vettcode-cli 1.0.0

package/dist/control-flow-analyzer.js

@@ -0,0 +1,184 @@
+"use strict";
+/**
+ * Control Flow Analyzer
+ * Finds unhandled errors, missing validation, race conditions
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeControlFlow = analyzeControlFlow;
+/**
+ * Analyze control flow for error handling and validation issues
+ */
+function analyzeControlFlow(files) {
+    const findings = [];
+    for (const file of files) {
+        // DISABLED: findUnhandledAsyncErrors - fundamentally flawed
+        // It flags function DECLARATIONS instead of actual unhandled promise CALLS
+        // Exported async functions that throw errors are a VALID pattern (error propagation)
+        // The caller is responsible for handling errors, not the function itself
+        // findings.push(...findUnhandledAsyncErrors(file.path, file.content));
+        findings.push(...findMissingValidation(file.path, file.content));
+        findings.push(...findRaceConditions(file.path, file.content));
+        findings.push(...findMissingNullChecks(file.path, file.content));
+    }
+    return findings;
+}
+/**
+ * Find async functions without error handling
+ */
+function findUnhandledAsyncErrors(filePath, content) {
+    const findings = [];
+    const lines = content.split('\n');
+    // Find async functions
+    const asyncFunctions = content.matchAll(/async\s+function\s+(\w+)|const\s+(\w+)\s*=\s*async/gi);
+    for (const match of asyncFunctions) {
+        if (!match.index)
+            continue;
+        const funcName = match[1] || match[2];
+        const lineNumber = content.slice(0, match.index).split('\n').length;
+        // Get function body (approximate)
+        const funcStart = match.index;
+        const funcEnd = findFunctionEnd(content, funcStart);
+        const funcBody = content.slice(funcStart, funcEnd);
+        // Check if function has error handling
+        const hasTryCatch = /try\s*\{[\s\S]*\}\s*catch/.test(funcBody);
+        const hasCatchChain = /\.catch\s*\(/.test(funcBody);
+        const throwsError = /throw\s+(?:new\s+)?Error/.test(funcBody);
+        if (!hasTryCatch && !hasCatchChain && !throwsError) {
+            findings.push({
+                id: `unhandled-async-${filePath}-${lineNumber}`,
+                severity: 'high',
+                category: 'production',
+                title: 'Async Function Without Error Handling',
+                description: `Function '${funcName}' is async but has no error handling`,
+                file: filePath,
+                line: lineNumber,
+                evidence: lines[lineNumber - 1]?.trim() || '',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Find API endpoints without input validation
+ */
+function findMissingValidation(filePath, content) {
+    const findings = [];
+    const lines = content.split('\n');
+    // Find API route handlers
+    const routes = content.matchAll(/router\.(get|post|put|delete|patch)\s*\(/gi);
+    for (const match of routes) {
+        if (!match.index)
+            continue;
+        const method = match[1];
+        const lineNumber = content.slice(0, match.index).split('\n').length;
+        // Get route handler body
+        const handlerStart = match.index;
+        const handlerEnd = findFunctionEnd(content, handlerStart);
+        const handlerBody = content.slice(handlerStart, handlerEnd);
+        // Check if handler validates input
+        const hasValidation = /validate|schema|zod|joi|yup/.test(handlerBody) ||
+            /if\s*\(!.*\)/.test(handlerBody) ||
+            /throw.*Error/.test(handlerBody);
+        if (!hasValidation && (method === 'post' || method === 'put' || method === 'patch')) {
+            findings.push({
+                id: `missing-validation-${filePath}-${lineNumber}`,
+                severity: 'high',
+                category: 'security',
+                title: 'API Endpoint Without Input Validation',
+                description: `${method.toUpperCase()} endpoint lacks input validation`,
+                file: filePath,
+                line: lineNumber,
+                evidence: lines[lineNumber - 1]?.trim() || '',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Find potential race conditions
+ */
+function findRaceConditions(filePath, content) {
+    const findings = [];
+    const lines = content.split('\n');
+    // Find concurrent operations without proper synchronization
+    const promiseAlls = content.matchAll(/Promise\.all\s*\(/gi);
+    for (const match of promiseAlls) {
+        if (!match.index)
+            continue;
+        const lineNumber = content.slice(0, match.index).split('\n').length;
+        const line = lines[lineNumber - 1] || '';
+        // Check if Promise.all involves database writes
+        if (/(?:update|insert|delete|create|save)/.test(line)) {
+            findings.push({
+                id: `race-condition-${filePath}-${lineNumber}`,
+                severity: 'high',
+                category: 'production',
+                title: 'Potential Race Condition in Concurrent Writes',
+                description: 'Concurrent database writes may cause race conditions',
+                file: filePath,
+                line: lineNumber,
+                evidence: line.trim(),
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Find missing null/undefined checks
+ */
+function findMissingNullChecks(filePath, content) {
+    const findings = [];
+    const lines = content.split('\n');
+    // Find property access that might be null/undefined
+    const propertyAccess = content.matchAll(/(\w+)\.(\w+)(?!\?\.)/gi);
+    for (const match of propertyAccess) {
+        if (!match.index)
+            continue;
+        const varName = match[1];
+        const lineNumber = content.slice(0, match.index).split('\n').length;
+        const line = lines[lineNumber - 1] || '';
+        // Skip if already using optional chaining
+        if (line.includes('?.'))
