eslint-plugin-jwt-security 2.3.0 → 2.3.2

package/dist/src/rules/no-sensitive-payload/index.js

@@ -1,103 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noSensitivePayload = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.noSensitivePayload = (0, eslint_devkit_1.createRule)({
-    name: 'no-sensitive-payload',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-sensitive-payload.md',
-            description: 'Prevent storing sensitive data in JWT payload which is only base64-encoded',
-            cwe: 'CWE-359',
-            cvss: 5,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            sensitivePayloadField: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Sensitive Data in JWT Payload',
-                cwe: 'CWE-359',
-                description: 'JWT payloads are not encrypted - sensitive data like "{{fieldName}}" can be read by anyone',
-                severity: 'MEDIUM',
-                fix: 'Store sensitive data server-side, reference by ID in token',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    additionalSensitiveFields: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional field names to flag as sensitive',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            additionalSensitiveFields: [],
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] ?? {};
-        const additionalFields = options.additionalSensitiveFields ?? [];
-        const allSensitiveFields = new Set([...utils_1.SENSITIVE_PAYLOAD_FIELDS, ...additionalFields]);
-        return {
-            CallExpression(node) {
-                if (!(0, utils_1.isSignOperation)(node)) {
-                    return;
-                }
-                if (node.arguments.length < 1) {
-                    return;
-                }
-                const payloadArg = node.arguments[0];
-                // Check object literal payload
-                if (payloadArg.type === 'ObjectExpression') {
-                    for (const prop of payloadArg.properties) {
-                        if (prop.type === 'Property' && prop.key.type === 'Identifier') {
-                            const fieldName = prop.key.name.toLowerCase();
-                            if (allSensitiveFields.has(fieldName)) {
-                                context.report({
-                                    node: prop,
-                                    messageId: 'sensitivePayloadField',
-                                    data: { fieldName: prop.key.name },
-                                });
-                            }
-                        }
-                    }
-                }
-            },
-        };
-    },
-});
-exports.default = exports.noSensitivePayload;

package/dist/src/rules/no-timestamp-manipulation/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-timestamp-manipulation
- *
- * Detects patterns that disable automatic timestamp (iat) generation.
- * This enables the "Back to the Future" replay attack (LightSEC 2025).
- *
- * CWE-294: Authentication Bypass by Capture-replay
- *
- * @see https://securitypattern.com/post/jwt-back-to-the-future
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { JwtRuleOptions } from '../../types';
-type MessageIds = 'timestampDisabled' | 'noTimestampTrue';
-type RuleOptions = [JwtRuleOptions?];
-export declare const noTimestampManipulation: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noTimestampManipulation;

package/dist/src/rules/no-timestamp-manipulation/index.js

@@ -1,97 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noTimestampManipulation = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.noTimestampManipulation = (0, eslint_devkit_1.createRule)({
-    name: 'no-timestamp-manipulation',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-timestamp-manipulation.md',
-            description: 'Prevent disabling automatic timestamp generation which enables replay attacks',
-            cwe: 'CWE-294',
-            cvss: 7.5,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            timestampDisabled: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Timestamp Generation Disabled',
-                cwe: 'CWE-294',
-                description: 'noTimestamp:true disables iat claim, enabling replay attacks',
-                severity: 'HIGH',
-                fix: 'Remove noTimestamp option or set to false',
-                documentationLink: 'https://securitypattern.com/post/jwt-back-to-the-future',
-            }),
-            noTimestampTrue: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Back to the Future Attack Vector',
-                cwe: 'CWE-294',
-                description: 'Disabling timestamps allows attackers to forge tokens valid in the future',
-                severity: 'HIGH',
-                fix: 'Always include iat claim for freshness validation',
-                documentationLink: 'https://securitypattern.com/post/jwt-back-to-the-future',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        return {
-            CallExpression(node) {
-                if (!(0, utils_1.isSignOperation)(node)) {
-                    return;
-                }
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                if (!optionsArg) {
-                    return;
-                }
-                // Check for noTimestamp: true
-                if ((0, utils_1.hasOption)(optionsArg, 'noTimestamp')) {
-                    const value = (0, utils_1.getOptionValue)(optionsArg, 'noTimestamp');
-                    if (value?.type === 'Literal' && value.value === true) {
-                        context.report({
-                            node: value,
-                            messageId: 'noTimestampTrue',
-                        });
-                    }
-                }
-            },
-        };
-    },
-});
-exports.default = exports.noTimestampManipulation;

