vibe-guard 1.0.0

package/dist/rules/open-cors.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenCorsRule = void 0;
+const types_1 = require("../types");
+class OpenCorsRule extends types_1.BaseRule {
+    constructor() {
+        super(...arguments);
+        this.name = 'open-cors';
+        this.description = 'Detects overly permissive CORS configurations';
+        this.severity = 'high';
+        this.corsPatterns = [
+            // Wildcard CORS origins
+            { pattern: /Access-Control-Allow-Origin\s*:\s*['"`]\*['"`]/gi, message: 'Wildcard CORS origin allows any domain' },
+            { pattern: /cors\(\s*\{\s*origin\s*:\s*['"`]\*['"`]/gi, message: 'CORS middleware configured with wildcard origin' },
+            { pattern: /\.header\s*\(\s*['"`]Access-Control-Allow-Origin['"`]\s*,\s*['"`]\*['"`]/gi, message: 'Manual CORS header set to wildcard' },
+            // Express CORS middleware with wildcard
+            { pattern: /app\.use\s*\(\s*cors\s*\(\s*\{\s*origin\s*:\s*true/gi, message: 'CORS origin set to true (allows all origins)' },
+            { pattern: /app\.use\s*\(\s*cors\s*\(\s*\)\s*\)/gi, message: 'CORS middleware used without origin restrictions' },
+            // Permissive credentials
+            { pattern: /Access-Control-Allow-Credentials\s*:\s*['"`]true['"`]/gi, message: 'CORS credentials enabled - ensure origin is restricted' },
+            // Overly broad methods
+            { pattern: /Access-Control-Allow-Methods\s*:\s*['"`]\*['"`]/gi, message: 'CORS allows all HTTP methods' },
+            { pattern: /Access-Control-Allow-Headers\s*:\s*['"`]\*['"`]/gi, message: 'CORS allows all headers' },
+            // Framework-specific patterns
+            { pattern: /@CrossOrigin\s*\(\s*origins\s*=\s*['"`]\*['"`]/gi, message: 'Spring @CrossOrigin annotation with wildcard origin' },
+            { pattern: /enable_cors\s*\(\s*origins\s*=\s*\[\s*['"`]\*['"`]/gi, message: 'FastAPI CORS with wildcard origin' }
+        ];
+        this.safePatterns = [
+            /localhost/i,
+            /127\.0\.0\.1/,
+            /\.local/i,
+            /development/i,
+            /staging/i,
+            /test/i
+        ];
+    }
+    check(fileContent) {
+        const issues = [];
+        for (const { pattern, message } of this.corsPatterns) {
+            const matches = this.findMatches(fileContent.content, pattern);
+            for (const { line, column, lineContent } of matches) {
+                // Skip if it's in a development/test context
+                if (this.isDevelopmentContext(fileContent.content, line)) {
+                    continue;
+                }
+                issues.push(this.createIssue(fileContent.path, line, column, lineContent, `Permissive CORS configuration: ${message}`, `Restrict CORS origins to specific domains. Use specific origins like 'https://yourdomain.com' instead of '*'. Consider using environment variables for different environments.`));
+            }
+        }
+        return issues;
+    }
+    isDevelopmentContext(content, lineNumber) {
+        const lines = content.split('\n');
+        const contextRange = 5;
+        const startLine = Math.max(0, lineNumber - contextRange - 1);
+        const endLine = Math.min(lines.length, lineNumber + contextRange);
+        const contextLines = lines.slice(startLine, endLine).join('\n');
+        return this.safePatterns.some(pattern => pattern.test(contextLines));
+    }
+}
+exports.OpenCorsRule = OpenCorsRule;
+//# sourceMappingURL=open-cors.js.map

package/dist/rules/open-cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-cors.js","sourceRoot":"","sources":["../../src/rules/open-cors.ts"],"names":[],"mappings":";;;AAAA,oCAAgE;AAEhE,MAAa,YAAa,SAAQ,gBAAQ;IAA1C;;QACW,SAAI,GAAG,WAAW,CAAC;QACnB,gBAAW,GAAG,+CAA+C,CAAC;QAC9D,aAAQ,GAAG,MAAe,CAAC;QAEnB,iBAAY,GAAG;YAC9B,wBAAwB;YACxB,EAAE,OAAO,EAAE,kDAAkD,EAAE,OAAO,EAAE,wCAAwC,EAAE;YAClH,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,iDAAiD,EAAE;YACpH,EAAE,OAAO,EAAE,4EAA4E,EAAE,OAAO,EAAE,oCAAoC,EAAE;YAExI,wCAAwC;YACxC,EAAE,OAAO,EAAE,sDAAsD,EAAE,OAAO,EAAE,8CAA8C,EAAE;YAC5H,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,kDAAkD,EAAE;YAEjH,yBAAyB;YACzB,EAAE,OAAO,EAAE,yDAAyD,EAAE,OAAO,EAAE,wDAAwD,EAAE;YAEzI,uBAAuB;YACvB,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,8BAA8B,EAAE;YACzG,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,yBAAyB,EAAE;YAEpG,8BAA8B;YAC9B,EAAE,OAAO,EAAE,kDAAkD,EAAE,OAAO,EAAE,qDAAqD,EAAE;YAC/H,EAAE,OAAO,EAAE,sDAAsD,EAAE,OAAO,EAAE,mCAAmC,EAAE;SAClH,CAAC;QAEe,iBAAY,GAAG;YAC9B,YAAY;YACZ,cAAc;YACd,UAAU;YACV,cAAc;YACd,UAAU;YACV,OAAO;SACR,CAAC;IAuCJ,CAAC;IArCC,KAAK,CAAC,WAAwB;QAC5B,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/D,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;gBACpD,6CAA6C;gBAC7C,IAAI,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;oBACzD,SAAS;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,WAAW,CAAC,IAAI,EAChB,IAAI,EACJ,MAAM,EACN,WAAW,EACX,kCAAkC,OAAO,EAAE,EAC3C,gLAAgL,CACjL,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,oBAAoB,CAAC,OAAe,EAAE,UAAkB;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,YAAY,GAAG,CAAC,CAAC;QAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACvE,CAAC;CACF;AAzED,oCAyEC"}

