"use strict";
/**
 * Layer 1: Comment Scanning for AI Patterns
 * Detects suspicious patterns in code comments that may indicate
 * prompt injection attempts or AI-generated security bypasses
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.detectAICommentPatterns = detectAICommentPatterns;
// Patterns that indicate potential prompt injection or AI manipulation
const AI_COMMENT_PATTERNS = [
    // Prompt injection attempts
    {
        pattern: /ignore\s+(previous|all|above)\s+instructions?/i,
        name: 'Prompt Injection Attempt',
        severity: 'high',
        description: 'Comment contains prompt injection language that could manipulate AI assistants',
    },
    {
        pattern: /disregard\s+(security|safety|previous|all)/i,
        name: 'Security Disregard Instruction',
        severity: 'high',
        description: 'Comment instructs to disregard security measures',
    },
    {
        pattern: /you\s+are\s+now\s+in\s+(developer|debug|admin)\s+mode/i,
        name: 'Mode Override Attempt',
        severity: 'high',
        description: 'Comment attempts to override AI mode or permissions',
    },
    {
        pattern: /override\s+(security|safety)\s+protocols?/i,
        name: 'Security Override Instruction',
        severity: 'high',
        description: 'Comment instructs to override security protocols',
    },
    {
        pattern: /system:\s*ignore/i,
        name: 'System Prompt Injection',
        severity: 'critical',
        description: 'Comment contains system-level prompt injection',
    },
    // Developer instructions to skip security
    {
        pattern: /skip\s+(security|validation|sanitization|auth)/i,
        name: 'Security Skip Instruction',
        severity: 'medium',
        description: 'Comment instructs to skip security measures',
    },
    {
        pattern: /don['']?t\s+(validate|sanitize|check|verify)/i,
        name: 'Validation Skip Instruction',
        severity: 'medium',
        description: 'Comment instructs to skip validation',
    },
    {
        pattern: /disable\s+(auth|authentication|authorization|csrf|xss)/i,
        name: 'Security Disable Instruction',
        severity: 'high',
        description: 'Comment instructs to disable security features',
    },
    // Security-related TODOs - downgraded as these are often addressed or intentional
    {
        pattern: /TODO[:\s].*fix.*security/i,
        name: 'Security TODO',
        severity: 'low', // Downgraded from medium
        description: 'Unresolved security-related TODO comment',
    },
    {
        pattern: /FIXME[:\s].*vulnerab/i,
        name: 'Vulnerability FIXME',
        severity: 'medium', // Downgraded from high
        description: 'Unresolved vulnerability-related FIXME comment',
    },
    {
        pattern: /HACK[:\s].*bypass/i,
        name: 'Security Bypass HACK',
        severity: 'medium', // Downgraded from high
        description: 'Hack comment indicating security bypass',
    },
    {
        pattern: /TODO[:\s].*add\s+(auth|authentication|authorization)/i,
        name: 'Missing Auth TODO',
        severity: 'low', // Downgraded from high - often outdated or in test code
        description: 'TODO indicates authentication may need implementation',
    },
    {
        pattern: /TODO[:\s].*implement\s+(validation|sanitization)/i,
        name: 'Missing Validation TODO',
        severity: 'low', // Downgraded from medium
        description: 'TODO indicates validation may need implementation',
    },
    // AI-generated placeholder patterns - downgraded to info (usually harmless)
    {
        pattern: /TODO[:\s].*add\s+proper\s+error\s+handling/i,
        name: 'AI Placeholder: Error Handling',
        severity: 'info', // Downgraded from low
        description: 'AI-typical placeholder comment for error handling',
    },
    {
        pattern: /TODO[:\s].*implement\s+proper/i,
        name: 'AI Placeholder: Implementation',
        severity: 'info', // Downgraded from low
        description: 'AI-typical placeholder comment for implementation',
    },
    {
        pattern: /add\s+your\s+(code|logic|implementation)\s+here/i,
        name: 'AI Placeholder: Code Here',
        severity: 'info', // Downgraded from low
        description: 'AI-typical placeholder comment',
    },
    // Temporary security bypasses
    {
        pattern: /temporary\s+(bypass|workaround|fix).*security/i,
        name: 'Temporary Security Bypass',
        severity: 'medium', // Downgraded from high
        description: 'Comment indicates temporary security bypass that may have become permanent',
    },
    {
        pattern: /remove\s+(before|in)\s+production/i,
        name: 'Pre-Production Code',
        severity: 'low', // Downgraded from medium
        description: 'Comment indicates code should be removed before production',
    },
];
// Extract comments from code
function extractComments(content) {
    const comments = [];
    const lines = content.split('\n');
    let inBlockComment = false;
    let blockCommentStart = 0;
    let blockCommentText = '';
    for (let i = 0; i < lines.length; i++) {
        const line = lines[i];
        const trimmed = line.trim();
        // Handle block comments
        if (inBlockComment) {
            if (trimmed.includes('*/')) {
                inBlockComment = false;
                blockCommentText += ' ' + trimmed.replace(/\*\/.*$/, '');
                comments.push({
                    text: blockCommentText,
                    line: blockCommentStart + 1,
                    lineContent: lines[blockCommentStart].trim(),
                });
                blockCommentText = '';
            }
            else {
                blockCommentText += ' ' + trimmed.replace(/^\*\s*/, '');
            }
            continue;
        }
        // Start of block comment
        if (trimmed.includes('/*')) {
            if (trimmed.includes('*/')) {
                // Single-line block comment
                const text = trimmed.replace(/\/\*|\*\//g, '');
                comments.push({ text, line: i + 1, lineContent: trimmed });
            }
            else {
                inBlockComment = true;
                blockCommentStart = i;
                blockCommentText = trimmed.replace(/\/\*/, '');
            }
            continue;
        }
        // Single-line comments
        const singleLineMatch = trimmed.match(/\/\/(.*)$|#(.*)$/);
        if (singleLineMatch) {
            const text = singleLineMatch[1] || singleLineMatch[2] || '';
            comments.push({ text, line: i + 1, lineContent: trimmed });
        }
    }
    return comments;
}
function detectAICommentPatterns(content, filePath, options) {
    const vulnerabilities = [];
    const comments = extractComments(content);
    for (const comment of comments) {
        for (const { pattern, name, severity, description } of AI_COMMENT_PATTERNS) {
            if (pattern.test(comment.text)) {
                // Most comment-based findings require AI validation to confirm relevance
                const requiresAIValidation = severity !== 'critical';
                vulnerabilities.push({
                    id: `ai-comment-${filePath}-${comment.line}`,
                    filePath,
                    lineNumber: comment.line,
                    lineContent: comment.lineContent,
                    severity,
                    category: 'ai_pattern',
                    title: name,
                    description,
                    suggestedFix: 'Review and address this comment. If it indicates a security issue, fix it. If it\'s a prompt injection attempt, remove it.',
                    confidence: severity === 'critical' || severity === 'high' ? 'high' : 'low', // Lower default confidence
                    layer: 1,
                    requiresAIValidation,
                });
                break; // Only report one pattern per comment
            }
        }
    }
    return vulnerabilities;
}
//# sourceMappingURL=comments.js.map