feat: VS Code拡張 posimai-guard-ext v0.1.0 を追加
Gemini直接呼び出し（Vercel経由なし）でAIコードセキュリティスキャンを実行。 APIキーはOS keychain（SecretStorage）に安全保存。Claudeオプション対応。 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
parent
6d0df5faae
commit
9e6178791f
|
|
@ -0,0 +1,7 @@
|
||||||
|
.vscode/**
|
||||||
|
node_modules/**
|
||||||
|
src/**
|
||||||
|
tsconfig.json
|
||||||
|
**/*.map
|
||||||
|
**/*.ts
|
||||||
|
!dist/**
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2026 posimai
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
Binary file not shown.
|
After Width: | Height: | Size: 1.1 KiB |
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,83 @@
|
||||||
|
{
|
||||||
|
"name": "posimai-guard",
|
||||||
|
"displayName": "Guard — AIコードセキュリティスキャナー",
|
||||||
|
"description": "AIが生成したコードのセキュリティリスクをワークスペース内で直接検出します",
|
||||||
|
"version": "0.1.0",
|
||||||
|
"publisher": "posimai",
|
||||||
|
"engines": { "vscode": "^1.85.0" },
|
||||||
|
"categories": ["Linters", "Other"],
|
||||||
|
"icon": "media/icon.png",
|
||||||
|
"license": "MIT",
|
||||||
|
"repository": { "type": "git", "url": "https://github.com/posimai/posimai-guard-ext" },
|
||||||
|
"main": "./dist/extension.js",
|
||||||
|
"activationEvents": [],
|
||||||
|
"contributes": {
|
||||||
|
"commands": [
|
||||||
|
{
|
||||||
|
"command": "guard.scanWorkspace",
|
||||||
|
"title": "Guard: ワークスペースをスキャン",
|
||||||
|
"icon": "$(shield)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"command": "guard.scanFile",
|
||||||
|
"title": "Guard: このファイルをスキャン"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"command": "guard.setApiKeys",
|
||||||
|
"title": "Guard: APIキーを設定"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"command": "guard.clearDiagnostics",
|
||||||
|
"title": "Guard: 診断をクリア"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"menus": {
|
||||||
|
"editor/title": [
|
||||||
|
{
|
||||||
|
"command": "guard.scanFile",
|
||||||
|
"group": "navigation"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"commandPalette": [
|
||||||
|
{ "command": "guard.scanWorkspace" },
|
||||||
|
{ "command": "guard.scanFile" },
|
||||||
|
{ "command": "guard.setApiKeys" },
|
||||||
|
{ "command": "guard.clearDiagnostics" }
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"configuration": {
|
||||||
|
"title": "Guard",
|
||||||
|
"properties": {
|
||||||
|
"guard.excludeDirs": {
|
||||||
|
"type": "array",
|
||||||
|
"default": ["node_modules", ".next", ".git", "dist", "build", "out", ".turbo", ".cache", "coverage", "__pycache__", ".venv", "venv"],
|
||||||
|
"description": "スキャンから除外するディレクトリ名"
|
||||||
|
},
|
||||||
|
"guard.maxFiles": {
|
||||||
|
"type": "number",
|
||||||
|
"default": 80,
|
||||||
|
"description": "一度にスキャンする最大ファイル数"
|
||||||
|
},
|
||||||
|
"guard.model": {
|
||||||
|
"type": "string",
|
||||||
|
"enum": ["gemini", "claude", "both"],
|
||||||
|
"default": "gemini",
|
||||||
|
"description": "使用するAIモデル（bothは両方使って精度向上）"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"scripts": {
|
||||||
|
"build": "esbuild src/extension.ts --bundle --outfile=dist/extension.js --external:vscode --platform=node --target=node18 --sourcemap",
|
||||||
|
"watch": "npm run build -- --watch",
|
||||||
|
"package": "vsce package --no-dependencies",
|
||||||
|
"vscode:prepublish": "npm run build -- --minify"
|
||||||
|
},
|
||||||
|
"devDependencies": {
|
||||||
|
"@types/node": "^18",
|
||||||
|
"@types/vscode": "^1.85.0",
|
||||||
|
"@vscode/vsce": "^2.24.0",
|
||||||
|
"esbuild": "^0.20.0",
|
||||||
|
"typescript": "^5"
|
||||||
|
}
|
||||||
|
}
|
||||||
Binary file not shown.
