eslint-plugin-crypto 2.2.0 → 2.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +23 -0
- package/README.md +38 -78
- package/package.json +3 -3
- package/AGENTS.md +0 -119
- package/CHANGELOG.md +0 -74
package/LICENSE
ADDED
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2025 Ofri Peretz
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
22
|
+
|
|
23
|
+
|
package/README.md
CHANGED
|
@@ -16,7 +16,8 @@
|
|
|
16
16
|
|
|
17
17
|
## Description
|
|
18
18
|
|
|
19
|
-
This plugin
|
|
19
|
+
This plugin provides Cryptographic security rules enforcing best practices and modern standards (Node.js crypto).
|
|
20
|
+
By using this plugin, you can proactively identify and mitigate security risks across your entire codebase.
|
|
20
21
|
|
|
21
22
|
## Philosophy
|
|
22
23
|
|
|
@@ -36,7 +37,6 @@ npm install eslint-plugin-crypto --save-dev
|
|
|
36
37
|
```
|
|
37
38
|
|
|
38
39
|
## 💡 What You Get
|
|
39
|
-
|
|
40
40
|
- **24 security rules** covering cryptographic best practices
|
|
41
41
|
- **CVE detection** for CVE-2023-46809, CVE-2020-36732, CVE-2023-46233
|
|
42
42
|
- **OWASP Top 10 coverage** for cryptographic vulnerabilities
|
|
@@ -44,7 +44,6 @@ npm install eslint-plugin-crypto --save-dev
|
|
|
44
44
|
- **Package support** for crypto-hash, crypto-random-string, crypto-js
|
|
45
45
|
|
|
46
46
|
## Features
|
|
47
|
-
|
|
48
47
|
- 🔐 **24 Rules** covering crypto best practices
|
|
49
48
|
- 🎯 **CVE Detection** (CVE-2023-46809, CVE-2020-36732, CVE-2023-46233)
|
|
50
49
|
- 🤖 **AI-Optimized** messages with CWE references
|
|
@@ -52,7 +51,6 @@ npm install eslint-plugin-crypto --save-dev
|
|
|
52
51
|
- 📦 **Package Support** for crypto-hash, crypto-random-string, crypto-js
|
|
53
52
|
|
|
54
53
|
## ⚙️ Configuration Presets
|
|
55
|
-
|
|
56
54
|
| Preset | Description |
|
|
57
55
|
| :------------------- | :------------------------------------------- |
|
|
58
56
|
| `recommended` | Balanced security defaults for most projects |
|
|
@@ -62,14 +60,12 @@ npm install eslint-plugin-crypto --save-dev
|
|
|
62
60
|
| `cve-focused` | Rules targeting specific CVEs |
|
|
63
61
|
|
|
64
62
|
## 📚 Supported Libraries
|
|
65
|
-
|
|
66
63
|
| Library | npm | Downloads | Detection |
|
|
67
64
|
| ------------------ | ------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
|
|
68
65
|
| `crypto` (Node.js) | [](https://nodejs.org/api/crypto.html) | - | Weak Algo, Key Length, Randomness |
|
|
69
66
|
| `crypto-js` | [](https://www.npmjs.com/package/crypto-js) | [](https://www.npmjs.com/package/crypto-js) | Legacy patterns, Weak PRNG |
|
|
70
67
|
|
|
71
68
|
## Examples
|
|
72
|
-
|
|
73
69
|
### ❌ Bad
|
|
74
70
|
|
|
75
71
|
```javascript
|
|
@@ -103,7 +99,6 @@ if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken))) {
