eslint-plugin-jwt-security 3.0.2 → 3.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
<p align="center">
|
|
2
|
-
<a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security" target="blank"><img src="https://eslint.interlace.tools/logos/interlace.svg" alt="Interlace" height="90" /></a>
|
|
2
|
+
<a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security" target="blank"><picture><source media="(prefers-color-scheme: dark)" srcset="https://eslint.interlace.tools/logos/interlace-dark.svg"><img src="https://eslint.interlace.tools/logos/interlace-light.svg" alt="Interlace" height="90" /></picture></a>
|
|
3
3
|
|
|
4
4
|
<a href="https://jwt.io" target="_blank"><img src="https://eslint.interlace.tools/logos/jwt.svg" alt="JSON Web Tokens" height="90" /></a>
|
|
5
5
|
|
|
6
|
-
<a href="https://oxc.rs" target="_blank"><img src="https://eslint.interlace.tools/logos/oxlint.svg" alt="oxlint" height="90" /></a>
|
|
6
|
+
<a href="https://oxc.rs" target="_blank"><picture><source media="(prefers-color-scheme: dark)" srcset="https://eslint.interlace.tools/logos/oxlint-dark.svg"><img src="https://eslint.interlace.tools/logos/oxlint-light.svg" alt="oxlint" height="90" /></picture></a>
|
|
7
7
|
|
|
8
|
-
<a href="https://eslint.org" target="_blank"><img src="https://eslint.interlace.tools/logos/eslint.svg" alt="ESLint" height="90" /></a>
|
|
8
|
+
<a href="https://eslint.org" target="_blank"><picture><source media="(prefers-color-scheme: dark)" srcset="https://eslint.interlace.tools/logos/eslint-dark.svg"><img src="https://eslint.interlace.tools/logos/eslint-light.svg" alt="ESLint" height="90" /></picture></a>
|
|
9
9
|
</p>
|
|
10
10
|
|
|
11
11
|
<p align="center">
|
|
@@ -27,57 +27,25 @@
|
|
|
27
27
|
|
|
28
28
|
This plugin provides Security validation for JSON Web Tokens (JWT) implementation (signing, verification).
|
|
29
29
|
|
|
30
|
-
## Philosophy
|
|
31
|
-
|
|
32
|
-
**Interlace** fosters **strength through integration**. Instead of stacking isolated rules, we **interlace** security directly into your workflow to create a resilient fabric of code. We believe tools should **guide rather than gatekeep**, providing educational feedback that strengthens the developer with every interaction.
|
|
33
|
-
|
|
34
30
|
<!-- AUTO-GENERATED:DOCTRINE:START - Do not edit manually -->
|
|
35
31
|
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
**
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
That is a trade, and it is made deliberately. It costs recall, and we measure what it
|
|
44
|
-
costs rather than assuming it is free.
|
|
45
|
-
|
|
46
|
-
## How the rules decide
|
|
47
|
-
|
|
48
|
-
**Evidence, not names.** A rule fires on what the code *does*, resolved through the
|
|
49
|
-
AST and ESLint's own scope analysis — not on an identifier that happens to contain
|
|
50
|
-
`query`, a method called `setItem`, or a file whose path contains `key`. Every one of
|
|
51
|
-
those was a real false positive in this ecosystem, found by reading our own output on
|
|
52
|
-
open-source projects and fixed with a test that fails on the unfixed rule.
|
|
53
|
-
|
|
54
|
-
Where a rule has known false-positive shapes, its page carries a **Not a finding**
|
|
55
|
-
section: what it deliberately stays quiet on, and what to check first when it fires
|
|
56
|
-
and you disagree.
|
|
32
|
+
- **Why** — a linter nobody reads protects nothing. We would rather miss a finding
|
|
33
|
+
than spend your attention on one that was never real.
|
|
34
|
+
- **How** — evidence, not names. A rule fires on what the code *does*, resolved
|
|
35
|
+
through the AST and ESLint's own scope analysis.
|
|
36
|
+
- **What** — every finding carries its fix, in prose for a human and as structured
|
|
37
|
+
JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.
|
|
57
38
|
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
structured JSON for an agent. Install it, enable
|
|
63
|
-
`recommended`, and read the findings. If one of them is wrong,
|
|
64
|
-
[open an issue](https://github.com/ofri-peretz/eslint/issues) — a false positive is a
|
|
65
|
-
bug here, not a tuning exercise for you.
|
|
66
|
-
|
|
67
|
-
How that is measured, on which projects, and where it falls short:
|
|
68
|
-
[benchmark methodology](https://github.com/ofri-peretz/eslint/blob/main/BENCHMARK-METHODOLOGY.md)
|
|
69
|
-
and [results](https://github.com/ofri-peretz/eslint/blob/main/BENCHMARK-RESULTS.md).
|
|
39
|
+
That trade costs recall, and we measure it:
|
|
40
|
+
[methodology](https://github.com/ofri-peretz/eslint/blob/main/BENCHMARK-METHODOLOGY.md)
|
|
41
|
+
· [results](https://github.com/ofri-peretz/eslint/blob/main/BENCHMARK-RESULTS.md)
|
|
42
|
+
· [a false positive is a bug](https://github.com/ofri-peretz/eslint/issues).
