xploitscan-shared-rules 1.12.0 → 1.13.1

package/dist/index.js

@@ -1,13 +1,48 @@
 // src/snippet.ts
-function getSnippet(content, line, contextLines = 2) {
+var cacheContent = null;
+var cacheLines = [];
+var cacheOffsets = [];
+function lineIndex(content) {
+  if (content === cacheContent) return { lines: cacheLines, offsets: cacheOffsets };
   const lines = content.split("\n");
+  const offsets = new Array(lines.length);
+  let off = 0;
+  for (let i = 0; i < lines.length; i++) {
+    offsets[i] = off;
+    off += lines[i].length + 1;
+  }
+  cacheContent = content;
+  cacheLines = lines;
+  cacheOffsets = offsets;
+  return { lines, offsets };
+}
+function lineNumberAt(content, index) {
+  const { offsets } = lineIndex(content);
+  let lo = 0;
+  let hi = offsets.length - 1;
+  let ans = 0;
+  while (lo <= hi) {
+    const mid = lo + hi >> 1;
+    if (offsets[mid] <= index) {
+      ans = mid;
+      lo = mid + 1;
+    } else {
+      hi = mid - 1;
+    }
+  }
+  return ans + 1;
+}
+function getSnippet(content, line, contextLines = 2) {
+  const { lines } = lineIndex(content);
   const start = Math.max(0, line - 1 - contextLines);
   const end = Math.min(lines.length, line + contextLines);
-  return lines.slice(start, end).map((l, i) => {
-    const lineNum = start + i + 1;
+  const out = [];
+  for (let i = start; i < end; i++) {
+    const lineNum = i + 1;
     const marker = lineNum === line ? ">" : " ";
-    return `${marker} ${lineNum.toString().padStart(4)} | ${l}`;
-  }).join("\n");
+    out.push(`${marker} ${lineNum.toString().padStart(4)} | ${lines[i]}`);
+  }
+  return out.join("\n");
 }
 
 // src/rule-impacts.ts
@@ -815,7 +850,7 @@ var SERVER_SIDE_PATH_RE = new RegExp(
   ].join("|"),
   "i"
 );
-var SERVER_SIDE_CONTENT_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies)\b|\b(?:app|router)\.(?:get|post|put|patch|delete|use|all)\s*\(|\bctx\.request\b|\bevent\.(?:body|queryStringParameters|pathParameters)\b|\(\s*req\s*,\s*res\b/;
+var SERVER_SIDE_CONTENT_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies)\b|\b(?:app|router)\.(?:get|post|put|patch|delete|use|all)\s*\(|\bctx\.request\b|\bevent\.(?:body|queryStringParameters|pathParameters)\b|\(\s*req\s*,\s*res\b|(?:import|require)\b[^;\n]{0,200}['"]express['"]|\bNextFunction\b/;
 function isServerSideFile(filePath, content) {
   if (isTestFile(filePath)) return false;
   if (SERVER_SIDE_PATH_RE.test(filePath)) return true;
@@ -862,13 +897,23 @@ function filterSilenced(matches, content, ruleId) {
 }
 function findMatches(content, pattern, rule, filePath, fixTemplate) {
   const matches = [];
-  const lines = content.split("\n");
   let m;
   const re = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+  let scanned = 0;
+  let lineNum = 1;
+  let lastMatchIndex = -1;
+  const MAX_MATCHES = 500;
   while ((m = re.exec(content)) !== null) {
+    if (m.index === lastMatchIndex && m[0].length === 0) {
+      re.lastIndex++;
+      continue;
+    }
+    lastMatchIndex = m.index;
     if (isCommentLine(content, m.index)) continue;
     if (isInsideFixMessage(content, m.index)) continue;
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    for (; scanned < m.index; scanned++) {
