eslint-plugin-jwt-security 2.3.0

package/src/rules/no-algorithm-none/index.ts

@@ -0,0 +1,270 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+
+/**
+ * ESLint Rule: no-algorithm-none
+ *
+ * Detects attempts to use the 'none' algorithm which bypasses JWT signature verification.
+ * This is a critical vulnerability (CVE-2022-23540) that allows attackers to forge JWT tokens.
+ *
+ * CWE-347: Improper Verification of Cryptographic Signature
+ *
+ * @see https://nvd.nist.gov/vuln/detail/CVE-2022-23540
+ * @see https://tools.ietf.org/html/rfc8725
+ */
+import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
+import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
+import {
+  isVerifyOperation,
+  isSignOperation,
+  getOptionsArgument,
+  isTestFile,
+} from '../../utils';
+import type { NoAlgorithmNoneOptions } from '../../types';
+
+type MessageIds =
+  | 'algorithmNone'
+  | 'algorithmNoneInArray'
+  | 'emptyAlgorithms'
+  | 'useSecureAlgorithm'
+  | 'decodeWithoutVerify';
+
+type RuleOptions = [NoAlgorithmNoneOptions?];
+
+export const noAlgorithmNone = createRule<RuleOptions, MessageIds>({
+  name: 'no-algorithm-none',
+  meta: {
+    type: 'problem',
+    docs: {
+      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-none.md',
+      description:
+        'Disallow JWT "none" algorithm which bypasses signature verification (CVE-2022-23540)',
+      cwe: 'CWE-347',
+      cvss: 9.5,
+      confidence: 'high',
+    },
+    fixable: undefined,
+    hasSuggestions: false,
+    messages: {
+      algorithmNone: formatLLMMessage({
+        icon: MessageIcons.SECURITY,
+        issueName: 'JWT Algorithm None Attack',
+        cwe: 'CWE-347',
+        description:
+          'Using alg:"none" bypasses signature verification, allowing token forgery',
+        severity: 'CRITICAL',
+        fix: 'Remove "none" and use RS256, ES256, or other secure algorithms',
+        documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23540',
+      }),
+      algorithmNoneInArray: formatLLMMessage({
+        icon: MessageIcons.SECURITY,
+        issueName: 'JWT Algorithm None in Whitelist',
+        cwe: 'CWE-347',
+        description:
+          'Including "none" in algorithms array allows unsigned tokens',
+        severity: 'CRITICAL',
+        fix: 'Remove "none" from the algorithms array',
+        documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23540',
+      }),
+      emptyAlgorithms: formatLLMMessage({
+        icon: MessageIcons.SECURITY,
+        issueName: 'Empty Algorithms Array',
+        cwe: 'CWE-347',
+        description:
+          'Empty algorithms array may default to accepting any algorithm including none',
+        severity: 'HIGH',
+        fix: 'Specify explicit algorithms: ["RS256"] or ["ES256"]',
+        documentationLink: 'https://tools.ietf.org/html/rfc8725',
+      }),
+      useSecureAlgorithm: formatLLMMessage({
+        icon: MessageIcons.INFO,
+        issueName: 'Use Secure Algorithm',
+        description: 'Replace with a secure algorithm',
+        severity: 'LOW',
+        fix: 'Use algorithms: ["RS256"] or algorithms: ["ES256"]',
+        documentationLink: 'https://tools.ietf.org/html/rfc8725',
+      }),
+      decodeWithoutVerify: formatLLMMessage({
+        icon: MessageIcons.SECURITY,
+        issueName: 'JWT Decode Without Verify',
+        cwe: 'CWE-347',
+        description:
+          'jwt.decode() does NOT verify the signature — using its result as if it were authenticated is functionally equivalent to algorithm:"none". Any token, including forged ones, will decode.',
+        severity: 'CRITICAL',
+        fix: 'Use jwt.verify(token, secret, { algorithms: ["RS256"] }) instead. Reserve jwt.decode() for non-security inspection only (e.g. logging the issuer).',
+        documentationLink: 'https://github.com/auth0/node-jsonwebtoken#jwtdecodetoken--options',
+      }),
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          allowInTests: {
+            type: 'boolean',
+            default: false,
+            description: 'Allow "none" algorithm in test files',
+          },
+          trustedSanitizers: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          trustedAnnotations: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          strictMode: {
+            type: 'boolean',
+            default: false,
+          },
+        },
+        additionalProperties: false,
+      },
+    ],
+  },
+  defaultOptions: [
+    {
+      allowInTests: false,
+      trustedSanitizers: [],
+      trustedAnnotations: [],
+      strictMode: false,
+    },
+  ],
+  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
+    const options = context.options[0] ?? {};
+    const { allowInTests = false } = options;
+    const filename = context.filename;
+
+    // Skip test files if configured
+    if (allowInTests && isTestFile(filename)) {
+      return {};
+    }
+
+    /**
+     * Check if an algorithm value is 'none' (case insensitive)
+     */
+    // oxlint-disable-next-line consistent-function-scoping
+    const isNoneAlgorithm = (value: string): boolean => {
+      return value.toLowerCase() === 'none';
+    };
+
+    /**
+     * Check options object for 'none' algorithm
+     */
+    const checkOptionsForNone = (
+      optionsNode: TSESTree.ObjectExpression
+    ): void => {
+      for (const prop of optionsNode.properties) {
+        if (prop.type !== 'Property' || prop.key.type !== 'Identifier') {
+          continue;
+        }
+
+        const keyName = prop.key.name;
+        if (
+          keyName !== 'algorithms' &&
+          keyName !== 'algorithm' &&
+          keyName !== 'alg'
+        ) {
+          continue;
+        }
+
+        // Single algorithm: { algorithm: 'none' }
+        if (
+          prop.value.type === 'Literal' &&
+          typeof prop.value.value === 'string'
+        ) {
+          if (isNoneAlgorithm(prop.value.value)) {
+            context.report({
+              node: prop.value,
+              messageId: 'algorithmNone',
+            });
+          }
+        }
+
+        // Array of algorithms: { algorithms: ['none'] } or { algorithms: [] }
+        if (prop.value.type === 'ArrayExpression') {
+          // Check for empty array
+          if (prop.value.elements.length === 0) {
+            context.report({
+              node: prop.value,
+              messageId: 'emptyAlgorithms',
+            });
+            continue;
+          }
+
+          // Check each element for 'none'
+          for (const elem of prop.value.elements) {
+            if (
+              elem &&
+              elem.type === 'Literal' &&
+              typeof elem.value === 'string' &&
+              isNoneAlgorithm(elem.value)
+            ) {
+              context.report({
+                node: elem,
+                messageId: 'algorithmNoneInArray',
+              });
+            }
+          }
+        }
+      }
+    };
+
+    /**
+     * Detect `jwt.decode()` calls — closes the audit FN where
+     * `jwt.decode(token)` followed by trusting the decoded payload was
+     * silent, despite being functionally equivalent to algorithm:"none".
+     * See benchmarks/AUDIT_PATTERNS.md §3.8 ("verify-then-trust mismatch").
+     *
+     * The check is conservative: we flag every `jwt.decode()` call. In
+     * the rare case where `decode` is used legitimately (e.g. logging
+     * the issuer of an inbound token without authentication semantics),
+     * the user can disable the rule on that line. The default-on
+     * behaviour is correct — most production uses of `jwt.decode` are
+     * authentication mistakes.
+     */
+    // oxlint-disable-next-line consistent-function-scoping
+    function isDecodeCall(node: TSESTree.CallExpression): boolean {
+      const callee = node.callee;
+      if (callee.type !== 'MemberExpression') return false;
+      if (callee.property.type !== 'Identifier') return false;
+      if (callee.property.name !== 'decode') return false;
+      // Object should be `jwt` (or imported as such). Check both
+      // `jwt.decode` and `JWT.decode` patterns.
+      if (callee.object.type === 'Identifier') {
+        const name = callee.object.name.toLowerCase();
+        return name === 'jwt' || name === 'jsonwebtoken';
+      }
+      return false;
+    }
+
+    return {
+      CallExpression(node: TSESTree.CallExpression) {
+        // Detect `jwt.decode(...)` — equivalent to algorithm:"none" if
+        // its result is trusted. We always flag (with critical severity)
+        // because the FN risk far outweighs the FP risk on real code.
+        if (isDecodeCall(node)) {
+          context.report({ node, messageId: 'decodeWithoutVerify' });
+          return;
+        }
+
+        // Check both verify and sign operations
+        if (!isVerifyOperation(node) && !isSignOperation(node)) {
+          return;
+        }
+
+        // Get options argument (usually 3rd argument)
+        const optionsArg = getOptionsArgument(node, 2);
+        if (optionsArg) {
+          checkOptionsForNone(optionsArg);
+        }
+      },
+    };
+  },
+});
+
+export default noAlgorithmNone;

package/src/rules/no-algorithm-none/no-algorithm-none.test.ts

@@ -0,0 +1,146 @@
+/**
+ * Tests for no-algorithm-none rule
+ * Security: CWE-347 (CVE-2022-23540)
+ */
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { describe, it, afterAll } from 'vitest';
+import parser from '@typescript-eslint/parser';
+import { noAlgorithmNone } from './index';
+
+// Configure RuleTester for Vitest
+RuleTester.afterAll = afterAll;
+RuleTester.it = it;
+RuleTester.itOnly = it.only;
+RuleTester.describe = describe;
+
+const ruleTester = new RuleTester({
+  languageOptions: {
+    parser,
+    ecmaVersion: 2022,
+    sourceType: 'module',
+  },
+});
+
+describe('no-algorithm-none', () => {
+  describe('Valid Code - Secure Algorithms', () => {
+    ruleTester.run('valid - secure algorithms', noAlgorithmNone, {
+      valid: [
+        // RS256 - RSA with SHA-256
+        { code: `jwt.verify(token, publicKey, { algorithms: ['RS256'] });` },
+        // ES256 - ECDSA with SHA-256
+        { code: `jwt.verify(token, publicKey, { algorithms: ['ES256'] });` },
+        // Multiple secure algorithms
+        { code: `jwt.verify(token, key, { algorithms: ['RS256', 'RS384', 'RS512'] });` },
+        // Single algorithm option
+        { code: `jwt.verify(token, secret, { algorithm: 'HS256' });` },
+        // jose library
+        { code: `jwtVerify(token, key, { algorithms: ['RS256'] });` },
+        // No options (doesn't trigger this rule)
+        { code: `jwt.verify(token, secret);` },
+        // Sign operation with secure algorithm
+        { code: `jwt.sign(payload, secret, { algorithm: 'RS256' });` },
+        // Spread operator in options (edge case - line 143 coverage)
+        { code: `jwt.verify(token, key, { ...opts, algorithms: ['RS256'] });` },
+        // Non-algorithm properties (line 152 coverage)
+        { code: `jwt.verify(token, key, { issuer: 'auth', complete: true });` },
+        // Options without algorithms (different property names)
+        { code: `jwt.sign(payload, secret, { expiresIn: '1h', subject: 'user' });` },
+        // Variable algorithms (not literal)
+        { code: `jwt.verify(token, key, { algorithms: allowedAlgorithms });` },
+        // Array with non-literal elements
+        { code: `jwt.verify(token, key, { algorithms: [defaultAlg] });` },
+        // Non-string literal in array
+        { code: `jwt.verify(token, key, { algorithms: [123] });` },
+        // Non-JWT function call - edge case (line 199 coverage)
+        { code: `console.log('hello');` },
+        { code: `someOtherFunction(token, key, { algorithm: 'none' });` },
+      ],
+      invalid: [],
+    });
+  });
+
+  describe('Invalid Code - Algorithm None', () => {
+    ruleTester.run('invalid - algorithm none', noAlgorithmNone, {
+      valid: [],
+      invalid: [
+        // Direct 'none' algorithm
+        {
+          code: `jwt.verify(token, secret, { algorithm: 'none' });`,
+          errors: [{ messageId: 'algorithmNone' }],
+        },
+        // 'none' in algorithms array (single element - gets replaced)
+        {
+          code: `jwt.verify(token, secret, { algorithms: ['none'] });`,
+          errors: [{ messageId: 'algorithmNoneInArray' }],
+        },
+        // 'none' mixed with other algorithms (no auto-fix for removal)
+        {
+          code: `jwt.verify(token, secret, { algorithms: ['RS256', 'none'] });`,
+          errors: [{ messageId: 'algorithmNoneInArray' }],
+        },
+        // Case insensitive - 'None'
+        {
+          code: `jwt.verify(token, secret, { algorithm: 'None' });`,
+          errors: [{ messageId: 'algorithmNone' }],
+        },
+        // Case insensitive - 'NONE'
+        {
+          code: `jwt.verify(token, secret, { algorithms: ['NONE'] });`,
+          errors: [{ messageId: 'algorithmNoneInArray' }],
+        },
+        // alg shorthand
+        {
+          code: `jwt.verify(token, secret, { alg: 'none' });`,
+          errors: [{ messageId: 'algorithmNone' }],
+        },
+        // Empty algorithms array
+        {
+          code: `jwt.verify(token, secret, { algorithms: [] });`,
+          errors: [{ messageId: 'emptyAlgorithms' }],
+        },
+        // Sign operation with none
+        {
+          code: `jwt.sign(payload, secret, { algorithm: 'none' });`,
+          errors: [{ messageId: 'algorithmNone' }],
+        },
+        // jose library
+        {
+          code: `jwtVerify(token, key, { algorithms: ['none'] });`,
+          errors: [{ messageId: 'algorithmNoneInArray' }],
+        },
+        // signJWT with none
+        {
+          code: `signJWT(payload, key, { algorithm: 'none' });`,
+          errors: [{ messageId: 'algorithmNone' }],
+        },
+      ],
+    });
+  });
+
+  describe('Configuration Options', () => {
+    ruleTester.run('config - allowInTests', noAlgorithmNone, {
+      valid: [
+        // Test file with allowInTests enabled
+        {
+          code: `jwt.verify(token, secret, { algorithm: 'none' });`,
+          options: [{ allowInTests: true }],
+          filename: 'auth.test.ts',
+        },
+        {
+          code: `jwt.verify(token, secret, { algorithm: 'none' });`,
+          options: [{ allowInTests: true }],
+          filename: '__tests__/jwt.ts',
+        },
+      ],
+      invalid: [
+        // Non-test file with allowInTests
+        {
+          code: `jwt.verify(token, secret, { algorithm: 'none' });`,
+          options: [{ allowInTests: true }],
+          filename: 'auth.ts',
+          errors: [{ messageId: 'algorithmNone' }],
+        },
+      ],
+    });
+  });
+});

package/src/rules/no-decode-without-verify/index.ts

@@ -0,0 +1,162 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+
+/**
+ * ESLint Rule: no-decode-without-verify
+ *
+ * Detects usage of jwt.decode() or jwt-decode library without corresponding
+ * verification. Decoded JWTs can be tampered with by attackers.
+ *
+ * CWE-345: Insufficient Verification of Data Authenticity
+ *
+ * @see https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/10-Testing_JSON_Web_Tokens
+ */
+import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
+import { createRule, formatLLMMessage, MessageIcons, hasSafeAnnotation } from '@interlace/eslint-devkit';
+import { isDecodeOperation } from '../../utils';
+import type { NoDecodeWithoutVerifyOptions } from '../../types';
+
+type MessageIds =
+  | 'decodeWithoutVerify'
+  | 'jwtDecodeLibrary'
+  | 'useVerifyInstead';
+
+type RuleOptions = [NoDecodeWithoutVerifyOptions?];
+
+export const noDecodeWithoutVerify = createRule<RuleOptions, MessageIds>({
+  name: 'no-decode-without-verify',
+  meta: {
+    type: 'problem',
+    docs: {
+      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-decode-without-verify.md',
+      description:
+        'Disallow trusting decoded JWT payload without signature verification',
+      cwe: 'CWE-345',
+      cvss: 7.5,
+    },
+    fixable: undefined,
+    hasSuggestions: false,
+    messages: {
+      decodeWithoutVerify: formatLLMMessage({
+        icon: MessageIcons.SECURITY,
+        issueName: 'Decoded JWT Without Verification',
+        cwe: 'CWE-345',
+        description:
+          'jwt.decode() returns payload without verifying signature - data can be forged',
+        severity: 'HIGH',
+        fix: 'Use jwt.verify(token, secret) instead of jwt.decode(token)',
+        documentationLink:
+          'https://owasp.org/API-Security/0xa7-security-misconfiguration/',
+      }),
+      jwtDecodeLibrary: formatLLMMessage({
+        icon: MessageIcons.SECURITY,
+        issueName: 'jwt-decode Library Usage',
+        cwe: 'CWE-345',
+        description:
+          'jwt-decode library only decodes tokens, never verifies signatures',
+        severity: 'HIGH',
+        fix: 'Use jsonwebtoken.verify() or jose.jwtVerify() for verification',
+        documentationLink: 'https://www.npmjs.com/package/jwt-decode',
+      }),
+      useVerifyInstead: formatLLMMessage({
+        icon: MessageIcons.INFO,
+        issueName: 'Use Verify Instead',
+        description: 'Replace decode with verify to ensure authenticity',
+        severity: 'LOW',
+        fix: 'jwt.verify(token, secret, { algorithms: ["RS256"] })',
+        documentationLink: 'https://www.npmjs.com/package/jsonwebtoken',
+      }),
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          allowHeaderInspection: {
+            type: 'boolean',
+            default: false,
+            description:
+              'Allow decode() for reading header before verification',
+          },
+          trustedSanitizers: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          trustedAnnotations: {
+            type: 'array',
+            items: { type: 'string' },
+            default: ['@decoded-header-only', '@verified-separately'],
+          },
+          strictMode: {
+            type: 'boolean',
+            default: false,
+          },
+        },
+        additionalProperties: false,
+      },
+    ],
+  },
+  defaultOptions: [
+    {
+      allowHeaderInspection: false,
+      trustedSanitizers: [],
+      trustedAnnotations: ['@decoded-header-only', '@verified-separately'],
+      strictMode: false,
+    },
+  ],
+  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
+    const options = context.options[0] ?? {};
+    const { trustedAnnotations = [] } = options;
+
+    /**
+     * Check if this is a jwt-decode import usage
+     */
+    // oxlint-disable-next-line consistent-function-scoping
+    const isJwtDecodeLibrary = (node: TSESTree.CallExpression): boolean => {
+      // Direct call: jwtDecode(token)
+      if (
+        node.callee.type === 'Identifier' &&
+        (node.callee.name === 'jwtDecode' || node.callee.name === 'jwt_decode')
+      ) {
+        return true;
+      }
+      return false;
+    };
+
+    return {
+      CallExpression(node: TSESTree.CallExpression) {
+        // Check for jwt.decode() pattern
+        if (isDecodeOperation(node)) {
+          // Check for safe annotations
+          if (hasSafeAnnotation(node, context, trustedAnnotations)) {
+            return;
+          }
+
+          context.report({
+            node,
+            messageId: 'decodeWithoutVerify',
+          });
+          return;
+        }
+
+        // Check for jwt-decode library usage
+        if (isJwtDecodeLibrary(node)) {
+          // Check for safe annotations
+          if (hasSafeAnnotation(node, context, trustedAnnotations)) {
+            return;
+          }
+
+          context.report({
+            node,
+            messageId: 'jwtDecodeLibrary',
+          });
+        }
+      },
+    };
+  },
+});
+
+export default noDecodeWithoutVerify;

package/src/rules/no-decode-without-verify/no-decode-without-verify.test.ts

@@ -0,0 +1,76 @@
+/**
+ * Tests for no-decode-without-verify rule
+ * Security: CWE-345 (Data Authenticity)
+ */
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { describe, it, afterAll } from 'vitest';
+import parser from '@typescript-eslint/parser';
+import { noDecodeWithoutVerify } from './index';
+
+RuleTester.afterAll = afterAll;
+RuleTester.it = it;
+RuleTester.itOnly = it.only;
+RuleTester.describe = describe;
+
+const ruleTester = new RuleTester({
+  languageOptions: {
+    parser,
+    ecmaVersion: 2022,
+    sourceType: 'module',
+  },
+});
+
+describe('no-decode-without-verify', () => {
+  describe('Valid Code - Verify Operations', () => {
+    ruleTester.run('valid - verify operations', noDecodeWithoutVerify, {
+      valid: [
+        // jwt.verify is safe
+        { code: `const payload = jwt.verify(token, secret);` },
+        { code: `jwt.verify(token, publicKey, { algorithms: ['RS256'] });` },
+        // jose jwtVerify is safe
+        { code: `const { payload } = await jwtVerify(token, key);` },
+        // sign is not flagged
+        { code: `jwt.sign(payload, secret);` },
+      ],
+      invalid: [],
+    });
+  });
+
+  describe('Invalid Code - Decode Operations', () => {
+    ruleTester.run('invalid - decode without verify', noDecodeWithoutVerify, {
+      valid: [],
+      invalid: [
+        // Basic jwt.decode()
+        {
+          code: `const payload = jwt.decode(token);`,
+          errors: [{ messageId: 'decodeWithoutVerify' }],
+        },
+        // decode with options
+        {
+          code: `const decoded = jwt.decode(token, { complete: true });`,
+          errors: [{ messageId: 'decodeWithoutVerify' }],
+        },
+        // Using payload directly
+        {
+          code: `const userId = jwt.decode(token).sub;`,
+          errors: [{ messageId: 'decodeWithoutVerify' }],
+        },
+        // jwt-decode library - jwtDecode pattern
+        {
+          code: `const payload = jwtDecode(accessToken);`,
+          errors: [{ messageId: 'decodeWithoutVerify' }],
+        },
+        // jwt-decode library - jwt_decode pattern (snake_case import)
+        {
+          code: `const payload = jwt_decode(accessToken);`,
+          errors: [{ messageId: 'jwtDecodeLibrary' }],
+        },
+        // jose decodeJwt (decode only)
+        {
+          code: `const payload = decodeJWT(token);`,
+          errors: [{ messageId: 'decodeWithoutVerify' }],
+        },
+      ],
+    });
+  });
+});