@harness-engineering/eslint-plugin 0.2.4 → 0.3.0

package/dist/index.d.ts

@@ -22,6 +22,9 @@ declare const rules: {
     'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
+    'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
     'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
@@ -66,6 +69,9 @@ declare const plugin: {
         'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
+        'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
         'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
@@ -95,6 +101,7 @@ declare const plugin: {
                 '@harness-engineering/enforce-doc-exports': string;
                 '@harness-engineering/no-unix-shell-command': string;
                 '@harness-engineering/no-hardcoded-path-separator': string;
+                '@harness-engineering/no-process-env-in-spawn': string;
                 '@harness-engineering/require-path-normalization': string;
             };
         };
@@ -110,6 +117,7 @@ declare const plugin: {
                 '@harness-engineering/enforce-doc-exports': string;
                 '@harness-engineering/no-unix-shell-command': string;
                 '@harness-engineering/no-hardcoded-path-separator': string;
+                '@harness-engineering/no-process-env-in-spawn': string;
                 '@harness-engineering/require-path-normalization': string;
             };
         };
@@ -146,6 +154,9 @@ declare const configs: {
                     'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
+                    'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+                        name: string;
+                    };
                     'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
@@ -173,6 +184,7 @@ declare const configs: {
             '@harness-engineering/enforce-doc-exports': string;
             '@harness-engineering/no-unix-shell-command': string;
             '@harness-engineering/no-hardcoded-path-separator': string;
+            '@harness-engineering/no-process-env-in-spawn': string;
             '@harness-engineering/require-path-normalization': string;
         };
     };
@@ -205,6 +217,9 @@ declare const configs: {
                     'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
+                    'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+                        name: string;
+                    };
                     'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
@@ -232,6 +247,7 @@ declare const configs: {
             '@harness-engineering/enforce-doc-exports': string;
             '@harness-engineering/no-unix-shell-command': string;
             '@harness-engineering/no-hardcoded-path-separator': string;
+            '@harness-engineering/no-process-env-in-spawn': string;
             '@harness-engineering/require-path-normalization': string;
         };
     };

package/dist/index.js

@@ -935,11 +935,71 @@ var no_hardcoded_path_separator_default = createRule10({
   }
 });
 
-// src/rules/require-path-normalization.ts
+// src/rules/no-process-env-in-spawn.ts
 import { ESLintUtils as ESLintUtils11 } from "@typescript-eslint/utils";
 var createRule11 = ESLintUtils11.RuleCreator(
   (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
 );
+var SPAWN_FUNCTIONS = /* @__PURE__ */ new Set(["spawn", "spawnSync", "execFile", "execFileSync", "fork"]);
+function getSpawnFunctionName(node) {
+  if (node.callee.type === "Identifier" && SPAWN_FUNCTIONS.has(node.callee.name)) {
+    return node.callee.name;
+  }
+  if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier" && SPAWN_FUNCTIONS.has(node.callee.property.name)) {
+    return node.callee.property.name;
+  }
+  return void 0;
+}
+function isProcessEnv(node) {
+  return node.type === "MemberExpression" && node.object.type === "Identifier" && node.object.name === "process" && node.property.type === "Identifier" && node.property.name === "env";
+}
+function hasProcessEnvProperty(node) {
+  for (const prop of node.properties) {
+    if (prop.type === "Property" && prop.key.type === "Identifier" && prop.key.name === "env" && isProcessEnv(prop.value)) {
+      return prop;
+    }
+    if (prop.type === "SpreadElement" && isProcessEnv(prop.argument)) {
+      return prop;
+    }
+  }
+  return void 0;
+}
+var no_process_env_in_spawn_default = createRule11({
+  name: "no-process-env-in-spawn",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow passing process.env directly to spawn/execFile/fork, which leaks all server-side secrets to child processes"
+    },
+    messages: {
+      processEnvInSpawn: "Do not pass process.env directly to '{{name}}'. Build an explicit env object with only the variables the child process needs."
+    },
+    schema: []
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        const name = getSpawnFunctionName(node);
+        if (!name) return;
+        for (const arg of node.arguments) {
+          if (arg.type === "ObjectExpression") {
+            const envProp = hasProcessEnvProperty(arg);
+            if (envProp) {
+              context.report({ node: envProp, messageId: "processEnvInSpawn", data: { name } });
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/rules/require-path-normalization.ts
+import { ESLintUtils as ESLintUtils12 } from "@typescript-eslint/utils";
+var createRule12 = ESLintUtils12.RuleCreator(
+  (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
+);
 function isRelativeCall(node) {
   const callee = node.callee;
   if (callee.type === "Identifier" && callee.name === "relative") {
@@ -965,7 +1025,7 @@ function hasNormalization(node) {
   if (grandparent?.type !== "CallExpression" || grandparent.arguments.length < 1) return false;
   return isBackslashNormalizationArg(grandparent.arguments[0]);
 }
-var require_path_normalization_default = createRule11({
+var require_path_normalization_default = createRule12({
   name: "require-path-normalization",
   meta: {
     type: "problem",
@@ -1000,6 +1060,7 @@ var rules = {
   "no-hardcoded-path-separator": no_hardcoded_path_separator_default,
   "no-layer-violation": no_layer_violation_default,
   "no-nested-loops-in-critical": no_nested_loops_in_critical_default,
+  "no-process-env-in-spawn": no_process_env_in_spawn_default,
   "no-sync-io-in-async": no_sync_io_in_async_default,
   "no-unbounded-array-chains": no_unbounded_array_chains_default,
   "no-unix-shell-command": no_unix_shell_command_default,
@@ -1029,6 +1090,7 @@ var plugin = {
         "@harness-engineering/enforce-doc-exports": "warn",
         "@harness-engineering/no-unix-shell-command": "warn",
         "@harness-engineering/no-hardcoded-path-separator": "warn",
+        "@harness-engineering/no-process-env-in-spawn": "error",
         "@harness-engineering/require-path-normalization": "warn"
       }
     },
@@ -1046,6 +1108,7 @@ var plugin = {
         "@harness-engineering/enforce-doc-exports": "error",
         "@harness-engineering/no-unix-shell-command": "error",
         "@harness-engineering/no-hardcoded-path-separator": "error",
+        "@harness-engineering/no-process-env-in-spawn": "error",
         "@harness-engineering/require-path-normalization": "error"
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-engineering/eslint-plugin",
-  "version": "0.2.4",
+  "version": "0.3.0",
   "description": "ESLint plugin for harness engineering architectural constraints",
   "type": "module",
   "main": "./dist/index.js",
@@ -16,19 +16,19 @@
     "README.md"
   ],
   "dependencies": {
-    "@typescript-eslint/utils": "^8.58.0",
+    "@typescript-eslint/utils": "^8.59.0",
     "minimatch": "^10.2.5",
     "zod": "^3.25.76"
   },
   "devDependencies": {
     "@types/node": "^22.19.15",
-    "@typescript-eslint/parser": "^8.58.0",
-    "@typescript-eslint/rule-tester": "^8.58.0",
-    "@vitest/coverage-v8": "^4.1.2",
-    "eslint": "^10.1.0",
+    "@typescript-eslint/parser": "^8.59.0",
+    "@typescript-eslint/rule-tester": "^8.59.0",
+    "@vitest/coverage-v8": "^4.1.5",
+    "eslint": "^10.2.1",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.2"
+    "vitest": "^4.1.5"
   },
   "peerDependencies": {
     "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",