seaworthycode 1.2.13 → 1.2.17

package/dist/index.js

@@ -412,7 +412,8 @@ async function crawl(options) {
             path: fullPath,
             relativePath: relPath,
             content: () => cachedContent ??= fs.readFile(fullPath, "utf-8"),
-            language: inferLanguage(entry.name)
+            language: inferLanguage(entry.name),
+            size: stat2.size
           });
         } catch {
         }
@@ -433,7 +434,8 @@ async function crawl(options) {
           path: fullPath,
           relativePath: relPath,
           content: () => cachedContent ??= fs.readFile(fullPath, "utf-8"),
-          language: inferLanguage(entry.name)
+          language: inferLanguage(entry.name),
+          size: stat2.size
         });
       } catch {
       }
@@ -1630,7 +1632,9 @@ var ScanRunner = class {
       files,
       meta,
       taintCache: /* @__PURE__ */ new Map(),
-      astCache: /* @__PURE__ */ new Map(),
+      // astCache is intentionally omitted here — each check gets its own
+      // per-check cache below so content strings are GC'd when the check ends.
+      astCache: void 0,
       bashAstCache: /* @__PURE__ */ new Map()
     };
     const results = [];
@@ -1654,6 +1658,7 @@ var ScanRunner = class {
         let timedOut = false;
         let softTimer;
         let hardTimer;
+        const checkCtx = { ...ctx, astCache: /* @__PURE__ */ new Map() };
         try {
           const findings2 = await new Promise((resolve22, reject) => {
             softTimer = setTimeout(() => {
@@ -1670,7 +1675,7 @@ var ScanRunner = class {
               );
               resolve22([]);
             }, checkTimeoutMs);
-            check2.run(ctx).then(resolve22, reject);
+            check2.run(checkCtx).then(resolve22, reject);
           });
           clearTimeout(softTimer);
           clearTimeout(hardTimer);
@@ -5982,6 +5987,14 @@ function getMaxFilesPerLlmCheck() {
   }
   return 150;
 }
+function getMechanicalMaxFiles() {
+  const env2 = process.env.SEAWORTHY_MECHANICAL_MAX_FILES;
+  if (env2 !== void 0) {
+    const n = parseInt(env2, 10);
+    if (!isNaN(n) && n > 0) return n;
+  }
+  return 2e3;
+}
 function withLLMTimeout(promise, ms) {
   return new Promise((resolve22, reject) => {
     const timerId = setTimeout(() => {
@@ -6034,8 +6047,14 @@ async function filterFilesByBudget(files, budget) {
   }
   const result = [];
   for (const file of files) {
-    const content = await file.content();
-    if (estimateTokens(content) <= budget) {
+    let tokens2;
+    if (file.size !== void 0) {
+      tokens2 = Math.ceil(file.size / 4);
+    } else {
+      const content = await file.content();
+      tokens2 = estimateTokens(content);
+    }
+    if (tokens2 <= budget) {
       result.push(file);
     }
   }
@@ -6090,7 +6109,9 @@ function capProjectScopedFindings(findings) {
 }
 async function runProjectScopedMechanical(eligibleFiles, template) {
   if (eligibleFiles.length === 0) return [];
-  const contents = await Promise.all(eligibleFiles.map((f) => f.content()));
+  const maxFiles = getMechanicalMaxFiles();
+  const scanFiles = eligibleFiles.length > maxFiles ? eligibleFiles.slice(0, maxFiles) : eligibleFiles;
+  const contents = await Promise.all(scanFiles.map((f) => f.content()));
   const combined = contents.join("\n");
   let shouldFlag = false;
   const pattern = template.fallbackPatterns[0];
@@ -6117,13 +6138,23 @@ async function runProjectAbsenceChecks(eligibleFiles, template) {
   if (absencePatterns.length === 0 || eligibleFiles.length === 0) {
     return [];
   }
-  const contents = await Promise.all(eligibleFiles.map((f) => f.content()));
+  const maxFiles = getMechanicalMaxFiles();
+  const scanFiles = eligibleFiles.length > maxFiles ? eligibleFiles.slice(0, maxFiles) : eligibleFiles;
   const anchorFile = pickProjectAnchorFile(eligibleFiles);
+  const foundIndices = /* @__PURE__ */ new Set();
