@n8n/eslint-plugin-community-nodes 0.26.0 → 0.27.0

package/src/rules/no-hardcoded-secrets.ts

@@ -0,0 +1,161 @@
+import { TSESTree } from '@typescript-eslint/utils';
+
+import { createRule, getStringLiteralValue, isSensitiveName } from '../utils/index.js';
+
+const { AST_NODE_TYPES } = TSESTree;
+
+/**
+ * Extra name fragments (beyond the shared sensitive set in `credential-fields`)
+ * that suggest a JS identifier holds a credential. Bare `key`/`auth` are broad,
+ * but the value heuristic below narrows the match, and they catch separator
+ * forms such as `api_key` that the compound fragments miss.
+ */
+const EXTRA_SECRET_NAME_FRAGMENTS = ['key', 'passwd', 'auth'];
+
+/**
+ * Fragments that mark a value as an obvious placeholder rather than a real
+ * secret. These are skipped to keep the (intentionally heuristic) rule quieter.
+ */
+const PLACEHOLDER_FRAGMENTS = [
+	'example',
+	'placeholder',
+	'changeme',
+	'your',
+	'dummy',
+	'xxxx',
+	'<',
+	'{{',
+];
+
+const MIN_SECRET_LENGTH = 16;
+
+function nameLooksLikeSecret(name: string): boolean {
+	// `exclusions: []` disables the URL/ID/pub name exclusions on purpose: the
+	// value heuristic below is the real gate, so a suspicious value on e.g.
+	// `publicKeyUrl` should still be flagged rather than silently skipped. Erring
+	// toward a false positive is safer than missing a secret.
+	return isSensitiveName(name, { extra: EXTRA_SECRET_NAME_FRAGMENTS, exclusions: [] });
+}
+
+function looksLikePlaceholder(value: string): boolean {
+	const lower = value.toLowerCase();
+	return PLACEHOLDER_FRAGMENTS.some((fragment) => lower.includes(fragment));
+}
+
+/**
+ * Heuristic: does this string value look like a real credential? Real secrets
+ * are long, contiguous tokens with the shape of a hex digest or a base64/token
+ * string. The digit+letter/punctuation requirement keeps ordinary long
+ * camelCase words from being treated as secrets.
+ */
+function looksLikeSecretValue(value: string): boolean {
+	// Require at least MIN_SECRET_LENGTH characters; anything shorter is almost
+	// always a non-secret word or identifier rather than a generated credential.
+	if (value.length < MIN_SECRET_LENGTH) return false;
+	if (/\s/.test(value)) return false;
+	if (looksLikePlaceholder(value)) return false;
+
+	// A long, purely hexadecimal string (e.g. an MD5/SHA/hex API key).
+	if (/^[0-9a-f]+$/i.test(value)) return true;
+
+	// A base64 / base64url / token-shaped string.
+	if (/^[A-Za-z0-9+/=_.-]+$/.test(value)) {
+		const hasDigit = /[0-9]/.test(value);
+		const hasLetter = /[a-z]/i.test(value);
+		// Only `+ / =` count as a standalone signal: they are hallmarks of base64
+		// but rarely appear in ordinary code strings. `. - _` are excluded here
+		// because dotted/hyphenated/snake_case constants (scopes, paths, ids) use
