eslint-plugin-jwt-security 2.3.0 → 2.3.2

package/src/oxlint.test.ts

@@ -1,61 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-import { describe, it, expect } from 'vitest';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { plugin as mainPlugin } from './index';
-
-/**
- * Smoke test for the `./oxlint` sub-export.
- *
- * Runtime shape: `oxlint.ts` uses `export = plugin`, which compiles to
- * `module.exports = plugin`. From an ESM dynamic `import('./oxlint')` view,
- * Node's CJS interop surfaces that value at `.default`. From oxlint's
- * `require('eslint-plugin-jwt-security/oxlint')` view, it sits at the top of
- * `module.exports` — exactly the `{ meta, rules }` shape oxlint's JS plugin
- * loader expects.
- */
-
-type Plugin = typeof mainPlugin;
-
-describe('eslint-plugin-jwt-security/oxlint sub-export', () => {
-  it('declares the ./oxlint sub-export in package.json', () => {
-    const pkgJson = JSON.parse(
-      fs.readFileSync(path.resolve(__dirname, '..', 'package.json'), 'utf8'),
-    );
-    expect(pkgJson.exports['./oxlint']).toEqual({
-      types: './src/oxlint.d.ts',
-      default: './src/oxlint.js',
-    });
-  });
-
-  it('re-exports the plugin object (meta + rules at top level)', async () => {
-    const oxlintModule = await import('./oxlint.js');
-    const oxlintPlugin = (oxlintModule as unknown as { default: Plugin }).default;
-    expect(oxlintPlugin).toBeDefined();
-    expect(oxlintPlugin.meta?.name).toBe('eslint-plugin-jwt-security');
-    expect(oxlintPlugin.rules).toBeDefined();
-  });
-
-  it('exposes the same rule names as the main entry (no rules dropped)', async () => {
-    const oxlintModule = await import('./oxlint.js');
-    const oxlintPlugin = (oxlintModule as unknown as { default: Plugin }).default;
-    expect(Object.keys(oxlintPlugin.rules || {}).toSorted()).toEqual(
-      Object.keys(mainPlugin.rules || {}).toSorted(),
-    );
-  });
-
-  it('exposes the same rule references (pass-through, not a copy)', async () => {
-    const oxlintModule = await import('./oxlint.js');
-    const oxlintPlugin = (oxlintModule as unknown as { default: Plugin }).default;
-    for (const ruleName of Object.keys(mainPlugin.rules || {})) {
-      expect(oxlintPlugin.rules?.[ruleName]).toBe(
-        (mainPlugin.rules as Record<string, unknown>)[ruleName],
-      );
-    }
-  });
-});

package/src/oxlint.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * oxlint sub-export.
- *
- * Consumers wire oxlint to this entry via:
- *   { "jsPlugins": ["eslint-plugin-jwt-security/oxlint"] }
- *
- * oxlint's JS plugin loader does `require('eslint-plugin-jwt-security/oxlint')` and reads
- * `.rules` off the result. The compiled output of `export = plugin` is
- * `module.exports = plugin`, which gives oxlint the plugin object directly
- * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
- *
- * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
- */
-
-import { plugin } from './index';
-
-export = plugin;

