sdlc-agent-4-enterprise-server 1.0.0

package/dist/engine/analyzers/security/dataflow/DataFlowAnalyzer.js

@@ -0,0 +1,61 @@
+/**
+ * KSA-164: Data Flow Analyzer — Computes def-use chains from CFG + reaching definitions.
+ */
+import { ReachingDefinitions } from './ReachingDefinitions.js';
+export class DataFlowAnalyzer {
+    reachingDefs = new ReachingDefinitions();
+    /** Analyze data flow for a control flow graph. */
+    analyze(cfg) {
+        const reaching = this.reachingDefs.compute(cfg);
+        const allDefs = this.collectAllDefinitions(cfg);
+        const chains = this.buildDefUseChains(cfg, reaching, allDefs);
+        return {
+            reachingDefs: reaching,
+            defUseChains: chains,
+            definitions: allDefs,
+        };
+    }
+    /** Collect all definitions across all blocks. */
+    collectAllDefinitions(cfg) {
+        const defs = [];
+        let id = 0;
+        for (const block of cfg.blocks) {
+            for (const varDef of block.getDefinitions()) {
+                defs.push({
+                    variable: varDef.name,
+                    line: varDef.line,
+                    blockId: block.id,
+                    id: id++,
+                });
+            }
+        }
+        return defs;
+    }
+    /** Build def-use chains: for each definition, find all uses that it reaches. */
+    buildDefUseChains(cfg, reaching, allDefs) {
+        const chains = [];
+        for (const def of allDefs) {
+            const uses = [];
+            for (const block of cfg.blocks) {
+                const reachingHere = reaching.get(block.id);
+                if (!reachingHere)
+                    continue;
+                // Check if this definition reaches this block
+                const reaches = Array.from(reachingHere).some(d => d.variable === def.variable && d.line === def.line && d.blockId === def.blockId);
+                if (!reaches)
+                    continue;
+                // Find uses of this variable in the block
+                for (const use of block.getUses()) {
+                    if (use.name === def.variable) {
+                        uses.push({ line: use.line, blockId: block.id });
+                    }
+                }
+            }
+            if (uses.length > 0) {
+                chains.push({ definition: def, uses });
+            }
+        }
+        return chains;
+    }
+}
+//# sourceMappingURL=DataFlowAnalyzer.js.map

package/dist/engine/analyzers/security/dataflow/DataFlowAnalyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DataFlowAnalyzer.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/dataflow/DataFlowAnalyzer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,OAAO,gBAAgB;IACnB,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAEjD,kDAAkD;IAClD,OAAO,CAAC,GAAqB;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAE9D,OAAO;YACL,YAAY,EAAE,QAAQ;YACtB,YAAY,EAAE,MAAM;YACpB,WAAW,EAAE,OAAO;SACrB,CAAC;IACJ,CAAC;IAED,iDAAiD;IACzC,qBAAqB,CAAC,GAAqB;QACjD,MAAM,IAAI,GAAiB,EAAE,CAAC;QAC9B,IAAI,EAAE,GAAG,CAAC,CAAC;QACX,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC5C,IAAI,CAAC,IAAI,CAAC;oBACR,QAAQ,EAAE,MAAM,CAAC,IAAI;oBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,EAAE,EAAE,EAAE,EAAE;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gFAAgF;IACxE,iBAAiB,CACvB,GAAqB,EACrB,QAAsC,EACtC,OAAqB;QAErB,MAAM,MAAM,GAAkB,EAAE,CAAC;QAEjC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,GAA6C,EAAE,CAAC;YAE1D,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/B,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC5C,IAAI,CAAC,YAAY;oBAAE,SAAS;gBAE5B,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,CACrF,CAAC;gBACF,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,0CAA0C;gBAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAClC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;wBAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/engine/analyzers/security/dataflow/ReachingDefinitions.d.ts

