@n8n/eslint-plugin-community-nodes 0.25.0 → 0.27.0

package/src/rules/no-hardcoded-secrets.test.ts

@@ -0,0 +1,124 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { NoHardcodedSecretsRule } from './no-hardcoded-secrets.js';
+
+const ruleTester = new RuleTester();
+
+// A 40-char hex string (SHA-1 shaped) — a realistic hardcoded secret value.
+const HEX_SECRET = 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0';
+// A base64/token-shaped value with mixed case, digits and punctuation.
+const TOKEN_SECRET = 'sk-1a2B3c4D5e6F7g8H9i0J-kLmNoP';
+
+ruleTester.run('no-hardcoded-secrets', NoHardcodedSecretsRule, {
+	valid: [
+		// Non-secret variable names are never inspected.
+		{ name: 'non-secret variable name', code: `const label = '${HEX_SECRET}';` },
+		{ name: 'unrelated name with long value', code: `const description = '${TOKEN_SECRET}';` },
+
+		// Secret-named variables with short values are ignored (< 16 chars).
+		{ name: 'short secret value', code: "const apiKey = 'short';" },
+		{ name: '15 chars, below minimum', code: "const token = 'abcdef012345678';" },
+
+		// Secret-named variables holding prose / human-readable strings.
+		{
+			name: 'secret name with human text',
+			code: "const passwordHint = 'Enter your account password here';",
+		},
+		{
+			name: 'secret name with spaces in value',
+			code: "const secretNote = 'this is not a secret';",
+		},
+
+		// Plain long camelCase word is not token-shaped (no digits/punctuation).
+		{ name: 'long word without digits', code: "const tokenName = 'anExtraordinarilyLongName';" },
+
+		// Dotted / hyphenated / snake_case constants without a digit+letter mix
+		// are common (scopes, paths, ids) and must not be treated as secrets.
+		{ name: 'dotted scope string', code: "const authScope = 'read.write.admin.profile.email';" },
+		{ name: 'hyphenated slug', code: "const secretName = 'my-very-long-descriptive-slug';" },
+		{ name: 'snake_case constant', code: "const tokenType = 'refresh_token_grant_type_value';" },
+
+		// Secret-shaped name but non-secret value: the value gate, not the name,
+		// is what decides. `tokenId` no longer benefits from a name exclusion, so
+		// this proves a benign value still passes on its own merits.
+		{
+			name: 'tokenId with human-readable value',
+			code: "const tokenId = 'primary-session-reference';",
+		},
+
+		// Obvious placeholders are skipped.
+		{ name: 'placeholder value', code: "const apiKey = 'your-api-key-goes-here-xxxx';" },
+		{ name: 'example placeholder', code: `const secret = 'example-secret-${HEX_SECRET}';` },
+
+		// Not a static string literal.
+		{ name: 'value from env', code: 'const apiKey = process.env.API_KEY;' },
+		// The payload must itself contain `${` to be a real template literal.
+		// eslint-disable-next-line n8n-local-rules/no-interpolation-in-regular-string
+		{ name: 'template literal with expression', code: 'const token = `${suffix}`;' },
+		{ name: 'computed member assignment', code: `obj[key] = '${HEX_SECRET}';` },
+	],
+	invalid: [
+		{
+			name: 'SECURITY: exactly 16 chars is flagged (minimum length)',
+			code: "const token = 'abcdef0123456789';",
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'token' } }],
+		},
+		{
+			name: 'SECURITY: hex secret in variable',
+			code: `const apiKey = '${HEX_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'apiKey' } }],
+		},
+		{
+			name: 'SECURITY: token-shaped secret in variable',
+			code: `const accessToken = '${TOKEN_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'accessToken' } }],
+		},
+		{
+			name: 'SECURITY: secret in object property (identifier key)',
+			code: `const config = { clientSecret: '${HEX_SECRET}' };`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'clientSecret' } }],
+		},
+		{
+			name: 'SECURITY: secret in object property (string key)',
+			code: `const config = { 'api_key': '${HEX_SECRET}' };`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'api_key' } }],
+		},
+		{
+			name: 'SECURITY: secret in class field',
+			code: `class C { private password = '${TOKEN_SECRET}'; }`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'password' } }],
+		},
+		{
+			name: 'SECURITY: secret in member assignment',
+			code: `this.authToken = '${HEX_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'authToken' } }],
+		},
+		{
+			name: 'SECURITY: secret in identifier assignment',
+			code: `secretKey = '${TOKEN_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'secretKey' } }],
+		},
+		{
+			name: 'SECURITY: secret in no-expression template literal',
+			code: `const apiKey = \`${HEX_SECRET}\`;`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'apiKey' } }],
+		},
+		// No name exclusions: a secret-shaped value is flagged even when the name
+		// also contains a normally-"non-sensitive" fragment (url/pub/id).
+		{
+			name: 'SECURITY: secret on name containing "pub"',
+			code: `const publicKey = '${HEX_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'publicKey' } }],
+		},
+		{
+			name: 'SECURITY: secret on name containing "id"',
+			code: `const tokenId = '${HEX_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'tokenId' } }],
+		},
+		{
+			name: 'SECURITY: secret on name containing "url"',
+			code: `const tokenUrl = '${TOKEN_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'tokenUrl' } }],
+		},
+	],
+});