package/src/rules/no-algorithm-confusion/index.ts

@@ -1,208 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * ESLint Rule: no-algorithm-confusion
- *
- * Detects algorithm confusion attacks where symmetric algorithms (HS256/384/512)
- * are used with asymmetric keys (public keys). This allows attackers to sign
- * tokens using the public key as an HMAC secret.
- *
- * CWE-347: Improper Verification of Cryptographic Signature
- *
- * @see https://portswigger.net/web-security/jwt/algorithm-confusion
- */
-import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import {
-  isVerifyOperation,
-  getOptionsArgument,
-  extractAlgorithms,
-} from '../../utils';
-import type { NoAlgorithmConfusionOptions } from '../../types';
-
-type MessageIds =
-  | 'algorithmConfusion'
-  | 'symmetricWithPublicKey'
-  | 'useAsymmetricAlgorithm';
-
-type RuleOptions = [NoAlgorithmConfusionOptions?];
-
-// Patterns that indicate a public key
-const PUBLIC_KEY_PATTERNS = [
-  /public/i,
-  /\.pub$/,
-  /\.pem$/,
-  /-----BEGIN PUBLIC KEY-----/,
-  /-----BEGIN RSA PUBLIC KEY-----/,
-  /-----BEGIN EC PUBLIC KEY-----/,
-  /getPublicKey/i,
-  /publicKey/i,
-  /jwks/i,
-];
-
-export const noAlgorithmConfusion = createRule<RuleOptions, MessageIds>({
-  name: 'no-algorithm-confusion',
-  meta: {
-    type: 'problem',
-    docs: {
-      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-confusion.md',
-      description:
-        'Prevent algorithm confusion attacks using symmetric algorithms with asymmetric keys',
-      cwe: 'CWE-347',
-      cvss: 9.5,
-    },
-    fixable: undefined,
-    hasSuggestions: false,
-    messages: {
-      algorithmConfusion: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'JWT Algorithm Confusion Attack',
-        cwe: 'CWE-347',
-        description:
-          'Symmetric algorithm (HS*) used with public key allows token forgery',
-        severity: 'CRITICAL',
-        fix: 'Use asymmetric algorithms (RS256, ES256) with public keys',
-        documentationLink:
-          'https://portswigger.net/web-security/jwt/algorithm-confusion',
-      }),
-      symmetricWithPublicKey: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Symmetric Algorithm with Public Key',
-        cwe: 'CWE-347',
-        description:
-          'HS256/384/512 should only be used with shared secrets, not public keys',
-        severity: 'CRITICAL',
-        fix: 'Switch to RS256 or ES256 for asymmetric key verification',
-        documentationLink:
-          'https://portswigger.net/web-security/jwt/algorithm-confusion',
-      }),
-      useAsymmetricAlgorithm: formatLLMMessage({
-        icon: MessageIcons.INFO,
-        issueName: 'Use Asymmetric Algorithm',
-        description: 'Replace HS* with RS* or ES* algorithm',
-        severity: 'LOW',
-        fix: 'Use RS256 or ES256 with public key verification',
-        documentationLink: 'https://tools.ietf.org/html/rfc8725',
-      }),
-    },
-    schema: [
-      {
-        type: 'object',
-        properties: {
-          symmetricAlgorithms: {
-            type: 'array',
-            items: { type: 'string' },
-            default: ['HS256', 'HS384', 'HS512'],
-            description: 'Algorithms to flag when used with public keys',
-          },
-          trustedSanitizers: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          trustedAnnotations: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          strictMode: {
-            type: 'boolean',
-            default: false,
-          },
-        },
-        additionalProperties: false,
-      },
-    ],
-  },
-  defaultOptions: [
-    {
-      symmetricAlgorithms: ['HS256', 'HS384', 'HS512'],
-      trustedSanitizers: [],
-      trustedAnnotations: [],
-      strictMode: false,
-    },
-  ],
-  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
-    const options = context.options[0] ?? {};
-    const symmetricAlgSet = new Set(
-      options.symmetricAlgorithms ?? ['HS256', 'HS384', 'HS512']
-    );
-    const sourceCode = context.sourceCode;
-
-    /**
-     * Check if a node looks like a public key reference
-     */
-    const looksLikePublicKey = (node: TSESTree.Node): boolean => {
-      const text = sourceCode.getText(node);
-      return PUBLIC_KEY_PATTERNS.some((pattern) => pattern.test(text));
-    };
-
-    /**
-     * Check if algorithms include symmetric algorithms
-     */
-    const hasSymmetricAlgorithm = (algorithms: string[]): string | null => {
-      for (const alg of algorithms) {
-        if (symmetricAlgSet.has(alg)) {
-          return alg;
-        }
-      }
-      return null;
-    };
-
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        // Only check verify operations
-        if (!isVerifyOperation(node)) {
-          return;
-        }
-
-        // Need at least 2 arguments: token, key
-        if (node.arguments.length < 2) {
-          return;
-        }
-
-        const keyArg = node.arguments[1];
-        const optionsArg = getOptionsArgument(node, 2);
-
-        // Check if key looks like a public key
-        if (!looksLikePublicKey(keyArg)) {
-          return;
-        }
-
-        // If there are options, check the algorithms
-        if (optionsArg) {
-          const algorithms = extractAlgorithms(optionsArg);
-          const symmetricAlg = hasSymmetricAlgorithm(algorithms);
-
-          if (symmetricAlg) {
-            // Find the algorithm node for precise error location
-            for (const prop of optionsArg.properties) {
-              if (
-                prop.type === 'Property' &&
-                prop.key.type === 'Identifier' &&
-                ['algorithms', 'algorithm', 'alg'].includes(prop.key.name)
-              ) {
-                context.report({
-                  node: prop.value,
-                  messageId: 'algorithmConfusion',
-                  data: { algorithm: symmetricAlg },
-                });
-                return;
-              }
-            }
-          }
-        }
-
-        // If no options specified but key looks like public key,
-        // and we're in verify, flag as potential issue
-        // (verification without explicit algorithm with public key is risky)
-      },
-    };
-  },
-});
-
-export default noAlgorithmConfusion;

