eslint-plugin-node-security 4.2.0 → 4.4.0

package/CHANGELOG.md

@@ -1,5 +1,144 @@
 ## [4.1.0] - 2026-05-03
 
+## 4.4.0
+
+### Minor Changes
+
+- [#190](https://github.com/ofri-peretz/eslint/pull/190) [`6bb476d`](https://github.com/ofri-peretz/eslint/commit/6bb476d232f85da8201b08d0a199c9267c3499e5) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - feat(node-security): add `no-dynamic-algorithm-selection` (CWE-327)
+
+  Disallow dynamic (non-literal) algorithm names in Node.js crypto functions.
+  A runtime-selected algorithm argument can allow a downgrade to a broken or
+  risky cryptographic algorithm (CWE-327: Use of a Broken or Risky
+  Cryptographic Algorithm). AST-structural — flags non-literal algorithm
+  arguments to the crypto APIs.
+
+### Patch Changes
+
+- [#215](https://github.com/ofri-peretz/eslint/pull/215) [`f42ea93`](https://github.com/ofri-peretz/eslint/commit/f42ea935555a558627dd61d1b013cd8509943c89) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Align `no-dynamic-algorithm-selection`'s `meta.docs.cvss` (7.4) to the CVSS its
+  finding actually emits. The rule's message carries `CWE-327` and sets no
+  per-message `cvss`, so it inherits `CWE_MAPPING['CWE-327']` = 7.5 via
+  `enrichFromCWE` — docs now match the emitted value. Surfaced by the
+  cross-plugin `security-cvss-docs-consistency.lock.test.ts` lock (added in [#213](https://github.com/ofri-peretz/eslint/issues/213)),
+  which turned main red when this rule landed concurrently with the CVSS sweep.
+  Documentation-metadata only; no emitted finding changes.
+
+- [#213](https://github.com/ofri-peretz/eslint/pull/213) [`391dbe6`](https://github.com/ofri-peretz/eslint/commit/391dbe6b39f78d549379218567cb959649f8c614) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Align every security rule's `meta.docs.cvss` to the CVSS its finding actually
+  emits. The emitted machine-readable message sources its `CVSS:x` from
+  `CWE_MAPPING` via `formatLLMMessage` → `enrichFromCWE`, but the static
+  `meta.docs.cvss` documentation field had drifted on 45 rules across these 7
+  plugins — e.g. `no-hardcoded-credentials` documented `9.5` while emitting
+  `CVSS:9.8` (the value the published article and SARIF/LLM consumers already
+  read).
+
+  This corrects the **documentation metadata only** — no emitted finding changes.
+  Locked by `security-cvss-docs-consistency.lock.test.ts` (cross-plugin: every
+  security rule's `meta.docs.cvss` must equal the CVSS it emits), the
+  `no-hardcoded-credentials` rule lock (real ESLint `Linter` emission), and a
+  devkit `enrichFromCWE` contract test pinning `CWE-798 → 9.8`.
+
+  Follow-up (not in scope): 50 security rules document a CVSS that never appears
+  in any emitted message (their messages carry no CWE), and several rules emit the
+  generic CWE score where a rule-specific score may be warranted — both change
+  emitted output and are separate decisions.
+
+## 4.3.0
+
+### Minor Changes
+
+- [#148](https://github.com/ofri-peretz/eslint/pull/148) [`82718c2`](https://github.com/ofri-peretz/eslint/commit/82718c282895710d42c36d4679fb24d47f1c35c7) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - feat(node-security): add `no-math-random-crypto` (CWE-338)
+
+  Detects `Math.random()` used in cryptographic contexts (tokens, keys, secrets,
+  salts, IVs, session IDs) and steers to `crypto.randomBytes()` / `crypto.randomUUID()`.
+
+  This was the one cryptography rule that the deprecated `eslint-plugin-crypto`
+  shipped but had **not** been carried into `node-security` during the 2026-05
+  consolidation — so `eslint-plugin-crypto`'s deprecation notice ("node-security
+  includes all cryptography rules") was previously inaccurate. It is now true.
+
+  Added to the `recommended` preset as `error`. The detection is return/assignment
+  context-aware (matches `crypto`-named variables, properties, and function
+  returns) so benign uses like a Fisher-Yates shuffle into a non-crypto variable
+  do not false-positive — verified against the fn-fp benchmark (40/40 detection,
+  0 false positives with the crypto-free fleet).
+
+### Patch Changes
+
+- [#144](https://github.com/ofri-peretz/eslint/pull/144) [`8843ce7`](https://github.com/ofri-peretz/eslint/commit/8843ce7fbb465caad161b97032467b3a37a49319) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - fix: ILB-Wild FP reduction + doc examples + doc-test-alignment scanner fixes
+
+  **`no-unlimited-resource-allocation` — FP reduction (430 Edge FPs)**
+  - Skip loop-allocation reporting when the first argument is a numeric literal (e.g. `Buffer.alloc(1024)` inside a loop is statically bounded, not a risk)
+  - Skip `Array.isArray`, `Array.from`, `Array.of` calls in the `alloc/Array` pattern check (these don't allocate unbounded memory)
+
+  **`no-hardcoded-credentials` — FP reduction (~280 Edge FPs)**
+  - Extended test-file skip to cover `.fixture.`, `.mock.`, `__mocks__/`, `/tests/`, `/fixtures/`, `/mocks/` paths
+  - Skip string literals that are fallback values in `process.env.X || 'fallback'` expressions — the secret lives in the environment, the string is only a dev-mode default
+
+  **Doc examples — 4 rules now have ❌ Incorrect examples**
+  - `lambda-security/no-missing-authorization-check`
+  - `lambda-security/no-overly-permissive-iam-policy`
+  - `node-security/prefer-native-crypto` (renamed non-standard `### ❌ Third-Party (Flagged)` to `### ❌ Incorrect`)
+  - `vercel-ai-security/require-tool-confirmation` (replaced placeholder with a real tested example)
+
+  **`ilb-doc-test-alignment` scanner fixes**
+  - Accept both `## ❌` and `### ❌` headings (docs use H3 under an H2 `## Examples` section; was only finding H2)
+  - Slice from end-of-line rather than end-of-regex-match (prevents `## ❌ Incorrect Code` from leaving a partial heading in the parsed section)
+
+  Result: `ilb:doc-test-alignment` → 206 ok, 0 doc has no ❌ examples (was 165 missing).
+
+- [#141](https://github.com/ofri-peretz/eslint/pull/141) [`38ab670`](https://github.com/ofri-peretz/eslint/commit/38ab670a0221684f4fd3d5dc3c05ddec7458ca2b) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - fix: remove false `meta.fixable: 'code'` declarations from 21 rules that had no `fix()` function
+
+  Rules that declared `fixable: 'code'` in their ESLint meta without an actual `fix()` implementation would show the ⚡ auto-fix icon in editors and CI formatters but apply no change when `--fix` was run. This patch removes the misleading declaration from:
+  - `browser-security/no-clickjacking`
+  - `import-next/first`, `named`, `no-barrel-import`, `no-import-module-exports`, `no-namespace`
+  - `node-security/no-buffer-overread`, `no-unsafe-dynamic-require`, `no-zip-slip`
+  - `react-features/react-no-inline-functions`
+  - `reliability/no-jsdoc-terminator-in-example` (uses `suggest`, not auto-fix; corrected to `hasSuggestions: true` only)
+  - `secure-coding/no-directive-injection`, `no-electron-security-issues`, `no-graphql-injection`, `no-improper-sanitization`, `no-improper-type-validation`, `no-ldap-injection`, `no-unchecked-loop-condition`, `no-unlimited-resource-allocation`, `no-weak-password-recovery`, `no-xpath-injection`
+
+- [#186](https://github.com/ofri-peretz/eslint/pull/186) [`edf208d`](https://github.com/ofri-peretz/eslint/commit/edf208d67ac2357312c97d8964fcf6a462e407eb) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Consolidation cleanup — no rule behavior change:
+  - **react-features**: the README rules table now lists the 8 `componentApi`
+    preset rules. The README generator (`sync-readme-rules.ts`) and the
+    `plugin-rule-source-drift` validator now recurse into nested
+    `docs/rules/<category>/` subfolders, so every documented rule is advertised
+    consistently (previously the nested componentApi docs were silently dropped,
+    which an earlier `readme` exception had papered over — that exception is now
+    removed in favour of the real fix).
+  - **node-security**: remove the orphaned `no-pii-in-logs` rule source — the rule
+    was migrated to `eslint-plugin-secure-coding` and is no longer exported here;
+    the dead source was still compiling into `dist`.
+  - **import-next**: restore the `no-cycle` unit test after [#180](https://github.com/ofri-peretz/eslint/issues/180)'s SCC refactor
+    (`computeSCCsFromFile` + `findShortestCyclePath` are now bridged in the mock).
+
+  Also fixes `scripts/ilb-plugin-scope-audit.ts` to stop mis-reading config-preset
+  keys (`'recommended-strict': {`) as rules.
+
+- [#148](https://github.com/ofri-peretz/eslint/pull/148) [`82718c2`](https://github.com/ofri-peretz/eslint/commit/82718c282895710d42c36d4679fb24d47f1c35c7) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - feat+fix: ILB-Wild FP reduction + two new quality rules
+
+  **`no-unsafe-deserialization` FP reduction (~112 FPs)**
+  - Track `fs.readFileSync('literal')` calls in `literalPathFileVars` — a file read with a
+    hardcoded path (bundled config) is not user-controlled input for safe deserializers
+    (`JSON.parse`, schema-validating parsers). `eval()` still fires even on literal-path reads.
+
+  **`no-buffer-overread` FP reduction (~129 FPs)**
+  - Remove `b` (single-char, too broad) and `chunk` (too common for array chunks) from the
+    Buffer alias heuristic — `isBufferType` now only matches `buf` and `bytes` by name,
+    reducing false matches on non-Buffer variables.
+
+  **New rule: `modernization/prefer-template-literal`**
+  - Flags `"string " + variable` concatenation and suggests the equivalent template literal.
+  - Auto-fix produces the correct `` `string ${variable}` `` replacement.
+  - Pure string literal chains (`"a" + "b"`) and numeric addition are not flagged.
+  - Closes P2 quality FN `prob_string_concat` in the ILB-Arena-Quality bench.
+
+  **New rule: `modularity/no-mutable-exports`**
+  - Flags `export let` and `export var` — module exports should be immutable `const`
+    bindings so all importers share a stable reference.
+  - Auto-fix replaces `let`/`var` with `const`.
+  - Closes P2 quality FN `prob_mutable_export` in the ILB-Arena-Quality bench.
+
+- Updated dependencies [[`736a5fe`](https://github.com/ofri-peretz/eslint/commit/736a5fed47e673f6157ea900b29fe2a54e4bc7df)]:
+  - @interlace/eslint-devkit@1.4.1
+
 ### Added
 