|
|
|
103
99
|
```
|
|
104
100
|
|
|
105
101
|
## Peer Dependencies (Optional)
|
|
106
|
-
|
|
107
102
|
```json
|
|
108
103
|
{
|
|
109
104
|
"crypto-hash": ">=3.0.0",
|
|
@@ -112,89 +107,54 @@ if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken))) {
|
|
|
112
107
|
}
|
|
113
108
|
```
|
|
114
109
|
|
|
115
|
-
## AI-Optimized Messages
|
|
116
|
-
|
|
117
|
-
This plugin is optimized for ESLint's [Model Context Protocol (MCP)](https://eslint.org/docs/latest/use/mcp), enabling AI assistants like **Cursor**, **GitHub Copilot**, and **Claude** to:
|
|
118
|
-
|
|
119
|
-
- Understand the exact vulnerability type via CWE references
|
|
120
|
-
- Apply the correct fix using structured guidance
|
|
121
|
-
- Provide educational context to developers
|
|
122
|
-
|
|
123
|
-
```json
|
|
124
|
-
// .cursor/mcp.json
|
|
125
|
-
{
|
|
126
|
-
"mcpServers": {
|
|
127
|
-
"eslint": {
|
|
128
|
-
"command": "npx",
|
|
129
|
-
"args": ["@eslint/mcp@latest"]
|
|
130
|
-
}
|
|
131
|
-
}
|
|
132
|
-
}
|
|
133
|
-
```
|
|
134
|
-
|
|
135
|
-
By providing this structured context (CWE, OWASP, Fix), we enable AI tools to **reason** about the security flaw rather than hallucinating. This allows Copilot/Cursor to suggest the _exact_ correct fix immediately.
|
|
136
|
-
|
|
137
110
|
## Rules
|
|
138
111
|
|
|
139
112
|
**Legend**
|
|
140
113
|
|
|
141
|
-
| Icon | Description
|
|
142
|
-
|
|
|
143
|
-
|
|
|
144
|
-
|
|
|
145
|
-
|
|
|
146
|
-
|
|
|
147
|
-
|
|
|
148
|
-
|
|
149
|
-
| Rule
|
|
150
|
-
|
|
|
151
|
-
| [no-
|
|
152
|
-
| [no-
|
|
153
|
-
| [no-
|
|
154
|
-
| [no-
|
|
155
|
-
| [no-
|
|
156
|
-
| [no-
|
|
157
|
-
| [
|
|
158
|
-
| [require-
|
|
159
|
-
| [
|
|
160
|
-
| [
|
|
161
|
-
| [require-
|
|
162
|
-
| [no-math-random-crypto](https://eslint.interlace.tools/docs/crypto/rules/no-math-random-crypto) | CWE-338 | A07:2025 | 5.3 | [no-math-random-crypto](docs/rules/no-math-random-crypto.md) | 💼 | | | 💡 | |
|
|
163
|
-
| [no-predictable-salt](https://eslint.interlace.tools/docs/crypto/rules/no-predictable-salt) | CWE-331 | A07:2025 | 7.5 | [no-predictable-salt](docs/rules/no-predictable-salt.md) | 💼 | | | 💡 | |
|
|
164
|
-
| [require-authenticated-encryption](https://eslint.interlace.tools/docs/crypto/rules/require-authenticated-encryption) | CWE-327 | A04:2025 | 6.5 | [require-authenticated-encryption](docs/rules/require-authenticated-encryption.md) | 💼 | ⚠️ | | 💡 | |
|
|
165
|
-
| [no-key-reuse](https://eslint.interlace.tools/docs/crypto/rules/no-key-reuse) | CWE-323 | A02:2025 | 7.5 | [no-key-reuse](docs/rules/no-key-reuse.md) | 💼 | ⚠️ | | 💡 | |
|
|
166
|
-
| [no-self-signed-certs](https://eslint.interlace.tools/docs/crypto/rules/no-self-signed-certs) | CWE-295 | A05:2025 | 7.5 | [no-self-signed-certs](docs/rules/no-self-signed-certs.md) | 💼 | | | 💡 | |
