"use strict";
/**
 * Secrets & Cryptography Module
 *
 * Categories: hardcoded_secret, high_entropy_string, sensitive_variable, weak_crypto
 * Contains rules for secrets, BYOK, Math.random(), and weak crypto that need AI reasoning.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.SECRETS_CRYPTO_MODULE = void 0;
exports.SECRETS_CRYPTO_MODULE = `
### Secrets, BYOK, and External Services
Distinguish these patterns:
- **Hardcoded secrets**: Real API keys in code = critical/high
- **Environment variables**: process.env.SECRET = safe (REJECT finding)
- **BYOK (Bring Your Own Key)**: This is a FEATURE, not a vulnerability.
  - Transient use (request -> API call -> discarded) = info. Do NOT describe as "stored without encryption".
  - Key storage without encryption = suggest encryption. Unauthenticated BYOK = medium (cost abuse).
  - Authenticated + transient use: info (feature). Cross-tenant storage: medium (data isolation).

**Math.random() for Security:**
Distinguish legitimate uses from security-critical misuse:
- **Seed/Data Generation Files**: Files in /seed/, /fixtures/, /factories/, datacreator.ts, *.fixture.* are for test data generation
  - Math.random() in seed files is acceptable - these are never production security code
  - REJECT findings from seed/data generation files entirely
- **Educational Vulnerability Files**: Files named insecurity.ts, vulnerable.ts, or in /intentionally-vulnerable/ paths
  - These are OWASP Juice Shop challenges or security training examples
  - REJECT entirely - they're intentionally vulnerable for educational purposes
- **UUID/Identifier Generation**: Functions named generateUUID(), createId(), correlationId(), etc.
  - Use Math.random() for UI correlation, React keys, element IDs
  - Short toString(36).substring(2, 9) patterns are for UI correlation, NOT security tokens
  - REJECT unless function name explicitly indicates security (generateToken, createSessionId, generateSecret)
- **CAPTCHA/Puzzle Generation**: Math.random() for CAPTCHA questions, puzzle difficulty, game mechanics
  - These don't need cryptographic randomness - legitimate non-security use
  - REJECT findings in CAPTCHA/puzzle generation functions
- **Security-Sensitive Context**: Only keep as HIGH/CRITICAL when:
  - Variable names indicate security: token, secret, key, auth, session, password
  - Function names indicate security: generateToken, createSession, makeSecret
  - Used in security-critical files: auth.ts, crypto.ts, session.ts
  - Long toString() patterns without truncation (potential token generation)

**Severity Ladder for Math.random():**
- Seed/educational files: REJECT (not production code)
- UUID/CAPTCHA functions: REJECT (legitimate use)
- Short UI IDs (toString(36).substring(2, 9)): INFO (UI correlation, suggest crypto.randomUUID())
- Business IDs: LOW (suggest crypto.randomUUID() for collision resistance)
- Security contexts (tokens/secrets/keys): HIGH (cryptographic weakness)
- Unknown context: MEDIUM (needs manual review)

**Weak Cryptography (weak_crypto):**
Distinguish actual USAGE from DOCUMENTATION or REFERENCE:
- **Actual function calls** (crypto.createCipheriv('des'), MD5.hash()): Keep finding, these are real usage
- **Documentation strings** describing vulnerabilities: REJECT
  - "DES can be brute-forced" is explaining why DES is bad, NOT using DES
  - Strings in metadata, comments, or error messages describing weak algorithms are informational
  - Rule registries, security scanners, and documentation files contain vulnerability descriptions
- **Configuration/Constants**: Strings like 'DES', 'MD5' in config keys or identifiers
  - Need context: is this SELECTING an algorithm or just naming something?
  - "algorithm: 'des'" in crypto options = real usage
  - "category: 'weak_crypto'" or "rule: 'DES_DETECTION'" = metadata, REJECT
- **Import statements**: Importing a weak crypto library needs context
  - Used for hashing passwords = HIGH
  - Used for checksums or compatibility = LOW/INFO
  - In test/migration files = INFO

**CRITICAL weak_crypto RULE**:
Files in /rules/, /detectors/, /checks/, /metadata/ directories that DESCRIBE security vulnerabilities are NOT themselves vulnerable. A security scanner documenting "DES is weak" is providing education, not using weak crypto.
`;
//# sourceMappingURL=secrets-crypto.js.map