|
|
70
43
|
|
|
71
44
|
<!-- AUTO-GENERATED:DOCTRINE:END -->
|
|
72
45
|
|
|
73
46
|
## Getting Started
|
|
74
47
|
|
|
75
|
-
- To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-jwt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security), visit [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security). 📚
|
|
76
|
-
- 要查看中文 [指南](https://eslint.interlace.tools/docs/security/plugin-jwt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security), 请访问 [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security). 📚
|
|
77
|
-
- [가이드](https://eslint.interlace.tools/docs/security/plugin-jwt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) 문서는 [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security)에서 확인하실 수 있습니다. 📚
|
|
78
|
-
- [ガイド](https://eslint.interlace.tools/docs/security/plugin-jwt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security)は [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security)でご確認ください。 📚
|
|
79
|
-
- Para ver la [guía](https://eslint.interlace.tools/docs/security/plugin-jwt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security), visita [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security). 📚
|
|
80
|
-
- للاطلاع على [الدليل](https://eslint.interlace.tools/docs/security/plugin-jwt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security)، قم بزيارة [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security). 📚
|
|
48
|
+
- To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-jwt-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security), visit [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security). 📚
|
|
81
49
|
|
|
82
50
|
```bash
|
|
83
51
|
npm install eslint-plugin-jwt-security --save-dev
|
|
@@ -158,23 +126,52 @@ See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md)
|
|
|
158
126
|
| [require-issuer-validation](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/require-issuer-validation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-287 | | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | | | | | |
|
|
159
127
|
| [require-max-age](https://eslint.interlace.tools/docs/security/plugin-jwt-security/rules/require-max-age?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security) | CWE-294 | | | This rule mandates maxAge in verify operations | 🟢 | | | | | |
|
|
160
128
|
<!-- AUTO-GENERATED:RULES_TABLE:END -->
|
|
129
|
+
<!-- AUTO-GENERATED:ECOSYSTEM_TABLE:START - Do not edit manually -->
|
|
130
|
+
|
|
161
131
|
## 🔗 Related ESLint Plugins
|
|
162
132
|
|
|
163
|
-
Part of the **Interlace ESLint
|
|
133
|
+
Part of the **Interlace ESLint ecosystem** — AI-native rules with LLM-optimized error messages:
|
|
134
|
+
|
|
135
|
+
**Security**
|
|
136
|
+
|
|
137
|
+
| Plugin | Downloads | Description |
|
|
138
|
+
| :--- | :---: | :--- |
|
|
139
|
+
| [`eslint-plugin-anthropic-security`](https://www.npmjs.com/package/eslint-plugin-anthropic-security) | [](https://www.npmjs.com/package/eslint-plugin-anthropic-security) | Anthropic SDK security. |
|
|
140
|
+
| [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [](https://www.npmjs.com/package/eslint-plugin-browser-security) | XSS, DOM security. |
|
|
141
|
+
| [`eslint-plugin-drizzle-security`](https://www.npmjs.com/package/eslint-plugin-drizzle-security) | [](https://www.npmjs.com/package/eslint-plugin-drizzle-security) | Drizzle security. |
|
|
142
|
+
| [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [](https://www.npmjs.com/package/eslint-plugin-express-security) | Express middleware hardening. |
|
|
143
|
+
| [`eslint-plugin-gemini-security`](https://www.npmjs.com/package/eslint-plugin-gemini-security) | [](https://www.npmjs.com/package/eslint-plugin-gemini-security) | Google Gemini SDK security. |
|
|
144
|
+
| [`eslint-plugin-knex-security`](https://www.npmjs.com/package/eslint-plugin-knex-security) | [](https://www.npmjs.com/package/eslint-plugin-knex-security) | Knex security. |
|
|
145
|
+
| [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security) | [](https://www.npmjs.com/package/eslint-plugin-lambda-security) | AWS Lambda hardening. |
|
|
146
|
+
| [`eslint-plugin-mcp-sdk-security`](https://www.npmjs.com/package/eslint-plugin-mcp-sdk-security) | [](https://www.npmjs.com/package/eslint-plugin-mcp-sdk-security) | MCP SDK security. |
|
|
147
|
+
| [`eslint-plugin-mongodb-security`](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | [](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | MongoDB injection. |
|
|
148
|
+
| [`eslint-plugin-mysql-security`](https://www.npmjs.com/package/eslint-plugin-mysql-security) | [](https://www.npmjs.com/package/eslint-plugin-mysql-security) | MySQL security. |
|
|
149
|
+
| [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | [](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | NestJS framework hardening. |
|
|
150
|
+
| [`eslint-plugin-node-security`](https://www.npmjs.com/package/eslint-plugin-node-security) | [](https://www.npmjs.com/package/eslint-plugin-node-security) | Server-side patterns. |
|
|
151
|
+
| [`eslint-plugin-openai-security`](https://www.npmjs.com/package/eslint-plugin-openai-security) | [](https://www.npmjs.com/package/eslint-plugin-openai-security) | OpenAI SDK security. |
|
|
152
|
+
| [`eslint-plugin-postgresql-security`](https://www.npmjs.com/package/eslint-plugin-postgresql-security) | [](https://www.npmjs.com/package/eslint-plugin-postgresql-security) | PostgreSQL security. |
|
|
153
|
+
| [`eslint-plugin-prisma-security`](https://www.npmjs.com/package/eslint-plugin-prisma-security) | [](https://www.npmjs.com/package/eslint-plugin-prisma-security) | Prisma security. |
|
|
154
|
+
| [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [](https://www.npmjs.com/package/eslint-plugin-secure-coding) | Injection prevention. |
|
|
155
|
+
| [`eslint-plugin-sequelize-security`](https://www.npmjs.com/package/eslint-plugin-sequelize-security) | [](https://www.npmjs.com/package/eslint-plugin-sequelize-security) | Sequelize ORM security. |
|
|
156
|
+
| [`eslint-plugin-sqlite-security`](https://www.npmjs.com/package/eslint-plugin-sqlite-security) | [](https://www.npmjs.com/package/eslint-plugin-sqlite-security) | SQLite security. |
|
|
157
|
+
| [`eslint-plugin-typeorm-security`](https://www.npmjs.com/package/eslint-plugin-typeorm-security) | [](https://www.npmjs.com/package/eslint-plugin-typeorm-security) | TypeORM security. |
|
|
158
|
+
| [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | AI SDK security. |
|
|
159
|
+
|
|
