@n8n/eslint-plugin-community-nodes 0.19.0 → 0.21.0

package/src/rules/no-dangerous-functions.ts

@@ -0,0 +1,155 @@
+import { TSESTree } from '@typescript-eslint/utils';
+
+import {
+	createRule,
+	getModulePath,
+	isDirectRequireCall,
+	isRequireMemberCall,
+} from '../utils/index.js';
+
+const { AST_NODE_TYPES } = TSESTree;
+
+const CHILD_PROCESS_MODULES = new Set(['child_process', 'node:child_process']);
+
+/**
+ * `child_process` functions that spawn OS processes and are therefore
+ * vulnerable to command injection when fed untrusted input.
+ */
+const DANGEROUS_CHILD_PROCESS_FUNCTIONS = new Set([
+	'exec',
+	'execSync',
+	'execFile',
+	'execFileSync',
+	'spawn',
+	'spawnSync',
+	'fork',
+]);
+
+const isChildProcessModule = (node: TSESTree.Node | null): boolean => {
+	const modulePath = getModulePath(node);
+	return modulePath !== null && CHILD_PROCESS_MODULES.has(modulePath);
+};
+
+export const NoDangerousFunctionsRule = createRule({
+	name: 'no-dangerous-functions',
+	meta: {
+		type: 'problem',
+		docs: {
+			description:
+				'Disallow `eval`, the `Function` constructor, and `child_process` process-spawning functions (`exec`, `spawn`, etc.) in community nodes.',
+		},
+		messages: {
+			noEval:
+				'Use of `eval` is not allowed. It executes arbitrary code and is a common source of remote code execution vulnerabilities.',
+			noFunctionConstructor:
+				'Use of the `Function` constructor is not allowed. Like `eval`, it executes arbitrary code from strings.',
+			noChildProcess:
+				'Use of `{{ name }}` from `child_process` is not allowed. Spawning OS processes is not permitted in community nodes and can lead to command injection.',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		// Local names bound to dangerous named imports, e.g. `import { exec as run }` -> `run`.
+		const dangerousLocalNames = new Map<string, string>();
+		// Local names bound to the whole module, e.g. `import * as cp` or `const cp = require(...)`.
+		const namespaceNames = new Set<string>();
+
+		const recordDestructuredModule = (pattern: TSESTree.ObjectPattern) => {
+			for (const property of pattern.properties) {
+				if (
+					property.type !== AST_NODE_TYPES.Property ||
+					property.key.type !== AST_NODE_TYPES.Identifier ||
+					!DANGEROUS_CHILD_PROCESS_FUNCTIONS.has(property.key.name)
+				) {
+					continue;
+				}
+
+				if (property.value.type === AST_NODE_TYPES.Identifier) {
+					dangerousLocalNames.set(property.value.name, property.key.name);
+				}
+			}
+		};
+
+		return {
+			ImportDeclaration(node) {
+				if (!CHILD_PROCESS_MODULES.has(node.source.value)) return;
+
+				for (const specifier of node.specifiers) {
+					if (
+						specifier.type === AST_NODE_TYPES.ImportSpecifier &&
+						specifier.imported.type === AST_NODE_TYPES.Identifier &&
+						DANGEROUS_CHILD_PROCESS_FUNCTIONS.has(specifier.imported.name)
+					) {
+						dangerousLocalNames.set(specifier.local.name, specifier.imported.name);
+					} else if (
+						specifier.type === AST_NODE_TYPES.ImportNamespaceSpecifier ||
+						specifier.type === AST_NODE_TYPES.ImportDefaultSpecifier
+					) {
+						namespaceNames.add(specifier.local.name);
+					}
+				}
+			},
+
+			VariableDeclarator(node) {
+				if (
+					node.init?.type !== AST_NODE_TYPES.CallExpression ||
+					!(isDirectRequireCall(node.init) || isRequireMemberCall(node.init)) ||
+					!isChildProcessModule(node.init.arguments[0] ?? null)
+				) {
+					return;
+				}
+
+				if (node.id.type === AST_NODE_TYPES.ObjectPattern) {
+					recordDestructuredModule(node.id);
+				} else if (node.id.type === AST_NODE_TYPES.Identifier) {
+					namespaceNames.add(node.id.name);
+				}
+			},
+
+			NewExpression(node) {
+				if (node.callee.type === AST_NODE_TYPES.Identifier && node.callee.name === 'Function') {
+					context.report({ node, messageId: 'noFunctionConstructor' });
+				}
+			},
+
+			CallExpression(node) {
+				const { callee } = node;
+
+				if (callee.type === AST_NODE_TYPES.Identifier) {
+					if (callee.name === 'eval') {
+						context.report({ node, messageId: 'noEval' });
+						return;
+					}
+
+					if (callee.name === 'Function') {
+						context.report({ node, messageId: 'noFunctionConstructor' });
+						return;
+					}
+
+					const originalName = dangerousLocalNames.get(callee.name);
+					if (originalName) {
+						context.report({ node, messageId: 'noChildProcess', data: { name: originalName } });
+					}
+
+					return;
+				}
+
+				if (
+					callee.type === AST_NODE_TYPES.MemberExpression &&
+					!callee.computed &&
+					callee.object.type === AST_NODE_TYPES.Identifier &&
+					namespaceNames.has(callee.object.name) &&
+					callee.property.type === AST_NODE_TYPES.Identifier &&
+					DANGEROUS_CHILD_PROCESS_FUNCTIONS.has(callee.property.name)
+				) {
+					context.report({
+						node,
+						messageId: 'noChildProcess',
+						data: { name: callee.property.name },
+					});
+				}
+			},
+		};
+	},
+});

