eslint-plugin-jwt-security 2.3.0

package/src/rules/no-hardcoded-secret/index.ts

@@ -0,0 +1,230 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+
+/**
+ * ESLint Rule: no-hardcoded-secret
+ *
+ * Detects hardcoded secrets in JWT sign/verify operations.
+ * Hardcoded secrets in source code are a critical security vulnerability.
+ *
+ * CWE-798: Use of Hard-coded Credentials
+ *
+ * @see https://cwe.mitre.org/data/definitions/798.html
+ */
+import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
+import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
+import {
+  isSignOperation,
+  isVerifyOperation,
+  isEnvVariable,
+} from '../../utils';
+import type { NoHardcodedSecretOptions } from '../../types';
+
+type MessageIds =
+  | 'hardcodedSecret'
+  | 'useEnvVariable';
+
+type RuleOptions = [NoHardcodedSecretOptions?];
+
+export const noHardcodedSecret = createRule<RuleOptions, MessageIds>({
+  name: 'no-hardcoded-secret',
+  meta: {
+    type: 'problem',
+    docs: {
+      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-hardcoded-secret.md',
+      description:
+        'Disallow hardcoded secrets in JWT sign/verify operations',
+      cwe: 'CWE-798',
+      cvss: 9.8,
+    },
+    fixable: undefined,
+    hasSuggestions: false,
+    messages: {
+      hardcodedSecret: formatLLMMessage({
+        icon: MessageIcons.SECURITY,
+        issueName: 'Hardcoded JWT Secret',
+        cwe: 'CWE-798',
+        description:
+          'Secret key hardcoded in source code can be extracted from repositories',
+        severity: 'HIGH',
+        fix: 'Use process.env.JWT_SECRET or secure secret management',
+        documentationLink: 'https://cwe.mitre.org/data/definitions/798.html',
+      }),
+      useEnvVariable: formatLLMMessage({
+        icon: MessageIcons.INFO,
+        issueName: 'Use Environment Variable',
+        description: 'Replace hardcoded secret with environment variable',
+        severity: 'LOW',
+        fix: 'process.env.JWT_SECRET',
+        documentationLink:
+          'https://12factor.net/config',
+      }),
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          envPatterns: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+            description: 'Patterns that indicate safe environment variable usage',
+          },
+          trustedSanitizers: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          trustedAnnotations: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          strictMode: {
+            type: 'boolean',
+            default: false,
+          },
+        },
+        additionalProperties: false,
+      },
+    ],
+  },
+  defaultOptions: [
+    {
+      envPatterns: [],
+      trustedSanitizers: [],
+      trustedAnnotations: [],
+      strictMode: false,
+    },
+  ],
+  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
+    /**
+     * Check if a node is a hardcoded string literal
+     */
+    // oxlint-disable-next-line consistent-function-scoping
+    const isHardcodedString = (node: TSESTree.Node): boolean => {
+      // String literal
+      if (node.type === 'Literal' && typeof node.value === 'string') {
+        return true;
+      }
+
+      // Template literal without expressions
+      if (
+        node.type === 'TemplateLiteral' &&
+        node.expressions.length === 0
+      ) {
+        return true;
+      }
+
+      return false;
+    };
+
+    /**
+     * Resolve an Identifier node to its initializer (one frame of indirection).
+     * Closes the audit FN where `const SECRET = 'x'; jwt.sign(p, SECRET)`
+     * was treated as safe — the literal-via-const pattern hides the
+     * hardcoded secret behind one declaration. See benchmarks/AUDIT_PATTERNS.md
+     * §3.2 ("Indirection through one level of variable").
