secure-scan 1.2.2

package/dist/rules/vulnerabilities/index.d.ts

@@ -0,0 +1,148 @@
+/**
+ * @fileoverview Vulnerability Detection Module - Main Entry Point
+ * @module rules/vulnerabilities
+ *
+ * Enterprise-grade SAST vulnerability detection module.
+ * Provides comprehensive security analysis covering OWASP Top 10,
+ * CWE, SANS Top 25, and MITRE ATT&CK mapped vulnerabilities.
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   VulnerabilityRuleEngine,
+ *   createDefaultEngine,
+ *   quickScan,
+ *   allVulnerabilityRules
+ * } from '@/rules/vulnerabilities';
+ *
+ * // Quick scan for vulnerabilities
+ * const findings = await quickScan(code, 'javascript');
+ *
+ * // Or use the full engine
+ * const engine = createDefaultEngine();
+ * const results = await engine.analyze(code, context);
+ * ```
+ */
+export { VulnerabilityType, VulnerabilityCategory, VulnerabilitySeverity, ConfidenceLevel, SupportedLanguage, PatternType, type VulnerabilityRule, type VulnerabilityFinding, type VulnerabilityPattern, type VulnerabilityScore, type TaintSource, type TaintSink, type TaintSanitizer, type TaintFlow, type DataFlowTrace, type ImpactAssessment, type ExploitabilityAssessment, type RemediationGuidance, type SecurityStandards, type AnalysisContext, type PatternMatch } from './types';
+export { SCORE_THRESHOLDS, LIMITS, JS_TAINT_SOURCES, PYTHON_TAINT_SOURCES, PHP_TAINT_SOURCES, JAVA_TAINT_SOURCES, CSHARP_TAINT_SOURCES, SQL_INJECTION_SINKS, COMMAND_INJECTION_SINKS, XSS_SINKS, PATH_TRAVERSAL_SINKS, SSRF_SINKS, SQL_SANITIZERS, XSS_SANITIZERS, COMMAND_SANITIZERS, PATH_SANITIZERS, OWASP_TOP_10_2021, CWE_REFERENCES } from './constants';
+export { safeRegexMatch, extractSnippet, normalizeCode, findTaintSources, findTaintSinks, findSanitizers, isTestFile, isVendorCode, detectLanguage, calculateConfidence } from './utils';
+export { VulnerabilityScoreCalculator } from './scoring';
+export { VulnerabilityRuleEngine, PatternMatcher, SimpleTaintAnalyzer, createDefaultEngine, quickScan } from './engine';
+export { sqlInjectionRules } from './rules/sqlInjection';
+export { xssRules } from './rules/xss';
+export { commandInjectionRules } from './rules/commandInjection';
+export { pathTraversalRules } from './rules/pathTraversal';
+export { ssrfRules } from './rules/ssrf';
+export { deserializationRules } from './rules/deserialization';
+export { hardcodedSecretsRules } from './rules/hardcodedSecrets';
+export { authenticationRules } from './rules/authentication';
+export { securityMisconfigurationRules } from './rules/securityMisconfiguration';
+export { csrfRules } from './rules/csrf';
+export { prototypePollutionRules } from './rules/prototypePollution';
+export { fileUploadRules } from './rules/fileUpload';
+/**
+ * All vulnerability detection rules combined.
+ * Use this for comprehensive scanning.
+ */
+export declare const allVulnerabilityRules: import("./types").VulnerabilityRule[];
+/**
+ * Critical severity rules only.
+ * Use for quick scans focusing on the most severe issues.
+ */
+export declare const criticalRules: import("./types").VulnerabilityRule[];
+/**
+ * High severity and above rules.
+ * Balanced between speed and coverage.
+ */
+export declare const highSeverityRules: import("./types").VulnerabilityRule[];
+/**
+ * OWASP Top 10 focused rules.
+ * Rules specifically mapped to OWASP Top 10 2021.
+ */
+export declare const owaspTop10Rules: import("./types").VulnerabilityRule[];
+/**
+ * Injection category rules (SQL, Command, XSS, etc.).
+ */
+export declare const injectionRules: import("./types").VulnerabilityRule[];
+/**
+ * Authentication and access control rules.
+ */
+export declare const authRules: import("./types").VulnerabilityRule[];
+/**
+ * Configuration and cryptographic rules.
+ */
+export declare const configRules: import("./types").VulnerabilityRule[];
+/**
+ * Rules by language mapping.