package/dist/rules/sql-injection.d.ts

@@ -0,0 +1,12 @@
+import { BaseRule, FileContent, SecurityIssue } from '../types';
+export declare class SqlInjectionRule extends BaseRule {
+    readonly name = "sql-injection";
+    readonly description = "Detects potential SQL injection vulnerabilities";
+    readonly severity: "high";
+    private readonly sqlInjectionPatterns;
+    private readonly safePatterns;
+    check(fileContent: FileContent): SecurityIssue[];
+    private hasSafeParameterization;
+    private isCommentOrTest;
+}
+//# sourceMappingURL=sql-injection.d.ts.map

package/dist/rules/sql-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection.d.ts","sourceRoot":"","sources":["../../src/rules/sql-injection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEhE,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,WAAW,qDAAqD;IACzE,QAAQ,CAAC,QAAQ,EAAG,MAAM,CAAU;IAEpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CA+BnC;IAEF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAS3B;IAEF,KAAK,CAAC,WAAW,EAAE,WAAW,GAAG,aAAa,EAAE;IA+BhD,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,eAAe;CA0BxB"}

package/dist/rules/sql-injection.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SqlInjectionRule = void 0;
+const types_1 = require("../types");
+class SqlInjectionRule extends types_1.BaseRule {
+    constructor() {
+        super(...arguments);
+        this.name = 'sql-injection';
+        this.description = 'Detects potential SQL injection vulnerabilities';
+        this.severity = 'high';
+        this.sqlInjectionPatterns = [
+            // String concatenation in SQL
+            { pattern: /(?:query|sql|execute)\s*\(\s*['"`][^'"`]*['"`]\s*\+\s*[^'"`\s)]+/gi, type: 'String concatenation in SQL query' },
+            { pattern: /['"`]SELECT\s+[^'"`]*['"`]\s*\+\s*[^'"`\s)]+/gi, type: 'SELECT query with concatenation' },
+            { pattern: /['"`]INSERT\s+[^'"`]*['"`]\s*\+\s*[^'"`\s)]+/gi, type: 'INSERT query with concatenation' },
+            { pattern: /['"`]UPDATE\s+[^'"`]*['"`]\s*\+\s*[^'"`\s)]+/gi, type: 'UPDATE query with concatenation' },
+            { pattern: /['"`]DELETE\s+[^'"`]*['"`]\s*\+\s*[^'"`\s)]+/gi, type: 'DELETE query with concatenation' },
+            // Template literals with variables
+            { pattern: /`SELECT\s+[^`]*\$\{[^}]+\}[^`]*`/gi, type: 'Template literal SQL with variables' },
+            { pattern: /`INSERT\s+[^`]*\$\{[^}]+\}[^`]*`/gi, type: 'Template literal INSERT with variables' },
+            { pattern: /`UPDATE\s+[^`]*\$\{[^}]+\}[^`]*`/gi, type: 'Template literal UPDATE with variables' },
+            { pattern: /`DELETE\s+[^`]*\$\{[^}]+\}[^`]*`/gi, type: 'Template literal DELETE with variables' },
+            // String formatting in SQL
+            { pattern: /(?:query|sql)\s*=\s*['"`][^'"`]*%s[^'"`]*['"`]\s*%\s*\(/gi, type: 'Python string formatting in SQL' },
+            { pattern: /(?:query|sql)\s*=\s*f['"`][^'"`]*\{[^}]+\}[^'"`]*['"`]/gi, type: 'Python f-string in SQL' },
+            { pattern: /String\.format\s*\(\s*['"`][^'"`]*\{[^}]*\}[^'"`]*['"`]/gi, type: 'Java String.format in SQL' },
+            // Direct variable insertion