@@ -0,0 +1,16 @@
+/**
+ * KSA-164: Reaching Definitions — Iterative dataflow algorithm.
+ * Computes which definitions reach each basic block.
+ */
+import { ControlFlowGraph } from '../cfg/ControlFlowGraph.js';
+import type { Definition } from '../types.js';
+export declare class ReachingDefinitions {
+    private defCounter;
+    /** Compute reaching definitions for all blocks in the CFG. */
+    compute(cfg: ControlFlowGraph): Map<number, Set<Definition>>;
+    /** GEN set: definitions created in this block. */
+    private gen;
+    /** Check if a block kills a definition (redefines the same variable). */
+    private kills;
+    private setsEqual;
+}

package/dist/engine/analyzers/security/dataflow/ReachingDefinitions.js

@@ -0,0 +1,79 @@
+/**
+ * KSA-164: Reaching Definitions — Iterative dataflow algorithm.
+ * Computes which definitions reach each basic block.
+ */
+export class ReachingDefinitions {
+    defCounter = 0;
+    /** Compute reaching definitions for all blocks in the CFG. */
+    compute(cfg) {
+        const IN = new Map();
+        const OUT = new Map();
+        // Initialize
+        for (const block of cfg.blocks) {
+            IN.set(block.id, new Set());
+            OUT.set(block.id, this.gen(block));
+        }
+        // Iterate until fixed point
+        let changed = true;
+        let iterations = 0;
+        const MAX_ITERATIONS = 100;
+        while (changed && iterations < MAX_ITERATIONS) {
+            changed = false;
+            iterations++;
+            for (const block of cfg.reversePostOrder()) {
+                // IN[B] = union of OUT[P] for all predecessors P
+                const newIN = new Set();
+                for (const pred of cfg.getPredecessors(block)) {
+                    const predOut = OUT.get(pred.id);
+                    if (predOut) {
+                        for (const def of predOut)
+                            newIN.add(def);
+                    }
+                }
+                IN.set(block.id, newIN);
+                // OUT[B] = GEN[B] union (IN[B] - KILL[B])
+                const genSet = this.gen(block);
+                const newOUT = new Set(genSet);
+                for (const def of newIN) {
+                    if (!this.kills(block, def)) {
+                        newOUT.add(def);
+                    }
+                }
+                const oldOUT = OUT.get(block.id);
+                if (!this.setsEqual(oldOUT, newOUT)) {
+                    OUT.set(block.id, newOUT);
+                    changed = true;
+                }
+            }
+        }
+        return IN;
+    }
+    /** GEN set: definitions created in this block. */
+    gen(block) {
+        const defs = new Set();
+        for (const varDef of block.getDefinitions()) {
+            defs.add({
+                variable: varDef.name,
+                line: varDef.line,
+                blockId: block.id,
+                id: this.defCounter++,
+            });
+        }
+        return defs;
+    }
+    /** Check if a block kills a definition (redefines the same variable). */
+    kills(block, def) {
+        const blockDefs = block.getDefinitions();
+        return blockDefs.some(d => d.name === def.variable && d.blockId === block.id);
+    }
+    setsEqual(a, b) {
+        if (a.size !== b.size)
+            return false;
+        for (const item of a) {
+            if (!b.has(item))
+                return false;
+        }
+        return true;
+    }
+}
+//# sourceMappingURL=ReachingDefinitions.js.map

package/dist/engine/analyzers/security/dataflow/ReachingDefinitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ReachingDefinitions.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/dataflow/ReachingDefinitions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,OAAO,mBAAmB;IACtB,UAAU,GAAG,CAAC,CAAC;IAEvB,8DAA8D;IAC9D,OAAO,CAAC,GAAqB;QAC3B,MAAM,EAAE,GAAG,IAAI,GAAG,EAA2B,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAC;QAE/C,aAAa;QACb,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,cAAc,GAAG,GAAG,CAAC;QAE3B,OAAO,OAAO,IAAI,UAAU,GAAG,cAAc,EAAE,CAAC;YAC9C,OAAO,GAAG,KAAK,CAAC;YAChB,UAAU,EAAE,CAAC;YAEb,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC;gBAC3C,iDAAiD;gBACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAc,CAAC;gBACpC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACjC,IAAI,OAAO,EAAE,CAAC;wBACZ,KAAK,MAAM,GAAG,IAAI,OAAO;4BAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;gBACD,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAExB,0CAA0C;gBAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAa,MAAM,CAAC,CAAC;gBAC3C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;oBACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;wBAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;oBACpC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;oBAC1B,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,kDAAkD;IAC1C,GAAG,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAc,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,GAAG,CAAC;gBACP,QAAQ,EAAE,MAAM,CAAC,IAAI;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,KAAiB,EAAE,GAAe;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAEO,SAAS,CAAC,CAAkB,EAAE,CAAkB;QACtD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/engine/analyzers/security/idor/IDORDetector.d.ts

