@critiq/rules 0.2.0 → 0.4.0

package/rules/typescript/ts.react.no-lifecycle-method-typo.rule.yaml

@@ -0,0 +1,36 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.react.no-lifecycle-method-typo
+  title: Typo in lifecycle method name
+  summary: A misspelled lifecycle method name will never be called by React, leading to silent runtime bugs.
+  rationale: React only calls exact lifecycle method names. A typo means the method is dead code and the intended lifecycle behavior never runs.
+  aliases:
+    - JS-0453
+  tags:
+    - react
+    - ui
+    - rules-catalog
+  stability: experimental
+  appliesTo: function
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: ui.react.lifecycle-method-typo
+    bind: issue
+emit:
+  finding:
+    category: correctness.ui
+    severity: high
+    confidence: 0.82
+    tags:
+      - react
+      - ui
+  message:
+    title: Correct lifecycle method spelling
+    summary: "${captures.issue.text} looks like a misspelled React lifecycle method."
+  remediation:
+    summary: Fix the method name to match the correct React lifecycle spelling.

package/rules/typescript/ts.react.no-render-invalid-return-type.rule.yaml

@@ -0,0 +1,36 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.react.no-render-invalid-return-type
+  title: Render must return valid React element
+  summary: A render method that returns a number, boolean, or plain object will produce an empty or broken UI.
+  rationale: React render methods must return JSX, fragments, strings, null, or boolean values. Numeric literals and plain objects are not valid React children.
+  aliases:
+    - JS-0467
+  tags:
+    - react
+    - ui
+    - rules-catalog
+  stability: experimental
+  appliesTo: function
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: ui.react.render-return-value
+    bind: issue
+emit:
+  finding:
+    category: correctness.ui
+    severity: high
+    confidence: 0.88
+    tags:
+      - react
+      - ui
+  message:
+    title: Return a valid React element from render
+    summary: "render returns `${captures.issue.text}` which is not a valid React child."
+  remediation:
+    summary: Wrap the return value in a JSX element, fragment, or string. Use null to render nothing.

package/rules/typescript/ts.react.no-set-state-in-component-did-mount.rule.yaml

@@ -5,6 +5,8 @@ metadata:
   title: Avoid setState in componentDidMount
   summary: Synchronous state updates during mount trigger an extra render before the browser paints the initial tree.
   rationale: Initial state belongs in the constructor or class field initializers so the first render already reflects the mounted view.
+  aliases:
+    - JS-0442
   tags:
     - react
     - ui

package/rules/typescript/ts.react.no-set-state-in-component-did-update.rule.yaml

@@ -5,6 +5,8 @@ metadata:
   title: Guard setState in componentDidUpdate
   summary: Unconditional setState in componentDidUpdate can recurse through renders when props or state change on every pass.
   rationale: Updates should compare against prevProps or prevState so the component only re-renders when inputs actually changed.
+  aliases:
+    - JS-0443
   tags:
     - react
     - ui

package/rules/typescript/ts.react.no-set-state-in-component-will-update.rule.yaml

@@ -0,0 +1,36 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.react.no-set-state-in-component-will-update
+  title: Avoid setState in componentWillUpdate
+  summary: Synchronous state updates during the legacy will-update lifecycle can cause infinite re-rendering loops.
+  rationale: componentWillUpdate is deprecated and setState inside it may trigger additional render cycles. Migrate to componentDidUpdate with a guard or getDerivedStateFromProps.
+  aliases:
+    - JS-0459
+  tags:
+    - react
+    - ui
+    - rules-catalog
+  stability: experimental
+  appliesTo: function
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: ui.react.set-state-in-component-will-update
+    bind: issue
+emit:
+  finding:
+    category: correctness.ui
+    severity: high
+    confidence: 0.85
+    tags:
+      - react
+      - ui
+  message:
+    title: Move setState out of componentWillUpdate
+    summary: "${captures.issue.text} calls setState inside componentWillUpdate."
+  remediation:
+    summary: Replace componentWillUpdate with componentDidUpdate and guard the setState with a prevProps or prevState comparison.

