solana-privacy-scanner-core 0.6.1 → 0.6.2

package/dist/index.cjs

@@ -82,7 +82,7 @@ var import_web3 = require("@solana/web3.js");
 // src/constants.ts
 var _RPC_ENCODED = "aHR0cHM6Ly9zZXJlbmUtcm91Z2gtcG9vbC5zb2xhbmEtbWFpbm5ldC5xdWlrbm9kZS5wcm8vYTliM2RkNGRkMzc0MzYwYzQzNzY4YzQyMTI2NmE2ZGNlZDU4MTI3Ny8=";
 var DEFAULT_RPC_URL = /* @__PURE__ */ Buffer.from(_RPC_ENCODED, "base64").toString("utf-8");
-var VERSION = "0.6.1";
+var VERSION = "0.6.2";
 
 // src/rpc/client.ts
 var RateLimiter = class {
@@ -2697,6 +2697,7 @@ function createDefaultLabelProvider() {
 var fs = __toESM(require("fs/promises"), 1);
 var path = __toESM(require("path"), 1);
 var import_glob = require("glob");
+var CODE_EXTENSIONS = ["ts", "tsx", "js", "jsx"];
 async function readFile2(filePath) {
   try {
     return await fs.readFile(filePath, "utf-8");
@@ -2704,15 +2705,29 @@ async function readFile2(filePath) {
     throw new Error(`Failed to read file ${filePath}: ${error}`);
   }
 }
+async function expandPattern(pattern) {
+  try {
+    const cleaned = pattern.replace(/\/+$/, "");
+    const stat2 = await fs.stat(cleaned);
+    if (stat2.isDirectory()) {
+      return CODE_EXTENSIONS.map((ext) => path.join(cleaned, "**", `*.${ext}`));
+    }
+  } catch {
+  }
+  return [pattern];
+}
 async function findFiles(patterns, options) {
   const files = [];
   for (const pattern of patterns) {
-    const matches = await (0, import_glob.glob)(pattern, {
-      ignore: options?.exclude || [],
-      nodir: true,
-      absolute: true
-    });
-    files.push(...matches);
+    const expanded = await expandPattern(pattern);
+    for (const p of expanded) {
+      const matches = await (0, import_glob.glob)(p, {
+        ignore: options?.exclude || [],
+        nodir: true,
+        absolute: true
+      });
+      files.push(...matches);
+    }
   }
   return [...new Set(files)];
 }
@@ -2802,7 +2817,7 @@ function detectFeePayerReuseInCode(content, filePath) {
     traverse(ast, (node) => {
       if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.init && isKeypairGenerate(node.init)) {
         const varName = node.id.name;
-        if (varName.toLowerCase().includes("fee") || varName.toLowerCase().includes("payer")) {
+        if (isFeePayerName(varName)) {
           const isInsideLoop = loops.some((loop) => {
             return isNodeInsideNode(node, loop.body);
           });
@@ -2819,6 +2834,22 @@ function detectFeePayerReuseInCode(content, filePath) {
           }
         }
       }
+      if ((node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression") && node.params) {
+        for (const param of node.params) {
+          const paramName = param.type === "Identifier" ? param.name : param.type === "AssignmentPattern" && param.left.type === "Identifier" ? param.left.name : null;
+          if (paramName && isFeePayerName(paramName)) {
+            feePayerVars.set(paramName, {
+              name: paramName,
+              declaration: {
+                line: param.loc.start.line,
+                column: param.loc.start.column,
+                file: filePath
+              },
+              usages: []
+            });
+          }
+        }
+      }
     });
     for (const [varName, varInfo] of feePayerVars) {
       for (const loop of loops) {
@@ -2833,6 +2864,34 @@ function detectFeePayerReuseInCode(content, filePath) {
               });
             }
           }
+          if (node.type === "CallExpression" && !isTransactionCall(node)) {
+            for (const arg of node.arguments) {
+              if (arg.type === "Identifier" && arg.name === varName) {
+                const alreadyTracked = varInfo.usages.some(
+                  (u) => u.line === node.loc.start.line && u.column === node.loc.start.column
+                );
+                if (!alreadyTracked) {
+                  varInfo.usages.push({
+                    line: node.loc.start.line,
+                    column: node.loc.start.column,
+                    file: filePath
+                  });
+                }
+                break;
+              }
+            }
+          }
+          if (node.type === "AssignmentExpression" && node.left.type === "MemberExpression" && node.left.property.type === "Identifier" && node.left.property.name === "feePayer") {
+            const right = node.right;
+            const assignedName = right.type === "MemberExpression" && right.object.type === "Identifier" ? right.object.name : right.type === "Identifier" ? right.name : null;
+            if (assignedName === varName) {
+              varInfo.usages.push({
+                line: node.loc.start.line,
+                column: node.loc.start.column,
+                file: filePath
+              });
+            }
+          }
         });
       }
       if (varInfo.usages.length > 0) {
@@ -2904,6 +2963,10 @@ function traverse(node, visitor) {
     }
   }
 }
+function isFeePayerName(name) {
+  const lower = name.toLowerCase();
+  return lower.includes("fee") || lower.includes("payer");
+}
 function isKeypairGenerate(node) {
   if (node.type === "CallExpression") {
     const callee = node.callee;
@@ -2935,10 +2998,15 @@ function findFeePayerArgument(node) {
   for (const arg of node.arguments) {
     if (arg.type === "ArrayExpression") {
       const elements = arg.elements.filter((e) => e !== null);
+      for (const el of elements) {
+        if (el && el.type === "Identifier" && isFeePayerName(el.name)) {
+          return el;
+        }
+      }
       if (elements.length > 0) {
-        const lastElement = elements[elements.length - 1];
-        if (lastElement && lastElement.type !== "SpreadElement") {
-          return lastElement;
+        const first = elements[0];
+        if (first && first.type !== "SpreadElement") {
+          return first;
         }
       }
     }
@@ -3027,6 +3095,20 @@ function detectMemoPII(content, filePath) {
           });
         }
       }
+      const piiVarMatches = memoValue.matchAll(/\$\{(\w*(?:email|name|user|phone|ssn|address|identity|account)\w*)\}/gi);
+      for (const match of piiVarMatches) {
+        issues.push({
+          type: "memo-pii",
+          severity: "HIGH",
+          file: filePath,
+          line: index + 1,
+          column: columnOffset,
+          message: `Variable '${match[1]}' interpolated into memo likely contains PII`,
+          suggestion: "Do not interpolate user-identifying variables into memo fields. Memos are permanently public on-chain.",
+          codeSnippet: extractSnippet(content, index + 1),
+          identifier: `pii-variable: ${match[1]}`
+        });
+      }
       if (isDescriptiveContent(memoValue)) {
         issues.push({
           type: "memo-pii",