xploitscan-shared-rules 1.13.0 → 1.13.1

package/dist/index.js

@@ -1,13 +1,48 @@
 // src/snippet.ts
-function getSnippet(content, line, contextLines = 2) {
+var cacheContent = null;
+var cacheLines = [];
+var cacheOffsets = [];
+function lineIndex(content) {
+  if (content === cacheContent) return { lines: cacheLines, offsets: cacheOffsets };
   const lines = content.split("\n");
+  const offsets = new Array(lines.length);
+  let off = 0;
+  for (let i = 0; i < lines.length; i++) {
+    offsets[i] = off;
+    off += lines[i].length + 1;
+  }
+  cacheContent = content;
+  cacheLines = lines;
+  cacheOffsets = offsets;
+  return { lines, offsets };
+}
+function lineNumberAt(content, index) {
+  const { offsets } = lineIndex(content);
+  let lo = 0;
+  let hi = offsets.length - 1;
+  let ans = 0;
+  while (lo <= hi) {
+    const mid = lo + hi >> 1;
+    if (offsets[mid] <= index) {
+      ans = mid;
+      lo = mid + 1;
+    } else {
+      hi = mid - 1;
+    }
+  }
+  return ans + 1;
+}
+function getSnippet(content, line, contextLines = 2) {
+  const { lines } = lineIndex(content);
   const start = Math.max(0, line - 1 - contextLines);
   const end = Math.min(lines.length, line + contextLines);
-  return lines.slice(start, end).map((l, i) => {
-    const lineNum = start + i + 1;
+  const out = [];
+  for (let i = start; i < end; i++) {
+    const lineNum = i + 1;
     const marker = lineNum === line ? ">" : " ";
-    return `${marker} ${lineNum.toString().padStart(4)} | ${l}`;
-  }).join("\n");
+    out.push(`${marker} ${lineNum.toString().padStart(4)} | ${lines[i]}`);
+  }
+  return out.join("\n");
 }
 
 // src/rule-impacts.ts
@@ -815,7 +850,7 @@ var SERVER_SIDE_PATH_RE = new RegExp(
   ].join("|"),
   "i"
 );
-var SERVER_SIDE_CONTENT_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies)\b|\b(?:app|router)\.(?:get|post|put|patch|delete|use|all)\s*\(|\bctx\.request\b|\bevent\.(?:body|queryStringParameters|pathParameters)\b|\(\s*req\s*,\s*res\b|(?:import|require)\b[^;\n]*['"]express['"]|\bNextFunction\b/;
+var SERVER_SIDE_CONTENT_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies)\b|\b(?:app|router)\.(?:get|post|put|patch|delete|use|all)\s*\(|\bctx\.request\b|\bevent\.(?:body|queryStringParameters|pathParameters)\b|\(\s*req\s*,\s*res\b|(?:import|require)\b[^;\n]{0,200}['"]express['"]|\bNextFunction\b/;
 function isServerSideFile(filePath, content) {
   if (isTestFile(filePath)) return false;
   if (SERVER_SIDE_PATH_RE.test(filePath)) return true;
@@ -862,13 +897,23 @@ function filterSilenced(matches, content, ruleId) {
 }
 function findMatches(content, pattern, rule, filePath, fixTemplate) {
   const matches = [];
-  const lines = content.split("\n");
   let m;
   const re = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+  let scanned = 0;
+  let lineNum = 1;
+  let lastMatchIndex = -1;
+  const MAX_MATCHES = 500;
   while ((m = re.exec(content)) !== null) {
+    if (m.index === lastMatchIndex && m[0].length === 0) {
+      re.lastIndex++;
+      continue;
+    }
+    lastMatchIndex = m.index;
     if (isCommentLine(content, m.index)) continue;
     if (isInsideFixMessage(content, m.index)) continue;
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    for (; scanned < m.index; scanned++) {
+      if (content.charCodeAt(scanned) === 10) lineNum++;
+    }
     matches.push({
       rule: rule.id,
       title: rule.title,
@@ -879,6 +924,7 @@ function findMatches(content, pattern, rule, filePath, fixTemplate) {
       snippet: getSnippet(content, lineNum),
       fix: fixTemplate?.(m)
     });
+    if (matches.length >= MAX_MATCHES) break;
   }
   return matches;
 }
@@ -894,10 +940,26 @@ function astMatch(content, filePath, line, rule, fix) {
     fix
   };
 }
+var parseCacheContent = null;
+var parseCachePath = null;
+var parseCacheResult = null;
+var parseCacheValid = false;
 function tryParse(content, filePath) {
-  const parsed = parseFile(content, filePath);
