"use strict";
/**
 * Dangerous Function Pattern Definitions
 *
 * This module defines the patterns for detecting dangerous function calls.
 * These patterns are used by the main detection engine.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.DANGEROUS_FUNCTIONS = void 0;
exports.matchesLanguage = matchesLanguage;
exports.DANGEROUS_FUNCTIONS = [
    // Code execution
    {
        name: 'eval() usage',
        pattern: /\beval\s*\(/gi,
        severity: 'critical',
        description: 'eval() executes arbitrary code and is a major security risk',
        suggestedFix: 'Use JSON.parse() for JSON data, or refactor to avoid dynamic code execution',
    },
    {
        name: 'Function constructor',
        pattern: /new\s+Function\s*\(/gi,
        severity: 'critical',
        description: 'Function constructor can execute arbitrary code like eval()',
        suggestedFix: 'Refactor to use static functions or safe alternatives',
    },
    {
        name: 'setTimeout/setInterval with string',
        pattern: /set(Timeout|Interval)\s*\(\s*['"`]/gi,
        severity: 'high',
        description: 'setTimeout/setInterval with string argument acts like eval()',
        suggestedFix: 'Pass a function reference instead of a string',
    },
    // Command injection
    {
        name: 'child_process exec',
        pattern: /\b(exec|execSync|spawn|spawnSync|execFile)\s*\(/gi,
        severity: 'high',
        description: 'Shell command execution can lead to command injection',
        suggestedFix: 'Validate and sanitize all inputs, prefer execFile over exec',
    },
    {
        name: 'os.system/subprocess (Python)',
        pattern: /\b(os\.system|subprocess\.(call|run|Popen|check_output))\s*\(/gi,
        severity: 'high',
        description: 'Shell command execution can lead to command injection',
        suggestedFix: 'Use subprocess with shell=False and pass arguments as a list',
        languages: ['py'],
    },
    // SQL injection risks
    // Note: .execute is too generic (used by axios, tRPC, request utilities)
    // Focus on .query and .raw which are more SQL-specific
    {
        name: 'Raw SQL query construction',
        pattern: /\.(query|raw)\s*\(\s*[`'"].*\$\{|\.query\s*\(\s*['"].*\+/gi,
        severity: 'critical',
        description: 'String concatenation in SQL queries can lead to SQL injection',
        suggestedFix: 'Use parameterized queries or prepared statements',
    },
    {
        name: 'SQL template literal',
        pattern: /`SELECT.*FROM.*WHERE.*\$\{|`INSERT.*INTO.*VALUES.*\$\{|`UPDATE.*SET.*\$\{|`DELETE.*FROM.*WHERE.*\$\{/gi,
        severity: 'critical',
        description: 'Template literals in SQL queries can lead to SQL injection',
        suggestedFix: 'Use parameterized queries with placeholders (?, $1, etc.)',
    },
    // XSS risks
    {
        name: 'innerHTML assignment',
        pattern: /\.innerHTML\s*=|\.outerHTML\s*=/gi,
        severity: 'high',
        description: 'Direct innerHTML assignment can lead to XSS vulnerabilities',
        suggestedFix: 'Use textContent for text, or sanitize HTML with DOMPurify',
    },
    {
        name: 'document.write',
        pattern: /document\.write\s*\(/gi,
        severity: 'high',
        description: 'document.write can introduce XSS vulnerabilities',
        suggestedFix: 'Use DOM manipulation methods instead',
    },
    {
        name: 'dangerouslySetInnerHTML',
        pattern: /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:/gi,
        severity: 'high',
        description: 'dangerouslySetInnerHTML can lead to XSS if content is not sanitized',
        suggestedFix: 'Sanitize HTML content with DOMPurify before rendering',
    },
    // Deserialization
    {
        name: 'Unsafe deserialization',
        pattern: /\b(pickle\.loads?|yaml\.load\s*\((?!.*Loader)|unserialize|Marshal\.load)\s*\(/gi,
        severity: 'critical',
        description: 'Unsafe deserialization can lead to remote code execution',
        suggestedFix: 'Use safe loaders (yaml.safe_load) or validate input before deserializing',
    },
    // Note: JSON.parse is handled specially with source-aware severity - see json-parse.ts
    // Note: request.json() is NOT a dangerous function - see request-validation.ts
    // File system risks
    {
        name: 'Dynamic file path',
        pattern: /\b(readFile|writeFile|readFileSync|writeFileSync|createReadStream|createWriteStream)\s*\(\s*[^'"]/gi,
        severity: 'medium',
        description: 'Dynamic file paths can lead to path traversal attacks',
        suggestedFix: 'Validate and sanitize file paths, use path.resolve with a base directory',
    },
    {
        name: 'Path traversal risk',
        pattern: /path\.(join|resolve)\s*\([^)]*req\.(params|query|body)/gi,
        severity: 'high',
        description: 'User input in file paths can lead to path traversal attacks',
        suggestedFix: 'Validate paths and ensure they stay within allowed directories',
    },
    // Crypto weaknesses
    {
        name: 'Math.random for security',
        pattern: /Math\.random\s*\(\s*\)/gi,
        severity: 'medium',
        description: 'Math.random() is not cryptographically secure',
        suggestedFix: 'Use crypto.randomBytes() or crypto.getRandomValues() for security-sensitive operations',
    },
    // Regex DoS
    {
        name: 'Potentially unsafe regex',
        pattern: /new\s+RegExp\s*\(\s*[^'"]/gi,
        severity: 'medium',
        description: 'Dynamic regex construction can lead to ReDoS attacks',
        suggestedFix: 'Validate regex patterns and consider using safe-regex library',
    },
    // Prototype pollution
    {
        name: 'Object.assign with user input',
        pattern: /Object\.assign\s*\(\s*\{\s*\}\s*,\s*(req\.|request\.|body|params|query)/gi,
        severity: 'high',
        description: 'Object.assign with user input can lead to prototype pollution',
        suggestedFix: 'Validate and sanitize input, or use a safe merge function',
    },
    {
        name: 'Spread operator with user input',
        pattern: /\{\s*\.\.\.req\.(body|params|query)|\.\.\.request\.(body|params|query)/gi,
        severity: 'medium',
        description: 'Spreading user input can lead to mass assignment vulnerabilities',
        suggestedFix: 'Explicitly pick allowed properties instead of spreading all input',
    },
];
/**
 * Check if file matches language filter
 */
function matchesLanguage(filePath, languages) {
    if (!languages || languages.length === 0)
        return true;
    const ext = filePath.split('.').pop()?.toLowerCase() || '';
    return languages.some(lang => {
        if (lang === 'py')
            return ext === 'py';
        if (lang === 'js')
            return ['js', 'jsx', 'mjs', 'cjs'].includes(ext);
        if (lang === 'ts')
            return ['ts', 'tsx'].includes(ext);
        return ext === lang;
    });
}
//# sourceMappingURL=patterns.js.map