package/src/rules/no-hardcoded-secrets.ts

@@ -0,0 +1,161 @@
+import { TSESTree } from '@typescript-eslint/utils';
+
+import { createRule, getStringLiteralValue, isSensitiveName } from '../utils/index.js';
+
+const { AST_NODE_TYPES } = TSESTree;
+
+/**
+ * Extra name fragments (beyond the shared sensitive set in `credential-fields`)
+ * that suggest a JS identifier holds a credential. Bare `key`/`auth` are broad,
+ * but the value heuristic below narrows the match, and they catch separator
+ * forms such as `api_key` that the compound fragments miss.
+ */
+const EXTRA_SECRET_NAME_FRAGMENTS = ['key', 'passwd', 'auth'];
+
+/**
+ * Fragments that mark a value as an obvious placeholder rather than a real
+ * secret. These are skipped to keep the (intentionally heuristic) rule quieter.
+ */
+const PLACEHOLDER_FRAGMENTS = [
+	'example',
+	'placeholder',
+	'changeme',
+	'your',
+	'dummy',
+	'xxxx',
+	'<',
+	'{{',
+];
+
+const MIN_SECRET_LENGTH = 16;
+
+function nameLooksLikeSecret(name: string): boolean {
+	// `exclusions: []` disables the URL/ID/pub name exclusions on purpose: the
+	// value heuristic below is the real gate, so a suspicious value on e.g.
+	// `publicKeyUrl` should still be flagged rather than silently skipped. Erring
+	// toward a false positive is safer than missing a secret.
+	return isSensitiveName(name, { extra: EXTRA_SECRET_NAME_FRAGMENTS, exclusions: [] });
+}
+
+function looksLikePlaceholder(value: string): boolean {
+	const lower = value.toLowerCase();
+	return PLACEHOLDER_FRAGMENTS.some((fragment) => lower.includes(fragment));
+}
+
+/**
+ * Heuristic: does this string value look like a real credential? Real secrets
+ * are long, contiguous tokens with the shape of a hex digest or a base64/token
+ * string. The digit+letter/punctuation requirement keeps ordinary long
+ * camelCase words from being treated as secrets.
+ */
+function looksLikeSecretValue(value: string): boolean {
+	// Require at least MIN_SECRET_LENGTH characters; anything shorter is almost
+	// always a non-secret word or identifier rather than a generated credential.
+	if (value.length < MIN_SECRET_LENGTH) return false;
+	if (/\s/.test(value)) return false;
+	if (looksLikePlaceholder(value)) return false;
+
+	// A long, purely hexadecimal string (e.g. an MD5/SHA/hex API key).
+	if (/^[0-9a-f]+$/i.test(value)) return true;
+
+	// A base64 / base64url / token-shaped string.
+	if (/^[A-Za-z0-9+/=_.-]+$/.test(value)) {
+		const hasDigit = /[0-9]/.test(value);
+		const hasLetter = /[a-z]/i.test(value);
+		// Only `+ / =` count as a standalone signal: they are hallmarks of base64
+		// but rarely appear in ordinary code strings. `. - _` are excluded here
+		// because dotted/hyphenated/snake_case constants (scopes, paths, ids) use
+		// them heavily and would otherwise be misflagged.
+		const hasStrongBase64Punctuation = /[+/=]/.test(value);