+ */
+export declare const rulesByLanguage: {
+    javascript: import("./types").VulnerabilityRule[];
+    typescript: import("./types").VulnerabilityRule[];
+    python: import("./types").VulnerabilityRule[];
+    php: import("./types").VulnerabilityRule[];
+    java: import("./types").VulnerabilityRule[];
+    csharp: import("./types").VulnerabilityRule[];
+};
+/**
+ * Module statistics.
+ */
+export declare const moduleStats: {
+    totalRules: number;
+    criticalRules: number;
+    highSeverityRules: number;
+    byCategory: {
+        injection: number;
+        authentication: number;
+        configuration: number;
+        ssrf: number;
+        pathTraversal: number;
+        deserialization: number;
+        fileUpload: number;
+    };
+    byLanguage: {
+        javascript: number;
+        python: number;
+        php: number;
+        java: number;
+        csharp: number;
+    };
+    version: string;
+};
+declare const _default: {
+    rules: import("./types").VulnerabilityRule[];
+    criticalRules: import("./types").VulnerabilityRule[];
+    highSeverityRules: import("./types").VulnerabilityRule[];
+    owaspTop10Rules: import("./types").VulnerabilityRule[];
+    rulesByLanguage: {
+        javascript: import("./types").VulnerabilityRule[];
+        typescript: import("./types").VulnerabilityRule[];
+        python: import("./types").VulnerabilityRule[];
+        php: import("./types").VulnerabilityRule[];
+        java: import("./types").VulnerabilityRule[];
+        csharp: import("./types").VulnerabilityRule[];
+    };
+    stats: {
+        totalRules: number;
+        criticalRules: number;
+        highSeverityRules: number;
+        byCategory: {
+            injection: number;
+            authentication: number;
+            configuration: number;
+            ssrf: number;
+            pathTraversal: number;
+            deserialization: number;
+            fileUpload: number;
+        };
+        byLanguage: {
+            javascript: number;
+            python: number;
+            php: number;
+            java: number;
+            csharp: number;
+        };
+        version: string;
+    };
+};
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/vulnerabilities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rules/vulnerabilities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAMH,OAAO,EAEL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,WAAW,EAGX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,YAAY,EAClB,MAAM,SAAS,CAAC;AAMjB,OAAO,EAEL,gBAAgB,EAChB,MAAM,EAGN,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAGpB,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,EACT,oBAAoB,EACpB,UAAU,EAGV,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,eAAe,EAGf,iBAAiB,EACjB,cAAc,EACf,MAAM,aAAa,CAAC;AAMrB,OAAO,EAEL,cAAc,EACd,cAAc,EACd,aAAa,EAGb,gBAAgB,EAChB,cAAc,EACd,cAAc,EAGd,UAAU,EACV,YAAY,EACZ,cAAc,EAGd,mBAAmB,EACpB,MAAM,SAAS,CAAC;AAMjB,OAAO,EACL,4BAA4B,EAC7B,MAAM,WAAW,CAAC;AAMnB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,SAAS,EACV,MAAM,UAAU,CAAC;AAwBlB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAMrD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,uCAajC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,uCAEzB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,uCAE7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,uCAE3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,uCAK1B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,SAAS,uCAGrB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,WAAW,uCAGvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;CAmB3B,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;CAwBvB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMF,wBAOE"}

package/dist/rules/vulnerabilities/index.js

@@ -0,0 +1,252 @@
+"use strict";
+/**
+ * @fileoverview Vulnerability Detection Module - Main Entry Point
+ * @module rules/vulnerabilities
+ *
+ * Enterprise-grade SAST vulnerability detection module.
+ * Provides comprehensive security analysis covering OWASP Top 10,
+ * CWE, SANS Top 25, and MITRE ATT&CK mapped vulnerabilities.
