/**
 * Fix suggestions for audit findings.
 *
 * Maps pattern IDs to human-readable remediation advice.
 */
/** Fix suggestion lookup by pattern ID */
export const FIX_SUGGESTIONS = {
    // --- Original SCAN_PATTERNS (37) ---
    "CI-001": "Replace exec() with execFile() or spawn() with explicit argument arrays to prevent command injection",
    "CI-002": "Ensure spawn() arguments are not user-controlled; use argument arrays instead of shell strings",
    "CI-003": "Replace system() with safer subprocess APIs that don't invoke a shell",
    "CI-004": "Avoid embedding shell paths in strings; use Node.js APIs or explicit command arrays",
    "CI-005": "Use execFile/spawn instead of execSync/spawnSync when possible; never pass unsanitized input",
    "CI-006": "Avoid shell pipe operators in exec calls; use separate process pipelines",
    "CI-007": "Never interpolate user input into exec() template strings; use execFile with argument arrays",
    "CI-008": "Never pipe curl/wget output directly to a shell; download to a file first, verify its integrity, then execute",
    "DE-001": "Validate and allowlist URLs before making fetch requests; avoid dynamic URL construction",
    "DE-002": "Replace XMLHttpRequest with fetch() and apply URL allowlisting",
    "DE-003": "Validate WebSocket connection URLs against an allowlist",
    "DE-004": "Avoid encoding data into DNS lookups; review data flow for exfiltration",
    "DE-005": "Review base64 encoding patterns for data exfiltration; ensure data isn't being sent externally",
    "PE-001": "Remove sudo invocations; run the required commands with appropriate user permissions",
    "PE-002": "Avoid chmod in application code; set permissions during deployment instead",
    "PE-003": "Avoid chown in application code; configure ownership during deployment",
    "PE-004": "Never use setuid/setgid in application code; run with least privilege",
    "PE-005": "Remove process.setuid/setgid calls; use proper OS-level privilege management",
    "CT-001": "Use environment variables or a secrets manager instead of reading .env files at runtime",
    "CT-002": "Never access SSH keys from application code; use a key management service",
    "CT-003": "Use IAM roles or a secrets manager instead of directly accessing AWS credential files",
    "CT-004": "Never access the system keychain from application code; use a proper secrets API",
    "CT-005": "Access environment variables by specific name, not dynamically; use a config loader",
    "CT-006": "Never hardcode secrets; use environment variables or a secrets manager",
    "PI-001": "Never allow user input to override system prompts; use input validation and sandboxing",
    "PI-002": "Filter and validate all input before passing to AI models; implement prompt guardrails",
    "PI-003": "Validate AI model inputs to prevent role impersonation attacks",
    "PI-004": "Sanitize input to remove instruction boundary markers; use structured prompting",
    "FS-001": "Avoid recursive delete operations; use targeted file removal with path validation",
    "FS-002": "Never write to system paths from application code; use application-specific directories",
    "FS-003": "Validate and normalize file paths; reject paths containing '..'",
    "FS-004": "Validate symlink targets before creation; use realpath() to resolve paths",
    "NA-001": "Validate and allowlist URLs for curl/wget; use application-level HTTP clients instead",
    "NA-002": "Remove reverse shell patterns; this is a critical security vulnerability",
    "NA-003": "Avoid constructing URLs from variables; use allowlisted base URLs with parameterized paths",
    "CE-001": "Replace eval() with JSON.parse() for data or Function constructor for code; never eval user input",
    "CE-002": "Avoid new Function(); use explicit function definitions instead",
    "CE-003": "Avoid dynamic imports with user-controlled paths; use a module allowlist",
    // --- DCI-abuse patterns ---
    "DCI-001": "Remove DCI blocks that read credential files (~/.ssh/, ~/.aws/, .env); use a secrets manager instead",
