sdlc-agent-4-enterprise-server 1.0.0

package/src/engine/analyzers/security/idor/IDORDetector.ts

@@ -0,0 +1,143 @@
+/**
+ * KSA-166: IDOR Detector — Detects Insecure Direct Object Reference vulnerabilities.
+ */
+
+import { TaintAnalyzer } from '../taint/TaintAnalyzer.js';
+import type { SyntaxNode } from '../../../parsers/types.js';
+import type { IDORFinding, TrustTier } from '../types.js';
+
+/** Patterns indicating a parameter is an object ID. */
+const ID_PARAM_PATTERNS = [
+  /id$/i, /Id$/, /_id$/i, /Id\b/, /uuid/i, /key$/i, /slug/i,
+  /params\.id/, /params\.\w+Id/, /params\.\w+_id/,
+];
+
+/** Patterns indicating a database lookup. */
+const DB_LOOKUP_PATTERNS = [
+  'findById(', 'findOne(', 'findByPk(', 'get(', '.find(',
+  'findUnique(', 'findFirst(', 'getOne(', 'load(',
+  'SELECT', 'WHERE', 'query(',
+];
+
+/** Patterns indicating authorization/ownership check. */
+const AUTHZ_PATTERNS = [
+  'owner', 'user_id', 'userId', 'createdBy', 'belongsTo',
+  'canAccess', 'isOwner', 'hasPermission', 'authorize',
+  'checkAccess', 'verifyOwnership', 'req.user.id',
+  'currentUser', 'session.user',
+];
+
+export class IDORDetector {
+  private taintAnalyzer: TaintAnalyzer;
+
+  constructor(taintAnalyzer?: TaintAnalyzer) {
+    this.taintAnalyzer = taintAnalyzer ?? new TaintAnalyzer();
+  }
+
+  /** Detect IDOR in a handler function. */
+  detect(
+    functionNode: SyntaxNode,
+    filePath: string,
+    language: string,
+    handlerName: string
+  ): IDORFinding[] {
+    const findings: IDORFinding[] = [];
+    const bodyText = functionNode.text;
+
+    // Step 1: Find ID parameters
+    const idParams = this.findIDParams(functionNode);
+    if (idParams.length === 0) return [];
+
+    // Step 2: For each ID param, check if there's a DB lookup
+    for (const param of idParams) {
+      const dbLookup = this.findDBLookup(bodyText, param);
+      if (!dbLookup) continue;
+
+      // Step 3: Check if there's an authorization check between param and lookup
+      const hasAuthz = this.hasAuthorizationCheck(bodyText, param);
+
+      if (!hasAuthz) {
+        const trustTier = this.classifyTrustTier(bodyText, param);
+        findings.push({
+          handler: handlerName,
+          filePath,
+          idParam: param,
+          dbLookup,
+          missingAuthzCheck: true,
+          trustTier,
+          confidence: trustTier === 'T1' ? 90 : trustTier === 'T2' ? 70 : 50,
+          cwe: 'CWE-639',
+          severity: trustTier === 'T1' ? 'High' : 'Medium',
+        });
+      }
+    }
+
+    return findings;
+  }
+
+  /** Find parameters that look like object IDs. */
+  private findIDParams(functionNode: SyntaxNode): string[] {
+    const params: string[] = [];
+    const text = functionNode.text;
+
+    for (const pattern of ID_PARAM_PATTERNS) {
+      const matches = text.match(new RegExp(pattern.source, 'g'));
+      if (matches) {
+        for (const match of matches) {
+          if (!params.includes(match)) params.push(match);
+        }
+      }
+    }
+
+    return params;
+  }
+
+  /** Find database lookup using the ID parameter. */
+  private findDBLookup(bodyText: string, param: string): { function: string; line: number } | null {
+    for (const pattern of DB_LOOKUP_PATTERNS) {
+      const idx = bodyText.indexOf(pattern);
+      if (idx !== -1) {
+        // Check if the param is used near the lookup
+        const context = bodyText.slice(Math.max(0, idx - 50), idx + 100);
+        if (context.includes(param) || this.isNearby(bodyText, idx, param)) {
+          const line = bodyText.slice(0, idx).split('\n').length;
+          return { function: pattern.replace('(', ''), line };
+        }
+      }
+    }
+    return null;
+  }
+
+  /** Check if there's an authorization check for the given parameter. */
+  private hasAuthorizationCheck(bodyText: string, param: string): boolean {
+    for (const pattern of AUTHZ_PATTERNS) {
+      if (bodyText.includes(pattern)) return true;
+    }
+    return false;
+  }
+
+  /** Classify trust tier based on directness. */
+  private classifyTrustTier(bodyText: string, param: string): TrustTier {
+    // T1: param goes directly to DB lookup (no intermediate processing)
+    const lines = bodyText.split('\n');
+    let paramLine = -1;
+    let lookupLine = -1;
+
+    for (let i = 0; i < lines.length; i++) {
+      if (lines[i].includes(param) && paramLine === -1) paramLine = i;
+      if (DB_LOOKUP_PATTERNS.some(p => lines[i].includes(p))) lookupLine = i;
+    }
+
+    if (paramLine >= 0 && lookupLine >= 0) {
+      const distance = Math.abs(lookupLine - paramLine);
+      if (distance <= 2) return 'T1';
+      if (distance <= 5) return 'T2';
+    }
+    return 'T3';
+  }
+
+  private isNearby(text: string, idx: number, param: string): boolean {
+    const window = text.slice(Math.max(0, idx - 200), idx + 200);
+    return window.includes(param);
+  }
+}

