ubon/dist/scanners/git-history-scanner.js

Security scanner for AI-generated React/Next.js and Python apps. Catches hardcoded secrets, accessibility issues, and vulnerabilities that traditional linters miss.

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.GitHistoryScanner = void 0;
const git_1 = require("../utils/git");
const child_process_1 = require("child_process");
const rules_1 = require("../types/rules");
const entropy_1 = require("../utils/entropy");
class GitHistoryScanner {
    constructor() {
        this.name = 'Git History Scanner';
    }
    async scan(options) {
        const results = [];
        const depth = Math.max(1, options.gitHistoryDepth || 0);
        if (!depth)
            return results;
        const commits = (0, git_1.getRecentCommitHashes)(depth, options.directory);
        for (const commit of commits) {
            let diff = '';
            try {
                diff = (0, child_process_1.execSync)(`git show ${commit} --unified=0`, { cwd: options.directory, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
            }
            catch {
                continue;
            }
            const lines = diff.split('\n');
            for (let i = 0; i < lines.length; i++) {
                const line = lines[i];
                if (!line.startsWith('+') || line.startsWith('+++'))
                    continue; // only added lines
                const content = line.slice(1);
                // simple secret regexes
                const patterns = [
                    /(sk-[A-Za-z0-9_-]{16,})/g,
                    /(AKIA[0-9A-Z]{16})/g,
                    /(gh[pousr]_[A-Za-z0-9_]{24,})/g,
                    /(eyJ[A-Za-z0-9_.-]{20,}\.[A-Za-z0-9_.-]{10,}\.[A-Za-z0-9_.-]{10,})/g
                ];
                let matched = false;
                for (const re of patterns) {
                    const m = content.match(re);
                    if (m) {
                        matched = true;
                        const meta = rules_1.RULES.SEC001;
                        results.push({
                            type: 'error',
                            category: meta.category,
                            message: `Potential secret in commit ${commit.slice(0, 7)}`,
                            severity: 'high',
                            ruleId: meta.id,
                            match: m[0].slice(0, 200),
                            confidence: 0.9
                        });
                    }
                }
                if (!matched) {
                    // entropy heuristic
                    const tokenMatch = content.match(/['"][A-Za-z0-9+/_=-]{16,}['"]/);
                    if (tokenMatch) {
                        const tok = tokenMatch[0].slice(1, -1);
                        const ent = (0, entropy_1.shannonEntropy)(tok);
                        if (ent >= 3.5) {
                            const meta = rules_1.RULES.SEC018;
                            results.push({
                                type: 'warning',
                                category: meta.category,
                                message: `High-entropy string added in ${commit.slice(0, 7)}`,
                                severity: 'high',
                                ruleId: meta.id,
                                match: tok.slice(0, 200),
                                confidence: 0.7
                            });
                        }
                    }
                }
            }
        }
        return results;
    }
}
exports.GitHistoryScanner = GitHistoryScanner;