eslint-plugin-jwt-security 2.3.0 → 2.3.1

package/src/rules/no-algorithm-none/no-algorithm-none.test.ts

@@ -1,146 +0,0 @@
-/**
- * Tests for no-algorithm-none rule
- * Security: CWE-347 (CVE-2022-23540)
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noAlgorithmNone } from './index';
-
-// Configure RuleTester for Vitest
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('no-algorithm-none', () => {
-  describe('Valid Code - Secure Algorithms', () => {
-    ruleTester.run('valid - secure algorithms', noAlgorithmNone, {
-      valid: [
-        // RS256 - RSA with SHA-256
-        { code: `jwt.verify(token, publicKey, { algorithms: ['RS256'] });` },
-        // ES256 - ECDSA with SHA-256
-        { code: `jwt.verify(token, publicKey, { algorithms: ['ES256'] });` },
-        // Multiple secure algorithms
-        { code: `jwt.verify(token, key, { algorithms: ['RS256', 'RS384', 'RS512'] });` },
-        // Single algorithm option
-        { code: `jwt.verify(token, secret, { algorithm: 'HS256' });` },
-        // jose library
-        { code: `jwtVerify(token, key, { algorithms: ['RS256'] });` },
-        // No options (doesn't trigger this rule)
-        { code: `jwt.verify(token, secret);` },
-        // Sign operation with secure algorithm
-        { code: `jwt.sign(payload, secret, { algorithm: 'RS256' });` },
-        // Spread operator in options (edge case - line 143 coverage)
-        { code: `jwt.verify(token, key, { ...opts, algorithms: ['RS256'] });` },
-        // Non-algorithm properties (line 152 coverage)
-        { code: `jwt.verify(token, key, { issuer: 'auth', complete: true });` },
-        // Options without algorithms (different property names)
-        { code: `jwt.sign(payload, secret, { expiresIn: '1h', subject: 'user' });` },
-        // Variable algorithms (not literal)
-        { code: `jwt.verify(token, key, { algorithms: allowedAlgorithms });` },
-        // Array with non-literal elements
-        { code: `jwt.verify(token, key, { algorithms: [defaultAlg] });` },
-        // Non-string literal in array
-        { code: `jwt.verify(token, key, { algorithms: [123] });` },
-        // Non-JWT function call - edge case (line 199 coverage)
-        { code: `console.log('hello');` },
-        { code: `someOtherFunction(token, key, { algorithm: 'none' });` },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code - Algorithm None', () => {
-    ruleTester.run('invalid - algorithm none', noAlgorithmNone, {
-      valid: [],
-      invalid: [
-        // Direct 'none' algorithm
-        {
-          code: `jwt.verify(token, secret, { algorithm: 'none' });`,
-          errors: [{ messageId: 'algorithmNone' }],
-        },
-        // 'none' in algorithms array (single element - gets replaced)
-        {
-          code: `jwt.verify(token, secret, { algorithms: ['none'] });`,
-          errors: [{ messageId: 'algorithmNoneInArray' }],
-        },
-        // 'none' mixed with other algorithms (no auto-fix for removal)
-        {
-          code: `jwt.verify(token, secret, { algorithms: ['RS256', 'none'] });`,
-          errors: [{ messageId: 'algorithmNoneInArray' }],
-        },
-        // Case insensitive - 'None'
-        {
-          code: `jwt.verify(token, secret, { algorithm: 'None' });`,
-          errors: [{ messageId: 'algorithmNone' }],
-        },
-        // Case insensitive - 'NONE'
-        {
-          code: `jwt.verify(token, secret, { algorithms: ['NONE'] });`,
-          errors: [{ messageId: 'algorithmNoneInArray' }],
-        },
-        // alg shorthand
-        {
-          code: `jwt.verify(token, secret, { alg: 'none' });`,
-          errors: [{ messageId: 'algorithmNone' }],
-        },
-        // Empty algorithms array
-        {
-          code: `jwt.verify(token, secret, { algorithms: [] });`,
-          errors: [{ messageId: 'emptyAlgorithms' }],
-        },
-        // Sign operation with none
-        {
-          code: `jwt.sign(payload, secret, { algorithm: 'none' });`,
-          errors: [{ messageId: 'algorithmNone' }],
-        },
-        // jose library
-        {
-          code: `jwtVerify(token, key, { algorithms: ['none'] });`,
-          errors: [{ messageId: 'algorithmNoneInArray' }],
-        },
-        // signJWT with none
-        {
-          code: `signJWT(payload, key, { algorithm: 'none' });`,
-          errors: [{ messageId: 'algorithmNone' }],
-        },
-      ],
-    });
-  });
-
-  describe('Configuration Options', () => {
-    ruleTester.run('config - allowInTests', noAlgorithmNone, {
-      valid: [
-        // Test file with allowInTests enabled
-        {
-          code: `jwt.verify(token, secret, { algorithm: 'none' });`,
-          options: [{ allowInTests: true }],
-          filename: 'auth.test.ts',
-        },
-        {
-          code: `jwt.verify(token, secret, { algorithm: 'none' });`,
-          options: [{ allowInTests: true }],
-          filename: '__tests__/jwt.ts',
-        },
-      ],
-      invalid: [
-        // Non-test file with allowInTests
-        {
-          code: `jwt.verify(token, secret, { algorithm: 'none' });`,
-          options: [{ allowInTests: true }],
-          filename: 'auth.ts',
-          errors: [{ messageId: 'algorithmNone' }],
-        },
-      ],
-    });
-  });
-});

