"use strict";
/**
 * Layer 2: Risky Import/Package Analysis
 * Detects imports of packages known to have security concerns or deprecated
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.detectRiskyImports = detectRiskyImports;
const context_helpers_1 = require("../utils/context-helpers");
const RISKY_PACKAGES = [
    // Known vulnerable or deprecated packages
    {
        name: 'request (deprecated)',
        pattern: /require\s*\(\s*['"]request['"]\s*\)|from\s+['"]request['"]/gi,
        severity: 'medium',
        description: 'The "request" package is deprecated and no longer maintained',
        suggestedFix: 'Migrate to fetch, axios, or node-fetch',
    },
    {
        name: 'node-uuid (deprecated)',
        pattern: /require\s*\(\s*['"]node-uuid['"]\s*\)|from\s+['"]node-uuid['"]/gi,
        severity: 'low',
        description: 'node-uuid is deprecated in favor of uuid package',
        suggestedFix: 'Use the "uuid" package instead',
    },
    // Packages with known security issues
    {
        name: 'lodash (full import)',
        pattern: /require\s*\(\s*['"]lodash['"]\s*\)|import\s+\*?\s*(?:as\s+)?\w+\s+from\s+['"]lodash['"]/gi,
        severity: 'low',
        description: 'Full lodash import increases bundle size and attack surface',
        suggestedFix: 'Import specific functions: import get from "lodash/get"',
    },
    {
        name: 'moment.js (deprecated)',
        pattern: /require\s*\(\s*['"]moment['"]\s*\)|from\s+['"]moment['"]/gi,
        severity: 'low',
        description: 'Moment.js is in maintenance mode, consider alternatives',
        suggestedFix: 'Use date-fns, dayjs, or native Intl APIs',
    },
    // Security-focused sandbox packages - info only (these are used for security, not risky)
    {
        name: 'vm2 (sandbox)',
        pattern: /require\s*\(\s*['"]vm2['"]\s*\)|from\s+['"]vm2['"]/gi,
        severity: 'info',
        description: 'vm2 is a sandboxing library. While it has had sandbox escape vulnerabilities historically, using it is generally safer than running untrusted code directly. Keep vm2 updated.',
        suggestedFix: 'Keep vm2 updated to the latest version. For maximum isolation, consider isolated-vm or running in a separate process.',
    },
    {
        name: 'serialize-javascript (RCE risk)',
        pattern: /require\s*\(\s*['"]serialize-javascript['"]\s*\)|from\s+['"]serialize-javascript['"]/gi,
        severity: 'medium',
        description: 'serialize-javascript can be dangerous if output is not properly handled',
        suggestedFix: 'Ensure serialized output is not directly executed or use JSON.stringify',
    },
    // Crypto-related risky imports
    {
        name: 'crypto-js (outdated patterns)',
        pattern: /require\s*\(\s*['"]crypto-js['"]\s*\)|from\s+['"]crypto-js['"]/gi,
        severity: 'low',
        description: 'crypto-js may use outdated crypto patterns',
        suggestedFix: 'Prefer Node.js built-in crypto module or Web Crypto API',
    },
    {
        name: 'bcrypt-nodejs (deprecated)',
        pattern: /require\s*\(\s*['"]bcrypt-nodejs['"]\s*\)|from\s+['"]bcrypt-nodejs['"]/gi,
        severity: 'medium',
        description: 'bcrypt-nodejs is deprecated and unmaintained',
        suggestedFix: 'Use bcrypt or bcryptjs instead',
    },
    // SQL/Database risky patterns
    {
        name: 'mysql (prefer mysql2)',
        pattern: /require\s*\(\s*['"]mysql['"]\s*\)|from\s+['"]mysql['"]/gi,
        severity: 'low',
        description: 'mysql package is less maintained than mysql2',
        suggestedFix: 'Consider using mysql2 for better security and performance',
    },
    // Python risky imports
    {
        name: 'pickle (unsafe deserialization)',
        pattern: /^import\s+pickle|^from\s+pickle\s+import/gim,
        severity: 'high',
        description: 'pickle can execute arbitrary code during deserialization',
        suggestedFix: 'Use JSON or other safe serialization formats for untrusted data',
    },
    {
        name: 'yaml unsafe load',
        pattern: /yaml\.load\s*\([^)]*\)(?!.*Loader)/gi,
        severity: 'high',
        description: 'yaml.load without Loader parameter can execute arbitrary code',
        suggestedFix: 'Use yaml.safe_load() or specify Loader=yaml.SafeLoader',
    },
    {
        name: 'subprocess shell=True',
        pattern: /subprocess\.(call|run|Popen|check_output)\s*\([^)]*shell\s*=\s*True/gi,
        severity: 'high',
        description: 'subprocess with shell=True is vulnerable to shell injection',
        suggestedFix: 'Use shell=False and pass arguments as a list',
    },
    // Telemetry/tracking packages (privacy concern)
    {
        name: 'Analytics package',
        pattern: /require\s*\(\s*['"](analytics|segment|mixpanel|amplitude)['"]\s*\)|from\s+['"](analytics|segment|mixpanel|amplitude)['"]/gi,
        severity: 'low',
        description: 'Analytics package detected - ensure user consent is obtained',
        suggestedFix: 'Implement proper consent mechanisms for user tracking',
    },
    // Outdated/vulnerable web frameworks
    {
        name: 'express-jwt (CVE history)',
        pattern: /require\s*\(\s*['"]express-jwt['"]\s*\)|from\s+['"]express-jwt['"]/gi,
        severity: 'medium',
        description: 'express-jwt has had security vulnerabilities - ensure latest version',
        suggestedFix: 'Update to latest version and consider jose or jsonwebtoken directly',
    },
    // Dangerous native modules
    {
        name: 'node-gyp native module',
        pattern: /require\s*\(\s*['"]node-gyp['"]\s*\)|from\s+['"]node-gyp['"]/gi,
        severity: 'low',
        description: 'Native modules can introduce platform-specific vulnerabilities',
        suggestedFix: 'Audit native dependencies and keep them updated',
    },
];
// Check if line is a comment
function isComment(line) {
    const trimmed = line.trim();
    return (trimmed.startsWith('//') ||
        trimmed.startsWith('#') ||
        trimmed.startsWith('*') ||
        trimmed.startsWith('/*'));
}
function detectRiskyImports(content, filePath, options) {
    const vulnerabilities = [];
    // Skip scanner/fixture files to avoid self-detection
    if ((0, context_helpers_1.isScannerOrFixtureFile)(filePath))
        return vulnerabilities;
    const lines = options?.parsed?.lines ?? content.split('\n');
    lines.forEach((line, index) => {
        // Skip comment lines
        if (isComment(line))
            return;
        for (const pkg of RISKY_PACKAGES) {
            const regex = new RegExp(pkg.pattern.source, pkg.pattern.flags);
            if (regex.test(line)) {
                vulnerabilities.push({
                    id: `risky-import-${filePath}-${index + 1}-${pkg.name}`,
                    filePath,
                    lineNumber: index + 1,
                    lineContent: line.trim(),
                    severity: pkg.severity,
                    category: 'suspicious_package',
                    title: `Risky package: ${pkg.name}`,
                    description: pkg.description,
                    suggestedFix: pkg.suggestedFix,
                    confidence: 'high',
                    layer: 2,
                });
                break; // Only report once per line
            }
        }
    });
    return vulnerabilities;
}
//# sourceMappingURL=risky-imports.js.map