+     */
+    const resolveConstLiteralValue = (
+      node: TSESTree.Node,
+    ): TSESTree.Node | null => {
+      if (node.type !== 'Identifier') return null;
+      const scope = context.sourceCode.getScope?.(node) ?? null;
+      if (!scope) return null;
+      const variable = scope.references.find(
+        (r) => r.identifier === node,
+      )?.resolved;
+      const def = variable?.defs[0];
+      if (!def || def.type !== 'Variable') return null;
+      const decl = def.parent;
+      if (decl?.type !== 'VariableDeclaration' || decl.kind !== 'const') return null;
+      return def.node.init ?? null;
+    };
+
+    /**
+     * Check if node is a safe key source
+     */
+    const isSafeKeySource = (node: TSESTree.Node): boolean => {
+      // Environment variable
+      if (isEnvVariable(node)) {
+        return true;
+      }
+
+      // Function call (getSecret(), loadKey(), etc.)
+      if (node.type === 'CallExpression') {
+        return true;
+      }
+
+      // await expression (async key loading)
+      if (node.type === 'AwaitExpression') {
+        return true;
+      }
+
+      // Variable reference: resolve `const X = ...` one level. If X is a
+      // hardcoded literal, treat as unsafe — fall through to the
+      // hardcoded check. Otherwise (env var, call, identifier chain)
+      // it's safe.
+      if (node.type === 'Identifier') {
+        const init = resolveConstLiteralValue(node);
+        if (init && isHardcodedString(init)) {
+          // Unsafe — let the caller's `isHardcodedString` (with the
+          // resolved init) flag it.
+          return false;
+        }
+        return true;
+      }
+
+      // Member expression but not literal (config.secret, etc.)
+      if (node.type === 'MemberExpression' && !isHardcodedString(node)) {
+        return true;
+      }
+
+      return false;
+    };
+
+    /**
+     * Like isHardcodedString but resolves single-level `const X = '...'`
+     * indirection so the caller fires on `const SECRET = 'x'; jwt.sign(p, SECRET)`.
+     */
+    const isHardcodedStringOrResolvedConst = (node: TSESTree.Node): boolean => {
+      if (isHardcodedString(node)) return true;
+      const init = resolveConstLiteralValue(node);
+      return init ? isHardcodedString(init) : false;
+    };
+
+    return {
+      CallExpression(node: TSESTree.CallExpression) {
+        // Check both sign and verify operations
+        if (!isSignOperation(node) && !isVerifyOperation(node)) {
+          return;
+        }
+
+        // Secret/key is the second argument
+        if (node.arguments.length < 2) {
+          return;
+        }
+
+        const secretArg = node.arguments[1];
+
+        // Skip if safe source
+        if (isSafeKeySource(secretArg)) {
+          return;
+        }
+
+        // Flag hardcoded strings (also follows single-frame `const X = '...'`).
+        if (isHardcodedStringOrResolvedConst(secretArg)) {
+          context.report({
+            node: secretArg,
+            messageId: 'hardcodedSecret',
+          });
+        }
+      },
+    };
+  },
+});
+
+export default noHardcodedSecret;

package/src/rules/no-hardcoded-secret/no-hardcoded-secret.test.ts

@@ -0,0 +1,97 @@
+/**
+ * Tests for no-hardcoded-secret rule
+ * Security: CWE-798 (Hardcoded Credentials)
+ */
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { describe, it, afterAll } from 'vitest';
