@noctcore/lint-meta-rules 0.4.2 → 0.6.0

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   recursiveGlobs,
   stripYamlComment,
   unquote
-} from "./chunk-Z7TXSZR4.js";
+} from "./chunk-OYFQKSJN.js";
 
 // src/rules/agents-doc-presence.ts
 function createAgentsDocPresenceRule(options = {}) {
@@ -244,8 +244,293 @@ function createFileSizeRatchetRule(options = {}) {
   };
 }
 
+// src/rules/github-actions-least-privilege-permissions.ts
+var RULE_ID2 = "github-actions-least-privilege-permissions";
+var TOP_KEY = /^([\w-]+):\s*(.*)$/u;
+var SCOPE_ENTRY = /^\s*['"]?([\w-]+)['"]?:\s*['"]?([\w-]+)['"]?\s*$/u;
+function indentOf(line) {
+  return /^\s*/u.exec(line)?.[0].length ?? 0;
+}
+function isContent(line) {
+  const trimmed = line.trim();
+  return trimmed !== "" && !trimmed.startsWith("#");
+}
+function topLevelKeys(lines) {
+  const keys = [];
+  lines.forEach((line, index) => {
+    const match = TOP_KEY.exec(line);
+    if (match === null) return;
+    keys.push({ key: unquote(match[1] ?? ""), value: stripYamlComment(match[2] ?? "").trim(), index });
+  });
+  return keys;
+}
+function blockOf(lines, index) {
+  const block = [];
+  for (let j = index + 1; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (!isContent(line)) continue;
+    if (indentOf(line) === 0) break;
+    block.push({ text: stripYamlComment(line), index: j });
+  }
+  return block;
+}
+function scopeEntries(lines, permissions) {
+  if (permissions.value.startsWith("{")) {
+    return permissions.value.replace(/^\{|\}$/gu, "").split(",").map((pair) => SCOPE_ENTRY.exec(pair)).filter((match) => match !== null).map((match) => ({ scope: match[1] ?? "", level: match[2] ?? "", line: permissions.index + 1 }));
+  }
+  return blockOf(lines, permissions.index).flatMap(({ text, index }) => {
+    const match = SCOPE_ENTRY.exec(text);
+    return match === null ? [] : [{ scope: match[1] ?? "", level: match[2] ?? "", line: index + 1 }];
+  });
+}
+function jobsWithoutPermissions(lines, jobs) {
+  const block = blockOf(lines, jobs.index);
+  const jobColumn = indentOf(block[0]?.text ?? "");
+  const missing = [];
+  let current;
+  let keyColumn = -1;
+  const settle = () => {
+    if (current !== void 0 && !current.hasPermissions) missing.push(current.name);
+  };
+  for (const { text } of block) {
+    const column = indentOf(text);
+    if (column === jobColumn) {
+      settle();
+      current = { name: unquote(text.trim().replace(/:.*$/u, "")), hasPermissions: false };
+      keyColumn = -1;
+      continue;
+    }
+    if (current === void 0 || column < jobColumn) continue;
+    if (keyColumn === -1) keyColumn = column;
+    if (column === keyColumn && /^\s*permissions:/u.test(text)) current.hasPermissions = true;
+  }
+  settle();
+  return missing;
+}
+function checkWorkflowPermissions(file, text, allowTopLevelWrite = []) {
+  const lines = text.split("\n");
+  const keys = topLevelKeys(lines);
+  const permissions = keys.find((entry) => entry.key === "permissions");
+  const report = (line, message) => ({
+    file,
+    rule: RULE_ID2,
+    message: `line ${line}: ${message}`,
+    line
+  });
+  if (permissions === void 0) {
+    const jobs = keys.find((entry) => entry.key === "jobs");
+    const missing = jobs === void 0 ? [] : jobsWithoutPermissions(lines, jobs);
+    if (missing.length === 0) return [];
+    return [
+      report(
+        1,
+        `no top-level \`permissions:\`, so ${missing.map((job) => `\`${job}\``).join(", ")} ${missing.length === 1 ? "runs" : "run"} with the repository's default token, which can be read-write. Add \`permissions: { contents: read }\` at the top and grant writes on the job that needs them.`
+      )
+    ];
+  }
+  const shorthand = unquote(permissions.value);
+  if (shorthand === "write-all" || shorthand === "read-all") {
+    return [
+      report(
+        permissions.index + 1,
+        `top-level \`permissions: ${shorthand}\` grants every scope to every job. List only the scopes the workflow reads (for example \`contents: read\`) and grant writes on the job that needs them.`
+      )
+    ];
+  }
+  const allowed = new Set(allowTopLevelWrite);
+  return scopeEntries(lines, permissions).filter(({ scope, level }) => level === "write" && !allowed.has(scope)).map(
+    ({ scope, line }) => report(
+      line,
+      `top-level \`permissions\` grants \`${scope}: write\` to every job. Move it to the job that needs it and keep the top level read-only.`
+    )
+  );
+}
+function createGithubActionsLeastPrivilegePermissionsRule(options = {}) {