+            { pattern: /WHERE\s+[^'"`\s]+\s*=\s*['"`]?\s*\+\s*[^'"`\s)]+/gi, type: 'WHERE clause with concatenation' },
+            { pattern: /WHERE\s+[^'"`\s]+\s*=\s*\$\{[^}]+\}/gi, type: 'WHERE clause with template variable' },
+            // Framework-specific patterns
+            { pattern: /\.query\s*\(\s*['"`][^'"`]*['"`]\s*\+/gi, type: 'Database query with concatenation' },
+            { pattern: /\.exec\s*\(\s*['"`][^'"`]*['"`]\s*\+/gi, type: 'Database exec with concatenation' },
+            { pattern: /\.raw\s*\(\s*['"`][^'"`]*['"`]\s*\+/gi, type: 'Raw SQL query with concatenation' },
+            // ORM unsafe patterns
+            { pattern: /\.where\s*\(\s*['"`][^'"`]*['"`]\s*\+/gi, type: 'ORM where clause with concatenation' },
+            { pattern: /\.whereRaw\s*\(\s*['"`][^'"`]*['"`]\s*\+/gi, type: 'ORM raw where with concatenation' }
+        ];
+        this.safePatterns = [
+            // Parameterized queries
+            /\?\s*,/g, // Question mark parameters
+            /\$\d+/g, // Numbered parameters
+            /:\w+/g, // Named parameters
+            /prepare/i,
+            /bind/i,
+            /params/i,
+            /placeholder/i
+        ];
+    }
+    check(fileContent) {
+        const issues = [];
+        for (const { pattern, type } of this.sqlInjectionPatterns) {
+            const matches = this.findMatches(fileContent.content, pattern);
+            for (const { line, column, lineContent } of matches) {
+                // Skip if the line contains safe parameterization patterns
+                if (this.hasSafeParameterization(lineContent)) {
+                    continue;
+                }
+                // Skip if it's in a comment or test file
+                if (this.isCommentOrTest(lineContent, fileContent.path)) {
+                    continue;
+                }
+                issues.push(this.createIssue(fileContent.path, line, column, lineContent, `Potential SQL injection vulnerability: ${type}`, `Use parameterized queries or prepared statements instead of string concatenation. Replace concatenation with placeholders (?, $1, :param) and pass values as parameters.`));
+            }
+        }
+        return issues;
+    }
+    hasSafeParameterization(line) {
+        return this.safePatterns.some(pattern => pattern.test(line));
+    }
+    isCommentOrTest(line, filePath) {
+        // Check if line is a comment
+        const commentPatterns = [
+            /^\s*\/\//, // JavaScript comment
+            /^\s*#/, // Python/Shell comment
+            /^\s*--/, // SQL comment
+            /^\s*\*/ // Multi-line comment
+        ];
+        if (commentPatterns.some(pattern => pattern.test(line))) {
+            return true;
+        }
+        // Check if it's a test file
+        const testPatterns = [
+            /test/i,
+            /spec/i,
+            /\.test\./i,
+            /\.spec\./i,
+            /__tests__/i,
+            /tests\//i,
+            /spec\//i
+        ];
+        return testPatterns.some(pattern => pattern.test(filePath));
+    }
+}
+exports.SqlInjectionRule = SqlInjectionRule;
+//# sourceMappingURL=sql-injection.js.map

