sdlc-agent-4-enterprise-server 1.0.0

package/dist/engine/analyzers/security/injection/SuppressionChecker.js

@@ -0,0 +1,52 @@
+/**
+ * KSA-165: Suppression Checker — Detects nosec/NOLINT markers to suppress findings.
+ */
+const DEFAULT_MARKERS = [
+    { pattern: '// nosec', scope: 'line' },
+    { pattern: '# nosec', scope: 'line' },
+    { pattern: '// NOLINT', scope: 'line' },
+    { pattern: '/* NOLINT */', scope: 'line' },
+    { pattern: '// @security-ignore', scope: 'line' },
+    { pattern: '# @security-ignore', scope: 'line' },
+    { pattern: '// nosec:block', scope: 'block' },
+    { pattern: '// @security-ignore-file', scope: 'file' },
+];
+export class SuppressionChecker {
+    markers;
+    constructor(markers) {
+        this.markers = markers ?? DEFAULT_MARKERS;
+    }
+    /** Check if a specific line in source code has a suppression marker. */
+    isSuppressed(sourceLines, line) {
+        const lineIdx = line - 1;
+        if (lineIdx < 0 || lineIdx >= sourceLines.length)
+            return null;
+        const lineText = sourceLines[lineIdx];
+        const prevLineText = lineIdx > 0 ? sourceLines[lineIdx - 1] : '';
+        for (const marker of this.markers) {
+            // Check current line (inline comment)
+            if (lineText.includes(marker.pattern)) {
+                return { marker: marker.pattern, scope: marker.scope, line };
+            }
+            // Check previous line (comment above)
+            if (prevLineText.includes(marker.pattern)) {
+                return { marker: marker.pattern, scope: marker.scope, line: line - 1 };
+            }
+        }
+        return null;
+    }
+    /** Check if entire file is suppressed. */
+    isFileSuppressed(sourceLines) {
+        // Check first 5 lines for file-level suppression
+        const headerLines = sourceLines.slice(0, 5);
+        for (const line of headerLines) {
+            for (const marker of this.markers) {
+                if (marker.scope === 'file' && line.includes(marker.pattern)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=SuppressionChecker.js.map

package/dist/engine/analyzers/security/injection/SuppressionChecker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SuppressionChecker.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/injection/SuppressionChecker.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,eAAe,GAAwB;IAC3C,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;IACtC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;IACrC,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;IACvC,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE;IAC1C,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;IACjD,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE;IAChD,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE;IAC7C,EAAE,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE;CACvD,CAAC;AAEF,MAAM,OAAO,kBAAkB;IACrB,OAAO,CAAsB;IAErC,YAAY,OAA6B;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,eAAe,CAAC;IAC5C,CAAC;IAED,wEAAwE;IACxE,YAAY,CAAC,WAAqB,EAAE,IAAY;QAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;QACzB,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,WAAW,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAE9D,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,sCAAsC;YACtC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YAC/D,CAAC;YACD,sCAAsC;YACtC,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,WAAqB;QACpC,iDAAiD;QACjD,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7D,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/engine/analyzers/security/injection/patterns/CommandInjectionMatcher.d.ts

@@ -0,0 +1,9 @@
+/**
+ * KSA-165: Command Injection Matcher — 4 patterns for OS command injection.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+export declare class CommandInjectionMatcher extends PatternMatcher {
+    readonly category = "command_injection";
+    readonly patterns: InjectionPattern[];
+}

package/dist/engine/analyzers/security/injection/patterns/CommandInjectionMatcher.js