|
|
167
|
-
| [no-timing-unsafe-compare](https://eslint.interlace.tools/docs/crypto/rules/no-timing-unsafe-compare) | CWE-208 | A02:2025 | 5.9 | [no-timing-unsafe-compare](docs/rules/no-timing-unsafe-compare.md) | 💼 | ⚠️ | | 💡 | |
|
|
168
|
-
| [require-key-length](https://eslint.interlace.tools/docs/crypto/rules/require-key-length) | CWE-326 | A02:2025 | 7.5 | [require-key-length](docs/rules/require-key-length.md) | 💼 | ⚠️ | | 💡 | |
|
|
169
|
-
| [no-web-crypto-export](https://eslint.interlace.tools/docs/crypto/rules/no-web-crypto-export) | CWE-321 | A02:2025 | 5.0 | [no-web-crypto-export](docs/rules/no-web-crypto-export.md) | 💼 | ⚠️ | | 💡 | |
|
|
170
|
-
| [no-sha1-hash](https://eslint.interlace.tools/docs/crypto/rules/no-sha1-hash) | CWE-327 | A02:2025 | 7.5 | [no-sha1-hash](docs/rules/no-sha1-hash.md) | 💼 | | | 💡 | |
|
|
171
|
-
| [require-sufficient-length](https://eslint.interlace.tools/docs/crypto/rules/require-sufficient-length) | CWE-326 | A02:2025 | 7.5 | [require-sufficient-length](docs/rules/require-sufficient-length.md) | 💼 | ⚠️ | | 💡 | |
|
|
172
|
-
| [no-numeric-only-tokens](https://eslint.interlace.tools/docs/crypto/rules/no-numeric-only-tokens) | CWE-330 | A07:2025 | 5.3 | [no-numeric-only-tokens](docs/rules/no-numeric-only-tokens.md) | 💼 | ⚠️ | | 💡 | |
|
|
173
|
-
| [no-cryptojs](https://eslint.interlace.tools/docs/crypto/rules/no-cryptojs) | CWE-327 | A02:2025 | 5.0 | [no-cryptojs](docs/rules/no-cryptojs.md) | 💼 | ⚠️ | | 💡 | |
|
|
174
|
-
| [prefer-native-crypto](https://eslint.interlace.tools/docs/crypto/rules/prefer-native-crypto) | CWE-327 | A05:2025 | 5.0 | [prefer-native-crypto](docs/rules/prefer-native-crypto.md) | 💼 | ⚠️ | | 💡 | |
|
|
114
|
+
| Icon | Description |
|
|
115
|
+
| :---: | :--- |
|
|
116
|
+
| 💼 | **Recommended**: Included in the recommended preset. |
|
|
117
|
+
| ⚠️ | **Warns**: Set towarn in recommended preset. |
|
|
118
|
+
| 🔧 | **Auto-fixable**: Automatically fixable by the `--fix` CLI option. |
|
|
119
|
+
| 💡 | **Suggestions**: Providing code suggestions in IDE. |
|
|
120
|
+
| 🚫 | **Deprecated**: This rule is deprecated. |
|
|
121
|
+
|
|
122
|
+
| Rule | CWE | OWASP | CVSS | Description | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
|
|
123
|
+
| :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: |
|
|
124
|
+
| [no-hardcoded-crypto-key](https://eslint.interlace.tools/docs/crypto/rules/no-hardcoded-crypto-key) | CWE-321 | A02:2025 | 9.8 | Enforce no hardcoded crypto key | 💼 | | | 💡 | |
|
|
125
|
+
| [no-key-reuse](https://eslint.interlace.tools/docs/crypto/rules/no-key-reuse) | CWE-323 | A02:2025 | 7.5 | Enforce no key reuse | 💼 | ⚠️ | | 💡 | |
|
|
126
|
+
