secure-review-extension 1.0.3 → 1.0.4

package/package.json

@@ -2,7 +2,7 @@
   "name": "secure-review-extension",
   "displayName": "Secure Review",
   "description": "Run deep static and Docker-based dynamic secure code reviews directly inside VS Code.",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "publisher": "your-publisher-id",
   "icon": "media/shield.png",
   "license": "MIT",

package/src/scanners/static-scan.js

@@ -43,6 +43,27 @@ const ALLOWED_EXTENSIONS = new Set([
   ".xml"
 ]);
 
+const LOCKFILE_NAMES = new Set([
+  "package-lock.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "Cargo.lock",
+  "poetry.lock"
+]);
+
+const ENV_LIKE_NAMES = new Set([
+  ".env",
+  ".env.local",
+  ".env.development",
+  ".env.production",
+  ".env.test"
+]);
+
+const ENV_ALLOWED_RULES = new Set([
+  "hardcoded-secret",
+  "aws-access-key"
+]);
+
 async function scanWorkspace(config) {
   const workspaceProfile = await buildWorkspaceProfile(config);
   return scanProfile(workspaceProfile, config);
@@ -104,8 +125,13 @@ function scanContent(filePath, content, workspaceRoot) {
   const lines = content.split(/\r?\n/);
   const findings = [];
   const relativePath = toRelativePath(filePath, workspaceRoot);
+  const baseName = path.basename(filePath);
 
   for (const rule of STATIC_RULES) {
+    if (!shouldApplyRuleToFile(rule, filePath, baseName)) {
+      continue;
+    }
+
     const regex = new RegExp(rule.regex);
     let match;
 
@@ -147,6 +173,26 @@ function scanContent(filePath, content, workspaceRoot) {
   return findings;
 }
 
+function shouldApplyRuleToFile(rule, filePath, baseName) {
+  if (isLockfile(baseName)) {
+    return false;
+  }
+
+  if (isEnvLikeFile(filePath, baseName)) {
+    return ENV_ALLOWED_RULES.has(rule.id);
+  }
+
+  return true;
+}
+
+function isLockfile(baseName) {
+  return LOCKFILE_NAMES.has(baseName);
+}
+
+function isEnvLikeFile(filePath, baseName) {
+  return ENV_LIKE_NAMES.has(baseName) || /\.env(\.|$)/i.test(filePath);
+}
+
 function correlateTestCoverage(findings, relativePaths) {
   return findings.filter((finding) => {
     if (finding.code !== "missing-tests-heuristic") {

package/src/scanners/tool-integrations.js

@@ -219,6 +219,10 @@ async function runEslint(workspaceProfile, config) {
   const excludes = scannerExcludeNames(workspaceProfile).flatMap((entry) => ["--ignore-pattern", entry]);
   const result = await execFileAsync("eslint", ["-f", "json", ...excludes, "."], scannerOptions(workspaceProfile, config));
 
+  if (eslintConfigMissing(result)) {
+    return [];
+  }
+
   if (result.error && !result.stdout) {
     throw result.error;
   }
@@ -260,6 +264,12 @@ async function runEslint(workspaceProfile, config) {
   }));
 }
 
+function eslintConfigMissing(result) {
+  const text = `${result?.stdout || ""}\n${result?.stderr || ""}`;
+  return /eslint couldn't find an eslint\.config\.(js|mjs|cjs) file/i.test(text)
+    || /could not find config file/i.test(text);
+}
+
 async function runNpmAudit(workspaceProfile, config) {
   if (!fs.existsSync(path.join(workspaceProfile.workspaceRoot, "package.json"))) {
     return [];