+		// them heavily and would otherwise be misflagged.
+		const hasStrongBase64Punctuation = /[+/=]/.test(value);
+		return (hasDigit && hasLetter) || hasStrongBase64Punctuation;
+	}
+
+	return false;
+}
+
+function getStaticStringValue(node: TSESTree.Node | null | undefined): string | null {
+	if (!node) return null;
+
+	const literal = getStringLiteralValue(node);
+	if (literal !== null) return literal;
+
+	if (
+		node.type === AST_NODE_TYPES.TemplateLiteral &&
+		node.expressions.length === 0 &&
+		node.quasis.length === 1
+	) {
+		return node.quasis[0]?.value.cooked ?? null;
+	}
+
+	return null;
+}
+
+function getKeyName(key: TSESTree.Node): string | null {
+	if (key.type === AST_NODE_TYPES.Identifier) return key.name;
+	if (key.type === AST_NODE_TYPES.Literal && typeof key.value === 'string') return key.value;
+	return null;
+}
+
+export const NoHardcodedSecretsRule = createRule({
+	name: 'no-hardcoded-secrets',
+	meta: {
+		type: 'problem',
+		docs: {
+			description:
+				'Disallow hardcoded secrets (API keys, tokens, passwords) embedded as string literals in source.',
+		},
+		messages: {
+			hardcodedSecret:
+				'Possible hardcoded secret assigned to `{{ name }}`. Store secrets in credentials or environment variables instead of embedding them in source. If this is not a real secret, rename the variable or move the value out of source to silence this rule.',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		const check = (name: string | null, valueNode: TSESTree.Node | null | undefined) => {
+			if (!name || !valueNode || !nameLooksLikeSecret(name)) return;
+
+			const value = getStaticStringValue(valueNode);
+			if (value === null || !looksLikeSecretValue(value)) return;
+
+			context.report({
+				node: valueNode,
+				messageId: 'hardcodedSecret',
+				data: { name },
+			});
+		};
+
+		return {
+			// const apiKey = '...'
+			VariableDeclarator(node) {
+				if (node.id.type !== AST_NODE_TYPES.Identifier) return;
+				check(node.id.name, node.init);
+			},
+
+			// class field: private token = '...'
+			PropertyDefinition(node) {
+				if (node.computed) return;
+				check(getKeyName(node.key), node.value);
+			},
+
+			// object literal: { apiKey: '...' } or { 'api_key': '...' }
+			Property(node) {
+				if (node.computed) return;
+				check(getKeyName(node.key), node.value);
+			},
+
+			// this.secret = '...' / config.token = '...' / secret = '...'
+			AssignmentExpression(node) {
+				if (node.left.type === AST_NODE_TYPES.Identifier) {
+					check(node.left.name, node.right);
+				} else if (
+					node.left.type === AST_NODE_TYPES.MemberExpression &&
+					!node.left.computed &&
+					node.left.property.type === AST_NODE_TYPES.Identifier
+				) {
+					check(node.left.property.name, node.right);
+				}
+			},
+		};
+	},
+});