@@ -0,0 +1,21 @@
+/**
+ * KSA-166: IDOR Detector — Detects Insecure Direct Object Reference vulnerabilities.
+ */
+import { TaintAnalyzer } from '../taint/TaintAnalyzer.js';
+import type { SyntaxNode } from '../../../parsers/types.js';
+import type { IDORFinding } from '../types.js';
+export declare class IDORDetector {
+    private taintAnalyzer;
+    constructor(taintAnalyzer?: TaintAnalyzer);
+    /** Detect IDOR in a handler function. */
+    detect(functionNode: SyntaxNode, filePath: string, language: string, handlerName: string): IDORFinding[];
+    /** Find parameters that look like object IDs. */
+    private findIDParams;
+    /** Find database lookup using the ID parameter. */
+    private findDBLookup;
+    /** Check if there's an authorization check for the given parameter. */
+    private hasAuthorizationCheck;
+    /** Classify trust tier based on directness. */
+    private classifyTrustTier;
+    private isNearby;
+}

package/dist/engine/analyzers/security/idor/IDORDetector.js

@@ -0,0 +1,124 @@
+/**
+ * KSA-166: IDOR Detector — Detects Insecure Direct Object Reference vulnerabilities.
+ */
+import { TaintAnalyzer } from '../taint/TaintAnalyzer.js';
+/** Patterns indicating a parameter is an object ID. */
+const ID_PARAM_PATTERNS = [
+    /id$/i, /Id$/, /_id$/i, /Id\b/, /uuid/i, /key$/i, /slug/i,
+    /params\.id/, /params\.\w+Id/, /params\.\w+_id/,
+];
+/** Patterns indicating a database lookup. */
+const DB_LOOKUP_PATTERNS = [
+    'findById(', 'findOne(', 'findByPk(', 'get(', '.find(',
+    'findUnique(', 'findFirst(', 'getOne(', 'load(',
+    'SELECT', 'WHERE', 'query(',
+];
+/** Patterns indicating authorization/ownership check. */
+const AUTHZ_PATTERNS = [
+    'owner', 'user_id', 'userId', 'createdBy', 'belongsTo',
+    'canAccess', 'isOwner', 'hasPermission', 'authorize',
+    'checkAccess', 'verifyOwnership', 'req.user.id',
+    'currentUser', 'session.user',
+];
+export class IDORDetector {
+    taintAnalyzer;
+    constructor(taintAnalyzer) {
+        this.taintAnalyzer = taintAnalyzer ?? new TaintAnalyzer();
+    }
+    /** Detect IDOR in a handler function. */
+    detect(functionNode, filePath, language, handlerName) {
+        const findings = [];
+        const bodyText = functionNode.text;
+        // Step 1: Find ID parameters
+        const idParams = this.findIDParams(functionNode);
+        if (idParams.length === 0)
+            return [];
+        // Step 2: For each ID param, check if there's a DB lookup
+        for (const param of idParams) {
+            const dbLookup = this.findDBLookup(bodyText, param);
+            if (!dbLookup)
+                continue;
+            // Step 3: Check if there's an authorization check between param and lookup
+            const hasAuthz = this.hasAuthorizationCheck(bodyText, param);
+            if (!hasAuthz) {
+                const trustTier = this.classifyTrustTier(bodyText, param);
+                findings.push({
+                    handler: handlerName,
+                    filePath,
+                    idParam: param,
+                    dbLookup,
+                    missingAuthzCheck: true,
+                    trustTier,
+                    confidence: trustTier === 'T1' ? 90 : trustTier === 'T2' ? 70 : 50,
+                    cwe: 'CWE-639',
+                    severity: trustTier === 'T1' ? 'High' : 'Medium',
+                });
+            }
+        }
+        return findings;
+    }
+    /** Find parameters that look like object IDs. */
+    findIDParams(functionNode) {
+        const params = [];
+        const text = functionNode.text;
+        for (const pattern of ID_PARAM_PATTERNS) {
+            const matches = text.match(new RegExp(pattern.source, 'g'));
+            if (matches) {
+                for (const match of matches) {
+                    if (!params.includes(match))
+                        params.push(match);
+                }
+            }
+        }
+        return params;
+    }
+    /** Find database lookup using the ID parameter. */
+    findDBLookup(bodyText, param) {
+        for (const pattern of DB_LOOKUP_PATTERNS) {
+            const idx = bodyText.indexOf(pattern);
+            if (idx !== -1) {
+                // Check if the param is used near the lookup
+                const context = bodyText.slice(Math.max(0, idx - 50), idx + 100);
+                if (context.includes(param) || this.isNearby(bodyText, idx, param)) {
+                    const line = bodyText.slice(0, idx).split('\n').length;
+                    return { function: pattern.replace('(', ''), line };
+                }
+            }
+        }
+        return null;
+    }
+    /** Check if there's an authorization check for the given parameter. */
+    hasAuthorizationCheck(bodyText, param) {
+        for (const pattern of AUTHZ_PATTERNS) {
+            if (bodyText.includes(pattern))
+                return true;
+        }
+        return false;
+    }
+    /** Classify trust tier based on directness. */
+    classifyTrustTier(bodyText, param) {
+        // T1: param goes directly to DB lookup (no intermediate processing)
+        const lines = bodyText.split('\n');
+        let paramLine = -1;
+        let lookupLine = -1;
+        for (let i = 0; i < lines.length; i++) {
+            if (lines[i].includes(param) && paramLine === -1)
+                paramLine = i;
+            if (DB_LOOKUP_PATTERNS.some(p => lines[i].includes(p)))
+                lookupLine = i;
+        }
+        if (paramLine >= 0 && lookupLine >= 0) {
+            const distance = Math.abs(lookupLine - paramLine);
+            if (distance <= 2)
+                return 'T1';
+            if (distance <= 5)
+                return 'T2';
+        }
+        return 'T3';
+    }
+    isNearby(text, idx, param) {
+        const window = text.slice(Math.max(0, idx - 200), idx + 200);
+        return window.includes(param);
+    }
+}
+//# sourceMappingURL=IDORDetector.js.map

