vibe-guard 1.0.0

package/dist/rules/insecure-dependencies.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InsecureDependenciesRule = void 0;
+const types_1 = require("../types");
+class InsecureDependenciesRule extends types_1.BaseRule {
+    constructor() {
+        super(...arguments);
+        this.name = 'insecure-dependencies';
+        this.description = 'Detects potentially insecure dependencies and packages';
+        this.severity = 'medium';
+        this.vulnerablePackages = [
+            // Known vulnerable packages
+            { name: 'lodash', versions: ['<4.17.21'], reason: 'Prototype pollution vulnerabilities' },
+            { name: 'moment', versions: ['*'], reason: 'Deprecated package, use date-fns or dayjs instead' },
+            { name: 'request', versions: ['*'], reason: 'Deprecated package with security issues' },
+            { name: 'node-uuid', versions: ['*'], reason: 'Deprecated, use uuid package instead' },
+            { name: 'growl', versions: ['<1.10.0'], reason: 'Command injection vulnerability' },
+            { name: 'handlebars', versions: ['<4.7.7'], reason: 'Template injection vulnerabilities' },
+            { name: 'serialize-javascript', versions: ['<3.1.0'], reason: 'XSS vulnerability' },
+            { name: 'minimist', versions: ['<1.2.6'], reason: 'Prototype pollution vulnerability' },
+            { name: 'yargs-parser', versions: ['<13.1.2'], reason: 'Prototype pollution vulnerability' },
+            { name: 'ini', versions: ['<1.3.6'], reason: 'Prototype pollution vulnerability' },
+            // Python packages
+            { name: 'django', versions: ['<3.2.13'], reason: 'Multiple security vulnerabilities' },
+            { name: 'flask', versions: ['<2.0.0'], reason: 'Security improvements in newer versions' },
+            { name: 'requests', versions: ['<2.20.0'], reason: 'SSL verification issues' },
+            { name: 'pyyaml', versions: ['<5.4'], reason: 'Arbitrary code execution vulnerability' },
+            { name: 'pillow', versions: ['<8.3.2'], reason: 'Multiple image processing vulnerabilities' },
+            // PHP packages
+            { name: 'symfony/symfony', versions: ['<4.4.35'], reason: 'Multiple security vulnerabilities' },
+            { name: 'laravel/framework', versions: ['<8.75.0'], reason: 'Security vulnerabilities' },
+            { name: 'monolog/monolog', versions: ['<2.3.5'], reason: 'Remote code execution vulnerability' }
+        ];
+        this.suspiciousPatterns = [
+            // Suspicious package names
+            { pattern: /(?:^|\s)(?:eval|exec|shell|cmd|system|proc|spawn)(?:-|_)?(?:js|py|php|rb)?\s*[:=]/gi, type: 'Suspicious package name' },
+            { pattern: /(?:^|\s)(?:backdoor|malware|virus|trojan|keylogger)\s*[:=]/gi, type: 'Malicious package name' },
+            // Typosquatting patterns (common misspellings)
+            { pattern: /(?:^|\s)(?:lodahs|momnet|expres|reactt|angualr|vuejs)\s*[:=]/gi, type: 'Potential typosquatting' },
+            // Suspicious version patterns
+            { pattern: /["'](?:\*|latest|>.*|>=.*\|\|.*|.*\.\*\.\*)["']/g, type: 'Overly permissive version range' },
+            // Development dependencies in production
+            { pattern: /"devDependencies"\s*:\s*\{[^}]*"(?:nodemon|webpack-dev-server|jest|mocha|chai|sinon)"/gi, type: 'Development dependency' }
+        ];
+    }
+    check(fileContent) {
+        const issues = [];
+        // Only check dependency files
+        if (!this.isDependencyFile(fileContent.path)) {
+            return issues;
+        }
+        // Check for vulnerable packages
+        this.checkVulnerablePackages(fileContent, issues);
+        // Check for suspicious patterns
+        this.checkSuspiciousPatterns(fileContent, issues);
+        return issues;
+    }
+    isDependencyFile(filePath) {
+        const dependencyFiles = [
+            /package\.json$/i,
+            /requirements\.txt$/i,
+            /Pipfile$/i,
+            /composer\.json$/i,
+            /Gemfile$/i,
+            /pom\.xml$/i,
+            /build\.gradle$/i,
+            /yarn\.lock$/i,
+            /package-lock\.json$/i
+        ];
+        return dependencyFiles.some(pattern => pattern.test(filePath));
+    }
+    checkVulnerablePackages(fileContent, issues) {
+        for (const pkg of this.vulnerablePackages) {
+            const pattern = new RegExp(`["']${pkg.name}["']\\s*:\\s*["']([^"']+)["']`, 'gi');
+            const matches = this.findMatches(fileContent.content, pattern);
+            for (const { match, line, column, lineContent } of matches) {
+                const version = match[1];
+                if (version && this.isVulnerableVersion(version, pkg.versions)) {
+                    issues.push(this.createIssue(fileContent.path, line, column, lineContent, `Vulnerable dependency: ${pkg.name}@${version}`, `${pkg.reason}. Update to a secure version or find an alternative package.`));
+                }
+            }
+        }
+    }
+    checkSuspiciousPatterns(fileContent, issues) {
+        for (const { pattern, type } of this.suspiciousPatterns) {
+            const matches = this.findMatches(fileContent.content, pattern);
+            for (const { line, column, lineContent } of matches) {
+                // Skip development dependencies check if it's actually in devDependencies section
+                if (type === 'Development dependency' && this.isInDevDependencies(fileContent.content, line)) {
+                    continue;
+                }
+                issues.push(this.createIssue(fileContent.path, line, column, lineContent, `Suspicious dependency pattern: ${type}`, `Review this dependency carefully. Ensure it's from a trusted source and serves a legitimate purpose.`));
+            }
+        }
+    }
+    isVulnerableVersion(version, vulnerableVersions) {
+        // Simple version checking - in a real implementation, you'd use semver
+        for (const vulnVersion of vulnerableVersions) {
+            if (vulnVersion === '*') {
+                return true;
+            }
+            if (vulnVersion.startsWith('<')) {
+                // This is a simplified check - real implementation would use proper semver comparison
+                const targetVersion = vulnVersion.substring(1);
+                if (this.compareVersions(version, targetVersion) < 0) {
+                    return true;
+                }
+            }
+            if (version === vulnVersion) {
+                return true;
+            }
+        }
+        return false;
+    }
+    compareVersions(version1, version2) {
+        // Simplified version comparison - real implementation would handle all semver cases
+        const v1Parts = version1.replace(/[^\d.]/g, '').split('.').map(Number);
+        const v2Parts = version2.replace(/[^\d.]/g, '').split('.').map(Number);
+        for (let i = 0; i < Math.max(v1Parts.length, v2Parts.length); i++) {
+            const v1Part = v1Parts[i] || 0;
+            const v2Part = v2Parts[i] || 0;
+            if (v1Part < v2Part)
+                return -1;
+            if (v1Part > v2Part)
+                return 1;
+        }
+        return 0;
+    }
+    isInDevDependencies(content, lineNumber) {
+        const lines = content.split('\n');
+        // Look backwards from the current line to find the section
+        for (let i = lineNumber - 1; i >= 0; i--) {
+            const line = lines[i];
+            if (!line)
+                continue;
+            const trimmedLine = line.trim();
+            if (trimmedLine.includes('"devDependencies"')) {
+                return true;
+            }
+            if (trimmedLine.includes('"dependencies"') && !trimmedLine.includes('"devDependencies"')) {
+                return false;
+            }
+            // If we hit another top-level section, stop looking
+            if (trimmedLine.match(/^"[^"]+"\s*:\s*\{/) && !trimmedLine.includes('Dependencies')) {
+                break;
+            }
+        }
+        return false;
+    }
+}
+exports.InsecureDependenciesRule = InsecureDependenciesRule;
+//# sourceMappingURL=insecure-dependencies.js.map

