eslint-plugin-node-security 4.4.2 → 4.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/CHANGELOG.md +98 -0
  2. package/README.md +8 -2
  3. package/package.json +28 -20
  4. package/src/index.js +10 -1
  5. package/src/index.js.map +1 -1
  6. package/src/rules/no-ssrf/index.js +84 -17
  7. package/src/rules/no-ssrf/index.js.map +1 -1
  8. package/src/rules/require-secure-deletion/index.d.ts +5 -0
  9. package/src/rules/require-secure-deletion/index.js +71 -9
  10. package/src/rules/require-secure-deletion/index.js.map +1 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,103 @@
1
1
  ## [4.1.0] - 2026-05-03
2
2
 
3
+ ## 4.5.0
4
+
5
+ ### Minor Changes
6
+
7
+ - [#310](https://github.com/ofri-peretz/eslint/pull/310) [`28d7898`](https://github.com/ofri-peretz/eslint/commit/28d789896b06dd13ac7c50bcb4aaa36fa5e4be29) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Add `no-timing-unsafe-compare` to the `recommended` preset, restoring CWE-697
8
+ coverage.
9
+
10
+ `secure-coding/no-insecure-comparison` was removed from every `secure-coding`
11
+ preset, with `node-security/no-timing-unsafe-compare` named as the replacement.
12
+ But that rule was not in any `recommended` preset, so the practical result was
13
+ that **no `recommended` preset anywhere covered CWE-697 timing-unsafe
14
+ comparison**, and the migration note pointed users at a rule they would have had
15
+ to enable by hand — which the note did not say.
16
+
17
+ It enters at `'warn'` rather than `'error'`, matching the precedent already set
18
+ by `no-deprecated-buffer` in this preset: adopters shouldn't have CI turn red on
19
+ a version bump. Promote to `'error'` on the next major.
20
+
21
+ Note the coverage now lives in a different package than before. A project that
22
+ installs only `eslint-plugin-secure-coding` and relied on its presets for this
23
+ check needs `eslint-plugin-node-security` as well.
24
+
25
+ A lock test in `src/index.test.ts` fails if the rule leaves `recommended` again,
26
+ since that would silently make the migration note false.
27
+
28
+ - [#288](https://github.com/ofri-peretz/eslint/pull/288) [`89bea05`](https://github.com/ofri-peretz/eslint/commit/89bea05c6c48f5f1bdbcc3c87b301d967d962051) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Cut false positives in five security rules, measured against a 1,470-file corpus (webpack `lib/`, lodash, eslint-plugin-import `src/`, and two NestJS boilerplates).
29
+
30
+ **`secure-coding/no-hardcoded-credentials` — decide on the value, not the key name.** The rule reported any string in a credential-named slot, so `errors: { password: 'incorrectPassword' }` (an i18n error key) was a CVSS 9.8 finding — 5 of its 10 corpus hits. Detection is now driven by the value's shape: entropy, character-class mix, charset, and a "natural word string" test that rejects identifier- and message-shaped values. A credential-shaped name is still consulted, but only to promote an already-secret-shaped value. Corpus: **10 → 7 findings, and all 7 are true positives** — including two the old logic missed, because a 25-character random `key:` is now found by shape rather than by being on a name allowlist.
31
+
32
+ **`secure-coding/no-unsafe-deserialization` — `setTimeout` is not a deserializer.** `await new Promise(resolve => setTimeout(resolve, 1000))` was rated CVSS 9.8 CRITICAL. `setTimeout` / `setInterval` now only report in their implied-`eval` form (string first argument), and calls inside a function named `deserialize` / `unserialize` / `fromJSON` / `fromBuffer` — a class implementing a serialization protocol — are exempt. Corpus: **35 → 4**.
33
+
34
+ **`secure-coding/no-graphql-injection` — require real GraphQL syntax.** Any template literal containing a nested brace or the word `type` was a CVSS 9.8 GraphQL injection. Operation and schema keywords must now start a line, schema keywords require a body, and a bare selection set must be the entire string. Concatenations are matched on their reassembled static value rather than on their source text. Corpus: **41 → 0**.
35
+
36
+ **`node-security/require-secure-deletion` — only sensitive properties.** The rule fired on every `delete obj.prop`. It now reports only a statically known, sensitive property name (`password`, `token`, `apiKey`, `privateKey`, `sessionId`, …), configurable via the new `additionalSensitiveProperties` option, and understands computed access and optional chaining. Corpus: **25 → 1** (a genuine `delete userDto.oldPassword`).
37
+
38
+ **`secure-coding/no-insecure-comparison` — removed from `recommended`, `recommended-strict` and `owasp-top-10`.** It is deprecated in favour of `node-security/no-timing-unsafe-compare`, and its loose-equality half re-reports core `eqeqeq` under a CWE-697 banner — 433 corpus findings, all duplicates. No narrowing fixes that, so the honest change is to stop switching it on for people; it remains exported and available via `strict` or explicit opt-in. Its timing-attack half was also narrowed to match secret keywords on identifier **word segments** instead of substrings of the whole expression text, which stops `if (key === "__non_webpack_require__")` (and `monkey`, `keyword`, `machine`, `author`) from being reported: **443 → 221**.