160
|
+
**Code quality**
|
|
164
161
|
|
|
165
162
|
| Plugin | Downloads | Description |
|
|
166
163
|
| :--- | :---: | :--- |
|
|
167
|
-
| [`eslint-plugin-
|
|
168
|
-
| [`eslint-plugin-
|
|
169
|
-
| [`eslint-plugin-
|
|
170
|
-
| [`eslint-plugin-
|
|
171
|
-
| [`eslint-plugin-
|
|
172
|
-
| [`eslint-plugin-
|
|
173
|
-
| [`eslint-plugin-
|
|
174
|
-
| [`eslint-plugin-
|
|
175
|
-
| [`eslint-plugin-
|
|
176
|
-
|
|
177
|
-
|
|
164
|
+
| [`eslint-plugin-conventions`](https://www.npmjs.com/package/eslint-plugin-conventions) | [](https://www.npmjs.com/package/eslint-plugin-conventions) | Team-specific habits and styles. |
|
|
165
|
+
| [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [](https://www.npmjs.com/package/eslint-plugin-import-next) | Fast cycle + import-graph analysis. |
|
|
166
|
+
| [`eslint-plugin-maintainability`](https://www.npmjs.com/package/eslint-plugin-maintainability) | [](https://www.npmjs.com/package/eslint-plugin-maintainability) | Cognitive load and clean-code patterns. |
|
|
167
|
+
| [`eslint-plugin-modernization`](https://www.npmjs.com/package/eslint-plugin-modernization) | [](https://www.npmjs.com/package/eslint-plugin-modernization) | ESNext migration + syntax evolution. |
|
|
168
|
+
| [`eslint-plugin-modularity`](https://www.npmjs.com/package/eslint-plugin-modularity) | [](https://www.npmjs.com/package/eslint-plugin-modularity) | Structural integrity and DDD patterns. |
|
|
169
|
+
| [`eslint-plugin-operability`](https://www.npmjs.com/package/eslint-plugin-operability) | [](https://www.npmjs.com/package/eslint-plugin-operability) | Production readiness and resource health. |
|
|
170
|
+
| [`eslint-plugin-react-a11y`](https://www.npmjs.com/package/eslint-plugin-react-a11y) | [](https://www.npmjs.com/package/eslint-plugin-react-a11y) | React accessibility / WCAG. |
|
|
171
|
+
| [`eslint-plugin-react-features`](https://www.npmjs.com/package/eslint-plugin-react-features) | [](https://www.npmjs.com/package/eslint-plugin-react-features) | React best practices and optimization. |
|
|
172
|
+
| [`eslint-plugin-reliability`](https://www.npmjs.com/package/eslint-plugin-reliability) | [](https://www.npmjs.com/package/eslint-plugin-reliability) | Runtime stability and error safety. |
|
|
173
|
+
|
|
174
|
+
<!-- AUTO-GENERATED:ECOSYSTEM_TABLE:END -->
|
|
178
175
|
|
|
179
176
|
<!-- INTERLACE:STAR_CTA:START -->
|
|
180
177
|
## ⭐ Support & follow
|
|
@@ -190,9 +187,9 @@ If this plugin caught a real bug for you, **[star the repo](https://github.com/o
|
|
|
190
187
|
MIT © [Ofri Peretz](https://github.com/ofri-peretz)
|
|
191
188
|
|
|
192
189
|
<p align="center">
|
|
193
|
-
<a href="https://eslint.interlace.tools/docs/security/plugin-jwt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security"><img src="https://eslint.interlace.tools/images/og-jwt-security.png" alt="ESLint Interlace Plugin" width="100%" /></a>
|
|
190
|
+
<a href="https://eslint.interlace.tools/docs/security/plugin-jwt-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security"><img src="https://eslint.interlace.tools/images/og-jwt-security.png" alt="ESLint Interlace Plugin" width="100%" /></a>
|
|
194
191
|
</p>
|
|
195
192
|
|
|
196
193
|
<p align="center">
|
|
197
|
-
<a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security" target="blank"><img src="https://eslint.interlace.tools/
|
|
194
|
+
<a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security" target="blank"><picture><source media="(prefers-color-scheme: dark)" srcset="https://eslint.interlace.tools/logos/interlace-dark.svg"><img src="https://eslint.interlace.tools/logos/interlace-light.svg" alt="Interlace" height="70" /></picture></a>
|
|
198
195
|
</p>
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "eslint-plugin-jwt-security",
|
|
3
|
-
"version": "3.0
|
|
3
|
+
"version": "3.1.0",
|
|
4
4
|
"description": "ESLint plugin for JWT security — detects algorithm confusion (CVE-2022-23540), alg:none, weak or hardcoded secrets, and decode-without-verify.",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -79,7 +79,7 @@
|
|
|
79
79
|
"node": ">=18.0.0"
|
|
80
80
|
},
|
|
81
81
|
"dependencies": {
|
|
82
|
-
"@interlace/eslint-devkit": "^1.
|
|
82
|
+
"@interlace/eslint-devkit": "^1.18.0"
|
|
83
83
|
},
|
|
84
84
|
"peerDependencies": {
|
|
85
85
|
"eslint": "^8.40.0 || ^9.0.0 || ^10.0.0",
|
package/src/index.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noSensitivePayload=exports.requireMaxAge=exports.noTimestampManipulation=exports.requireAudienceValidation=exports.requireIssuerValidation=exports.requireIssuedAt=exports.noHardcodedSecret=exports.requireExpiration=exports.noWeakSecret=exports.noDecodeWithoutVerify=exports.requireAlgorithmWhitelist=exports.noAlgorithmConfusion=exports.noAlgorithmNone=exports.configs=exports.plugin=exports.rules=void 0;const no_algorithm_none_1=require("./rules/no-algorithm-none");Object.defineProperty(exports,"noAlgorithmNone",{enumerable:true,get:function(){return no_algorithm_none_1.noAlgorithmNone}});const no_algorithm_confusion_1=require("./rules/no-algorithm-confusion");Object.defineProperty(exports,"noAlgorithmConfusion",{enumerable:true,get:function(){return no_algorithm_confusion_1.noAlgorithmConfusion}});const require_algorithm_whitelist_1=require("./rules/require-algorithm-whitelist");Object.defineProperty(exports,"requireAlgorithmWhitelist",{enumerable:true,get:function(){return require_algorithm_whitelist_1.requireAlgorithmWhitelist}});const no_decode_without_verify_1=require("./rules/no-decode-without-verify");Object.defineProperty(exports,"noDecodeWithoutVerify",{enumerable:true,get:function(){return no_decode_without_verify_1.noDecodeWithoutVerify}});const no_weak_secret_1=require("./rules/no-weak-secret");Object.defineProperty(exports,"noWeakSecret",{enumerable:true,get:function(){return no_weak_secret_1.noWeakSecret}});const require_expiration_1=require("./rules/require-expiration");Object.defineProperty(exports,"requireExpiration",{enumerable:true,get:function(){return require_expiration_1.requireExpiration}});const no_hardcoded_secret_1=require("./rules/no-hardcoded-secret");Object.defineProperty(exports,"noHardcodedSecret",{enumerable:true,get:function(){return no_hardcoded_secret_1.noHardcodedSecret}});const require_issued_at_1=require("./rules/require-issued-at");Object.defineProperty(exports,"requireIssuedAt",{enumerable:true,get:function(){return require_issued_at_1.requireIssuedAt}});const