package/rules/typescript/ts.react.no-should-component-update.rule.yaml

@@ -0,0 +1,36 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.react.no-should-component-update
+  title: Avoid shouldComponentUpdate
+  summary: Manual shouldComponentUpdate overrides increase maintenance cost and are rarely needed with modern React.
+  rationale: PureComponent and React.memo provide shallow comparison out of the box. Hand-rolling shouldComponentUpdate is error-prone and duplicates built-in optimizations.
+  aliases:
+    - JS-0448
+  tags:
+    - react
+    - ui
+    - rules-catalog
+  stability: experimental
+  appliesTo: function
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: ui.react.should-component-update
+    bind: issue
+emit:
+  finding:
+    category: maintainability.ui
+    severity: medium
+    confidence: 0.75
+    tags:
+      - react
+      - ui
+  message:
+    title: Prefer PureComponent or React.memo
+    summary: "${captures.issue.text} overrides shouldComponentUpdate — consider PureComponent or React.memo instead."
+  remediation:
+    summary: Replace extends Component with extends PureComponent, or wrap the component with React.memo for function components.

package/rules/typescript/ts.react.no-target-blank-without-rel.rule.yaml

@@ -14,6 +14,8 @@ metadata:
     - kind: owasp
       title: Cross Site Scripting Prevention Cheat Sheet
       url: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
+  aliases:
+    - JS-0422
   tags:
     - react
     - security

package/rules/typescript/ts.react.no-this-state-in-set-state.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.react.no-this-state-in-set-state
+  title: Avoid this.state inside setState()
+  summary: Reading this.state inside setState() leads to stale state references because React batches updates asynchronously.
+  rationale: setState updates are asynchronous and may be batched; reading this.state directly inside the updater bypasses the guaranteed-latest state provided by the updater function parameter.
+  aliases:
+    - JS-0435
+  tags:
+    - react
+    - ui
+    - rules-catalog
+  stability: experimental
+  appliesTo: function
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: ui.react.this-state-in-set-state
+    bind: issue
+emit:
+  finding:
+    category: correctness.ui
+    severity: high
+    confidence: 0.85
+    tags:
+      - react
+      - ui
+  message:
+    title: Use updater function parameter instead of this.state
+    summary: "${captures.issue.text} reads this.state inside a setState call, which may use stale state."
+  remediation:
+    summary: >-
+      Replace this.setState({ key: this.state.key + 1 }) with
+      this.setState(prevState => ({ key: prevState.key + 1 })) to guarantee latest state.

package/rules/typescript/ts.react.no-unnecessary-fragment.rule.yaml

@@ -0,0 +1,36 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.react.no-unnecessary-fragment
+  title: Remove unnecessary React fragments
+  summary: Fragments wrapping a single child add runtime overhead without structural benefit.
+  rationale: A fragment with one element or text child can be replaced by the child itself, reducing render tree depth and making the component simpler.
+  aliases:
+    - JS-0424
+  tags:
+    - react
+    - ui
+    - rules-catalog
+  stability: experimental
+  appliesTo: function
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: ui.react.unnecessary-fragment
+    bind: issue
+emit:
+  finding:
+    category: correctness.ui
+    severity: low
+    confidence: 0.85
+    tags:
+      - react
+      - ui
+  message:
+    title: Replace unnecessary fragment with its single child
+    summary: "${captures.issue.text} wraps exactly one child element and can be removed."
+  remediation:
+    summary: Remove the wrapping fragment and keep only the single child element.

package/rules/typescript/ts.runtime.no-process-exit.rule.yaml

@@ -14,10 +14,13 @@ metadata:
     - kind: owasp
       title: Secure Configuration Cheat Sheet
       url: https://cheatsheetseries.owasp.org/cheatsheets/Secure_Configuration_Cheat_Sheet.html
+  aliases:
+    - JS-0263
   tags:
     - runtime
     - node
     - rules-catalog
+    - public-directory-parity
   stability: stable
   appliesTo: block
 scope:

package/rules/typescript/ts.runtime.process-exit-control-flow.rule.yaml

@@ -0,0 +1,46 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.runtime.process-exit-control-flow
+  title: process.exit() in control flow
+  summary: "Avoid `process.exit()` in finally blocks or followed by reachable code."
+  rationale: "`process.exit()` in a finally block runs even after errors, and reachable code after exit creates dead code and logic errors."
+  detection:
+    kind: pattern
+  references:
+    - kind: cwe
+      id: CWE-16
+      title: Configuration
+    - kind: owasp
+      title: Secure Configuration Cheat Sheet
+      url: https://cheatsheetseries.owasp.org/cheatsheets/Secure_Configuration_Cheat_Sheet.html
+  aliases:
+    - JS-0270
+  tags:
+    - runtime
+    - node
+    - rules-catalog
+    - public-directory-parity
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: runtime.process-exit-control-flow
+    bind: issue
+emit:
+  finding:
+    category: security.reliability
+    severity: high
+    confidence: 0.85
+    tags:
+      - runtime
+      - node
+  message:
+    title: Review process.exit() placement
+    summary: "`${captures.issue.text}` may terminate the process in an unexpected control flow context."
+  remediation:
+    summary: Use structured error handling (throw/try-catch) instead of process.exit() in finally blocks. Remove dead code after process.exit().

