eslint-plugin-jwt-security 3.0.0 → 3.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +52 -13
- package/package.json +2 -2
- package/src/index.js +1 -1
- package/src/rules/no-sensitive-payload/index.js +1 -1
package/README.md
CHANGED
|
@@ -31,6 +31,45 @@ This plugin provides Security validation for JSON Web Tokens (JWT) implementatio
|
|
|
31
31
|
|
|
32
32
|
**Interlace** fosters **strength through integration**. Instead of stacking isolated rules, we **interlace** security directly into your workflow to create a resilient fabric of code. We believe tools should **guide rather than gatekeep**, providing educational feedback that strengthens the developer with every interaction.
|
|
33
33
|
|
|
34
|
+
<!-- AUTO-GENERATED:DOCTRINE:START - Do not edit manually -->
|
|
35
|
+
|
|
36
|
+
## Why these rules are quiet
|
|
37
|
+
|
|
38
|
+
**Noise creates apathy, and apathy is not a security posture.** A linter that reports
|
|
39
|
+
a thousand things a week gets switched off in a month, and the real finding goes with
|
|
40
|
+
it. So every rule here is built to be worth reading: we would rather miss a finding
|
|
41
|
+
than spend your attention on one that was never real.
|
|
42
|
+
|
|
43
|
+
That is a trade, and it is made deliberately. It costs recall, and we measure what it
|
|
44
|
+
costs rather than assuming it is free.
|
|
45
|
+
|
|
46
|
+
## How the rules decide
|
|
47
|
+
|
|
48
|
+
**Evidence, not names.** A rule fires on what the code *does*, resolved through the
|
|
49
|
+
AST and ESLint's own scope analysis — not on an identifier that happens to contain
|
|
50
|
+
`query`, a method called `setItem`, or a file whose path contains `key`. Every one of
|
|
51
|
+
those was a real false positive in this ecosystem, found by reading our own output on
|
|
52
|
+
open-source projects and fixed with a test that fails on the unfixed rule.
|
|
53
|
+
|
|
54
|
+
Where a rule has known false-positive shapes, its page carries a **Not a finding**
|
|
55
|
+
section: what it deliberately stays quiet on, and what to check first when it fires
|
|
56
|
+
and you disagree.
|
|
57
|
+
|
|
58
|
+
## What you get
|
|
59
|
+
|
|
60
|
+
The rules below. Security rules carry a CWE mapping and, where one is assigned, a
|
|
61
|
+
CVSS score; every rule carries a fix on its message — in prose for a human and as
|
|
62
|
+
structured JSON for an agent. Install it, enable
|
|
63
|
+
`recommended`, and read the findings. If one of them is wrong,
|
|
64
|
+
[open an issue](https://github.com/ofri-peretz/eslint/issues) — a false positive is a
|
|
65
|
+
bug here, not a tuning exercise for you.
|
|
66
|
+
|
|
67
|
+
How that is measured, on which projects, and where it falls short:
|
|
68
|
+
[benchmark methodology](https://github.com/ofri-peretz/eslint/blob/main/BENCHMARK-METHODOLOGY.md)
|
|
69
|
+
and [results](https://github.com/ofri-peretz/eslint/blob/main/BENCHMARK-RESULTS.md).