package/src/rules/no-decode-without-verify/index.ts

@@ -1,162 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * ESLint Rule: no-decode-without-verify
- *
- * Detects usage of jwt.decode() or jwt-decode library without corresponding
- * verification. Decoded JWTs can be tampered with by attackers.
- *
- * CWE-345: Insufficient Verification of Data Authenticity
- *
- * @see https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/10-Testing_JSON_Web_Tokens
- */
-import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
-import { createRule, formatLLMMessage, MessageIcons, hasSafeAnnotation } from '@interlace/eslint-devkit';
-import { isDecodeOperation } from '../../utils';
-import type { NoDecodeWithoutVerifyOptions } from '../../types';
-
-type MessageIds =
-  | 'decodeWithoutVerify'
-  | 'jwtDecodeLibrary'
-  | 'useVerifyInstead';
-
-type RuleOptions = [NoDecodeWithoutVerifyOptions?];
-
-export const noDecodeWithoutVerify = createRule<RuleOptions, MessageIds>({
-  name: 'no-decode-without-verify',
-  meta: {
-    type: 'problem',
-    docs: {
-      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-decode-without-verify.md',
-      description:
-        'Disallow trusting decoded JWT payload without signature verification',
-      cwe: 'CWE-345',
-      cvss: 7.5,
-    },
-    fixable: undefined,
-    hasSuggestions: false,
-    messages: {
-      decodeWithoutVerify: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Decoded JWT Without Verification',
-        cwe: 'CWE-345',
-        description:
-          'jwt.decode() returns payload without verifying signature - data can be forged',
-        severity: 'HIGH',
-        fix: 'Use jwt.verify(token, secret) instead of jwt.decode(token)',
-        documentationLink:
-          'https://owasp.org/API-Security/0xa7-security-misconfiguration/',
-      }),
-      jwtDecodeLibrary: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'jwt-decode Library Usage',
-        cwe: 'CWE-345',
-        description:
-          'jwt-decode library only decodes tokens, never verifies signatures',
-        severity: 'HIGH',
-        fix: 'Use jsonwebtoken.verify() or jose.jwtVerify() for verification',
-        documentationLink: 'https://www.npmjs.com/package/jwt-decode',
-      }),
-      useVerifyInstead: formatLLMMessage({
-        icon: MessageIcons.INFO,
-        issueName: 'Use Verify Instead',
-        description: 'Replace decode with verify to ensure authenticity',
-        severity: 'LOW',
-        fix: 'jwt.verify(token, secret, { algorithms: ["RS256"] })',
-        documentationLink: 'https://www.npmjs.com/package/jsonwebtoken',
-      }),
-    },
-    schema: [
-      {
-        type: 'object',
-        properties: {
-          allowHeaderInspection: {
-            type: 'boolean',
-            default: false,
-            description:
-              'Allow decode() for reading header before verification',
-          },
-          trustedSanitizers: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          trustedAnnotations: {
-            type: 'array',
-            items: { type: 'string' },
-            default: ['@decoded-header-only', '@verified-separately'],
-          },
-          strictMode: {
-            type: 'boolean',
-            default: false,
-          },
-        },
-        additionalProperties: false,
-      },
-    ],
-  },
-  defaultOptions: [
-    {
-      allowHeaderInspection: false,
-      trustedSanitizers: [],
-      trustedAnnotations: ['@decoded-header-only', '@verified-separately'],
-      strictMode: false,
-    },
-  ],
-  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
-    const options = context.options[0] ?? {};
-    const { trustedAnnotations = [] } = options;
-
-    /**
-     * Check if this is a jwt-decode import usage
-     */
-    // oxlint-disable-next-line consistent-function-scoping
-    const isJwtDecodeLibrary = (node: TSESTree.CallExpression): boolean => {
-      // Direct call: jwtDecode(token)
-      if (
-        node.callee.type === 'Identifier' &&
-        (node.callee.name === 'jwtDecode' || node.callee.name === 'jwt_decode')
-      ) {
-        return true;
-      }
-      return false;
-    };
-
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        // Check for jwt.decode() pattern
-        if (isDecodeOperation(node)) {
-          // Check for safe annotations
-          if (hasSafeAnnotation(node, context, trustedAnnotations)) {
-            return;
-          }
-
-          context.report({
-            node,
-            messageId: 'decodeWithoutVerify',
-          });
-          return;
-        }
-
-        // Check for jwt-decode library usage
-        if (isJwtDecodeLibrary(node)) {
-          // Check for safe annotations
-          if (hasSafeAnnotation(node, context, trustedAnnotations)) {
-            return;
-          }
-
-          context.report({
-            node,
-            messageId: 'jwtDecodeLibrary',
-          });
-        }
-      },
-    };
-  },
-});
-
-export default noDecodeWithoutVerify;

