eslint-plugin-jwt-security 2.3.0 → 2.3.2

package/dist/src/index.d.ts

@@ -1,101 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * eslint-plugin-jwt-security
- *
- * Comprehensive JWT security ESLint plugin for Node.js applications.
- * Detects vulnerabilities across jsonwebtoken, jose, express-jwt,
- * @nestjs/jwt, jwks-rsa, and jwt-decode libraries.
- *
- * Features:
- * - Algorithm confusion attack detection (CVE-2022-23540)
- * - "Back to the Future" replay attack prevention (LightSEC 2025)
- * - Signature verification enforcement
- * - Weak secret detection
- * - Expiration and claim validation
- * - AI-assisted fix guidance with CWE references
- *
- * @see https://tools.ietf.org/html/rfc8725
- * @see https://securitypattern.com/post/jwt-back-to-the-future
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import { noAlgorithmNone } from './rules/no-algorithm-none';
-import { noAlgorithmConfusion } from './rules/no-algorithm-confusion';
-import { requireAlgorithmWhitelist } from './rules/require-algorithm-whitelist';
-import { noDecodeWithoutVerify } from './rules/no-decode-without-verify';
-import { noWeakSecret } from './rules/no-weak-secret';
-import { requireExpiration } from './rules/require-expiration';
-import { noHardcodedSecret } from './rules/no-hardcoded-secret';
-import { requireIssuedAt } from './rules/require-issued-at';
-import { requireIssuerValidation } from './rules/require-issuer-validation';
-import { requireAudienceValidation } from './rules/require-audience-validation';
-import { noTimestampManipulation } from './rules/no-timestamp-manipulation';
-import { requireMaxAge } from './rules/require-max-age';
-import { noSensitivePayload } from './rules/no-sensitive-payload';
-/**
- * Collection of all JWT security ESLint rules (13 rules)
- */
-export declare const rules: Record<string, TSESLint.RuleModule<string, readonly unknown[]>>;
-/**
- * ESLint Plugin object
- */
-export declare const plugin: TSESLint.FlatConfig.Plugin;
-/**
- * Configuration presets for flat config
- */
-export declare const configs: {
-    /**
-     * Flagship preset — the rule from this plugin in the ecosystem-wide
-     * flagship list (`.agent/flagship-rules.md`). Use this when you want
-     * the highest-signal JWT subset shippable in CI gates.
-     */
-    flagship: {
-        plugins: {
-            jwt: TSESLint.FlatConfig.Plugin;
-        };
-        rules: {
-            'jwt/no-algorithm-none': "error";
-        };
-    };
-    /**
-     * Recommended preset - balanced security
-     */
-    recommended: {
-        plugins: {
-            jwt: TSESLint.FlatConfig.Plugin;
-        };
-        rules: Record<string, TSESLint.SharedConfig.RuleEntry>;
-    };
-    /**
-     * Strict preset - maximum security (includes 2025 research)
-     */
-    strict: {
-        plugins: {
-            jwt: TSESLint.FlatConfig.Plugin;
-        };
-        rules: Record<string, TSESLint.SharedConfig.RuleEntry>;
-    };
-    /**
-     * Legacy preset - migration mode
-     */
-    legacy: {
-        plugins: {
-            jwt: TSESLint.FlatConfig.Plugin;
-        };
-        rules: Record<string, TSESLint.SharedConfig.RuleEntry>;
-    };
-    /**
-     * All rules preset
-     */
-    all: {
-        plugins: {
-            jwt: TSESLint.FlatConfig.Plugin;
-        };
-        rules: Record<string, TSESLint.SharedConfig.RuleEntry>;
-    };
-};
-export default plugin;
-export { noAlgorithmNone, noAlgorithmConfusion, requireAlgorithmWhitelist, noDecodeWithoutVerify, noWeakSecret, requireExpiration, noHardcodedSecret, requireIssuedAt, requireIssuerValidation, requireAudienceValidation, noTimestampManipulation, requireMaxAge, noSensitivePayload, };