+      if (content.charCodeAt(scanned) === 10) lineNum++;
+    }
     matches.push({
       rule: rule.id,
       title: rule.title,
@@ -879,6 +924,7 @@ function findMatches(content, pattern, rule, filePath, fixTemplate) {
       snippet: getSnippet(content, lineNum),
       fix: fixTemplate?.(m)
     });
+    if (matches.length >= MAX_MATCHES) break;
   }
   return matches;
 }
@@ -894,10 +940,26 @@ function astMatch(content, filePath, line, rule, fix) {
     fix
   };
 }
+var parseCacheContent = null;
+var parseCachePath = null;
+var parseCacheResult = null;
+var parseCacheValid = false;
 function tryParse(content, filePath) {
-  const parsed = parseFile(content, filePath);
-  if (!parsed) return null;
-  return { parsed, taint: buildTaintMap(parsed) };
+  if (parseCacheValid && content === parseCacheContent && filePath === parseCachePath) {
+    return parseCacheResult;
+  }
+  let result = null;
+  try {
+    const parsed = parseFile(content, filePath);
+    result = parsed ? { parsed, taint: buildTaintMap(parsed) } : null;
+  } catch {
+    result = null;
+  }
+  parseCacheResult = result;
+  parseCacheContent = content;
+  parseCachePath = filePath;
+  parseCacheValid = true;
+  return result;
 }
 var hardcodedSecrets = {
   id: "VC001",
@@ -1262,9 +1324,10 @@ var xssVulnerability = {
   category: "Injection",
   description: "Rendering user input without sanitization allows attackers to inject malicious scripts.",
   check(content, filePath) {
+    const hasSanitizerBypass = /bypassSecurityTrust(?:Html|Script|Style|Url|ResourceUrl)\s*\(/.test(content);
     if (/(?:sanitize|purify|escape|xss)/i.test(filePath)) return [];
-    if (/DOMPurify\.sanitize|sanitizeHtml|xss\(|escapeHtml/i.test(content)) return [];
-    if (/(?:import|require)\s*\(?.*(?:DOMPurify|dompurify|sanitize|sanitizer)/i.test(content)) return [];
+    if (!hasSanitizerBypass && /DOMPurify\.sanitize|sanitizeHtml|xss\(|escapeHtml/i.test(content)) return [];
+    if (!hasSanitizerBypass && /(?:import|require)\s*\(?[^\n]{0,200}(?:DOMPurify|dompurify|sanitize|sanitizer)/i.test(content)) return [];
     const patterns = [
       // React dangerouslySetInnerHTML
       /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:/g,
@@ -1275,7 +1338,12 @@ var xssVulnerability = {
       // v-html in Vue
       /v-html\s*=/g,
       // {@html} in Svelte
-      /\{@html\s/g
+      /\{@html\s/g,
+      // Angular DomSanitizer escape hatches — bypassSecurityTrustHtml /
+      // bypassSecurityTrustScript / ...Url / ...ResourceUrl / ...Style. These
+      // mark a value as trusted and skip Angular's built-in sanitization;
+      // passing user input through one is the canonical Angular DOM-XSS sink.
+      /bypassSecurityTrust(?:Html|Script|Style|Url|ResourceUrl)\s*\(/g
     ];
     const allLines = content.split("\n");
     const matches = [];
@@ -1288,9 +1356,9 @@ var xssVulnerability = {
         () => "Sanitize user input before rendering as HTML. Use a library like DOMPurify: DOMPurify.sanitize(userInput). If this site is intentional (JSON-LD structured data, a const boot script, a sandboxed preview), add an inline `// VC007-OK: <reason>` comment above the line to silence."
