secure-scan 1.2.2

package/dist/rules/vulnerabilities/rules/pathTraversal.js

@@ -0,0 +1,351 @@
+"use strict";
+/**
+ * @fileoverview Path Traversal Detection Rules
+ * @module rules/vulnerabilities/rules/pathTraversal
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pathTraversalRules = void 0;
+const types_1 = require("../types");
+const constants_1 = require("../constants");
+exports.pathTraversalRules = [
+    {
+        id: 'VUL-PATH-001',
+        name: 'Path Traversal - Node.js fs with User Input',
+        description: 'Detects file system operations using unsanitized user input.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.PATH_TRAVERSAL,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 80,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-fs-req',
+                pattern: '(?:fs\\.(?:readFile|writeFile|unlink|readdir|mkdir|rmdir|stat|access)|require\\s*\\()\\s*(?:Sync)?\\s*\\([^)]*(?:req\\.|params\\.|query\\.)',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'fs operation with request data'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-join-req',
+                pattern: 'path\\.(?:join|resolve)\\s*\\([^)]*(?:req\\.|params\\.|query\\.)',
+                flags: 'gi',
+                weight: 0.85,
+                description: 'path.join with user input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-traversal-pattern',
+                pattern: '(?:\\.\\.\\/|\\.\\.\\.\\\\)',
+                flags: 'g',
+                weight: 0.70,
+                description: 'Literal path traversal pattern'
+            }
+        ],
+        taintAnalysis: {
+            sources: ['req.params', 'req.query', 'req.body', 'process.argv'],
+            sinks: ['fs.readFile', 'fs.writeFile', 'fs.createReadStream', 'fs.createWriteStream', 'require'],
+            sanitizers: ['path.basename', 'path.normalize', '.includes("..")', '.startsWith(allowedDir)']
+        },
+        impact: {
+            confidentiality: 'high',
+            integrity: 'medium',
+            availability: 'low',
+            technicalImpact: 'Read or write arbitrary files on the server.',
+            businessImpact: 'Sensitive data exposure, configuration disclosure, code execution via file overwrite.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none'
+        },
+        remediation: {
+            summary: 'Validate file paths against allowed directories. Use path.basename() and verify the resolved path.',
+            steps: [
+                'Use path.basename() to extract filename only',
+                'Resolve the full path and verify it starts with allowed directory',
+                'Reject paths containing ".." or null bytes',
+                'Use chroot or sandboxed file access'
+            ],
+            secureCodeExample: `const path = require('path');
+const fs = require('fs');
+
+const ALLOWED_DIR = '/app/uploads';
+
+function readSafeFile(userPath) {
+  const filename = path.basename(userPath);
+  const fullPath = path.resolve(ALLOWED_DIR, filename);
+  
+  // Ensure path is within allowed directory
+  if (!fullPath.startsWith(ALLOWED_DIR)) {
+    throw new Error('Invalid path');
+  }
+  
+  return fs.readFileSync(fullPath);
+}`,
+            effort: 'medium',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A01],
+            cwe: [constants_1.CWE_REFERENCES.CWE_22]
+        },
+        tags: ['path-traversal', 'lfi', 'file-access', 'nodejs'],
+        enabled: true
+    },
+    {
+        id: 'VUL-PATH-002',
+        name: 'Path Traversal - Python open() with User Input',
+        description: 'Detects Python file operations with user-controlled paths.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.PATH_TRAVERSAL,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.PYTHON],
+        severity: types_1.VulnerabilitySeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 80,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-python-open',
+                pattern: 'open\\s*\\([^)]*(?:request\\.|input\\(|sys\\.argv|f[\'"])',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'open() with user input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-python-pathlib',
+                pattern: 'Path\\s*\\([^)]*(?:request\\.|input\\()',
+                flags: 'gi',
+                weight: 0.90,
+                description: 'pathlib.Path with user input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-python-send-file',
+                pattern: 'send_file\\s*\\([^)]*(?:request\\.|\\+)',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'Flask send_file with user input'