package/dist/engine/analyzers/security/idor/IDORDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDORDetector.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/idor/IDORDetector.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAI1D,uDAAuD;AACvD,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;IACzD,YAAY,EAAE,eAAe,EAAE,gBAAgB;CAChD,CAAC;AAEF,6CAA6C;AAC7C,MAAM,kBAAkB,GAAG;IACzB,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ;IACtD,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO;IAC/C,QAAQ,EAAE,OAAO,EAAE,QAAQ;CAC5B,CAAC;AAEF,yDAAyD;AACzD,MAAM,cAAc,GAAG;IACrB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW;IACtD,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW;IACpD,aAAa,EAAE,iBAAiB,EAAE,aAAa;IAC/C,aAAa,EAAE,cAAc;CAC9B,CAAC;AAEF,MAAM,OAAO,YAAY;IACf,aAAa,CAAgB;IAErC,YAAY,aAA6B;QACvC,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,IAAI,aAAa,EAAE,CAAC;IAC5D,CAAC;IAED,yCAAyC;IACzC,MAAM,CACJ,YAAwB,EACxB,QAAgB,EAChB,QAAgB,EAChB,WAAmB;QAEnB,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC;QAEnC,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAErC,0DAA0D;QAC1D,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,WAAW;oBACpB,QAAQ;oBACR,OAAO,EAAE,KAAK;oBACd,QAAQ;oBACR,iBAAiB,EAAE,IAAI;oBACvB,SAAS;oBACT,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBAClE,GAAG,EAAE,SAAS;oBACd,QAAQ,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,iDAAiD;IACzC,YAAY,CAAC,YAAwB;QAC3C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;QAE/B,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5D,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;wBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mDAAmD;IAC3C,YAAY,CAAC,QAAgB,EAAE,KAAa;QAClD,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,6CAA6C;gBAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;gBACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;oBACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;oBACvD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IAC/D,qBAAqB,CAAC,QAAgB,EAAE,KAAa;QAC3D,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+CAA+C;IACvC,iBAAiB,CAAC,QAAgB,EAAE,KAAa;QACvD,oEAAoE;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;QACnB,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;QAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,CAAC;gBAAE,SAAS,GAAG,CAAC,CAAC;YAChE,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,UAAU,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;YAClD,IAAI,QAAQ,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/B,IAAI,QAAQ,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/engine/analyzers/security/injection/InjectionScanner.d.ts