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   VulnerabilityRuleEngine,
+ *   createDefaultEngine,
+ *   quickScan,
+ *   allVulnerabilityRules
+ * } from '@/rules/vulnerabilities';
+ *
+ * // Quick scan for vulnerabilities
+ * const findings = await quickScan(code, 'javascript');
+ *
+ * // Or use the full engine
+ * const engine = createDefaultEngine();
+ * const results = await engine.analyze(code, context);
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.csrfRules = exports.securityMisconfigurationRules = exports.authenticationRules = exports.hardcodedSecretsRules = exports.deserializationRules = exports.ssrfRules = exports.pathTraversalRules = exports.commandInjectionRules = exports.xssRules = exports.sqlInjectionRules = exports.quickScan = exports.createDefaultEngine = exports.SimpleTaintAnalyzer = exports.PatternMatcher = exports.VulnerabilityRuleEngine = exports.VulnerabilityScoreCalculator = exports.calculateConfidence = exports.detectLanguage = exports.isVendorCode = exports.isTestFile = exports.findSanitizers = exports.findTaintSinks = exports.findTaintSources = exports.normalizeCode = exports.extractSnippet = exports.safeRegexMatch = exports.CWE_REFERENCES = exports.OWASP_TOP_10_2021 = exports.PATH_SANITIZERS = exports.COMMAND_SANITIZERS = exports.XSS_SANITIZERS = exports.SQL_SANITIZERS = exports.SSRF_SINKS = exports.PATH_TRAVERSAL_SINKS = exports.XSS_SINKS = exports.COMMAND_INJECTION_SINKS = exports.SQL_INJECTION_SINKS = exports.CSHARP_TAINT_SOURCES = exports.JAVA_TAINT_SOURCES = exports.PHP_TAINT_SOURCES = exports.PYTHON_TAINT_SOURCES = exports.JS_TAINT_SOURCES = exports.LIMITS = exports.SCORE_THRESHOLDS = exports.PatternType = exports.SupportedLanguage = exports.ConfidenceLevel = exports.VulnerabilitySeverity = exports.VulnerabilityCategory = exports.VulnerabilityType = void 0;
+exports.moduleStats = exports.rulesByLanguage = exports.configRules = exports.authRules = exports.injectionRules = exports.owaspTop10Rules = exports.highSeverityRules = exports.criticalRules = exports.allVulnerabilityRules = exports.fileUploadRules = exports.prototypePollutionRules = void 0;
+// ============================================================================
+// TYPE EXPORTS
+// ============================================================================
+var types_1 = require("./types");
+// Enums
+Object.defineProperty(exports, "VulnerabilityType", { enumerable: true, get: function () { return types_1.VulnerabilityType; } });
+Object.defineProperty(exports, "VulnerabilityCategory", { enumerable: true, get: function () { return types_1.VulnerabilityCategory; } });
+Object.defineProperty(exports, "VulnerabilitySeverity", { enumerable: true, get: function () { return types_1.VulnerabilitySeverity; } });
+Object.defineProperty(exports, "ConfidenceLevel", { enumerable: true, get: function () { return types_1.ConfidenceLevel; } });
+Object.defineProperty(exports, "SupportedLanguage", { enumerable: true, get: function () { return types_1.SupportedLanguage; } });
+Object.defineProperty(exports, "PatternType", { enumerable: true, get: function () { return types_1.PatternType; } });
+// ============================================================================
+// CONSTANTS EXPORTS
+// ============================================================================
+var constants_1 = require("./constants");
+// Score thresholds
+Object.defineProperty(exports, "SCORE_THRESHOLDS", { enumerable: true, get: function () { return constants_1.SCORE_THRESHOLDS; } });
+Object.defineProperty(exports, "LIMITS", { enumerable: true, get: function () { return constants_1.LIMITS; } });
+// Taint sources by language
+Object.defineProperty(exports, "JS_TAINT_SOURCES", { enumerable: true, get: function () { return constants_1.JS_TAINT_SOURCES; } });
+Object.defineProperty(exports, "PYTHON_TAINT_SOURCES", { enumerable: true, get: function () { return constants_1.PYTHON_TAINT_SOURCES; } });
+Object.defineProperty(exports, "PHP_TAINT_SOURCES", { enumerable: true, get: function () { return constants_1.PHP_TAINT_SOURCES; } });
+Object.defineProperty(exports, "JAVA_TAINT_SOURCES", { enumerable: true, get: function () { return constants_1.JAVA_TAINT_SOURCES; } });
+Object.defineProperty(exports, "CSHARP_TAINT_SOURCES", { enumerable: true, get: function () { return constants_1.CSHARP_TAINT_SOURCES; } });
+// Taint sinks by category
+Object.defineProperty(exports, "SQL_INJECTION_SINKS", { enumerable: true, get: function () { return constants_1.SQL_INJECTION_SINKS; } });