       );
       for (const m of raw) {
-        const lineText = allLines[m.line - 1] || "";
+        const lineText = (allLines[m.line - 1] || "").slice(0, 4e3);
         if (/\.innerHTML\s*=\s*['"]/.test(lineText) && !/\$\{/.test(lineText)) continue;
-        if (/\.innerHTML\s*=\s*['"][^'"]*['"]\s*$/.test(lineText)) continue;
+        if (/\.innerHTML\s*=\s*['"][^'"]{0,2000}['"]\s*$/.test(lineText)) continue;
         if (/dangerouslySetInnerHTML/.test(lineText)) {
           const windowText = allLines.slice(m.line - 1, m.line + 2).join("\n");
           if (/JSON\.stringify/i.test(windowText)) continue;
@@ -1541,7 +1609,7 @@ var evalUsage = {
       /new\s+Function\s*\(\s*(?!["'`])/g
     ];
     const hasEvalInString = /["'`]eval(?:-source-map|["'`])/i.test(content);
-    if (hasEvalInString && !/\beval\s*\([^)]*(?:req\.|body\.|input|params|user|data)/i.test(content)) return [];
+    if (hasEvalInString && !/\beval\s*\([^)]{0,500}(?:req\.|body\.|input|params|user|data)/i.test(content)) return [];
     const matches = [];
     for (const p of patterns) {
       const rawMatches = findMatches(
@@ -1582,7 +1650,7 @@ var unvalidatedRedirect = {
       const isPureLiteral = /^["'`][^"'`]*["'`]$/.test(value);
       if (!hasInterpolation && isPureLiteral) continue;
       if (isInlineSilenced(content, m.index, "VC016")) continue;
-      const line = content.substring(0, m.index).split("\n").length;
+      const line = lineNumberAt(content, m.index);
       matches.push({
         rule: "VC016",
         title: unvalidatedRedirect.title,
@@ -1805,11 +1873,11 @@ var prototypePollution = {
     ];
     const hasValidation = /schema|validate|sanitize|whitelist|allowedKeys|pick\(|Object\.freeze|zod|yup|joi|ajv/i.test(content);
     if (!hasValidation) {
-      const hasUnsafeMerge = /Object\.assign\s*\([^)]*JSON\.parse|\.\.\.JSON\.parse|\{.*\.\.\.(?:stored|saved|cached|parsed|data)/i.test(content);
+      const hasUnsafeMerge = /Object\.assign\s*\([^)]{0,500}JSON\.parse|\.\.\.JSON\.parse|\{[^\n]{0,300}\.\.\.(?:stored|saved|cached|parsed|data)/i.test(content);
       if (hasUnsafeMerge) {
         matches.push(...findMatches(
           content,
-          /Object\.assign\s*\([^)]*JSON\.parse|\.\.\.JSON\.parse/g,
+          /Object\.assign\s*\([^)]{0,500}JSON\.parse|\.\.\.JSON\.parse/g,
           prototypePollution,
           filePath,
           () => "Validate parsed data against an expected schema before merging into objects. Use Object.freeze(), a validation library (Zod, Yup), or manually check for __proto__ and constructor keys."
@@ -3355,7 +3423,7 @@ var dangerousInnerHTML = {
       if (/^[A-Z][A-Z0-9_]+$/.test(value)) continue;
       if (/^["'`][^$]*["'`]$/.test(value)) continue;
       if (/JSON\.stringify/i.test(value)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC063",
         title: dangerousInnerHTML.title,
@@ -4018,17 +4086,37 @@ var ssti = {
       (call, line) => {
         const first = call.arguments[0];
         if (!first || first.type === "SpreadElement") return;
-        if (!taint.isTainted(first)) return;
-        if (matches.some((m) => m.line === line)) return;
-        matches.push(
-          astMatch(
-            content,
-            filePath,
-            line,
-            ssti,
-            "Compile templates from a trusted, static source (a file path or a constant string). Pass user data only as context values."
-          )
-        );
+        if (taint.isTainted(first)) {
+          if (matches.some((m) => m.line === line)) return;
+          matches.push(
+            astMatch(
+              content,
+              filePath,
+              line,
+              ssti,
+              "Compile templates from a trusted, static source (a file path or a constant string). Pass user data only as context values."
+            )
+          );
+          return;
+        }
+        const opts = call.arguments[1];
+        if (opts && opts.type === "ObjectExpression") {
+          const hasTaintedSpread = opts.properties.some(
+            (p) => p.type === "SpreadElement" && taint.isTainted(p.argument)
+          );
+          if (hasTaintedSpread) {
+            if (matches.some((m) => m.line === line)) return;
+            matches.push(
+              astMatch(
+                content,
+                filePath,
+                line,
+                ssti,
+                "Don't spread req.body/req.query into template locals \u2014 an attacker can inject reserved view options (e.g. `layout`) to load arbitrary templates. Pass only the specific values the view needs: render('view', { name: req.body.name })."