|
|
70
|
+
|
|
71
|
+
<!-- AUTO-GENERATED:DOCTRINE:END -->
|
|
72
|
+
|
|
34
73
|
## Getting Started
|
|
35
74
|
|
|
36
75
|
- To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-jwt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security), visit [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security). 📚
|
|
@@ -105,19 +144,19 @@ See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md)
|
|
|
105
144
|
<!-- AUTO-GENERATED:RULES_TABLE:START - Do not edit manually -->
|
|
106
145
|
| Rule | CWE | OWASP | CVSS | Description | 🧠 | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
|
|
107
146
|
| :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: | :---: |
|
|
108
|
-
| [no-algorithm-confusion](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/no-algorithm-confusion?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-347 | | | This rule detects algorithm confusion attacks where symmetric algorithms (HS256, HS384, HS512) are used wit… | 🟢 |
|
|
109
|
-
| [no-algorithm-none](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/no-algorithm-none?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-347 | | | This rule detects attempts to use the none algorithm which completely bypasses JWT signature verification | 🟢 |
|
|
110
|
-
| [no-decode-without-verify](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/no-decode-without-verify?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-345 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 |
|
|
111
|
-
| [no-hardcoded-secret](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/no-hardcoded-secret?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-798 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 |
|
|
112
|
-
| [no-sensitive-payload](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/no-sensitive-payload?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-359 | | | JWT payloads are NOT encrypted, only base64-encoded | 🟢 | |
|
|
113
|
-
| [no-timestamp-manipulation](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/no-timestamp-manipulation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-294 | | | This rule detects noTimestamp: true which disables automatic iat (issued at) claim generation | 🟢 |
|
|
114
|
-
| [no-weak-secret](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/no-weak-secret?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-326 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 |
|
|
115
|
-
| [require-algorithm-whitelist](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/require-algorithm-whitelist?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-757 | | | This rule enforces explicit algorithm specification in verify() calls | 🟢 |
|
|
116
|
-
| [require-audience-validation](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/require-audience-validation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-287 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | | | | | |
|
|
117
|
-
| [require-expiration](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/require-expiration?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-613 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 |
|
|
118
|
-
| [require-issued-at](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/require-issued-at?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-294 | | | This rule ensures tokens have the iat claim for freshness validation | 🟢 | | | | | |
|
|
119
|
-
| [require-issuer-validation](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/require-issuer-validation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-287 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | | | | | |
|
|
120
|
-
| [require-max-age](https://eslint.interlace.tools/docs/security/plugin-jwt/rules/require-max-age?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-294 | | | This rule mandates maxAge in verify operations | 🟢 | | | | | |
|
|
147
|
+
| [no-algorithm-confusion](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/no-algorithm-confusion?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-347 | | | This rule detects algorithm confusion attacks where symmetric algorithms (HS256, HS384, HS512) are used wit… | 🟢 | 💼 | | | | |
|
|
148
|
+
| [no-algorithm-none](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/no-algorithm-none?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-347 | | | This rule detects attempts to use the none algorithm which completely bypasses JWT signature verification | 🟢 | 💼 | | | | |
|
|
149
|
+
| [no-decode-without-verify](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/no-decode-without-verify?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-345 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | 💼 | | | | |
|
|
150
|
+
| [no-hardcoded-secret](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/no-hardcoded-secret?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-798 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | 💼 | | | | |
|
|
151
|
+
| [no-sensitive-payload](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/no-sensitive-payload?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-359 | | | JWT payloads are NOT encrypted, only base64-encoded | 🟢 | | ⚠️ | | | |
|
|
152
|
+
| [no-timestamp-manipulation](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/no-timestamp-manipulation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-294 | | | This rule detects noTimestamp: true which disables automatic iat (issued at) claim generation | 🟢 | 💼 | | | | |
|
|
153
|
+
| [no-weak-secret](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/no-weak-secret?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-326 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | 💼 | | | | |
|
|
154
|
+
| [require-algorithm-whitelist](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/require-algorithm-whitelist?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-757 | | | This rule enforces explicit algorithm specification in verify() calls | 🟢 | 💼 | | | | |
|
|
155
|
+
| [require-audience-validation](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/require-audience-validation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-287 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | | | | | |
|
|
156
|
+
| [require-expiration](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/require-expiration?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-613 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | 💼 | | | | |
|
|
157
|
+
| [require-issued-at](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/require-issued-at?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-294 | | | This rule ensures tokens have the iat claim for freshness validation | 🟢 | | | | | |
|
|
158
|
+
| [require-issuer-validation](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/require-issuer-validation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-287 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | | | | | |
|
|
159
|
+
| [require-max-age](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/require-max-age?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-294 | | | This rule mandates maxAge in verify operations | 🟢 | | | | | |
|
|
121
160
|
<!-- AUTO-GENERATED:RULES_TABLE:END -->
|
|
122
161
|
## 🔗 Related ESLint Plugins
|
|
123
162
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "eslint-plugin-jwt-security",
|
|
3
|
-
"version": "3.0.