@@ -0,0 +1,28 @@
+/**
+ * KSA-165: Injection Scanner — Main orchestrator for injection detection.
+ */
+import type { SyntaxNode } from '../../../parsers/types.js';
+import { TaintAnalyzer } from '../taint/TaintAnalyzer.js';
+import type { Finding, ScanOptions, ScanResult } from '../types.js';
+export declare class InjectionScanner {
+    private taintAnalyzer;
+    private matchers;
+    private suppressionChecker;
+    constructor(taintAnalyzer?: TaintAnalyzer);
+    /** Scan a function AST node for injection vulnerabilities. */
+    scanFunction(functionNode: SyntaxNode, filePath: string, language: string, sourceLines: string[], functionName?: string): Finding[];
+    /** Scan multiple functions and aggregate results. */
+    scanFunctions(functions: Array<{
+        node: SyntaxNode;
+        name: string;
+    }>, filePath: string, language: string, sourceLines: string[], options?: ScanOptions): ScanResult;
+    /** Get all registered patterns (for SARIF rule generation). */
+    getAllPatterns(): Array<{
+        category: string;
+        patterns: import('../types.js').InjectionPattern[];
+    }>;
+    private meetsThreshold;
+    private countBySeverity;
+    private countByCategory;
+    private emptyResult;
+}