-  if (!parsed) return null;
-  return { parsed, taint: buildTaintMap(parsed) };
+  if (parseCacheValid && content === parseCacheContent && filePath === parseCachePath) {
+    return parseCacheResult;
+  }
+  let result = null;
+  try {
+    const parsed = parseFile(content, filePath);
+    result = parsed ? { parsed, taint: buildTaintMap(parsed) } : null;
+  } catch {
+    result = null;
+  }
+  parseCacheResult = result;
+  parseCacheContent = content;
+  parseCachePath = filePath;
+  parseCacheValid = true;
+  return result;
 }
 var hardcodedSecrets = {
   id: "VC001",
@@ -1265,7 +1327,7 @@ var xssVulnerability = {
     const hasSanitizerBypass = /bypassSecurityTrust(?:Html|Script|Style|Url|ResourceUrl)\s*\(/.test(content);
     if (/(?:sanitize|purify|escape|xss)/i.test(filePath)) return [];
     if (!hasSanitizerBypass && /DOMPurify\.sanitize|sanitizeHtml|xss\(|escapeHtml/i.test(content)) return [];
-    if (!hasSanitizerBypass && /(?:import|require)\s*\(?.*(?:DOMPurify|dompurify|sanitize|sanitizer)/i.test(content)) return [];
+    if (!hasSanitizerBypass && /(?:import|require)\s*\(?[^\n]{0,200}(?:DOMPurify|dompurify|sanitize|sanitizer)/i.test(content)) return [];
     const patterns = [
       // React dangerouslySetInnerHTML
       /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:/g,
@@ -1294,9 +1356,9 @@ var xssVulnerability = {
         () => "Sanitize user input before rendering as HTML. Use a library like DOMPurify: DOMPurify.sanitize(userInput). If this site is intentional (JSON-LD structured data, a const boot script, a sandboxed preview), add an inline `// VC007-OK: <reason>` comment above the line to silence."
       );
       for (const m of raw) {
-        const lineText = allLines[m.line - 1] || "";
+        const lineText = (allLines[m.line - 1] || "").slice(0, 4e3);
         if (/\.innerHTML\s*=\s*['"]/.test(lineText) && !/\$\{/.test(lineText)) continue;
-        if (/\.innerHTML\s*=\s*['"][^'"]*['"]\s*$/.test(lineText)) continue;
+        if (/\.innerHTML\s*=\s*['"][^'"]{0,2000}['"]\s*$/.test(lineText)) continue;
         if (/dangerouslySetInnerHTML/.test(lineText)) {
           const windowText = allLines.slice(m.line - 1, m.line + 2).join("\n");
           if (/JSON\.stringify/i.test(windowText)) continue;
@@ -1547,7 +1609,7 @@ var evalUsage = {
       /new\s+Function\s*\(\s*(?!["'`])/g
     ];
     const hasEvalInString = /["'`]eval(?:-source-map|["'`])/i.test(content);
-    if (hasEvalInString && !/\beval\s*\([^)]*(?:req\.|body\.|input|params|user|data)/i.test(content)) return [];
+    if (hasEvalInString && !/\beval\s*\([^)]{0,500}(?:req\.|body\.|input|params|user|data)/i.test(content)) return [];
     const matches = [];
     for (const p of patterns) {
       const rawMatches = findMatches(
@@ -1588,7 +1650,7 @@ var unvalidatedRedirect = {
       const isPureLiteral = /^["'`][^"'`]*["'`]$/.test(value);
       if (!hasInterpolation && isPureLiteral) continue;
       if (isInlineSilenced(content, m.index, "VC016")) continue;
-      const line = content.substring(0, m.index).split("\n").length;
+      const line = lineNumberAt(content, m.index);
       matches.push({
         rule: "VC016",
         title: unvalidatedRedirect.title,
@@ -1811,11 +1873,11 @@ var prototypePollution = {
     ];
     const hasValidation = /schema|validate|sanitize|whitelist|allowedKeys|pick\(|Object\.freeze|zod|yup|joi|ajv/i.test(content);
     if (!hasValidation) {
-      const hasUnsafeMerge = /Object\.assign\s*\([^)]*JSON\.parse|\.\.\.JSON\.parse|\{.*\.\.\.(?:stored|saved|cached|parsed|data)/i.test(content);
+      const hasUnsafeMerge = /Object\.assign\s*\([^)]{0,500}JSON\.parse|\.\.\.JSON\.parse|\{[^\n]{0,300}\.\.\.(?:stored|saved|cached|parsed|data)/i.test(content);
       if (hasUnsafeMerge) {
         matches.push(...findMatches(
           content,
-          /Object\.assign\s*\([^)]*JSON\.parse|\.\.\.JSON\.parse/g,
+          /Object\.assign\s*\([^)]{0,500}JSON\.parse|\.\.\.JSON\.parse/g,