39
+
40
+ ### Patch Changes
41
+
42
+ - [#294](https://github.com/ofri-peretz/eslint/pull/294) [`659f6dc`](https://github.com/ofri-peretz/eslint/commit/659f6dc0181b03b675f72b5949fcf123dd066358) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Rewrite `description` and `keywords` on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release.
43
+
44
+ **Descriptions now lead with the search phrase.** Every one starts `ESLint plugin for <the thing you'd search>` instead of a brand-first or category-first framing, and names the concrete vulnerabilities the plugin actually detects. Three were corrected while doing so:
45
+
46
+ - `eslint-plugin-import-next` claimed "100x faster no-cycle detection". No 100x measurement exists: `CLAIMS.md` records **3.1x end-to-end** (8x in pure rule execution) on a 5,483-file React codebase, and the highest number in any benchmark result is 54.9x on the synthetic corpus. The description now states the real-codebase figure.
47
+ - `eslint-plugin-secure-coding` claimed SQL injection, XSS and CSRF coverage — none of which are its rules. It now names what it does detect: LDAP, XPath, XXE, GraphQL and template injection, unsafe deserialization, ReDoS, missing authentication, and PII in logs.
48
+ - `eslint-plugin-secure-coding` ("89 rules") and `eslint-plugin-react-a11y` ("37 rules") hard-coded rule counts that had drifted from reality. Counts are generated into `interlace-numbers.json`; hand-typed copies are removed rather than corrected.
49
+
50
+ **Keywords now match the vocabulary of the plugins that rank.** `eslint-plugin-security`, `eslint-plugin-jsx-a11y`, `eslint-plugin-n` and `eslint-plugin-import` all carry the `eslint` / `eslintplugin` / `eslint-plugin` trio — six of our packages were missing `eslintplugin`, and every one now carries all three plus `static-analysis`, `linting` and `code-quality`. Security plugins add `sast`, `appsec` and `vulnerability`; `node-security` and `secure-coding` also carry `nodesecurity`, the exact keyword `eslint-plugin-security` ranks on. Each plugin gained the CWE identifiers and attack names for what it detects (`cwe-78` command injection, `cwe-22` path traversal, `cwe-89` SQL injection, `cwe-79` XSS, `cwe-347` JWT algorithm confusion, `cwe-352` CSRF, `cwe-943` NoSQL injection), and `node-security` gained the crypto vocabulary it had been missing entirely despite absorbing the crypto rule set (`crypto`, `cryptography`, `weak-hash`, `md5`, `sha1`, `timing-attack`).
51
+
52
+ No rule behavior, exports, or configuration changes.
53
+
54
+ - [#296](https://github.com/ofri-peretz/eslint/pull/296) [`0c7a208`](https://github.com/ofri-peretz/eslint/commit/0c7a208f568436cc55ac6732641df46e8f44af1f) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Cut two false positives confirmed against the benchmark corpus SAFE fixtures.
55
+
56
+ **`node-security/no-ssrf`** — the user-input gate only ran when the URL argument
57
+ was a bare identifier, so every other shape reported unconditionally. A Node
58
+ options object built from a helper's own parameters —
59
+ `https.request({ host, path, method: 'GET' })`, from
60
+ `benchmarks/corpus/CWE-444/safe/request-default-parser.js` — was flagged with no
61
+ user data anywhere in the flow.
62
+
63
+ The gate now applies to every argument shape and requires evidence: a
64
+ user-input-named identifier standing as the URL, a read off a request object
65
+ (`req` / `request` / `ctx` / `event`), or a template literal or concatenation
66
+ interpolating either. Options-object fields count when they are request-sourced,
67
+ or when a `url` / `href` / `uri` key holds a user-input-named identifier.
68
+
69
+ Newly ignored: options objects and interpolations built purely from locals.
70
+ Still reported: `fetch(userUrl)`, `fetch(req.query.url)`,
71
+ `https.request({ host: req.query.host })`, ``fetch(`https://${userHost}/x`)``.
72
+
73
+ **`secure-coding/no-hardcoded-credentials`** — `secret: '<your-secret-here>'`
74
+ from `benchmarks/corpus/CWE-798/safe/test-placeholder-values.js` was reported at
75
+ CVSS 9.8. The angle brackets are two character classes, which is all the shape
76
+ gate asks for once the slot is credential-named.
77
+
78
+ Self-evident placeholders are now skipped: bracketed template slots (`<…>`,
79
+ `{{…}}`, `${…}`, `[…]`), placeholder words standing as their own token
80
+ (`changeme`, `YOUR_API_KEY`, `example`), and one character repeated
81
+ (`xxxxxxxxxxxx`). Whole-token matching only, so a real secret that merely
82
+ contains such a substring is unaffected.
