eslint-plugin-jwt-security 2.3.0 → 2.3.2

package/src/rules/no-hardcoded-secret/no-hardcoded-secret.test.ts

@@ -1,97 +0,0 @@
-/**
- * Tests for no-hardcoded-secret rule
- * Security: CWE-798 (Hardcoded Credentials)
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noHardcodedSecret } from './index';
-
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('no-hardcoded-secret', () => {
-  describe('Valid Code - Safe Key Sources', () => {
-    ruleTester.run('valid - environment and config', noHardcodedSecret, {
-      valid: [
-        // Environment variable
-        { code: `jwt.sign(payload, process.env.JWT_SECRET);` },
-        { code: `jwt.verify(token, process.env.JWT_SECRET);` },
-        // Variable reference
-        { code: `jwt.sign(payload, secret);` },
-        { code: `jwt.verify(token, privateKey);` },
-        // Function call
-        { code: `jwt.sign(payload, getSecretKey());` },
-        { code: `jwt.verify(token, await loadPublicKey());` },
-        // Config object
-        { code: `jwt.sign(payload, config.jwtSecret);` },
-        { code: `jwt.verify(token, settings.publicKey);` },
-        // Async key loading
-        { code: `jwt.verify(token, await importJWK(jwk));` },
-        // crypto operations
-        { code: `jwt.sign(payload, crypto.randomBytes(32));` },
-        // Only 1 argument - edge case (line 156 coverage)
-        { code: `jwt.sign(payload);` },
-        { code: `jwt.verify(token);` },
-        // MemberExpression that's not hardcoded
-        { code: `jwt.sign(payload, keys.current);` },
-        // signJWT with env var
-        { code: `signJWT(payload, process.env.SECRET);` },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code - Hardcoded Secrets', () => {
-    ruleTester.run('invalid - hardcoded strings', noHardcodedSecret, {
-      valid: [],
-      invalid: [
-        // String literal
-        {
-          code: `jwt.sign(payload, 'my-secret-key');`,
-          errors: [{ messageId: 'hardcodedSecret' }],
-        },
-        // Long string (still hardcoded)
-        {
-          code: `jwt.sign(payload, 'this-is-a-very-long-secret-but-still-hardcoded');`,
-          errors: [{ messageId: 'hardcodedSecret' }],
-        },
-        // Template literal without variables
-        {
-          code: 'jwt.sign(payload, `my-secret-key`);',
-          errors: [{ messageId: 'hardcodedSecret' }],
-        },
-        // Verify with hardcoded
-        {
-          code: `jwt.verify(token, 'hardcoded-public-key');`,
-          errors: [{ messageId: 'hardcodedSecret' }],
-        },
-        // PEM key inline
-        {
-          code: `jwt.verify(token, '-----BEGIN PUBLIC KEY-----\\\\nMIIBIj...');`,
-          errors: [{ messageId: 'hardcodedSecret' }],
-        },
-        // signJWT with hardcoded
-        {
-          code: `signJWT(payload, 'hardcoded');`,
-          errors: [{ messageId: 'hardcodedSecret' }],
-        },
-        // sign() direct call with hardcoded
-        {
-          code: `sign(payload, 'secret123');`,
-          errors: [{ messageId: 'hardcodedSecret' }],
-        },
-      ],
-    });
-  });
-});

