@next-secure-check/rules 0.3.0 → 0.5.0

package/dist/xss-ast.js

@@ -0,0 +1,162 @@
+import ts from "typescript";
+const SANITIZER_MODULE_PATTERN = /^(?:dompurify|sanitize-html)$/i;
+const SANITIZER_FUNCTION_PATTERN = /^(?:sanitizeHtml|sanitizeMarkdown)$/i;
+const SANITIZER_METHOD_NAME = "sanitize";
+export function createXssAnalysisFacts(sourceFile) {
+    const { sanitizerIdentifiers, untrustedSanitizerIdentifiers } = collectSanitizerIdentifiers(sourceFile);
+    return {
+        sanitizerIdentifiers,
+        untrustedSanitizerIdentifiers,
+        safeHtmlIdentifiers: collectSafeHtmlIdentifiers(sourceFile, sanitizerIdentifiers, untrustedSanitizerIdentifiers)
+    };
+}
+export function findDangerouslySetInnerHtmlNodes(sourceFile, sanitizerIdentifiers, safeHtmlIdentifiers, boundedFlow, untrustedSanitizerIdentifiers) {
+    const matches = [];
+    visitXssNodes(sourceFile, (node) => {
+        if (!ts.isJsxAttribute(node) || !ts.isIdentifier(node.name) || node.name.text !== "dangerouslySetInnerHTML") {
+            return;
+        }
+        const severity = dangerouslySetInnerHtmlSeverity(node.initializer, sanitizerIdentifiers, safeHtmlIdentifiers, untrustedSanitizerIdentifiers);
+        if (severity) {
+            const valueExpression = dangerouslySetInnerHtmlValueExpression(node.initializer);
+            const evidencePath = valueExpression ? findBoundedSourcePath(valueExpression, boundedFlow) : undefined;
+            matches.push({ node, severity, ...(evidencePath ? { evidencePath } : {}) });
+        }
+    });
+    return matches;
+}
+function dangerouslySetInnerHtmlSeverity(initializer, sanitizerIdentifiers, safeHtmlIdentifiers, untrustedSanitizerIdentifiers) {
+    if (!initializer || ts.isStringLiteral(initializer)) {
+        return undefined;
+    }
+    if (!ts.isJsxExpression(initializer) || !initializer.expression) {
+        return undefined;
+    }
+    const expression = initializer.expression;
+    if (!ts.isObjectLiteralExpression(expression)) {
+        return "LOW";
+    }
+    const htmlExpression = expression.properties
+        .filter(ts.isPropertyAssignment)
+        .find((property) => propertyNameText(property.name) === "__html")?.initializer;
+    if (!htmlExpression ||
+        isStaticHtmlExpression(htmlExpression, safeHtmlIdentifiers) ||
+        isSanitizedHtmlExpression(htmlExpression, sanitizerIdentifiers, untrustedSanitizerIdentifiers)) {
+        return undefined;
+    }
+    return "MEDIUM";
+}
+function collectSanitizerIdentifiers(sourceFile) {
+    const sanitizerIdentifiers = new Set();
+    const untrustedSanitizerIdentifiers = new Set();
+    visitXssNodes(sourceFile, (node) => {
+        if (!ts.isImportDeclaration(node) || !ts.isStringLiteralLike(node.moduleSpecifier)) {
+            return;
+        }
+        const moduleName = node.moduleSpecifier.text;
+        const isKnownSanitizerModule = SANITIZER_MODULE_PATTERN.test(moduleName);
+        const importClause = node.importClause;
+        if (!importClause) {
+            return;
+        }
+        if (importClause.name && isKnownSanitizerModule) {
+            sanitizerIdentifiers.add(importClause.name.text);
+        }
+        else if (importClause.name && isSanitizerFunctionName(importClause.name.text)) {
+            untrustedSanitizerIdentifiers.add(importClause.name.text);
+        }
+        const namedBindings = importClause.namedBindings;
+        if (!namedBindings || !ts.isNamedImports(namedBindings)) {
+            return;
+        }
+        for (const importSpecifier of namedBindings.elements) {
+            const localName = importSpecifier.name.text;
+            const importedName = importSpecifier.propertyName?.text ?? importSpecifier.name.text;
+            if (isKnownSanitizerModule && isSanitizerFunctionName(importedName)) {
+                sanitizerIdentifiers.add(localName);
+            }
+            else if (!isKnownSanitizerModule && isSanitizerFunctionName(localName)) {
+                untrustedSanitizerIdentifiers.add(localName);
+            }
+        }
+    });
+    return { sanitizerIdentifiers, untrustedSanitizerIdentifiers };
+}