83
+
84
+ The allowlist applies to non-structural findings only — a JWT, an `sk_live_`
85
+ key, or a `postgres://user:pass@host` string still reports whatever words it
86
+ contains. Set the new `allowPlaceholders: false` option to restore the previous
87
+ behaviour.
88
+
89
+ - Updated dependencies [[`e1cdf83`](https://github.com/ofri-peretz/eslint/commit/e1cdf83e3db761907f0ab06f7fc6c1f1da7513a5), [`659f6dc`](https://github.com/ofri-peretz/eslint/commit/659f6dc0181b03b675f72b5949fcf123dd066358)]:
90
+ - @interlace/eslint-devkit@1.4.3
91
+
92
+ ## 4.4.3
93
+
94
+ ### Patch Changes
95
+
96
+ - [#269](https://github.com/ofri-peretz/eslint/pull/269) [`7028fe2`](https://github.com/ofri-peretz/eslint/commit/7028fe2668a42266d831014184dcef70e73101ad) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - docs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes.
97
+
98
+ - Updated dependencies [[`7028fe2`](https://github.com/ofri-peretz/eslint/commit/7028fe2668a42266d831014184dcef70e73101ad)]:
99
+ - @interlace/eslint-devkit@1.4.2
100
+
3
101
  ## 4.4.2
4
102
 
5
103
  ### Patch Changes
package/README.md CHANGED
@@ -1,5 +1,7 @@
1
1
  <p align="center">
2
- <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security" target="blank"><img src="https://eslint.interlace.tools/eslint-interlace-logo-light.svg" alt="ESLint Interlace Logo" width="120" /></a>
2
+ <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security" target="blank"><img src="https://eslint.interlace.tools/icon-light.svg" alt="Interlace" height="90" /></a>
3
+ &nbsp;&nbsp;
4
+ <a href="https://eslint.org" target="_blank"><img src="https://eslint.interlace.tools/eslint-logo.svg" alt="ESLint" height="90" /></a>
3
5
  </p>
4
6
 
5
7
  <p align="center">
@@ -146,4 +148,8 @@ MIT © [Ofri Peretz](https://github.com/ofri-peretz)
146
148
 
147
149
  <p align="center">
148
150
  <a href="https://eslint.interlace.tools/docs/security/plugin-node-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security"><img src="https://eslint.interlace.tools/images/og-node-security.png" alt="ESLint Interlace Plugin" width="100%" /></a>
149
- </p>
151
+ </p>
152
+
153
+ <p align="center">
154
+ <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security" target="blank"><img src="https://eslint.interlace.tools/icon-light.svg" alt="Interlace" height="70" /></a>
155
+ </p>
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "eslint-plugin-node-security",
3
- "version": "4.4.2",
4
- "description": "Security-focused ESLint plugin for Node.js built-in modules (fs, child_process, vm, path, Buffer). Detects command injection, path traversal, code execution vulnerabilities with AI-parseable error messages.",
3
+ "version": "4.5.0",
4
+ "description": "ESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.",
5
5
  "type": "commonjs",
6
6
  "main": "./src/index.js",
7
7
  "types": "./src/index.d.ts",
@@ -43,38 +43,46 @@
43
43
  ],
44
44
  "keywords": [
45
45
  "eslint",
46
- "eslint-plugin",
47
46
  "eslintplugin",
48
- "interlace-security",
47
+ "eslint-plugin",
48
+ "static-analysis",
49
+ "linting",
50
+ "code-quality",
49
51
  "security",
50
- "node-security",
52
+ "sast",
53
+ "appsec",
54
+ "vulnerability",
55
+ "owasp",
56
+ "cwe",
57
+ "interlace-security",
58
+ "node",
51
59
  "nodejs",
52
- "child-process",
60
+ "node-security",
61
+ "nodesecurity",
53
62
  "command-injection",
63
+ "cwe-78",
54
64
  "path-traversal",
55
- "fs",
56
- "vm",
57
- "buffer",
58
- "owasp",
59
- "cwe",
60
- "vulnerability",
65
+ "cwe-22",
66
+ "ssrf",
67
+ "zip-slip",
68
+ "child-process",
69
+ "crypto",
70
+ "cryptography",
71
+ "weak-hash",
72
+ "md5",
73
+ "sha1",
74
+ "timing-attack",
61
75
  "llm-optimized",
62
76
  "ai-assistant",
63
- "auto-fix",
64
77
  "typescript",
65
- "linting",
66
- "code-quality",
67
- "ast",
68
- "static-analysis",
69
- "mcp",
70
- "model-context-protocol"
78
+ "auto-fix"
71
79
  ],
72
80
  "engines": {
73
81
  "node": ">=18.0.0"
74
82
  },
75
83
  "dependencies": {
76
84
  "tslib": "^2.3.0",
77
- "@interlace/eslint-devkit": "^1.4.1"
85
+ "@interlace/eslint-devkit": "^1.4.3"
78
86
  },
79
87
  "devDependencies": {
80
88
  "@typescript-eslint/parser": "^8.46.2",
package/src/index.js CHANGED
@@ -85,7 +85,7 @@ exports.rules = {
85
85
  exports.plugin = {
86
86
  meta: {
87
87
  name: 'eslint-plugin-node-security',
88
- version: '4.4.2',
88
+ version: '4.5.0',
89
89
  },
90
90
  rules: exports.rules,
91
91
  };
@@ -112,6 +112,15 @@ const recommendedRules = {
112
112
  'node-security/no-ssrf': 'warn',
113
113
  'node-security/no-shell-injection': 'error',
114
114
  'node-security/no-dynamic-algorithm-selection': 'error',
115
+ // Added to `recommended` 2026-08-02. `secure-coding/no-insecure-comparison`
116
+ // was removed from every `secure-coding` preset in favour of this rule, but
117
+ // this rule was not in any `recommended` preset — so CWE-697 timing-unsafe
118
+ // comparison had no preset coverage anywhere in the ecosystem, and the
119
+ // migration note pointed at a rule users would have had to enable by hand.