package/dist/rules/insecure-dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-dependencies.js","sourceRoot":"","sources":["../../src/rules/insecure-dependencies.ts"],"names":[],"mappings":";;;AAAA,oCAAgE;AAEhE,MAAa,wBAAyB,SAAQ,gBAAQ;IAAtD;;QACW,SAAI,GAAG,uBAAuB,CAAC;QAC/B,gBAAW,GAAG,wDAAwD,CAAC;QACvE,aAAQ,GAAG,QAAiB,CAAC;QAErB,uBAAkB,GAAG;YACpC,4BAA4B;YAC5B,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE;YACzF,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,mDAAmD,EAAE;YAChG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,yCAAyC,EAAE;YACvF,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,sCAAsC,EAAE;YACtF,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE;YACnF,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE;YAC1F,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE;YACnF,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE;YACvF,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE;YAC5F,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE;YAElF,kBAAkB;YAClB,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE;YACtF,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,yCAAyC,EAAE;YAC1F,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE;YAC9E,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,wCAAwC,EAAE;YACxF,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,2CAA2C,EAAE;YAE7F,eAAe;YACf,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE;YAC/F,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACxF,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE;SACjG,CAAC;QAEe,uBAAkB,GAAG;YACpC,2BAA2B;YAC3B,EAAE,OAAO,EAAE,qFAAqF,EAAE,IAAI,EAAE,yBAAyB,EAAE;YACnI,EAAE,OAAO,EAAE,8DAA8D,EAAE,IAAI,EAAE,wBAAwB,EAAE;YAE3G,+CAA+C;YAC/C,EAAE,OAAO,EAAE,gEAAgE,EAAE,IAAI,EAAE,yBAAyB,EAAE;YAE9G,8BAA8B;YAC9B,EAAE,OAAO,EAAE,kDAAkD,EAAE,IAAI,EAAE,iCAAiC,EAAE;YAExG,yCAAyC;YACzC,EAAE,OAAO,EAAE,yFAAyF,EAAE,IAAI,EAAE,wBAAwB,EAAE;SACvI,CAAC;IAgJJ,CAAC;IA9IC,KAAK,CAAC,WAAwB;QAC5B,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAElD,gCAAgC;QAChC,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAElD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,gBAAgB,CAAC,QAAgB;QACvC,MAAM,eAAe,GAAG;YACtB,iBAAiB;YACjB,qBAAqB;YACrB,WAAW;YACX,kBAAkB;YAClB,WAAW;YACX,YAAY;YACZ,iBAAiB;YACjB,cAAc;YACd,sBAAsB;SACvB,CAAC;QAEF,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,uBAAuB,CAAC,WAAwB,EAAE,MAAuB;QAC/E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,+BAA+B,EAAE,IAAI,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/D,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAEzB,IAAI,OAAO,IAAI,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,WAAW,CAAC,IAAI,EAChB,IAAI,EACJ,MAAM,EACN,WAAW,EACX,0BAA0B,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,EAC/C,GAAG,GAAG,CAAC,MAAM,8DAA8D,CAC5E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,uBAAuB,CAAC,WAAwB,EAAE,MAAuB;QAC/E,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/D,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;gBACpD,kFAAkF;gBAClF,IAAI,IAAI,KAAK,wBAAwB,IAAI,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC7F,SAAS;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,WAAW,CAAC,IAAI,EAChB,IAAI,EACJ,MAAM,EACN,WAAW,EACX,kCAAkC,IAAI,EAAE,EACxC,sGAAsG,CACvG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,OAAe,EAAE,kBAA4B;QACvE,uEAAuE;QACvE,KAAK,MAAM,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC7C,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,sFAAsF;gBACtF,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC/C,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CAAC,QAAgB,EAAE,QAAgB;QACxD,oFAAoF;QACpF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAE/B,IAAI,MAAM,GAAG,MAAM;gBAAE,OAAO,CAAC,CAAC,CAAC;YAC/B,IAAI,MAAM,GAAG,MAAM;gBAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,mBAAmB,CAAC,OAAe,EAAE,UAAkB;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,2DAA2D;QAC3D,KAAK,IAAI,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAEhC,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACzF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,oDAAoD;YACpD,IAAI,WAAW,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpF,MAAM;YACR,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AA5LD,4DA4LC"}