           prototypePollution,
           filePath,
           () => "Validate parsed data against an expected schema before merging into objects. Use Object.freeze(), a validation library (Zod, Yup), or manually check for __proto__ and constructor keys."
@@ -3361,7 +3423,7 @@ var dangerousInnerHTML = {
       if (/^[A-Z][A-Z0-9_]+$/.test(value)) continue;
       if (/^["'`][^$]*["'`]$/.test(value)) continue;
       if (/JSON\.stringify/i.test(value)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC063",
         title: dangerousInnerHTML.title,
@@ -4103,7 +4165,7 @@ var missingSRI = {
     const re = new RegExp(scriptPattern.source, scriptPattern.flags);
     while ((m = re.exec(content)) !== null) {
       if (!m[0].includes("integrity")) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC084",
           title: missingSRI.title,
@@ -4974,7 +5036,7 @@ var s3BucketNoEncryption = {
       const blockEnd = Math.min(m.index + 2e3, content.length);
       const blockContent = content.substring(m.index, blockEnd);
       if (!/server_side_encryption/.test(blockContent)) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC107",
           title: s3BucketNoEncryption.title,
@@ -5005,7 +5067,7 @@ var securityGroupAllInbound = {
       while ((m = ingressPattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (/from_port\s*=\s*0/.test(m[0]) || !/from_port/.test(m[0])) {
-          const lineNum = content.substring(0, m.index).split("\n").length;
+          const lineNum = lineNumberAt(content, m.index);
           matches.push({
             rule: "VC108",
             title: securityGroupAllInbound.title,
@@ -5092,7 +5154,7 @@ var lambdaWithoutVPC = {
       const blockEnd = Math.min(m.index + 2e3, content.length);
       const blockContent = content.substring(m.index, blockEnd);
       if (!/vpc_config\s*\{/.test(blockContent)) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC111",
           title: lambdaWithoutVPC.title,
@@ -5122,7 +5184,7 @@ var dockerLatestTag = {
     while ((m = fromPattern.exec(content)) !== null) {
       const image = m[1];
       if (image.endsWith(":latest") || !image.includes(":") && !image.startsWith("$")) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         matches.push({
           rule: "VC112",
           title: dockerLatestTag.title,
@@ -5250,17 +5312,26 @@ var pathTraversal = {
     const findings = [];
     const patterns = [
       /(?:readFile|readFileSync|createReadStream|writeFile|writeFileSync|appendFile|unlink|unlinkSync|access|stat|statSync|existsSync)\s*\(\s*(?:req\.|request\.|ctx\.|params\.|query\.)/gi,
-      /(?:path\.join|path\.resolve)\s*\([^)]*(?:req\.|request\.|ctx\.|params\.|query\.)[^)]*\)/gi,
-      /(?:res\.sendFile|res\.download)\s*\([^)]*(?:req\.|request\.)/gi,
+      /(?:path\.join|path\.resolve)\s*\([^)]{0,500}(?:req\.|request\.|ctx\.|params\.|query\.)[^)]{0,500}\)/gi,
+      /(?:res\.sendFile|res\.download)\s*\([^)]{0,500}(?:req\.|request\.)/gi,
       /open\s*\(\s*(?:request\.|params\[|args\.)/gi
     ];
+    const MAX_MATCHES = 500;
     for (const pat of patterns) {
+      if (findings.length >= MAX_MATCHES) break;
       let m;
+      let lastIdx = -1;
       while ((m = pat.exec(content)) !== null) {
+        if (findings.length >= MAX_MATCHES) break;
+        if (m.index === lastIdx && m[0].length === 0) {
+          pat.lastIndex++;
+          continue;
+        }
+        lastIdx = m.index;
         if (isCommentLine(content, m.index)) continue;
         const surrounding = content.substring(Math.max(0, m.index - 200), m.index + 200);
         if (/path\.normalize|sanitize|\.replace\(\s*['"]\.\.|\.startsWith\s*\(|realpath/i.test(surrounding)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC117",
           title: pathTraversal.title,
@@ -5291,7 +5362,7 @@ var piiInLogs = {
     while ((m = logPattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
