secure-scan 1.2.2

package/dist/rules/vulnerabilities/rules/securityMisconfiguration.js

@@ -0,0 +1,438 @@
+"use strict";
+/**
+ * @fileoverview Security Misconfiguration Detection Rules
+ * @module rules/vulnerabilities/rules/securityMisconfiguration
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityMisconfigurationRules = void 0;
+const types_1 = require("../types");
+const constants_1 = require("../constants");
+exports.securityMisconfigurationRules = [
+    {
+        id: 'VUL-MISCONFIG-001',
+        name: 'Debug Mode Enabled in Production',
+        description: 'Detects debug mode configurations that should not be in production.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.SECURITY_MISCONFIGURATION,
+        category: types_1.VulnerabilityCategory.SECURITY_MISCONFIGURATION,
+        languages: [
+            types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT,
+            types_1.SupportedLanguage.PYTHON, types_1.SupportedLanguage.PHP
+        ],
+        severity: types_1.VulnerabilitySeverity.MEDIUM,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 55,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-debug-true',
+                pattern: '(?:debug|DEBUG)\\s*[=:]\\s*(?:true|True|1|[\'"]true[\'"])',
+                flags: 'g',
+                weight: 0.80,
+                description: 'Debug mode enabled'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-flask-debug',
+                pattern: 'app\\.run\\s*\\([^)]*debug\\s*=\\s*True',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'Flask debug mode'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-django-debug',
+                pattern: 'DEBUG\\s*=\\s*True',
+                flags: 'g',
+                weight: 0.90,
+                description: 'Django DEBUG setting'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-php-display-errors',
+                pattern: 'display_errors\\s*[=,]\\s*(?:1|On|true)',
+                flags: 'gi',
+                weight: 0.85,
+                description: 'PHP display_errors enabled'
+            }
+        ],
+        impact: {
+            confidentiality: 'medium',
+            integrity: 'low',
+            availability: 'low',
+            technicalImpact: 'Information disclosure, stack traces, internal paths, configuration details.',
+            businessImpact: 'Information leakage aids targeted attacks.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none'
+        },
+        remediation: {
+            summary: 'Disable debug mode in production environments.',
+            steps: [
+                'Use environment variables for debug settings',
+                'Set DEBUG=False in production',
+                'Configure proper error handling and logging',
+                'Use separate configuration files for environments'
+            ],
+            secureCodeExample: `# Flask - Use environment variable
+app.run(debug=os.environ.get('FLASK_DEBUG', 'false').lower() == 'true')
+
+# Django - Use environment variable
+DEBUG = os.environ.get('DJANGO_DEBUG', 'False') == 'True'
+
+// Node.js - Express
+if (process.env.NODE_ENV !== 'development') {
+  app.set('env', 'production');
+}`,
+            effort: 'low',
+            priority: 'medium'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A05],
+            cwe: [constants_1.CWE_REFERENCES.CWE_489]
+        },
+        tags: ['configuration', 'debug', 'information-disclosure'],
+        enabled: true
+    },
+    {
+        id: 'VUL-MISCONFIG-002',
+        name: 'CORS Wildcard or Overly Permissive',
+        description: 'Detects overly permissive CORS configurations.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.SECURITY_MISCONFIGURATION,
+        category: types_1.VulnerabilityCategory.SECURITY_MISCONFIGURATION,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.MEDIUM,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 60,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-cors-wildcard',
+                pattern: 'Access-Control-Allow-Origin[\'"]?\\s*[,:]\\s*[\'"]\\*[\'"]',
+                flags: 'gi',
+                weight: 0.90,
+                description: 'CORS Allow-Origin: *'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-cors-origin-true',
+                pattern: 'cors\\s*\\([^)]*origin\\s*:\\s*true',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'CORS origin: true (reflects any origin)'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-cors-credentials-wildcard',