|
|
@ -0,0 +1,87 @@
|
||||||
|
import * as vscode from 'vscode';
|
||||||
|
import { readSingleFile } from '../scanner/fileReader';
|
||||||
|
import { scanWithGemini } from '../scanner/geminiClient';
|
||||||
|
import { scanWithClaude } from '../scanner/claudeClient';
|
||||||
|
import { issuesToDiagnostics } from '../ui/diagnostics';
|
||||||
|
import { ResultsPanel } from '../ui/resultsPanel';
|
||||||
|
import { ScanIssue } from '../scanner/prompt';
|
||||||
|
|
||||||
|
export async function scanFile(
|
||||||
|
context: vscode.ExtensionContext,
|
||||||
|
collection: vscode.DiagnosticCollection,
|
||||||
|
): Promise<void> {
|
||||||
|
const editor = vscode.window.activeTextEditor;
|
||||||
|
if (!editor) {
|
||||||
|
vscode.window.showWarningMessage('Guard: アクティブなエディタがありません');
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
const geminiKey = await context.secrets.get('guard.geminiKey');
|
||||||
|
if (!geminiKey) {
|
||||||
|
const action = await vscode.window.showErrorMessage(
|
||||||
|
'Guard: Gemini API キーが未設定です',
|
||||||
|
'APIキーを設定',
|
||||||
|
);
|
||||||
|
if (action === 'APIキーを設定') {
|
||||||
|
await vscode.commands.executeCommand('guard.setApiKeys');
|
||||||
|
}
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
const config = vscode.workspace.getConfiguration('guard');
|
||||||
|
const model: string = config.get('model') ?? 'gemini';
|
||||||
|
|
||||||
|
const files = readSingleFile(editor.document);
|
||||||
|
const fileName = files[0].name;
|
||||||
|
|
||||||
|
await vscode.window.withProgress(
|
||||||
|
{
|
||||||
|
location: vscode.ProgressLocation.Notification,
|
||||||
|
title: `Guard: ${fileName} をスキャン中...`,
|
||||||
|
cancellable: false,
|
||||||
|
},
|
||||||
|
async () => {
|
||||||
|
let issues: ScanIssue[] = [];
|
||||||
|
|
||||||
|
try {
|
||||||
|
issues = await scanWithGemini(files, geminiKey);
|
||||||
|
} catch (err) {
|
||||||
|
vscode.window.showErrorMessage(`Guard: Gemini スキャンに失敗しました: ${String(err)}`);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (model === 'claude' || model === 'both') {
|
||||||
|
const claudeKey = await context.secrets.get('guard.claudeKey');
|
||||||
|
if (claudeKey) {
|
||||||
|
try {
|
||||||
|
const claudeIssues = await scanWithClaude(files, claudeKey);
|
||||||
|
const seen = new Set(issues.map(i => `${i.file}::${i.title}`));
|
||||||
|
for (const ci of claudeIssues) {
|
||||||
|
if (!seen.has(`${ci.file}::${ci.title}`)) {
|
||||||
|
issues.push(ci);
|
||||||
|
seen.add(`${ci.file}::${ci.title}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} catch {
|
||||||
|
// optional
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
issuesToDiagnostics(issues, collection);
|
||||||
|
ResultsPanel.show(context, issues, fileName);
|
||||||
|
|
||||||
|
const danger = issues.filter(i => i.severity === 'danger').length;
|
||||||
|
const warning = issues.filter(i => i.severity === 'warning').length;
|
||||||
|
const msg = `Guard: ${issues.length} 件検出 (危険 ${danger} / 警告 ${warning})`;
|
||||||
|
|
||||||
|
if (danger > 0) {
|
||||||
|
vscode.window.showErrorMessage(msg);
|
||||||
|
} else if (warning > 0) {
|
||||||
|
vscode.window.showWarningMessage(msg);
|
||||||
|
} else {
|
||||||
|
vscode.window.showInformationMessage(msg);
|
||||||
|
}
|
||||||
|
},
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,97 @@
|
||||||
|
import * as vscode from 'vscode';
|
||||||
|
import { readWorkspaceFiles } from '../scanner/fileReader';
|
||||||
|
import { scanWithGemini } from '../scanner/geminiClient';
|
||||||
|
import { scanWithClaude } from '../scanner/claudeClient';
|
||||||
|
import { issuesToDiagnostics } from '../ui/diagnostics';
|
||||||
|
import { ResultsPanel } from '../ui/resultsPanel';
|
||||||
|
import { ScanIssue } from '../scanner/prompt';
|
||||||
|
|
||||||
|
export async function scanWorkspace(
|
||||||
|
context: vscode.ExtensionContext,
|
||||||
|
collection: vscode.DiagnosticCollection,
|
||||||
|
): Promise<void> {
|
||||||
|
const folders = vscode.workspace.workspaceFolders;
|
||||||
|
if (!folders || folders.length === 0) {
|
||||||
|
vscode.window.showWarningMessage('Guard: ワークスペースが開かれていません');
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
const geminiKey = await context.secrets.get('guard.geminiKey');
|
||||||
|
if (!geminiKey) {
|
||||||
|
const action = await vscode.window.showErrorMessage(
|
||||||
|
'Guard: Gemini API キーが未設定です',
|
||||||
|
'APIキーを設定',
|
||||||
|
);
|
||||||
|
if (action === 'APIキーを設定') {
|
||||||
|
await vscode.commands.executeCommand('guard.setApiKeys');
|
||||||
|
}
