ubon/dist/scanners/iac-scanner.js

Security scanner for AI-generated React/Next.js and Python apps. Catches hardcoded secrets, accessibility issues, and vulnerabilities that traditional linters miss.

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.IacScanner = void 0;
const glob_1 = require("glob");
const fs_1 = require("fs");
const rules_1 = require("../types/rules");
class IacScanner {
    constructor() {
        this.name = 'IaC Scanner';
    }
    async scan(options) {
        const results = [];
        // Dockerfile checks
        const dockerFiles = await (0, glob_1.glob)('**/Dockerfile', { cwd: options.directory, ignore: ['node_modules/**', 'dist/**', 'build/**', 'examples/**'] });
        for (const file of dockerFiles) {
            try {
                const content = (0, fs_1.readFileSync)(`${options.directory}/${file}`, 'utf-8');
                const lines = content.split('\n');
                for (let i = 0; i < lines.length; i++) {
                    const line = lines[i];
                    if (/apt-get\s+update.*apt-get\s+install/i.test(line) && !/rm\s+-rf\s+\/var\/lib\/apt\/lists\//i.test(content)) {
                        const meta = rules_1.RULES.DOCKER004;
                        results.push({
                            type: 'warning',
                            category: meta.category,
                            message: meta.message,
                            file,
                            line: i + 1,
                            range: { startLine: i + 1, startColumn: 1, endLine: i + 1, endColumn: Math.max(1, line.length) },
                            severity: meta.severity,
                            ruleId: meta.id,
                            confidence: 0.8,
                            fix: meta.fix
                        });
                    }
                }
            }
            catch { }
        }
        // GitHub Actions workflows
        const ghaFiles = await (0, glob_1.glob)('.github/workflows/**/*.y?(a)ml', { cwd: options.directory, ignore: ['node_modules/**', 'dist/**', 'build/**', 'examples/**'] });
        for (const file of ghaFiles) {
            try {
                const content = (0, fs_1.readFileSync)(`${options.directory}/${file}`, 'utf-8');
                const lines = content.split('\n');
                for (let i = 0; i < lines.length; i++) {
                    const line = lines[i];
                    if (/\becho\s+\$\{\{\s*secrets\.[^}]+\}\}/i.test(line)) {
                        const meta = rules_1.RULES.GHA001;
                        results.push({
                            type: 'error',
                            category: meta.category,
                            message: meta.message,
                            file,
                            line: i + 1,
                            range: { startLine: i + 1, startColumn: 1, endLine: i + 1, endColumn: Math.max(1, line.length) },
                            severity: meta.severity,
                            ruleId: meta.id,
                            confidence: 0.9,
                            fix: meta.fix
                        });
                    }
                }
            }
            catch { }
        }
        return results;
    }
}
exports.IacScanner = IacScanner;