+              )
+            );
+          }
+        }
       }
     );
     return filterSilenced(matches, content, "VC082");
@@ -4077,7 +4165,7 @@ var missingSRI = {
     const re = new RegExp(scriptPattern.source, scriptPattern.flags);
     while ((m = re.exec(content)) !== null) {
       if (!m[0].includes("integrity")) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC084",
           title: missingSRI.title,
@@ -4291,16 +4379,61 @@ var unprotectedDownload = {
     if (!/(?:download|sendFile|send_file)/i.test(content)) return [];
     if (!isServerSideFile(filePath, content)) return [];
     const matches = [];
-    if (/(?:sendFile|download|send_file)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/i.test(content)) {
-      const hasValidation = /path\.resolve|path\.normalize|path\.join.*__dirname|realpath|includes\s*\(\s*["']\.\./i.test(content);
-      if (!hasValidation) {
-        matches.push(...findMatches(
-          content,
-          /(?:sendFile|download|send_file)\s*\(/gi,
-          unprotectedDownload,
-          filePath,
-          () => "Validate file paths: const safePath = path.resolve(DOWNLOAD_DIR, filename); if (!safePath.startsWith(DOWNLOAD_DIR)) throw new Error('Invalid path');"
-        ));
+    const hasContainmentCheck = /\.startsWith\s*\(/.test(content) || /realpath/i.test(content) || /includes\s*\(\s*["']\.\./.test(content);
+    if (/(?:sendFile|download|send_file)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/i.test(content) && !hasContainmentCheck) {
+      matches.push(...findMatches(
+        content,
+        /(?:sendFile|download|send_file)\s*\(/gi,
+        unprotectedDownload,
+        filePath,
+        () => "Validate file paths: const safePath = path.resolve(DOWNLOAD_DIR, filename); if (!safePath.startsWith(DOWNLOAD_DIR + path.sep)) throw new Error('Invalid path');"
+      ));
+    }
+    if (!hasContainmentCheck && /\b(?:sendFile|download)\s*\(/.test(content)) {
+      const ctx = tryParse(content, filePath);
+      if (ctx) {
+        const { parsed, taint } = ctx;
+        const readsUserInput = /\b(?:req|request)\s*\.\s*(?:params|query|body|headers|cookies)\b/.test(content) || /\bparams\s*\.\s*\w/.test(content) || /\bquery\s*\.\s*\w/.test(content) || /\breq\.body\b/.test(content);
+        const isUnsafePathBuild = (node) => {
+          if (node.type !== "CallExpression") return false;
+          const callee = node.callee;
+          const isPathBuild = callee.type === "MemberExpression" && callee.object.type === "Identifier" && callee.object.name === "path" && callee.property.type === "Identifier" && (callee.property.name === "resolve" || callee.property.name === "join");
+          if (!isPathBuild) return false;
+          const rootedAtDirname = node.arguments.some(
+            (a) => a.type === "Identifier" && (a.name === "__dirname" || a.name === "__filename")
+          );
+          if (rootedAtDirname) return false;
+          return node.arguments.some(
+            (a) => a.type !== "SpreadElement" && a.type !== "StringLiteral" && a.type !== "TemplateLiteral"
+          );
+        };
+        const argIsTainted = (node) => {
+          if (taint.isTainted(node)) return true;
+          if (readsUserInput && isUnsafePathBuild(node)) return true;
+          if (node.type === "CallExpression") {
+            return node.arguments.some((a) => a.type !== "SpreadElement" && argIsTainted(a));
+          }
+          return false;
+        };
+        visitCalls(
+          parsed,
+          (callee) => callee.type === "MemberExpression" && callee.property.type === "Identifier" && (callee.property.name === "sendFile" || callee.property.name === "download"),
+          (call, line) => {
+            const first = call.arguments[0];
+            if (!first || first.type === "SpreadElement") return;
+            if (!argIsTainted(first)) return;
+            if (matches.some((m) => m.line === line)) return;
+            matches.push(
+              astMatch(
+                content,
+                filePath,
+                line,
+                unprotectedDownload,
+                "Validate file paths: const safePath = path.resolve(DOWNLOAD_DIR, filename); if (!safePath.startsWith(DOWNLOAD_DIR + path.sep)) throw new Error('Invalid path');"
+              )
+            );
+          }
+        );
       }
     }
     return matches;
@@ -4903,7 +5036,7 @@ var s3BucketNoEncryption = {
       const blockEnd = Math.min(m.index + 2e3, content.length);