package/dist/engine/analyzers/security/injection/InjectionScanner.js

@@ -0,0 +1,134 @@
+/**
+ * KSA-165: Injection Scanner — Main orchestrator for injection detection.
+ */
+import { TaintAnalyzer } from '../taint/TaintAnalyzer.js';
+import { SuppressionChecker } from './SuppressionChecker.js';
+import { SQLInjectionMatcher } from './patterns/SQLInjectionMatcher.js';
+import { XSSMatcher } from './patterns/XSSMatcher.js';
+import { CommandInjectionMatcher } from './patterns/CommandInjectionMatcher.js';
+import { PathTraversalMatcher } from './patterns/PathTraversalMatcher.js';
+import { DeserializationMatcher } from './patterns/DeserializationMatcher.js';
+import { LDAPXMLMatcher } from './patterns/LDAPXMLMatcher.js';
+export class InjectionScanner {
+    taintAnalyzer;
+    matchers;
+    suppressionChecker;
+    constructor(taintAnalyzer) {
+        this.taintAnalyzer = taintAnalyzer ?? new TaintAnalyzer();
+        this.suppressionChecker = new SuppressionChecker();
+        this.matchers = [
+            new SQLInjectionMatcher(),
+            new XSSMatcher(),
+            new CommandInjectionMatcher(),
+            new PathTraversalMatcher(),
+            new DeserializationMatcher(),
+            new LDAPXMLMatcher(),
+        ];
+    }
+    /** Scan a function AST node for injection vulnerabilities. */
+    scanFunction(functionNode, filePath, language, sourceLines, functionName) {
+        // Run taint analysis
+        const taintResult = this.taintAnalyzer.analyze(functionNode, language);
+        if (taintResult.paths.length === 0)
+            return [];
+        const context = {
+            filePath,
+            functionName: functionName ?? 'anonymous',
+            language,
+        };
+        const findings = [];
+        // Match each taint path against all patterns
+        for (const path of taintResult.paths) {
+            for (const matcher of this.matchers) {
+                const finding = matcher.match(path, context);
+                if (finding) {
+                    // Check suppression
+                    const suppression = this.suppressionChecker.isSuppressed(sourceLines, path.sink.line);
+                    if (suppression) {
+                        finding.suppressed = true;
+                        finding.suppressionInfo = suppression;
+                    }
+                    findings.push(finding);
+                    break; // One finding per path (first match wins)
+                }
+            }
+        }
+        return findings;
+    }
+    /** Scan multiple functions and aggregate results. */
+    scanFunctions(functions, filePath, language, sourceLines, options = {}) {
+        const startTime = Date.now();
+        const allFindings = [];
+        const suppressed = [];
+        // Check file-level suppression
+        if (this.suppressionChecker.isFileSuppressed(sourceLines)) {
+            return this.emptyResult(1, Date.now() - startTime);
+        }
+        for (const fn of functions) {
+            const findings = this.scanFunction(fn.node, filePath, language, sourceLines, fn.name);
+            for (const finding of findings) {
+                // Apply severity threshold
+                if (options.severityThreshold && !this.meetsThreshold(finding.severity, options.severityThreshold)) {
+                    continue;
+                }
+                // Apply category filter
+                if (options.categories && !options.categories.includes(finding.category)) {
+                    continue;
+                }
+                if (finding.suppressed) {
+                    suppressed.push(finding);
+                }
+                else {
+                    allFindings.push(finding);
+                }
+            }
+        }
+        const duration = Date.now() - startTime;
+        return {
+            findings: allFindings,
+            suppressed: options.includeSuppressed ? suppressed : [],
+            summary: {
+                total: allFindings.length,
+                bySeverity: this.countBySeverity(allFindings),
+                byCategory: this.countByCategory(allFindings),
+                filesScanned: 1,
+                scanDuration: duration,
+            },
+        };
+    }
+    /** Get all registered patterns (for SARIF rule generation). */
+    getAllPatterns() {
+        return this.matchers.map(m => ({ category: m.category, patterns: m.patterns }));
+    }
+    meetsThreshold(severity, threshold) {
+        const order = ['Critical', 'High', 'Medium', 'Low', 'Info'];
+        return order.indexOf(severity) <= order.indexOf(threshold);
+    }
+    countBySeverity(findings) {
+        const counts = { Critical: 0, High: 0, Medium: 0, Low: 0, Info: 0 };
+        for (const f of findings)
+            counts[f.severity]++;
+        return counts;
+    }
+    countByCategory(findings) {
+        const counts = {};
+        for (const f of findings) {
+            counts[f.category] = (counts[f.category] ?? 0) + 1;
+        }
+        return counts;
+    }
+    emptyResult(filesScanned, duration) {
+        return {
+            findings: [],
+            suppressed: [],
+            summary: {
+                total: 0,
+                bySeverity: { Critical: 0, High: 0, Medium: 0, Low: 0, Info: 0 },
+                byCategory: {},
+                filesScanned,
+                scanDuration: duration,
+            },
+        };
+    }
+}
+//# sourceMappingURL=InjectionScanner.js.map