package/src/rules/no-silent-error-swallowing.test.ts

@@ -0,0 +1,245 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { NoSilentErrorSwallowingRule } from './no-silent-error-swallowing.js';
+
+const ruleTester = new RuleTester();
+
+function createTriggerNode(webhookMethods: string): string {
+	return `
+import type { INodeType, INodeTypeDescription, IHookFunctions } from 'n8n-workflow';
+
+export class TestTrigger implements INodeType {
+	description: INodeTypeDescription = {
+		displayName: 'Test Trigger',
+		name: 'testTrigger',
+		group: ['trigger'],
+		version: 1,
+		description: 'A test trigger',
+		defaults: { name: 'Test Trigger' },
+		inputs: [],
+		outputs: ['main'],
+		webhooks: [{ name: 'default', httpMethod: 'POST', responseMode: 'onReceived', path: 'webhook' }],
+		properties: [],
+	};
+
+	webhookMethods = ${webhookMethods};
+}`;
+}
+
+ruleTester.run('no-silent-error-swallowing', NoSilentErrorSwallowingRule, {
+	valid: [
+		{
+			name: 'lifecycle methods with no catch blocks',
+			code: createTriggerNode(`{
+				default: {
+					async checkExists(this: IHookFunctions): Promise<boolean> { return true; },
+					async create(this: IHookFunctions): Promise<boolean> { return true; },
+					async delete(this: IHookFunctions): Promise<boolean> { return true; },
+				},
+			}`),
+		},
+		{
+			name: 'catch block that logs and returns',
+			code: createTriggerNode(`{
+				default: {
+					async checkExists(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							this.logger.error('checkExists failed', { error });
+							return false;
+						}
+					},
+				},
+			}`),
+		},
+		{
+			name: 'catch block that rethrows',
+			code: createTriggerNode(`{
+				default: {
+					async create(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							throw error;
+						}
+					},
+				},
+			}`),
+		},
+		{
+			name: 'catch block that returns a non-boolean expression',
+			code: createTriggerNode(`{
+				default: {
+					async delete(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return this.recover(error);
+						}
+					},
+				},
+			}`),
+		},
+		{
+			name: 'silent catch inside a non-lifecycle method is ignored',
+			code: createTriggerNode(`{
+				default: {
+					async someHelper(this: IHookFunctions): Promise<boolean> {
+						try {
+							return true;
+						} catch (error) {
+							return false;
+						}
+					},
+				},
+			}`),
+		},
+		{
+			name: 'silent catch inside a nested callback within a lifecycle method is ignored',
+			code: createTriggerNode(`{
+				default: {
+					async create(this: IHookFunctions): Promise<boolean> {
+						const results = items.map((item) => {
+							try {
+								return normalize(item);
+							} catch (error) {
+								return false;
+							}
+						});
+						return results.length > 0;
+					},
+				},
+			}`),
+		},
+		{
+			name: 'silent catch in a non-node-type class is ignored',
+			code: `
+export class RegularClass {
+	webhookMethods = {
+		default: {
+			async checkExists() {
+				try {
+					return true;
+				} catch (error) {
+					return false;
+				}
+			},
+		},
+	};
+}`,
+		},
+	],
+	invalid: [
+		{
+			name: 'empty catch block in checkExists',
+			code: createTriggerNode(`{
+				default: {
+					async checkExists(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'emptyCatch', data: { method: 'checkExists' } }],
+		},
+		{
+			name: 'catch block that only returns false in create',
+			code: createTriggerNode(`{
+				default: {
+					async create(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return false;
+						}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'silentReturn', data: { method: 'create' } }],
+		},
+		{
+			name: 'catch block that only returns true in delete',
+			code: createTriggerNode(`{
+				default: {
+					async delete(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return true;
+						}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'silentReturn', data: { method: 'delete' } }],
+		},
+		{
+			name: 'catch block with a bare return',
+			code: createTriggerNode(`{
+				default: {
+					async checkExists(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return;
+						}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'silentReturn', data: { method: 'checkExists' } }],
+		},
+		{
+			name: 'silent catch defined via arrow function method',
+			code: createTriggerNode(`{
+				default: {
+					checkExists: async (this: IHookFunctions): Promise<boolean> => {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return false;
+						}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'silentReturn', data: { method: 'checkExists' } }],
+		},
+		{
+			name: 'flagged regardless of file name (webhookMethods is the signal)',
+			filename: 'GenericFunctions.ts',
+			code: createTriggerNode(`{
+				default: {
+					async create(this: IHookFunctions): Promise<boolean> {
+						try {
+							return await this.helpers.httpRequest({ url: 'https://example.com' });
+						} catch (error) {
+							return false;
+						}
+					},
+				},
+			}`),
+			errors: [{ messageId: 'silentReturn', data: { method: 'create' } }],
+		},
+		{
+			name: 'multiple silent lifecycle methods each flagged',
+			code: createTriggerNode(`{
+				default: {
+					async checkExists(this: IHookFunctions): Promise<boolean> {
+						try { return await this.helpers.httpRequest({ url: 'https://example.com' }); } catch (error) {}
+					},
+					async create(this: IHookFunctions): Promise<boolean> {
+						try { return await this.helpers.httpRequest({ url: 'https://example.com' }); } catch (error) { return false; }
+					},
+					async delete(this: IHookFunctions): Promise<boolean> {
+						try { return await this.helpers.httpRequest({ url: 'https://example.com' }); } catch (error) { return true; }
+					},
+				},
+			}`),
+			errors: [
+				{ messageId: 'emptyCatch', data: { method: 'checkExists' } },
+				{ messageId: 'silentReturn', data: { method: 'create' } },
+				{ messageId: 'silentReturn', data: { method: 'delete' } },
+			],
+		},
+	],
+});

