eslint-plugin-node-security 4.0.4 → 4.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +27 -0
- package/LICENSE +23 -0
- package/README.md +58 -47
- package/package.json +15 -2
- package/src/index.js +16 -2
- package/src/index.js.map +1 -1
- package/src/oxlint.d.ts +20 -0
- package/src/oxlint.js +22 -0
- package/src/oxlint.js.map +1 -0
- package/src/rules/detect-child-process/index.js +26 -6
- package/src/rules/detect-child-process/index.js.map +1 -1
- package/src/rules/detect-eval-with-expression/index.js +16 -5
- package/src/rules/detect-eval-with-expression/index.js.map +1 -1
- package/src/rules/detect-non-literal-fs-filename/index.js +14 -7
- package/src/rules/detect-non-literal-fs-filename/index.js.map +1 -1
- package/src/rules/detect-suspicious-dependencies/index.js +4 -0
- package/src/rules/detect-suspicious-dependencies/index.js.map +1 -1
- package/src/rules/lock-file/index.js +25 -9
- package/src/rules/lock-file/index.js.map +1 -1
- package/src/rules/no-arbitrary-file-access/index.js +5 -2
- package/src/rules/no-arbitrary-file-access/index.js.map +1 -1
- package/src/rules/no-buffer-overread/index.js +36 -2
- package/src/rules/no-buffer-overread/index.js.map +1 -1
- package/src/rules/no-cryptojs/index.js +3 -0
- package/src/rules/no-cryptojs/index.js.map +1 -1
- package/src/rules/no-cryptojs-weak-random/index.js +3 -0
- package/src/rules/no-cryptojs-weak-random/index.js.map +1 -1
- package/src/rules/no-data-in-temp-storage/index.js +3 -0
- package/src/rules/no-data-in-temp-storage/index.js.map +1 -1
- package/src/rules/no-deprecated-buffer/index.d.ts +23 -0
- package/src/rules/no-deprecated-buffer/index.js +73 -0
- package/src/rules/no-deprecated-buffer/index.js.map +1 -0
- package/src/rules/no-deprecated-cipher-method/index.js +3 -0
- package/src/rules/no-deprecated-cipher-method/index.js.map +1 -1
- package/src/rules/no-dynamic-dependency-loading/index.js +3 -0
- package/src/rules/no-dynamic-dependency-loading/index.js.map +1 -1
- package/src/rules/no-dynamic-require/index.js +6 -1
- package/src/rules/no-dynamic-require/index.js.map +1 -1
- package/src/rules/no-ecb-mode/index.js +3 -0
- package/src/rules/no-ecb-mode/index.js.map +1 -1
- package/src/rules/no-insecure-key-derivation/index.js +3 -0
- package/src/rules/no-insecure-key-derivation/index.js.map +1 -1
- package/src/rules/no-insecure-rsa-padding/index.js +3 -0
- package/src/rules/no-insecure-rsa-padding/index.js.map +1 -1
- package/src/rules/no-pii-in-logs/index.js +3 -0
- package/src/rules/no-pii-in-logs/index.js.map +1 -1
- package/src/rules/no-self-signed-certs/index.js +3 -0
- package/src/rules/no-self-signed-certs/index.js.map +1 -1
- package/src/rules/no-sha1-hash/index.js +3 -0
- package/src/rules/no-sha1-hash/index.js.map +1 -1
- package/src/rules/no-ssrf/index.js +4 -1
- package/src/rules/no-ssrf/index.js.map +1 -1
- package/src/rules/no-static-iv/index.js +3 -0
- package/src/rules/no-static-iv/index.js.map +1 -1
- package/src/rules/no-timing-unsafe-compare/index.js +3 -0
- package/src/rules/no-timing-unsafe-compare/index.js.map +1 -1
- package/src/rules/no-toctou-vulnerability/index.js +5 -2
- package/src/rules/no-toctou-vulnerability/index.js.map +1 -1
- package/src/rules/no-unsafe-dynamic-require/index.js +4 -0
- package/src/rules/no-unsafe-dynamic-require/index.js.map +1 -1
- package/src/rules/no-weak-cipher-algorithm/index.js +3 -0
- package/src/rules/no-weak-cipher-algorithm/index.js.map +1 -1
- package/src/rules/no-weak-hash-algorithm/index.js +3 -0
- package/src/rules/no-weak-hash-algorithm/index.js.map +1 -1
- package/src/rules/no-zip-slip/index.js +40 -62
- package/src/rules/no-zip-slip/index.js.map +1 -1
- package/src/rules/prefer-native-crypto/index.js +3 -0
- package/src/rules/prefer-native-crypto/index.js.map +1 -1
- package/src/rules/require-dependency-integrity/index.js +3 -0
- package/src/rules/require-dependency-integrity/index.js.map +1 -1
- package/src/rules/require-secure-credential-storage/index.js +3 -0
- package/src/rules/require-secure-credential-storage/index.js.map +1 -1
- package/src/rules/require-secure-deletion/index.js +3 -0
- package/src/rules/require-secure-deletion/index.js.map +1 -1
- package/src/rules/require-storage-encryption/index.js +3 -0
- package/src/rules/require-storage-encryption/index.js.map +1 -1
- package/src/types/index.js.map +1 -1
|
@@ -35,6 +35,7 @@ const EVAL_PATTERNS = [
|
|
|
35
35
|
safeAlternative: 'Template literals or template engine',
|
|
36
36
|
example: {
|
|
37
37
|
bad: 'eval(\'Hello \' + userName + \'!\')',
|
|
38
|
+
// oxlint-disable-next-line no-template-curly-in-string
|
|
38
39
|
good: 'const template = `Hello ${userName}!`;'
|
|
39
40
|
},
|
|
40
41
|
effort: '3 minutes'
|
|
@@ -55,7 +56,11 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
|
|
|
55
56
|
meta: {
|
|
56
57
|
type: 'problem',
|
|
57
58
|
docs: {
|
|
59
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-eval-with-expression.md',
|
|
58
60
|
description: 'Detects eval(variable) which can allow an attacker to run arbitrary code',
|
|
61
|
+
cwe: 'CWE-95',
|
|
62
|
+
cvss: 9.5,
|
|
63
|
+
confidence: 'high',
|
|
59
64
|
},
|
|
60
65
|
messages: {
|
|
61
66
|
// 🎯 Token optimization: 38% reduction (47→29 tokens) - compact format saves LLM processing
|
|
@@ -91,7 +96,9 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
|
|
|
91
96
|
issueName: 'Unsafe eval() for string interpolation',
|
|
92
97
|
cwe: 'CWE-95',
|
|
93
98
|
description: 'Use template literals instead of eval() for string interpolation',
|
|
99
|
+
// oxlint-disable-next-line no-template-curly-in-string
|
|
94
100
|
severity: 'HIGH',
|
|
101
|
+
// oxlint-disable-next-line no-template-curly-in-string
|
|
95
102
|
fix: 'Replace eval() with template literals: `Hello ${name}`',
|
|
96
103
|
documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
|
|
97
104
|
}),
|
|
@@ -181,14 +188,15 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
|
|
|
181
188
|
* All functions that can execute arbitrary code
|
|
182
189
|
* NOTE: setTimeout/setInterval are NOT eval-like - they don't execute code strings
|
|
183
190
|
*/
|
|
184
|
-
const evalFunctions = [
|
|
191
|
+
const evalFunctions = new Set([
|
|
185
192
|
'eval',
|
|
186
193
|
'Function',
|
|
187
194
|
...additionalEvalFunctions
|
|
188
|
-
];
|
|
195
|
+
]);
|
|
189
196
|
/**
|
|
190
197
|
* Check if a node is a literal string (safe)
|
|
191
198
|
*/
|
|
199
|
+
// oxlint-disable-next-line consistent-function-scoping
|
|
192
200
|
const isLiteralString = (node) => {