+  const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
+  const allowTopLevelWrite = options.allowTopLevelWrite ?? [];
+  const ciCritical = options.ciCritical ?? true;
+  return {
+    id: RULE_ID2,
+    category: "ci",
+    ciCritical,
+    description: "GitHub Actions workflows declare a read-only top-level `permissions:` (no `write-all`/`read-all`, no `<scope>: write`); writes go on the job that needs them.",
+    run(ctx) {
+      return globFiles((p) => ctx.glob(p), workflowGlobs).flatMap(
+        (file) => checkWorkflowPermissions(file, ctx.read(file) ?? "", allowTopLevelWrite)
+      );
+    }
+  };
+}
+
+// src/rules/github-actions-no-template-injection.ts
+var RULE_ID3 = "github-actions-no-template-injection";
+var DEFAULT_ACTION_GLOBS = anywhereGlobs(["action.yml", "action.yaml"]);
+var EVENT = String.raw`(?<![\w.])github\.event\.`;
+var ANY_ITEM = String.raw`(?:\.\*|\[\d+\])`;
+var TAINTED_CONTEXTS = [
+  new RegExp(String.raw`${EVENT}(?:issue|pull_request|discussion)\.(?:title|body)\b`, "u"),
+  new RegExp(String.raw`${EVENT}pull_request\.head\.(?:ref|label)\b`, "u"),
+  new RegExp(String.raw`${EVENT}(?:comment|review|review_comment)\.body\b`, "u"),
+  new RegExp(String.raw`${EVENT}pages${ANY_ITEM}\.page_name\b`, "u"),
+  new RegExp(String.raw`${EVENT}commits${ANY_ITEM}\.(?:message|author|committer)\b`, "u"),
+  new RegExp(String.raw`${EVENT}head_commit\.(?:message|author|committer)\b`, "u"),
+  new RegExp(String.raw`${EVENT}workflow_run\.head_branch\b`, "u"),
+  new RegExp(String.raw`${EVENT}workflow_run\.head_commit\.(?:message|author|committer)\b`, "u"),
+  /(?<![\w.])github\.head_ref\b/u
+];
+var INPUT_CONTEXT = /(?<![\w.])(?:github\.event\.)?inputs\.([\w-]+)/gu;
+var STEP_OUTPUT_CONTEXT = /(?<![\w.])steps\.[\w-]+\.outputs\.[\w-]+/u;
+var SAFE_INPUT_TYPES = /* @__PURE__ */ new Set(["boolean", "number", "choice"]);
+var EXPRESSION = /\$\{\{(.*?)\}\}/gu;
+var SCRIPT_KEY = /^(\s*)(-\s+)?(run|script):(?:\s+(.*))?$/u;
+var BLOCK_INDICATOR = /^[|>][-+0-9]*\s*(?:#.*)?$/u;
+var MAPPING_LINE = /^\s*[\w-]+:(?:\s|$)/u;
+var GITHUB_SCRIPT_USES = /^\s*(?:-\s+)?uses:\s*['"]?actions\/github-script@/u;
+function indentOf2(line) {
+  return /^\s*/u.exec(line)?.[0].length ?? 0;
+}
+function isContent2(line) {
+  const trimmed = line.trim();
+  return trimmed !== "" && !trimmed.startsWith("#");
+}
+function parentOf(lines, index, column) {
+  for (let j = index - 1; j >= 0; j -= 1) {
+    const line = lines[j] ?? "";
+    if (isContent2(line) && indentOf2(line) < column) return j;
+  }
+  return -1;
+}
+function isGithubScriptStep(lines, withIndex) {
+  const stepStart = parentOf(lines, withIndex, indentOf2(lines[withIndex] ?? ""));
+  const stepLine = lines[stepStart] ?? "";
+  if (!stepLine.trimStart().startsWith("-")) return false;
+  const dashColumn = indentOf2(stepLine);
+  for (let j = stepStart; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (j > stepStart && isContent2(line) && indentOf2(line) <= dashColumn) break;
+    if (GITHUB_SCRIPT_USES.test(line)) return true;
+  }
+  return false;
+}
+function safeInputNames(lines) {
+  const safe = /* @__PURE__ */ new Set();
+  lines.forEach((line, index) => {
+    if (!/^\s*inputs:\s*(?:#.*)?$/u.test(line)) return;
+    const column = indentOf2(line);
+    let nameColumn = -1;
+    let name = "";
+    for (const child of lines.slice(index + 1)) {
+      if (!isContent2(child)) continue;
+      const childColumn = indentOf2(child);
+      if (childColumn <= column) break;
+      if (nameColumn === -1) nameColumn = childColumn;
+      if (childColumn === nameColumn) {
+        name = /^\s*['"]?([\w-]+)['"]?:/u.exec(child)?.[1] ?? "";
+        continue;
+      }
+      const type = /^\s*type:\s*['"]?(\w+)/u.exec(stripYamlComment(child))?.[1];
+      if (type !== void 0 && SAFE_INPUT_TYPES.has(type) && name !== "") safe.add(name);
+    }
+  });
+  return safe;
+}
+function scriptLines(lines, index, keyColumn) {
+  const inline = SCRIPT_KEY.exec(lines[index] ?? "")?.[4] ?? "";
+  const block = BLOCK_INDICATOR.test(inline.trim());
+  const quoted = /^['"]/u.test(inline.trim());
+  const keep = (text) => block || quoted ? text : stripYamlComment(text);
+  const collected = block ? [] : [{ line: index + 1, text: keep(inline) }];
+  for (let j = index + 1; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (line.trim() !== "" && indentOf2(line) <= keyColumn) break;
+    collected.push({ line: j + 1, text: keep(line) });
+  }
+  const first = collected.find((entry) => entry.text.trim() !== "");
