xploitscan-shared-rules 1.4.0 → 1.5.0

package/dist/index.cjs

@@ -39,6 +39,7 @@ __export(index_exports, {
   calculateGrade: () => calculateGrade,
   callSpreads: () => callSpreads,
   callbackHell: () => callbackHell,
+  classifyExposure: () => classifyExposure,
   clickjacking: () => clickjacking,
   clientComponentSecret: () => clientComponentSecret,
   clientSideAuth: () => clientSideAuth,
@@ -285,6 +286,27 @@ var RULE_IMPACTS = {
   VC011: "The NEXT_PUBLIC_ prefix exposes this value in the browser bundle. If it's a secret, anyone viewing your site's JavaScript can extract it."
 };
 
+// src/exposure.ts
+function classifyExposure(filePath) {
+  if (/(?:\/api\/|pages\/api\/|routes?\/|controllers?\/|endpoints?\/|server\.|app\/.*route\.)/.test(
+    filePath
+  )) {
+    return "public";
+  }
+  if (/(?:app\/.*page\.|pages\/(?!api\/)|views?\/|templates?\/)/.test(filePath)) {
+    return "public";
+  }
+  if (/(?:lib\/|utils?\/|helpers?\/|services?\/|models?\/|hooks?\/)/.test(
+    filePath
+  )) {
+    return "internal";
+  }
+  if (/(?:middleware|config|constants?)/.test(filePath)) {
+    return "internal";
+  }
+  return "unknown";
+}
+
 // src/ast/parse.ts
 var import_parser = require("@babel/parser");
 var MAX_CACHE = 256;
@@ -8102,6 +8124,7 @@ function scanEntropy(files) {
   calculateGrade,
   callSpreads,
   callbackHell,
+  classifyExposure,
   clickjacking,
   clientComponentSecret,
   clientSideAuth,