120
+ // Enters at 'warn' rather than 'error' for the same reason as
121
+ // `no-deprecated-buffer` above: adopters already on this preset shouldn't
122
+ // have CI turn red on a version bump. Promote on the next major.
123
+ 'node-security/no-timing-unsafe-compare': 'warn',
115
124
  // Migrated Rules
116
125
  'node-security/detect-suspicious-dependencies': 'warn',
117
126
  'node-security/lock-file': 'warn', // filesystem check — not pure AST; CI enforces this better
package/src/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,uEAAkE;AAClE,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,6CAAyC;AACzC,mEAA8D;AAC9D,2FAAqF;AAErF,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,yEAAmE;AACnE,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAGd;IACF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,sBAAsB,EAAE,yCAAkB;IAC1C,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,SAAS,EAAE,gBAAM;IACjB,oBAAoB,EAAE,qCAAgB;IACtC,gCAAgC,EAAE,4DAA2B;IAE7D,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,uBAAuB,EAAE,0CAAkB;IAC3C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kCAAkC,EAAE,MAAM;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,6CAA6C;IAC7C,oCAAoC,EAAE,OAAO;IAC7C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,MAAM;IAC/B,kCAAkC,EAAE,OAAO;IAC3C,8CAA8C,EAAE,OAAO;IAEvD,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,MAAM,EAAE,2DAA2D;IAC9F,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,qCAAqC,EAAE,OAAO;IAC9C,2BAA2B,EAAE,OAAO;CACrC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,iBAAiB,QAAQ,EAAE;YAC3B,OAAO;SACR,CAAC,CACH;KACmC;CACvC,CAAC;AAEF,kBAAe,cAAM,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,uEAAkE;AAClE,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,6CAAyC;AACzC,mEAA8D;AAC9D,2FAAqF;AAErF,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,yEAAmE;AACnE,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAGd;IACF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,sBAAsB,EAAE,yCAAkB;IAC1C,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,SAAS,EAAE,gBAAM;IACjB,oBAAoB,EAAE,qCAAgB;IACtC,gCAAgC,EAAE,4DAA2B;IAE7D,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,uBAAuB,EAAE,0CAAkB;IAC3C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kCAAkC,EAAE,MAAM;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,6CAA6C;IAC7C,oCAAoC,EAAE,OAAO;IAC7C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,MAAM;IAC/B,kCAAkC,EAAE,OAAO;IAC3C,8CAA8C,EAAE,OAAO;IACvD,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8DAA8D;IAC9D,0EAA0E;IAC1E,iEAAiE;IACjE,wCAAwC,EAAE,MAAM;IAEhD,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,MAAM,EAAE,2DAA2D;IAC9F,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,qCAAqC,EAAE,OAAO;IAC9C,2BAA2B,EAAE,OAAO;CACrC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,iBAAiB,QAAQ,EAAE;YAC3B,OAAO;SACR,CAAC,CACH;KACmC;CACvC,CAAC;AAEF,kBAAe,cAAM,CAAC"}
package/src/rules/no-ssrf/index.js CHANGED
@@ -40,6 +40,82 @@ function isUserInputParamName(name) {
40
40
  const lower = name.toLowerCase();
41
41
  return USER_INPUT_SUBSTRINGS.some(sub => lower.includes(sub));
42
42
  }
43
+ // Object roots whose members carry attacker-controlled data in the common
44
+ // server frameworks: Express `req`/`request`, Koa `ctx`, Lambda `event`.
45
+ const REQUEST_ROOT_NAMES = new Set(['req', 'request', 'ctx', 'event']);
46
+ // Keys of a Node `http.request(options)` object that actually name a URL.
