ubon
Version:
Security scanner for AI-generated apps (Cursor, Lovable, Windsurf, v0). Catches hardcoded secrets, prompt injection, hallucinated imports, Server Actions / Edge runtime mistakes, and the vibe-coded vulnerabilities traditional linters miss.
141 lines • 6.39 kB
JavaScript
;
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
var ownKeys = function(o) {
ownKeys = Object.getOwnPropertyNames || function (o) {
var ar = [];
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
return ar;
};
return ownKeys(o);
};
return function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
__setModuleDefault(result, mod);
return result;
};
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.InternalCrawler = void 0;
const rules_1 = require("../rules");
class InternalCrawler {
name = 'Internal Crawler';
async scan(options) {
const results = [];
if (!options.crawlInternal)
return results;
let puppeteer;
try {
// Loaded dynamically with a string-built specifier so TypeScript does
// not require puppeteer's types to be installed (it's an optional,
// user-provided dep — see package.json optionalDependencies docs).
const mod = 'puppeteer';
puppeteer = await Promise.resolve(`${mod}`).then(s => __importStar(require(s)));
}
catch {
// Not installed; advise
const meta = rules_1.RULES.LINK001;
results.push({ type: 'info', category: meta.category, message: meta.message, ruleId: meta.id, severity: meta.severity, fix: meta.fix, confidence: 0.6 });
return results;
}
const startUrl = options.crawlStartUrl || `http://localhost:${options.port || 3000}`;
// SSRF guard: when invoked from CI on untrusted code we must not let a
// malicious config drive the headless browser at an arbitrary URL.
// Allow loopback only by default; remote crawl requires the explicit
// UBON_ALLOW_REMOTE_CRAWL=1 escape hatch (deliberately undocumented in
// CLI help to keep the safe path obvious).
try {
const u = new URL(startUrl);
const isLocal = ['localhost', '127.0.0.1', '::1', '[::1]'].includes(u.hostname);
if (!isLocal && process.env.UBON_ALLOW_REMOTE_CRAWL !== '1') {
const meta = rules_1.RULES.LINK001;
results.push({
type: 'info',
category: meta.category,
message: `Refusing to crawl non-loopback URL ${u.origin}. Set UBON_ALLOW_REMOTE_CRAWL=1 to override.`,
ruleId: meta.id,
severity: meta.severity,
fix: 'Use a localhost dev server URL, or explicitly opt in with UBON_ALLOW_REMOTE_CRAWL=1.',
confidence: 1.0,
});
return results;
}
}
catch {
return results;
}
const maxDepth = options.crawlDepth ?? 2;
const timeout = options.crawlTimeoutMs ?? 10000;
const seen = new Set();
const queue = [{ url: startUrl, depth: 0 }];
const browser = await puppeteer.launch({ headless: 'new' });
try {
while (queue.length > 0) {
const { url, depth } = queue.shift();
if (seen.has(url) || depth > maxDepth)
continue;
seen.add(url);
const page = await browser.newPage();
try {
page.setDefaultNavigationTimeout(timeout);
const resp = await page.goto(url, { waitUntil: 'domcontentloaded', timeout });
const status = resp?.status() ?? 0;
if (status >= 400 || status === 0) {
const meta = rules_1.RULES.LINK003;
results.push({
type: meta.severity === 'high' ? 'error' : 'warning',
category: meta.category,
message: `${meta.message}: ${url} (${status || 'timeout'})`,
severity: meta.severity,
ruleId: meta.id,
confidence: 0.8
});
}
// collect same-origin links
const anchors = await page.$$eval('a[href]', (els) => els.map((a) => a.getAttribute('href')));
for (const href of anchors) {
if (!href)
continue;
try {
const next = new URL(href, url);
const start = new URL(startUrl);
if (next.origin === start.origin)
queue.push({ url: next.href, depth: depth + 1 });
}
catch { }
}
}
catch {
const meta = rules_1.RULES.LINK003;
results.push({ type: 'warning', category: meta.category, message: `${meta.message}: ${url} (navigation error)`, severity: meta.severity, ruleId: meta.id, confidence: 0.7 });
}
finally {
await page.close().catch(() => { });
}
}
}
finally {
await browser.close().catch(() => { });
}
return results;
}
}
exports.InternalCrawler = InternalCrawler;
//# sourceMappingURL=internal-crawler.js.map