eslint-plugin-jwt-security 2.3.0 → 2.3.2

package/dist/src/rules/no-algorithm-none/index.js

@@ -1,222 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noAlgorithmNone = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.noAlgorithmNone = (0, eslint_devkit_1.createRule)({
-    name: 'no-algorithm-none',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-none.md',
-            description: 'Disallow JWT "none" algorithm which bypasses signature verification (CVE-2022-23540)',
-            cwe: 'CWE-347',
-            cvss: 9.5,
-            confidence: 'high',
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            algorithmNone: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'JWT Algorithm None Attack',
-                cwe: 'CWE-347',
-                description: 'Using alg:"none" bypasses signature verification, allowing token forgery',
-                severity: 'CRITICAL',
-                fix: 'Remove "none" and use RS256, ES256, or other secure algorithms',
-                documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23540',
-            }),
-            algorithmNoneInArray: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'JWT Algorithm None in Whitelist',
-                cwe: 'CWE-347',
-                description: 'Including "none" in algorithms array allows unsigned tokens',
-                severity: 'CRITICAL',
-                fix: 'Remove "none" from the algorithms array',
-                documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23540',
-            }),
-            emptyAlgorithms: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Empty Algorithms Array',
-                cwe: 'CWE-347',
-                description: 'Empty algorithms array may default to accepting any algorithm including none',
-                severity: 'HIGH',
-                fix: 'Specify explicit algorithms: ["RS256"] or ["ES256"]',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-            useSecureAlgorithm: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Secure Algorithm',
-                description: 'Replace with a secure algorithm',
-                severity: 'LOW',
-                fix: 'Use algorithms: ["RS256"] or algorithms: ["ES256"]',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-            decodeWithoutVerify: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'JWT Decode Without Verify',
-                cwe: 'CWE-347',
-                description: 'jwt.decode() does NOT verify the signature — using its result as if it were authenticated is functionally equivalent to algorithm:"none". Any token, including forged ones, will decode.',
-                severity: 'CRITICAL',
-                fix: 'Use jwt.verify(token, secret, { algorithms: ["RS256"] }) instead. Reserve jwt.decode() for non-security inspection only (e.g. logging the issuer).',
-                documentationLink: 'https://github.com/auth0/node-jsonwebtoken#jwtdecodetoken--options',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow "none" algorithm in test files',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] ?? {};
-        const { allowInTests = false } = options;
-        const filename = context.filename;
-        // Skip test files if configured
-        if (allowInTests && (0, utils_1.isTestFile)(filename)) {
-            return {};
-        }
-        /**
-         * Check if an algorithm value is 'none' (case insensitive)
-         */
-        // oxlint-disable-next-line consistent-function-scoping
-        const isNoneAlgorithm = (value) => {
-            return value.toLowerCase() === 'none';
-        };
-        /**
-         * Check options object for 'none' algorithm
-         */
-        const checkOptionsForNone = (optionsNode) => {
-            for (const prop of optionsNode.properties) {
-                if (prop.type !== 'Property' || prop.key.type !== 'Identifier') {
-                    continue;
-                }
-                const keyName = prop.key.name;
-                if (keyName !== 'algorithms' &&
-                    keyName !== 'algorithm' &&
-                    keyName !== 'alg') {