 - New rule `no-deprecated-buffer` — flags use of the deprecated `Buffer()` constructor (Node.js security advisory; `Buffer.from`/`Buffer.alloc` should be used instead). Enabled in the `recommended` preset at `warn` to avoid breaking adopters with legacy `Buffer()` calls; will be promoted to `error` in the next major.
@@ -29,10 +168,10 @@
 
 ### Bug Fixes
 
-- ⚠️  **rules:** reduce false positives across security rules ([af4ca0e7](https://github.com/ofri-peretz/eslint/commit/af4ca0e7))
+- ⚠️ **rules:** reduce false positives across security rules ([af4ca0e7](https://github.com/ofri-peretz/eslint/commit/af4ca0e7))
 - align codecov component names and update docs components ([0a59a86c](https://github.com/ofri-peretz/eslint/commit/0a59a86c))
 
-### ⚠️  Breaking Changes
+### ⚠️ Breaking Changes
 
 - **rules:** Some previously flagged patterns are now correctly allowed ([af4ca0e7](https://github.com/ofri-peretz/eslint/commit/af4ca0e7))
 

package/README.md

@@ -14,6 +14,8 @@
   <a href="https://github.com/ofri-peretz/eslint" target="_blank"><img src="https://img.shields.io/badge/Since-Dec_2025-blue?logo=rocket&logoColor=white" alt="Since Dec 2025" /></a>
 </p>
 
+> ⭐ If this plugin caught a real bug for you, [**star the repo**](https://github.com/ofri-peretz/eslint) — it's the signal that keeps these rules maintained.
+
 ## Description
 
 This plugin provides Security rules for Node.js core modules (fs, child_process, crypto, etc).
@@ -94,8 +96,7 @@ See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md)
 | [no-ecb-mode](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-ecb-mode?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow ECB encryption mode (use GCM or CBC instead) | 🟢 |  |  |  |  |  |
 | [no-insecure-key-derivation](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-insecure-key-derivation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-916 | A02:2021 |  | Disallow PBKDF2 with insufficient iterations (< 100,000) | 🟢 |  |  |  |  |  |
 | [no-insecure-rsa-padding](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-insecure-rsa-padding?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow RSA PKCS#1 v1.5 padding (CVE-2023-46809 Marvin Attack) | 🟢 |  |  |  |  |  |
-| [no-math-random-crypto](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-math-random-crypto?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-338 | A02:2021 |  | Disallow Math.random() for cryptographic purposes (tokens, keys, secrets) | 🟢 |  | ⚠️ |  | 💡 |  |
-| [no-pii-in-logs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-pii-in-logs?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-532 |  |  | CWE: [CWE-532](https://cwe.mitre.org/data/definitions/532.html) | 🟢 |  |  |  |  |  |
+| [no-math-random-crypto](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-math-random-crypto?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-338 | A02:2021 |  | Disallow Math.random() for cryptographic purposes (tokens, keys, secrets, salts, IVs) | 🟢 |  |  |  |  |  |
 | [no-self-signed-certs](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-self-signed-certs?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-295 | A07:2021 |  | Disallow rejectUnauthorized false in TLS options | 🟢 |  |  |  |  |  |
 | [no-sha1-hash](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-sha1-hash?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow sha1() from crypto-hash package (use sha256 or sha512) | 🟢 |  |  |  |  |  |
 | [no-ssrf](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-ssrf?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-918 | A10:2021 |  | Detect HTTP requests with user-controlled URLs (server-side request forgery). | 🟢 |  |  |  | 💡 |  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-node-security",
-  "version": "4.2.0",
+  "version": "4.4.0",
   "description": "Security-focused ESLint plugin for Node.js built-in modules (fs, child_process, vm, path, Buffer). Detects command injection, path traversal, code execution vulnerabilities with AI-parseable error messages.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -74,7 +74,7 @@
   },
   "dependencies": {
     "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.2.1"
+    "@interlace/eslint-devkit": "^1.4.1"
   },
   "devDependencies": {
     "@typescript-eslint/parser": "^8.46.2",
@@ -88,5 +88,9 @@
   },
   "peerDependencies": {
     "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
+  },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/ofri-peretz/eslint"
   }
 }