package/rules/typescript/ts.security.dangerous-insert-html.rule.yaml

@@ -25,6 +25,11 @@ scope:
   languages:
     - typescript
     - javascript
+  paths:
+    exclude:
+      - "**/build/**"
+      - "**/scripts/**"
+      - "**/docs/**"
 match:
   fact:
     kind: security.dangerous-insert-html

package/rules/typescript/ts.security.express-insecure-listen.rule.yaml

@@ -0,0 +1,52 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.security.express-insecure-listen
+  title: Avoid insecure HTTP server bootstrap in production entrypoints
+  summary: Application servers should terminate TLS locally or document trusted edge termination before exposing plain HTTP listeners.
+  rationale: Bootstrapping Express, Fastify, Nest, or raw HTTP servers without HTTPS exposes traffic to interception and downgrade attacks when no compensating TLS layer exists.
+  detection:
+    kind: pattern
+  references:
+    - kind: cwe
+      id: CWE-319
+      title: Cleartext Transmission of Sensitive Information
+    - kind: owasp
+      title: Transport Layer Protection Cheat Sheet
+      url: https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html
+  tags:
+    - security
+    - transport
+    - express
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - typescript
+    - javascript
+  paths:
+    exclude:
+      - "**/build/**"
+      - "**/scripts/**"
+      - "**/docs/**"
+      - "**/*.spec.*"
+      - "**/*.test.*"
+match:
+  fact:
+    kind: security.express-insecure-listen
+    bind: issue
+emit:
+  finding:
+    category: security.transport
+    severity: high
+    confidence: 0.85
+    tags:
+      - security
+      - transport
+      - express
+  message:
+    title: Protect `${captures.issue.text}` with TLS or documented edge termination
+    summary: "`${captures.issue.text}` starts a plain HTTP listener without local HTTPS bootstrap or a documented TLS termination guard."
+  remediation:
+    summary: Use `https.createServer` with valid credentials, terminate TLS at a trusted reverse proxy, or restrict the listener to explicit development-only guards.

package/rules/typescript/ts.security.express-nosql-injection.rule.yaml

@@ -2,18 +2,18 @@ apiVersion: critiq.dev/v1alpha1
 kind: Rule
 metadata:
   id: ts.security.express-nosql-injection
-  title: Avoid request-driven model queries
-  summary: Express handlers should not pass raw request objects into NoSQL filters, query helpers, or aggregation pipelines.
-  rationale: Request-shaped filters, operators, or pipelines can expand query scope and inject unintended behavior.
+  title: Request-driven NoSQL query or aggregation pipeline
+  summary: Express handlers should not pass raw request objects into NoSQL filters, query helpers, or aggregation pipelines to prevent injection attacks.
+  rationale: Passing unvalidated request data directly into NoSQL model queries can allow attackers to manipulate query scope, bypass access controls, or extract unintended data from MongoDB and similar databases.
   detection:
     kind: pattern
   references:
     - kind: cwe
-      id: CWE-89
-      title: SQL Injection
+      id: CWE-943
+      title: Improper Neutralization of Special Elements in Data Query Logic
     - kind: owasp
-      title: SQL Injection Prevention Cheat Sheet
-      url: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
+      title: NoSQL Injection Prevention Cheat Sheet
+      url: https://cheatsheetseries.owasp.org/cheatsheets/NoSQL_Injection_Prevention_Cheat_Sheet.html
     - kind: url
       title: Node.js security best practices
       url: https://nodejs.org/en/learn/getting-started/security-best-practices
@@ -31,6 +31,11 @@ scope:
   languages:
     - typescript
     - javascript
+  paths:
+    exclude:
+      - "**/types/**/*-tests.ts"
+      - "**/types/**/*.test.*"
+      - "**/types/**/*.spec.*"
 match:
   fact:
     kind: security.express-nosql-injection
@@ -38,15 +43,15 @@ match:
 emit:
   finding:
     category: security.input-validation
-    severity: critical
+    severity: high
     confidence: 0.92
     tags:
       - security
       - injection
       - nosql
   message:
-    title: Narrow the query passed to `${captures.issue.text}`
-    summary: "`${captures.issue.text}` receives request-controlled query input without an allowlisted query or pipeline shape."
+    title: NoSQL injection via `${captures.issue.text}`
+    summary: "`${captures.issue.text}` passes unvalidated request data into a NoSQL model query, allowing attackers to manipulate query scope, bypass filters, or extract unauthorized data."
   remediation:
-    summary: Build the NoSQL query or aggregation pipeline from fixed fields or validated filter builders instead of passing request data directly.
+    summary: Restrict NoSQL queries to allowlisted field names and validated filter shapes. Use typed query builders (e.g., Mongoose `where` chaining, MongoDB aggregation pipeline validators) instead of passing raw request objects.
 