require_issuer_validation_1=require("./rules/require-issuer-validation");Object.defineProperty(exports,"requireIssuerValidation",{enumerable:true,get:function(){return require_issuer_validation_1.requireIssuerValidation}});const require_audience_validation_1=require("./rules/require-audience-validation");Object.defineProperty(exports,"requireAudienceValidation",{enumerable:true,get:function(){return require_audience_validation_1.requireAudienceValidation}});const no_timestamp_manipulation_1=require("./rules/no-timestamp-manipulation");Object.defineProperty(exports,"noTimestampManipulation",{enumerable:true,get:function(){return no_timestamp_manipulation_1.noTimestampManipulation}});const require_max_age_1=require("./rules/require-max-age");Object.defineProperty(exports,"requireMaxAge",{enumerable:true,get:function(){return require_max_age_1.requireMaxAge}});const no_sensitive_payload_1=require("./rules/no-sensitive-payload");Object.defineProperty(exports,"noSensitivePayload",{enumerable:true,get:function(){return no_sensitive_payload_1.noSensitivePayload}});exports.rules={get"no-algorithm-none"(){return require("./rules/no-algorithm-none").noAlgorithmNone},get"no-algorithm-confusion"(){return require("./rules/no-algorithm-confusion").noAlgorithmConfusion},get"require-algorithm-whitelist"(){return require("./rules/require-algorithm-whitelist").requireAlgorithmWhitelist},get"no-decode-without-verify"(){return require("./rules/no-decode-without-verify").noDecodeWithoutVerify},get"no-weak-secret"(){return require("./rules/no-weak-secret").noWeakSecret},get"require-expiration"(){return require("./rules/require-expiration").requireExpiration},get"no-hardcoded-secret"(){return require("./rules/no-hardcoded-secret").noHardcodedSecret},get"require-issued-at"(){return require("./rules/require-issued-at").requireIssuedAt},get"require-issuer-validation"(){return require("./rules/require-issuer-validation").requireIssuerValidation},get"require-audience-validation"(){return require("./rules/require-audience-validation").requireAudienceValidation},get"no-timestamp-manipulation"(){return require("./rules/no-timestamp-manipulation").noTimestampManipulation},get"require-max-age"(){return require("./rules/require-max-age").requireMaxAge},get"no-sensitive-payload"(){return require("./rules/no-sensitive-payload").noSensitivePayload}};exports.plugin={meta:{name:"eslint-plugin-jwt-security",version:"3.0
|
|
1
|
+
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noSensitivePayload=exports.requireMaxAge=exports.noTimestampManipulation=exports.requireAudienceValidation=exports.requireIssuerValidation=exports.requireIssuedAt=exports.noHardcodedSecret=exports.requireExpiration=exports.noWeakSecret=exports.noDecodeWithoutVerify=exports.requireAlgorithmWhitelist=exports.noAlgorithmConfusion=exports.noAlgorithmNone=exports.configs=exports.plugin=exports.rules=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const no_algorithm_none_1=require("./rules/no-algorithm-none");Object.defineProperty(exports,"noAlgorithmNone",{enumerable:true,get:function(){return no_algorithm_none_1.noAlgorithmNone}});const no_algorithm_confusion_1=require("./rules/no-algorithm-confusion");Object.defineProperty(exports,"noAlgorithmConfusion",{enumerable:true,get:function(){return no_algorithm_confusion_1.noAlgorithmConfusion}});const require_algorithm_whitelist_1=require("./rules/require-algorithm-whitelist");Object.defineProperty(exports,"requireAlgorithmWhitelist",{enumerable:true,get:function(){return require_algorithm_whitelist_1.requireAlgorithmWhitelist}});const no_decode_without_verify_1=require("./rules/no-decode-without-verify");Object.defineProperty(exports,"noDecodeWithoutVerify",{enumerable:true,get:function(){return no_decode_without_verify_1.noDecodeWithoutVerify}});const no_weak_secret_1=require("./rules/no-weak-secret");Object.defineProperty(exports,"noWeakSecret",{enumerable:true,get:function(){return no_weak_secret_1.noWeakSecret}});const require_expiration_1=require("./rules/require-expiration");Object.defineProperty(exports,"requireExpiration",{enumerable:true,get:function(){return require_expiration_1.requireExpiration}});const no_hardcoded_secret_1=require("./rules/no-hardcoded-secret");Object.defineProperty(exports,"noHardcodedSecret",{enumerable:true,get:function(){return no_hardcoded_secret_1.noHardcodedSecret}});const require_issued_at_1=require("./rules/require-issued-at");Object.defineProperty(exports,"requireIssuedAt",{enumerable:true,get:function(){return require_issued_at_1.requireIssuedAt}});const require_issuer_validation_1=require("./rules/require-issuer-validation");Object.defineProperty(exports,"requireIssuerValidation",{enumerable:true,get:function(){return require_issuer_validation_1.requireIssuerValidation}});const require_audience_validation_1=require("./rules/require-audience-validation");Object.defineProperty(exports,"requireAudienceValidation",{enumerable:true,get:function(){return require_audience_validation_1.requireAudienceValidation}});const no_timestamp_manipulation_1=require("./rules/no-timestamp-manipulation");Object.defineProperty(exports,"noTimestampManipulation",{enumerable:true,get:function(){return no_timestamp_manipulation_1.noTimestampManipulation}});const require_max_age_1=require("./rules/require-max-age");Object.defineProperty(exports,"requireMaxAge",{enumerable:true,get:function(){return require_max_age_1.requireMaxAge}});const no_sensitive_payload_1=require("./rules/no-sensitive-payload");Object.defineProperty(exports,"noSensitivePayload",{enumerable:true,get:function(){return no_sensitive_payload_1.noSensitivePayload}});exports.rules={get"no-algorithm-none"(){return require("./rules/no-algorithm-none").noAlgorithmNone},get"no-algorithm-confusion"(){return require("./rules/no-algorithm-confusion").noAlgorithmConfusion},get"require-algorithm-whitelist"(){return require("./rules/require-algorithm-whitelist").requireAlgorithmWhitelist},get"no-decode-without-verify"(){return require("./rules/no-decode-without-verify").noDecodeWithoutVerify},get"no-weak-secret"(){return require("./rules/no-weak-secret").noWeakSecret},get"require-expiration"(){return require("./rules/require-expiration").requireExpiration},get"no-hardcoded-secret"(){return require("./rules/no-hardcoded-secret").noHardcodedSecret},get"require-issued-at"(){return require("./rules/require-issued-at").requireIssuedAt},get"require-issuer-validation"(){return require("./rules/require-issuer-validation").requireIssuerValidation},get"require-audience-validation"(){return