+Object.defineProperty(exports, "COMMAND_INJECTION_SINKS", { enumerable: true, get: function () { return constants_1.COMMAND_INJECTION_SINKS; } });
+Object.defineProperty(exports, "XSS_SINKS", { enumerable: true, get: function () { return constants_1.XSS_SINKS; } });
+Object.defineProperty(exports, "PATH_TRAVERSAL_SINKS", { enumerable: true, get: function () { return constants_1.PATH_TRAVERSAL_SINKS; } });
+Object.defineProperty(exports, "SSRF_SINKS", { enumerable: true, get: function () { return constants_1.SSRF_SINKS; } });
+// Sanitizers
+Object.defineProperty(exports, "SQL_SANITIZERS", { enumerable: true, get: function () { return constants_1.SQL_SANITIZERS; } });
+Object.defineProperty(exports, "XSS_SANITIZERS", { enumerable: true, get: function () { return constants_1.XSS_SANITIZERS; } });
+Object.defineProperty(exports, "COMMAND_SANITIZERS", { enumerable: true, get: function () { return constants_1.COMMAND_SANITIZERS; } });
+Object.defineProperty(exports, "PATH_SANITIZERS", { enumerable: true, get: function () { return constants_1.PATH_SANITIZERS; } });
+// Security standards
+Object.defineProperty(exports, "OWASP_TOP_10_2021", { enumerable: true, get: function () { return constants_1.OWASP_TOP_10_2021; } });
+Object.defineProperty(exports, "CWE_REFERENCES", { enumerable: true, get: function () { return constants_1.CWE_REFERENCES; } });
+// ============================================================================
+// UTILITY EXPORTS
+// ============================================================================
+var utils_1 = require("./utils");
+// Regex utilities
+Object.defineProperty(exports, "safeRegexMatch", { enumerable: true, get: function () { return utils_1.safeRegexMatch; } });
+Object.defineProperty(exports, "extractSnippet", { enumerable: true, get: function () { return utils_1.extractSnippet; } });
+Object.defineProperty(exports, "normalizeCode", { enumerable: true, get: function () { return utils_1.normalizeCode; } });
+// Taint analysis helpers
+Object.defineProperty(exports, "findTaintSources", { enumerable: true, get: function () { return utils_1.findTaintSources; } });
+Object.defineProperty(exports, "findTaintSinks", { enumerable: true, get: function () { return utils_1.findTaintSinks; } });
+Object.defineProperty(exports, "findSanitizers", { enumerable: true, get: function () { return utils_1.findSanitizers; } });
+// Context detection
+Object.defineProperty(exports, "isTestFile", { enumerable: true, get: function () { return utils_1.isTestFile; } });
+Object.defineProperty(exports, "isVendorCode", { enumerable: true, get: function () { return utils_1.isVendorCode; } });
+Object.defineProperty(exports, "detectLanguage", { enumerable: true, get: function () { return utils_1.detectLanguage; } });
+// Confidence calculation
+Object.defineProperty(exports, "calculateConfidence", { enumerable: true, get: function () { return utils_1.calculateConfidence; } });
+// ============================================================================
+// SCORING EXPORTS
+// ============================================================================
+var scoring_1 = require("./scoring");
+Object.defineProperty(exports, "VulnerabilityScoreCalculator", { enumerable: true, get: function () { return scoring_1.VulnerabilityScoreCalculator; } });
+// ============================================================================
+// ENGINE EXPORTS
+// ============================================================================
+var engine_1 = require("./engine");
+Object.defineProperty(exports, "VulnerabilityRuleEngine", { enumerable: true, get: function () { return engine_1.VulnerabilityRuleEngine; } });
+Object.defineProperty(exports, "PatternMatcher", { enumerable: true, get: function () { return engine_1.PatternMatcher; } });
+Object.defineProperty(exports, "SimpleTaintAnalyzer", { enumerable: true, get: function () { return engine_1.SimpleTaintAnalyzer; } });
+Object.defineProperty(exports, "createDefaultEngine", { enumerable: true, get: function () { return engine_1.createDefaultEngine; } });
+Object.defineProperty(exports, "quickScan", { enumerable: true, get: function () { return engine_1.quickScan; } });
+// ============================================================================
+// RULE IMPORTS
+// ============================================================================
+const types_2 = require("./types");
+const sqlInjection_1 = require("./rules/sqlInjection");
+const xss_1 = require("./rules/xss");