package/src/rules/no-algorithm-confusion/no-algorithm-confusion.test.ts

@@ -1,106 +0,0 @@
-/**
- * Tests for no-algorithm-confusion rule
- * Security: CWE-347 (Algorithm Confusion Attack)
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noAlgorithmConfusion } from './index';
-
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('no-algorithm-confusion', () => {
-  describe('Valid Code - Safe Patterns', () => {
-    ruleTester.run('valid - asymmetric algorithms with public keys', noAlgorithmConfusion, {
-      valid: [
-        // RS256 with public key - SAFE
-        { code: `jwt.verify(token, publicKey, { algorithms: ['RS256'] });` },
-        // ES256 with public key - SAFE
-        { code: `jwt.verify(token, publicKey, { algorithms: ['ES256'] });` },
-        // Multiple asymmetric algorithms
-        { code: `jwt.verify(token, publicKey, { algorithms: ['RS256', 'ES256'] });` },
-        // HS256 with secret (not public key) - SAFE
-        { code: `jwt.verify(token, secret, { algorithms: ['HS256'] });` },
-        // HS256 with env var - SAFE
-        { code: `jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });` },
-        // No options specified
-        { code: `jwt.verify(token, publicKey);` },
-        // Sign operation (not verify)
-        { code: `jwt.sign(payload, privateKey, { algorithm: 'HS256' });` },
-        // Only 1 argument (edge case - line 157 coverage)
-        { code: `jwt.verify(token);` },
-        // No key that looks like public key
-        { code: `jwt.verify(token, sharedSecret, { algorithms: ['HS256'] });` },
-        // Empty options object with public key (no algorithms)
-        { code: `jwt.verify(token, publicKey, {});` },
-        // Options without algorithms property
-        { code: `jwt.verify(token, publicKey, { complete: true });` },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code - Algorithm Confusion', () => {
-    ruleTester.run('invalid - symmetric with public key', noAlgorithmConfusion, {
-      valid: [],
-      invalid: [
-        // HS256 with publicKey variable
-        {
-          code: `jwt.verify(token, publicKey, { algorithms: ['HS256'] });`,
-          errors: [{ messageId: 'algorithmConfusion' }],
-        },
-        // HS384 with public key
-        {
-          code: `jwt.verify(token, publicKey, { algorithms: ['HS384'] });`,
-          errors: [{ messageId: 'algorithmConfusion' }],
-        },
-        // HS512 with public key
-        {
-          code: `jwt.verify(token, publicKey, { algorithms: ['HS512'] });`,
-          errors: [{ messageId: 'algorithmConfusion' }],
-        },
-        // Single algorithm option
-        {
-          code: `jwt.verify(token, publicKey, { algorithm: 'HS256' });`,
-          errors: [{ messageId: 'algorithmConfusion' }],
-        },
-        // Mixed algorithms with symmetric
-        {
-          code: `jwt.verify(token, publicKey, { algorithms: ['RS256', 'HS256'] });`,
-          errors: [{ messageId: 'algorithmConfusion' }],
-        },
-        // getPublicKey() function
-        {
-          code: `jwt.verify(token, getPublicKey(), { algorithms: ['HS256'] });`,
-          errors: [{ messageId: 'algorithmConfusion' }],
-        },
-        // JWKS pattern
-        {
-          code: `jwt.verify(token, jwksKey, { algorithms: ['HS256'] });`,
-          errors: [{ messageId: 'algorithmConfusion' }],
-        },
-        // alg shorthand with public key
-        {
-          code: `jwt.verify(token, publicKey, { alg: 'HS256' });`,
-          errors: [{ messageId: 'algorithmConfusion' }],
-        },
-        // jwtVerify with public key
-        {
-          code: `jwtVerify(token, publicKey, { algorithms: ['HS256'] });`,
-          errors: [{ messageId: 'algorithmConfusion' }],
-        },
-      ],
-    });
-  });
-});