|
|
3
|
+
"version": "3.0.1",
|
|
4
4
|
"description": "ESLint plugin for JWT security — detects algorithm confusion (CVE-2022-23540), alg:none, weak or hardcoded secrets, and decode-without-verify.",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -79,7 +79,7 @@
|
|
|
79
79
|
"node": ">=18.0.0"
|
|
80
80
|
},
|
|
81
81
|
"dependencies": {
|
|
82
|
-
"@interlace/eslint-devkit": "^1.
|
|
82
|
+
"@interlace/eslint-devkit": "^1.16.0"
|
|
83
83
|
},
|
|
84
84
|
"peerDependencies": {
|
|
85
85
|
"eslint": "^8.40.0 || ^9.0.0 || ^10.0.0",
|
package/src/index.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noSensitivePayload=exports.requireMaxAge=exports.noTimestampManipulation=exports.requireAudienceValidation=exports.requireIssuerValidation=exports.requireIssuedAt=exports.noHardcodedSecret=exports.requireExpiration=exports.noWeakSecret=exports.noDecodeWithoutVerify=exports.requireAlgorithmWhitelist=exports.noAlgorithmConfusion=exports.noAlgorithmNone=exports.configs=exports.plugin=exports.rules=void 0;const no_algorithm_none_1=require("./rules/no-algorithm-none");Object.defineProperty(exports,"noAlgorithmNone",{enumerable:true,get:function(){return no_algorithm_none_1.noAlgorithmNone}});const no_algorithm_confusion_1=require("./rules/no-algorithm-confusion");Object.defineProperty(exports,"noAlgorithmConfusion",{enumerable:true,get:function(){return no_algorithm_confusion_1.noAlgorithmConfusion}});const require_algorithm_whitelist_1=require("./rules/require-algorithm-whitelist");Object.defineProperty(exports,"requireAlgorithmWhitelist",{enumerable:true,get:function(){return require_algorithm_whitelist_1.requireAlgorithmWhitelist}});const no_decode_without_verify_1=require("./rules/no-decode-without-verify");Object.defineProperty(exports,"noDecodeWithoutVerify",{enumerable:true,get:function(){return no_decode_without_verify_1.noDecodeWithoutVerify}});const no_weak_secret_1=require("./rules/no-weak-secret");Object.defineProperty(exports,"noWeakSecret",{enumerable:true,get:function(){return no_weak_secret_1.noWeakSecret}});const require_expiration_1=require("./rules/require-expiration");Object.defineProperty(exports,"requireExpiration",{enumerable:true,get:function(){return require_expiration_1.requireExpiration}});const no_hardcoded_secret_1=require("./rules/no-hardcoded-secret");Object.defineProperty(exports,"noHardcodedSecret",{enumerable:true,get:function(){return no_hardcoded_secret_1.noHardcodedSecret}});const require_issued_at_1=require("./rules/require-issued-at");Object.defineProperty(exports,"requireIssuedAt",{enumerable:true,get:function(){return require_issued_at_1.requireIssuedAt}});const require_issuer_validation_1=require("./rules/require-issuer-validation");Object.defineProperty(exports,"requireIssuerValidation",{enumerable:true,get:function(){return require_issuer_validation_1.requireIssuerValidation}});const require_audience_validation_1=require("./rules/require-audience-validation");Object.defineProperty(exports,"requireAudienceValidation",{enumerable:true,get:function(){return require_audience_validation_1.requireAudienceValidation}});const no_timestamp_manipulation_1=require("./rules/no-timestamp-manipulation");Object.defineProperty(exports,"noTimestampManipulation",{enumerable:true,get:function(){return no_timestamp_manipulation_1.noTimestampManipulation}});const require_max_age_1=require("./rules/require-max-age");Object.defineProperty(exports,"requireMaxAge",{enumerable:true,get:function(){return require_max_age_1.requireMaxAge}});const no_sensitive_payload_1=require("./rules/no-sensitive-payload");Object.defineProperty(exports,"noSensitivePayload",{enumerable:true,get:function(){return no_sensitive_payload_1.noSensitivePayload}});exports.rules={get"no-algorithm-none"(){return