eslint-plugin-anthropic-security 0.1.1 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-anthropic-security",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "ESLint plugin for Anthropic SDK security — catches hardcoded API keys in the Claude client options.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -75,7 +75,7 @@
     }
   },
   "dependencies": {
-    "@interlace/eslint-devkit": "^1.8.0"
+    "@interlace/eslint-devkit": "^1.9.0"
   },
   "funding": {
     "type": "github",

package/src/index.js

@@ -1,16 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.configs = exports.plugin = exports.rules = exports.noHardcodedApiKey = void 0;
+exports.configs = exports.plugin = exports.rules = exports.noHardcodedApiKey = exports.noBrowserApiKeyExposure = void 0;
+var no_browser_api_key_exposure_2 = require("./rules/no-browser-api-key-exposure");
+Object.defineProperty(exports, "noBrowserApiKeyExposure", { enumerable: true, get: function () { return no_browser_api_key_exposure_2.noBrowserApiKeyExposure; } });
 var no_hardcoded_api_key_2 = require("./rules/no-hardcoded-api-key");
 Object.defineProperty(exports, "noHardcodedApiKey", { enumerable: true, get: function () { return no_hardcoded_api_key_2.noHardcodedApiKey; } });
 exports.rules = {
+    get 'no-browser-api-key-exposure'() { return require("./rules/no-browser-api-key-exposure").noBrowserApiKeyExposure; },
     get 'no-hardcoded-api-key'() { return require("./rules/no-hardcoded-api-key").noHardcodedApiKey; },
 
 };
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-anthropic-security',
-        version: '0.1.1',
+        version: '0.2.0',
     },
     rules: exports.rules,
 };
@@ -19,6 +22,7 @@ const enabled = {
         'anthropic-security': exports.plugin,
     },
     rules: {
+        'anthropic-security/no-browser-api-key-exposure': 'error',
         'anthropic-security/no-hardcoded-api-key': 'error',
     },
 };

package/src/rules/no-browser-api-key-exposure/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noBrowserApiKeyExposure = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+exports.noBrowserApiKeyExposure = (0, eslint_devkit_1.createBrowserEscapeHatchRule)({
+    ruleName: 'no-browser-api-key-exposure',
+    vendor: 'Anthropic',
+    modules: ['@anthropic-ai'],
+    docsUrl: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-browser-api-key-exposure.md',
+    documentationLink: 'https://docs.anthropic.com/en/api/getting-started',
+});

package/src/rules/no-hardcoded-api-key/index.js

@@ -2,91 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noHardcodedApiKey = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const ANTHROPIC_MODULE_PREFIX = '@anthropic-ai/';
-const KEY_PROPS = new Set(['apiKey', 'authToken']);
-function readCredential(options) {
-    for (const prop of options.properties) {
-        if (prop.type === 'SpreadElement')
-            return { kind: 'unreadable' };
-        if (prop.computed)
-            continue;
-        const name = prop.key.type === 'Identifier' ? prop.key.name : String(prop.key.value);
-        if (!KEY_PROPS.has(name))
-            continue;
-        if (prop.value.type !== 'Literal')
-            return { kind: 'safe' };
-        if (typeof prop.value.value === 'string' && prop.value.value.length > 0) {
-            return { kind: 'literal', prop: name };
-        }
-        return { kind: 'safe' };
-    }
-    return { kind: 'safe' };
-}
-exports.noHardcodedApiKey = (0, eslint_devkit_1.createRule)({
-    name: 'no-hardcoded-api-key',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-hardcoded-api-key.md',
-            description: 'Forbid a literal API key in the Anthropic client options',
-            cwe: 'CWE-798',
-            cvss: 9.1,
-        },
-        messages: {
-            hardcodedApiKey: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Hardcoded Anthropic Credential',
-                cwe: 'CWE-798',
-                owasp: 'A07:2021',
-                cvss: 9.1,
-                description: '{{prop}} is a string literal, so the credential is committed to source control and readable by anyone with repository access',
-                severity: 'CRITICAL',
-                compliance: ['SOC2', 'PCI-DSS'],
-                fix: 'Read it from the environment: new Anthropic({ {{prop}}: process.env.ANTHROPIC_API_KEY })',
-                documentationLink: 'https://docs.anthropic.com/en/api/getting-started',
-            }),
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        let importsAnthropic = false;
-        const candidates = [];
-        function inspect(node, args) {
-            const options = args[0];
-            if (options?.type !== 'ObjectExpression')
-                return;
-            const verdict = readCredential(options);
-            if (verdict.kind === 'literal') {
-                candidates.push({ node, prop: verdict.prop });
-            }
-        }
-        return {
-            ImportDeclaration(node) {
-                if (node.source.value.startsWith(ANTHROPIC_MODULE_PREFIX))
-                    importsAnthropic = true;
-            },
-            NewExpression(node) {
-                inspect(node, [...node.arguments]);
-            },
-            CallExpression(node) {
-                if (node.callee.type === 'Identifier' &&
-                    node.callee.name === 'require' &&
-                    node.arguments[0]?.type === 'Literal' &&
-                    typeof node.arguments[0].value === 'string' &&
-                    node.arguments[0].value.startsWith(ANTHROPIC_MODULE_PREFIX)) {
-                    importsAnthropic = true;
-                    return;
-                }
-                inspect(node, [...node.arguments]);
-            },
-            'Program:exit'() {
-                if (!importsAnthropic)
-                    return;
-                for (const { node, prop } of candidates) {
-                    context.report({ node, messageId: 'hardcodedApiKey', data: { prop } });
-                }
-            },
-        };
-    },
+exports.noHardcodedApiKey = (0, eslint_devkit_1.createSdkApiKeyRule)({
+    ruleName: 'no-hardcoded-api-key',
+    vendor: 'Anthropic',
+    modules: ['@anthropic-ai'],
+    keyProps: ['apiKey', 'authToken'],
+    fixTemplate: 'new Anthropic({ {{prop}}: process.env.ANTHROPIC_API_KEY })',
+    docsUrl: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-hardcoded-api-key.md',
+    documentationLink: 'https://docs.anthropic.com/en/api/getting-started',
 });