package/dist/rules/insecure-http.d.ts

@@ -0,0 +1,13 @@
+import { BaseRule, FileContent, SecurityIssue } from '../types';
+export declare class InsecureHttpRule extends BaseRule {
+    readonly name = "insecure-http";
+    readonly description = "Detects insecure HTTP usage instead of HTTPS";
+    readonly severity: "medium";
+    private readonly httpPatterns;
+    private readonly safePatterns;
+    check(fileContent: FileContent): SecurityIssue[];
+    private isDevelopmentContext;
+    private isTestFile;
+    private extractUrl;
+}
+//# sourceMappingURL=insecure-http.d.ts.map

package/dist/rules/insecure-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-http.d.ts","sourceRoot":"","sources":["../../src/rules/insecure-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEhE,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,WAAW,kDAAkD;IACtE,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;IAEtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CA4B3B;IAEF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAY3B;IAEF,KAAK,CAAC,WAAW,EAAE,WAAW,GAAG,aAAa,EAAE;IAiChD,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,UAAU;CAInB"}

package/dist/rules/insecure-http.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InsecureHttpRule = void 0;
+const types_1 = require("../types");
+class InsecureHttpRule extends types_1.BaseRule {
+    constructor() {
+        super(...arguments);
+        this.name = 'insecure-http';
+        this.description = 'Detects insecure HTTP usage instead of HTTPS';
+        this.severity = 'medium';
+        this.httpPatterns = [
+            // Direct HTTP URLs
+            { pattern: /['"`]http:\/\/(?!localhost|127\.0\.0\.1|0\.0\.0\.0)[^'"`\s]+['"`]/gi, type: 'HTTP URL' },
+            // API endpoints
+            { pattern: /(?:api_url|endpoint|base_url)\s*[:=]\s*['"`]http:\/\/[^'"`\s]+['"`]/gi, type: 'HTTP API Endpoint' },
+            { pattern: /fetch\s*\(\s*['"`]http:\/\/[^'"`\s]+['"`]/gi, type: 'HTTP Fetch Request' },
+            { pattern: /axios\.(?:get|post|put|delete)\s*\(\s*['"`]http:\/\/[^'"`\s]+['"`]/gi, type: 'HTTP Axios Request' },
+            // Configuration
+            { pattern: /(?:protocol|scheme)\s*[:=]\s*['"`]http['"`]/gi, type: 'HTTP Protocol Configuration' },
+            { pattern: /secure\s*[:=]\s*false/gi, type: 'Insecure Configuration' },
+            // Express/Node.js specific
+            { pattern: /app\.listen\s*\(\s*\d+\s*,\s*['"`]0\.0\.0\.0['"`]/gi, type: 'HTTP Server Binding' },
+            { pattern: /createServer\s*\(\s*(?!.*https)/gi, type: 'HTTP Server Creation' },
+            // Cookie security
+            { pattern: /httpOnly\s*:\s*false/gi, type: 'Insecure Cookie Configuration' },
+            { pattern: /secure\s*:\s*false/gi, type: 'Insecure Cookie Security' },
+            // Mixed content
+            { pattern: /src\s*=\s*['"`]http:\/\/[^'"`\s]+['"`]/gi, type: 'Mixed Content Resource' },
+            { pattern: /href\s*=\s*['"`]http:\/\/[^'"`\s]+['"`]/gi, type: 'Mixed Content Link' },
+            // Framework specific
+            { pattern: /@RequestMapping.*http:/gi, type: 'HTTP Spring Mapping' },
+            { pattern: /ALLOWED_HOSTS\s*=\s*\[\s*['"`]\*['"`]/gi, type: 'Permissive Host Configuration' }
+        ];
+        this.safePatterns = [
+            /localhost/i,
+            /127\.0\.0\.1/,
+            /0\.0\.0\.0/,
+            /\.local/i,
+            /development/i,
+            /dev/i,
+            /staging/i,
+            /test/i,
+            /mock/i,
+            /example/i,
+            /placeholder/i
+        ];
+    }
+    check(fileContent) {
+        const issues = [];
+        for (const { pattern, type } of this.httpPatterns) {
+            const matches = this.findMatches(fileContent.content, pattern);
+            for (const { match, line, column, lineContent } of matches) {
+                const matchedText = match[0];
+                // Skip if it's in a development/test context
+                if (this.isDevelopmentContext(matchedText) || this.isDevelopmentContext(lineContent)) {
+                    continue;
+                }
+                // Skip if the file appears to be a test or development file
+                if (this.isTestFile(fileContent.path)) {
+                    continue;
+                }
+                issues.push(this.createIssue(fileContent.path, line, column, lineContent, `Insecure ${type} detected: ${this.extractUrl(matchedText)}`, `Use HTTPS instead of HTTP for secure communication. Replace 'http://' with 'https://' and ensure SSL/TLS certificates are properly configured.`));
+            }
+        }
+        return issues;
+    }
+    isDevelopmentContext(text) {
+        return this.safePatterns.some(pattern => pattern.test(text));
+    }
+    isTestFile(filePath) {
+        const testPatterns = [
+            /test/i,
+            /spec/i,
+            /\.test\./i,
+            /\.spec\./i,
+            /__tests__/i,
+            /tests\//i,
+            /spec\//i,
+            /dev/i,
+            /development/i,
+            /local/i
+        ];
+        return testPatterns.some(pattern => pattern.test(filePath));
+    }
+    extractUrl(text) {
+        const urlMatch = text.match(/http:\/\/[^'"`\s]+/);
+        return urlMatch ? urlMatch[0] : text;
+    }
+}
+exports.InsecureHttpRule = InsecureHttpRule;
+//# sourceMappingURL=insecure-http.js.map