package/dist/rules/sql-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection.js","sourceRoot":"","sources":["../../src/rules/sql-injection.ts"],"names":[],"mappings":";;;AAAA,oCAAgE;AAEhE,MAAa,gBAAiB,SAAQ,gBAAQ;IAA9C;;QACW,SAAI,GAAG,eAAe,CAAC;QACvB,gBAAW,GAAG,iDAAiD,CAAC;QAChE,aAAQ,GAAG,MAAe,CAAC;QAEnB,yBAAoB,GAAG;YACtC,8BAA8B;YAC9B,EAAE,OAAO,EAAE,oEAAoE,EAAE,IAAI,EAAE,mCAAmC,EAAE;YAC5H,EAAE,OAAO,EAAE,gDAAgD,EAAE,IAAI,EAAE,iCAAiC,EAAE;YACtG,EAAE,OAAO,EAAE,gDAAgD,EAAE,IAAI,EAAE,iCAAiC,EAAE;YACtG,EAAE,OAAO,EAAE,gDAAgD,EAAE,IAAI,EAAE,iCAAiC,EAAE;YACtG,EAAE,OAAO,EAAE,gDAAgD,EAAE,IAAI,EAAE,iCAAiC,EAAE;YAEtG,mCAAmC;YACnC,EAAE,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,qCAAqC,EAAE;YAC9F,EAAE,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,wCAAwC,EAAE;YACjG,EAAE,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,wCAAwC,EAAE;YACjG,EAAE,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,wCAAwC,EAAE;YAEjG,2BAA2B;YAC3B,EAAE,OAAO,EAAE,2DAA2D,EAAE,IAAI,EAAE,iCAAiC,EAAE;YACjH,EAAE,OAAO,EAAE,0DAA0D,EAAE,IAAI,EAAE,wBAAwB,EAAE;YACvG,EAAE,OAAO,EAAE,2DAA2D,EAAE,IAAI,EAAE,2BAA2B,EAAE;YAE3G,4BAA4B;YAC5B,EAAE,OAAO,EAAE,oDAAoD,EAAE,IAAI,EAAE,iCAAiC,EAAE;YAC1G,EAAE,OAAO,EAAE,uCAAuC,EAAE,IAAI,EAAE,qCAAqC,EAAE;YAEjG,8BAA8B;YAC9B,EAAE,OAAO,EAAE,yCAAyC,EAAE,IAAI,EAAE,mCAAmC,EAAE;YACjG,EAAE,OAAO,EAAE,wCAAwC,EAAE,IAAI,EAAE,kCAAkC,EAAE;YAC/F,EAAE,OAAO,EAAE,uCAAuC,EAAE,IAAI,EAAE,kCAAkC,EAAE;YAE9F,sBAAsB;YACtB,EAAE,OAAO,EAAE,yCAAyC,EAAE,IAAI,EAAE,qCAAqC,EAAE;YACnG,EAAE,OAAO,EAAE,4CAA4C,EAAE,IAAI,EAAE,kCAAkC,EAAE;SACpG,CAAC;QAEe,iBAAY,GAAG;YAC9B,wBAAwB;YACxB,SAAS,EAAG,2BAA2B;YACvC,QAAQ,EAAI,sBAAsB;YAClC,OAAO,EAAK,mBAAmB;YAC/B,UAAU;YACV,OAAO;YACP,SAAS;YACT,cAAc;SACf,CAAC;IA+DJ,CAAC;IA7DC,KAAK,CAAC,WAAwB;QAC5B,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/D,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;gBACpD,2DAA2D;gBAC3D,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBAED,yCAAyC;gBACzC,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,SAAS;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,WAAW,CAAC,IAAI,EAChB,IAAI,EACJ,MAAM,EACN,WAAW,EACX,0CAA0C,IAAI,EAAE,EAChD,0KAA0K,CAC3K,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,uBAAuB,CAAC,IAAY;QAC1C,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAEO,eAAe,CAAC,IAAY,EAAE,QAAgB;QACpD,6BAA6B;QAC7B,MAAM,eAAe,GAAG;YACtB,UAAU,EAAG,qBAAqB;YAClC,OAAO,EAAM,uBAAuB;YACpC,QAAQ,EAAK,cAAc;YAC3B,QAAQ,CAAK,qBAAqB;SACnC,CAAC;QAEF,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4BAA4B;QAC5B,MAAM,YAAY,GAAG;YACnB,OAAO;YACP,OAAO;YACP,WAAW;YACX,WAAW;YACX,YAAY;YACZ,UAAU;YACV,SAAS;SACV,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,CAAC;CACF;AA9GD,4CA8GC"}

package/dist/rules/unvalidated-input.d.ts

@@ -0,0 +1,13 @@
+import { BaseRule, FileContent, SecurityIssue } from '../types';
+export declare class UnvalidatedInputRule extends BaseRule {
+    readonly name = "unvalidated-input";
+    readonly description = "Detects potentially unvalidated user input";
+    readonly severity: "medium";
+    private readonly inputPatterns;
+    private readonly validationPatterns;
+    check(fileContent: FileContent): SecurityIssue[];
+    private hasValidationNearby;
+    private isCommentOrTest;
+    private isSimplePropertyAccess;
+}
+//# sourceMappingURL=unvalidated-input.d.ts.map

package/dist/rules/unvalidated-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unvalidated-input.d.ts","sourceRoot":"","sources":["../../src/rules/unvalidated-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEhE,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,WAAW,gDAAgD;IACpE,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;IAEtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CA+B5B;IAEF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAuBjC;IAEF,KAAK,CAAC,WAAW,EAAE,WAAW,GAAG,aAAa,EAAE;IAoChD,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,eAAe;IA0BvB,OAAO,CAAC,sBAAsB;CAe/B"}

