@duckmind/dm-linux-x64 0.63.9 → 0.64.2

package/extensions/dm-lens/rules/ast-grep-rules/coderabbit/rules/typescript/security/node-rsa-weak-key-typescript.yml

@@ -0,0 +1,1483 @@
+id: node-rsa-weak-key-typescript
+language: typescript
+severity: warning
+message: Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits.
+note: |-
+  [CWE-326] Inadequate Encryption Strength. [REFERENCES]
+      - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
+ast-grep-essentials: true
+utils:
+  PATTERN_require_crypto:
+    pattern: $NUMBER
+    all:
+      - inside:
+          stopBy: end
+          kind: call_expression
+          all:
+            - has:
+                stopBy: neighbor
+                kind: member_expression
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: identifier
+                      pattern: $CRYPTO
+                  - has:
+                      stopBy: neighbor
+                      kind: property_identifier
+            - has:
+                stopBy: neighbor
+                kind: arguments
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      regex: ^"rsa"$
+                  - has:
+                      stopBy: neighbor
+                      kind: object
+                      all:
+                        - has:
+                            stopBy: neighbor
+                            kind: pair
+                            all:
+                              - has:
+                                  stopBy: neighbor
+                                  kind: property_identifier
+                                  regex: ^modulusLength$
+                              - has:
+                                  stopBy: neighbor
+                                  pattern: $NUMBER
+      - inside:
+          stopBy: neighbor
+          kind: pair
+          not:
+            follows:
+              stopBy: end
+              kind: pair
+              all:
+                - has:
+                    stopBy: neighbor
+                    kind: property_identifier
+                    regex: ^modulusLength$
+      - inside:
+          stopBy: end
+          any:
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $CRYPTO
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^crypto$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      all:
+                        - has:
+                            stopBy: neighbor
+                            kind: identifier
+                            nthChild: 1
+                            pattern: $CRYPTO
+                        - not:
+                            has:
+                              stopBy: neighbor
+                              nthChild: 2
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^crypto$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: namespace_import
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              nthChild: 1
+                              pattern: $CRYPTO
+                          - not:
+                              has:
+                                stopBy: neighbor
+                                nthChild: 2
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^crypto$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $CRYPTO
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^crypto$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: lexical_declaration
+                has:
+                  stopBy: neighbor
+                  kind: variable_declarator
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $CRYPTO
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^crypto$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+            - follows:
+                stopBy: end
+                kind: variable_declaration
+                has:
+                  stopBy: neighbor
+                  kind: variable_declarator
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $CRYPTO
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^crypto$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+            - follows:
+                stopBy: end
+                kind: expression_statement
+                has:
+                  stopBy: neighbor
+                  kind: assignment_expression
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $CRYPTO
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^crypto$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+  PATTERN_require_crypto__pattern_2:
+    pattern: $NUMBER
+    all:
+      - inside:
+          stopBy: end
+          kind: call_expression
+          all:
+            - has:
+                stopBy: neighbor
+                kind: call_expression
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: member_expression
+                      all:
+                        - has:
+                            stopBy: end
+                            kind: identifier
+                        - has:
+                            stopBy: neighbor
+                            kind: property_identifier
+                            regex: ^promisify$
+                  - has:
+                      stopBy: neighbor
+                      kind: arguments
+                      has:
+                        stopBy: neighbor
+                        kind: member_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              pattern: $CRYPTO
+                          - has:
+                              stopBy: neighbor
+                              kind: property_identifier
+            - has:
+                stopBy: neighbor
+                kind: arguments
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      regex: ^"rsa"$
+                  - has:
+                      stopBy: neighbor
+                      kind: object
+                      all:
+                        - has:
+                            stopBy: neighbor
+                            kind: pair
+                            all:
+                              - has:
+                                  stopBy: neighbor
+                                  kind: property_identifier
+                                  regex: ^modulusLength$
+                              - has:
+                                  stopBy: neighbor
+                                  pattern: $NUMBER
+      - inside:
+          stopBy: neighbor
+          kind: pair
+          not:
+            follows:
+              stopBy: end
+              kind: pair
+              all:
+                - has:
+                    stopBy: neighbor
+                    kind: property_identifier
+                    regex: ^modulusLength$
+      - inside:
+          stopBy: end
+          any:
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $CRYPTO