package/dist/rules/insecure-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insecure-http.js","sourceRoot":"","sources":["../../src/rules/insecure-http.ts"],"names":[],"mappings":";;;AAAA,oCAAgE;AAEhE,MAAa,gBAAiB,SAAQ,gBAAQ;IAA9C;;QACW,SAAI,GAAG,eAAe,CAAC;QACvB,gBAAW,GAAG,8CAA8C,CAAC;QAC7D,aAAQ,GAAG,QAAiB,CAAC;QAErB,iBAAY,GAAG;YAC9B,mBAAmB;YACnB,EAAE,OAAO,EAAE,qEAAqE,EAAE,IAAI,EAAE,UAAU,EAAE;YAEpG,gBAAgB;YAChB,EAAE,OAAO,EAAE,uEAAuE,EAAE,IAAI,EAAE,mBAAmB,EAAE;YAC/G,EAAE,OAAO,EAAE,6CAA6C,EAAE,IAAI,EAAE,oBAAoB,EAAE;YACtF,EAAE,OAAO,EAAE,sEAAsE,EAAE,IAAI,EAAE,oBAAoB,EAAE;YAE/G,gBAAgB;YAChB,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,6BAA6B,EAAE;YACjG,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,wBAAwB,EAAE;YAEtE,2BAA2B;YAC3B,EAAE,OAAO,EAAE,qDAAqD,EAAE,IAAI,EAAE,qBAAqB,EAAE;YAC/F,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,sBAAsB,EAAE;YAE9E,kBAAkB;YAClB,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,+BAA+B,EAAE;YAC5E,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,0BAA0B,EAAE;YAErE,gBAAgB;YAChB,EAAE,OAAO,EAAE,0CAA0C,EAAE,IAAI,EAAE,wBAAwB,EAAE;YACvF,EAAE,OAAO,EAAE,2CAA2C,EAAE,IAAI,EAAE,oBAAoB,EAAE;YAEpF,qBAAqB;YACrB,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,qBAAqB,EAAE;YACpE,EAAE,OAAO,EAAE,yCAAyC,EAAE,IAAI,EAAE,+BAA+B,EAAE;SAC9F,CAAC;QAEe,iBAAY,GAAG;YAC9B,YAAY;YACZ,cAAc;YACd,YAAY;YACZ,UAAU;YACV,cAAc;YACd,MAAM;YACN,UAAU;YACV,OAAO;YACP,OAAO;YACP,UAAU;YACV,cAAc;SACf,CAAC;IA4DJ,CAAC;IA1DC,KAAK,CAAC,WAAwB;QAC5B,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/D,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAE7B,6CAA6C;gBAC7C,IAAI,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;oBACrF,SAAS;gBACX,CAAC;gBAED,4DAA4D;gBAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,WAAW,CAAC,IAAI,EAChB,IAAI,EACJ,MAAM,EACN,WAAW,EACX,YAAY,IAAI,cAAc,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,EAC5D,gJAAgJ,CACjJ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,oBAAoB,CAAC,IAAY;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,MAAM,YAAY,GAAG;YACnB,OAAO;YACP,OAAO;YACP,WAAW;YACX,WAAW;YACX,YAAY;YACZ,UAAU;YACV,SAAS;YACT,MAAM;YACN,cAAc;YACd,QAAQ;SACT,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEO,UAAU,CAAC,IAAY;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;CACF;AA3GD,4CA2GC"}

package/dist/rules/missing-authentication.d.ts

@@ -0,0 +1,14 @@
+import { BaseRule, FileContent, SecurityIssue } from '../types';
+export declare class MissingAuthenticationRule extends BaseRule {
+    readonly name = "missing-authentication";
+    readonly description = "Detects potentially unprotected routes and endpoints";
+    readonly severity: "high";
+    private readonly routePatterns;
+    private readonly protectedPatterns;
+    private readonly publicEndpoints;
+    check(fileContent: FileContent): SecurityIssue[];
+    private extractRoute;
+    private isPublicEndpoint;
+    private hasAuthenticationContext;
+}
+//# sourceMappingURL=missing-authentication.d.ts.map

package/dist/rules/missing-authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-authentication.d.ts","sourceRoot":"","sources":["../../src/rules/missing-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEhE,qBAAa,yBAA0B,SAAQ,QAAQ;IACrD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,WAAW,0DAA0D;IAC9E,QAAQ,CAAC,QAAQ,EAAG,MAAM,CAAU;IAEpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAgB5B;IAEF,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAahC;IAEF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAgB9B;IAEF,KAAK,CAAC,WAAW,EAAE,WAAW,GAAG,aAAa,EAAE;IAiChD,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,wBAAwB;CAWjC"}