package/src/rules/no-decode-without-verify/no-decode-without-verify.test.ts

@@ -1,76 +0,0 @@
-/**
- * Tests for no-decode-without-verify rule
- * Security: CWE-345 (Data Authenticity)
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noDecodeWithoutVerify } from './index';
-
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('no-decode-without-verify', () => {
-  describe('Valid Code - Verify Operations', () => {
-    ruleTester.run('valid - verify operations', noDecodeWithoutVerify, {
-      valid: [
-        // jwt.verify is safe
-        { code: `const payload = jwt.verify(token, secret);` },
-        { code: `jwt.verify(token, publicKey, { algorithms: ['RS256'] });` },
-        // jose jwtVerify is safe
-        { code: `const { payload } = await jwtVerify(token, key);` },
-        // sign is not flagged
-        { code: `jwt.sign(payload, secret);` },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code - Decode Operations', () => {
-    ruleTester.run('invalid - decode without verify', noDecodeWithoutVerify, {
-      valid: [],
-      invalid: [
-        // Basic jwt.decode()
-        {
-          code: `const payload = jwt.decode(token);`,
-          errors: [{ messageId: 'decodeWithoutVerify' }],
-        },
-        // decode with options
-        {
-          code: `const decoded = jwt.decode(token, { complete: true });`,
-          errors: [{ messageId: 'decodeWithoutVerify' }],
-        },
-        // Using payload directly
-        {
-          code: `const userId = jwt.decode(token).sub;`,
-          errors: [{ messageId: 'decodeWithoutVerify' }],
-        },
-        // jwt-decode library - jwtDecode pattern
-        {
-          code: `const payload = jwtDecode(accessToken);`,
-          errors: [{ messageId: 'decodeWithoutVerify' }],
-        },
-        // jwt-decode library - jwt_decode pattern (snake_case import)
-        {
-          code: `const payload = jwt_decode(accessToken);`,
-          errors: [{ messageId: 'jwtDecodeLibrary' }],
-        },
-        // jose decodeJwt (decode only)
-        {
-          code: `const payload = decodeJWT(token);`,
-          errors: [{ messageId: 'decodeWithoutVerify' }],
-        },
-      ],
-    });
-  });
-});

