eslint-plugin-node-security 4.0.3 → 4.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +42 -0
- package/LICENSE +23 -0
- package/README.md +57 -46
- package/package.json +15 -2
- package/src/index.js +19 -2
- package/src/index.js.map +1 -1
- package/src/oxlint.d.ts +20 -0
- package/src/oxlint.js +22 -0
- package/src/oxlint.js.map +1 -0
- package/src/rules/detect-child-process/index.js +121 -58
- package/src/rules/detect-child-process/index.js.map +1 -1
- package/src/rules/detect-eval-with-expression/index.js +16 -5
- package/src/rules/detect-eval-with-expression/index.js.map +1 -1
- package/src/rules/detect-non-literal-fs-filename/index.js +30 -7
- package/src/rules/detect-non-literal-fs-filename/index.js.map +1 -1
- package/src/rules/detect-suspicious-dependencies/index.js +4 -0
- package/src/rules/detect-suspicious-dependencies/index.js.map +1 -1
- package/src/rules/lock-file/index.js +25 -9
- package/src/rules/lock-file/index.js.map +1 -1
- package/src/rules/no-arbitrary-file-access/index.js +5 -2
- package/src/rules/no-arbitrary-file-access/index.js.map +1 -1
- package/src/rules/no-buffer-overread/index.js +36 -2
- package/src/rules/no-buffer-overread/index.js.map +1 -1
- package/src/rules/no-cryptojs/index.js +3 -0
- package/src/rules/no-cryptojs/index.js.map +1 -1
- package/src/rules/no-cryptojs-weak-random/index.js +3 -0
- package/src/rules/no-cryptojs-weak-random/index.js.map +1 -1
- package/src/rules/no-data-in-temp-storage/index.js +3 -0
- package/src/rules/no-data-in-temp-storage/index.js.map +1 -1
- package/src/rules/no-deprecated-buffer/index.d.ts +23 -0
- package/src/rules/no-deprecated-buffer/index.js +73 -0
- package/src/rules/no-deprecated-buffer/index.js.map +1 -0
- package/src/rules/no-deprecated-cipher-method/index.js +3 -0
- package/src/rules/no-deprecated-cipher-method/index.js.map +1 -1
- package/src/rules/no-dynamic-dependency-loading/index.js +3 -0
- package/src/rules/no-dynamic-dependency-loading/index.js.map +1 -1
- package/src/rules/no-dynamic-require/index.js +6 -1
- package/src/rules/no-dynamic-require/index.js.map +1 -1
- package/src/rules/no-ecb-mode/index.js +3 -0
- package/src/rules/no-ecb-mode/index.js.map +1 -1
- package/src/rules/no-insecure-key-derivation/index.js +3 -0
- package/src/rules/no-insecure-key-derivation/index.js.map +1 -1
- package/src/rules/no-insecure-rsa-padding/index.js +3 -0
- package/src/rules/no-insecure-rsa-padding/index.js.map +1 -1
- package/src/rules/no-pii-in-logs/index.js +3 -0
- package/src/rules/no-pii-in-logs/index.js.map +1 -1
- package/src/rules/no-self-signed-certs/index.js +3 -0
- package/src/rules/no-self-signed-certs/index.js.map +1 -1
- package/src/rules/no-sha1-hash/index.js +3 -0
- package/src/rules/no-sha1-hash/index.js.map +1 -1
- package/src/rules/no-ssrf/index.d.ts +25 -0
- package/src/rules/no-ssrf/index.js +228 -0
- package/src/rules/no-ssrf/index.js.map +1 -0
- package/src/rules/no-static-iv/index.js +3 -0
- package/src/rules/no-static-iv/index.js.map +1 -1
- package/src/rules/no-timing-unsafe-compare/index.js +3 -0
- package/src/rules/no-timing-unsafe-compare/index.js.map +1 -1
- package/src/rules/no-toctou-vulnerability/index.js +5 -2
- package/src/rules/no-toctou-vulnerability/index.js.map +1 -1
- package/src/rules/no-unsafe-dynamic-require/index.js +4 -0
- package/src/rules/no-unsafe-dynamic-require/index.js.map +1 -1
- package/src/rules/no-weak-cipher-algorithm/index.js +3 -0
- package/src/rules/no-weak-cipher-algorithm/index.js.map +1 -1
- package/src/rules/no-weak-hash-algorithm/index.js +3 -0
- package/src/rules/no-weak-hash-algorithm/index.js.map +1 -1
- package/src/rules/no-zip-slip/index.js +40 -62
- package/src/rules/no-zip-slip/index.js.map +1 -1
- package/src/rules/prefer-native-crypto/index.js +3 -0
- package/src/rules/prefer-native-crypto/index.js.map +1 -1
- package/src/rules/require-dependency-integrity/index.js +3 -0
- package/src/rules/require-dependency-integrity/index.js.map +1 -1
- package/src/rules/require-secure-credential-storage/index.js +3 -0
- package/src/rules/require-secure-credential-storage/index.js.map +1 -1
- package/src/rules/require-secure-deletion/index.js +3 -0
- package/src/rules/require-secure-deletion/index.js.map +1 -1
- package/src/rules/require-storage-encryption/index.js +3 -0
- package/src/rules/require-storage-encryption/index.js.map +1 -1
- package/src/types/index.js.map +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-deprecated-cipher-method/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,4DAAsG;AAatG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE1D,QAAA,wBAAwB,GAAG,IAAA,0BAAU,EAA0B;IAC1E,IAAI,EAAE,6BAA6B;IACnC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,gIAAgI;YACrI,WAAW,EAAE,8GAA8G;YAC3H,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,8IAA8I;gBAC3J,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,8DAA8D;gBACnE,iBAAiB,EAAE,iFAAiF;aACrG,CAAC;YACF,WAAW,EAAE,IAAA,gCAAgB,EAAC;gBAC5B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,+DAA+D;gBAC5E,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mJAAmJ;gBACxJ,iBAAiB,EAAE,iFAAiF;aACrG,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,wCAAwC;qBACtD;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;SACpB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAkB,CAAC;QAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpF,SAAS,mBAAmB,CAAC,IAA6B;YACxD,IAAI,UAAU;gBAAE,OAAO;YAEvB,6DAA6D;YAC7D,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACvD,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EACjD,CAAC;gBACD,iFAAiF;gBACjF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,QAA+B,CAAC;gBAC5D,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC;gBACrC,MAAM,eAAe,GAAG,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,CAAC;gBAE9F,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,YAAY;oBAClB,SAAS,EAAE,wBAAwB;oBACnC,IAAI,EAAE;wBACJ,MAAM,EAAE,UAAU;wBAClB,WAAW,EAAE,eAAe;qBAC7B;oBACD,OAAO,EAAE;wBACP;4BACE,SAAS,EAAE,aAAa;4BACxB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;gCACjC,OAAO,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;4BAC1D,CAAC;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YAED,yDAAyD;YACzD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAC9C,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EACxC,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACpC,MAAM,eAAe,GAAG,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,CAAC;gBAE9F,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,IAAI,CAAC,MAAM;oBACjB,SAAS,EAAE,wBAAwB;oBACnC,IAAI,EAAE;wBACJ,MAAM,EAAE,UAAU;wBAClB,WAAW,EAAE,eAAe;qBAC7B;oBACD,OAAO,EAAE;wBACP;4BACE,SAAS,EAAE,aAAa;4BACxB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;gCACjC,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;4BACzD,CAAC;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,cAAc,EAAE,mBAAmB;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -17,7 +17,10 @@ exports.noDynamicDependencyLoading = (0, eslint_devkit_1.createRule)({