require("./rules/require-audience-validation").requireAudienceValidation},get"no-timestamp-manipulation"(){return require("./rules/no-timestamp-manipulation").noTimestampManipulation},get"require-max-age"(){return require("./rules/require-max-age").requireMaxAge},get"no-sensitive-payload"(){return require("./rules/no-sensitive-payload").noSensitivePayload}};(0,eslint_devkit_1.withCanonicalDocsUrls)("plugin-jwt-security",exports.rules);exports.plugin={meta:{name:"eslint-plugin-jwt-security",version:"3.1.0"},rules:exports.rules};const recommendedRules={"jwt-security/no-algorithm-none":"error","jwt-security/no-algorithm-confusion":"error","jwt-security/require-algorithm-whitelist":"error","jwt-security/no-decode-without-verify":"error","jwt-security/no-weak-secret":"error","jwt-security/no-hardcoded-secret":"error","jwt-security/no-timestamp-manipulation":"error","jwt-security/require-expiration":"error","jwt-security/no-sensitive-payload":"warn"};const strictRules={"jwt-security/no-algorithm-none":"error","jwt-security/no-algorithm-confusion":"error","jwt-security/require-algorithm-whitelist":"error","jwt-security/no-decode-without-verify":"error","jwt-security/no-weak-secret":"error","jwt-security/no-hardcoded-secret":"error","jwt-security/require-expiration":"error","jwt-security/require-issued-at":"error","jwt-security/require-issuer-validation":"error","jwt-security/require-audience-validation":"error","jwt-security/no-timestamp-manipulation":"error","jwt-security/require-max-age":"error","jwt-security/no-sensitive-payload":"error"};const legacyRules={"jwt-security/no-algorithm-none":"error","jwt-security/no-algorithm-confusion":"error","jwt-security/no-hardcoded-secret":"warn"};exports.configs={flagship:{plugins:{"jwt-security":exports.plugin,jwt:exports.plugin},rules:{"jwt-security/no-algorithm-none":"error"}},recommended:{plugins:{"jwt-security":exports.plugin,jwt:exports.plugin},rules:recommendedRules},strict:{plugins:{"jwt-security":exports.plugin,jwt:exports.plugin},rules:strictRules},legacy:{plugins:{"jwt-security":exports.plugin,jwt:exports.plugin},rules:legacyRules},all:{plugins:{"jwt-security":exports.plugin,jwt:exports.plugin},rules:strictRules}};exports.default=exports.plugin;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noDecodeWithoutVerify=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");exports.noDecodeWithoutVerify=(0,eslint_devkit_1.createRule)({name:"no-decode-without-verify",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-decode-without-verify.md",description:"Disallow trusting decoded JWT payload without signature verification",cwe:"CWE-345",cvss:7.5},fixable:void 0,hasSuggestions:false,messages:{decodeWithoutVerify:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Decoded JWT Without Verification",cwe:"CWE-345",description:"jwt.decode() returns payload without verifying signature - data can be forged",severity:"HIGH",fix:"Use jwt.verify(token, secret) instead of jwt.decode(token)",documentationLink:"https://owasp.org/API-Security/0xa7-security-misconfiguration/"}),jwtDecodeLibrary:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"jwt-decode Library Usage",cwe:"CWE-345",description:"jwt-decode library only decodes tokens, never verifies signatures",severity:"HIGH",fix:"Use jsonwebtoken.verify() or jose.jwtVerify() for verification",documentationLink:"https://www.npmjs.com/package/jwt-decode"}),useVerifyInstead:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Verify Instead",description:"Replace decode with verify to ensure authenticity",severity:"LOW",fix:'jwt.verify(token, secret, { algorithms: ["RS256"] })',documentationLink:"https://www.npmjs.com/package/jsonwebtoken"})},schema:[{type:"object",properties:{allowHeaderInspection:{type:"boolean",default:false,description:"Allow decode() for reading header before verification"},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:["@decoded-header-only","@verified-separately"]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{allowHeaderInspection:false,trustedSanitizers:[],trustedAnnotations:["@decoded-header-only","@verified-separately"],strictMode:false}],create(context){const options=context.options[0]??{};const{trustedAnnotations=[]}=options;const isJwtDecodeLibrary=node=>{if(node.callee.type==="Identifier"&&(node.callee.name==="jwtDecode"||node.callee.name==="jwt_decode")){return true}return false};const TIME_CLAIMS=new Set(["exp","iat","nbf"]);const skipTypeWrappers=node=>{let current=node;while(current.parent!=null&&(current.parent.type==="TSAsExpression"||current.parent.type==="TSNonNullExpression")){current=current.parent}return current};const readsOnlyTimeClaims=node=>{const outer=skipTypeWrappers(node);const parent=outer.parent;if(parent.type==="MemberExpression"&&parent.object===outer){return!parent.computed&&parent.property.type==="Identifier"&&TIME_CLAIMS.has(parent.property.name)}if(parent.type!=="VariableDeclarator"||parent.id.type!=="Identifier"){return false}const[variable]=context.sourceCode.getDeclaredVariables(parent);let sawTimeClaim=false;const allUsesAllowed=variable.references.every(reference=>{const use=skipTypeWrappers(reference.identifier);const useParent=use.parent;if(useParent.type==="VariableDeclarator"){return true}if(useParent.type==="UnaryExpression"||useParent.type==="IfStatement"||useParent.type==="LogicalExpression"||useParent.type==="ConditionalExpression"){return true}const isTimeClaimRead=useParent.type==="MemberExpression"&&useParent.object===use&&!useParent.computed&&useParent.property.type==="Identifier"&&TIME_CLAIMS.has(useParent.property.name);if(isTimeClaimRead){sawTimeClaim=true}return isTimeClaimRead});return allUsesAllowed&&sawTimeClaim};const GRANT_RESPONSE_MEMBERS=new Set(["access_token","id_token","refresh_token"]);const REQUEST_RECEIVER=/\b(?:req|reqs|request|body|query|params|headers|header|cookies|cookie|searchParams|payload|input)\b/i;const MAX_PROVENANCE_DEPTH=4;const lookupVariable=(startScope,name)=>{for(let scope=startScope;scope!=null;scope=scope.upper){const found=scope.set.get(name);if(found)return found}return null};const tracesToGrantResponse=(node,depth)=>{if(depth>MAX_PROVENANCE_DEPTH)return false;if(node.type==="TSAsExpression"||node.type==="TSNonNullExpression"){return tracesToGrantResponse(node.expression,depth+1)}if(node.type==="MemberExpression"){if(node.computed||node.property.type!=="Identifier")return false;if(!GRANT_RESPONSE_MEMBERS.has(node.property.name))return false;return!REQUEST_RECEIVER.test(context.sourceCode.getText(node.object))}if(node.type!