package/dist/rules/unvalidated-input.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnvalidatedInputRule = void 0;
+const types_1 = require("../types");
+class UnvalidatedInputRule extends types_1.BaseRule {
+    constructor() {
+        super(...arguments);
+        this.name = 'unvalidated-input';
+        this.description = 'Detects potentially unvalidated user input';
+        this.severity = 'medium';
+        this.inputPatterns = [
+            // Express.js patterns
+            { pattern: /req\.(?:body|query|params)\.[a-zA-Z_][a-zA-Z0-9_]*(?!\s*\.\s*(?:validate|sanitize|escape|trim|length|match|test))/g, type: 'Express request parameter' },
+            { pattern: /req\.(?:body|query|params)(?!\s*\.\s*(?:validate|sanitize|escape))/g, type: 'Express request object' },
+            // Direct user input usage
+            { pattern: /(?:eval|exec|system|shell_exec)\s*\(\s*(?:req\.|request\.|input\.|params\.|query\.)/gi, type: 'Code execution with user input' },
+            { pattern: /(?:innerHTML|outerHTML)\s*=\s*(?:req\.|request\.|input\.|params\.|query\.)/gi, type: 'DOM manipulation with user input' },
+            // File operations with user input
+            { pattern: /(?:readFile|writeFile|unlink|rmdir|mkdir)\s*\(\s*(?:req\.|request\.|input\.|params\.|query\.)/gi, type: 'File operation with user input' },
+            { pattern: /(?:open|fopen|file_get_contents)\s*\(\s*(?:\$_GET|\$_POST|\$_REQUEST)/gi, type: 'PHP file operation with user input' },
+            // Database operations without validation
+            { pattern: /\.(?:query|exec|execute)\s*\(\s*(?:req\.|request\.|input\.|params\.|query\.)(?![^)]*(?:validate|sanitize|escape))/gi, type: 'Database query with unvalidated input' },
+            // Command injection patterns
+            { pattern: /(?:spawn|exec|execSync)\s*\(\s*(?:req\.|request\.|input\.|params\.|query\.)/gi, type: 'Command execution with user input' },
+            // Python patterns
+            { pattern: /(?:os\.system|subprocess\.call|eval|exec)\s*\(\s*(?:request\.|flask\.request\.)/gi, type: 'Python system call with user input' },
+            // PHP patterns
+            { pattern: /(?:system|exec|shell_exec|passthru)\s*\(\s*(?:\$_GET|\$_POST|\$_REQUEST)/gi, type: 'PHP system call with user input' },
+            { pattern: /(?:include|require|include_once|require_once)\s*\(\s*(?:\$_GET|\$_POST|\$_REQUEST)/gi, type: 'PHP file inclusion with user input' },
+            // Java patterns
+            { pattern: /Runtime\.getRuntime\(\)\.exec\s*\(\s*(?:request\.getParameter|request\.getAttribute)/gi, type: 'Java runtime execution with user input' },
+            // Generic patterns
+            { pattern: /\$\{(?:req\.|request\.|input\.|params\.|query\.)[^}]+\}/g, type: 'Template literal with user input' }
+        ];
+        this.validationPatterns = [
+            /validate/i,
+            /sanitize/i,
+            /escape/i,
+            /filter/i,
+            /clean/i,
+            /trim/i,
+            /strip/i,
+            /whitelist/i,
+            /blacklist/i,
+            /check/i,
+            /verify/i,
+            /isValid/i,
+            /typeof/i,
+            /instanceof/i,
+            /\.length\s*[><=]/,
+            /\.match\s*\(/,
+            /\.test\s*\(/,
+            /parseInt/i,
+            /parseFloat/i,
+            /Number\(/,
+            /String\(/,
+            /Boolean\(/
+        ];
+    }
+    check(fileContent) {
+        const issues = [];
+        for (const { pattern, type } of this.inputPatterns) {
+            const matches = this.findMatches(fileContent.content, pattern);
+            for (const { line, column, lineContent } of matches) {
+                // Skip if validation is present in the same line or nearby lines
+                if (this.hasValidationNearby(fileContent.content, line)) {
+                    continue;
+                }
+                // Skip if it's in a comment or test file
+                if (this.isCommentOrTest(lineContent, fileContent.path)) {
+                    continue;
+                }
+                // Skip if it's just a simple property access for logging or display
+                if (this.isSimplePropertyAccess(lineContent)) {
+                    continue;
+                }
+                issues.push(this.createIssue(fileContent.path, line, column, lineContent, `Potentially unvalidated user input: ${type}`, `Validate and sanitize user input before use. Consider using validation libraries like Joi, express-validator, or built-in validation methods.`));
+            }
+        }
+        return issues;
+    }
+    hasValidationNearby(content, lineNumber) {
+        const lines = content.split('\n');
+        const contextRange = 3; // Check 3 lines before and after
+        const startLine = Math.max(0, lineNumber - contextRange - 1);
+        const endLine = Math.min(lines.length, lineNumber + contextRange);
+        const contextLines = lines.slice(startLine, endLine).join('\n');
+        return this.validationPatterns.some(pattern => pattern.test(contextLines));
+    }
+    isCommentOrTest(line, filePath) {
+        // Check if line is a comment
+        const commentPatterns = [
+            /^\s*\/\//, // JavaScript comment
+            /^\s*#/, // Python/Shell comment
+            /^\s*\*/ // Multi-line comment
+        ];
+        if (commentPatterns.some(pattern => pattern.test(line))) {
+            return true;
+        }
+        // Check if it's a test file
+        const testPatterns = [
+            /test/i,
+            /spec/i,
+            /\.test\./i,
+            /\.spec\./i,
+            /__tests__/i,
+            /tests\//i,
+            /spec\//i
+        ];
+        return testPatterns.some(pattern => pattern.test(filePath));
+    }
+    isSimplePropertyAccess(line) {
+        // Check if it's just logging, console output, or simple assignment
+        const safePatterns = [
+            /console\./i,
+            /log\(/i,
+            /print\(/i,
+            /echo\s/i,
+            /return\s/i,
+            /res\.json\s*\(/i,
+            /res\.send\s*\(/i,
+            /JSON\.stringify/i
+        ];
+        return safePatterns.some(pattern => pattern.test(line));
+    }
+}
+exports.UnvalidatedInputRule = UnvalidatedInputRule;
+//# sourceMappingURL=unvalidated-input.js.map