| [no-math-random-crypto](https://eslint.interlace.tools/docs/crypto/rules/no-math-random-crypto) | CWE-338 | A07:2025 | 5.3 | Enforce no math random crypto | 💼 | | | 💡 | |
|
|
127
|
+
| [no-numeric-only-tokens](https://eslint.interlace.tools/docs/crypto/rules/no-numeric-only-tokens) | CWE-330 | A07:2025 | 5.3 | Enforce no numeric only tokens | 💼 | ⚠️ | | 💡 | |
|
|
128
|
+
| [no-predictable-salt](https://eslint.interlace.tools/docs/crypto/rules/no-predictable-salt) | CWE-331 | A07:2025 | 7.5 | Enforce no predictable salt | 💼 | | | 💡 | |
|
|
129
|
+
| [no-web-crypto-export](https://eslint.interlace.tools/docs/crypto/rules/no-web-crypto-export) | CWE-321 | A02:2025 | 5.0 | Enforce no web crypto export | 💼 | ⚠️ | | 💡 | |
|
|
130
|
+
| [require-authenticated-encryption](https://eslint.interlace.tools/docs/crypto/rules/require-authenticated-encryption) | CWE-327 | A04:2025 | 6.5 | Enforce require authenticated encryption | 💼 | ⚠️ | | 💡 | |
|
|
131
|
+
| [require-key-length](https://eslint.interlace.tools/docs/crypto/rules/require-key-length) | CWE-326 | A02:2025 | 7.5 | Enforce require key length | 💼 | ⚠️ | | 💡 | |
|
|
132
|
+
| [require-random-iv](https://eslint.interlace.tools/docs/crypto/rules/require-random-iv) | CWE-329 | A02:2025 | 7.5 | Enforce require random iv | 💼 | ⚠️ | | 💡 | |
|
|
133
|
+
| [require-secure-pbkdf2-digest](https://eslint.interlace.tools/docs/crypto/rules/require-secure-pbkdf2-digest) | CWE-916 | A02:2025 | 9.1 | Enforce require secure pbkdf2 digest | 💼 | | | 💡 | |
|
|
134
|
+
| [require-sufficient-length](https://eslint.interlace.tools/docs/crypto/rules/require-sufficient-length) | CWE-326 | A02:2025 | 7.5 | Enforce require sufficient length | 💼 | ⚠️ | | 💡 | |
|
|
175
135
|
|
|
176
136
|
## 🔗 Related ESLint Plugins
|
|
177
137
|
|
|
178
138
|
Part of the **Interlace ESLint Ecosystem** — AI-native security plugins with LLM-optimized error messages:
|
|
179
139
|
|
|
180
|
-
| Plugin
|
|
181
|
-
|
|
|
182
|
-
| [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding)
|
|
183
|
-
| [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg)
|
|
184
|
-
| [`eslint-plugin-crypto`](https://www.npmjs.com/package/eslint-plugin-crypto)
|
|
185
|
-
| [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt)
|
|
186
|
-
| [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security)
|
|
187
|
-
| [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security)
|
|
188
|
-
| [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security)
|
|
189
|
-
| [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security)
|
|
190
|
-
| [`eslint-plugin-mongodb-security`](https://www.npmjs.com/package/eslint-plugin-mongodb-security)
|
|
191
|
-
| [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security hardening.