package/src/rules/no-silent-error-swallowing.ts

@@ -0,0 +1,127 @@
+import { AST_NODE_TYPES, type TSESTree } from '@typescript-eslint/utils';
+
+import {
+	createRule,
+	findClassProperty,
+	isNodeTypeClass,
+	WEBHOOK_LIFECYCLE_METHODS,
+} from '../utils/index.js';
+
+const LIFECYCLE_METHODS: readonly string[] = WEBHOOK_LIFECYCLE_METHODS;
+
+/** Returns the static name of a non-computed object property key, or null. */
+function getPropertyName(property: TSESTree.Property): string | null {
+	if (property.computed) return null;
+	if (property.key.type === AST_NODE_TYPES.Identifier) return property.key.name;
+	if (property.key.type === AST_NODE_TYPES.Literal) return String(property.key.value);
+	return null;
+}
+
+function isFunctionNode(node: TSESTree.Node): boolean {
+	return (
+		node.type === AST_NODE_TYPES.FunctionDeclaration ||
+		node.type === AST_NODE_TYPES.FunctionExpression ||
+		node.type === AST_NODE_TYPES.ArrowFunctionExpression
+	);
+}
+
+/** Walks up to the function that lexically encloses `node`, or null at module scope. */
+function getEnclosingFunction(node: TSESTree.Node): TSESTree.Node | null {
+	let current = node.parent;
+	while (current) {
+		if (isFunctionNode(current)) return current;
+		current = current.parent;
+	}
+	return null;
+}
+
+/** A bare `return;` or `return true/false;` with no other work in the block. */
+function isSilentReturn(statement: TSESTree.Statement): boolean {
+	if (statement.type !== AST_NODE_TYPES.ReturnStatement) return false;
+	const argument = statement.argument;
+	if (argument === null) return true;
+	return argument.type === AST_NODE_TYPES.Literal && typeof argument.value === 'boolean';
+}
+
+export const NoSilentErrorSwallowingRule = createRule({
+	name: 'no-silent-error-swallowing',
+	meta: {
+		type: 'problem',
+		docs: {
+			description:
+				'Disallow webhook lifecycle methods (checkExists, create, delete) from silently swallowing errors in catch blocks',
+		},
+		messages: {
+			emptyCatch:
+				'Empty catch block in webhook lifecycle method `{{method}}` silently swallows the error. Log the error or rethrow it so failures surface instead of being hidden.',
+			silentReturn:
+				'Catch block in webhook lifecycle method `{{method}}` swallows the error and only returns without logging. Log the error (or rethrow) so failures surface instead of being hidden.',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		// Maps each lifecycle method's function node to its method name. Populated
+		// when the enclosing class is visited (before its `catch` clauses), so a
+		// `catch` is only flagged when its *nearest* enclosing function is a
+		// lifecycle method — catches inside nested callbacks are left alone.
+		const lifecycleMethodByFn = new WeakMap<TSESTree.Node, string>();
+
+		return {
+			ClassDeclaration(node) {
+				if (!isNodeTypeClass(node)) return;
+
+				const webhookMethodsProperty = findClassProperty(node, 'webhookMethods');
+				if (webhookMethodsProperty?.value?.type !== AST_NODE_TYPES.ObjectExpression) return;
+
+				for (const groupProperty of webhookMethodsProperty.value.properties) {
+					if (groupProperty.type !== AST_NODE_TYPES.Property) continue;
+					if (groupProperty.value.type !== AST_NODE_TYPES.ObjectExpression) continue;
+
+					for (const methodProperty of groupProperty.value.properties) {
+						if (methodProperty.type !== AST_NODE_TYPES.Property) continue;
+
+						const methodName = getPropertyName(methodProperty);
+						if (methodName === null || !LIFECYCLE_METHODS.includes(methodName)) continue;
+
+						const fn = methodProperty.value;
+						if (
+							fn.type === AST_NODE_TYPES.FunctionExpression ||
+							fn.type === AST_NODE_TYPES.ArrowFunctionExpression
+						) {
+							lifecycleMethodByFn.set(fn, methodName);
+						}
+					}
+				}
+			},
+
+			CatchClause(node) {
+				const enclosingFn = getEnclosingFunction(node);
+				if (enclosingFn === null) return;
+
+				const methodName = lifecycleMethodByFn.get(enclosingFn);
+				if (methodName === undefined) return;
+
+				const statements = node.body.body;
+
+				if (statements.length === 0) {
+					context.report({
+						node: node.body,
+						messageId: 'emptyCatch',
+						data: { method: methodName },
+					});
+					return;
+				}
+
+				const onlyStatement = statements.length === 1 ? statements[0] : undefined;
+				if (onlyStatement && isSilentReturn(onlyStatement)) {
+					context.report({
+						node: onlyStatement,
+						messageId: 'silentReturn',
+						data: { method: methodName },
+					});
+				}
+			},
+		};
+	},
+});