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
const config = vscode.workspace.getConfiguration('guard');
|
||||||
|
const maxFiles: number = config.get('maxFiles') ?? 80;
|
||||||
|
const model: string = config.get('model') ?? 'gemini';
|
||||||
|
|
||||||
|
await vscode.window.withProgress(
|
||||||
|
{
|
||||||
|
location: vscode.ProgressLocation.Notification,
|
||||||
|
title: 'Guard: スキャン中...',
|
||||||
|
cancellable: false,
|
||||||
|
},
|
||||||
|
async progress => {
|
||||||
|
progress.report({ message: 'ファイルを読み込んでいます...' });
|
||||||
|
const files = readWorkspaceFiles(maxFiles);
|
||||||
|
|
||||||
|
if (files.length === 0) {
|
||||||
|
vscode.window.showInformationMessage('Guard: スキャン対象のファイルが見つかりませんでした');
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
const sourceName = folders[0].name;
|
||||||
|
let issues: ScanIssue[] = [];
|
||||||
|
|
||||||
|
try {
|
||||||
|
progress.report({ message: `Gemini でスキャン中... (${files.length} ファイル)` });
|
||||||
|
issues = await scanWithGemini(files, geminiKey);
|
||||||
|
} catch (err) {
|
||||||
|
vscode.window.showErrorMessage(`Guard: Gemini スキャンに失敗しました: ${String(err)}`);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (model === 'claude' || model === 'both') {
|
||||||
|
const claudeKey = await context.secrets.get('guard.claudeKey');
|
||||||
|
if (claudeKey) {
|
||||||
|
try {
|
||||||
|
progress.report({ message: 'Claude でスキャン中...' });
|
||||||
|
const claudeIssues = await scanWithClaude(files, claudeKey);
|
||||||
|
// Merge: dedup by file + title
|
||||||
|
const seen = new Set(issues.map(i => `${i.file}::${i.title}`));
|
||||||
|
for (const ci of claudeIssues) {
|
||||||
|
if (!seen.has(`${ci.file}::${ci.title}`)) {
|
||||||
|
issues.push(ci);
|
||||||
|
seen.add(`${ci.file}::${ci.title}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} catch {
|
||||||
|
// Claude is optional — silent fail
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
issuesToDiagnostics(issues, collection);
|
||||||
|
ResultsPanel.show(context, issues, sourceName);
|
||||||
|
|
||||||
|
const danger = issues.filter(i => i.severity === 'danger').length;
|
||||||
|
const warning = issues.filter(i => i.severity === 'warning').length;
|
||||||
|
const msg = `Guard: ${issues.length} 件検出 (危険 ${danger} / 警告 ${warning})`;
|
||||||
|
|
||||||
|
if (danger > 0) {
|
||||||
|
vscode.window.showErrorMessage(msg);
|
||||||
|
} else if (warning > 0) {
|
||||||
|
vscode.window.showWarningMessage(msg);
|
||||||
|
} else {
|
||||||
|
vscode.window.showInformationMessage(msg);
|
||||||
|
}
|
||||||
|
},
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,75 @@
|
||||||
|
import * as vscode from 'vscode';
|
||||||
|
import { scanWorkspace } from './commands/scanWorkspace';
|
||||||
|
import { scanFile } from './commands/scanFile';
|
||||||
|
|
||||||
|
let diagnosticCollection: vscode.DiagnosticCollection;
|
||||||
|
|
||||||
|
export function activate(context: vscode.ExtensionContext): void {
|
||||||
|
diagnosticCollection = vscode.languages.createDiagnosticCollection('guard');
|
||||||
|
context.subscriptions.push(diagnosticCollection);
|
||||||
|
|
||||||
|
// Status bar item
|
||||||
|
const statusBar = vscode.window.createStatusBarItem(vscode.StatusBarAlignment.Right, 100);
|
||||||
|
statusBar.text = '$(shield) Guard';
|
||||||
|
statusBar.tooltip = 'Guard: ワークスペースをスキャン';
|
||||||
|
statusBar.command = 'guard.scanWorkspace';
|
||||||
|
statusBar.show();
|
||||||
|
context.subscriptions.push(statusBar);
|
||||||
|
|
||||||
|
// Commands
|
||||||
|
context.subscriptions.push(
|
||||||
|
vscode.commands.registerCommand('guard.scanWorkspace', () =>
|
||||||
|
scanWorkspace(context, diagnosticCollection),
|
||||||
|
),
|
||||||
|
|
||||||
|
vscode.commands.registerCommand('guard.scanFile', () =>
|
||||||
|
scanFile(context, diagnosticCollection),
|
||||||
|
),
|
||||||
|
|
||||||
|
vscode.commands.registerCommand('guard.setApiKeys', async () => {
|
||||||
|
const geminiKey = await vscode.window.showInputBox({
|
||||||
|
title: 'Guard: Gemini API キー',
|
||||||
|
prompt: 'Google AI Studio で取得した Gemini API キーを入力してください',
|
||||||
|
password: true,
|
||||||
|
placeHolder: 'AIza...',
|
||||||
|
ignoreFocusOut: true,
|
||||||
|
});
|
||||||
|
|
||||||
|
if (geminiKey !== undefined) {
|
||||||
|
if (geminiKey.trim()) {
|
||||||
|
await context.secrets.store('guard.geminiKey', geminiKey.trim());
|
||||||
|
vscode.window.showInformationMessage('Guard: Gemini API キーを保存しました');
|
||||||
|
} else {
|
||||||
|
await context.secrets.delete('guard.geminiKey');
|
||||||
|