+import parser from '@typescript-eslint/parser';
+import { noHardcodedSecret } from './index';
+
+RuleTester.afterAll = afterAll;
+RuleTester.it = it;
+RuleTester.itOnly = it.only;
+RuleTester.describe = describe;
+
+const ruleTester = new RuleTester({
+  languageOptions: {
+    parser,
+    ecmaVersion: 2022,
+    sourceType: 'module',
+  },
+});
+
+describe('no-hardcoded-secret', () => {
+  describe('Valid Code - Safe Key Sources', () => {
+    ruleTester.run('valid - environment and config', noHardcodedSecret, {
+      valid: [
+        // Environment variable
+        { code: `jwt.sign(payload, process.env.JWT_SECRET);` },
+        { code: `jwt.verify(token, process.env.JWT_SECRET);` },
+        // Variable reference
+        { code: `jwt.sign(payload, secret);` },
+        { code: `jwt.verify(token, privateKey);` },
+        // Function call
+        { code: `jwt.sign(payload, getSecretKey());` },
+        { code: `jwt.verify(token, await loadPublicKey());` },
+        // Config object
+        { code: `jwt.sign(payload, config.jwtSecret);` },
+        { code: `jwt.verify(token, settings.publicKey);` },
+        // Async key loading
+        { code: `jwt.verify(token, await importJWK(jwk));` },
+        // crypto operations
+        { code: `jwt.sign(payload, crypto.randomBytes(32));` },
+        // Only 1 argument - edge case (line 156 coverage)
+        { code: `jwt.sign(payload);` },
+        { code: `jwt.verify(token);` },
+        // MemberExpression that's not hardcoded
+        { code: `jwt.sign(payload, keys.current);` },
+        // signJWT with env var
+        { code: `signJWT(payload, process.env.SECRET);` },
+      ],
+      invalid: [],
+    });
+  });
+
+  describe('Invalid Code - Hardcoded Secrets', () => {
+    ruleTester.run('invalid - hardcoded strings', noHardcodedSecret, {
+      valid: [],
+      invalid: [
+        // String literal
+        {
+          code: `jwt.sign(payload, 'my-secret-key');`,
+          errors: [{ messageId: 'hardcodedSecret' }],
+        },
+        // Long string (still hardcoded)
+        {
+          code: `jwt.sign(payload, 'this-is-a-very-long-secret-but-still-hardcoded');`,
+          errors: [{ messageId: 'hardcodedSecret' }],
+        },
+        // Template literal without variables
+        {
+          code: 'jwt.sign(payload, `my-secret-key`);',
+          errors: [{ messageId: 'hardcodedSecret' }],
+        },
+        // Verify with hardcoded
+        {
+          code: `jwt.verify(token, 'hardcoded-public-key');`,
+          errors: [{ messageId: 'hardcodedSecret' }],
+        },
+        // PEM key inline
+        {
+          code: `jwt.verify(token, '-----BEGIN PUBLIC KEY-----\\\\nMIIBIj...');`,
+          errors: [{ messageId: 'hardcodedSecret' }],
+        },
+        // signJWT with hardcoded
+        {
+          code: `signJWT(payload, 'hardcoded');`,
+          errors: [{ messageId: 'hardcodedSecret' }],
+        },
+        // sign() direct call with hardcoded
+        {
+          code: `sign(payload, 'secret123');`,
+          errors: [{ messageId: 'hardcodedSecret' }],
+        },
+      ],
+    });
+  });
+});

package/src/rules/no-sensitive-payload/index.ts

@@ -0,0 +1,123 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+
+/**
+ * ESLint Rule: no-sensitive-payload
+ *
+ * Detects storage of sensitive data in JWT payload.
+ * JWT payloads are only base64-encoded, not encrypted.