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^crypto$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      all:
+                        - has:
+                            stopBy: neighbor
+                            kind: identifier
+                            nthChild: 1
+                            pattern: $CRYPTO
+                        - not:
+                            has:
+                              stopBy: neighbor
+                              nthChild: 2
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^crypto$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: namespace_import
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              nthChild: 1
+                              pattern: $CRYPTO
+                          - not:
+                              has:
+                                stopBy: neighbor
+                                nthChild: 2
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^crypto$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $CRYPTO
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^crypto$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: lexical_declaration
+                has:
+                  stopBy: neighbor
+                  kind: variable_declarator
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $CRYPTO
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^crypto$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+            - follows:
+                stopBy: end
+                kind: variable_declaration
+                has:
+                  stopBy: neighbor
+                  kind: variable_declarator
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $CRYPTO
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^crypto$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+            - follows:
+                stopBy: end
+                kind: expression_statement
+                has:
+                  stopBy: neighbor
+                  kind: assignment_expression
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $CRYPTO
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^crypto$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+  PATTERN_require_node-rsa:
+    pattern: $NUMBER
+    all:
+      - inside:
+          stopBy: end
+          kind: new_expression
+          all:
+            - has:
+                stopBy: neighbor
+                kind: identifier
+                pattern: $NODERSA
+            - has:
+                stopBy: neighbor
+                kind: arguments
+                has:
+                  stopBy: neighbor
+                  kind: object
+                  has:
+                    stopBy: neighbor
+                    kind: pair
+                    all:
+                      - has:
+                          stopBy: neighbor
+                          kind: property_identifier
+                          regex: ^b$
+                      - has:
+                          stopBy: neighbor
+                          pattern: $NUMBER
+      - inside:
+          stopBy: end
+          kind: pair
+          all:
+            - not:
+                follows:
+                  stopBy: end
+                  kind: pair
+                  has:
+                    stopBy: neighbor
+                    kind: property_identifier
+                    regex: ^b$
+            - not:
+                has:
+                  stopBy: end
+                  kind: computed_property_name
+            - inside:
+                stopBy: neighbor
+                kind: object
+                all:
+                  - not:
+                      follows:
+                        stopBy: end
+                        kind: object
+                        has:
+                          stopBy: neighbor
+                          kind: pair
+                          has:
+                            stopBy: neighbor
+                            kind: property_identifier
+                            regex: ^b$
+                  - not:
+                      precedes:
+                        stopBy: end
+                        kind: object
+                        has:
+                          stopBy: neighbor
+                          kind: pair
+                          has:
+                            stopBy: neighbor
+                            kind: property_identifier
+                            regex: ^b$
+                  - not:
+                      has:
+                        stopBy: end
+                        kind: object
+                        has:
+                          stopBy: neighbor
+                          kind: pair
+                          has:
+                            stopBy: neighbor
+                            kind: property_identifier
+                            regex: ^b$
+                  - not:
+                      inside:
+                        stopBy: end
+                        kind: object
+                        has:
+                          stopBy: neighbor
+                          kind: pair
+                          has:
+                            stopBy: neighbor
+                            kind: property_identifier
+                            regex: ^b$
+      - inside:
+          stopBy: end
+          any:
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $NODERSA
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-rsa$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      all:
+                        - has:
+                            stopBy: neighbor
+                            kind: identifier
+                            nthChild: 1
+                            pattern: $NODERSA
+                        - not:
+                            has:
+                              stopBy: neighbor
+                              nthChild: 2
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-rsa$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: namespace_import
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              nthChild: 1
+                              pattern: $NODERSA
+                          - not:
+                              has:
+                                stopBy: neighbor
+                                nthChild: 2
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-rsa$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $NODERSA
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-rsa$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $NODERSA
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-rsa$
+            - follows:
+                stopBy: end
+                kind: variable_declaration
+                has:
+                  stopBy: neighbor
+                  kind: variable_declarator
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $NODERSA
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^node-rsa$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+            - follows:
+                stopBy: end
+                kind: expression_statement
+                has:
+                  stopBy: neighbor
+                  kind: assignment_expression
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $NODERSA
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^node-rsa$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+            - follows:
+                stopBy: end
+                kind: lexical_declaration
+                has:
+                  stopBy: neighbor
+                  kind: variable_declarator
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $NODERSA
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^node-rsa$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+  PATTERN_require_node-forge:
+    pattern: $NUMBER
+    all:
+      - inside:
+          stopBy: end
+          kind: call_expression
+          all:
+            - has:
+                stopBy: neighbor
+                kind: member_expression
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: member_expression
+                      all:
+                        - has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $FORGE
+                            nthChild: 1
+                        - has:
+                            stopBy: neighbor
+                            kind: property_identifier
+                            nthChild: 2
+                            regex: ^rsa$
+                  - has:
+                      stopBy: neighbor
+                      kind: property_identifier
+            - has:
+                stopBy: neighbor
+                kind: arguments
+                all:
+                  - has:
+                      stopBy: neighbor
+                      pattern: $NUMBER
+                  - not:
+                      follows:
+                        stopBy: end
+                        pattern: $NUMBER
+                  - not:
+                      has:
+                        stopBy: end
+                        nthChild: 2
+      - inside:
+          stopBy: end
+          follows:
+            stopBy: end
+            any:
+              - pattern: $FORGE = $NODEFORGE.pki;
+              - pattern: const $FORGE = $NODEFORGE.pki;
+              - pattern: var $FORGE = $NODEFORGE.pki;
+              - pattern: $FORGE = $NODEFORGE.pki.rsa;
+              - pattern: const $FORGE = $NODEFORGE.pki.rsa;
+              - pattern: var $FORGE = $NODEFORGE.pki.rsa;
+      - inside:
+          stopBy: end
+          any:
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $NODEFORGE
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-forge$
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      all:
+                        - has:
+                            stopBy: neighbor
+                            kind: identifier
+                            nthChild: 1
+                            pattern: $NODEFORGE
+                        - not:
+                            has:
+                              stopBy: neighbor
+                              nthChild: 2
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-forge$
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: namespace_import
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              nthChild: 1
+                              pattern: $NODEFORGE
+                          - not:
+                              has:
+                                stopBy: neighbor
+                                nthChild: 2
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-forge$
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $NODEFORGE
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-forge$
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $NODEFORGE
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-forgeo$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: variable_declaration
+                has:
+                  stopBy: neighbor
+                  kind: variable_declarator
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $NODEFORGE
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^node-forge$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+            - follows:
+                stopBy: end
+                kind: expression_statement
+                has:
+                  stopBy: neighbor
+                  kind: assignment_expression
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $NODEFORGE
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^node-forge$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+            - follows:
+                stopBy: end
+                kind: lexical_declaration
+                has:
+                  stopBy: neighbor
+                  kind: variable_declarator
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $NODEFORGE
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^node-forge$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+      - inside:
+          stopBy: neighbor
+          kind: arguments
+          not:
+            has:
+              all:
+                - kind: array
+  PATTERN_require_node-forge__pattern_2:
+    pattern: $NUMBER
+    all:
+      - inside:
+          stopBy: end
+          kind: call_expression
+          all:
+            - has:
+                stopBy: neighbor
+                kind: member_expression
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: identifier
+                      pattern: $FORGE
+                  - has:
+                      stopBy: neighbor
+                      kind: property_identifier
+            - has:
+                stopBy: neighbor
+                kind: arguments
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: object
+                      all:
+                        - has:
+                            stopBy: neighbor
+                            kind: pair
+                            all:
+                              - has:
+                                  stopBy: neighbor
+                                  kind: property_identifier
+                                  regex: ^bits$
+                              - has:
+                                  stopBy: neighbor
+                                  pattern: $NUMBER
+                              - not:
+                                  follows:
+                                    stopBy: end
+                                    kind: pair