|
|
|
17
17
|
meta: {
|
|
18
18
|
type: 'problem',
|
|
19
19
|
docs: {
|
|
20
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-dependency-loading.md',
|
|
20
21
|
description: 'Prevent runtime dependency injection with dynamic paths',
|
|
22
|
+
cwe: 'CWE-1104',
|
|
23
|
+
cvss: 7.5,
|
|
21
24
|
},
|
|
22
25
|
messages: {
|
|
23
26
|
violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-dynamic-dependency-loading/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;GAIG;AAEH,4DAAsG;AAUzF,QAAA,0BAA0B,GAAG,IAAA,0BAAU,EAA0B;IAC5E,IAAI,EAAE,+BAA+B;IACrC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,kIAAkI;YACvI,WAAW,EAAE,yDAAyD;YACtE,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,mEAAmE;gBAChF,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,mCAAmC;gBACxC,iBAAiB,EAAE,kDAAkD;aACtE,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,kBAAkB;gBAClB,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAC9B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,8BAAc,CAAC,OAAO,EAClD,CAAC;oBACD,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAED,gBAAgB,CAAC,IAA+B;gBAC9C,mBAAmB;gBACnB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACnC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;SACH,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -13,7 +13,11 @@ exports.noDynamicRequire = (0, eslint_devkit_1.createRule)({
|
|
|
13
13
|
meta: {
|
|
14
14
|
type: 'problem',
|
|
15
15
|
docs: {
|
|
16
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-require.md',
|
|
16
17
|
description: 'Forbid `require()` calls with expressions',
|
|
18
|
+
cwe: 'CWE-94',
|
|
19
|
+
cweJustification: 'CWE-94 (Improper Control of Generation of Code) — dynamic require with attacker-influenced path can load arbitrary modules, equivalent to remote code execution.',
|
|
20
|
+
confidence: 'high',
|
|
17
21
|
},
|
|
18
22
|
hasSuggestions: false,
|
|
19
23
|
messages: {
|
|
@@ -55,7 +59,7 @@ exports.noDynamicRequire = (0, eslint_devkit_1.createRule)({
|
|
|
55
59
|
create(context) {
|
|
56
60
|
const [options] = context.options;
|
|
57
61
|
const { allowContexts = [], allowPatterns = [], } = options || {};
|
|
58
|
-
const filename = context.
|
|
62
|
+
const filename = context.filename || '';
|
|
59
63
|
function isInAllowedContext() {
|
|
60
64
|
if (allowContexts.includes('test') && (filename.includes('.test.') || filename.includes('.spec.') || filename.includes('/__tests__/'))) {
|
|
61
65
|
return true;
|
|
@@ -84,6 +88,7 @@ exports.noDynamicRequire = (0, eslint_devkit_1.createRule)({
|
|
|
84
88
|
});
|
|
85
89
|
}
|
|
86
90
|
/* v8 ignore stop */
|
|
91
|
+
// oxlint-disable-next-line consistent-function-scoping
|
|
87
92
|
function isStaticLiteral(node) {
|
|
88
93
|
return node.type === 'Literal' && typeof node.value === 'string';
|
|
89
94
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-dynamic-require/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAOH,4DAAsD;AACtD,4DAA0E;AAa7D,QAAA,gBAAgB,GAAG,IAAA,0BAAU,EAA0B;IAClE,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,uHAAuH;YAC5H,WAAW,EACT,2CAA2C;YAC7C,GAAG,EAAE,QAAQ;YACb,gBAAgB,EAAE,kKAAkK;YACpL,UAAU,EAAE,MAAM;SACnB;QACD,cAAc,EAAE,KAAK;QACrB,QAAQ,EAAE;YACR,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,OAAO;gBAC1B,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,sCAAsC;gBACnD,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,gDAAgD;gBACrD,iBAAiB,EAAE,8FAA8F;aAClH,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,aAAa,EAAE;wBACb,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;yBAC7C;wBACD,WAAW,EAAE,8CAA8C;qBAC5D;oBACD,aAAa,EAAE;wBACb,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,WAAW,EAAE,mDAAmD;qBACjE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC;YACf,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE,EAAE;SAClB,CAAC;IAEF,MAAM,CAAC,OAAsD;QAC3D,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QAClC,MAAM,EACJ,aAAa,GAAG,EAAE,EAClB,aAAa,GAAG,EAAE,GACnB,GAAG,OAAO,IAAI,EAAE,CAAC;QAElB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QAExC,SAAS,kBAAkB;YACzB,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;gBACvI,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACrI,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAClI,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACxG,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2GAA2G;QAC3G,SAAS,gBAAgB,CAAC,WAAmB;YAC3C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE;gBAC5C,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;oBAClC,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,oBAAoB;QAEpB,uDAAuD;QACvD,SAAS,eAAe,CAAC,IAAmB;YAC1C,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;QACnE,CAAC;QAED,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACjC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;oBACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAErC,IAAI,kBAAkB,EAAE,EAAE,CAAC;wBACzB,OAAO;oBACT,CAAC;oBAED,iCAAiC;oBACjC,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;wBAChC,8BAA8B;wBAC9B,OAAO;oBACT,CAAC;oBAED,4EAA4E;oBAC5E,uBAAuB;oBACvB,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC1E,IAAI,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;4BACvC,OAAO;wBACT,CAAC;oBACH,CAAC;oBACD,oBAAoB;oBAEpB,yBAAyB;oBACzB,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,UAAU;wBAChB,SAAS,EAAE,gBAAgB;qBAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -12,7 +12,10 @@ exports.noEcbMode = (0, eslint_devkit_1.createRule)({
|
|
|
12
12
|
meta: {
|
|
13
13
|
type: 'problem',
|
|
14
14
|
docs: {
|
|
15
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-ecb-mode.md',
|
|
15
16
|
description: 'Disallow ECB encryption mode (use GCM or CBC instead)',
|
|
17
|
+
cwe: 'CWE-327',
|
|
18
|
+
cvss: 7.5,
|
|
16
19
|
},
|
|
17
20
|
hasSuggestions: true,
|
|
18
21
|