require("./rules/no-algorithm-none").noAlgorithmNone},get"no-algorithm-confusion"(){return require("./rules/no-algorithm-confusion").noAlgorithmConfusion},get"require-algorithm-whitelist"(){return require("./rules/require-algorithm-whitelist").requireAlgorithmWhitelist},get"no-decode-without-verify"(){return require("./rules/no-decode-without-verify").noDecodeWithoutVerify},get"no-weak-secret"(){return require("./rules/no-weak-secret").noWeakSecret},get"require-expiration"(){return require("./rules/require-expiration").requireExpiration},get"no-hardcoded-secret"(){return require("./rules/no-hardcoded-secret").noHardcodedSecret},get"require-issued-at"(){return require("./rules/require-issued-at").requireIssuedAt},get"require-issuer-validation"(){return require("./rules/require-issuer-validation").requireIssuerValidation},get"require-audience-validation"(){return require("./rules/require-audience-validation").requireAudienceValidation},get"no-timestamp-manipulation"(){return require("./rules/no-timestamp-manipulation").noTimestampManipulation},get"require-max-age"(){return require("./rules/require-max-age").requireMaxAge},get"no-sensitive-payload"(){return require("./rules/no-sensitive-payload").noSensitivePayload}};exports.plugin={meta:{name:"eslint-plugin-jwt-security",version:"3.0.
|
|
1
|
+
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noSensitivePayload=exports.requireMaxAge=exports.noTimestampManipulation=exports.requireAudienceValidation=exports.requireIssuerValidation=exports.requireIssuedAt=exports.noHardcodedSecret=exports.requireExpiration=exports.noWeakSecret=exports.noDecodeWithoutVerify=exports.requireAlgorithmWhitelist=exports.noAlgorithmConfusion=exports.noAlgorithmNone=exports.configs=exports.plugin=exports.rules=void 0;const no_algorithm_none_1=require("./rules/no-algorithm-none");Object.defineProperty(exports,"noAlgorithmNone",{enumerable:true,get:function(){return no_algorithm_none_1.noAlgorithmNone}});const no_algorithm_confusion_1=require("./rules/no-algorithm-confusion");Object.defineProperty(exports,"noAlgorithmConfusion",{enumerable:true,get:function(){return no_algorithm_confusion_1.noAlgorithmConfusion}});const require_algorithm_whitelist_1=require("./rules/require-algorithm-whitelist");Object.defineProperty(exports,"requireAlgorithmWhitelist",{enumerable:true,get:function(){return require_algorithm_whitelist_1.requireAlgorithmWhitelist}});const no_decode_without_verify_1=require("./rules/no-decode-without-verify");Object.defineProperty(exports,"noDecodeWithoutVerify",{enumerable:true,get:function(){return no_decode_without_verify_1.noDecodeWithoutVerify}});const no_weak_secret_1=require("./rules/no-weak-secret");Object.defineProperty(exports,"noWeakSecret",{enumerable:true,get:function(){return no_weak_secret_1.noWeakSecret}});const require_expiration_1=require("./rules/require-expiration");Object.defineProperty(exports,"requireExpiration",{enumerable:true,get:function(){return require_expiration_1.requireExpiration}});const no_hardcoded_secret_1=require("./rules/no-hardcoded-secret");Object.defineProperty(exports,"noHardcodedSecret",{enumerable:true,get:function(){return no_hardcoded_secret_1.noHardcodedSecret}});const require_issued_at_1=require("./rules/require-issued-at");Object.defineProperty(exports,"requireIssuedAt",{enumerable:true,get:function(){return require_issued_at_1.requireIssuedAt}});const require_issuer_validation_1=require("./rules/require-issuer-validation");Object.defineProperty(exports,"requireIssuerValidation",{enumerable:true,get:function(){return require_issuer_validation_1.requireIssuerValidation}});const require_audience_validation_1=require("./rules/require-audience-validation");Object.defineProperty(exports,"requireAudienceValidation",{enumerable:true,get:function(){return