       if (isInsideFixMessage(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC118",
         title: piiInLogs.title,
@@ -5329,7 +5400,7 @@ var hardcodedOAuthSecret = {
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (/process\.env|os\.environ|ENV\[|getenv|\$\{|<your|CHANGE_ME|xxx|placeholder/i.test(m[0])) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC119",
           title: hardcodedOAuthSecret.title,
@@ -5361,7 +5432,7 @@ var missingOAuthState = {
       if (isCommentLine(content, m.index)) continue;
       const surrounding = content.substring(m.index, Math.min(content.length, m.index + 500));
       if (/state\s*[=:]/i.test(surrounding)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC120",
         title: missingOAuthState.title,
@@ -5389,7 +5460,7 @@ var unpinnedGitHubAction = {
     let m;
     while ((m = usesPattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC121",
         title: unpinnedGitHubAction.title,
@@ -5423,7 +5494,7 @@ var deprecatedTLS = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC122",
           title: deprecatedTLS.title,
@@ -5459,7 +5530,7 @@ var weakRSAKeySize = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC123",
           title: weakRSAKeySize.title,
@@ -5495,7 +5566,7 @@ var ecbModeEncryption = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC124",
           title: ecbModeEncryption.title,
@@ -5526,7 +5597,7 @@ var insecurePasswordReset = {
     let m;
     while ((m = weakTokens.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC125",
         title: insecurePasswordReset.title,
@@ -5543,7 +5614,7 @@ var insecurePasswordReset = {
       if (isCommentLine(content, m.index)) continue;
       const surrounding = content.substring(Math.max(0, m.index - 500), m.index);
       if (!/(?:reset|forgot).*password/i.test(surrounding)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC125",
         title: insecurePasswordReset.title,
@@ -5604,7 +5675,7 @@ var insecureHTTPMethods = {
         if (isCommentLine(content, m.index)) continue;
         const handlerBlock = content.substring(m.index, Math.min(content.length, m.index + 500));
         if (/auth|authenticate|authorize|requireAuth|isAuthenticated|protect|guard|middleware|session|jwt|verify|clerk|getAuth/i.test(handlerBlock)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC127",
           title: insecureHTTPMethods.title,
@@ -5638,7 +5709,7 @@ var httpRequestSmuggling = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC128",
           title: httpRequestSmuggling.title,
@@ -5672,7 +5743,7 @@ var unencryptedPII = {
       let m;
       while ((m = pat.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC129",
           title: unencryptedPII.title,
@@ -5704,7 +5775,7 @@ var missingAuthRateLimit = {
       if (isCommentLine(content, m.index)) continue;
       const surrounding = content.substring(Math.max(0, m.index - 300), Math.min(content.length, m.index + 300));
       if (/rateLimit|rateLimiter|throttle|slowDown|express-rate-limit|rate_limit|RateLimiter|limiter/i.test(surrounding)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC130",
         title: missingAuthRateLimit.title,
@@ -5742,7 +5813,7 @@ var vulnerableDependencies = {
     for (const [pat, message] of vulnerablePackages) {
       let m;
       while ((m = pat.exec(content)) !== null) {
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC131",
           title: vulnerableDependencies.title,
@@ -5774,7 +5845,7 @@ function secretRuleCheck(content, filePath, pattern, ruleId, title, severity, fi
     const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
     const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
     if (PLACEHOLDER_RE.test(lineText)) continue;
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     findings.push({
       rule: ruleId,
       title,
@@ -5875,7 +5946,7 @@ var hardcodedGCPServiceAccount = {
     const findings = [];
     const m = content.match(/"type"\s*:\s*"service_account"/);