@@ -0,0 +1,54 @@
+/**
+ * KSA-165: Command Injection Matcher — 4 patterns for OS command injection.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+export class CommandInjectionMatcher extends PatternMatcher {
+    category = 'command_injection';
+    patterns = [
+        {
+            id: 9,
+            name: 'Shell Command with String Concatenation',
+            category: 'command_injection',
+            cwe: 'CWE-78',
+            severity: 'Critical',
+            sinkPatterns: ['exec(', 'execSync(', 'system(', 'popen(', 'subprocess.run', 'child_process.exec'],
+            dangerousOps: ['concat', 'template_literal', 'format_string'],
+            safePatterns: ['execFile', 'spawn', 'shell=False', 'shellescape'],
+            description: 'Use execFile/spawn with array arguments instead of exec with shell string. Example: execFile("cmd", [arg1, arg2])',
+        },
+        {
+            id: 10,
+            name: 'Shell=True with User Input',
+            category: 'command_injection',
+            cwe: 'CWE-78',
+            severity: 'Critical',
+            sinkPatterns: ['subprocess.run', 'subprocess.Popen', 'subprocess.call'],
+            dangerousOps: ['concat', 'template_literal', 'pass_through'],
+            safePatterns: ['shell=False', 'shlex.quote', 'shellescape'],
+            description: 'Use shell=False and pass command as list: subprocess.run(["cmd", user_input], shell=False)',
+        },
+        {
+            id: 11,
+            name: 'eval() with User Input',
+            category: 'command_injection',
+            cwe: 'CWE-95',
+            severity: 'Critical',
+            sinkPatterns: ['eval(', 'Function(', 'vm.runInContext', 'vm.runInNewContext'],
+            dangerousOps: ['concat', 'template_literal', 'pass_through', 'assign'],
+            safePatterns: ['JSON.parse', 'parseInt', 'sandbox'],
+            description: 'Never use eval() with user input. Use JSON.parse for data, or a sandboxed VM for code execution.',
+        },
+        {
+            id: 12,
+            name: 'Dynamic Require/Import with User Input',
+            category: 'command_injection',
+            cwe: 'CWE-94',
+            severity: 'High',
+            sinkPatterns: ['require(', 'import(', '__import__'],
+            dangerousOps: ['concat', 'template_literal', 'pass_through'],
+            safePatterns: ['whitelist', 'allowedModules', 'includes('],
+            description: 'Validate module names against a whitelist before dynamic import.',
+        },
+    ];
+}
+//# sourceMappingURL=CommandInjectionMatcher.js.map

package/dist/engine/analyzers/security/injection/patterns/CommandInjectionMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandInjectionMatcher.js","sourceRoot":"","sources":["../../../../../../src/engine/analyzers/security/injection/patterns/CommandInjectionMatcher.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,MAAM,OAAO,uBAAwB,SAAQ,cAAc;IAChD,QAAQ,GAAG,mBAAmB,CAAC;IAC/B,QAAQ,GAAuB;QACtC;YACE,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,yCAAyC;YAC/C,QAAQ,EAAE,mBAAmB;YAC7B,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,oBAAoB,CAAC;YACjG,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,CAAC;YAC7D,YAAY,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC;YACjE,WAAW,EAAE,mHAAmH;SACjI;QACD;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,4BAA4B;YAClC,QAAQ,EAAE,mBAAmB;YAC7B,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,CAAC;YACvE,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC;YAC5D,YAAY,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC;YAC3D,WAAW,EAAE,4FAA4F;SAC1G;QACD;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,wBAAwB;YAC9B,QAAQ,EAAE,mBAAmB;YAC7B,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,CAAC;YAC7E,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,CAAC;YACtE,YAAY,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC;YACnD,WAAW,EAAE,kGAAkG;SAChH;QACD;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,wCAAwC;YAC9C,QAAQ,EAAE,mBAAmB;YAC7B,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC;YACnD,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC;YAC5D,YAAY,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC;YAC1D,WAAW,EAAE,kEAAkE;SAChF;KACF,CAAC;CACH"}

package/dist/engine/analyzers/security/injection/patterns/DeserializationMatcher.d.ts

@@ -0,0 +1,9 @@
+/**
+ * KSA-165: Deserialization Matcher — 3 patterns for unsafe deserialization.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+export declare class DeserializationMatcher extends PatternMatcher {
+    readonly category = "deserialization";
+    readonly patterns: InjectionPattern[];
+}

package/dist/engine/analyzers/security/injection/patterns/DeserializationMatcher.js