|
|
192
|
-
| [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next)
|
|
140
|
+
| Plugin | Downloads | Description |
|
|
141
|
+
| :--- | :---: | :--- |
|
|
142
|
+
| [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [](https://www.npmjs.com/package/eslint-plugin-secure-coding) | General security rules & OWASP guidelines. |
|
|
143
|
+
| [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg) | [](https://www.npmjs.com/package/eslint-plugin-pg) | PostgreSQL security & best practices. |
|
|
144
|
+
| [`eslint-plugin-crypto`](https://www.npmjs.com/package/eslint-plugin-crypto) | [](https://www.npmjs.com/package/eslint-plugin-crypto) | NodeJS Cryptography security rules. |
|
|
145
|
+
| [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt) | [](https://www.npmjs.com/package/eslint-plugin-jwt) | JWT security & best practices. |
|
|
146
|
+
| [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [](https://www.npmjs.com/package/eslint-plugin-browser-security) | Browser-specific security & XSS prevention. |
|
|
147
|
+
| [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [](https://www.npmjs.com/package/eslint-plugin-express-security) | Express.js security hardening rules. |
|
|
148
|
+
| [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security) | [](https://www.npmjs.com/package/eslint-plugin-lambda-security) | AWS Lambda security best practices. |
|
|
149
|
+
| [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | [](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | NestJS security rules & patterns. |
|
|
150
|
+
| [`eslint-plugin-mongodb-security`](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | [](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | MongoDB security best practices. |
|
|
151
|
+
| [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security hardening. |
|
|
152
|
+
| [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [](https://www.npmjs.com/package/eslint-plugin-import-next) | Next-gen import sorting & architecture. |
|
|
193
153
|
|
|
194
154
|
## 📄 License
|
|
195
155
|
|
|
196
156
|
MIT © [Ofri Peretz](https://github.com/ofri-peretz)
|
|
197
157
|
|
|
198
158
|
<p align="center">
|
|
199
|
-
<a href="https://eslint.interlace.tools/docs/crypto"><img src="https://eslint.interlace.tools/images/og-crypto.png" alt="ESLint Interlace Plugin" width="
|
|
200
|
-
</p>
|
|
159
|
+
<a href="https://eslint.interlace.tools/docs/crypto"><img src="https://eslint.interlace.tools/images/og-crypto.png" alt="ESLint Interlace Plugin" width="100%" /></a>
|
|
160
|
+
</p>
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "eslint-plugin-crypto",
|
|
3
|
-
"version": "2.2.
|
|
3
|
+
"version": "2.2.2",
|
|
4
4
|
"description": "Security-focused ESLint plugin with 24 AI-parseable rules for cryptographic best practices. Detects weak algorithms, insecure key handling, CVE-specific vulnerabilities, and deprecated crypto patterns.",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -17,10 +17,10 @@
|
|
|
17
17
|
},
|
|
18
18
|
"author": "Ofri Peretz <ofriperetzdev@gmail.com>",