require_audience_validation_1.requireAudienceValidation}});const no_timestamp_manipulation_1=require("./rules/no-timestamp-manipulation");Object.defineProperty(exports,"noTimestampManipulation",{enumerable:true,get:function(){return no_timestamp_manipulation_1.noTimestampManipulation}});const require_max_age_1=require("./rules/require-max-age");Object.defineProperty(exports,"requireMaxAge",{enumerable:true,get:function(){return require_max_age_1.requireMaxAge}});const no_sensitive_payload_1=require("./rules/no-sensitive-payload");Object.defineProperty(exports,"noSensitivePayload",{enumerable:true,get:function(){return no_sensitive_payload_1.noSensitivePayload}});exports.rules={get"no-algorithm-none"(){return require("./rules/no-algorithm-none").noAlgorithmNone},get"no-algorithm-confusion"(){return require("./rules/no-algorithm-confusion").noAlgorithmConfusion},get"require-algorithm-whitelist"(){return require("./rules/require-algorithm-whitelist").requireAlgorithmWhitelist},get"no-decode-without-verify"(){return require("./rules/no-decode-without-verify").noDecodeWithoutVerify},get"no-weak-secret"(){return require("./rules/no-weak-secret").noWeakSecret},get"require-expiration"(){return require("./rules/require-expiration").requireExpiration},get"no-hardcoded-secret"(){return require("./rules/no-hardcoded-secret").noHardcodedSecret},get"require-issued-at"(){return require("./rules/require-issued-at").requireIssuedAt},get"require-issuer-validation"(){return require("./rules/require-issuer-validation").requireIssuerValidation},get"require-audience-validation"(){return require("./rules/require-audience-validation").requireAudienceValidation},get"no-timestamp-manipulation"(){return require("./rules/no-timestamp-manipulation").noTimestampManipulation},get"require-max-age"(){return require("./rules/require-max-age").requireMaxAge},get"no-sensitive-payload"(){return require("./rules/no-sensitive-payload").noSensitivePayload}};exports.plugin={meta:{name:"eslint-plugin-jwt-security",version:"3.0.1"},rules:exports.rules};const recommendedRules={"jwt-security/no-algorithm-none":"error","jwt-security/no-algorithm-confusion":"error","jwt-security/require-algorithm-whitelist":"error","jwt-security/no-decode-without-verify":"error","jwt-security/no-weak-secret":"error","jwt-security/no-hardcoded-secret":"error","jwt-security/no-timestamp-manipulation":"error","jwt-security/require-expiration":"error","jwt-security/no-sensitive-payload":"warn"};const strictRules={"jwt-security/no-algorithm-none":"error","jwt-security/no-algorithm-confusion":"error","jwt-security/require-algorithm-whitelist":"error","jwt-security/no-decode-without-verify":"error","jwt-security/no-weak-secret":"error","jwt-security/no-hardcoded-secret":"error","jwt-security/require-expiration":"error","jwt-security/require-issued-at":"error","jwt-security/require-issuer-validation":"error","jwt-security/require-audience-validation":"error","jwt-security/no-timestamp-manipulation":"error","jwt-security/require-max-age":"error","jwt-security/no-sensitive-payload":"error"};const legacyRules={"jwt-security/no-algorithm-none":"error","jwt-security/no-algorithm-confusion":"error","jwt-security/no-hardcoded-secret":"warn"};exports.configs={flagship:{plugins:{"jwt-security":exports.plugin,jwt:exports.plugin},rules:{"jwt-security/no-algorithm-none":"error"}},recommended:{plugins:{"jwt-security":exports.plugin,jwt:exports.plugin},rules:recommendedRules},strict:{plugins:{"jwt-security":exports.plugin,jwt:exports.plugin},rules:strictRules},legacy:{plugins:{"jwt-security":exports.plugin,jwt:exports.plugin},rules:legacyRules},all:{plugins:{"jwt-security":exports.plugin,jwt:exports.plugin},rules:strictRules}};exports.default=exports.plugin;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noSensitivePayload=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");exports.noSensitivePayload=(0,eslint_devkit_1.createRule)({name:"no-sensitive-payload",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-sensitive-payload.md",description:"Prevent