// engine/runtime-security/checkers/content-security.ts — SPEC-084 AC-12
// Detects insecure code patterns and unsafe configurations in generated content.
const INSECURE_CODE_PATTERNS = [
    // TypeScript/JavaScript
    { name: 'eval', regex: /\beval\s*\(/g, language: 'typescript' },
    { name: 'innerHTML', regex: /\.innerHTML\s*=/g, language: 'typescript' },
    { name: 'dangerouslySetInnerHTML', regex: /dangerouslySetInnerHTML/g, language: 'typescript' },
    { name: 'document.write', regex: /document\.write\s*\(/g, language: 'typescript' },
    // Python
    { name: 'pickle.loads', regex: /pickle\.loads?\s*\(/g, language: 'python' },
    { name: 'yaml.load-unsafe', regex: /yaml\.load\s*\([^)]*(?!Loader)/g, language: 'python' },
    {
        name: 'subprocess-shell',
        regex: /subprocess\.\w+\([^)]*shell\s*=\s*True/g,
        language: 'python',
    },
    { name: 'exec-python', regex: /\bexec\s*\(\s*[^)]+\)/g, language: 'python' },
    // Go
    { name: 'template-unescaped', regex: /template\.HTML\s*\(/g, language: 'go' },
    {
        name: 'sql-concat',
        regex: /fmt\.Sprintf\s*\(\s*"[^"]*(?:SELECT|INSERT|UPDATE|DELETE)/gi,
        language: 'go',
    },
    { name: 'tls-skip-verify', regex: /InsecureSkipVerify\s*:\s*true/g, language: 'go' },
    // Java
    {
        name: 'sql-concat-java',
        regex: /Statement\s*\.\s*execute(?:Query|Update)\s*\(\s*"[^"]*\+/g,
        language: 'java',
    },
    { name: 'runtime-exec', regex: /Runtime\.getRuntime\(\)\.exec/g, language: 'java' },
    {
        name: 'xml-external-entity',
        regex: /XMLInputFactory|SAXParser(?!.*disallow)/g,
        language: 'java',
    },
    // Ruby
    { name: 'system-ruby', regex: /\bsystem\s*\(/g, language: 'ruby' },
    { name: 'send-ruby', regex: /\.send\s*\(\s*params/g, language: 'ruby' },
    { name: 'constantize', regex: /\.constantize/g, language: 'ruby' },
    // PHP
    { name: 'shell-exec-php', regex: /shell_exec\s*\(/g, language: 'php' },
    { name: 'preg-replace-e', regex: /preg_replace\s*\([^)]*\/e/g, language: 'php' },
    { name: 'extract-php', regex: /\bextract\s*\(\s*\$_/g, language: 'php' },
    // Rust
    { name: 'unsafe-rust', regex: /unsafe\s*\{/g, language: 'rust' },
    { name: 'unwrap-rust', regex: /\.unwrap\(\)/g, language: 'rust' },
    // C#
    { name: 'sql-concat-csharp', regex: /SqlCommand\s*\([^)]*\+/g, language: 'csharp' },
    { name: 'process-start', regex: /Process\.Start\s*\(/g, language: 'csharp' },
    // Swift
    { name: 'force-unwrap', regex: /!\s*\./g, language: 'swift' },
    {
        name: 'nsurlsession-no-ssl',
        regex: /allowsExpiredCertificates|NSAllowsArbitraryLoads/g,
        language: 'swift',
    },
    // Dart
    { name: 'dart-mirrors', regex: /import\s+['"]dart:mirrors['"]/g, language: 'dart' },
];
const INSECURE_CONFIG_PATTERNS = [
    {
        name: 'cors-wildcard',
        regex: /(?:cors|access-control-allow-origin)\s*[:=]\s*['"]\*['"]/gi,
        language: 'config',
    },
    { name: 'debug-production', regex: /debug\s*[:=]\s*(?:true|True|1)/gi, language: 'config' },
    { name: 'node-env-dev', regex: /NODE_ENV\s*[:=]\s*['"]?development['"]?/g, language: 'config' },
    {
        name: 'ssl-disabled',
        regex: /(?:disable_ssl|verify_ssl\s*[:=]\s*false|rejectUnauthorized\s*:\s*false)/gi,
        language: 'config',
    },
];
function checkContent(value, field) {
    const threats = [];
    for (const pattern of [...INSECURE_CODE_PATTERNS, ...INSECURE_CONFIG_PATTERNS]) {
        pattern.regex.lastIndex = 0;
        if (pattern.regex.test(value)) {
            threats.push({
                type: 'content-security',
                severity: 'warning',
                message: `Insecure pattern detected: ${pattern.name} (${pattern.language})`,
                field,
                pattern: pattern.name,
            });
        }
    }
    return threats;
}
export const contentSecurityChecker = {
    type: 'content-security',
    check(_toolName, inputs, _config) {
        const threats = [];
        // Only check content-like fields (not paths, IDs, etc.)
        const contentFields = ['content', 'code', 'template', 'output', 'description', 'body'];
        for (const [key, value] of Object.entries(inputs)) {
            if (typeof value === 'string' && (contentFields.includes(key) || value.length > 200)) {
                threats.push(...checkContent(value, key));
            }
        }
        return threats;
    },
};
//# sourceMappingURL=content-security.js.map