package/dist/engine/analyzers/security/injection/InjectionScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InjectionScanner.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/injection/InjectionScanner.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,MAAM,OAAO,gBAAgB;IACnB,aAAa,CAAgB;IAC7B,QAAQ,CAAmB;IAC3B,kBAAkB,CAAqB;IAE/C,YAAY,aAA6B;QACvC,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,IAAI,aAAa,EAAE,CAAC;QAC1D,IAAI,CAAC,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG;YACd,IAAI,mBAAmB,EAAE;YACzB,IAAI,UAAU,EAAE;YAChB,IAAI,uBAAuB,EAAE;YAC7B,IAAI,oBAAoB,EAAE;YAC1B,IAAI,sBAAsB,EAAE;YAC5B,IAAI,cAAc,EAAE;SACrB,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,YAAY,CACV,YAAwB,EACxB,QAAgB,EAChB,QAAgB,EAChB,WAAqB,EACrB,YAAqB;QAErB,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACvE,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE9C,MAAM,OAAO,GAAiB;YAC5B,QAAQ;YACR,YAAY,EAAE,YAAY,IAAI,WAAW;YACzC,QAAQ;SACT,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,6CAA6C;QAC7C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACrC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,IAAI,OAAO,EAAE,CAAC;oBACZ,oBAAoB;oBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACtF,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;wBAC1B,OAAO,CAAC,eAAe,GAAG,WAAW,CAAC;oBACxC,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACvB,MAAM,CAAC,0CAA0C;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,qDAAqD;IACrD,aAAa,CACX,SAAoD,EACpD,QAAgB,EAChB,QAAgB,EAChB,WAAqB,EACrB,UAAuB,EAAE;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAc,EAAE,CAAC;QAEjC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAEtF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,2BAA2B;gBAC3B,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBACnG,SAAS;gBACX,CAAC;gBACD,wBAAwB;gBACxB,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzE,SAAS;gBACX,CAAC;gBAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;oBACvB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,OAAO;YACL,QAAQ,EAAE,WAAW;YACrB,UAAU,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACvD,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW,CAAC,MAAM;gBACzB,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;gBAC7C,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;gBAC7C,YAAY,EAAE,CAAC;gBACf,YAAY,EAAE,QAAQ;aACvB;SACF,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAEO,cAAc,CAAC,QAAkB,EAAE,SAAmB;QAC5D,MAAM,KAAK,GAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAEO,eAAe,CAAC,QAAmB;QACzC,MAAM,MAAM,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,eAAe,CAAC,QAAmB;QACzC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,WAAW,CAAC,YAAoB,EAAE,QAAgB;QACxD,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;YACd,OAAO,EAAE;gBACP,KAAK,EAAE,CAAC;gBACR,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE;gBAChE,UAAU,EAAE,EAAE;gBACd,YAAY;gBACZ,YAAY,EAAE,QAAQ;aACvB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/engine/analyzers/security/injection/PatternMatcher.d.ts

@@ -0,0 +1,25 @@
+/**
+ * KSA-165: Pattern Matcher — Base class for injection pattern matching.
+ */
+import type { TaintPath, InjectionPattern, Finding, Confidence } from '../types.js';
+export interface MatchContext {
+    filePath: string;
+    functionName: string;
+    language: string;
+}
+export declare abstract class PatternMatcher {
+    abstract readonly category: string;
+    abstract readonly patterns: InjectionPattern[];
+    /** Check if a taint path matches any pattern in this category. */
+    match(taintPath: TaintPath, context: MatchContext): Finding | null;
+    /** Check if sink function matches pattern's sink signatures. */
+    protected matchesSink(sinkFunction: string, pattern: InjectionPattern): boolean;
+    /** Check if taint path has a dangerous operation. */
+    protected hasDangerousOp(path: TaintPath, dangerousOps: string[]): boolean;
+    /** Check if taint path has a safe pattern (sanitization). */
+    protected hasSafePattern(path: TaintPath, safePatterns: string[]): boolean;
+    /** Create a finding from a matched pattern. */
+    protected createFinding(path: TaintPath, pattern: InjectionPattern, context: MatchContext): Finding;
+    /** Compute confidence based on path characteristics. */
+    protected computeConfidence(path: TaintPath, pattern: InjectionPattern): Confidence;
+}