       const blockContent = content.substring(m.index, blockEnd);
       if (!/server_side_encryption/.test(blockContent)) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC107",
           title: s3BucketNoEncryption.title,
@@ -4934,7 +5067,7 @@ var securityGroupAllInbound = {
       while ((m = ingressPattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (/from_port\s*=\s*0/.test(m[0]) || !/from_port/.test(m[0])) {
-          const lineNum = content.substring(0, m.index).split("\n").length;
+          const lineNum = lineNumberAt(content, m.index);
           matches.push({
             rule: "VC108",
             title: securityGroupAllInbound.title,
@@ -5021,7 +5154,7 @@ var lambdaWithoutVPC = {
       const blockEnd = Math.min(m.index + 2e3, content.length);
       const blockContent = content.substring(m.index, blockEnd);
       if (!/vpc_config\s*\{/.test(blockContent)) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC111",
           title: lambdaWithoutVPC.title,
@@ -5051,7 +5184,7 @@ var dockerLatestTag = {
     while ((m = fromPattern.exec(content)) !== null) {
       const image = m[1];
       if (image.endsWith(":latest") || !image.includes(":") && !image.startsWith("$")) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC112",
           title: dockerLatestTag.title,
@@ -5179,17 +5312,26 @@ var pathTraversal = {
     const findings = [];
     const patterns = [
       /(?:readFile|readFileSync|createReadStream|writeFile|writeFileSync|appendFile|unlink|unlinkSync|access|stat|statSync|existsSync)\s*\(\s*(?:req\.|request\.|ctx\.|params\.|query\.)/gi,
-      /(?:path\.join|path\.resolve)\s*\([^)]*(?:req\.|request\.|ctx\.|params\.|query\.)[^)]*\)/gi,
-      /(?:res\.sendFile|res\.download)\s*\([^)]*(?:req\.|request\.)/gi,
+      /(?:path\.join|path\.resolve)\s*\([^)]{0,500}(?:req\.|request\.|ctx\.|params\.|query\.)[^)]{0,500}\)/gi,
+      /(?:res\.sendFile|res\.download)\s*\([^)]{0,500}(?:req\.|request\.)/gi,
       /open\s*\(\s*(?:request\.|params\[|args\.)/gi
     ];
+    const MAX_MATCHES = 500;
     for (const pat of patterns) {
+      if (findings.length >= MAX_MATCHES) break;
       let m;
+      let lastIdx = -1;
       while ((m = pat.exec(content)) !== null) {
+        if (findings.length >= MAX_MATCHES) break;
+        if (m.index === lastIdx && m[0].length === 0) {
+          pat.lastIndex++;
+          continue;
+        }
+        lastIdx = m.index;
         if (isCommentLine(content, m.index)) continue;
         const surrounding = content.substring(Math.max(0, m.index - 200), m.index + 200);
-        if (/path\.normalize|sanitize|\.replace\(\s*['"]\.\./i.test(surrounding)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        if (/path\.normalize|sanitize|\.replace\(\s*['"]\.\.|\.startsWith\s*\(|realpath/i.test(surrounding)) continue;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC117",
           title: pathTraversal.title,
@@ -5220,7 +5362,7 @@ var piiInLogs = {
     while ((m = logPattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
       if (isInsideFixMessage(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC118",
         title: piiInLogs.title,
@@ -5258,7 +5400,7 @@ var hardcodedOAuthSecret = {
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (/process\.env|os\.environ|ENV\[|getenv|\$\{|<your|CHANGE_ME|xxx|placeholder/i.test(m[0])) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC119",
           title: hardcodedOAuthSecret.title,
@@ -5290,7 +5432,7 @@ var missingOAuthState = {
       if (isCommentLine(content, m.index)) continue;
       const surrounding = content.substring(m.index, Math.min(content.length, m.index + 500));
       if (/state\s*[=:]/i.test(surrounding)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC120",
         title: missingOAuthState.title,
@@ -5318,7 +5460,7 @@ var unpinnedGitHubAction = {
     let m;
     while ((m = usesPattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC121",
         title: unpinnedGitHubAction.title,
@@ -5352,7 +5494,7 @@ var deprecatedTLS = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC122",
           title: deprecatedTLS.title,
@@ -5388,7 +5530,7 @@ var weakRSAKeySize = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC123",
           title: weakRSAKeySize.title,
@@ -5424,7 +5566,7 @@ var ecbModeEncryption = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC124",
           title: ecbModeEncryption.title,
@@ -5455,7 +5597,7 @@ var insecurePasswordReset = {
     let m;
