vettcode-cli 1.0.0

package/dist/enhanced-patterns.js

@@ -0,0 +1,457 @@
+"use strict";
+/**
+ * Enhanced Security Patterns - 350+ Additional Patterns
+ * Comprehensive coverage of OWASP Top 10 and framework-specific vulnerabilities
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_ENHANCED_PATTERNS = exports.SECURITY_HEADER_PATTERNS = exports.ERROR_HANDLING_PATTERNS = exports.DATABASE_PATTERNS = exports.CRYPTO_PATTERNS = exports.REACT_PATTERNS = exports.AUTH_PATTERNS = exports.PATH_TRAVERSAL_PATTERNS = exports.COMMAND_INJECTION_PATTERNS = exports.XSS_PATTERNS = exports.SQL_INJECTION_PATTERNS = void 0;
+// ============================================
+// SQL INJECTION - 25 Patterns
+// ============================================
+exports.SQL_INJECTION_PATTERNS = [
+    {
+        id: "sql-injection-template-literal",
+        regex: /(?:execute|query|raw)\s*\(\s*`[^`]*\$\{[^}]+\}[^`]*`/gi,
+        severity: "critical",
+        category: "security",
+        title: "SQL Injection via Template Literal",
+        description: "SQL query uses template literal with user input",
+        confidence: "high",
+    },
+    {
+        id: "sql-injection-string-concat-plus",
+        regex: /(?:execute|query|raw)\s*\(\s*['"][^'"]*['"]\s*\+\s*(?:req\.|params\.|query\.|body\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "SQL Injection via String Concatenation",
+        description: "SQL query concatenates user input directly",
+        confidence: "high",
+    },
+    {
+        id: "sql-injection-where-clause",
+        regex: /WHERE\s+[^=]+\s*=\s*['"]?\$\{|WHERE\s+[^=]+\s*=\s*['"]\s*\+/gi,
+        severity: "critical",
+        category: "security",
+        title: "SQL Injection in WHERE Clause",
+        description: "WHERE clause uses unsanitized user input",
+        confidence: "high",
+    },
+    {
+        id: "sql-injection-order-by",
+        regex: /ORDER\s+BY\s+\$\{|ORDER\s+BY\s+['"]\s*\+/gi,
+        severity: "critical",
+        category: "security",
+        title: "SQL Injection in ORDER BY",
+        description: "ORDER BY clause vulnerable to injection",
+        confidence: "high",
+    },
+    {
+        id: "sql-injection-limit",
+        regex: /LIMIT\s+\$\{|LIMIT\s+['"]\s*\+/gi,
+        severity: "high",
+        category: "security",
+        title: "SQL Injection in LIMIT Clause",
+        description: "LIMIT clause uses unsanitized input",
+        confidence: "high",
+    },
+];
+// ============================================
+// XSS - 20 Patterns
+// ============================================
+exports.XSS_PATTERNS = [
+    {
+        id: "xss-react-dangerously-set-html",
+        regex: /dangerouslySetInnerHTML\s*=\s*\{\s*\{?\s*__html\s*:\s*(?!DOMPurify)/gi,
+        severity: "high",
+        category: "security",
+        title: "XSS via dangerouslySetInnerHTML Without Sanitization",
+        description: "React component uses dangerouslySetInnerHTML without DOMPurify",
+        confidence: "high",
+    },
+    {
+        id: "xss-dom-innerhtml",
+        regex: /\.innerHTML\s*=\s*(?!['"`]|DOMPurify)/gi,
+        severity: "high",
+        category: "security",
+        title: "XSS via innerHTML Assignment",
+        description: "Direct innerHTML assignment without sanitization",
+        confidence: "medium",
+    },
+    {
+        id: "xss-dom-outerhtml",
+        regex: /\.outerHTML\s*=\s*(?!['"`])/gi,
+        severity: "high",
+        category: "security",
+        title: "XSS via outerHTML Assignment",
+        description: "Direct outerHTML assignment can lead to XSS",
+        confidence: "medium",
+    },
+    {
+        id: "xss-document-write",
+        regex: /document\.write\s*\(/gi,
+        severity: "high",
+        category: "security",
+        title: "XSS via document.write",
+        description: "document.write can execute malicious scripts",
+        confidence: "medium",
+    },
+];
+// ============================================