messages: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-ecb-mode/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,4DAAsG;AAczF,QAAA,SAAS,GAAG,IAAA,0BAAU,EAA0B;IAC3D,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,gHAAgH;YACrH,WAAW,EAAE,uDAAuD;YACpE,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,OAAO,EAAE,IAAA,gCAAgB,EAAC;gBACxB,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mBAAmB;gBAC9B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,iIAAiI;gBAC9I,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,0FAA0F;gBAC/F,iBAAiB,EAAE,0EAA0E;aAC9F,CAAC;YACF,MAAM,EAAE,IAAA,gCAAgB,EAAC;gBACvB,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,qEAAqE;gBAClF,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+CAA+C;gBACpD,iBAAiB,EAAE,iFAAiF;aACrG,CAAC;YACF,MAAM,EAAE,IAAA,gCAAgB,EAAC;gBACvB,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,yEAAyE;gBACtF,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+CAA+C;gBACpD,iBAAiB,EAAE,iFAAiF;aACrG,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,8BAA8B;qBAC5C;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;SACpB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAkB,CAAC;QAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpF,SAAS,mBAAmB,CAAC,IAA6B;YACxD,IAAI,UAAU;gBAAE,OAAO;YAEvB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,CAAC;YAExG,2CAA2C;YAC3C,MAAM,YAAY,GAChB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACvD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC/C,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC7C,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAEzC,IAAI,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACvC,IAAI,YAAY,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,YAAY,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC3F,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;oBACnD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC5D,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;wBAE3D,wGAAwG;wBACxG,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,YAAY;4BAClB,SAAS,EAAE,SAAS;4BACpB,OAAO,EAAE;gCACP;oCACE,SAAS,EAAE,QAAQ;oCACnB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;wCACjC,OAAO,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,cAAc,GAAG,CAAC,CAAC;oCAChE,CAAC;iCACF;gCACD;oCACE,SAAS,EAAE,QAAQ;oCACnB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;wCACjC,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;wCAC3D,OAAO,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,cAAc,GAAG,CAAC,CAAC;oCAChE,CAAC;iCACF;6BACF;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,cAAc,EAAE,mBAAmB;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -14,7 +14,10 @@ exports.noInsecureKeyDerivation = (0, eslint_devkit_1.createRule)({
|
|
|
14
14
|
meta: {
|
|
15
15
|
type: 'problem',
|
|
16
16
|
docs: {
|
|
17
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-insecure-key-derivation.md',
|
|
17
18
|
description: 'Disallow PBKDF2 with insufficient iterations (< 100,000)',
|
|
19
|
+
cwe: 'CWE-916',
|
|
20
|
+
cvss: 7.5,
|
|
18
21
|
},
|
|
19
22
|
hasSuggestions: true,
|
|
20
23
|
messages: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-insecure-key-derivation/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAAsG;AAetG,6BAA6B;AAC7B,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEzB,QAAA,uBAAuB,GAAG,IAAA,0BAAU,EAA0B;IACzE,IAAI,EAAE,4BAA4B;IAClC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,+HAA+H;YACpI,WAAW,EAAE,0DAA0D;YACvE,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,gCAAgC;gBAC3C,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,yGAAyG;gBACtH,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,mEAAmE;gBACxE,iBAAiB,EAAE,kFAAkF;aACtG,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,wBAAwB;gBACnC,WAAW,EAAE,gDAAgD;gBAC7D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,4DAA4D;gBACjE,iBAAiB,EAAE,gGAAgG;aACpH,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,yDAAyD;gBACtE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,uCAAuC;gBAC5C,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,4DAA4D;gBACzE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kDAAkD;gBACvD,iBAAiB,EAAE,yCAAyC;aAC7D,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,aAAa,EAAE;wBACb,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,sBAAsB;wBAC/B,WAAW,EAAE,oCAAoC;qBAClD;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,aAAa,EAAE,sBAAsB;SACtC;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,aAAa,GAAG,sBAAsB,EAAE,GAAG,OAAkB,CAAC;QAEtE,SAAS,mBAAmB,CAAC,IAA6B;YACxD,mDAAmD;YACnD,MAAM,YAAY,GAChB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACvD,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;gBACzF,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC7C,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC;YAE1E,IAAI,YAAY,EAAE,CAAC;gBACjB,+DAA+D;gBAC/D,2CAA2C;gBAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAExC,IAAI,aAAa,EAAE,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9F,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC;oBAEvC,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;wBAC/B,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,aAAa;4BACnB,SAAS,EAAE,wBAAwB;4BACnC,IAAI,EAAE;gCACJ,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC;gCAC1B,OAAO,EAAE,MAAM,CAAC,aAAa,CAAC;6BAC/B;4BACD,OAAO,EAAE;gCACP;oCACE,SAAS,EAAE,kBAAkB;oCAC7B,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE;oCACxC,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;wCACjC,OAAO,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;oCACjE,CAAC;iCACF;6BACF;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,cAAc,EAAE,mBAAmB;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -18,7 +18,10 @@ exports.noInsecureRsaPadding = (0, eslint_devkit_1.createRule)({
|
|
|
18
18
|
meta: {
|
|
19
19
|
type: 'problem',
|
|
20
20
|
docs: {
|
|
21
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-insecure-rsa-padding.md',
|
|
21
22
|
description: 'Disallow RSA PKCS#1 v1.5 padding (CVE-2023-46809 Marvin Attack)',
|
|
23
|
+
cwe: 'CWE-327',
|
|
24
|
+
cvss: 7.5,
|
|
22
25
|
},
|
|
23
26
|
hasSuggestions: true,
|
|
24
27
|