vscode.window.showInformationMessage('Guard: Gemini API キーを削除しました');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
const claudeKey = await vscode.window.showInputBox({
|
||||||
|
title: 'Guard: Anthropic API キー（任意）',
|
||||||
|
prompt: '設定するとGeminiに加えてClaudeでもスキャンし、見落とし率が下がります（任意）',
|
||||||
|
password: true,
|
||||||
|
placeHolder: 'sk-ant-...',
|
||||||
|
ignoreFocusOut: true,
|
||||||
|
});
|
||||||
|
|
||||||
|
if (claudeKey !== undefined) {
|
||||||
|
if (claudeKey.trim()) {
|
||||||
|
await context.secrets.store('guard.claudeKey', claudeKey.trim());
|
||||||
|
vscode.window.showInformationMessage('Guard: Anthropic API キーを保存しました');
|
||||||
|
} else {
|
||||||
|
await context.secrets.delete('guard.claudeKey');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}),
|
||||||
|
|
||||||
|
vscode.commands.registerCommand('guard.clearDiagnostics', () => {
|
||||||
|
diagnosticCollection.clear();
|
||||||
|
vscode.window.showInformationMessage('Guard: 診断をクリアしました');
|
||||||
|
}),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
export function deactivate(): void {
|
||||||
|
diagnosticCollection?.dispose();
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,56 @@
|
||||||
|
import * as https from 'https';
|
||||||
|
import { SYSTEM_PROMPT, buildFileContext, parseIssues, ScanIssue } from './prompt';
|
||||||
|
|
||||||
|
const MODEL = 'claude-sonnet-4-6';
|
||||||
|
|
||||||
|
function httpsPost(url: string, body: string, headers: Record<string, string>): Promise<string> {
|
||||||
|
return new Promise((resolve, reject) => {
|
||||||
|
const parsed = new URL(url);
|
||||||
|
const options = {
|
||||||
|
hostname: parsed.hostname,
|
||||||
|
path: parsed.pathname + parsed.search,
|
||||||
|
method: 'POST',
|
||||||
|
headers: { 'Content-Type': 'application/json', ...headers },
|
||||||
|
};
|
||||||
|
const req = https.request(options, res => {
|
||||||
|
const chunks: Buffer[] = [];
|
||||||
|
res.on('data', d => chunks.push(d));
|
||||||
|
res.on('end', () => {
|
||||||
|
const text = Buffer.concat(chunks).toString('utf-8');
|
||||||
|
if (res.statusCode === 401) {
|
||||||
|
reject(new Error('INVALID_KEY'));
|
||||||
|
} else if (res.statusCode && res.statusCode >= 400) {
|
||||||
|
reject(new Error(`HTTP ${res.statusCode}: ${text.slice(0, 200)}`));
|
||||||
|
} else {
|
||||||
|
resolve(text);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
});
|
||||||
|
req.on('error', reject);
|
||||||
|
req.write(body);
|
||||||
|
req.end();
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
export async function scanWithClaude(
|
||||||
|
files: { name: string; content: string }[],
|
||||||
|
apiKey: string,
|
||||||
|
): Promise<ScanIssue[]> {
|
||||||
|
const fileContext = buildFileContext(files);
|
||||||
|
|
||||||
|
const body = JSON.stringify({
|
||||||
|
model: MODEL,
|
||||||
|
max_tokens: 4096,
|
||||||
|
system: SYSTEM_PROMPT,
|
||||||
|
messages: [{ role: 'user', content: fileContext }],
|
||||||
|
});
|
||||||
|
|
||||||
|
const raw = await httpsPost('https://api.anthropic.com/v1/messages', body, {
|
||||||
|
'x-api-key': apiKey,
|
||||||
|
'anthropic-version': '2023-06-01',
|
||||||
|
});
|
||||||
|
|
||||||
|
const json = JSON.parse(raw);
|
||||||
|
const text: string = json?.content?.[0]?.text ?? '{"issues":[]}';
|
||||||
|
return parseIssues(text);
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,119 @@
|
||||||
|
import * as vscode from 'vscode';
|
||||||
|
import * as path from 'path';
|
||||||
|
import * as fs from 'fs';
|
||||||
|
|
||||||
|
export type ScannableFile = { name: string; content: string };
|
||||||
|
|
||||||
|
const SCAN_EXTENSIONS = new Set([
|
||||||
|
'.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
|
||||||
|
'.py', '.go', '.rs', '.php', '.rb', '.java', '.kt', '.swift',
|
||||||
|
'.json', '.yaml', '.yml', '.toml', '.env',
|
||||||
|
'.sh', '.bash', '.zsh',
|
||||||
|
'.dockerfile', '.conf', '.nginx',
|
||||||
|
]);
|
||||||
|
|
||||||
|
const EXCLUDE_FILES = new Set([
|
||||||
|
'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lockb',
|
||||||
|
'composer.lock', 'Cargo.lock', 'poetry.lock', 'Pipfile.lock',
|
||||||
|
]);
|
||||||
|
|
||||||
|
const EXACT_NAMES = new Set([
|
||||||
|
'Dockerfile', 'dockerfile', '.gitignore', '.dockerignore',
|
||||||
|
'Makefile', 'Procfile', 'nginx.conf', 'Caddyfile',
|
||||||
|
]);
|
||||||
|
|
||||||
|
const MAX_FILE_SIZE = 100_000;
|
||||||
|
const MAX_BUCKET = 320;
|
||||||
|
|
||||||
|
function shouldInclude(fileName: string): boolean {
|
||||||
|
if (EXCLUDE_FILES.has(fileName)) return false;
|
||||||
|