+            }
+        ],
+        taintAnalysis: {
+            sources: ['request.args', 'request.form', 'request.files', 'sys.argv', 'input()'],
+            sinks: ['open(', 'Path(', 'send_file(', 'send_from_directory('],
+            sanitizers: ['os.path.basename', 'secure_filename', 'Path.resolve().is_relative_to']
+        },
+        impact: {
+            confidentiality: 'high',
+            integrity: 'medium',
+            availability: 'low',
+            technicalImpact: 'Arbitrary file read/write access.',
+            businessImpact: 'Data breach, source code disclosure.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none'
+        },
+        remediation: {
+            summary: 'Use os.path.basename() or werkzeug.secure_filename(). Validate resolved paths.',
+            steps: [
+                'Extract basename from user input',
+                'Use secure_filename() for uploads',
+                'Verify resolved path is within allowed directory',
+                'Use pathlib for safer path operations'
+            ],
+            secureCodeExample: `from pathlib import Path
+from werkzeug.utils import secure_filename
+
+UPLOAD_DIR = Path('/app/uploads')
+
+def read_safe_file(user_path: str) -> bytes:
+    filename = secure_filename(user_path)
+    full_path = (UPLOAD_DIR / filename).resolve()
+    
+    if not full_path.is_relative_to(UPLOAD_DIR):
+        raise ValueError('Invalid path')
+    
+    return full_path.read_bytes()`,
+            effort: 'low',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A01],
+            cwe: [constants_1.CWE_REFERENCES.CWE_22]
+        },
+        tags: ['path-traversal', 'python', 'file-access'],
+        enabled: true
+    },
+    {
+        id: 'VUL-PATH-003',
+        name: 'Path Traversal - PHP file_get_contents/include',
+        description: 'Detects PHP file operations with user-controlled paths (LFI/RFI).',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.PATH_TRAVERSAL,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.PHP],
+        severity: types_1.VulnerabilitySeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 90,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-php-include',
+                pattern: '(?:include|require)(?:_once)?\\s*\\(?\\s*\\$_(?:GET|POST|REQUEST)',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'include/require with superglobal'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-php-file-get',
+                pattern: 'file_get_contents\\s*\\([^)]*\\$_(?:GET|POST|REQUEST)',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'file_get_contents with user input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-php-fopen',
+                pattern: 'fopen\\s*\\([^)]*\\$_(?:GET|POST|REQUEST)',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'fopen with user input'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'medium',
+            technicalImpact: 'LFI can lead to RCE via log poisoning or wrapper exploitation. RFI allows direct code execution.',
+            businessImpact: 'Complete server compromise.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Never include files based on user input. Use allowlist and basename().',
+            steps: [
+                'Use allowlist of permitted files',
+                'Use basename() to strip directory components',
+                'Disable allow_url_include in php.ini',
+                'Use realpath() and verify prefix'
+            ],
+            secureCodeExample: `<?php
+$allowed_pages = ['home', 'about', 'contact'];
+$page = basename($_GET['page'] ?? 'home');
+
+if (!in_array($page, $allowed_pages, true)) {
+    $page = 'home';
+}
+
+include __DIR__ . '/pages/' . $page . '.php';
+?>`,
+            effort: 'medium',
+            priority: 'immediate'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A01, constants_1.OWASP_TOP_10_2021.A03],
+            cwe: [constants_1.CWE_REFERENCES.CWE_22, constants_1.CWE_REFERENCES.CWE_98]
+        },
+        tags: ['path-traversal', 'lfi', 'rfi', 'php', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'VUL-PATH-004',
+        name: 'Path Traversal - Java File/Path with User Input',
+        description: 'Detects Java file operations with user-controlled paths.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.PATH_TRAVERSAL,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.JAVA],
+        severity: types_1.VulnerabilitySeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 80,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-java-new-file',