@@ -0,0 +1,43 @@
+/**
+ * KSA-165: Deserialization Matcher — 3 patterns for unsafe deserialization.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+export class DeserializationMatcher extends PatternMatcher {
+    category = 'deserialization';
+    patterns = [
+        {
+            id: 16,
+            name: 'Unsafe YAML Load with User Input',
+            category: 'deserialization',
+            cwe: 'CWE-502',
+            severity: 'Critical',
+            sinkPatterns: ['yaml.load(', 'yaml.unsafe_load(', 'YAML.load('],
+            dangerousOps: ['pass_through', 'assign', 'function_call'],
+            safePatterns: ['yaml.safe_load', 'yaml.SafeLoader', 'Loader=SafeLoader'],
+            description: 'Use yaml.safe_load() or yaml.load(data, Loader=SafeLoader) instead of yaml.load().',
+        },
+        {
+            id: 17,
+            name: 'Pickle/Marshal Deserialization of User Data',
+            category: 'deserialization',
+            cwe: 'CWE-502',
+            severity: 'Critical',
+            sinkPatterns: ['pickle.loads(', 'pickle.load(', 'marshal.loads(', 'unserialize('],
+            dangerousOps: ['pass_through', 'assign', 'function_call'],
+            safePatterns: ['hmac', 'signature', 'verify'],
+            description: 'Never deserialize untrusted data with pickle/marshal. Use JSON or implement HMAC signature verification.',
+        },
+        {
+            id: 18,
+            name: 'XML External Entity (XXE) Processing',
+            category: 'deserialization',
+            cwe: 'CWE-611',
+            severity: 'High',
+            sinkPatterns: ['parseXML(', 'DOMParser', 'xml2js.parse', 'etree.fromstring', 'etree.parse'],
+            dangerousOps: ['pass_through', 'assign', 'function_call'],
+            safePatterns: ['resolve_entities=False', 'disallow_doctype', 'defusedxml', 'noent: false'],
+            description: 'Disable external entity resolution: use defusedxml (Python) or set parser options to disallow DTD/entities.',
+        },
+    ];
+}
+//# sourceMappingURL=DeserializationMatcher.js.map

package/dist/engine/analyzers/security/injection/patterns/DeserializationMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeserializationMatcher.js","sourceRoot":"","sources":["../../../../../../src/engine/analyzers/security/injection/patterns/DeserializationMatcher.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,MAAM,OAAO,sBAAuB,SAAQ,cAAc;IAC/C,QAAQ,GAAG,iBAAiB,CAAC;IAC7B,QAAQ,GAAuB;QACtC;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,kCAAkC;YACxC,QAAQ,EAAE,iBAAiB;YAC3B,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,YAAY,CAAC;YAC/D,YAAY,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,eAAe,CAAC;YACzD,YAAY,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,CAAC;YACxE,WAAW,EAAE,oFAAoF;SAClG;QACD;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,6CAA6C;YACnD,QAAQ,EAAE,iBAAiB;YAC3B,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,CAAC;YACjF,YAAY,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,eAAe,CAAC;YACzD,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;YAC7C,WAAW,EAAE,0GAA0G;SACxH;QACD;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,sCAAsC;YAC5C,QAAQ,EAAE,iBAAiB;YAC3B,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,CAAC;YAC3F,YAAY,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,eAAe,CAAC;YACzD,YAAY,EAAE,CAAC,wBAAwB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,CAAC;YAC1F,WAAW,EAAE,6GAA6G;SAC3H;KACF,CAAC;CACH"}

package/dist/engine/analyzers/security/injection/patterns/LDAPXMLMatcher.d.ts

@@ -0,0 +1,9 @@
+/**
+ * KSA-165: LDAP/XML Matcher — 2 patterns for LDAP and XML injection.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+export declare class LDAPXMLMatcher extends PatternMatcher {
+    readonly category = "ldap_xml_injection";
+    readonly patterns: InjectionPattern[];
+}

package/dist/engine/analyzers/security/injection/patterns/LDAPXMLMatcher.js

@@ -0,0 +1,32 @@
+/**
+ * KSA-165: LDAP/XML Matcher — 2 patterns for LDAP and XML injection.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+export class LDAPXMLMatcher extends PatternMatcher {
+    category = 'ldap_xml_injection';
+    patterns = [
+        {
+            id: 19,
+            name: 'LDAP Injection via String Concatenation',
+            category: 'ldap_xml_injection',
+            cwe: 'CWE-90',
+            severity: 'High',
+            sinkPatterns: ['ldap.search(', 'ldap.bind(', 'ldapjs.search', 'search_s('],
+            dangerousOps: ['concat', 'template_literal', 'format_string'],
+            safePatterns: ['ldap.filter.escape', 'escape_filter_chars', 'ldapEscape'],
+            description: 'Escape LDAP special characters: use ldap.filter.escape() or equivalent before inserting into LDAP filters.',
+        },
+        {
+            id: 20,
+            name: 'XPath Injection via User Input',
+            category: 'ldap_xml_injection',
+            cwe: 'CWE-643',
+            severity: 'High',
+            sinkPatterns: ['xpath(', 'evaluate(', 'selectNodes(', 'xmlDoc.find('],
+            dangerousOps: ['concat', 'template_literal', 'format_string'],
+            safePatterns: ['parameterize', 'compile(', 'XPathExpression'],
+            description: 'Use parameterized XPath queries or pre-compiled expressions. Never concatenate user input into XPath strings.',
+        },
+    ];
+}
+//# sourceMappingURL=LDAPXMLMatcher.js.map