package/dist/rules/missing-authentication.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MissingAuthenticationRule = void 0;
+const types_1 = require("../types");
+class MissingAuthenticationRule extends types_1.BaseRule {
+    constructor() {
+        super(...arguments);
+        this.name = 'missing-authentication';
+        this.description = 'Detects potentially unprotected routes and endpoints';
+        this.severity = 'high';
+        this.routePatterns = [
+            // Express.js
+            { pattern: /app\.(get|post|put|delete|patch)\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*(?!.*auth|.*login|.*verify|.*middleware)/gi, framework: 'Express' },
+            { pattern: /router\.(get|post|put|delete|patch)\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*(?!.*auth|.*login|.*verify|.*middleware)/gi, framework: 'Express' },
+            // Next.js API routes
+            { pattern: /export\s+(?:default\s+)?(?:async\s+)?function\s+handler\s*\([^)]*\)\s*\{(?![\s\S]*auth|[\s\S]*login|[\s\S]*verify)/gi, framework: 'Next.js' },
+            // Flask
+            { pattern: /@app\.route\s*\(\s*['"`]([^'"`]+)['"`](?:[^)]*)\)\s*\n\s*def\s+\w+\s*\([^)]*\)\s*:(?![\s\S]*auth|[\s\S]*login|[\s\S]*verify)/gi, framework: 'Flask' },
+            // FastAPI
+            { pattern: /@app\.(get|post|put|delete|patch)\s*\(\s*['"`]([^'"`]+)['"`]\s*\)\s*\n\s*(?:async\s+)?def\s+\w+\s*\([^)]*\)\s*:(?![\s\S]*auth|[\s\S]*login|[\s\S]*verify)/gi, framework: 'FastAPI' },
+            // Laravel
+            { pattern: /Route::(get|post|put|delete|patch)\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*(?!.*auth|.*login|.*verify|.*middleware)/gi, framework: 'Laravel' }
+        ];
+        this.protectedPatterns = [
+            /auth/i,
+            /login/i,
+            /verify/i,
+            /middleware/i,
+            /guard/i,
+            /protect/i,
+            /secure/i,
+            /jwt/i,
+            /token/i,
+            /session/i,
+            /permission/i,
+            /role/i
+        ];
+        this.publicEndpoints = [
+            /\/public/i,
+            /\/health/i,
+            /\/ping/i,
+            /\/status/i,
+            /\/docs/i,
+            /\/swagger/i,
+            /\/api-docs/i,
+            /\/favicon/i,
+            /\/robots\.txt/i,
+            /\/sitemap/i,
+            /\/login/i,
+            /\/register/i,
+            /\/signup/i,
+            /\/forgot-password/i,
+            /\/reset-password/i
+        ];
+    }
+    check(fileContent) {
+        const issues = [];
+        for (const { pattern, framework } of this.routePatterns) {
+            const matches = this.findMatches(fileContent.content, pattern);
+            for (const { match, line, column, lineContent } of matches) {
+                const route = this.extractRoute(match);
+                // Skip if it's a known public endpoint
+                if (this.isPublicEndpoint(route)) {
+                    continue;
+                }
+                // Skip if the surrounding code suggests authentication
+                if (this.hasAuthenticationContext(fileContent.content, line)) {
+                    continue;
+                }
+                issues.push(this.createIssue(fileContent.path, line, column, lineContent, `Potentially unprotected ${framework} route: ${route}`, `Add authentication middleware or verify that this endpoint should be publicly accessible. Consider using authentication guards, middleware, or decorators.`));
+            }
+        }
+        return issues;
+    }
+    extractRoute(match) {
+        // Try to find the route path in the match
+        for (let i = 1; i < match.length; i++) {
+            const matchGroup = match[i];
+            if (matchGroup && matchGroup.startsWith('/')) {
+                return matchGroup;
+            }
+        }
+        return match[0] || '';
+    }
+    isPublicEndpoint(route) {
+        return this.publicEndpoints.some(pattern => pattern.test(route));
+    }
+    hasAuthenticationContext(content, lineNumber) {
+        const lines = content.split('\n');
+        const contextRange = 10; // Check 10 lines before and after
+        const startLine = Math.max(0, lineNumber - contextRange - 1);
+        const endLine = Math.min(lines.length, lineNumber + contextRange);
+        const contextLines = lines.slice(startLine, endLine).join('\n');
+        return this.protectedPatterns.some(pattern => pattern.test(contextLines));
+    }
+}
+exports.MissingAuthenticationRule = MissingAuthenticationRule;
+//# sourceMappingURL=missing-authentication.js.map