+ *
+ * CWE-359: Exposure of Private Personal Information
+ */
+import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
+import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
+import { isSignOperation, SENSITIVE_PAYLOAD_FIELDS } from '../../utils';
+import type { NoSensitivePayloadOptions } from '../../types';
+
+type MessageIds = 'sensitivePayloadField';
+
+type RuleOptions = [NoSensitivePayloadOptions?];
+
+export const noSensitivePayload = createRule<RuleOptions, MessageIds>({
+  name: 'no-sensitive-payload',
+  meta: {
+    type: 'problem',
+    docs: {
+      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-sensitive-payload.md',
+      description:
+        'Prevent storing sensitive data in JWT payload which is only base64-encoded',
+      cwe: 'CWE-359',
+      cvss: 5,
+    },
+    fixable: undefined,
+    hasSuggestions: false,
+    messages: {
+      sensitivePayloadField: formatLLMMessage({
+        icon: MessageIcons.SECURITY,
+        issueName: 'Sensitive Data in JWT Payload',
+        cwe: 'CWE-359',
+        description:
+          'JWT payloads are not encrypted - sensitive data like "{{fieldName}}" can be read by anyone',
+        severity: 'MEDIUM',
+        fix: 'Store sensitive data server-side, reference by ID in token',
+        documentationLink: 'https://tools.ietf.org/html/rfc8725',
+      }),
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          additionalSensitiveFields: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+            description: 'Additional field names to flag as sensitive',
+          },
+          trustedSanitizers: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          trustedAnnotations: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          strictMode: {
+            type: 'boolean',
+            default: false,
+          },
+        },
+        additionalProperties: false,
+      },
+    ],
+  },
+  defaultOptions: [
+    {
+      additionalSensitiveFields: [],
+      trustedSanitizers: [],
+      trustedAnnotations: [],
+      strictMode: false,
+    },
+  ],
+  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
+    const options = context.options[0] ?? {};
+    const additionalFields = options.additionalSensitiveFields ?? [];
+    const allSensitiveFields = new Set([...SENSITIVE_PAYLOAD_FIELDS, ...additionalFields]);
+
+    return {
+      CallExpression(node: TSESTree.CallExpression) {
+        if (!isSignOperation(node)) {
+          return;
+        }
+
+        if (node.arguments.length < 1) {
+          return;
+        }
+
+        const payloadArg = node.arguments[0];
+
+        // Check object literal payload
+        if (payloadArg.type === 'ObjectExpression') {
+          for (const prop of payloadArg.properties) {
+            if (prop.type === 'Property' && prop.key.type === 'Identifier') {
+              const fieldName = prop.key.name.toLowerCase();
+              if (allSensitiveFields.has(fieldName)) {
+                context.report({
+                  node: prop,
+                  messageId: 'sensitivePayloadField',
+                  data: { fieldName: prop.key.name },
+                });
+              }
+            }
+          }
+        }
+      },
+    };
+  },
+});
+
+export default noSensitivePayload;

package/src/rules/no-sensitive-payload/no-sensitive-payload.test.ts

@@ -0,0 +1,157 @@
+/**
+ * Tests for no-sensitive-payload rule
+ */
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { describe, it, afterAll } from 'vitest';
+import parser from '@typescript-eslint/parser';
+import { noSensitivePayload } from './index';
+
+RuleTester.afterAll = afterAll;
+RuleTester.it = it;
+RuleTester.itOnly = it.only;
+RuleTester.describe = describe;
+
+const ruleTester = new RuleTester({
+  languageOptions: {
+    parser,
+    ecmaVersion: 2022,
+    sourceType: 'module',
+  },
+});
+
+describe('no-sensitive-payload', () => {
+  describe('Valid Code - Safe Payloads', () => {
+    ruleTester.run('valid - standard claims', noSensitivePayload, {
+      valid: [
+        // Standard JWT claims
+        { code: `jwt.sign({ sub: 'user123', role: 'admin' }, secret);` },
+        { code: `jwt.sign({ userId: '123', permissions: [] }, secret);` },
+        { code: `jwt.sign({ sub: 'user', iss: 'auth', aud: 'api', exp: 123 }, secret);` },
+        // Variable reference (cannot analyze)
+        { code: `jwt.sign(payload, secret);` },
+        // Verify operation (not checked)
+        { code: `jwt.verify(token, secret);` },
+        // No arguments
+        { code: `jwt.sign();` },
+        // Non-JWT sign function
+        { code: `sign(payload, secret);` },
+        // Similar but non-sensitive names
+        { code: `jwt.sign({ passwordResetToken: false }, secret);` },
+        { code: `jwt.sign({ emailVerified: true }, secret);` },
+        { code: `jwt.sign({ phoneVerified: true }, secret);` },
