/**
 * Integration tests for the built-in Semgrep taint rules.
 *
 * These tests write temp-file fixtures, invoke semgrep directly, and assert
 * that the `vaspera-path-traversal`, `vaspera-mass-assignment`, and
 * `vaspera-prototype-pollution` rules produce the expected findings.
 * They are skipped automatically when semgrep is not installed so that the
 * suite stays green in CI environments without semgrep.
 *
 * Cases per the task specification:
 *  Path-traversal:
 *   1. Vulnerable: destructured import + bare readFile(req.query.path)
 *   2. Vulnerable: destructured import + readFile(join("/data", req.query.file))
 *   3. Safe: basename sanitizer — readFile(join("/data", basename(req.query.file)))
 *   4. Safe: hardcoded path — readFile(join("/data", "config.json"))
 *   5. Safe: env var source — readFile(process.env.CONFIG_PATH)
 *  Mass-assignment:
 *   MA-1. MUST flag: db.insert().values(req.body) — whole body direct
 *   MA-2. MUST flag: db.insert().values({ ...req.body }) — whole body spread
 *   MA-3. MUST flag: db.update().set(req.body) — whole body to set
 *   MA-4. MUST flag: prisma.user.create({ data: req.body })
 *   MA-5. MUST flag: new User(req.body)
 *   MA-6. MUST NOT flag: db.insert().values({ email: req.body.email, name: req.body.name }) — allowlist
 *  Prototype-pollution:
 *   PP-1. MUST flag: obj[req.body.key] = req.body.value
 *   PP-2. MUST flag: Object.assign(target, req.body)
 *   PP-3. MUST flag: Object.assign(target, req.query)
 *   PP-4. MUST NOT flag: Object.assign({}, defaults) — no request source
 *   PP-5. MUST NOT flag: obj.knownField = req.body.value — static key
 *
 * Each test passes an explicit 30-second timeout because semgrep startup
 * costs ~2–4 s per invocation and the default vitest timeout is 5 s.
 */
export {};
//# sourceMappingURL=semgrep.test.d.ts.map