+            continue;
+        // Skip if there's a null check before
+        const beforeLines = lines.slice(Math.max(0, lineNumber - 5), lineNumber).join('\n');
+        if (new RegExp(`if\\s*\\(${varName}\\)|${varName}\\s*&&|${varName}\\s*\\?`).test(beforeLines)) {
+            continue;
+        }
+        // Check if variable comes from external source
+        if (/req\.|params\.|query\.|body\.|find|get/.test(line)) {
+            findings.push({
+                id: `missing-null-check-${filePath}-${lineNumber}`,
+                severity: 'medium',
+                category: 'production',
+                title: 'Missing Null/Undefined Check',
+                description: `Property access on '${varName}' without null check`,
+                file: filePath,
+                line: lineNumber,
+                evidence: line.trim(),
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Helper: Find the end of a function body
+ */
+function findFunctionEnd(content, start) {
+    let braceCount = 0;
+    let inFunction = false;
+    for (let i = start; i < content.length; i++) {
+        const char = content[i];
+        if (char === '{') {
+            braceCount++;
+            inFunction = true;
+        }
+        else if (char === '}') {
+            braceCount--;
+            if (inFunction && braceCount === 0) {
+                return i + 1;
+            }
+        }
+    }
+    return content.length;
+}

package/dist/data-flow-analyzer.js

@@ -0,0 +1,197 @@
+"use strict";
+/**
+ * Data Flow Analyzer
+ * Tracks user input from sources to dangerous sinks
+ * Detects injection vulnerabilities without AI
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeDataFlow = analyzeDataFlow;
+// User input sources (tainted data)
+const INPUT_SOURCES = [
+    /req\.body/gi,
+    /req\.query/gi,
+    /req\.params/gi,
+    /req\.headers/gi,
+    /req\.cookies/gi,
+    /searchParams\.get/gi,
+    /formData\.get/gi,
+    /process\.env/gi, // Can be tainted in some contexts
+];
+// Dangerous sinks (where tainted data causes vulnerabilities)
+const DANGEROUS_SINKS = {
+    sql: [
+        /\.execute\s*\(/gi,
+        /\.query\s*\(/gi,
+        /\.raw\s*\(/gi,
+        /sql`/gi,
+    ],
+    command: [
+        /exec\s*\(/gi,
+        /execSync\s*\(/gi,
+        /spawn\s*\(/gi,
+        /spawnSync\s*\(/gi,
+        /eval\s*\(/gi,
+    ],
+    path: [
+        /fs\.readFile/gi,
+        /fs\.writeFile/gi,
+        /fs\.unlink/gi,
+        /fs\.rm/gi,
+        /require\s*\(/gi,
+        /import\s*\(/gi,
+    ],
+    xss: [
+        /\.innerHTML\s*=/gi,
+        /\.outerHTML\s*=/gi,
+        /document\.write/gi,
+        /dangerouslySetInnerHTML/gi,
+    ],
+};
+// Sanitization functions (clean tainted data)
+const SANITIZERS = [
+    /DOMPurify\.sanitize/gi,
+    /escape/gi,
+    /sanitize/gi,
+    /validate/gi,
+    /parseInt/gi,
+    /parseFloat/gi,
+    /Number\(/gi,
+    /\.trim\(\)/gi,
+    /\.replace\(/gi,
+];
+/**
+ * Analyze data flow from user inputs to dangerous sinks
+ */
+function analyzeDataFlow(files) {
+    const findings = [];
+    for (const file of files) {
+        const fileFindings = analyzeFileDataFlow(file.path, file.content);
+        findings.push(...fileFindings);
+    }
+    return findings;
+}
+function analyzeFileDataFlow(filePath, content) {
+    const findings = [];
+    const lines = content.split('\n');
+    // Find all user input sources
+    const sources = findInputSources(content, lines);
+    // Find all dangerous sinks
+    const sinks = findDangerousSinks(content, lines);
+    // Trace data flow from sources to sinks
+    for (const source of sources) {
+        for (const sink of sinks) {
+            // Check if data flows from source to sink
+            if (dataFlowsFromTo(source, sink, content, lines)) {
+                // Check if data is sanitized
+                const sanitized = isSanitizedBetween(source, sink, content);
