eslint-plugin-node-security 4.10.0 → 4.11.0

package/src/utils/constant-folding.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.makeIsLiteralConstant=makeIsLiteralConstant;exports.parameterIsAlwaysDefault=parameterIsAlwaysDefault;const eslint_devkit_1=require("@interlace/eslint-devkit");const provenance_1=require("./provenance");const MAX_DEPTH=8;function constInitOf(sourceCode,node){const variable=(0,provenance_1.findVariable)(sourceCode,node);if(!variable||variable.defs.length!==1)return void 0;const def=variable.defs[0];if(def.type!=="Variable"||def.parent.kind!=="const")return void 0;if(def.node.id.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)return void 0;return def.node.init??void 0}function loopElementsOf(sourceCode,node){const variable=(0,provenance_1.findVariable)(sourceCode,node);if(!variable||variable.defs.length!==1)return null;const def=variable.defs[0];if(def.type!=="Variable"||def.parent.kind!=="const")return null;const statement=def.parent.parent;if(statement?.type!==eslint_devkit_1.AST_NODE_TYPES.ForOfStatement)return null;return arrayElementsOf(sourceCode,statement.right,0)}function arrayElementsOf(sourceCode,node,depth){if(depth>MAX_DEPTH)return null;if(node.type===eslint_devkit_1.AST_NODE_TYPES.ArrayExpression){return node.elements.every(element=>element!==null)?node.elements:null}if(node.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)return null;const init=constInitOf(sourceCode,node);if(init===void 0)return null;return arrayElementsOf(sourceCode,init,depth+1)}function propertyValueOf(object,name){for(const property of object.properties){if(property.type!==eslint_devkit_1.AST_NODE_TYPES.Property)return null;if(property.computed||property.key.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)continue;if(property.key.name===name)return property.value}return null}function makeIsLiteralConstant(sourceCode){const objectSourcesOf=(node,depth)=>{if(depth>MAX_DEPTH)return null;if(node.type===eslint_devkit_1.AST_NODE_TYPES.ObjectExpression)return[node];if(node.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)return null;const init=constInitOf(sourceCode,node);if(init!==void 0)return objectSourcesOf(init,depth+1);const elements=loopElementsOf(sourceCode,node);if(elements===null)return null;const objects=[];for(const element of elements){if(element.type!==eslint_devkit_1.AST_NODE_TYPES.ObjectExpression)return null;objects.push(element)}return objects};const fold=(node,depth)=>{if(depth>MAX_DEPTH)return false;switch(node.type){case eslint_devkit_1.AST_NODE_TYPES.Literal:return typeof node.value==="string"||typeof node.value==="number";case eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral:return node.expressions.every(expression=>fold(expression,depth+1));case eslint_devkit_1.AST_NODE_TYPES.ConditionalExpression:return fold(node.consequent,depth+1)&&fold(node.alternate,depth+1);case eslint_devkit_1.AST_NODE_TYPES.BinaryExpression:return node.operator==="+"&&fold(node.left,depth+1)&&fold(node.right,depth+1);case eslint_devkit_1.AST_NODE_TYPES.Identifier:{const init=constInitOf(sourceCode,node);return init!==void 0&&fold(init,depth+1)}case eslint_devkit_1.AST_NODE_TYPES.MemberExpression:{if(node.computed||node.property.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)return false;const objects=objectSourcesOf(node.object,depth+1);if(objects===null||objects.length===0)return false;const name=node.property.name;return objects.every(object=>{const value=propertyValueOf(object,name);return value!==null&&fold(value,depth+1)})}default:return false}};return node=>fold(node,0)}function parameterIsAlwaysDefault(sourceCode,identifier,isLiteralConstant){const variable=(0,provenance_1.findVariable)(sourceCode,identifier);if(!variable||variable.defs.length!==1)return false;const def=variable.defs[0];if(def.type!=="Parameter")return false;const fn=def.node;if(fn.type!==eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration||fn.id===null)return false;if(fn.parent.type===eslint_devkit_1.AST_NODE_TYPES.ExportNamedDeclaration||fn.parent.type===eslint_devkit_1.AST_NODE_TYPES.ExportDefaultDeclaration){return false}const index=fn.params.findIndex(param2=>param2.type===eslint_devkit_1.AST_NODE_TYPES.AssignmentPattern&&param2.left===def.name);if(index===-1)return false;const param=fn.params[index];if(!isLiteralConstant(param.right))return false;return everyCallStopsBefore(sourceCode,fn.id,index)}function everyCallStopsBefore(sourceCode,name,index){const variable=(0,provenance_1.findVariable)(sourceCode,name);return variable.references.every(reference=>{const parent=reference.identifier.parent;return parent.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&parent.callee===reference.identifier&&parent.arguments.length<=index})}