     while ((m = weakTokens.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC125",
         title: insecurePasswordReset.title,
@@ -5472,7 +5614,7 @@ var insecurePasswordReset = {
       if (isCommentLine(content, m.index)) continue;
       const surrounding = content.substring(Math.max(0, m.index - 500), m.index);
       if (!/(?:reset|forgot).*password/i.test(surrounding)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC125",
         title: insecurePasswordReset.title,
@@ -5533,7 +5675,7 @@ var insecureHTTPMethods = {
         if (isCommentLine(content, m.index)) continue;
         const handlerBlock = content.substring(m.index, Math.min(content.length, m.index + 500));
         if (/auth|authenticate|authorize|requireAuth|isAuthenticated|protect|guard|middleware|session|jwt|verify|clerk|getAuth/i.test(handlerBlock)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC127",
           title: insecureHTTPMethods.title,
@@ -5567,7 +5709,7 @@ var httpRequestSmuggling = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC128",
           title: httpRequestSmuggling.title,
@@ -5601,7 +5743,7 @@ var unencryptedPII = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC129",
           title: unencryptedPII.title,
@@ -5633,7 +5775,7 @@ var missingAuthRateLimit = {
       if (isCommentLine(content, m.index)) continue;
       const surrounding = content.substring(Math.max(0, m.index - 300), Math.min(content.length, m.index + 300));
       if (/rateLimit|rateLimiter|throttle|slowDown|express-rate-limit|rate_limit|RateLimiter|limiter/i.test(surrounding)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC130",
         title: missingAuthRateLimit.title,
@@ -5671,7 +5813,7 @@ var vulnerableDependencies = {
     for (const [pat, message] of vulnerablePackages) {
       let m;
       while ((m = pat.exec(content)) !== null) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC131",
           title: vulnerableDependencies.title,
@@ -5703,7 +5845,7 @@ function secretRuleCheck(content, filePath, pattern, ruleId, title, severity, fi
     const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
     const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
     if (PLACEHOLDER_RE.test(lineText)) continue;
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     findings.push({
       rule: ruleId,
       title,
@@ -5804,7 +5946,7 @@ var hardcodedGCPServiceAccount = {
     const findings = [];
     const m = content.match(/"type"\s*:\s*"service_account"/);
     if (m && m.index !== void 0) {
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC136",
         title: this.title,
@@ -5910,7 +6052,7 @@ var hardcodedDatadogKey = {
       const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
       const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
       if (PLACEHOLDER_RE.test(lineText)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC141",
         title: this.title,
@@ -5944,7 +6086,7 @@ var hardcodedVercelToken = {
       const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
       const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
       if (PLACEHOLDER_RE.test(lineText)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC142",
         title: this.title,
@@ -5978,7 +6120,7 @@ var hardcodedSupabaseServiceRole = {
       const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
       const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
       if (PLACEHOLDER_RE.test(lineText)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC143",
         title: this.title,
@@ -6042,7 +6184,7 @@ function contextSecretRuleCheck(content, filePath, pattern, ruleId, title, sever
     const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
     const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
     if (PLACEHOLDER_RE.test(lineText)) continue;
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     findings.push({
       rule: ruleId,
       title,
@@ -6522,7 +6664,7 @@ var ghaPullRequestTargetCheckout = {
     const checkoutPattern = /uses\s*:\s*actions\/checkout@[^\n]*[\s\S]{0,400}?ref\s*:\s*\$\{\{\s*github\.event\.pull_request\.head\.(?:ref|sha)\s*\}\}/g;
     let m;
     while ((m = checkoutPattern.exec(content)) !== null) {
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC184",
         title: ghaPullRequestTargetCheckout.title,
@@ -6606,7 +6748,7 @@ var ghaThirdPartyActionWithSecrets = {
     const pattern = /uses\s*:\s*(?!actions\/|github\/|aws-actions\/|azure\/|google-github-actions\/|hashicorp\/)([\w\-]+\/[\w\-./]+)@[^\n]*\n[\s\S]{0,800}?with\s*:[\s\S]{0,800}?\$\{\{\s*secrets\./g;
