seaworthycode 1.2.13 → 1.2.16

package/dist/index.js

@@ -407,12 +407,12 @@ async function crawl(options) {
           const { isBinary, isGenerated } = await peekFileHead(fullPath);
           if (isBinary || isGenerated) continue;
           if (await shouldSkipMinifiedJs(fullPath, entry.name)) continue;
-          let cachedContent;
           files.push({
             path: fullPath,
             relativePath: relPath,
-            content: () => cachedContent ??= fs.readFile(fullPath, "utf-8"),
-            language: inferLanguage(entry.name)
+            content: () => fs.readFile(fullPath, "utf-8"),
+            language: inferLanguage(entry.name),
+            size: stat2.size
           });
         } catch {
         }
@@ -428,12 +428,12 @@ async function crawl(options) {
         const { isBinary, isGenerated } = await peekFileHead(fullPath);
         if (isBinary || isGenerated) continue;
         if (await shouldSkipMinifiedJs(fullPath, entry.name)) continue;
-        let cachedContent;
         files.push({
           path: fullPath,
           relativePath: relPath,
-          content: () => cachedContent ??= fs.readFile(fullPath, "utf-8"),
-          language: inferLanguage(entry.name)
+          content: () => fs.readFile(fullPath, "utf-8"),
+          language: inferLanguage(entry.name),
+          size: stat2.size
         });
       } catch {
       }
@@ -1630,7 +1630,9 @@ var ScanRunner = class {
       files,
       meta,
       taintCache: /* @__PURE__ */ new Map(),
-      astCache: /* @__PURE__ */ new Map(),
+      // astCache is intentionally omitted here — each check gets its own
+      // per-check cache below so content strings are GC'd when the check ends.
+      astCache: void 0,
       bashAstCache: /* @__PURE__ */ new Map()
     };
     const results = [];
@@ -1654,6 +1656,7 @@ var ScanRunner = class {
         let timedOut = false;
         let softTimer;
         let hardTimer;
+        const checkCtx = { ...ctx, astCache: /* @__PURE__ */ new Map() };
         try {
           const findings2 = await new Promise((resolve22, reject) => {
             softTimer = setTimeout(() => {
@@ -1670,7 +1673,7 @@ var ScanRunner = class {
               );
               resolve22([]);
             }, checkTimeoutMs);
-            check2.run(ctx).then(resolve22, reject);
+            check2.run(checkCtx).then(resolve22, reject);
           });
           clearTimeout(softTimer);
           clearTimeout(hardTimer);
@@ -6025,21 +6028,14 @@ function downgradeSeverity(severity) {
   if (idx < 0 || idx >= SEVERITY_ORDER3.length - 1) return severity;
   return SEVERITY_ORDER3[idx + 1];
 }
-function estimateTokens(text22) {
-  return Math.ceil(text22.length / 4);
-}
-async function filterFilesByBudget(files, budget) {
+function filterFilesByBudget(files, budget) {
   if (budget === void 0 || budget === Infinity) {
     return files;
   }
-  const result = [];
-  for (const file of files) {
-    const content = await file.content();
-    if (estimateTokens(content) <= budget) {
-      result.push(file);
-    }
-  }
-  return result;
+  return files.filter((file) => {
+    const tokens2 = file.size !== void 0 ? Math.ceil(file.size / 4) : budget;
+    return tokens2 <= budget;
+  });
 }
 async function buildCacheKey(ctx, template, files) {
   if (!ctx.llm) return void 0;
@@ -6216,14 +6212,21 @@ async function runLLMCheck(ctx, template) {
     return [];
   }
   const proEligibleFiles = ctx.files.filter((f) => isProCheckEligible(f, template));
-  const cacheKey = await buildCacheKey(ctx, template, proEligibleFiles);
+  let eligibleFiles = filterFilesByBudget(proEligibleFiles, template.tokenBudget);
+  const maxFiles = getMaxFilesPerLlmCheck();
+  if (eligibleFiles.length > maxFiles) {
+    console.error(
+      `[seaworthy] ${template.checkId}: ${eligibleFiles.length} eligible files \u2014 capping LLM prompt to ${maxFiles}`
+    );
+    eligibleFiles = eligibleFiles.slice(0, maxFiles);
+  }
+  const cacheKey = await buildCacheKey(ctx, template, eligibleFiles);
   if (cacheKey) {
     const cached = readCache(cacheKey);
     if (cached !== null) {
       return cached;
     }
   }
-  let eligibleFiles = await filterFilesByBudget(proEligibleFiles, template.tokenBudget);
   if (eligibleFiles.length === 0) {
     let mechFindings = await runMechanicalCheck(ctx, template);
     if (template.projectScoped) {
@@ -6239,13 +6242,6 @@ async function runLLMCheck(ctx, template) {
     }
     return withRemediation;
   }
-  const maxFiles = getMaxFilesPerLlmCheck();
-  if (eligibleFiles.length > maxFiles) {
-    console.error(
-      `[seaworthy] ${template.checkId}: ${eligibleFiles.length} eligible files \u2014 capping LLM prompt to ${maxFiles}`
-    );
-    eligibleFiles = eligibleFiles.slice(0, maxFiles);
-  }
   const prompt = `${PROMPT_PREAMBLE}
 