47
+ // `host`/`hostname`/`path`/`port` are deliberately absent: a helper that
48
+ // parameterises them is ordinary internal plumbing, not evidence of user flow.
49
+ const URL_OPTION_KEYS = new Set(['url', 'href', 'uri']);
50
+ /**
51
+ * True when the expression reads off a request object — `req.query.url`,
52
+ * `ctx.request.body.target`, `event.queryStringParameters.u`. Everything
53
+ * hanging off a request is untrusted, so the root name is the whole test.
54
+ */
55
+ function isRequestSourced(node) {
56
+ let current = node;
57
+ while (current.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
58
+ current = current.object;
59
+ }
60
+ return (current !== node &&
61
+ current.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
62
+ REQUEST_ROOT_NAMES.has(current.name.toLowerCase()));
63
+ }
64
+ /**
65
+ * Does the URL argument carry untrusted data into the request?
66
+ *
67
+ * The rule reports on evidence of flow, never on the mere presence of a
68
+ * dynamic argument. Three shapes qualify:
69
+ *
70
+ * 1. The whole argument is a user-input-named identifier — `fetch(userUrl)`.
71
+ * This is the rule's documented naming heuristic: a bare identifier in
72
+ * URL position *is* the URL.
73
+ * 2. Any part of the expression reads from a request object —
74
+ * `fetch(req.query.url)`, `https.request({ host: req.query.h })`.
75
+ * 3. A template literal URL interpolates either of the above —
76
+ * `fetch(\`https://\${userHost}/x\`)`.
77
+ *
78
+ * Everything else is not evidence. In particular an options object whose
79
+ * fields are plain locals — `https.request({ host, path, method: 'GET' })`,
80
+ * benchmarks/corpus/CWE-444/safe/request-default-parser.js — used to be
81
+ * reported unconditionally because a non-Identifier argument bypassed the
82
+ * name gate entirely.
83
+ */
84
+ function carriesUntrustedUrl(node) {
85
+ switch (node.type) {
86
+ case eslint_devkit_1.AST_NODE_TYPES.Identifier:
87
+ return isUserInputParamName(node.name);
88
+ case eslint_devkit_1.AST_NODE_TYPES.MemberExpression:
89
+ return isRequestSourced(node);
90
+ case eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral:
91
+ return node.expressions.some(carriesUntrustedUrl);
92
+ // `new URL(userUrl)` / `String(req.query.url)` — inspect the arguments.
93
+ case eslint_devkit_1.AST_NODE_TYPES.CallExpression:
94
+ case eslint_devkit_1.AST_NODE_TYPES.NewExpression:
95
+ return node.arguments.some(carriesUntrustedUrl);
96
+ // `'https://host' + userPath`
97
+ case eslint_devkit_1.AST_NODE_TYPES.BinaryExpression:
98
+ return carriesUntrustedUrl(node.left) || carriesUntrustedUrl(node.right);
99
+ // `http.request({ url: x, host: y })` — only URL-naming keys count by
100
+ // name; every other key still counts if its value is request-sourced.
101
+ case eslint_devkit_1.AST_NODE_TYPES.ObjectExpression:
102
+ return node.properties.some(property => {
103
+ if (property.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
104
+ return false;
105
+ const value = property.value;
106
+ if (isRequestSourced(value))
107
+ return true;
108
+ const key = property.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier
109
+ ? property.key.name
110
+ : property.key.type === eslint_devkit_1.AST_NODE_TYPES.Literal
111
+ ? String(property.key.value)
112
+ : '';
113
+ return URL_OPTION_KEYS.has(key.toLowerCase()) && carriesUntrustedUrl(value);
114
+ });
115
+ default:
116
+ return false;
117
+ }
118
+ }
43
119
  /**
44
120
  * AST-based check: does this node contain a validation pattern?
45
121
  * Walks the node tree looking for known validation constructs.
@@ -139,7 +215,7 @@ exports.noSsrf = (0, eslint_devkit_1.createRule)({
139
215
  type: 'suggestion',
140
216
  docs: {
141
217
  url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-ssrf.md',
142
- description: 'Flags HTTP calls whose URL argument is an identifier with a user-input-sounding name — a heuristic prompt for code review, not a proof of SSRF',
218
+ description: 'Flags HTTP calls whose URL argument is a user-input-named identifier or reads off a request object — a heuristic prompt for code review, not a proof of SSRF',
143
219
  cwe: 'CWE-918',
144
220
  cvss: 9.1,
145
221
  },
@@ -196,26 +272,17 @@ exports.noSsrf = (0, eslint_devkit_1.createRule)({
196
272
  const urlArg = node.arguments[0];
197
273
  if (!urlArg)
198
274
  return;
199
- // Safe: literal string URL — fetch('https://api.example.com')
200
- if (urlArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal)
201
- return;
202
- // Safe: template literal without expressions — fetch(`https://api.example.com`)
203
- if (urlArg.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral &&
204
- urlArg.expressions.length === 0) {
205
- return;
206
- }
207
- // The URL is dynamic (identifier, template with expressions, etc.)