if (EXACT_NAMES.has(fileName)) return true;
|
||||||
|
if (fileName.startsWith('.env')) return true;
|
||||||
|
if (fileName.startsWith('docker-compose')) return true;
|
||||||
|
const ext = fileName.slice(fileName.lastIndexOf('.')).toLowerCase();
|
||||||
|
return SCAN_EXTENSIONS.has(ext);
|
||||||
|
}
|
||||||
|
|
||||||
|
function scanPriority(relativePath: string): number {
|
||||||
|
const p = relativePath.replace(/\\/g, '/').toLowerCase();
|
||||||
|
if (p.includes('route.ts') || p.includes('route.js')) return 100;
|
||||||
|
if (p.includes('middleware.ts') || p.includes('middleware.js')) return 95;
|
||||||
|
if (p.includes('next.config')) return 92;
|
||||||
|
if (p.includes('/.env') || p.endsWith('.env') || p.includes('.env.')) return 88;
|
||||||
|
if (p.includes('docker-compose') || p.endsWith('/dockerfile')) return 82;
|
||||||
|
if (p.includes('vercel.json')) return 78;
|
||||||
|
if (p.includes('/api/')) return 72;
|
||||||
|
if (p.includes('server.ts') || p.includes('server.js')) return 68;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
function collectFiles(
|
||||||
|
dir: string,
|
||||||
|
root: string,
|
||||||
|
excludeDirs: Set<string>,
|
||||||
|
results: ScannableFile[],
|
||||||
|
): void {
|
||||||
|
if (results.length >= MAX_BUCKET) return;
|
||||||
|
|
||||||
|
let entries: fs.Dirent[];
|
||||||
|
try {
|
||||||
|
entries = fs.readdirSync(dir, { withFileTypes: true });
|
||||||
|
} catch {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
for (const entry of entries) {
|
||||||
|
if (results.length >= MAX_BUCKET) break;
|
||||||
|
|
||||||
|
if (entry.isDirectory()) {
|
||||||
|
if (excludeDirs.has(entry.name)) continue;
|
||||||
|
collectFiles(path.join(dir, entry.name), root, excludeDirs, results);
|
||||||
|
} else if (entry.isFile()) {
|
||||||
|
if (!shouldInclude(entry.name)) continue;
|
||||||
|
const fullPath = path.join(dir, entry.name);
|
||||||
|
try {
|
||||||
|
const stat = fs.statSync(fullPath);
|
||||||
|
if (stat.size > MAX_FILE_SIZE) continue;
|
||||||
|
const content = fs.readFileSync(fullPath, 'utf-8');
|
||||||
|
const relativePath = path.relative(root, fullPath).replace(/\\/g, '/');
|
||||||
|
results.push({ name: relativePath, content });
|
||||||
|
} catch {
|
||||||
|
// skip unreadable files
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
export function readWorkspaceFiles(maxFiles: number): ScannableFile[] {
|
||||||
|
const folders = vscode.workspace.workspaceFolders;
|
||||||
|
if (!folders || folders.length === 0) return [];
|
||||||
|
|
||||||
|
const config = vscode.workspace.getConfiguration('guard');
|
||||||
|
const excludeDirsArr: string[] = config.get('excludeDirs') ?? [
|
||||||
|
'node_modules', '.next', '.git', 'dist', 'build', 'out',
|
||||||
|
'.turbo', '.cache', 'coverage', '__pycache__', '.venv', 'venv',
|
||||||
|
];
|
||||||
|
const excludeDirs = new Set(excludeDirsArr);
|
||||||
|
|
||||||
|
const all: ScannableFile[] = [];
|
||||||
|
for (const folder of folders) {
|
||||||
|
collectFiles(folder.uri.fsPath, folder.uri.fsPath, excludeDirs, all);
|
||||||
|
if (all.length >= MAX_BUCKET) break;
|
||||||
|
}
|
||||||
|
|
||||||
|
const sorted = [...all].sort((a, b) => {
|
||||||
|
const d = scanPriority(b.name) - scanPriority(a.name);
|
||||||
|
return d !== 0 ? d : a.name.localeCompare(b.name);
|
||||||
|
});
|
||||||
|
|
||||||
|
return sorted.slice(0, maxFiles);
|
||||||
|
}
|
||||||
|
|
||||||
|
export function readSingleFile(document: vscode.TextDocument): ScannableFile[] {
|
||||||
|
const folders = vscode.workspace.workspaceFolders;
|
||||||
|
const root = folders?.[0]?.uri.fsPath ?? '';
|
||||||
|
const relativePath = root
|
||||||
|
? path.relative(root, document.uri.fsPath).replace(/\\/g, '/')
|
||||||
|
: path.basename(document.uri.fsPath);
|
||||||
|
return [{ name: relativePath, content: document.getText() }];
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,77 @@
|
||||||
|
import * as https from 'https';
|
||||||
|
import { buildFileContext, parseIssues, ScanIssue } from './prompt';
|
||||||
|
|
||||||
|
const MODEL = 'gemini-2.5-flash';
|
||||||
|
const API_URL = `https://generativelanguage.googleapis.com/v1beta/models/${MODEL}:generateContent`;
|
||||||
|
|
||||||
|
const RESPONSE_SCHEMA = {
|
||||||
|
type: 'object',
|
||||||
|
properties: {
|
||||||
|
issues: {
|
||||||
|
type: 'array',
|
||||||
|
items: {
|
||||||
|
type: 'object',
|
||||||
|
properties: {
|
||||||
|
severity: { type: 'string', enum: ['danger', 'warning', 'info'] },
|
||||||
|
title: { type: 'string' },
|
||||||
|
description: { type: 'string' },
