// engine/auditor-security/security-checks.ts — Security and XSS checks
export function checkSecurity(file, content, lines) {
    const findings = [];
    for (let i = 0; i < lines.length; i++) {
        const line = lines[i];
        /* v8 ignore next 2 */
        if (line === undefined) {
            continue;
        }
        if (/(?:api[_-]?key|secret|token|password|private[_-]?key)\s*[:=]\s*["'][^"']{8,}["']/i.exec(line)) {
            if (!/(?:your[-_]|example|placeholder|xxx|change[-_]me|TODO)/i.exec(line)) {
                findings.push({
                    file,
                    line: i + 1,
                    category: 'security',
                    severity: 'critical',
                    rule: 'hardcoded-secret',
                    message: 'Possible hardcoded secret or API key detected.',
                    suggestion: 'Move to environment variables. Never commit secrets to source control.',
                    reference: 'OWASP: Sensitive Data Exposure',
                });
            }
        }
        if (/(?:query|execute|raw)\s*\(\s*[`"'].*\$\{|.*\+\s*\w+.*(?:WHERE|INSERT|UPDATE|DELETE)/i.exec(line)) {
            findings.push({
                file,
                line: i + 1,
                category: 'security',
                severity: 'critical',
                rule: 'sql-injection-risk',
                message: 'Potential SQL injection: string interpolation in query detected.',
                suggestion: 'Use parameterized queries or prepared statements.',
                reference: 'OWASP: SQL Injection',
            });
        }
        if (/\beval\s*\(/.exec(line)) {
            findings.push({
                file,
                line: i + 1,
                category: 'security',
                severity: 'critical',
                rule: 'no-eval',
                message: 'eval() is extremely dangerous and enables code injection attacks.',
                suggestion: 'Find an alternative approach. eval() should almost never be used.',
                reference: 'OWASP: Code Injection',
            });
        }
        if (/\.innerHTML\s*=|dangerouslySetInnerHTML/.exec(line)) {
            findings.push({
                file,
                line: i + 1,
                category: 'security',
                severity: 'error',
                rule: 'xss-risk',
                message: 'Direct HTML insertion creates XSS vulnerability risk.',
                suggestion: 'Sanitize content before insertion, or use safe APIs (textContent, DOM methods).',
                reference: 'OWASP: Cross-Site Scripting (XSS)',
            });
        }
    }
    if (/(?:cors|access-control-allow-origin)\s*[:=]\s*['"]\*['"]/i.exec(content)) {
        findings.push({
            file,
            category: 'security',
            severity: 'warning',
            rule: 'cors-wildcard',
            message: 'CORS is configured with wildcard (*) origin.',
            suggestion: 'Restrict CORS to specific allowed origins in production.',
            reference: 'OWASP: Security Misconfiguration',
        });
    }
    // SPEC-045 TD-P14-02: Detect hardcoded system prompts with sensitive content
    findings.push(...checkHardcodedSystemPrompts(file, content));
    return findings;
}
/**
 * Detect hardcoded system prompts that contain sensitive indicators.
 * A prompt pattern + sensitive content = HIGH security finding (OWASP LLM07 2025).
 */
export function checkHardcodedSystemPrompts(file, content) {
    const findings = [];
    // Patterns that indicate a hardcoded system prompt
    const systemPromptPatterns = [
        /you\s+are\s+a\s+helpful\s+assistant/i,
        /SYSTEM_PROMPT\s*=\s*[`"']{1,3}/,
        /system_prompt\s*=\s*["']/i,
        /systemPrompt\s*[:=]\s*[`"']/,
        /system\s*:\s*["'`][\s\S]{20,}/,
    ];
    // Sensitive content indicators within prompts
    const sensitiveIndicators = [/\/etc\//, /sk-[A-Za-z0-9]{10,}/, /Bearer\s+[A-Za-z0-9._-]{10,}/];
    const hasPromptPattern = systemPromptPatterns.some((p) => p.test(content));
    if (!hasPromptPattern) {
        return findings;
    }
    const hasSensitiveContent = sensitiveIndicators.some((p) => p.test(content));
    if (hasSensitiveContent) {
        findings.push({
            file,
            category: 'security',
            severity: 'error',
            rule: 'hardcoded-system-prompt-with-secrets',
            message: 'Hardcoded system prompt contains sensitive content (paths, tokens, or credentials). ' +
                'System prompts are extractable by adversarial users (OWASP LLM07 2025).',
            suggestion: 'Load sensitive content dynamically from a secrets manager at runtime. ' +
                'System prompts should contain only behavioral instructions.',
            reference: 'OWASP LLM07 2025: System Prompt Leakage',
        });
    }
    else {
        // Report as warning: hardcoded prompt without secrets is still a maintenance concern.
        // Prompts should be versioned/configurable, not embedded in source code.
        findings.push({
            file,
            category: 'security',
            severity: 'warning',
            rule: 'hardcoded-system-prompt',
            message: 'Hardcoded system prompt detected. Prompt engineering logic embedded in source code ' +
                'is hard to iterate on and may leak behavioral instructions to adversarial users.',
            suggestion: 'Load system prompts from a config file, environment variable, or prompt registry. ' +
                'This allows prompt updates without code deploys and enables versioning.',
            reference: 'OWASP LLM07 2025: System Prompt Leakage',
        });
    }
    return findings;
}
//# sourceMappingURL=security-checks.js.map