+const commandInjection_1 = require("./rules/commandInjection");
+const pathTraversal_1 = require("./rules/pathTraversal");
+const ssrf_1 = require("./rules/ssrf");
+const deserialization_1 = require("./rules/deserialization");
+const hardcodedSecrets_1 = require("./rules/hardcodedSecrets");
+const authentication_1 = require("./rules/authentication");
+const securityMisconfiguration_1 = require("./rules/securityMisconfiguration");
+const csrf_1 = require("./rules/csrf");
+const prototypePollution_1 = require("./rules/prototypePollution");
+const fileUpload_1 = require("./rules/fileUpload");
+// ============================================================================
+// INDIVIDUAL RULE EXPORTS
+// ============================================================================
+var sqlInjection_2 = require("./rules/sqlInjection");
+Object.defineProperty(exports, "sqlInjectionRules", { enumerable: true, get: function () { return sqlInjection_2.sqlInjectionRules; } });
+var xss_2 = require("./rules/xss");
+Object.defineProperty(exports, "xssRules", { enumerable: true, get: function () { return xss_2.xssRules; } });
+var commandInjection_2 = require("./rules/commandInjection");
+Object.defineProperty(exports, "commandInjectionRules", { enumerable: true, get: function () { return commandInjection_2.commandInjectionRules; } });
+var pathTraversal_2 = require("./rules/pathTraversal");
+Object.defineProperty(exports, "pathTraversalRules", { enumerable: true, get: function () { return pathTraversal_2.pathTraversalRules; } });
+var ssrf_2 = require("./rules/ssrf");
+Object.defineProperty(exports, "ssrfRules", { enumerable: true, get: function () { return ssrf_2.ssrfRules; } });
+var deserialization_2 = require("./rules/deserialization");
+Object.defineProperty(exports, "deserializationRules", { enumerable: true, get: function () { return deserialization_2.deserializationRules; } });
+var hardcodedSecrets_2 = require("./rules/hardcodedSecrets");
+Object.defineProperty(exports, "hardcodedSecretsRules", { enumerable: true, get: function () { return hardcodedSecrets_2.hardcodedSecretsRules; } });
+var authentication_2 = require("./rules/authentication");
+Object.defineProperty(exports, "authenticationRules", { enumerable: true, get: function () { return authentication_2.authenticationRules; } });
+var securityMisconfiguration_2 = require("./rules/securityMisconfiguration");
+Object.defineProperty(exports, "securityMisconfigurationRules", { enumerable: true, get: function () { return securityMisconfiguration_2.securityMisconfigurationRules; } });
+var csrf_2 = require("./rules/csrf");
+Object.defineProperty(exports, "csrfRules", { enumerable: true, get: function () { return csrf_2.csrfRules; } });
+var prototypePollution_2 = require("./rules/prototypePollution");
+Object.defineProperty(exports, "prototypePollutionRules", { enumerable: true, get: function () { return prototypePollution_2.prototypePollutionRules; } });
+var fileUpload_2 = require("./rules/fileUpload");
+Object.defineProperty(exports, "fileUploadRules", { enumerable: true, get: function () { return fileUpload_2.fileUploadRules; } });
+// ============================================================================
+// AGGREGATED RULE COLLECTIONS
+// ============================================================================
+/**
+ * All vulnerability detection rules combined.
+ * Use this for comprehensive scanning.
+ */
+exports.allVulnerabilityRules = [
+    ...sqlInjection_1.sqlInjectionRules,
+    ...xss_1.xssRules,
+    ...commandInjection_1.commandInjectionRules,
+    ...pathTraversal_1.pathTraversalRules,
+    ...ssrf_1.ssrfRules,
+    ...deserialization_1.deserializationRules,
+    ...hardcodedSecrets_1.hardcodedSecretsRules,
+    ...authentication_1.authenticationRules,
+    ...securityMisconfiguration_1.securityMisconfigurationRules,
+    ...csrf_1.csrfRules,
+    ...prototypePollution_1.prototypePollutionRules,
+    ...fileUpload_1.fileUploadRules
+];
+/**
+ * Critical severity rules only.
+ * Use for quick scans focusing on the most severe issues.
+ */
+exports.criticalRules = exports.allVulnerabilityRules.filter(rule => rule.severity === 'critical');
+/**
+ * High severity and above rules.
+ * Balanced between speed and coverage.
+ */
+exports.highSeverityRules = exports.allVulnerabilityRules.filter(rule => rule.severity === 'critical' || rule.severity === 'high');
+/**
+ * OWASP Top 10 focused rules.
+ * Rules specifically mapped to OWASP Top 10 2021.