package/src/engine/analyzers/security/injection/InjectionScanner.ts

@@ -0,0 +1,164 @@
+/**
+ * KSA-165: Injection Scanner — Main orchestrator for injection detection.
+ */
+
+import type { SyntaxNode } from '../../../parsers/types.js';
+import { TaintAnalyzer } from '../taint/TaintAnalyzer.js';
+import { PatternMatcher, type MatchContext } from './PatternMatcher.js';
+import { SuppressionChecker } from './SuppressionChecker.js';
+import { SQLInjectionMatcher } from './patterns/SQLInjectionMatcher.js';
+import { XSSMatcher } from './patterns/XSSMatcher.js';
+import { CommandInjectionMatcher } from './patterns/CommandInjectionMatcher.js';
+import { PathTraversalMatcher } from './patterns/PathTraversalMatcher.js';
+import { DeserializationMatcher } from './patterns/DeserializationMatcher.js';
+import { LDAPXMLMatcher } from './patterns/LDAPXMLMatcher.js';
+import type { Finding, ScanOptions, ScanResult, Severity, TaintPath } from '../types.js';
+
+export class InjectionScanner {
+  private taintAnalyzer: TaintAnalyzer;
+  private matchers: PatternMatcher[];
+  private suppressionChecker: SuppressionChecker;
+
+  constructor(taintAnalyzer?: TaintAnalyzer) {
+    this.taintAnalyzer = taintAnalyzer ?? new TaintAnalyzer();
+    this.suppressionChecker = new SuppressionChecker();
+    this.matchers = [
+      new SQLInjectionMatcher(),
+      new XSSMatcher(),
+      new CommandInjectionMatcher(),
+      new PathTraversalMatcher(),
+      new DeserializationMatcher(),
+      new LDAPXMLMatcher(),
+    ];
+  }
+
+  /** Scan a function AST node for injection vulnerabilities. */
+  scanFunction(
+    functionNode: SyntaxNode,
+    filePath: string,
+    language: string,
+    sourceLines: string[],
+    functionName?: string
+  ): Finding[] {
+    // Run taint analysis
+    const taintResult = this.taintAnalyzer.analyze(functionNode, language);
+    if (taintResult.paths.length === 0) return [];
+
+    const context: MatchContext = {
+      filePath,
+      functionName: functionName ?? 'anonymous',
+      language,
+    };
+
+    const findings: Finding[] = [];
+
+    // Match each taint path against all patterns
+    for (const path of taintResult.paths) {
+      for (const matcher of this.matchers) {
+        const finding = matcher.match(path, context);
+        if (finding) {
+          // Check suppression
+          const suppression = this.suppressionChecker.isSuppressed(sourceLines, path.sink.line);
+          if (suppression) {
+            finding.suppressed = true;
+            finding.suppressionInfo = suppression;
+          }
+          findings.push(finding);
+          break; // One finding per path (first match wins)
+        }
+      }
+    }
+
+    return findings;
+  }
+
+  /** Scan multiple functions and aggregate results. */
+  scanFunctions(
+    functions: Array<{ node: SyntaxNode; name: string }>,