-                    continue;
-                }
-                // Single algorithm: { algorithm: 'none' }
-                if (prop.value.type === 'Literal' &&
-                    typeof prop.value.value === 'string') {
-                    if (isNoneAlgorithm(prop.value.value)) {
-                        context.report({
-                            node: prop.value,
-                            messageId: 'algorithmNone',
-                        });
-                    }
-                }
-                // Array of algorithms: { algorithms: ['none'] } or { algorithms: [] }
-                if (prop.value.type === 'ArrayExpression') {
-                    // Check for empty array
-                    if (prop.value.elements.length === 0) {
-                        context.report({
-                            node: prop.value,
-                            messageId: 'emptyAlgorithms',
-                        });
-                        continue;
-                    }
-                    // Check each element for 'none'
-                    for (const elem of prop.value.elements) {
-                        if (elem &&
-                            elem.type === 'Literal' &&
-                            typeof elem.value === 'string' &&
-                            isNoneAlgorithm(elem.value)) {
-                            context.report({
-                                node: elem,
-                                messageId: 'algorithmNoneInArray',
-                            });
-                        }
-                    }
-                }
-            }
-        };
-        /**
-         * Detect `jwt.decode()` calls — closes the audit FN where
-         * `jwt.decode(token)` followed by trusting the decoded payload was
-         * silent, despite being functionally equivalent to algorithm:"none".
-         * See benchmarks/AUDIT_PATTERNS.md §3.8 ("verify-then-trust mismatch").
-         *
-         * The check is conservative: we flag every `jwt.decode()` call. In
-         * the rare case where `decode` is used legitimately (e.g. logging
-         * the issuer of an inbound token without authentication semantics),
-         * the user can disable the rule on that line. The default-on
-         * behaviour is correct — most production uses of `jwt.decode` are
-         * authentication mistakes.
-         */
-        // oxlint-disable-next-line consistent-function-scoping
-        function isDecodeCall(node) {
-            const callee = node.callee;
-            if (callee.type !== 'MemberExpression')
-                return false;
-            if (callee.property.type !== 'Identifier')
-                return false;
-            if (callee.property.name !== 'decode')
-                return false;
-            // Object should be `jwt` (or imported as such). Check both
-            // `jwt.decode` and `JWT.decode` patterns.
-            if (callee.object.type === 'Identifier') {
-                const name = callee.object.name.toLowerCase();
-                return name === 'jwt' || name === 'jsonwebtoken';
-            }
-            return false;
-        }
-        return {
-            CallExpression(node) {
-                // Detect `jwt.decode(...)` — equivalent to algorithm:"none" if
-                // its result is trusted. We always flag (with critical severity)
-                // because the FN risk far outweighs the FP risk on real code.
-                if (isDecodeCall(node)) {
-                    context.report({ node, messageId: 'decodeWithoutVerify' });
-                    return;
-                }
-                // Check both verify and sign operations
-                if (!(0, utils_1.isVerifyOperation)(node) && !(0, utils_1.isSignOperation)(node)) {
-                    return;
-                }
-                // Get options argument (usually 3rd argument)
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                if (optionsArg) {
-                    checkOptionsForNone(optionsArg);
-                }
-            },
-        };
-    },
-});
-exports.default = exports.noAlgorithmNone;

