smart-review 1.0.2 → 1.0.3

package/templates/rules/en-US/security.js

@@ -8,6 +8,7 @@ export default [
     message: 'Hard-coded password or secret detected',
     suggestion: 'Use environment variables or a secure secret manager',
     flags: 'gi',
+    extensions: ['.js', '.ts', '.py', '.java', '.php', '.rb', '.cs'],
     excludePatterns: ['//.*', '/\\*[\\s\\S]*?\\*/', '(example|test|demo|placeholder|xxx|123|abc|password|secret)']
   },
   {
@@ -17,7 +18,8 @@ export default [
     risk: 'critical',
     message: 'String-concatenated SQL detected; injection risk',
     suggestion: 'Use parameterized queries or the ORM’s safe APIs',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.py', '.java', '.php', '.rb', '.cs']
   },
   {
     id: 'SEC003',
@@ -26,7 +28,8 @@ export default [
     risk: 'high',
     message: 'Direct HTML manipulation detected; possible XSS',
     suggestion: 'Use textContent or safe DOM APIs',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'SEC004',
@@ -35,7 +38,8 @@ export default [
     risk: 'critical',
     message: 'Command execution with possible user input detected',
     suggestion: 'Avoid constructing commands from user input; validate strictly',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   }
 ,
   {
@@ -45,7 +49,8 @@ export default [
     risk: 'high',
     message: 'Potential path traversal or unvalidated file path usage',
     suggestion: 'Normalize and whitelist paths; never concatenate untrusted input',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.java', '.php', '.py']
   },
   {
     id: 'SEC006',
@@ -54,7 +59,8 @@ export default [
     risk: 'high',
     message: 'HTTP request with certificate verification disabled detected',
     suggestion: 'Enable verification and use trusted CAs; avoid MITM attacks',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.py']
   },
   {
     id: 'SEC007',
@@ -63,7 +69,8 @@ export default [
     risk: 'high',
     message: 'Detected use of weak algorithms such as MD5/SHA-1',
     suggestion: 'Use stronger algorithms: SHA-256/512, Argon2, bcrypt, scrypt',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.java']
   },
   {
     id: 'SEC008',
@@ -72,7 +79,8 @@ export default [
     risk: 'high',
     message: 'Hard-coded secret or access token detected',
     suggestion: 'Store secrets in a manager or environment variables',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.py', '.java', '.php', '.rb', '.cs']
   },
   {
     id: 'SEC009',
@@ -81,7 +89,8 @@ export default [
     risk: 'critical',
     message: 'Potentially unsafe deserialization detected',
     suggestion: 'Use safe methods (e.g., yaml.safe_load); never deserialize untrusted data',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.py', '.java', '.php']
   },
   {
     id: 'SEC010',
@@ -90,7 +99,8 @@ export default [
     risk: 'high',
     message: 'User-controlled URL request detected; SSRF risk',
     suggestion: 'Whitelist external URLs; prohibit access to internal addresses',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.py']
   },
   {
     id: 'SEC011',
@@ -99,7 +109,8 @@ export default [
     risk: 'high',
     message: 'Possible NoSQL injection (dynamically concatenated conditions)',
     suggestion: 'Use parameterized queries or safe builders; avoid concatenation',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.py', '.rb', '.php']
   },
   {
     id: 'SEC012',
@@ -108,7 +119,8 @@ export default [
     risk: 'high',
     message: 'User-controlled redirection detected; open-redirect risk',
     suggestion: 'Whitelist target URLs or fix them to safe destinations',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.java']
   },
   {
     id: 'SEC013',
@@ -117,7 +129,8 @@ export default [
     risk: 'critical',
     message: 'System command execution detected; injection risk if user input involved',
     suggestion: 'Avoid direct system calls; use safe libraries or strict whitelists',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.py']
   },
   {
     id: 'SEC014',