storing sensitive data in JWT payload which is only base64-encoded",cwe:"CWE-359",cvss:5},fixable:void 0,hasSuggestions:false,messages:{sensitivePayloadField:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Sensitive Data in JWT Payload",cwe:"CWE-359",description:'JWT payloads are not encrypted - sensitive data like "{{fieldName}}" can be read by anyone',severity:"MEDIUM",fix:"Store sensitive data server-side, reference by ID in token",documentationLink:"https://tools.ietf.org/html/rfc8725"})},schema:[{type:"object",properties:{additionalSensitiveFields:{type:"array",items:{type:"string"},default:[],description:"Additional field names to flag as sensitive"},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:[]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{additionalSensitiveFields:[],trustedSanitizers:[],trustedAnnotations:[],strictMode:false}],create(context){const options=context.options[0]??{};const additionalFields=options.additionalSensitiveFields??[];const allSensitiveFields=new Set([...utils_1.SENSITIVE_PAYLOAD_FIELDS,...additionalFields]);return{CallExpression(node){if(!(0,utils_1.isSignOperation)(node)){return}if(node.arguments.length<1){return}const payloadArg=node.arguments[0];if(payloadArg.type==="ObjectExpression"){for(const prop of payloadArg.properties){if(prop.type==="Property"&&prop.key.type==="Identifier"){const fieldName=prop.key.name.toLowerCase();if(allSensitiveFields.has(fieldName)){context.report({node:prop,messageId:"sensitivePayloadField",data:{fieldName:prop.key.name}})}}}}}}}});exports.default=exports.noSensitivePayload;
|
|
1
|
+
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noSensitivePayload=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");exports.noSensitivePayload=(0,eslint_devkit_1.createRule)({name:"no-sensitive-payload",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-sensitive-payload.md",description:"Prevent storing sensitive data in JWT payload which is only base64-encoded",cwe:"CWE-359",cvss:5.3},fixable:void 0,hasSuggestions:false,messages:{sensitivePayloadField:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Sensitive Data in JWT Payload",cwe:"CWE-359",description:'JWT payloads are not encrypted - sensitive data like "{{fieldName}}" can be read by anyone',severity:"MEDIUM",fix:"Store sensitive data server-side, reference by ID in token",documentationLink:"https://tools.ietf.org/html/rfc8725"})},schema:[{type:"object",properties:{additionalSensitiveFields:{type:"array",items:{type:"string"},default:[],description:"Additional field names to flag as sensitive"},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:[]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{additionalSensitiveFields:[],trustedSanitizers:[],trustedAnnotations:[],strictMode:false}],create(context){const options=context.options[0]??{};const additionalFields=options.additionalSensitiveFields??[];const allSensitiveFields=new Set([...utils_1.SENSITIVE_PAYLOAD_FIELDS,...additionalFields]);return{CallExpression(node){if(!(0,utils_1.isSignOperation)(node)){return}if(node.arguments.length<1){return}const payloadArg=node.arguments[0];if(payloadArg.type==="ObjectExpression"){for(const prop of payloadArg.properties){if(prop.type==="Property"&&prop.key.type==="Identifier"){const fieldName=prop.key.name.toLowerCase();if(allSensitiveFields.has(fieldName)){context.report({node:prop,messageId:"sensitivePayloadField",data:{fieldName:prop.key.name}})}}}}}}}});exports.default=exports.noSensitivePayload;
|