+		return (hasDigit && hasLetter) || hasStrongBase64Punctuation;
+	}
+
+	return false;
+}
+
+function getStaticStringValue(node: TSESTree.Node | null | undefined): string | null {
+	if (!node) return null;
+
+	const literal = getStringLiteralValue(node);
+	if (literal !== null) return literal;
+
+	if (
+		node.type === AST_NODE_TYPES.TemplateLiteral &&
+		node.expressions.length === 0 &&
+		node.quasis.length === 1
+	) {
+		return node.quasis[0]?.value.cooked ?? null;
+	}
+
+	return null;
+}
+
+function getKeyName(key: TSESTree.Node): string | null {
+	if (key.type === AST_NODE_TYPES.Identifier) return key.name;
+	if (key.type === AST_NODE_TYPES.Literal && typeof key.value === 'string') return key.value;
+	return null;
+}
+
+export const NoHardcodedSecretsRule = createRule({
+	name: 'no-hardcoded-secrets',
+	meta: {
+		type: 'problem',
+		docs: {
+			description:
+				'Disallow hardcoded secrets (API keys, tokens, passwords) embedded as string literals in source.',
+		},
+		messages: {
+			hardcodedSecret:
+				'Possible hardcoded secret assigned to `{{ name }}`. Store secrets in credentials or environment variables instead of embedding them in source. If this is not a real secret, rename the variable or move the value out of source to silence this rule.',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		const check = (name: string | null, valueNode: TSESTree.Node | null | undefined) => {
+			if (!name || !valueNode || !nameLooksLikeSecret(name)) return;
+
+			const value = getStaticStringValue(valueNode);
+			if (value === null || !looksLikeSecretValue(value)) return;
+
+			context.report({
+				node: valueNode,
+				messageId: 'hardcodedSecret',
+				data: { name },
+			});
+		};
+
+		return {
+			// const apiKey = '...'
+			VariableDeclarator(node) {
+				if (node.id.type !== AST_NODE_TYPES.Identifier) return;
+				check(node.id.name, node.init);
+			},
+
+			// class field: private token = '...'
+			PropertyDefinition(node) {
+				if (node.computed) return;
+				check(getKeyName(node.key), node.value);
+			},
+
+			// object literal: { apiKey: '...' } or { 'api_key': '...' }
+			Property(node) {
+				if (node.computed) return;
+				check(getKeyName(node.key), node.value);
+			},
+
+			// this.secret = '...' / config.token = '...' / secret = '...'
+			AssignmentExpression(node) {
+				if (node.left.type === AST_NODE_TYPES.Identifier) {
+					check(node.left.name, node.right);
+				} else if (
+					node.left.type === AST_NODE_TYPES.MemberExpression &&
+					!node.left.computed &&
+					node.left.property.type === AST_NODE_TYPES.Identifier
+				) {
+					check(node.left.property.name, node.right);
+				}
+			},
+		};
+	},
+});

package/src/rules/no-restricted-imports.test.ts

@@ -1,7 +1,33 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll } from 'vitest';
 
 import { NoRestrictedImportsRule } from './no-restricted-imports.js';
 