275
+ // Static URLs — fetch('https://api.example.com'), fetch(`https://…`) —
276
+ // carry nothing untrusted and fall out at the evidence gate below.
208
277
  // Check if there is URL validation before this call
209
278
  if (hasValidationBefore(node)) {
210
279
  return;
211
280
  }
212
- // Check if the argument is a function parameter that looks like user input
213
- if (urlArg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
214
- // If the variable name doesn't suggest user input, skip
215
- // This reduces false positives on internal API calls
216
- if (!isUserInputParamName(urlArg.name)) {
217
- return;
218
- }
281
+ // Require evidence that untrusted data reaches the URL. Applies to
282
+ // every argument shape — an options object or a template literal used
283
+ // to bypass this gate entirely and report unconditionally.
284
+ if (!carriesUntrustedUrl(urlArg)) {
285
+ return;
219
286
  }
220
287
  context.report({
221
288
  node,
package/src/rules/no-ssrf/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-ssrf/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,4DAKkC;AAWlC,oDAAoD;AACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO,EAAQ,wBAAwB;IACvC,KAAK,EAAU,MAAM;IACrB,WAAW,EAAI,aAAa;IAC5B,QAAQ,EAAO,SAAS;CACzB,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;CACtE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;CACnE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IACpE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa;CACnE,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACxC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAClC,MAAM,EAAE,OAAO,EAAE,OAAO;CACzB,CAAC;AAEF;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAmB;IACjD,oDAAoD;IACpD,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,aAAa;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QAC7C,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACnD,CACE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;YACrD,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAChF,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtD,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CACnF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5F,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,KAAK,GAAI,IAA2C,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAK,KAAiC,EAAE,CAAC;YACvF,IAAI,sBAAsB,CAAC,KAAsB,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACvD,IAAI,sBAAsB,CAAC,IAAqB,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAA6B;IACxD,uCAAuC;IACvC,IAAI,OAAO,GAA+B,IAAmD,CAAC,MAAM,CAAC;IACrG,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAA+B,OAAsD,CAAC,MAAM,CAAC;QACzG,IAAI,CAAC,MAAM;YAAE,MAAM;QAEnB,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAA6B,CAAC,CAAC;YAExD,4DAA4D;YAC5D,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,MAAM,GAAG,IAAA,0BAAU,EAA0B;IACxD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,4GAA4G;YACjH,WAAW,EACT,gJAAgJ;YAClJ,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,SAAS;gBACd,WAAW,EACT,yLAAyL;gBAC3L,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kHAAkH;gBACvH,iBAAiB,EACf,wGAAwG;aAC3G,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GACd,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,UAAU;YAAE,OAAO,EAAE,CAAC;QAE1B,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;gBAEvB,gDAAgD;gBAChD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,oDAAoD;gBACpD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAClD,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAExB,qCAAqC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBAEpB,8DAA8D;gBAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBAAE,OAAO;gBAEnD,gFAAgF;gBAChF,IACE,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;oBAC9C,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,mEAAmE;gBACnE,oDAAoD;gBACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBAED,2EAA2E;gBAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;oBAC9C,wDAAwD;oBACxD,qDAAqD;oBACrD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvC,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,mBAAmB;iBAC/B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-ssrf/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,4DAKkC;AAWlC,oDAAoD;AACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO,EAAQ,wBAAwB;IACvC,KAAK,EAAU,MAAM;IACrB,WAAW,EAAI,aAAa;IAC5B,QAAQ,EAAO,SAAS;CACzB,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;CACtE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;CACnE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IACpE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa;CACnE,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACxC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAClC,MAAM,EAAE,OAAO,EAAE,OAAO;CACzB,CAAC;AAEF;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvE,0EAA0E;AAC1E,yEAAyE;AACzE,+EAA+E;AAC/E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAExD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB,EAAE,CAAC;QACxD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC1C,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,mBAAmB,CAAC,IAAmB;IAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,8BAAc,CAAC,UAAU;YAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzC,KAAK,8BAAc,CAAC,gBAAgB;YAClC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAEhC,KAAK,8BAAc,CAAC,eAAe;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAEpD,wEAAwE;QACxE,KAAK,8BAAc,CAAC,cAAc,CAAC;QACnC,KAAK,8BAAc,CAAC,aAAa;YAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAElD,8BAA8B;QAC9B,KAAK,8BAAc,CAAC,gBAAgB;YAClC,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAqB,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE5F,sEAAsE;QACtE,sEAAsE;QACtE,KAAK,8BAAc,CAAC,gBAAgB;YAClC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACrC,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAsB,CAAC;gBAC9C,IAAI,gBAAgB,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzC,MAAM,GAAG,GACP,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC7C,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI;oBACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;wBAC5C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;wBAC5B,CAAC