// engine/auditor-security/electron-checks.ts — Electron-specific security checks (SPEC-014b)
function isElectronMainOrPreload(file, content) {
    const isMainProcess = file.includes('main.ts') ||
        file.includes('main.js') ||
        file.includes('preload.ts') ||
        file.includes('preload.js');
    return isMainProcess || content.includes('BrowserWindow') || content.includes('contextBridge');
}
/**
 * Check Electron-specific security configurations in BrowserWindow creation.
 * Verifies: contextIsolation, nodeIntegration, sandbox, CSP, eval usage.
 */
export function checkElectronSecurity(file, content, lines) {
    const findings = [];
    if (!isElectronMainOrPreload(file, content)) {
        return findings;
    }
    if (/contextIsolation\s*:\s*false/.exec(content)) {
        findings.push({
            file,
            category: 'security',
            severity: 'critical',
            rule: 'electron-context-isolation-disabled',
            message: 'contextIsolation: false disables renderer process isolation. This is a critical security vulnerability.',
            suggestion: 'Set contextIsolation: true (default in Electron 12+). Use contextBridge.exposeInMainWorld() for IPC.',
            reference: 'CVE-2022-21718 — Electron contextIsolation bypass',
        });
    }
    if (/nodeIntegration\s*:\s*true/.exec(content)) {
        findings.push({
            file,
            category: 'security',
            severity: 'critical',
            rule: 'electron-node-integration-enabled',
            message: 'nodeIntegration: true allows renderer process full Node.js access. Attackers can execute arbitrary code.',
            suggestion: 'Set nodeIntegration: false. Use contextBridge + ipcRenderer for safe communication.',
            reference: 'GHSA-2r2v-9pf8-6342 — Electron RCE via nodeIntegration',
        });
    }
    if (/webSecurity\s*:\s*false/.exec(content)) {
        findings.push({
            file,
            category: 'security',
            severity: 'critical',
            rule: 'electron-web-security-disabled',
            message: 'webSecurity: false disables CORS and same-origin policy in Electron renderer.',
            suggestion: 'Never set webSecurity: false in production. Fix CORS issues properly instead.',
            reference: 'Electron Security Checklist — webSecurity',
        });
    }
    if (/sandbox\s*:\s*false/.exec(content)) {
        findings.push({
            file,
            category: 'security',
            severity: 'error',
            rule: 'electron-sandbox-disabled',
            message: 'sandbox: false removes the Chromium sandbox from the renderer process.',
            suggestion: 'Keep sandbox: true (default). Combine with contextBridge for safe IPC.',
            reference: 'Electron Security Checklist — Process Sandboxing',
        });
    }
    for (let i = 0; i < lines.length; i++) {
        const line = lines[i];
        /* v8 ignore next 2 */
        if (line === undefined) {
            continue;
        }
        if (/\beval\s*\(/.exec(line) && !file.includes('.test.')) {
            findings.push({
                file,
                line: i + 1,
                category: 'security',
                severity: 'critical',
                rule: 'electron-eval-in-renderer',
                message: 'eval() in Electron renderer enables remote code execution if XSS is present.',
                suggestion: 'Remove all eval() calls. Use JSON.parse() or safer alternatives.',
                reference: 'Electron Security Guideline #2 — Do not enable eval from remote content',
            });
        }
    }
    return findings;
}
//# sourceMappingURL=electron-checks.js.map