+function collectSafeHtmlIdentifiers(sourceFile, sanitizerIdentifiers, untrustedSanitizerIdentifiers) {
+    const safeHtmlIdentifiers = new Set();
+    visitXssNodes(sourceFile, (node) => {
+        if (!ts.isVariableStatement(node) || (node.declarationList.flags & ts.NodeFlags.Const) === 0) {
+            return;
+        }
+        for (const declaration of node.declarationList.declarations) {
+            if (!ts.isIdentifier(declaration.name) || !declaration.initializer) {
+                continue;
+            }
+            if (isStaticHtmlExpression(declaration.initializer, safeHtmlIdentifiers) ||
+                isSanitizedHtmlExpression(declaration.initializer, sanitizerIdentifiers, untrustedSanitizerIdentifiers)) {
+                safeHtmlIdentifiers.add(declaration.name.text);
+            }
+        }
+    });
+    return safeHtmlIdentifiers;
+}
+function propertyNameText(name) {
+    if (ts.isIdentifier(name) || ts.isStringLiteralLike(name) || ts.isNumericLiteral(name)) {
+        return name.text;
+    }
+    return undefined;
+}
+function isStaticHtmlExpression(expression, safeHtmlIdentifiers) {
+    return ts.isStringLiteralLike(expression) || ts.isNoSubstitutionTemplateLiteral(expression) || (ts.isIdentifier(expression) && safeHtmlIdentifiers.has(expression.text));
+}
+function isSanitizedHtmlExpression(expression, sanitizerIdentifiers, untrustedSanitizerIdentifiers) {
+    if (!ts.isCallExpression(expression)) {
+        return false;
+    }
+    if (ts.isIdentifier(expression.expression)) {
+        return (sanitizerIdentifiers.has(expression.expression.text) ||
+            (!untrustedSanitizerIdentifiers.has(expression.expression.text) && isSanitizerFunctionName(expression.expression.text)));
+    }
+    if (ts.isPropertyAccessExpression(expression.expression)) {
+        const receiver = expression.expression.expression;
+        return (expression.expression.name.text === SANITIZER_METHOD_NAME &&
+            ts.isIdentifier(receiver) &&
+            (receiver.text === "DOMPurify" || sanitizerIdentifiers.has(receiver.text)));
+    }
+    return false;
+}
+function isSanitizerFunctionName(name) {
+    return SANITIZER_FUNCTION_PATTERN.test(name);
+}
+function dangerouslySetInnerHtmlValueExpression(initializer) {
+    if (!initializer || !ts.isJsxExpression(initializer) || !initializer.expression) {
+        return undefined;
+    }
+    if (!ts.isObjectLiteralExpression(initializer.expression)) {
+        return initializer.expression;
+    }
+    return initializer.expression.properties
+        .filter(ts.isPropertyAssignment)
+        .find((property) => propertyNameText(property.name) === "__html")?.initializer;
+}
+function findBoundedSourcePath(expression, boundedFlow) {
+    const directSource = boundedFlow.sources.find((source) => source.node === expression);
+    if (directSource) {
+        return directSource.path;
+    }
+    if (ts.isFunctionLike(expression)) {
+        return undefined;
+    }
+    let evidencePath;
+    ts.forEachChild(expression, (child) => {
+        if (!evidencePath) {
+            evidencePath = findBoundedSourcePath(child, boundedFlow);
+        }
+    });
+    return evidencePath;
+}
+function visitXssNodes(node, callback) {
+    callback(node);
+    ts.forEachChild(node, (child) => visitXssNodes(child, callback));
+}
+//# sourceMappingURL=xss-ast.js.map

package/dist/xss-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xss-ast.js","sourceRoot":"","sources":["../src/xss-ast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,MAAM,wBAAwB,GAAG,gCAAgC,CAAC;AAClE,MAAM,0BAA0B,GAAG,sCAAsC,CAAC;AAC1E,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAgBzC,MAAM,UAAU,sBAAsB,CAAC,UAAyB;IAC9D,MAAM,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAExG,OAAO;QACL,oBAAoB;QACpB,6BAA6B;QAC7B,mBAAmB,EAAE,0BAA0B,CAAC,UAAU,EAAE,oBAAoB,EAAE,6BAA6B,CAAC;KACjH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,UAAyB,EACzB,oBAAyC,EACzC,mBAAwC,EACxC,WAA6B,EAC7B,6BAAkD;IAElD,MAAM,OAAO,GAAkC,EAAE,CAAC;IAElD,aAAa,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAC5G,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,+BAA+B,CAC9C,IAAI,CAAC,WAAW,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