@next-secure-check/rules 0.3.0 → 0.4.0

package/dist/sql-ast.js

@@ -0,0 +1,36 @@
+import ts from "typescript";
+const SQL_QUERY_METHOD_NAMES = new Set(["query", "execute"]);
+const SQL_RAW_TAG_NAMES = new Set(["$queryRaw", "$executeRaw"]);
+const SQL_KEYWORD_PATTERN = /\b(SELECT|INSERT|UPDATE|DELETE)\b/i;
+export function findRawSqlConcatNodes(sourceFile) {
+    const matches = [];
+    visitSqlNodes(sourceFile, (node) => {
+        if (ts.isCallExpression(node) && isSqlQuerySinkCall(node)) {
+            const [firstArgument] = node.arguments;
+            if (isInterpolatedSqlTemplate(firstArgument)) {
+                matches.push(node);
+            }
+            return;
+        }
+        if (ts.isTaggedTemplateExpression(node) && isRawSqlTaggedTemplate(node) && isInterpolatedSqlTemplate(node.template)) {
+            matches.push(node);
+        }
+    });
+    return matches;
+}
+function isSqlQuerySinkCall(node) {
+    const expression = node.expression;
+    return ts.isPropertyAccessExpression(expression) && SQL_QUERY_METHOD_NAMES.has(expression.name.text);
+}
+function isRawSqlTaggedTemplate(node) {
+    const tag = node.tag;
+    return ts.isPropertyAccessExpression(tag) && SQL_RAW_TAG_NAMES.has(tag.name.text);
+}
+function isInterpolatedSqlTemplate(node) {
+    return node !== undefined && ts.isTemplateExpression(node) && SQL_KEYWORD_PATTERN.test(node.getText());
+}
+function visitSqlNodes(node, callback) {
+    callback(node);
+    ts.forEachChild(node, (child) => visitSqlNodes(child, callback));
+}
+//# sourceMappingURL=sql-ast.js.map

package/dist/sql-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-ast.js","sourceRoot":"","sources":["../src/sql-ast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAChE,MAAM,mBAAmB,GAAG,oCAAoC,CAAC;AAEjE,MAAM,UAAU,qBAAqB,CAAC,UAAyB;IAC7D,MAAM,OAAO,GAAc,EAAE,CAAC;IAE9B,aAAa,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YACvC,IAAI,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAuB;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,OAAO,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAiC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,OAAO,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAyB;IAC1D,OAAO,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,aAAa,CAAC,IAAa,EAAE,QAAiC;IACrE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACf,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/xss-ast.d.ts

@@ -0,0 +1,13 @@
+import ts from "typescript";
+export type XssSeverity = "LOW" | "MEDIUM";
+export type XssAnalysisFacts = {
+    sanitizerIdentifiers: ReadonlySet<string>;
+    safeHtmlIdentifiers: ReadonlySet<string>;
+};
+export type DangerouslySetInnerHtmlNode = {
+    node: ts.JsxAttribute;
+    severity: XssSeverity;
+};
+export declare function createXssAnalysisFacts(sourceFile: ts.SourceFile): XssAnalysisFacts;
+export declare function findDangerouslySetInnerHtmlNodes(sourceFile: ts.SourceFile, sanitizerIdentifiers: ReadonlySet<string>, safeHtmlIdentifiers: ReadonlySet<string>): DangerouslySetInnerHtmlNode[];
+//# sourceMappingURL=xss-ast.d.ts.map

package/dist/xss-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xss-ast.d.ts","sourceRoot":"","sources":["../src/xss-ast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAI5B,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE3C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC;IACtB,QAAQ,EAAE,WAAW,CAAC;CACvB,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,GAAG,gBAAgB,CAOlF;AAED,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,EACzC,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,GACvC,2BAA2B,EAAE,CAe/B"}