messages: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-insecure-rsa-padding/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAAsG;AAatG,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,mBAAmB;IACnB,6BAA6B;IAC7B,oCAAoC;CACrC,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,IAAA,0BAAU,EAA0B;IACtE,IAAI,EAAE,yBAAyB;IAC/B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,4HAA4H;YACjI,WAAW,EAAE,iEAAiE;YAC9E,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,sBAAsB;gBACjC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,+JAA+J;gBAC5K,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,oCAAoC;gBACzC,iBAAiB,EAAE,2CAA2C;aAC/D,CAAC;YACF,OAAO,EAAE,IAAA,gCAAgB,EAAC;gBACxB,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,WAAW,EAAE,gEAAgE;gBAC7E,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kDAAkD;gBACvD,iBAAiB,EAAE,kEAAkE;aACtF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,qBAAqB;qBACnC;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;SACpB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAkB,CAAC;QAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QAEtC,SAAS,mBAAmB,CAAC,IAA6B;YACxD,IAAI,UAAU;gBAAE,OAAO;YAEvB,yEAAyE;YACzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;YAEnG,MAAM,SAAS,GACb,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACvD,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5C,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC7C,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAEtC,IAAI,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAEjC,6DAA6D;gBAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB,EAAE,CAAC;oBACpD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;wBACrC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,QAAQ;4BACrC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;4BAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,EAC3B,CAAC;4BACD,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;4BACnD,IAAI,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gCACtF,OAAO,CAAC,MAAM,CAAC;oCACb,IAAI,EAAE,IAAI;oCACV,SAAS,EAAE,oBAAoB;oCAC/B,OAAO,EAAE;wCACP;4CACE,SAAS,EAAE,SAAS;4CACpB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;gDACjC,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;4CAClF,CAAC;yCACF;qCACF;iCACF,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,cAAc,EAAE,mBAAmB;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -17,7 +17,10 @@ exports.noPiiInLogs = (0, eslint_devkit_1.createRule)({
|
|
|
17
17
|
meta: {
|
|
18
18
|
type: 'problem',
|
|
19
19
|
docs: {
|
|
20
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-pii-in-logs.md',
|
|
20
21
|
description: 'Prevent PII (email, SSN, credit cards) in console logs',
|
|
22
|
+
cwe: 'CWE-359',
|
|
23
|
+
cvss: 7.5,
|
|
21
24
|
},
|
|
22
25
|
messages: {
|
|
23
26
|
violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-pii-in-logs/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;GAIG;AAEH,4DAAsG;AAUzF,QAAA,WAAW,GAAG,IAAA,0BAAU,EAA0B;IAC7D,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,mHAAmH;YACxH,WAAW,EAAE,wDAAwD;YACrE,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,2FAA2F;gBACxG,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,mCAAmC;gBACxC,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,SAAS,MAAM,CAAC,IAAmB;YACjC,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,mBAAmB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,qCAAqC;gBACrC,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EACpE,CAAC;oBACD,kDAAkD;oBAClD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACjC,IACE,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;4BAC5C,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAC/C,CAAC;4BACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;4BACjD,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;4BAErE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCAC7C,MAAM,CAAC,IAAI,CAAC,CAAC;4BACf,CAAC;wBACH,CAAC;wBAED,uCAAuC;wBACvC,IAAI,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;4BACzE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;4BACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gCACnF,MAAM,CAAC,IAAI,CAAC,CAAC;4BACf,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -12,7 +12,10 @@ exports.noSelfSignedCerts = (0, eslint_devkit_1.createRule)({
|
|
|
12
12
|
meta: {
|
|
13
13
|
type: 'problem',
|
|
14
14
|
docs: {
|
|
15
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-self-signed-certs.md',
|
|
15
16
|
description: 'Disallow rejectUnauthorized: false in TLS options',
|
|
17
|
+
cwe: 'CWE-295',
|
|
18
|
+
cvss: 9.5,
|
|
16
19
|
},
|
|
17
20
|
hasSuggestions: true,
|
|
18
21
|
messages: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-self-signed-certs/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,4DAAsG;AAazF,QAAA,iBAAiB,GAAG,IAAA,0BAAU,EAA0B;IACnE,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,yHAAyH;YAC9H,WAAW,EAAE,mDAAmD;YAChE,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,WAAW,EAAE,IAAA,gCAAgB,EAAC;gBAC5B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,8KAA8K;gBAC3L,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,oDAAoD;gBACzD,iBAAiB,EAAE,0FAA0F;aAC9G,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,+BAA+B;gBAC1C,WAAW,EAAE,0CAA0C;gBACvD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mDAAmD;gBACxD,iBAAiB,EAAE,4DAA4D;aAChF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,qBAAqB;qBACnC;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;SACpB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAkB,CAAC;QAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpF,SAAS,aAAa,CAAC,IAAuB;YAC5C,IAAI,UAAU;gBAAE,OAAO;YAEvB,sCAAsC;YACtC,IACE,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,oBAAoB;gBACtC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;gBAC1C,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,EAC1B,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,aAAa;oBACxB,OAAO,EAAE;wBACP;4BACE,SAAS,EAAE,kBAAkB;4BAC7B,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;gCACjC,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;4BAC/C,CAAC;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,SAAS,yBAAyB,CAAC,IAAmC;YACpE,IAAI,UAAU;gBAAE,OAAO;YAEvB,2DAA2D;YAC3D,IACE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACzD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAC1D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;gBAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;gBACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAA8B,EAC1D,CAAC;gBACD,IACE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBAC1C,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,EACpD,CAAC;oBACD,gGAAgG;oBAChG,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,aAAa;wBACxB,OAAO,EAAE;4BACP;gCACE,SAAS,EAAE,kBAAkB;gCAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,+BAA+B;6BACjD;yBACF;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,oBAAoB,EAAE,yBAAyB;SAChD,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -12,7 +12,10 @@ exports.noSha1Hash = (0, eslint_devkit_1.createRule)({
