@ttsc/lint 0.19.3 → 0.20.1

package/linthost/rules_security.go

@@ -158,9 +158,66 @@ func (securityDetectNewBuffer) Check(ctx *Context, node *shimast.Node) {
     return
   }
   bindings := ctx.securityBindings()
-  if !isSecurityStaticExpression(expr.Arguments.Nodes[0], bindings, nil) {
-    ctx.Report(node, "Found new Buffer with a non-literal argument.")
+  if isSecurityStaticExpression(expr.Arguments.Nodes[0], bindings, nil) {
+    return
+  }
+  message := "Found new Buffer with a non-literal argument."
+  replacements := securityNewBufferReplacements(ctx.File, node, expr)
+  if len(replacements) == 0 {
+    ctx.Report(node, message)
+    return
   }
+  ctx.ReportFixSuggestions(node, message, nil, replacements...)
+}
+
+// securityNewBufferReplacements offers the three successors `new Buffer` was
+// split into, and imposes none of them.
+//
+// Which one is correct depends on what the argument turns out to be —
+// `Buffer.from` for a string, array, or buffer; `Buffer.alloc` for a
+// zero-filled size; `Buffer.allocUnsafe` for an uninitialized size — and this
+// rule fires precisely when the argument is not a literal, so the source
+// cannot say. Picking one automatically is how the deprecated constructor's
+// original hazard comes back: applying `Buffer.allocUnsafe` to what was really
+// a string silently allocates uninitialized heap memory.
+//
+// Each edit removes `new` and replaces the callee while leaving the argument
+// list untouched. It consumes only whitespace immediately after `new`, so a
+// comment between `new` and `Buffer` stays in the source. Returns nil when
+// those token ranges cannot be bounded, which downgrades the caller to a plain
+// diagnostic.
+func securityNewBufferReplacements(
+  file *shimast.SourceFile,
+  node *shimast.Node,
+  expr *shimast.NewExpression,
+) []Suggestion {
+  pos, _ := tokenRange(file, node)
+  calleePos, calleeEnd := tokenRange(file, expr.Expression)
+  if pos < 0 || expr.Expression == nil || calleePos < pos+len("new") {
+    return nil
+  }
+  src := file.Text()
+  newEnd := pos + len("new")
+  if newEnd > len(src) || src[pos:newEnd] != "new" || calleeEnd <= calleePos {
+    return nil
+  }
+  removeEnd := newEnd
+  for removeEnd < calleePos &&
+    (src[removeEnd] == ' ' || src[removeEnd] == '\t' || src[removeEnd] == '\r' || src[removeEnd] == '\n') {
+    removeEnd++
+  }
+  successors := []string{"Buffer.from", "Buffer.alloc", "Buffer.allocUnsafe"}
+  suggestions := make([]Suggestion, 0, len(successors))
+  for _, successor := range successors {
+    suggestions = append(suggestions, Suggestion{
+      Title: "Replace with `" + successor + "`.",
+      Edits: []TextEdit{
+        {Pos: pos, End: removeEnd, Text: ""},
+        {Pos: calleePos, End: calleeEnd, Text: successor},
+      },
+    })
+  }
+  return suggestions
 }
 