package/dist/engine/analyzers/security/injection/PatternMatcher.js

@@ -0,0 +1,72 @@
+/**
+ * KSA-165: Pattern Matcher — Base class for injection pattern matching.
+ */
+export class PatternMatcher {
+    /** Check if a taint path matches any pattern in this category. */
+    match(taintPath, context) {
+        for (const pattern of this.patterns) {
+            if (this.matchesSink(taintPath.sink.function, pattern) &&
+                this.hasDangerousOp(taintPath, pattern.dangerousOps) &&
+                !this.hasSafePattern(taintPath, pattern.safePatterns)) {
+                return this.createFinding(taintPath, pattern, context);
+            }
+        }
+        return null;
+    }
+    /** Check if sink function matches pattern's sink signatures. */
+    matchesSink(sinkFunction, pattern) {
+        return pattern.sinkPatterns.some(sp => sinkFunction.includes(sp));
+    }
+    /** Check if taint path has a dangerous operation. */
+    hasDangerousOp(path, dangerousOps) {
+        if (dangerousOps.length === 0)
+            return true; // No specific op required
+        return path.chain.some(step => dangerousOps.includes(step.action));
+    }
+    /** Check if taint path has a safe pattern (sanitization). */
+    hasSafePattern(path, safePatterns) {
+        if (safePatterns.length === 0)
+            return false;
+        const sinkExpr = path.sink.expression;
+        for (const safe of safePatterns) {
+            if (sinkExpr.includes(safe))
+                return true;
+        }
+        // Check if any step is a sanitizer
+        return path.chain.some(step => step.action === 'sanitize');
+    }
+    /** Create a finding from a matched pattern. */
+    createFinding(path, pattern, context) {
+        const confidence = this.computeConfidence(path, pattern);
+        return {
+            id: `${pattern.category.toUpperCase()}-${pattern.id}-${context.filePath}:${path.sink.line}`,
+            ruleId: `INJ-${pattern.category.toUpperCase()}-${String(pattern.id).padStart(3, '0')}`,
+            category: pattern.category,
+            pattern,
+            taintPath: path,
+            severity: pattern.severity,
+            confidence,
+            cwe: pattern.cwe,
+            message: `${pattern.name}: Tainted data from ${path.source.type} flows to ${path.sink.function} without sanitization`,
+            remediation: pattern.description,
+            location: {
+                file: context.filePath,
+                startLine: path.source.line,
+                endLine: path.sink.line,
+            },
+            suppressed: false,
+        };
+    }
+    /** Compute confidence based on path characteristics. */
+    computeConfidence(path, pattern) {
+        // Short direct paths = high confidence
+        if (path.length <= 3)
+            return 'High';
+        // Medium paths
+        if (path.length <= 6)
+            return 'Medium';
+        // Long indirect paths
+        return 'Low';
+    }
+}
+//# sourceMappingURL=PatternMatcher.js.map

package/dist/engine/analyzers/security/injection/PatternMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PatternMatcher.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/injection/PatternMatcher.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,MAAM,OAAgB,cAAc;IAIlC,kEAAkE;IAClE,KAAK,CAAC,SAAoB,EAAE,OAAqB;QAC/C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAClD,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;gBACpD,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1D,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gEAAgE;IACtD,WAAW,CAAC,YAAoB,EAAE,OAAyB;QACnE,OAAO,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,qDAAqD;IAC3C,cAAc,CAAC,IAAe,EAAE,YAAsB;QAC9D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;QACtE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,6DAA6D;IACnD,cAAc,CAAC,IAAe,EAAE,YAAsB;QAC9D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC3C,CAAC;QAED,mCAAmC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED,+CAA+C;IACrC,aAAa,CAAC,IAAe,EAAE,OAAyB,EAAE,OAAqB;QACvF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAC3F,MAAM,EAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACtF,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO;YACP,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU;YACV,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,uBAAuB,IAAI,CAAC,MAAM,CAAC,IAAI,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,uBAAuB;YACrH,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE;gBACR,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBAC3B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;aACxB;YACD,UAAU,EAAE,KAAK;SAClB,CAAC;IACJ,CAAC;IAED,wDAAwD;IAC9C,iBAAiB,CAAC,IAAe,EAAE,OAAyB;QACpE,uCAAuC;QACvC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC;QACpC,eAAe;QACf,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAC;QACtC,sBAAsB;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/engine/analyzers/security/injection/SuppressionChecker.d.ts

@@ -0,0 +1,17 @@
+/**
+ * KSA-165: Suppression Checker — Detects nosec/NOLINT markers to suppress findings.
+ */
+import type { SuppressionInfo } from '../types.js';
+interface SuppressionMarker {
+    pattern: string;
+    scope: 'line' | 'block' | 'file';
+}
+export declare class SuppressionChecker {
+    private markers;
+    constructor(markers?: SuppressionMarker[]);
+    /** Check if a specific line in source code has a suppression marker. */
+    isSuppressed(sourceLines: string[], line: number): SuppressionInfo | null;
+    /** Check if entire file is suppressed. */
+    isFileSuppressed(sourceLines: string[]): boolean;
+}
+export {};