sicua/dist/analyzers/security/detectors/UnvalidatedRedirectDetector.d.ts

A tool for analyzing project structure and dependencies

/**
 * Detector for unvalidated redirects using router.push() and similar methods
 */
import { BaseDetector } from "./BaseDetector";
import { Vulnerability } from "../types/vulnerability.types";
import { ScanResult } from "../../../types";
export declare class UnvalidatedRedirectDetector extends BaseDetector {
    private static readonly REDIRECT_PATTERNS;
    constructor();
    detect(scanResult: ScanResult): Promise<Vulnerability[]>;
    /**
     * Validate if a redirect pattern match is problematic
     */
    private validateRedirectMatch;
    /**
     * AST-based analysis for unvalidated redirects
     */
    private analyzeASTForUnvalidatedRedirects;
    /**
     * Find redirect-related function calls
     */
    private findRedirectCalls;
    /**
     * Find window.location assignments
     */
    private findLocationAssignments;
    /**
     * Check if expression is a location property (window.location, location.href, etc.)
     */
    private isLocationProperty;
    /**
     * Analyze redirect function call
     */
    private analyzeRedirectCall;
    /**
     * Analyze location assignment
     */
    private analyzeLocationAssignment;
    /**
     * Get redirect method name
     */
    private getRedirectMethodName;
    /**
     * Analyze redirect function arguments for user input
     */
    private analyzeRedirectArguments;
    /**
     * Analyze expression for user input sources
     */
    private analyzeExpressionForUserInput;
    /**
     * Extract user input source from property access
     */
    private extractUserInputFromPropertyAccess;
    /**
     * Check if the input source is actually data manipulation rather than user input
     */
    private isDataManipulation;
    /**
     * Assess risk level based on input source
     */
    private assessRiskLevel;
    /**
     * Check if validation exists in context
     */
    private hasValidationInContext;
    private isServerData;
    /**
     * Check if the method call is actually for array/collection operations, not navigation
     */
    private isArrayMethod;
    /**
     * Check if validation exists in the containing function
     */
    private hasValidationInFunction;
    /**
     * Generate security recommendations
     */
    private generateRedirectRecommendations;
    /**
     * Extract function name from AST node context
     */
    private extractFunctionFromAST;
}