 type securityDetectNoCSRFBeforeMethodOverride struct{}
@@ -307,14 +364,196 @@ type securityDetectPseudoRandomBytes struct{}
 func (securityDetectPseudoRandomBytes) Name() string {
   return securityRulePrefix + "detect-pseudoRandomBytes"
 }
+func (securityDetectPseudoRandomBytes) NeedsTypeChecker() bool {
+  return true
+}
 func (securityDetectPseudoRandomBytes) Visits() []shimast.Kind {
   return []shimast.Kind{shimast.KindPropertyAccessExpression}
 }
 func (securityDetectPseudoRandomBytes) Check(ctx *Context, node *shimast.Node) {
   obj, prop, ok := propertyAccessParts(node)
-  if ok && prop == "pseudoRandomBytes" && identifierText(obj) == "crypto" {
-    ctx.Report(node, "Found crypto.pseudoRandomBytes which is not cryptographically strong.")
+  if !ok || prop != "pseudoRandomBytes" || identifierText(obj) != "crypto" {
+    return
+  }
+  message := "Found crypto.pseudoRandomBytes which is not cryptographically strong. Use `crypto.randomBytes` instead."
+  edits := securityRandomBytesEdits(ctx.File, node)
+  if len(edits) == 0 {
+    ctx.Report(node, message)
+    return
+  }
+  bindings := ctx.securityBindings()
+  module := bindings.Modules[identifierText(obj)]
+  if isNodeCryptoModule(module) && securityValueBindingModule(ctx, obj) == module {
+    ctx.ReportFix(node, message, edits...)
+    return
+  }
+  ctx.ReportSuggestion(node, message, "Replace with `crypto.randomBytes`.", edits...)
+}
+
+// securityRandomBytesEdits renames the member being accessed to `randomBytes`
+// and touches nothing else.
+//
+// The caller imposes the rewrite only when the existing security binding table
+// and the TypeScript checker agree that this exact object reference resolves
+// to Node's `crypto` module. The identity check matters when an imported name
+// is shadowed by a parameter or block-local declaration. A name-only match can
+// be a local application object, so that shape receives the same edit as an
+// opt-in suggestion instead.
+//
+// Only the member name is replaced, so `crypto.pseudoRandomBytes` passed
+// around as a value — not just called — is repaired the same way. Returns nil
+// when the name token cannot be located, which downgrades the caller to a
+// plain diagnostic.
+func securityRandomBytesEdits(file *shimast.SourceFile, node *shimast.Node) []TextEdit {
+  access := node.AsPropertyAccessExpression()
+  if access == nil {
+    return nil
+  }
+  pos, end := tokenRange(file, access.Name())
+  if pos < 0 {
+    return nil
+  }
+  return []TextEdit{{Pos: pos, End: end, Text: "randomBytes"}}
+}
+
+func isNodeCryptoModule(module string) bool {
+  return module == "crypto" || module == "node:crypto"
+}
+
+// securityValueBindingModule resolves an identifier in value position and
+// returns the module named by that exact binding's declaration.
+//
+// The security binding table is intentionally file-wide and text-keyed because
+// most security rules are syntax-only. That table can establish that a file
+// declares a Node module binding named `crypto`, but it cannot distinguish a
+// same-named parameter or block-local declaration at one use site. An
+// automatic edit needs the stronger statement, so this helper asks the
+// checker whether the use resolves to the import or require declaration. A
+// CommonJS script can resolve the use to lib.dom's global `crypto` even while a
+// top-level `const crypto = require("crypto")` is the runtime binding; that
+// shape is accepted only when the checker finds no different declaration in
+// the current file. Missing checker data or any other declaration shape is not
+// proof and returns the empty string.
+func securityValueBindingModule(ctx *Context, identifier *shimast.Node) string {
+  if ctx == nil || ctx.File == nil {
+    return ""
+  }
+  target := canonicalValueSymbol(ctx, identifier)
+  if target == nil {
+    return ""
+  }
+  if module := securityRequiredModuleFromDeclaration(target.ValueDeclaration); module != "" {
+    return module
+  }
+  for _, declaration := range target.Declarations {
+    if module := securityRequiredModuleFromDeclaration(declaration); module != "" {
+      return module
+    }
+  }
+
+  module := ""
+  topLevelRequire := ""
+  walkDescendants(ctx.File.AsNode(), func(candidate *shimast.Node) {
+    if module != "" || candidate == nil {
+      return
+    }
+    switch candidate.Kind {
+    case shimast.KindImportDeclaration:
+      imported := candidate.AsImportDeclaration()
+      if imported == nil || imported.ImportClause == nil {
+        return
+      }
+      clause := imported.ImportClause.AsImportClause()
+      if clause == nil {
+        return
+      }
+      if canonicalValueSymbol(ctx, clause.Name()) == target {
+        module = stringLiteralText(imported.ModuleSpecifier)
+        return
+      }
+      if clause.NamedBindings == nil || clause.NamedBindings.Kind != shimast.KindNamespaceImport {
+        return
+      }
+      namespace := clause.NamedBindings.AsNamespaceImport()
+      if namespace != nil && canonicalValueSymbol(ctx, namespace.Name()) == target {
+        module = stringLiteralText(imported.ModuleSpecifier)
+      }
+    case shimast.KindVariableDeclaration:
+      variable := candidate.AsVariableDeclaration()
+      if variable == nil {
+        return
+      }
+      name := variable.Name()
+      required, ok := requireExpressionModule(variable.Initializer)
+      if !ok || identifierText(name) != identifierText(identifier) {
+        return
+      }
+      if name != nil && name.Kind == shimast.KindIdentifier &&
+        canonicalValueSymbol(ctx, name) == target {
+        module = required
+        return
+      }
+      if securityTopLevelVariableDeclaration(candidate) {
+        topLevelRequire = required
+      }
+    }
+  })
+  if module == "" && topLevelRequire != "" &&
+    !securitySymbolHasDeclarationInFile(target, ctx.File) {
+    module = topLevelRequire
   }
+  return module
+}
+
+func securityRequiredModuleFromDeclaration(declaration *shimast.Node) string {
+  for current := declaration; current != nil && current.Kind != shimast.KindSourceFile; current = current.Parent {
+    if current.Kind != shimast.KindVariableDeclaration {
+      continue
+    }
+    variable := current.AsVariableDeclaration()
+    if variable == nil {
+      return ""
+    }
+    module, _ := requireExpressionModule(variable.Initializer)
+    return module
+  }
+  return ""
+}
+
+func securityTopLevelVariableDeclaration(declaration *shimast.Node) bool {
+  if declaration == nil || declaration.Kind != shimast.KindVariableDeclaration {
+    return false
+  }
+  list := declaration.Parent
+  if list == nil || list.Kind != shimast.KindVariableDeclarationList {
+    return false
+  }
+  statement := list.Parent
+  return statement != nil && statement.Kind == shimast.KindVariableStatement &&
+    statement.Parent != nil && statement.Parent.Kind == shimast.KindSourceFile
+}
+
+func securitySymbolHasDeclarationInFile(symbol *shimast.Symbol, file *shimast.SourceFile) bool {
+  if symbol == nil || file == nil {
+    return false
+  }
+  belongs := func(declaration *shimast.Node) bool {
+    for current := declaration; current != nil; current = current.Parent {
+      if current.Kind == shimast.KindSourceFile {
+        return current == file.AsNode()
+      }
+    }
+    return false
+  }
+  if belongs(symbol.ValueDeclaration) {
+    return true
+  }
+  for _, declaration := range symbol.Declarations {
+    if belongs(declaration) {
+      return true
+    }
+  }
+  return false
 }
 
 type securityDetectUnsafeRegex struct{}