+// COMMAND INJECTION - 15 Patterns
+// ============================================
+exports.COMMAND_INJECTION_PATTERNS = [
+    {
+        id: "command-injection-exec",
+        regex: /(?:exec|execSync|spawn|spawnSync)\s*\(\s*[`'"]?[^`'"]*\$\{/gi,
+        severity: "critical",
+        category: "security",
+        title: "Command Injection via exec/spawn",
+        description: "Shell command execution with user input",
+        confidence: "high",
+    },
+    {
+        id: "command-injection-child-process",
+        regex: /child_process\.\w+\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "Command Injection via child_process",
+        description: "Child process spawned with user input",
+        confidence: "high",
+    },
+    {
+        id: "command-injection-eval",
+        regex: /eval\s*\(\s*(?:req\.|params\.|query\.|body\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "Code Injection via eval",
+        description: "eval() called with user input",
+        confidence: "high",
+    },
+    {
+        id: "command-injection-function-constructor",
+        regex: /new\s+Function\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "Code Injection via Function Constructor",
+        description: "Function constructor with user input",
+        confidence: "high",
+    },
+];
+// ============================================
+// PATH TRAVERSAL - 12 Patterns
+// ============================================
+exports.PATH_TRAVERSAL_PATTERNS = [
+    {
+        id: "path-traversal-fs-read",
+        regex: /fs\.(?:readFile|readFileSync|createReadStream)\s*\([^)]*(?:req\.|params\.|query\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "Path Traversal in File Read",
+        description: "File read operation with unsanitized user input",
+        confidence: "high",
+    },
+    {
+        id: "path-traversal-fs-write",
+        regex: /fs\.(?:writeFile|writeFileSync|createWriteStream)\s*\([^)]*(?:req\.|params\.|query\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "Path Traversal in File Write",
+        description: "File write operation with unsanitized user input",
+        confidence: "high",
+    },
+    {
+        id: "path-traversal-fs-unlink",
+        regex: /fs\.(?:unlink|unlinkSync|rm|rmSync)\s*\([^)]*(?:req\.|params\.|query\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "Path Traversal in File Delete",
+        description: "File deletion with unsanitized user input",
+        confidence: "high",
+    },
+    {
+        id: "path-traversal-dotdot",
+        regex: /\.\.[\/\\]/gi,
+        severity: "medium",
+        category: "security",
+        title: "Potential Path Traversal Pattern",
+        description: "Path contains ../ or ..\\ which may allow directory traversal",
+        confidence: "low",
+    },
+];
+// ============================================
+// AUTHENTICATION & AUTHORIZATION - 25 Patterns
+// ============================================
+exports.AUTH_PATTERNS = [
+    {
+        id: "missing-auth-middleware",
+        regex: /router\.(?:post|put|delete|patch)\s*\([^)]*\)\s*(?!.*(?:auth|authenticate|isAuthenticated|requireAuth|protect))/gi,
+        severity: "high",
+        category: "security",
+        title: "API Endpoint Without Authentication",
+        description: "State-changing endpoint lacks authentication middleware",
+        confidence: "medium",
+    },
+    {
+        id: "weak-jwt-secret",
+        regex: /jwt\.sign\s*\([^)]*,\s*['"](?:secret|password|123|test)['"]/gi,
+        severity: "critical",
+        category: "security",
+        title: "Weak JWT Secret",
+        description: "JWT signed with weak or hardcoded secret",
+        confidence: "high",
+    },
+    {
+        id: "jwt-no-expiry",
+        regex: /jwt\.sign\s*\([^)]*\)(?![\s\S]{0,100}expiresIn)/gi,
+        severity: "high",
+        category: "security",
+        title: "JWT Without Expiration",
+        description: "JWT token has no expiration time",