|
|
|
12
12
|
meta: {
|
|
13
13
|
type: 'problem',
|
|
14
14
|
docs: {
|
|
15
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-sha1-hash.md',
|
|
15
16
|
description: 'Disallow sha1() from crypto-hash package (use sha256 or sha512)',
|
|
17
|
+
cwe: 'CWE-327',
|
|
18
|
+
cvss: 7.5,
|
|
16
19
|
},
|
|
17
20
|
hasSuggestions: true,
|
|
18
21
|
messages: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-sha1-hash/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAAsG;AAczF,QAAA,UAAU,GAAG,IAAA,0BAAU,EAA0B;IAC5D,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,iHAAiH;YACtH,WAAW,EAAE,iEAAiE;YAC9E,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qBAAqB;gBAChC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,sHAAsH;gBACnI,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,uBAAuB;aAC3C,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,uDAAuD;gBACpE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0DAA0D;gBAC/D,iBAAiB,EAAE,2CAA2C;aAC/D,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,qDAAqD;gBAClE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0DAA0D;gBAC/D,iBAAiB,EAAE,2CAA2C;aAC/D,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,0BAA0B;qBACxC;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;SACpB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAkB,CAAC;QAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpF,8CAA8C;QAC9C,IAAI,0BAA0B,GAAG,KAAK,CAAC;QAEvC,OAAO;YACL,iBAAiB,CAAC,IAAgC;gBAChD,IAAI,UAAU;oBAAE,OAAO;gBAEvB,gDAAgD;gBAChD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;oBACxC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;wBACxC,IACE,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;4BACjD,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;4BACrD,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,EAClC,CAAC;4BACD,0BAA0B,GAAG,IAAI,CAAC;4BAClC,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI,EAAE,SAAS;gCACf,SAAS,EAAE,gBAAgB;gCAC3B,OAAO,EAAE;oCACP;wCACE,SAAS,EAAE,WAAW;wCACtB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;4CACjC,OAAO,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;wCACzD,CAAC;qCACF;oCACD;wCACE,SAAS,EAAE,WAAW;wCACtB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;4CACjC,OAAO,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;wCACzD,CAAC;qCACF;iCACF;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,cAAc,CAAC,IAA6B;gBAC1C,IAAI,UAAU;oBAAE,OAAO;gBAEvB,qDAAqD;gBACrD,IACE,0BAA0B;oBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,EAC3B,CAAC;oBACD,gFAAgF;oBAChF,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,gBAAgB;wBAC3B,OAAO,EAAE;4BACP;gCACE,SAAS,EAAE,WAAW;gCACtB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;oCACjC,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gCAClD,CAAC;6BACF;yBACF;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Copyright (c) 2025 Ofri Peretz
|
|
3
|
+
* Licensed under the MIT License. Use of this source code is governed by the
|
|
4
|
+
* MIT license that can be found in the LICENSE file.
|
|
5
|
+
*/
|
|
6
|
+
/**
|
|
7
|
+
* ESLint Rule: no-ssrf
|
|
8
|
+
* Detects Server-Side Request Forgery (SSRF) vulnerabilities where
|
|
9
|
+
* user-controlled URLs are passed to HTTP client functions without validation.
|
|
10
|
+
*
|
|
11
|
+
* CWE-918: Server-Side Request Forgery (SSRF)
|
|
12
|
+
*
|
|
13
|
+
* @see https://cwe.mitre.org/data/definitions/918.html
|
|
14
|
+
* @see https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
|
|
15
|
+
*/
|
|
16
|
+
import type { TSESLint } from '@interlace/eslint-devkit';
|
|
17
|
+
export interface Options {
|
|
18
|
+
/** Ignore in test files. Default: true */
|
|
19
|
+
allowInTests?: boolean;
|
|
20
|
+
}
|
|
21
|
+
type RuleOptions = [Options?];
|
|
22
|
+
export declare const noSsrf: TSESLint.RuleModule<"ssrfVulnerability", RuleOptions, unknown, TSESLint.RuleListener> & {
|
|
23
|
+
name: string;
|
|
24
|
+
};
|
|
25
|
+
export {};
|
|
@@ -0,0 +1,228 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Copyright (c) 2025 Ofri Peretz
|
|
4
|
+
* Licensed under the MIT License. Use of this source code is governed by the
|
|
5
|
+
* MIT license that can be found in the LICENSE file.
|
|
6
|
+
*/
|
|
7
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
8
|
+
exports.noSsrf = void 0;
|
|
9
|
+
const eslint_devkit_1 = require("@interlace/eslint-devkit");
|
|
10
|
+
// HTTP client functions that make outbound requests
|
|
11
|
+
const HTTP_CLIENT_FUNCTIONS = new Set([
|
|
12
|
+
'fetch', // built-in / node-fetch
|
|
13
|
+
'got', // got
|
|
14
|
+
'nodeFetch', // node-fetch
|
|
15
|
+
'undici', // undici
|
|
16
|
+
]);
|
|
17
|
+
// HTTP client method calls (e.g., axios.get, http.request)
|
|
18
|
+
const HTTP_CLIENT_METHODS = new Set([
|
|
19
|
+
'get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'request',
|
|
20
|
+
]);
|
|
21
|
+
// Object names that are HTTP client libraries
|
|
22
|
+
const HTTP_CLIENT_OBJECTS = new Set([
|
|
23
|
+
'axios', 'got', 'superagent', 'request', 'http', 'https', 'undici',
|
|
24
|
+
]);
|
|
25
|
+
// Function names that indicate URL validation
|
|
26
|
+
const VALIDATION_FUNCTION_NAMES = new Set([
|
|
27
|
+
'validateUrl', 'validateURL', 'isValidUrl', 'isSafeUrl', 'isAllowed',
|
|
28
|
+
'isValidURL', 'checkUrl', 'checkURL', 'sanitizeUrl', 'sanitizeURL',
|
|
29
|
+
]);
|
|
30
|
+
// Substrings in identifier names that suggest user input
|
|
31
|
+
const USER_INPUT_SUBSTRINGS = [
|
|
32
|
+
'url', 'endpoint', 'uri', 'href', 'link',
|
|
33
|
+
'target', 'dest', 'source', 'host',
|
|
34
|
+
'user', 'input', 'param',
|
|
35
|
+
];
|
|
36
|
+
/**
|
|
37
|
+
* Check if a function parameter name suggests user input
|
|
38
|
+
*/
|
|
39
|
+
function isUserInputParamName(name) {
|
|
40
|
+
const lower = name.toLowerCase();
|
|
41
|
+
return USER_INPUT_SUBSTRINGS.some(sub => lower.includes(sub));
|
|
42
|
+
}
|
|
43
|
+
/**
|
|
44
|
+
* AST-based check: does this node contain a validation pattern?
|
|
45
|
+
* Walks the node tree looking for known validation constructs.