+                pattern: 'credentials\\s*:\\s*true[^}]*origin\\s*:\\s*(?:true|[\'"]\\*[\'"])',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'CORS credentials with wildcard origin'
+            }
+        ],
+        impact: {
+            confidentiality: 'medium',
+            integrity: 'medium',
+            availability: 'low',
+            technicalImpact: 'Cross-origin requests from any domain. Combined with credentials, allows data theft.',
+            businessImpact: 'Data exfiltration, CSRF-like attacks.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'required'
+        },
+        remediation: {
+            summary: 'Use explicit origin allowlist. Never use wildcard with credentials.',
+            steps: [
+                'Define explicit list of allowed origins',
+                'Validate Origin header against allowlist',
+                'Never combine credentials: true with origin: "*"',
+                'Consider using origin callback function'
+            ],
+            secureCodeExample: `const corsOptions = {
+  origin: function (origin, callback) {
+    const allowedOrigins = ['https://app.example.com', 'https://admin.example.com'];
+    if (!origin || allowedOrigins.includes(origin)) {
+      callback(null, true);
+    } else {
+      callback(new Error('Not allowed by CORS'));
+    }
+  },
+  credentials: true,
+  methods: ['GET', 'POST', 'PUT', 'DELETE'],
+  allowedHeaders: ['Content-Type', 'Authorization']
+};
+
+app.use(cors(corsOptions));`,
+            effort: 'low',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A05],
+            cwe: [constants_1.CWE_REFERENCES.CWE_942]
+        },
+        tags: ['configuration', 'cors', 'cross-origin'],
+        enabled: true
+    },
+    {
+        id: 'VUL-MISCONFIG-003',
+        name: 'Missing Security Headers',
+        description: 'Detects applications without important security headers.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.SECURITY_MISCONFIGURATION,
+        category: types_1.VulnerabilityCategory.SECURITY_MISCONFIGURATION,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.LOW,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 40,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-no-helmet',
+                pattern: 'express\\s*\\(\\)(?![\\s\\S]*helmet)',
+                flags: 'gi',
+                weight: 0.70,
+                description: 'Express without helmet'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-helmet-disabled',
+                pattern: 'helmet\\.(?:contentSecurityPolicy|xssFilter|noSniff)\\s*\\([^)]*enabled\\s*:\\s*false',
+                flags: 'gi',
+                weight: 0.85,
+                description: 'Helmet protection disabled'
+            }
+        ],
+        impact: {
+            confidentiality: 'low',
+            integrity: 'medium',
+            availability: 'low',
+            technicalImpact: 'Missing CSP allows XSS. Missing X-Frame-Options allows clickjacking.',
+            businessImpact: 'Increased attack surface.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'medium',
+            privilegesRequired: 'none',
+            userInteraction: 'required'
+        },
+        remediation: {
+            summary: 'Use helmet middleware and configure appropriate security headers.',
+            steps: [
+                'Install and use helmet middleware',
+                'Configure Content-Security-Policy',
+                'Enable X-Frame-Options',
+                'Enable X-Content-Type-Options',
+                'Configure Strict-Transport-Security for HTTPS'
+            ],
+            secureCodeExample: `const helmet = require('helmet');
+
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", "'strict-dynamic'"],
+      styleSrc: ["'self'", "'unsafe-inline'"],
+      imgSrc: ["'self'", "data:", "https:"],
+      connectSrc: ["'self'"],
+      frameSrc: ["'none'"],
+      objectSrc: ["'none'"]
+    }
+  },
+  hsts: {
+    maxAge: 31536000,
+    includeSubDomains: true,
+    preload: true
+  }
+}));`,
+            effort: 'low',
+            priority: 'medium'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A05],
+            cwe: [constants_1.CWE_REFERENCES.CWE_693]
+        },
+        tags: ['configuration', 'headers', 'csp', 'helmet'],