+// Fixture package whose devDependencies include `vitest` and `@vitest/expect`,
+// and whose runtime `dependencies` include `axios`. Used to verify the rule
+// allows dev-dependency imports but still restricts runtime dependencies.
+// Created synchronously because RuleTester.run reads the `filename` option at
+// module-eval time, before any test hooks fire.
+const fixtureDir = mkdtempSync(join(tmpdir(), 'n8n-restricted-imports-'));
+writeFileSync(
+	join(fixtureDir, 'package.json'),
+	JSON.stringify({
+		name: 'n8n-nodes-devdep-fixture',
+		version: '1.0.0',
+		devDependencies: { vitest: '^1.0.0', '@vitest/expect': '^1.0.0' },
+		dependencies: { axios: '^1.0.0' },
+	}),
+);
+const fixtureTestFile = join(fixtureDir, '__tests__', 'MyNode.test.ts');
+const fixtureRealFile = join(fixtureDir, 'src', 'MyNode.node.ts');
+
+afterAll(() => {
+	rmSync(fixtureDir, { recursive: true, force: true });
+});
+
 const ruleTester = new RuleTester();
 
 ruleTester.run('no-restricted-imports', NoRestrictedImportsRule, {
@@ -78,6 +104,31 @@ ruleTester.run('no-restricted-imports', NoRestrictedImportsRule, {
 		{
 			code: 'const workflow = await import(`n8n-workflow`);',
 		},
+		{
+			name: 'devDependency (vitest) import is allowed in test files',
+			filename: fixtureTestFile,
+			code: 'import { describe } from "vitest";',
+		},
+		{
+			name: 'scoped devDependency import is allowed in test files',
+			filename: fixtureTestFile,
+			code: 'import { expect } from "@vitest/expect";',
+		},
+		{
+			name: 'devDependency require is allowed in test files',
+			filename: fixtureTestFile,
+			code: 'const { it } = require("vitest");',
+		},
+		{
+			name: 'devDependency dynamic import is allowed in test files',
+			filename: fixtureTestFile,
+			code: 'const vitest = await import("vitest");',
+		},
+		{
+			name: 'type-only devDependency import is allowed in node source',
+			filename: fixtureRealFile,
+			code: 'import type { Task } from "vitest";',
+		},
 	],
 	invalid: [
 		{
@@ -157,6 +208,18 @@ const lodash = require("lodash");`,
 			code: 'const express = await import("express");',
 			errors: [{ messageId: 'restrictedDynamicImport', data: { modulePath: 'express' } }],
 		},
+		{
+			name: 'runtime dependency (axios) is still restricted in a real node file',
+			filename: fixtureRealFile,
+			code: 'import axios from "axios";',
+			errors: [{ messageId: 'restrictedImport', data: { modulePath: 'axios' } }],
+		},
+		{
+			name: 'runtime dependency (axios) stays restricted even in test files',
+			filename: fixtureTestFile,
+			code: 'import axios from "axios";',
+			errors: [{ messageId: 'restrictedImport', data: { modulePath: 'axios' } }],
+		},
 		{
 			code: 'const path = require(`path`);',
 			errors: [{ messageId: 'restrictedRequire', data: { modulePath: 'path' } }],

package/src/rules/no-restricted-imports.ts

@@ -3,6 +3,8 @@ import {
 	isDirectRequireCall,
 	isRequireMemberCall,
 	createRule,
+	findPackageJson,
+	readPackageJsonDevDependencies,
 } from '../utils/index.js';
 
 const allowedModules = [
@@ -18,13 +20,20 @@ const allowedModules = [
 	'@n8n/ai-node-sdk',
 ];
 