package/dist/src/rules/no-decode-without-verify/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-decode-without-verify
- *
- * Detects usage of jwt.decode() or jwt-decode library without corresponding
- * verification. Decoded JWTs can be tampered with by attackers.
- *
- * CWE-345: Insufficient Verification of Data Authenticity
- *
- * @see https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/10-Testing_JSON_Web_Tokens
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoDecodeWithoutVerifyOptions } from '../../types';
-type MessageIds = 'decodeWithoutVerify' | 'jwtDecodeLibrary' | 'useVerifyInstead';
-type RuleOptions = [NoDecodeWithoutVerifyOptions?];
-export declare const noDecodeWithoutVerify: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noDecodeWithoutVerify;

package/dist/src/rules/no-decode-without-verify/index.js

@@ -1,131 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noDecodeWithoutVerify = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.noDecodeWithoutVerify = (0, eslint_devkit_1.createRule)({
-    name: 'no-decode-without-verify',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-decode-without-verify.md',
-            description: 'Disallow trusting decoded JWT payload without signature verification',
-            cwe: 'CWE-345',
-            cvss: 7.5,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            decodeWithoutVerify: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Decoded JWT Without Verification',
-                cwe: 'CWE-345',
-                description: 'jwt.decode() returns payload without verifying signature - data can be forged',
-                severity: 'HIGH',
-                fix: 'Use jwt.verify(token, secret) instead of jwt.decode(token)',
-                documentationLink: 'https://owasp.org/API-Security/0xa7-security-misconfiguration/',
-            }),
-            jwtDecodeLibrary: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'jwt-decode Library Usage',
-                cwe: 'CWE-345',
-                description: 'jwt-decode library only decodes tokens, never verifies signatures',
-                severity: 'HIGH',
-                fix: 'Use jsonwebtoken.verify() or jose.jwtVerify() for verification',
-                documentationLink: 'https://www.npmjs.com/package/jwt-decode',
-            }),
-            useVerifyInstead: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Verify Instead',
-                description: 'Replace decode with verify to ensure authenticity',
-                severity: 'LOW',
-                fix: 'jwt.verify(token, secret, { algorithms: ["RS256"] })',
-                documentationLink: 'https://www.npmjs.com/package/jsonwebtoken',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowHeaderInspection: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow decode() for reading header before verification',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['@decoded-header-only', '@verified-separately'],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowHeaderInspection: false,
-            trustedSanitizers: [],
-            trustedAnnotations: ['@decoded-header-only', '@verified-separately'],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] ?? {};
-        const { trustedAnnotations = [] } = options;
-        /**
-         * Check if this is a jwt-decode import usage
-         */
-        // oxlint-disable-next-line consistent-function-scoping
-        const isJwtDecodeLibrary = (node) => {
-            // Direct call: jwtDecode(token)
-            if (node.callee.type === 'Identifier' &&
-                (node.callee.name === 'jwtDecode' || node.callee.name === 'jwt_decode')) {
-                return true;
-            }
-            return false;
-        };
-        return {
-            CallExpression(node) {
-                // Check for jwt.decode() pattern
-                if ((0, utils_1.isDecodeOperation)(node)) {
-                    // Check for safe annotations
-                    if ((0, eslint_devkit_1.hasSafeAnnotation)(node, context, trustedAnnotations)) {
-                        return;
-                    }
-                    context.report({
-                        node,
-                        messageId: 'decodeWithoutVerify',
-                    });
-                    return;
-                }
-                // Check for jwt-decode library usage
-                if (isJwtDecodeLibrary(node)) {
-                    // Check for safe annotations
-                    if ((0, eslint_devkit_1.hasSafeAnnotation)(node, context, trustedAnnotations)) {
-                        return;
-                    }
-                    context.report({
-                        node,
-                        messageId: 'jwtDecodeLibrary',
-                    });
-                }
-            },
-        };
-    },
-});
-exports.default = exports.noDecodeWithoutVerify;

package/dist/src/rules/no-hardcoded-secret/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-hardcoded-secret
- *
- * Detects hardcoded secrets in JWT sign/verify operations.
- * Hardcoded secrets in source code are a critical security vulnerability.
- *
- * CWE-798: Use of Hard-coded Credentials
- *
- * @see https://cwe.mitre.org/data/definitions/798.html
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoHardcodedSecretOptions } from '../../types';
-type MessageIds = 'hardcodedSecret' | 'useEnvVariable';
-type RuleOptions = [NoHardcodedSecretOptions?];
-export declare const noHardcodedSecret: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noHardcodedSecret;