package/dist/engine/analyzers/security/injection/patterns/LDAPXMLMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LDAPXMLMatcher.js","sourceRoot":"","sources":["../../../../../../src/engine/analyzers/security/injection/patterns/LDAPXMLMatcher.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,MAAM,OAAO,cAAe,SAAQ,cAAc;IACvC,QAAQ,GAAG,oBAAoB,CAAC;IAChC,QAAQ,GAAuB;QACtC;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,yCAAyC;YAC/C,QAAQ,EAAE,oBAAoB;YAC9B,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,CAAC;YAC1E,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,CAAC;YAC7D,YAAY,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,YAAY,CAAC;YACzE,WAAW,EAAE,4GAA4G;SAC1H;QACD;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,gCAAgC;YACtC,QAAQ,EAAE,oBAAoB;YAC9B,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC;YACrE,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,CAAC;YAC7D,YAAY,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,iBAAiB,CAAC;YAC7D,WAAW,EAAE,+GAA+G;SAC7H;KACF,CAAC;CACH"}

package/dist/engine/analyzers/security/injection/patterns/PathTraversalMatcher.d.ts

@@ -0,0 +1,9 @@
+/**
+ * KSA-165: Path Traversal Matcher — 3 patterns for path traversal detection.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+export declare class PathTraversalMatcher extends PatternMatcher {
+    readonly category = "path_traversal";
+    readonly patterns: InjectionPattern[];
+}

package/dist/engine/analyzers/security/injection/patterns/PathTraversalMatcher.js

@@ -0,0 +1,43 @@
+/**
+ * KSA-165: Path Traversal Matcher — 3 patterns for path traversal detection.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+export class PathTraversalMatcher extends PatternMatcher {
+    category = 'path_traversal';
+    patterns = [
+        {
+            id: 13,
+            name: 'File Read with User-Controlled Path',
+            category: 'path_traversal',
+            cwe: 'CWE-22',
+            severity: 'High',
+            sinkPatterns: ['readFile(', 'readFileSync(', 'createReadStream(', 'open(', 'fopen('],
+            dangerousOps: ['concat', 'template_literal', 'pass_through'],
+            safePatterns: ['path.basename', 'path.normalize', 'startsWith(', 'resolve('],
+            description: 'Validate path: const safe = path.resolve(baseDir, userPath); if (!safe.startsWith(baseDir)) throw Error("Invalid path")',
+        },
+        {
+            id: 14,
+            name: 'File Write with User-Controlled Path',
+            category: 'path_traversal',
+            cwe: 'CWE-22',
+            severity: 'Critical',
+            sinkPatterns: ['writeFile(', 'writeFileSync(', 'createWriteStream(', 'fwrite('],
+            dangerousOps: ['concat', 'template_literal', 'pass_through'],
+            safePatterns: ['path.basename', 'startsWith(', 'whitelist'],
+            description: 'Restrict write paths to a safe directory. Validate resolved path starts with allowed base directory.',
+        },
+        {
+            id: 15,
+            name: 'Directory Listing with User Input',
+            category: 'path_traversal',
+            cwe: 'CWE-22',
+            severity: 'Medium',
+            sinkPatterns: ['readdir(', 'readdirSync(', 'listdir(', 'scandir('],
+            dangerousOps: ['concat', 'template_literal', 'pass_through'],
+            safePatterns: ['path.basename', 'startsWith(', 'resolve('],
+            description: 'Validate directory path against allowed base directories before listing.',
+        },
+    ];
+}
+//# sourceMappingURL=PathTraversalMatcher.js.map