-const isModuleAllowed = (modulePath: string): boolean => {
+const isModuleAllowed = (modulePath: string, devDependencies: Set<string>): boolean => {
 	if (modulePath.startsWith('./') || modulePath.startsWith('../')) return true;
 
 	const moduleName = modulePath.startsWith('@')
 		? modulePath.split('/').slice(0, 2).join('/')
 		: modulePath.split('/')[0];
 	if (!moduleName) return true;
+	// Dev dependencies (e.g. `vitest`) are never installed at runtime on n8n
+	// Cloud, so they are not subject to this rule — it targets runtime
+	// dependencies only. `no-runtime-dependencies` already enforces that the
+	// package's `dependencies` field is empty, so any external package an
+	// author uses must be a devDependency (bundled at build) or a
+	// peerDependency (provided by the instance).
+	if (devDependencies.has(moduleName)) return true;
 	return allowedModules.includes(moduleName);
 };
 
@@ -47,10 +56,14 @@ export const NoRestrictedImportsRule = createRule({
 	},
 	defaultOptions: [],
 	create(context) {
+		const devDependencies = readPackageJsonDevDependencies(
+			findPackageJson(context.physicalFilename),
+		);
+
 		return {
 			ImportDeclaration(node) {
 				const modulePath = getModulePath(node.source);
-				if (modulePath && !isModuleAllowed(modulePath)) {
+				if (modulePath && !isModuleAllowed(modulePath, devDependencies)) {
 					context.report({
 						node,
 						messageId: 'restrictedImport',
@@ -63,7 +76,7 @@ export const NoRestrictedImportsRule = createRule({
 
 			ImportExpression(node) {
 				const modulePath = getModulePath(node.source);
-				if (modulePath && !isModuleAllowed(modulePath)) {
+				if (modulePath && !isModuleAllowed(modulePath, devDependencies)) {
 					context.report({
 						node,
 						messageId: 'restrictedDynamicImport',
@@ -77,7 +90,7 @@ export const NoRestrictedImportsRule = createRule({
 			CallExpression(node) {
 				if (isDirectRequireCall(node) || isRequireMemberCall(node)) {
 					const modulePath = getModulePath(node.arguments[0] ?? null);
-					if (modulePath && !isModuleAllowed(modulePath)) {
+					if (modulePath && !isModuleAllowed(modulePath, devDependencies)) {
 						context.report({
 							node,
 							messageId: 'restrictedRequire',