+        enabled: true
+    },
+    {
+        id: 'VUL-MISCONFIG-004',
+        name: 'Insecure TLS/SSL Configuration',
+        description: 'Detects insecure SSL/TLS configurations.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.SECURITY_MISCONFIGURATION,
+        category: types_1.VulnerabilityCategory.CRYPTOGRAPHIC_FAILURE,
+        languages: [
+            types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT,
+            types_1.SupportedLanguage.PYTHON
+        ],
+        severity: types_1.VulnerabilitySeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 75,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-reject-unauthorized',
+                pattern: 'rejectUnauthorized\\s*:\\s*false',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'TLS certificate validation disabled'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-node-tls-reject',
+                pattern: 'NODE_TLS_REJECT_UNAUTHORIZED\\s*[=:]\\s*[\'"]?0',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'Node TLS rejection disabled via env'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-python-verify-false',
+                pattern: 'verify\\s*=\\s*False',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'Python requests verify=False'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-ssl-context-unverified',
+                pattern: 'ssl\\._create_unverified_context',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'Python unverified SSL context'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'low',
+            technicalImpact: 'Man-in-the-middle attacks. All TLS traffic can be intercepted.',
+            businessImpact: 'Data interception, credential theft.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'medium',
+            privilegesRequired: 'none',
+            userInteraction: 'none'
+        },
+        remediation: {
+            summary: 'Always verify TLS certificates in production. Use proper CA bundles.',
+            steps: [
+                'Remove rejectUnauthorized: false',
+                'Remove verify=False from requests',
+                'Use proper CA bundle for internal CAs',
+                'Configure TLS 1.2+ only'
+            ],
+            secureCodeExample: `// Node.js - Proper TLS config
+const https = require('https');
+const options = {
+  hostname: 'api.example.com',
+  port: 443,
+  // rejectUnauthorized defaults to true
+  ca: fs.readFileSync('./internal-ca.pem') // For internal CAs
+};
+
+# Python - Proper TLS
+import requests
+response = requests.get('https://api.example.com', verify=True)
+# For internal CA:
+response = requests.get('https://internal.example.com', verify='/path/to/ca-bundle.crt')`,
+            effort: 'low',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A02, constants_1.OWASP_TOP_10_2021.A05],
+            cwe: [constants_1.CWE_REFERENCES.CWE_295]
+        },
+        tags: ['configuration', 'tls', 'ssl', 'certificate'],
+        enabled: true
+    },
+    {
+        id: 'VUL-MISCONFIG-005',
+        name: 'Verbose Error Messages',
+        description: 'Detects error handling that exposes stack traces or internal details.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.SECURITY_MISCONFIGURATION,
+        category: types_1.VulnerabilityCategory.SECURITY_MISCONFIGURATION,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.LOW,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 35,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-error-stack',
+                pattern: 'res\\.(?:send|json)\\s*\\([^)]*(?:err\\.stack|error\\.stack|e\\.stack)',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'Stack trace sent in response'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'misconfig-error-message-direct',
+                pattern: 'res\\.(?:send|json)\\s*\\([^)]*(?:err\\.message|error\\.message|e\\.message)',
+                flags: 'gi',
+                weight: 0.70,
+                description: 'Raw error message in response'
+            }
+        ],
+        impact: {
+            confidentiality: 'low',
+            integrity: 'none',
+            availability: 'none',
+            technicalImpact: 'Stack traces reveal file paths, library versions, internal logic.',
+            businessImpact: 'Information aids targeted attacks.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none'