+  for (const file of scanFiles) {
+    if (foundIndices.size === absencePatterns.length) break;
+    const content = await file.content();
+    for (let i = 0; i < absencePatterns.length; i++) {
+      if (!foundIndices.has(i) && absencePatterns[i].regex.test(content)) {
+        foundIndices.add(i);
+      }
+    }
+  }
   const results = [];
-  for (const pattern of absencePatterns) {
-    const foundAnywhere = contents.some((content) => pattern.regex.test(content));
-    if (!foundAnywhere) {
-      results.push(makeMechanicalFinding(template, pattern, anchorFile, 1));
+  for (let i = 0; i < absencePatterns.length; i++) {
+    if (!foundIndices.has(i)) {
+      results.push(makeMechanicalFinding(template, absencePatterns[i], anchorFile, 1));
     }
   }
   return results;
@@ -6135,8 +6166,16 @@ async function runMechanicalCheck(ctx, template) {
   }
   const perFilePatterns = template.fallbackPatterns.filter((p) => !p.absenceBased);
   const projectResults = await runProjectAbsenceChecks(eligibleFiles, template);
+  const maxMechanicalFiles = getMechanicalMaxFiles();
+  let cappedFiles = eligibleFiles;
+  if (cappedFiles.length > maxMechanicalFiles) {
+    console.error(
+      `[seaworthy] ${template.checkId}: ${cappedFiles.length} eligible files \u2014 capping mechanical scan to ${maxMechanicalFiles}`
+    );
+    cappedFiles = cappedFiles.slice(0, maxMechanicalFiles);
+  }
   const fileResults = perFilePatterns.length === 0 ? [] : await runWithConcurrencyCollect(
-    eligibleFiles,
+    cappedFiles,
     async (file) => {
       const content = await file.content();
       const lines = content.split("\n");
@@ -6216,14 +6255,21 @@ async function runLLMCheck(ctx, template) {
     return [];
   }
   const proEligibleFiles = ctx.files.filter((f) => isProCheckEligible(f, template));
-  const cacheKey = await buildCacheKey(ctx, template, proEligibleFiles);
+  let eligibleFiles = await filterFilesByBudget(proEligibleFiles, template.tokenBudget);
+  const maxFiles = getMaxFilesPerLlmCheck();
+  if (eligibleFiles.length > maxFiles) {
+    console.error(
+      `[seaworthy] ${template.checkId}: ${eligibleFiles.length} eligible files \u2014 capping LLM prompt to ${maxFiles}`
+    );
+    eligibleFiles = eligibleFiles.slice(0, maxFiles);
+  }
+  const cacheKey = await buildCacheKey(ctx, template, eligibleFiles);
   if (cacheKey) {
     const cached = readCache(cacheKey);
     if (cached !== null) {
       return cached;
     }
   }
-  let eligibleFiles = await filterFilesByBudget(proEligibleFiles, template.tokenBudget);
   if (eligibleFiles.length === 0) {
     let mechFindings = await runMechanicalCheck(ctx, template);
     if (template.projectScoped) {
@@ -6239,13 +6285,6 @@ async function runLLMCheck(ctx, template) {
     }
     return withRemediation;
   }
-  const maxFiles = getMaxFilesPerLlmCheck();
-  if (eligibleFiles.length > maxFiles) {
-    console.error(
-      `[seaworthy] ${template.checkId}: ${eligibleFiles.length} eligible files \u2014 capping LLM prompt to ${maxFiles}`
-    );
-    eligibleFiles = eligibleFiles.slice(0, maxFiles);
-  }
   const prompt = `${PROMPT_PREAMBLE}
 
 ${await template.buildPrompt(eligibleFiles)}`;
@@ -6399,7 +6438,7 @@ registry.register({
     return runLLMCheck(ctx, promptTemplate2);
   }
 });
-var PROMPT_VERSION3 = "1.0.0";
+var PROMPT_VERSION3 = "1.1.0";
 var fallbackPatterns3 = [
   {
     regex: /['"`]\s*(?:SELECT|INSERT|UPDATE|DELETE)\s+.*\$\{/i,
@@ -6413,7 +6452,22 @@ var fallbackPatterns3 = [
   }
 ];
 async function buildPrompt3(sourceFiles) {
-  const parts = ["Check for SQL injection vulnerabilities. Look for raw string concatenation or template literals used to build SQL queries. Flag any use of string interpolation in .query(), .raw(), .execute(), or raw SQL strings."];
+  const parts = [
+    `Check for SQL injection: flag ONLY where user-controlled input reaches a SQL query WITHOUT parameterization.