     if (m && m.index !== void 0) {
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC136",
         title: this.title,
@@ -5981,7 +6052,7 @@ var hardcodedDatadogKey = {
       const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
       const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
       if (PLACEHOLDER_RE.test(lineText)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC141",
         title: this.title,
@@ -6015,7 +6086,7 @@ var hardcodedVercelToken = {
       const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
       const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
       if (PLACEHOLDER_RE.test(lineText)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC142",
         title: this.title,
@@ -6049,7 +6120,7 @@ var hardcodedSupabaseServiceRole = {
       const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
       const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
       if (PLACEHOLDER_RE.test(lineText)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC143",
         title: this.title,
@@ -6113,7 +6184,7 @@ function contextSecretRuleCheck(content, filePath, pattern, ruleId, title, sever
     const lineStart = content.lastIndexOf("\n", m.index - 1) + 1;
     const lineText = content.substring(lineStart, content.indexOf("\n", m.index));
     if (PLACEHOLDER_RE.test(lineText)) continue;
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     findings.push({
       rule: ruleId,
       title,
@@ -6593,7 +6664,7 @@ var ghaPullRequestTargetCheckout = {
     const checkoutPattern = /uses\s*:\s*actions\/checkout@[^\n]*[\s\S]{0,400}?ref\s*:\s*\$\{\{\s*github\.event\.pull_request\.head\.(?:ref|sha)\s*\}\}/g;
     let m;
     while ((m = checkoutPattern.exec(content)) !== null) {
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC184",
         title: ghaPullRequestTargetCheckout.title,
@@ -6677,7 +6748,7 @@ var ghaThirdPartyActionWithSecrets = {
     const pattern = /uses\s*:\s*(?!actions\/|github\/|aws-actions\/|azure\/|google-github-actions\/|hashicorp\/)([\w\-]+\/[\w\-./]+)@[^\n]*\n[\s\S]{0,800}?with\s*:[\s\S]{0,800}?\$\{\{\s*secrets\./g;
     let m;
     while ((m = pattern.exec(content)) !== null) {
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC187",
         title: ghaThirdPartyActionWithSecrets.title,
@@ -6842,7 +6913,7 @@ var pyRequestsVerifyFalse = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC191",
         title: pyRequestsVerifyFalse.title,
@@ -6873,7 +6944,7 @@ var pyJinja2AutoescapeOff = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC192",
         title: pyJinja2AutoescapeOff.title,
@@ -6902,7 +6973,7 @@ var pyTempfileMktemp = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC193",
         title: pyTempfileMktemp.title,
@@ -6944,7 +7015,7 @@ var pyDjangoMarkSafe = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -6981,7 +7052,7 @@ var pyParamikoAutoAdd = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7014,7 +7085,7 @@ var pyDjangoAllowedHostsWildcard = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC196",
         title: pyDjangoAllowedHostsWildcard.title,
@@ -7052,7 +7123,7 @@ var pyJWTDecodeWeakConfig = {
         if (isCommentLine(content, m.index)) continue;
         const args = m[1];
         if (/\balgorithms\s*=/.test(args)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7103,7 +7174,7 @@ var llmPromptInjection = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7142,7 +7213,7 @@ var llmSystemPromptInjection = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC199",
           title: llmSystemPromptInjection.title,
@@ -7184,7 +7255,7 @@ var llmOutputAsHTML = {
       let m;
       while ((m = pattern.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         if (seenLines.has(lineNum)) continue;
         seenLines.add(lineNum);
         findings.push({
@@ -7221,7 +7292,7 @@ var vectorStoreQueryNoUserFilter = {