+                pattern: 'new\\s+File\\s*\\([^)]*(?:request\\.getParameter|\\+)',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'new File with user input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-java-paths-get',
+                pattern: 'Paths\\.get\\s*\\([^)]*(?:request\\.getParameter|\\+)',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'Paths.get with user input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'path-java-fileinputstream',
+                pattern: 'new\\s+FileInputStream\\s*\\([^)]*(?:request|\\+)',
+                flags: 'gi',
+                weight: 0.90,
+                description: 'FileInputStream with dynamic path'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'medium',
+            availability: 'low',
+            technicalImpact: 'Read or write files outside intended directory.',
+            businessImpact: 'Data disclosure, configuration exposure.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none'
+        },
+        remediation: {
+            summary: 'Use Path.normalize() and verify canonical path starts with allowed directory.',
+            steps: [
+                'Normalize the path using Path.normalize()',
+                'Get canonical path and verify it starts with base directory',
+                'Use FilenameUtils.getName() for basename extraction',
+                'Implement file access through a secure abstraction layer'
+            ],
+            secureCodeExample: `import java.nio.file.Path;
+import java.nio.file.Paths;
+
+public class SecureFileAccess {
+    private static final Path BASE_DIR = Paths.get("/app/uploads").toAbsolutePath();
+    
+    public Path resolvePath(String userInput) throws SecurityException {
+        Path resolved = BASE_DIR.resolve(userInput).normalize().toAbsolutePath();
+        
+        if (!resolved.startsWith(BASE_DIR)) {
+            throw new SecurityException("Path traversal attempt detected");
+        }
+        
+        return resolved;
+    }
+}`,
+            effort: 'medium',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A01],
+            cwe: [constants_1.CWE_REFERENCES.CWE_22]
+        },
+        tags: ['path-traversal', 'java', 'file-access'],
+        enabled: true
+    }
+];
+exports.default = exports.pathTraversalRules;
+//# sourceMappingURL=pathTraversal.js.map

package/dist/rules/vulnerabilities/rules/pathTraversal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathTraversal.js","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/pathTraversal.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,oCAQkB;AAClB,4CAAiE;AAEpD,QAAA,kBAAkB,GAAwB;IACrD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,6CAA6C;QACnD,WAAW,EAAE,8DAA8D;QAC3E,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,cAAc;QACnD,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,6BAAqB,CAAC,IAAI;QACpC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,aAAa;gBACxB,OAAO,EAAE,6IAA6I;gBACtJ,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,gCAAgC;aAC9C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,kEAAkE;gBAC3E,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,2BAA2B;aACzC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,wBAAwB;gBACnC,OAAO,EAAE,6BAA6B;gBACtC,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,gCAAgC;aAC9C;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC;YAChE,KAAK,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,SAAS,CAAC;YAChG,UAAU,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,yBAAyB,CAAC;SAC9F;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,8CAA8C;YAC/D,cAAc,EAAE,uFAAuF;SACxG;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;SACxB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,oGAAoG;YAC7G,KAAK,EAAE;gBACL,8CAA8C;gBAC9C,mEAAmE;gBACnE,4CAA4C;gBAC5C,qCAAqC;aACtC;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;;EAevB;YACI,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,MAAM;SACjB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,MAAM,CAAC;SAC7B;QACD,IAAI,EAAE,CAAC,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC;QACxD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,gDAAgD;QACtD,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,cAAc;QACnD,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,MAAM,CAAC;QACrC,QAAQ,EAAE,6BAAqB,CAAC,IAAI;QACpC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,OAAO,EAAE,2DAA2D;gBACpE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,wBAAwB;aACtC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,OAAO,EAAE,yCAAyC;gBAClD,