package/dist/src/index.js

@@ -1,171 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noSensitivePayload = exports.requireMaxAge = exports.noTimestampManipulation = exports.requireAudienceValidation = exports.requireIssuerValidation = exports.requireIssuedAt = exports.noHardcodedSecret = exports.requireExpiration = exports.noWeakSecret = exports.noDecodeWithoutVerify = exports.requireAlgorithmWhitelist = exports.noAlgorithmConfusion = exports.noAlgorithmNone = exports.configs = exports.plugin = exports.rules = void 0;
-// Import rules - Core Security
-const no_algorithm_none_1 = require("./rules/no-algorithm-none");
-Object.defineProperty(exports, "noAlgorithmNone", { enumerable: true, get: function () { return no_algorithm_none_1.noAlgorithmNone; } });
-const no_algorithm_confusion_1 = require("./rules/no-algorithm-confusion");
-Object.defineProperty(exports, "noAlgorithmConfusion", { enumerable: true, get: function () { return no_algorithm_confusion_1.noAlgorithmConfusion; } });
-const require_algorithm_whitelist_1 = require("./rules/require-algorithm-whitelist");
-Object.defineProperty(exports, "requireAlgorithmWhitelist", { enumerable: true, get: function () { return require_algorithm_whitelist_1.requireAlgorithmWhitelist; } });
-const no_decode_without_verify_1 = require("./rules/no-decode-without-verify");
-Object.defineProperty(exports, "noDecodeWithoutVerify", { enumerable: true, get: function () { return no_decode_without_verify_1.noDecodeWithoutVerify; } });
-const no_weak_secret_1 = require("./rules/no-weak-secret");
-Object.defineProperty(exports, "noWeakSecret", { enumerable: true, get: function () { return no_weak_secret_1.noWeakSecret; } });
-const require_expiration_1 = require("./rules/require-expiration");
-Object.defineProperty(exports, "requireExpiration", { enumerable: true, get: function () { return require_expiration_1.requireExpiration; } });
-const no_hardcoded_secret_1 = require("./rules/no-hardcoded-secret");
-Object.defineProperty(exports, "noHardcodedSecret", { enumerable: true, get: function () { return no_hardcoded_secret_1.noHardcodedSecret; } });
-// Import rules - 2025 Vulnerability Research
-const require_issued_at_1 = require("./rules/require-issued-at");
-Object.defineProperty(exports, "requireIssuedAt", { enumerable: true, get: function () { return require_issued_at_1.requireIssuedAt; } });
-const require_issuer_validation_1 = require("./rules/require-issuer-validation");
-Object.defineProperty(exports, "requireIssuerValidation", { enumerable: true, get: function () { return require_issuer_validation_1.requireIssuerValidation; } });
-const require_audience_validation_1 = require("./rules/require-audience-validation");
-Object.defineProperty(exports, "requireAudienceValidation", { enumerable: true, get: function () { return require_audience_validation_1.requireAudienceValidation; } });
-const no_timestamp_manipulation_1 = require("./rules/no-timestamp-manipulation");
-Object.defineProperty(exports, "noTimestampManipulation", { enumerable: true, get: function () { return no_timestamp_manipulation_1.noTimestampManipulation; } });
-const require_max_age_1 = require("./rules/require-max-age");
-Object.defineProperty(exports, "requireMaxAge", { enumerable: true, get: function () { return require_max_age_1.requireMaxAge; } });
-const no_sensitive_payload_1 = require("./rules/no-sensitive-payload");
-Object.defineProperty(exports, "noSensitivePayload", { enumerable: true, get: function () { return no_sensitive_payload_1.noSensitivePayload; } });
-/**
- * Collection of all JWT security ESLint rules (13 rules)
- */
-exports.rules = {
-    // Core Security Rules
-    'no-algorithm-none': no_algorithm_none_1.noAlgorithmNone,
-    'no-algorithm-confusion': no_algorithm_confusion_1.noAlgorithmConfusion,
-    'require-algorithm-whitelist': require_algorithm_whitelist_1.requireAlgorithmWhitelist,
-    'no-decode-without-verify': no_decode_without_verify_1.noDecodeWithoutVerify,