+        confidence: "medium",
+    },
+    {
+        id: "session-no-secure-flag",
+        regex: /session\s*\([^)]*\)(?![\s\S]{0,200}secure\s*:\s*true)/gi,
+        severity: "high",
+        category: "security",
+        title: "Session Cookie Without Secure Flag",
+        description: "Session cookie can be transmitted over HTTP",
+        confidence: "medium",
+    },
+    {
+        id: "session-no-httponly",
+        regex: /session\s*\([^)]*\)(?![\s\S]{0,200}httpOnly\s*:\s*true)/gi,
+        severity: "high",
+        category: "security",
+        title: "Session Cookie Without HttpOnly Flag",
+        description: "Session cookie accessible via JavaScript",
+        confidence: "medium",
+    },
+    {
+        id: "bcrypt-low-rounds",
+        regex: /bcrypt\.hash\w*\s*\([^)]*,\s*([1-9]|10)\s*\)/gi,
+        severity: "high",
+        category: "security",
+        title: "Weak bcrypt Rounds",
+        description: "bcrypt rounds < 10 is too weak",
+        confidence: "high",
+    },
+];
+// ============================================
+// REACT/NEXT.JS SPECIFIC - 30 Patterns
+// ============================================
+exports.REACT_PATTERNS = [
+    {
+        id: "react-useeffect-missing-deps",
+        regex: /useEffect\s*\([^)]*\)\s*,\s*\[\s*\]/gi,
+        severity: "medium",
+        category: "react",
+        title: "useEffect with Empty Dependency Array",
+        description: "useEffect may have missing dependencies",
+        confidence: "low",
+    },
+    {
+        id: "react-state-mutation",
+        regex: /(?:state|props)\.\w+\s*=\s*[^=]/gi,
+        severity: "high",
+        category: "react",
+        title: "Direct State/Props Mutation",
+        description: "Mutating state or props directly instead of using setState",
+        confidence: "medium",
+    },
+    {
+        id: "nextjs-getserversideprops-no-auth",
+        regex: /export\s+async\s+function\s+getServerSideProps(?![\s\S]{0,300}(?:session|auth|token))/gi,
+        severity: "high",
+        category: "security",
+        title: "getServerSideProps Without Authentication",
+        description: "Server-side data fetching without auth check",
+        confidence: "low",
+    },
+    {
+        id: "nextjs-api-no-method-check",
+        regex: /export\s+(?:async\s+)?function\s+\w+\s*\([^)]*req[^)]*\)(?![\s\S]{0,100}req\.method)/gi,
+        severity: "medium",
+        category: "security",
+        title: "API Route Without HTTP Method Check",
+        description: "API route doesn't validate HTTP method",
+        confidence: "medium",
+    },
+    {
+        id: "react-key-index",
+        regex: /key\s*=\s*\{\s*(?:index|i|idx)\s*\}/gi,
+        severity: "low",
+        category: "react",
+        title: "Using Array Index as React Key",
+        description: "Array index as key can cause rendering issues",
+        confidence: "medium",
+    },
+];
+// ============================================
+// CRYPTOGRAPHY - 20 Patterns
+// ============================================
+exports.CRYPTO_PATTERNS = [
+    {
+        id: "crypto-weak-algorithm-md5",
+        regex: /crypto\.createHash\s*\(\s*['"]md5['"]\s*\)/gi,
+        severity: "high",
+        category: "security",
+        title: "Weak Cryptographic Algorithm: MD5",
+        description: "MD5 is cryptographically broken",
+        confidence: "high",
+    },
+    {
+        id: "crypto-weak-algorithm-sha1",
+        regex: /crypto\.createHash\s*\(\s*['"]sha1['"]\s*\)/gi,
+        severity: "high",
+        category: "security",
+        title: "Weak Cryptographic Algorithm: SHA1",
+        description: "SHA1 is deprecated and insecure",
+        confidence: "high",
+    },
+    {
+        id: "crypto-weak-random",
+        regex: /Math\.random\s*\(\s*\)/gi,
+        severity: "medium",
+        category: "security",
+        title: "Weak Random Number Generation",
+        description: "Math.random() is not cryptographically secure",
