"use strict";
/**
 * Django Framework Security Model
 *
 * Django ORM queries are parameterised by default. Templates auto-escape.
 * |safe filter, .extra(), .raw(), mark_safe() bypass protections.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.djangoModel = void 0;
// Safe ORM patterns
const ORM_FILTER_RE = /\.objects\.(filter|get|exclude|create|update|values|annotate|aggregate|count|exists)\s*\(/;
const ORM_QUERYSET_RE = /\.(select_related|prefetch_related|order_by|distinct|first|last|earliest|latest)\s*\(/;
// Unsafe patterns
const SAFE_FILTER_RE = /\|\s*safe\b/;
const EXTRA_RE = /\.extra\s*\(/;
const RAW_RE = /\.raw\s*\(/;
const CURSOR_EXECUTE_RE = /cursor\s*\(\s*\)\s*\.execute\s*\(/;
const MARK_SAFE_RE = /mark_safe\s*\(/;
exports.djangoModel = {
    framework: 'django',
    safePatterns: [
        {
            id: 'orm_django_parameterised',
            suppressesCategory: ['sql_injection', 'dangerous_function'],
            detect: (line, filePath, _fileContent) => {
                if (!/\.py$/.test(filePath))
                    return false;
                return ORM_FILTER_RE.test(line) || ORM_QUERYSET_RE.test(line);
            },
            reason: 'Django ORM parameterises queries by default — SQL injection not applicable',
        },
        {
            id: 'django_template_auto_escape',
            suppressesCategory: ['xss'],
            detect: (line, filePath, _fileContent) => {
                // Django templates auto-escape by default
                if (!/\.html$/.test(filePath))
                    return false;
                // Template variable interpolation
                return /\{\{.*\}\}/.test(line) && !SAFE_FILTER_RE.test(line);
            },
            reason: 'Django templates auto-escape variables by default — XSS not applicable',
        },
    ],
    unsafePatterns: [
        {
            id: 'django_safe_filter',
            boostsCategory: ['xss'],
            detect: (line, filePath, _fileContent) => {
                if (!/\.html$/.test(filePath))
                    return false;
                return SAFE_FILTER_RE.test(line);
            },
            reason: 'Django |safe filter bypasses template auto-escaping — XSS risk',
        },
        {
            id: 'django_extra_raw_sql',
            boostsCategory: ['sql_injection'],
            detect: (line, _filePath, _fileContent) => EXTRA_RE.test(line),
            reason: 'Django .extra() accepts raw SQL — SQL injection risk',
        },
        {
            id: 'django_raw_query',
            boostsCategory: ['sql_injection'],
            detect: (line, _filePath, _fileContent) => RAW_RE.test(line),
            reason: 'Django .raw() executes raw SQL — SQL injection risk',
        },
        {
            id: 'django_cursor_execute',
            boostsCategory: ['sql_injection'],
            detect: (line, _filePath, _fileContent) => CURSOR_EXECUTE_RE.test(line),
            reason: 'Django connection.cursor().execute() is raw SQL — SQL injection risk',
        },
        {
            id: 'django_mark_safe',
            boostsCategory: ['xss'],
            detect: (line, _filePath, _fileContent) => MARK_SAFE_RE.test(line),
            reason: 'mark_safe() bypasses Django template auto-escaping — XSS risk',
        },
    ],
};
//# sourceMappingURL=django.js.map