+  if (inline.trim() === "" && first !== void 0 && MAPPING_LINE.test(first.text)) return [];
+  return collected;
+}
+function taintedContexts(expression, checkInputs, checkStepOutputs, safeInputs) {
+  const found = [];
+  for (const pattern of TAINTED_CONTEXTS) {
+    const match = pattern.exec(expression);
+    if (match !== null) found.push(match[0]);
+  }
+  if (checkInputs) {
+    for (const match of expression.matchAll(INPUT_CONTEXT)) {
+      if (!safeInputs.has(match[1] ?? "")) found.push(match[0]);
+    }
+  }
+  if (checkStepOutputs) {
+    const match = STEP_OUTPUT_CONTEXT.exec(expression);
+    if (match !== null) found.push(match[0]);
+  }
+  return found;
+}
+function checkWorkflowTemplateInjection(file, text, options = {}) {
+  const checkInputs = options.checkInputs ?? true;
+  const checkStepOutputs = options.checkStepOutputs ?? false;
+  const lines = text.split("\n");
+  const safeInputs = checkInputs ? safeInputNames(lines) : /* @__PURE__ */ new Set();
+  const violations = [];
+  let skipThrough = -1;
+  lines.forEach((line, index) => {
+    const match = index > skipThrough ? SCRIPT_KEY.exec(line) : null;
+    if (match === null) return;
+    const keyColumn = (match[1]?.length ?? 0) + (match[2]?.length ?? 0);
+    const key = match[3] ?? "run";
+    if (key === "script") {
+      const parent = parentOf(lines, index, keyColumn);
+      if (!/^\s*with:\s*(?:#.*)?$/u.test(lines[parent] ?? "")) return;
+      if (!isGithubScriptStep(lines, parent)) return;
+    }
+    const where = key === "run" ? "`run:` script" : "`actions/github-script` `script:`";
+    const script = scriptLines(lines, index, keyColumn);
+    skipThrough = (script[script.length - 1]?.line ?? index + 1) - 1;
+    for (const entry of script) {
+      for (const expression of entry.text.matchAll(EXPRESSION)) {
+        const contexts = taintedContexts(
+          expression[1] ?? "",
+          checkInputs,
+          checkStepOutputs,
+          safeInputs
+        );
+        if (contexts.length === 0) continue;
+        violations.push({
+          file,
+          rule: RULE_ID3,
+          message: `line ${entry.line}: \`${expression[0]}\` expands attacker-controllable \`${contexts.join("`, `")}\` into a ${where}, where it runs as code. Pass it through \`env:\` (for example \`VALUE: ${expression[0]}\`) and read \`"$VALUE"\` instead.`,
+          line: entry.line
+        });
+      }
+    }
+  });
+  return violations;
+}
+function createGithubActionsNoTemplateInjectionRule(options = {}) {
+  const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
+  const actionGlobs = options.actionGlobs ?? DEFAULT_ACTION_GLOBS;
+  const skipDirs = options.skipDirs ?? DEFAULT_SKIP_DIRS;
+  const ciCritical = options.ciCritical ?? true;
+  return {
+    id: RULE_ID3,
+    category: "ci",
+    ciCritical,
+    description: "GitHub Actions `run:` and github-script bodies never expand attacker-controllable `${{ }}` context (issue/PR titles, comments, branch names); pass it through `env:` instead.",
+    run(ctx) {
+      const files = globFiles(
+        (p) => ctx.glob(p),
+        [...workflowGlobs, ...actionGlobs],
+        skipDirs
+      );
+      return files.flatMap(
+        (file) => checkWorkflowTemplateInjection(file, ctx.read(file) ?? "", options)
+      );
+    }
+  };
+}
+
 // src/rules/github-actions-runner-pinned.ts
-var RULE_ID2 = "github-actions-runner-pinned";
+var RULE_ID4 = "github-actions-runner-pinned";
 var RUNS_ON = /^(\s*)runs-on:\s*(.*)$/u;
 var DEFAULT_FLOATING_LABEL = /^[\w.-]+-latest$/u;
 function runnerLabels(lines, start, indent) {
@@ -277,7 +562,7 @@ function checkWorkflowRunnersPinned(file, text, floatingLabel = DEFAULT_FLOATING
       if (floatingLabel.test(label)) {
         violations.push({
           file,
-          rule: RULE_ID2,
+          rule: RULE_ID4,
           message: `line ${index + 1}: \`runs-on\` uses the floating runner label "${label}". Pin a named image (for example \`ubuntu-24.04\`) so a runner image change is a reviewed diff.`,
           line: index + 1
         });
@@ -291,7 +576,7 @@ function createGithubActionsRunnerPinnedRule(options = {}) {
   const floatingLabel = options.floatingLabel ?? DEFAULT_FLOATING_LABEL;
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID2,
+    id: RULE_ID4,
     category: "ci",
     ciCritical,
     description: "GitHub Actions jobs must run on a pinned runner image (for example ubuntu-24.04), never a *-latest label.",
@@ -304,7 +589,7 @@ function createGithubActionsRunnerPinnedRule(options = {}) {
 }
 