package/dist/rules/unvalidated-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unvalidated-input.js","sourceRoot":"","sources":["../../src/rules/unvalidated-input.ts"],"names":[],"mappings":";;;AAAA,oCAAgE;AAEhE,MAAa,oBAAqB,SAAQ,gBAAQ;IAAlD;;QACW,SAAI,GAAG,mBAAmB,CAAC;QAC3B,gBAAW,GAAG,4CAA4C,CAAC;QAC3D,aAAQ,GAAG,QAAiB,CAAC;QAErB,kBAAa,GAAG;YAC/B,sBAAsB;YACtB,EAAE,OAAO,EAAE,oHAAoH,EAAE,IAAI,EAAE,2BAA2B,EAAE;YACpK,EAAE,OAAO,EAAE,qEAAqE,EAAE,IAAI,EAAE,wBAAwB,EAAE;YAElH,0BAA0B;YAC1B,EAAE,OAAO,EAAE,uFAAuF,EAAE,IAAI,EAAE,gCAAgC,EAAE;YAC5I,EAAE,OAAO,EAAE,8EAA8E,EAAE,IAAI,EAAE,kCAAkC,EAAE;YAErI,kCAAkC;YAClC,EAAE,OAAO,EAAE,iGAAiG,EAAE,IAAI,EAAE,gCAAgC,EAAE;YACtJ,EAAE,OAAO,EAAE,yEAAyE,EAAE,IAAI,EAAE,oCAAoC,EAAE;YAElI,yCAAyC;YACzC,EAAE,OAAO,EAAE,qHAAqH,EAAE,IAAI,EAAE,uCAAuC,EAAE;YAEjL,6BAA6B;YAC7B,EAAE,OAAO,EAAE,+EAA+E,EAAE,IAAI,EAAE,mCAAmC,EAAE;YAEvI,kBAAkB;YAClB,EAAE,OAAO,EAAE,mFAAmF,EAAE,IAAI,EAAE,oCAAoC,EAAE;YAE5I,eAAe;YACf,EAAE,OAAO,EAAE,4EAA4E,EAAE,IAAI,EAAE,iCAAiC,EAAE;YAClI,EAAE,OAAO,EAAE,sFAAsF,EAAE,IAAI,EAAE,oCAAoC,EAAE;YAE/I,gBAAgB;YAChB,EAAE,OAAO,EAAE,wFAAwF,EAAE,IAAI,EAAE,wCAAwC,EAAE;YAErJ,mBAAmB;YACnB,EAAE,OAAO,EAAE,0DAA0D,EAAE,IAAI,EAAE,kCAAkC,EAAE;SAClH,CAAC;QAEe,uBAAkB,GAAG;YACpC,WAAW;YACX,WAAW;YACX,SAAS;YACT,SAAS;YACT,QAAQ;YACR,OAAO;YACP,QAAQ;YACR,YAAY;YACZ,YAAY;YACZ,QAAQ;YACR,SAAS;YACT,UAAU;YACV,SAAS;YACT,aAAa;YACb,kBAAkB;YAClB,cAAc;YACd,aAAa;YACb,WAAW;YACX,aAAa;YACb,UAAU;YACV,UAAU;YACV,WAAW;SACZ,CAAC;IA2FJ,CAAC;IAzFC,KAAK,CAAC,WAAwB;QAC5B,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/D,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;gBACpD,iEAAiE;gBACjE,IAAI,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;oBACxD,SAAS;gBACX,CAAC;gBAED,yCAAyC;gBACzC,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,SAAS;gBACX,CAAC;gBAED,oEAAoE;gBACpE,IAAI,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7C,SAAS;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC1B,WAAW,CAAC,IAAI,EAChB,IAAI,EACJ,MAAM,EACN,WAAW,EACX,uCAAuC,IAAI,EAAE,EAC7C,+IAA+I,CAChJ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,mBAAmB,CAAC,OAAe,EAAE,UAAkB;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,iCAAiC;QAEzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEO,eAAe,CAAC,IAAY,EAAE,QAAgB;QACpD,6BAA6B;QAC7B,MAAM,eAAe,GAAG;YACtB,UAAU,EAAG,qBAAqB;YAClC,OAAO,EAAM,uBAAuB;YACpC,QAAQ,CAAK,qBAAqB;SACnC,CAAC;QAEF,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4BAA4B;QAC5B,MAAM,YAAY,GAAG;YACnB,OAAO;YACP,OAAO;YACP,WAAW;YACX,WAAW;YACX,YAAY;YACZ,UAAU;YACV,SAAS;SACV,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEO,sBAAsB,CAAC,IAAY;QACzC,mEAAmE;QACnE,MAAM,YAAY,GAAG;YACnB,YAAY;YACZ,QAAQ;YACR,UAAU;YACV,SAAS;YACT,WAAW;YACX,iBAAiB;YACjB,iBAAiB;YACjB,kBAAkB;SACnB,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;CACF;AAxJD,oDAwJC"}