package/src/rules/no-silent-error-swallowing.test.ts

@@ -0,0 +1,245 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { NoSilentErrorSwallowingRule } from './no-silent-error-swallowing.js';
+
+const ruleTester = new RuleTester();
+
+function createTriggerNode(webhookMethods: string): string {
+	return `
+import type { INodeType, INodeTypeDescription, IHookFunctions } from 'n8n-workflow';
+
+export class TestTrigger implements INodeType {
+	description: INodeTypeDescription = {
+		displayName: 'Test Trigger',
+		name: 'testTrigger',
+		group: ['trigger'],
+		version: 1,
+		description: 'A test trigger',
+		defaults: { name: 'Test Trigger' },
+		inputs: [],
+		outputs: ['main'],
+		webhooks: [{ name: 'default', httpMethod: 'POST', responseMode: 'onReceived', path: 'webhook' }],
+		properties: [],
+	};
+
+	webhookMethods = ${webhookMethods};
+}`;
+}
+
+ruleTester.run('no-silent-error-swallowing', NoSilentErrorSwallowingRule, {
+	valid: [
+		{
+			name: 'lifecycle methods with no catch blocks',
+			code: createTriggerNode(`{
+				default: {
+					async checkExists(this: IHookFunctions): Promise<boolean> { return true; },
+					async create(this: IHookFunctions): Promise<boolean> { return true; },
+					async delete(this: IHookFunctions): Promise<boolean> { return true; },
+				},
+			}`),
+		},
+		{
+			name: 'catch block that logs and returns',
+			code: createTriggerNode(`{
+				default: {
+					async checkExists(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							this.logger.error('checkExists failed', { error });
+							return false;
+						}
+					},
+				},
+			}`),
+		},
+		{
+			name: 'catch block that rethrows',
+			code: createTriggerNode(`{
+				default: {
+					async create(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							throw error;
+						}
+					},
+				},
+			}`),
+		},
+		{
+			name: 'catch block that returns a non-boolean expression',
+			code: createTriggerNode(`{
+				default: {
+					async delete(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return this.recover(error);
+						}
+					},
+				},
+			}`),
+		},
+		{
+			name: 'silent catch inside a non-lifecycle method is ignored',
+			code: createTriggerNode(`{
+				default: {
+					async someHelper(this: IHookFunctions): Promise<boolean> {
+						try {
+							return true;
+						} catch (error) {
+							return false;
+						}
+					},
+				},
+			}`),
+		},
+		{
+			name: 'silent catch inside a nested callback within a lifecycle method is ignored',
+			code: createTriggerNode(`{
+				default: {
+					async create(this: IHookFunctions): Promise<boolean> {
+						const results = items.map((item) => {
+							try {
+								return normalize(item);
+							} catch (error) {
+								return false;
+							}
+						});
+						return results.length > 0;
+					},
+				},
+			}`),
+		},
+		{
+			name: 'silent catch in a non-node-type class is ignored',
+			code: `
+export class RegularClass {
+	webhookMethods = {
+		default: {
+			async checkExists() {
+				try {
+					return true;
+				} catch (error) {
+					return false;
+				}
+			},
+		},
+	};
+}`,
+		},
+	],
+	invalid: [
+		{
+			name: 'empty catch block in checkExists',
+			code: createTriggerNode(`{
+				default: {
+					async checkExists(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'emptyCatch', data: { method: 'checkExists' } }],
+		},
+		{
+			name: 'catch block that only returns false in create',
+			code: createTriggerNode(`{
+				default: {
+					async create(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return false;
+						}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'silentReturn', data: { method: 'create' } }],
+		},
+		{
+			name: 'catch block that only returns true in delete',
+			code: createTriggerNode(`{
+				default: {
+					async delete(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return true;
+						}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'silentReturn', data: { method: 'delete' } }],
+		},
+		{
+			name: 'catch block with a bare return',
+			code: createTriggerNode(`{
+				default: {
+					async checkExists(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return;
+						}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'silentReturn', data: { method: 'checkExists' } }],
+		},
+		{
+			name: 'silent catch defined via arrow function method',
+			code: createTriggerNode(`{
+				default: {
+					checkExists: async (this: IHookFunctions): Promise<boolean> => {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return false;
+						}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'silentReturn', data: { method: 'checkExists' } }],
+		},
+		{
+			name: 'flagged regardless of file name (webhookMethods is the signal)',
+			filename: 'GenericFunctions.ts',
+			code: createTriggerNode(`{
+				default: {
+					async create(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return false;
+						}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'silentReturn', data: { method: 'create' } }],
+		},
+		{
+			name: 'multiple silent lifecycle methods each flagged',
+			code: createTriggerNode(`{
+				default: {
+					async checkExists(this: IHookFunctions): Promise<boolean> {
+						try { return await this.helpers.httpRequest({ url: 'https://example.com' }); } catch (error) {}
+					},
+					async create(this: IHookFunctions): Promise<boolean> {
+						try { return await this.helpers.httpRequest({ url: 'https://example.com' }); } catch (error) { return false; }
+					},
+					async delete(this: IHookFunctions): Promise<boolean> {
+						try { return await this.helpers.httpRequest({ url: 'https://example.com' }); } catch (error) { return true; }
+					},
+				},
+			}`),
+			errors: [
+				{ messageId: 'emptyCatch', data: { method: 'checkExists' } },
+				{ messageId: 'silentReturn', data: { method: 'create' } },
+				{ messageId: 'silentReturn', data: { method: 'delete' } },
+			],
+		},
+	],
+});