package/src/rules/no-sensitive-payload/index.ts

@@ -1,123 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * ESLint Rule: no-sensitive-payload
- *
- * Detects storage of sensitive data in JWT payload.
- * JWT payloads are only base64-encoded, not encrypted.
- *
- * CWE-359: Exposure of Private Personal Information
- */
-import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import { isSignOperation, SENSITIVE_PAYLOAD_FIELDS } from '../../utils';
-import type { NoSensitivePayloadOptions } from '../../types';
-
-type MessageIds = 'sensitivePayloadField';
-
-type RuleOptions = [NoSensitivePayloadOptions?];
-
-export const noSensitivePayload = createRule<RuleOptions, MessageIds>({
-  name: 'no-sensitive-payload',
-  meta: {
-    type: 'problem',
-    docs: {
-      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-sensitive-payload.md',
-      description:
-        'Prevent storing sensitive data in JWT payload which is only base64-encoded',
-      cwe: 'CWE-359',
-      cvss: 5,
-    },
-    fixable: undefined,
-    hasSuggestions: false,
-    messages: {
-      sensitivePayloadField: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Sensitive Data in JWT Payload',
-        cwe: 'CWE-359',
-        description:
-          'JWT payloads are not encrypted - sensitive data like "{{fieldName}}" can be read by anyone',
-        severity: 'MEDIUM',
-        fix: 'Store sensitive data server-side, reference by ID in token',
-        documentationLink: 'https://tools.ietf.org/html/rfc8725',
-      }),
-    },
-    schema: [
-      {
-        type: 'object',
-        properties: {
-          additionalSensitiveFields: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-            description: 'Additional field names to flag as sensitive',
-          },
-          trustedSanitizers: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          trustedAnnotations: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          strictMode: {
-            type: 'boolean',
-            default: false,
-          },
-        },
-        additionalProperties: false,
-      },
-    ],
-  },
-  defaultOptions: [
-    {
-      additionalSensitiveFields: [],
-      trustedSanitizers: [],
-      trustedAnnotations: [],
-      strictMode: false,
-    },
-  ],
-  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
-    const options = context.options[0] ?? {};
-    const additionalFields = options.additionalSensitiveFields ?? [];
-    const allSensitiveFields = new Set([...SENSITIVE_PAYLOAD_FIELDS, ...additionalFields]);
-
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        if (!isSignOperation(node)) {
-          return;
-        }
-
-        if (node.arguments.length < 1) {
-          return;
-        }
-
-        const payloadArg = node.arguments[0];
-
-        // Check object literal payload
-        if (payloadArg.type === 'ObjectExpression') {
-          for (const prop of payloadArg.properties) {
-            if (prop.type === 'Property' && prop.key.type === 'Identifier') {
-              const fieldName = prop.key.name.toLowerCase();
-              if (allSensitiveFields.has(fieldName)) {
-                context.report({
-                  node: prop,
-                  messageId: 'sensitivePayloadField',
-                  data: { fieldName: prop.key.name },
-                });
-              }
-            }
-          }
-        }
-      },
-    };
-  },
-});
-
-export default noSensitivePayload;

