScope')) {
+      return false;
+    }
+
+    const start = index + 'GlobalScope'.length;
+    const tail = kotlinSource.slice(start, start + 32);
+    return /^\s*\.(launch|async|produce|actor)\b/.test(tail);
+  });
+};
+
+export const hasKotlinRunBlockingUsage = (source: string): boolean => {
+  return scanCodeLikeSource(source, ({ source: kotlinSource, index, current }) => {
+    if (current !== 'r' || !hasIdentifierAt(kotlinSource, index, 'runBlocking')) {
+      return false;
+    }
+
+    const start = index + 'runBlocking'.length;
+    const tail = kotlinSource.slice(start, start + 48);
+    return /^\s*(<[^>\n]+>\s*)?(\(|\{)/.test(tail);
+  });
+};

package/core/facts/detectors/text/ios.test.ts

@@ -0,0 +1,83 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  hasSwiftAnyViewUsage,
+  hasSwiftCallbackStyleSignature,
+  hasSwiftForceCastUsage,
+  hasSwiftForceTryUsage,
+  hasSwiftForceUnwrap,
+} from './ios';
+
+test('hasSwiftForceUnwrap detecta force unwrap postfix en expresiones', () => {
+  const source = `
+let token = optionalToken!
+let value = loadUser()!
+`;
+  assert.equal(hasSwiftForceUnwrap(source), true);
+});
+
+test('hasSwiftForceUnwrap excluye type annotations, force cast y operadores', () => {
+  const source = `
+let name: String!
+let model = payload as! User
+if left != right { print("ok") }
+let flag = value!!
+`;
+  assert.equal(hasSwiftForceUnwrap(source), false);
+});
+
+test('hasSwiftAnyViewUsage detecta AnyView en codigo real', () => {
+  const source = `
+func render() -> some View {
+  AnyView(Text("hello"))
+}
+`;
+  assert.equal(hasSwiftAnyViewUsage(source), true);
+});
+
+test('hasSwiftAnyViewUsage ignora comentarios, strings y coincidencias parciales', () => {
+  const source = `\n// AnyView(Text("debug"))\nlet value = "AnyView(Text(\\"debug\\"))"\nlet customAnyViewBuilder = true\n`;
+  assert.equal(hasSwiftAnyViewUsage(source), false);
+});
+
+test('hasSwiftForceTryUsage detecta try! y descarta try?', () => {
+  const positive = `
+func load() {
+  let user = try! repository.fetch()
+}
+`;
+  const negative = `
+func load() {
+  let user = try? repository.fetch()
+}
+`;
+  assert.equal(hasSwiftForceTryUsage(positive), true);
+  assert.equal(hasSwiftForceTryUsage(negative), false);
+});
+
+test('hasSwiftForceCastUsage detecta as! y descarta as?', () => {
+  const positive = `
+let model = payload as! User
+`;
+  const negative = `
+let model = payload as? User
+`;
+  assert.equal(hasSwiftForceCastUsage(positive), true);
+  assert.equal(hasSwiftForceCastUsage(negative), false);
+});
+
+test('hasSwiftCallbackStyleSignature detecta firmas callback con @escaping', () => {
+  const completionSignature = `
+func fetch(completion: @escaping (Result<Void, Error>) -> Void) {}
+`;
+  const handlerSignature = `
+func run(handler: @MainActor @escaping () -> Void) {}
+`;
+  assert.equal(hasSwiftCallbackStyleSignature(completionSignature), true);
+  assert.equal(hasSwiftCallbackStyleSignature(handlerSignature), true);
+});
+
+test('hasSwiftCallbackStyleSignature ignora usos fuera de firmas callback', () => {
+  const source = `\n// @escaping completion: @escaping () -> Void\nlet text = "@escaping completion: @escaping () -> Void"\n`;
+  assert.equal(hasSwiftCallbackStyleSignature(source), false);
+});