package/src/rules/no-emoji-in-options.test.ts

@@ -0,0 +1,157 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { NoEmojiInOptionsRule } from './no-emoji-in-options.js';
+
+const ruleTester = new RuleTester();
+
+function createNodeCode(body: string): string {
+	return `
+		import type { INodeType, INodeTypeDescription } from 'n8n-workflow';
+
+		export class TestNode implements INodeType {
+			description: INodeTypeDescription = {
+				${body}
+			};
+		}
+	`;
+}
+
+ruleTester.run('no-emoji-in-options', NoEmojiInOptionsRule, {
+	valid: [
+		{
+			name: 'class that does not implement INodeType',
+			filename: '/tmp/TestNode.node.ts',
+			code: `
+				export class NotANode {
+					description = { displayName: '🚀 Rocket' };
+				}
+			`,
+		},
+		{
+			name: 'non .node.ts file is ignored',
+			filename: '/tmp/helper.ts',
+			code: `
+				export class TestNode {
+					description = { displayName: '🚀 Rocket' };
+				}
+			`,
+		},
+		{
+			name: 'node and option labels without emoji',
+			filename: '/tmp/TestNode.node.ts',
+			code: createNodeCode(`
+				displayName: 'Test Node',
+				name: 'testNode',
+				defaults: { name: 'Test Node' },
+				properties: [
+					{
+						displayName: 'Operation',
+						name: 'operation',
+						type: 'options',
+						options: [
+							{ name: 'Create', value: 'create' },
+							{ name: 'Delete', value: 'delete' },
+						],
+						default: 'create',
+					},
+				],
+			`),
+		},
+		{
+			name: 'accented and non-latin characters are allowed',
+			filename: '/tmp/TestNode.node.ts',
+			code: createNodeCode(`
+				displayName: 'Créer un café',
+				name: 'testNode',
+				properties: [
+					{
+						displayName: '日本語',
+						name: 'field',
+						type: 'string',
+						default: '',
+					},
+				],
+			`),
+		},
+	],
+	invalid: [
+		{
+			name: 'emoji in node displayName',
+			filename: '/tmp/TestNode.node.ts',
+			code: createNodeCode(`
+				displayName: '🚀 Rocket Node',
+				name: 'testNode',
+				properties: [],
+			`),
+			errors: [{ messageId: 'emojiInOption', data: { key: 'displayName', emoji: '🚀' } }],
+		},
+		{
+			name: 'emoji in option name within options array',
+			filename: '/tmp/TestNode.node.ts',
+			code: createNodeCode(`
+				displayName: 'Test Node',
+				name: 'testNode',
+				properties: [
+					{
+						displayName: 'Operation',
+						name: 'operation',
+						type: 'options',
+						options: [
+							{ name: '✅ Create', value: 'create' },
+							{ name: 'Delete', value: 'delete' },
+						],
+						default: 'create',
+					},
+				],
+			`),
+			errors: [{ messageId: 'emojiInOption', data: { key: 'name', emoji: '✅' } }],
+		},
+		{
+			name: 'emoji in property displayName',
+			filename: '/tmp/TestNode.node.ts',
+			code: createNodeCode(`
+				displayName: 'Test Node',
+				name: 'testNode',
+				properties: [
+					{
+						displayName: 'First Name 🙂',
+						name: 'firstName',
+						type: 'string',
+						default: '',
+					},
+				],
+			`),
+			errors: [{ messageId: 'emojiInOption', data: { key: 'displayName', emoji: '🙂' } }],
+		},
+		{
+			name: 'flag emoji built from regional indicators',
+			filename: '/tmp/TestNode.node.ts',
+			code: createNodeCode(`
+				displayName: 'Region 🇺🇸',
+				name: 'testNode',
+				properties: [],
+			`),
+			errors: [{ messageId: 'emojiInOption', data: { key: 'displayName', emoji: '🇺 🇸' } }],
+		},
+		{
+			name: 'multiple emoji values reported separately',
+			filename: '/tmp/TestNode.node.ts',
+			code: createNodeCode(`
+				displayName: '🚀 Node',
+				name: 'testNode',
+				properties: [
+					{
+						displayName: 'Field 🎉',
+						name: 'field',
+						type: 'string',
+						default: '',
+					},
+				],
+			`),
+			errors: [
+				{ messageId: 'emojiInOption', data: { key: 'displayName', emoji: '🚀' } },
+				{ messageId: 'emojiInOption', data: { key: 'displayName', emoji: '🎉' } },
+			],
+		},
+	],
+});