package/src/rules/no-algorithm-none/index.ts

@@ -1,270 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * ESLint Rule: no-algorithm-none
- *
- * Detects attempts to use the 'none' algorithm which bypasses JWT signature verification.
- * This is a critical vulnerability (CVE-2022-23540) that allows attackers to forge JWT tokens.
- *
- * CWE-347: Improper Verification of Cryptographic Signature
- *
- * @see https://nvd.nist.gov/vuln/detail/CVE-2022-23540
- * @see https://tools.ietf.org/html/rfc8725
- */
-import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import {
-  isVerifyOperation,
-  isSignOperation,
-  getOptionsArgument,
-  isTestFile,
-} from '../../utils';
-import type { NoAlgorithmNoneOptions } from '../../types';
-
-type MessageIds =
-  | 'algorithmNone'
-  | 'algorithmNoneInArray'
-  | 'emptyAlgorithms'
-  | 'useSecureAlgorithm'
-  | 'decodeWithoutVerify';
-
-type RuleOptions = [NoAlgorithmNoneOptions?];
-
-export const noAlgorithmNone = createRule<RuleOptions, MessageIds>({
-  name: 'no-algorithm-none',
-  meta: {
-    type: 'problem',
-    docs: {
-      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-none.md',
-      description:
-        'Disallow JWT "none" algorithm which bypasses signature verification (CVE-2022-23540)',
-      cwe: 'CWE-347',
-      cvss: 9.5,
-      confidence: 'high',
-    },
-    fixable: undefined,
-    hasSuggestions: false,
-    messages: {
-      algorithmNone: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'JWT Algorithm None Attack',
-        cwe: 'CWE-347',
-        description:
-          'Using alg:"none" bypasses signature verification, allowing token forgery',
-        severity: 'CRITICAL',
-        fix: 'Remove "none" and use RS256, ES256, or other secure algorithms',
-        documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23540',
-      }),
-      algorithmNoneInArray: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'JWT Algorithm None in Whitelist',
-        cwe: 'CWE-347',
-        description:
-          'Including "none" in algorithms array allows unsigned tokens',
-        severity: 'CRITICAL',
-        fix: 'Remove "none" from the algorithms array',
-        documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23540',
-      }),
-      emptyAlgorithms: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Empty Algorithms Array',
-        cwe: 'CWE-347',
-        description:
-          'Empty algorithms array may default to accepting any algorithm including none',
-        severity: 'HIGH',
-        fix: 'Specify explicit algorithms: ["RS256"] or ["ES256"]',
-        documentationLink: 'https://tools.ietf.org/html/rfc8725',
-      }),
-      useSecureAlgorithm: formatLLMMessage({
-        icon: MessageIcons.INFO,
-        issueName: 'Use Secure Algorithm',
-        description: 'Replace with a secure algorithm',
-        severity: 'LOW',
-        fix: 'Use algorithms: ["RS256"] or algorithms: ["ES256"]',
-        documentationLink: 'https://tools.ietf.org/html/rfc8725',
-      }),
-      decodeWithoutVerify: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'JWT Decode Without Verify',
-        cwe: 'CWE-347',
-        description:
-          'jwt.decode() does NOT verify the signature — using its result as if it were authenticated is functionally equivalent to algorithm:"none". Any token, including forged ones, will decode.',
-        severity: 'CRITICAL',
-        fix: 'Use jwt.verify(token, secret, { algorithms: ["RS256"] }) instead. Reserve jwt.decode() for non-security inspection only (e.g. logging the issuer).',
-        documentationLink: 'https://github.com/auth0/node-jsonwebtoken#jwtdecodetoken--options',
-      }),
-    },
-    schema: [
-      {
-        type: 'object',
-        properties: {
-          allowInTests: {
-            type: 'boolean',
-            default: false,
-            description: 'Allow "none" algorithm in test files',
-          },
-          trustedSanitizers: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          trustedAnnotations: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          strictMode: {
-            type: 'boolean',
-            default: false,
-          },
-        },
-        additionalProperties: false,
-      },
-    ],
-  },
-  defaultOptions: [
-    {
-      allowInTests: false,
-      trustedSanitizers: [],
-      trustedAnnotations: [],
-      strictMode: false,
-    },
-  ],
-  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