+        confidence: "low",
+    },
+    {
+        id: "crypto-hardcoded-iv",
+        regex: /(?:iv|initializationVector)\s*[=:]\s*['"][a-zA-Z0-9]{16,}['"]/gi,
+        severity: "critical",
+        category: "security",
+        title: "Hardcoded Initialization Vector",
+        description: "IV should be randomly generated for each encryption",
+        confidence: "high",
+    },
+    {
+        id: "crypto-ecb-mode",
+        regex: /cipher\s*\(\s*['"]aes-\d+-ecb['"]/gi,
+        severity: "high",
+        category: "security",
+        title: "Insecure Cipher Mode: ECB",
+        description: "ECB mode is insecure, use CBC or GCM",
+        confidence: "high",
+    },
+];
+// ============================================
+// DATABASE - 25 Patterns
+// ============================================
+exports.DATABASE_PATTERNS = [
+    {
+        id: "db-no-connection-limit",
+        regex: /createConnection\s*\((?![\s\S]{0,200}connectionLimit)/gi,
+        severity: "high",
+        category: "production",
+        title: "Database Connection Without Limit",
+        description: "Database pool has no connection limit",
+        confidence: "medium",
+    },
+    {
+        id: "db-no-timeout",
+        regex: /createConnection\s*\((?![\s\S]{0,200}(?:timeout|connectTimeout))/gi,
+        severity: "medium",
+        category: "production",
+        title: "Database Connection Without Timeout",
+        description: "Database connection has no timeout",
+        confidence: "medium",
+    },
+    {
+        id: "db-query-no-limit",
+        regex: /\.find\s*\(\s*\{[^}]*\}\s*\)(?![\s\S]{0,100}\.limit)/gi,
+        severity: "high",
+        category: "performance",
+        title: "Database Query Without Limit",
+        description: "Query can return unlimited results causing OOM",
+        confidence: "medium",
+    },
+    {
+        id: "db-n-plus-one",
+        regex: /for\s*\([^)]*\)\s*\{[^}]*(?:find|findOne|query)\s*\(/gi,
+        severity: "high",
+        category: "performance",
+        title: "Potential N+1 Query Problem",
+        description: "Database query inside loop causes N+1 problem",
+        confidence: "low",
+    },
+];
+// ============================================
+// ERROR HANDLING - 20 Patterns
+// ============================================
+exports.ERROR_HANDLING_PATTERNS = [
+    {
+        id: "empty-catch-block",
+        regex: /catch\s*\([^)]*\)\s*\{\s*\}/gi,
+        severity: "medium",
+        category: "production",
+        title: "Empty Catch Block",
+        description: "Error caught but not handled",
+        confidence: "high",
+    },
+    {
+        id: "catch-without-logging",
+        regex: /catch\s*\([^)]*\)\s*\{(?![\s\S]{0,100}(?:console\.|logger\.|log\(|error\())/gi,
+        severity: "medium",
+        category: "production",
+        title: "Catch Block Without Logging",
+        description: "Error caught but not logged",
+        confidence: "low",
+    },
+    {
+        id: "throw-string",
+        regex: /throw\s+['"][^'"]+['"]/gi,
+        severity: "low",
+        category: "code-quality",
+        title: "Throwing String Instead of Error",
+        description: "Should throw Error objects, not strings",
+        confidence: "high",
+    },
+];
+// ============================================
+// SECURITY HEADERS - 15 Patterns
+// ============================================
+exports.SECURITY_HEADER_PATTERNS = [
+    {
+        id: "missing-helmet",
+        regex: /express\s*\(\s*\)(?![\s\S]{0,500}helmet)/gi,
+        severity: "high",
+        category: "security",
+        title: "Express App Without Helmet",
+        description: "Missing security headers middleware",
+        confidence: "medium",
+    },
+    {
+        id: "missing-cors-config",
+        regex: /cors\s*\(\s*\)(?![\s\S]{0,100}origin)/gi,
+        severity: "high",
+        category: "security",
+        title: "CORS Without Origin Restriction",