+    filePath: string,
+    language: string,
+    sourceLines: string[],
+    options: ScanOptions = {}
+  ): ScanResult {
+    const startTime = Date.now();
+    const allFindings: Finding[] = [];
+    const suppressed: Finding[] = [];
+
+    // Check file-level suppression
+    if (this.suppressionChecker.isFileSuppressed(sourceLines)) {
+      return this.emptyResult(1, Date.now() - startTime);
+    }
+
+    for (const fn of functions) {
+      const findings = this.scanFunction(fn.node, filePath, language, sourceLines, fn.name);
+
+      for (const finding of findings) {
+        // Apply severity threshold
+        if (options.severityThreshold && !this.meetsThreshold(finding.severity, options.severityThreshold)) {
+          continue;
+        }
+        // Apply category filter
+        if (options.categories && !options.categories.includes(finding.category)) {
+          continue;
+        }
+
+        if (finding.suppressed) {
+          suppressed.push(finding);
+        } else {
+          allFindings.push(finding);
+        }
+      }
+    }
+
+    const duration = Date.now() - startTime;
+    return {
+      findings: allFindings,
+      suppressed: options.includeSuppressed ? suppressed : [],
+      summary: {
+        total: allFindings.length,
+        bySeverity: this.countBySeverity(allFindings),
+        byCategory: this.countByCategory(allFindings),
+        filesScanned: 1,
+        scanDuration: duration,
+      },
+    };
+  }
+
+  /** Get all registered patterns (for SARIF rule generation). */
+  getAllPatterns(): Array<{ category: string; patterns: import('../types.js').InjectionPattern[] }> {
+    return this.matchers.map(m => ({ category: m.category, patterns: m.patterns }));
+  }
+
+  private meetsThreshold(severity: Severity, threshold: Severity): boolean {
+    const order: Severity[] = ['Critical', 'High', 'Medium', 'Low', 'Info'];
+    return order.indexOf(severity) <= order.indexOf(threshold);
+  }
+
+  private countBySeverity(findings: Finding[]): Record<Severity, number> {
+    const counts: Record<Severity, number> = { Critical: 0, High: 0, Medium: 0, Low: 0, Info: 0 };
+    for (const f of findings) counts[f.severity]++;
+    return counts;
+  }
+
+  private countByCategory(findings: Finding[]): Record<string, number> {
+    const counts: Record<string, number> = {};
+    for (const f of findings) {
+      counts[f.category] = (counts[f.category] ?? 0) + 1;
+    }
+    return counts;
+  }
+
+  private emptyResult(filesScanned: number, duration: number): ScanResult {
+    return {
+      findings: [],
+      suppressed: [],
+      summary: {
+        total: 0,
+        bySeverity: { Critical: 0, High: 0, Medium: 0, Low: 0, Info: 0 },
+        byCategory: {},
+        filesScanned,
+        scanDuration: duration,
+      },
+    };
+  }
+}