package/src/index.js

@@ -16,8 +16,9 @@ const no_toctou_vulnerability_1 = require("./rules/no-toctou-vulnerability");
 const no_zip_slip_1 = require("./rules/no-zip-slip");
 const no_arbitrary_file_access_1 = require("./rules/no-arbitrary-file-access");
 const no_data_in_temp_storage_1 = require("./rules/no-data-in-temp-storage");
-const no_pii_in_logs_1 = require("./rules/no-pii-in-logs");
 const no_ssrf_1 = require("./rules/no-ssrf");
+const no_shell_injection_1 = require("./rules/no-shell-injection");
+const no_dynamic_algorithm_selection_1 = require("./rules/no-dynamic-algorithm-selection");
 // Migrated rules from secure-coding
 const detect_suspicious_dependencies_1 = require("./rules/detect-suspicious-dependencies");
 const lock_file_1 = require("./rules/lock-file");
@@ -53,8 +54,9 @@ exports.rules = {
     'no-zip-slip': no_zip_slip_1.noZipSlip,
     'no-arbitrary-file-access': no_arbitrary_file_access_1.noArbitraryFileAccess,
     'no-data-in-temp-storage': no_data_in_temp_storage_1.noDataInTempStorage,
-    'no-pii-in-logs': no_pii_in_logs_1.noPiiInLogs,
     'no-ssrf': no_ssrf_1.noSsrf,
+    'no-shell-injection': no_shell_injection_1.noShellInjection,
+    'no-dynamic-algorithm-selection': no_dynamic_algorithm_selection_1.noDynamicAlgorithmSelection,
     // Migrated rules
     'detect-suspicious-dependencies': detect_suspicious_dependencies_1.detectSuspiciousDependencies,
     'lock-file': lock_file_1.lockFile,
@@ -83,7 +85,7 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-node-security',
-        version: '4.2.0',
+        version: '4.4.0',
     },
     rules: exports.rules,
 };
@@ -102,15 +104,17 @@ const recommendedRules = {
     // Added in 4.1.0. Set to 'warn' in `recommended` to avoid breaking
     // adopters who already use the preset and have legacy `Buffer()` calls.
     // Promote to 'error' on the next major bump.
-    'node-security/no-deprecated-buffer': 'warn',
+    'node-security/no-deprecated-buffer': 'error',
     'node-security/no-toctou-vulnerability': 'error',
     'node-security/no-zip-slip': 'error',
     'node-security/no-arbitrary-file-access': 'error',
     'node-security/no-data-in-temp-storage': 'error',
-    'node-security/no-ssrf': 'error',
+    'node-security/no-ssrf': 'warn',
+    'node-security/no-shell-injection': 'error',
+    'node-security/no-dynamic-algorithm-selection': 'error',
     // Migrated Rules
     'node-security/detect-suspicious-dependencies': 'warn',
-    'node-security/lock-file': 'error',
+    'node-security/lock-file': 'warn', // filesystem check — not pure AST; CI enforces this better
     'node-security/require-dependency-integrity': 'error',
     // Crypto rules in recommended
     'node-security/no-weak-hash-algorithm': 'error',
@@ -118,7 +122,7 @@ const recommendedRules = {
     'node-security/no-static-iv': 'error',
     'node-security/no-ecb-mode': 'error',
     'node-security/no-math-random-crypto': 'error',
-    'node-security/no-cryptojs': 'warn',
+    'node-security/no-cryptojs': 'error',
 };
 exports.configs = {
     recommended: {

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,uEAAkE;AAClE,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,2DAAqD;AACrD,6CAAyC;AAEzC,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,yEAAmE;AACnE,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAGd;IACF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,sBAAsB,EAAE,yCAAkB;IAC1C,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,gBAAgB,EAAE,4BAAW;IAC7B,SAAS,EAAE,gBAAM;IAEjB,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,uBAAuB,EAAE,0CAAkB;IAC3C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kCAAkC,EAAE,MAAM;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,6CAA6C;IAC7C,oCAAoC,EAAE,MAAM;IAC5C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,OAAO;IAEhC,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,OAAO;IAClC,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,qCAAqC,EAAE,OAAO;IAC9C,2BAA2B,EAAE,MAAM;CACpC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,iBAAiB,QAAQ,EAAE;YAC3B,OAAO;SACR,CAAC,CACH;KACmC;CACvC,CAAC;AAEF,kBAAe,cAAM,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,uEAAkE;AAClE,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,6CAAyC;AACzC,mEAA8D;AAC9D,2FAAqF;AAErF,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,yEAAmE;AACnE,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAGd;IACF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,sBAAsB,EAAE,yCAAkB;IAC1C,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,SAAS,EAAE,gBAAM;IACjB,oBAAoB,EAAE,qCAAgB;IACtC,gCAAgC,EAAE,4DAA2B;IAE7D,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,uBAAuB,EAAE,0CAAkB;IAC3C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kCAAkC,EAAE,MAAM;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,6CAA6C;IAC7C,oCAAoC,EAAE,OAAO;IAC7C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,MAAM;IAC/B,kCAAkC,EAAE,OAAO;IAC3C,8CAA8C,EAAE,OAAO;IAEvD,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,MAAM,EAAE,2DAA2D;IAC9F,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,qCAAqC,EAAE,OAAO;IAC9C,2BAA2B,EAAE,OAAO;CACrC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,iBAAiB,QAAQ,EAAE;YAC3B,OAAO;SACR,CAAC,CACH;KACmC;CACvC,CAAC;AAEF,kBAAe,cAAM,CAAC"}

package/src/rules/detect-child-process/index.js

@@ -133,7 +133,7 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-child-process.md',
             description: 'Detects child_process usage that may allow command injection',
             cwe: 'CWE-78',
-            cvss: 9.5,
+            cvss: 9.8,
             confidence: 'medium',
         },
         messages: {

package/src/rules/detect-eval-with-expression/index.js

@@ -59,7 +59,7 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-eval-with-expression.md',
             description: 'Detects eval(variable) which can allow an attacker to run arbitrary code',
             cwe: 'CWE-95',
-            cvss: 9.5,
+            cvss: 9.8,
             confidence: 'high',
         },
         messages: {

package/src/rules/no-cryptojs/index.js

@@ -15,7 +15,7 @@ exports.noCryptojs = (0, eslint_devkit_1.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-cryptojs.md',
             description: 'Disallow deprecated crypto-js library (use native crypto instead)',
             cwe: 'CWE-1104',
-            cvss: 5,
+            cvss: 5.3,
         },
         hasSuggestions: true,
         messages: {