package/src/rules/no-sensitive-payload/no-sensitive-payload.test.ts

@@ -1,157 +0,0 @@
-/**
- * Tests for no-sensitive-payload rule
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noSensitivePayload } from './index';
-
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('no-sensitive-payload', () => {
-  describe('Valid Code - Safe Payloads', () => {
-    ruleTester.run('valid - standard claims', noSensitivePayload, {
-      valid: [
-        // Standard JWT claims
-        { code: `jwt.sign({ sub: 'user123', role: 'admin' }, secret);` },
-        { code: `jwt.sign({ userId: '123', permissions: [] }, secret);` },
-        { code: `jwt.sign({ sub: 'user', iss: 'auth', aud: 'api', exp: 123 }, secret);` },
-        // Variable reference (cannot analyze)
-        { code: `jwt.sign(payload, secret);` },
-        // Verify operation (not checked)
-        { code: `jwt.verify(token, secret);` },
-        // No arguments
-        { code: `jwt.sign();` },
-        // Non-JWT sign function
-        { code: `sign(payload, secret);` },
-        // Similar but non-sensitive names
-        { code: `jwt.sign({ passwordResetToken: false }, secret);` },
-        { code: `jwt.sign({ emailVerified: true }, secret);` },
-        { code: `jwt.sign({ phoneVerified: true }, secret);` },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code - Password Fields', () => {
-    ruleTester.run('invalid - password variations', noSensitivePayload, {
-      valid: [],
-      invalid: [
-        { code: `jwt.sign({ password: 'secret123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ passwd: 'abc' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ pwd: '123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ pass: 'xyz' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-      ],
-    });
-  });
-
-  describe('Invalid Code - PII Fields', () => {
-    ruleTester.run('invalid - personal identifiable information', noSensitivePayload, {
-      valid: [],
-      invalid: [
-        // Email
-        { code: `jwt.sign({ email: 'user@example.com' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ emailAddress: 'user@test.com' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // Phone
-        { code: `jwt.sign({ phone: '555-1234' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ phoneNumber: '1234567890' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // SSN
-        { code: `jwt.sign({ ssn: '123-45-6789' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // Address
-        { code: `jwt.sign({ address: '123 Main St' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // DOB
-        { code: `jwt.sign({ dob: '1990-01-01' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ dateOfBirth: '1990-01-01' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Financial Fields', () => {
-    ruleTester.run('invalid - financial data', noSensitivePayload, {
-      valid: [],
-      invalid: [
-        // Credit card (camelCase)
-        { code: `jwt.sign({ creditCard: '4111111111111111' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // Credit card (snake_case)
-        { code: `jwt.sign({ credit_card: '4111111111111111' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // Card number
-        { code: `jwt.sign({ cardNumber: '1234' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // CVV
-        { code: `jwt.sign({ cvv: '123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ cvc: '456' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // PIN
-        { code: `jwt.sign({ pin: '1234' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // Bank account
-        { code: `jwt.sign({ bankAccount: '123456' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ accountNumber: '789' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ routingNumber: '111' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-      ],
-    });
-  });
-
-  describe('Invalid Code - API Keys and Secrets', () => {
-    ruleTester.run('invalid - secrets and keys', noSensitivePayload, {
-      valid: [],
-      invalid: [
-        // API key variations
-        { code: `jwt.sign({ apiKey: 'sk_live_123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ api_key: 'sk_live_123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // Secret
-        { code: `jwt.sign({ secret: 'abc123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // Token fields
-        { code: `jwt.sign({ accessToken: 'abc123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ refreshToken: 'xyz789' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ bearerToken: 'bearer123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        // Private key
-        { code: `jwt.sign({ privateKey: '-----BEGIN RSA' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-        { code: `jwt.sign({ secretKey: 'key123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Multiple Sensitive Fields', () => {
-    ruleTester.run('invalid - multiple violations', noSensitivePayload, {
-      valid: [],
-      invalid: [
-        // Two sensitive fields - should report both
-        {
-          code: `jwt.sign({ email: 'user@test.com', phone: '555-1234' }, secret);`,
-          errors: [
-            { messageId: 'sensitivePayloadField' },
-            { messageId: 'sensitivePayloadField' },
-          ],
-        },
-        // Mixed valid and invalid
-        {
-          code: `jwt.sign({ sub: 'user', password: 'secret' }, secret);`,
-          errors: [{ messageId: 'sensitivePayloadField' }],
-        },
-      ],
-    });
-  });
-
-  describe('Edge Cases - Custom Configuration', () => {
-    ruleTester.run('custom sensitive fields', noSensitivePayload, {
-      valid: [],
-      invalid: [
-        // Test additionalSensitiveFields option
-        {
-          code: `jwt.sign({ customSecret: 'value' }, secret);`,
-          options: [{ additionalSensitiveFields: ['customsecret'] }],
-          errors: [{ messageId: 'sensitivePayloadField' }],
-        },
-      ],
-    });
-  });
-});