+        },
+        remediation: {
+            summary: 'Log detailed errors server-side. Return generic messages to clients.',
+            steps: [
+                'Log full error details server-side',
+                'Return generic error messages to clients',
+                'Include error reference ID for correlation',
+                'Use error handling middleware'
+            ],
+            secureCodeExample: `// Express error handler
+app.use((err, req, res, next) => {
+  const errorId = crypto.randomUUID();
+  
+  // Log full details
+  logger.error({
+    id: errorId,
+    error: err.message,
+    stack: err.stack,
+    path: req.path,
+    method: req.method
+  });
+  
+  // Return generic message
+  res.status(err.status || 500).json({
+    error: 'An error occurred',
+    reference: errorId
+  });
+});`,
+            effort: 'low',
+            priority: 'low'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A05],
+            cwe: [constants_1.CWE_REFERENCES.CWE_209]
+        },
+        tags: ['configuration', 'error-handling', 'information-disclosure'],
+        enabled: true
+    }
+];
+exports.default = exports.securityMisconfigurationRules;
+//# sourceMappingURL=securityMisconfiguration.js.map

package/dist/rules/vulnerabilities/rules/securityMisconfiguration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityMisconfiguration.js","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/securityMisconfiguration.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,oCAQkB;AAClB,4CAAiE;AAEpD,QAAA,6BAA6B,GAAwB;IAChE;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,kCAAkC;QACxC,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,yBAAyB;QAC9D,QAAQ,EAAE,6BAAqB,CAAC,yBAAyB;QACzD,SAAS,EAAE;YACT,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU;YAC1D,yBAAiB,CAAC,MAAM,EAAE,yBAAiB,CAAC,GAAG;SAChD;QACD,QAAQ,EAAE,6BAAqB,CAAC,MAAM;QACtC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,2DAA2D;gBACpE,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,oBAAoB;aAClC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EAAE,yCAAyC;gBAClD,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,kBAAkB;aAChC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,wBAAwB;gBACnC,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,sBAAsB;aACpC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,8BAA8B;gBACzC,OAAO,EAAE,yCAAyC;gBAClD,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,4BAA4B;aAC1C;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,QAAQ;YACzB,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,8EAA8E;YAC/F,cAAc,EAAE,4CAA4C;SAC7D;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;SACxB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,gDAAgD;YACzD,KAAK,EAAE;gBACL,8CAA8C;gBAC9C,+BAA+B;gBAC/B,6CAA6C;gBAC7C,mDAAmD;aACpD;YACD,iBAAiB,EAAE;;;;;;;;;EASvB;YACI,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,QAAQ;SACnB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,wBAAwB,CAAC;QAC1D,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EAAE,gDAAgD;QAC7D,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,yBAAyB;QAC9D,QAAQ,EAAE,6BAAqB,CAAC,yBAAyB;QACzD,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,6BAAqB,CAAC,MAAM;QACtC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,yBAAyB;gBACpC,OAAO,EAAE,4DAA4D;gBACrE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,sBAAsB;aACpC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,4BAA4B;gBACvC,OAAO,EAAE,qCAAqC;gBAC9C,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,yCAAyC;aACvD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,qCAAqC;gBAChD,OAAO,EAAE,oEAAoE;gBAC7E,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,uCAAuC;aACrD;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,QAAQ;YACzB,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,sFAAsF;YACvG,cAAc,EAAE,uCAAuC;SACxD;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,UAAU;SAC5B;QACD,WAAW,EAAE;YACX,OAAO,EAAE,qEAAqE;YAC9E,KAAK,EAAE;gBACL,yCAAyC;gBACzC,0CAA0C;gBAC1C,kDAAkD;gBAClD,yCAAyC;aAC1C;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;4BAcG;YACtB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,MAAM;SACjB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,cAAc,CAAC;QAC/C,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,yBAAyB;QAC9D,QAAQ,EAAE,6BAAqB,CAAC,yBAAyB;QACzD,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