+                                    has:
+                                      stopBy: end
+                                      kind: property_identifier
+                                      regex: ^bits$
+                        - not:
+                            follows:
+                              stopBy: end
+                              kind: pair
+                              has:
+                                stopBy: end
+                                kind: property_identifier
+                                regex: ^bits$
+      - inside:
+          stopBy: end
+          follows:
+            stopBy: end
+            any:
+              - pattern: $FORGE = $NODEFORGE.pki
+              - pattern: const $FORGE = $NODEFORGE.pki
+              - pattern: var $FORGE = $NODEFORGE.pki
+              - pattern: $FORGE = $NODEFORGE.pki.rsa
+              - pattern: const $FORGE = $NODEFORGE.pki.rsa
+              - pattern: var $FORGE = $NODEFORGE.pki.rsa
+      - inside:
+          stopBy: end
+          kind: object
+          not:
+            has:
+              all:
+                - kind: array
+      - inside:
+          stopBy: end
+          kind: pair
+          not:
+            follows:
+              stopBy: end
+              kind: pair
+              has:
+                stopBy: end
+                kind: property_identifier
+                regex: ^bits$
+      - inside:
+          stopBy: end
+          any:
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $NODEFORGE
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-forge$
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      all:
+                        - has:
+                            stopBy: neighbor
+                            kind: identifier
+                            nthChild: 1
+                            pattern: $NODEFORGE
+                        - not:
+                            has:
+                              stopBy: neighbor
+                              nthChild: 2
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-forge$
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: namespace_import
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              nthChild: 1
+                              pattern: $NODEFORGE
+                          - not:
+                              has:
+                                stopBy: neighbor
+                                nthChild: 2
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-forge$
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $NODEFORGE
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-forge$
+            - follows:
+                stopBy: end
+                kind: import_statement
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: import_clause
+                      has:
+                        stopBy: neighbor
+                        kind: named_imports
+                        has:
+                          stopBy: neighbor
+                          kind: import_specifier
+                          has:
+                            stopBy: neighbor
+                            kind: identifier
+                            pattern: $NODEFORGE
+                  - has:
+                      stopBy: neighbor
+                      kind: string
+                      has:
+                        stopBy: neighbor
+                        kind: string_fragment
+                        regex: ^node-forgeo$
+                        not:
+                          inside:
+                            stopBy: end
+                            kind: array
+            - follows:
+                stopBy: end
+                kind: variable_declaration
+                has:
+                  stopBy: neighbor
+                  kind: variable_declarator
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $NODEFORGE
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^node-forge$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+            - follows:
+                stopBy: end
+                kind: expression_statement
+                has:
+                  stopBy: neighbor
+                  kind: assignment_expression
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $NODEFORGE
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^node-forge$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+            - follows:
+                stopBy: end
+                kind: lexical_declaration
+                has:
+                  stopBy: neighbor
+                  kind: variable_declarator
+                  all:
+                    - has:
+                        stopBy: neighbor
+                        kind: identifier
+                        pattern: $NODEFORGE
+                    - has:
+                        stopBy: neighbor
+                        kind: call_expression
+                        all:
+                          - has:
+                              stopBy: neighbor
+                              kind: identifier
+                              regex: ^require$
+                          - has:
+                              stopBy: neighbor
+                              kind: arguments
+                              has:
+                                stopBy: end
+                                kind: string_fragment
+                                regex: ^node-forge$
+                                not:
+                                  inside:
+                                    stopBy: end
+                                    kind: array
+rule:
+  any:
+    - kind: number
+      any:
+        - matches: PATTERN_require_crypto
+        - matches: PATTERN_require_crypto__pattern_2
+        - matches: PATTERN_require_node-rsa
+        - matches: PATTERN_require_node-forge
+        - matches: PATTERN_require_node-forge__pattern_2
+    - kind: unary_expression
+      any:
+        - matches: PATTERN_require_crypto
+        - matches: PATTERN_require_crypto__pattern_2
+        - matches: PATTERN_require_node-rsa
+        - matches: PATTERN_require_node-forge
+        - matches: PATTERN_require_node-forge__pattern_2
+    - kind: binary_expression
+      any:
+        - matches: PATTERN_require_crypto
+        - matches: PATTERN_require_crypto__pattern_2
+        - matches: PATTERN_require_node-rsa
+        - matches: PATTERN_require_node-forge
+        - matches: PATTERN_require_node-forge__pattern_2
+constraints:
+  NUMBER:
+    regex: >-
+      ^([+-]?(0|[1-9][0-9]?|[1-9][0-9]{2}|1[0-9]{3}|20[0-3][0-9]|204[0-7])(\.[0-9]+)?|([+-]?(0|[1-9][0-9]?|[1-9][0-9]{2}|1[0-9]{3}|20[0-3][0-9]|204[0-7])(\.[0-9]+)?\/[1-9][0-9]*)|[+-]?(\.[0-9]+)|([+-]?\.[0-9]+\/[1-9][0-9]*))$