-    'no-weak-secret': no_weak_secret_1.noWeakSecret,
-    'require-expiration': require_expiration_1.requireExpiration,
-    'no-hardcoded-secret': no_hardcoded_secret_1.noHardcodedSecret,
-    // 2025 Vulnerability Research - "Back to the Future" & Replay Prevention
-    'require-issued-at': require_issued_at_1.requireIssuedAt,
-    'require-issuer-validation': require_issuer_validation_1.requireIssuerValidation,
-    'require-audience-validation': require_audience_validation_1.requireAudienceValidation,
-    'no-timestamp-manipulation': no_timestamp_manipulation_1.noTimestampManipulation,
-    'require-max-age': require_max_age_1.requireMaxAge,
-    'no-sensitive-payload': no_sensitive_payload_1.noSensitivePayload,
-};
-/**
- * ESLint Plugin object
- */
-exports.plugin = {
-    meta: {
-        name: 'eslint-plugin-jwt-security',
-        version: '2.2.9',
-    },
-    rules: exports.rules,
-};
-/**
- * Recommended configuration - baseline security
- * Critical rules as errors, high as warnings
- */
-const recommendedRules = {
-    // CRITICAL - Algorithm attacks
-    'jwt/no-algorithm-none': 'error',
-    'jwt/no-algorithm-confusion': 'error',
-    // HIGH - Verification and secrets
-    'jwt/require-algorithm-whitelist': 'error',
-    'jwt/no-decode-without-verify': 'error',
-    'jwt/no-weak-secret': 'error',
-    'jwt/no-hardcoded-secret': 'error',
-    'jwt/no-timestamp-manipulation': 'error', // LightSEC 2025
-    // MEDIUM - Best practices
-    'jwt/require-expiration': 'error',
-    'jwt/no-sensitive-payload': 'warn',
-};
-/**
- * Strict configuration - maximum security (2025 research)
- * All rules as errors - includes replay attack prevention
- */
-const strictRules = {
-    // All core rules as errors
-    'jwt/no-algorithm-none': 'error',
-    'jwt/no-algorithm-confusion': 'error',
-    'jwt/require-algorithm-whitelist': 'error',
-    'jwt/no-decode-without-verify': 'error',
-    'jwt/no-weak-secret': 'error',
-    'jwt/no-hardcoded-secret': 'error',
-    'jwt/require-expiration': 'error',
-    // 2025 Research - Full replay attack prevention
-    'jwt/require-issued-at': 'error',
-    'jwt/require-issuer-validation': 'error',
-    'jwt/require-audience-validation': 'error',
-    'jwt/no-timestamp-manipulation': 'error',
-    'jwt/require-max-age': 'error',
-    'jwt/no-sensitive-payload': 'error',
-};
-/**
- * Legacy configuration - migration mode
- * Only critical rules enabled
- */
-const legacyRules = {
-    // Only most critical rules
-    'jwt/no-algorithm-none': 'error',
-    'jwt/no-algorithm-confusion': 'error',
-    'jwt/no-hardcoded-secret': 'warn',
-};
-/**
- * Configuration presets for flat config
- */
-exports.configs = {
-    /**
-     * Flagship preset — the rule from this plugin in the ecosystem-wide
-     * flagship list (`.agent/flagship-rules.md`). Use this when you want
-     * the highest-signal JWT subset shippable in CI gates.
-     */
-    flagship: {
-        plugins: {
-            jwt: exports.plugin,
-        },
-        rules: {
-            'jwt/no-algorithm-none': 'error',
-        },
-    },
-    /**
-     * Recommended preset - balanced security
-     */
-    recommended: {
-        plugins: {
-            jwt: exports.plugin,
-        },
-        rules: recommendedRules,
-    },
-    /**
-     * Strict preset - maximum security (includes 2025 research)
-     */
-    strict: {
-        plugins: {
-            jwt: exports.plugin,
-        },
-        rules: strictRules,
-    },
-    /**
-     * Legacy preset - migration mode
-     */
-    legacy: {
-        plugins: {
-            jwt: exports.plugin,
-        },
-        rules: legacyRules,
-    },
-    /**
-     * All rules preset
-     */
-    all: {
-        plugins: {
-            jwt: exports.plugin,
-        },
-        rules: strictRules,
-    },
-};
-// Default export for flat config usage
-exports.default = exports.plugin;