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,8BAA8B;aAC5C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EAAE,yCAAyC;gBAClD,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,iCAAiC;aAC/C;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,CAAC;YACjF,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,sBAAsB,CAAC;YAC/D,UAAU,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,+BAA+B,CAAC;SACrF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,mCAAmC;YACpD,cAAc,EAAE,sCAAsC;SACvD;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;SACxB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,gFAAgF;YACzF,KAAK,EAAE;gBACL,kCAAkC;gBAClC,mCAAmC;gBACnC,kDAAkD;gBAClD,uCAAuC;aACxC;YACD,iBAAiB,EAAE;;;;;;;;;;;;kCAYS;YAC5B,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,MAAM;SACjB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,MAAM,CAAC;SAC7B;QACD,IAAI,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,aAAa,CAAC;QACjD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,gDAAgD;QACtD,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,cAAc;QACnD,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,GAAG,CAAC;QAClC,QAAQ,EAAE,6BAAqB,CAAC,QAAQ;QACxC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,OAAO,EAAE,mEAAmE;gBAC5E,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kCAAkC;aAChD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,uDAAuD;gBAChE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,mCAAmC;aACjD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,2CAA2C;gBACpD,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,uBAAuB;aACrC;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,QAAQ;YACtB,eAAe,EAAE,kGAAkG;YACnH,cAAc,EAAE,6BAA6B;SAC9C;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,wEAAwE;YACjF,KAAK,EAAE;gBACL,kCAAkC;gBAClC,8CAA8C;gBAC9C,sCAAsC;gBACtC,kCAAkC;aACnC;YACD,iBAAiB,EAAE;;;;;;;;;GAStB;YACG,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,WAAW;SACtB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,EAAE,6BAAiB,CAAC,GAAG,CAAC;YACrD,GAAG,EAAE,CAAC,0BAAc,CAAC,MAAM,EAAE,0BAAc,CAAC,MAAM,CAAC;SACpD;QACD,IAAI,EAAE,CAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC;QACzD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,iDAAiD;QACvD,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,cAAc;QACnD,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,IAAI,CAAC;QACnC,QAAQ,EAAE,6BAAqB,CAAC,IAAI;QACpC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,uDAAuD;gBAChE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,0BAA0B;aACxC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,OAAO,EAAE,uDAAuD;gBAChE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,2BAA2B;aACzC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,2BAA2B;gBACtC,OAAO,EAAE,mDAAmD;gBAC5D,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,mCAAmC;aACjD;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,iDAAiD;YAClE,cAAc,EAAE,0CAA0C;SAC3D;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;SACxB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,+EAA+E;YACxF,KAAK,EAAE;gBACL,2CAA2C;gBAC3C,6DAA6D;gBAC7D,qDAAqD;gBACrD,0DAA0D;aAC3D;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;;EAevB;YACI,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,MAAM;SACjB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,MAAM,CAAC;SAC7B;QACD,IAAI,EAAE,CAAC,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC;QAC/C,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,kBAAe,0BAAkB,CAAC"}

package/dist/rules/vulnerabilities/rules/prototypePollution.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @fileoverview Prototype Pollution Detection Rules
+ * @module rules/vulnerabilities/rules/prototypePollution
+ */
+import { VulnerabilityRule } from '../types';
+export declare const prototypePollutionRules: VulnerabilityRule[];
+export default prototypePollutionRules;
+//# sourceMappingURL=prototypePollution.d.ts.map

package/dist/rules/vulnerabilities/rules/prototypePollution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prototypePollution.d.ts","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/prototypePollution.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,iBAAiB,EAOlB,MAAM,UAAU,CAAC;AAGlB,eAAO,MAAM,uBAAuB,EAAE,iBAAiB,EAoQtD,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/rules/vulnerabilities/rules/prototypePollution.js

@@ -0,0 +1,272 @@
+"use strict";
+/**
+ * @fileoverview Prototype Pollution Detection Rules
+ * @module rules/vulnerabilities/rules/prototypePollution
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prototypePollutionRules = void 0;