,6BAAqB,CAAC,GAAG;QACnC,UAAU,EAAE,uBAAe,CAAC,MAAM;QAClC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,wBAAwB;aACtC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,2BAA2B;gBACtC,OAAO,EAAE,uFAAuF;gBAChG,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,4BAA4B;aAC1C;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,sEAAsE;YACvF,cAAc,EAAE,2BAA2B;SAC5C;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,QAAQ;YAC1B,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,UAAU;SAC5B;QACD,WAAW,EAAE;YACX,OAAO,EAAE,mEAAmE;YAC5E,KAAK,EAAE;gBACL,mCAAmC;gBACnC,mCAAmC;gBACnC,wBAAwB;gBACxB,+BAA+B;gBAC/B,+CAA+C;aAChD;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;KAmBpB;YACC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,QAAQ;SACnB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC;QACnD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,yBAAyB;QAC9D,QAAQ,EAAE,6BAAqB,CAAC,qBAAqB;QACrD,SAAS,EAAE;YACT,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU;YAC1D,yBAAiB,CAAC,MAAM;SACzB;QACD,QAAQ,EAAE,6BAAqB,CAAC,IAAI;QACpC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,+BAA+B;gBAC1C,OAAO,EAAE,kCAAkC;gBAC3C,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,qCAAqC;aACnD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,2BAA2B;gBACtC,OAAO,EAAE,iDAAiD;gBAC1D,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,qCAAqC;aACnD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,+BAA+B;gBAC1C,OAAO,EAAE,sBAAsB;gBAC/B,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,8BAA8B;aAC5C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,kCAAkC;gBAC7C,OAAO,EAAE,kCAAkC;gBAC3C,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,+BAA+B;aAC7C;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,gEAAgE;YACjF,cAAc,EAAE,sCAAsC;SACvD;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,QAAQ;YAC1B,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;SACxB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,sEAAsE;YAC/E,KAAK,EAAE;gBACL,kCAAkC;gBAClC,mCAAmC;gBACnC,uCAAuC;gBACvC,yBAAyB;aAC1B;YACD,iBAAiB,EAAE;;;;;;;;;;;;;yFAagE;YACnF,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,MAAM;SACjB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,EAAE,6BAAiB,CAAC,GAAG,CAAC;YACrD,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC;QACpD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,uEAAuE;QACpF,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,yBAAyB;QAC9D,QAAQ,EAAE,6BAAqB,CAAC,yBAAyB;QACzD,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,6BAAqB,CAAC,GAAG;QACnC,UAAU,EAAE,uBAAe,CAAC,MAAM;QAClC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EAAE,wEAAwE;gBACjF,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,8BAA8B;aAC5C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,gCAAgC;gBAC3C,OAAO,EAAE,8EAA8E;gBACvF,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,+BAA+B;aAC7C;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,MAAM;YACpB,eAAe,EAAE,mEAAmE;YACpF,cAAc,EAAE,oCAAoC;SACrD;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;SACxB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,sEAAsE;YAC/E,KAAK,EAAE;gBACL,oCAAoC;gBACpC,0CAA0C;gBAC1C,4CAA4C;gBAC5C,+BAA+B;aAChC;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;IAkBrB;YACE,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,KAAK;SAChB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,wBAAwB,CAAC;QACnE,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,kBAAe,qCAA6B,CAAC"}

package/dist/rules/vulnerabilities/rules/sqlInjection.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview SQL Injection Detection Rules
+ * @module rules/vulnerabilities/rules/sqlInjection
+ *
+ * Comprehensive SQL injection detection for multiple languages and frameworks.
+ * Detects string concatenation in SQL queries, unsafe query building, and
+ * missing parameterized queries.
+ */
+import { VulnerabilityRule } from '../types';
+export declare const sqlInjectionRules: VulnerabilityRule[];
+export default sqlInjectionRules;
+//# sourceMappingURL=sqlInjection.d.ts.map

package/dist/rules/vulnerabilities/rules/sqlInjection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlInjection.d.ts","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/sqlInjection.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,iBAAiB,EAUlB,MAAM,UAAU,CAAC;AAkElB,eAAO,MAAM,iBAAiB,EAAE,iBAAiB,EAgkBhD,CAAC;AAMF,eAAe,iBAAiB,CAAC"}