package/dist/src/rules/no-weak-secret/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-weak-secret
- *
- * Detects weak secrets used for HMAC-based JWT signing.
- * Weak secrets can be brute-forced, allowing attackers to forge tokens.
- *
- * CWE-326: Inadequate Encryption Strength
- *
- * @see https://tools.ietf.org/html/rfc8725
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoWeakSecretOptions } from '../../types';
-type MessageIds = 'weakSecret' | 'shortSecret' | 'useStrongSecret';
-type RuleOptions = [NoWeakSecretOptions?];
-export declare const noWeakSecret: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noWeakSecret;

package/dist/src/rules/no-weak-secret/index.js

@@ -1,165 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noWeakSecret = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-// Common weak secret patterns
-const WEAK_SECRET_PATTERNS = [
-    /^secret$/i,
-    /^password$/i,
-    /^123456/,
-    /^test/i,
-    /^demo/i,
-    /^example/i,
-    /^changeme/i,
-    /^default/i,
-];
-exports.noWeakSecret = (0, eslint_devkit_1.createRule)({
-    name: 'no-weak-secret',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-weak-secret.md',
-            description: 'Require strong secrets (256+ bits) for HMAC-based JWT signing',
-            cwe: 'CWE-326',
-            cvss: 5.9,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            weakSecret: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Weak JWT Secret',
-                cwe: 'CWE-326',
-                description: 'JWT secret is too weak and can be brute-forced',
-                severity: 'HIGH',
-                fix: 'Use crypto.randomBytes(32).toString("hex") for secrets',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-            shortSecret: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Short JWT Secret',
-                cwe: 'CWE-326',
-                description: 'JWT secret must be at least 32 characters (256 bits) for HS256',
-                severity: 'HIGH',
-                fix: 'Generate a secret with: crypto.randomBytes(32).toString("hex")',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-            useStrongSecret: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Strong Secret',
-                description: 'Replace with cryptographically strong secret',
-                severity: 'LOW',
-                fix: 'Use process.env.JWT_SECRET with a 256-bit random value',
-                documentationLink: 'https://nodejs.org/api/crypto.html',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    minSecretLength: {
-                        type: 'integer',
-                        default: 32,
-                        minimum: 16,
-                        description: 'Minimum secret length in characters',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            minSecretLength: 32,
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] ?? {};
-        const { minSecretLength = 32 } = options;
-        /**
-         * Check if a value matches known weak patterns
-         */
-        const isKnownWeakPattern = (value) => {
-            return WEAK_SECRET_PATTERNS.some((pattern) => pattern.test(value));
-        };
-        /**
-         * Check the secret argument for weakness
-         */
-        const checkSecret = (secretNode) => {
-            // Environment variables are considered safe (configuration)
-            if ((0, utils_1.isEnvVariable)(secretNode)) {
-                return;
-            }
-            // Check string literals
-            if (secretNode.type === 'Literal' &&
-                typeof secretNode.value === 'string') {
-                const secretValue = secretNode.value;
-                // Check for known weak patterns
-                if (isKnownWeakPattern(secretValue)) {
-                    context.report({
-                        node: secretNode,
-                        messageId: 'weakSecret',
-                    });
-                    return;
-                }
-                // Check for short secrets
-                if (secretValue.length < minSecretLength) {
-                    context.report({
-                        node: secretNode,
-                        messageId: 'shortSecret',
-                        data: {
-                            length: String(secretValue.length),
-                            minLength: String(minSecretLength),
-                        },
-                    });
-                }
-            }
-            // Template literals with obvious weak values
-            if (secretNode.type === 'TemplateLiteral' && secretNode.quasis.length === 1) {
-                const rawValue = secretNode.quasis[0].value.raw;
-                if (isKnownWeakPattern(rawValue) || rawValue.length < minSecretLength) {
-                    context.report({
-                        node: secretNode,
-                        messageId: 'weakSecret',
-                    });
-                }
-            }
-        };
-        return {
-            CallExpression(node) {
-                // Check both sign and verify operations
-                if (!(0, utils_1.isSignOperation)(node) && !(0, utils_1.isVerifyOperation)(node)) {
-                    return;
-                }
-                // Secret is usually the second argument
-                if (node.arguments.length >= 2) {
-                    checkSecret(node.arguments[1]);
-                }
-            },
-        };
-    },
-});
-exports.default = exports.noWeakSecret;

package/dist/src/rules/require-algorithm-whitelist/index.d.ts

@@ -1,24 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-algorithm-whitelist
- *
- * Enforces explicit algorithm specification in JWT verify operations.
- * Without explicit algorithms, the token's header algorithm is trusted,
- * enabling algorithm substitution attacks.
- *
- * CWE-757: Selection of Less-Secure Algorithm During Negotiation
- *
- * @see https://tools.ietf.org/html/rfc8725
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { RequireAlgorithmWhitelistOptions } from '../../types';
-type MessageIds = 'missingAlgorithmWhitelist' | 'addAlgorithmWhitelist';
-type RuleOptions = [RequireAlgorithmWhitelistOptions?];
-export declare const requireAlgorithmWhitelist: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireAlgorithmWhitelist;