package/src/rules/no-timestamp-manipulation/index.ts

@@ -1,118 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * ESLint Rule: no-timestamp-manipulation
- *
- * Detects patterns that disable automatic timestamp (iat) generation.
- * This enables the "Back to the Future" replay attack (LightSEC 2025).
- *
- * CWE-294: Authentication Bypass by Capture-replay
- *
- * @see https://securitypattern.com/post/jwt-back-to-the-future
- */
-import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import { isSignOperation, getOptionsArgument, hasOption, getOptionValue } from '../../utils';
-import type { JwtRuleOptions } from '../../types';
-
-type MessageIds = 'timestampDisabled' | 'noTimestampTrue';
-
-type RuleOptions = [JwtRuleOptions?];
-
-export const noTimestampManipulation = createRule<RuleOptions, MessageIds>({
-  name: 'no-timestamp-manipulation',
-  meta: {
-    type: 'problem',
-    docs: {
-      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-timestamp-manipulation.md',
-      description:
-        'Prevent disabling automatic timestamp generation which enables replay attacks',
-      cwe: 'CWE-294',
-      cvss: 7.5,
-    },
-    fixable: undefined,
-    hasSuggestions: false,
-    messages: {
-      timestampDisabled: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Timestamp Generation Disabled',
-        cwe: 'CWE-294',
-        description:
-          'noTimestamp:true disables iat claim, enabling replay attacks',
-        severity: 'HIGH',
-        fix: 'Remove noTimestamp option or set to false',
-        documentationLink: 'https://securitypattern.com/post/jwt-back-to-the-future',
-      }),
-      noTimestampTrue: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Back to the Future Attack Vector',
-        cwe: 'CWE-294',
-        description:
-          'Disabling timestamps allows attackers to forge tokens valid in the future',
-        severity: 'HIGH',
-        fix: 'Always include iat claim for freshness validation',
-        documentationLink: 'https://securitypattern.com/post/jwt-back-to-the-future',
-      }),
-    },
-    schema: [
-      {
-        type: 'object',
-        properties: {
-          trustedSanitizers: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          trustedAnnotations: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          strictMode: {
-            type: 'boolean',
-            default: false,
-          },
-        },
-        additionalProperties: false,
-      },
-    ],
-  },
-  defaultOptions: [
-    {
-      trustedSanitizers: [],
-      trustedAnnotations: [],
-      strictMode: false,
-    },
-  ],
-  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        if (!isSignOperation(node)) {
-          return;
-        }
-
-        const optionsArg = getOptionsArgument(node, 2);
-        if (!optionsArg) {
-          return;
-        }
-
-        // Check for noTimestamp: true
-        if (hasOption(optionsArg, 'noTimestamp')) {
-          const value = getOptionValue(optionsArg, 'noTimestamp');
-          if (value?.type === 'Literal' && value.value === true) {
-            context.report({
-              node: value,
-              messageId: 'noTimestampTrue',
-            });
-          }
-        }
-      },
-    };
-  },
-});
-
-export default noTimestampManipulation;

package/src/rules/no-timestamp-manipulation/no-timestamp-manipulation.test.ts

@@ -1,54 +0,0 @@
-/**
- * Tests for no-timestamp-manipulation rule
- * Security: LightSEC 2025 - "Back to the Future" Attack
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noTimestampManipulation } from './index';
-
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('no-timestamp-manipulation', () => {
-  describe('Valid Code', () => {
-    ruleTester.run('valid - default timestamps', noTimestampManipulation, {
-      valid: [
-        'const x = 42;',
-        'const flag = true;',
-        { code: `jwt.sign(payload, secret);` },
-        { code: `jwt.sign(payload, secret, {});` },
-        { code: `jwt.sign(payload, secret, { expiresIn: '1h' });` },
-        { code: `jwt.sign(payload, secret, { noTimestamp: false });` },
-        { code: `jwt.verify(token, secret);` }, // verify not checked
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code', () => {
-    ruleTester.run('invalid - noTimestamp true', noTimestampManipulation, {
-      valid: [],
-      invalid: [
-        {
-          code: `jwt.sign(payload, secret, { noTimestamp: true });`,
-          errors: [{ messageId: 'noTimestampTrue' }],
-        },
-        {
-          code: `jwt.sign(payload, secret, { algorithm: 'RS256', noTimestamp: true });`,
-          errors: [{ messageId: 'noTimestampTrue' }],
-        },
-      ],
-    });
-  });
-});