+ */
+exports.owaspTop10Rules = exports.allVulnerabilityRules.filter(rule => rule.standards?.owasp && rule.standards.owasp.length > 0);
+/**
+ * Injection category rules (SQL, Command, XSS, etc.).
+ */
+exports.injectionRules = [
+    ...sqlInjection_1.sqlInjectionRules,
+    ...xss_1.xssRules,
+    ...commandInjection_1.commandInjectionRules,
+    ...prototypePollution_1.prototypePollutionRules
+];
+/**
+ * Authentication and access control rules.
+ */
+exports.authRules = [
+    ...authentication_1.authenticationRules,
+    ...csrf_1.csrfRules
+];
+/**
+ * Configuration and cryptographic rules.
+ */
+exports.configRules = [
+    ...securityMisconfiguration_1.securityMisconfigurationRules,
+    ...hardcodedSecrets_1.hardcodedSecretsRules
+];
+/**
+ * Rules by language mapping.
+ */
+exports.rulesByLanguage = {
+    javascript: exports.allVulnerabilityRules.filter(rule => rule.languages.includes(types_2.SupportedLanguage.JAVASCRIPT) || rule.languages.includes(types_2.SupportedLanguage.TYPESCRIPT)),
+    typescript: exports.allVulnerabilityRules.filter(rule => rule.languages.includes(types_2.SupportedLanguage.TYPESCRIPT) || rule.languages.includes(types_2.SupportedLanguage.JAVASCRIPT)),
+    python: exports.allVulnerabilityRules.filter(rule => rule.languages.includes(types_2.SupportedLanguage.PYTHON)),
+    php: exports.allVulnerabilityRules.filter(rule => rule.languages.includes(types_2.SupportedLanguage.PHP)),
+    java: exports.allVulnerabilityRules.filter(rule => rule.languages.includes(types_2.SupportedLanguage.JAVA)),
+    csharp: exports.allVulnerabilityRules.filter(rule => rule.languages.includes(types_2.SupportedLanguage.CSHARP))
+};
+// ============================================================================
+// STATISTICS AND METADATA
+// ============================================================================
+/**
+ * Module statistics.
+ */
+exports.moduleStats = {
+    totalRules: exports.allVulnerabilityRules.length,
+    criticalRules: exports.criticalRules.length,
+    highSeverityRules: exports.highSeverityRules.length,
+    byCategory: {
+        injection: exports.injectionRules.length,
+        authentication: exports.authRules.length,
+        configuration: exports.configRules.length,
+        ssrf: ssrf_1.ssrfRules.length,
+        pathTraversal: pathTraversal_1.pathTraversalRules.length,
+        deserialization: deserialization_1.deserializationRules.length,
+        fileUpload: fileUpload_1.fileUploadRules.length
+    },
+    byLanguage: {
+        javascript: exports.rulesByLanguage.javascript.length,
+        python: exports.rulesByLanguage.python.length,
+        php: exports.rulesByLanguage.php.length,
+        java: exports.rulesByLanguage.java.length,
+        csharp: exports.rulesByLanguage.csharp.length
+    },
+    version: '1.0.0'
+};
+// ============================================================================
+// DEFAULT EXPORT
+// ============================================================================