package/src/engine/analyzers/security/injection/PatternMatcher.ts

@@ -0,0 +1,85 @@
+/**
+ * KSA-165: Pattern Matcher — Base class for injection pattern matching.
+ */
+
+import type { TaintPath, InjectionPattern, Finding, Confidence, TaintStep } from '../types.js';
+
+export interface MatchContext {
+  filePath: string;
+  functionName: string;
+  language: string;
+}
+
+export abstract class PatternMatcher {
+  abstract readonly category: string;
+  abstract readonly patterns: InjectionPattern[];
+
+  /** Check if a taint path matches any pattern in this category. */
+  match(taintPath: TaintPath, context: MatchContext): Finding | null {
+    for (const pattern of this.patterns) {
+      if (this.matchesSink(taintPath.sink.function, pattern) &&
+          this.hasDangerousOp(taintPath, pattern.dangerousOps) &&
+          !this.hasSafePattern(taintPath, pattern.safePatterns)) {
+        return this.createFinding(taintPath, pattern, context);
+      }
+    }
+    return null;
+  }
+
+  /** Check if sink function matches pattern's sink signatures. */
+  protected matchesSink(sinkFunction: string, pattern: InjectionPattern): boolean {
+    return pattern.sinkPatterns.some(sp => sinkFunction.includes(sp));
+  }
+
+  /** Check if taint path has a dangerous operation. */
+  protected hasDangerousOp(path: TaintPath, dangerousOps: string[]): boolean {
+    if (dangerousOps.length === 0) return true; // No specific op required
+    return path.chain.some(step => dangerousOps.includes(step.action));
+  }
+
+  /** Check if taint path has a safe pattern (sanitization). */
+  protected hasSafePattern(path: TaintPath, safePatterns: string[]): boolean {
+    if (safePatterns.length === 0) return false;
+
+    const sinkExpr = path.sink.expression;
+    for (const safe of safePatterns) {
+      if (sinkExpr.includes(safe)) return true;
+    }
+
+    // Check if any step is a sanitizer
+    return path.chain.some(step => step.action === 'sanitize');
+  }
+
+  /** Create a finding from a matched pattern. */
+  protected createFinding(path: TaintPath, pattern: InjectionPattern, context: MatchContext): Finding {
+    const confidence = this.computeConfidence(path, pattern);
+    return {
+      id: `${pattern.category.toUpperCase()}-${pattern.id}-${context.filePath}:${path.sink.line}`,
+      ruleId: `INJ-${pattern.category.toUpperCase()}-${String(pattern.id).padStart(3, '0')}`,
+      category: pattern.category,
+      pattern,
+      taintPath: path,
+      severity: pattern.severity,
+      confidence,
+      cwe: pattern.cwe,
+      message: `${pattern.name}: Tainted data from ${path.source.type} flows to ${path.sink.function} without sanitization`,
+      remediation: pattern.description,
+      location: {
+        file: context.filePath,
+        startLine: path.source.line,
+        endLine: path.sink.line,
+      },
+      suppressed: false,
+    };
+  }
+
+  /** Compute confidence based on path characteristics. */
+  protected computeConfidence(path: TaintPath, pattern: InjectionPattern): Confidence {
+    // Short direct paths = high confidence
+    if (path.length <= 3) return 'High';
+    // Medium paths
+    if (path.length <= 6) return 'Medium';
+    // Long indirect paths
+    return 'Low';
+  }
+}

package/src/engine/analyzers/security/injection/SuppressionChecker.ts

@@ -0,0 +1,65 @@
+/**
+ * KSA-165: Suppression Checker — Detects nosec/NOLINT markers to suppress findings.
+ */
+
+import type { SuppressionInfo } from '../types.js';
+
+interface SuppressionMarker {
+  pattern: string;
+  scope: 'line' | 'block' | 'file';
+}
+
+const DEFAULT_MARKERS: SuppressionMarker[] = [
+  { pattern: '// nosec', scope: 'line' },
+  { pattern: '# nosec', scope: 'line' },
+  { pattern: '// NOLINT', scope: 'line' },
+  { pattern: '/* NOLINT */', scope: 'line' },
+  { pattern: '// @security-ignore', scope: 'line' },
+  { pattern: '# @security-ignore', scope: 'line' },
+  { pattern: '// nosec:block', scope: 'block' },
+  { pattern: '// @security-ignore-file', scope: 'file' },
+];
+
+export class SuppressionChecker {
+  private markers: SuppressionMarker[];
+
+  constructor(markers?: SuppressionMarker[]) {
+    this.markers = markers ?? DEFAULT_MARKERS;
+  }
+
+  /** Check if a specific line in source code has a suppression marker. */
+  isSuppressed(sourceLines: string[], line: number): SuppressionInfo | null {
+    const lineIdx = line - 1;
+    if (lineIdx < 0 || lineIdx >= sourceLines.length) return null;
+
+    const lineText = sourceLines[lineIdx];
+    const prevLineText = lineIdx > 0 ? sourceLines[lineIdx - 1] : '';
+
+    for (const marker of this.markers) {
+      // Check current line (inline comment)
+      if (lineText.includes(marker.pattern)) {
+        return { marker: marker.pattern, scope: marker.scope, line };
+      }
+      // Check previous line (comment above)
+      if (prevLineText.includes(marker.pattern)) {
+        return { marker: marker.pattern, scope: marker.scope, line: line - 1 };
+      }
+    }
+
+    return null;
+  }
+
+  /** Check if entire file is suppressed. */
+  isFileSuppressed(sourceLines: string[]): boolean {
+    // Check first 5 lines for file-level suppression
+    const headerLines = sourceLines.slice(0, 5);
+    for (const line of headerLines) {
+      for (const marker of this.markers) {
+        if (marker.scope === 'file' && line.includes(marker.pattern)) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+}

package/src/engine/analyzers/security/injection/patterns/CommandInjectionMatcher.ts