,CAAC,EAAE,CAAC;gBACX,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;QAEL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAmB;IACjD,oDAAoD;IACpD,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,aAAa;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QAC7C,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACnD,CACE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;YACrD,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAChF,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtD,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CACnF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5F,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,KAAK,GAAI,IAA2C,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAK,KAAiC,EAAE,CAAC;YACvF,IAAI,sBAAsB,CAAC,KAAsB,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACvD,IAAI,sBAAsB,CAAC,IAAqB,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAA6B;IACxD,uCAAuC;IACvC,IAAI,OAAO,GAA+B,IAAmD,CAAC,MAAM,CAAC;IACrG,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAA+B,OAAsD,CAAC,MAAM,CAAC;QACzG,IAAI,CAAC,MAAM;YAAE,MAAM;QAEnB,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAA6B,CAAC,CAAC;YAExD,4DAA4D;YAC5D,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,MAAM,GAAG,IAAA,0BAAU,EAA0B;IACxD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,4GAA4G;YACjH,WAAW,EACT,8JAA8J;YAChK,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,SAAS;gBACd,WAAW,EACT,yLAAyL;gBAC3L,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kHAAkH;gBACvH,iBAAiB,EACf,wGAAwG;aAC3G,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GACd,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,UAAU;YAAE,OAAO,EAAE,CAAC;QAE1B,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;gBAEvB,gDAAgD;gBAChD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,oDAAoD;gBACpD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAClD,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAExB,qCAAqC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBAEpB,uEAAuE;gBACvE,mEAAmE;gBAEnE,oDAAoD;gBACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBAED,mEAAmE;gBACnE,sEAAsE;gBACtE,2DAA2D;gBAC3D,IAAI,CAAC,mBAAmB,CAAC,MAAuB,CAAC,EAAE,CAAC;oBAClD,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,mBAAmB;iBAC/B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
package/src/rules/require-secure-deletion/index.d.ts CHANGED
@@ -4,6 +4,11 @@
4
4
  * MIT license that can be found in the LICENSE file.
5
5
  */
6
6
  export interface Options {
7
+ /**
8
+ * Extra property-name fragments (case-insensitive substrings) to treat as
9
+ * sensitive, on top of the built-in list. Default: []
10
+ */
11
+ additionalSensitiveProperties?: string[];
7
12
  }
8
13
  type RuleOptions = [Options?];
9
14
  export declare const requireSecureDeletion: import("@typescript-eslint/utils/ts-eslint").RuleModule<"violationDetected", RuleOptions, unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
package/src/rules/require-secure-deletion/index.js CHANGED
@@ -12,6 +12,26 @@ exports.requireSecureDeletion = void 0;
12
12
  * @see https://cwe.mitre.org/data/definitions/459.html
13
13
  */
14
14
  const eslint_devkit_1 = require("@interlace/eslint-devkit");
15
+ /**
16
+ * Property-name fragments that mark a value as a secret whose lifetime matters.
17
+ *
18
+ * `delete` unbinds a property; it does not scrub the string, and every other
19
+ * reference (a spread copy, a log line, an already-serialised response body)
20
+ * keeps the value alive. That is the CWE-459 "incomplete cleanup" this rule is
21
+ * about — and it only means anything when the property actually held a secret.
22
+ *
23
+ * Matching is on the property NAME, deliberately: the value at a `delete` site
24
+ * is not available to a syntactic rule, so the name is the only signal there
25
+ * is. The cost of that is bounded by keeping this list narrow.
26
+ */
27
+ const SENSITIVE_PROPERTY_FRAGMENTS = [
28
+ 'password', 'passwd', 'pwd', 'passphrase',
29
+ 'secret', 'apikey', 'api_key',
30
+ 'token', 'jwt', 'bearer',
31
+ 'credential', 'privatekey', 'private_key', 'signingkey', 'signing_key',
32
+ 'sessionid', 'session_id', 'refreshtoken', 'refresh_token',
33
+ 'ssn', 'creditcard', 'credit_card', 'cardnumber', 'card_number', 'cvv',
34
+ ];
15
35
  exports.requireSecureDeletion = (0, eslint_devkit_1.createRule)({
16
36
  name: 'require-secure-deletion',
17
37
  meta: {
@@ -25,23 +45,65 @@ exports.requireSecureDeletion = (0, eslint_devkit_1.createRule)({
25
45
  messages: {
26
46
  violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
27
47
  icon: eslint_devkit_1.MessageIcons.SECURITY,
28
- issueName: 'violation Detected',
48
+ issueName: 'Incomplete Secret Cleanup',
29
49
  cwe: 'CWE-459',
30
- description: 'Require secure data deletion patterns detected - delete without secure wipe',
50
+ description: '`delete` on the sensitive property `{{property}}` unbinds it without scrubbing the value',
31
51
  severity: 'MEDIUM',
32
- fix: 'Review and apply secure practices',
52
+ fix: 'Overwrite the value before deleting it (obj.{{property}} = undefined, or zero-fill the Buffer), and make sure no copy of the object was spread, logged, or serialised first',
33
53
  documentationLink: 'https://cwe.mitre.org/data/definitions/459.html',
34
54
  })
35
55
  },
36
- schema: [],
56
+ schema: [
57
+ {
58
+ type: 'object',
59
+ properties: {
60
+ additionalSensitiveProperties: {
61
+ type: 'array',
62
+ items: { type: 'string' },
63
+ default: [],
64
+ description: 'Extra property-name fragments to treat as sensitive',
65
+ },
66
+ },
67
+ additionalProperties: false,
68
+ },
69
+ ],
37
70
  },
38
- defaultOptions: [],
39
- create(context) {
71
+ defaultOptions: [{ additionalSensitiveProperties: [] }],
72
+ create(context, [options = {}]) {
73
+ const { additionalSensitiveProperties = [] } = options;
74
+ const fragments = [
75
+ ...SENSITIVE_PROPERTY_FRAGMENTS,
76
+ ...additionalSensitiveProperties.map((f) => f.toLowerCase()),
77
+ ];
78
+ /** The property name being deleted, or undefined if it isn't statically known. */
79
+ function deletedPropertyName(node) {
80
+ // `delete obj?.password` wraps the member expression in a ChainExpression.