package/src/rules/no-cryptojs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-cryptojs/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAAsG;AAczF,QAAA,UAAU,GAAG,IAAA,0BAAU,EAA0B;IAC5D,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,gHAAgH;YACrH,WAAW,EAAE,mEAAmE;YAChF,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,CAAC;SACR;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,OAAO;gBAC1B,SAAS,EAAE,8BAA8B;gBACzC,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,oGAAoG;gBACjH,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,2DAA2D;gBAChE,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,8DAA8D;gBAC3E,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,8CAA8C;gBAC3D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0BAA0B;gBAC/B,iBAAiB,EAAE,iEAAiE;aACrF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;wBACvB,OAAO,EAAE,MAAM;wBACf,WAAW,EAAE,6BAA6B;qBAC3C;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,SAAS,uBAAuB,CAAC,IAAmB;YAClD,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE;oBACP;wBACE,SAAS,EAAE,iBAAiB;wBAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,oBAAoB;qBACtC;oBACD;wBACE,SAAS,EAAE,cAAc;wBACzB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,oBAAoB;qBACtC;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,mCAAmC;YACnC,iBAAiB,CAAC,IAAgC;gBAChD,IACE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;oBACrC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EACjF,CAAC;oBACD,uBAAuB,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAED,wCAAwC;YACxC,cAAc,CAAC,IAA6B;gBAC1C,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAC3B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBACjD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ;oBAC3C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAC7F,CAAC;oBACD,uBAAuB,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-cryptojs/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAAsG;AAczF,QAAA,UAAU,GAAG,IAAA,0BAAU,EAA0B;IAC5D,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,gHAAgH;YACrH,WAAW,EAAE,mEAAmE;YAChF,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,OAAO;gBAC1B,SAAS,EAAE,8BAA8B;gBACzC,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,oGAAoG;gBACjH,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,2DAA2D;gBAChE,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,8DAA8D;gBAC3E,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,8CAA8C;gBAC3D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0BAA0B;gBAC/B,iBAAiB,EAAE,iEAAiE;aACrF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;wBACvB,OAAO,EAAE,MAAM;wBACf,WAAW,EAAE,6BAA6B;qBAC3C;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,SAAS,uBAAuB,CAAC,IAAmB;YAClD,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE;oBACP;wBACE,SAAS,EAAE,iBAAiB;wBAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,oBAAoB;qBACtC;oBACD;wBACE,SAAS,EAAE,cAAc;wBACzB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,oBAAoB;qBACtC;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,mCAAmC;YACnC,iBAAiB,CAAC,IAAgC;gBAChD,IACE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;oBACrC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EACjF,CAAC;oBACD,uBAAuB,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAED,wCAAwC;YACxC,cAAc,CAAC,IAA6B;gBAC1C,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAC3B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBACjD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ;oBAC3C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAC7F,CAAC;oBACD,uBAAuB,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/no-cryptojs-weak-random/index.js

@@ -15,7 +15,7 @@ exports.noCryptojsWeakRandom = (0, eslint_devkit_1.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-cryptojs-weak-random.md',
             description: 'Disallow crypto-js WordArray.random() (CVE-2020-36732)',
             cwe: 'CWE-338',
-            cvss: 9.5,
+            cvss: 5.3,
         },
         hasSuggestions: true,
         messages: {

package/src/rules/no-deprecated-buffer/index.js

@@ -17,7 +17,7 @@ exports.noDeprecatedBuffer = (0, eslint_devkit_1.createRule)({
             cwe: 'CWE-676',
             cvss: 7.5,
         },
-        hasSuggestions: true,
+        fixable: 'code',
         messages: {
             deprecatedBufferConstructor: (0, eslint_devkit_1.formatLLMMessage)({
                 icon: eslint_devkit_1.MessageIcons.SECURITY,
@@ -48,23 +48,49 @@ exports.noDeprecatedBuffer = (0, eslint_devkit_1.createRule)({
             return (node.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 node.name === 'Buffer');
         }
+        /**
+         * Returns the safe replacement for new Buffer(args):
+         *   new Buffer(number) → Buffer.alloc(number)
+         *   new Buffer(...)    → Buffer.from(...)
+         */
+        function getBufferReplacement(args) {
+            if (args.length === 1 &&
+                args[0].type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
+                typeof args[0].value === 'number') {
+                return 'Buffer.alloc';
+            }
+            return 'Buffer.from';
+        }
         return {
             // Catches `new Buffer(size)` / `new Buffer(arr)` / `new Buffer('str')`
             NewExpression(node) {
                 if (!isBufferIdentifier(node.callee))
                     return;
+                const replacement = getBufferReplacement(node.arguments);
                 context.report({
                     node,
                     messageId: 'deprecatedBufferConstructor',
+                    fix(fixer) {
+                        // Replace `new Buffer` with `Buffer.from` or `Buffer.alloc`,
+                        // removing the `new` keyword in the process.
+                        const sourceCode = context.sourceCode;
+                        const newToken = sourceCode.getFirstToken(node);
+                        const calleeEnd = node.callee.range[1];
+                        return fixer.replaceTextRange([newToken.range[0], calleeEnd], replacement);
+                    },
                 });
             },
             // Catches `Buffer(size)` (factory call without `new`)
             CallExpression(node) {
                 if (!isBufferIdentifier(node.callee))
                     return;
+                const replacement = getBufferReplacement(node.arguments);
                 context.report({
                     node,
                     messageId: 'deprecatedBufferCall',
+                    fix(fixer) {
+                        return fixer.replaceText(node.callee, replacement);
+                    },
                 });
             },
         };

