ubon/dist/scanners/internal-crawler.js

Security scanner for AI-generated React/Next.js and Python apps. Catches hardcoded secrets, accessibility issues, and vulnerabilities that traditional linters miss.

"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.InternalCrawler = void 0;
const rules_1 = require("../types/rules");
class InternalCrawler {
    constructor() {
        this.name = 'Internal Crawler';
    }
    async scan(options) {
        const results = [];
        if (!options.crawlInternal)
            return results;
        let puppeteer;
        try {
            puppeteer = await Promise.resolve().then(() => __importStar(require('puppeteer')));
        }
        catch {
            // Not installed; advise
            const meta = rules_1.RULES.LINK001;
            results.push({ type: 'info', category: meta.category, message: meta.message, ruleId: meta.id, severity: meta.severity, fix: meta.fix, confidence: 0.6 });
            return results;
        }
        const startUrl = options.crawlStartUrl || `http://localhost:${options.port || 3000}`;
        const maxDepth = options.crawlDepth ?? 2;
        const timeout = options.crawlTimeoutMs ?? 10000;
        const seen = new Set();
        const queue = [{ url: startUrl, depth: 0 }];
        const browser = await puppeteer.launch({ headless: 'new' });
        try {
            while (queue.length > 0) {
                const { url, depth } = queue.shift();
                if (seen.has(url) || depth > maxDepth)
                    continue;
                seen.add(url);
                const page = await browser.newPage();
                try {
                    page.setDefaultNavigationTimeout(timeout);
                    const resp = await page.goto(url, { waitUntil: 'domcontentloaded', timeout });
                    const status = resp?.status() ?? 0;
                    if (status >= 400 || status === 0) {
                        const meta = rules_1.RULES.LINK003;
                        results.push({
                            type: meta.severity === 'high' ? 'error' : 'warning',
                            category: meta.category,
                            message: `${meta.message}: ${url} (${status || 'timeout'})`,
                            severity: meta.severity,
                            ruleId: meta.id,
                            confidence: 0.8
                        });
                    }
                    // collect same-origin links
                    const anchors = await page.$$eval('a[href]', (els) => els.map((a) => a.getAttribute('href')));
                    for (const href of anchors) {
                        if (!href)
                            continue;
                        try {
                            const next = new URL(href, url);
                            const start = new URL(startUrl);
                            if (next.origin === start.origin)
                                queue.push({ url: next.href, depth: depth + 1 });
                        }
                        catch { }
                    }
                }
                catch {
                    const meta = rules_1.RULES.LINK003;
                    results.push({ type: 'warning', category: meta.category, message: `${meta.message}: ${url} (navigation error)`, severity: meta.severity, ruleId: meta.id, confidence: 0.7 });
                }
                finally {
                    await page.close().catch(() => { });
                }
            }
        }
        finally {
            await browser.close().catch(() => { });
        }
        return results;
    }
}
exports.InternalCrawler = InternalCrawler;