,6BAA6B,CAC9B,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,eAAe,GAAG,sCAAsC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjF,MAAM,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,+BAA+B,CACtC,WAA2C,EAC3C,oBAAyC,EACzC,mBAAwC,EACxC,6BAAkD;IAElD,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,UAAU;SACzC,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC;SAC/B,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,WAAW,CAAC;IAEjF,IACE,CAAC,cAAc;QACf,sBAAsB,CAAC,cAAc,EAAE,mBAAmB,CAAC;QAC3D,yBAAyB,CAAC,cAAc,EAAE,oBAAoB,EAAE,6BAA6B,CAAC,EAC9F,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAyB;IAI5D,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/C,MAAM,6BAA6B,GAAG,IAAI,GAAG,EAAU,CAAC;IAExD,aAAa,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACnF,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAC7C,MAAM,sBAAsB,GAAG,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;YAChD,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,YAAY,CAAC,IAAI,IAAI,uBAAuB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChF,6BAA6B,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,eAAe,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5C,MAAM,YAAY,GAAG,eAAe,CAAC,YAAY,EAAE,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YACrF,IAAI,sBAAsB,IAAI,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpE,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC;iBAAM,IAAI,CAAC,sBAAsB,IAAI,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzE,6BAA6B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAyB,EACzB,oBAAiC,EACjC,6BAA0C;IAE1C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,aAAa,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;YAC5D,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBACnE,SAAS;YACX,CAAC;YAED,IACE,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,mBAAmB,CAAC;gBACpE,yBAAyB,CAAC,WAAW,CAAC,WAAW,EAAE,oBAAoB,EAAE,6BAA6B,CAAC,EACvG,CAAC;gBACD,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAqB;IAC7C,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAyB,EAAE,mBAAwC;IACjG,OAAO,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,+BAA+B,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3K,CAAC;AAED,SAAS,yBAAyB,CAChC,UAAyB,EACzB,oBAAyC,EACzC,6BAAkD;IAElD,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,OAAO,CACL,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,6BAA6B,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CACxH,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;QAClD,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB;YACzD,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;YACzB,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC3E,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,sCAAsC,CAAC,WAA2C;IACzF,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QAChF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,OAAO,WAAW,CAAC,UAAU,CAAC;IAChC,CAAC;IAED,OAAO,WAAW,CAAC,UAAU,CAAC,UAAU;SACrC,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC;SAC/B,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,WAAW,CAAC;AACnF,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAmB,EAAE,WAA6B;IAC/E,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACtF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,IAAI,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,YAAgC,CAAC;IACrC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;QACpC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,qBAAqB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,IAAa,EAAE,QAAiC;IACrE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACf,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-secure-check/rules",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Security rules for next-secure-check",
   "keywords": [
     "nextjs",
@@ -16,7 +16,7 @@
   "license": "MIT",
   "type": "module",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "publishConfig": {
     "access": "public"
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "typescript": "^5.9.0",
-    "@next-secure-check/core": "0.3.0"
+    "@next-secure-check/core": "0.5.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",