package/src/rules/no-hardcoded-secret/index.ts

@@ -1,230 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * ESLint Rule: no-hardcoded-secret
- *
- * Detects hardcoded secrets in JWT sign/verify operations.
- * Hardcoded secrets in source code are a critical security vulnerability.
- *
- * CWE-798: Use of Hard-coded Credentials
- *
- * @see https://cwe.mitre.org/data/definitions/798.html
- */
-import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import {
-  isSignOperation,
-  isVerifyOperation,
-  isEnvVariable,
-} from '../../utils';
-import type { NoHardcodedSecretOptions } from '../../types';
-
-type MessageIds =
-  | 'hardcodedSecret'
-  | 'useEnvVariable';
-
-type RuleOptions = [NoHardcodedSecretOptions?];
-
-export const noHardcodedSecret = createRule<RuleOptions, MessageIds>({
-  name: 'no-hardcoded-secret',
-  meta: {
-    type: 'problem',
-    docs: {
-      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-hardcoded-secret.md',
-      description:
-        'Disallow hardcoded secrets in JWT sign/verify operations',
-      cwe: 'CWE-798',
-      cvss: 9.8,
-    },
-    fixable: undefined,
-    hasSuggestions: false,
-    messages: {
-      hardcodedSecret: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Hardcoded JWT Secret',
-        cwe: 'CWE-798',
-        description:
-          'Secret key hardcoded in source code can be extracted from repositories',
-        severity: 'HIGH',
-        fix: 'Use process.env.JWT_SECRET or secure secret management',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/798.html',
-      }),
-      useEnvVariable: formatLLMMessage({
-        icon: MessageIcons.INFO,
-        issueName: 'Use Environment Variable',
-        description: 'Replace hardcoded secret with environment variable',
-        severity: 'LOW',
-        fix: 'process.env.JWT_SECRET',
-        documentationLink:
-          'https://12factor.net/config',
-      }),
-    },
-    schema: [
-      {
-        type: 'object',
-        properties: {
-          envPatterns: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-            description: 'Patterns that indicate safe environment variable usage',
-          },
-          trustedSanitizers: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          trustedAnnotations: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          strictMode: {
-            type: 'boolean',
-            default: false,
-          },
-        },
-        additionalProperties: false,
-      },
-    ],
-  },
-  defaultOptions: [
-    {
-      envPatterns: [],
-      trustedSanitizers: [],
-      trustedAnnotations: [],
-      strictMode: false,
-    },
-  ],
-  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
-    /**
-     * Check if a node is a hardcoded string literal
-     */
-    // oxlint-disable-next-line consistent-function-scoping
-    const isHardcodedString = (node: TSESTree.Node): boolean => {
-      // String literal
-      if (node.type === 'Literal' && typeof node.value === 'string') {
-        return true;
-      }
-
-      // Template literal without expressions
-      if (
-        node.type === 'TemplateLiteral' &&
-        node.expressions.length === 0
-      ) {
-        return true;
-      }
-
-      return false;
-    };
-
-    /**
-     * Resolve an Identifier node to its initializer (one frame of indirection).
-     * Closes the audit FN where `const SECRET = 'x'; jwt.sign(p, SECRET)`
-     * was treated as safe — the literal-via-const pattern hides the
-     * hardcoded secret behind one declaration. See benchmarks/AUDIT_PATTERNS.md
-     * §3.2 ("Indirection through one level of variable").
-     */
-    const resolveConstLiteralValue = (
-      node: TSESTree.Node,
-    ): TSESTree.Node | null => {
-      if (node.type !== 'Identifier') return null;
-      const scope = context.sourceCode.getScope?.(node) ?? null;
-      if (!scope) return null;
-      const variable = scope.references.find(
-        (r) => r.identifier === node,
-      )?.resolved;
-      const def = variable?.defs[0];
-      if (!def || def.type !== 'Variable') return null;
-      const decl = def.parent;
-      if (decl?.type !== 'VariableDeclaration' || decl.kind !== 'const') return null;
-      return def.node.init ?? null;
-    };
-
-    /**
-     * Check if node is a safe key source
-     */
-    const isSafeKeySource = (node: TSESTree.Node): boolean => {
-      // Environment variable
-      if (isEnvVariable(node)) {
-        return true;
-      }
-
-      // Function call (getSecret(), loadKey(), etc.)
-      if (node.type === 'CallExpression') {
-        return true;
-      }
-
-      // await expression (async key loading)
-      if (node.type === 'AwaitExpression') {
-        return true;
-      }
-
-      // Variable reference: resolve `const X = ...` one level. If X is a
-      // hardcoded literal, treat as unsafe — fall through to the
-      // hardcoded check. Otherwise (env var, call, identifier chain)
-      // it's safe.
-      if (node.type === 'Identifier') {
-        const init = resolveConstLiteralValue(node);
-        if (init && isHardcodedString(init)) {
-          // Unsafe — let the caller's `isHardcodedString` (with the
-          // resolved init) flag it.
-          return false;
-        }
-        return true;
-      }
-
-      // Member expression but not literal (config.secret, etc.)
-      if (node.type === 'MemberExpression' && !isHardcodedString(node)) {
-        return true;
-      }
-
-      return false;
-    };
-
-    /**
-     * Like isHardcodedString but resolves single-level `const X = '...'`
-     * indirection so the caller fires on `const SECRET = 'x'; jwt.sign(p, SECRET)`.
-     */
-    const isHardcodedStringOrResolvedConst = (node: TSESTree.Node): boolean => {
-      if (isHardcodedString(node)) return true;
-      const init = resolveConstLiteralValue(node);
-      return init ? isHardcodedString(init) : false;
-    };
-
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        // Check both sign and verify operations
-        if (!isSignOperation(node) && !isVerifyOperation(node)) {
-          return;
-        }
-
-        // Secret/key is the second argument
-        if (node.arguments.length < 2) {
-          return;
-        }
-
-        const secretArg = node.arguments[1];
-
-        // Skip if safe source
-        if (isSafeKeySource(secretArg)) {
-          return;
-        }
-
-        // Flag hardcoded strings (also follows single-frame `const X = '...'`).
-        if (isHardcodedStringOrResolvedConst(secretArg)) {
-          context.report({
-            node: secretArg,
-            messageId: 'hardcodedSecret',
-          });
-        }
-      },
-    };
-  },
-});
-
-export default noHardcodedSecret;