eslint-plugin-anthropic-security 0.1.1 → 0.3.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "eslint-plugin-anthropic-security",
-  "version": "0.1.1",
-  "description": "ESLint plugin for Anthropic SDK security — catches hardcoded API keys in the Claude client options.",
+  "version": "0.3.0",
+  "description": "ESLint plugin for Anthropic SDK security — catches hardcoded Claude API keys, the browser escape hatch that ships them to every visitor, and system prompts assembled from untrusted input.",
   "type": "commonjs",
   "main": "./src/index.js",
   "types": "./src/index.d.ts",
@@ -75,7 +75,7 @@
     }
   },
   "dependencies": {
-    "@interlace/eslint-devkit": "^1.8.0"
+    "@interlace/eslint-devkit": "^1.10.0"
   },
   "funding": {
     "type": "github",

package/src/index.js

@@ -1,33 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.configs = exports.plugin = exports.rules = exports.noHardcodedApiKey = void 0;
-var no_hardcoded_api_key_2 = require("./rules/no-hardcoded-api-key");
-Object.defineProperty(exports, "noHardcodedApiKey", { enumerable: true, get: function () { return no_hardcoded_api_key_2.noHardcodedApiKey; } });
-exports.rules = {
-    get 'no-hardcoded-api-key'() { return require("./rules/no-hardcoded-api-key").noHardcodedApiKey; },
-
-};
-exports.plugin = {
-    meta: {
-        name: 'eslint-plugin-anthropic-security',
-        version: '0.1.1',
-    },
-    rules: exports.rules,
-};
-const enabled = {
-    plugins: {
-        'anthropic-security': exports.plugin,
-    },
-    rules: {
-        'anthropic-security/no-hardcoded-api-key': 'error',
-    },
-};
-exports.configs = {
-    minimal: enabled,
-    recommended: enabled,
-    strict: enabled,
-};
-exports.default = {
-    ...exports.plugin,
-    configs: exports.configs,
-};
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.configs=exports.plugin=exports.rules=exports.noUntrustedContentInPrompt=exports.noHardcodedApiKey=exports.noBrowserApiKeyExposure=void 0;var no_browser_api_key_exposure_2=require("./rules/no-browser-api-key-exposure");Object.defineProperty(exports,"noBrowserApiKeyExposure",{enumerable:true,get:function(){return no_browser_api_key_exposure_2.noBrowserApiKeyExposure}});var no_hardcoded_api_key_2=require("./rules/no-hardcoded-api-key");Object.defineProperty(exports,"noHardcodedApiKey",{enumerable:true,get:function(){return no_hardcoded_api_key_2.noHardcodedApiKey}});var no_untrusted_content_in_prompt_2=require("./rules/no-untrusted-content-in-prompt");Object.defineProperty(exports,"noUntrustedContentInPrompt",{enumerable:true,get:function(){return no_untrusted_content_in_prompt_2.noUntrustedContentInPrompt}});exports.rules={get"no-browser-api-key-exposure"(){return require("./rules/no-browser-api-key-exposure").noBrowserApiKeyExposure},get"no-hardcoded-api-key"(){return require("./rules/no-hardcoded-api-key").noHardcodedApiKey},get"no-untrusted-content-in-prompt"(){return require("./rules/no-untrusted-content-in-prompt").noUntrustedContentInPrompt}};exports.plugin={meta:{name:"eslint-plugin-anthropic-security",version:"0.3.0"},rules:exports.rules};const enabled={plugins:{"anthropic-security":exports.plugin},rules:{"anthropic-security/no-browser-api-key-exposure":"error","anthropic-security/no-hardcoded-api-key":"error"}};const strict={plugins:{"anthropic-security":exports.plugin},rules:{...enabled.rules,"anthropic-security/no-untrusted-content-in-prompt":"error"}};exports.configs={minimal:enabled,recommended:enabled,strict};exports.default={...exports.plugin,configs:exports.configs};

package/src/oxlint.js

@@ -1,3 +1 @@
-"use strict";
-const index_1 = require("./index");
-module.exports = index_1.plugin;
+"use strict";const index_1=require("./index");module.exports=index_1.plugin;

package/src/rules/no-browser-api-key-exposure/index.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noBrowserApiKeyExposure=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noBrowserApiKeyExposure=(0,eslint_devkit_1.createBrowserEscapeHatchRule)({ruleName:"no-browser-api-key-exposure",vendor:"Anthropic",modules:["@anthropic-ai"],docsUrl:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-browser-api-key-exposure.md",documentationLink:"https://docs.anthropic.com/en/api/getting-started"});