package/dist/engine/analyzers/security/injection/patterns/PathTraversalMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PathTraversalMatcher.js","sourceRoot":"","sources":["../../../../../../src/engine/analyzers/security/injection/patterns/PathTraversalMatcher.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,MAAM,OAAO,oBAAqB,SAAQ,cAAc;IAC7C,QAAQ,GAAG,gBAAgB,CAAC;IAC5B,QAAQ,GAAuB;QACtC;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,qCAAqC;YAC3C,QAAQ,EAAE,gBAAgB;YAC1B,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,OAAO,EAAE,QAAQ,CAAC;YACpF,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC;YAC5D,YAAY,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,UAAU,CAAC;YAC5E,WAAW,EAAE,yHAAyH;SACvI;QACD;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,sCAAsC;YAC5C,QAAQ,EAAE,gBAAgB;YAC1B,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,CAAC,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,SAAS,CAAC;YAC/E,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC;YAC5D,YAAY,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,CAAC;YAC3D,WAAW,EAAE,sGAAsG;SACpH;QACD;YACE,EAAE,EAAE,EAAE;YACN,IAAI,EAAE,mCAAmC;YACzC,QAAQ,EAAE,gBAAgB;YAC1B,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC;YAClE,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC;YAC5D,YAAY,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,UAAU,CAAC;YAC1D,WAAW,EAAE,0EAA0E;SACxF;KACF,CAAC;CACH"}

package/dist/engine/analyzers/security/injection/patterns/SQLInjectionMatcher.d.ts

@@ -0,0 +1,9 @@
+/**
+ * KSA-165: SQL Injection Matcher — 4 patterns for SQL injection detection.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+export declare class SQLInjectionMatcher extends PatternMatcher {
+    readonly category = "sql_injection";
+    readonly patterns: InjectionPattern[];
+}

package/dist/engine/analyzers/security/injection/patterns/SQLInjectionMatcher.js

@@ -0,0 +1,54 @@
+/**
+ * KSA-165: SQL Injection Matcher — 4 patterns for SQL injection detection.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+export class SQLInjectionMatcher extends PatternMatcher {
+    category = 'sql_injection';
+    patterns = [
+        {
+            id: 1,
+            name: 'String Concatenation in SQL Query',
+            category: 'sql_injection',
+            cwe: 'CWE-89',
+            severity: 'Critical',
+            sinkPatterns: ['query(', 'execute(', 'raw(', 'knex.raw', 'sequelize.query', 'db.run(', 'cursor.execute'],
+            dangerousOps: ['concat', 'template_literal', 'format_string'],
+            safePatterns: ['?', '$1', '%s', 'prepare', 'parameterize'],
+            description: 'Use parameterized queries instead of string concatenation. Example: db.query("SELECT * FROM users WHERE id = ?", [userId])',
+        },
+        {
+            id: 2,
+            name: 'Template Literal in SQL Query',
+            category: 'sql_injection',
+            cwe: 'CWE-89',
+            severity: 'Critical',
+            sinkPatterns: ['query(', 'execute(', 'raw(', 'knex.raw', 'sequelize.query'],
+            dangerousOps: ['template_literal'],
+            safePatterns: ['?', '$1', 'tagged_template', 'sql`'],
+            description: 'Use tagged template literals (e.g., sql`...`) or parameterized queries instead of plain template literals.',
+        },
+        {
+            id: 3,
+            name: 'Dynamic Table/Column Name in SQL',
+            category: 'sql_injection',
+            cwe: 'CWE-89',
+            severity: 'High',
+            sinkPatterns: ['query(', 'execute(', 'raw('],
+            dangerousOps: ['concat', 'template_literal', 'format_string'],
+            safePatterns: ['whitelist', 'allowedColumns', 'allowedTables', 'includes('],
+            description: 'Validate table/column names against a whitelist. Parameterized queries cannot protect identifiers.',
+        },
+        {
+            id: 4,
+            name: 'ORM Raw Query with User Input',
+            category: 'sql_injection',
+            cwe: 'CWE-89',
+            severity: 'High',
+            sinkPatterns: ['raw(', 'rawQuery(', 'literal(', '$queryRaw'],
+            dangerousOps: ['concat', 'template_literal', 'format_string', 'pass_through'],
+            safePatterns: ['bind', 'replacements', 'Prisma.sql'],
+            description: 'Use ORM binding parameters: Model.rawQuery("... WHERE id = ?", { replacements: [id] })',
+        },
+    ];
+}
+//# sourceMappingURL=SQLInjectionMatcher.js.map