package/dist/src/rules/require-algorithm-whitelist/index.js

@@ -1,113 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireAlgorithmWhitelist = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.requireAlgorithmWhitelist = (0, eslint_devkit_1.createRule)({
-    name: 'require-algorithm-whitelist',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/require-algorithm-whitelist.md',
-            description: 'Require explicit algorithm specification in JWT verify operations',
-            cwe: 'CWE-757',
-            cvss: 7.5,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            missingAlgorithmWhitelist: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Missing Algorithm Whitelist',
-                cwe: 'CWE-757',
-                description: 'JWT verification without explicit algorithms trusts the token header',
-                severity: 'HIGH',
-                fix: 'Add algorithms: ["RS256"] or algorithms: ["ES256"] to options',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-            addAlgorithmWhitelist: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Add Algorithm Whitelist',
-                description: 'Specify allowed algorithms explicitly',
-                severity: 'LOW',
-                fix: 'jwt.verify(token, key, { algorithms: ["RS256"] })',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    recommendedAlgorithms: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['RS256', 'ES256'],
-                        description: 'Algorithms to suggest in auto-fix',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            recommendedAlgorithms: ['RS256', 'ES256'],
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        return {
-            CallExpression(node) {
-                // Only check verify operations
-                if (!(0, utils_1.isVerifyOperation)(node)) {
-                    return;
-                }
-                // Need at least token and key arguments
-                if (node.arguments.length < 2) {
-                    return;
-                }
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // No options at all - definitely missing algorithms
-                if (!optionsArg) {
-                    context.report({
-                        node,
-                        messageId: 'missingAlgorithmWhitelist',
-                    });
-                    return;
-                }
-                // Options exist but no algorithms property
-                const hasAlgorithms = (0, utils_1.hasOption)(optionsArg, 'algorithms') ||
-                    (0, utils_1.hasOption)(optionsArg, 'algorithm') ||
-                    (0, utils_1.hasOption)(optionsArg, 'alg');
-                if (!hasAlgorithms) {
-                    context.report({
-                        node: optionsArg,
-                        messageId: 'missingAlgorithmWhitelist',
-                    });
-                }
-            },
-        };
-    },
-});
-exports.default = exports.requireAlgorithmWhitelist;

package/dist/src/rules/require-audience-validation/index.d.ts

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-audience-validation
- *
- * Mandates audience (aud) claim validation in JWT verify operations.
- * Without audience validation, tokens intended for other services are accepted.
- *
- * CWE-287: Improper Authentication
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { RequireAudienceValidationOptions } from '../../types';
-type RuleOptions = [RequireAudienceValidationOptions?];
-export declare const requireAudienceValidation: TSESLint.RuleModule<"missingAudienceValidation", RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireAudienceValidation;

package/dist/src/rules/require-audience-validation/index.js

@@ -1,100 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireAudienceValidation = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.requireAudienceValidation = (0, eslint_devkit_1.createRule)({
-    name: 'require-audience-validation',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/require-audience-validation.md',
-            description: 'Require audience (aud) claim validation in JWT verify operations',
-            cwe: 'CWE-287',
-            cvss: 9.8,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            missingAudienceValidation: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Missing Audience Validation',
-                cwe: 'CWE-287',
-                description: 'JWT verification without audience validation accepts tokens intended for other services',
-                severity: 'MEDIUM',
-                fix: 'Add audience option: { audience: "https://api.example.com" }',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    knownAudiences: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Known valid audiences to suggest',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            knownAudiences: [],
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        return {
-            CallExpression(node) {
-                if (!(0, utils_1.isVerifyOperation)(node)) {
-                    return;
-                }
-                if (node.arguments.length < 2) {
-                    return;
-                }
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // No options at all
-                if (!optionsArg) {
-                    context.report({
-                        node,
-                        messageId: 'missingAudienceValidation',
-                    });
-                    return;
-                }
-                // Check for audience option
-                if (!(0, utils_1.hasOption)(optionsArg, 'audience') && !(0, utils_1.hasOption)(optionsArg, 'aud')) {
-                    context.report({
-                        node: optionsArg,
-                        messageId: 'missingAudienceValidation',
-                    });
-                }
-            },
-        };
-    },
-});
-exports.default = exports.requireAudienceValidation;