Description

Detects when TypeScript source maps are enabled in configuration files (tsconfig.json), which can expose sensitive source code information in production environments. Source maps allow debugging of minified JavaScript by mapping it back to the original TypeScript code, potentially revealing implementation details to attackers.

Detection Strategy

• Scans tsconfig.json files in the project (excluding tsconfig.spec.json test configurations)

• Checks for configuration entries that enable source map generation (like 'sourceMap: true' or 'inlineSourceMap: true')

• Reports a vulnerability when source map generation is explicitly enabled in production configuration files

Vulnerable code example

{
  "compilerOptions": {
    "target": "es2017",
    "module": "commonjs",
    "sourceMap": true,  // Security risk: Source maps enabled in production exposes source code
    "outDir": "./dist"
  },
  "include": [...

✅ Secure code example

{
  "compilerOptions": {
    "target": "es2017",
    "module": "commonjs",
    "sourceMap": false,  // Disabled source maps in production for security
    "outDir": "./dist"
  },
  "include": [...