SG-102: Char-Coded Endpoint to Network Sink

Severity: HIGH

JS/TS host or URL assembled from charcode / atob / hex / numeric char-array decode that feeds a network sink (fetch, axios, http(s).request, WebSocket, XMLHttpRequest, net.connect, tls.connect, dgram, sendBeacon). Escalates to CRITICAL when two or more distinct decode primitives feed the same sink.

Fires when

• A string decoded via String.fromCharCode, atob() of a literal, a numeric char-array .map, or a hex Buffer.from reaches a network sink within ~800 chars
• The sink is a network primitive: fetch, axios, http(s).request, WebSocket, XMLHttpRequest, net.connect, tls.connect, dgram, or sendBeacon
• Severity escalates to CRITICAL when two or more distinct decode primitives feed the same sink

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.