@@ -0,0 +1,56 @@
+/**
+ * KSA-165: Command Injection Matcher — 4 patterns for OS command injection.
+ */
+
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+
+export class CommandInjectionMatcher extends PatternMatcher {
+  readonly category = 'command_injection';
+  readonly patterns: InjectionPattern[] = [
+    {
+      id: 9,
+      name: 'Shell Command with String Concatenation',
+      category: 'command_injection',
+      cwe: 'CWE-78',
+      severity: 'Critical',
+      sinkPatterns: ['exec(', 'execSync(', 'system(', 'popen(', 'subprocess.run', 'child_process.exec'],
+      dangerousOps: ['concat', 'template_literal', 'format_string'],
+      safePatterns: ['execFile', 'spawn', 'shell=False', 'shellescape'],
+      description: 'Use execFile/spawn with array arguments instead of exec with shell string. Example: execFile("cmd", [arg1, arg2])',
+    },
+    {
+      id: 10,
+      name: 'Shell=True with User Input',
+      category: 'command_injection',
+      cwe: 'CWE-78',
+      severity: 'Critical',
+      sinkPatterns: ['subprocess.run', 'subprocess.Popen', 'subprocess.call'],
+      dangerousOps: ['concat', 'template_literal', 'pass_through'],
+      safePatterns: ['shell=False', 'shlex.quote', 'shellescape'],
+      description: 'Use shell=False and pass command as list: subprocess.run(["cmd", user_input], shell=False)',
+    },
+    {
+      id: 11,
+      name: 'eval() with User Input',
+      category: 'command_injection',
+      cwe: 'CWE-95',
+      severity: 'Critical',
+      sinkPatterns: ['eval(', 'Function(', 'vm.runInContext', 'vm.runInNewContext'],
+      dangerousOps: ['concat', 'template_literal', 'pass_through', 'assign'],
+      safePatterns: ['JSON.parse', 'parseInt', 'sandbox'],
+      description: 'Never use eval() with user input. Use JSON.parse for data, or a sandboxed VM for code execution.',
+    },
+    {
+      id: 12,
+      name: 'Dynamic Require/Import with User Input',
+      category: 'command_injection',
+      cwe: 'CWE-94',
+      severity: 'High',
+      sinkPatterns: ['require(', 'import(', '__import__'],
+      dangerousOps: ['concat', 'template_literal', 'pass_through'],
+      safePatterns: ['whitelist', 'allowedModules', 'includes('],
+      description: 'Validate module names against a whitelist before dynamic import.',
+    },
+  ];
+}

package/src/engine/analyzers/security/injection/patterns/DeserializationMatcher.ts

@@ -0,0 +1,45 @@
+/**
+ * KSA-165: Deserialization Matcher — 3 patterns for unsafe deserialization.
+ */
+
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+
+export class DeserializationMatcher extends PatternMatcher {
+  readonly category = 'deserialization';
+  readonly patterns: InjectionPattern[] = [
+    {
+      id: 16,
+      name: 'Unsafe YAML Load with User Input',
+      category: 'deserialization',
+      cwe: 'CWE-502',
+      severity: 'Critical',
+      sinkPatterns: ['yaml.load(', 'yaml.unsafe_load(', 'YAML.load('],
+      dangerousOps: ['pass_through', 'assign', 'function_call'],
+      safePatterns: ['yaml.safe_load', 'yaml.SafeLoader', 'Loader=SafeLoader'],
+      description: 'Use yaml.safe_load() or yaml.load(data, Loader=SafeLoader) instead of yaml.load().',
+    },
+    {
+      id: 17,
+      name: 'Pickle/Marshal Deserialization of User Data',
+      category: 'deserialization',
+      cwe: 'CWE-502',
+      severity: 'Critical',
+      sinkPatterns: ['pickle.loads(', 'pickle.load(', 'marshal.loads(', 'unserialize('],
+      dangerousOps: ['pass_through', 'assign', 'function_call'],
+      safePatterns: ['hmac', 'signature', 'verify'],
+      description: 'Never deserialize untrusted data with pickle/marshal. Use JSON or implement HMAC signature verification.',
+    },
+    {
+      id: 18,
+      name: 'XML External Entity (XXE) Processing',
+      category: 'deserialization',
+      cwe: 'CWE-611',
+      severity: 'High',
+      sinkPatterns: ['parseXML(', 'DOMParser', 'xml2js.parse', 'etree.fromstring', 'etree.parse'],
+      dangerousOps: ['pass_through', 'assign', 'function_call'],
+      safePatterns: ['resolve_entities=False', 'disallow_doctype', 'defusedxml', 'noent: false'],
+      description: 'Disable external entity resolution: use defusedxml (Python) or set parser options to disallow DTD/entities.',
+    },
+  ];
+}

