eslint-plugin-jwt-security 2.3.0

package/dist/src/utils/index.js

@@ -0,0 +1,238 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JWT_METHODS = exports.SENSITIVE_PAYLOAD_FIELDS = exports.SECURE_ALGORITHMS = exports.SYMMETRIC_ALGORITHMS = exports.INSECURE_ALGORITHMS = exports.JWT_LIBRARIES = void 0;
+exports.isJwtLibraryCall = isJwtLibraryCall;
+exports.isStringLiteral = isStringLiteral;
+exports.extractAlgorithms = extractAlgorithms;
+exports.hasOption = hasOption;
+exports.getOptionValue = getOptionValue;
+exports.isWeakSecret = isWeakSecret;
+exports.isEnvVariable = isEnvVariable;
+exports.isSignOperation = isSignOperation;
+exports.isVerifyOperation = isVerifyOperation;
+exports.isDecodeOperation = isDecodeOperation;
+exports.getOptionsArgument = getOptionsArgument;
+exports.isTestFile = isTestFile;
+/**
+ * Supported JWT libraries
+ */
+exports.JWT_LIBRARIES = {
+    JSONWEBTOKEN: 'jsonwebtoken',
+    JOSE: 'jose',
+    EXPRESS_JWT: 'express-jwt',
+    NESTJS_JWT: '@nestjs/jwt',
+    JWKS_RSA: 'jwks-rsa',
+    JWT_DECODE: 'jwt-decode',
+};
+/**
+ * Insecure algorithms that should be flagged
+ */
+exports.INSECURE_ALGORITHMS = new Set([
+    'none',
+    'None',
+    'NONE',
+    'HS256', // Only insecure when used with public keys
+    'HS384',
+    'HS512',
+]);
+/**
+ * Algorithms vulnerable to confusion attacks when used with asymmetric keys
+ */
+exports.SYMMETRIC_ALGORITHMS = new Set(['HS256', 'HS384', 'HS512']);
+/**
+ * Recommended secure algorithms
+ */
+exports.SECURE_ALGORITHMS = new Set([
+    'RS256',
+    'RS384',
+    'RS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'EdDSA',
+]);
+/**
+ * Sensitive field names that should not be in JWT payload
+ * All lowercase for case-insensitive matching
+ */
+exports.SENSITIVE_PAYLOAD_FIELDS = new Set([
+    // Passwords
+    'password', 'passwd', 'pwd', 'pass', 'secret',
+    // API Keys
+    'apikey', 'api_key', 'api-key',
+    'apisecret', 'api_secret', 'api-secret',
+    // Tokens
+    'accesstoken', 'access_token', 'access-token',
+    'refreshtoken', 'refresh_token', 'refresh-token',
+    'bearertoken', 'bearer_token', 'bearer-token',
+    // Keys
+    'privatekey', 'private_key', 'private-key',
+    'secretkey', 'secret_key', 'secret-key',
+    // PII - Personal Identifiable Information
+    'email', 'emailaddress', 'email_address', 'email-address',
+    'phone', 'phonenumber', 'phone_number', 'phone-number',
+    'ssn', 'socialsecuritynumber', 'social_security_number',
+    'dob', 'dateofbirth', 'date_of_birth', 'birthdate',
+    'address', 'streetaddress', 'street_address',
+    // Financial
+    'creditcard', 'credit_card', 'credit-card',
+    'cardnumber', 'card_number', 'card-number',
+    'cvv', 'cvc', 'securitycode', 'security_code',
+    'pin', 'pincode', 'pin_code',
+    'bankaccount', 'bank_account', 'bank-account',
+    'accountnumber', 'account_number', 'account-number',
+    'routingnumber', 'routing_number', 'routing-number',
+]);
+/**
+ * JWT method patterns for different operations
+ */
+exports.JWT_METHODS = {
+    SIGN: new Set(['sign', 'signJWT', 'SignJWT']),
+    VERIFY: new Set(['verify', 'verifyJWT', 'jwtVerify']),
+    DECODE: new Set(['decode', 'jwtDecode', 'decodeJWT']),
+};
+/**
+ * Check if a node represents a call to a JWT library method
+ */
+function isJwtLibraryCall(node, targetMethods) {
+    // Check member expression: jwt.verify(), jose.jwtVerify()
+    if (node.callee.type === 'MemberExpression') {
+        const property = node.callee.property;
+        if (property.type === 'Identifier') {
+            return targetMethods.has(property.name);
+        }
+    }
+    // Check direct calls: jwtVerify(), jwtDecode()
+    if (node.callee.type === 'Identifier') {
+        return targetMethods.has(node.callee.name);
+    }
+    return false;
+}
+/**
+ * Check if a node is a string literal with a specific value
+ */
+function isStringLiteral(node, value) {
+    if (node.type !== 'Literal' || typeof node.value !== 'string') {
+        return false;
+    }
+    return value === undefined || node.value === value;
+}
+/**
+ * Extract algorithm from options object
+ */
+function extractAlgorithms(optionsNode) {
+    const algorithms = [];
+    for (const prop of optionsNode.properties) {
+        if (prop.type !== 'Property' || prop.key.type !== 'Identifier') {
+            continue;
+        }
+        const keyName = prop.key.name;
+        if (keyName !== 'algorithms' && keyName !== 'algorithm' && keyName !== 'alg') {
+            continue;
+        }
+        // Single algorithm: { algorithm: 'HS256' }
+        if (prop.value.type === 'Literal' && typeof prop.value.value === 'string') {
+            algorithms.push(prop.value.value);
+        }
+        // Array of algorithms: { algorithms: ['RS256', 'ES256'] }
+        if (prop.value.type === 'ArrayExpression') {
+            for (const elem of prop.value.elements) {
+                if (elem && elem.type === 'Literal' && typeof elem.value === 'string') {
+                    algorithms.push(elem.value);
+                }
+            }
+        }
+    }
+    return algorithms;
+}
+/**
+ * Check if options object has a specific property set
+ */
+function hasOption(optionsNode, optionName) {
+    return optionsNode.properties.some((prop) => prop.type === 'Property' &&
+        prop.key.type === 'Identifier' &&
+        prop.key.name === optionName);
+}
+/**
+ * Get the value of a specific option from options object
+ */
+function getOptionValue(optionsNode, optionName) {
+    for (const prop of optionsNode.properties) {
+        if (prop.type === 'Property' &&
+            prop.key.type === 'Identifier' &&
+            prop.key.name === optionName) {
+            return prop.value;
+        }
+    }
+    return undefined;
+}
+/**
+ * Check if a literal appears to be a weak secret (short string)
+ */
+function isWeakSecret(node, minLength = 32) {
+    if (node.type === 'Literal' && typeof node.value === 'string') {
+        return node.value.length < minLength;
+    }
+    return false;
+}
+/**
+ * Check if a node is an environment variable access (safe pattern)
+ */
+function isEnvVariable(node) {
+    // process.env.JWT_SECRET
+    if (node.type === 'MemberExpression' &&
+        node.object.type === 'MemberExpression' &&
+        node.object.object.type === 'Identifier' &&
+        node.object.object.name === 'process' &&
+        node.object.property.type === 'Identifier' &&
+        node.object.property.name === 'env') {
+        return true;
+    }
+    return false;
+}
+/**
+ * Check if this call looks like a JWT sign operation
+ */
+function isSignOperation(node) {
+    return isJwtLibraryCall(node, exports.JWT_METHODS.SIGN);
+}
+/**
+ * Check if this call looks like a JWT verify operation
+ */
+function isVerifyOperation(node) {
+    return isJwtLibraryCall(node, exports.JWT_METHODS.VERIFY);
+}
+/**
+ * Check if this call looks like a JWT decode operation (no verification)
+ */
+function isDecodeOperation(node) {
+    return isJwtLibraryCall(node, exports.JWT_METHODS.DECODE);
+}
+/**
+ * Get the options argument from a JWT call
+ * For jwt.verify(token, secret, options) -> returns options
+ * For jwt.sign(payload, secret, options) -> returns options
+ */
+function getOptionsArgument(node, optionsIndex = 2) {
+    const arg = node.arguments[optionsIndex];
+    if (arg && arg.type === 'ObjectExpression') {
+        return arg;
+    }
+    return undefined;
+}
+/**
+ * Check if file is a test file
+ */
+function isTestFile(filename) {
+    return /\.(test|spec)\.[jt]sx?$/.test(filename) ||
+        /__(tests?|mocks?)__/.test(filename) ||
+        /\/(tests?|specs?|__tests__)\//.test(filename);
+}

package/package.json

@@ -0,0 +1,125 @@
+{
+  "name": "eslint-plugin-jwt-security",
+  "version": "2.3.0",
+  "description": "ESLint plugin for JWT security \u2014 detects algorithm confusion (CVE-2022-23540), alg:none, weak or hardcoded secrets, and decode-without-verify.",
+  "type": "commonjs",
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    },
+    "./types": {
+      "types": "./src/types/index.d.ts",
+      "default": "./src/types/index.js"
+    },
+    "./oxlint": {
+      "types": "./src/oxlint.d.ts",
+      "default": "./src/oxlint.js"
+    }
+  },
+  "author": "Ofri Peretz <ofriperetzdev@gmail.com>",
+  "license": "MIT",
+  "homepage": "https://eslint.interlace.tools/docs/security/plugin-jwt-security?utm_source=npm&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security-security",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ofri-peretz/eslint",
+    "directory": "packages/eslint-plugin-jwt-security"
+  },
+  "bugs": {
+    "url": "https://github.com/ofri-peretz/eslint/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "src/",
+    "dist/",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "AGENTS.md"
+  ],
+  "keywords": [
+    "eslint",
+    "eslintplugin",
+    "eslint-plugin",
+    "static-analysis",
+    "linting",
+    "code-quality",
+    "security",
+    "sast",
+    "appsec",
+    "vulnerability",
+    "owasp",
+    "cwe",
+    "interlace-security",
+    "jwt",
+    "json-web-token",
+    "jwt-security",
+    "jsonwebtoken",
+    "jose",
+    "express-jwt",
+    "nestjs-jwt",
+    "jwks-rsa",
+    "jwt-decode",
+    "algorithm-confusion",
+    "cve-2022-23540",
+    "cwe-347",
+    "cwe-757",
+    "token",
+    "authentication",
+    "authorization",
+    "llm-optimized",
+    "ai-assistant",
+    "typescript",
+    "auto-fix",
+    "auth-security",
+    "token-security"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "tslib": "^2.3.0",
+    "@interlace/eslint-devkit": "^1.4.3"
+  },
+  "peerDependencies": {
+    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
+  },
+  "peerDependenciesMeta": {
+    "jsonwebtoken": {
+      "optional": true
+    },
+    "@nestjs/jwt": {
+      "optional": true
+    },
+    "express-jwt": {
+      "optional": true
+    },
+    "jose": {
+      "optional": true
+    },
+    "jwks-rsa": {
+      "optional": true
+    },
+    "jwt-decode": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@typescript-eslint/parser": "^8.46.2",
+    "@typescript-eslint/rule-tester": "^8.46.2"
+  },
+  "scripts": {
+    "build": "tsx ../../scripts/build-package.ts",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc -p tsconfig.lib.json --noEmit"
+  },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/ofri-peretz/eslint"
+  }
+}

package/src/__compatibility__/jwt-interface.spec.ts

@@ -0,0 +1,192 @@
+/**
+ * JWT Ecosystem Interface Compatibility Tests
+ *
+ * Verifies that JWT-related packages export the interfaces our ESLint rules depend on.
+ *
+ * @sdk jsonwebtoken, jose, express-jwt, jwks-rsa, jwt-decode
+ * @last-updated 2026-01-02
+ */
+
+import { describe, it, expect, beforeAll } from 'vitest';
+
+// Use unknown types to avoid ESM/CJS type conflicts at compile time
+// Runtime checks handle the actual exports
+let jsonwebtokenModule: unknown;
+let joseModule: unknown;
+let jwtDecodeModule: unknown;
+
+// Helper to safely access properties on unknown types
+const getProp = (obj: unknown, key: string): unknown => {
+  if (obj && typeof obj === 'object' && key in obj) {
+    return (obj as Record<string, unknown>)[key];
+  }
+  return undefined;
+};
+
+beforeAll(async () => {
+  try {
+    jsonwebtokenModule = await import('jsonwebtoken');
+  } catch {
+    console.warn('jsonwebtoken not installed');
+  }
+  try {
+    joseModule = await import('jose');
+  } catch {
+    console.warn('jose not installed');
+  }
+  try {
+    jwtDecodeModule = await import('jwt-decode');
+  } catch {
+    console.warn('jwt-decode not installed');
+  }
+}, 30_000); // native-addon packages can take >10s to load cold
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// JSONWEBTOKEN INTERFACE
+// Primary package for JWT operations in Node.js
+// ═══════════════════════════════════════════════════════════════════════════════
+
+describe('jsonwebtoken Interface Compatibility', () => {
+  describe('Core Exports', () => {
+    it('exports sign function', () => {
+      const sign = getProp(jsonwebtokenModule, 'sign');
+      expect(sign).toBeDefined();
+      expect(typeof sign).toBe('function');
+    });
+
+    it('exports verify function', () => {
+      const verify = getProp(jsonwebtokenModule, 'verify');
+      expect(verify).toBeDefined();
+      expect(typeof verify).toBe('function');
+    });
+
+    it('exports decode function', () => {
+      const decode = getProp(jsonwebtokenModule, 'decode');
+      expect(decode).toBeDefined();
+      expect(typeof decode).toBe('function');
+    });
+  });
+
+  describe('Sign Options (Critical for Security Rules)', () => {
+    it('sign accepts algorithm option', () => {
+      // Rules check: no-algorithm-none, require-algorithm-whitelist
+      expect(getProp(jsonwebtokenModule, 'sign')).toBeDefined();
+    });
+
+    it('sign accepts expiresIn option', () => {
+      // Rules check: require-expiration
+      expect(getProp(jsonwebtokenModule, 'sign')).toBeDefined();
+    });
+
+    it('sign accepts audience option', () => {
+      // Rules check: require-audience
+      expect(getProp(jsonwebtokenModule, 'sign')).toBeDefined();
+    });
+
+    it('sign accepts issuer option', () => {
+      // Rules check: require-issuer
+      expect(getProp(jsonwebtokenModule, 'sign')).toBeDefined();
+    });
+  });
+
+  describe('Verify Options (Critical for Security Rules)', () => {
+    it('verify accepts algorithms option (array)', () => {
+      // Rules check: verify-algorithm-explicit
+      expect(getProp(jsonwebtokenModule, 'verify')).toBeDefined();
+    });
+
+    it('verify accepts complete option', () => {
+      // Returns full decoded token with header
+      expect(getProp(jsonwebtokenModule, 'verify')).toBeDefined();
+    });
+  });
+});
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// JOSE INTERFACE
+// Modern JWT library with async/await support
+// ═══════════════════════════════════════════════════════════════════════════════
+
+describe('jose Interface Compatibility', () => {
+  describe('Core Exports', () => {
+    it('exports SignJWT class', () => {
+      expect(getProp(joseModule, 'SignJWT')).toBeDefined();
+    });
+
+    it('exports jwtVerify function', () => {
+      const jwtVerify = getProp(joseModule, 'jwtVerify');
+      expect(jwtVerify).toBeDefined();
+      expect(typeof jwtVerify).toBe('function');
+    });
+
+    it('exports jwtDecrypt function', () => {
+      const jwtDecrypt = getProp(joseModule, 'jwtDecrypt');
+      expect(jwtDecrypt).toBeDefined();
+      expect(typeof jwtDecrypt).toBe('function');
+    });
+
+    it('exports createRemoteJWKSet function', () => {
+      // Used for JWKS validation
+      const createRemoteJWKSet = getProp(joseModule, 'createRemoteJWKSet');
+      expect(createRemoteJWKSet).toBeDefined();
+      expect(typeof createRemoteJWKSet).toBe('function');
+    });
+  });
+
+  describe('Key Generation', () => {
+    it('exports generateKeyPair function', () => {
+      expect(getProp(joseModule, 'generateKeyPair')).toBeDefined();
+    });
+
+    it('exports generateSecret function', () => {
+      expect(getProp(joseModule, 'generateSecret')).toBeDefined();
+    });
+  });
+});
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// JWT-DECODE INTERFACE
+// Client-side JWT decoding (no verification)
+// ═══════════════════════════════════════════════════════════════════════════════
+
+describe('jwt-decode Interface Compatibility', () => {
+  describe('Core Exports', () => {
+    it('exports jwtDecode function', () => {
+      // Can be either named export or default export depending on version
+      const jwtDecode = getProp(jwtDecodeModule, 'jwtDecode') ?? getProp(jwtDecodeModule, 'default');
+      expect(jwtDecode).toBeDefined();
+    });
+
+    it('exports InvalidTokenError', () => {
+      expect(getProp(jwtDecodeModule, 'InvalidTokenError')).toBeDefined();
+    });
+  });
+});
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// PACKAGE METADATA
+// ═══════════════════════════════════════════════════════════════════════════════
+
+describe('Package Metadata', () => {
+  it('jsonwebtoken has discoverable version', async () => {
+    try {
+      const pkgPath = require.resolve('jsonwebtoken/package.json');
+      const pkg = await import(pkgPath, { with: { type: 'json' } }).then(m => m.default);
+      expect(pkg.version).toBeDefined();
+      console.log(`📦 jsonwebtoken version: ${pkg.version}`);
+    } catch {
+      console.log('📦 jsonwebtoken not installed');
+    }
+  });
+
+  it('jose has discoverable version', async () => {
+    try {
+      const pkgPath = require.resolve('jose/package.json');
+      const pkg = await import(pkgPath, { with: { type: 'json' } }).then(m => m.default);
+      expect(pkg.version).toBeDefined();
+      console.log(`📦 jose version: ${pkg.version}`);
+    } catch {
+      console.log('📦 jose not installed');
+    }
+  });
+});

package/src/index.test.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect } from 'vitest';
+import plugin from './index';
+import { rules, configs } from './index';
+
+describe('eslint-plugin-jwt-security plugin interface', () => {
+  it('should export correct meta information', () => {
+    expect(plugin.meta).toBeDefined();
+    expect(plugin.meta?.name).toBe('eslint-plugin-jwt-security');
+    expect(plugin.meta?.version).toBeDefined();
+  });
+
+  it('should export all JWT security rules', () => {
+    expect(plugin.rules).toBeDefined();
+    const ruleNames = Object.keys(plugin.rules || {});
+    expect(ruleNames).toContain('no-algorithm-none');
+    expect(ruleNames).toContain('no-algorithm-confusion');
+    expect(ruleNames).toContain('no-timestamp-manipulation');
+    expect(ruleNames.length).toBe(13);
+  });
+
+  describe('configurations', () => {
+    it('should provide recommended configuration', () => {
+      expect(configs.recommended).toBeDefined();
+      expect(configs.recommended.plugins?.jwt).toBeDefined();
+      
+      const recommendedRules = configs.recommended.rules || {};
+      Object.keys(recommendedRules).forEach(ruleName => {
+        expect(ruleName).toMatch(/^jwt\//);
+      });
+      
+      expect(recommendedRules['jwt/no-algorithm-none']).toBe('error');
+    });
+
+    it('should provide strict configuration', () => {
+      expect(configs.strict).toBeDefined();
+      expect(configs.strict.plugins?.jwt).toBeDefined();
+      
+      const strictRules = configs.strict.rules || {};
+      Object.keys(strictRules).forEach(ruleName => {
+        expect(ruleName).toMatch(/^jwt\//);
+      });
+      
+      expect(strictRules['jwt/no-algorithm-none']).toBe('error');
+      expect(Object.keys(strictRules).length).toBe(Object.keys(rules).length);
+    });
+  });
+});