package/src/rules/no-deprecated-buffer/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-deprecated-buffer/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAkBH,4DAKkC;AAIrB,QAAA,kBAAkB,GAAwC,IAAA,0BAAU,EAAiB;IAChG,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,yHAAyH;YAC9H,WAAW,EAAE,iFAAiF;YAC9F,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,2BAA2B,EAAE,IAAA,gCAAgB,EAAC;gBAC5C,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,+BAA+B;gBAC1C,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EACT,oIAAoI;gBACtI,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,4KAA4K;gBACjL,iBAAiB,EAAE,sDAAsD;aAC1E,CAAC;YACF,oBAAoB,EAAE,IAAA,gCAAgB,EAAC;gBACrC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,kCAAkC;gBAC7C,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EACT,gIAAgI;gBAClI,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,gFAAgF;gBACrF,iBAAiB,EAAE,sDAAsD;aAC1E,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,SAAS,kBAAkB,CAAC,IAAmB;YAC7C,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtC,IAA4B,CAAC,IAAI,KAAK,QAAQ,CAChD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,uEAAuE;YACvE,aAAa,CAAC,IAAI;gBAChB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAC7C,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,6BAA6B;iBACzC,CAAC,CAAC;YACL,CAAC;YAED,sDAAsD;YACtD,cAAc,CAAC,IAAI;gBACjB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAC7C,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,sBAAsB;iBAClC,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-deprecated-buffer/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAkBH,4DAKkC;AAIrB,QAAA,kBAAkB,GAAwC,IAAA,0BAAU,EAAiB;IAChG,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,yHAAyH;YAC9H,WAAW,EAAE,iFAAiF;YAC9F,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE;YACR,2BAA2B,EAAE,IAAA,gCAAgB,EAAC;gBAC5C,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,+BAA+B;gBAC1C,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EACT,oIAAoI;gBACtI,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,4KAA4K;gBACjL,iBAAiB,EAAE,sDAAsD;aAC1E,CAAC;YACF,oBAAoB,EAAE,IAAA,gCAAgB,EAAC;gBACrC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,kCAAkC;gBAC7C,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EACT,gIAAgI;gBAClI,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,gFAAgF;gBACrF,iBAAiB,EAAE,sDAAsD;aAC1E,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,SAAS,kBAAkB,CAAC,IAAmB;YAC7C,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtC,IAA4B,CAAC,IAAI,KAAK,QAAQ,CAChD,CAAC;QACJ,CAAC;QAED;;;;WAIG;QACH,SAAS,oBAAoB,CAAC,IAAuC;YACnE,IACE,IAAI,CAAC,MAAM,KAAK,CAAC;gBACjB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;gBACvC,OAAQ,IAAI,CAAC,CAAC,CAAsB,CAAC,KAAK,KAAK,QAAQ,EACvD,CAAC;gBACD,OAAO,cAAc,CAAC;YACxB,CAAC;YACD,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,OAAO;YACL,uEAAuE;YACvE,aAAa,CAAC,IAAI;gBAChB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAC7C,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,6BAA6B;oBACxC,GAAG,CAAC,KAAK;wBACP,6DAA6D;wBAC7D,6CAA6C;wBAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;wBACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,CAAE,CAAC;wBACjD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC;wBACxC,OAAO,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;oBAC7E,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,sDAAsD;YACtD,cAAc,CAAC,IAAI;gBACjB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAC7C,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,sBAAsB;oBACjC,GAAG,CAAC,KAAK;wBACP,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;oBACrD,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/no-dynamic-algorithm-selection/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License.
+ */
+/**
+ * ESLint Rule: no-dynamic-algorithm-selection
+ * CWE-327: Use of a Broken or Risky Cryptographic Algorithm
+ *
+ * Detects crypto.createHash(), crypto.createCipheriv(), crypto.createSign(),
+ * and similar Node crypto APIs where the algorithm name comes from a dynamic
+ * value (variable, request param, config value) rather than a literal string.
+ *
+ * An attacker who controls the algorithm parameter can:
+ * - Downgrade to a weak algorithm (MD5, SHA1, RC4)
+ * - Cause a crash with an unsupported algorithm name
+ * - Bypass security controls that assume a strong algorithm is in use
+ *
+ * Detection: structural-api.
+ *   crypto.createHash(req.query.algo)  → fires (dynamic first arg)
+ *   crypto.createHash('sha256')         → silent (literal, checked separately)
+ *   crypto.createHash(`sha256`)         → silent (static template)
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+export declare const noDynamicAlgorithmSelection: TSESLint.RuleModule<"dynamicAlgorithm", [], unknown, TSESLint.RuleListener> & {
+    name: string;
+};

package/src/rules/no-dynamic-algorithm-selection/index.js

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noDynamicAlgorithmSelection = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+/** Node crypto functions whose first argument is the algorithm name. */
+const CRYPTO_ALGORITHM_FUNCTIONS = new Set([
+    'createHash',
+    'createHmac',
+    'createSign',
+    'createVerify',
+    'createCipher',
+    'createCipheriv',
+    'createDecipher',
+    'createDecipheriv',
+]);
+exports.noDynamicAlgorithmSelection = (0, eslint_devkit_1.createRule)({
+    name: 'no-dynamic-algorithm-selection',
+    meta: {
+        type: 'problem',
+        docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-algorithm-selection.md',
+            description: 'Disallow dynamic algorithm names in Node.js crypto functions (CWE-327)',
+            cwe: 'CWE-327',
+            // Match the CVSS the finding emits: the message sets no per-message
+            // cvss, so it inherits CWE_MAPPING['CWE-327'] (7.5) via enrichFromCWE.
+            // Locked by security-cvss-docs-consistency.lock.test.ts.
+            cvss: 7.5,
+        },
+        messages: {
+            dynamicAlgorithm: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Dynamic Cryptographic Algorithm (CWE-327)',
+                cwe: 'CWE-327',
+                description: '`crypto.{{method}}()` receives a dynamic algorithm name. An attacker who controls this value can downgrade to a weak algorithm (MD5, SHA1, RC4) or cause a crash.',
+                severity: 'HIGH',
+                fix: 'Hard-code the algorithm name as a literal string (e.g. "sha256", "aes-256-gcm"). Use an allowlist if the algorithm must vary at runtime.',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html',
+            }),
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            CallExpression(node) {
+                const { callee, arguments: args } = node;
+                // Match crypto.method(algo) — MemberExpression where object is 'crypto'
+                if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression)
+                    return;
+                if (callee.object.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier)
+                    return;
+                if (callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier)
+                    return;
+                const objectName = callee.object.name;
+                const methodName = callee.property.name;
+                if (objectName !== 'crypto')
+                    return;
+                if (!CRYPTO_ALGORITHM_FUNCTIONS.has(methodName))
+                    return;
+                const firstArg = args[0];
+                if (!firstArg)
+                    return;
+                // String literal → already handled by no-weak-hash-algorithm for weak algos;
+                // a literal is always an intentional, auditable choice.
+                if (firstArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
+                    typeof firstArg.value === 'string')
+                    return;
+                // Template literal without expressions → equivalent to literal, safe.
+                if (firstArg.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral &&
+                    firstArg.expressions.length === 0)
+                    return;
+                context.report({
+                    node: firstArg,
+                    messageId: 'dynamicAlgorithm',
+                    data: { method: methodName },
+                });
+            },
+        };
+    },
+});
+//# sourceMappingURL=index.js.map

package/src/rules/no-dynamic-algorithm-selection/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-dynamic-algorithm-selection/index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAsBH,4DAKkC;AAIlC,wEAAwE;AACxE,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;CACnB,CAAC,CAAC;AAEU,QAAA,2BAA2B,GAAG,IAAA,0BAAU,EAAiB;IACpE,IAAI,EAAE,gCAAgC;IACtC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,mIAAmI;YACxI,WAAW,EACT,wEAAwE;YAC1E,GAAG,EAAE,SAAS;YACd,oEAAoE;YACpE,uEAAuE;YACvE,yDAAyD;YACzD,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2CAA2C;gBACtD,GAAG,EAAE,SAAS;gBACd,WAAW,EACT,mKAAmK;gBACrK,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,0IAA0I;gBAC/I,iBAAiB,EACf,uFAAuF;aAC1F,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAA6C;QAClD,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;gBAEzC,wEAAwE;gBACxE,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBAAE,OAAO;gBAC5D,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAAE,OAAO;gBAC7D,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAAE,OAAO;gBAE/D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACtC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAExC,IAAI,UAAU,KAAK,QAAQ;oBAAE,OAAO;gBACpC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,UAAU,CAAC;oBAAE,OAAO;gBAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBAEtB,6EAA6E;gBAC7E,wDAAwD;gBACxD,IACE,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBACxC,OAAQ,QAA6B,CAAC,KAAK,KAAK,QAAQ;oBACxD,OAAO;gBAET,sEAAsE;gBACtE,IACE,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;oBAC/C,QAAqC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;oBAC/D,OAAO;gBAET,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,kBAAkB;oBAC7B,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;iBAC7B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/no-dynamic-dependency-loading/index.js