package/dist/engine/analyzers/security/injection/patterns/SQLInjectionMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SQLInjectionMatcher.js","sourceRoot":"","sources":["../../../../../../src/engine/analyzers/security/injection/patterns/SQLInjectionMatcher.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IAC5C,QAAQ,GAAG,eAAe,CAAC;IAC3B,QAAQ,GAAuB;QACtC;YACE,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,mCAAmC;YACzC,QAAQ,EAAE,eAAe;YACzB,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,CAAC;YACxG,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,CAAC;YAC7D,YAAY,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC;YAC1D,WAAW,EAAE,4HAA4H;SAC1I;QACD;YACE,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,eAAe;YACzB,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,CAAC;YAC3E,YAAY,EAAE,CAAC,kBAAkB,CAAC;YAClC,YAAY,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC;YACpD,WAAW,EAAE,4GAA4G;SAC1H;QACD;YACE,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,kCAAkC;YACxC,QAAQ,EAAE,eAAe;YACzB,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC;YAC5C,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,CAAC;YAC7D,YAAY,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,CAAC;YAC3E,WAAW,EAAE,oGAAoG;SAClH;QACD;YACE,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,eAAe;YACzB,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC;YAC5D,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,EAAE,cAAc,CAAC;YAC7E,YAAY,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,CAAC;YACpD,WAAW,EAAE,wFAAwF;SACtG;KACF,CAAC;CACH"}

package/dist/engine/analyzers/security/injection/patterns/XSSMatcher.d.ts

@@ -0,0 +1,9 @@
+/**
+ * KSA-165: XSS Matcher — 4 patterns for Cross-Site Scripting detection.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+import type { InjectionPattern } from '../../types.js';
+export declare class XSSMatcher extends PatternMatcher {
+    readonly category = "xss";
+    readonly patterns: InjectionPattern[];
+}

package/dist/engine/analyzers/security/injection/patterns/XSSMatcher.js

@@ -0,0 +1,54 @@
+/**
+ * KSA-165: XSS Matcher — 4 patterns for Cross-Site Scripting detection.
+ */
+import { PatternMatcher } from '../PatternMatcher.js';
+export class XSSMatcher extends PatternMatcher {
+    category = 'xss';
+    patterns = [
+        {
+            id: 5,
+            name: 'innerHTML Assignment with User Input',
+            category: 'xss',
+            cwe: 'CWE-79',
+            severity: 'High',
+            sinkPatterns: ['innerHTML', 'outerHTML', 'dangerouslySetInnerHTML'],
+            dangerousOps: ['concat', 'template_literal', 'assign', 'pass_through'],
+            safePatterns: ['DOMPurify', 'sanitize', 'textContent', 'innerText'],
+            description: 'Use textContent/innerText instead of innerHTML, or sanitize with DOMPurify.sanitize(input)',
+        },
+        {
+            id: 6,
+            name: 'document.write with User Input',
+            category: 'xss',
+            cwe: 'CWE-79',
+            severity: 'Critical',
+            sinkPatterns: ['document.write(', 'document.writeln('],
+            dangerousOps: ['concat', 'template_literal', 'pass_through'],
+            safePatterns: ['encode', 'escape', 'sanitize'],
+            description: 'Avoid document.write entirely. Use DOM manipulation methods with textContent.',
+        },
+        {
+            id: 7,
+            name: 'Reflected XSS in Server Response',
+            category: 'xss',
+            cwe: 'CWE-79',
+            severity: 'High',
+            sinkPatterns: ['res.send(', 'res.write(', 'response.write(', 'render('],
+            dangerousOps: ['concat', 'template_literal', 'format_string'],
+            safePatterns: ['escape', 'encode', 'sanitize', 'helmet', 'csp'],
+            description: 'Use template engines with auto-escaping (EJS, Handlebars) or explicitly escape output.',
+        },
+        {
+            id: 8,
+            name: 'DOM-based XSS via URL Fragment',
+            category: 'xss',
+            cwe: 'CWE-79',
+            severity: 'High',
+            sinkPatterns: ['innerHTML', 'eval(', 'document.write(', 'location.href'],
+            dangerousOps: ['pass_through', 'assign'],
+            safePatterns: ['encodeURIComponent', 'sanitize', 'DOMPurify'],
+            description: 'Sanitize URL fragments before DOM insertion. Use encodeURIComponent or DOMPurify.',
+        },
+    ];
+}
+//# sourceMappingURL=XSSMatcher.js.map