package/dist/scanner.d.ts

@@ -0,0 +1,15 @@
+import { ScanResult, BaseRule } from './types';
+export declare class FileScanner {
+    private readonly supportedExtensions;
+    private readonly excludePatterns;
+    private readonly maxFileSize;
+    private readonly binaryExtensions;
+    scanDirectory(targetPath: string, rules: BaseRule[]): Promise<ScanResult>;
+    scanFile(filePath: string, rules: BaseRule[]): Promise<ScanResult>;
+    private findFiles;
+    private isSupportedFile;
+    private readFile;
+    private isBinaryFile;
+    private createScanResult;
+}
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE3E,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAOlC;IAEF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAc9B;IAGF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAG/C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAW/B;IAEI,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAgCzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;YAuB1D,SAAS;IAqBvB,OAAO,CAAC,eAAe;YAWT,QAAQ;YAkCR,YAAY;IAuC1B,OAAO,CAAC,gBAAgB;CAmBzB"}

package/dist/scanner.js

@@ -0,0 +1,240 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileScanner = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const glob_1 = require("glob");
+class FileScanner {
+    constructor() {
+        this.supportedExtensions = [
+            '.js', '.jsx', '.ts', '.tsx', '.vue', '.svelte',
+            '.py', '.php', '.rb', '.go', '.java', '.cs',
+            '.cpp', '.c', '.h', '.hpp', '.rs', '.kt',
+            '.swift', '.dart', '.scala', '.clj', '.hs',
+            '.json', '.yaml', '.yml', '.xml', '.env',
+            '.config', '.conf', '.ini', '.toml'
+        ];
+        this.excludePatterns = [
+            '**/node_modules/**',
+            '**/dist/**',
+            '**/build/**',
+            '**/.git/**',
+            '**/coverage/**',
+            '**/*.min.js',
+            '**/*.bundle.js',
+            '**/vendor/**',
+            '**/__pycache__/**',
+            '**/*.pyc',
+            '**/target/**',
+            '**/bin/**',
+            '**/obj/**'
+        ];
+        // File size limit: 5MB (prevents performance issues)
+        this.maxFileSize = 5 * 1024 * 1024;
+        // Binary file extensions to skip
+        this.binaryExtensions = [
+            '.exe', '.dll', '.so', '.dylib', '.bin', '.dat',
+            '.img', '.iso', '.dmg', '.pkg', '.deb', '.rpm',
+            '.zip', '.tar', '.gz', '.bz2', '.7z', '.rar',
+            '.jpg', '.jpeg', '.png', '.gif', '.bmp', '.ico',
+            '.mp3', '.mp4', '.avi', '.mov', '.wmv', '.flv',
+            '.pdf', '.doc', '.docx', '.xls', '.xlsx', '.ppt',
+            '.sqlite', '.db', '.mdb', '.accdb',
+            '.ttf', '.otf', '.woff', '.woff2', '.eot',
+            '.class', '.jar', '.war', '.ear',
+            '.o', '.obj', '.lib', '.a'
+        ];
+    }
+    async scanDirectory(targetPath, rules) {
+        const files = await this.findFiles(targetPath);
+        const issues = [];
+        let filesScanned = 0;
+        let filesSkipped = 0;
+        for (const filePath of files) {
+            try {
+                const fileContent = await this.readFile(filePath);
+                if (fileContent) {
+                    filesScanned++;
+                    for (const rule of rules) {
+                        const ruleIssues = rule.check(fileContent);
+                        issues.push(...ruleIssues);
+                    }
+                }
+                else {
+                    filesSkipped++;
+                }
+            }
+            catch (error) {
+                console.warn(`Warning: Could not scan file ${filePath}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+                filesSkipped++;
+            }
+        }
+        if (filesSkipped > 0) {
+            console.log(`📋 Skipped ${filesSkipped} files (binary, too large, or unreadable)`);
+        }
+        return this.createScanResult(issues, filesScanned);
+    }
+    async scanFile(filePath, rules) {
+        const issues = [];
+        let filesScanned = 0;
+        try {
+            const fileContent = await this.readFile(filePath);
+            if (fileContent) {
+                filesScanned = 1;
+                for (const rule of rules) {
+                    const ruleIssues = rule.check(fileContent);
+                    issues.push(...ruleIssues);
+                }
+            }
+            else {
+                console.log(`📋 Skipped file: ${filePath} (binary, too large, or unreadable)`);
+            }
+        }
+        catch (error) {
+            throw new Error(`Could not scan file ${filePath}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+        return this.createScanResult(issues, filesScanned);
+    }
+    async findFiles(targetPath) {
+        const stats = await fs.promises.stat(targetPath);
+        if (stats.isFile()) {
+            return [targetPath];
+        }
+        if (!stats.isDirectory()) {
+            throw new Error(`Target path is neither a file nor a directory: ${targetPath}`);
+        }
+        const pattern = path.join(targetPath, '**/*');
+        const allFiles = glob_1.glob.sync(pattern, {
+            ignore: this.excludePatterns,
+            nodir: true,
+            absolute: true
+        });
+        return allFiles.filter((file) => this.isSupportedFile(file));
+    }
+    isSupportedFile(filePath) {
+        const ext = path.extname(filePath).toLowerCase();
+        // Skip binary files
+        if (this.binaryExtensions.includes(ext)) {
+            return false;
+        }
+        return this.supportedExtensions.includes(ext);
+    }
+    async readFile(filePath) {
+        try {
+            // Check file size first
+            const stats = await fs.promises.stat(filePath);
+            if (stats.size > this.maxFileSize) {
+                console.warn(`Skipping large file: ${filePath} (${Math.round(stats.size / 1024 / 1024)}MB > 5MB limit)`);
+                return null;
+            }
+            // Check if file is binary by reading first few bytes
+            if (await this.isBinaryFile(filePath)) {
+                return null;
+            }
+            const content = await fs.promises.readFile(filePath, 'utf-8');
+            const lines = content.split('\n');
+            return {