@@ -20,7 +20,7 @@ exports.noDynamicDependencyLoading = (0, eslint_devkit_1.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-dependency-loading.md',
             description: 'Prevent runtime dependency injection with dynamic paths',
             cwe: 'CWE-1104',
-            cvss: 7.5,
+            cvss: 5.3,
         },
         messages: {
             violationDetected: (0, eslint_devkit_1.formatLLMMessage)({

package/src/rules/no-math-random-crypto/index.js

@@ -49,7 +49,7 @@ exports.noMathRandomCrypto = (0, eslint_devkit_1.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-math-random-crypto.md',
             description: 'Disallow Math.random() for cryptographic purposes',
             cwe: 'CWE-338',
-            cvss: 9.5,
+            cvss: 5.3,
             confidence: 'medium',
         },
         hasSuggestions: true,

package/src/rules/no-shell-injection/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * ESLint Rule: no-shell-injection
+ * CWE-78: OS Command Injection
+ *
+ * Fires when child_process shell-execution functions receive a first
+ * argument built via string concatenation or template literal expressions.
+ *
+ * Detection: structural-api. The rule checks the SHAPE of the first argument,
+ * not what value flows into it. exec(`git ${cmd}`) fires regardless of what
+ * `cmd` contains — the concatenation itself is the signal.
+ *
+ * Does NOT fire on:
+ *   - exec('literal command') — static string, no injection surface
+ *   - spawn('cmd', [args]) — args array is the safe parameterization form
+ *   - exec(variable) — indirect; data-flow analysis required, out of scope
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+export declare const noShellInjection: TSESLint.RuleModule<"shellInjection", [], unknown, TSESLint.RuleListener> & {
+    name: string;
+};

package/src/rules/no-shell-injection/index.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * ESLint Rule: no-shell-injection
+ * CWE-78: OS Command Injection
+ *
+ * Fires when child_process shell-execution functions receive a first
+ * argument built via string concatenation or template literal expressions.
+ *
+ * Detection: structural-api. The rule checks the SHAPE of the first argument,
+ * not what value flows into it. exec(`git ${cmd}`) fires regardless of what
+ * `cmd` contains — the concatenation itself is the signal.
+ *
+ * Does NOT fire on:
+ *   - exec('literal command') — static string, no injection surface
+ *   - spawn('cmd', [args]) — args array is the safe parameterization form
+ *   - exec(variable) — indirect; data-flow analysis required, out of scope
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noShellInjection = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+/** Shell-execution functions from child_process that run the first arg as a shell command. */
+const SHELL_EXEC_FUNCTIONS = new Set([
+    'exec', 'execSync',
+]);
+function isStringConcatOrTemplate(node) {
+    if (node.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral && node.expressions.length > 0)
+        return true;
+    if (node.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression &&
+        node.operator === '+' &&
+        (node.left.type === eslint_devkit_1.AST_NODE_TYPES.Literal ||
+            node.left.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral ||
+            node.left.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression ||
+            node.right.type === eslint_devkit_1.AST_NODE_TYPES.Literal ||
+            node.right.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral))
+        return true;
+    return false;
+}
+exports.noShellInjection = (0, eslint_devkit_1.createRule)({
+    name: 'no-shell-injection',
+    meta: {
+        type: 'problem',
+        docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-shell-injection.md',
+            description: 'Disallow string concatenation or template expressions in shell command arguments (CWE-78)',
+            cwe: 'CWE-78',
+            cvss: 9.8,
+        },
+        messages: {
+            shellInjection: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'OS Command Injection (CWE-78)',
+                cwe: 'CWE-78',
+                description: 'Shell command built via string concatenation or template literal. An attacker who controls any interpolated value can execute arbitrary OS commands.',
+                severity: 'CRITICAL',
+                fix: 'Use spawn(cmd, [arg1, arg2]) with separate arguments instead of exec(cmd + args). Never build shell commands via string interpolation.',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html',
+            }),
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                let fnName = null;
+                // exec('cmd') / execSync('cmd') — bare call
+                if (callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                    fnName = callee.name;
+                }
+                // require('child_process').exec('cmd') — member access
+                else if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                    callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                    fnName = callee.property.name;
+                }
+                if (!fnName || !SHELL_EXEC_FUNCTIONS.has(fnName))
+                    return;
+                const firstArg = node.arguments[0];
+                if (!firstArg || firstArg.type === eslint_devkit_1.AST_NODE_TYPES.SpreadElement)
+                    return;
+                if (isStringConcatOrTemplate(firstArg)) {
+                    context.report({ node: firstArg, messageId: 'shellInjection' });
+                }
+            },
+        };
+    },
+});
+//# sourceMappingURL=index.js.map

package/src/rules/no-shell-injection/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-shell-injection/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAGH,4DAAsG;AAKtG,8FAA8F;AAC9F,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM,EAAE,UAAU;CACnB,CAAC,CAAC;AAEH,SAAS,wBAAwB,CAAC,IAAmB;IACnD,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7F,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QAC7C,IAAI,CAAC,QAAQ,KAAK,GAAG;QACrB,CACE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;YACzC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;YACjD,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;YAClD,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;YAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,CACnD;QACD,OAAO,IAAI,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,gBAAgB,GAAG,IAAA,0BAAU,EAA0B;IAClE,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,uHAAuH;YAC5H,WAAW,EAAE,2FAA2F;YACxG,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,+BAA+B;gBAC1C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,sJAAsJ;gBACnK,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,wIAAwI;gBAC7I,iBAAiB,EAAE,8FAA8F;aAClH,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAsD;QAC3D,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,IAAI,MAAM,GAAkB,IAAI,CAAC;gBAEjC,4CAA4C;gBAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;oBAC9C,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;gBACvB,CAAC;gBACD,uDAAuD;qBAClD,IACH,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAClD,CAAC;oBACD,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,CAAC;gBAED,IAAI,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAEzD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,aAAa;oBAAE,OAAO;gBAExE,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/no-ssrf/index.js