=="Identifier")return false;const variable=lookupVariable(context.sourceCode.getScope(node),node.name);const[definition]=variable?.defs??[];if(definition===void 0)return false;if(definition.type==="Variable"){const{init}=definition.node;return init!=null&&tracesToGrantResponse(init,depth+1)}if(definition.type!=="Parameter")return false;return everyCallSitePassesGrantResponse(definition,depth)};const everyCallSitePassesGrantResponse=(definition,depth)=>{const fn=definition.node;const index=fn.params.indexOf(definition.name);if(index<0||fn.id==null)return false;const fnVariable=lookupVariable(context.sourceCode.getScope(fn),fn.id.name);const references=fnVariable.references;let sawCall=false;for(const reference of references){const parent=reference.identifier.parent;if(parent?.type!=="CallExpression"||parent.callee!==reference.identifier){continue}sawCall=true;const argument=parent.arguments[index];if(argument===void 0||!tracesToGrantResponse(argument,depth+1)){return false}}return sawCall};return{CallExpression(node){if((0,utils_1.isDecodeOperation)(node)){if((0,eslint_devkit_1.hasSafeAnnotation)(node,context,trustedAnnotations)){return}if(readsOnlyTimeClaims(node)){return}const[tokenArgument]=node.arguments;if(tokenArgument!==void 0&&tracesToGrantResponse(tokenArgument,0)){return}context.report({node,messageId:"decodeWithoutVerify"});return}if(isJwtDecodeLibrary(node)){if((0,eslint_devkit_1.hasSafeAnnotation)(node,context,trustedAnnotations)){return}context.report({node,messageId:"jwtDecodeLibrary"})}}}}});exports.default=exports.noDecodeWithoutVerify;
|
|
1
|
+
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noDecodeWithoutVerify=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");exports.noDecodeWithoutVerify=(0,eslint_devkit_1.createRule)({name:"no-decode-without-verify",skipTestFiles:true,meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-decode-without-verify.md",description:"Disallow trusting decoded JWT payload without signature verification",cwe:"CWE-345",cvss:7.5},fixable:void 0,hasSuggestions:false,messages:{decodeWithoutVerify:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Decoded JWT Without Verification",cwe:"CWE-345",description:"jwt.decode() returns payload without verifying signature - data can be forged",severity:"HIGH",fix:"Use jwt.verify(token, secret) instead of jwt.decode(token)",documentationLink:"https://owasp.org/API-Security/0xa7-security-misconfiguration/"}),jwtDecodeLibrary:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"jwt-decode Library Usage",cwe:"CWE-345",description:"jwt-decode library only decodes tokens, never verifies signatures",severity:"HIGH",fix:"Use jsonwebtoken.verify() or jose.jwtVerify() for verification",documentationLink:"https://www.npmjs.com/package/jwt-decode"}),useVerifyInstead:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Verify Instead",description:"Replace decode with verify to ensure authenticity",severity:"LOW",fix:'jwt.verify(token, secret, { algorithms: ["RS256"] })',documentationLink:"https://www.npmjs.com/package/jsonwebtoken"})},schema:[{type:"object",properties:{allowHeaderInspection:{type:"boolean",default:false,description:"Allow decode() for reading header before verification"},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:["@decoded-header-only","@verified-separately"]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{allowHeaderInspection:false,trustedSanitizers:[],trustedAnnotations:["@decoded-header-only","@verified-separately"],strictMode:false}],create(context){const options=context.options[0]??{};const{trustedAnnotations=[]}=options;const isJwtDecodeLibrary=node=>{if(node.callee.type==="Identifier"&&(node.callee.name==="jwtDecode"||node.callee.name==="jwt_decode")){return true}return false};const TIME_CLAIMS=new Set(["exp","iat","nbf"]);const skipTypeWrappers=node=>{let current=node;while(current.parent!=null&&(current.parent.type==="TSAsExpression"||current.parent.type==="TSNonNullExpression")){current=current.parent}return current};const readsOnlyTimeClaims=node=>{const outer=skipTypeWrappers(node);const parent=outer.parent;if(parent.type==="MemberExpression"&&parent.object===outer){return!parent.computed&&parent.property.type==="Identifier"&&TIME_CLAIMS.has(parent.property.name)}if(parent.type!=="VariableDeclarator"||parent.id.type!=="Identifier"){return false}const[variable]=context.sourceCode.getDeclaredVariables(parent);let sawTimeClaim=false;const allUsesAllowed=variable.references.every(reference=>{const use=skipTypeWrappers(reference.identifier);const useParent=use.parent;if(useParent.type==="VariableDeclarator"){return true}if(useParent.type==="UnaryExpression"||useParent.type==="IfStatement"||useParent.type==="LogicalExpression"||useParent.type==="ConditionalExpression"){return true}const isTimeClaimRead=useParent.type==="MemberExpression"&&useParent.object===use&&!useParent.computed&&useParent.property.type==="Identifier"&&TIME_CLAIMS.has(useParent.property.name);if(isTimeClaimRead){sawTimeClaim=true}return isTimeClaimRead});return allUsesAllowed&&sawTimeClaim};const GRANT_RESPONSE_MEMBERS=new Set(["access_token","id_token","refresh_token"]);const REQUEST_RECEIVER=/\b(?:req|reqs|request|body|query|params|headers|header|cookies|cookie|searchParams|payload|input)\b/i;const MAX_PROVENANCE_DEPTH=4;const lookupVariable=(startScope,name)=>{for(let scope=startScope;scope!=null;scope=scope.upper){const found=scope.set.get(name);if(found)return found}return null};const tracesToGrantResponse=(node,depth)=>{if(depth>MAX_PROVENANCE_DEPTH)return false;if(node.type==="TSAsExpression"||node.type==="TSNonNullExpression"){return tracesToGrantResponse(node.expression,depth+1)}if(node.type==="MemberExpression"){if(node.computed||node.property.type!=="Identifier")return false;if(!GRANT_RESPONSE_MEMBERS.has(node.property.name))return false;return!REQUEST_RECEIVER.test(context.sourceCode.getText(node.object))}if(node.type!=="Identifier")return false;const variable=lookupVariable(context.sourceCode.getScope(node),node.name);const[definition]=variable?.defs??[];if(definition===void 0)return false;if(definition.type==="Variable"){const{init}=definition.node;return init!=null&&tracesToGrantResponse(init,depth+1)}if(definition.type!=="Parameter")return false;return everyCallSitePassesGrantResponse(definition,depth)};const everyCallSitePassesGrantResponse=(definition,depth)=>{const fn=definition.node;const index=fn.params.indexOf(definition.name);if(index<0||fn.id==null)return false;const fnVariable=lookupVariable(context.sourceCode.getScope(fn),fn.id.name);const references=fnVariable.references;let sawCall=false;for(const reference of references){const parent=reference.identifier.parent;if(parent?.type!