|
|
19
19
|
"license": "MIT",
|
|
20
|
-
"homepage": "https://github.com/ofri-peretz/eslint/
|
|
20
|
+
"homepage": "https://github.com/ofri-peretz/eslint/tree/main/packages/eslint-plugin-crypto#readme",
|
|
21
21
|
"repository": {
|
|
22
22
|
"type": "git",
|
|
23
|
-
"url": "
|
|
23
|
+
"url": "https://github.com/ofri-peretz/eslint",
|
|
24
24
|
"directory": "packages/eslint-plugin-crypto"
|
|
25
25
|
},
|
|
26
26
|
"bugs": {
|
package/AGENTS.md
DELETED
|
@@ -1,119 +0,0 @@
|
|
|
1
|
-
# AGENTS.md
|
|
2
|
-
|
|
3
|
-
> Context for AI coding agents working on eslint-plugin-crypto
|
|
4
|
-
|
|
5
|
-
## Setup Commands
|
|
6
|
-
|
|
7
|
-
```bash
|
|
8
|
-
# Install dependencies (from monorepo root)
|
|
9
|
-
pnpm install
|
|
10
|
-
|
|
11
|
-
# Build this package
|
|
12
|
-
nx build eslint-plugin-crypto
|
|
13
|
-
|
|
14
|
-
# Run tests
|
|
15
|
-
nx test eslint-plugin-crypto
|
|
16
|
-
|
|
17
|
-
# Run tests with coverage
|
|
18
|
-
nx test eslint-plugin-crypto --coverage
|
|
19
|
-
|
|
20
|
-
# Lint this package
|
|
21
|
-
nx lint eslint-plugin-crypto
|
|
22
|
-
```
|
|
23
|
-
|
|
24
|
-
## Code Style
|
|
25
|
-
|
|
26
|
-
- TypeScript strict mode with `@interlace/eslint-devkit` types
|
|
27
|
-
- Use `AST_NODE_TYPES` constants, never string literals for node types
|
|
28
|
-
- Use `formatLLMMessage()` for all rule error messages
|
|
29
|
-
- Include CWE, CVSS, CVE references in every security message
|
|
30
|
-
- Use `c8 ignore` comments with documented reasons for untestable code
|
|
31
|
-
- Single-pass AST traversal patterns (O(n) complexity)
|
|
32
|
-
|
|
33
|
-
## Testing Instructions
|
|
34
|
-
|
|
35
|
-
- Tests use `@typescript-eslint/rule-tester` with Vitest
|
|
36
|
-
- Each rule has `index.ts` (implementation) and `*.test.ts` (tests) in same directory
|
|
37
|
-
- Run specific rule test: `nx test eslint-plugin-crypto --testPathPattern="no-weak-hash"`
|
|
38
|
-
- Coverage target: ≥90% lines, ≥95% functions
|
|
39
|
-
- All tests must pass before committing
|
|
40
|
-
|
|
41
|
-
## Project Structure
|
|
42
|
-
|
|
43
|
-
```
|
|
44
|
-
src/
|
|
45
|
-
├── index.ts # Plugin entry, 5 configs
|
|
46
|
-
├── types/index.ts # 24 rule option types
|
|
47
|
-
└── rules/ # 24 rule directories
|
|
48
|
-
```
|
|
49
|
-
|
|
50
|
-
## Plugin Purpose
|
|
51
|
-
|
|
52
|
-
Security-focused ESLint plugin with **24 rules** for cryptographic best practices. Covers Node.js `crypto`, Web Crypto API, and npm packages (crypto-hash, crypto-random-string, crypto-js).
|
|
53
|
-
|
|
54
|
-
## Rule Categories
|
|
55
|
-
|
|
56
|
-
### Core Node.js Crypto Rules (8)
|
|
57
|
-
|
|
58
|
-
| Rule | CWE | Detects | Fix |
|
|
59
|
-
| ----------------------------- | --- | -------------- | ---------------- |
|
|
60
|
-
| `no-weak-hash-algorithm` | 327 | MD5, SHA1, MD4 | SHA-256/512 |
|
|
61
|
-
| `no-weak-cipher-algorithm` | 327 | DES, 3DES, RC4 | AES-256-GCM |
|
|
62
|
-
| `no-deprecated-cipher-method` | 327 | createCipher() | createCipheriv() |
|
|
63
|
-
| `no-static-iv` | 329 | Hardcoded IVs | randomBytes(16) |
|
|
64
|
-