|
|
193
201
|
return node.type === 'Literal' && typeof node.value === 'string';
|
|
194
202
|
};
|
|
@@ -232,6 +240,7 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
|
|
|
232
240
|
/**
|
|
233
241
|
* Generate refactoring steps based on pattern
|
|
234
242
|
*/
|
|
243
|
+
// oxlint-disable-next-line consistent-function-scoping
|
|
235
244
|
const generateRefactoringSteps = (pattern) => {
|
|
236
245
|
if (!pattern) {
|
|
237
246
|
return [
|
|
@@ -257,8 +266,10 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
|
|
|
257
266
|
' 3. Validate inputs are numbers',
|
|
258
267
|
' 4. Consider using a math expression parser library'
|
|
259
268
|
].join('\n');
|
|
269
|
+
// oxlint-disable-next-line no-template-curly-in-string
|
|
260
270
|
case 'template':
|
|
261
271
|
return [
|
|
272
|
+
// oxlint-disable-next-line no-template-curly-in-string
|
|
262
273
|
' 1. Use template literals: `Hello ${name}`',
|
|
263
274
|
' 2. Sanitize variables before interpolation',
|
|
264
275
|
' 3. Use a template engine like Handlebars if complex',
|
|
@@ -284,7 +295,7 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
|
|
|
284
295
|
* Extract expression text for pattern analysis
|
|
285
296
|
*/
|
|
286
297
|
const extractExpression = (node) => {
|
|
287
|
-
const sourceCode = context.sourceCode
|
|
298
|
+
const sourceCode = context.sourceCode;
|
|
288
299
|
// Try to get the argument text
|
|
289
300
|
if (node.arguments.length > 0) {
|
|
290
301
|
return sourceCode.getText(node.arguments[0]);
|
|
@@ -297,7 +308,7 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
|
|
|
297
308
|
const checkCallExpression = (node) => {
|
|
298
309
|
// Check if it's a call to an eval-like function
|
|
299
310
|
if (node.callee.type === 'Identifier' &&
|
|
300
|
-
evalFunctions.
|
|
311
|
+
evalFunctions.has(node.callee.name)) {
|
|
301
312
|
// Skip if it's a literal string and literals are allowed
|
|
302
313
|
if (allowLiteralStrings &&
|
|
303
314
|
node.arguments.length > 0 &&
|
|
@@ -367,7 +378,7 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
|
|
|
367
378
|
const checkNewExpression = (node) => {
|
|
368
379
|
// Check for new Function() usage
|
|
369
380
|
if (node.callee.type === 'Identifier' && node.callee.name === 'Function') {
|
|
370
|
-
const sourceCode = context.sourceCode
|
|
381
|
+
const sourceCode = context.sourceCode;
|
|
371
382
|
const expression = node.arguments.map((arg) => sourceCode.getText(arg)).join(', ');
|
|
372
383
|
const pattern = detectPattern(expression);
|
|
373
384
|
const strategyMessageId = selectStrategyMessage(pattern);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/detect-eval-with-expression/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAA0E;AAC1E,4DAAsD;AAqCtD,MAAM,aAAa,GAAkB;IACnC;QACE,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,MAAM;QAChB,eAAe,EAAE,cAAc;QAC/B,OAAO,EAAE;YACP,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,6CAA6C;SACpD;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,MAAM;QAChB,eAAe,EAAE,uCAAuC;QACxD,OAAO,EAAE;YACP,GAAG,EAAE,gDAAgD;YACrD,IAAI,EAAE,8EAA8E;SACrF;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,sCAAsC;QACvD,OAAO,EAAE;YACP,GAAG,EAAE,qCAAqC;YAC1C,uDAAuD;YACvD,IAAI,EAAE,wCAAwC;SAC/C;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,QAAQ;QAClB,eAAe,EAAE,+BAA+B;QAChD,OAAO,EAAE;YACP,GAAG,EAAE,2BAA2B;YAChC,IAAI,EAAE,yFAAyF;SAChG;QACD,MAAM,EAAE,WAAW;KACpB;CACF,CAAC;AAEW,QAAA,wBAAwB,GAAG,IAAA,0BAAU,EAA0B;IAC1E,IAAI,EAAE,6BAA6B;IACnC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,gIAAgI;YACrI,WAAW,EAAE,0EAA0E;YACvF,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,GAAG;YACT,UAAU,EAAE,MAAM;SACnB;QACD,QAAQ,EAAE;YACR,4FAA4F;YAC5F,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,0BAA0B;gBACvC,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,gCAAgC;gBAC3C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,4DAA4D;gBACzE,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mCAAmC;gBAC9C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,0EAA0E;gBACvF,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,gDAAgD;gBACrD,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,wCAAwC;gBACnD,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,kEAAkE;gBAC/E,uDAAuD;gBACvD,QAAQ,EAAE,MAAM;gBAChB,uDAAuD;gBACvD,GAAG,EAAE,wDAAwD;gBAC7D,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,4DAA4D;gBACzE,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,oDAAoD;gBACzD,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,8BAA8B;gBACzC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,6CAA6C;gBAC1D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,iBAAiB;gBACtB,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,wCAAwC;gBACnD,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,iDAAiD;gBACtD,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,6BAA6B;gBACxC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,+CAA+C;gBAC5D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,gCAAgC;gBAC3C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,+CAA+C;gBAC5D,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,0CAA0C;gBAC/C,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,mBAAmB,EAAE;wBACnB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,oDAAoD;qBAClE;oBACD,uBAAuB,EAAE;wBACvB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,4CAA4C;qBAC1D;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC;wBAChD,OAAO,EAAE,MAAM;wBACf,WAAW,EAAE,yDAAyD;qBACvE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,mBAAmB,EAAE,KAAK;YAC1B,uBAAuB,EAAE,EAAE;YAC3B,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACJ,mBAAmB,GAAG,KAAK,EAC3B,uBAAuB,GAAG,EAAE,EAC5B,QAAQ,GAAG,MAAM,EAClB,GAAY,OAAO,IAAI,EAAE,CAAC;QAE3B;;;WAGG;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;YAC5B,MAAM;YACN,UAAU;YACV,GAAG,uBAAuB;SAC3B,CAAC,CAAC;QAEH;;WAEG;QACH,uDAAuD;QACvD,MAAM,eAAe,GAAG,CAAC,IAAmB,EAAW,EAAE;YACvD,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,qBAAqB,GAAG,CAAC,OAA2B,EAAc,EAAE;YACxE,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,QAAQ;oBACX,OAAO,gBAAgB,CAAC;gBAC1B,KAAK,UAAU;oBACb,OAAO,kBAAkB,CAAC;gBAC5B,KAAK,UAAU;oBACb,OAAO,kBAAkB,CAAC;gBAC5B,KAAK,MAAM,CAAC;gBACZ;oBACE,gDAAgD;oBAChD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;wBAC3C,OAAO,cAAc,CAAC;oBACxB,CAAC;oBACD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAC7C,OAAO,iBAAiB,CAAC;oBAC3B,CAAC;oBACD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;wBAC/C,OAAO,oBAAoB,CAAC;oBAC9B,CAAC;oBACD,OAAO,kBAAkB,CAAC