package/src/rules/no-hardcoded-api-key/index.js

@@ -1,92 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noHardcodedApiKey = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const ANTHROPIC_MODULE_PREFIX = '@anthropic-ai/';
-const KEY_PROPS = new Set(['apiKey', 'authToken']);
-function readCredential(options) {
-    for (const prop of options.properties) {
-        if (prop.type === 'SpreadElement')
-            return { kind: 'unreadable' };
-        if (prop.computed)
-            continue;
-        const name = prop.key.type === 'Identifier' ? prop.key.name : String(prop.key.value);
-        if (!KEY_PROPS.has(name))
-            continue;
-        if (prop.value.type !== 'Literal')
-            return { kind: 'safe' };
-        if (typeof prop.value.value === 'string' && prop.value.value.length > 0) {
-            return { kind: 'literal', prop: name };
-        }
-        return { kind: 'safe' };
-    }
-    return { kind: 'safe' };
-}
-exports.noHardcodedApiKey = (0, eslint_devkit_1.createRule)({
-    name: 'no-hardcoded-api-key',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-hardcoded-api-key.md',
-            description: 'Forbid a literal API key in the Anthropic client options',
-            cwe: 'CWE-798',
-            cvss: 9.1,
-        },
-        messages: {
-            hardcodedApiKey: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Hardcoded Anthropic Credential',
-                cwe: 'CWE-798',
-                owasp: 'A07:2021',
-                cvss: 9.1,
-                description: '{{prop}} is a string literal, so the credential is committed to source control and readable by anyone with repository access',
-                severity: 'CRITICAL',
-                compliance: ['SOC2', 'PCI-DSS'],
-                fix: 'Read it from the environment: new Anthropic({ {{prop}}: process.env.ANTHROPIC_API_KEY })',
-                documentationLink: 'https://docs.anthropic.com/en/api/getting-started',
-            }),
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        let importsAnthropic = false;
-        const candidates = [];
-        function inspect(node, args) {
-            const options = args[0];
-            if (options?.type !== 'ObjectExpression')
-                return;
-            const verdict = readCredential(options);
-            if (verdict.kind === 'literal') {
-                candidates.push({ node, prop: verdict.prop });
-            }
-        }
-        return {
-            ImportDeclaration(node) {
-                if (node.source.value.startsWith(ANTHROPIC_MODULE_PREFIX))
-                    importsAnthropic = true;
-            },
-            NewExpression(node) {
-                inspect(node, [...node.arguments]);
-            },
-            CallExpression(node) {
-                if (node.callee.type === 'Identifier' &&
-                    node.callee.name === 'require' &&
-                    node.arguments[0]?.type === 'Literal' &&
-                    typeof node.arguments[0].value === 'string' &&
-                    node.arguments[0].value.startsWith(ANTHROPIC_MODULE_PREFIX)) {
-                    importsAnthropic = true;
-                    return;
-                }
-                inspect(node, [...node.arguments]);
-            },
-            'Program:exit'() {
-                if (!importsAnthropic)
-                    return;
-                for (const { node, prop } of candidates) {
-                    context.report({ node, messageId: 'hardcodedApiKey', data: { prop } });
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noHardcodedApiKey=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noHardcodedApiKey=(0,eslint_devkit_1.createSdkApiKeyRule)({ruleName:"no-hardcoded-api-key",vendor:"Anthropic",modules:["@anthropic-ai"],keyProps:["apiKey","authToken"],fixTemplate:"new Anthropic({ {{prop}}: process.env.ANTHROPIC_API_KEY })",docsUrl:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-hardcoded-api-key.md",documentationLink:"https://docs.anthropic.com/en/api/getting-started"});

package/src/rules/no-untrusted-content-in-prompt/index.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noUntrustedContentInPrompt=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noUntrustedContentInPrompt=(0,eslint_devkit_1.createSystemPromptInjectionRule)({ruleName:"no-untrusted-content-in-prompt",vendor:"Anthropic",modules:["@anthropic-ai"],requestPaths:["messages.create","messages.stream"],systemPromptProps:["system"],docsUrl:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-untrusted-content-in-prompt.md",documentationLink:"https://docs.anthropic.com/en/docs/system-prompts"});