+exports.default = {
+    rules: exports.allVulnerabilityRules,
+    criticalRules: exports.criticalRules,
+    highSeverityRules: exports.highSeverityRules,
+    owaspTop10Rules: exports.owaspTop10Rules,
+    rulesByLanguage: exports.rulesByLanguage,
+    stats: exports.moduleStats
+};
+//# sourceMappingURL=index.js.map

package/dist/rules/vulnerabilities/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rules/vulnerabilities/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;;AAEH,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,iCAyBiB;AAxBf,QAAQ;AACR,0GAAA,iBAAiB,OAAA;AACjB,8GAAA,qBAAqB,OAAA;AACrB,8GAAA,qBAAqB,OAAA;AACrB,wGAAA,eAAe,OAAA;AACf,0GAAA,iBAAiB,OAAA;AACjB,oGAAA,WAAW,OAAA;AAoBb,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,yCA4BqB;AA3BnB,mBAAmB;AACnB,6GAAA,gBAAgB,OAAA;AAChB,mGAAA,MAAM,OAAA;AAEN,4BAA4B;AAC5B,6GAAA,gBAAgB,OAAA;AAChB,iHAAA,oBAAoB,OAAA;AACpB,8GAAA,iBAAiB,OAAA;AACjB,+GAAA,kBAAkB,OAAA;AAClB,iHAAA,oBAAoB,OAAA;AAEpB,0BAA0B;AAC1B,gHAAA,mBAAmB,OAAA;AACnB,oHAAA,uBAAuB,OAAA;AACvB,sGAAA,SAAS,OAAA;AACT,iHAAA,oBAAoB,OAAA;AACpB,uGAAA,UAAU,OAAA;AAEV,aAAa;AACb,2GAAA,cAAc,OAAA;AACd,2GAAA,cAAc,OAAA;AACd,+GAAA,kBAAkB,OAAA;AAClB,4GAAA,eAAe,OAAA;AAEf,qBAAqB;AACrB,8GAAA,iBAAiB,OAAA;AACjB,2GAAA,cAAc,OAAA;AAGhB,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,iCAkBiB;AAjBf,kBAAkB;AAClB,uGAAA,cAAc,OAAA;AACd,uGAAA,cAAc,OAAA;AACd,sGAAA,aAAa,OAAA;AAEb,yBAAyB;AACzB,yGAAA,gBAAgB,OAAA;AAChB,uGAAA,cAAc,OAAA;AACd,uGAAA,cAAc,OAAA;AAEd,oBAAoB;AACpB,mGAAA,UAAU,OAAA;AACV,qGAAA,YAAY,OAAA;AACZ,uGAAA,cAAc,OAAA;AAEd,yBAAyB;AACzB,4GAAA,mBAAmB,OAAA;AAGrB,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,qCAEmB;AADjB,uHAAA,4BAA4B,OAAA;AAG9B,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,mCAMkB;AALhB,iHAAA,uBAAuB,OAAA;AACvB,wGAAA,cAAc,OAAA;AACd,6GAAA,mBAAmB,OAAA;AACnB,6GAAA,mBAAmB,OAAA;AACnB,mGAAA,SAAS,OAAA;AAGX,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,mCAA4C;AAC5C,uDAAyD;AACzD,qCAAuC;AACvC,+DAAiE;AACjE,yDAA2D;AAC3D,uCAAyC;AACzC,6DAA+D;AAC/D,+DAAiE;AACjE,2DAA6D;AAC7D,+EAAiF;AACjF,uCAAyC;AACzC,mEAAqE;AACrE,mDAAqD;AAErD,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,qDAAyD;AAAhD,iHAAA,iBAAiB,OAAA;AAC1B,mCAAuC;AAA9B,+FAAA,QAAQ,OAAA;AACjB,6DAAiE;AAAxD,yHAAA,qBAAqB,OAAA;AAC9B,uDAA2D;AAAlD,mHAAA,kBAAkB,OAAA;AAC3B,qCAAyC;AAAhC,iGAAA,SAAS,OAAA;AAClB,2DAA+D;AAAtD,uHAAA,oBAAoB,OAAA;AAC7B,6DAAiE;AAAxD,yHAAA,qBAAqB,OAAA;AAC9B,yDAA6D;AAApD,qHAAA,mBAAmB,OAAA;AAC5B,6EAAiF;AAAxE,yIAAA,6BAA6B,OAAA;AACtC,qCAAyC;AAAhC,iGAAA,SAAS,OAAA;AAClB,iEAAqE;AAA5D,6HAAA,uBAAuB,OAAA;AAChC,iDAAqD;AAA5C,6GAAA,eAAe,OAAA;AAExB,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E;;;GAGG;AACU,QAAA,qBAAqB,GAAG;IACnC,GAAG,gCAAiB;IACpB,GAAG,cAAQ;IACX,GAAG,wCAAqB;IACxB,GAAG,kCAAkB;IACrB,GAAG,gBAAS;IACZ,GAAG,sCAAoB;IACvB,GAAG,wCAAqB;IACxB,GAAG,oCAAmB;IACtB,GAAG,wDAA6B;IAChC,GAAG,gBAAS;IACZ,GAAG,4CAAuB;IAC1B,GAAG,4BAAe;CACnB,CAAC;AAEF;;;GAGG;AACU,QAAA,aAAa,GAAG,6BAAqB,CAAC,MAAM,CACvD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