package/dist/src/oxlint.d.ts

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * oxlint sub-export.
- *
- * Consumers wire oxlint to this entry via:
- *   { "jsPlugins": ["eslint-plugin-jwt-security/oxlint"] }
- *
- * oxlint's JS plugin loader does `require('eslint-plugin-jwt-security/oxlint')` and reads
- * `.rules` off the result. The compiled output of `export = plugin` is
- * `module.exports = plugin`, which gives oxlint the plugin object directly
- * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
- *
- * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
- */
-import { plugin } from './index';
-export = plugin;

package/dist/src/oxlint.js

@@ -1,21 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * oxlint sub-export.
- *
- * Consumers wire oxlint to this entry via:
- *   { "jsPlugins": ["eslint-plugin-jwt-security/oxlint"] }
- *
- * oxlint's JS plugin loader does `require('eslint-plugin-jwt-security/oxlint')` and reads
- * `.rules` off the result. The compiled output of `export = plugin` is
- * `module.exports = plugin`, which gives oxlint the plugin object directly
- * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
- *
- * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
- */
-const index_1 = require("./index");
-module.exports = index_1.plugin;

package/dist/src/rules/no-algorithm-confusion/index.d.ts

@@ -1,24 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-algorithm-confusion
- *
- * Detects algorithm confusion attacks where symmetric algorithms (HS256/384/512)
- * are used with asymmetric keys (public keys). This allows attackers to sign
- * tokens using the public key as an HMAC secret.
- *
- * CWE-347: Improper Verification of Cryptographic Signature
- *
- * @see https://portswigger.net/web-security/jwt/algorithm-confusion
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoAlgorithmConfusionOptions } from '../../types';
-type MessageIds = 'algorithmConfusion' | 'symmetricWithPublicKey' | 'useAsymmetricAlgorithm';
-type RuleOptions = [NoAlgorithmConfusionOptions?];
-export declare const noAlgorithmConfusion: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noAlgorithmConfusion;