package/dist/xss-ast.js

@@ -0,0 +1,114 @@
+import ts from "typescript";
+const SANITIZER_MODULE_PATTERN = /^(?:dompurify|sanitize-html)$/i;
+export function createXssAnalysisFacts(sourceFile) {
+    const sanitizerIdentifiers = collectSanitizerIdentifiers(sourceFile);
+    return {
+        sanitizerIdentifiers,
+        safeHtmlIdentifiers: collectSafeHtmlIdentifiers(sourceFile, sanitizerIdentifiers)
+    };
+}
+export function findDangerouslySetInnerHtmlNodes(sourceFile, sanitizerIdentifiers, safeHtmlIdentifiers) {
+    const matches = [];
+    visitXssNodes(sourceFile, (node) => {
+        if (!ts.isJsxAttribute(node) || !ts.isIdentifier(node.name) || node.name.text !== "dangerouslySetInnerHTML") {
+            return;
+        }
+        const severity = dangerouslySetInnerHtmlSeverity(node.initializer, sanitizerIdentifiers, safeHtmlIdentifiers);
+        if (severity) {
+            matches.push({ node, severity });
+        }
+    });
+    return matches;
+}
+function dangerouslySetInnerHtmlSeverity(initializer, sanitizerIdentifiers, safeHtmlIdentifiers) {
+    if (!initializer || ts.isStringLiteral(initializer)) {
+        return undefined;
+    }
+    if (!ts.isJsxExpression(initializer) || !initializer.expression) {
+        return undefined;
+    }
+    const expression = initializer.expression;
+    if (!ts.isObjectLiteralExpression(expression)) {
+        return "LOW";
+    }
+    const htmlExpression = expression.properties
+        .filter(ts.isPropertyAssignment)
+        .find((property) => propertyNameText(property.name) === "__html")?.initializer;
+    if (!htmlExpression || isStaticHtmlExpression(htmlExpression, safeHtmlIdentifiers) || isSanitizedHtmlExpression(htmlExpression, sanitizerIdentifiers)) {
+        return undefined;
+    }
+    return "MEDIUM";
+}
+function collectSanitizerIdentifiers(sourceFile) {
+    const sanitizerIdentifiers = new Set();
+    visitXssNodes(sourceFile, (node) => {
+        if (!ts.isImportDeclaration(node) || !ts.isStringLiteralLike(node.moduleSpecifier)) {
+            return;
+        }
+        const moduleName = node.moduleSpecifier.text;
+        const importClause = node.importClause;
+        if (!importClause) {
+            return;
+        }
+        if (importClause.name && SANITIZER_MODULE_PATTERN.test(moduleName)) {
+            sanitizerIdentifiers.add(importClause.name.text);
+        }
+        const namedBindings = importClause.namedBindings;
+        if (!namedBindings || !ts.isNamedImports(namedBindings)) {
+            return;
+        }
+        for (const importSpecifier of namedBindings.elements) {
+            const importedName = importSpecifier.propertyName?.text ?? importSpecifier.name.text;
+            if (isSanitizerFunctionName(importedName)) {
+                sanitizerIdentifiers.add(importSpecifier.name.text);
+            }
+        }
+    });
+    return sanitizerIdentifiers;
+}
+function collectSafeHtmlIdentifiers(sourceFile, sanitizerIdentifiers) {
+    const safeHtmlIdentifiers = new Set();
+    visitXssNodes(sourceFile, (node) => {
+        if (!ts.isVariableStatement(node) || (node.declarationList.flags & ts.NodeFlags.Const) === 0) {
+            return;
+        }
+        for (const declaration of node.declarationList.declarations) {
+            if (!ts.isIdentifier(declaration.name) || !declaration.initializer) {
+                continue;
+            }
+            if (isStaticHtmlExpression(declaration.initializer, safeHtmlIdentifiers) || isSanitizedHtmlExpression(declaration.initializer, sanitizerIdentifiers)) {
+                safeHtmlIdentifiers.add(declaration.name.text);
+            }
+        }
+    });
+    return safeHtmlIdentifiers;
+}
+function propertyNameText(name) {
+    if (ts.isIdentifier(name) || ts.isStringLiteralLike(name) || ts.isNumericLiteral(name)) {
+        return name.text;
+    }
+    return undefined;
+}
+function isStaticHtmlExpression(expression, safeHtmlIdentifiers) {
+    return ts.isStringLiteralLike(expression) || ts.isNoSubstitutionTemplateLiteral(expression) || (ts.isIdentifier(expression) && safeHtmlIdentifiers.has(expression.text));
+}
+function isSanitizedHtmlExpression(expression, sanitizerIdentifiers) {
+    if (!ts.isCallExpression(expression)) {
+        return false;
+    }
+    if (ts.isIdentifier(expression.expression)) {
+        return sanitizerIdentifiers.has(expression.expression.text) || isSanitizerFunctionName(expression.expression.text);
+    }
+    if (ts.isPropertyAccessExpression(expression.expression)) {
+        return isSanitizerFunctionName(expression.expression.name.text);
+    }
+    return false;
+}
+function isSanitizerFunctionName(name) {
+    return /^(?:sanitize|sanitizeHtml|sanitizeMarkdown|sanitizeContent|toSafeHtml)$/i.test(name);
+}
+function visitXssNodes(node, callback) {
+    callback(node);
+    ts.forEachChild(node, (child) => visitXssNodes(child, callback));
+}
+//# sourceMappingURL=xss-ast.js.map