       if (/\b(?:user[_-]?id|userId|tenant[_-]?id|tenantId|org[_-]?id|orgId|owner[_-]?id|ownerId|account[_-]?id|customer[_-]?id|workspace[_-]?id)\b/i.test(args)) continue;
       if (/\bnamespace\s*[:=]\s*[`"']?[^,)`"']*(?:user|tenant|org|owner|account|customer|workspace)/i.test(args)) continue;
       if (/\bfilter\s*[:=][\s\S]*?(?:\buser|\btenant|\borg|\bowner|\baccount|\bcustomer|\bworkspace)/i.test(args)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC201",
         title: vectorStoreQueryNoUserFilter.title,
@@ -7258,7 +7329,7 @@ var vectorStoreUpsertNoMetadata = {
       if (/\bnamespace\s*[:=]\s*[`"']?[^,)`"']*(?:user|tenant|org)/i.test(args)) {
         continue;
       }
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC202",
         title: vectorStoreUpsertNoMetadata.title,
@@ -7312,7 +7383,7 @@ var llmCallNoMaxTokens = {
       if (depth !== 0) continue;
       const args = content.substring(openIdx + 1, i).replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "").replace(/#[^\n]*/g, "");
       if (TOKEN_KW_RE.test(args)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC203",
         title: llmCallNoMaxTokens.title,
@@ -7352,7 +7423,7 @@ var graphqlNoDepthLimit = {
     let m;
     while ((m = anchorRe.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC204",
         title: graphqlNoDepthLimit.title,
@@ -7386,7 +7457,7 @@ var graphqlNoComplexityLimit = {
     let m;
     while ((m = anchorRe.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC205",
         title: graphqlNoComplexityLimit.title,
@@ -7416,7 +7487,7 @@ var graphqlCSRFDisabled = {
     let m;
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC206",
         title: graphqlCSRFDisabled.title,
@@ -7512,7 +7583,7 @@ var webhookMissingIdempotency = {
     if (/idempoten|event\.id|evt\.id|delivery_?id|alreadyProcessed|processedEvents|ON\s+CONFLICT|INSERT\s+OR\s+IGNORE|\bseen\b|\bprocessed\b/i.test(content)) return [];
     const m = content.match(/constructEvent|new\s+Webhook\s*\(|verifyHeader/i);
     if (!m || m.index === void 0) return [];
-    const line = content.substring(0, m.index).split("\n").length;
+    const line = lineNumberAt(content, m.index);
     return filterSilenced([{
       rule: "VC209",
       title: webhookMissingIdempotency.title,
@@ -7539,7 +7610,7 @@ var middlewareMatcherExcludesApi = {
     if (!/\(\?!\s*[^)]*\bapi\b/.test(content)) return [];
     const m = content.match(/matcher\s*:/);
     if (!m || m.index === void 0) return [];
-    const line = content.substring(0, m.index).split("\n").length;
+    const line = lineNumberAt(content, m.index);
     return filterSilenced([{
       rule: "VC210",
       title: middlewareMatcherExcludesApi.title,
@@ -7577,7 +7648,7 @@ var secretInURLParam = {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
         if (isInlineSilenced(content, m.index, "VC146")) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC146",
           title: this.title,
@@ -7608,7 +7679,7 @@ var secretLoggedToConsole = {
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
       if (isInsideFixMessage(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC147",
         title: this.title,
@@ -7638,7 +7709,7 @@ var secretInErrorResponse = {
     while ((m = pattern.exec(content)) !== null) {
       if (isCommentLine(content, m.index)) continue;
       if (isInsideFixMessage(content, m.index)) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC148",
         title: this.title,
@@ -7677,7 +7748,7 @@ var secretInBundleConfig = {
       while ((m = re.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC149",
           title: this.title,
@@ -7715,7 +7786,7 @@ var secretInHTMLAttribute = {
       while ((m = re.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC150",
           title: this.title,
@@ -7742,9 +7813,9 @@ var secretInCLIArgument = {
     if (!filePath.match(/\.(js|ts|jsx|tsx|py|rb)$/)) return [];
     const findings = [];
     const patterns = [
