"use strict";
/**
 * OWASP Classic Module
 *
 * Categories: missing_security_headers, ssrf, log_injection, xxe
 * Contains rules for classic OWASP vulnerabilities added in Workstream 1.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.OWASP_CLASSIC_MODULE = void 0;
exports.OWASP_CLASSIC_MODULE = `
### Missing Security Headers (missing_security_headers)
HTTP security headers protect against common web attacks.

**CDN/Reverse Proxy Headers:**
- If project deploys behind Cloudflare, Vercel, AWS CloudFront -> **REJECT** (CDN adds headers)
- If Vercel deployment (Next.js) and using middleware for headers -> **REJECT**
- Dev-only server config -> **INFO** (not production-facing)

**Express without Helmet:**
- No helmet AND no manual header setting -> **MEDIUM** (real gap)
- Has helmet but CSP disabled -> **LOW** (partial protection)
- Framework adds headers automatically (e.g., Fastify with @fastify/helmet) -> **REJECT**

**Next.js Config:**
- No headers() but uses middleware.ts for headers -> **REJECT** (headers set in middleware)
- No headers() and no middleware -> **MEDIUM** (suggest adding)

### Server-Side Request Forgery (ssrf)
SSRF allows servers to make requests to unintended destinations.

**Direct Taint (req.body/query -> fetch/axios):**
- User input directly in HTTP request -> **HIGH** (clear SSRF)
- URL from environment variable (process.env) -> **REJECT** (not user-controlled)
- URL from config object/constant -> **REJECT** (not user-controlled)
- URL from database with auth-scoped query -> **LOW** (indirect, needs review)

**Mitigations:**
- Allowlist/whitelist validation nearby -> **REJECT** or **INFO**
- URL validation with hostname/origin check -> **LOW** (partial mitigation)
- IP range checking (isPrivateIP, block 10.x/192.168.x) -> **REJECT** (properly mitigated)

**SSRF is Server-Only:**
- Client-side fetch() in browser -> **REJECT** (not SSRF, browser makes the request)
- 'use client' files -> **REJECT**

### Log Injection (log_injection)
Unsanitized user input in logs can forge entries.

**Structured Logging:**
- JSON-formatted structured logging (pino, winston JSON) with redaction -> **REJECT**
- Structured logging without redaction -> **INFO** (good pattern, suggest redaction)

**Request Data in Logs:**
- req.headers in console.log -> **MEDIUM** (CRLF injection risk)
- req.body field in console.log -> **LOW** (log forging)
- req.ip, req.method, req.url -> **REJECT** (server-controlled, standard logging)

**Not Log Injection:**
- Error objects in catch blocks (console.error(err)) -> **REJECT**
- Internal IDs (userId, sessionId) -> **REJECT** (not from request)
- Static strings -> **REJECT**
- Morgan/express-winston middleware -> **REJECT** (intentional access logging)

### XML External Entity (xxe)
XXE allows attackers to read server files via XML parsing.

**Python:**
- defusedxml imported anywhere in file -> **REJECT** (safe library)
- Standard xml.etree/lxml without defusedxml -> **HIGH** (Python XML is vulnerable by default)

**Java:**
- DocumentBuilderFactory with disallow-doctype-decl feature -> **REJECT** (safe)
- Without feature -> **HIGH** (Java defaults are unsafe)

**Node.js:**
- xml2js v0.5+: safer defaults -> **MEDIUM** (may still be vulnerable on older versions)
- fast-xml-parser with processEntities: false -> **REJECT** (safe)
- DOMParser in browser/client -> **REJECT** (browsers block XXE)

**PHP:**
- libxml_disable_entity_loader(true) before parsing -> **REJECT** (safe)
- Without disable -> **HIGH**
`;
//# sourceMappingURL=owasp-classic.js.map