 // src/rules/github-actions-sha-pinned.ts
-var RULE_ID3 = "github-actions-sha-pinned";
+var RULE_ID5 = "github-actions-sha-pinned";
 var USES_LINE = /^\s*(?:-\s+)?uses:\s*['"]?([^\s'"#]+)['"]?\s*(#.*)?$/u;
 var FULL_SHA = /^[0-9a-f]{40}$/u;
 var DOCKER_DIGEST = /@sha256:[0-9a-f]{64}$/u;
@@ -319,7 +604,7 @@ function checkWorkflowActionsPinned(file, text) {
     }
     const where = `line ${index + 1}`;
     const report = (message) => {
-      violations.push({ file, rule: RULE_ID3, message, line: index + 1 });
+      violations.push({ file, rule: RULE_ID5, message, line: index + 1 });
     };
     if (ref.startsWith("docker://")) {
       if (!DOCKER_DIGEST.test(ref)) {
@@ -347,7 +632,7 @@ function createGithubActionsShaPinnedRule(options = {}) {
   const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID3,
+    id: RULE_ID5,
     category: "ci",
     ciCritical,
     description: "GitHub Actions `uses:` refs must be pinned to a 40-character commit SHA with a `# vN` comment (local ./ actions exempt).",
@@ -572,7 +857,7 @@ function createPackageShapeRule(options = {}) {
 }
 