+
+SAFE \u2014 do NOT flag:
+- Queries using ? or $N placeholders with a separate args array: db.Query("SELECT * FROM t WHERE id = ?", id)
+- GORM .Raw()/.Exec() with ? bindings, even when the SQL string contains || (PostgreSQL concat operator inside the string): db.Exec("ST_GeomFromText('POINT(' || ? || ')', 4326)", lat, lng)
+- String concatenation where ALL operands are string literals (compile-time constants, not variables)
+- Variables sourced from application config or startup env, not from HTTP requests or user payloads
+
+UNSAFE \u2014 DO flag:
+- Template literals / f-strings injecting request values: db.query(\`SELECT * FROM t WHERE id = \${req.params.id}\`)
+- String concatenation where a variable traces to req.body, req.query, FormValue(), r.URL.Query(), $_GET, $_POST, or similar external input
+- fmt.Sprintf building a SQL string with user-supplied arguments (not just format specifiers over internal values)
+
+Only flag if you can trace the injected value to an external input source (HTTP request, message payload, file upload).`
+  ];
   for (const file of sourceFiles) {
     const content = await file.content();
     parts.push(`--- ${file.relativePath} ---
@@ -6455,7 +6509,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|raw|execute)$"))
   arguments: (arguments
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (member_expression
@@ -6485,7 +6540,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|raw|execute)$"))
   arguments: (arguments
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (member_expression
@@ -6515,7 +6571,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|raw|execute)$"))
   arguments: (arguments
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (member_expression
@@ -6545,7 +6602,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|execute|raw)$"))
   arguments: (argument_list
     (binary_operator
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call
   function: (attribute
@@ -6574,7 +6632,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(Query|Exec|QueryRow)$"))
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (selector_expression
@@ -6623,14 +6682,16 @@ var tsCheck4 = createTreeSitterCheck({
   (#match? @method "^execute.*$")
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (method_invocation
   name: (identifier) @method
   (#eq? @method "prepareStatement")
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (method_invocation
   object: (identifier) @obj
@@ -6639,7 +6700,8 @@ var tsCheck4 = createTreeSitterCheck({
   (#match? @method "^(query|update)$")
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 `,
     ruby: `
 (call
@@ -6662,6 +6724,13 @@ var tsCheck4 = createTreeSitterCheck({
   remediationKey: "remediation.security.sql-injection-surface",
   messageFactory: (captures) => {
     return getCopy("checks.sql-injection-surface.message", captures.method ?? "?");
+  },
+  matchFilter: (captures) => {
+    if (!captures.rhs) return true;
+    const rhs = captures.rhs.trim();
+    if (/^["'`]/.test(rhs)) return false;
+    if (/^\[\]byte\s*\(["']/.test(rhs)) return false;
+    return true;
   }
 });
 var llmCheck = {
@@ -8903,52 +8972,6 @@ var QUERIES6 = {
   arguments: (argument_list
     (_) @data)) @match
   `,
-  go: `
-(call_expression
-  function: (selector_expression
-    operand: (identifier) @obj
-    field: (field_identifier) @field
-    (#eq? @obj "json")
-    (#eq? @field "Unmarshal"))
-  arguments: (argument_list
-    [
-      (identifier) @data
-      (call_expression) @data
-      (selector_expression) @data
-      (index_expression) @data
-      (binary_expression) @data
-    ]
-    (_))) @match
-
-(call_expression
-  function: (selector_expression
-    field: (field_identifier) @field
-    (#eq? @field "Decode"))
-  arguments: (argument_list
-    [
-      (identifier) @data
-      (call_expression) @data
-      (selector_expression) @data
-      (index_expression) @data
-      (binary_expression) @data
-    ])) @match
-
-(call_expression
-  function: (selector_expression
-    operand: (identifier) @obj
-    field: (field_identifier) @field
-    (#eq? @obj "xml")
-    (#eq? @field "Unmarshal"))
-  arguments: (argument_list
-    [
-      (identifier) @data
-      (call_expression) @data
-      (selector_expression) @data
-      (index_expression) @data
-      (binary_expression) @data
-    ]
-    (_))) @match
-  `,
   java: `
 (method_invocation
   name: (identifier) @method