|
||||||
|
file: { type: 'string' },
|
||||||
|
line: { type: 'integer', nullable: true },
|
||||||
|
fix: { type: 'string', nullable: true },
|
||||||
|
},
|
||||||
|
required: ['severity', 'title', 'description', 'file', 'line', 'fix'],
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
required: ['issues'],
|
||||||
|
};
|
||||||
|
|
||||||
|
function httpsPost(url: string, body: string, headers: Record<string, string>): Promise<string> {
|
||||||
|
return new Promise((resolve, reject) => {
|
||||||
|
const parsed = new URL(url);
|
||||||
|
const options = {
|
||||||
|
hostname: parsed.hostname,
|
||||||
|
path: parsed.pathname + parsed.search,
|
||||||
|
method: 'POST',
|
||||||
|
headers: { 'Content-Type': 'application/json', ...headers },
|
||||||
|
};
|
||||||
|
const req = https.request(options, res => {
|
||||||
|
const chunks: Buffer[] = [];
|
||||||
|
res.on('data', d => chunks.push(d));
|
||||||
|
res.on('end', () => {
|
||||||
|
const text = Buffer.concat(chunks).toString('utf-8');
|
||||||
|
if (res.statusCode && res.statusCode >= 400) {
|
||||||
|
reject(new Error(`HTTP ${res.statusCode}: ${text.slice(0, 200)}`));
|
||||||
|
} else {
|
||||||
|
resolve(text);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
});
|
||||||
|
req.on('error', reject);
|
||||||
|
req.write(body);
|
||||||
|
req.end();
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
export async function scanWithGemini(
|
||||||
|
files: { name: string; content: string }[],
|
||||||
|
apiKey: string,
|
||||||
|
): Promise<ScanIssue[]> {
|
||||||
|
const { SYSTEM_PROMPT } = await import('./prompt');
|
||||||
|
const fileContext = buildFileContext(files);
|
||||||
|
|
||||||
|
const body = JSON.stringify({
|
||||||
|
system_instruction: { parts: [{ text: SYSTEM_PROMPT }] },
|
||||||
|
contents: [{ role: 'user', parts: [{ text: fileContext }] }],
|
||||||
|
generationConfig: {
|
||||||
|
responseMimeType: 'application/json',
|
||||||
|
responseSchema: RESPONSE_SCHEMA,
|
||||||
|
temperature: 0.1,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
const raw = await httpsPost(`${API_URL}?key=${apiKey}`, body, {});
|
||||||
|
const json = JSON.parse(raw);
|
||||||
|
const text: string = json?.candidates?.[0]?.content?.parts?.[0]?.text ?? '{"issues":[]}';
|
||||||
|
return parseIssues(text);
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,87 @@
|
||||||
|
export const SYSTEM_PROMPT = `あなたはAI生成コードのセキュリティとコード品質の専門家です。
|
||||||
|
提供されたファイル群を横断的に解析し、AI生成コードに特有のリスク・設定ミス・外部連携の穴を発見してください。
|
||||||
|
|
||||||
|
【A: コード品質・セキュリティ（ソースコード全般）】
|
||||||
|
1. ハードコードされたシークレット（APIキー・パスワード・トークン・認証情報）
|
||||||
|
2. 文字列結合によるSQLインジェクションリスク
|
||||||
|
3. 過度に許可されたCORS（Access-Control-Allow-Origin: * など）
|
||||||
|
4. 認証チェックの欠如・TODOプレースホルダーで認証をスキップしている箇所
|
||||||
|
5. APIエンドポイントのレートリミット未実装
|
||||||
|
6. target="_blank" に rel="noopener" がない
|
||||||
|
7. エラーレスポンスでの情報漏洩（error.message をそのままクライアントに返す等）
|
||||||
|
8. 本番コードにハードコードされた localhost・開発用URL
|
||||||
|
9. 入力バリデーションの欠如（ユーザー入力をSQLや外部APIにそのまま渡す箇所）
|
||||||
|
10. 依存パッケージの問題（package.json: 既知の脆弱バージョン・@latest固定なし）
|
||||||
|
|
||||||
|
【B: 設定ファイル・インフラ（vercel.json / next.config.*）】
|
||||||
|
11. セキュリティヘッダー未設定（X-Frame-Options・X-Content-Type-Options・CSP の欠落）
|
||||||
|
12. next.config.* の危険設定（dangerouslyAllowBrowser・ignoreBuildErrors 等）
|
||||||
|
13. 過度に広い rewrites/redirects
|
||||||
|
|
||||||
|
【C: コンテナ・CI/CD（docker-compose / Dockerfile / .github/workflows）】
|
||||||
|
14. docker-compose.yml の問題（ポートのホスト公開・root実行・hardcodedパスワード）
|
||||||
|
15. Dockerfile のセキュリティ問題（rootで実行・latest タグ）
|
||||||
|
16. GitHub Actions の問題（シークレットのログ出力・過剰な permissions）
|
||||||
|
|
||||||
|
【D: 認証・セッション設計】
|
||||||
|
17. JWT をlocalStorage に保存（XSS リスク）
|
||||||
|
18. セッショントークンの有効期限未設定
|
||||||
|
19. 認証ミドルウェアの保護漏れ
|
||||||
|
20. パスワードを bcrypt/argon2 以外でハッシュ化
|
||||||
|
|
||||||
|
【E: ファイルアップロード・外部リクエスト】
|
||||||
|
21. ファイルアップロードのバリデーション未実施
|
||||||
|
22. アップロードファイルを実行可能ディレクトリに保存
|
||||||
|
23. SSRF: ユーザー指定URLを検証なしでfetch
|
||||||
|
24. XML/SVG/HTMLファイルのアップロード許可
|
||||||
|
|
||||||
|
【F: 環境変数・シークレット管理】
|
||||||
|
25. .env ファイルがリポジトリに含まれている
|
||||||
|
26. NEXT_PUBLIC_ でシークレットを露出
|
||||||
|
27. 本番・開発環境で同一シークレットを使いまわし
|
||||||
|
|
||||||
|
【出力ルール】
|
||||||
|
- コードブロックなし・JSONのみ・余分なテキストなし
|
||||||
|
- severity: danger / warning / info
|
||||||
|
- title: 日本語・25文字以内
|
||||||
|
- description: 120文字以内・何が起きると困るかを明示
|
||||||
|
- fix: 修正後のコードスニペット（15行以内）または具体的な対処法（なければnull）
|
||||||
|
- file: 該当ファイル名
|
||||||
|
- line: 該当行番号（特定できない場合はnull）
|
||||||
|
|
||||||
|
必ず以下の形式で返すこと:
|
||||||
|