package/dist/src/rules/no-hardcoded-secret/index.js

@@ -1,189 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noHardcodedSecret = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.noHardcodedSecret = (0, eslint_devkit_1.createRule)({
-    name: 'no-hardcoded-secret',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-hardcoded-secret.md',
-            description: 'Disallow hardcoded secrets in JWT sign/verify operations',
-            cwe: 'CWE-798',
-            cvss: 9.8,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            hardcodedSecret: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Hardcoded JWT Secret',
-                cwe: 'CWE-798',
-                description: 'Secret key hardcoded in source code can be extracted from repositories',
-                severity: 'HIGH',
-                fix: 'Use process.env.JWT_SECRET or secure secret management',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/798.html',
-            }),
-            useEnvVariable: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Environment Variable',
-                description: 'Replace hardcoded secret with environment variable',
-                severity: 'LOW',
-                fix: 'process.env.JWT_SECRET',
-                documentationLink: 'https://12factor.net/config',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    envPatterns: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Patterns that indicate safe environment variable usage',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            envPatterns: [],
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        /**
-         * Check if a node is a hardcoded string literal
-         */
-        // oxlint-disable-next-line consistent-function-scoping
-        const isHardcodedString = (node) => {
-            // String literal
-            if (node.type === 'Literal' && typeof node.value === 'string') {
-                return true;
-            }
-            // Template literal without expressions
-            if (node.type === 'TemplateLiteral' &&
-                node.expressions.length === 0) {
-                return true;
-            }
-            return false;
-        };
-        /**
-         * Resolve an Identifier node to its initializer (one frame of indirection).
-         * Closes the audit FN where `const SECRET = 'x'; jwt.sign(p, SECRET)`
-         * was treated as safe — the literal-via-const pattern hides the
-         * hardcoded secret behind one declaration. See benchmarks/AUDIT_PATTERNS.md
-         * §3.2 ("Indirection through one level of variable").
-         */
-        const resolveConstLiteralValue = (node) => {
-            if (node.type !== 'Identifier')
-                return null;
-            const scope = context.sourceCode.getScope?.(node) ?? null;
-            if (!scope)
-                return null;
-            const variable = scope.references.find((r) => r.identifier === node)?.resolved;
-            const def = variable?.defs[0];
-            if (!def || def.type !== 'Variable')
-                return null;
-            const decl = def.parent;
-            if (decl?.type !== 'VariableDeclaration' || decl.kind !== 'const')
-                return null;
-            return def.node.init ?? null;
-        };
-        /**
-         * Check if node is a safe key source
-         */
-        const isSafeKeySource = (node) => {
-            // Environment variable
-            if ((0, utils_1.isEnvVariable)(node)) {
-                return true;
-            }
-            // Function call (getSecret(), loadKey(), etc.)
-            if (node.type === 'CallExpression') {
-                return true;
-            }
-            // await expression (async key loading)
-            if (node.type === 'AwaitExpression') {
-                return true;
-            }
-            // Variable reference: resolve `const X = ...` one level. If X is a
-            // hardcoded literal, treat as unsafe — fall through to the
-            // hardcoded check. Otherwise (env var, call, identifier chain)
-            // it's safe.
-            if (node.type === 'Identifier') {
-                const init = resolveConstLiteralValue(node);
-                if (init && isHardcodedString(init)) {
-                    // Unsafe — let the caller's `isHardcodedString` (with the
-                    // resolved init) flag it.
-                    return false;
-                }
-                return true;
-            }
-            // Member expression but not literal (config.secret, etc.)
-            if (node.type === 'MemberExpression' && !isHardcodedString(node)) {
-                return true;
-            }
-            return false;
-        };
-        /**
-         * Like isHardcodedString but resolves single-level `const X = '...'`
-         * indirection so the caller fires on `const SECRET = 'x'; jwt.sign(p, SECRET)`.
-         */
-        const isHardcodedStringOrResolvedConst = (node) => {
-            if (isHardcodedString(node))
-                return true;
-            const init = resolveConstLiteralValue(node);
-            return init ? isHardcodedString(init) : false;
-        };
-        return {
-            CallExpression(node) {
-                // Check both sign and verify operations
-                if (!(0, utils_1.isSignOperation)(node) && !(0, utils_1.isVerifyOperation)(node)) {
-                    return;
-                }
-                // Secret/key is the second argument
-                if (node.arguments.length < 2) {
-                    return;
-                }
-                const secretArg = node.arguments[1];
-                // Skip if safe source
-                if (isSafeKeySource(secretArg)) {
-                    return;
-                }
-                // Flag hardcoded strings (also follows single-frame `const X = '...'`).
-                if (isHardcodedStringOrResolvedConst(secretArg)) {
-                    context.report({
-                        node: secretArg,
-                        messageId: 'hardcodedSecret',
-                    });
-                }
-            },
-        };
-    },
-});
-exports.default = exports.noHardcodedSecret;

package/dist/src/rules/no-sensitive-payload/index.d.ts

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-sensitive-payload
- *
- * Detects storage of sensitive data in JWT payload.
- * JWT payloads are only base64-encoded, not encrypted.
- *
- * CWE-359: Exposure of Private Personal Information
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoSensitivePayloadOptions } from '../../types';
-type RuleOptions = [NoSensitivePayloadOptions?];
-export declare const noSensitivePayload: TSESLint.RuleModule<"sensitivePayloadField", RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noSensitivePayload;