+const types_1 = require("../types");
+const constants_1 = require("../constants");
+exports.prototypePollutionRules = [
+    {
+        id: 'VUL-PROTO-001',
+        name: 'Prototype Pollution - Unsafe Object Merge',
+        description: 'Detects unsafe object merging that may lead to prototype pollution.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.PROTOTYPE_POLLUTION,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 75,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'proto-object-assign-req',
+                pattern: 'Object\\.assign\\s*\\([^,]*,\\s*(?:req\\.|body|params|query)',
+                flags: 'gi',
+                weight: 0.90,
+                description: 'Object.assign with user input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'proto-spread-req',
+                pattern: '\\{\\s*\\.\\.\\.(?:req\\.|body|params)',
+                flags: 'gi',
+                weight: 0.85,
+                description: 'Spread operator with user input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'proto-lodash-merge',
+                pattern: '(?:_|lodash)\\.(?:merge|defaultsDeep|set)\\s*\\([^)]*(?:req\\.|body)',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'lodash merge/set with user input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'proto-bracket-proto',
+                pattern: '\\[[\'"]__proto__[\'"]\\]|\\[[\'"]constructor[\'"]\\]\\s*\\[[\'"]prototype[\'"]\\]',
+                flags: 'g',
+                weight: 1.0,
+                description: 'Direct __proto__ or constructor.prototype access'
+            }
+        ],
+        taintAnalysis: {
+            sources: ['req.body', 'req.query', 'req.params', 'JSON.parse'],
+            sinks: ['Object.assign', 'Object.defineProperty', '_.merge', '_.set', '_.defaultsDeep'],
+            sanitizers: ['Object.create(null)', 'Object.freeze', 'hasOwnProperty']
+        },
+        impact: {
+            confidentiality: 'medium',
+            integrity: 'high',
+            availability: 'medium',
+            technicalImpact: 'Modify Object.prototype properties affecting all objects. May lead to RCE.',
+            businessImpact: 'Denial of service, authentication bypass, RCE in some cases.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'medium',
+            privilegesRequired: 'none',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Validate object keys. Use Object.create(null) for dictionaries. Block __proto__ keys.',
+            steps: [
+                'Filter __proto__, constructor, prototype from user input',
+                'Use Object.create(null) for user-controlled objects',
+                'Freeze prototypes if possible',
+                'Update vulnerable libraries (lodash < 4.17.12)',
+                'Use Map instead of plain objects for dictionaries'
+            ],
+            secureCodeExample: `// Filter dangerous keys
+function safeMerge(target, source) {
+  const dangerous = ['__proto__', 'constructor', 'prototype'];
+  
+  for (const key of Object.keys(source)) {
+    if (dangerous.includes(key)) continue;
+    if (typeof source[key] === 'object' && source[key] !== null) {
+      target[key] = safeMerge(target[key] || {}, source[key]);
+    } else {
+      target[key] = source[key];
+    }
+  }
+  return target;
+}
+
+// Use Map for user-controlled data
+const userSettings = new Map();
+userSettings.set(req.body.key, req.body.value);
+
+// Use Object.create(null)
+const dict = Object.create(null);
+dict[userKey] = userValue;`,
+            effort: 'medium',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A03],
+            cwe: [constants_1.CWE_REFERENCES.CWE_1321]
+        },
+        tags: ['prototype-pollution', 'javascript', 'injection'],
+        enabled: true
+    },
+    {
+        id: 'VUL-PROTO-002',
+        name: 'Prototype Pollution - JSON.parse with Reviver',
+        description: 'Detects potentially unsafe JSON parsing patterns.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.PROTOTYPE_POLLUTION,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.MEDIUM,
+        confidence: types_1.ConfidenceLevel.LOW,
+        baseScore: 50,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'proto-json-parse-body',
+                pattern: 'JSON\\.parse\\s*\\([^)]*(?:req\\.body|body|data)',
+                flags: 'gi',
+                weight: 0.70,
+                description: 'JSON.parse on user data'
+            }
+        ],
+        impact: {
+            confidentiality: 'low',
+            integrity: 'medium',
+            availability: 'low',