=="CallExpression"||parent.callee!==reference.identifier){continue}sawCall=true;const argument=parent.arguments[index];if(argument===void 0||!tracesToGrantResponse(argument,depth+1)){return false}}return sawCall};return{CallExpression(node){if((0,utils_1.isDecodeOperation)(node)){if((0,eslint_devkit_1.hasSafeAnnotation)(node,context,trustedAnnotations)){return}if(readsOnlyTimeClaims(node)){return}const[tokenArgument]=node.arguments;if(tokenArgument!==void 0&&tracesToGrantResponse(tokenArgument,0)){return}context.report({node,messageId:"decodeWithoutVerify"});return}if(isJwtDecodeLibrary(node)){if((0,eslint_devkit_1.hasSafeAnnotation)(node,context,trustedAnnotations)){return}context.report({node,messageId:"jwtDecodeLibrary"})}}}}});exports.default=exports.noDecodeWithoutVerify;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noHardcodedSecret=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");exports.noHardcodedSecret=(0,eslint_devkit_1.createRule)({name:"no-hardcoded-secret",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-hardcoded-secret.md",description:"Disallow hardcoded secrets in JWT sign/verify operations",cwe:"CWE-798",cvss:9.8},fixable:void 0,hasSuggestions:false,messages:{hardcodedSecret:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Hardcoded JWT Secret",cwe:"CWE-798",description:"Secret key hardcoded in source code can be extracted from repositories",severity:"HIGH",fix:"Use process.env.JWT_SECRET or secure secret management",documentationLink:"https://cwe.mitre.org/data/definitions/798.html"}),useEnvVariable:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Environment Variable",description:"Replace hardcoded secret with environment variable",severity:"LOW",fix:"process.env.JWT_SECRET",documentationLink:"https://12factor.net/config"})},schema:[{type:"object",properties:{envPatterns:{type:"array",items:{type:"string"},default:[],description:"Patterns that indicate safe environment variable usage"},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:[]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{envPatterns:[],trustedSanitizers:[],trustedAnnotations:[],strictMode:false}],create(context){const isHardcodedString=node=>
|
|
1
|
+
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noHardcodedSecret=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");exports.noHardcodedSecret=(0,eslint_devkit_1.createRule)({name:"no-hardcoded-secret",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-hardcoded-secret.md",description:"Disallow hardcoded secrets in JWT sign/verify operations",cwe:"CWE-798",cvss:9.8},fixable:void 0,hasSuggestions:false,messages:{hardcodedSecret:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Hardcoded JWT Secret",cwe:"CWE-798",description:"Secret key hardcoded in source code can be extracted from repositories",severity:"HIGH",fix:"Use process.env.JWT_SECRET or secure secret management",documentationLink:"https://cwe.mitre.org/data/definitions/798.html"}),useEnvVariable:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Environment Variable",description:"Replace hardcoded secret with environment variable",severity:"LOW",fix:"process.env.JWT_SECRET",documentationLink:"https://12factor.net/config"})},schema:[{type:"object",properties:{envPatterns:{type:"array",items:{type:"string"},default:[],description:"Patterns that indicate safe environment variable usage"},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:[]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{envPatterns:[],trustedSanitizers:[],trustedAnnotations:[],strictMode:false}],create(context){const isHardcodedString=node=>(0,eslint_devkit_1.staticString)(node)!==null;const resolveConstLiteralValue=node=>{if(node.type!=="Identifier")return null;const scope=context.sourceCode.getScope(node);const variable=scope.references.find(r=>r.identifier===node)?.resolved;const def=variable?.defs[0];if(!def||def.type!=="Variable")return null;const decl=def.parent;if(decl?.type!=="VariableDeclaration"||decl.kind!=="const")return null;return def.node.init??null};const isSafeKeySource=node=>{if((0,utils_1.isEnvVariable)(node)){return true}if(node.type==="CallExpression"){return true}if(node.type==="AwaitExpression"){return true}if(node.type==="Identifier"){const init=resolveConstLiteralValue(node);if(init&&isHardcodedString(init)){return false}return true}if(node.type==="MemberExpression"&&!isHardcodedString(node)){return true}return false};const isHardcodedStringOrResolvedConst=node=>{if(isHardcodedString(node))return true;const init=resolveConstLiteralValue(node);return init?isHardcodedString(init):false};return{CallExpression(node){if(!(0,utils_1.isSignOperation)(node)&&!(0,utils_1.isVerifyOperation)(node)){return}if(node.arguments.length<2){return}const secretArg=node.arguments[1];if(isSafeKeySource(secretArg)){return}if(isHardcodedStringOrResolvedConst(secretArg)){context.report({node:secretArg,messageId:"hardcodedSecret"})}}}}});exports.default=exports.noHardcodedSecret;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.requireExpiration=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");exports.requireExpiration=(0,eslint_devkit_1.createRule)({name:"require-expiration",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/require-expiration.md",description:"Require expiration claim (exp) or expiresIn option in JWT signing",cwe:"CWE-613",cvss:5.4},hasSuggestions:true,messages:{missingExpiration:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Missing JWT Expiration",cwe:"CWE-613",description:"JWT without expiration is valid forever, increasing exposure window",severity:"MEDIUM",fix:'Add expiresIn: "1h" or exp claim to payload',documentationLink:"https://tools.ietf.org/html/rfc8725"}),addExpiration:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Add Expiration",description:"Add expiration to limit token lifetime",severity:"LOW",fix:'jwt.sign(payload, secret, { expiresIn: "1h" })',documentationLink:"https://www.npmjs.com/package/jsonwebtoken"})},schema:[{type:"object",properties:{maxExpirationSeconds:{type:"integer",default:86400,description:"Maximum allowed expiration time in seconds (24h default)"},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:[]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{maxExpirationSeconds:86400,trustedSanitizers:[],trustedAnnotations:[],strictMode:false}],create(context){const payloadHasExp=payloadNode=>{const resolved=payloadNode.type==="Identifier"?resolveObjectLiteral(payloadNode):payloadNode;if(resolved===null||resolved.type!