"use strict";
/**
 * Child Process Detection
 *
 * Detection logic for child_process functions (exec, spawn, execFile, etc.)
 * that can lead to command injection vulnerabilities.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.isChildProcessExec = isChildProcessExec;
exports.isChildProcessSpawn = isChildProcessSpawn;
/**
 * Check if exec() call is from child_process (dangerous) vs RegExp.exec (safe)
 * Returns true if this is a child_process exec call that should be flagged
 */
function isChildProcessExec(content, lineContent) {
    // Check for child_process import
    const hasChildProcessImport = /require\s*\(\s*['"]child_process['"]\s*\)/.test(content) ||
        /from\s+['"]child_process['"]/.test(content) ||
        /import\s+.*child_process/.test(content) ||
        /require\s*\(\s*['"]node:child_process['"]\s*\)/.test(content) ||
        /from\s+['"]node:child_process['"]/.test(content);
    // If no child_process import, this is likely RegExp.exec or similar
    if (!hasChildProcessImport) {
        return false;
    }
    // Check if this specific line is RegExp.exec pattern
    // RegExp.exec is called as: regex.exec(string) or /pattern/.exec(string)
    const isRegExpExec = /\.\s*exec\s*\(/.test(lineContent) && // Method call on an object
        !/\bexec\s*\(/.test(lineContent.replace(/\.\s*exec\s*\(/, '')); // Not a standalone exec()
    // Also check for common RegExp patterns
    const isRegExpPattern = /\/[^/]+\/[gimsuy]*\.exec\s*\(/.test(lineContent) || // /pattern/.exec()
        /new\s+RegExp\s*\([^)]+\)\.exec\s*\(/.test(lineContent) || // new RegExp().exec()
        /regex\.exec\s*\(/i.test(lineContent) || // regex.exec()
        /pattern\.exec\s*\(/i.test(lineContent) || // pattern.exec()
        /match\.exec\s*\(/i.test(lineContent) || // match.exec()
        /re\.exec\s*\(/i.test(lineContent); // re.exec()
    if (isRegExpExec || isRegExpPattern) {
        return false;
    }
    // Check if exec is imported/destructured from child_process
    const execImported = /\{\s*[^}]*\bexec\b[^}]*\}\s*=\s*require\s*\(\s*['"]child_process['"]/.test(content) ||
        /\{\s*[^}]*\bexec\b[^}]*\}\s*=\s*require\s*\(\s*['"]node:child_process['"]/.test(content) ||
        /import\s+\{\s*[^}]*\bexec\b[^}]*\}\s+from\s+['"]child_process['"]/.test(content) ||
        /import\s+\{\s*[^}]*\bexec\b[^}]*\}\s+from\s+['"]node:child_process['"]/.test(content);
    // If exec is directly imported from child_process, standalone exec() is dangerous
    if (execImported && /\bexec\s*\(/.test(lineContent)) {
        return true;
    }
    // Check for child_process.exec() pattern
    if (/child_process\.exec\s*\(/.test(lineContent) ||
        /cp\.exec\s*\(/.test(lineContent) ||
        /childProcess\.exec\s*\(/.test(lineContent)) {
        return true;
    }
    // If we have child_process import but can't determine usage, be conservative
    // Only flag if it looks like a standalone exec() call
    return /\bexec\s*\(/.test(lineContent) && !/\.\s*exec\s*\(/.test(lineContent);
}
/**
 * Check if spawn/execFile/execSync is from child_process
 */
function isChildProcessSpawn(content, lineContent) {
    // Check for child_process import
    const hasChildProcessImport = /require\s*\(\s*['"]child_process['"]\s*\)/.test(content) ||
        /from\s+['"]child_process['"]/.test(content) ||
        /require\s*\(\s*['"]node:child_process['"]\s*\)/.test(content) ||
        /from\s+['"]node:child_process['"]/.test(content);
    if (!hasChildProcessImport) {
        return false;
    }
    // These functions are always from child_process when that module is imported
    return /\b(spawn|spawnSync|execSync|execFile|execFileSync)\s*\(/.test(lineContent);
}
//# sourceMappingURL=child-process.js.map