+            technicalImpact: 'Parsed JSON with __proto__ key can pollute prototypes.',
+            businessImpact: 'Application behavior modification.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'medium',
+            privilegesRequired: 'none',
+            userInteraction: 'none'
+        },
+        remediation: {
+            summary: 'Use JSON.parse with a reviver that filters dangerous keys.',
+            steps: [
+                'Use reviver function to filter dangerous keys',
+                'Validate parsed object structure',
+                'Consider using schema validation libraries'
+            ],
+            secureCodeExample: `// Safe JSON parsing with reviver
+function safeJsonParse(str) {
+  return JSON.parse(str, (key, value) => {
+    if (key === '__proto__' || key === 'constructor') {
+      return undefined;
+    }
+    return value;
+  });
+}
+
+// With schema validation (e.g., Zod)
+import { z } from 'zod';
+const UserSchema = z.object({
+  name: z.string(),
+  email: z.string().email()
+});
+
+const userData = UserSchema.parse(JSON.parse(req.body));`,
+            effort: 'low',
+            priority: 'medium'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A03],
+            cwe: [constants_1.CWE_REFERENCES.CWE_1321]
+        },
+        tags: ['prototype-pollution', 'json', 'javascript'],
+        enabled: true
+    },
+    {
+        id: 'VUL-PROTO-003',
+        name: 'Prototype Pollution - Vulnerable Package Usage',
+        description: 'Detects usage of packages known to have prototype pollution vulnerabilities.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.PROTOTYPE_POLLUTION,
+        category: types_1.VulnerabilityCategory.KNOWN_VULNERABLE_COMPONENT,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 70,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'proto-vulnerable-qs',
+                pattern: 'require\\s*\\([\'"]qs[\'"]\\)',
+                flags: 'g',
+                weight: 0.70,
+                description: 'qs package (check version for CVE-2022-24999)'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'proto-vulnerable-flat',
+                pattern: 'require\\s*\\([\'"]flat[\'"]\\)',
+                flags: 'g',
+                weight: 0.80,
+                description: 'flat package (vulnerable < 5.0.1)'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'proto-vulnerable-merge',
+                pattern: 'require\\s*\\([\'"](?:deepmerge|deep-extend|merge-deep)[\'"]\\)',
+                flags: 'g',
+                weight: 0.75,
+                description: 'Deep merge packages (verify versions)'
+            }
+        ],
+        impact: {
+            confidentiality: 'medium',
+            integrity: 'high',
+            availability: 'medium',
+            technicalImpact: 'Known vulnerabilities in dependencies allow prototype pollution.',
+            businessImpact: 'Exploitation via known CVEs.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Update vulnerable packages to patched versions.',
+            steps: [
+                'Run npm audit or yarn audit',
+                'Update lodash to >= 4.17.21',
+                'Update qs to >= 6.10.3',
+                'Update flat to >= 5.0.1',
+                'Consider alternative packages without vulnerabilities'
+            ],
+            secureCodeExample: `// Update packages in package.json
+{
+  "dependencies": {
+    "lodash": "^4.17.21",
+    "qs": "^6.11.0",
+    "flat": "^5.0.2"
+  }
+}
+
+// Or use native alternatives
+// Instead of lodash.merge:
+const merged = { ...defaults, ...userOptions };
+
+// Instead of qs:
+const params = new URLSearchParams(queryString);`,
+            effort: 'low',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A06],
+            cwe: [constants_1.CWE_REFERENCES.CWE_1321]
+        },
+        tags: ['prototype-pollution', 'dependencies', 'npm'],
+        enabled: true
+    }
+];
+exports.default = exports.prototypePollutionRules;
+//# sourceMappingURL=prototypePollution.js.map