+                path: filePath,
+                content,
+                lines
+            };
+        }
+        catch (error) {
+            if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+                return null;
+            }
+            // Handle encoding errors (binary files read as text)
+            if (error instanceof Error && error.message.includes('invalid')) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    async isBinaryFile(filePath) {
+        try {
+            // Read first 512 bytes to check for binary content
+            const fd = await fs.promises.open(filePath, 'r');
+            const buffer = Buffer.alloc(512);
+            const { bytesRead } = await fd.read(buffer, 0, 512, 0);
+            await fd.close();
+            if (bytesRead === 0) {
+                return false; // Empty file, treat as text
+            }
+            // Check for null bytes (common in binary files)
+            for (let i = 0; i < bytesRead; i++) {
+                if (buffer[i] === 0) {
+                    return true;
+                }
+            }
+            // Check for high percentage of non-printable characters
+            let nonPrintable = 0;
+            for (let i = 0; i < bytesRead; i++) {
+                const byte = buffer[i];
+                if (byte !== undefined) {
+                    // Allow common text characters: printable ASCII, newlines, tabs
+                    if (byte < 32 && byte !== 9 && byte !== 10 && byte !== 13) {
+                        nonPrintable++;
+                    }
+                }
+            }
+            // If more than 30% non-printable, consider it binary
+            return (nonPrintable / bytesRead) > 0.3;
+        }
+        catch {
+            // If we can't read the file, assume it's not binary
+            return false;
+        }
+    }
+    createScanResult(issues, filesScanned) {
+        const summary = {
+            critical: 0,
+            high: 0,
+            medium: 0,
+            low: 0
+        };
+        issues.forEach(issue => {
+            summary[issue.severity]++;
+        });
+        return {
+            issues,
+            filesScanned,
+            issuesFound: issues.length,
+            summary
+        };
+    }
+}
+exports.FileScanner = FileScanner;
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAC7B,+BAA4B;AAG5B,MAAa,WAAW;IAAxB;QACmB,wBAAmB,GAAG;YACrC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;YAC/C,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;YAC3C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;YACxC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK;YAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;YACxC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;SACpC,CAAC;QAEe,oBAAe,GAAG;YACjC,oBAAoB;YACpB,YAAY;YACZ,aAAa;YACb,YAAY;YACZ,gBAAgB;YAChB,aAAa;YACb,gBAAgB;YAChB,cAAc;YACd,mBAAmB;YACnB,UAAU;YACV,cAAc;YACd,WAAW;YACX,WAAW;SACZ,CAAC;QAEF,qDAAqD;QACpC,gBAAW,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;QAE/C,iCAAiC;QAChB,qBAAgB,GAAG;YAClC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;YAC/C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;YAC9C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;YAC5C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;YAC/C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;YAC9C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;YAChD,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ;YAClC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;YACzC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;YAChC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI;SAC3B,CAAC;IAqLJ,CAAC;IAnLC,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,KAAiB;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAClD,IAAI,WAAW,EAAE,CAAC;oBAChB,YAAY,EAAE,CAAC;oBAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;wBAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,YAAY,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,gCAAgC,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;gBACtH,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,cAAc,YAAY,2CAA2C,CAAC,CAAC;QACrF,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,KAAiB;QAChD,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,YAAY,GAAG,CAAC,CAAC;gBAEjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;oBAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,oBAAoB,QAAQ,qCAAqC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QAClH,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,UAAkB;QACxC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,OAAO,CAAC,UAAU,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,UAAU,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,WAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAClC,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAEO,eAAe,CAAC,QAAgB;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAEjD,oBAAoB;QACpB,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,QAAgB;QACrC,IAAI,CAAC;YACH,wBAAwB;YACxB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,wBAAwB,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACzG,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qDAAqD;YACrD,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAElC,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,OAAO;gBACP,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACzE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,qDAAqD;YACrD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAAgB;QACzC,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YAEjB,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,CAAC,4BAA4B;YAC5C,CAAC;YAED,gDAAgD;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpB,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,gEAAgE;oBAChE,IAAI,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;wBAC1D,YAAY,EAAE,CAAC;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,GAAG,GAAG,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,MAAuB,EAAE,YAAoB;QACpE,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,GAAG,EAAE,CAAC;SACP,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACrB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,MAAM;YACN,YAAY;YACZ,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,OAAO;SACR,CAAC;IACJ,CAAC;CACF;AA9ND,kCA8NC"}