package/core/facts/detectors/text/ios.ts

@@ -0,0 +1,108 @@
+import {
+  hasIdentifierAt,
+  isIdentifierCharacter,
+  nextNonWhitespaceIndex,
+  prevNonWhitespaceIndex,
+  readIdentifierBackward,
+  scanCodeLikeSource,
+} from './utils';
+
+const isLikelySwiftTypeAnnotation = (source: string, identifierStart: number): boolean => {
+  if (identifierStart <= 0) {
+    return false;
+  }
+
+  const before = prevNonWhitespaceIndex(source, identifierStart - 1);
+  return before >= 0 && source[before] === ':';
+};
+
+const isForceUnwrapAt = (source: string, index: number): boolean => {
+  const previousIndex = prevNonWhitespaceIndex(source, index - 1);
+  if (previousIndex < 0) {
+    return false;
+  }
+
+  const nextIndex = nextNonWhitespaceIndex(source, index + 1);
+  if (nextIndex >= 0 && (source[nextIndex] === '=' || source[nextIndex] === '!')) {
+    return false;
+  }
+
+  const previousChar = source[previousIndex];
+  const previousIdentifier = readIdentifierBackward(source, previousIndex);
+  if (previousIdentifier.value === 'as') {
+    return false;
+  }
+  if (
+    previousIdentifier.start >= 0 &&
+    isLikelySwiftTypeAnnotation(source, previousIdentifier.start)
+  ) {
+    return false;
+  }
+
+  const isPostfixToken =
+    isIdentifierCharacter(previousChar) ||
+    previousChar === ')' ||
+    previousChar === ']' ||
+    previousChar === '}';
+  if (!isPostfixToken) {
+    return false;
+  }
+
+  return true;
+};
+
+export const hasSwiftForceUnwrap = (source: string): boolean => {
+  return scanCodeLikeSource(source, ({ source: swiftSource, index, current }) => {
+    return current === '!' && isForceUnwrapAt(swiftSource, index);
+  });
+};
+
+export const hasSwiftAnyViewUsage = (source: string): boolean => {
+  return scanCodeLikeSource(source, ({ source: swiftSource, index, current }) => {
+    if (current !== 'A') {
+      return false;
+    }
+
+    return hasIdentifierAt(swiftSource, index, 'AnyView');
+  });
+};
+
+export const hasSwiftForceTryUsage = (source: string): boolean => {
+  return scanCodeLikeSource(source, ({ source: swiftSource, index, current }) => {
+    if (current !== 't' || !hasIdentifierAt(swiftSource, index, 'try')) {
+      return false;
+    }
+
+    const bangIndex = nextNonWhitespaceIndex(swiftSource, index + 'try'.length);
+    return bangIndex >= 0 && swiftSource[bangIndex] === '!';
+  });
+};
+
+export const hasSwiftForceCastUsage = (source: string): boolean => {
+  return scanCodeLikeSource(source, ({ source: swiftSource, index, current }) => {
+    if (current !== 'a' || !hasIdentifierAt(swiftSource, index, 'as')) {
+      return false;
+    }
+
+    const bangIndex = nextNonWhitespaceIndex(swiftSource, index + 'as'.length);
+    return bangIndex >= 0 && swiftSource[bangIndex] === '!';
+  });
+};
+
+export const hasSwiftCallbackStyleSignature = (source: string): boolean => {
+  return scanCodeLikeSource(source, ({ source: swiftSource, index, current }) => {
+    if (current !== '@' || !swiftSource.startsWith('@escaping', index)) {
+      return false;
+    }
+
+    const segmentStart = Math.max(0, index - 180);
+    const segmentEnd = Math.min(swiftSource.length, index + 260);
+    const segment = swiftSource.slice(segmentStart, segmentEnd);
+
+    return (
+      /\b(?:completion|handler|callback)\s*:\s*(?:@[A-Za-z0-9_]+\s+)?@escaping\b/.test(
+        segment
+      ) || /\bfunc\b[\s\S]{0,180}@escaping[\s\S]{0,120}->\s*Void\b/.test(segment)
+    );
+  });
+};