package/dist/rules/missing-authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-authentication.js","sourceRoot":"","sources":["../../src/rules/missing-authentication.ts"],"names":[],"mappings":";;;AAAA,oCAAgE;AAEhE,MAAa,yBAA0B,SAAQ,gBAAQ;IAAvD;;QACW,SAAI,GAAG,wBAAwB,CAAC;QAChC,gBAAW,GAAG,sDAAsD,CAAC;QACrE,aAAQ,GAAG,MAAe,CAAC;QAEnB,kBAAa,GAAG;YAC/B,aAAa;YACb,EAAE,OAAO,EAAE,8GAA8G,EAAE,SAAS,EAAE,SAAS,EAAE;YACjJ,EAAE,OAAO,EAAE,iHAAiH,EAAE,SAAS,EAAE,SAAS,EAAE;YAEpJ,qBAAqB;YACrB,EAAE,OAAO,EAAE,sHAAsH,EAAE,SAAS,EAAE,SAAS,EAAE;YAEzJ,QAAQ;YACR,EAAE,OAAO,EAAE,gIAAgI,EAAE,SAAS,EAAE,OAAO,EAAE;YAEjK,UAAU;YACV,EAAE,OAAO,EAAE,6JAA6J,EAAE,SAAS,EAAE,SAAS,EAAE;YAEhM,UAAU;YACV,EAAE,OAAO,EAAE,gHAAgH,EAAE,SAAS,EAAE,SAAS,EAAE;SACpJ,CAAC;QAEe,sBAAiB,GAAG;YACnC,OAAO;YACP,QAAQ;YACR,SAAS;YACT,aAAa;YACb,QAAQ;YACR,UAAU;YACV,SAAS;YACT,MAAM;YACN,QAAQ;YACR,UAAU;YACV,aAAa;YACb,OAAO;SACR,CAAC;QAEe,oBAAe,GAAG;YACjC,WAAW;YACX,WAAW;YACX,SAAS;YACT,WAAW;YACX,SAAS;YACT,YAAY;YACZ,aAAa;YACb,YAAY;YACZ,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,aAAa;YACb,WAAW;YACX,oBAAoB;YACpB,mBAAmB;SACpB,CAAC;IA6DJ,CAAC;IA3DC,KAAK,CAAC,WAAwB;QAC5B,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/D,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEvC,uCAAuC;gBACvC,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,SAAS;gBACX,CAAC;gBAED,uDAAuD;gBACvD,IAAI,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC7D,SAAS;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,WAAW,CAAC,IAAI,EAChB,IAAI,EACJ,MAAM,EACN,WAAW,EACX,2BAA2B,SAAS,WAAW,KAAK,EAAE,EACtD,4JAA4J,CAC7J,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,KAAuB;QAC1C,0CAA0C;QAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAEO,gBAAgB,CAAC,KAAa;QACpC,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,wBAAwB,CAAC,OAAe,EAAE,UAAkB;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,kCAAkC;QAE3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5E,CAAC;CACF;AAnHD,8DAmHC"}

package/dist/rules/missing-security-headers.d.ts

@@ -0,0 +1,16 @@
+import { BaseRule, FileContent, SecurityIssue } from '../types';
+export declare class MissingSecurityHeadersRule extends BaseRule {
+    readonly name = "missing-security-headers";
+    readonly description = "Detects missing HTTP security headers";
+    readonly severity: "medium";
+    private readonly securityHeaders;
+    private readonly serverPatterns;
+    check(fileContent: FileContent): SecurityIssue[];
+    private isWebApplicationFile;
+    private hasServerCode;
+    private checkMissingHeaders;
+    private hasSecurityHeader;
+    private findReportLocation;
+    private getHeaderRecommendations;
+}
+//# sourceMappingURL=missing-security-headers.d.ts.map

package/dist/rules/missing-security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-security-headers.d.ts","sourceRoot":"","sources":["../../src/rules/missing-security-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEhE,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,QAAQ,CAAC,WAAW,2CAA2C;IAC/D,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;IAEtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAS9B;IAEF,OAAO,CAAC,QAAQ,CAAC,cAAc,CA4B7B;IAEF,KAAK,CAAC,WAAW,EAAE,WAAW,GAAG,aAAa,EAAE;IAoBhD,OAAO,CAAC,oBAAoB;IA8B5B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,mBAAmB;IA2B3B,OAAO,CAAC,iBAAiB;IA0BzB,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,wBAAwB;CAqBjC"}