package/dist/src/rules/no-algorithm-confusion/index.js

@@ -1,165 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noAlgorithmConfusion = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-// Patterns that indicate a public key
-const PUBLIC_KEY_PATTERNS = [
-    /public/i,
-    /\.pub$/,
-    /\.pem$/,
-    /-----BEGIN PUBLIC KEY-----/,
-    /-----BEGIN RSA PUBLIC KEY-----/,
-    /-----BEGIN EC PUBLIC KEY-----/,
-    /getPublicKey/i,
-    /publicKey/i,
-    /jwks/i,
-];
-exports.noAlgorithmConfusion = (0, eslint_devkit_1.createRule)({
-    name: 'no-algorithm-confusion',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-confusion.md',
-            description: 'Prevent algorithm confusion attacks using symmetric algorithms with asymmetric keys',
-            cwe: 'CWE-347',
-            cvss: 9.5,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            algorithmConfusion: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'JWT Algorithm Confusion Attack',
-                cwe: 'CWE-347',
-                description: 'Symmetric algorithm (HS*) used with public key allows token forgery',
-                severity: 'CRITICAL',
-                fix: 'Use asymmetric algorithms (RS256, ES256) with public keys',
-                documentationLink: 'https://portswigger.net/web-security/jwt/algorithm-confusion',
-            }),
-            symmetricWithPublicKey: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Symmetric Algorithm with Public Key',
-                cwe: 'CWE-347',
-                description: 'HS256/384/512 should only be used with shared secrets, not public keys',
-                severity: 'CRITICAL',
-                fix: 'Switch to RS256 or ES256 for asymmetric key verification',
-                documentationLink: 'https://portswigger.net/web-security/jwt/algorithm-confusion',
-            }),
-            useAsymmetricAlgorithm: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Asymmetric Algorithm',
-                description: 'Replace HS* with RS* or ES* algorithm',
-                severity: 'LOW',
-                fix: 'Use RS256 or ES256 with public key verification',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    symmetricAlgorithms: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['HS256', 'HS384', 'HS512'],
-                        description: 'Algorithms to flag when used with public keys',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            symmetricAlgorithms: ['HS256', 'HS384', 'HS512'],
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] ?? {};
-        const symmetricAlgSet = new Set(options.symmetricAlgorithms ?? ['HS256', 'HS384', 'HS512']);
-        const sourceCode = context.sourceCode;
-        /**
-         * Check if a node looks like a public key reference
-         */
-        const looksLikePublicKey = (node) => {
-            const text = sourceCode.getText(node);
-            return PUBLIC_KEY_PATTERNS.some((pattern) => pattern.test(text));
-        };
-        /**
-         * Check if algorithms include symmetric algorithms
-         */
-        const hasSymmetricAlgorithm = (algorithms) => {
-            for (const alg of algorithms) {
-                if (symmetricAlgSet.has(alg)) {
-                    return alg;
-                }
-            }
-            return null;
-        };
-        return {
-            CallExpression(node) {
-                // Only check verify operations
-                if (!(0, utils_1.isVerifyOperation)(node)) {
-                    return;
-                }
-                // Need at least 2 arguments: token, key
-                if (node.arguments.length < 2) {
-                    return;
-                }
-                const keyArg = node.arguments[1];
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // Check if key looks like a public key
-                if (!looksLikePublicKey(keyArg)) {
-                    return;
-                }
-                // If there are options, check the algorithms
-                if (optionsArg) {
-                    const algorithms = (0, utils_1.extractAlgorithms)(optionsArg);
-                    const symmetricAlg = hasSymmetricAlgorithm(algorithms);
-                    if (symmetricAlg) {
-                        // Find the algorithm node for precise error location
-                        for (const prop of optionsArg.properties) {
-                            if (prop.type === 'Property' &&
-                                prop.key.type === 'Identifier' &&
-                                ['algorithms', 'algorithm', 'alg'].includes(prop.key.name)) {
-                                context.report({
-                                    node: prop.value,
-                                    messageId: 'algorithmConfusion',
-                                    data: { algorithm: symmetricAlg },
-                                });
-                                return;
-                            }
-                        }
-                    }
-                }
-                // If no options specified but key looks like public key,
-                // and we're in verify, flag as potential issue
-                // (verification without explicit algorithm with public key is risky)
-            },
-        };
-    },
-});
-exports.default = exports.noAlgorithmConfusion;

package/dist/src/rules/no-algorithm-none/index.d.ts

@@ -1,24 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-algorithm-none
- *
- * Detects attempts to use the 'none' algorithm which bypasses JWT signature verification.
- * This is a critical vulnerability (CVE-2022-23540) that allows attackers to forge JWT tokens.
- *
- * CWE-347: Improper Verification of Cryptographic Signature
- *
- * @see https://nvd.nist.gov/vuln/detail/CVE-2022-23540
- * @see https://tools.ietf.org/html/rfc8725
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoAlgorithmNoneOptions } from '../../types';
-type MessageIds = 'algorithmNone' | 'algorithmNoneInArray' | 'emptyAlgorithms' | 'useSecureAlgorithm' | 'decodeWithoutVerify';
-type RuleOptions = [NoAlgorithmNoneOptions?];
-export declare const noAlgorithmNone: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noAlgorithmNone;