package/dist/xss-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xss-ast.js","sourceRoot":"","sources":["../src/xss-ast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,wBAAwB,GAAG,gCAAgC,CAAC;AAclE,MAAM,UAAU,sBAAsB,CAAC,UAAyB;IAC9D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAErE,OAAO;QACL,oBAAoB;QACpB,mBAAmB,EAAE,0BAA0B,CAAC,UAAU,EAAE,oBAAoB,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,UAAyB,EACzB,oBAAyC,EACzC,mBAAwC;IAExC,MAAM,OAAO,GAAkC,EAAE,CAAC;IAElD,aAAa,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAC5G,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,+BAA+B,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;QAC9G,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,+BAA+B,CACtC,WAA2C,EAC3C,oBAAyC,EACzC,mBAAwC;IAExC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,UAAU;SACzC,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC;SAC/B,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,WAAW,CAAC;IAEjF,IAAI,CAAC,cAAc,IAAI,sBAAsB,CAAC,cAAc,EAAE,mBAAmB,CAAC,IAAI,yBAAyB,CAAC,cAAc,EAAE,oBAAoB,CAAC,EAAE,CAAC;QACtJ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAyB;IAC5D,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/C,aAAa,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACnF,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,eAAe,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YACrD,MAAM,YAAY,GAAG,eAAe,CAAC,YAAY,EAAE,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YACrF,IAAI,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1C,oBAAoB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,0BAA0B,CAAC,UAAyB,EAAE,oBAAiC;IAC9F,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,aAAa,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;YAC5D,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBACnE,SAAS;YACX,CAAC;YAED,IAAI,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,mBAAmB,CAAC,IAAI,yBAAyB,CAAC,WAAW,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBACrJ,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAqB;IAC7C,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAyB,EAAE,mBAAwC;IACjG,OAAO,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,+BAA+B,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3K,CAAC;AAED,SAAS,yBAAyB,CAAC,UAAyB,EAAE,oBAAyC;IACrG,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,OAAO,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,OAAO,uBAAuB,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,0EAA0E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,aAAa,CAAC,IAAa,EAAE,QAAiC;IACrE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACf,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-secure-check/rules",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Security rules for next-secure-check",
   "keywords": [
     "nextjs",
@@ -16,7 +16,7 @@
   "license": "MIT",
   "type": "module",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "publishConfig": {
     "access": "public"
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "typescript": "^5.9.0",
-    "@next-secure-check/core": "0.3.0"
+    "@next-secure-check/core": "0.4.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",