xploitscan 1.0.9 → 1.0.10

package/dist/index.js

@@ -577,15 +577,19 @@ var xssVulnerability = {
     ];
     const matches = [];
     for (const pattern of patterns) {
-      matches.push(
-        ...findMatches(
-          content,
-          pattern,
-          xssVulnerability,
-          filePath,
-          () => "Sanitize user input before rendering as HTML. Use a library like DOMPurify: DOMPurify.sanitize(userInput)"
-        )
+      const raw = findMatches(
+        content,
+        pattern,
+        xssVulnerability,
+        filePath,
+        () => "Sanitize user input before rendering as HTML. Use a library like DOMPurify: DOMPurify.sanitize(userInput)"
       );
+      for (const m of raw) {
+        const lineText = content.split("\n")[m.line - 1] || "";
+        if (/\.innerHTML\s*=\s*['"]/.test(lineText) && !/\$\{/.test(lineText)) continue;
+        if (/\.innerHTML\s*=\s*['"][^'"]*['"]\s*$/.test(lineText)) continue;
+        matches.push(m);
+      }
     }
     return matches;
   }
@@ -688,13 +692,21 @@ var nextPublicSecret = {
     ];
     const matches = [];
     for (const p of patterns) {
-      matches.push(...findMatches(
+      const raw = findMatches(
         content,
         p,
         nextPublicSecret,
         filePath,
         () => "Remove the NEXT_PUBLIC_ prefix. Only use NEXT_PUBLIC_ for values safe to expose in the browser."
-      ));
+      );
+      for (const m of raw) {
+        const lineText = content.split("\n")[m.line - 1] || "";
+        if (/PUBLISHABLE|ANON_KEY|PUBLIC_KEY/i.test(lineText)) continue;
+        if (/CLERK_PUBLISHABLE/i.test(lineText)) continue;
+        if (/STRIPE_PUBLISHABLE/i.test(lineText)) continue;
+        if (/=\s*["']?\s*$|=\s*["']?pk_(?:test|live)_["']?\s*$/.test(lineText)) continue;
+        matches.push(m);
+      }
     }
     return matches;
   }
@@ -766,6 +778,8 @@ var unvalidatedRedirect = {
   category: "Injection",
   description: "Redirecting users to URLs from untrusted input enables phishing attacks.",
   check(content, filePath) {
+    if (isTestFile(filePath)) return [];
+    if (/isAllowedRedirect|validateRedirect|isSafeRedirect|allowedDomains|trustedDomains|whitelist.*url|allowlist.*url/i.test(content)) return [];
     const patterns = [
       /window\.location\s*=\s*(?!["'`]https?:\/\/)/g,
       /window\.location\.href\s*=\s*(?!["'`]https?:\/\/)/g,
@@ -1394,21 +1408,24 @@ var complianceMap = {
 var consoleLogProduction = {
   id: "VC097",
   title: "Console.log Left in Production Code",
-  severity: "medium",
+  severity: "low",
   category: "Performance",
   description: "console.log statements left in production code can leak sensitive data, slow down rendering, and clutter browser consoles.",
   check(content, filePath) {
-    if (filePath.match(/test|spec|mock|__tests__|fixture|\.test\.|\.spec\./i)) return [];
+    if (isTestFile(filePath)) return [];
+    if (/(?:migrate|seed|script|cli|setup|dev)\./i.test(filePath)) return [];
     if (!/console\.log\s*\(/g.test(content)) return [];
     const lines = content.split("\n");
+    const logCount = lines.filter((l) => /console\.log\s*\(/.test(l.trim()) && !l.trim().startsWith("//")).length;
+    if (logCount > 5) return [];
     const matches = [];
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i].trim();
       if (/console\.log\s*\(/.test(line) && !line.startsWith("//") && !line.startsWith("*") && !/if\s*\(\s*(?:debug|process\.env)/i.test(lines[Math.max(0, i - 1)] + line)) {
-        matches.push({ rule: "VC097", title: consoleLogProduction.title, severity: "medium", category: "Performance", file: filePath, line: i + 1, snippet: getSnippet(content, i + 1), fix: "Remove console.log or use a logger that can be disabled in production." });
+        matches.push({ rule: "VC097", title: consoleLogProduction.title, severity: "low", category: "Performance", file: filePath, line: i + 1, snippet: getSnippet(content, i + 1), fix: "Remove console.log or use a structured logger that can be disabled in production." });
       }
     }
-    return matches.slice(0, 3);
+    return matches.slice(0, 1);
   }
 };
 var todoLeftInCode = {