-    const options = context.options[0] ?? {};
-    const { allowInTests = false } = options;
-    const filename = context.filename;
-
-    // Skip test files if configured
-    if (allowInTests && isTestFile(filename)) {
-      return {};
-    }
-
-    /**
-     * Check if an algorithm value is 'none' (case insensitive)
-     */
-    // oxlint-disable-next-line consistent-function-scoping
-    const isNoneAlgorithm = (value: string): boolean => {
-      return value.toLowerCase() === 'none';
-    };
-
-    /**
-     * Check options object for 'none' algorithm
-     */
-    const checkOptionsForNone = (
-      optionsNode: TSESTree.ObjectExpression
-    ): void => {
-      for (const prop of optionsNode.properties) {
-        if (prop.type !== 'Property' || prop.key.type !== 'Identifier') {
-          continue;
-        }
-
-        const keyName = prop.key.name;
-        if (
-          keyName !== 'algorithms' &&
-          keyName !== 'algorithm' &&
-          keyName !== 'alg'
-        ) {
-          continue;
-        }
-
-        // Single algorithm: { algorithm: 'none' }
-        if (
-          prop.value.type === 'Literal' &&
-          typeof prop.value.value === 'string'
-        ) {
-          if (isNoneAlgorithm(prop.value.value)) {
-            context.report({
-              node: prop.value,
-              messageId: 'algorithmNone',
-            });
-          }
-        }
-
-        // Array of algorithms: { algorithms: ['none'] } or { algorithms: [] }
-        if (prop.value.type === 'ArrayExpression') {
-          // Check for empty array
-          if (prop.value.elements.length === 0) {
-            context.report({
-              node: prop.value,
-              messageId: 'emptyAlgorithms',
-            });
-            continue;
-          }
-
-          // Check each element for 'none'
-          for (const elem of prop.value.elements) {
-            if (
-              elem &&
-              elem.type === 'Literal' &&
-              typeof elem.value === 'string' &&
-              isNoneAlgorithm(elem.value)
-            ) {
-              context.report({
-                node: elem,
-                messageId: 'algorithmNoneInArray',
-              });
-            }
-          }
-        }
-      }
-    };
-
-    /**
-     * Detect `jwt.decode()` calls — closes the audit FN where
-     * `jwt.decode(token)` followed by trusting the decoded payload was
-     * silent, despite being functionally equivalent to algorithm:"none".
-     * See benchmarks/AUDIT_PATTERNS.md §3.8 ("verify-then-trust mismatch").
-     *
-     * The check is conservative: we flag every `jwt.decode()` call. In
-     * the rare case where `decode` is used legitimately (e.g. logging
-     * the issuer of an inbound token without authentication semantics),
-     * the user can disable the rule on that line. The default-on
-     * behaviour is correct — most production uses of `jwt.decode` are
-     * authentication mistakes.
-     */
-    // oxlint-disable-next-line consistent-function-scoping
-    function isDecodeCall(node: TSESTree.CallExpression): boolean {
-      const callee = node.callee;
-      if (callee.type !== 'MemberExpression') return false;
-      if (callee.property.type !== 'Identifier') return false;
-      if (callee.property.name !== 'decode') return false;
-      // Object should be `jwt` (or imported as such). Check both
-      // `jwt.decode` and `JWT.decode` patterns.
-      if (callee.object.type === 'Identifier') {
-        const name = callee.object.name.toLowerCase();
-        return name === 'jwt' || name === 'jsonwebtoken';
-      }
-      return false;
-    }
-
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        // Detect `jwt.decode(...)` — equivalent to algorithm:"none" if
-        // its result is trusted. We always flag (with critical severity)
-        // because the FN risk far outweighs the FP risk on real code.
-        if (isDecodeCall(node)) {
-          context.report({ node, messageId: 'decodeWithoutVerify' });
-          return;
-        }
-
-        // Check both verify and sign operations
-        if (!isVerifyOperation(node) && !isSignOperation(node)) {
-          return;
-        }
-
-        // Get options argument (usually 3rd argument)
-        const optionsArg = getOptionsArgument(node, 2);
-        if (optionsArg) {
-          checkOptionsForNone(optionsArg);
-        }
-      },
-    };
-  },
-});
-
-export default noAlgorithmNone;