     let m;
     while ((m = pattern.exec(content)) !== null) {
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC187",
         title: ghaThirdPartyActionWithSecrets.title,
@@ -6771,7 +6913,7 @@ var pyRequestsVerifyFalse = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC191",
         title: pyRequestsVerifyFalse.title,
@@ -6802,7 +6944,7 @@ var pyJinja2AutoescapeOff = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC192",
         title: pyJinja2AutoescapeOff.title,
@@ -6831,7 +6973,7 @@ var pyTempfileMktemp = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC193",
         title: pyTempfileMktemp.title,
@@ -6873,7 +7015,7 @@ var pyDjangoMarkSafe = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -6910,7 +7052,7 @@ var pyParamikoAutoAdd = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -6943,7 +7085,7 @@ var pyDjangoAllowedHostsWildcard = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC196",
         title: pyDjangoAllowedHostsWildcard.title,
@@ -6981,7 +7123,7 @@ var pyJWTDecodeWeakConfig = {
         if (isCommentLine(content, m.index)) continue;
         const args = m[1];
         if (/\balgorithms\s*=/.test(args)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7032,7 +7174,7 @@ var llmPromptInjection = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7071,7 +7213,7 @@ var llmSystemPromptInjection = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC199",
           title: llmSystemPromptInjection.title,
@@ -7113,7 +7255,7 @@ var llmOutputAsHTML = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7150,7 +7292,7 @@ var vectorStoreQueryNoUserFilter = {
       if (/\b(?:user[_-]?id|userId|tenant[_-]?id|tenantId|org[_-]?id|orgId|owner[_-]?id|ownerId|account[_-]?id|customer[_-]?id|workspace[_-]?id)\b/i.test(args)) continue;
       if (/\bnamespace\s*[:=]\s*[`"']?[^,)`"']*(?:user|tenant|org|owner|account|customer|workspace)/i.test(args)) continue;
       if (/\bfilter\s*[:=][\s\S]*?(?:\buser|\btenant|\borg|\bowner|\baccount|\bcustomer|\bworkspace)/i.test(args)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC201",
         title: vectorStoreQueryNoUserFilter.title,
@@ -7187,7 +7329,7 @@ var vectorStoreUpsertNoMetadata = {
       if (/\bnamespace\s*[:=]\s*[`"']?[^,)`"']*(?:user|tenant|org)/i.test(args)) {
         continue;
       }
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC202",
         title: vectorStoreUpsertNoMetadata.title,
@@ -7241,7 +7383,7 @@ var llmCallNoMaxTokens = {
       if (depth !== 0) continue;
       const args = content.substring(openIdx + 1, i).replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "").replace(/#[^\n]*/g, "");
       if (TOKEN_KW_RE.test(args)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC203",
         title: llmCallNoMaxTokens.title,
@@ -7281,7 +7423,7 @@ var graphqlNoDepthLimit = {
     let m;
     while ((m = anchorRe.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC204",
         title: graphqlNoDepthLimit.title,
@@ -7315,7 +7457,7 @@ var graphqlNoComplexityLimit = {
     let m;
     while ((m = anchorRe.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC205",
         title: graphqlNoComplexityLimit.title,
@@ -7345,7 +7487,7 @@ var graphqlCSRFDisabled = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC206",
         title: graphqlCSRFDisabled.title,
@@ -7441,7 +7583,7 @@ var webhookMissingIdempotency = {
     if (/idempoten|event\.id|evt\.id|delivery_?id|alreadyProcessed|processedEvents|ON\s+CONFLICT|INSERT\s+OR\s+IGNORE|\bseen\b|\bprocessed\b/i.test(content)) return [];
     const m = content.match(/constructEvent|new\s+Webhook\s*\(|verifyHeader/i);
     if (!m || m.index === void 0) return [];
-    const line = content.substring(0, m.index).split("\n").length;
+    const line = lineNumberAt(content, m.index);
     return filterSilenced([{
       rule: "VC209",
       title: webhookMissingIdempotency.title,
@@ -7468,7 +7610,7 @@ var middlewareMatcherExcludesApi = {
     if (!/\(\?!\s*[^)]*\bapi\b/.test(content)) return [];
     const m = content.match(/matcher\s*:/);
     if (!m || m.index === void 0) return [];
-    const line = content.substring(0, m.index).split("\n").length;
+    const line = lineNumberAt(content, m.index);
     return filterSilenced([{
       rule: "VC210",
       title: middlewareMatcherExcludesApi.title,
@@ -7506,7 +7648,7 @@ var secretInURLParam = {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