package/rules/typescript/ts.security.express-static-dotfiles-allow.rule.yaml

@@ -31,6 +31,11 @@ scope:
   languages:
     - typescript
     - javascript
+  paths:
+    exclude:
+      - "**/lib/**"
+      - "**/node_modules/**"
+      - "**/vendor/**"
 match:
   fact:
     kind: security.express-static-dotfiles-allow

package/rules/typescript/ts.security.iframe-missing-sandbox-attribute.rule.yaml

@@ -2,9 +2,17 @@ apiVersion: critiq.dev/v1alpha1
 kind: Rule
 metadata:
   id: ts.security.iframe-missing-sandbox-attribute
-  title: Add a sandbox attribute to iframes
-  summary: Intrinsic iframe elements should declare a sandbox attribute to reduce blast radius.
-  rationale: Sandboxed iframes limit scripts, forms, and top-level navigation when embedded third-party content is compromised.
+  title: Iframe without sandbox attribute
+  summary: Intrinsic iframe elements embedding untrusted third-party content should declare a sandbox attribute to reduce blast radius.
+  rationale: |
+    The sandbox attribute restricts what the embedded document can do — forms,
+    scripts, navigation, and plugin access are blocked by default. Iframes
+    loading untrusted third-party content without sandbox protection expose
+    users to clickjacking, credential theft, and XSS via the embedded context.
+    However, some iframes intentionally embed trusted services (payment gateways,
+    app marketplaces, developer tools) and may not need sandboxing. If the iframe
+    has `allowFullScreen` or `allow` attributes, the developer has explicitly
+    granted permissions — these are assumed to be trusted embeds.
   detection:
     kind: pattern
   references:
@@ -25,6 +33,10 @@ scope:
   languages:
     - typescript
     - javascript
+  paths:
+    exclude:
+      - "**/DefinitelyTyped/**"
+      - "**/types/**/*-tests.*"
 match:
   fact:
     kind: security.iframe-missing-sandbox-attribute
@@ -38,8 +50,8 @@ emit:
       - security
       - react
   message:
-    title: "Add sandbox to ${captures.issue.text}"
-    summary: "${captures.issue.text} is missing a sandbox attribute."
+    title: "Iframe missing sandbox attribute"
+    summary: "${captures.issue.text} loads external content without sandbox restrictions. If the content is untrusted, add sandbox to prevent clickjacking and XSS. If the iframe loads a trusted service (payment gateway, app marketplace, developer tool), add allowFullScreen or allow to signal explicit trust."
   remediation:
-    summary: Add the most restrictive sandbox token set that still allows required behavior, and combine with a strict CSP.
+    summary: Add the most restrictive sandbox token set that still allows required behavior (e.g., `sandbox="allow-scripts"` for scripts only). If the iframe embeds a trusted external service that cannot be sandboxed (payment gateway, app marketplace), add `allowFullScreen` or `allow` to signal intentional trust.
 