    "DCI-002": "Remove DCI blocks that write to agent config files (CLAUDE.md, .claude/); legitimate skills do not modify agent configuration",
    "DCI-003": "Remove DCI blocks that make network calls (curl, wget); DCI blocks should not perform outbound network requests",
    "DCI-004": "Remove DCI blocks that use base64 decoding; this is a common obfuscation technique for hiding malicious payloads",
    "DCI-005": "Remove DCI blocks that pipe downloads to shell (curl|sh); download and verify files separately before execution",
    "DCI-006": "Remove DCI blocks that use eval or source; these execute arbitrary code and can be exploited",
    "DCI-007": "Remove DCI blocks that use hex/octal escape sequences; this is an obfuscation technique to hide malicious intent",
    "DCI-008": "Remove DCI blocks that use netcat (nc); reverse shells and network listeners are critical security threats",
    "DCI-009": "Remove DCI blocks that read sensitive directories (.gnupg/, .docker/); these contain private keys and credentials",
    "DCI-010": "Remove DCI blocks that write to .specweave/ directories; legitimate skills do not modify framework configuration",
    "DCI-011": "Remove DCI blocks that write to AGENTS.md; legitimate skills do not modify agent instruction files",
    "DCI-012": "Remove DCI blocks that post data externally (curl -d, curl --data); this is a data exfiltration technique",
    "DCI-013": "Remove DCI blocks that modify file permissions (chmod); DCI blocks should not alter system permissions",
    "DCI-014": "Remove DCI blocks that access .kube/config; Kubernetes credentials should be managed through a secrets manager",
    // --- Project-specific AUDIT_PATTERNS ---
    "SQLI-001": "Use parameterized queries or prepared statements instead of string concatenation in SQL",
    "SQLI-002": "Use parameterized queries; never use template literals for SQL with user input",
    "SQLI-003": "Use query parameters (?) or named parameters (:name) instead of string interpolation",
    "SSRF-001": "Validate URLs against an allowlist of trusted domains before making requests",
    "SSRF-002": "Never pass request parameters directly to HTTP clients; validate and sanitize URLs",
    "BAC-001": "Add authentication middleware to all non-public route handlers",
    "BAC-002": "Verify resource ownership by comparing request user ID with resource owner ID",
    "HS-001": "Move API keys to environment variables or a secrets manager; never hardcode in source",
    "HS-002": "Remove private keys from source code; use a key management service or environment variables",
    "HS-003": "Move passwords to environment variables or a secrets manager; use bcrypt/argon2 for hashing",
    "HS-004": "Remove cloud credentials from source code; use IAM roles or environment-based configuration",
    "XSS-001": "Use textContent instead of innerHTML; if HTML is needed, sanitize with DOMPurify",
    "XSS-002": "Ensure content passed to dangerouslySetInnerHTML is sanitized with DOMPurify or similar",
    "XSS-003": "Replace document.write() with DOM manipulation methods (createElement, appendChild)",
    "OR-001": "Validate redirect URLs against an allowlist of trusted paths/domains",
    "OR-002": "Only set Location header from a predefined list of valid redirect targets",
    "ID-001": "Use yaml.safeLoad() or yaml.load() with SAFE_SCHEMA instead of yaml.load()",
    "ID-002": "Replace pickle with JSON or another safe serialization format; never deserialize untrusted data",
    "ID-003": "Validate parsed JSON against a schema (Zod, Joi, or ajv) before using it",
    "WC-001": "Replace MD5 with SHA-256 or SHA-3 for cryptographic hashing",
    "WC-002": "Replace SHA-1 with SHA-256 or SHA-3; SHA-1 is deprecated for security use",
};
/**
 * Attach fix suggestions to findings based on their ruleId.
 * Only attaches when fix=true.
 */
export function attachFixSuggestions(findings, fix) {
    if (!fix)
        return findings;
    return findings.map((f) => {
        const suggestion = FIX_SUGGESTIONS[f.ruleId];
        if (suggestion) {
            return { ...f, suggestedFix: suggestion };
        }
        return f;
    });
}
//# sourceMappingURL=fix-suggestions.js.map