         if (isInlineSilenced(content, m.index, "VC146")) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC146",
           title: this.title,
@@ -7537,7 +7679,7 @@ var secretLoggedToConsole = {
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
       if (isInsideFixMessage(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC147",
         title: this.title,
@@ -7567,7 +7709,7 @@ var secretInErrorResponse = {
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
       if (isInsideFixMessage(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC148",
         title: this.title,
@@ -7606,7 +7748,7 @@ var secretInBundleConfig = {
       while ((m = re.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC149",
           title: this.title,
@@ -7644,7 +7786,7 @@ var secretInHTMLAttribute = {
       while ((m = re.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC150",
           title: this.title,
@@ -7671,9 +7813,9 @@ var secretInCLIArgument = {
     if (!filePath.match(/\.(js|ts|jsx|tsx|py|rb)$/)) return [];
     const findings = [];
     const patterns = [
-      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]*\$\{[^}]*(?:api[_-]?key|secret|token|password|credentials)/gi,
-      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]*["']\s*\+\s*(?:api[_-]?key|secret|token|password|credentials)/gi,
-      /(?:subprocess|os\.system|os\.popen)\s*\([^)]*\{[^}]*(?:api[_-]?key|secret|token|password|credentials)/gi
+      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]{0,500}\$\{[^}]{0,200}(?:api[_-]?key|secret|token|password|credentials)/gi,
+      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]{0,500}["']\s*\+\s*(?:api[_-]?key|secret|token|password|credentials)/gi,
+      /(?:subprocess|os\.system|os\.popen)\s*\([^)]{0,500}\{[^}]{0,200}(?:api[_-]?key|secret|token|password|credentials)/gi
     ];
     for (const p of patterns) {
       let m;
@@ -7681,7 +7823,7 @@ var secretInCLIArgument = {
       while ((m = re.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC151",
           title: this.title,
@@ -7727,7 +7869,7 @@ var webhookSignatureVerification = {
       if (svc.verify.test(content)) continue;
       const m = content.match(/export\s+(?:async\s+)?function\s+POST/);
       if (!m || m.index === void 0) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC152",
         title: `${svc.name} Webhook Missing Signature Verification`,
@@ -7794,7 +7936,7 @@ var missingRequestValidation = {
     if (/if\s*\(\s*!(?:body|parsed|data|payload)\.|throw.*(?:missing|invalid|required)/i.test(content)) return [];
     const m = content.match(/export\s+(?:async\s+)?function\s+(?:POST|PUT|PATCH)/);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC154",
       title: this.title,
@@ -7821,7 +7963,7 @@ var missingAIRateLimit = {
     if (/rateLimit|rateLimiter|throttle|checkRateLimit|limiter|slowDown|express-rate-limit/i.test(content)) return [];
     const m = content.match(/export\s+(?:async\s+)?function\s+(?:POST|GET)/i) || content.match(/\.(post|get)\s*\(/i);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC155",
       title: this.title,
@@ -7850,7 +7992,7 @@ var missingPagination = {
     if (/findUnique|findFirst|findById|\.findOne|WHERE.*id\s*=/i.test(content)) return [];
     const m = content.match(/export\s+(?:async\s+)?function\s+GET/);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC156",
       title: this.title,
@@ -7911,7 +8053,7 @@ var insecureDirectObjectReference = {
     if (/requireUser|requireUserForApi|getServerSession|auth\(\)/i.test(content)) return [];
     const m = content.match(/params\.id|params\.(?:slug|uuid)|req\.params\./);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC158",
       title: this.title,
@@ -8217,6 +8359,17 @@ function runCustomRules(content, filePath, disabledRules = [], tier = "free", ex
     return findings;
   }
   if (/pro-rules-bundle|\.bundle\./i.test(filePath)) return findings;
+  let maxLineLen = 0;
+  {
+    let lineStart = 0;
+    for (let i = 0; i <= content.length; i++) {
+      if (i === content.length || content.charCodeAt(i) === 10) {
+        if (i - lineStart > maxLineLen) maxLineLen = i - lineStart;
+        lineStart = i + 1;
+      }
+    }
+  }
+  if (maxLineLen > 5e4) return findings;
   if (/onboarding|demo-data|example-vulnerable|code-sample/i.test(filePath)) return findings;
   const ruleset = tier === "pro" && extraRules.length > 0 ? [...freeRules, ...extraRules] : freeRules;
   for (const rule of ruleset) {