,UAAU,CACrC,CAAC;AAEF;;;GAGG;AACU,QAAA,iBAAiB,GAAG,6BAAqB,CAAC,MAAM,CAC3D,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CACjE,CAAC;AAEF;;;GAGG;AACU,QAAA,eAAe,GAAG,6BAAqB,CAAC,MAAM,CACzD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CACjE,CAAC;AAEF;;GAEG;AACU,QAAA,cAAc,GAAG;IAC5B,GAAG,gCAAiB;IACpB,GAAG,cAAQ;IACX,GAAG,wCAAqB;IACxB,GAAG,4CAAuB;CAC3B,CAAC;AAEF;;GAEG;AACU,QAAA,SAAS,GAAG;IACvB,GAAG,oCAAmB;IACtB,GAAG,gBAAS;CACb,CAAC;AAEF;;GAEG;AACU,QAAA,WAAW,GAAG;IACzB,GAAG,wDAA6B;IAChC,GAAG,wCAAqB;CACzB,CAAC;AAEF;;GAEG;AACU,QAAA,eAAe,GAAG;IAC7B,UAAU,EAAE,6BAAqB,CAAC,MAAM,CACtC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAAiB,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAAiB,CAAC,UAAU,CAAC,CACvH;IACD,UAAU,EAAE,6BAAqB,CAAC,MAAM,CACtC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAAiB,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAAiB,CAAC,UAAU,CAAC,CACvH;IACD,MAAM,EAAE,6BAAqB,CAAC,MAAM,CAClC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAAiB,CAAC,MAAM,CAAC,CAC1D;IACD,GAAG,EAAE,6BAAqB,CAAC,MAAM,CAC/B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAAiB,CAAC,GAAG,CAAC,CACvD;IACD,IAAI,EAAE,6BAAqB,CAAC,MAAM,CAChC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAAiB,CAAC,IAAI,CAAC,CACxD;IACD,MAAM,EAAE,6BAAqB,CAAC,MAAM,CAClC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAAiB,CAAC,MAAM,CAAC,CAC1D;CACF,CAAC;AAEF,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;GAEG;AACU,QAAA,WAAW,GAAG;IACzB,UAAU,EAAE,6BAAqB,CAAC,MAAM;IACxC,aAAa,EAAE,qBAAa,CAAC,MAAM;IACnC,iBAAiB,EAAE,yBAAiB,CAAC,MAAM;IAE3C,UAAU,EAAE;QACV,SAAS,EAAE,sBAAc,CAAC,MAAM;QAChC,cAAc,EAAE,iBAAS,CAAC,MAAM;QAChC,aAAa,EAAE,mBAAW,CAAC,MAAM;QACjC,IAAI,EAAE,gBAAS,CAAC,MAAM;QACtB,aAAa,EAAE,kCAAkB,CAAC,MAAM;QACxC,eAAe,EAAE,sCAAoB,CAAC,MAAM;QAC5C,UAAU,EAAE,4BAAe,CAAC,MAAM;KACnC;IAED,UAAU,EAAE;QACV,UAAU,EAAE,uBAAe,CAAC,UAAU,CAAC,MAAM;QAC7C,MAAM,EAAE,uBAAe,CAAC,MAAM,CAAC,MAAM;QACrC,GAAG,EAAE,uBAAe,CAAC,GAAG,CAAC,MAAM;QAC/B,IAAI,EAAE,uBAAe,CAAC,IAAI,CAAC,MAAM;QACjC,MAAM,EAAE,uBAAe,CAAC,MAAM,CAAC,MAAM;KACtC;IAED,OAAO,EAAE,OAAO;CACjB,CAAC;AAEF,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,kBAAe;IACb,KAAK,EAAE,6BAAqB;IAC5B,aAAa,EAAb,qBAAa;IACb,iBAAiB,EAAjB,yBAAiB;IACjB,eAAe,EAAf,uBAAe;IACf,eAAe,EAAf,uBAAe;IACf,KAAK,EAAE,mBAAW;CACnB,CAAC"}

package/dist/rules/vulnerabilities/rules/authentication.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @fileoverview Authentication and Session Vulnerabilities Detection Rules
+ * @module rules/vulnerabilities/rules/authentication
+ */
+import { VulnerabilityRule } from '../types';
+export declare const authenticationRules: VulnerabilityRule[];
+export default authenticationRules;
+//# sourceMappingURL=authentication.d.ts.map

package/dist/rules/vulnerabilities/rules/authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/authentication.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,iBAAiB,EAOlB,MAAM,UAAU,CAAC;AAGlB,eAAO,MAAM,mBAAmB,EAAE,iBAAiB,EAuZlD,CAAC;AAEF,eAAe,mBAAmB,CAAC"}