package/src/rules/no-emoji-in-options.ts

@@ -0,0 +1,105 @@
+import type { TSESTree } from '@typescript-eslint/utils';
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+
+import {
+	isNodeTypeClass,
+	findClassProperty,
+	getStringLiteralValue,
+	isFileType,
+	createRule,
+} from '../utils/index.js';
+
+/**
+ * Matches emoji characters: pictographs (😀, 🚀, ✉️, etc.) and regional
+ * indicator symbols that compose flag emoji (🇺🇸).
+ */
+const EMOJI_REGEX = /(\p{Extended_Pictographic}|\p{Regional_Indicator})/gu;
+
+/** Keys whose string values are surfaced to users as labels. */
+const LABEL_KEYS = new Set(['name', 'displayName']);
+
+export const NoEmojiInOptionsRule = createRule({
+	name: 'no-emoji-in-options',
+	meta: {
+		type: 'problem',
+		docs: {
+			description: 'Disallow emoji characters in node option name and displayName values',
+		},
+		messages: {
+			emojiInOption: 'Emoji characters are not allowed in "{{ key }}" values. Found: {{ emoji }}.',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		if (!isFileType(context.filename, '.node.ts')) {
+			return {};
+		}
+
+		const checkLabelValue = (key: string, valueNode: TSESTree.Node): void => {
+			const value = getStringLiteralValue(valueNode);
+			if (value === null) {
+				return;
+			}
+
+			const matches = value.match(EMOJI_REGEX);
+			if (!matches) {
+				return;
+			}
+
+			context.report({
+				node: valueNode,
+				messageId: 'emojiInOption',
+				data: {
+					key,
+					emoji: [...new Set(matches)].join(' '),
+				},
+			});
+		};
+
+		const traverse = (node: TSESTree.Node): void => {
+			if (node.type === AST_NODE_TYPES.ObjectExpression) {
+				for (const property of node.properties) {
+					if (
+						property.type === AST_NODE_TYPES.Property &&
+						property.key.type === AST_NODE_TYPES.Identifier &&
+						LABEL_KEYS.has(property.key.name)
+					) {
+						checkLabelValue(property.key.name, property.value);
+					}
+				}
+			}
+
+			for (const key in node) {
+				if (key === 'parent') {
+					continue;
+				}
+				const child = node[key as keyof TSESTree.Node] as unknown;
+				if (Array.isArray(child)) {
+					for (const item of child) {
+						if (item && typeof item === 'object' && 'type' in item) {
+							traverse(item as TSESTree.Node);
+						}
+					}
+				} else if (child && typeof child === 'object' && 'type' in child) {
+					traverse(child as TSESTree.Node);
+				}
+			}
+		};
+
+		return {
+			ClassDeclaration(node) {
+				if (!isNodeTypeClass(node)) {
+					return;
+				}
+
+				const descriptionProperty = findClassProperty(node, 'description');
+				if (!descriptionProperty?.value) {
+					return;
+				}
+
+				traverse(descriptionProperty.value);
+			},
+		};
+	},
+});