package/dist/rules/missing-security-headers.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MissingSecurityHeadersRule = void 0;
+const types_1 = require("../types");
+class MissingSecurityHeadersRule extends types_1.BaseRule {
+    constructor() {
+        super(...arguments);
+        this.name = 'missing-security-headers';
+        this.description = 'Detects missing HTTP security headers';
+        this.severity = 'medium';
+        this.securityHeaders = [
+            'Content-Security-Policy',
+            'X-Frame-Options',
+            'X-Content-Type-Options',
+            'X-XSS-Protection',
+            'Strict-Transport-Security',
+            'Referrer-Policy',
+            'Permissions-Policy',
+            'X-Permitted-Cross-Domain-Policies'
+        ];
+        this.serverPatterns = [
+            // Express.js patterns
+            { pattern: /app\.(?:get|post|put|delete|patch|use)\s*\(/gi, type: 'Express route handler' },
+            { pattern: /router\.(?:get|post|put|delete|patch|use)\s*\(/gi, type: 'Express router' },
+            { pattern: /app\.listen\s*\(/gi, type: 'Express server' },
+            // Next.js API routes
+            { pattern: /export\s+(?:default\s+)?(?:async\s+)?function\s+handler/gi, type: 'Next.js API handler' },
+            { pattern: /export\s+(?:const|let|var)\s+\w+\s*=\s*(?:async\s+)?\([^)]*req[^)]*res[^)]*\)/gi, type: 'Next.js API function' },
+            // Node.js HTTP server
+            { pattern: /createServer\s*\(\s*(?:async\s+)?\([^)]*req[^)]*res[^)]*\)/gi, type: 'Node.js HTTP server' },
+            { pattern: /http\.createServer/gi, type: 'HTTP server creation' },
+            // Framework response patterns
+            { pattern: /res\.(?:send|json|render|redirect)/gi, type: 'Response method' },
+            { pattern: /response\.(?:send|json|render|redirect)/gi, type: 'Response method' },
+            // Flask patterns
+            { pattern: /@app\.route/gi, type: 'Flask route' },
+            { pattern: /return\s+(?:render_template|jsonify|redirect)/gi, type: 'Flask response' },
+            // Django patterns
+            { pattern: /def\s+\w+\s*\([^)]*request[^)]*\)/gi, type: 'Django view function' },
+            { pattern: /HttpResponse\s*\(/gi, type: 'Django HTTP response' },
+            // PHP patterns
+            { pattern: /header\s*\(\s*['"`][^'"`]*['"`]/gi, type: 'PHP header function' }
+        ];
+    }
+    check(fileContent) {
+        const issues = [];
+        // Only check server/web application files
+        if (!this.isWebApplicationFile(fileContent.path)) {
+            return issues;
+        }
+        // Check if file contains server/route patterns
+        const hasServerCode = this.hasServerCode(fileContent.content);
+        if (!hasServerCode) {
+            return issues;
+        }
+        // Check for missing security headers
+        this.checkMissingHeaders(fileContent, issues);
+        return issues;
+    }
+    isWebApplicationFile(filePath) {
+        const webFiles = [
+            /\.js$/i,
+            /\.ts$/i,
+            /\.jsx$/i,
+            /\.tsx$/i,
+            /\.py$/i,
+            /\.php$/i,
+            /\.rb$/i,
+            /\.go$/i,
+            /\.java$/i,
+            /\.cs$/i
+        ];
+        // Skip test files
+        const testPatterns = [
+            /test/i,
+            /spec/i,
+            /\.test\./i,
+            /\.spec\./i,
+            /__tests__/i
+        ];
+        if (testPatterns.some(pattern => pattern.test(filePath))) {
+            return false;
+        }
+        return webFiles.some(pattern => pattern.test(filePath));
+    }
+    hasServerCode(content) {
+        return this.serverPatterns.some(({ pattern }) => pattern.test(content));
+    }
+    checkMissingHeaders(fileContent, issues) {
+        const content = fileContent.content;
+        const missingHeaders = [];
+        for (const header of this.securityHeaders) {
+            if (!this.hasSecurityHeader(content, header)) {
+                missingHeaders.push(header);
+            }
+        }
+        if (missingHeaders.length > 0) {
+            // Find a good location to report the issue (first route handler or server setup)
+            const location = this.findReportLocation(fileContent);
+            if (location) {
+                issues.push(this.createIssue(fileContent.path, location.line, location.column, location.lineContent, `Missing security headers: ${missingHeaders.join(', ')}`, `Add security headers to protect against common attacks. Consider using helmet.js for Express or implementing headers manually: ${this.getHeaderRecommendations(missingHeaders)}`));
+            }
+        }
+    }
+    hasSecurityHeader(content, header) {
+        const headerPatterns = [
+            // Express.js patterns
+            new RegExp(`res\\.(?:set|header)\\s*\\(\\s*['"\`]${header}['"\`]`, 'gi'),
+            new RegExp(`res\\.setHeader\\s*\\(\\s*['"\`]${header}['"\`]`, 'gi'),
+            // Helmet.js patterns
+            /helmet\s*\(\s*\)/gi,
+            /helmet\./gi,
+            // Manual header setting
+            new RegExp(`['"\`]${header}['"\`]\\s*:\\s*['"\`]`, 'gi'),
+            // PHP patterns
+            new RegExp(`header\\s*\\(\\s*['"\`]${header}:`, 'gi'),
+            // Python Flask patterns
+            new RegExp(`response\\.headers\\[['"\`]${header}['"\`]\\]`, 'gi'),
+            // Django patterns
+            new RegExp(`response\\[['"\`]${header}['"\`]\\]`, 'gi')
+        ];
+        return headerPatterns.some(pattern => pattern.test(content));
+    }
+    findReportLocation(fileContent) {
+        for (const { pattern } of this.serverPatterns) {
+            const matches = this.findMatches(fileContent.content, pattern);
+            if (matches.length > 0) {
+                const firstMatch = matches[0];
+                if (firstMatch) {
+                    return {
+                        line: firstMatch.line,
+                        column: firstMatch.column,
+                        lineContent: firstMatch.lineContent
+                    };
+                }
+            }
+        }
+        return null;
+    }
+    getHeaderRecommendations(missingHeaders) {
+        const recommendations = [];
+        if (missingHeaders.includes('Content-Security-Policy')) {
+            recommendations.push("CSP: \"default-src 'self'\"");
+        }
+        if (missingHeaders.includes('X-Frame-Options')) {
+            recommendations.push("X-Frame-Options: 'DENY'");
+        }
+        if (missingHeaders.includes('X-Content-Type-Options')) {
+            recommendations.push("X-Content-Type-Options: 'nosniff'");
+        }
+        if (missingHeaders.includes('Strict-Transport-Security')) {
+            recommendations.push("HSTS: 'max-age=31536000; includeSubDomains'");
+        }
+        return recommendations.slice(0, 2).join(', ') + (recommendations.length > 2 ? '...' : '');
+    }
+}
+exports.MissingSecurityHeadersRule = MissingSecurityHeadersRule;
+//# sourceMappingURL=missing-security-headers.js.map