{"issues":[{"severity":"danger","title":"...","description":"...","file":"...","line":12,"fix":"..."}]}`;
|
||||||
|
|
||||||
|
const CONFIG_PATTERNS = /\.(ya?ml|toml|json|conf|nginx|dockerfile)$|^Dockerfile$|^docker-compose|^\.env|^\.gitignore|^Caddyfile/i;
|
||||||
|
|
||||||
|
export function buildFileContext(files: { name: string; content: string }[]): string {
|
||||||
|
return files
|
||||||
|
.slice(0, 50)
|
||||||
|
.map(f => {
|
||||||
|
const limit = CONFIG_PATTERNS.test(f.name) ? 6000 : 4000;
|
||||||
|
return `=== ${f.name} ===\n${f.content.slice(0, limit)}`;
|
||||||
|
})
|
||||||
|
.join('\n\n');
|
||||||
|
}
|
||||||
|
|
||||||
|
export function parseIssues(raw: string): ScanIssue[] {
|
||||||
|
try {
|
||||||
|
const cleaned = raw.replace(/^```(?:json)?\n?/, '').replace(/\n?```$/, '').trim();
|
||||||
|
return JSON.parse(cleaned).issues ?? [];
|
||||||
|
} catch {
|
||||||
|
const match = raw.match(/\{[\s\S]*\}/);
|
||||||
|
if (match) {
|
||||||
|
try { return JSON.parse(match[0]).issues ?? []; } catch { return []; }
|
||||||
|
}
|
||||||
|
return [];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
export interface ScanIssue {
|
||||||
|
severity: 'danger' | 'warning' | 'info';
|
||||||
|
title: string;
|
||||||
|
description: string;
|
||||||
|
file: string;
|
||||||
|
line: number | null;
|
||||||
|
fix: string | null;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,47 @@
|
||||||
|
import * as vscode from 'vscode';
|
||||||
|
import * as path from 'path';
|
||||||
|
import { ScanIssue } from '../scanner/prompt';
|
||||||
|
|
||||||
|
export function issuesToDiagnostics(
|
||||||
|
issues: ScanIssue[],
|
||||||
|
collection: vscode.DiagnosticCollection,
|
||||||
|
): void {
|
||||||
|
collection.clear();
|
||||||
|
|
||||||
|
const folders = vscode.workspace.workspaceFolders;
|
||||||
|
const root = folders?.[0]?.uri.fsPath ?? '';
|
||||||
|
|
||||||
|
// Group by file
|
||||||
|
const byFile = new Map<string, ScanIssue[]>();
|
||||||
|
for (const issue of issues) {
|
||||||
|
const key = issue.file;
|
||||||
|
if (!byFile.has(key)) byFile.set(key, []);
|
||||||
|
byFile.get(key)!.push(issue);
|
||||||
|
}
|
||||||
|
|
||||||
|
for (const [relativePath, fileIssues] of byFile) {
|
||||||
|
const absPath = root ? path.join(root, relativePath) : relativePath;
|
||||||
|
const uri = vscode.Uri.file(absPath);
|
||||||
|
|
||||||
|
const diagnostics: vscode.Diagnostic[] = fileIssues.map(issue => {
|
||||||
|
const lineNum = issue.line != null ? Math.max(0, issue.line - 1) : 0;
|
||||||
|
const range = new vscode.Range(lineNum, 0, lineNum, 999);
|
||||||
|
|
||||||
|
const severity =
|
||||||
|
issue.severity === 'danger'
|
||||||
|
? vscode.DiagnosticSeverity.Error
|
||||||
|
: issue.severity === 'warning'
|
||||||
|
? vscode.DiagnosticSeverity.Warning
|
||||||
|
: vscode.DiagnosticSeverity.Information;
|
||||||
|
|
||||||
|
const diag = new vscode.Diagnostic(range, `[Guard] ${issue.title}: ${issue.description}`, severity);
|
||||||
|
diag.source = 'Guard';
|
||||||
|
if (issue.fix) {
|
||||||
|
diag.code = { value: 'view-fix', target: vscode.Uri.parse('https://github.com') };
|
||||||
|
}
|
||||||
|
return diag;
|
||||||
|
});
|
||||||
|
|
||||||
|
collection.set(uri, diagnostics);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,116 @@
|
||||||
|
import * as vscode from 'vscode';
|
||||||
|
import { ScanIssue } from '../scanner/prompt';
|
||||||
|
|
||||||
|
export class ResultsPanel {
|
||||||
|
private static _current: ResultsPanel | undefined;
|
||||||
|
private readonly _panel: vscode.WebviewPanel;
|
||||||
|
private _disposables: vscode.Disposable[] = [];
|
||||||
|
|
||||||
|
static show(context: vscode.ExtensionContext, issues: ScanIssue[], source: string): void {
|
||||||
|
if (ResultsPanel._current) {
|
||||||
|
ResultsPanel._current._panel.reveal(vscode.ViewColumn.Beside);
|
||||||
|
ResultsPanel._current._update(issues, source);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
ResultsPanel._current = new ResultsPanel(context, issues, source);
|
||||||
|
}
|
||||||
|
|
||||||
|
private constructor(
|
||||||
|
context: vscode.ExtensionContext,
|
||||||
|
issues: ScanIssue[],
|
||||||
|
source: string,
|
||||||
|
) {
|
||||||
|
this._panel = vscode.window.createWebviewPanel(
|
||||||
|
'guardResults',
|
||||||
|
'Guard スキャン結果',
|
||||||
|
vscode.ViewColumn.Beside,
|
||||||
|
{ enableScripts: false, retainContextWhenHidden: true },
|
||||||
|
);
|
||||||
|
|
||||||
|
this._panel.onDidDispose(() => {
|
||||||
|
ResultsPanel._current = undefined;
|
||||||
|
this._disposables.forEach(d => d.dispose());