=="ObjectExpression"){return false}return resolved.properties.some(prop=>prop.type==="Property"&&!prop.computed&&(prop.key.type==="Identifier"&&prop.key.name==="exp"||prop.key.type==="Literal"&&prop.key.value==="exp"))};const resolveObjectLiteral=node=>{let variable=null;let scope=context.sourceCode.getScope(node);while(scope!==null&&variable===null){variable=scope.variables.find(candidate=>candidate.name===node.name)??null;scope=scope.upper}if(variable===null||variable.defs.length!==1){return null}const definition=variable.defs[0];return definition.type==="Variable"?definition.node.init??null:null};const JWS_ONLY_BUILDERS=new Set(["FlattenedSign","CompactSign","GeneralSign"]);const chainSetsExpiration=node=>{let current=node;while(current.type==="CallExpression"||current.type==="MemberExpression"){if(current.type==="CallExpression"&¤t.callee.type==="MemberExpression"&¤t.callee.property.type==="Identifier"&¤t.callee.property.name==="setExpirationTime"){return true}current=current.type==="CallExpression"?current.callee:current.object}if(current.type!=="NewExpression"){return false}const ctor=current.callee.type==="Identifier"?current.callee.name:current.callee.type==="MemberExpression"&¤t.callee.property.type==="Identifier"?current.callee.property.name:null;if(ctor!==null&&JWS_ONLY_BUILDERS.has(ctor)){return true}const claims=current.arguments[0];return claims!==void 0&&payloadHasExp(claims)};return{CallExpression(node){if(!(0,utils_1.isSignOperation)(node)){return}if(node.arguments.length<1){return}const payloadArg=node.arguments[0];const optionsArg=(0,utils_1.getOptionsArgument)(node,2);if(payloadHasExp(payloadArg)){return}if(chainSetsExpiration(node)){return}if(optionsArg&&(0,utils_1.hasOption)(optionsArg,"expiresIn")){return}const optionsArg3=node.arguments[2];context.report({node,messageId:"missingExpiration",suggest:[{messageId:"addExpiration",fix(fixer){const sourceCode=context.sourceCode;if(optionsArg3&&optionsArg3.type===eslint_devkit_1.AST_NODE_TYPES.ObjectExpression){const openBrace=sourceCode.getFirstToken(optionsArg3);return fixer.insertTextAfter(openBrace," expiresIn: '1h',")}const lastArg=node.arguments[node.arguments.length-1];return fixer.insertTextAfter(lastArg,", { expiresIn: '1h' }")}}]})}}}});exports.default=exports.requireExpiration;
|
|
1
|
+
"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.requireExpiration=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const utils_1=require("../../utils");exports.requireExpiration=(0,eslint_devkit_1.createRule)({name:"require-expiration",skipTestFiles:true,meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/require-expiration.md",description:"Require expiration claim (exp) or expiresIn option in JWT signing",cwe:"CWE-613",cvss:5.4},hasSuggestions:true,messages:{missingExpiration:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Missing JWT Expiration",cwe:"CWE-613",description:"JWT without expiration is valid forever, increasing exposure window",severity:"MEDIUM",fix:'Add expiresIn: "1h" or exp claim to payload',documentationLink:"https://tools.ietf.org/html/rfc8725"}),addExpiration:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Add Expiration",description:"Add expiration to limit token lifetime",severity:"LOW",fix:'jwt.sign(payload, secret, { expiresIn: "1h" })',documentationLink:"https://www.npmjs.com/package/jsonwebtoken"})},schema:[{type:"object",properties:{maxExpirationSeconds:{type:"integer",default:86400,description:"Maximum allowed expiration time in seconds (24h default)"},trustedSanitizers:{type:"array",items:{type:"string"},default:[]},trustedAnnotations:{type:"array",items:{type:"string"},default:[]},strictMode:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{maxExpirationSeconds:86400,trustedSanitizers:[],trustedAnnotations:[],strictMode:false}],create(context){const payloadHasExp=payloadNode=>{const resolved=payloadNode.type==="Identifier"?resolveObjectLiteral(payloadNode):payloadNode;if(resolved===null||resolved.type!=="ObjectExpression"){return false}return resolved.properties.some(prop=>prop.type==="Property"&&!prop.computed&&(prop.key.type==="Identifier"&&prop.key.name==="exp"||prop.key.type==="Literal"&&prop.key.value==="exp"))};const resolveObjectLiteral=node=>{let variable=null;let scope=context.sourceCode.getScope(node);while(scope!==null&&variable===null){variable=scope.variables.find(candidate=>candidate.name===node.name)??null;scope=scope.upper}if(variable===null||variable.defs.length!==1){return null}const definition=variable.defs[0];return definition.type==="Variable"?definition.node.init??null:null};const JWS_ONLY_BUILDERS=new Set(["FlattenedSign","CompactSign","GeneralSign"]);const chainSetsExpiration=node=>{let current=node;while(current.type==="CallExpression"||current.type==="MemberExpression"){if(current.type==="CallExpression"&¤t.callee.type==="MemberExpression"&¤t.callee.property.type==="Identifier"&¤t.callee.property.name==="setExpirationTime"){return true}current=current.type==="CallExpression"?current.callee:current.object}if(current.type!=="NewExpression"){return false}const ctor=current.callee.type==="Identifier"?current.callee.name:current.callee.type==="MemberExpression"&¤t.callee.property.type==="Identifier"?current.callee.property.name:null;if(ctor!==null&&JWS_ONLY_BUILDERS.has(ctor)){return true}const claims=current.arguments[0];return claims!==void 0&&payloadHasExp(claims)};return{CallExpression(node){if(!(0,utils_1.isSignOperation)(node)){return}if(node.arguments.length<1){return}const payloadArg=node.arguments[0];const optionsArg=(0,utils_1.getOptionsArgument)(node,2);if(payloadHasExp(payloadArg)){return}if(chainSetsExpiration(node)){return}if(optionsArg&&(0,utils_1.hasOption)(optionsArg,"expiresIn")){return}const optionsArg3=node.arguments[2];context.report({node,messageId:"missingExpiration",suggest:[{messageId:"addExpiration",fix(fixer){const sourceCode=context.sourceCode;if(optionsArg3&&optionsArg3.type===eslint_devkit_1.AST_NODE_TYPES.ObjectExpression){const openBrace=sourceCode.getFirstToken(optionsArg3);return fixer.insertTextAfter(openBrace," expiresIn: '1h',")}const lastArg=node.arguments[node.arguments.length-1];return fixer.insertTextAfter(lastArg,", { expiresIn: '1h' }")}}]})}}}});exports.default=exports.requireExpiration;
|