 ${await template.buildPrompt(eligibleFiles)}`;
@@ -6399,7 +6395,7 @@ registry.register({
     return runLLMCheck(ctx, promptTemplate2);
   }
 });
-var PROMPT_VERSION3 = "1.0.0";
+var PROMPT_VERSION3 = "1.1.0";
 var fallbackPatterns3 = [
   {
     regex: /['"`]\s*(?:SELECT|INSERT|UPDATE|DELETE)\s+.*\$\{/i,
@@ -6413,7 +6409,22 @@ var fallbackPatterns3 = [
   }
 ];
 async function buildPrompt3(sourceFiles) {
-  const parts = ["Check for SQL injection vulnerabilities. Look for raw string concatenation or template literals used to build SQL queries. Flag any use of string interpolation in .query(), .raw(), .execute(), or raw SQL strings."];
+  const parts = [
+    `Check for SQL injection: flag ONLY where user-controlled input reaches a SQL query WITHOUT parameterization.
+
+SAFE \u2014 do NOT flag:
+- Queries using ? or $N placeholders with a separate args array: db.Query("SELECT * FROM t WHERE id = ?", id)
+- GORM .Raw()/.Exec() with ? bindings, even when the SQL string contains || (PostgreSQL concat operator inside the string): db.Exec("ST_GeomFromText('POINT(' || ? || ')', 4326)", lat, lng)
+- String concatenation where ALL operands are string literals (compile-time constants, not variables)
+- Variables sourced from application config or startup env, not from HTTP requests or user payloads
+
+UNSAFE \u2014 DO flag:
+- Template literals / f-strings injecting request values: db.query(\`SELECT * FROM t WHERE id = \${req.params.id}\`)
+- String concatenation where a variable traces to req.body, req.query, FormValue(), r.URL.Query(), $_GET, $_POST, or similar external input
+- fmt.Sprintf building a SQL string with user-supplied arguments (not just format specifiers over internal values)
+
+Only flag if you can trace the injected value to an external input source (HTTP request, message payload, file upload).`
+  ];
   for (const file of sourceFiles) {
     const content = await file.content();
     parts.push(`--- ${file.relativePath} ---
@@ -6455,7 +6466,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|raw|execute)$"))
   arguments: (arguments
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (member_expression
@@ -6485,7 +6497,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|raw|execute)$"))
   arguments: (arguments
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (member_expression
@@ -6515,7 +6528,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|raw|execute)$"))
   arguments: (arguments
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (member_expression
@@ -6545,7 +6559,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|execute|raw)$"))
   arguments: (argument_list
     (binary_operator
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call
   function: (attribute
@@ -6574,7 +6589,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(Query|Exec|QueryRow)$"))
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (selector_expression
@@ -6623,14 +6639,16 @@ var tsCheck4 = createTreeSitterCheck({
   (#match? @method "^execute.*$")
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (method_invocation
   name: (identifier) @method
   (#eq? @method "prepareStatement")
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (method_invocation
   object: (identifier) @obj
@@ -6639,7 +6657,8 @@ var tsCheck4 = createTreeSitterCheck({
   (#match? @method "^(query|update)$")
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 `,
     ruby: `
 (call
@@ -6662,6 +6681,13 @@ var tsCheck4 = createTreeSitterCheck({
   remediationKey: "remediation.security.sql-injection-surface",
   messageFactory: (captures) => {
     return getCopy("checks.sql-injection-surface.message", captures.method ?? "?");
+  },
+  matchFilter: (captures) => {
+    if (!captures.rhs) return true;
+    const rhs = captures.rhs.trim();
+    if (/^["'`]/.test(rhs)) return false;
+    if (/^\[\]byte\s*\(["']/.test(rhs)) return false;
+    return true;
   }
 });
 var llmCheck = {
@@ -8903,52 +8929,6 @@ var QUERIES6 = {
   arguments: (argument_list
     (_) @data)) @match
   `,
-  go: `
-(call_expression
-  function: (selector_expression
-    operand: (identifier) @obj
-    field: (field_identifier) @field
-    (#eq? @obj "json")
-    (#eq? @field "Unmarshal"))
-  arguments: (argument_list
-    [
-      (identifier) @data
-      (call_expression) @data
-      (selector_expression) @data
-      (index_expression) @data
-      (binary_expression) @data
-    ]
-    (_))) @match
-
-(call_expression
-  function: (selector_expression
-    field: (field_identifier) @field
-    (#eq? @field "Decode"))
-  arguments: (argument_list
-    [
-      (identifier) @data
-      (call_expression) @data
-      (selector_expression) @data
-      (index_expression) @data
-      (binary_expression) @data
-    ])) @match
-
-(call_expression
-  function: (selector_expression
-    operand: (identifier) @obj
-    field: (field_identifier) @field
-    (#eq? @obj "xml")
-    (#eq? @field "Unmarshal"))
-  arguments: (argument_list
-    [
-      (identifier) @data
-      (call_expression) @data
-      (selector_expression) @data
-      (index_expression) @data
-      (binary_expression) @data
-    ]
-    (_))) @match
-  `,
   java: `
 (method_invocation
   name: (identifier) @method