package/src/engine/analyzers/security/injection/patterns/LDAPXMLMatcher.ts

@@ -0,0 +1,34 @@
+/**
+ * KSA-165: LDAP/XML Matcher — 2 patterns for LDAP and XML injection.
+ */
+
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+
+export class LDAPXMLMatcher extends PatternMatcher {
+  readonly category = 'ldap_xml_injection';
+  readonly patterns: InjectionPattern[] = [
+    {
+      id: 19,
+      name: 'LDAP Injection via String Concatenation',
+      category: 'ldap_xml_injection',
+      cwe: 'CWE-90',
+      severity: 'High',
+      sinkPatterns: ['ldap.search(', 'ldap.bind(', 'ldapjs.search', 'search_s('],
+      dangerousOps: ['concat', 'template_literal', 'format_string'],
+      safePatterns: ['ldap.filter.escape', 'escape_filter_chars', 'ldapEscape'],
+      description: 'Escape LDAP special characters: use ldap.filter.escape() or equivalent before inserting into LDAP filters.',
+    },
+    {
+      id: 20,
+      name: 'XPath Injection via User Input',
+      category: 'ldap_xml_injection',
+      cwe: 'CWE-643',
+      severity: 'High',
+      sinkPatterns: ['xpath(', 'evaluate(', 'selectNodes(', 'xmlDoc.find('],
+      dangerousOps: ['concat', 'template_literal', 'format_string'],
+      safePatterns: ['parameterize', 'compile(', 'XPathExpression'],
+      description: 'Use parameterized XPath queries or pre-compiled expressions. Never concatenate user input into XPath strings.',
+    },
+  ];
+}

package/src/engine/analyzers/security/injection/patterns/PathTraversalMatcher.ts

@@ -0,0 +1,45 @@
+/**
+ * KSA-165: Path Traversal Matcher — 3 patterns for path traversal detection.
+ */
+
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+
+export class PathTraversalMatcher extends PatternMatcher {
+  readonly category = 'path_traversal';
+  readonly patterns: InjectionPattern[] = [
+    {
+      id: 13,
+      name: 'File Read with User-Controlled Path',
+      category: 'path_traversal',
+      cwe: 'CWE-22',
+      severity: 'High',
+      sinkPatterns: ['readFile(', 'readFileSync(', 'createReadStream(', 'open(', 'fopen('],
+      dangerousOps: ['concat', 'template_literal', 'pass_through'],
+      safePatterns: ['path.basename', 'path.normalize', 'startsWith(', 'resolve('],
+      description: 'Validate path: const safe = path.resolve(baseDir, userPath); if (!safe.startsWith(baseDir)) throw Error("Invalid path")',
+    },
+    {
+      id: 14,
+      name: 'File Write with User-Controlled Path',
+      category: 'path_traversal',
+      cwe: 'CWE-22',
+      severity: 'Critical',
+      sinkPatterns: ['writeFile(', 'writeFileSync(', 'createWriteStream(', 'fwrite('],
+      dangerousOps: ['concat', 'template_literal', 'pass_through'],
+      safePatterns: ['path.basename', 'startsWith(', 'whitelist'],
+      description: 'Restrict write paths to a safe directory. Validate resolved path starts with allowed base directory.',
+    },
+    {
+      id: 15,
+      name: 'Directory Listing with User Input',
+      category: 'path_traversal',
+      cwe: 'CWE-22',
+      severity: 'Medium',
+      sinkPatterns: ['readdir(', 'readdirSync(', 'listdir(', 'scandir('],
+      dangerousOps: ['concat', 'template_literal', 'pass_through'],
+      safePatterns: ['path.basename', 'startsWith(', 'resolve('],
+      description: 'Validate directory path against allowed base directories before listing.',
+    },
+  ];
+}