package/src/rules/node-filename-against-convention.test.ts

@@ -0,0 +1,115 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { NodeFilenameAgainstConventionRule } from './node-filename-against-convention.js';
+
+const ruleTester = new RuleTester();
+
+function createNodeCode(name: string): string {
+	return `
+import type { INodeType, INodeTypeDescription } from 'n8n-workflow';
+
+export class TestNode implements INodeType {
+	description: INodeTypeDescription = {
+		displayName: 'Test Node',
+		name: '${name}',
+		group: ['input'],
+		version: 1,
+		description: 'A test node',
+		defaults: { name: 'Test Node' },
+		inputs: [],
+		outputs: [],
+		properties: [],
+	};
+}`;
+}
+
+function createNodeCodeWithoutName(): string {
+	return `
+import type { INodeType, INodeTypeDescription } from 'n8n-workflow';
+
+export class TestNode implements INodeType {
+	description: INodeTypeDescription = {
+		displayName: 'Test Node',
+		group: ['input'],
+		version: 1,
+		description: 'A test node',
+		defaults: { name: 'Test Node' },
+		inputs: [],
+		outputs: [],
+		properties: [],
+	};
+}`;
+}
+
+function createRegularClass(): string {
+	return `
+export class SomeHelper {
+	name = 'github';
+}`;
+}
+
+ruleTester.run('node-filename-against-convention', NodeFilenameAgainstConventionRule, {
+	valid: [
+		{
+			name: 'filename matches PascalCased description.name',
+			filename: '/tmp/Github.node.ts',
+			code: createNodeCode('github'),
+		},
+		{
+			name: 'filename with version suffix is accepted',
+			filename: '/tmp/GithubV2.node.ts',
+			code: createNodeCode('github'),
+		},
+		{
+			name: 'filename with multi-digit version suffix is accepted',
+			filename: '/tmp/GithubV10.node.ts',
+			code: createNodeCode('github'),
+		},
+		{
+			name: 'multi-word camelCase name maps to PascalCase filename',
+			filename: '/tmp/GoogleSheets.node.ts',
+			code: createNodeCode('googleSheets'),
+		},
+		{
+			name: 'class not implementing INodeType is ignored',
+			filename: '/tmp/Github.node.ts',
+			code: createRegularClass(),
+		},
+		{
+			name: 'non-.node.ts file is ignored',
+			filename: '/tmp/Github.ts',
+			code: createNodeCode('mismatch'),
+		},
+		{
+			name: 'missing description.name is ignored',
+			filename: '/tmp/Github.node.ts',
+			code: createNodeCodeWithoutName(),
+		},
+	],
+	invalid: [
+		{
+			name: 'filename does not match description.name',
+			filename: '/tmp/Github.node.ts',
+			code: createNodeCode('gitlab'),
+			errors: [{ messageId: 'renameFile', data: { expected: 'Gitlab.node.ts' } }],
+		},
+		{
+			name: 'filename is lowercased',
+			filename: '/tmp/github.node.ts',
+			code: createNodeCode('github'),
+			errors: [{ messageId: 'renameFile', data: { expected: 'Github.node.ts' } }],
+		},
+		{
+			name: 'filename has wrong internal casing',
+			filename: '/tmp/GitHub.node.ts',
+			code: createNodeCode('github'),
+			errors: [{ messageId: 'renameFile', data: { expected: 'Github.node.ts' } }],
+		},
+		{
+			name: 'version suffix does not excuse a mismatched base name',
+			filename: '/tmp/GitlabV2.node.ts',
+			code: createNodeCode('github'),
+			errors: [{ messageId: 'renameFile', data: { expected: 'Github.node.ts' } }],
+		},
+	],
+});