package/dist/rules/vulnerabilities/rules/prototypePollution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prototypePollution.js","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/prototypePollution.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,oCAQkB;AAClB,4CAAiE;AAEpD,QAAA,uBAAuB,GAAwB;IAC1D;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,2CAA2C;QACjD,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,mBAAmB;QACxD,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,6BAAqB,CAAC,IAAI;QACpC,UAAU,EAAE,uBAAe,CAAC,MAAM;QAClC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,yBAAyB;gBACpC,OAAO,EAAE,8DAA8D;gBACvE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,+BAA+B;aAC7C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,OAAO,EAAE,wCAAwC;gBACjD,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,iCAAiC;aAC/C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,sEAAsE;gBAC/E,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,kCAAkC;aAChD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,OAAO,EAAE,oFAAoF;gBAC7F,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kDAAkD;aAChE;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC;YAC9D,KAAK,EAAE,CAAC,eAAe,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;YACvF,UAAU,EAAE,CAAC,qBAAqB,EAAE,eAAe,EAAE,gBAAgB,CAAC;SACvE;QACD,MAAM,EAAE;YACN,eAAe,EAAE,QAAQ;YACzB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,QAAQ;YACtB,eAAe,EAAE,4EAA4E;YAC7F,cAAc,EAAE,8DAA8D;SAC/E;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,QAAQ;YAC1B,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,uFAAuF;YAChG,KAAK,EAAE;gBACL,0DAA0D;gBAC1D,qDAAqD;gBACrD,+BAA+B;gBAC/B,gDAAgD;gBAChD,mDAAmD;aACpD;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;2BAqBE;YACrB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,MAAM;SACjB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,QAAQ,CAAC;SAC/B;QACD,IAAI,EAAE,CAAC,qBAAqB,EAAE,YAAY,EAAE,WAAW,CAAC;QACxD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,+CAA+C;QACrD,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,mBAAmB;QACxD,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,6BAAqB,CAAC,MAAM;QACtC,UAAU,EAAE,uBAAe,CAAC,GAAG;QAC/B,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EAAE,kDAAkD;gBAC3D,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,yBAAyB;aACvC;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,wDAAwD;YACzE,cAAc,EAAE,oCAAoC;SACrD;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,QAAQ;YAC1B,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;SACxB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,4DAA4D;YACrE,KAAK,EAAE;gBACL,+CAA+C;gBAC/C,kCAAkC;gBAClC,4CAA4C;aAC7C;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;;;;yDAiBgC;YACnD,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,QAAQ;SACnB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,QAAQ,CAAC;SAC/B;QACD,IAAI,EAAE,CAAC,qBAAqB,EAAE,MAAM,EAAE,YAAY,CAAC;QACnD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,gDAAgD;QACtD,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,mBAAmB;QACxD,QAAQ,EAAE,6BAAqB,CAAC,0BAA0B;QAC1D,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,6BAAqB,CAAC,IAAI;QACpC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,OAAO,EAAE,+BAA+B;gBACxC,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,+CAA+C;aAC7D;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EAAE,iCAAiC;gBAC1C,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,mCAAmC;aACjD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,wBAAwB;gBACnC,OAAO,EAAE,iEAAiE;gBAC1E,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,uCAAuC;aACrD;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,QAAQ;YACzB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,QAAQ;YACtB,eAAe,EAAE,kEAAkE;YACnF,cAAc,EAAE,8BAA8B;SAC/C;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,iDAAiD;YAC1D,KAAK,EAAE;gBACL,6BAA6B;gBAC7B,6BAA6B;gBAC7B,wBAAwB;gBACxB,yBAAyB;gBACzB,uDAAuD;aACxD;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;iDAcwB;YAC3C,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,MAAM;SACjB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,QAAQ,CAAC;SAC/B;QACD,IAAI,EAAE,CAAC,qBAAqB,EAAE,cAAc,EAAE,KAAK,CAAC;QACpD,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,kBAAe,+BAAuB,CAAC"}

package/dist/rules/vulnerabilities/rules/securityMisconfiguration.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @fileoverview Security Misconfiguration Detection Rules
+ * @module rules/vulnerabilities/rules/securityMisconfiguration
+ */
+import { VulnerabilityRule } from '../types';
+export declare const securityMisconfigurationRules: VulnerabilityRule[];
+export default securityMisconfigurationRules;
+//# sourceMappingURL=securityMisconfiguration.d.ts.map

package/dist/rules/vulnerabilities/rules/securityMisconfiguration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityMisconfiguration.d.ts","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/securityMisconfiguration.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,iBAAiB,EAOlB,MAAM,UAAU,CAAC;AAGlB,eAAO,MAAM,6BAA6B,EAAE,iBAAiB,EA0a5D,CAAC;AAEF,eAAe,6BAA6B,CAAC"}