 // src/rules/security-scanner-version-parity.ts
-var RULE_ID4 = "security-scanner-version-parity";
+var RULE_ID6 = "security-scanner-version-parity";
 function createSecurityScannerVersionParityRule(options = {}) {
   const scanner = options.scanner ?? "gitleaks";
   const versionVariable = options.versionVariable ?? "GITLEAKS_VERSION";
@@ -597,7 +882,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
   const runtimeCheck = new RegExp(`\\b${name}\\s+version\\b`, "u");
   const mentionsScanner = new RegExp(name, "iu");
   return {
-    id: RULE_ID4,
+    id: RULE_ID6,
     category: "ci",
     ciCritical,
     description: `The ${scanner} version pinned in the workflows must equal the one in ${hookFile}, and the hook must compare a native ${scanner} against it at run time.`,
@@ -616,7 +901,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
       }
       const violations = [];
       const report = (file, message) => {
-        violations.push({ file, rule: RULE_ID4, message });
+        violations.push({ file, rule: RULE_ID6, message });
       };
       if (ciVersions.size > 1) {
         report(
@@ -669,7 +954,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
 }
 
 // src/rules/service-image-digest-pin.ts
-var RULE_ID5 = "service-image-digest-pin";
+var RULE_ID7 = "service-image-digest-pin";
 var DIGEST2 = /@sha256:[0-9a-f]{64}$/u;
 var KEY_LINE = /^(\s*)(?:-\s+)?([\w-]+):\s*(.*)$/u;
 var DEFAULT_COMPOSE_GLOBS = anywhereGlobs(
@@ -677,7 +962,7 @@ var DEFAULT_COMPOSE_GLOBS = anywhereGlobs(
     (stem) => ["", ".*", "-*"].flatMap((infix) => ["yml", "yaml"].map((ext) => `${stem}${infix}.${ext}`))
   )
 );
-function indentOf(line) {
+function indentOf3(line) {
   return /^\s*/u.exec(line)?.[0].length ?? 0;
 }
 function workflowImages(text) {
@@ -729,7 +1014,7 @@ function composeImages(text) {
     if (line.trim() === "" || line.trimStart().startsWith("#")) {
       continue;
     }
-    const indent = indentOf(line);
+    const indent = indentOf3(line);
     if (indent === 0) {
       break;
     }
@@ -763,7 +1048,7 @@ function violationsFor(file, images, allowUnpinned) {
     const reference = image.split("@")[0];
     return {
       file,
-      rule: RULE_ID5,
+      rule: RULE_ID7,
       message: `line ${line}: image "${image}" is not pinned by digest. Write \`${reference}@sha256:<digest>\` (resolve it with \`docker buildx imagetools inspect ${reference}\`) so CI and local runs use the same bytes.`,
       line
     };
@@ -776,7 +1061,7 @@ function createServiceImageDigestPinRule(options = {}) {
   const allowUnpinned = new Set(options.allowUnpinned ?? []);
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID5,
+    id: RULE_ID7,
     category: "ci",
     ciCritical,
     description: "Workflow service and container images, and docker-compose images, must be pinned by `@sha256:` digest (a service that builds locally is exempt).",
@@ -1061,6 +1346,8 @@ var RULE_FACTORIES = {
   "canonical-helpers-single-home": createCanonicalHelpersSingleHomeRule,
   "dockerfile-base-image-digest-pin": createDockerfileBaseImageDigestPinRule,
   "file-size-ratchet": createFileSizeRatchetRule,
+  "github-actions-least-privilege-permissions": createGithubActionsLeastPrivilegePermissionsRule,
+  "github-actions-no-template-injection": createGithubActionsNoTemplateInjectionRule,
   "github-actions-runner-pinned": createGithubActionsRunnerPinnedRule,
   "github-actions-sha-pinned": createGithubActionsShaPinnedRule,
   "layer-rank": createLayerRankRule,
@@ -1088,6 +1375,8 @@ export {
   createCanonicalHelpersSingleHomeRule,
   createDockerfileBaseImageDigestPinRule,
   createFileSizeRatchetRule,
+  createGithubActionsLeastPrivilegePermissionsRule,
+  createGithubActionsNoTemplateInjectionRule,
   createGithubActionsRunnerPinnedRule,
   createGithubActionsShaPinnedRule,
   createLayerRankRule,

package/dist/prisma.js

@@ -1,11 +1,11 @@
-import {
-  globFiles
-} from "./chunk-Z7TXSZR4.js";
 import {
   firstOptionOf,
   resolveRules,
   severityOf
 } from "./chunk-VFCX3QKZ.js";
+import {
+  globFiles
+} from "./chunk-OYFQKSJN.js";
 
 // src/prisma/prisma-method-surface.ts
 import { PRISMA_READ_METHODS, PRISMA_WRITE_METHODS } from "@noctcore/eslint-plugin-prisma";