/**
 * Pass: insecure-cookie (CWE-614, category: security)
 *
 * Pattern pass — flags cookie set operations that are missing the `Secure`
 * or `HttpOnly` flags. This is a configuration/absence vulnerability (the
 * cookie value itself does not need to be tainted), so it is detected by
 * inspecting call-site option literals rather than via taint flow.
 *
 * Detection per language:
 *   JavaScript / TypeScript:
 *     - Express `res.cookie(name, value, options)` — flag if options object
 *       (arg 2) is absent OR does not literally contain `secure: true` and
 *       `httpOnly: true`.
 *   Python:
 *     - Flask / Django / Starlette `response.set_cookie(name, value, **kw)`
 *       — flag if `secure=True` and `httponly=True` keyword args are not
 *       present in the call expression text.
 *   Java:
 *     - `new javax.servlet.http.Cookie("name", "value")` — flag the
 *       construction site if no `.setSecure(true)` AND `.setHttpOnly(true)`
 *       calls appear in the same source file (text-based heuristic; a
 *       full DFG-based version would require tracking the assigned
 *       variable through CFG).
 *
 * Excluded (intentionally not flagged):
 *   - `res.clearCookie(...)` — clears, not sets.
 *   - Cookie session middleware initialisation (`app.use(cookieSession(...))`).
 *
 * Out of scope (call site does not have enough information):
 *   - Spread-based options: `res.cookie('a', v, { ...secureDefaults, ... })`.
 *     We flag the call (RHS is opaque) unless `secure: true` and
 *     `httpOnly: true` appear literally. Users can suppress via config.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface InsecureCookieResult {
    insecureCookies: Array<{
        line: number;
        receiver: string;
        missingSecure: boolean;
        missingHttpOnly: boolean;
        optionsPresent: boolean;
    }>;
}
export declare class InsecureCookiePass implements AnalysisPass<InsecureCookieResult> {
    readonly name = "insecure-cookie";
    readonly category: "security";
    run(ctx: PassContext): InsecureCookieResult;
    private detectJs;
    private detectPython;
    private detectJavaCookieCtor;
    private detectGo;
    private detectRustSetCookieFormat;
    private emit;
}
//# sourceMappingURL=insecure-cookie-pass.d.ts.map