|
||||||
|
}, null, this._disposables);
|
||||||
|
|
||||||
|
this._update(issues, source);
|
||||||
|
}
|
||||||
|
|
||||||
|
private _update(issues: ScanIssue[], source: string): void {
|
||||||
|
this._panel.title = `Guard: ${source}`;
|
||||||
|
this._panel.webview.html = buildHtml(issues, source);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function esc(s: string): string {
|
||||||
|
return s
|
||||||
|
.replace(/&/g, '&')
|
||||||
|
.replace(/</g, '<')
|
||||||
|
.replace(/>/g, '>')
|
||||||
|
.replace(/"/g, '"');
|
||||||
|
}
|
||||||
|
|
||||||
|
function buildHtml(issues: ScanIssue[], source: string): string {
|
||||||
|
const danger = issues.filter(i => i.severity === 'danger');
|
||||||
|
const warning = issues.filter(i => i.severity === 'warning');
|
||||||
|
const info = issues.filter(i => i.severity === 'info');
|
||||||
|
|
||||||
|
const badge = (label: string, count: number, color: string) =>
|
||||||
|
count > 0
|
||||||
|
? `<span style="display:inline-block;padding:2px 8px;border-radius:4px;font-size:11px;font-weight:600;background:${color};color:#fff;margin-right:6px">${label} ${count}</span>`
|
||||||
|
: '';
|
||||||
|
|
||||||
|
const issueHtml = (issue: ScanIssue) => {
|
||||||
|
const color =
|
||||||
|
issue.severity === 'danger' ? '#e53e3e' :
|
||||||
|
issue.severity === 'warning' ? '#d69e2e' : '#3182ce';
|
||||||
|
const bg =
|
||||||
|
issue.severity === 'danger' ? '#fff5f5' :
|
||||||
|
issue.severity === 'warning' ? '#fffff0' : '#ebf8ff';
|
||||||
|
const fixSection = issue.fix
|
||||||
|
? `<pre style="margin:8px 0 0;padding:10px;background:#1a1a2e;color:#e2e8f0;border-radius:4px;font-size:11px;overflow-x:auto;white-space:pre-wrap;word-break:break-all">${esc(issue.fix)}</pre>`
|
||||||
|
: '';
|
||||||
|
const location = issue.line != null ? `${esc(issue.file)}:${issue.line}` : esc(issue.file);
|
||||||
|
return `
|
||||||
|
<div style="margin-bottom:10px;border:1px solid ${color}33;border-left:3px solid ${color};border-radius:4px;padding:12px 14px;background:${bg}">
|
||||||
|
<div style="display:flex;align-items:flex-start;gap:8px;margin-bottom:6px">
|
||||||
|
<span style="color:${color};font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:.05em;flex-shrink:0;padding-top:1px">${esc(issue.severity)}</span>
|
||||||
|
<span style="font-weight:600;font-size:13px;color:#1a202c">${esc(issue.title)}</span>
|
||||||
|
</div>
|
||||||
|
<div style="font-size:12px;color:#4a5568;margin-bottom:6px;line-height:1.5">${esc(issue.description)}</div>
|
||||||
|
<div style="font-size:11px;color:#718096;font-family:monospace">${location}</div>
|
||||||
|
${fixSection}
|
||||||
|
</div>`;
|
||||||
|
};
|
||||||
|
|
||||||
|
const allHtml = [...danger, ...warning, ...info].map(issueHtml).join('');
|
||||||
|
|
||||||
|
return `<!DOCTYPE html>
|
||||||
|
<html lang="ja">
|
||||||
|
<head>
|
||||||
|
<meta charset="UTF-8">
|
||||||
|
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline';">
|
||||||
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
||||||
|
<style>
|
||||||
|
* { box-sizing: border-box; margin: 0; padding: 0; }
|
||||||
|
body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: #f7fafc; color: #2d3748; padding: 20px; }
|
||||||
|
h1 { font-size: 15px; font-weight: 700; margin-bottom: 4px; color: #1a202c; }
|
||||||
|
.meta { font-size: 11px; color: #718096; margin-bottom: 16px; }
|
||||||
|
.summary { margin-bottom: 20px; }
|
||||||
|
.empty { text-align: center; padding: 40px; color: #718096; font-size: 14px; }
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<h1>Guard スキャン結果</h1>
|
||||||
|
<div class="meta">${esc(source)} — ${issues.length} 件の指摘</div>
|
||||||
|
<div class="summary">
|
||||||
|
${badge('危険', danger.length, '#e53e3e')}
|
||||||
|
${badge('警告', warning.length, '#d69e2e')}
|
||||||
|
${badge('情報', info.length, '#3182ce')}
|
||||||
|
</div>
|
||||||
|
${issues.length === 0
|
||||||
|
? '<div class="empty">問題は検出されませんでした</div>'
|
||||||
|
: allHtml
|
||||||
|
}
|
||||||
|
</body>
|
||||||
|
</html>`;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
{
|
||||||
|
"compilerOptions": {
|
||||||
|
"target": "ES2020",
|
||||||
|
"module": "commonjs",
|
||||||
|
"lib": ["ES2020"],
|
||||||
|
"outDir": "./dist",
|
||||||
|
"rootDir": "./src",
|
||||||
|
"strict": true,
|
||||||
|
"esModuleInterop": true,
|
||||||
|
"skipLibCheck": true,
|
||||||
|
"moduleResolution": "node"
|
||||||
|
},
|
||||||
|
"include": ["src/**/*"],
|
||||||
|
"exclude": ["node_modules", "dist"]
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue