eslint-plugin-jwt-security 2.3.1 → 2.3.3

package/README.md

@@ -81,7 +81,7 @@ By structuring errors with specific CWE codes, OWASP categories, and direct fix
 ## 📦 Compatibility
 | Package | Version |
 | :--- | :--- |
-| ESLint | `^8.0.0 \|\| ^9.0.0 \|\| ^10.0.0` |
+| ESLint | `^8.40.0 \|\| ^9.0.0 \|\| ^10.0.0` |
 | Node.js | `>=18.0.0` |
 
 See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md) — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-jwt-security",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "description": "ESLint plugin for JWT security — detects algorithm confusion (CVE-2022-23540), alg:none, weak or hardcoded secrets, and decode-without-verify.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -79,10 +79,10 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@interlace/eslint-devkit": "^1.8.0"
+    "@interlace/eslint-devkit": "^1.11.0"
   },
   "peerDependencies": {
-    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",
+    "eslint": "^8.40.0 || ^9.0.0 || ^10.0.0",
     "jsonwebtoken": "^8.0.0 || ^9.0.0",
     "@nestjs/jwt": "^9.0.0 || ^10.0.0 || ^11.0.0",
     "express-jwt": "^7.0.0 || ^8.0.0",

package/src/index.js

@@ -1,118 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noSensitivePayload = exports.requireMaxAge = exports.noTimestampManipulation = exports.requireAudienceValidation = exports.requireIssuerValidation = exports.requireIssuedAt = exports.noHardcodedSecret = exports.requireExpiration = exports.noWeakSecret = exports.noDecodeWithoutVerify = exports.requireAlgorithmWhitelist = exports.noAlgorithmConfusion = exports.noAlgorithmNone = exports.configs = exports.plugin = exports.rules = void 0;
-const no_algorithm_none_1 = require("./rules/no-algorithm-none");
-Object.defineProperty(exports, "noAlgorithmNone", { enumerable: true, get: function () { return no_algorithm_none_1.noAlgorithmNone; } });
-const no_algorithm_confusion_1 = require("./rules/no-algorithm-confusion");
-Object.defineProperty(exports, "noAlgorithmConfusion", { enumerable: true, get: function () { return no_algorithm_confusion_1.noAlgorithmConfusion; } });
-const require_algorithm_whitelist_1 = require("./rules/require-algorithm-whitelist");
-Object.defineProperty(exports, "requireAlgorithmWhitelist", { enumerable: true, get: function () { return require_algorithm_whitelist_1.requireAlgorithmWhitelist; } });
-const no_decode_without_verify_1 = require("./rules/no-decode-without-verify");
-Object.defineProperty(exports, "noDecodeWithoutVerify", { enumerable: true, get: function () { return no_decode_without_verify_1.noDecodeWithoutVerify; } });
-const no_weak_secret_1 = require("./rules/no-weak-secret");
-Object.defineProperty(exports, "noWeakSecret", { enumerable: true, get: function () { return no_weak_secret_1.noWeakSecret; } });
-const require_expiration_1 = require("./rules/require-expiration");
-Object.defineProperty(exports, "requireExpiration", { enumerable: true, get: function () { return require_expiration_1.requireExpiration; } });
-const no_hardcoded_secret_1 = require("./rules/no-hardcoded-secret");
-Object.defineProperty(exports, "noHardcodedSecret", { enumerable: true, get: function () { return no_hardcoded_secret_1.noHardcodedSecret; } });
-const require_issued_at_1 = require("./rules/require-issued-at");
-Object.defineProperty(exports, "requireIssuedAt", { enumerable: true, get: function () { return require_issued_at_1.requireIssuedAt; } });
-const require_issuer_validation_1 = require("./rules/require-issuer-validation");
-Object.defineProperty(exports, "requireIssuerValidation", { enumerable: true, get: function () { return require_issuer_validation_1.requireIssuerValidation; } });
-const require_audience_validation_1 = require("./rules/require-audience-validation");
-Object.defineProperty(exports, "requireAudienceValidation", { enumerable: true, get: function () { return require_audience_validation_1.requireAudienceValidation; } });
-const no_timestamp_manipulation_1 = require("./rules/no-timestamp-manipulation");
-Object.defineProperty(exports, "noTimestampManipulation", { enumerable: true, get: function () { return no_timestamp_manipulation_1.noTimestampManipulation; } });
-const require_max_age_1 = require("./rules/require-max-age");
-Object.defineProperty(exports, "requireMaxAge", { enumerable: true, get: function () { return require_max_age_1.requireMaxAge; } });
-const no_sensitive_payload_1 = require("./rules/no-sensitive-payload");
-Object.defineProperty(exports, "noSensitivePayload", { enumerable: true, get: function () { return no_sensitive_payload_1.noSensitivePayload; } });
-exports.rules = {
-    get 'no-algorithm-none'() { return require("./rules/no-algorithm-none").noAlgorithmNone; },
-    get 'no-algorithm-confusion'() { return require("./rules/no-algorithm-confusion").noAlgorithmConfusion; },
-    get 'require-algorithm-whitelist'() { return require("./rules/require-algorithm-whitelist").requireAlgorithmWhitelist; },
-    get 'no-decode-without-verify'() { return require("./rules/no-decode-without-verify").noDecodeWithoutVerify; },
-    get 'no-weak-secret'() { return require("./rules/no-weak-secret").noWeakSecret; },
-    get 'require-expiration'() { return require("./rules/require-expiration").requireExpiration; },
-    get 'no-hardcoded-secret'() { return require("./rules/no-hardcoded-secret").noHardcodedSecret; },
-    get 'require-issued-at'() { return require("./rules/require-issued-at").requireIssuedAt; },
-    get 'require-issuer-validation'() { return require("./rules/require-issuer-validation").requireIssuerValidation; },
-    get 'require-audience-validation'() { return require("./rules/require-audience-validation").requireAudienceValidation; },
-    get 'no-timestamp-manipulation'() { return require("./rules/no-timestamp-manipulation").noTimestampManipulation; },
-    get 'require-max-age'() { return require("./rules/require-max-age").requireMaxAge; },
-    get 'no-sensitive-payload'() { return require("./rules/no-sensitive-payload").noSensitivePayload; },
-
-};
-exports.plugin = {
-    meta: {
-        name: 'eslint-plugin-jwt-security',
-        version: '2.3.1',
-    },
-    rules: exports.rules,
-};
-const recommendedRules = {
-    'jwt/no-algorithm-none': 'error',
-    'jwt/no-algorithm-confusion': 'error',
-    'jwt/require-algorithm-whitelist': 'error',
-    'jwt/no-decode-without-verify': 'error',
-    'jwt/no-weak-secret': 'error',
-    'jwt/no-hardcoded-secret': 'error',
-    'jwt/no-timestamp-manipulation': 'error',
-    'jwt/require-expiration': 'error',
-    'jwt/no-sensitive-payload': 'warn',
-};
-const strictRules = {
-    'jwt/no-algorithm-none': 'error',
-    'jwt/no-algorithm-confusion': 'error',
-    'jwt/require-algorithm-whitelist': 'error',
-    'jwt/no-decode-without-verify': 'error',
-    'jwt/no-weak-secret': 'error',
-    'jwt/no-hardcoded-secret': 'error',
-    'jwt/require-expiration': 'error',
-    'jwt/require-issued-at': 'error',
-    'jwt/require-issuer-validation': 'error',
-    'jwt/require-audience-validation': 'error',
-    'jwt/no-timestamp-manipulation': 'error',
-    'jwt/require-max-age': 'error',
-    'jwt/no-sensitive-payload': 'error',
-};
-const legacyRules = {
-    'jwt/no-algorithm-none': 'error',
-    'jwt/no-algorithm-confusion': 'error',
-    'jwt/no-hardcoded-secret': 'warn',
-};
-exports.configs = {
-    flagship: {
-        plugins: {
-            jwt: exports.plugin,
-        },
-        rules: {
-            'jwt/no-algorithm-none': 'error',
-        },
-    },
-    recommended: {
-        plugins: {
-            jwt: exports.plugin,
-        },
-        rules: recommendedRules,
-    },
-    strict: {
-        plugins: {
-            jwt: exports.plugin,
-        },
-        rules: strictRules,
-    },
-    legacy: {
-        plugins: {
-            jwt: exports.plugin,
-        },
-        rules: legacyRules,
-    },
-    all: {
-        plugins: {
-            jwt: exports.plugin,
-        },
-        rules: strictRules,
-    },
-};
-exports.default = exports.plugin;
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noSensitivePayload=exports.requireMaxAge=exports.noTimestampManipulation=exports.requireAudienceValidation=exports.requireIssuerValidation=exports.requireIssuedAt=exports.noHardcodedSecret=exports.requireExpiration=exports.noWeakSecret=exports.noDecodeWithoutVerify=exports.requireAlgorithmWhitelist=exports.noAlgorithmConfusion=exports.noAlgorithmNone=exports.configs=exports.plugin=exports.rules=void 0;const no_algorithm_none_1=require("./rules/no-algorithm-none");Object.defineProperty(exports,"noAlgorithmNone",{enumerable:true,get:function(){return no_algorithm_none_1.noAlgorithmNone}});const no_algorithm_confusion_1=require("./rules/no-algorithm-confusion");Object.defineProperty(exports,"noAlgorithmConfusion",{enumerable:true,get:function(){return no_algorithm_confusion_1.noAlgorithmConfusion}});const require_algorithm_whitelist_1=require("./rules/require-algorithm-whitelist");Object.defineProperty(exports,"requireAlgorithmWhitelist",{enumerable:true,get:function(){return require_algorithm_whitelist_1.requireAlgorithmWhitelist}});const no_decode_without_verify_1=require("./rules/no-decode-without-verify");Object.defineProperty(exports,"noDecodeWithoutVerify",{enumerable:true,get:function(){return no_decode_without_verify_1.noDecodeWithoutVerify}});const no_weak_secret_1=require("./rules/no-weak-secret");Object.defineProperty(exports,"noWeakSecret",{enumerable:true,get:function(){return no_weak_secret_1.noWeakSecret}});const require_expiration_1=require("./rules/require-expiration");Object.defineProperty(exports,"requireExpiration",{enumerable:true,get:function(){return require_expiration_1.requireExpiration}});const no_hardcoded_secret_1=require("./rules/no-hardcoded-secret");Object.defineProperty(exports,"noHardcodedSecret",{enumerable:true,get:function(){return no_hardcoded_secret_1.noHardcodedSecret}});const require_issued_at_1=require("./rules/require-issued-at");Object.defineProperty(exports,"requireIssuedAt",{enumerable:true,get:function(){return require_issued_at_1.requireIssuedAt}});const require_issuer_validation_1=require("./rules/require-issuer-validation");Object.defineProperty(exports,"requireIssuerValidation",{enumerable:true,get:function(){return require_issuer_validation_1.requireIssuerValidation}});const require_audience_validation_1=require("./rules/require-audience-validation");Object.defineProperty(exports,"requireAudienceValidation",{enumerable:true,get:function(){return require_audience_validation_1.requireAudienceValidation}});const no_timestamp_manipulation_1=require("./rules/no-timestamp-manipulation");Object.defineProperty(exports,"noTimestampManipulation",{enumerable:true,get:function(){return no_timestamp_manipulation_1.noTimestampManipulation}});const require_max_age_1=require("./rules/require-max-age");Object.defineProperty(exports,"requireMaxAge",{enumerable:true,get:function(){return require_max_age_1.requireMaxAge}});const no_sensitive_payload_1=require("./rules/no-sensitive-payload");Object.defineProperty(exports,"noSensitivePayload",{enumerable:true,get:function(){return no_sensitive_payload_1.noSensitivePayload}});exports.rules={get"no-algorithm-none"(){return require("./rules/no-algorithm-none").noAlgorithmNone},get"no-algorithm-confusion"(){return require("./rules/no-algorithm-confusion").noAlgorithmConfusion},get"require-algorithm-whitelist"(){return require("./rules/require-algorithm-whitelist").requireAlgorithmWhitelist},get"no-decode-without-verify"(){return require("./rules/no-decode-without-verify").noDecodeWithoutVerify},get"no-weak-secret"(){return require("./rules/no-weak-secret").noWeakSecret},get"require-expiration"(){return require("./rules/require-expiration").requireExpiration},get"no-hardcoded-secret"(){return require("./rules/no-hardcoded-secret").noHardcodedSecret},get"require-issued-at"(){return require("./rules/require-issued-at").requireIssuedAt},get"require-issuer-validation"(){return require("./rules/require-issuer-validation").requireIssuerValidation},get"require-audience-validation"(){return require("./rules/require-audience-validation").requireAudienceValidation},get"no-timestamp-manipulation"(){return require("./rules/no-timestamp-manipulation").noTimestampManipulation},get"require-max-age"(){return require("./rules/require-max-age").requireMaxAge},get"no-sensitive-payload"(){return require("./rules/no-sensitive-payload").noSensitivePayload}};exports.plugin={meta:{name:"eslint-plugin-jwt-security",version:"2.3.3"},rules:exports.rules};const recommendedRules={"jwt/no-algorithm-none":"error","jwt/no-algorithm-confusion":"error","jwt/require-algorithm-whitelist":"error","jwt/no-decode-without-verify":"error","jwt/no-weak-secret":"error","jwt/no-hardcoded-secret":"error","jwt/no-timestamp-manipulation":"error","jwt/require-expiration":"error","jwt/no-sensitive-payload":"warn"};const strictRules={"jwt/no-algorithm-none":"error","jwt/no-algorithm-confusion":"error","jwt/require-algorithm-whitelist":"error","jwt/no-decode-without-verify":"error","jwt/no-weak-secret":"error","jwt/no-hardcoded-secret":"error","jwt/require-expiration":"error","jwt/require-issued-at":"error","jwt/require-issuer-validation":"error","jwt/require-audience-validation":"error","jwt/no-timestamp-manipulation":"error","jwt/require-max-age":"error","jwt/no-sensitive-payload":"error"};const legacyRules={"jwt/no-algorithm-none":"error","jwt/no-algorithm-confusion":"error","jwt/no-hardcoded-secret":"warn"};exports.configs={flagship:{plugins:{jwt:exports.plugin},rules:{"jwt/no-algorithm-none":"error"}},recommended:{plugins:{jwt:exports.plugin},rules:recommendedRules},strict:{plugins:{jwt:exports.plugin},rules:strictRules},legacy:{plugins:{jwt:exports.plugin},rules:legacyRules},all:{plugins:{jwt:exports.plugin},rules:strictRules}};exports.default=exports.plugin;

package/src/oxlint.js

@@ -1,3 +1 @@
-"use strict";
-const index_1 = require("./index");
-module.exports = index_1.plugin;
+"use strict";const index_1=require("./index");module.exports=index_1.plugin;

package/src/rules/no-algorithm-confusion/index.js

@@ -1,145 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noAlgorithmConfusion = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-const PUBLIC_KEY_PATTERNS = [
-    /public/i,
-    /\.pub$/,
-    /\.pem$/,
-    /-----BEGIN PUBLIC KEY-----/,
-    /-----BEGIN RSA PUBLIC KEY-----/,
-    /-----BEGIN EC PUBLIC KEY-----/,
-    /getPublicKey/i,
-    /publicKey/i,
-    /jwks/i,
-];
-exports.noAlgorithmConfusion = (0, eslint_devkit_1.createRule)({
-    name: 'no-algorithm-confusion',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-confusion.md',
-            description: 'Prevent algorithm confusion attacks using symmetric algorithms with asymmetric keys',
-            cwe: 'CWE-347',
-            cvss: 9.5,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            algorithmConfusion: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'JWT Algorithm Confusion Attack',
-                cwe: 'CWE-347',
-                description: 'Symmetric algorithm (HS*) used with public key allows token forgery',
-                severity: 'CRITICAL',
-                fix: 'Use asymmetric algorithms (RS256, ES256) with public keys',
-                documentationLink: 'https://portswigger.net/web-security/jwt/algorithm-confusion',
-            }),
-            symmetricWithPublicKey: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Symmetric Algorithm with Public Key',
-                cwe: 'CWE-347',
-                description: 'HS256/384/512 should only be used with shared secrets, not public keys',
-                severity: 'CRITICAL',
-                fix: 'Switch to RS256 or ES256 for asymmetric key verification',
-                documentationLink: 'https://portswigger.net/web-security/jwt/algorithm-confusion',
-            }),
-            useAsymmetricAlgorithm: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Asymmetric Algorithm',
-                description: 'Replace HS* with RS* or ES* algorithm',
-                severity: 'LOW',
-                fix: 'Use RS256 or ES256 with public key verification',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    symmetricAlgorithms: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['HS256', 'HS384', 'HS512'],
-                        description: 'Algorithms to flag when used with public keys',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            symmetricAlgorithms: ['HS256', 'HS384', 'HS512'],
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] ?? {};
-        const symmetricAlgSet = new Set(options.symmetricAlgorithms ?? ['HS256', 'HS384', 'HS512']);
-        const sourceCode = context.sourceCode;
-        const looksLikePublicKey = (node) => {
-            const text = sourceCode.getText(node);
-            return PUBLIC_KEY_PATTERNS.some((pattern) => pattern.test(text));
-        };
-        const hasSymmetricAlgorithm = (algorithms) => {
-            for (const alg of algorithms) {
-                if (symmetricAlgSet.has(alg)) {
-                    return alg;
-                }
-            }
-            return null;
-        };
-        return {
-            CallExpression(node) {
-                if (!(0, utils_1.isVerifyOperation)(node)) {
-                    return;
-                }
-                if (node.arguments.length < 2) {
-                    return;
-                }
-                const keyArg = node.arguments[1];
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                if (!looksLikePublicKey(keyArg)) {
-                    return;
-                }
-                if (optionsArg) {
-                    const algorithms = (0, utils_1.extractAlgorithms)(optionsArg);
-                    const symmetricAlg = hasSymmetricAlgorithm(algorithms);
-                    if (symmetricAlg) {
-                        for (const prop of optionsArg.properties) {
-                            if (prop.type === 'Property' &&
-                                prop.key.type === 'Identifier' &&
-                                ['algorithms', 'algorithm', 'alg'].includes(prop.key.name)) {
-                                context.report({
-                                    node: prop.value,
-                                    messageId: 'algorithmConfusion',
-                                    data: { algorithm: symmetricAlg },
-                                });
-                                return;
-                            }
-                        }
-                    }
-                }
-            },
-        };
-    },
-});
-exports.default = exports.noAlgorithmConfusion;
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noAlgorithmConfusion=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");const PUBLIC_KEY_PATTERNS=[/public/i,/\.pub$/,/\.pem$/,/-----BEGIN PUBLIC KEY-----/,/-----BEGIN RSA PUBLIC KEY-----/,/-----BEGIN EC PUBLIC KEY-----/,/getPublicKey/i,/publicKey/i,/jwks/i];exports.noAlgorithmConfusion=(0,eslint_devkit_1.createRule)({name:"no-algorithm-confusion",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-confusion.md",description:"Prevent algorithm confusion attacks using symmetric algorithms with asymmetric keys",cwe:"CWE-347",cvss:9.5},fixable:void 0,hasSuggestions:false,messages:{algorithmConfusion:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"JWT Algorithm Confusion Attack",cwe:"CWE-347",description:"Symmetric algorithm (HS*) used with public key allows token forgery",severity:"CRITICAL",fix:"Use asymmetric algorithms (RS256, ES256) with public keys",documentationLink:"https://portswigger.net/web-security/jwt/algorithm-confusion"}),symmetricWithPublicKey:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Symmetric Algorithm with Public Key",cwe:"CWE-347",description:"HS256/384/512 should only be used with shared secrets, not public keys",severity:"CRITICAL",fix:"Switch to RS256 or ES256 for asymmetric key verification",documentationLink:"https://portswigger.net/web-security/jwt/algorithm-confusion"}),useAsymmetricAlgorithm:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Asymmetric Algorithm",description:"Replace HS* with RS* or ES* algorithm",severity:"LOW",fix:"Use RS256 or ES256 with public key verification",documentationLink:"https://tools.ietf.org/html/rfc8725"})},schema:[{type:"object",properties:{symmetricAlgorithms:{type:"array",items:{type:"string"},default:["HS256","HS384","HS512"],description:"Algorithms to flag when used with public keys"},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:[]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{symmetricAlgorithms:["HS256","HS384","HS512"],trustedSanitizers:[],trustedAnnotations:[],strictMode:false}],create(context){const options=context.options[0]??{};const symmetricAlgSet=new Set(options.symmetricAlgorithms??["HS256","HS384","HS512"]);const sourceCode=context.sourceCode;const looksLikePublicKey=node=>{const text=sourceCode.getText(node);return PUBLIC_KEY_PATTERNS.some(pattern=>pattern.test(text))};const hasSymmetricAlgorithm=algorithms=>{for(const alg of algorithms){if(symmetricAlgSet.has(alg)){return alg}}return null};return{CallExpression(node){if(!(0,utils_1.isVerifyOperation)(node)){return}if(node.arguments.length<2){return}const keyArg=node.arguments[1];const optionsArg=(0,utils_1.getOptionsArgument)(node,2);if(!looksLikePublicKey(keyArg)){return}if(optionsArg){const algorithms=(0,utils_1.extractAlgorithms)(optionsArg);const symmetricAlg=hasSymmetricAlgorithm(algorithms);if(symmetricAlg){for(const prop of optionsArg.properties){if(prop.type==="Property"&&prop.key.type==="Identifier"&&["algorithms","algorithm","alg"].includes(prop.key.name)){context.report({node:prop.value,messageId:"algorithmConfusion",data:{algorithm:symmetricAlg}});return}}}}}}}});exports.default=exports.noAlgorithmConfusion;

package/src/rules/no-algorithm-none/index.js

@@ -1,184 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noAlgorithmNone = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.noAlgorithmNone = (0, eslint_devkit_1.createRule)({
-    name: 'no-algorithm-none',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-none.md',
-            description: 'Disallow JWT "none" algorithm which bypasses signature verification (CVE-2022-23540)',
-            cwe: 'CWE-347',
-            cvss: 9.5,
-            confidence: 'high',
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            algorithmNone: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'JWT Algorithm None Attack',
-                cwe: 'CWE-347',
-                description: 'Using alg:"none" bypasses signature verification, allowing token forgery',
-                severity: 'CRITICAL',
-                fix: 'Remove "none" and use RS256, ES256, or other secure algorithms',
-                documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23540',
-            }),
-            algorithmNoneInArray: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'JWT Algorithm None in Whitelist',
-                cwe: 'CWE-347',
-                description: 'Including "none" in algorithms array allows unsigned tokens',
-                severity: 'CRITICAL',
-                fix: 'Remove "none" from the algorithms array',
-                documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23540',
-            }),
-            emptyAlgorithms: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Empty Algorithms Array',
-                cwe: 'CWE-347',
-                description: 'Empty algorithms array may default to accepting any algorithm including none',
-                severity: 'HIGH',
-                fix: 'Specify explicit algorithms: ["RS256"] or ["ES256"]',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-            useSecureAlgorithm: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Secure Algorithm',
-                description: 'Replace with a secure algorithm',
-                severity: 'LOW',
-                fix: 'Use algorithms: ["RS256"] or algorithms: ["ES256"]',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-            decodeWithoutVerify: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'JWT Decode Without Verify',
-                cwe: 'CWE-347',
-                description: 'jwt.decode() does NOT verify the signature — using its result as if it were authenticated is functionally equivalent to algorithm:"none". Any token, including forged ones, will decode.',
-                severity: 'CRITICAL',
-                fix: 'Use jwt.verify(token, secret, { algorithms: ["RS256"] }) instead. Reserve jwt.decode() for non-security inspection only (e.g. logging the issuer).',
-                documentationLink: 'https://github.com/auth0/node-jsonwebtoken#jwtdecodetoken--options',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow "none" algorithm in test files',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] ?? {};
-        const { allowInTests = false } = options;
-        const filename = context.filename;
-        if (allowInTests && (0, utils_1.isTestFile)(filename)) {
-            return {};
-        }
-        const isNoneAlgorithm = (value) => {
-            return value.toLowerCase() === 'none';
-        };
-        const checkOptionsForNone = (optionsNode) => {
-            for (const prop of optionsNode.properties) {
-                if (prop.type !== 'Property' || prop.key.type !== 'Identifier') {
-                    continue;
-                }
-                const keyName = prop.key.name;
-                if (keyName !== 'algorithms' &&
-                    keyName !== 'algorithm' &&
-                    keyName !== 'alg') {
-                    continue;
-                }
-                if (prop.value.type === 'Literal' &&
-                    typeof prop.value.value === 'string') {
-                    if (isNoneAlgorithm(prop.value.value)) {
-                        context.report({
-                            node: prop.value,
-                            messageId: 'algorithmNone',
-                        });
-                    }
-                }
-                if (prop.value.type === 'ArrayExpression') {
-                    if (prop.value.elements.length === 0) {
-                        context.report({
-                            node: prop.value,
-                            messageId: 'emptyAlgorithms',
-                        });
-                        continue;
-                    }
-                    for (const elem of prop.value.elements) {
-                        if (elem &&
-                            elem.type === 'Literal' &&
-                            typeof elem.value === 'string' &&
-                            isNoneAlgorithm(elem.value)) {
-                            context.report({
-                                node: elem,
-                                messageId: 'algorithmNoneInArray',
-                            });
-                        }
-                    }
-                }
-            }
-        };
-        function isDecodeCall(node) {
-            const callee = node.callee;
-            if (callee.type !== 'MemberExpression')
-                return false;
-            if (callee.property.type !== 'Identifier')
-                return false;
-            if (callee.property.name !== 'decode')
-                return false;
-            if (callee.object.type === 'Identifier') {
-                const name = callee.object.name.toLowerCase();
-                return name === 'jwt' || name === 'jsonwebtoken';
-            }
-            return false;
-        }
-        return {
-            CallExpression(node) {
-                if (isDecodeCall(node)) {
-                    context.report({ node, messageId: 'decodeWithoutVerify' });
-                    return;
-                }
-                if (!(0, utils_1.isVerifyOperation)(node) && !(0, utils_1.isSignOperation)(node)) {
-                    return;
-                }
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                if (optionsArg) {
-                    checkOptionsForNone(optionsArg);
-                }
-            },
-        };
-    },
-});
-exports.default = exports.noAlgorithmNone;
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noAlgorithmNone=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");exports.noAlgorithmNone=(0,eslint_devkit_1.createRule)({name:"no-algorithm-none",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-none.md",description:'Disallow JWT "none" algorithm which bypasses signature verification (CVE-2022-23540)',cwe:"CWE-347",cvss:9.5,confidence:"high"},fixable:void 0,hasSuggestions:false,messages:{algorithmNone:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"JWT Algorithm None Attack",cwe:"CWE-347",description:'Using alg:"none" bypasses signature verification, allowing token forgery',severity:"CRITICAL",fix:'Remove "none" and use RS256, ES256, or other secure algorithms',documentationLink:"https://nvd.nist.gov/vuln/detail/CVE-2022-23540"}),algorithmNoneInArray:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"JWT Algorithm None in Whitelist",cwe:"CWE-347",description:'Including "none" in algorithms array allows unsigned tokens',severity:"CRITICAL",fix:'Remove "none" from the algorithms array',documentationLink:"https://nvd.nist.gov/vuln/detail/CVE-2022-23540"}),emptyAlgorithms:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Empty Algorithms Array",cwe:"CWE-347",description:"Empty algorithms array may default to accepting any algorithm including none",severity:"HIGH",fix:'Specify explicit algorithms: ["RS256"] or ["ES256"]',documentationLink:"https://tools.ietf.org/html/rfc8725"}),useSecureAlgorithm:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Secure Algorithm",description:"Replace with a secure algorithm",severity:"LOW",fix:'Use algorithms: ["RS256"] or algorithms: ["ES256"]',documentationLink:"https://tools.ietf.org/html/rfc8725"}),decodeWithoutVerify:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"JWT Decode Without Verify",cwe:"CWE-347",description:'jwt.decode() does NOT verify the signature \u2014 using its result as if it were authenticated is functionally equivalent to algorithm:"none". Any token, including forged ones, will decode.',severity:"CRITICAL",fix:'Use jwt.verify(token, secret, { algorithms: ["RS256"] }) instead. Reserve jwt.decode() for non-security inspection only (e.g. logging the issuer).',documentationLink:"https://github.com/auth0/node-jsonwebtoken#jwtdecodetoken--options"})},schema:[{type:"object",properties:{allowInTests:{type:"boolean",default:false,description:'Allow "none" algorithm in test files'},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:[]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{allowInTests:false,trustedSanitizers:[],trustedAnnotations:[],strictMode:false}],create(context){const options=context.options[0]??{};const{allowInTests=false}=options;const filename=context.filename;if(allowInTests&&(0,utils_1.isTestFile)(filename)){return{}}const isNoneAlgorithm=value=>{return value.toLowerCase()==="none"};const checkOptionsForNone=optionsNode=>{for(const prop of optionsNode.properties){if(prop.type!=="Property"||prop.key.type!=="Identifier"){continue}const keyName=prop.key.name;if(keyName!=="algorithms"&&keyName!=="algorithm"&&keyName!=="alg"){continue}if(prop.value.type==="Literal"&&typeof prop.value.value==="string"){if(isNoneAlgorithm(prop.value.value)){context.report({node:prop.value,messageId:"algorithmNone"})}}if(prop.value.type==="ArrayExpression"){if(prop.value.elements.length===0){context.report({node:prop.value,messageId:"emptyAlgorithms"});continue}for(const elem of prop.value.elements){if(elem&&elem.type==="Literal"&&typeof elem.value==="string"&&isNoneAlgorithm(elem.value)){context.report({node:elem,messageId:"algorithmNoneInArray"})}}}}};function isDecodeCall(node){const callee=node.callee;if(callee.type!=="MemberExpression")return false;if(callee.property.type!=="Identifier")return false;if(callee.property.name!=="decode")return false;if(callee.object.type==="Identifier"){const name=callee.object.name.toLowerCase();return name==="jwt"||name==="jsonwebtoken"}return false}return{CallExpression(node){if(isDecodeCall(node)){context.report({node,messageId:"decodeWithoutVerify"});return}if(!(0,utils_1.isVerifyOperation)(node)&&!(0,utils_1.isSignOperation)(node)){return}const optionsArg=(0,utils_1.getOptionsArgument)(node,2);if(optionsArg){checkOptionsForNone(optionsArg)}}}}});exports.default=exports.noAlgorithmNone;

package/src/rules/no-decode-without-verify/index.js

@@ -1,117 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noDecodeWithoutVerify = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.noDecodeWithoutVerify = (0, eslint_devkit_1.createRule)({
-    name: 'no-decode-without-verify',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-decode-without-verify.md',
-            description: 'Disallow trusting decoded JWT payload without signature verification',
-            cwe: 'CWE-345',
-            cvss: 7.5,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            decodeWithoutVerify: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Decoded JWT Without Verification',
-                cwe: 'CWE-345',
-                description: 'jwt.decode() returns payload without verifying signature - data can be forged',
-                severity: 'HIGH',
-                fix: 'Use jwt.verify(token, secret) instead of jwt.decode(token)',
-                documentationLink: 'https://owasp.org/API-Security/0xa7-security-misconfiguration/',
-            }),
-            jwtDecodeLibrary: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'jwt-decode Library Usage',
-                cwe: 'CWE-345',
-                description: 'jwt-decode library only decodes tokens, never verifies signatures',
-                severity: 'HIGH',
-                fix: 'Use jsonwebtoken.verify() or jose.jwtVerify() for verification',
-                documentationLink: 'https://www.npmjs.com/package/jwt-decode',
-            }),
-            useVerifyInstead: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Verify Instead',
-                description: 'Replace decode with verify to ensure authenticity',
-                severity: 'LOW',
-                fix: 'jwt.verify(token, secret, { algorithms: ["RS256"] })',
-                documentationLink: 'https://www.npmjs.com/package/jsonwebtoken',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowHeaderInspection: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow decode() for reading header before verification',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['@decoded-header-only', '@verified-separately'],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowHeaderInspection: false,
-            trustedSanitizers: [],
-            trustedAnnotations: ['@decoded-header-only', '@verified-separately'],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] ?? {};
-        const { trustedAnnotations = [] } = options;
-        const isJwtDecodeLibrary = (node) => {
-            if (node.callee.type === 'Identifier' &&
-                (node.callee.name === 'jwtDecode' || node.callee.name === 'jwt_decode')) {
-                return true;
-            }
-            return false;
-        };
-        return {
-            CallExpression(node) {
-                if ((0, utils_1.isDecodeOperation)(node)) {
-                    if ((0, eslint_devkit_1.hasSafeAnnotation)(node, context, trustedAnnotations)) {
-                        return;
-                    }
-                    context.report({
-                        node,
-                        messageId: 'decodeWithoutVerify',
-                    });
-                    return;
-                }
-                if (isJwtDecodeLibrary(node)) {
-                    if ((0, eslint_devkit_1.hasSafeAnnotation)(node, context, trustedAnnotations)) {
-                        return;
-                    }
-                    context.report({
-                        node,
-                        messageId: 'jwtDecodeLibrary',
-                    });
-                }
-            },
-        };
-    },
-});
-exports.default = exports.noDecodeWithoutVerify;
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noDecodeWithoutVerify=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");exports.noDecodeWithoutVerify=(0,eslint_devkit_1.createRule)({name:"no-decode-without-verify",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-decode-without-verify.md",description:"Disallow trusting decoded JWT payload without signature verification",cwe:"CWE-345",cvss:7.5},fixable:void 0,hasSuggestions:false,messages:{decodeWithoutVerify:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Decoded JWT Without Verification",cwe:"CWE-345",description:"jwt.decode() returns payload without verifying signature - data can be forged",severity:"HIGH",fix:"Use jwt.verify(token, secret) instead of jwt.decode(token)",documentationLink:"https://owasp.org/API-Security/0xa7-security-misconfiguration/"}),jwtDecodeLibrary:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"jwt-decode Library Usage",cwe:"CWE-345",description:"jwt-decode library only decodes tokens, never verifies signatures",severity:"HIGH",fix:"Use jsonwebtoken.verify() or jose.jwtVerify() for verification",documentationLink:"https://www.npmjs.com/package/jwt-decode"}),useVerifyInstead:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Verify Instead",description:"Replace decode with verify to ensure authenticity",severity:"LOW",fix:'jwt.verify(token, secret, { algorithms: ["RS256"] })',documentationLink:"https://www.npmjs.com/package/jsonwebtoken"})},schema:[{type:"object",properties:{allowHeaderInspection:{type:"boolean",default:false,description:"Allow decode() for reading header before verification"},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:["@decoded-header-only","@verified-separately"]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{allowHeaderInspection:false,trustedSanitizers:[],trustedAnnotations:["@decoded-header-only","@verified-separately"],strictMode:false}],create(context){const options=context.options[0]??{};const{trustedAnnotations=[]}=options;const isJwtDecodeLibrary=node=>{if(node.callee.type==="Identifier"&&(node.callee.name==="jwtDecode"||node.callee.name==="jwt_decode")){return true}return false};return{CallExpression(node){if((0,utils_1.isDecodeOperation)(node)){if((0,eslint_devkit_1.hasSafeAnnotation)(node,context,trustedAnnotations)){return}context.report({node,messageId:"decodeWithoutVerify"});return}if(isJwtDecodeLibrary(node)){if((0,eslint_devkit_1.hasSafeAnnotation)(node,context,trustedAnnotations)){return}context.report({node,messageId:"jwtDecodeLibrary"})}}}}});exports.default=exports.noDecodeWithoutVerify;