@@ -136,21 +136,21 @@ function hasValidationBefore(node) {
 exports.noSsrf = (0, eslint_devkit_1.createRule)({
     name: 'no-ssrf',
     meta: {
-        type: 'problem',
+        type: 'suggestion',
         docs: {
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-ssrf.md',
-            description: 'Detects HTTP requests with user-controlled URLs (SSRF vulnerability)',
+            description: 'Flags HTTP calls whose URL argument is an identifier with a user-input-sounding name — a heuristic prompt for code review, not a proof of SSRF',
             cwe: 'CWE-918',
-            cvss: 7.5,
+            cvss: 9.1,
         },
         messages: {
             ssrfVulnerability: (0, eslint_devkit_1.formatLLMMessage)({
                 icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Server-Side Request Forgery (SSRF)',
+                issueName: 'Possible SSRF — heuristic (CWE-918)',
                 cwe: 'CWE-918',
-                description: 'HTTP request with potentially user-controlled URL. An attacker could access internal services.',
-                severity: 'HIGH',
-                fix: 'Validate URL against an allowlist of permitted hosts before making the request.',
+                description: 'HTTP call whose URL argument name suggests user input. This is a naming heuristic, not data-flow analysis — review whether the URL could originate from an untrusted source at runtime.',
+                severity: 'LOW',
+                fix: 'If the URL comes from user input, validate it against an allowlist of permitted hosts before making the request.',
                 documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html',
             }),
         },

package/src/rules/no-ssrf/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-ssrf/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,4DAKkC;AAWlC,oDAAoD;AACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO,EAAQ,wBAAwB;IACvC,KAAK,EAAU,MAAM;IACrB,WAAW,EAAI,aAAa;IAC5B,QAAQ,EAAO,SAAS;CACzB,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;CACtE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;CACnE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IACpE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa;CACnE,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACxC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAClC,MAAM,EAAE,OAAO,EAAE,OAAO;CACzB,CAAC;AAEF;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAmB;IACjD,oDAAoD;IACpD,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,aAAa;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QAC7C,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACnD,CACE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;YACrD,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAChF,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtD,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CACnF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5F,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,KAAK,GAAI,IAA2C,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAK,KAAiC,EAAE,CAAC;YACvF,IAAI,sBAAsB,CAAC,KAAsB,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACvD,IAAI,sBAAsB,CAAC,IAAqB,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAA6B;IACxD,uCAAuC;IACvC,IAAI,OAAO,GAA+B,IAAmD,CAAC,MAAM,CAAC;IACrG,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAA+B,OAAsD,CAAC,MAAM,CAAC;QACzG,IAAI,CAAC,MAAM;YAAE,MAAM;QAEnB,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAA6B,CAAC,CAAC;YAExD,4DAA4D;YAC5D,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,MAAM,GAAG,IAAA,0BAAU,EAA0B;IACxD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,4GAA4G;YACjH,WAAW,EACT,sEAAsE;YACxE,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oCAAoC;gBAC/C,GAAG,EAAE,SAAS;gBACd,WAAW,EACT,gGAAgG;gBAClG,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,iFAAiF;gBACtF,iBAAiB,EACf,wGAAwG;aAC3G,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GACd,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,UAAU;YAAE,OAAO,EAAE,CAAC;QAE1B,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;gBAEvB,gDAAgD;gBAChD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,oDAAoD;gBACpD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAClD,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAExB,qCAAqC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBAEpB,8DAA8D;gBAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBAAE,OAAO;gBAEnD,gFAAgF;gBAChF,IACE,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;oBAC9C,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,mEAAmE;gBACnE,oDAAoD;gBACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBAED,2EAA2E;gBAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;oBAC9C,wDAAwD;oBACxD,qDAAqD;oBACrD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvC,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,mBAAmB;iBAC/B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-ssrf/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,4DAKkC;AAWlC,oDAAoD;AACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO,EAAQ,wBAAwB;IACvC,KAAK,EAAU,MAAM;IACrB,WAAW,EAAI,aAAa;IAC5B,QAAQ,EAAO,SAAS;CACzB,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;CACtE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;CACnE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IACpE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa;CACnE,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACxC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAClC,MAAM,EAAE,OAAO,EAAE,OAAO;CACzB,CAAC;AAEF;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAmB;IACjD,oDAAoD;IACpD,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,aAAa;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QAC7C,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACnD,CACE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;YACrD,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAChF,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtD,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CACnF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5F,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,KAAK,GAAI,IAA2C,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAK,KAAiC,EAAE,CAAC;YACvF,IAAI,sBAAsB,CAAC,KAAsB,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACvD,IAAI,sBAAsB,CAAC,IAAqB,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAA6B;IACxD,uCAAuC;IACvC,IAAI,OAAO,GAA+B,IAAmD,CAAC,MAAM,CAAC;IACrG,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAA+B,OAAsD,CAAC,MAAM,CAAC;QACzG,IAAI,CAAC,MAAM;YAAE,MAAM;QAEnB,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAA6B,CAAC,CAAC;YAExD,4DAA4D;YAC5D,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,MAAM,GAAG,IAAA,0BAAU,EAA0B;IACxD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,4GAA4G;YACjH,WAAW,EACT,gJAAgJ;YAClJ,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,SAAS;gBACd,WAAW,EACT,yLAAyL;gBAC3L,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kHAAkH;gBACvH,iBAAiB,EACf,wGAAwG;aAC3G,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GACd,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,UAAU;YAAE,OAAO,EAAE,CAAC;QAE1B,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;gBAEvB,gDAAgD;gBAChD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,oDAAoD;gBACpD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAClD,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAExB,qCAAqC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBAEpB,8DAA8D;gBAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBAAE,OAAO;gBAEnD,gFAAgF;gBAChF,IACE,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;oBAC9C,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,mEAAmE;gBACnE,oDAAoD;gBACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBAED,2EAA2E;gBAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;oBAC9C,wDAAwD;oBACxD,qDAAqD;oBACrD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvC,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,mBAAmB;iBAC/B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/no-unsafe-dynamic-require/index.js

@@ -16,7 +16,7 @@ exports.noUnsafeDynamicRequire = (0, eslint_devkit_2.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-unsafe-dynamic-require.md',
             description: 'Prevent unsafe dynamic require() calls that could enable code injection',
             cwe: 'CWE-95',
-            cvss: 9.5,
+            cvss: 9.8,
         },
         hasSuggestions: false,
         messages: {

package/src/rules/no-weak-cipher-algorithm/index.js

@@ -77,7 +77,7 @@ exports.noWeakCipherAlgorithm = (0, eslint_devkit_1.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-weak-cipher-algorithm.md',
             description: 'Disallow weak cipher algorithms (DES, 3DES, RC4, Blowfish)',
             cwe: 'CWE-327',
-            cvss: 9.5,
+            cvss: 7.5,
         },
         hasSuggestions: true,
         messages: {

package/src/rules/no-weak-hash-algorithm/index.js

@@ -65,7 +65,7 @@ exports.noWeakHashAlgorithm = (0, eslint_devkit_1.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-weak-hash-algorithm.md',
             description: 'Disallow weak hash algorithms (MD5, SHA1, MD4)',
             cwe: 'CWE-327',
-            cvss: 9.5,
+            cvss: 7.5,
         },
         hasSuggestions: true,
         messages: {

package/src/rules/prefer-native-crypto/index.js

@@ -31,7 +31,7 @@ exports.preferNativeCrypto = (0, eslint_devkit_1.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/prefer-native-crypto.md',
             description: 'Prefer native crypto over third-party libraries',
             cwe: 'CWE-1104',
-            cvss: 5,
+            cvss: 5.3,
         },
         hasSuggestions: true,
         messages: {