,CAAC,2CAA2C;YAC1E,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAsB,EAAE;YAC/D,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACtD,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;WAEG;QACH,uDAAuD;QACvD,MAAM,wBAAwB,GAAG,CAAC,OAA2B,EAAU,EAAE;YACvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,oCAAoC;oBACpC,mDAAmD;oBACnD,gEAAgE;oBAChE,uDAAuD;oBACvD,sCAAsC;iBACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;YAED,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzB,KAAK,MAAM;oBACT,OAAO;wBACL,wCAAwC;wBACxC,yCAAyC;wBACzC,6CAA6C;wBAC7C,8CAA8C;qBAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,KAAK,MAAM;oBACT,OAAO;wBACL,kDAAkD;wBAClD,8CAA8C;wBAC9C,mCAAmC;wBACnC,uDAAuD;qBACxD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,uDAAuD;gBACvD,KAAK,UAAU;oBACb,OAAO;wBACL,uDAAuD;wBACvD,8CAA8C;wBAC9C,+CAA+C;wBAC/C,wDAAwD;wBACxD,mCAAmC;qBACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,KAAK,QAAQ;oBACX,OAAO;wBACL,oDAAoD;wBACpD,wCAAwC;wBACxC,kCAAkC;wBAClC,sDAAsD;qBACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf;oBACE,OAAO;wBACL,sCAAsC;wBACtC,yCAAyC;wBACzC,0CAA0C;wBAC1C,uCAAuC;qBACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,iBAAiB,GAAG,CAAC,IAA6B,EAAU,EAAE;YAClE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAEtC,+BAA+B;YAC/B,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;YAED,OAAO,oBAAoB,CAAC;QAC9B,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,mBAAmB,GAAG,CAAC,IAA6B,EAAE,EAAE;YAC5D,gDAAgD;YAChD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACjC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAExC,yDAAyD;gBACzD,IAAI,mBAAmB;oBACnB,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;oBACzB,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,OAAO;gBACT,CAAC;gBAED,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;oBAC3B,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,OAAO;gBACT,CAAC;gBAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE;wBACJ,UAAU;wBACV,eAAe,EAAE,OAAO,EAAE,QAAQ,IAAI,wBAAwB;wBAC9D,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,sBAAsB;wBACnE,KAAK;wBACL,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,eAAe;qBAC3C;oBACD,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;wBACjB;4BACE,SAAS,EAAE,iBAAiB;4BAC5B,IAAI,EAAE;gCACJ,eAAe,EAAE,OAAO,CAAC,eAAe;gCACxC,WAAW,EAAE,OAAO,CAAC,eAAe;6BACrC;4BACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,8CAA8C;yBAC/D;qBACF,CAAC,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,4CAA4C;YAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAE3C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE;wBACJ,UAAU,EAAE,gBAAgB,UAAU,GAAG;wBACzC,eAAe,EAAE,sBAAsB;wBACvC,eAAe,EAAE,oCAAoC;wBACrD,KAAK,EAAE;4BACL,wDAAwD;4BACxD,wCAAwC;4BACxC,kCAAkC;4BAClC,uCAAuC;yBACxC,CAAC,IAAI,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,YAAY;qBACrB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,kBAAkB,GAAG,CAAC,IAA4B,EAAE,EAAE;YAC1D,iCAAiC;YACjC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;gBACtC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClG,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE;wBACJ,UAAU,EAAE,gBAAgB,UAAU,GAAG;wBACzC,eAAe,EAAE,sBAAsB;wBACvC,eAAe,EAAE,oCAAoC;wBACrD,KAAK,EAAE;4BACL,wDAAwD;4BACxD,wCAAwC;4BACxC,kCAAkC;4BAClC,uCAAuC;yBACxC,CAAC,IAAI,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,YAAY;qBACrB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,OAAO;YACL,cAAc,EAAE,mBAAmB;YACnC,aAAa,EAAE,kBAAkB;SAClC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -59,7 +59,10 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
|
|
|
59
59
|
meta: {
|
|
60
60
|
type: 'problem',
|
|
61
61
|
docs: {
|
|
62
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-non-literal-fs-filename.md',
|
|
62
63
|
description: 'Detects variable in filename argument of fs calls, which might allow an attacker to access anything on your system',
|
|
64
|
+
cwe: 'CWE-22',
|
|
65
|
+
confidence: 'medium',
|
|
63
66
|
},
|
|
64
67
|
messages: {
|
|
65
68
|
// 🎯 Token optimization: 39% reduction (49→30 tokens) - template variables still work
|
|
@@ -151,7 +154,7 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
|
|
|
151
154
|
/**
|
|
152
155
|
* File system methods that can be dangerous with user input
|
|
153
156
|
*/
|
|
154
|
-
const dangerousMethods = [
|
|
157
|
+
const dangerousMethods = new Set([
|
|
155
158
|
'readFile', 'readFileSync',
|
|
156
159
|
'writeFile', 'writeFileSync',
|
|
157
160
|
'appendFile', 'appendFileSync',
|
|
@@ -164,16 +167,18 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
|
|
|
164
167
|
'access', 'accessSync',
|
|
165
168
|
'createReadStream', 'createWriteStream',
|
|
166
169
|
...additionalMethods
|
|
167
|
-
];
|
|
170
|
+
]);
|
|
168
171
|
/**
|
|
169
172
|
* Check if a node is a literal string (safe)
|
|
170
173
|
*/
|
|
174
|
+
// oxlint-disable-next-line consistent-function-scoping
|
|
171
175
|
const isLiteralString = (node) => {
|
|
172
176
|
return node.type === 'Literal' && typeof node.value === 'string';
|
|
173
177
|
};
|
|
174
178
|
/**
|
|
175
179
|
* Check if path has dangerous patterns like ../ or ..\
|
|
176
180
|
*/
|
|
181
|
+
// oxlint-disable-next-line consistent-function-scoping
|
|
177
182
|
const hasTraversalPatterns = (pathStr) => {
|
|
178
183
|
return /\.\.[/\\]/.test(pathStr) || /^\.\.[/\\]/.test(pathStr);
|
|
179
184
|
};
|
|
@@ -188,7 +193,7 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
|
|
|
188
193
|
const operation = FS_OPERATIONS.find(op => op.method === method) || null;
|
|
189
194
|
// First argument is usually the path
|
|
190
195
|
const pathNode = node.arguments.length > 0 ? node.arguments[0] : null;
|
|
191
|
-
const sourceCode = context.sourceCode
|
|
196
|
+
const sourceCode = context.sourceCode;
|
|
192
197
|
const path = pathNode ? sourceCode.getText(pathNode) : '';
|
|
193
198
|
return { path, pathNode, method, operation };
|
|
194
199
|
};
|
|
@@ -291,13 +296,14 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
|
|
|
291
296
|
const varName = pathNode.name;
|
|
292
297
|
// AST-based validation detection (faster than getText + regex)
|
|
293
298
|
const isValidationCall = (testNode) => {
|
|
294
|
-
// Handle negation: !path.startsWith(...)
|
|
295
|
-
|
|
299
|
+
// Handle negation: !path.startsWith(...). The negation flag was
|
|
300
|
+
// tracked here but never read afterwards (CodeQL:
|
|
301
|
+
// `js/useless-assignment-to-local`); current callers only need to
|
|
302
|
+
// know whether the call matches a validation idiom.