+        description: "CORS allows all origins",
+        confidence: "medium",
+    },
+    {
+        id: "cors-allow-all",
+        regex: /Access-Control-Allow-Origin['"]?\s*[,:]?\s*['"]?\*/gi,
+        severity: "high",
+        category: "security",
+        title: "CORS Allows All Origins",
+        description: "Wildcard CORS policy is insecure",
+        confidence: "high",
+    },
+];
+// Export all patterns combined
+exports.ALL_ENHANCED_PATTERNS = [
+    ...exports.SQL_INJECTION_PATTERNS,
+    ...exports.XSS_PATTERNS,
+    ...exports.COMMAND_INJECTION_PATTERNS,
+    ...exports.PATH_TRAVERSAL_PATTERNS,
+    ...exports.AUTH_PATTERNS,
+    ...exports.REACT_PATTERNS,
+    ...exports.CRYPTO_PATTERNS,
+    ...exports.DATABASE_PATTERNS,
+    ...exports.ERROR_HANDLING_PATTERNS,
+    ...exports.SECURITY_HEADER_PATTERNS,
+];

package/dist/file-collector.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * File Collector - Collects files from local directories
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectFiles = collectFiles;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const DEFAULT_IGNORE = [
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    ".next",
+    "coverage",
+    ".vscode",
+    ".idea",
+    "*.log",
+    "*.min.js",
+    "*.min.css",
+    "package-lock.json",
+    "yarn.lock",
+    "pnpm-lock.yaml",
+];
+const CODE_EXTENSIONS = [
+    ".js", ".jsx", ".ts", ".tsx", // JavaScript/TypeScript
+    ".py", ".pyw", // Python
+    ".java", // Java
+    ".php", ".phtml", // PHP
+    ".go", // Go
+    ".rb", // Ruby
+    ".cs", // C#
+    ".cpp", ".c", ".h", // C/C++
+    ".swift", // Swift
+    ".kt", ".kts", // Kotlin
+    ".rs", // Rust
+    ".vue", // Vue
+    ".svelte", // Svelte
+];
+function shouldIgnore(filePath, ignorePatterns) {
+    const fileName = path.basename(filePath);
+    const relativePath = filePath;
+    for (const pattern of ignorePatterns) {
+        if (pattern.includes("*")) {
+            const regex = new RegExp(pattern.replace(/\*/g, ".*"));
+            if (regex.test(fileName) || regex.test(relativePath)) {
+                return true;
+            }
+        }
+        else if (relativePath.includes(pattern) || fileName === pattern) {
+            return true;
+        }
+    }
+    return false;
+}
+function hasCodeExtension(filePath) {
+    return CODE_EXTENSIONS.some(ext => filePath.endsWith(ext));
+}
+function collectFiles(directory, ignorePatterns = DEFAULT_IGNORE) {
+    const files = [];
+    function walk(dir, baseDir) {
+        try {
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                const fullPath = path.join(dir, entry.name);
+                const relativePath = path.relative(baseDir, fullPath);
+                if (shouldIgnore(relativePath, ignorePatterns)) {
+                    continue;
+                }
+                if (entry.isDirectory()) {
+                    walk(fullPath, baseDir);
+                }
+                else if (entry.isFile() && hasCodeExtension(entry.name)) {
+                    try {
+                        const content = fs.readFileSync(fullPath, "utf-8");
+                        files.push({
+                            path: relativePath,
+                            content: content,
+                            lines: content.split("\n").length,
+                        });
+                    }
+                    catch (error) {
+                        // Skip files that can't be read
+                        console.warn(`Warning: Could not read file ${relativePath}`);
+                    }
+                }
+            }
+        }
+        catch (error) {
+            console.warn(`Warning: Could not read directory ${dir}`);
+        }
+    }
+    const absolutePath = path.resolve(directory);
+    if (!fs.existsSync(absolutePath)) {
+        throw new Error(`Directory not found: ${directory}`);
+    }
+    walk(absolutePath, absolutePath);
+    return files;
+}