package/src/utils/names.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.identifierWords=identifierWords;exports.makeNameTest=makeNameTest;function identifierWords(name){return name.replaceAll(/([a-z0-9])([A-Z])/g,"$1 $2").replaceAll(/([A-Z]+)([A-Z][a-z])/g,"$1 $2").split(/[^a-zA-Z0-9]+/).filter(Boolean).map(word=>word.toLowerCase())}function makeNameTest(names){const wanted=new Set(names.map(entry=>entry.toLowerCase()));const substrings=[...wanted].filter(entry=>entry.length>=6);return name=>{const words=identifierWords(name);if(words.some(word=>wanted.has(word)))return true;const joined=words.join("");return substrings.some(entry=>joined.includes(entry))}}

package/src/utils/provenance.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.findVariable=findVariable;exports.bindingInit=bindingInit;exports.constLiteralOf=constLiteralOf;exports.makeReadsTaintSource=makeReadsTaintSource;const eslint_devkit_1=require("@interlace/eslint-devkit");function findVariable(sourceCode,node){let scope=sourceCode.getScope(node);while(scope){const found=scope.set?.get(node.name);if(found)return found;scope=scope.upper}return null}function bindingInit(sourceCode,node){const variable=findVariable(sourceCode,node);if(!variable||variable.defs.length!==1)return void 0;const def=variable.defs[0];if(def.type!=="Variable")return void 0;return def.node.init??void 0}function constLiteralOf(sourceCode,node){const variable=findVariable(sourceCode,node);if(!variable||variable.defs.length!==1)return void 0;const def=variable.defs[0];if(def.type!=="Variable")return void 0;if(def.parent.kind!=="const")return void 0;if(def.node.id.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)return void 0;const init=def.node.init;if(!init)return void 0;if(init.type===eslint_devkit_1.AST_NODE_TYPES.Literal)return init;if(init.type===eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral&&init.expressions.length===0){return init}return void 0}const REQUEST_PROPERTY_NAMES=new Set(["headers","query","body","params","cookies","searchparams","rawbody","querystringparameters","pathparameters","formdata"]);function makeReadsTaintSource(sourceCode,roots){const reads=(node,depth)=>{if(depth>6)return false;switch(node.type){case eslint_devkit_1.AST_NODE_TYPES.Identifier:{if(roots.has(node.name.toLowerCase()))return true;const init=bindingInit(sourceCode,node);return init!==void 0&&reads(init,depth+1)}case eslint_devkit_1.AST_NODE_TYPES.MemberExpression:{if(!node.computed&&node.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&REQUEST_PROPERTY_NAMES.has(node.property.name.toLowerCase())){return true}return reads(node.object,depth+1)}case eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral:return node.expressions.some(expression=>reads(expression,depth+1));case eslint_devkit_1.AST_NODE_TYPES.BinaryExpression:return reads(node.left,depth+1)||reads(node.right,depth+1);case eslint_devkit_1.AST_NODE_TYPES.AwaitExpression:return reads(node.argument,depth+1);case eslint_devkit_1.AST_NODE_TYPES.ArrayExpression:return node.elements.some(element=>element!==null&&reads(element,depth+1));case eslint_devkit_1.AST_NODE_TYPES.SpreadElement:return reads(node.argument,depth+1);case eslint_devkit_1.AST_NODE_TYPES.CallExpression:case eslint_devkit_1.AST_NODE_TYPES.NewExpression:return node.arguments.some(argument=>reads(argument,depth+1))||node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&!(node.callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.object.name==="process")&&reads(node.callee.object,depth+1);default:return false}};return node=>reads(node,0)}