/**
 * Pass: csrf-protection-disabled (CWE-352, category: security)
 *
 * Pattern pass — flags places where cross-site request forgery (CSRF)
 * protection is *explicitly disabled*. We do not attempt to detect the
 * absence of CSRF protection (false-positive prone across framework
 * idioms); instead we look for the documented "turn it off" calls.
 *
 * Detection per language:
 *   Java (Spring Security):
 *     - `http.csrf().disable()`
 *     - `http.csrf(csrf -> csrf.disable())`        — DSL form
 *     - `http.csrf(AbstractHttpConfigurer::disable)` — method-ref form
 *     - `.csrfTokenRepository(null)`               — neuters the repo
 *   Python (Django):
 *     - `@csrf_exempt` decorator on a view
 *     - `MIDDLEWARE = [...]` with `django.middleware.csrf.CsrfViewMiddleware`
 *       removed — we do NOT detect this (config-file analysis).
 *   JavaScript (Express):
 *     - We do NOT detect "csurf missing" — that's an absence check that
 *       fires on every non-Express handler.
 *
 * Severity: critical (CWE-352 is direct privilege escalation).
 * Issue: #86, Sprint 6.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface CsrfProtectionDisabledResult {
    findings: Array<{
        line: number;
        language: string;
        pattern: string;
        api: string;
    }>;
}
export declare class CsrfProtectionDisabledPass implements AnalysisPass<CsrfProtectionDisabledResult> {
    readonly name = "csrf-protection-disabled";
    readonly category: "security";
    run(ctx: PassContext): CsrfProtectionDisabledResult;
    private detectCall;
    private fixFor;
}
//# sourceMappingURL=csrf-protection-disabled-pass.d.ts.map