package/src/rules/prefer-native-crypto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/prefer-native-crypto/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,4DAAsG;AActG,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,UAAU;IACV,MAAM,EAAY,qCAAqC;IACvD,OAAO,EAAW,aAAa;IAC/B,YAAY;IACZ,WAAW;IACX,UAAU,EAAQ,wCAAwC;IAC1D,WAAW;IACX,WAAW;IACX,SAAS;IACT,QAAQ;IACR,aAAa;IACb,QAAQ;CACT,CAAC,CAAC;AAEU,QAAA,kBAAkB,GAAG,IAAA,0BAAU,EAA0B;IACpE,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,yHAAyH;YAC9H,WAAW,EAAE,iDAAiD;YAC9D,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,CAAC;SACR;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,OAAO;gBAC1B,SAAS,EAAE,4BAA4B;gBACvC,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,8IAA8I;gBAC3J,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,iCAAiC;gBACtC,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,aAAa,EAAE,IAAA,gCAAgB,EAAC;gBAC9B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,kDAAkD;gBAC/D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,uDAAuD;gBACpE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0BAA0B;gBAC/B,iBAAiB,EAAE,iEAAiE;aACrF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;wBACvB,OAAO,EAAE,MAAM;wBACf,WAAW,EAAE,gBAAgB;qBAC9B;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,SAAS,mBAAmB,CAAC,IAAmB,EAAE,OAAe;YAC/D,4FAA4F;YAC5F,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,cAAc;gBACzB,IAAI,EAAE,EAAE,OAAO,EAAE;gBACjB,OAAO,EAAE;oBACP;wBACE,SAAS,EAAE,eAAe;wBAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,cAAc;wBACzB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,iBAAiB,CAAC,IAAgC;gBAChD,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;oBACrE,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACrC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,cAAc,CAAC,IAA6B;gBAC1C,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAC3B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBACjD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,EAC3C,CAAC;oBACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClD,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACrC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/prefer-native-crypto/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,4DAAsG;AActG,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,UAAU;IACV,MAAM,EAAY,qCAAqC;IACvD,OAAO,EAAW,aAAa;IAC/B,YAAY;IACZ,WAAW;IACX,UAAU,EAAQ,wCAAwC;IAC1D,WAAW;IACX,WAAW;IACX,SAAS;IACT,QAAQ;IACR,aAAa;IACb,QAAQ;CACT,CAAC,CAAC;AAEU,QAAA,kBAAkB,GAAG,IAAA,0BAAU,EAA0B;IACpE,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,yHAAyH;YAC9H,WAAW,EAAE,iDAAiD;YAC9D,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,GAAG;SACV;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,OAAO;gBAC1B,SAAS,EAAE,4BAA4B;gBACvC,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,8IAA8I;gBAC3J,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,iCAAiC;gBACtC,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,aAAa,EAAE,IAAA,gCAAgB,EAAC;gBAC9B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,kDAAkD;gBAC/D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,uDAAuD;gBACpE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0BAA0B;gBAC/B,iBAAiB,EAAE,iEAAiE;aACrF,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;wBACvB,OAAO,EAAE,MAAM;wBACf,WAAW,EAAE,gBAAgB;qBAC9B;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,SAAS,mBAAmB,CAAC,IAAmB,EAAE,OAAe;YAC/D,4FAA4F;YAC5F,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,cAAc;gBACzB,IAAI,EAAE,EAAE,OAAO,EAAE;gBACjB,OAAO,EAAE;oBACP;wBACE,SAAS,EAAE,eAAe;wBAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,cAAc;wBACzB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,iBAAiB,CAAC,IAAgC;gBAChD,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;oBACrE,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACrC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,cAAc,CAAC,IAA6B;gBAC1C,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAC3B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBACjD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,EAC3C,CAAC;oBACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClD,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACrC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/require-dependency-integrity/index.js

@@ -18,7 +18,7 @@ exports.requireDependencyIntegrity = (0, eslint_devkit_1.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/require-dependency-integrity.md',
             description: 'Require SRI (Subresource Integrity) for CDN resources',
             cwe: 'CWE-494',
-            cvss: 7.5,
+            cvss: 8.1,
         },
         messages: {
             violationDetected: (0, eslint_devkit_1.formatLLMMessage)({

package/src/rules/no-pii-in-logs/index.d.ts

@@ -1,12 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-export interface Options {
-}
-type RuleOptions = [Options?];
-export declare const noPiiInLogs: import("@typescript-eslint/utils/ts-eslint").RuleModule<"violationDetected", RuleOptions, unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
-    name: string;
-};
-export {};

package/src/rules/no-pii-in-logs/index.js

@@ -1,77 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noPiiInLogs = void 0;
-/**
- * @fileoverview Prevent PII (email, SSN, credit cards) in console logs
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/532.html
- */
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noPiiInLogs = (0, eslint_devkit_1.createRule)({
-    name: 'no-pii-in-logs',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-pii-in-logs.md',
-            description: 'Prevent PII (email, SSN, credit cards) in console logs',
-            cwe: 'CWE-359',
-            cvss: 7.5,
-        },
-        messages: {
-            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'violation Detected',
-                cwe: 'CWE-359',
-                description: 'Prevent PII (email, SSN, credit cards) in console logs detected - this is a security risk',
-                severity: 'HIGH',
-                fix: 'Review and apply secure practices',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/359.html',
-            })
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        function report(node) {
-            context.report({
-                node,
-                messageId: 'violationDetected',
-            });
-        }
-        return {
-            CallExpression(node) {
-                // Check console.log/error/warn calls
-                if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    node.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    node.callee.object.name === 'console' &&
-                    node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    ['log', 'error', 'warn', 'info'].includes(node.callee.property.name)) {
-                    // Check arguments for PII-related property access
-                    for (const arg of node.arguments) {
-                        if (arg.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                            arg.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                            const propName = arg.property.name.toLowerCase();
-                            const piiProps = ['email', 'ssn', 'password', 'creditcard', 'phone'];
-                            if (piiProps.some(p => propName.includes(p))) {
-                                report(node);
-                            }
-                        }
-                        // Check string literals mentioning PII
-                        if (arg.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof arg.value === 'string') {
-                            const text = arg.value.toLowerCase();
-                            if (text.includes('email:') || text.includes('ssn:') || text.includes('password:')) {
-                                report(node);
-                            }
-                        }
-                    }
-                }
-            },
-        };
-    },
-});
-//# sourceMappingURL=index.js.map

package/src/rules/no-pii-in-logs/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-pii-in-logs/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;GAIG;AAEH,4DAAsG;AAUzF,QAAA,WAAW,GAAG,IAAA,0BAAU,EAA0B;IAC7D,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,mHAAmH;YACxH,WAAW,EAAE,wDAAwD;YACrE,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,2FAA2F;gBACxG,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,mCAAmC;gBACxC,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,SAAS,MAAM,CAAC,IAAmB;YACjC,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,mBAAmB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,qCAAqC;gBACrC,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EACpE,CAAC;oBACD,kDAAkD;oBAClD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACjC,IACE,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;4BAC5C,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAC/C,CAAC;4BACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;4BACjD,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;4BAErE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCAC7C,MAAM,CAAC,IAAI,CAAC,CAAC;4BACf,CAAC;wBACH,CAAC;wBAED,uCAAuC;wBACvC,IAAI,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;4BACzE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;4BACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gCACnF,MAAM,CAAC,IAAI,CAAC,CAAC;4BACf,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}