|
|
296
303
|
if (testNode.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression &&
|
|
297
304
|
testNode.operator === '!' &&
|
|
298
305
|
testNode.argument.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
|
|
299
306
|
testNode = testNode.argument;
|
|
300
|
-
_isNegated = true;
|
|
301
307
|
}
|
|
302
308
|
if (testNode.type !== eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
|
|
303
309
|
return false;
|
|
@@ -385,6 +391,7 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
|
|
|
385
391
|
/**
|
|
386
392
|
* Generate refactoring steps based on the operation
|
|
387
393
|
*/
|
|
394
|
+
// oxlint-disable-next-line consistent-function-scoping
|
|
388
395
|
const generateRefactoringSteps = (operation) => {
|
|
389
396
|
switch (operation.method) {
|
|
390
397
|
case 'readFile':
|
|
@@ -447,7 +454,7 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
|
|
|
447
454
|
}
|
|
448
455
|
const methodName = node.callee.property.name;
|
|
449
456
|
// Skip if not a dangerous method
|
|
450
|
-
if (!dangerousMethods.
|
|
457
|
+
if (!dangerousMethods.has(methodName)) {
|
|
451
458
|
return;
|
|
452
459
|
}
|
|
453
460
|
const { path, pathNode, method, operation } = extractPathArgument(node);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-node-security/src/rules/detect-non-literal-fs-filename/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAA0F;AAC1F,4DAAsD;AAgCtD,MAAM,aAAa,GAAkB;IACnC;QACE,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,aAAa;QAC5B,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE;YACP,GAAG,EAAE,iCAAiC;YACtC,IAAI,EAAE,wGAAwG;SAC/G;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,aAAa;QAC5B,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE;YACP,GAAG,EAAE,wCAAwC;YAC7C,IAAI,EAAE,8GAA8G;SACrH;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,gBAAgB;QAC/B,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE;YACP,GAAG,EAAE,6BAA6B;YAClC,IAAI,EAAE,0IAA0I;SACjJ;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,qBAAqB;QACpC,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE;YACP,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,iJAAiJ;SACxJ;QACD,MAAM,EAAE,eAAe;KACxB;CACF,CAAC;AAEW,QAAA,0BAA0B,GAAG,IAAA,0BAAU,EAA0B;IAC5E,IAAI,EAAE,gCAAgC;IACtC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,oHAAoH;SAClI;QACD,QAAQ,EAAE;YACR,sFAAsF;YACtF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,gBAAgB;gBAC3B,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,8BAA8B;gBAC3C,QAAQ,EAAE,eAAe;gBACzB,GAAG,EAAE,iBAAiB;gBACtB,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,WAAW,EAAE,uCAAuC;gBACpD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mCAAmC;gBACxC,iBAAiB,EAAE,mDAAmD;aACvE,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,eAAe;gBAC1B,WAAW,EAAE,iDAAiD;gBAC9D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,uDAAuD;gBAC5D,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,WAAW,EAAE,IAAA,gCAAgB,EAAC;gBAC5B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,mDAAmD;gBAChE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0BAA0B;gBAC/B,iBAAiB,EAAE,0DAA0D;aAC9E,CAAC;YACF,aAAa,EAAE,IAAA,gCAAgB,EAAC;gBAC9B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,WAAW,EAAE,0BAA0B;gBACvC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,qDAAqD;gBAC1D,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,sBAAsB;gBACjC,WAAW,EAAE,mCAAmC;gBAChD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,6EAA6E;gBAClF,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,aAAa,EAAE;wBACb,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,4BAA4B;qBAC1C;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,gCAAgC;qBAC9C;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,mDAAmD;qBACjE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,aAAa,EAAE,KAAK;YACpB,iBAAiB,EAAE,EAAE;SACtB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACV,aAAa,GAAG,KAAK,EACf,iBAAiB,GAAG,EAAE,EAE3B,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvB;;WAEG;QACH,MAAM,gBAAgB,GAAG;YACvB,UAAU,EAAE,cAAc;YAC1B,WAAW,EAAE,eAAe;YAC5B,YAAY,EAAE,gBAAgB;YAC9B,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,aAAa;YACxB,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,WAAW;YACpB,QAAQ,EAAE,YAAY;YACtB,kBAAkB,EAAE,mBAAmB;YACvC,GAAG,iBAAiB;SACrB,CAAC;QAEF;;WAEG;QACH,MAAM,eAAe,GAAG,CAAC,IAAmB,EAAW,EAAE;YACvD,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAW,EAAE;YACxD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,mBAAmB,GAAG,CAAC,IAA6B,EAKxD,EAAE;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACrD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;gBAC3B,CAAC,CAAC,SAAS,CAAC;YAE5B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;YAEzE,qCAAqC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;YAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE1D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/C,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,eAAe,GAAG,CAAC,QAA8B,EAAE,OAAe,EAAW,EAAE;YACnF,+BAA+B;YAC/B,IAAI,aAAa,IAAI,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mDAAmD;YACnD,IAAI,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,sEAAsE;YACtE,IAAI,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,sEAAsE;YACtE,IAAI,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,4EAA4E;YAC5E,sFAAsF;YACtF,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;gBAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAChD,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;oBAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAClD,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvD,gFAAgF;oBAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAE,EAAE,CACnE,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CACnE,CAAC;oBACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,GAAkB,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;wBAChG,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+BAA+B;YAC/B,OAAO,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC,CAAC;QAEF;;;;;;WAMG;QACH,MAAM,sBAAsB,GAAG,CAAC,QAAuB,EAAW,EAAE;YAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAChD,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;gBAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC;YAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,cAAc,GAClB,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC;gBAC9E,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;YAEnF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,wCAAwC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACzE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,gDAAgD;gBAChD,IAAI,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC5C,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;;;;;WAMG;QACH,MAAM,iBAAiB,GAAG,CAAC,QAAuB,EAAW,EAAE;YAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;YAE9B,+DAA+D;YAC/D,MAAM,gBAAgB,GAAG,CAAC,QAAuB,EAAW,EAAE;gBAC5D,yCAAyC;gBACzC,IAAI,UAAU,GAAG,KAAK,CAAC;gBACvB,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;oBAChD,QAAQ,CAAC,QAAQ,KAAK,GAAG;oBACzB,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;oBAC7D,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;oBAC7B,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;oBACpD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,8DAA8D;gBAC9D,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACxD,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACzD,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;oBACvC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC3D,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBAC9C,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,oEAAoE;gBACpE,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACxD,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC3D,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACjD,uCAAuC;oBACvC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;wBACrC,IAAI,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;4BACnE,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,sDAAsD;gBACtD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACxD,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC3D,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC7C,uCAAuC;oBACvC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;wBACrC,IAAI,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;4BACnE,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YAEF,MAAM,YAAY,GAAG,CAAC,UAA8B,EAAW,EAAE;gBAC/D,IAAI,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;oBACtD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;wBAC3C,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,CAC7C,CAAC;gBACJ,CAAC;gBACD,OAAO,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;oBACjD,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,CAAC;YAC5D,CAAC,CAAC;YAEF,0DAA0D;YAC1D,IAAI,OAAO,GAA8B,QAAQ,CAAC,MAAM,CAAC;YACzD,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAE9B,OAAO,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACrC,8CAA8C;gBAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,EAAE,CAAC;oBAChD,IAAI,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnC,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAED,0FAA0F;gBAC1F,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,IAAI,CACpE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,mBAAmB;oBAC1D,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,kBAAkB;oBACzD,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAEpE,iBAAiB,GAAG,IAAI,CAAC;oBACzB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;oBAC/B,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,IAAwB,EAAE,EAAE;wBACjE,IAAI,KAAK,GAA8B,QAAQ,CAAC;wBAChD,OAAO,KAAK,EAAE,CAAC;4BACb,IAAI,KAAK,KAAK,IAAI;gCAAE,OAAO,IAAI,CAAC;4BAChC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;wBACvB,CAAC;wBACD,OAAO,KAAK,CAAC;oBACf,CAAC,CAAC,CAAC;oBAEH,uEAAuE;oBACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;wBACnC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;wBAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW;4BACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;4BAC3B,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;4BAClC,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC3B,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,wBAAwB,GAAG,CAAC,SAAsB,EAAU,EAAE;YAClE,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;gBACzB,KAAK,UAAU,CAAC;gBAChB,KAAK,WAAW;oBACd,OAAO;wBACL,yDAAyD;wBACzD,yDAAyD;wBACzD,2EAA2E;wBAC3E,2CAA2C;wBAC3C,4CAA4C;qBAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,KAAK,MAAM;oBACT,OAAO;wBACL,gDAAgD;wBAChD,iEAAiE;wBACjE,yDAAyD;wBACzD,qDAAqD;wBACrD,0CAA0C;qBAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,KAAK,SAAS;oBACZ,OAAO;wBACL,uEAAuE;wBACvE,uDAAuD;wBACvD,8CAA8C;wBAC9C,iDAAiD;wBACjD,wDAAwD;qBACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf;oBACE,OAAO;wBACL,mDAAmD;wBACnD,mDAAmD;wBACnD,mDAAmD;wBACnD,4DAA4D;wBAC5D,wCAAwC;qBACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,kBAAkB,GAAG,CAAC,SAAsB,EAAE,OAAe,EAAU,EAAE;YAC7E,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;gBACxB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,WAAW,GAAG,CAAC,IAA6B,EAAE,EAAE;YACpD,kCAAkC;YAClC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI;gBAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC/C,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAE7C,iCAAiC;YACjC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAExE,0CAA0C;YAC1C,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,oCAAoC,CAAC;YACrG,MAAM,WAAW,GAAG,SAAS,EAAE,WAAW,IAAI,oCAAoC,CAAC;YAEnF,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE;oBACJ,MAAM;oBACN,IAAI;oBACJ,SAAS;oBACT,aAAa,EAAE,SAAS,EAAE,aAAa,IAAI,gBAAgB;oBAC3D,WAAW;oBACX,KAAK;oBACL,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,eAAe;iBAC7C;gBACD,OAAO,EAAE;oBACP;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,cAAc;wBACzB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,aAAa;wBACxB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,eAAe;wBAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,qBAAqB;wBAChC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO;YACL,cAAc,EAAE,WAAW;SAC5B,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/detect-non-literal-fs-filename/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAA0F;AAC1F,4DAAsD;AAgCtD,MAAM,aAAa,GAAkB;IACnC;QACE,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,aAAa;QAC5B,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE;YACP,GAAG,EAAE,iCAAiC;YACtC,IAAI,EAAE,wGAAwG;SAC/G;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,aAAa;QAC5B,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE;YACP,GAAG,EAAE,wCAAwC;YAC7C,IAAI,EAAE,8GAA8G;SACrH;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,gBAAgB;QAC/B,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE;YACP,GAAG,EAAE,6BAA6B;YAClC,IAAI,EAAE,0IAA0I;SACjJ;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,qBAAqB;QACpC,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE;YACP,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,iJAAiJ;SACxJ;QACD,MAAM,EAAE,eAAe;KACxB;CACF,CAAC;AAEW,QAAA,0BAA0B,GAAG,IAAA,0BAAU,EAA0B;IAC5E,IAAI,EAAE,gCAAgC;IACtC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,mIAAmI;YACxI,WAAW,EAAE,oHAAoH;YACjI,GAAG,EAAE,QAAQ;YACb,UAAU,EAAE,QAAQ;SACrB;QACD,QAAQ,EAAE;YACR,sFAAsF;YACtF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,gBAAgB;gBAC3B,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,8BAA8B;gBAC3C,QAAQ,EAAE,eAAe;gBACzB,GAAG,EAAE,iBAAiB;gBACtB,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,WAAW,EAAE,uCAAuC;gBACpD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mCAAmC;gBACxC,iBAAiB,EAAE,mDAAmD;aACvE,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,eAAe;gBAC1B,WAAW,EAAE,iDAAiD;gBAC9D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,uDAAuD;gBAC5D,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,WAAW,EAAE,IAAA,gCAAgB,EAAC;gBAC5B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,mDAAmD;gBAChE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0BAA0B;gBAC/B,iBAAiB,EAAE,0DAA0D;aAC9E,CAAC;YACF,aAAa,EAAE,IAAA,gCAAgB,EAAC;gBAC9B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,WAAW,EAAE,0BAA0B;gBACvC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,qDAAqD;gBAC1D,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,sBAAsB;gBACjC,WAAW,EAAE,mCAAmC;gBAChD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,6EAA6E;gBAClF,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,aAAa,EAAE;wBACb,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,4BAA4B;qBAC1C;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,gCAAgC;qBAC9C;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,mDAAmD;qBACjE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,aAAa,EAAE,KAAK;YACpB,iBAAiB,EAAE,EAAE;SACtB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACV,aAAa,GAAG,KAAK,EACf,iBAAiB,GAAG,EAAE,EAE3B,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvB;;WAEG;QACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;YAC/B,UAAU,EAAE,cAAc;YAC1B,WAAW,EAAE,eAAe;YAC5B,YAAY,EAAE,gBAAgB;YAC9B,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,aAAa;YACxB,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,WAAW;YACpB,QAAQ,EAAE,YAAY;YACtB,kBAAkB,EAAE,mBAAmB;YACvC,GAAG,iBAAiB;SACrB,CAAC,CAAC;QAEH;;WAEG;QACH,uDAAuD;QACvD,MAAM,eAAe,GAAG,CAAC,IAAmB,EAAW,EAAE;YACvD,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC;QAEF;;WAEG;QACH,uDAAuD;QACvD,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAW,EAAE;YACxD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,mBAAmB,GAAG,CAAC,IAA6B,EAKxD,EAAE;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACrD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;gBAC3B,CAAC,CAAC,SAAS,CAAC;YAE5B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;YAEzE,qCAAqC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE1D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/C,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,eAAe,GAAG,CAAC,QAA8B,EAAE,OAAe,EAAW,EAAE;YACnF,+BAA+B;YAC/B,IAAI,aAAa,IAAI,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mDAAmD;YACnD,IAAI,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,sEAAsE;YACtE,IAAI,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,sEAAsE;YACtE,IAAI,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,4EAA4E;YAC5E,sFAAsF;YACtF,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;gBAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAChD,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;oBAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAClD,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvD,gFAAgF;oBAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAE,EAAE,CACnE,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CACnE,CAAC;oBACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,GAAkB,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;wBAChG,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+BAA+B;YAC/B,OAAO,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC,CAAC;QAEF;;;;;;WAMG;QACH,MAAM,sBAAsB,GAAG,CAAC,QAAuB,EAAW,EAAE;YAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAChD,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;gBAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC;YAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,cAAc,GAClB,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC;gBAC9E,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;YAEnF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,wCAAwC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACzE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,gDAAgD;gBAChD,IAAI,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC5C,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;;;;;WAMG;QACH,MAAM,iBAAiB,GAAG,CAAC,QAAuB,EAAW,EAAE;YAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;YAE9B,+DAA+D;YAC/D,MAAM,gBAAgB,GAAG,CAAC,QAAuB,EAAW,EAAE;gBAC5D,gEAAgE;gBAChE,kDAAkD;gBAClD,kEAAkE;gBAClE,oDAAoD;gBACpD,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;oBAChD,QAAQ,CAAC,QAAQ,KAAK,GAAG;oBACzB,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;oBAC7D,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;gBAC/B,CAAC;gBAED,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;oBACpD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,8DAA8D;gBAC9D,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACxD,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACzD,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;oBACvC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC3D,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBAC9C,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,oEAAoE;gBACpE,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACxD,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC3D,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACjD,uCAAuC;oBACvC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;wBACrC,IAAI,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;4BACnE,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,sDAAsD;gBACtD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACxD,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC3D,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC7C,uCAAuC;oBACvC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;wBACrC,IAAI,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;4BACnE,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YAEF,MAAM,YAAY,GAAG,CAAC,UAA8B,EAAW,EAAE;gBAC/D,IAAI,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;oBACtD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;wBAC3C,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,CAC7C,CAAC;gBACJ,CAAC;gBACD,OAAO,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;oBACjD,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,CAAC;YAC5D,CAAC,CAAC;YAEF,0DAA0D;YAC1D,IAAI,OAAO,GAA8B,QAAQ,CAAC,MAAM,CAAC;YACzD,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAE9B,OAAO,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACrC,8CAA8C;gBAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,EAAE,CAAC;oBAChD,IAAI,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnC,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAED,0FAA0F;gBAC1F,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,IAAI,CACpE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,mBAAmB;oBAC1D,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,kBAAkB;oBACzD,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAEpE,iBAAiB,GAAG,IAAI,CAAC;oBACzB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;oBAC/B,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,IAAwB,EAAE,EAAE;wBACjE,IAAI,KAAK,GAA8B,QAAQ,CAAC;wBAChD,OAAO,KAAK,EAAE,CAAC;4BACb,IAAI,KAAK,KAAK,IAAI;gCAAE,OAAO,IAAI,CAAC;4BAChC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;wBACvB,CAAC;wBACD,OAAO,KAAK,CAAC;oBACf,CAAC,CAAC,CAAC;oBAEH,uEAAuE;oBACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;wBACnC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;wBAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW;4BACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;4BAC3B,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;4BAClC,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC3B,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,uDAAuD;QACvD,MAAM,wBAAwB,GAAG,CAAC,SAAsB,EAAU,EAAE;YAClE,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;gBACzB,KAAK,UAAU,CAAC;gBAChB,KAAK,WAAW;oBACd,OAAO;wBACL,yDAAyD;wBACzD,yDAAyD;wBACzD,2EAA2E;wBAC3E,2CAA2C;wBAC3C,4CAA4C;qBAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,KAAK,MAAM;oBACT,OAAO;wBACL,gDAAgD;wBAChD,iEAAiE;wBACjE,yDAAyD;wBACzD,qDAAqD;wBACrD,0CAA0C;qBAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,KAAK,SAAS;oBACZ,OAAO;wBACL,uEAAuE;wBACvE,uDAAuD;wBACvD,8CAA8C;wBAC9C,iDAAiD;wBACjD,wDAAwD;qBACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf;oBACE,OAAO;wBACL,mDAAmD;wBACnD,mDAAmD;wBACnD,mDAAmD;wBACnD,4DAA4D;wBAC5D,wCAAwC;qBACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,kBAAkB,GAAG,CAAC,SAAsB,EAAE,OAAe,EAAU,EAAE;YAC7E,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;gBACxB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,WAAW,GAAG,CAAC,IAA6B,EAAE,EAAE;YACpD,kCAAkC;YAClC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI;gBAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC/C,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAE7C,iCAAiC;YACjC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAExE,0CAA0C;YAC1C,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,oCAAoC,CAAC;YACrG,MAAM,WAAW,GAAG,SAAS,EAAE,WAAW,IAAI,oCAAoC,CAAC;YAEnF,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE;oBACJ,MAAM;oBACN,IAAI;oBACJ,SAAS;oBACT,aAAa,EAAE,SAAS,EAAE,aAAa,IAAI,gBAAgB;oBAC3D,WAAW;oBACX,KAAK;oBACL,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,eAAe;iBAC7C;gBACD,OAAO,EAAE;oBACP;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,cAAc;wBACzB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,aAAa;wBACxB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,eAAe;wBAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,qBAAqB;wBAChC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO;YACL,cAAc,EAAE,WAAW;SAC5B,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -17,7 +17,10 @@ exports.detectSuspiciousDependencies = (0, eslint_devkit_1.createRule)({
|
|
|
17
17
|
meta: {
|
|
18
18
|
type: 'problem',
|
|
19
19
|
docs: {
|
|
20
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-suspicious-dependencies.md',
|
|
20
21
|
description: 'Detect typosquatting in package names',
|
|
22
|
+
cwe: 'CWE-506',
|
|
23
|
+
cvss: 7.5,
|
|
21
24
|
},
|
|
22
25
|
messages: {
|
|
23
26
|
violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
|
|
@@ -35,6 +38,7 @@ exports.detectSuspiciousDependencies = (0, eslint_devkit_1.createRule)({
|
|
|
35
38
|
defaultOptions: [],
|
|
36
39
|
create(context) {
|
|
37
40
|
const popularPackages = ['react', 'lodash', 'express', 'axios', 'webpack'];
|
|
41
|
+
// oxlint-disable-next-line consistent-function-scoping
|
|
38
42
|
function levenshtein(a, b) {
|
|
39
43
|
const matrix = [];
|
|
40
44
|
for (let i = 0; i <= b.length; i++) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/detect-suspicious-dependencies/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;GAIG;AAEH,4DAAsF;AAUzE,QAAA,4BAA4B,GAAG,IAAA,0BAAU,EAA0B;IAC9E,IAAI,EAAE,gCAAgC;IACtC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,mIAAmI;YACxI,WAAW,EAAE,uCAAuC;YACpD,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,uBAAuB;gBAClC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,2DAA2D;gBACxE,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,6CAA6C;gBAClD,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAE3E,uDAAuD;QACvD,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;YACvC,MAAM,MAAM,GAAG,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACnC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;wBACxC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBACtC,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CACrB,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EACxB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EACpB,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CACrB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,OAAO;YACL,iBAAiB,CAAC,IAAgC;gBAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrF,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;wBACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;wBAC9C,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;4BAClC,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI;gCACJ,SAAS,EAAE,mBAAmB;gCAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;6BACzC,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -17,7 +17,10 @@ exports.lockFile = (0, eslint_devkit_1.createRule)({
|
|
|
17
17
|
meta: {
|
|
18
18
|
type: 'suggestion',
|
|
19
19
|
docs: {
|
|
20
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/lock-file.md',
|
|
20
21
|
description: 'Ensure package lock file exists for the configured package manager',
|
|
22
|
+
cwe: 'CWE-829',
|
|
23
|
+
cvss: 7.5,
|
|
21
24
|
},
|
|
22
25
|
messages: {
|
|
23
26
|
violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
|
|
@@ -43,20 +46,30 @@ exports.lockFile = (0, eslint_devkit_1.createRule)({
|
|
|
43
46
|
},
|
|
44
47
|
],
|
|
45
48
|
},
|
|
46
|
-
defaultOptions: [{
|
|
49
|
+
defaultOptions: [{}],
|
|
47
50
|
create(context) {
|
|
48
51
|
const fs = require('node:fs');
|
|
49
52
|
const path = require('node:path');
|
|
50
53
|
// Check once per file
|
|
51
54
|
let checked = false;
|
|
52
55
|
const options = context.options[0] || {};
|
|
53
|
-
const
|
|
56
|
+
const userPackageManager = options.packageManager;
|
|
54
57
|
const lockFiles = {
|
|
55
58
|
npm: 'package-lock.json',
|
|
56
59
|
yarn: 'yarn.lock',
|
|
57
60
|
pnpm: 'pnpm-lock.yaml',
|
|
58
61
|
};
|
|
59
|
-
|
|
62
|
+
// When no packageManager is configured, accept ANY of the three common
|
|
63
|
+
// lock files. Otherwise look only for the configured one. This avoids
|
|
64
|
+
// firing on every file in a pnpm/yarn monorepo just because the rule
|
|
65
|
+
// defaulted to looking for package-lock.json.
|
|
66
|
+
const targetLockFiles = userPackageManager
|
|
67
|
+
? [lockFiles[userPackageManager]]
|
|
68
|
+
: Object.values(lockFiles);
|
|
69
|
+
const targetLockFile = userPackageManager
|
|
70
|
+
? lockFiles[userPackageManager]
|
|
71
|
+
: 'package-lock.json | yarn.lock | pnpm-lock.yaml';
|
|
72
|
+
const reportedManager = userPackageManager ?? 'any';
|
|
60
73
|
return {
|
|
61
74
|
Program(node) {
|
|
62
75
|
if (checked)
|
|
@@ -65,13 +78,16 @@ exports.lockFile = (0, eslint_devkit_1.createRule)({
|
|
|
65
78
|
// Find project root (simplified)
|
|
66
79
|
let dir = path.dirname(context.filename);
|
|
67
80
|
let found = false;
|
|
68
|
-
// Search up to 10 levels for
|
|
81
|
+
// Search up to 10 levels for any acceptable lock file
|
|
69
82
|
for (let i = 0; i < 10; i++) {
|
|
70
|
-
const
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
83
|
+
for (const lf of targetLockFiles) {
|
|
84
|
+
if (fs.existsSync(path.join(dir, lf))) {
|
|
85
|
+
found = true;
|
|
86
|
+
break;
|
|
87
|
+
}
|
|
74
88
|
}
|
|
89
|
+
if (found)
|
|
90
|
+
break;
|
|
75
91
|
const parentDir = path.dirname(dir);
|
|
76
92
|
if (parentDir === dir)
|
|
77
93
|
break;
|
|
@@ -82,7 +98,7 @@ exports.lockFile = (0, eslint_devkit_1.createRule)({
|
|
|
82
98
|
node,
|
|
83
99
|
messageId: 'violationDetected',
|
|
84
100
|
data: {
|
|
85
|
-
packageManager,
|
|
101
|
+
packageManager: reportedManager,
|
|
86
102
|
lockFile: targetLockFile,
|
|
87
103
|
}
|
|
88
104
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/lock-file/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;GAIG;AAEH,4DAAsF;AAWzE,QAAA,QAAQ,GAAG,IAAA,0BAAU,EAA0B;IAC1D,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,8GAA8G;YACnH,WAAW,EAAE,oEAAoE;YACjF,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mBAAmB;gBAC9B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,6HAA6H;gBAC1I,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,8CAA8C;gBACnD,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,cAAc,EAAE;wBACd,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;qBAC9B;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,CAAC;IACpB,MAAM,CAAC,OAAO;QACZ,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAElC,sBAAsB;QACtB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC;QAElD,MAAM,SAAS,GAA2B;YACxC,GAAG,EAAE,mBAAmB;YACxB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,gBAAgB;SACvB,CAAC;QAEF,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,eAAe,GAAG,kBAAkB;YACxC,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,cAAc,GAAG,kBAAkB;YACvC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC;YAC/B,CAAC,CAAC,gDAAgD,CAAC;QACrD,MAAM,eAAe,GAAG,kBAAkB,IAAI,KAAK,CAAC;QAEpD,OAAO;YACL,OAAO,CAAC,IAAsB;gBAC5B,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBAEf,iCAAiC;gBACjC,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACzC,IAAI,KAAK,GAAG,KAAK,CAAC;gBAElB,sDAAsD;gBACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC5B,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;wBACjC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;4BACtC,KAAK,GAAG,IAAI,CAAC;4BACb,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,IAAI,KAAK;wBAAE,MAAM;oBACjB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACpC,IAAI,SAAS,KAAK,GAAG;wBAAE,MAAM;oBAC7B,GAAG,GAAG,SAAS,CAAC;gBAClB,CAAC;gBAED,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,mBAAmB;wBAC9B,IAAI,EAAE;4BACJ,cAAc,EAAE,eAAe;4BAC/B,QAAQ,EAAE,cAAc;yBACzB;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -22,7 +22,10 @@ exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
|
|
|
22
22
|
meta: {
|
|
23
23
|
type: 'problem',
|
|
24
24
|
docs: {
|
|
25
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-arbitrary-file-access.md',
|
|
25
26
|
description: 'Prevent file access from user input',
|
|
27
|
+
cwe: 'CWE-22',
|
|
28
|
+
cvss: 7.5,
|
|
26
29
|
},
|
|
27
30
|
messages: {
|
|
28
31
|
violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
|
|
@@ -45,7 +48,7 @@ exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
|
|
|
45
48
|
}
|
|
46
49
|
const fsReadMethods = ['readFile', 'readFileSync', 'readdir', 'readdirSync', 'stat', 'statSync'];
|
|
47
50
|
const fsWriteMethods = ['writeFile', 'writeFileSync', 'appendFile', 'appendFileSync'];
|
|
48
|
-
const userInputSources = ['req', 'request', 'params', 'query', 'body'];
|
|
51
|
+
const userInputSources = new Set(['req', 'request', 'params', 'query', 'body']);
|
|
49
52
|
// Track variables that have been sanitized with path.basename()
|
|
50
53
|
const sanitizedVariables = new Set();
|
|
51
54
|
// Track variables that have been validated with startsWith() guards
|
|
@@ -189,7 +192,7 @@ exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
|
|
|
189
192
|
if (pathArg?.type === 'MemberExpression' &&
|
|
190
193
|
pathArg.object.type === 'Identifier') {
|
|
191
194
|
const objName = pathArg.object.name.toLowerCase();
|
|
192
|
-
if (userInputSources.
|
|
195
|
+
if (userInputSources.has(objName)) {
|
|
193
196
|
report(node);
|
|
194
197
|
}
|
|
195
198
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-arbitrary-file-access/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;;;;;;GASG;AAEH,4DAAsG;AAUzF,QAAA,qBAAqB,GAAG,IAAA,0BAAU,EAA0B;IACvE,IAAI,EAAE,0BAA0B;IAChC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,6HAA6H;YAClI,WAAW,EAAE,qCAAqC;YAClD,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,uBAAuB;gBAClC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,0DAA0D;gBACvE,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,kDAAkD;gBACvD,iBAAiB,EAAE,gDAAgD;aACpE,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QAEtC,SAAS,MAAM,CAAC,IAAmB;YACjC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACjG,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACtF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAEhF,gEAAgE;QAChE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,oEAAoE;QACpE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE7C;;WAEG;QACH,SAAS,wBAAwB,CAAC,IAAiC;YACjE,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAChD,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YAEvB,uCAAuC;YACvC,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;gBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;gBAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC7C,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;YAED,kEAAkE;YAClE,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;gBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;gBAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAEzC,gDAAgD;gBAChD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAoC,EAAE,EAAE,CACnF,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAC9D,CAAC;gBAEF,qEAAqE;gBACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACnC,MAAM,WAAW,GAAG,QAAQ,IAAI,CAC9B,QAAQ,CAAC,IAAI,KAAK,SAAS;oBAC3B,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC3F,CAAC;gBAEF,IAAI,eAAe,IAAI,WAAW,EAAE,CAAC;oBACnC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAED;;;;;WAKG;QACH,SAAS,kBAAkB,CAAC,IAAmB,EAAE,OAAe;YAC9D,oBAAoB;YACpB,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mDAAmD;YACnD,IAAI,OAAO,GAA8B,IAAI,CAAC,MAAM,CAAC;YAErD,OAAO,OAAO,EAAE,CAAC;gBACf,mEAAmE;gBACnE,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;oBACnD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;oBAEhC,kEAAkE;oBAClE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;wBAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,EAAE,CAAC;4BAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;4BAE7D,8DAA8D;4BAC9D,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gCAChF,wEAAwE;gCACxE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;gCAEnC,qDAAqD;gCACrD,IAAI,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oCACpF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oCACrC,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,EAAE,CAAC;wCAC1G,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wCAChC,OAAO,IAAI,CAAC;oCACd,CAAC;gCACH,CAAC;gCAED,kDAAkD;gCAClD,IAAI,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,EAAE,CAAC;oCAC5G,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oCAChC,OAAO,IAAI,CAAC;gCACd,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,gFAAgF;gBAChF,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,EAAE,CAAC;oBAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;oBAChE,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;wBAChF,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAChC,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAED,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC3B,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;WAEG;QACH,SAAS,cAAc,CAAC,OAAe,EAAE,IAAmB;YAC1D,+BAA+B;YAC/B,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,kCAAkC;YAClC,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,+CAA+C;YAC/C,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO;YACL,wDAAwD;YACxD,kBAAkB,CAAC,IAAiC;gBAClD,wBAAwB,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;YAED,cAAc,CAAC,IAA6B;gBAC1C,8BAA8B;gBAC9B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI;oBAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBAC1C,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAE9E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAElC,mCAAmC;oBACnC,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBAC1C,OAAO;oBACT,CAAC;oBAED,8BAA8B;oBAC9B,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;wBAE7B,6CAA6C;wBAC7C,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;4BAClC,OAAO;wBACT,CAAC;wBAED,MAAM,CAAC,IAAI,CAAC,CAAC;wBACb,OAAO;oBACT,CAAC;oBAED,gEAAgE;oBAChE,IAAI,OAAO,EAAE,IAAI,KAAK,kBAAkB;wBACpC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBACzC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;wBAClD,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;4BAClC,MAAM,CAAC,IAAI,CAAC,CAAC;wBACf,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -12,7 +12,9 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
|
|
|
12
12
|
meta: {
|
|
13
13
|
type: 'problem',
|
|
14
14
|
docs: {
|
|
15
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-buffer-overread.md',
|
|
15
16
|
description: 'Detects buffer access beyond bounds',
|
|
17
|
+
cwe: 'CWE-126',
|
|
16
18
|
},
|
|
17
19
|
fixable: 'code',
|
|
18
20
|
hasSuggestions: true,
|
|
@@ -183,8 +185,8 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
|
|
|
183
185
|
create(context) {
|
|
184
186
|
const options = context.options[0] || {};
|
|
185
187
|
const { bufferMethods = ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'], boundsCheckFunctions = ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'], bufferTypes = ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'], trustedSanitizers = [], trustedAnnotations = [], strictMode = false, } = options;
|
|
186
|
-
const sourceCode = context.sourceCode
|
|
187
|
-
const filename = context.filename
|
|
188
|
+
const sourceCode = context.sourceCode;
|
|
189
|
+
const filename = context.filename;
|
|
188
190
|
// Create safety checker for false positive detection
|
|
189
191
|
const safetyChecker = (0, eslint_devkit_1.createSafetyChecker)({
|
|
190
192
|
trustedSanitizers,
|
|
@@ -209,6 +211,13 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
|
|
|
209
211
|
if (lowerName.includes(type))
|
|
210
212
|
return true;
|
|
211
213
|
}
|
|
214
|
+
// Conventional Buffer parameter names that don't lexically include
|
|
215
|
+
// 'buffer'. The audit FN was on `function readChunk(buf, req) {
|
|
216
|
+
// buf.slice(0, req.query.length) }` — `buf` is the universal Node
|
|
217
|
+
// Buffer parameter convention. Adding these aliases closes the FN
|
|
218
|
+
// without requiring authors to rename parameters.
|
|
219
|
+
if (lowerName === 'buf' || lowerName === 'b' || lowerName === 'bytes' || lowerName === 'chunk')
|
|
220
|
+
return true;
|
|
212
221
|
return false;
|
|
213
222
|
};
|
|
214
223
|
/**
|
|
@@ -216,6 +225,31 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
|
|
|
216
225
|
* Uses Set-based keyword matching for O(1) lookups
|
|
217
226
|
*/
|
|
218
227
|
const isUserControlledIndex = (indexNode) => {
|
|
228
|
+
// Direct MemberExpression: `req.query.length`, `req.body.size`,
|
|
229
|
+
// `event.queryStringParameters.limit`, etc. — walk the chain to
|
|
230
|
+
// check if the root identifier is a known taint source. Closes the
|
|
231
|
+
// audit FN where `buf.slice(0, req.query.length)` was bypassing
|
|
232
|
+
// detection because the arg was a MemberExpression, not an
|
|
233
|
+
// Identifier. See benchmarks/AUDIT_PATTERNS.md §3.6 ("taint-source
|
|
234
|
+
// breadth").
|
|
235
|
+
if (indexNode.type === 'MemberExpression') {
|
|
236
|
+
let walker = indexNode;
|
|
237
|
+
while (walker.type === 'MemberExpression') {
|
|
238
|
+
walker = walker.object;
|
|
239
|
+
}
|
|
240
|
+
if (walker.type === 'Identifier') {
|
|
241
|
+
const root = walker.name.toLowerCase();
|
|
242
|
+
// Express / Lambda / Koa / Hono taint-source roots.
|
|
243
|
+
if (['req', 'request', 'event', 'ctx', 'context'].includes(root)) {
|
|
244
|
+
return true;
|
|
245
|
+
}
|
|
246
|
+
// Generic user-controlled keyword check on root name.
|
|
247
|
+
for (const keyword of userControlledKeywords) {
|
|
248
|
+
if (root.includes(keyword))
|
|
249
|
+
return true;
|
|
250
|
+
}
|
|
251
|
+
}
|
|
252
|
+
}
|
|
219
253
|
if (indexNode.type === 'Identifier') {
|
|
220
254
|
const varName = indexNode.name.toLowerCase();
|
|
221
255
|
// Check each part of the variable name against keywords Set
|