| `no-ecb-mode` | 327 | ECB mode | GCM or CBC |
|
|
65
|
-
| `no-insecure-key-derivation` | 916 | PBKDF2 <100k | ≥100k iterations |
|
|
66
|
-
| `no-hardcoded-crypto-key` | 321 | Literal keys | env vars/KMS |
|
|
67
|
-
| `require-random-iv` | 329 | Non-random IVs | randomBytes() |
|
|
68
|
-
|
|
69
|
-
### CVE-Specific Rules (3)
|
|
70
|
-
|
|
71
|
-
| Rule | CVE | Vulnerability |
|
|
72
|
-
| ------------------------------ | -------------- | ------------- |
|
|
73
|
-
| `no-insecure-rsa-padding` | CVE-2023-46809 | Marvin Attack |
|
|
74
|
-
| `no-cryptojs-weak-random` | CVE-2020-36732 | Weak PRNG |
|
|
75
|
-
| `require-secure-pbkdf2-digest` | CVE-2023-46233 | SHA1 PBKDF2 |
|
|
76
|
-
|
|
77
|
-
## Common Fix Patterns
|
|
78
|
-
|
|
79
|
-
```typescript
|
|
80
|
-
// Weak Hash
|
|
81
|
-
// BAD: crypto.createHash('md5')
|
|
82
|
-
// GOOD: crypto.createHash('sha256')
|
|
83
|
-
|
|
84
|
-
// RSA Padding (CVE-2023-46809)
|
|
85
|
-
// BAD: padding: crypto.constants.RSA_PKCS1_PADDING
|
|
86
|
-
// GOOD: padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
|
|
87
|
-
|
|
88
|
-
// Math.random for crypto
|
|
89
|
-
// BAD: const token = Math.random().toString(36)
|
|
90
|
-
// GOOD: const token = crypto.randomBytes(32).toString('hex')
|
|
91
|
-
|
|
92
|
-
// Timing-safe compare
|
|
93
|
-
// BAD: if (userToken === storedToken)
|
|
94
|
-
// GOOD: if (crypto.timingSafeEqual(Buffer.from(userToken), Buffer.from(storedToken)))
|
|
95
|
-
|
|
96
|
-
// Authenticated encryption
|
|
97
|
-
// BAD: crypto.createCipheriv('aes-256-cbc', key, iv)
|
|
98
|
-
// GOOD: crypto.createCipheriv('aes-256-gcm', key, iv)
|
|
99
|
-
```
|
|
100
|
-
|
|
101
|
-
## Presets (5)
|
|
102
|
-
|
|
103
|
-
| Preset | Use Case |
|
|
104
|
-
| -------------------- | ----------------------- |
|
|
105
|
-
| `recommended` | Most projects |
|
|
106
|
-
| `strict` | High-security apps |
|
|
107
|
-
| `cryptojs-migration` | Migrating off crypto-js |
|
|
108
|
-
| `nodejs-only` | Server-side only |
|
|
109
|
-
| `cve-focused` | Known CVE protection |
|
|
110
|
-
|
|
111
|
-
## CWE Coverage
|
|
112
|
-
|
|
113
|
-
208, 295, 321, 323, 326, 327, 328, 329, 330, 331, 338, 916, 1104
|
|
114
|
-
|
|
115
|
-
## Security Considerations
|
|
116
|
-
|
|
117
|
-
- Detects 3 specific CVEs: CVE-2023-46809, CVE-2020-36732, CVE-2023-46233
|
|
118
|
-
- Marvin Attack detection for RSA padding
|
|
119
|
-
- crypto-js weak PRNG detection
|
package/CHANGELOG.md
DELETED
|
@@ -1,74 +0,0 @@
|
|
|
1
|
-
# Changelog
|
|
2
|
-
|
|
3
|
-
All notable changes to `eslint-plugin-crypto` will be documented in this file.
|
|
4
|
-
|
|
5
|
-
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
|
-
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
|
-
|
|
8
|
-
## [Unreleased]
|
|
9
|
-
|
|
10
|
-
### Documentation
|
|
11
|
-
|
|
12
|
-
- 📘 Launched new documentation site: [eslint.interlace.tools](https://eslint.interlace.tools/)
|
|
13
|
-
|
|
14
|
-
## [1.0.0] - 2025-12-29
|
|
15
|
-
|
|
16
|
-
### Added
|
|
17
|
-
|
|
18
|
-
#### Core Node.js Crypto Rules (8)
|
|
19
|
-
|
|
20