+      ],
+      invalid: [],
+    });
+  });
+
+  describe('Invalid Code - Password Fields', () => {
+    ruleTester.run('invalid - password variations', noSensitivePayload, {
+      valid: [],
+      invalid: [
+        { code: `jwt.sign({ password: 'secret123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ passwd: 'abc' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ pwd: '123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ pass: 'xyz' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+      ],
+    });
+  });
+
+  describe('Invalid Code - PII Fields', () => {
+    ruleTester.run('invalid - personal identifiable information', noSensitivePayload, {
+      valid: [],
+      invalid: [
+        // Email
+        { code: `jwt.sign({ email: 'user@example.com' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ emailAddress: 'user@test.com' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // Phone
+        { code: `jwt.sign({ phone: '555-1234' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ phoneNumber: '1234567890' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // SSN
+        { code: `jwt.sign({ ssn: '123-45-6789' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // Address
+        { code: `jwt.sign({ address: '123 Main St' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // DOB
+        { code: `jwt.sign({ dob: '1990-01-01' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ dateOfBirth: '1990-01-01' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+      ],
+    });
+  });
+
+  describe('Invalid Code - Financial Fields', () => {
+    ruleTester.run('invalid - financial data', noSensitivePayload, {
+      valid: [],
+      invalid: [
+        // Credit card (camelCase)
+        { code: `jwt.sign({ creditCard: '4111111111111111' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // Credit card (snake_case)
+        { code: `jwt.sign({ credit_card: '4111111111111111' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // Card number
+        { code: `jwt.sign({ cardNumber: '1234' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // CVV
+        { code: `jwt.sign({ cvv: '123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ cvc: '456' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // PIN
+        { code: `jwt.sign({ pin: '1234' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // Bank account
+        { code: `jwt.sign({ bankAccount: '123456' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ accountNumber: '789' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ routingNumber: '111' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+      ],
+    });
+  });
+
+  describe('Invalid Code - API Keys and Secrets', () => {
+    ruleTester.run('invalid - secrets and keys', noSensitivePayload, {
+      valid: [],
+      invalid: [
+        // API key variations
+        { code: `jwt.sign({ apiKey: 'sk_live_123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ api_key: 'sk_live_123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // Secret
+        { code: `jwt.sign({ secret: 'abc123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // Token fields
+        { code: `jwt.sign({ accessToken: 'abc123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ refreshToken: 'xyz789' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ bearerToken: 'bearer123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        // Private key
+        { code: `jwt.sign({ privateKey: '-----BEGIN RSA' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+        { code: `jwt.sign({ secretKey: 'key123' }, secret);`, errors: [{ messageId: 'sensitivePayloadField' }] },
+      ],
+    });
+  });
+
+  describe('Invalid Code - Multiple Sensitive Fields', () => {
+    ruleTester.run('invalid - multiple violations', noSensitivePayload, {
+      valid: [],
+      invalid: [
+        // Two sensitive fields - should report both
+        {
+          code: `jwt.sign({ email: 'user@test.com', phone: '555-1234' }, secret);`,
+          errors: [
+            { messageId: 'sensitivePayloadField' },
+            { messageId: 'sensitivePayloadField' },
+          ],
+        },
+        // Mixed valid and invalid
+        {
+          code: `jwt.sign({ sub: 'user', password: 'secret' }, secret);`,
+          errors: [{ messageId: 'sensitivePayloadField' }],
+        },
+      ],
+    });
+  });
+
+  describe('Edge Cases - Custom Configuration', () => {
+    ruleTester.run('custom sensitive fields', noSensitivePayload, {
+      valid: [],
+      invalid: [
+        // Test additionalSensitiveFields option
+        {
+          code: `jwt.sign({ customSecret: 'value' }, secret);`,
+          options: [{ additionalSensitiveFields: ['customsecret'] }],
+          errors: [{ messageId: 'sensitivePayloadField' }],
+        },
+      ],
+    });
+  });
+});