CodeSentry by Afshan

CodeSentry by Afshan Qasim

CodeSentry is an enterprise-grade Static Application Security Testing (SAST) and neuro-symbolic vulnerability detection engine built for JavaScript, TypeScript, and Node.js.

Combining 70+ deterministic Abstract Syntax Tree (AST) & taint-analysis detectors with a deep learning bidirectional sequence network, CodeSentry performs sub-second in-editor security audits, flagging vulnerabilities with exact line numbers, snippets, and actionable code fixes.

Complete Vulnerability Detection Coverage

CodeSentry detects and flags major OWASP Top 10 and CWE security flaws across full-stack JavaScript and TypeScript applications:

1. Prototype Pollution (CWE-1321)

• Recursive object merge and deep clone poisoning
• Unsanitized __proto__ and constructor.prototype property assignments
• Path-based property injection across dynamic object payloads

2. Injection Flaws

• SQL Injection (CWE-89): Unparameterized queries, string concatenations, and raw query executions in MySQL, PostgreSQL, SQLite, and database drivers.
• NoSQL Injection (CWE-943): Unsanitized query operators, $where clause injections, and object-based selector manipulations in MongoDB and DocumentDB.
• OS Command Injection (CWE-78): User-controlled input flowing into child process sinks (exec, execSync, spawn with shell flag enabled).
• Code Injection / Dynamic Evaluation (CWE-94): Direct use of eval(), new Function(), setTimeout(string), and dynamic vm context executions.

3. Client-Side & DOM Exploits

• DOM-Based & Reflected XSS (CWE-79): Unsafe assignment of user input to dangerous DOM sinks (innerHTML, outerHTML, document.write()).
• Dangerous URL Schemes: Injection of javascript:, data:, or vbscript: URI protocols into anchor links and navigation handlers.
• Open Redirection (CWE-601): Unvalidated redirects allowing attacker-controlled destination routing.

4. Network & Server-Side Vulnerabilities

• Server-Side Request Forgery (SSRF - CWE-918): Unrestricted HTTP requests via fetch(), axios.get(), or http.request() using unvalidated user URLs.
• Path Traversal / Arbitrary File Read (CWE-22): Directory traversal attacks via unsanitized paths in fs.readFile(), fs.createReadStream(), and file uploads.
• Insecure Deserialization (CWE-502): Unsafe object deserialization through packages like node-serialize or unvalidated YAML loading.

5. Secrets, Authentication & Cryptography

• Hardcoded Secrets & Credentials (CWE-798): Database passwords, JWT signing keys, private API keys, and access tokens hardcoded in source files.
• Weak Cryptography (CWE-327 / CWE-328): Use of broken hashing algorithms (MD5, SHA-1) for sensitive data, static initialization vectors (IVs), and insecure random generators.
• Insecure Session Configuration (CWE-384): Cookies missing HttpOnly, Secure, or SameSite flags.

6. Denial of Service (DoS)

• Regular Expression Denial of Service (ReDoS - CWE-1333): Catastrophic backtracking patterns, nested quantifiers like (a+)+, and unanchored dynamic regex constructs.
• Uncontrolled Resource Allocation: Unbounded loops and missing size limits on incoming request payloads.

7. Modern Framework & Misconfiguration Security

• React: Unescaped content passed into dangerouslySetInnerHTML.
• Vue.js: Unsanitized data binding in v-html directives.
• Angular: Unsafe bypasses of sanitizer routines (bypassSecurityTrustHtml, bypassSecurityTrustScript).
• Express.js: Applications running without Helmet.js security headers (CWE-693) or permissive CORS wildcards.

Live Audit Example

When scanning a vulnerable backend route:

// Example: Vulnerable Express Route
const { exec } = require("child_process");
const mysql = require("mysql");

app.get("/api/user", (req, res) => {
    // Flagged: SQL Injection (CWE-89)
    const sql = "SELECT * FROM users WHERE id = '" + req.query.id + "'";
    db.query(sql);

    // Flagged: Command Injection (CWE-78)
    exec("ping -c 1 " + req.query.host, (err, out) => res.send(out));
});

CodeSentry immediately opens an in-editor report:

[CRITICAL] Command Injection (CWE-78) - Line 10
Confidence:  99%
Detector:    CodeSentry Hybrid
Vulnerable:  exec("ping -c 1 " + req.query.host, ...)
Remediation: Use execFile() with fixed executable and argument array. Never pass user input to exec.

How to Use

1. Open any JavaScript (.js) or TypeScript (.ts, .tsx) file in VS Code.
2. Run a scan via either method:
   • Scan Selected Code: Highlight any function or code block, right-click, and select CodeSentry: Scan Selected Code.
   • Scan Entire File: Open the Command Palette (Ctrl + Shift + P or Cmd + Shift + P) and run CodeSentry: Scan Entire File.
3. A dark-mode Security Audit Report will open beside your editor displaying all detected issues, line numbers, snippets, and recommended fixes.

Privacy & Security Architecture

• Zero Local Dependencies: Requires no Python setup, no Docker containers, and no background CLI daemons.
• Transient In-Memory Analysis: Code snippets sent to the analysis gateway are processed in memory and are never stored on disk, logged, or used for model training.
• Enterprise Configurable: On-premise teams can point the extension to a private gateway via codesentry.apiUrl.

Author: Afshan Qasim