|
|
46
|
+
*/
|
|
47
|
+
function nodeContainsValidation(node) {
|
|
48
|
+
// new URL(x) — URL constructor (parsing/validation)
|
|
49
|
+
if (node.type === eslint_devkit_1.AST_NODE_TYPES.NewExpression &&
|
|
50
|
+
node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
|
|
51
|
+
node.callee.name === 'URL') {
|
|
52
|
+
return true;
|
|
53
|
+
}
|
|
54
|
+
// validateUrl(x), isValidUrl(x), etc.
|
|
55
|
+
if (node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
|
|
56
|
+
node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
|
|
57
|
+
VALIDATION_FUNCTION_NAMES.has(node.callee.name)) {
|
|
58
|
+
return true;
|
|
59
|
+
}
|
|
60
|
+
// arr.includes(x), set.has(x), x.startsWith('...'), regex.test(x)
|
|
61
|
+
if (node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
|
|
62
|
+
node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
|
|
63
|
+
node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
|
|
64
|
+
const method = node.callee.property.name;
|
|
65
|
+
if (method === 'includes' || method === 'has' || method === 'startsWith' || method === 'test' || method === 'some') {
|
|
66
|
+
return true;
|
|
67
|
+
}
|
|
68
|
+
}
|
|
69
|
+
// hostname === '...' or host === '...'
|
|
70
|
+
if (node.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression &&
|
|
71
|
+
(node.operator === '===' || node.operator === '==') &&
|
|
72
|
+
((node.left.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
|
|
73
|
+
node.left.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
|
|
74
|
+
(node.left.property.name === 'hostname' || node.left.property.name === 'host')) ||
|
|
75
|
+
(node.right.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
|
|
76
|
+
node.right.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
|
|
77
|
+
(node.right.property.name === 'hostname' || node.right.property.name === 'host')))) {
|
|
78
|
+
return true;
|
|
79
|
+
}
|
|
80
|
+
// throw new Error(...) — guard clause
|
|
81
|
+
if (node.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement) {
|
|
82
|
+
return true;
|
|
83
|
+
}
|
|
84
|
+
// Keys to skip: non-child properties that cause circular refs or aren't AST children
|
|
85
|
+
const SKIP_KEYS = new Set(['parent', 'range', 'loc', 'tokens', 'comments', 'start', 'end']);
|
|
86
|
+
// Recurse into child nodes
|
|
87
|
+
for (const key of Object.keys(node)) {
|
|
88
|
+
if (SKIP_KEYS.has(key))
|
|
89
|
+
continue;
|
|
90
|
+
const value = node[key];
|
|
91
|
+
if (value && typeof value === 'object' && 'type' in value) {
|
|
92
|
+
if (nodeContainsValidation(value))
|
|
93
|
+
return true;
|
|
94
|
+
}
|
|
95
|
+
if (Array.isArray(value)) {
|
|
96
|
+
for (const item of value) {
|
|
97
|
+
if (item && typeof item === 'object' && 'type' in item) {
|
|
98
|
+
if (nodeContainsValidation(item))
|
|
99
|
+
return true;
|
|
100
|
+
}
|
|
101
|
+
}
|
|
102
|
+
}
|
|
103
|
+
}
|
|
104
|
+
return false;
|
|
105
|
+
}
|
|
106
|
+
/**
|
|
107
|
+
* Check if there is URL validation before the HTTP call using AST walking
|
|
108
|
+
*/
|
|
109
|
+
function hasValidationBefore(node) {
|
|
110
|
+
// Walk up to find the containing block
|
|
111
|
+
let current = node.parent;
|
|
112
|
+
while (current) {
|
|
113
|
+
const parent = current.parent;
|
|
114
|
+
if (!parent)
|
|
115
|
+
break;
|
|
116
|
+
if (parent.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement || parent.type === eslint_devkit_1.AST_NODE_TYPES.Program) {
|
|
117
|
+
const body = parent.body;
|
|
118
|
+
const idx = body.indexOf(current);
|
|
119
|
+
// Check previous sibling statements for validation patterns
|
|
120
|
+
for (let i = idx - 1; i >= 0 && i >= idx - 10; i--) {
|
|
121
|
+
if (nodeContainsValidation(body[i])) {
|
|
122
|
+
return true;
|
|
123
|
+
}
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
// Check if inside an if-block where the condition contains validation
|
|
127
|
+
if (parent.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement && parent.test) {
|
|
128
|
+
if (nodeContainsValidation(parent.test)) {
|
|
129
|
+
return true;
|
|
130
|
+
}
|
|
131
|
+
}
|
|
132
|
+
current = parent;
|
|
133
|
+
}
|
|
134
|
+
return false;
|
|
135
|
+
}
|
|
136
|
+
exports.noSsrf = (0, eslint_devkit_1.createRule)({
|
|
137
|
+
name: 'no-ssrf',
|
|
138
|
+
meta: {
|
|
139
|
+
type: 'problem',
|
|
140
|
+
docs: {
|
|
141
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-ssrf.md',
|
|
142
|
+
description: 'Detects HTTP requests with user-controlled URLs (SSRF vulnerability)',
|
|
143
|
+
cwe: 'CWE-918',
|
|
144
|
+
cvss: 7.5,
|
|
145
|
+
},
|
|
146
|
+
messages: {
|
|
147
|
+
ssrfVulnerability: (0, eslint_devkit_1.formatLLMMessage)({
|
|
148
|
+
icon: eslint_devkit_1.MessageIcons.SECURITY,
|
|
149
|
+
issueName: 'Server-Side Request Forgery (SSRF)',
|
|
150
|
+
cwe: 'CWE-918',
|
|
151
|
+
description: 'HTTP request with potentially user-controlled URL. An attacker could access internal services.',
|
|
152
|
+
severity: 'HIGH',
|
|
153
|
+
fix: 'Validate URL against an allowlist of permitted hosts before making the request.',
|
|
154
|
+
documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html',
|
|
155
|
+
}),
|
|
156
|
+
},
|
|
157
|
+
schema: [
|
|
158
|
+
{
|
|
159
|
+
type: 'object',
|
|
160
|
+
properties: {
|
|
161
|
+
allowInTests: {
|
|
162
|
+
type: 'boolean',
|
|
163
|
+
default: true,
|
|
164
|
+
},
|
|
165
|
+
},
|
|
166
|
+
additionalProperties: false,
|
|
167
|
+
},
|
|
168
|
+
],
|
|
169
|
+
},
|
|
170
|
+
defaultOptions: [{ allowInTests: true }],
|
|
171
|
+
create(context, [options = {}]) {
|
|
172
|
+
const { allowInTests = true } = options || {};
|
|
173
|
+
const filename = context.filename;
|
|
174
|
+
const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
|
|
175
|
+
if (isTestFile)
|
|
176
|
+
return {};
|
|
177
|
+
return {
|
|
178
|
+
CallExpression(node) {
|
|
179
|
+
let isHttpCall = false;
|
|
180
|
+
// 1. Direct function call: fetch(url), got(url)
|
|
181
|
+
if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
|
|
182
|
+
HTTP_CLIENT_FUNCTIONS.has(node.callee.name)) {
|
|
183
|
+
isHttpCall = true;
|
|
184
|
+
}
|
|
185
|
+
// 2. Method call: axios.get(url), http.request(url)
|
|
186
|
+
if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
|
|
187
|
+
node.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
|
|
188
|
+
node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
|
|
189
|
+
HTTP_CLIENT_OBJECTS.has(node.callee.object.name) &&
|
|
190
|
+
HTTP_CLIENT_METHODS.has(node.callee.property.name)) {
|
|
191
|
+
isHttpCall = true;
|
|
192
|
+
}
|
|
193
|
+
if (!isHttpCall)
|
|
194
|
+
return;
|
|
195
|
+
// Check the first argument (the URL)
|
|
196
|
+
const urlArg = node.arguments[0];
|
|
197
|
+
if (!urlArg)
|
|
198
|
+
return;
|
|
199
|
+
// Safe: literal string URL — fetch('https://api.example.com')
|
|
200
|
+
if (urlArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal)
|
|
201
|
+
return;
|
|
202
|
+
// Safe: template literal without expressions — fetch(`https://api.example.com`)
|
|
203
|
+
if (urlArg.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral &&
|
|
204
|
+
urlArg.expressions.length === 0) {
|
|
205
|
+
return;
|
|
206
|
+
}
|
|
207
|
+
// The URL is dynamic (identifier, template with expressions, etc.)
|
|
208
|
+
// Check if there is URL validation before this call
|
|
209
|
+
if (hasValidationBefore(node)) {
|
|
210
|
+
return;
|
|
211
|
+
}
|
|
212
|
+
// Check if the argument is a function parameter that looks like user input
|
|
213
|
+
if (urlArg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
|
|
214
|
+
// If the variable name doesn't suggest user input, skip
|
|
215
|
+
// This reduces false positives on internal API calls
|
|
216
|
+
if (!isUserInputParamName(urlArg.name)) {
|
|
217
|
+
return;
|
|
218
|
+
}
|
|
219
|
+
}
|
|
220
|
+
context.report({
|
|
221
|
+
node,
|
|
222
|
+
messageId: 'ssrfVulnerability',
|
|
223
|
+
});
|
|
224
|
+
},
|
|
225
|
+
};
|
|
226
|
+
},
|
|
227
|
+
});
|
|
228
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-ssrf/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,4DAKkC;AAWlC,oDAAoD;AACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO,EAAQ,wBAAwB;IACvC,KAAK,EAAU,MAAM;IACrB,WAAW,EAAI,aAAa;IAC5B,QAAQ,EAAO,SAAS;CACzB,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;CACtE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;CACnE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IACpE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa;CACnE,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACxC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAClC,MAAM,EAAE,OAAO,EAAE,OAAO;CACzB,CAAC;AAEF;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAmB;IACjD,oDAAoD;IACpD,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,aAAa;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QAC7C,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACnD,CACE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;YACrD,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAChF,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtD,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CACnF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5F,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,KAAK,GAAI,IAA2C,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAK,KAAiC,EAAE,CAAC;YACvF,IAAI,sBAAsB,CAAC,KAAsB,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACvD,IAAI,sBAAsB,CAAC,IAAqB,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAA6B;IACxD,uCAAuC;IACvC,IAAI,OAAO,GAA+B,IAAmD,CAAC,MAAM,CAAC;IACrG,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAA+B,OAAsD,CAAC,MAAM,CAAC;QACzG,IAAI,CAAC,MAAM;YAAE,MAAM;QAEnB,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAA6B,CAAC,CAAC;YAExD,4DAA4D;YAC5D,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,MAAM,GAAG,IAAA,0BAAU,EAA0B;IACxD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,4GAA4G;YACjH,WAAW,EACT,sEAAsE;YACxE,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oCAAoC;gBAC/C,GAAG,EAAE,SAAS;gBACd,WAAW,EACT,gGAAgG;gBAClG,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,iFAAiF;gBACtF,iBAAiB,EACf,wGAAwG;aAC3G,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GACd,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,UAAU;YAAE,OAAO,EAAE,CAAC;QAE1B,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;gBAEvB,gDAAgD;gBAChD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,oDAAoD;gBACpD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAClD,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAExB,qCAAqC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBAEpB,8DAA8D;gBAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBAAE,OAAO;gBAEnD,gFAAgF;gBAChF,IACE,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;oBAC9C,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,mEAAmE;gBACnE,oDAAoD;gBACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBAED,2EAA2E;gBAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;oBAC9C,wDAAwD;oBACxD,qDAAqD;oBACrD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvC,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,mBAAmB;iBAC/B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -19,7 +19,10 @@ exports.noStaticIv = (0, eslint_devkit_1.createRule)({
|
|
|
19
19
|
meta: {
|
|
20
20
|
type: 'problem',
|
|
21
21
|
docs: {
|
|
22
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-static-iv.md',
|
|
22
23
|
description: 'Disallow static or hardcoded initialization vectors (IVs)',
|
|
24
|
+
cwe: 'CWE-329',
|
|
25
|
+
cvss: 7.5,
|
|
23
26
|
},
|
|
24
27
|
hasSuggestions: false,
|
|
25
28
|
messages: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-static-iv/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,4DAAsG;AAatG;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,cAAc,EAAG,aAAa;IAC9B,oBAAoB,EAAG,SAAS;CACjC,CAAC;AAEW,QAAA,UAAU,GAAG,IAAA,0BAAU,EAA0B;IAC5D,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,iHAAiH;YACtH,WAAW,EAAE,2DAA2D;YACxE,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,KAAK;QACrB,QAAQ,EAAE;YACR,QAAQ,EAAE,IAAA,gCAAgB,EAAC;gBACzB,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,2HAA2H;gBACxI,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,sDAAsD;gBAC3D,iBAAiB,EAAE,8GAA8G;aAClI,CAAC;YACF,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,uDAAuD;gBACpE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,oCAAoC;gBACzC,iBAAiB,EAAE,mEAAmE;aACvF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,gCAAgC;qBAC9C;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;SACpB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAkB,CAAC;QAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpF,4CAA4C;QAC5C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE5C,SAAS,uBAAuB,CAAC,IAAiC;YAChE,2CAA2C;YAC3C,IACE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAC1C,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,8BAAc,CAAC,cAAc,EACjD,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,EAC3C,CAAC;oBACD,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;gBACD,sFAAsF;gBACtF,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,EAClC,CAAC;oBACD,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,mBAAmB,CAAC,IAA6B;YACxD,IAAI,UAAU;gBAAE,OAAO;YAEvB,iCAAiC;YACjC,MAAM,cAAc,GAClB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACvD,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;gBACvG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC7C,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC;YAExF,IAAI,cAAc,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAChC,eAAe,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,SAAS,eAAe,CAAC,KAAsC;YAC7D,8BAA8B;YAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC1B,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACrE,cAAc,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,IACE,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;gBAC5C,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACrD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;gBACrC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACxD,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,EACjF,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAI,QAAQ,EAAE,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACpF,cAAc,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;gBACD,mFAAmF;gBACnF,kCAAkC;gBAClC,IAAI,QAAQ,EAAE,IAAI,KAAK,8BAAc,CAAC,eAAe,EAAE,CAAC;oBACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CACzC,CAAC,EAAuD,EAAW,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,CAC1I,CAAC;oBACF,IAAI,WAAW,EAAE,CAAC;wBAChB,cAAc,CAAC,KAAK,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,2DAA2D;YAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gBAC7C,qEAAqE;gBACrE,0EAA0E;gBAC1E,+EAA+E;YACjF,CAAC;QACH,CAAC;QAED,SAAS,cAAc,CAAC,IAAmB;YACzC,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,kBAAkB,EAAE,uBAAuB;YAC3C,cAAc,EAAE,mBAAmB;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -26,7 +26,10 @@ exports.noTimingUnsafeCompare = (0, eslint_devkit_1.createRule)({
|
|
|
26
26
|
meta: {
|
|
27
27
|
type: 'problem',
|
|
28
28
|
docs: {
|
|
29
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-timing-unsafe-compare.md',
|
|
29
30
|
description: 'Disallow timing-unsafe comparison of secrets',
|
|
31
|
+
cwe: 'CWE-208',
|
|
32
|
+
cvss: 7.5,
|
|
30
33
|
},
|
|
31
34
|
hasSuggestions: true,
|
|
32
35
|
messages: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-timing-unsafe-compare/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,4DAAsG;AAatG,MAAM,uBAAuB,GAAG;IAC9B,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW;IACzD,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;IACvD,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;IACtD,kCAAkC;IAClC,KAAK,EAAE,iBAAiB,EAAE,iBAAiB;IAC3C,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;IACjD,cAAc,EAAE,cAAc,EAAE,aAAa;IAC7C,eAAe,EAAE,eAAe,EAAE,cAAc;IAChD,YAAY,EAAE,YAAY,EAAE,WAAW;IACvC,YAAY,EAAE,YAAY,EAAE,WAAW;IACvC,gBAAgB,EAAE,gBAAgB,EAAE,eAAe;CACpD,CAAC;AAEW,QAAA,qBAAqB,GAAG,IAAA,0BAAU,EAA0B;IACvE,IAAI,EAAE,0BAA0B;IAChC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,6HAA6H;YAClI,WAAW,EAAE,8CAA8C;YAC3D,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,6IAA6I;gBAC1J,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,2DAA2D;gBAChE,iBAAiB,EAAE,6DAA6D;aACjF,CAAC;YACF,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,WAAW,EAAE,wDAAwD;gBACrE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,wDAAwD;gBAC7D,iBAAiB,EAAE,6DAA6D;aACjF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,uBAAuB;wBAChC,WAAW,EAAE,8CAA8C;qBAC5D;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,cAAc,EAAE,uBAAuB;SACxC;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,cAAc,GAAG,uBAAuB,EAAE,GAAG,OAAkB,CAAC;QACxE,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAE7D,SAAS,kBAAkB,CAAC,IAAmB;YAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gBAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;oBAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,SAAS,qBAAqB,CAAC,IAA+B;YAC5D,kCAAkC;YAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;gBACjD,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,2CAA2C;YAC3C,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAErD,IAAI,YAAY,IAAI,aAAa,EAAE,CAAC;gBAClC,4FAA4F;gBAC5F,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,qBAAqB;oBAChC,OAAO,EAAE;wBACP;4BACE,SAAS,EAAE,oBAAoB;4BAC/B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,sBAAsB;yBACxC;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,gBAAgB,EAAE,qBAAqB;SACxC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -13,7 +13,10 @@ exports.noToctouVulnerability = (0, eslint_devkit_2.createRule)({
|
|
|
13
13
|
meta: {
|
|
14
14
|
type: 'problem',
|
|
15
15
|
docs: {
|
|
16
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-toctou-vulnerability.md',
|
|
16
17
|
description: 'Detects Time-of-Check-Time-of-Use vulnerabilities',
|
|
18
|
+
cwe: 'CWE-367',
|
|
19
|
+
cvss: 7.5,
|
|
17
20
|
},
|
|
18
21
|
hasSuggestions: true,
|
|
19
22
|
messages: {
|
|
@@ -77,12 +80,12 @@ exports.noToctouVulnerability = (0, eslint_devkit_2.createRule)({
|
|
|
77
80
|
],
|
|
78
81
|
create(context, [options = {}]) {
|
|
79
82
|
const { ignoreInTests = true } = options || {};
|
|
80
|
-
const filename = context.
|
|
83
|
+
const filename = context.filename;
|
|
81
84
|
const isTestFile = ignoreInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
|
|
82
85
|
if (isTestFile) {
|
|
83
86
|
return {};
|
|
84
87
|
}
|
|
85
|
-
const sourceCode = context.sourceCode
|
|
88
|
+
const sourceCode = context.sourceCode;
|
|
86
89
|
/**
|
|
87
90
|
* Check for TOCTOU patterns
|
|
88
91
|
*/
|