@@ -126,7 +139,8 @@ export default [
     risk: 'medium',
     message: 'Non-cryptographic RNG used in security-sensitive contexts',
     suggestion: 'Use cryptographically secure RNGs (crypto.randomBytes, secrets.SystemRandom)',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.py', '.java']
   },
   {
     id: 'SEC015',
@@ -135,7 +149,8 @@ export default [
     risk: 'high',
     message: 'Dynamic execution that may lead to code injection',
     suggestion: 'Avoid eval/Function; use safe parsing/mapping logic',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'SEC016',
@@ -144,7 +159,8 @@ export default [
     risk: 'high',
     message: 'Direct assignment to object prototypes; may cause pollution',
     suggestion: 'Avoid merging untrusted data into prototypes; use safe merging',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'SEC017',
@@ -153,7 +169,8 @@ export default [
     risk: 'critical',
     message: 'SQL execution built via string concatenation detected',
     suggestion: 'Use PreparedStatement with placeholders',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.java']
   },
   {
     id: 'SEC018',
@@ -162,7 +179,8 @@ export default [
     risk: 'high',
     message: 'Direct HTML injection detected; possible XSS',
     suggestion: 'Use text() or trusted templating with escaping',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js']
   },
   {
     id: 'SEC019',
@@ -171,7 +189,8 @@ export default [
     risk: 'high',
     message: 'Setting wide-open file permissions detected',
     suggestion: 'Apply least privilege; avoid 777 and similar modes',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.php']
   },
   {
     id: 'SEC020',
@@ -180,7 +199,8 @@ export default [
     risk: 'critical',
     message: 'System command execution detected; injection risk with user input',
     suggestion: 'Avoid shell commands; use safe libraries and whitelist parameters',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.php', '.cs']
   },
   {
     id: 'SEC021',
@@ -189,7 +209,8 @@ export default [
     risk: 'high',
     message: 'TLS certificate verification disabled detected',
     suggestion: 'Enable verification and use trusted CA to avoid MITM',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'SEC022',
@@ -198,7 +219,8 @@ export default [
     risk: 'medium',
     message: 'CORS allows "*"; may lead to cross-origin data leaks',
     suggestion: 'Only allow trusted origins; use tokens and fine-grained policy',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'SEC023',
@@ -207,7 +229,8 @@ export default [
     risk: 'high',
     message: 'String-concatenated LDAP filters detected',
     suggestion: 'Build filters safely and bind parameters; avoid concatenation',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.java', '.py']
   },
   {
     id: 'SEC024',
@@ -216,7 +239,8 @@ export default [
     risk: 'high',
     message: 'XML parsing with external entities not disabled',
     suggestion: 'Disable external entities or use safe libraries (e.g., defusedxml)',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.py', '.java', '.php']
   },
   {
     id: 'SEC025',
@@ -225,7 +249,8 @@ export default [
     risk: 'high',
     message: 'Hostname verification bypass detected for HTTPS',
     suggestion: 'Implement strict hostname verification to avoid permissive behavior',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.java']
   },
   {
     id: 'SEC026',
@@ -234,7 +259,8 @@ export default [
     risk: 'critical',
     message: 'Global env disables certificate errors detected',
     suggestion: 'Remove the setting and use valid certs or isolate in test env',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'SEC027',
@@ -243,7 +269,8 @@ export default [
     risk: 'high',
     message: 'Username/password hard-coded in connection string detected',
     suggestion: 'Use env variables or secure credential storage; avoid plaintext in code',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.py', '.java', '.php', '.rb', '.cs']