package/src/rules/require-files-array.test.ts

@@ -0,0 +1,57 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { RequireFilesArrayRule } from './require-files-array.js';
+
+const ruleTester = new RuleTester();
+
+ruleTester.run('require-files-array', RequireFilesArrayRule, {
+	valid: [
+		{
+			name: 'files array with entries',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "files": ["dist"] }',
+		},
+		{
+			name: 'files array with multiple entries',
+			filename: 'package.json',
+			code: '{ "files": ["dist", "credentials"] }',
+		},
+		{
+			name: 'non-package.json file is ignored',
+			filename: 'some-config.json',
+			code: '{ "name": "n8n-nodes-example" }',
+		},
+	],
+	invalid: [
+		{
+			name: 'missing files field entirely',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "version": "1.0.0" }',
+			errors: [{ messageId: 'filesMissing' }],
+		},
+		{
+			name: 'empty package.json object',
+			filename: 'package.json',
+			code: '{}',
+			errors: [{ messageId: 'filesMissing' }],
+		},
+		{
+			name: 'files as empty array',
+			filename: 'package.json',
+			code: '{ "files": [] }',
+			errors: [{ messageId: 'filesEmpty' }],
+		},
+		{
+			name: 'files as string instead of array',
+			filename: 'package.json',
+			code: '{ "files": "dist" }',
+			errors: [{ messageId: 'filesEmpty' }],
+		},
+		{
+			name: 'files as non-array value',
+			filename: 'package.json',
+			code: '{ "files": null }',
+			errors: [{ messageId: 'filesEmpty' }],
+		},
+	],
+});

package/src/rules/require-files-array.ts

@@ -0,0 +1,50 @@
+import type { TSESTree } from '@typescript-eslint/utils';
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+
+import { createRule, findJsonProperty, getTopLevelObjectInJson } from '../utils/index.js';
+
+export const RequireFilesArrayRule = createRule({
+	name: 'require-files-array',
+	meta: {
+		type: 'problem',
+		docs: {
+			description: 'Require a non-empty "files" array in package.json',
+		},
+		messages: {
+			filesMissing:
+				'package.json must have a "files" field with a non-empty array of files to publish.',
+			filesEmpty: 'The "files" field must be a non-empty array.',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		if (!context.filename.endsWith('package.json')) {
+			return {};
+		}
+
+		return {
+			ObjectExpression(node: TSESTree.ObjectExpression) {
+				const root = getTopLevelObjectInJson(node);
+				if (!root) {
+					return;
+				}
+
+				const filesProp = findJsonProperty(root, 'files');
+				if (!filesProp) {
+					context.report({ node: root, messageId: 'filesMissing' });
+					return;
+				}
+
+				const filesValue = filesProp.value;
+
+				if (
+					filesValue.type !== AST_NODE_TYPES.ArrayExpression ||
+					filesValue.elements.length === 0
+				) {
+					context.report({ node: filesProp, messageId: 'filesEmpty' });
+				}
+			},
+		};
+	},
+});