+                if (!sanitized) {
+                    findings.push({
+                        id: `dataflow-${source.type}-${sink.type}-${filePath}-${sink.line}`,
+                        severity: getSeverity(sink.type),
+                        category: getCategory(sink.type),
+                        title: `${sink.type.toUpperCase()} Injection via Data Flow`,
+                        description: `User input from ${source.name} flows to ${sink.name} without sanitization`,
+                        file: filePath,
+                        line: sink.line,
+                        evidence: lines[sink.line - 1]?.trim() || '',
+                        dataFlow: {
+                            source: source.name,
+                            sourceLine: source.line,
+                            sink: sink.name,
+                            sinkLine: sink.line,
+                            sanitized: false,
+                            path: [source.name, sink.name],
+                        },
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+function findInputSources(content, lines) {
+    const sources = [];
+    for (const pattern of INPUT_SOURCES) {
+        const matches = content.matchAll(pattern);
+        for (const match of matches) {
+            if (!match.index)
+                continue;
+            const beforeMatch = content.slice(0, match.index);
+            const lineNumber = beforeMatch.split('\n').length;
+            // Try to extract variable name
+            const line = lines[lineNumber - 1] || '';
+            const varMatch = line.match(/(?:const|let|var)\s+(\w+)\s*=/);
+            sources.push({
+                name: match[0],
+                line: lineNumber,
+                type: 'user-input',
+                variable: varMatch?.[1],
+            });
+        }
+    }
+    return sources;
+}
+function findDangerousSinks(content, lines) {
+    const sinks = [];
+    for (const [type, patterns] of Object.entries(DANGEROUS_SINKS)) {
+        for (const pattern of patterns) {
+            const matches = content.matchAll(pattern);
+            for (const match of matches) {
+                if (!match.index)
+                    continue;
+                const beforeMatch = content.slice(0, match.index);
+                const lineNumber = beforeMatch.split('\n').length;
+                sinks.push({
+                    name: match[0],
+                    line: lineNumber,
+                    type: type,
+                });
+            }
+        }
+    }
+    return sinks;
+}
+function dataFlowsFromTo(source, sink, content, lines) {
+    // Source must come before sink
+    if (source.line >= sink.line)
+        return false;
+    // If we have a variable name, check if it's used in the sink line
+    if (source.variable) {
+        const sinkLine = lines[sink.line - 1] || '';
+        if (sinkLine.includes(source.variable)) {
+            return true;
+        }
+    }
+    // Check if req.body/query/params is used directly in sink
+    const sinkLine = lines[sink.line - 1] || '';
+    if (/req\.(body|query|params|headers|cookies)/.test(sinkLine)) {
+        return true;
+    }
+    return false;
+}
+function isSanitizedBetween(source, sink, content) {
+    const lines = content.split('\n');
+    const betweenLines = lines.slice(source.line, sink.line).join('\n');
+    // Check if any sanitization function is called
+    for (const sanitizer of SANITIZERS) {
+        if (sanitizer.test(betweenLines)) {
+            return true;
+        }
+    }
+    return false;
+}
+function getSeverity(sinkType) {
+    switch (sinkType) {
+        case 'sql':
+        case 'command':
+            return 'critical';
+        case 'path':
+        case 'xss':
+            return 'high';
+        default:
+            return 'medium';
+    }
+}
+function getCategory(sinkType) {
+    return 'security';
+}