package/dist/rules/missing-security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-security-headers.js","sourceRoot":"","sources":["../../src/rules/missing-security-headers.ts"],"names":[],"mappings":";;;AAAA,oCAAgE;AAEhE,MAAa,0BAA2B,SAAQ,gBAAQ;IAAxD;;QACW,SAAI,GAAG,0BAA0B,CAAC;QAClC,gBAAW,GAAG,uCAAuC,CAAC;QACtD,aAAQ,GAAG,QAAiB,CAAC;QAErB,oBAAe,GAAG;YACjC,yBAAyB;YACzB,iBAAiB;YACjB,wBAAwB;YACxB,kBAAkB;YAClB,2BAA2B;YAC3B,iBAAiB;YACjB,oBAAoB;YACpB,mCAAmC;SACpC,CAAC;QAEe,mBAAc,GAAG;YAChC,sBAAsB;YACtB,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,uBAAuB,EAAE;YAC3F,EAAE,OAAO,EAAE,kDAAkD,EAAE,IAAI,EAAE,gBAAgB,EAAE;YACvF,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,gBAAgB,EAAE;YAEzD,qBAAqB;YACrB,EAAE,OAAO,EAAE,2DAA2D,EAAE,IAAI,EAAE,qBAAqB,EAAE;YACrG,EAAE,OAAO,EAAE,iFAAiF,EAAE,IAAI,EAAE,sBAAsB,EAAE;YAE5H,sBAAsB;YACtB,EAAE,OAAO,EAAE,8DAA8D,EAAE,IAAI,EAAE,qBAAqB,EAAE;YACxG,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,sBAAsB,EAAE;YAEjE,8BAA8B;YAC9B,EAAE,OAAO,EAAE,sCAAsC,EAAE,IAAI,EAAE,iBAAiB,EAAE;YAC5E,EAAE,OAAO,EAAE,2CAA2C,EAAE,IAAI,EAAE,iBAAiB,EAAE;YAEjF,iBAAiB;YACjB,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE;YACjD,EAAE,OAAO,EAAE,iDAAiD,EAAE,IAAI,EAAE,gBAAgB,EAAE;YAEtF,kBAAkB;YAClB,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,sBAAsB,EAAE;YAChF,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,sBAAsB,EAAE;YAEhE,eAAe;YACf,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,qBAAqB,EAAE;SAC9E,CAAC;IAmJJ,CAAC;IAjJC,KAAK,CAAC,WAAwB;QAC5B,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,0CAA0C;QAC1C,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,+CAA+C;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE9C,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,MAAM,QAAQ,GAAG;YACf,QAAQ;YACR,QAAQ;YACR,SAAS;YACT,SAAS;YACT,QAAQ;YACR,SAAS;YACT,QAAQ;YACR,QAAQ;YACR,UAAU;YACV,QAAQ;SACT,CAAC;QAEF,kBAAkB;QAClB,MAAM,YAAY,GAAG;YACnB,OAAO;YACP,OAAO;YACP,WAAW;YACX,WAAW;YACX,YAAY;SACb,CAAC;QAEF,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1D,CAAC;IAEO,aAAa,CAAC,OAAe;QACnC,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,mBAAmB,CAAC,WAAwB,EAAE,MAAuB;QAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;QACpC,MAAM,cAAc,GAAa,EAAE,CAAC;QAEpC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC7C,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,iFAAiF;YACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAEtD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,WAAW,CAAC,IAAI,EAChB,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,WAAW,EACpB,6BAA6B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxD,kIAAkI,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAClL,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,OAAe,EAAE,MAAc;QACvD,MAAM,cAAc,GAAG;YACrB,sBAAsB;YACtB,IAAI,MAAM,CAAC,wCAAwC,MAAM,QAAQ,EAAE,IAAI,CAAC;YACxE,IAAI,MAAM,CAAC,mCAAmC,MAAM,QAAQ,EAAE,IAAI,CAAC;YAEnE,qBAAqB;YACrB,oBAAoB;YACpB,YAAY;YAEZ,wBAAwB;YACxB,IAAI,MAAM,CAAC,SAAS,MAAM,uBAAuB,EAAE,IAAI,CAAC;YAExD,eAAe;YACf,IAAI,MAAM,CAAC,0BAA0B,MAAM,GAAG,EAAE,IAAI,CAAC;YAErD,wBAAwB;YACxB,IAAI,MAAM,CAAC,8BAA8B,MAAM,WAAW,EAAE,IAAI,CAAC;YAEjE,kBAAkB;YAClB,IAAI,MAAM,CAAC,oBAAoB,MAAM,WAAW,EAAE,IAAI,CAAC;SACxD,CAAC;QAEF,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IAEO,kBAAkB,CAAC,WAAwB;QACjD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO;wBACL,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,WAAW,EAAE,UAAU,CAAC,WAAW;qBACpC,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,wBAAwB,CAAC,cAAwB;QACvD,MAAM,eAAe,GAAa,EAAE,CAAC;QAErC,IAAI,cAAc,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;YACvD,eAAe,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC/C,eAAe,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,cAAc,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACtD,eAAe,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,cAAc,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;CACF;AA/LD,gEA+LC"}

package/dist/rules/open-cors.d.ts

@@ -0,0 +1,11 @@
+import { BaseRule, FileContent, SecurityIssue } from '../types';
+export declare class OpenCorsRule extends BaseRule {
+    readonly name = "open-cors";
+    readonly description = "Detects overly permissive CORS configurations";
+    readonly severity: "high";
+    private readonly corsPatterns;
+    private readonly safePatterns;
+    check(fileContent: FileContent): SecurityIssue[];
+    private isDevelopmentContext;
+}
+//# sourceMappingURL=open-cors.d.ts.map

package/dist/rules/open-cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-cors.d.ts","sourceRoot":"","sources":["../../src/rules/open-cors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEhE,qBAAa,YAAa,SAAQ,QAAQ;IACxC,QAAQ,CAAC,IAAI,eAAe;IAC5B,QAAQ,CAAC,WAAW,mDAAmD;IACvE,QAAQ,CAAC,QAAQ,EAAG,MAAM,CAAU;IAEpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAoB3B;IAEF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAO3B;IAEF,KAAK,CAAC,WAAW,EAAE,WAAW,GAAG,aAAa,EAAE;IA0BhD,OAAO,CAAC,oBAAoB;CAW7B"}