package/src/rules/node-filename-against-convention.ts

@@ -0,0 +1,76 @@
+import { TSESTree } from '@typescript-eslint/utils';
+import * as path from 'node:path';
+
+import {
+	isNodeTypeClass,
+	findClassProperty,
+	findObjectProperty,
+	getStringLiteralValue,
+	isFileType,
+	createRule,
+} from '../utils/index.js';
+
+/**
+ * Converts a `description.name` to the expected node file basename by
+ * upper-casing the first character. The source of truth is `description.name`,
+ * not the class name. Example: `github` -> `Github`.
+ */
+function toExpectedBaseName(name: string): string {
+	return name.charAt(0).toUpperCase() + name.slice(1);
+}
+
+export const NodeFilenameAgainstConventionRule = createRule({
+	name: 'node-filename-against-convention',
+	meta: {
+		type: 'problem',
+		docs: {
+			description: 'Node filename must match the node `description.name`',
+		},
+		messages: {
+			renameFile: 'Node filename must match `description.name`. Rename file to "{{expected}}".',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		if (!isFileType(context.filename, '.node.ts')) {
+			return {};
+		}
+
+		return {
+			ClassDeclaration(node) {
+				if (!isNodeTypeClass(node)) {
+					return;
+				}
+
+				const descriptionProperty = findClassProperty(node, 'description');
+				if (descriptionProperty?.value?.type !== TSESTree.AST_NODE_TYPES.ObjectExpression) {
+					return;
+				}
+
+				const nameProperty = findObjectProperty(descriptionProperty.value, 'name');
+				if (!nameProperty) {
+					return;
+				}
+
+				const name = getStringLiteralValue(nameProperty.value);
+				if (!name) {
+					return;
+				}
+
+				const expectedBaseName = toExpectedBaseName(name);
+				// Strip the `.node.ts` extension and any trailing `V<digits>` version
+				// suffix so versioned files (e.g. `GithubV2.node.ts`) are accepted.
+				const actualBaseName = path.basename(context.filename, '.node.ts').replace(/V\d+$/, '');
+
+				if (actualBaseName !== expectedBaseName) {
+					context.report({
+						node: nameProperty.value,
+						messageId: 'renameFile',
+						data: { expected: `${expectedBaseName}.node.ts` },
+					});
+				}
+			},
+		};
+	},
+});

package/src/rules/node-registration-complete.test.ts

@@ -0,0 +1,87 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { afterEach, vi } from 'vitest';
+
+import { NodeRegistrationCompleteRule } from './node-registration-complete.js';
+import * as fileUtils from '../utils/file-utils.js';
+
+vi.mock('../utils/file-utils.js', async () => {
+	const actual = await vi.importActual('../utils/file-utils.js');
+	return {
+		...actual,
+		findNodeSourceFilesOnDisk: vi.fn(),
+		readPackageJsonNodes: vi.fn(),
+	};
+});
+
+const mockFindNodeSourceFilesOnDisk = vi.mocked(fileUtils.findNodeSourceFilesOnDisk);
+const mockReadPackageJsonNodes = vi.mocked(fileUtils.readPackageJsonNodes);
+
+const packageJsonPath = '/tmp/package.json';
+const fooNode = '/tmp/nodes/Foo/Foo.node.ts';
+const barNode = '/tmp/nodes/Bar/Bar.node.ts';
+
+const ruleTester = new RuleTester();
+
+function setup(onDisk: string[], registered: string[]): void {
+	mockFindNodeSourceFilesOnDisk.mockReturnValue(onDisk);
+	mockReadPackageJsonNodes.mockReturnValue(registered);
+}
+
+afterEach(() => {
+	vi.clearAllMocks();
+});
+
+// Default: both node files exist on disk and both are registered.
+setup([fooNode, barNode], [fooNode, barNode]);
+
+ruleTester.run('node-registration-complete', NodeRegistrationCompleteRule, {
+	valid: [
+		{
+			name: 'all node files are registered',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example", "n8n": { "nodes": ["dist/nodes/Foo/Foo.node.js", "dist/nodes/Bar/Bar.node.js"] } }',
+		},
+		{
+			name: 'non-package.json file is ignored',
+			filename: 'some-config.json',
+			code: '{ "name": "n8n-nodes-example" }',
+		},
+	],
+	invalid: [
+		{
+			name: 'one node file is not registered',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example", "n8n": { "nodes": ["dist/nodes/Foo/Foo.node.js"] } }',
+			before() {
+				setup([fooNode, barNode], [fooNode]);
+			},
+			errors: [
+				{
+					messageId: 'nodeNotRegistered',
+					data: { nodeFile: 'nodes/Bar/Bar.node.ts' },
+				},
+			],
+		},
+		{
+			name: 'multiple node files are not registered',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example", "n8n": { "nodes": [] } }',
+			before() {
+				setup([fooNode, barNode], []);
+			},
+			errors: [
+				{ messageId: 'nodeNotRegistered', data: { nodeFile: 'nodes/Foo/Foo.node.ts' } },
+				{ messageId: 'nodeNotRegistered', data: { nodeFile: 'nodes/Bar/Bar.node.ts' } },
+			],
+		},
+		{
+			name: 'node files exist on disk but there is no n8n object',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup([fooNode], []);
+			},
+			errors: [{ messageId: 'nodeNotRegistered', data: { nodeFile: 'nodes/Foo/Foo.node.ts' } }],
+		},
+	],
+});