81
+ const argument = node.type === 'ChainExpression' ? node.expression : node;
82
+ if (argument.type !== 'MemberExpression')
83
+ return undefined;
84
+ const property = argument.property;
85
+ if (!argument.computed && property.type === 'Identifier')
86
+ return property.name;
87
+ if (argument.computed && property.type === 'Literal' && typeof property.value === 'string') {
88
+ return property.value;
89
+ }
90
+ return undefined;
91
+ }
40
92
  return {
41
93
  UnaryExpression(node) {
42
- if (node.operator === 'delete') {
43
- context.report({ node, messageId: 'violationDetected' });
44
- }
94
+ if (node.operator !== 'delete')
95
+ return;
96
+ // Only a `delete` of a *named, statically known, sensitive* property is
97
+ // reportable. Firing on every `delete obj.prop` produced 120 findings
98
+ // on a 1,470-file corpus with no security content whatsoever — the rule
99
+ // was a `delete` detector, not a secret-cleanup detector.
100
+ const property = deletedPropertyName(node.argument);
101
+ if (!property)
102
+ return;
103
+ const normalized = property.toLowerCase().replace(/[^a-z0-9_]/g, '');
104
+ if (!fragments.some((fragment) => normalized.includes(fragment)))
105
+ return;
106
+ context.report({ node, messageId: 'violationDetected', data: { property } });
45
107
  },
46
108
  };
47
109
  },
package/src/rules/require-secure-deletion/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/require-secure-deletion/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;GAIG;AAEH,4DAAsF;AAUzE,QAAA,qBAAqB,GAAG,IAAA,0BAAU,EAA0B;IACvE,IAAI,EAAE,yBAAyB;IAC/B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,4HAA4H;YACjI,WAAW,EAAE,uCAAuC;YACpD,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,CAAC;SACR;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,6EAA6E;gBAC1F,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,mCAAmC;gBACxC,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,OAAO;YAEL,eAAe,CAAC,IAA8B;gBAC5C,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC/B,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/require-secure-deletion/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;GAIG;AAEH,4DAAsF;AAetF;;;;;;;;;;;GAWG;AACH,MAAM,4BAA4B,GAAG;IACnC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY;IACzC,QAAQ,EAAE,QAAQ,EAAE,SAAS;IAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ;IACxB,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa;IACtE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe;IAC1D,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK;CACvE,CAAC;AAEW,QAAA,qBAAqB,GAAG,IAAA,0BAAU,EAA0B;IACvE,IAAI,EAAE,yBAAyB;IAC/B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,4HAA4H;YACjI,WAAW,EAAE,uCAAuC;YACpD,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,CAAC;SACR;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,0FAA0F;gBACvG,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,6KAA6K;gBAClL,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,6BAA6B,EAAE;wBAC7B,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,qDAAqD;qBACnE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,6BAA6B,EAAE,EAAE,EAAE,CAAC;IACvD,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC;QAC5B,MAAM,EAAE,6BAA6B,GAAG,EAAE,EAAE,GAAG,OAAkB,CAAC;QAClE,MAAM,SAAS,GAAG;YAChB,GAAG,4BAA4B;YAC/B,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC7D,CAAC;QAEF,kFAAkF;QAClF,SAAS,mBAAmB,CAAC,IAAmB;YAC9C,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,IAAI,QAAQ,CAAC,IAAI,KAAK,kBAAkB;gBAAE,OAAO,SAAS,CAAC;YAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;YAC/E,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC3F,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,eAAe,CAAC,IAA8B;gBAC5C,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO;gBAEvC,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,0DAA0D;gBAC1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACpD,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBAEtB,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAAE,OAAO;gBAEzE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}