   },
   {
     id: 'SEC028',
@@ -252,7 +279,8 @@ export default [
     risk: 'medium',
     message: 'Sensitive information logged',
     suggestion: 'Mask sensitive fields or avoid logging them altogether',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.py', '.java', '.php', '.rb']
   },
   {
     id: 'SEC029',
@@ -261,7 +289,8 @@ export default [
     risk: 'high',
     message: 'Possible mass assignment risk; no whitelist validation',
     suggestion: 'Enable strong parameters/whitelist; only allow safe fields',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.rb', '.php']
   },
   {
     id: 'SEC030',
@@ -270,7 +299,8 @@ export default [
     risk: 'high',
     message: 'TLS certificate verification disabled in Go detected',
     suggestion: 'Enable verification and use trusted CA; avoid MITM attacks',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.go']
   },
   {
     id: 'SEC031',
@@ -279,7 +309,8 @@ export default [
     risk: 'high',
     message: 'Overriding global certificate validation; may accept any certificate',
     suggestion: 'Remove the override and use proper validation mechanisms',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.cs']
   },
   {
     id: 'SEC032',
@@ -288,7 +319,8 @@ export default [
     risk: 'critical',
     message: 'Using FromSqlRaw with string concatenation detected',
     suggestion: 'Use FromSqlInterpolated or parameterized queries to avoid injection',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.cs']
   },
   {
     id: 'SEC033',
@@ -297,7 +329,8 @@ export default [
     risk: 'high',
     message: 'System command execution in Go; injection risk if user input involved',
     suggestion: 'Avoid shell -c and concatenation; whitelist parameters and exec paths',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.go']
   },
   {
     id: 'SEC034',
@@ -306,6 +339,7 @@ export default [
     risk: 'medium',
     message: 'Using math/rand for randomness; not cryptographically secure',
     suggestion: 'Use crypto/rand or secure RNG libraries for tokens and keys',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.go']
   }
 ];

package/templates/rules/zh-CN/best-practices.js

@@ -7,7 +7,8 @@ export default [
     risk: 'low',
     message: '发现调试代码，建议在提交前移除',
     suggestion: '使用日志系统替代console.log',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.py', '.php', '.rb']
   },
   {
     id: 'BP002',
@@ -16,7 +17,8 @@ export default [
     risk: 'low',
     message: '检测到魔法数字，建议使用常量定义',
     suggestion: '将数字定义为有意义的常量',
-    flags: 'g'
+    flags: 'g',
+    extensions: ['.js', '.ts', '.java', '.cs', '.php', '.py', '.rb', '.go']
   },
   {
     id: 'BP003',
@@ -25,7 +27,8 @@ export default [
     risk: 'medium',
     message: '检测到空的catch块，可能隐藏错误并导致不可预期行为',
     suggestion: '记录日志或采取补救措施，避免吞掉异常',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.java', '.cs', '.php']
   },
   {
     id: 'BP004',
@@ -34,7 +37,8 @@ export default [
     risk: 'medium',
     message: '检测到@ts-ignore，可能掩盖类型错误',
     suggestion: '修复类型问题或使用更精确的类型定义',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.ts']
   },
   {
     id: 'BP005',
@@ -43,7 +47,8 @@ export default [
     risk: 'medium',
     message: '检测到any类型，可能削弱类型系统保护',
     suggestion: '使用具体类型或泛型替代any，提高类型安全',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.ts']
   },
   {
     id: 'BP006',
@@ -52,7 +57,8 @@ export default [
     risk: 'medium',
     message: '检测到禁用ESLint，可能隐藏代码质量问题',
     suggestion: '只在必要范围局部禁用，并给出明确原因',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'BP007',
@@ -61,7 +67,8 @@ export default [
     risk: 'medium',
     message: '检测到调试断点，可能影响线上行为',
     suggestion: '在提交前移除debugger并使用日志或断言',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'BP008',
@@ -70,7 +77,8 @@ export default [
     risk: 'medium',
     message: '捕获过于宽泛的异常类型且未进行适当处理',
     suggestion: '捕获具体的异常类型，并确保进行适当的日志记录或重新抛出',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.java', '.cs', '.php']
   },
   {
     id: 'BP009',
@@ -79,7 +87,8 @@ export default [