package/dist/engine/analyzers/security/injection/patterns/XSSMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"XSSMatcher.js","sourceRoot":"","sources":["../../../../../../src/engine/analyzers/security/injection/patterns/XSSMatcher.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,MAAM,OAAO,UAAW,SAAQ,cAAc;IACnC,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAuB;QACtC;YACE,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,sCAAsC;YAC5C,QAAQ,EAAE,KAAK;YACf,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,yBAAyB,CAAC;YACnE,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,CAAC;YACtE,YAAY,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC;YACnE,WAAW,EAAE,4FAA4F;SAC1G;QACD;YACE,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,gCAAgC;YACtC,QAAQ,EAAE,KAAK;YACf,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;YACtD,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC;YAC5D,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC;YAC9C,WAAW,EAAE,+EAA+E;SAC7F;QACD;YACE,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,kCAAkC;YACxC,QAAQ,EAAE,KAAK;YACf,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,SAAS,CAAC;YACvE,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,CAAC;YAC7D,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC;YAC/D,WAAW,EAAE,wFAAwF;SACtG;QACD;YACE,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,gCAAgC;YACtC,QAAQ,EAAE,KAAK;YACf,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,eAAe,CAAC;YACxE,YAAY,EAAE,CAAC,cAAc,EAAE,QAAQ,CAAC;YACxC,YAAY,EAAE,CAAC,oBAAoB,EAAE,UAAU,EAAE,WAAW,CAAC;YAC7D,WAAW,EAAE,mFAAmF;SACjG;KACF,CAAC;CACH"}

package/dist/engine/analyzers/security/ssrf/SSRFDetector.d.ts

@@ -0,0 +1,16 @@
+/**
+ * KSA-166: SSRF Detector — Detects Server-Side Request Forgery vulnerabilities.
+ */
+import { TaintAnalyzer } from '../taint/TaintAnalyzer.js';
+import type { SyntaxNode } from '../../../parsers/types.js';
+import type { SSRFFinding } from '../types.js';
+export declare class SSRFDetector {
+    private taintAnalyzer;
+    constructor(taintAnalyzer?: TaintAnalyzer);
+    /** Detect SSRF in a function that handles HTTP requests. */
+    detect(functionNode: SyntaxNode, filePath: string, language: string, handlerName: string): SSRFFinding[];
+    private isHTTPSink;
+    private hasURLValidation;
+    private classifyTrustTier;
+    private computeConfidence;
+}

package/dist/engine/analyzers/security/ssrf/SSRFDetector.js

@@ -0,0 +1,89 @@
+/**
+ * KSA-166: SSRF Detector — Detects Server-Side Request Forgery vulnerabilities.
+ */
+import { TaintAnalyzer } from '../taint/TaintAnalyzer.js';
+/** HTTP sink functions that make outbound requests. */
+const HTTP_SINKS = [
+    'fetch(', 'axios(', 'axios.get(', 'axios.post(', 'axios.put(', 'axios.delete(',
+    'http.get(', 'http.request(', 'https.get(', 'https.request(',
+    'request(', 'got(', 'got.get(', 'superagent.get(',
+    'urllib.request.urlopen', 'requests.get(', 'requests.post(',
+    'httpx.get(', 'httpx.post(',
+];
+/** URL validation patterns that mitigate SSRF. */
+const URL_VALIDATORS = [
+    'new URL(', 'URL.parse(', 'url.parse(',
+    'allowedHosts', 'allowedDomains', 'whitelist',
+    'isInternalUrl', 'validateUrl', 'isAllowedHost',
+    'startsWith("http', 'startsWith("https',
+];
+export class SSRFDetector {
+    taintAnalyzer;
+    constructor(taintAnalyzer) {
+        this.taintAnalyzer = taintAnalyzer ?? new TaintAnalyzer();
+    }
+    /** Detect SSRF in a function that handles HTTP requests. */
+    detect(functionNode, filePath, language, handlerName) {
+        const taintResult = this.taintAnalyzer.analyze(functionNode, language, {
+            sinkTypes: ['url_fetch'],
+        });
+        const findings = [];
+        for (const path of taintResult.paths) {
+            // Only care about paths that end in HTTP sinks
+            if (!this.isHTTPSink(path.sink.function))
+                continue;
+            // Check if URL validation exists in the path
+            const hasValidation = this.hasURLValidation(path);
+            if (hasValidation)
+                continue;
+            const trustTier = this.classifyTrustTier(path);
+            const confidence = this.computeConfidence(path, trustTier);
+            findings.push({
+                handler: handlerName,
+                filePath,
+                source: path.source,
+                sink: path.sink,
+                path: path.chain.map(s => s.line),
+                trustTier,
+                confidence,
+                missingControl: 'URL validation/allowlist',
+                cwe: 'CWE-918',
+                severity: trustTier === 'T1' ? 'Critical' : trustTier === 'T2' ? 'High' : 'Medium',
+            });
+        }
+        return findings;
+    }
+    isHTTPSink(functionName) {
+        return HTTP_SINKS.some(sink => functionName.includes(sink));
+    }
+    hasURLValidation(path) {
+        // Check if any step in the chain involves URL validation
+        for (const step of path.chain) {
+            for (const validator of URL_VALIDATORS) {
+                if (step.expression.includes(validator))
+                    return true;
+            }
+        }
+        // Also check sink expression
+        for (const validator of URL_VALIDATORS) {
+            if (path.sink.expression.includes(validator))
+                return true;
+        }
+        return false;
+    }
+    classifyTrustTier(path) {
+        if (path.length <= 2)
+            return 'T1'; // Direct: param → fetch
+        if (path.length <= 5)
+            return 'T2'; // Partial processing
+        return 'T3'; // Indirect
+    }
+    computeConfidence(path, tier) {
+        if (tier === 'T1')
+            return 95;
+        if (tier === 'T2')
+            return 75;
+        return 50;
+    }
+}
+//# sourceMappingURL=SSRFDetector.js.map