-      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]*\$\{[^}]*(?:api[_-]?key|secret|token|password|credentials)/gi,
-      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]*["']\s*\+\s*(?:api[_-]?key|secret|token|password|credentials)/gi,
-      /(?:subprocess|os\.system|os\.popen)\s*\([^)]*\{[^}]*(?:api[_-]?key|secret|token|password|credentials)/gi
+      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]{0,500}\$\{[^}]{0,200}(?:api[_-]?key|secret|token|password|credentials)/gi,
+      /(?:exec|execSync|spawn|spawnSync|child_process)\s*\([^)]{0,500}["']\s*\+\s*(?:api[_-]?key|secret|token|password|credentials)/gi,
+      /(?:subprocess|os\.system|os\.popen)\s*\([^)]{0,500}\{[^}]{0,200}(?:api[_-]?key|secret|token|password|credentials)/gi
     ];
     for (const p of patterns) {
       let m;
@@ -7752,7 +7823,7 @@ var secretInCLIArgument = {
       while ((m = re.exec(content)) !== null) {
         if (isCommentLine(content, m.index)) continue;
         if (isInsideFixMessage(content, m.index)) continue;
-        const lineNum = content.substring(0, m.index).split("\n").length;
+        const lineNum = lineNumberAt(content, m.index);
         findings.push({
           rule: "VC151",
           title: this.title,
@@ -7798,7 +7869,7 @@ var webhookSignatureVerification = {
       if (svc.verify.test(content)) continue;
       const m = content.match(/export\s+(?:async\s+)?function\s+POST/);
       if (!m || m.index === void 0) continue;
-      const lineNum = content.substring(0, m.index).split("\n").length;
+      const lineNum = lineNumberAt(content, m.index);
       findings.push({
         rule: "VC152",
         title: `${svc.name} Webhook Missing Signature Verification`,
@@ -7865,7 +7936,7 @@ var missingRequestValidation = {
     if (/if\s*\(\s*!(?:body|parsed|data|payload)\.|throw.*(?:missing|invalid|required)/i.test(content)) return [];
     const m = content.match(/export\s+(?:async\s+)?function\s+(?:POST|PUT|PATCH)/);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC154",
       title: this.title,
@@ -7892,7 +7963,7 @@ var missingAIRateLimit = {
     if (/rateLimit|rateLimiter|throttle|checkRateLimit|limiter|slowDown|express-rate-limit/i.test(content)) return [];
     const m = content.match(/export\s+(?:async\s+)?function\s+(?:POST|GET)/i) || content.match(/\.(post|get)\s*\(/i);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC155",
       title: this.title,
@@ -7921,7 +7992,7 @@ var missingPagination = {
     if (/findUnique|findFirst|findById|\.findOne|WHERE.*id\s*=/i.test(content)) return [];
     const m = content.match(/export\s+(?:async\s+)?function\s+GET/);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC156",
       title: this.title,
@@ -7982,7 +8053,7 @@ var insecureDirectObjectReference = {
     if (/requireUser|requireUserForApi|getServerSession|auth\(\)/i.test(content)) return [];
     const m = content.match(/params\.id|params\.(?:slug|uuid)|req\.params\./);
     if (!m || m.index === void 0) return [];
-    const lineNum = content.substring(0, m.index).split("\n").length;
+    const lineNum = lineNumberAt(content, m.index);
     return [{
       rule: "VC158",
       title: this.title,
@@ -8288,6 +8359,17 @@ function runCustomRules(content, filePath, disabledRules = [], tier = "free", ex
     return findings;
   }
   if (/pro-rules-bundle|\.bundle\./i.test(filePath)) return findings;
+  let maxLineLen = 0;
+  {
+    let lineStart = 0;
+    for (let i = 0; i <= content.length; i++) {
+      if (i === content.length || content.charCodeAt(i) === 10) {
+        if (i - lineStart > maxLineLen) maxLineLen = i - lineStart;
+        lineStart = i + 1;
+      }
+    }
+  }
+  if (maxLineLen > 5e4) return findings;
   if (/onboarding|demo-data|example-vulnerable|code-sample/i.test(filePath)) return findings;
   const ruleset = tier === "pro" && extraRules.length > 0 ? [...freeRules, ...extraRules] : freeRules;
   for (const rule of ruleset) {