     risk: 'medium',
     message: '检测到直接打印堆栈跟踪，可能导致信息丢失与不可控输出',
     suggestion: '使用结构化日志记录错误，并附带上下文信息',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.java']
   },
   {
     id: 'BP010',
@@ -88,7 +97,8 @@ export default [
     risk: 'high',
     message: '检测到System.exit，可能导致服务非预期中断',
     suggestion: '使用受控的停止流程（优雅关闭）、信号处理与资源回收',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.java']
   },
   {
     id: 'BP011',
@@ -97,7 +107,8 @@ export default [
     risk: 'medium',
     message: '检测到使用root作为数据库用户，存在安全与审计风险',
     suggestion: '使用最小权限的应用专用账户，分离权限与职责',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.java', '.cs', '.php', '.py', '.rb', '.go']
   },
   {
     id: 'BP012',
@@ -106,6 +117,7 @@ export default [
     risk: 'high',
     message: '检测到全局禁用CSRF保护，可能导致跨站请求伪造风险',
     suggestion: '在必要的API上采用令牌/同源策略，避免全局关闭',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.java']
   }
 ];

package/templates/rules/zh-CN/performance.js

@@ -7,7 +7,8 @@ export default [
     risk: 'medium',
     message: '在循环内执行数据库查询，可能导致N+1查询问题',
     suggestion: '使用批量查询或预加载数据',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.java', '.py', '.php', '.rb', '.cs', '.go']
   },
   {
     id: 'PERF002',
@@ -17,6 +18,7 @@ export default [
     message: '发现定时器使用，若未清理可能导致内存泄漏或残留任务',
     suggestion: '确保在适当生命周期调用 clearInterval/clearTimeout 进行清理',
     flags: 'gi',
+    extensions: ['.js', '.ts'],
     // 为了覆盖内置 PERF002，外部规则增加清理检测，若文件中存在任一清理则跳过此规则
     requiresAbsent: ['clearInterval\\s*\\(', 'clearTimeout\\s*\\(']
   },
@@ -27,7 +29,8 @@ export default [
     risk: 'high',
     message: '检测到同步文件IO，可能阻塞事件循环并影响吞吐',
     suggestion: '优先使用异步IO或队列化处理，避免阻塞主线程',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'PERF004',
@@ -36,7 +39,8 @@ export default [
     risk: 'high',
     message: '检测到循环内执行网络请求，可能导致级联延迟与拥塞',
     suggestion: '合并请求、并发控制或批量处理，减少往返次数',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.py']
   },
   {
     id: 'PERF005',
@@ -45,7 +49,8 @@ export default [
     risk: 'medium',
     message: '循环内频繁序列化可能导致CPU开销过大',
     suggestion: '将序列化移到循环外或进行缓存/批量处理',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'PERF006',
@@ -54,7 +59,8 @@ export default [
     risk: 'medium',
     message: '循环内重复编译正则会增加不必要的开销',
     suggestion: '将正则常量化或预编译，避免在循环中创建',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'PERF007',
@@ -63,7 +69,8 @@ export default [
     risk: 'high',
     message: '检测到可能的忙等待循环，可能导致CPU飙升与资源浪费',
     suggestion: '使用事件驱动或阻塞等待机制，避免空循环',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.java', '.cs', '.php', '.rb']
   },
   {
     id: 'PERF008',
@@ -72,7 +79,8 @@ export default [
     risk: 'high',
     message: '循环内读取布局信息会触发频繁回流/重绘',
     suggestion: '合并DOM读写、使用批处理、减少同步布局查询',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts']
   },
   {
     id: 'PERF009',
@@ -81,7 +89,8 @@ export default [
     risk: 'medium',
     message: '检测到阻塞等待调用，可能降低服务吞吐和响应',
     suggestion: '改用异步等待或限流/队列机制，避免阻塞主线程',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.java', '.py']
   },
   {
     id: 'PERF010',
@@ -90,7 +99,8 @@ export default [
     risk: 'high',
     message: '检测到无界线程池，可能导致线程爆炸与资源枯竭',
     suggestion: '使用有界线程池并设置合理最大值与队列长度',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.java']
   },
   {
     id: 'PERF011',
@@ -99,7 +109,8 @@ export default [
     risk: 'medium',
     message: '循环内频繁字符串拼接会造成较大CPU与内存开销',
     suggestion: '使用StringBuilder/列表收集再join，或其他批量化策略',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.java', '.cs', '.py', '.rb']
   },
   {
     id: 'PERF012',
@@ -108,7 +119,8 @@ export default [
     risk: 'high',
     message: '循环内反复创建数据库连接会导致严重性能问题',
     suggestion: '使用连接池与复用策略，在循环外预先获取连接',
-    flags: 'gi'
+    flags: 'gi',
+    extensions: ['.js', '.ts', '.java', '.cs', '.php']
   },
   {
     id: 'PERF013',
@@ -118,6 +130,7 @@ export default [
     message: '网络请求未设置超时会造成资源悬挂与吞吐下降',
     suggestion: '设置合理的timeout参数，并对重试与熔断进行控制',
     flags: 'gi',
+    extensions: ['.py'],
     requiresAbsent: ['timeout\\s*=']
   }
 ];