|
-
- `no-weak-hash-algorithm` - Detect MD5, SHA1, MD4, RIPEMD (CWE-327)
|
|
21
|
-
- `no-weak-cipher-algorithm` - Detect DES, 3DES, RC4, Blowfish (CWE-327)
|
|
22
|
-
- `no-deprecated-cipher-method` - Detect createCipher/createDecipher (CWE-327)
|
|
23
|
-
- `no-static-iv` - Detect hardcoded initialization vectors (CWE-329)
|
|
24
|
-
- `no-ecb-mode` - Detect ECB encryption mode (CWE-327)
|
|
25
|
-
- `no-insecure-key-derivation` - Detect PBKDF2 < 100k iterations (CWE-916)
|
|
26
|
-
- `no-hardcoded-crypto-key` - Detect literal encryption keys (CWE-321)
|
|
27
|
-
- `require-random-iv` - Ensure IV from crypto.randomBytes() (CWE-329)
|
|
28
|
-
|
|
29
|
-
#### CVE-Specific Rules (3)
|
|
30
|
-
|
|
31
|
-
- `no-insecure-rsa-padding` - **CVE-2023-46809** Marvin Attack detection (CWE-327)
|
|
32
|
-
- `no-cryptojs-weak-random` - **CVE-2020-36732** crypto-js weak PRNG (CWE-338)
|
|
33
|
-
- `require-secure-pbkdf2-digest` - **CVE-2023-46233** PBKDF2 SHA1 default (CWE-328)
|
|
34
|
-
|
|
35
|
-
#### Advanced Security Rules (7)
|
|
36
|
-
|
|
37
|
-
- `no-math-random-crypto` - Detect Math.random() in crypto contexts (CWE-338)
|
|
38
|
-
- `no-predictable-salt` - Detect empty/hardcoded salts (CWE-331)
|
|
39
|
-
- `require-authenticated-encryption` - Flag CBC/CTR without MAC (CWE-327)
|
|
40
|
-
- `no-key-reuse` - Warn on key reuse across operations (CWE-323)
|
|
41
|
-
- `no-self-signed-certs` - Detect rejectUnauthorized: false (CWE-295)
|
|
42
|
-
- `no-timing-unsafe-compare` - Detect timing-unsafe secret comparison (CWE-208)
|
|
43
|
-
- `require-key-length` - Recommend AES-256 over AES-128/192 (CWE-326)
|
|
44
|
-
- `no-web-crypto-export` - Warn on key export (CWE-321)
|
|
45
|
-
|
|
46
|
-
#### Package-Specific Rules (6)
|
|
47
|
-
|
|
48
|
-
- `no-sha1-hash` - Detect sha1() from crypto-hash (CWE-327)
|
|
49
|
-
- `require-sufficient-length` - Require crypto-random-string ≥32 chars (CWE-330)
|
|
50
|
-
- `no-numeric-only-tokens` - Warn on type: 'numeric' (CWE-330)
|
|
51
|
-
- `no-cryptojs` - Warn on deprecated crypto-js usage (CWE-1104)
|
|
52
|
-
- `no-cryptojs-weak-random` - CVE-2020-36732 (CWE-338)
|
|
53
|
-
- `prefer-native-crypto` - Recommend native crypto (CWE-1104)
|
|
54
|
-
|
|
55
|
-
#### Presets (5)
|
|
56
|
-
|
|
57
|
-
- `recommended` - Balanced security defaults
|
|
58
|
-
- `strict` - All 24 rules as errors
|
|
59
|
-
- `cryptojs-migration` - For migrating off crypto-js
|
|
60
|
-
- `nodejs-only` - Server-side only (no package rules)
|
|
61
|
-
- `cve-focused` - Rules targeting specific CVEs
|
|
62
|
-
|
|
63
|
-
#### Features
|
|
64
|
-
|
|
65
|
-
- LLM-optimized error messages with CWE references
|
|
66
|
-
- Auto-fix suggestions where safe
|
|
67
|
-
- OWASP-aligned recommendations
|
|
68
|
-
- TypeScript support
|
|
69
|
-
- Comprehensive test coverage (302 edge case tests)
|
|
70
|
-
|
|
71
|
-
### Security
|
|
72
|
-
|
|
73
|
-
- Covers 13 CWEs: 208, 295, 321, 323, 326, 327, 328, 329, 330, 331, 338, 916, 1104
|
|
74
|
-
- Detects 3 specific CVEs: CVE-2023-46809, CVE-2020-36732, CVE-2023-46233
|