package/dist/engine/analyzers/security/ssrf/SSRFDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SSRFDetector.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/ssrf/SSRFDetector.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAI1D,uDAAuD;AACvD,MAAM,UAAU,GAAG;IACjB,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe;IAC9E,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB;IAC5D,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB;IACjD,wBAAwB,EAAE,eAAe,EAAE,gBAAgB;IAC3D,YAAY,EAAE,aAAa;CAC5B,CAAC;AAEF,kDAAkD;AAClD,MAAM,cAAc,GAAG;IACrB,UAAU,EAAE,YAAY,EAAE,YAAY;IACtC,cAAc,EAAE,gBAAgB,EAAE,WAAW;IAC7C,eAAe,EAAE,aAAa,EAAE,eAAe;IAC/C,kBAAkB,EAAE,mBAAmB;CACxC,CAAC;AAEF,MAAM,OAAO,YAAY;IACf,aAAa,CAAgB;IAErC,YAAY,aAA6B;QACvC,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,IAAI,aAAa,EAAE,CAAC;IAC5D,CAAC;IAED,4DAA4D;IAC5D,MAAM,CACJ,YAAwB,EACxB,QAAgB,EAChB,QAAgB,EAChB,WAAmB;QAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE;YACrE,SAAS,EAAE,CAAC,WAAW,CAAC;SACzB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAkB,EAAE,CAAC;QAEnC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACrC,+CAA+C;YAC/C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEnD,6CAA6C;YAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,aAAa;gBAAE,SAAS;YAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAE3D,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,WAAW;gBACpB,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACjC,SAAS;gBACT,UAAU;gBACV,cAAc,EAAE,0BAA0B;gBAC1C,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;aACnF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,UAAU,CAAC,YAAoB;QACrC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEO,gBAAgB,CAAC,IAAe;QACtC,yDAAyD;QACzD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;gBACvC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAAE,OAAO,IAAI,CAAC;YACvD,CAAC;QACH,CAAC;QACD,6BAA6B;QAC7B,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,iBAAiB,CAAC,IAAe;QACvC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC3D,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;QACxD,OAAO,IAAI,CAAC,CAAC,WAAW;IAC1B,CAAC;IAEO,iBAAiB,CAAC,IAAe,EAAE,IAAe;QACxD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/engine/analyzers/security/taint/TaintAnalyzer.d.ts

@@ -0,0 +1,24 @@
+/**
+ * KSA-164: Taint Analyzer — Main taint analysis engine.
+ * Combines CFG, data flow, and taint propagation to find source-to-sink paths.
+ */
+import type { SyntaxNode } from '../../../parsers/types.js';
+import { TaintRegistry } from './TaintRegistry.js';
+import type { TaintResult, TaintOptions } from '../types.js';
+export declare class TaintAnalyzer {
+    private cfgBuilder;
+    private dataFlowAnalyzer;
+    private registry;
+    private propagator;
+    private cfgCache;
+    private readonly MAX_CACHE;
+    constructor(registry?: TaintRegistry);
+    /** Perform taint analysis on a function node. */
+    analyze(functionNode: SyntaxNode, language: string, options?: TaintOptions): TaintResult;
+    /** Get the taint registry for external configuration. */
+    getRegistry(): TaintRegistry;
+    /** Identify taint sources from function parameters. */
+    private identifyParamSources;
+    /** Find a taint sink in a statement and check if it receives tainted data. */
+    private findSink;
+}