/**
 * OWASP Classic Module
 *
 * Categories: missing_security_headers, ssrf, log_injection, xxe
 * Contains rules for classic OWASP vulnerabilities added in Workstream 1.
 */
export declare const OWASP_CLASSIC_MODULE = "\n### Missing Security Headers (missing_security_headers)\nHTTP security headers protect against common web attacks.\n\n**CDN/Reverse Proxy Headers:**\n- If project deploys behind Cloudflare, Vercel, AWS CloudFront -> **REJECT** (CDN adds headers)\n- If Vercel deployment (Next.js) and using middleware for headers -> **REJECT**\n- Dev-only server config -> **INFO** (not production-facing)\n\n**Express without Helmet:**\n- No helmet AND no manual header setting -> **MEDIUM** (real gap)\n- Has helmet but CSP disabled -> **LOW** (partial protection)\n- Framework adds headers automatically (e.g., Fastify with @fastify/helmet) -> **REJECT**\n\n**Next.js Config:**\n- No headers() but uses middleware.ts for headers -> **REJECT** (headers set in middleware)\n- No headers() and no middleware -> **MEDIUM** (suggest adding)\n\n### Server-Side Request Forgery (ssrf)\nSSRF allows servers to make requests to unintended destinations.\n\n**Direct Taint (req.body/query -> fetch/axios):**\n- User input directly in HTTP request -> **HIGH** (clear SSRF)\n- URL from environment variable (process.env) -> **REJECT** (not user-controlled)\n- URL from config object/constant -> **REJECT** (not user-controlled)\n- URL from database with auth-scoped query -> **LOW** (indirect, needs review)\n\n**Mitigations:**\n- Allowlist/whitelist validation nearby -> **REJECT** or **INFO**\n- URL validation with hostname/origin check -> **LOW** (partial mitigation)\n- IP range checking (isPrivateIP, block 10.x/192.168.x) -> **REJECT** (properly mitigated)\n\n**SSRF is Server-Only:**\n- Client-side fetch() in browser -> **REJECT** (not SSRF, browser makes the request)\n- 'use client' files -> **REJECT**\n\n### Log Injection (log_injection)\nUnsanitized user input in logs can forge entries.\n\n**Structured Logging:**\n- JSON-formatted structured logging (pino, winston JSON) with redaction -> **REJECT**\n- Structured logging without redaction -> **INFO** (good pattern, suggest redaction)\n\n**Request Data in Logs:**\n- req.headers in console.log -> **MEDIUM** (CRLF injection risk)\n- req.body field in console.log -> **LOW** (log forging)\n- req.ip, req.method, req.url -> **REJECT** (server-controlled, standard logging)\n\n**Not Log Injection:**\n- Error objects in catch blocks (console.error(err)) -> **REJECT**\n- Internal IDs (userId, sessionId) -> **REJECT** (not from request)\n- Static strings -> **REJECT**\n- Morgan/express-winston middleware -> **REJECT** (intentional access logging)\n\n### XML External Entity (xxe)\nXXE allows attackers to read server files via XML parsing.\n\n**Python:**\n- defusedxml imported anywhere in file -> **REJECT** (safe library)\n- Standard xml.etree/lxml without defusedxml -> **HIGH** (Python XML is vulnerable by default)\n\n**Java:**\n- DocumentBuilderFactory with disallow-doctype-decl feature -> **REJECT** (safe)\n- Without feature -> **HIGH** (Java defaults are unsafe)\n\n**Node.js:**\n- xml2js v0.5+: safer defaults -> **MEDIUM** (may still be vulnerable on older versions)\n- fast-xml-parser with processEntities: false -> **REJECT** (safe)\n- DOMParser in browser/client -> **REJECT** (browsers block XXE)\n\n**PHP:**\n- libxml_disable_entity_loader(true) before parsing -> **REJECT** (safe)\n- Without disable -> **HIGH**\n";
//# sourceMappingURL=owasp-classic.d.ts.map