package/rules/typescript/ts.security.import-using-user-input.rule.yaml

@@ -2,18 +2,18 @@ apiVersion: critiq.dev/v1alpha1
 kind: Rule
 metadata:
   id: ts.security.import-using-user-input
-  title: Constrain module-loading trust boundaries
+  title: Constrain module-loading to trusted allowlists
   summary: "`require()` and dynamic `import()` should not resolve modules from untrusted input."
-  rationale: Untrusted module paths let attackers steer module-loading boundaries toward unintended files, packages, or plugins.
+  rationale: Untrusted module paths let attackers steer module-loading boundaries toward unintended files, packages, or plugins. Only flag when the module path is derived from request or event data — static string literals and allowlist-validated paths are intentionally excluded. Test, bundled, and tutorial files are excluded because they contain static or intentionally simplified imports.
   detection:
     kind: pattern
   references:
     - kind: cwe
-      id: CWE-78
-      title: OS Command Injection
+      id: CWE-73
+      title: External Control of File Name or Path
     - kind: owasp
-      title: OS Command Injection Defense Cheat Sheet
-      url: https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html
+      title: Input Validation Cheat Sheet
+      url: https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
   tags:
     - security
     - execution
@@ -25,6 +25,24 @@ scope:
   languages:
     - typescript
     - javascript
+  paths:
+    exclude:
+      - "**/*.test.*"
+      - "**/*.spec.*"
+      - "**/__tests__/**"
+      - "**/__mocks__/**"
+      - "**/tests/**"
+      - "**/test/**"
+      - "**/e2e/**"
+      - "**/integration-tests/**"
+      - "**/.yarn/releases/**"
+      - "**/*-bundle.*"
+      - "**/*.min.*"
+      - "**/tutorials/**"
+      - "**/content/tutorials/**"
+      - "**/types/**/*-tests.*"
+      - "**/types/**/*.test.*"
+      - "**/types/**/*.spec.*"
 match:
   fact:
     kind: security.import-using-user-input
@@ -32,15 +50,49 @@ match:
 emit:
   finding:
     category: security.execution
-    severity: high
+    severity: medium
     confidence: 0.92
     tags:
       - security
       - execution
       - module-loading
   message:
-    title: Resolve `${captures.issue.text}` from a trusted module map
-    summary: "`${captures.issue.text}` crosses a module-loading trust boundary with untrusted input."
+    title: Resolve modules from a trusted allowlist instead of `${captures.issue.text}`
+    summary: "`${captures.issue.text}` resolves a module using request- or event-derived input. Untrusted module paths can load arbitrary files or packages, bypassing intended security boundaries."
   remediation:
-    summary: Resolve modules from a fixed allowlist or explicit dispatcher instead of untrusted request or event data.
+    summary: |-
+      Replace dynamic module paths with a fixed allowlist or validated dispatcher:
+
+      ### Unsafe — dynamic path from request input
+      ```typescript
+      const plugin = require(req.query.plugin);
+      await import(req.body.moduleName);
+      ```
+
+      ### Safe — allowlist dispatch
+      ```typescript
+      const ALLOWED_PLUGINS: Record<string, string> = {
+        analytics: './plugins/analytics',
+        auth: './plugins/auth',
+      };
+      const pluginPath = ALLOWED_PLUGINS[req.query.plugin];
+      if (pluginPath) {
+        const plugin = require(pluginPath);
+      }
+      ```
+
+      ### Safe — validation before import
+      ```typescript
+      function isValidModule(modName: string): boolean {
+        return /^[a-z-]+$/u.test(modName);
+      }
+      const moduleName = req.query.module;
+      if (isValidModule(moduleName)) {
+        const mod = require('./modules/' + moduleName);
+      }
+      ```
+
+      ### References
+      - CWE-73: External Control of File Name or Path
+      - OWASP Input Validation Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
 

package/rules/typescript/ts.security.insecure-auth-cookie-flags.rule.yaml

@@ -25,6 +25,14 @@ scope:
   languages:
     - typescript
     - javascript
+  paths:
+    exclude:
+      - "**/test/**"
+      - "**/tests/**"
+      - "**/__tests__/**"
+      - "**/*.test.*"
+      - "**/*.spec.*"
+      - "**/types/**/*-tests.*"
 match:
   fact:
     kind: ts.security.insecure-auth-cookie-flags
@@ -32,16 +40,16 @@ match:
 emit:
   finding:
     category: security.authentication
-    severity: high
+    severity: medium
     confidence: 0.9
     tags:
       - security
       - authentication
       - cookies
   message:
-    title: Harden `${captures.issue.text}` for auth cookies
-    summary: "`${captures.issue.text}` sets an auth-bearing cookie without the expected protections."
+    title: Auth cookie `${captures.issue.text}` missing security flags
+    summary: "`${captures.issue.text}` sets a cookie with an auth-signaling name without HttpOnly, Secure, or SameSite protections. Missing these flags makes the cookie vulnerable to session theft via XSS, MITM, or CSRF."
   remediation:
-    summary: Add `HttpOnly`, `Secure`, and an explicit `SameSite` policy before the cookie is used for session or auth state.
+    summary: "Add `HttpOnly`, `Secure`, and an explicit `SameSite` policy (preferably `Lax` or `Strict`) before the cookie is used for session or auth state. For example: `{ httpOnly: true, secure: true, sameSite: 'lax' }`."